DSM-G600, DNS-3xx and NSA-220 Hack Forum

beattie wrote:

I'd like to collect up any changes that others have done or would like where they fit in with the scheme of things.

Some of new stuff I did add is committed in svn (particularly http://dsmg600.googlecode.com/svn/trunk/Fwimage.mk )
It probably look like shit, but that was in my mind - to add automatic download sources and patching instead of using d-link tarballs. Plus removing all bin and tar files out of build script.
http://dsmg600.googlecode.com/svn/trunk/

Here's kernel patchset:
http://dns323.kood.org/forum/p1069-2007 … html#p1069

Plus I had this crazy thought while rewriting asp pages. What about just dropping a whole webs and replace it with busybox httpd+cgi+auth and plain cgi based text editor which we can use to modify config files. Of course this needs first some documentation in wiki and also some help pages, examples and maybe presets, which clearly will be available in firmware, along with text editor.
So far I can see some downsides doing that:
*Most cases we need to do_restart after making changes
*Download scheduling will not work any more
*Automatic disk format and on-click disk-checks/tools will be gone
*While configuring wireless settings, we cant see any access point info (site survey)
*Newbie users my get stuck configuring the device
*and some more
And by doing that we will profit by:
*Gaining additional free space in flash
*Total control over configuring process
*Maybe one step closer to completely new firmware
*Adding new features (web pages) will be easier because of already present httpd with cgi support.

sala wrote:

beattie wrote:

I'd like to collect up any changes that others have done or would like where they fit in with the scheme of things.

Some of new stuff I did add is committed in svn (particularly http://dsmg600.googlecode.com/svn/trunk/Fwimage.mk )
It probably look like shit, but that was in my mind - to add automatic download sources and patching instead of using d-link tarballs. Plus removing all bin and tar files out of build script.
http://dsmg600.googlecode.com/svn/trunk/

Here's kernel patchset:
http://dns323.kood.org/forum/p1069-2007 … html#p1069

Can you give a quick summary of what these patches do?

sala wrote:

Plus I had this crazy thought while rewriting asp pages. What about just dropping a whole webs and replace it with busybox httpd+cgi+auth and plain cgi based text editor which we can use to modify config files. Of course this needs first some documentation in wiki and also some help pages, examples and maybe presets, which clearly will be available in firmware, along with text editor.

It's a longer term goal of mine to compeletely replace the firmware

sala wrote:

So far I can see some downsides doing that:
*Most cases we need to do_restart after making changes
*Download scheduling will not work any more
*Automatic disk format and on-click disk-checks/tools will be gone
*While configuring wireless settings, we cant see any access point info (site survey)
*Newbie users my get stuck configuring the device
*and some more
And by doing that we will profit by:
*Gaining additional free space in flash

This would require a new u-boot which I won't do unless I can get the JTAG working (it needs some resistors and possibly a transistor of unknow value)

sala wrote:

*Total control over configuring process
*Maybe one step closer to completely new firmware
*Adding new features (web pages) will be easier because of already present httpd with cgi support.

BertrandB wrote:

jens wrote:

The modular firmware design would be such that a basic bootloader firmware will load a customized firmware from the harddisk)

Yes it's why we are looking for a ppc kexec patch (for 2.4.21 kernel).
But the solution may be to make a real small 2.6 kernel with only kexec, ide and usbstorage support to use it as an advance bootloader.

As part of replaceing the firmware I would like go to a 2.6 kernel.  In the mean time one of my goals is to have the firmware continue to retain it's current functionality so people can flash it and not lose existing functionality in the builtin flashed firmware.  For 0.6 or 0.7 I may try to add the kexec system call (of course that process would be sped up if somebody found or developed a ppc/2.4 patch)

Lately I have kind of bugged myself with kernel CONFIG_CMDLINE_BOOL and CONFIG_CMDLINE variables.
I have set them to

CONFIG_CMDLINE_BOOL=y
CONFIG_CMDLINE="root=/dev/sda3 console=ttyS0,9600"

but kernel cmdline gets overwritten with u-boot parameter CONFIG_BOOTARGS "root=/dev/ram console=ttyS0,9600"
Some idea how to force kernel to ignore u-boot environment variables? It could be done in init/do_mounts.c prepare_namespace(void) with sys_mount?

bingt wrote:

It's been interesting following the progress of the custom firmware. Good work!

