Talk:The LinkStation firmware flasher

Testing freelink images on LS2, i found out a lot of details on the flashing process. I don't know if this applies to LS1, HG, Kuro, TS as well, so I decided to put my knowledge in this discussion area. Please correct me if I'm wrong, make additions and integrate this stuff in the main article if it's of general use for other platforms.

We have two ways of flashing: EM mode and normal mode.

Flashing the image.dat to hda1 from Windows needs at least the follwing requirements:
This is true only for normal mode on my LS2:

1. idtinfo loaded to create /proc/linkstation root@FL060727:~# lsmod Module                 Size  Used by    Tainted: P idtinfo                12428   0  (unused) if idtinfo is not loaded, do (ignore warnings, this a license problem): root@FL060727:~# insmod idtinfo Using /lib/modules/2.4.20_mipsel_linkstation/idtinfo.o Warning: loading /lib/modules/2.4.20_mipsel_linkstation/idtinfo.o will taint the kernel: no license See http://www.tux.org/lkml/#export-tainted for information about tainted modules Module idtinfo loaded, with warnings

2. apservd must be executeable. If he is not, do a changemod and start it: root@FL060727:~# chmod +x /etc/init.d/apservd root@FL060727:~# ls -la /etc/init.d/apservd -rwxr-xr-x 1 root root 1286 Jul 29 23:20 /etc/init.d/apservd root@FL060727:~# /etc/init.d/apservd start Start services: ls_servd on eth0 ls_servd is triggerd by starting apservd. ls_servd is opening a port on your LS2: root@FL060727:~# netstat -a Active Internet connections (servers and established) ... udp       0      0 *:22936                 *:* ... If you can't see this open port, the flasher won't be able to find your box. All 3 Windows applications which came with your Linkstatation (HD-HLAN FWUpdate.exe, IPSetup.exe and LsBackup.exe) are using this open UDP port to communicate with your Linkstation.

3. Some scripts must be in the right place on your box. As I did not sort out those scripts, which are really essential to the flashing process, I was copying all scripts to hda1: root@FL060727:~# ls -la /www/script/* -r-xr-xr-x 1 root root    4 Dec 21  2004 /www/script/Yes -rwxr-xr-x 1 root root   32 Dec 21  2004 /www/script/dobackup.sh -r-xr-xr-x  1 root root  206 Dec 21  2004 /www/script/index.htm -rwxr-xr-x 1 root root  528 Dec 21  2004 /www/script/melsub_check_ip.sh -rwxr-xr-x  1 root root  759 Dec 21  2004 /www/script/melsub_disk_rebuild.sh -rwxr-xr-x  1 root root 1764 Dec 21  2004 /www/script/melsub_disk_repair.sh -rwxr-xr-x  1 root root 2056 Dec 21  2004 /www/script/melsub_filepath.sh -rwxr-xr-x  1 root root 2285 Dec 21  2004 /www/script/melsub_flash.sh -rwxr-xr-x  1 root root  876 Dec 21  2004 /www/script/melsub_init.sh -rwxr-xr-x  1 root root 7801 Dec 21  2004 /www/script/melsub_mkprintfilter.sh -rwxr-xr-x  1 root root  828 Dec 21  2004 /www/script/melsub_shutdown.sh -rwxr-xr-x  1 root root  572 Dec 21  2004 /www/script/melsub_shutdown2.sh -rwxr-xr-x  1 root root   99 Dec 21  2004 /www/script/melsub_tmpclean.sh -rwxr-xr-x  1 root root 2824 Dec 21  2004 /www/script/ref_lpr_filter_info.sh -rwxr-xr-x  1 root root  932 Dec 21  2004 /www/script/set_delshare_base.sh -rwxr-xr-x  1 root root  766 Dec 21  2004 /www/script/set_hdd_check_detail.sh -rwxr-xr-x  1 root root  763 Dec 21  2004 /www/script/set_hdd_check_normal.sh -rwxr-xr-x  1 root root 1880 Dec 21  2004 /www/script/set_hdd_format.sh -rwxr-xr-x  1 root root  705 Dec 21  2004 /www/script/set_hdd_format_usb.sh -rwxr-xr-x  1 root root 2542 Dec 21  2004 /www/script/set_ip.sh -rwxr-xr-x  1 root root   46 Dec 21  2004 /www/script/set_printer_queue.sh At least melsub_flash.sh, melsub_shutdown2.sh  and melsub_filepath.sh are needed by the flasher

If these requirements are met, I was able to use the flasher and put new images to my box. There's still much to be done, as at the moment the flashing procedure always ends up with an error message: "Attempt to renew firmware has failed". Nevertheless my box was always working.

