まっさらにする

LS-WSGL/R1

セキュリティホールをまっさらな状態から確認してみる。
今度は LS-WSGL 。どんどんややこしくなる。

まっさらな状態にするには

まっさらな状態にするには、
パーティションを削除して
tftpboot して、
ファームウェアアップデート
する。

uImage.buffalo, uboot.buffalo の吸出し

まずは、tftpboot するために、標準ファームの HDD を tftp サーバである旧型 LS-GL に接続し、 標準ファームの HDD の /boot にある uImage.buffalo, uboot.buffalo を 旧型 LS-GL の /srv/tftp に置く。

標準ファームの HDD を USB で旧型 LS-GL に接続

ude:~# tail -f /var/log/messages
	:
	:
Mar 25 20:34:57 ude kernel: usb 2-1: new high speed USB device using ehci_platform and address 2
Mar 25 20:34:57 ude kernel: usb 2-1: configuration #1 chosen from 1 choice
Mar 25 20:34:57 ude kernel: scsi2 : SCSI emulation for USB Mass Storage devices
Mar 25 20:35:02 ude kernel:  Vendor: Maxtor 6  Model: 026G              Rev: 1G20
Mar 25 20:35:02 ude kernel:  Type:   Direct-Access                      ANSI SCSI revision: 02
Mar 25 20:35:02 ude kernel: SCSI device sdb: 398297088 512-byte hdwr sectors (203928 MB)
Mar 25 20:35:02 ude kernel: sdb: Write Protect is off
Mar 25 20:35:02 ude kernel: SCSI device sdb: 398297088 512-byte hdwr sectors (203928 MB)
Mar 25 20:35:02 ude kernel: sdb: Write Protect is off
Mar 25 20:35:02 ude kernel: sdb: sdb1 sdb2 sdb4 < sdb5 sdb6 >
Mar 25 20:35:02 ude kernel: sd 2:0:0:0: Attached scsi disk sdb
Mar 25 20:35:02 ude kernel: sd 2:0:0:0: Attached scsi generic sg1 type 0
正常に、sdb と認識された。
なんで、LS-WSGL なのに、3.5 インチの Maxtor 6 026G やの? という突っ込み禁止。
標準ファームのまま温存するには高すぎる 2.5 インチ HDD。

マウント

/tmp/boot にマウント
ude:~# mkdir /tmp/boot
ude:~# mount /dev/sdb1 /tmp/boot
mount: unknown filesystem type 'mdraid'
ude:~#
んがー。
仕方がない。標準ファームで起動して、ftp の方法にする。

標準ファームにログイン


BUFFALO INC. LinkStation series
LS-WSGL678 login: root
root@LS-WSGL678:~#

ftp put

root@LS-WSGL678:~# ftp ude.yamasita.jp
sh: ftp: command not found
root@LS-WSGL678:~#
ふんがー。ftp コマンドがない。
root@LS-WSGL678:~# ps
  PID  Uid     VmSize Stat Command
    1 root        576 S   init
    2 root            SWN [ksoftirqd/0]
	:
	:
 2078 nobody     1080 S   proftpd: (accepting connections)
	:
	:
root@LS-WSGL678:~#
proftpd が動いているので、LS-GL から ftp すればよい?

ftp get

LS-GL から ftp get する。
Debian GNU/Linux 5.0
ude login: yasunari
Password:
Last login: Wed Mar 25 20:34:13 JST 2009 from uxl.yamasita.jp on pts/0
Linux ude 2.6.16.16-arm1 #37 Tue May 20 10:01:57 JST 2008 armv5tejl

