Talk:The LinkStation firmware flasher

From NAS-Central Buffalo - The Linkstation Wiki

Latest revision as of 22:34, 1 August 2006

Testing freelink images on LS2, i found out a lot of details on the flashing process. I don't know if this applies to LS1, HG, Kuro, TS as well, so I decided to put my knowledge in this discussion area. Please correct me if I'm wrong, make additions and integrate this stuff in the main article if it's of general use for other platforms.

We have two ways of flashing: EM mode and normal mode.

Flashing the image.dat to hda1 from Windows needs at least the follwing requirements:

This is true only for normal mode on my LS2:

1. idtinfo loaded to create /proc/linkstation

root@FL060727:~# lsmod
Module                  Size  Used by    Tainted: P
idtinfo                12428   0  (unused)

if idtinfo is not loaded, do (ignore warnings, this a license problem):

root@FL060727:~# insmod idtinfo
Using /lib/modules/2.4.20_mipsel_linkstation/idtinfo.o
Warning: loading /lib/modules/2.4.20_mipsel_linkstation/idtinfo.o will taint the kernel: no license
See http://www.tux.org/lkml/#export-tainted for information about tainted modules
Module idtinfo loaded, with warnings

2. apservd must be executeable. If he is not, do a changemod and start it:

root@FL060727:~# chmod +x /etc/init.d/apservd
root@FL060727:~# ls -la /etc/init.d/apservd
-rwxr-xr-x  1 root root 1286 Jul 29 23:20 /etc/init.d/apservd
root@FL060727:~# /etc/init.d/apservd start
Start services: ls_servd on eth0

ls_servd is triggerd by starting apservd. ls_servd is opening a port on your LS2:

root@FL060727:~# netstat -a
Active Internet connections (servers and established)
...
udp        0      0 *:22936                 *:*
...

If you can't see this open port, the flasher won't be able to find your box. All 3 Windows applications which came with your Linkstatation (HD-HLAN FWUpdate.exe, IPSetup.exe and LsBackup.exe) are using this open UDP port to communicate with your Linkstation.

3. Some scripts must be in the right place on your box. As I did not sort out those scripts, which are really essential to the flashing process, I was copying all scripts to hda1:

root@FL060727:~# ls -la /www/script/*
-r-xr-xr-x  1 root root    4 Dec 21  2004 /www/script/Yes
-rwxr-xr-x  1 root root   32 Dec 21  2004 /www/script/dobackup.sh
-r-xr-xr-x  1 root root  206 Dec 21  2004 /www/script/index.htm
-rwxr-xr-x  1 root root  528 Dec 21  2004 /www/script/melsub_check_ip.sh
-rwxr-xr-x  1 root root  759 Dec 21  2004 /www/script/melsub_disk_rebuild.sh
-rwxr-xr-x  1 root root 1764 Dec 21  2004 /www/script/melsub_disk_repair.sh
-rwxr-xr-x  1 root root 2056 Dec 21  2004 /www/script/melsub_filepath.sh
-rwxr-xr-x  1 root root 2285 Dec 21  2004 /www/script/melsub_flash.sh
-rwxr-xr-x  1 root root  876 Dec 21  2004 /www/script/melsub_init.sh
-rwxr-xr-x  1 root root 7801 Dec 21  2004 /www/script/melsub_mkprintfilter.sh
-rwxr-xr-x  1 root root  828 Dec 21  2004 /www/script/melsub_shutdown.sh
-rwxr-xr-x  1 root root  572 Dec 21  2004 /www/script/melsub_shutdown2.sh
-rwxr-xr-x  1 root root   99 Dec 21  2004 /www/script/melsub_tmpclean.sh
-rwxr-xr-x  1 root root 2824 Dec 21  2004 /www/script/ref_lpr_filter_info.sh
-rwxr-xr-x  1 root root  932 Dec 21  2004 /www/script/set_delshare_base.sh
-rwxr-xr-x  1 root root  766 Dec 21  2004 /www/script/set_hdd_check_detail.sh
-rwxr-xr-x  1 root root  763 Dec 21  2004 /www/script/set_hdd_check_normal.sh
-rwxr-xr-x  1 root root 1880 Dec 21  2004 /www/script/set_hdd_format.sh
-rwxr-xr-x  1 root root  705 Dec 21  2004 /www/script/set_hdd_format_usb.sh
-rwxr-xr-x  1 root root 2542 Dec 21  2004 /www/script/set_ip.sh
-rwxr-xr-x  1 root root   46 Dec 21  2004 /www/script/set_printer_queue.sh

At least melsub_flash.sh, melsub_shutdown2.sh and melsub_filepath.sh are needed by the flasher

If these requirements are met, I was able to use the flasher and put new images to my box. There's still much to be done, as at the moment the flashing procedure always ends up with an error message: "Attempt to renew firmware has failed". Nevertheless my box was always working.

