Talk:The LinkStation firmware flasher
Testing freelink images on LS2, i found out a lot of details on the flashing process. I don't know if this applies to LS1, HG, Kuro, TS as well, so I decided to put my knowledge in this discussion area. Please correct me if I'm wrong, make additions and integrate this stuff in the main article if it's of general use for other platforms.
We have two ways of flashing: EM mode and normal mode.
Flashing the image.dat to hda1 from Windows needs at least the follwing requirements:
This is true only for normal mode on my LS2:
1. idtinfo loaded to create /proc/linkstation
root@FL060727:~# lsmod Module Size Used by Tainted: P idtinfo 12428 0 (unused)
if idtinfo is not loaded, do (ignore warnings, this a license problem):
root@FL060727:~# insmod idtinfo Using /lib/modules/2.4.20_mipsel_linkstation/idtinfo.o Warning: loading /lib/modules/2.4.20_mipsel_linkstation/idtinfo.o will taint the kernel: no license See http://www.tux.org/lkml/#export-tainted for information about tainted modules Module idtinfo loaded, with warnings
2. apservd must be executeable. If he is not, do a changemod and start it:
root@FL060727:~# chmod +x /etc/init.d/apservd root@FL060727:~# ls -la /etc/init.d/apservd -rwxr-xr-x 1 root root 1286 Jul 29 23:20 /etc/init.d/apservd root@FL060727:~# /etc/init.d/apservd start Start services: ls_servd on eth0
ls_servd is triggerd by starting apservd. ls_servd is opening a port on your LS2:
root@FL060727:~# netstat -a Active Internet connections (servers and established) ... udp 0 0 *:22936 *:* ...
If you can't see this open port, the flasher won't be able to find your box. All 3 Windows applications which came with your Linkstatation (HD-HLAN FWUpdate.exe, IPSetup.exe and LsBackup.exe) are using this open UDP port to communicate with your Linkstation.
3. Some scripts must be in the right place on your box. As I did not sort out those scripts, which are really essential to the flashing process, I was copying all scripts to hda1:
root@FL060727:~# ls -la /www/script/* -r-xr-xr-x 1 root root 4 Dec 21 2004 /www/script/Yes -rwxr-xr-x 1 root root 32 Dec 21 2004 /www/script/dobackup.sh -r-xr-xr-x 1 root root 206 Dec 21 2004 /www/script/index.htm -rwxr-xr-x 1 root root 528 Dec 21 2004 /www/script/melsub_check_ip.sh -rwxr-xr-x 1 root root 759 Dec 21 2004 /www/script/melsub_disk_rebuild.sh -rwxr-xr-x 1 root root 1764 Dec 21 2004 /www/script/melsub_disk_repair.sh -rwxr-xr-x 1 root root 2056 Dec 21 2004 /www/script/melsub_filepath.sh -rwxr-xr-x 1 root root 2285 Dec 21 2004 /www/script/melsub_flash.sh -rwxr-xr-x 1 root root 876 Dec 21 2004 /www/script/melsub_init.sh -rwxr-xr-x 1 root root 7801 Dec 21 2004 /www/script/melsub_mkprintfilter.sh -rwxr-xr-x 1 root root 828 Dec 21 2004 /www/script/melsub_shutdown.sh -rwxr-xr-x 1 root root 572 Dec 21 2004 /www/script/melsub_shutdown2.sh -rwxr-xr-x 1 root root 99 Dec 21 2004 /www/script/melsub_tmpclean.sh -rwxr-xr-x 1 root root 2824 Dec 21 2004 /www/script/ref_lpr_filter_info.sh -rwxr-xr-x 1 root root 932 Dec 21 2004 /www/script/set_delshare_base.sh -rwxr-xr-x 1 root root 766 Dec 21 2004 /www/script/set_hdd_check_detail.sh -rwxr-xr-x 1 root root 763 Dec 21 2004 /www/script/set_hdd_check_normal.sh -rwxr-xr-x 1 root root 1880 Dec 21 2004 /www/script/set_hdd_format.sh -rwxr-xr-x 1 root root 705 Dec 21 2004 /www/script/set_hdd_format_usb.sh -rwxr-xr-x 1 root root 2542 Dec 21 2004 /www/script/set_ip.sh -rwxr-xr-x 1 root root 46 Dec 21 2004 /www/script/set_printer_queue.sh
At least melsub_flash.sh, melsub_shutdown2.sh and melsub_filepath.sh are needed by the flasher
If these requirements are met, I was able to use the flasher and put new images to my box. There's still much to be done, as at the moment the flashing procedure always ends up with an error message: "Attempt to renew firmware has failed". Nevertheless my box was always working.