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
yasunari@ude:~$ cd /srv/tftp/
yasunari@ude:/srv/tftp$ mkdir LS-WSGL_1.06
yasunari@ude:/srv/tftp$ cd !$
cd LS-WSGL_1.06
yasunari@ude:/srv/tftp/LS-WSGL_1.06$ ftp mini.yamasita.jp
Connected to mini.yamasita.jp.
220 192.168.2.45 FTP server ready
Name (mini.yamasita.jp:yasunari): root
331 Password required for root.
Password:
530 Login incorrect.
Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> quit
221 Goodbye.
yasunari@ude:/srv/tftp/LS-WSGL_1.06$ ftp mini.yamasita.jp
Connected to mini.yamasita.jp.
220 192.168.2.45 FTP server ready
Name (mini.yamasita.jp:yasunari): admin
331 Password required for admin.
Password:
230 User admin logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd /boot
550 /boot: No such file or directory
ftp> ls /
200 PORT command successful
150 Opening ASCII mode data connection for file list
drwxrwxrwx   5 root     root           49 Dec  4 21:47 disk1
drwxr-xr-x   2 root     root            6 Nov 10 13:37 disk2
drwxr-xr-x   4 root     root           35 Nov 10 13:37 info
226 Transfer complete.
ftp>
/boot が見えない。
とりあえずコピー。
root@LS-WSGL678:~# (cd / ; tar cf - boot)|(cd /mnt; tar xvf -)
boot/
boot/initrd.buffalo
tar: boot/initrd.buffalo: time stamp 2008-11-10 13:34:40 is 32448401.924467 s in the future
boot/uImage.buffalo
tar: boot/uImage.buffalo: time stamp 2008-11-28 22:35:13 is 34036034.832595 s in the future
boot/initrd.gz
tar: boot/initrd.gz: time stamp 2008-03-02 08:43:58 is 10571759.543814 s in the future
boot/conf_save.tgz
tar: boot/conf_save.tgz: time stamp 2009-02-27 16:24:41 is 41876202.537212 s in the future
boot/hddrootfs.buffalo.updated.done
tar: boot/hddrootfs.buffalo.updated.done: time stamp 2008-11-10 13:39:15 is 32448665.765992 s in the future
boot/conf_save.tgz.orig
tar: boot/conf_save.tgz.orig: time stamp 2007-11-01 00:44:45 is 2195.742648 s in the future
boot/initrd.buffalo.orig
tar: boot/initrd.buffalo.orig: time stamp 2008-07-22 16:23:07 is 22868096.98422 s in the future
boot/lost+found/
boot/u-boot.buffalo
tar: boot/u-boot.buffalo: time stamp 2008-11-28 22:35:10 is 34036019.87637 s in the future
root@LS-WSGL678:~#
これで get できる?
ftp> ls
200 PORT command successful
150 Opening ASCII mode data connection for file list
drwxr-xr-x   3 root     root         4096 Nov  1 00:00 boot
drwxrwxrwx   5 root     root           49 Dec  4 21:47 disk1
drwxr-xr-x   2 root     root            6 Nov 10 13:37 disk2
drwxr-xr-x   4 root     root           35 Nov 10 13:37 info
226 Transfer complete.
ftp> cd boot
250 CWD command successful
ftp> ls
200 PORT command successful
150 Opening ASCII mode data connection for file list
-rw-r--r--   1 root     root        25007 Feb 27 16:24 conf_save.tgz
-rw-r--r--   1 root     root        23832 Nov  1 00:44 conf_save.tgz.orig
-rw-r--r--   1 root     root     110310320 Nov 10 13:39 hddrootfs.buffalo.updated.done
-rw-r--r--   1 root     root      5697905 Nov 10 13:34 initrd.buffalo
-rw-r--r--   1 root     root      5622690 Jul 22 16:23 initrd.buffalo.orig
-rw-r--r--   1 root     root      5596070 Mar  2 08:43 initrd.gz
drwxr-xr-x   2 root     root            6 Nov  1 00:07 lost+found
-rw-r--r--   1 root     root       245776 Nov 28 22:35 u-boot.buffalo
-rw-r--r--   1 root     root      1757604 Nov 28 22:35 uImage.buffalo
226 Transfer complete.
ftp> bin
200 Type set to I
ftp> hash
Hash mark printing on (1024 bytes/hash mark).
ftp> get initrd.buffalo
local: initrd.buffalo remote: initrd.buffalo
200 PORT command successful
150 Opening BINARY mode data connection for initrd.buffalo (5697905 bytes)
############################################(略)
226 Transfer complete.
5697905 bytes received in 0.80 secs (6919.1 kB/s)
ftp> get uImage.buffalo
local: uImage.buffalo remote: uImage.buffalo
200 PORT command successful
150 Opening BINARY mode data connection for uImage.buffalo (1757604 bytes)
############################################(略)
226 Transfer complete.
1757604 bytes received in 0.23 secs (7356.5 kB/s)
ftp> bye
221 Goodbye.
yasunari@ude:/srv/tftp/LS-WSGL_1.06$

tftp サーバの準備

tftp サーバである旧型 LS-GL で tftpboot できるよう準備する。

モードの確認

yasunari@ude:/srv/tftp/LS-WSGL_1.06$ ls -l
total 7288
-rw-r--r-- 1 yasunari root 5697905 Mar 25 21:04 initrd.buffalo
-rw-r--r-- 1 yasunari root 1757604 Mar 25 21:04 uImage.buffalo
yasunari@ude:/srv/tftp/LS-WSGL_1.06$
特に問題なく読めそうだ。

リンク

LS-WSGL 用にリンクを張りなおす。
yasunari@ude:/srv/tftp/LS-WSGL_1.06$ cd ..
yasunari@ude:/srv/tftp$ ls -l
total 8952
drwxr-s--- 2 yasunari root      48 Mar 22 10:12 HS-DHGL_1.20
drwxrwxr-x 2 root     root      48 Jan 24 09:31 LS-CL+HackKit
drwxr-sr-x 2 root     root      48 Mar 23 17:44 LS-CL_1.07
drwxrwxr-x 2 yasunari root      48 Mar 20 14:32 LS-GL_1.15
drwxr-sr-x 2 root     root      48 Mar 23 14:22 LS-HGL_1.07b
drwxr-sr-x 2 root     root      48 Mar 23 13:31 LS-LGL_2.01
drwxrwxr-x 2 root     root      48 Feb 20 12:00 LS-QL_1.05+telnet
drwxr-sr-x 2 yasunari root      48 Mar 25 21:04 LS-WSGL_1.06
drwxrwxr-x 2 root     root      48 Jan 24 18:00 LS-XHL_1.02
drwxrwxr-x 2 root     root      64 Jan 24 22:17 LS-XHL_1.02+telnet
-rw-r--r-- 2 root     root 7048817 Feb 23 17:14 initrd.buffalo
-rw-r--r-- 2 root     root 2115636 Mar 15 11:37 uImage.buffalo
yasunari@ude:/srv/tftp$ rm initrd.buffalo uImage.buffalo
rm: remove write-protected regular file `initrd.buffalo'? y
rm: remove write-protected regular file `uImage.buffalo'? y
yasunari@ude:/srv/tftp$ ln LS-WSGL_1.06/* .
yasunari@ude:/srv/tftp$ ls -l
total 7288
drwxr-s--- 2 yasunari root      48 Mar 22 10:12 HS-DHGL_1.20
drwxrwxr-x 2 root     root      48 Jan 24 09:31 LS-CL+HackKit
drwxr-sr-x 2 root     root      48 Mar 23 17:44 LS-CL_1.07
drwxrwxr-x 2 yasunari root      48 Mar 20 14:32 LS-GL_1.15
drwxr-sr-x 2 root     root      48 Mar 23 14:22 LS-HGL_1.07b
drwxr-sr-x 2 root     root      48 Mar 23 13:31 LS-LGL_2.01
drwxrwxr-x 2 root     root      48 Feb 20 12:00 LS-QL_1.05+telnet
drwxr-sr-x 2 yasunari root      48 Mar 25 21:04 LS-WSGL_1.06
drwxrwxr-x 2 root     root      48 Jan 24 18:00 LS-XHL_1.02
drwxrwxr-x 2 root     root      64 Jan 24 22:17 LS-XHL_1.02+telnet
-rw-r--r-- 2 yasunari root 5697905 Mar 25 21:04 initrd.buffalo
-rw-r--r-- 2 yasunari root 1757604 Mar 25 21:04 uImage.buffalo
yasunari@ude:/srv/tftp$