I am working on adding iSCSI, raid and LVM2 support to the kernel. With these components it would be possible to really use the DSM as a storage unit. Also it would be possible to use 2 DSM's, one as iSCSI target and one as initiator, sharing raided iSCSI disks (endless possibilities!)...

I have managed to patch and build the kernel (from DLINK source) with iSCSI, Device-mapper patches and raid support (as modules). It builds perfectly, resulting in a pImage ppc bootable kernel (Which is actually smaller than the shipping kernel since i changed UDF, NTFS and FAT16 to be built as modules, these are probably not used any way by people, or should'nt be used (write support for NTFS in kernel 2.4....)).

Using the patched kernel source it is also possible to compile libdevmapper, LVM2 userspace tools, iSCSI target modules and iSCSI initator modules, not the latest but versions supporting 2.4...

I've been thinking of using this kernel (and modules) in salas or beattie's fw buildscripts but since I dont have a Serial connector I have not tried it yet, it should work but bricking my DSM is not an option at the moment.

So.. if you are interested I can supply the kernel patches and perhaps sala or beattie could use them in their patchsets....

First a comment, FAT is probably used by most people with USB-Keys.

As to patches, thia is not really the direction I'm intereted in going, but if you build a fw image and send it to me, I'd be willing to test boot it, at least to make sure it boots and can reflash the firmware.

One of the biggest problems with the DSM-G600, is unlike the WRT54G is there is no failsafe modethat allows the reloading of firmware if you get a bad firmware load.

I did tried sys_mount("/dev/sda3", "/root", "ext3", flags, root_mount_data); to 339 line in do_mounts.c but this will end up with error (it shows still ram because printk takes it from a variable root_device_name).

Hit any key to stop autoboot:  0
## Booting image at fff10000 ...
   Image Name:   Linux-2.4.21-pre4
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    922356 Bytes = 900.7 kB
   Load Address: 00000000
   Entry Point:  00000000
 Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
## Loading RAMDisk Image at ffc20000 ...
   Image Name:   default
   Image Type:   PowerPC Linux RAMDisk Image (gzip compressed)
   Data Size:    2886935 Bytes =  2.8 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
   Loading Ramdisk to 01c6e000, end 01f2ed17 ... OK
Total memory 33554432 MB.
Memory BAT mapping: BAT2=32Mb, BAT3=0Mb, residual: 0Mb
Total memory is 33554432.
CPU = 82xx
Linux version 2.4.21-pre4 (root@serv) (gcc version 2.95.4 20010319 (prerelease)7
OpenPIC_Addr in mpc10x_bridge_init function is fc040000
Motorola SPS Sandpoint Test Platform
Port by MontaVista Software, Inc. (source@mvista.com)
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram console=ttyS0,9600
OpenPIC Version 1.2 (1 CPUs and 123 IRQ sources) at fc040000
Calibrating delay loop... 133.12 BogoMIPS
Memory: 27324k available (1576k kernel code, 600k data, 60k init, 0k highmem)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
POSIX conformance testing by UNIFIX
PCI: Probing PCI hardware
PCI fixup irq: (PCI device 1814:0201) got 0
PCI fixup irq: (PCI device 1033:0035) got 1
PCI fixup irq: (PCI device 1033:0035) got -1
PCI fixup irq: (PCI device 1033:00e0) got 2
PCI fixup irq: (PCI device 13f0:1023) got 3
PCI fixup irq: (PCI device 1191:0009) got 4
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Journalled Block Device driver loaded
NTFS driver v1.1.22 [Flags: R/W]
udf: registering filesystem
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SERIAL_PCI enabled
ttyS00 at 0xfc004500 (IOMEM)(irq = 121) is a ST16650
ttyS01 at 0xfc004600 (IOMEM)(irq = 122) is a ST16650
RAMDISK driver initialized: 16 RAM disks of 6144K size 1024 blocksize
loop: loaded (max 8 devices)
ipg : v0.36 10/31/01  Written by Craig Rich, www.sundanceti.com
IC PLUS IP1000 1000/100/10 based NIC found.
Ethernet device registered as: eth0
IPG module loaded.
SCSI subsystem driver Revision: 1.00
atp86x_detect:
   ACARD ATP-865 PCI ATA133 2-Channels Host Adapter: 0    IO:FEBFFEF8, IRQ:4.
         ID:  0  SAMSUNG SP0802N                  UDMA5 (100)
scsi0 : ACARD ATP86X PCI ATA133 Adapter Driver Ver: 0.78  Date: 2004/01/15