Analysis of HD-HLAN FWUpdate.exe
Following the flashing process on Windows, the process goes trough 5 different stages (at least when the software really does what it says):
- Settings are being saved
- Firmware is being transmitted
- LinkStation firmware has been renewed
- Settings are being restored
- Attempt to renew firmware has failed
If the melsub scripts are missing, the process ends up shortly after saying "Settings are being saved". If these scripts are in place, it ends up after saying "Settings are being restored". So probably there's a file or directory missing on the newcreated hda1 partition, where setting could be restored successfully.
Leaving my ssh connection open while attempting to flash the box, i could see some errormessages during the flashing process:
root@FL060727:~# sh: line 1: /www/script/melsub_flash.sh: No such file or directory /www/script/melsub_shutdown2.sh: /www/script/melsub_shutdown2.sh: No such file or directory
This was the reason to put the required scripts in right place.
root@FL060729:/mnt# cat: /etc/linkstation_release: No such file or directory
I checked the content of /etc/linkstation_release inside openlink 0.52b and found:
PRODUCTNAME=HD-HLAN(IENOBU) VERSION=2.05 SUBVERSION=HDD 1.2 PRODUCTID=0x00000006 BUILDDATE=2005/04/01 13:35:54
So i put this file inside /etc and flashed again, but ended up with "Attempt to renew firmware has failed".
Wondering about settings restore
This is true only for EM Mode flashing on my LS2:
By flashing a firmware after connecting an empty disk to the Linkstation I expected to loose all settings which I had before on my old disk. But this not true. I experienced that some settings must be restored from the flash. Flashing openlink 0.52b to an empty disk and opening buffalos webinterface, I could check for some settings restored from flash:
- Character code
- Shared folder information
- LinkStation name
- Linkstation description
- IP adress
- Default gateway settings
- Workgroup setting
are restored from flash, while
- actual time was reset to 2002 01 01
I relized that the restored settings where not those from my last openlink installation, but those which I did some weeks before, having the original 160 GB HD inside. Opening putty I could check for some files in root directory:
did not change. I discovered that there's a second directory with config files: /etc/melco
bash-2.05a# ls -la total 44 drw-rw-r-- 2 root root 4096 Jan 1 18:02 . drwxr-xr-x 23 root root 4096 Jan 1 18:02 .. -rw-r--r-- 1 root root 0 Dec 20 2004 backup_error_status -rw-r--r-- 1 root root 59 Jul 10 2006 ftpstatus -rw-r--r-- 1 root root 24 Dec 20 2004 groupinfo -rw--w---- 1 root root 105 Jul 15 2006 info -rw-r--r-- 1 root root 35 Aug 26 2005 ntp -rw-r--r-- 1 root root 0 Dec 20 2004 ntp_result -rw-r--r-- 1 root root 57 Aug 25 2005 pcast_mp2000 -rw-r--r-- 1 root root 0 Dec 20 2004 pdcuserinfo -rw-r--r-- 1 root root 11 Aug 29 2005 printer -rw-r--r-- 1 root root 1544 Jan 1 18:02 shareinfo -rw-r--r-- 1 root root 135 Jul 15 2006 shareinfo.bak -rw-r--r-- 1 root root 0 Aug 26 2005 timer_backup.cron -rw-r--r-- 1 root root 0 Dec 20 2004 timer_backup_folder -rw-r--r-- 1 root root 133 Jul 10 2006 timer_status -rw-r--r-- 1 root root 0 Dec 20 2004 userinfo
Inside these files I could find a backup of the usual config files. Don't know if this a template to fill up the usual Linux config files with restored data again, or if this is only a sort of backup.