まっさらな HDD の用意

実験用 HDD として、今回も MAXTOR DiamondMax Plus 9 160GB を使う。
って、一個だけかい。

USB で接続

旧形 LS-GL に USB で接続

パーティションの削除

取り外し

USB ケーブルを抜き、HDD への電源を絶つ。

まっさらな HDD の接続

パーティションを削除した MAXTOR DiamondMax Plus 9 160GB を LS-WSGL の SATA2 にセットする。

tftpboot

LS-WSGL に AC アダプタを刺す。
Orion1   CPU =  Low

Checking DATA BUS
Checking ADDRESS BUS

> Checking hardware info ...
=== Strap status : 0x00802030 ===
=== H/W boardId  :       0x33 ===
=== boardId      :       0x1a ===
=== micon_support:        off ===
> OK.
=== BUFFALO LS-WSGL/R1 U-Boot. ===
 ** LOADER **
 ** BUFFALO BOARD: BUFFALO_BOARD_LS_WSGL/R1 LE (CFG_ENV_ADDR=fffff000)


U-Boot 1.1.1 (Oct 22 2008 - 20:00:59) Marvell version: 1.12.1 - TINY
Buffalo Version: 1.23-1.00

DRAM CS[0] base 0x00000000   size 128MB
DRAM Total size 128MB
[256kB@fffc0000] Flash: 256 kB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done

Soc: 88F5182 A2
CPU: ARM926 (Rev 0) running @ 400Mhz
Orion 1 streaming disabled
SysClock = 200Mhz , TClock = 166Mhz


USB 0: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Using 88E1118 phy
buffalo_change_power_status > Read 0x5c
buffalo_IsStopAtUbootStatus > MagicKey=0x5c
buffalo_change_power_status > Read 0x5c
buffalo_change_power_status > Read 0x5c
buffalo_change_power_status > Writing 0x5c

Please Press HDD power button to continue ...
buffalo_change_power_status > Read 0x5c
buffalo_change_power_status > Writing 0x3a

Marvell Serial ATA Adapter
Integrated Sata device found
  Device 0: OK
Model: Maxtor 6Y160M0                           Firm: YAR51HW0 Ser#: Y48CANLE   
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 156334.5 MB = 152.6 GB (320173056 x 512)

Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 1
Lost all init_rd
func SW を押す。
func switch pushed, and exited loop
wait until func switch released.

Marvell Serial ATA Adapter
Integrated Sata device found
  Device 0: OK
Model: Maxtor 6Y160M0                           Firm: YAR51HW0 Ser#: Y48CANLE   
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 156334.5 MB = 152.6 GB (320173056 x 512)

Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 1
hit any key to switch tftp boot.
Hit any key to stop autoboot:  0
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.150
Filename 'uImage.buffalo'.
Load address: 0x100000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###################
done
Bytes transferred = 1757604 (1ad1a4 hex)
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.150
Filename 'initrd.buffalo'.
Load address: 0x800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########
done
Bytes transferred = 5697905 (56f171 hex)
## Booting image at 00100000 ...
   Image Name:   Linux-2.6.16.16-arm1
   Created:      2008-11-10   4:33:33 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1757540 Bytes =  1.7 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 00800000 ...
   Image Name:   initrd
   Created:      2008-11-10   4:34:40 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    5697841 Bytes =  5.4 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK

Starting kernel ...

arg:console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,15M panic=5 BOOTVER=1.23 tftpboot=yes
CONFIG_BUFFALO_PLATFORM CONFIG_BUFFALO_LINKSTATION_LSWSGL_R1 ---
Uncompressing Linux................................................................................................................... done, booting the kernel.
Linux version 2.6.16.16-arm1 (root@build.dd-hot24.nas.buffalo.local) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-2)) #383 Mon Nov 10 13:33:20 JST 2008
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 200000000, Tclk = 166664740


- Warning - This LSP release was tested only with U-Boot release 1.7.3

Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,15M panic=5 BOOTVER=1.23 tftpboot=yes
PID hash table entries: 1024 (order: 10, 16384 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 128MB 0MB 0MB 0MB = 128MB total
Memory: 110620KB available (2992K code, 553K data, 112K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 15360K
NET: Registered protocol family 16
FLASH boardId = 19
Flash bankwidth 1, base ff800000, size 40000
BUFFALO LS_WSGL_R1 FLASH size 256[KB]