  Vendor: SAMSUNG   Model: SP0802N           Rev:
  Type:   Direct-Access                      ANSI SCSI revision: 02
Attached scsi disk sda at scsi0, channel 0, id 0, lun 0
SCSI device sda: 156368015 512-byte hdwr sectors (40030 MB)
Partition check:
 sda1 sda2 sda3
USI AMD/FUJITSU flash: probing 8-bit flash bus
 Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Creating 5 MTD partitions on "USI Intel flash":
0x00000000-0x00010000 : "Linux mtd1"
0x00010000-0x00020000 : "Linux mtd2"
0x00020000-0x00300000 : "Linux Ramdisk"
0x00300000-0x00310000 : "U-BOOT BOOT LOADER"
0x00310000-0x00400000 : "Linux Kernel"
usb.c: registered new driver hub
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 2048)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 2819k freed
VFS: Cannot open root device "ram" or 01:00
Please append a correct "root=" boot option
Kernel panic: VFS: Unable to mount root fs on 01:00
 <0>Rebooting in 180 seconds..

BertrandB wrote:

I don't know well but try ext2 (on my linux box when i boot on my ext3 disk it is mounted first as ext2 because ext3 is a module)
You're trying to boot on the third partition may be too far from the begin of the disk (it's a problem with old bios PC) so try too with sda2

Thats not it, there are a few additional places that need also patching. First I try to make this work on a regular PC but it may take some time because I don't know much of C.
Now I am thinking that maybe arch/ppc/kernel/setup.c would be more appropriate place for this root device hack because bootargs will be parsed there (cmd_line holds all boot parameters).

Gentoo is running quite well If there is someone wanting to go this down, then I might start writing some Wiki pages. Remember that you need a serial port!

I got 100mbit network with WRT54GS router.
Using vsftpd on DSM-G600 side and command line ftp client on client side.

150 Ok to send data.
226 File receive OK.
ftp: 183185408 bytes sent in 31,45Seconds 5824,10Kbytes/sec.

226 File send OK.
ftp: 183185408 bytes received in 19,30Seconds 9492,95Kbytes/sec.

Number look pretty nice, I think in gig mode, downloading files will be even faster.

dsmg600 / # hdparm -tT /dev/sda

/dev/sda:
 Timing cached reads:   220 MB in  2.01 seconds = 109.45 MB/sec
 Timing buffered disk reads:   80 MB in  3.04 seconds =  26.32 MB/sec

I believe that using reiserfs in here we can gain some extra boost

Next I have nbenc numbers. Now you can compare DSM-G600 with Linkstations (remember to compare only AMD K6 233Mhz line).

dsmg600 / # nbench

BYTEmark* Native Mode Benchmark ver. 2 (10/95)
Index-split by Andrew D. Balsa (11/97)
Linux/Unix* port by Uwe F. Mayer (12/96,11/97)

