version 1.3, 2015/09/04 22:30:35
|
version 1.4, 2015/09/05 17:04:26
|
Line 35 is a small tab besides the grey frame, w
|
Line 35 is a small tab besides the grey frame, w
|
(e.g. with a screwdriver) to be able to move the frame to the front. On |
(e.g. with a screwdriver) to be able to move the frame to the front. On |
the photo below the location is marked red. |
the photo below the location is marked red. |
|
|
KuroBox with tab marked |
<img src="//www.netbsd.org/images/ports/sandpoint/kuro_top.jpg" alt="KuroBox with tab marked" /></td> |
|
|
After a few millimeters the grey piece snaps free and comes up. You need |
After a few millimeters the grey piece snaps free and comes up. You need |
quite some force to do that, because the shiny front bezel is secured by |
quite some force to do that, because the shiny front bezel is secured by |
two hidden screws (one in the top and another in the bottom of the |
two hidden screws (one in the top and another in the bottom of the |
Line 43 bezel). With enough force and skill you
|
Line 44 bezel). With enough force and skill you
|
out of the case (fortunately the screws are small). They remain in the |
out of the case (fortunately the screws are small). They remain in the |
shiny bezel. You may want to shorten the screws with a file now. |
shiny bezel. You may want to shorten the screws with a file now. |
|
|
HD-HLAN half opened |
<img src="//www.netbsd.org/images/ports/sandpoint/ls1_opened.jpg" alt="HD-HLAN half opened" /></td> |
|
|
Before the case can be opened you have to remove a screw hidden under a |
Before the case can be opened you have to remove a screw hidden under a |
sticker, below the fan (marked on the right side of the picture). Then |
sticker, below the fan (marked on the right side of the picture). Then |
press the four tabs on the top and bottom to remove the upper half of |
press the four tabs on the top and bottom to remove the upper half of |
Line 114 levels, which have to be converted into
|
Line 116 levels, which have to be converted into
|
shifter circuit. If you are not anxious using a soldering iron you find |
shifter circuit. If you are not anxious using a soldering iron you find |
detailed instructions how to build such a converter here: |
detailed instructions how to build such a converter here: |
|
|
- Serial adapter for 3.3V TTL |
- [Serial adapter for 3.3V TTL](http://www.netbsd.org/ports/sandpoint/ttl2rs232.html) |
|
|
Make sure that the layout of the plug fits to the pinout of the |
Make sure that the layout of the plug fits to the pinout of the |
LinkStation's serial header, as shown above. |
LinkStation's serial header, as shown above. |
Line 149 flash a new firmware. Without the origin
|
Line 151 flash a new firmware. Without the origin
|
difficult. You would either have to find a way to install the system |
difficult. You would either have to find a way to install the system |
onto a new disk with the help of a second machine, or use the JTAG port |
onto a new disk with the help of a second machine, or use the JTAG port |
to flash the new firmware directly into the chip (in the last case you |
to flash the new firmware directly into the chip (in the last case you |
can skip all sections until ?). |
can skip all sections until |
|
[the section called “First installation”](#install) ). |
|
|
For the KuroBox you can skip this section. The root password is known to |
For the KuroBox you can skip this section. The root password is known to |
be `kuro`. Also telnet access is enabled. The default IP of the KuroBox |
be `kuro`. Also telnet access is enabled. The default IP of the KuroBox |
Line 158 is `192.168.11.150`.
|
Line 161 is `192.168.11.150`.