  Marvell Development Board (LSP Version 1.7.8_NAS)-- BUFFALO_BOARD_LS_WSGL_R1

 Detected Tclk 166664740 and SysClk 200000000
Marvell USB EHCI Host controller #0: c16f5e00
Marvell USB EHCI Host controller #1: c16f5c00
pexBarOverlapDetect: winNum 2 overlap current 0
mvPexInit:Warning :Bar 2 size is illigal
it will be disabled
please check Pex and CPU windows configuration
PCI: bus0: Fast back to back transfers enabled
PCI: bus1: Fast back to back transfers enabled
SCSI subsystem initialized
use IDMA acceleration in copy to/from user buffers. used channels 2 and 3
Done.
cesadev_init(c0011c44)
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
SGI XFS with large block numbers, no debug enabled
Initializing Cryptographic API
io scheduler noop registered (default)
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
serial8250: ttyS1 at MMIO 0x0 (irq = 4) is a 16550A
RAMDISK driver initialized: 3 RAM disks of 16384K size 1024 blocksize
loop: loaded (max 8 devices)
Marvell Gigabit Ethernet Driver 'egiga':
  o Ethernet descriptors in DRAM
  o DRAM SW cache-coherency
  o Checksum offload enabled
  o Loading network interface ** egiga_init_module (0)
'eth0'
Intergrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
** BUFFALO Disable Command Queuing Function [0 0] **
  Vendor: Maxtor    Model: 6Y160M0           Rev: YAR5
  Type:   Direct-Access                      ANSI SCSI revision: 03
Linux IAL (ERROR) : retry command host=0, bus=0 SCpnt = c1433ba0
SCSI device sda: 320173056 512-byte hdwr sectors (163929 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back
SCSI device sda: 320173056 512-byte hdwr sectors (163929 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back
 sda:
sd 0:0:0:0: Attached scsi disk sda
sd 0:0:0:0: Attached scsi generic sg0 type 0
physmap flash device: 40000 at ff800000
>jedec_probe
Found: SST 39LF020
phys_mapped_flash: Found 1 x8 devices at 0x0 in 8-bit bank
number of JEDEC chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
cmdlinepart partition parsing not available
RedBoot partition parsing not available
mice: PS/2 mouse device common for all mice
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: md driver 0.90.3 MAX_MD_DEVS=256, MD_SB_DISKS=27
md: bitmap version 4.39
Kernel event proc (C) BUFFALO INC. V.1.00 installed.
MICON ctrl (C) BUFFALO INC. V.1.00 installed.
mvGppValueSet: Err. An attempt to set output value to GPP 15 in input mode.
Buffalo CPU Inerupts Driver (C) BUFFALO INC. Ver.0.01 alpha1 installed.
mvGppValueSet: Err. An attempt to set output value to GPP 2 in input mode.
Buffalo Gpio Control Driver (C) BUFFALO INC. Ver.0.02 installed.
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 3, 32768 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
RAMDISK: Compressed image found at block 0
VFS: Mounted root (ext2 filesystem).
---- in linuxrc ---
Thu Nov  1 00:16:17 JST 2007
CheckDevices
linuxrc:choose operation (timeout 4[s])
 1:RamRoot other:HddRoot  ? -HddRoot-
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk1_1: No such device or address
mdadm: cannot open /dev/disk1_2: No such device or address
mdadm: cannot open /dev/disk1_5: No such device or address
mdadm: No arrays found in config file
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
Starting :fsck_disks(boot) ...         [Failed. ]
Starting :fsck_disks(rootfs) ...       [Success.]
Starting :mount(boot) ...              [Failed. ]
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk1_1: No such device or address
mdadm: cannot open /dev/disk1_2: No such device or address
mdadm: cannot open /dev/disk1_5: No such device or address
mdadm: No arrays found in config file
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
/sys/block/md1/md/maxerr_cnt is setted to -1
/sys/block/md10/md/maxerr_cnt is setted to -1
/etc/init.d/startSysMd.sh: /etc/init.d/startSysMd.sh: 23: cannot create /sys/block/md10/md/maxerr_cnt: Directory nonexistent
/dev/md1: Invalid argument
mount: you must specify the filesystem type
/dev/md1: Invalid argument
mount: you must specify the filesystem type
md: md0 stopped.
mdadm: stopped /md: md1 stopped.
dev/md0
mdadm: stopped /md: md10 stopped.
dev/md1
mdadm: stopped /dev/md10
Freeing init memory: 112K
init started:  BusyBox v1.1.1 (2008.11.04-08:25+0000) multi-call binary
Starting pid 462, console /dev/ttyS0: '/etc/init.d/rcS'
--- rcStart (initrd) ---
chmod: /home: No such file or directory
Unable to find swap-space signature
swapon: /dev/md10: Invalid argument
create dir : /home
create dir : /var/www
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk1_1: No such device or address
mdadm: cannot open /dev/disk1_2: No such device or address
mdadm: cannot open /dev/disk1_5: No such device or address
mdadm: No arrays found in config file
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
/sys/block/md1/md/maxerr_cnt is setted to -1
/sys/block/md10/md/maxerr_cnt is setted to -1
umount: /boot: not mounted
mkdir: Cannot create directory `/boot': File exists
/dev/md0: Invalid argument
mount: you must specify the filesystem type
md: md0 stopped.
mdadm: stopped /md: md1 stopped.
dev/md0
md: md10 stopped.
mdadm: stopped /dev/md1
mdadm: stopped /dev/md10
configure files from Buffalo parameters.
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk1_1: No such device or address
mdadm: cannot open /dev/disk1_2: No such device or address
mdadm: cannot open /dev/disk1_5: No such device or address
mdadm: No arrays found in config file
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
/dev/md0: Invalid argument
mount: you must specify the filesystem type
Restore previous configuration files
/bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory
/bin/tar: Error is not recoverable: exiting now
/bin/tar: Child returned status 2
/bin/tar: Error exit delayed from previous errors
/bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory
/bin/tar: Error is not recoverable: exiting now
/bin/tar: Child returned status 2
/bin/tar: Error exit delayed from previous errors
unzip  fail.
umount: /boot: not mounted
rootfs on / type rootfs (rw)
/dev/root.old on / type ext2 (rw,nogrpid)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw)
/dev/ram1 on /mnt/ram type tmpfs (rw)
  PID  Uid     VmSize Stat Command
    1 root        576 S   init
    2 root            SWN [ksoftirqd/0]
    3 root            SW< [events/0]
    4 root            SW< [khelper]
    5 root            SW< [kthread]
   11 root            SW< [kblockd/0]
   38 root            SW  [pdflush]
   39 root            SW  [pdflush]
   41 root            SW< [aio/0]
   40 root            SW  [kswapd0]
   42 root            SW< [xfslogd/0]
   43 root      md: md0 stopped.
      SW< [xfsdamd: md1 stopped.
tad/0]
   44 romd: md10 stopped.
ot            SW  [crypto]
   45 root            SW  [crypto_ret]
  168 root            SW< [scsi_eh_0]
  169 root            SW< [scsi_eh_1]
  178 root            SW  [mtdblockd]
  461 root        236 S   init
  462 root        672 S   /bin/sh /etc/init.d/rcS
  861 root        760 R   /bin/sh /etc/init.d/restore_config.sh start
  900 root        800 R   ps
mdadm: stopped /dev/md0
mdadm: stopped /dev/md1
mdadm: stopped /dev/md10
create network files..
IP=[dhcp], netmask=[], dgw=[], dns1=[], dns2=[]
killall: dhcpcd: no process killed
route: SIOC[ADD|DEL]RT: No such process
Configuration network interface: lo eth0
requesting DHCP  tout=30[s]
networking.sh: dhcp requesting...
DontDownIface
alwaysFork
eth0: link down
eth0: link up<5>, full duplex<5>, speed 1 Gbps<5>
sendto:  count 6   sync 1
sendto:  count 5   sync 0
sendto:  count 6   sync 0
dhcpcd.exe: interface eth0 has been configured with new IP=192.168.2.45 GATEWAY=192.168.2.1
** networking.sh dhcp fin.
configure files from Buffalo parameters.
Starting kernelmon:Starting clientUtil_server:starting on eth0
Starting daemonwatch:daemonwatch Ver.1.01
watch list file : /etc/daemonwatch.list
KERNELMOn (lanact 0 half)
usbcore: registered new driver usbfs
usbcore: registered new driver hub
ehci_platform ehci_platform.4523: EHCI Platform Host Controller
ehci_platform ehci_platform.4523: new USB bus registered, assigned bus number 1
ehci_platform ehci_platform.4523: irq 17, io mem 0x00000000
ehci_platform ehci_platform.4523: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ehci_platform ehci_platform.16781: EHCI Platform Host Controller
ehci_platform ehci_platform.16781: new USB bus registered, assigned bus number 2
ehci_platform ehci_platform.16781: irq 12, io mem 0x00000000
ehci_platform ehci_platform.16781: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
KERNELMOn (lanact 1000 full)
No need to run drivecheck.sh
/etc/init.d/bootcomplete.sh: /etc/init.d/bootcomplete.sh: 51: /usr/local/bin/sendmail.sh: not found
**** request DHCP
Starting pid 1239, console /dev/ttyS0: '/sbin/getty'

