From NAS-Central Buffalo - The Linkstation Wiki
Jump to: navigation, search

This article Based on work by naxalite, wth, frontalot, and noName. Originally by frontalot. at

Nuvola apps important.png 

Some of these commands have not yet been tested on the mipsel-hdhlan LinkStation. Please report any differences

The MIPSel LS2 actually does not contain an AVR (other LS versions do). AVRs are microcontrollers from Atmel and an Atmel brand, while the LS2 contains a Freescale (Motorola) microcontroller MC68HC908JL8, which is based upon the Motorola 6808 microprocessor, which is a decendant of the classic Motorola 6800 microprocessor, first released in 1975 at the dawn of microprocessors.

The microcontroller serves the same purpose as the AVRs in other LinkStation models. It controls much of the LinkStation hardware, including the power button and LED indicator. It is controlled by the commands sent to /dev/ttyS0.

To send commands to the microcontroller use e.g.:

echo -n "commands" > /dev/ttyS0
Command Action/Code
\30\30\30\30 Stops smbd and atalkd if /dev/hda3 is not mounted to /mnt. Sent by /www/script/
[[[[ Starts slowly blinking power LED (sleep).
]]]] High-speed cooling fan rotation.
\\\\ Low-speed cooling fan rotation.
>>>> Unknown. Sent by mc_ctld on boot.
AAAA Unknown. Sent by mc_ctld on boot.
CCCC Sent by shutdown -r now (reboot).
EEEE Sent by shutdown -h now (halt).
FFFF Unknown. Sent by mc_ctld on boot.
JJJJ Unknown. Sent by mc_ctld on boot.
KKKK Unknown. Sent by mc_ctld on boot.
QQQQ Unknown. Sent by mc_ctld on set timer.
RRRR End of clear flash memory.
SSSS Start of clear flash memory and /www/script/ Sent by /www/script/
TTTT Flash memory update completed (stops blinking power, disk full, and diagnostic LEDs).
UUUU Flash memory update started (starts blinking power, disk full, and diagnostic LEDs).
VVVV Turns off disk full LED.
WWWW Turns on disk full LED.
XXXX Stops blinking disk full LED.
YYYY Starts blinking disk full LED.
ZZZZ Stops slowly blinking power LED. Sent by mc_ctld.
gggg Diagnostic LED blinks 3 times and system shutdown (partition error).
iiii Diagnostic LED blinks 4 times and system shutdown (cooling fan error).
kkkk Diagnostic LED blinks 5 times and system powers off (flash memory error).
mmmm Diagnostic LED blinks 6 times and system shutdown (hard drive or mc_ctld error).
oooo Diagnostic LED blinks 7 times and system shutdown (RAM, NIC, or HDD controller error).

Most of this information courtesy of

Pin Functions

For an in depth description of the pin functions of the microcontroller see Kuroguy's analysis of the pin functions


mc_ctld is the microcontroller control daemon. It is a piece of software running on the LS2 under Linux, which communicates with the LS2's Freescale housekeeping microcontroller. It is proprietary Buffalo software, and Buffalo refuses to release the source code. Therefore, the exact inner working of the software is not known. However, its general function is known, due to extensive analysis which has been done on the LS1 equivalent of that software (ppc_uartd), and a free replacement has been written avr_evtd.

The daemon is started during system boot in run-level 2, and stopped in run-level 0 (system halt) and 6 (system reboot). The startup script is /etc/init.d/mc_ctld, while the daemon binary itself is /usr/sbin/mc_ctld.

The daemon's primary task it to reset the watchdog timer in the microcontroller in regular intervals. So that timer doesn't trigger and doesn't initiate a reboot. mc_ctld monitors some system health indicators, like the Samba process (via using the process ID stored in /var/run/ If these fail, it initiates a reboot (or stops resetting the timer).

It also observes /etc/melco/timer_status to adhere to "sleep / wakeup" settings - an LS feature configurable via the web admin interface at http://linkstation/cgi-bin/setup-sleep.cgi. The web admin interface stores the configured values in /etc/melco/timer_status and mc_ctld reads them and forwards them to the housekeeping microcontroller.

The communication with the microcontroller is done via /dev/ttyS0, using the commands listed at the beginning of this article or similar, currently not reverse-engineered commands.

mc_ctld's relatively late position in the LinkStation's boot procedure can sometimes be the cause of bricking a LinkStation. If the preceding startup scripts take too long, the watchdog timer can trigger before mc_ctld was started and had a chance to reset the timer. The LS will then repeatedly reboot while still in the boot procedure. Usually this is not a problem with the standard system configuration, but it is known to become a problem if the startup of additional services had been added before the mc_ctld startup. Therefore it is highly recommended to add own rc startup scripts after start sequence S95 only.