Dataon DNS-1640D for Homelab

Dataon DNS-1640D for Homelab
Front of the disk shelf.
This is a living page, I'll update as more information becomes available.

So I decided that I wanted more 2.5" drive bays for my home NAS, unfortunately modules that can fit into 5.25" drive bays are becoming horiffically expensive (for no good reason).

I was trawling eBay for SAS disk shelves, and I found a Dataon shelf, complete with 24x 900Gb 10k disks for a very low price. I couldn't find any solid information if the device could accept SATA disks, information was limited - I took a punt.

All this was done on FreeBSD 13, to a LSI SAS2008 -> HP SAS Expander Card -> Dataon DNS-1640D.

The chassis is managable via a SES SAS endpoint, disk to slot, fault and locator lights.


They work - without an interposer, however they are only available via the primary SAS expander (the left one as you look at its rear). If you need fake multipath support to expose them via the secondary SAS expander (right rear), you're gonna need interposers - they don't appear to be cheap, or recommended by anyone.

FWIW I tried a "Samsung SSD 850", it just worked.

It's loud

It comes with redundant PSUs, if one of the PSUs is unpowered fans in the powered PSU will go on maximum. If both PSUs are powered, they'll go half speed or similar.

But - it's loud, the frequency spread isn't offensive, but you don't want it in the corner of your office.

I'm hoping via the "Debug Ports" there might be a way to control them, alternatively it wouldn't be the first device I've retrofitted Noctua fans to.

Each PSU contains two fans, they are of a blower design - I'm guessing they are relying on some fluid dynamics effect to draw air in over the SAS expanders.

Debug Ports

Backend of the disk shelf, showing both PSUs and SAS expanders/controllers.

On the SAS expander/controller there are two, a small round port and an RJ45 - the latter is dead, no ethernet link.

Internal PCB of SAS expander/controller.

The former is a 3.5mm jack TRS jack, the sleve appears is ground, the ring and tip are currently unknown.

They connect to a ST232C, which is an RS232 driver - so with an appropriate lead we might get something out of it. Next to the ST chip is a IDT QS3VH126, which is a high bandwidth switch.

Close up of external service ports.

Interestingly there is a 0.1" header on the board marked "EXP TO EXT UART", this enables the output of a line to the ST232C.

I've shorted this and now need to go and get an RS 232 adapter from storage.

With the shorted pin (EXP TO EXT UART)

At 115200-N-1, the tip appears to be TX, and the sleeve appears to be RX. Oh ho ho.

On boot:

Firmware internal build: B028
Flash active image build: 0460
Flash inactive image build: 0460

It doesn't perform echo for your commands, but a help:

help       Alias of menu
prompt     Prompt on/off
reset      Reset Device :
rd_32      32-bit Read  : rd_32 <address> <# of 32 bit words>
wr_32      32-bit Write : wr_32 <address> <data> [<address> <data>, ...]
rd_16      16-bit Read  : rd_16 <address> <# of 16 bit words>
wr_16      16-bit Write : wr_16 <address> <data> [<address> <data>, ...]
rd_8        8-bit Read  : rd_8  <address> <# of 8 bit words>
wr_8        8-bit Write : wr_8  <address> <data> [<address> <data>, ...]
rd_seeprom  8-bit Read  : rd_seeprom <port_id> <device address> <offset> <offset width> <# of 8 bit words>
wr_seeprom  8-bit Write : wr_seeprom <port_id> <device address> <offset> <offset width> <data> [<data>, ...]
dwld       Download     : dwld -fl|-se <offset> <hexdata0>...
dbs        Database Read: dbs  <page>
ipconfig  Show/Config IP: ipconfig [[help]|[dhcp 0|1 [ip ip_addr] [nm netmask] [gw gateway]]]
qinfo             Query flash partition informations,internal debug use only
hash_tbl_map_get  Retrieves the indices of non-zero hash table entries
rd_ecbi           ECBI read: rd_ecbi <address> [<address>, ...]
wr_ecbi           ECBI write: wr_ecbi <address> <data> [<address> <data>, ...]
ind_sel           Indirect select: ind_sel <table> <data>
ind_ecbi_rd       Indirect ECBI read: ind_ecbi_rd <address> [<address>, ...]
rd_see            Read SEEPROM : rd_see <offset> <num bytes>
smp               SMP command : smp <data> [<data>, ...]
DFE_asyncEye      DFE Eye Capture: DFE_asyncEye <phy_number> <ncount> <phases>
dp                Get drive presence states
phycfg8           print config data for PHY 16 byte 8 preem & swing
sep_chgmaster      sep_chgmaster : change SEP master
verbose_ema        EMA Thread Trace ON or OFF -- re-execute to toggle 

A qinfo gives us information about the flash memory:

  #id name : v (crc     .img_len .ver ) [offset    .begin     -end       .w.part_len  ] (misc)
  #00 BOOT : v (0c595df1.0001fc00.    ) [0x00000000.0xbfc00000-0xbfc1ffff.w.0x00010000]  
  #01 DAT0 : v (d054d676.00001ff8.P036) [0x00020000.0xbfc20000-0xbfc2ffff.r.0x00008000]  
  #02 DAT1 : - (00000000.ffffffff.    ) [0x00030000.0xbfc30000-0xbfc3ffff.w.0x00008000]  
  #03 BCFG : v (4ebfdb36.00000002.    ) [0x00040000.0xbfc40000-0xbfc4ffff.w.0x00008000] (AIF=IMG0)
  #04 OTHER: - (00000000.ffffffff.    ) [0x00050000.0xbfc50000-0xbfc7ffff.w.0x00018000]  
  #05 IMG0 : v (cce8bef9.000b9352.0460) [0x00080000.0xbfc80000-0xbfe3ffff.r.0x000e0000] (Running)
  #06 IMG1 : v (fdcecaae.000b9352.0460) [0x00240000.0xbfe40000-0xbfffffff.w.0x000e0000]  

ipconfig was initially exciting, but there doesn't appear to be a way to turn on the NIC:

Local IP       :
Net Mask       :
Default Gateway:
MAC Address    : 00-e0-04-fe-dc-ba

Nothing to manage fans, or really do anything but very low level debug.

Google search for the obscure commands brings us: which is interesting. Also this:

Without the shorted pin

There's something there... but I haven't figure out a working combination. 19200-N-1 the bytes seem out of sync, occasionally you'll get what you sent echo'd back, but usually it's corrupt.

When the card starts it outputs something, but then nothing. It feels like a command prompt.

It appears that the microprocessor on the controller has sight or maybe control of the same line that I've jumpered to get serial out. The jump just shorts the line to ground, i.e. pulling it low.

The MCU may also be able to operationally pull this line down, to expose the EXP to the service port at the back.

Next step is to attach a scope to the serial port to validate if there is actually anything meaningful being sent.