BUFFALO INC. LinkStation series
LS-WSGL-EM678 login: BuffaloSwPollingCheck> SW_POWER_ON
PING 192.168.2.39 (192.168.2.39): 56 data bytes
                                               84 bytes from 192.168.2.39: icmp_seq=0 ttl=64 time=10.3 ms
                         KERNELMOn (PSW_on)
                                           84 bytes from 192.168.2.39: icmp_seq=1 ttl=64 time=0.2 ms
                    84 bytes from 192.168.2.39: icmp_seq=2 ttl=64 time=0.2 ms
                                                                             84 bytes from 192.168.2.39: icmp_seq=3 ttl=64 time=0.2 ms
                                                      84 bytes from 192.168.2.39: icmp_seq=4 ttl=64 time=0.2 ms

                               --- 192.168.2.39 ping statistics ---
                                                                   5 packets transmitted, 5 packets received, 0% packet loss
                                            round-trip min/avg/max = 0.2/2.2/10.3 ms
    **** update DHCP IP

ファームウェアアップデータの実行

lswsgl-106.exe を実行し、
表示されたページにリンクされている LSUpdater.exe を実行、
LS-WSGL-EM678 が見つかるので、「ファームウェア更新」を実行する。
「HDD のパーティション情報が確認できませんでした・・」には「はい」
「フォーマットに失敗しました(ACP_STATE_FAILURE)
アップデートを中止します。
と。

HDD がひとつだとだめなのか?
それとも LS-WSGL はもともとだめなのか?