|
Make a new user over the LinkStation's web interface. We can use it to |
Make a new user over the LinkStation's web interface. We can use it to |
log in over the serial port. |
log in over the serial port. |
|
|
Add a new user on the GUI |
<img src="//www.netbsd.org/images/ports/sandpoint/ls1_new_user.jpg" alt="Add a new user on the GUI" /></td> |
|
|
Log in into the new account and create a CGI file under `/www` which |
Log in into the new account and create a CGI file under `/www` which |
makes `/etc/passwd` writeable for all users. |
makes `/etc/passwd` writeable for all users. |
|
|
BUFFALO INC. Link Station series HD-HLAN (HIDETADA) |
<pre> |
|
BUFFALO INC. Link Station series HD-HLAN (HIDETADA) |
|
|
BUFFALO login: |
BUFFALO login: <strong>Besucher</strong> |
Password: |
Password: |
Linux (none) 2.4.17_mvl21-sandpoint #990 2004xxxx 13:39:00 JST ppc unknown |
Linux (none) 2.4.17_mvl21-sandpoint #990 2004xxxx 13:39:00 JST ppc unknown |
Besucher@BUFFALO:~$ |
Besucher@BUFFALO:~$ <strong>mkdir /www/cgi-bin3</strong> |
Besucher@BUFFALO:~$ |
Besucher@BUFFALO:~$ <strong>vi /www/cgi-bin3/exploit.cgi</strong> |
|
</pre> |
|
|
`exploit.cgi` should look like this: |
`exploit.cgi` should look like this: |
|
|
Line 177 makes `/etc/passwd` writeable for all us
|
Line 183 makes `/etc/passwd` writeable for all us
|
|
|
Then enter the URL `http://mylinkstation/cgi-bin3/exploit.cgi` into your |
Then enter the URL `http://mylinkstation/cgi-bin3/exploit.cgi` into your |
browser. When all went well, `/etc/passwd` is writeable now. Edit it |
browser. When all went well, `/etc/passwd` is writeable now. Edit it |
with `vi` and copy your user password (`/Jg58Gq9427qY` in this example) |
with **vi** and copy your user password (`/Jg58Gq9427qY` in this example) |
over the current root password. Now you can log in with the same |
over the current root password. Now you can log in with the same |
password into the root account. |
password into the root account. |
|
|
Line 208 configure FTP access (already enabled fo
|
Line 214 configure FTP access (already enabled fo
|
and allow write access for registered users to the shared folders (e.g. |
and allow write access for registered users to the shared folders (e.g. |
`share`). |
`share`). |
|
|
Enable FTP access with the GUI |
<img src="//www.netbsd.org/images/ports/sandpoint/ls1_ftp_enable.jpg" alt="Enable FTP access with the GUI" /></td> |
|
|
Get an appropriate U-Boot firmware image from |
Get an appropriate U-Boot firmware image from |
<http://www.genbako.com/u-boot_loader/>: |
<http://www.genbako.com/u-boot_loader/> (site is obsolete, use copies below): |
|
|
- LinkStation HD-HLAN or KuroBox classic |
- [LinkStation HD-HLAN or KuroBox classic](http://www.netbsd.org/~phx/LinkStation/u-boot-hd.flash.bin) |
- LinkStation HD-HGLAN or KuroBox HG |
- [LinkStation HD-HGLAN or KuroBox HG](http://www.netbsd.org/~phx/LinkStation/u-boot-hg.flash.bin) |
|
|
Transfer the firmware into the `share` folder on the LinkStation. |
Transfer the firmware into the `share` folder on the LinkStation. |
|
|
$ |
<pre> |
Connected to 192.168.0.9. |
$ <strong>ftp mylinkstation</strong> |
220 BUFFALO FTP server ready |
Connected to 192.168.0.9. |
Name (192.168.0.9:user): |
220 BUFFALO FTP server ready |
331 Password required for Besucher. |
Name (192.168.0.9:user): <strong>Besucher</strong> |
Password: |
331 Password required for Besucher. |
230 User Besucher logged in. |
Password: |
Remote system type is UNIX. |
230 User Besucher logged in. |
Using binary mode to transfer files. |
Remote system type is UNIX. |
ftp> |
Using binary mode to transfer files. |
250 CWD command successful. |
ftp> <strong>cd share</strong> |
ftp> |
250 CWD command successful. |
local: u-boot-hd.flash.bin remote: u-boot-hd.flash.bin |
ftp> <strong>put u-boot-hd.flash.bin</strong> |
229 Entering Extended Passive Mode (|||1045|) |
local: u-boot-hd.flash.bin remote: u-boot-hd.flash.bin |
150 Opening BINARY mode data connection for u-boot-hd.flash.bin |
229 Entering Extended Passive Mode (|||1045|) |