Analysis of HD-HLAN FWUpdate.exe
Following the flashing process on Windows, the process goes trough 5 different stages (at least when the software really does what it says):
 * Settings are being saved
 * Firmware is being transmitted
 * LinkStation firmware has been renewed
 * Settings are being restored
 * Attempt to renew firmware has failed

If the melsub scripts are missing, the process ends up shortly after saying "Settings are being saved". If these scripts are in place, it ends up after saying "Settings are being restored". So probably there's a file or directory missing on the newcreated hda1 partition, where setting could be restored successfully.

Leaving my ssh connection open while attempting to flash the box, i could see some errormessages during the flashing process: root@FL060727:~# sh: line 1: /www/script/melsub_flash.sh: No such file or directory /www/script/melsub_shutdown2.sh: /www/script/melsub_shutdown2.sh: No such file or directory This was the reason to put the required scripts in right place. root@FL060729:/mnt# cat: /etc/linkstation_release: No such file or directory I checked the content of /etc/linkstation_release inside openlink 0.52b and found: PRODUCTNAME=HD-HLAN(IENOBU) VERSION=2.05 SUBVERSION=HDD 1.2 PRODUCTID=0x00000006 BUILDDATE=2005/04/01 13:35:54 So i put this file inside /etc and flashed again, but ended up with "Attempt to renew firmware has failed".

Wondering about settings restore
This is true only for EM Mode  flashing on my LS2:

By flashing a firmware after connecting an empty disk to the Linkstation I expected to loose all settings which I had before on my old disk. But this not true. I experienced that some settings must be restored from the flash. Flashing openlink 0.52b to an empty disk and opening buffalos webinterface, I could check for some settings restored from flash:
 * Character code
 * Timezone
 * Shared folder information
 * LinkStation name
 * Linkstation description
 * IP adress
 * Default gateway settings
 * Workgroup setting

are restored from flash, while
 * actual time was reset to 2002 01 01

I relized that the restored settings where not those from my last openlink installation, but those which I did some weeks before, having the original 160 GB HD inside. Opening putty I could check for some files in root directory:
 * /etc/resolv.conf
 * /etc/samba/smb.conf
 * /etc/network/interfaces

did not change. I discovered that there's a second directory with config files: /etc/melco bash-2.05a# ls -la total 44 drw-rw-r--   2 root     root         4096 Jan  1 18:02. drwxr-xr-x  23 root     root         4096 Jan  1 18:02 .. -rw-r--r--   1 root     root            0 Dec 20  2004 backup_error_status -rw-r--r--   1 root     root           59 Jul 10  2006 ftpstatus -rw-r--r--   1 root     root           24 Dec 20  2004 groupinfo -rw--w   1 root     root          105 Jul 15  2006 info -rw-r--r--   1 root     root           35 Aug 26  2005 ntp -rw-r--r--   1 root     root            0 Dec 20  2004 ntp_result -rw-r--r--   1 root     root           57 Aug 25  2005 pcast_mp2000 -rw-r--r--   1 root     root            0 Dec 20  2004 pdcuserinfo -rw-r--r--   1 root     root           11 Aug 29  2005 printer -rw-r--r--   1 root     root         1544 Jan  1 18:02 shareinfo -rw-r--r--   1 root     root          135 Jul 15  2006 shareinfo.bak -rw-r--r--   1 root     root            0 Aug 26  2005 timer_backup.cron -rw-r--r--   1 root     root            0 Dec 20  2004 timer_backup_folder -rw-r--r--   1 root     root          133 Jul 10  2006 timer_status -rw-r--r--   1 root     root            0 Dec 20  2004 userinfo Inside these files I could find a backup of the usual config files. Don't know if this a template to fill up the usual Linux config files with restored data again, or if this is only a sort of backup.