Analysis of HD-HLAN FWUpdate.exe

Following the flashing process on Windows, the process goes trough 5 different stages (at least when the software really does what it says):

Settings are being saved

Firmware is being transmitted

LinkStation firmware has been renewed

Settings are being restored

Attempt to renew firmware has failed

If the melsub scripts are missing, the process ends up shortly after saying "Settings are being saved". If these scripts are in place, it ends up after saying "Settings are being restored". So probably there's a file or directory missing on the newcreated hda1 partition, where setting could be restored successfully.

Leaving my ssh connection open while attempting to flash the box, i could see some errormessages during the flashing process:

root@FL060727:~# sh: line 1: /www/script/melsub_flash.sh: No such file or directory
/www/script/melsub_shutdown2.sh: /www/script/melsub_shutdown2.sh: No such file or directory

This was the reason to put the required scripts in right place.

root@FL060729:/mnt# cat: /etc/linkstation_release: No such file or directory

I checked the content of /etc/linkstation_release inside openlink 0.52b and found:

PRODUCTNAME=HD-HLAN(IENOBU)
VERSION=2.05
SUBVERSION=HDD 1.2
PRODUCTID=0x00000006
BUILDDATE=2005/04/01 13:35:54

So i put this file inside /etc and flashed again, but ended up with "Attempt to renew firmware has failed".

Wondering about settings restore

This is true only for EM Mode flashing on my LS2:

By flashing a firmware after connecting an empty disk to the Linkstation I expected to loose all settings which I had before on my old disk. But this not true. I experienced that some settings must be restored from the flash. Flashing openlink 0.52b to an empty disk and opening buffalos webinterface, I could check for some settings restored from flash:

Character code

Timezone

Shared folder information

LinkStation name

Linkstation description

IP adress

Default gateway settings

Workgroup setting

are restored from flash, while

actual time was reset to 2002 01 01

I relized that the restored settings where not those from my last openlink installation, but those which I did some weeks before, having the original 160 GB HD inside. Opening putty I could check for some files in root directory:

/etc/resolv.conf

/etc/samba/smb.conf

/etc/network/interfaces

did not change. I discovered that there's a second directory with config files: /etc/melco

bash-2.05a# ls -la
total 44
drw-rw-r--    2 root     root         4096 Jan  1 18:02 .
drwxr-xr-x   23 root     root         4096 Jan  1 18:02 ..
-rw-r--r--    1 root     root            0 Dec 20  2004 backup_error_status
-rw-r--r--    1 root     root           59 Jul 10  2006 ftpstatus
-rw-r--r--    1 root     root           24 Dec 20  2004 groupinfo
-rw--w----    1 root     root          105 Jul 15  2006 info
-rw-r--r--    1 root     root           35 Aug 26  2005 ntp
-rw-r--r--    1 root     root            0 Dec 20  2004 ntp_result
-rw-r--r--    1 root     root           57 Aug 25  2005 pcast_mp2000
-rw-r--r--    1 root     root            0 Dec 20  2004 pdcuserinfo
-rw-r--r--    1 root     root           11 Aug 29  2005 printer
-rw-r--r--    1 root     root         1544 Jan  1 18:02 shareinfo
-rw-r--r--    1 root     root          135 Jul 15  2006 shareinfo.bak
-rw-r--r--    1 root     root            0 Aug 26  2005 timer_backup.cron
-rw-r--r--    1 root     root            0 Dec 20  2004 timer_backup_folder
-rw-r--r--    1 root     root          133 Jul 10  2006 timer_status
-rw-r--r--    1 root     root            0 Dec 20  2004 userinfo

Inside these files I could find a backup of the usual config files. Don't know if this a template to fill up the usual Linux config files with restored data again, or if this is only a sort of backup.