ANALYSIS of /etc/scripts/melsub_flash
/www/cgi-bin/mellib.pl (seems to be equal to /www.cgi-bin2/mellib2.pl) /www/script/melsub_filepath.sh
are the files that includes all variables.
/etc/scripts/melsub_flash refers to a variable
$fileMELSETTMP = '/tmp/conf_save.tar';
there are 2 different things that melsub_flash does
- either it is used for flashing a conf_save.tar.gz additionally (as_flash /dev/fl0 add) to the flash
- or it is used for clearing it totaly(as_flash /dev/fl0 init)
before flashing, it creates an archive of the most important info
### Archive Make ### tar cp "$fileIFCFG" > "$fileMELSETTMP" 2> /dev/null tar rfp "$fileMELSETTMP" "$dirSAMBA" 2> /dev/null tar rfp "$fileMELSETTMP" "$dirATALK" 2> /dev/null tar rfp "$fileMELSETTMP" "$dirMELCO" 2> /dev/null tar rfp "$fileMELSETTMP" "$filePASSWD" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileGROUP" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileHOSTS" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileHTPASSWD" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileHTPASSWD1" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileHTPASSWD2" 2> /dev/null tar rfp "$fileMELSETTMP" "$fileAPSERVD" 2> /dev/null tar rfp "$fileMELSETTMP" "$filePRINTCAP" 2> /dev/null if [ -f "$fileCRONTAB" ] ; then tar rfp "$fileMELSETTMP" "$fileCRONTAB" 2> /dev/null fi if [ -f "$filePCASTD" ] ; then tar rfp "$fileMELSETTMP" "$filePCASTD" 2> /dev/null fi
info about tar-options
tar rfp -r, --append append files to the end of an archive -f, --file=ARCHIVE use archive file or device ARCHIVE -p, --same-permissions extract permissions information
afterwards it is zipped:
gzip "$fileMELSETTMP" 1> /dev/null 2> /dev/null
it is written to the end of the flash!
### Flash Write ### as_flash /dev/fl0 add -n "$fileMELSETTMP".gz 1> /dev/null 2> /dev/null
then the file gets deleted
rm -f "$fileMELSETTMP".gz 1> /dev/null 2> /dev/null
these are the options of as_flash
root@LINKSTATION:~# as_flash as_flash [device] [add|del|get|init] [options] add -n <filename> add file image to end of flash del [-n <filename>|-i <block number>] delete Entered file name or block number of block data from flash get [-n <filename>|-i <block number>] [--output <filename>] read Entered file name or block number of block data from flash, and store output filename init clear device by zero
it seems that as_flash /dev/fl0 init seems to delete the whole content of the flash. but maybe this is only an area? i mean...maybe it clears only the area where the config-files are stored? i can only verify that when i finally get the JTAG-Equipment and it works.
we need to find all the files that use as_flash. especially all files/scripts that use as_flash /dev/fl0 get. then we know where info is extracted and used from the flash.
/etc/init.d/load_config is the file that uses as_flash to get the tared config-files back. but it is never started...when does this get executed?
AS_FLASH=/usr/bin/as_flash FLASH_DEV=/dev/fl0 FILENAME=/tmp/conf_save.tar.gz $AS_FLASH $FLASH_DEV get -n $FILENAME --output $FILENAME cd / /bin/tar -xzf $FILENAME
in kernel 2.4 (in 2.6 is no /dev/fl*) i tried to extract conf_save_tar.gz with
/usr/bin/as_flash /dev/fl0 get -n /tmp/conf_save.tar.gz --output /tmp/conf_save.tar.gz
and it worked.