TEST                : Iterations/sec.  : Old Index   : New Index
                    :                  : Pentium 90* : AMD K6/233*
--------------------:------------------:-------------:------------
NUMERIC SORT        :           82.72  :       2.12  :       0.70
STRING SORT         :          5.8389  :       2.61  :       0.40
BITFIELD            :      3.1719e+07  :       5.44  :       1.14
FP EMULATION        :          9.4899  :       4.55  :       1.05
FOURIER             :          1012.1  :       1.15  :       0.65
ASSIGNMENT          :         0.70126  :       2.67  :       0.69
IDEA                :          247.62  :       3.79  :       1.12
HUFFMAN             :          157.73  :       4.37  :       1.40
NEURAL NET          :          1.5198  :       2.44  :       1.03
LU DECOMPOSITION    :          26.406  :       1.37  :       0.99
==========================ORIGINAL BYTEMARK RESULTS==========================
INTEGER INDEX       : 3.470
FLOATING-POINT INDEX: 1.567
Baseline (MSDOS*)   : Pentium* 90, 256 KB L2-cache, Watcom* compiler 10.0
==============================LINUX DATA BELOW===============================
CPU                 :
L2 Cache            :
OS                  : Linux 2.4.21-pre4
C compiler          : 3.4.1
libc                :
MEMORY INDEX        : 0.682
INTEGER INDEX       : 1.036
FLOATING-POINT INDEX: 0.869
Baseline (LINUX)    : AMD K6/233*, 512 KB L2-cache, gcc 2.7.2.3, libc-5.4.38
* Trademarks are property of their respective holder.

qn1234 wrote:

Could you provide the complete source (with this patch)

First install gentoo chroot into sda3 root
http://dns323.kood.org/dsmg600/howto:chroot_gentoo
Get Kernel source:
ftp://ftp.dlink.com/GPL/DSMG-600_reB/ppclinux.tar.gz
Apply patch:

--- arch/ppc/kernel/setup.c.orig        2005-04-11 05:50:07.000000000 +0300
+++ arch/ppc/kernel/setup.c     2007-02-17 16:06:16.000000000 +0200
@@ -607,8 +611,8 @@
        init_mm.brk = (unsigned long) klimit;

        /* Save unparsed command line copy for /proc/cmdline */
-       strcpy(saved_command_line, cmd_line);
-       *cmdline_p = cmd_line;
+       strcpy(saved_command_line, CONFIG_CMDLINE);
+       *cmdline_p = CONFIG_CMDLINE;

        /* set up the bootmem stuff with available memory */
        do_init_bootmem();

Additional kernel .config entries you might want to add/change:

CONFIG_CMDLINE_BOOL=y
CONFIG_CMDLINE="root=/dev/sda3 console=ttyS0,9600"
CONFIG_DEVFS_FS=y
CONFIG_UNIX=y
CONFIG_FILTER=y
CONFIG_UNIX98_PTYS=y
CONFIG_DEVPTS_FS=y
# CONFIG_NTFS_FS is not set
# CONFIG_NTFS_RW is not set
# CONFIG_TULIP is not set

If you want to also enable reiserfs then you need to disable NFS for example to get more space. Remember that maximum u-boot formated kernel size is 936KB!
Guide for compiling kernel:
http://dns323.kood.org/dsmg600/howto:kernel_build
Guide for uploading new kernel:
http://dns323.kood.org/dsmg600/howto:kernel_upload

Last edited by sala (2007-02-19 09:45:18)

sala wrote:

Ramdisk tips:
But there might be some other way to make kernel ignore the ramdisk and let Linux to overwrite it.
Maybe in drivers/mtd/maps/usi-flash.c ? Or actuality by disabling ramdisk support in kernel with CONFIG_BLK_DEV_RAM CONFIG_BLK_DEV_INITRD ?

u-boot uncompress the ramdisk and loads it into ram.  What you can do is get the kernel to free up the ramdisk.  I don't have the details handy, but a little research should turn up the answers.