100% |***********************************| 170 KiB 6.07 MiB/s 00:00 |
150 Opening BINARY mode data connection for u-boot-hd.flash.bin |
ETA |
100% |***********************************| 170 KiB 6.07 MiB/s 00:00 |
226 Transfer complete. |
ETA |
174640 bytes sent in 00:00 (4.86 MiB/s) |
226 Transfer complete. |
ftp> |
174640 bytes sent in 00:00 (4.86 MiB/s) |
|
ftp> <strong>quit</strong> |
|
</pre> |
|
|
The next step is dangerous. Any fault, like a wrong firmware or an |
The next step is dangerous. Any fault, like a wrong firmware or an |
interrupted flashing process, will turn your LinkStation into a brick. |
interrupted flashing process, will turn your LinkStation into a brick. |
|
|
The boot loader firmware can be accessed from Linux through `/dev/fl2`. |
The boot loader firmware can be accessed from Linux through `/dev/fl2`. |
There is no `dd` so we will use `cat`. Log in as root on the serial |
There is no **dd** so we will use **cat**. Log in as root on the serial |
console, go to the shared folder where we uploaded the new firmware and |
console, go to the shared folder where we uploaded the new firmware and |
flash it. |
flash it. |
|
|
root@BUFFALO:~# |
<pre> |
root@BUFFALO:/mnt/share# |
root@BUFFALO:~# <strong>cd /mnt/share</strong> |
total 176 |
root@BUFFALO:/mnt/share# <strong>ls -l</strong> |
-rw-rw-rw- 1 Besucher hdusers 174640 May 13 15:43 u-boot-hd.flash.bin |
total 176 |
root@BUFFALO:/mnt/share# |
-rw-rw-rw- 1 Besucher hdusers 174640 May 13 15:43 u-boot-hd.flash.bin |
|
root@BUFFALO:/mnt/share# <strong>cat u-boot-hd.flash.bin > /dev/fl2</strong> |
|
</pre> |
|
|
The Diag and Disk Full LEDs will flash red during this process. This is |
The Diag and Disk Full LEDs will flash red during this process. This is |
normal. After a few seconds the LEDs are off again and the prompt |
normal. After a few seconds the LEDs are off again and the prompt |
returns. To make sure the process was successful, you should reread the |
returns. To make sure the process was successful, you should reread the |
firmware from the flash and compare it with the original. Therefore you |
firmware from the flash and compare it with the original. Therefore you |
have to download the new image, as this Linux installation also got no |
have to download the new image, as this Linux installation also got no |
`cmp`. |
**cmp**. |
|
|
root@BUFFALO:/mnt/share# |
<pre> |
|
root@BUFFALO:/mnt/share# <strong>cat /dev/fl2 > /mnt/share/newfl2</strong> |
|
</pre> |
|
|
Here the downloaded image differs at character 174641. But that is ok, |
Here the downloaded image differs at character 174641. But that is ok, |
because the firmware is only 174640 bytes large and we downloaded the |
because the firmware is only 174640 bytes large and we downloaded the |
whole flash contents. |
whole flash contents. |
|
|
$ |
<pre> |
cmp: EOF on u-boot-hd.flash.bin: char 174641, line 891 |
$ <strong>cmp -l newfl2 u-boot-hd.flash.bin</strong> |
|
cmp: EOF on u-boot-hd.flash.bin: char 174641, line 891 |
|
</pre> |
|
|
Reboot your LinkStation and cross fingers. When all went well, the |
Reboot your LinkStation and cross fingers. When all went well, the |
following lines will appear on your serial console: |
following lines will appear on your serial console: |
Line 303 to serial.
|
Line 318 to serial.
|
Here you should press `s` to stop booting and change some environment |
Here you should press `s` to stop booting and change some environment |
variables to make U-Boot default to serial. |
variables to make U-Boot default to serial. |
|
|
=> |
<pre> |
=> |
=> <strong>run ser</strong> |
=> |
=> <strong>setenv bootcmd</strong> |
=> |
=> <strong>setenv bootdelay -1</strong> |
|
=> <strong>saveenv</strong> |
|
</pre> |
|
|
Enter `reset` to reboot into interactive mode with serial console. At |
Enter **reset** to reboot into interactive mode with serial console. At |
this point we no longer need the original Linux installation and we are |
this point we no longer need the original Linux installation and we are |
ready for NetBSD. |
ready for NetBSD. |
|
|
Line 326 bootinfo list to the kernel.
