Information/MIPSelFlashROM

This article Based on work by nix, frontalot and noName. Originally by frontalot. at Linkstationwiki.org

First some background. 'mtd' stands for memory technology device. Traditionally Unix (and Linux) just has two device types

1. Block special files
2. Character special files

Major number The major number in a special file entry identifies the device driver. Each driver in a Linux or Unix kernel has a number. The major number just selects the driver, e.g. if a serial port driver or a hard disk driver should be associated with the name in the file system

Minor number The minor number in a special file entry is interpreted individually by a particular device driver. For example a serial driver might use it to compute the I/O address of a UART, or a hard disk driver might use it to address a particular disk on the periphery bus

The interfaces of these special files is and was primarily geared at communicating with devices like hard disks, tapes, or terminals. Flash memory, or other 'memory technology' doesn't match to well to the classic device interfaces. For example, writing to a flash device should usually be more controlled to avoid excessive wear and tear of the memory (flash memory allows just a limited number of re-writes). So a particular mtd interface was created in the kernel to support these devices better. In addition, for backward-compatibility with non-mtd-aware software and tools (most are not mtd-aware) the mtd interface was mapped back to the classic block and character special device interfaces. The LinkStation firmware contains the necessary mtd device driver and matching file entries under /dev.

Flash ROM analysis

(all information based on official firmware 2.05):

Device	Major	Minor	Start	Size	Function
/dev/mtd0	90	0	0xbfc00000	0x040000	Boot loader (custom version of idt/sim)
/dev/mtd1	90	2	0xbfc40000	0x350000	Stores firmimg.bin (encrypted bzip2 compressed (vmlinux with embedded initrd.gz)).
/dev/mtd2	90	4	0xbffc0000	0x040000	Stores configuration files as conf_save.tar.gz (written by ls_flash).
/dev/mtd3	90	6	0xbfc00000	0x400000	The whole flash.
/dev/mtdblock0	31	0			Block special file version of mtd0.
/dev/mtdblock1	31	1			Block special file version of mtd1.
/dev/mtdblock2	31	2			Block special file version of mtd2.
/dev/mtdblock3	31	3			Block special file version of mtd3.

Note: If the flash devices do not already exist, they can easily be created by mknod:

mknod /dev/mtd0 c 90 0
mknod /dev/mtd1 c 90 2
mknod /dev/mtd2 c 90 4
mknod /dev/mtd2 c 90 6
mknod /dev/mtdblock0 b 31 0
mknod /dev/mtdblock1 b 31 1
mknod /dev/mtdblock2 b 31 2
mknod /dev/mtdblock2 b 31 3

/dev/mtd1

The kernel is compiled with embedded gzip-ed ram disk. The resulting ELF image is then compressed using bzip2 and then encrypted. An encrypted header is prepended and the result is firmimg.bin.

/dev/mtd2

Contents of conf_save.tar.gz:

etc/network/interfaces
etc/samba/
etc/samba/smb.conf
etc/samba/lmhosts
etc/samba/smbpasswd
etc/samba/smbusers
etc/samba/recycle.conf
etc/samba/secrets.tdb
etc/samba/smb.conf.bak
etc/atalk/
etc/atalk/atalkd.conf
etc/atalk/AppleVolumes.default
etc/atalk/AppleVolumes.system
etc/atalk/afpd.conf
etc/atalk/config
etc/atalk/config.papd
etc/atalk/papd.conf
etc/melco/
etc/melco/info
etc/melco/shareinfo
etc/melco/userinfo
etc/melco/groupinfo
etc/melco/ntp
etc/melco/ntp_result
etc/melco/timer_backup.cron
etc/melco/timer_status
etc/melco/pcast_mp2000
etc/melco/printer
etc/melco/ftpstatus
etc/melco/pdcuserinfo
etc/melco/backup_error_status
etc/melco/timer_backup_folder
etc/melco/groupinfo.bak
etc/passwd
etc/group
etc/hosts
www/.htpasswd
www/cgi-bin/.htpasswd
www/script/.htpasswd
etc/ls_servd.log
etc/shadow
etc/printcap
etc/pcast/pcastd.conf

You can read and write conf_save.tar.gz to and from /dev/mtdblock2 (using the block device here is slightliy more efficient) by using /usr/bin/ls_flash - However, at least in the 2.05 firmware that file in the flash partition is not used. The init.d script load_config is not referenced in any init.d run-level.

ls_flash [device] [add|del|get|init] [options]
add -n <filename>
 add file image to end of flash
del [-n <filename>|-i <block number>]
 delete Entered file name or block number of block data from flash
get [-n <filename>|-i <block number>] [--output <filename>]
 read Entered file name or block number of block data from flash, and store output filename
init
 clear device by zero

For example:

ls_flash /dev/mtdblock2 get -n /tmp/conf_save.tar.gz --output /tmp/conf_save.tar.gz

There is a "hidden" feature to list the contents of the flash bank:

ls_flash /dev/mtdblock2 list

Some of this information courtesy of http://www.yamasita.jp/linkstation.en/index.html.