Analysis of /etc/scripts/melsub_flash
a hint: /www/cgi-bin/mellib.pl (seems to be equal to /www.cgi-bin2/mellib2.pl) /www/script/melsub_filepath.sh are the files that includes all variables.

/etc/scripts/melsub_flash refers to a variable $fileMELSETTMP   = '/tmp/conf_save.tar';

there are 2 different things that melsub_flash does
 * either it is used for flashing a conf_save.tar.gz additionally (as_flash /dev/fl0 add) to the flash
 * or it is used for clearing it totaly(as_flash /dev/fl0 init)

before flashing, it creates an archive of the most important info tar cp "$fileIFCFG" > "$fileMELSETTMP" 2> /dev/null tar rfp "$fileMELSETTMP" "$dirSAMBA" 2> /dev/null tar rfp "$fileMELSETTMP" "$dirATALK" 2> /dev/null tar rfp "$fileMELSETTMP" "$dirMELCO" 2> /dev/null tar rfp "$fileMELSETTMP" "$filePASSWD" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileGROUP" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileHOSTS" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileHTPASSWD" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileHTPASSWD1" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileHTPASSWD2" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileAPSERVD" 2> /dev/null tar rfp "$fileMELSETTMP" "$filePRINTCAP" 2> /dev/null if [ -f "$fileCRONTAB" ] ; then tar rfp "$fileMELSETTMP" "$fileCRONTAB" 2> /dev/null fi if [ -f "$filePCASTD" ] ; then tar rfp "$fileMELSETTMP" "$filePCASTD" 2> /dev/null fi
 * 1) Archive Make ###

info about tar-options tar rfp -r, --append           append files to the end of an archive -f, --file=ARCHIVE            use archive file or device ARCHIVE -p, --same-permissions      extract permissions information

afterwards it is zipped: gzip "$fileMELSETTMP" 1> /dev/null 2> /dev/null it is written to the end of the flash! as_flash /dev/fl0 add -n "$fileMELSETTMP".gz 1> /dev/null 2> /dev/null then the file gets deleted rm -f "$fileMELSETTMP".gz 1> /dev/null 2> /dev/null
 * 1) Flash Write ###

the counterpart to as_flash on ppc-Linkstations is ls_flash on the LS2 (mips)

these are the options of as_flash root@LINKSTATION:~# as_flash as_flash [device] [add|del|get|init] [options] add -n add file image to end of flash del [-n |-i ] delete Entered file name or block number of block data from flash get [-n |-i ] [--output ] read Entered file name or block number of block data from flash, and store output filename init clear device by zero

it seems that as_flash /dev/fl0 init seems to delete the whole content of the flash. but maybe this is only an area? i mean...maybe it clears only the area where the config-files are stored? i can only verify that when i finally get the JTAG-Equipment and it works.

we need to find all the files that use as_flash. especially all files/scripts that use as_flash /dev/fl0 get. then we know where info is extracted and used from the flash.

/etc/init.d/load_config is the file that uses as_flash to get the tared config-files back. but it is never started...when does this get executed?

AS_FLASH=/usr/bin/as_flash FLASH_DEV=/dev/fl0 FILENAME=/tmp/conf_save.tar.gz $AS_FLASH $FLASH_DEV get -n $FILENAME --output $FILENAME cd / /bin/tar -xzf $FILENAME