|
Line 343 bootinfo list to the kernel.
|
|
|
The `altboot` boot loader has to be loaded and started using U-Boot. For |
The `altboot` boot loader has to be loaded and started using U-Boot. For |
the first installation we have to load it over the network with TFTP |
the first installation we have to load it over the network with TFTP |
protocol, using the command `tftpboot`. Later we can put `altboot` into |
protocol, using the command **tftpboot**. Later we can put `altboot` into |
the flash memory and copy it from there. |
the flash memory and copy it from there. |
|
|
When not already done, enable TFTP on your working system in |
When not already done, enable TFTP on your working system in |
Line 336 tell U-Boot its client address and the `
|
Line 353 tell U-Boot its client address and the `
|
working system's server address is `192.168.0.5` in this example, and |
working system's server address is `192.168.0.5` in this example, and |
the LinkStation is at `192.168.0.102`. |
the LinkStation is at `192.168.0.102`. |
|
|
=> |
<pre> |
=> |
=> <strong>setenv ipaddr 192.168.0.102</strong> |
=> |
=> <strong>setenv serverip 192.168.0.5</strong> |
Saving Environment to Flash... |
=> <strong>saveenv</strong> |
Un-Protected 1 sectors |
Saving Environment to Flash... |
Erasing Flash... |
Un-Protected 1 sectors |
Flash erase: first = 54 @ 0xfff60000 |
Erasing Flash... |
last = 54 @ 0xfff60000 |
Flash erase: first = 54 @ 0xfff60000 |
Flash erase: Done |
last = 54 @ 0xfff60000 |
Erased 1 sectors |
Flash erase: Done |
Writing to Flash... done |
Erased 1 sectors |
Protected 1 sectors |
Writing to Flash... done |
|
Protected 1 sectors |
|
</pre> |
|
|
Load `altboot.bin` into memory. The binary is relocated at 0x1000000, so |
Load `altboot.bin` into memory. The binary is relocated at 0x1000000, so |
type: |
type: |
|
|
=> |
<pre> |
Using COMET#0 device |
=> <strong>tftpboot 1000000 altboot.bin</strong> |
TFTP from server 192.168.0.5; our IP address is 192.168.0.102 |
Using COMET#0 device |
Filename 'altboot.bin'. |
TFTP from server 192.168.0.5; our IP address is 192.168.0.102 |
Load address: 0x1000000 |
Filename 'altboot.bin'. |
Loading: ############## |
Load address: 0x1000000 |
done |
Loading: ############## |
Bytes transferred = 70844 (114bc hex) |
done |
|
Bytes transferred = 70844 (114bc hex) |
|
</pre> |
|
|
Boot the INSTALL kernel with altboot |
Boot the INSTALL kernel with altboot |
------------------------------------ |
------------------------------------ |
Line 369 installing NetBSD. It is important to ta
|
Line 390 installing NetBSD. It is important to ta
|
`netbsd-INSTALL`, because LinkStation and KuroBox systems have the UARTs |
`netbsd-INSTALL`, because LinkStation and KuroBox systems have the UARTs |
swapped, i.e. they are using the second UART for the serial console. You |
swapped, i.e. they are using the second UART for the serial console. You |
may choose to load the installation kernel with TFTP or from NFS. TFTP |
may choose to load the installation kernel with TFTP or from NFS. TFTP |
was described above and for NFS there is a documentation at [The Network |
was described above and for NFS there is a documentation at |
File |
[The Network File System](http://www.NetBSD.org/docs/guide/en/chap-net-services.html#chap-net-services-nfs). |
System](http://www.NetBSD.org/docs/guide/en/chap-net-services.html#chap-net-services-nfs). |
|
But in both cases you have to set up a DHCP server, which is explained |
But in both cases you have to set up a DHCP server, which is explained |
in the [DHCP Howto](http://www.NetBSD.org/docs/network/dhcp.html). An |
in the [DHCP Howto](http://www.NetBSD.org/docs/network/dhcp.html). An |
appropriate `dhcpd.conf` entry could look like this: |