もうひとつまっさらな HDD の用意

仕方がないので、買ったときについてきた 2.5 インチ HDD、 WD2500 をひとつ使う。
もうひとつは温存。

USB で接続

旧形 LS-GL に USB で接続

パーティションの削除

取り外し

USB ケーブルを抜き、HDD への電源を絶つ。

まっさらな HDD の接続

パーティションを削除した MAXTOR DiamondMax Plus 9 160GB を LS-WSGL の SATA2 に
パーティションを削除した WD WD2500 を LS-WSGL の SATA1 に
セットする。

tftpboot

LS-WSGL に AC アダプタを刺す。
Orion1   CPU =  Low

Checking DATA BUS
Checking ADDRESS BUS

> Checking hardware info ...
=== Strap status : 0x00802030 ===
=== H/W boardId  :       0x33 ===
=== boardId      :       0x1a ===
=== micon_support:        off ===
> OK.
=== BUFFALO LS-WSGL/R1 U-Boot. ===
 ** LOADER **
 ** BUFFALO BOARD: BUFFALO_BOARD_LS_WSGL/R1 LE (CFG_ENV_ADDR=fffff000)


U-Boot 1.1.1 (Oct 22 2008 - 20:00:59) Marvell version: 1.12.1 - TINY
Buffalo Version: 1.23-1.00

DRAM CS[0] base 0x00000000   size 128MB
DRAM Total size 128MB
[256kB@fffc0000] Flash: 256 kB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done

Soc: 88F5182 A2
CPU: ARM926 (Rev 0) running @ 400Mhz
Orion 1 streaming disabled
SysClock = 200Mhz , TClock = 166Mhz


USB 0: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Using 88E1118 phy
buffalo_change_power_status > Read 0x00
buffalo_IsStopAtUbootStatus > MagicKey=0x00
buffalo_change_power_status > Read 0x00
buffalo_change_power_status > Read 0x00
buffalo_change_power_status > Writing 0x5c

Please Press HDD power button to continue ...
電源 SW を ON にする。
buffalo_change_power_status > Read 0x5c
buffalo_change_power_status > Writing 0x3a

Marvell Serial ATA Adapter
Integrated Sata device found
  Device 0: OK
Model: Maxtor 6Y160M0                           Firm: YAR51HW0 Ser#: Y48CANLE   
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 156334.5 MB = 152.6 GB (320173056 x 512)
  Device 1: OK
Model: WDC WD2500BEVS-00UST0                    Firm: 01.01A01 Ser#:      WD-WXE508EV3494
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 238475.1 MB = 232.8 GB (488397168 x 512)

Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 1
Lost all init_rd
func SW を押す
func switch pushed, and exited loop
wait until func switch released.

Marvell Serial ATA Adapter
Integrated Sata device found
  Device 0: OK
Model: Maxtor 6Y160M0                           Firm: YAR51HW0 Ser#: Y48CANLE   
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 156334.5 MB = 152.6 GB (320173056 x 512)
  Device 1: OK
Model: WDC WD2500BEVS-00UST0                    Firm: 01.01A01 Ser#:      WD-WXE508EV3494
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 238475.1 MB = 232.8 GB (488397168 x 512)

Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 1
hit any key to switch tftp boot.
Hit any key to stop autoboot:  0
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.150
Filename 'uImage.buffalo'.
Load address: 0x100000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###################
done
Bytes transferred = 1757604 (1ad1a4 hex)
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.150
Filename 'initrd.buffalo'.
Load address: 0x800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########
done
Bytes transferred = 5697905 (56f171 hex)
## Booting image at 00100000 ...
   Image Name:   Linux-2.6.16.16-arm1
   Created:      2008-11-10   4:33:33 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1757540 Bytes =  1.7 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 00800000 ...
   Image Name:   initrd
   Created:      2008-11-10   4:34:40 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    5697841 Bytes =  5.4 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK

Starting kernel ...

arg:console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,15M panic=5 BOOTVER=1.23 tftpboot=yes
CONFIG_BUFFALO_PLATFORM CONFIG_BUFFALO_LINKSTATION_LSWSGL_R1 ---
Uncompressing Linux................................................................................................................... done, booting the kernel.
Linux version 2.6.16.16-arm1 (root@build.dd-hot24.nas.buffalo.local) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-2)) #383 Mon Nov 10 13:33:20 JST 2008
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 200000000, Tclk = 166664740


- Warning - This LSP release was tested only with U-Boot release 1.7.3

Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,15M panic=5 BOOTVER=1.23 tftpboot=yes
PID hash table entries: 1024 (order: 10, 16384 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 128MB 0MB 0MB 0MB = 128MB total
Memory: 110620KB available (2992K code, 553K data, 112K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 15360K
NET: Registered protocol family 16
FLASH boardId = 19
Flash bankwidth 1, base ff800000, size 40000
BUFFALO LS_WSGL_R1 FLASH size 256[KB]

