Analysis of the ARM9 boot process
The Update Process
This is based on FW 1.41.
Basic steps are:
- In Linuxrc: If the boot partition contains any any of uImage.buffalo.updated, u-boot.buffalo.updated, initrd.buffalo.updated or hddrootfs.buffalo.updated, a marker /tmp/need_firmup is set and boot continues from ram-disk (this is initrd).
- See functions HasUpdatedFile and HddRoot in /linuxrc
- init will now read /etc/inittab and run /etc/init.d/rcS, which (after some basic setup) runs
- Since the marker /tmp/need_firmup is set, this will mount the raid (if any), even if faulty (function hotadd_faulty_SysMd in /usr//lib/libmd.sh)
- Updates the system (see below) and reboots.
NB: The maker /tmp/need_firmup never get deleted. It vanishes on reboot since /tmp/ is a ram disk.
Update steps processed by /etc/init.d/fwupdate.sh, triggered by the existence of the named file:
- NAND-update (not analyzed yet)
- uImage.buffalo.updated (kernel): will be moved to uImage.buffalo
- uImage.map: find the name of the kernel file in uImage.map (based on product id) and rename this file to uImage.buffalo. Other kernel images named in the map will be deleted, map will be deleted.
- initrd.buffalo.updated: will be moved to initrd.buffalo
- u-boot.buffalo.updated (bootloader): will be copied into /dev/mtdblock0
- u-boot.map: find the name of the bootloader file in u-boot.map (based on product id) and copy it into /dev/mtdblock0. Other bootloader images named in the map will be deleted, map will be deleted.
- save config (/usr/local/lib/libbuffalo.sh:save_config)
- clear and format root filesystem (/usr/local/lib/libbuffalo.sh:format_SystemArea)
- extract tar archive hddrootfs.buffalo.updated into root filesystem
- N.B. This tries hddrootfs.buffalo.updated both as gzip-compresses file and as uncompressed file
- rename hddrootfs.buffalo.updated to hddrootfs.buffalo.updated.done
- update_feature() (not analyzed yet)
Conclusion: If the original initrd is active, the system can be updated by copying the *.updated file to /boot and reboot.