cd /tmp ls AppleVolumes conf_save.tar.gz shareinfo
i created an additional folder, changed in that directory and untared the file
/tmp# mkdir temp2 /tmp# cd temp2 /tmp/temp2# tar xzvf ../conf_save.tar.gz
this is the content of conf_save.tar.gz
etc/network/interfaces etc/samba/ etc/samba/smbusers etc/samba/smb.conf etc/samba/lmhosts etc/samba/smbpasswd etc/samba/recycle.conf etc/samba/secrets.tdb etc/samba/smb.conf.bak etc/atalk/ etc/atalk/atalkd.conf etc/atalk/AppleVolumes.default etc/atalk/AppleVolumes.system etc/atalk/afpd.conf etc/atalk/config etc/atalk/papd.conf etc/atalk/config.papd etc/melco/ etc/melco/timer_sleep etc/melco/timer_backup etc/melco/timer_backup.cron etc/melco/timer_status etc/melco/info etc/melco/shareinfo etc/melco/usercount etc/melco/userinfo etc/melco/printer etc/melco/groupinfo etc/melco/ver etc/melco/pcast_mp2000 etc/melco/ftpstatus etc/melco/pdcuserinfo etc/melco/pdcuserinfo.base etc/melco/backup_error_status etc/melco/timer_backup_folder etc/melco/ntp etc/melco/ntp_result etc/passwd etc/group etc/hosts www/.htpasswd www/cgi-bin/.htpasswd www/script/.htpasswd etc/ap_servd.log etc/printcap etc/pcast/pcastd.conf
but when is this /etc/init.d/load_config started? there is no symlink anywhere. maybe somehow over ap_servd? maybe only if it was in EM Mode? maybe only if it was flashed in normal mode?
i just also wanted to mention that there is file called /www/scripts/melsub_init.sh. it takes down all services and afterwards overwrites all the config files by
### extrace default files ### cd / tar xvzf /root/.files/initfile.tar.gz -C / > /dev/null 2> /dev/null
look into /root/.files....you will see that there is the initfile.tar.gz which has the files that are initially used....
:~/.files# ls -la -rw-r--r-- 1 root root 12 Jul 9 2005 initfile.sum -rw-r--r-- 1 root root 10398 Jul 9 2005 initfile.tar.gz -rw-r--r-- 1 root root 10240 Jul 9 2005 ramdiskimg.tar.gz
the ramdiskimg.tar.gz includes all the files that are needed to reconstruct /var/...on the stock firmware & openlink, var is on a ramdisk...it needs to be reconstructed each time. this is the content of initfile.tar.gz
etc/ap_servd.log etc/group etc/melco/ etc/melco/timer_sleep etc/melco/timer_backup etc/melco/timer_backup.cron etc/melco/timer_status etc/melco/info etc/melco/shareinfo etc/melco/usercount etc/melco/userinfo etc/melco/printer etc/melco/groupinfo etc/melco/ver etc/melco/pcast_mp2000 etc/melco/ftpstatus etc/melco/pdcuserinfo etc/melco/pdcuserinfo.base etc/melco/backup_error_status etc/melco/timer_backup_folder etc/melco/ntp etc/melco/ntp_result etc/passwd etc/proftpd.conf etc/wu-ftpd/ftpaccess etc/atalk/ etc/atalk/atalkd.conf etc/atalk/AppleVolumes.default etc/atalk/AppleVolumes.system etc/atalk/afpd.conf etc/atalk/config etc/atalk/papd.conf etc/atalk/config.papd etc/hosts etc/network/interfaces etc/printcap etc/samba/smb.conf etc/samba/smbpasswd www/.htpasswd www/cgi-bin/.htpasswd www/script/.htpasswd
this is the content of ramdiskimg.tar.gz (only folders)
var/ var/cache/ var/cache/samba/ var/lib/ var/lib/misc/ var/lib/locate/ var/lib/logrotate/ var/local/ var/lock/ var/lock/subsys/ var/lock/dev/ var/log/ var/log/samba/ var/opt/ var/spool/ var/spool/samba/ var/spool/cron/ var/spool/cron/crontabs/ var/tmp/ var/run/