  Marvell Development Board (LSP Version 1.7.8_NAS)-- BUFFALO_BOARD_LS_WSGL_R1

 Detected Tclk 166664740 and SysClk 200000000
Marvell USB EHCI Host controller #0: c16f5e00
Marvell USB EHCI Host controller #1: c16f5c00
pexBarOverlapDetect: winNum 2 overlap current 0
mvPexInit:Warning :Bar 2 size is illigal
it will be disabled
please check Pex and CPU windows configuration
PCI: bus0: Fast back to back transfers enabled
PCI: bus1: Fast back to back transfers enabled
SCSI subsystem initialized
use IDMA acceleration in copy to/from user buffers. used channels 2 and 3
Done.
cesadev_init(c0011c44)
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
SGI XFS with large block numbers, no debug enabled
Initializing Cryptographic API
io scheduler noop registered (default)
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
serial8250: ttyS1 at MMIO 0x0 (irq = 4) is a 16550A
RAMDISK driver initialized: 3 RAM disks of 16384K size 1024 blocksize
loop: loaded (max 8 devices)
Marvell Gigabit Ethernet Driver 'egiga':
  o Ethernet descriptors in DRAM
  o DRAM SW cache-coherency
  o Checksum offload enabled
  o Loading network interface ** egiga_init_module (0)
'eth0'
Intergrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
** BUFFALO Disable Command Queuing Function [0 0] **
** BUFFALO Disable Command Queuing Function [0 1] **
  Vendor: Maxtor    Model: 6Y160M0           Rev: YAR5
  Type:   Direct-Access                      ANSI SCSI revision: 03
  Vendor: WDC       Model: WD2500BEVS-00UST  Rev: 01.0
  Type:   Direct-Access                      ANSI SCSI revision: 03
Linux IAL (ERROR) : retry command host=0, bus=0 SCpnt = c1433ba0
SCSI device sda: 320173056 512-byte hdwr sectors (163929 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back
SCSI device sda: 320173056 512-byte hdwr sectors (163929 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back
 sda:
sd 0:0:0:0: Attached scsi disk sda
Linux IAL (ERROR) : retry command host=1, bus=1 SCpnt = c1433ba0
SCSI device sdb: 488397168 512-byte hdwr sectors (250059 MB)
sdb: Write Protect is off
SCSI device sdb: drive cache: write back
SCSI device sdb: 488397168 512-byte hdwr sectors (250059 MB)
sdb: Write Protect is off
SCSI device sdb: drive cache: write back
 sdb:
sd 1:0:0:0: Attached scsi disk sdb
sd 0:0:0:0: Attached scsi generic sg0 type 0
sd 1:0:0:0: Attached scsi generic sg1 type 0
physmap flash device: 40000 at ff800000
>jedec_probe
Found: SST 39LF020
phys_mapped_flash: Found 1 x8 devices at 0x0 in 8-bit bank
number of JEDEC chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
cmdlinepart partition parsing not available
RedBoot partition parsing not available
mice: PS/2 mouse device common for all mice
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
md: md driver 0.90.3 MAX_MD_DEVS=256, MD_SB_DISKS=27
md: bitmap version 4.39
Kernel event proc (C) BUFFALO INC. V.1.00 installed.
MICON ctrl (C) BUFFALO INC. V.1.00 installed.
mvGppValueSet: Err. An attempt to set output value to GPP 15 in input mode.
Buffalo CPU Inerupts Driver (C) BUFFALO INC. Ver.0.01 alpha1 installed.
mvGppValueSet: Err. An attempt to set output value to GPP 2 in input mode.
Buffalo Gpio Control Driver (C) BUFFALO INC. Ver.0.02 installed.
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 3, 32768 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
RAMDISK: Compressed image found at block 0
VFS: Mounted root (ext2 filesystem).
---- in linuxrc ---
Thu Nov  1 00:02:31 JST 2007
CheckDevices
linuxrc:choose operation (timeout 4[s])
 1:RamRoot other:HddRoot  ? -HddRoot-
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk1_1: No such device or address
mdadm: cannot open /dev/disk2_1: No such device or address
mdadm: cannot open /dev/disk1_2: No such device or address
mdadm: cannot open /dev/disk2_2: No such device or address
mdadm: cannot open /dev/disk1_5: No such device or address
mdadm: cannot open /dev/disk2_5: No such device or address
mdadm: No arrays found in config file
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
Starting :fsck_disks(boot) ...         [Failed. ]
Starting :fsck_disks(rootfs) ...       [Success.]
Starting :mount(boot) ...              [Failed. ]
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk1_1: No such device or address
mdadm: cannot open /dev/disk2_1: No such device or address
mdadm: cannot open /dev/disk1_2: No such device or address
mdadm: cannot open /dev/disk2_2: No such device or address
mdadm: cannot open /dev/disk1_5: No such device or address
mdadm: cannot open /dev/disk2_5: No such device or address
mdadm: No arrays found in config file
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
/sys/block/md1/md/maxerr_cnt is setted to -1
/sys/block/md10/md/maxerr_cnt is setted to -1
/etc/init.d/startSysMd.sh: /etc/init.d/startSysMd.sh: 23: cannot create /sys/block/md10/md/maxerr_cnt: Directory nonexistent
/dev/md1: Invalid argument
mount: you must specify the filesystem type
/dev/md1: Invalid argument
mount: you must specify the filesystem type
md: md0 stopped.
mdadm: stopped /md: md1 stopped.
dev/md0
md: md10 stopped.
mdadm: stopped /dev/md1
mdadm: stopped /dev/md10
Freeing init memory: 112K
