I recently got an Emprex NSD-100 from eBuyer, as they were dirt cheap. The purpose of this device is to sit on your network and have a hard disk attached, and sit there just doing BitTorrent downloads all the time, even when your computer is off. Needless to say this is no use to me at all, but it’s a low-power, small box with an ARM processor, 64MB of RAM, USB and Ethernet that other people have hacked to use their own Linux systems on.
Cracking it open
The best way to get Linux on this thing is to get to its bootloader. This is the piece of software that first runs on the device, a bit like the BIOS on your home PC. Its job is to set up the hardware ready for things like a kernel to run, and in our case it can also download a kernel from a TFTP server and run it instead of the built-in version.
To communicate with the bootloader, we need a serial port. Once you open the NSD-100 there is an obvious single unpopulated header, which serves as the serial port. All you need to do is solder on a ribbon cable on the underside of the board, and you get a 3.3V TTL level serial port. By soldering a ribbon cable on the underside of the board, there is no need to remove the EMI shield on the top side of the board.
If you’re careful you can close the box back up without modification and keep it reasonably tidy. Of course since the pinout follows no standard you need to build an adapter for whatever serial cable you use. If you’re using an FTDI serial cable (or equivalent) make sure you use a 3.3V variant!
The adapter from NSD-100 to FTDI cable should have the following pinout:
My adapter, shown on the right, needs making a bit more permanent by soldering the wires down on the solder side rather than the very poor attempt at wire-wrapping I managed, but it works most of the time.
Talking to the bootloader
The NSD-100 uses 38400 8N1 on its serial port. By default all you can see when you plug it in is the kernel boot messages, and you get dropped into a root BusyBox shell. Sadly there isn’t very much you can do with the stock firmware and its ancient 2.4 kernel, but it’s nice to have this level of access without any firmware hacks at all.
If you hold down the reset button (small hole next to the power connector) while you apply power to the device, you get taken to the bootloader prompt. The bootloader is a modified version of ARMboot with a couple of bugs, but they’re easy enough to work around.
One bug is the
bootp command has endianness issues, so is virtually unusable unless you perform some nasty hacks in your DHCP/BootP server. You can get around this by assigning a static IP in the environment settings and using the
tftpboot command instead.
To change your IP address:
TR9100>printenv baudrate=38400 ethaddr=00:aa:bb:cc:dd:10 bootcmd=go 0x10020000 ipaddr=192.168.xx.xx serverip=192.168.xx.xx netmask=255.255.xx.xx bootdelay=0 Environment size: 141/4092 bytes STR9100>setenv ipaddr Â«IP addressÂ» STR9100>setenv netmask Â«netmaskÂ» STR9100>setenv serverip Â«TFTP server IPÂ» STR9100>saveenv Un-Protected 1 sectors Erasing sector 1 ... Flash sector 1 is erased successfully. ok. Saving Environment to Flash... Erasing sector 1 ... Flash sector 1 is erased successfully. ok. 0x10020000 done! Protected 1 sectors STR9100>
You probably also want to set
bootdelay to something like 5 or 10, so you don’t have to keep pushing the reset button to get into the bootloader. With this set the bootloader waits a few seconds before loading the default kernel and will interrupt the boot process if it receives anything over the serial connection during that time. Remember to run
saveenv after any environment variable change you want to keep.
Booting a custom kernel
So now we can talk to the bootloader, the next thing to do is boot our own custom kernel. The easiest and safest way to do this is to download and boot it over the nextwork using TFTP. First, download the pre-built kernel image from tinyhack.com and place it somewhere so that it can be downloaded over TFTP. Installing a TFTP server is left as an exercise for the reader, but I recommend using atftpd on Linux. Next, fire up the bootloader and run the following:
STR9100>tftpboot 0x1000000 zImage-2.6.29 Check MAC/PHY 0 Link Status : UP! Check MAC/PHY 1 Link Status : DOWN! ARP broadcast 1 ARP broadcast 2 eth addr: XX:XX:XX:XX:XX:XX TFTP from server 81.187.xx.xx ; our IP address is 81.187.xx.xx Filename 'zImage-2.6.29'. Load address: 0x1000000 Loading: ######## [snip] ######## done Bytes transferred = 5015120 (4c8650 hex) STR9100>go 0x1000000 Uncompressing Linux........ [snip] ........ done, booting the kernel. Linux version 2.6.29joe (yohanes@koala) (gcc version 3.4.4) #32 PREEMPT Sun Mar 29 11:15:39 ICT 2009 CPU: FA526id(wb)  revision 1 (ARMv4), cr=0000397f CPU: VIVT data cache, VIVT instruction cache Machine: STAR_9104NAS [snip] BusyBox v1.10.4 (2008-07-20 00:43:02 ICT) built-in shell (ash) Enter 'help' for a list of built-in commands. /bin/sh: can't access tty; job control turned off / #
Congratulations! You’re now running a custom firmware on the NSD-100. It’s not a huge amount of use at the moment, but it’s a start.
Compile your own kernel for NSD-100. I’ll show you how to build your GCC toolchain using crosstool-NG and use Tinyhack.com’s patches to build a working custom kernel for NSD-100.
Install Debian Lenny on your NSD-100. This is a proper install, not chrooted like the guide on http://emprex-nas.blogspot.com/ and uses a more recent version of Debian. We sadly can’t use the current stable, Squeeze, due to that having moved entirely to
armel (ARM EABI) which is currently unsupported on the FA526 CPU used in the NSD-100.
I am also currently working on porting Tinyhack.com’s kernel patches to more recent kernels, though this is a work in progress and nothing is working yet! 🙂