Analysis of /etc/scripts/melsub_flash

a hint:

/www/cgi-bin/mellib.pl (seems to be equal to /www.cgi-bin2/mellib2.pl)
/www/script/melsub_filepath.sh

are the files that includes all variables.

/etc/scripts/melsub_flash refers to a variable

$fileMELSETTMP    = '/tmp/conf_save.tar';

there are 2 different things that melsub_flash does

• either it is used for flashing a conf_save.tar.gz additionally (as_flash /dev/fl0 add) to the flash
• or it is used for clearing it totaly(as_flash /dev/fl0 init)

before flashing, it creates an archive of the most important info

### Archive Make ###
tar cp "$fileIFCFG" > "$fileMELSETTMP" 2> /dev/null
tar rfp "$fileMELSETTMP" "$dirSAMBA" 2> /dev/null
tar rfp "$fileMELSETTMP" "$dirATALK" 2> /dev/null
tar rfp "$fileMELSETTMP" "$dirMELCO" 2> /dev/null
tar rfp "$fileMELSETTMP" "$filePASSWD" 2> /dev/null
tar rfp "$fileMELSETTMP" "$fileGROUP" 2> /dev/null
tar rfp "$fileMELSETTMP" "$fileHOSTS" 2> /dev/null
tar rfp "$fileMELSETTMP" "$fileHTPASSWD" 2> /dev/null
tar rfp "$fileMELSETTMP" "$fileHTPASSWD1" 2> /dev/null
tar rfp "$fileMELSETTMP" "$fileHTPASSWD2" 2> /dev/null
tar rfp "$fileMELSETTMP" "$fileAPSERVD" 2> /dev/null
tar rfp "$fileMELSETTMP" "$filePRINTCAP" 2> /dev/null
if [ -f "$fileCRONTAB" ] ; then
    tar rfp "$fileMELSETTMP" "$fileCRONTAB" 2> /dev/null
fi
if [ -f "$filePCASTD" ] ; then
    tar rfp "$fileMELSETTMP" "$filePCASTD" 2> /dev/null
fi

info about tar-options

 tar rfp  
 -r, --append            append files to the end of an archive
 -f, --file=ARCHIVE             use archive file or device ARCHIVE
 -p, --same-permissions       extract permissions information

afterwards it is zipped:

gzip "$fileMELSETTMP" 1> /dev/null 2> /dev/null 

it is written to the end of the flash!

### Flash Write ###
as_flash /dev/fl0 add -n "$fileMELSETTMP".gz 1> /dev/null 2> /dev/null

then the file gets deleted

rm -f "$fileMELSETTMP".gz 1> /dev/null 2> /dev/null

the counterpart to as_flash on ppc-Linkstations is ls_flash on the LS2 (mips)

these are the options of as_flash

root@LINKSTATION:~# as_flash
as_flash [device] [add|del|get|init] [options]
add -n <filename>
   add file image to end of flash
del [-n <filename>|-i <block number>]
   delete Entered file name or block number of block data from flash
get [-n <filename>|-i <block number>] [--output <filename>]
   read Entered file name or block number of block data from flash,
   and store output filename
init
   clear device by zero

it seems that as_flash /dev/fl0 init seems to delete the whole content of the flash. but maybe this is only an area? i mean...maybe it clears only the area where the config-files are stored? i can only verify that when i finally get the JTAG-Equipment and it works.

we need to find all the files that use as_flash. especially all files/scripts that use as_flash /dev/fl0 get. then we know where info is extracted and used from the flash.

/etc/init.d/load_config is the file that uses as_flash to get the tared config-files back. but it is never started...when does this get executed?

AS_FLASH=/usr/bin/as_flash
FLASH_DEV=/dev/fl0
FILENAME=/tmp/conf_save.tar.gz
$AS_FLASH $FLASH_DEV get -n $FILENAME --output $FILENAME

cd /
/bin/tar -xzf $FILENAME

in kernel 2.4 (in 2.6 is no /dev/fl*) i tried to extract conf_save_tar.gz with

/usr/bin/as_flash /dev/fl0 get -n /tmp/conf_save.tar.gz --output /tmp/conf_save.tar.gz

and it worked.