in kernel 2.4 (in 2.6 is no /dev/fl*) i tried to extract conf_save_tar.gz with /usr/bin/as_flash /dev/fl0 get -n /tmp/conf_save.tar.gz --output /tmp/conf_save.tar.gz and it worked. cd /tmp ls AppleVolumes conf_save.tar.gz  shareinfo i created an additional folder, changed in that directory and untared the file /tmp# mkdir temp2 /tmp# cd temp2 /tmp/temp2# tar xzvf ../conf_save.tar.gz this is the content of conf_save.tar.gz etc/network/interfaces etc/samba/ etc/samba/smbusers etc/samba/smb.conf etc/samba/lmhosts etc/samba/smbpasswd etc/samba/recycle.conf etc/samba/secrets.tdb etc/samba/smb.conf.bak etc/atalk/ etc/atalk/atalkd.conf etc/atalk/AppleVolumes.default etc/atalk/AppleVolumes.system etc/atalk/afpd.conf etc/atalk/config etc/atalk/papd.conf etc/atalk/config.papd etc/melco/ etc/melco/timer_sleep etc/melco/timer_backup etc/melco/timer_backup.cron etc/melco/timer_status etc/melco/info etc/melco/shareinfo etc/melco/usercount etc/melco/userinfo etc/melco/printer etc/melco/groupinfo etc/melco/ver etc/melco/pcast_mp2000 etc/melco/ftpstatus etc/melco/pdcuserinfo etc/melco/pdcuserinfo.base etc/melco/backup_error_status etc/melco/timer_backup_folder etc/melco/ntp etc/melco/ntp_result etc/passwd etc/group etc/hosts www/.htpasswd www/cgi-bin/.htpasswd www/script/.htpasswd etc/ap_servd.log etc/printcap etc/pcast/pcastd.conf

but when is this /etc/init.d/load_config started? there is no symlink anywhere. maybe somehow over ap_servd? maybe only if it was in EM Mode? maybe only if it was flashed in normal mode?

what about the idea that /etc/init.d/load_config is triggered by ap_servd/firmware_updater in the config-restore step? maybe the reason for the update-error is because /etc/init.d/load_config isn`t there?

Analysis of /www/script/melsub_init.sh
i just also wanted to mention that there is file called /www/scripts/melsub_init.sh. it takes down all services and afterwards overwrites all the config files by cd / tar xvzf /root/.files/initfile.tar.gz -C / > /dev/null 2> /dev/null look into /root/.files....you will see that there is the initfile.tar.gz which has the files that are initially used.... :~/.files# ls -la -rw-r--r--   1 root     root           12 Jul  9  2005 initfile.sum -rw-r--r--   1 root     root        10398 Jul  9  2005 initfile.tar.gz -rw-r--r--    1 root     root        10240 Jul  9  2005 ramdiskimg.tar.gz the ramdiskimg.tar.gz includes all the files that are needed to reconstruct /var/...on the stock firmware & openlink, var is on a ramdisk...it needs to be reconstructed each time. this is the content of initfile.tar.gz etc/ap_servd.log etc/group etc/melco/ etc/melco/timer_sleep etc/melco/timer_backup etc/melco/timer_backup.cron etc/melco/timer_status etc/melco/info etc/melco/shareinfo etc/melco/usercount etc/melco/userinfo etc/melco/printer etc/melco/groupinfo etc/melco/ver etc/melco/pcast_mp2000 etc/melco/ftpstatus etc/melco/pdcuserinfo etc/melco/pdcuserinfo.base etc/melco/backup_error_status etc/melco/timer_backup_folder etc/melco/ntp etc/melco/ntp_result etc/passwd etc/proftpd.conf etc/wu-ftpd/ftpaccess etc/atalk/ etc/atalk/atalkd.conf etc/atalk/AppleVolumes.default etc/atalk/AppleVolumes.system etc/atalk/afpd.conf etc/atalk/config etc/atalk/papd.conf etc/atalk/config.papd etc/hosts etc/network/interfaces etc/printcap etc/samba/smb.conf etc/samba/smbpasswd www/.htpasswd www/cgi-bin/.htpasswd www/script/.htpasswd this is the content of ramdiskimg.tar.gz (only folders) var/ var/cache/ var/cache/samba/ var/lib/ var/lib/misc/ var/lib/locate/ var/lib/logrotate/ var/local/ var/lock/ var/lock/subsys/ var/lock/dev/ var/log/ var/log/samba/ var/opt/ var/spool/ var/spool/samba/ var/spool/cron/ var/spool/cron/crontabs/ var/tmp/ var/run/
 * 1) extrace default files ###