I don't know how many of you have followed my lead on loader.o but now I can confirm that it works like a charm.
So now there is no need of custom firmware at all. Just compile your own kernel, setup a user space to sda3 for example and add fun_plug (or run it manually using telnet) line:

sync;insmod /mnt/HD_a2/loader.o kernel=/mnt/HD_a2/vmlinux

And you can do it all pretty much with zero risk, no need of serial port and did I mention that you keep your warranty (at least I think so)

If you want to give a try then here is mine binary formated kernel and pre-compiled loader.o
http://dns323.kood.org/downloads/people/sala/vmlinux
http://dns323.kood.org/downloads/people/sala/loader.o
And also note that if you are going to compile your own kernel then you must do:

powerpc-linux-objcopy -O binary vmlinux

This kernel will set a root parameter to sda3, so if you want to get some practical results you must setup for example a working Gentoo chroot to sda3 otherwise you wont see any output except of course if you have a serial port.
Later on I can provide a pre-configured tarball that you can extract to sda3 or maybe a initrd image to you get started.

You also may ask me why I want to use sda3 instead of sda2? The answer is that D-Link firmware still fixes a file permissions and you don't really want that all your system files are chmoded to 777.

Next I'll try to get 2.6.20 kernel working on DSM-G600, with this method It is just a joy to get it work, no need to flash and no need to worry about kernel image size

sala wrote:

I don't know how many of you have followed my lead on loader.o but now I can confirm that it works like a charm.
So now there is no need of custom firmware at all. Just compile your own kernel, setup a user space to sda3 for example and add fun_plug (or run it manually using telnet) line:

Code:

sync;insmod /mnt/HD_a2/loader.o kernel=/mnt/HD_a2/vmlinux

And you can do it all pretty much with zero risk, no need of serial port and did I mention that you keep your warranty (at least I think so)

If you want to give a try then here is mine binary formated kernel and pre-compiled loader.o
http://dns323.kood.org/downloads/people/sala/vmlinux
http://dns323.kood.org/downloads/people/sala/loader.o
And also note that if you are going to compile your own kernel then you must do:

Code:

powerpc-linux-objcopy -O binary vmlinux

This kernel will set a root parameter to sda3, so if you want to get some practical results you must setup for example a working Gentoo chroot to sda3 otherwise you wont see any output except of course if you have a serial port.
Later on I can provide a pre-configured tarball that you can extract to sda3 or maybe a initrd image to you get started.

You also may ask me why I want to use sda3 instead of sda2? The answer is that D-Link firmware still fixes a file permissions and you don't really want that all your system files are chmoded to 777.

Next I'll try to get 2.6.20 kernel working on DSM-G600, with this method It is just a joy to get it work, no need to flash and no need to worry about kernel image size

I tried to get a working gentoo installation but I when I insert the last command (# sync;insmod /mnt/HD_a2/loader.o kernel=/mnt/HD_a2/vmlinux)  it shows this log message
Using /mnt/HD_a2/loader.o
and I can't do nothing more..

I've not a serial port installed! I tried using telnet...

sala wrote:

SystemR89 wrote:

I tried to get a working gentoo installation but I when I insert the last command (# sync;insmod /mnt/HD_a2/loader.o kernel=/mnt/HD_a2/vmlinux)  it shows this log message
Using /mnt/HD_a2/loader.o
and I can't do nothing more..

Which version of firmware you are using and
what do you mean with "I can't do nothing more"? I t means that you can enter new commands or it means that your telnet connection drops and you cant connect your DSM-G600 any more without cycling power?

I'm using your 0.4 release and I'm connected with busybox's telnetd...
Yes, my telnet connection is dropped and after I can't do nothing more... you have some ideas?

I did update gentoo howto page in wiki so it would be less painful to get gentoo booting
http://dns323.kood.org/dsmg600/howto:chroot_gentoo