cd /tmp ls
AppleVolumes  conf_save.tar.gz  shareinfo

i created an additional folder, changed in that directory and untared the file

/tmp# mkdir temp2
/tmp# cd temp2
/tmp/temp2# tar xzvf ../conf_save.tar.gz

this is the content of conf_save.tar.gz

etc/network/interfaces
etc/samba/
etc/samba/smbusers
etc/samba/smb.conf
etc/samba/lmhosts
etc/samba/smbpasswd
etc/samba/recycle.conf
etc/samba/secrets.tdb
etc/samba/smb.conf.bak
etc/atalk/
etc/atalk/atalkd.conf
etc/atalk/AppleVolumes.default
etc/atalk/AppleVolumes.system
etc/atalk/afpd.conf
etc/atalk/config
etc/atalk/papd.conf
etc/atalk/config.papd
etc/melco/
etc/melco/timer_sleep
etc/melco/timer_backup
etc/melco/timer_backup.cron
etc/melco/timer_status
etc/melco/info
etc/melco/shareinfo
etc/melco/usercount
etc/melco/userinfo
etc/melco/printer
etc/melco/groupinfo
etc/melco/ver
etc/melco/pcast_mp2000
etc/melco/ftpstatus
etc/melco/pdcuserinfo
etc/melco/pdcuserinfo.base
etc/melco/backup_error_status
etc/melco/timer_backup_folder
etc/melco/ntp
etc/melco/ntp_result
etc/passwd
etc/group
etc/hosts
www/.htpasswd
www/cgi-bin/.htpasswd
www/script/.htpasswd
etc/ap_servd.log
etc/printcap
etc/pcast/pcastd.conf

but when is this /etc/init.d/load_config started? there is no symlink anywhere. maybe somehow over ap_servd? maybe only if it was in EM Mode? maybe only if it was flashed in normal mode?

what about the idea that /etc/init.d/load_config is triggered by ap_servd/firmware_updater in the config-restore step? maybe the reason for the update-error is because /etc/init.d/load_config isn`t there?

Analysis of /www/script/melsub_init.sh

i just also wanted to mention that there is file called /www/scripts/melsub_init.sh. it takes down all services and afterwards overwrites all the config files by

### extrace default files ###
cd /
tar xvzf /root/.files/initfile.tar.gz -C / > /dev/null 2> /dev/null

look into /root/.files....you will see that there is the initfile.tar.gz which has the files that are initially used....

:~/.files# ls -la
-rw-r--r--    1 root     root           12 Jul  9  2005 initfile.sum
-rw-r--r--    1 root     root        10398 Jul  9  2005 initfile.tar.gz
-rw-r--r--    1 root     root        10240 Jul  9  2005 ramdiskimg.tar.gz

the ramdiskimg.tar.gz includes all the files that are needed to reconstruct /var/...on the stock firmware & openlink, var is on a ramdisk...it needs to be reconstructed each time. this is the content of initfile.tar.gz

etc/ap_servd.log
etc/group
etc/melco/
etc/melco/timer_sleep
etc/melco/timer_backup
etc/melco/timer_backup.cron
etc/melco/timer_status
etc/melco/info
etc/melco/shareinfo
etc/melco/usercount
etc/melco/userinfo
etc/melco/printer
etc/melco/groupinfo
etc/melco/ver
etc/melco/pcast_mp2000
etc/melco/ftpstatus
etc/melco/pdcuserinfo
etc/melco/pdcuserinfo.base
etc/melco/backup_error_status
etc/melco/timer_backup_folder
etc/melco/ntp
etc/melco/ntp_result
etc/passwd
etc/proftpd.conf
etc/wu-ftpd/ftpaccess
etc/atalk/
etc/atalk/atalkd.conf
etc/atalk/AppleVolumes.default
etc/atalk/AppleVolumes.system
etc/atalk/afpd.conf
etc/atalk/config
etc/atalk/papd.conf
etc/atalk/config.papd
etc/hosts
etc/network/interfaces
etc/printcap
etc/samba/smb.conf
etc/samba/smbpasswd
www/.htpasswd
www/cgi-bin/.htpasswd
www/script/.htpasswd

this is the content of ramdiskimg.tar.gz (only folders)

var/
var/cache/
var/cache/samba/
var/lib/
var/lib/misc/
var/lib/locate/
var/lib/logrotate/
var/local/
var/lock/
var/lock/subsys/
var/lock/dev/
var/log/
var/log/samba/
var/opt/
var/spool/
var/spool/samba/
var/spool/cron/
var/spool/cron/crontabs/
var/tmp/
var/run/