Information/HGFlashROM

'' This article Originally by Frontalot. at Linkstationwiki.org '' First some background. 'mtd' stands for memory technology device. Traditionally Unix (and Linux) just has two device types


 * 1) Block special files
 * 2) Character special files

The interfaces of these special files is and was primarily geared at communicating with devices like hard disks, tapes, or terminals. Flash memory, or other 'memory technology' doesn't match to well to the classic device interfaces. For example, writing to a flash device should usually be more controlled to avoid excessive wear and tear of the memory (flash memory allows just a limited number of re-writes). So a particular mtd interface was created in the kernel to support these devices better. In addition, for backward-compatibility with non-mtd-aware software and tools (most are not mtd-aware) the mtd interface was mapped back to the classic block and character special device interfaces. The LinkStation firmware contains the necessary mtd device driver and matching file entries under /dev.

The following information only applies to firmwares 1.41 and newer. Firmwares prior to 1.41 function the same as powerpc-hdhlan firmwares.

Flash ROM analysis
(all information based on official firmware 1.45b):

Note: If the flash devices do not already exist, they can easily be created by mknod: mknod /dev/mtd0 c 90 0 mknod /dev/mtd1 c 90 2 mknod /dev/mtd2 c 90 4 mknod /dev/mtd3 c 90 6 mknod /dev/mtd4 c 90 8 mknod /dev/mtdblock0 b 90 0 mknod /dev/mtdblock1 b 90 2 mknod /dev/mtdblock2 b 90 4 mknod /dev/mtdblock3 b 90 6 mknod /dev/mtdblock4 b 90 8

/dev/mtd0
firmimg.bin contains 3 parts:
 * 1) firminfo.txt - The 108 byte firmware header.
 * 2) vmlinux.gz - The kernel.
 * 3) ramdisk.image.gz - The ramdisk.

firminfo.txt:
The following script analyzes firmimg.bin and provides the preceding information:
 * 1) ! /usr/bin/perl

read(STDIN, $tmp, 108, 0); @tmp = unpack("LLA32A32SSSC6LLLLLL", $tmp);

print "Version                 ". $tmp[0]."\n"; print "Firmware ID             ". $tmp[1]."\n"; print "Firmware Name           ". $tmp[2]."\n"; print "Sub Version             ". $tmp[3]."\n"; print "Major Version           ". $tmp[4]."\n"; print "Minor Version           ". $tmp[5]."\n"; print "Build Number            ". $tmp[6]."\n"; printf "Build Date             %d/%d/%d %d:%d:%d\n", $tmp[7] + 1900, $tmp[8], $tmp[9], $tmp[10], $tmp[11], $tmp[12]; print "firmimg.bin size        ". $tmp[13]."\n"; print "Checksum                ". $tmp[14]."\n"; print "vmlinux.gz offset       ". $tmp[15]."\n"; print "vmlinux.gz size         ". $tmp[16]."\n"; print "ramdisk.image.gz offset ". $tmp[17]."\n"; print "ramdisk.image.gz size   ". $tmp[18]."\n";

The script can read the firmware information directly from the flash ROM: ./showflash.pl < /dev/mtd0

The script also can be used to read the firmware information from firmimg.bin: ./showflash.pl < firmimg.bin

You can extract firmimg.bin from /dev/mtd0 by using head: head -c 2903237 /dev/mtd0 > firmimg.bin

firminfo.txt, vmlinux.gz, and ramdisk.image.gz can be extracted from firmimg.bin: head -c 108 firmimg.bin > firminfo.txt tail -c 2903129 firmimg.bin > temp; head -c 855915 temp > vmlinux.gz; rm temp tail -c 2047214 firmimg.bin > ramdisk.image.gz

vmlinux.gz:
Linux kernel.

ramdisk.image.gz:
You can mount the ramdisk as follows:

mount ramdisk.image /mnt/ramdisk -o loop

Raw listing of 1.45b ramdisk contents.

/dev/mtd1
Contains bootcode.bin (created by "make zImage")

/dev/mtd2
Contains boot status ("OKOK" - normal boot, "NGNG" - EM mode).

Normal boot:
00000000 00 00 41 82 4f 4b 4f 4b 00 00 00 00 00 00 00 00 |..A.OKOK........ | 00000010 62 6f 6f 74 70 61 72 6d 3d 72 6f 6f 74 3d 2f 64 |bootparm=root=/d| 00000020 65 76 2f 68 64 61 31 00 00 00 00 00 00 00 00 00 |ev/hda1......... | 00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000100 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................ | * 00010000

EM mode
00000000 4e 47 4e 47 4e 47 4e 47 00 00 00 00 00 00 00 00 |NGNGNGNG........ | 00000010 62 6f 6f 74 70 61 72 6d 3d 72 6f 6f 74 3d 2f 64 |bootparm=root=/d| 00000020 65 76 2f 72 61 6d 30 00 00 00 00 00 00 00 00 00 |ev/ram0......... | 00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000100 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................ | * 00010000

To read the boot status: od -xc /dev/mtd2

You can change the boot status by using write_ng and write_ok. To change the boot status to normal: write_ok

To change the boot status to EM mode: write_ng

/dev/mtd3
Contents of conf_save.tar.gz: ??? You can read and write conf_save.tar.gz to and from /dev/mtd3 by using /usr/bin/as_flash: as_flash [device] [add|del|get|init] [options] add -n add file image to end of flash del [-n |-i ] delete Entered file name or block number of block data from flash get [-n |-i ] [--output ] read Entered file name or block number of block data from flash, and store output filename init clear device by zero

For example: as_flash /dev/mtd3 get -n /tmp/conf_save.tar.gz --output /tmp/conf_save.tar.gz

There is a "hidden" feature to list the contents of the flash bank: as_flash /dev/mtd3 list

Some of this information courtesy of http://www.yamasita.jp/linkstation.en/index.html.