appropriate `dhcpd.conf` entry could look like this: |
Line 389 the NetBSD/sandpoint distribution and co
|
Line 409 the NetBSD/sandpoint distribution and co
|
directory. Then start the DHCP, NFS or TFTP server and boot the |
directory. Then start the DHCP, NFS or TFTP server and boot the |
installation kernel from the firmware either with |
installation kernel from the firmware either with |
|
|
=> |
<pre> |
|
=> <strong>go 1000000 tftp:netbsd-INSTALL_KURO</strong> |
|
</pre> |
|
|
or from NFS: |
or from NFS: |
|
|
=> |
<pre> |
|
=> <strong>go 1000000 nfs:netbsd-INSTALL_KURO</strong> |
|
</pre> |
|
|
Our bootloader configures the hardware, determines the IP address, loads |
Our bootloader configures the hardware, determines the IP address, loads |
the kernel via network and launches it: |
the kernel via network and launches it: |
Line 473 the kernel via network and launches it:
|
Line 497 the kernel via network and launches it:
|
|
|
Just follow the usual procedure to install a NetBSD system. |
Just follow the usual procedure to install a NetBSD system. |
|
|
Sandpoint installation window |
<img src="//www.netbsd.org/images/ports/sandpoint/install_window.jpg" alt="Sandpoint installation window" /></td> |
|
|
Post installation steps |
Post installation steps |
======================= |
======================= |
|
|
Line 487 to be unused, so we can put `altboot` th
|
Line 512 to be unused, so we can put `altboot` th
|
memory at `0x1000000` again, as explained above, and execute the |
memory at `0x1000000` again, as explained above, and execute the |
following commands to write it to Flash ROM: |
following commands to write it to Flash ROM: |
|
|
=> |
<pre> |
Un-Protected 9 sectors |
=> <strong>protect off fffe0000 +20000</strong> |
=> |
Un-Protected 9 sectors |
|
=> <strong>erase fffe0000 +20000</strong> |
Flash erase: first = 62 @ 0xfffe0000 |
|
last = 70 @ 0xffffe000 |
Flash erase: first = 62 @ 0xfffe0000 |
Flash erase: Done |
last = 70 @ 0xffffe000 |
Erased 9 sectors |
Flash erase: Done |
=> |
Erased 9 sectors |
=> |
=> <strong>mw.b 1000000 ff 20000</strong> |
Using COMET#0 device |
=> <strong>tftp 1000000 altboot.bin</strong> |
TFTP from server 192.168.0.5; our IP address is 192.168.0.102 |
Using COMET#0 device |
Filename 'altboot.bin'. |
TFTP from server 192.168.0.5; our IP address is 192.168.0.102 |
Load address: 0x1000000 |
Filename 'altboot.bin'. |
Loading: ############## |
Load address: 0x1000000 |
done |
Loading: ############## |
Bytes transferred = 70844 (114bc hex) |
done |
=> |
Bytes transferred = 70844 (114bc hex) |
Copy to Flash... done |
=> <strong>cp.b 1000000 fffe0000 20000</strong> |
=> |
Copy to Flash... done |
Total of 131072 bytes were the same |
=> <strong>cmp.b 1000000 fffe0000 20000</strong> |
=> |
Total of 131072 bytes were the same |
Protected 9 sectors |
=> <strong>protect on fffe0000 +20000</strong> |
=> |
Protected 9 sectors |
|
=> <strong>reset</strong> |
|
</pre> |
|
|
Finally adapt the `bootcmd` environment string to autoboot `altboot` and |
Finally adapt the `bootcmd` environment string to autoboot `altboot` and |
start the `netbsd` kernel (which is the default name) from `wd0` on each |
start the `netbsd` kernel (which is the default name) from `wd0` on each |
reboot: |
reboot: |
|
|
=> |
<pre> |
=> |
=> <strong>setenv bootcmd cp.b fffe0000 1000000 20000\; go 1000000 wd0:netbsd</strong> |
=> |
=> <strong>setenv bootdelay 3</strong> |
|
=> <strong>saveenv</strong> |
|
</pre> |
|
|
The `\` is important for `setenv` not to misinterpret the `;` as the end |
The `\` is important for **setenv** not to misinterpret the `;` as the end |
of the command. |
of the command. |
|
|
Have fun with your mini NetBSD server! |
Have fun with your mini NetBSD server! |