init started:  BusyBox v1.1.1 (2008.11.04-08:25+0000) multi-call binary
Starting pid 488, console /dev/ttyS0: '/etc/init.d/rcS'
--- rcStart (initrd) ---
chmod: /home: No such file or directory
Unable to find swap-space signature
swapon: /dev/md10: Invalid argument
create dir : /home
create dir : /var/www
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk1_1: No such device or address
mdadm: cannot open /dev/disk2_1: No such device or address
mdadm: cannot open /dev/disk1_2: No such device or address
mdadm: cannot open /dev/disk2_2: No such device or address
mdadm: cannot open /dev/disk1_5: No such device or address
mdadm: cannot open /dev/disk2_5: No such device or address
mdadm: No arrays found in config file
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
/sys/block/md1/md/maxerr_cnt is setted to -1
/sys/block/md10/md/maxerr_cnt is setted to -1
umount: /boot: not mounted
mkdir: Cannot create directory `/boot': File exists
/dev/md0: Invalid argument
mount: you must specify the filesystem type
md: md0 stopped.
mdadm: stopped /md: md1 stopped.
dev/md0
md: md10 stopped.
mdadm: stopped /dev/md1
mdadm: stopped /dev/md10
configure files from Buffalo parameters.
-- rebuild mdadm.conf for BOOT, ROOTFS --
mdadm: cannot open /dev/disk1_1: No such device or address
mdadm: cannot open /dev/disk2_1: No such device or address
mdadm: cannot open /dev/disk1_2: No such device or address
mdadm: cannot open /dev/disk2_2: No such device or address
mdadm: cannot open /dev/disk1_5: No such device or address
mdadm: cannot open /dev/disk2_5: No such device or address
mdadm: No arrays found in config file
-- setup max error counts --
/sys/block/md0/md/maxerr_cnt is setted to -1
/dev/md0: Invalid argument
mount: you must specify the filesystem type
Restore previous configuration files
/bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory
/bin/tar: Error is not recoverable: exiting now
/bin/tar: Child returned status 2
/bin/tar: Error exit delayed from previous errors
/bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory
/bin/tar: Error is not recoverable: exiting now
/bin/tar: Child returned status 2
/bin/tar: Error exit delayed from previous errors
unzip  fail.
umount: /boot: not mounted
rootfs on / type rootfs (rw)
/dev/root.old on / type ext2 (rw,nogrpid)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw)
/dev/ram1 on /mnt/ram type tmpfs (rw)
  PID  Uid     VmSize Stat Command
    1 root        576 S   init
    2 root            SWN [ksoftirqd/0]
    3 root            SW< [events/0]
    4 root            SW< [khelper]
    5 root            SW< [kthread]
   11 root            SW< [kblockd/0]
   38 root            SW  [pdflush]
   39 root            SW  [pdflush]
   41 root            SW< [aio/0]
   42 root            SW< [xfslogd/0]
   43 root            SW< [xfsdatad/0]
   40 root   md: md0 stopped.
         SW  [ksmd: md1 stopped.
wapd0]
   44 romd: md10 stopped.
ot            SW  [crypto]
   45 root            SW  [crypto_ret]
  168 root            SW< [scsi_eh_0]
  169 root            SW< [scsi_eh_1]
  182 root            SW  [mtdblockd]
  487 root        236 S   init
  488 root        672 S   /bin/sh /etc/init.d/rcS
  931 root        764 R   /bin/sh /etc/init.d/restore_config.sh start
  970 root        800 R   ps
mdadm: stopped /dev/md0
mdadm: stopped /dev/md1
mdadm: stopped /dev/md10
create network files..
IP=[dhcp], netmask=[], dgw=[], dns1=[], dns2=[]
killall: dhcpcd: no process killed
route: SIOC[ADD|DEL]RT: No such process
Configuration network interface: lo eth0
requesting DHCP  tout=30[s]
networking.sh: dhcp requesting...
DontDownIface
alwaysFork
eth0: link down
eth0: link up<5>, full duplex<5>, speed 1 Gbps<5>
sendto:  count 6   sync 0
sendto:  count 6   sync 0
sendto:  count 6   sync 0
dhcpcd.exe: interface eth0 has been configured with new IP=192.168.2.45 GATEWAY=192.168.2.1
** networking.sh dhcp fin.
configure files from Buffalo parameters.
Starting kernelmon:Starting clientUtil_server:starting on eth0
Starting daemonwatch:daemonwatch Ver.1.01
watch list file : /etc/daemonwatch.list
KERNELMOn (lanact 0 half)
usbcore: registered new driver usbfs
usbcore: registered new driver hub
ehci_platform ehci_platform.4523: EHCI Platform Host Controller
ehci_platform ehci_platform.4523: new USB bus registered, assigned bus number 1
ehci_platform ehci_platform.4523: irq 17, io mem 0x00000000
ehci_platform ehci_platform.4523: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ehci_platform ehci_platform.16781: EHCI Platform Host Controller
ehci_platform ehci_platform.16781: new USB bus registered, assigned bus number 2
ehci_platform ehci_platform.16781: irq 12, io mem 0x00000000
ehci_platform ehci_platform.16781: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
KERNELMOn (lanact 1000 full)
No need to run drivecheck.sh
/etc/init.d/bootcomplete.sh: /etc/init.d/bootcomplete.sh: 51: /usr/local/bin/sendmail.sh: not found
**** request DHCP
Starting pid 1309, console /dev/ttyS0: '/sbin/getty'

BUFFALO INC. LinkStation series
LS-WSGL-EM678 login:

ファームウェアアップデータの実行

lswsgl-106.exe を実行した時に作られた C:\Documents and Settings\yasunari\デスクトップ\LS-WSGL FW Ver.1.06\LS_WSGL_Fw1.06 にある LSUpdater.exe を実行。
LS-WSGL-EM678 が見つかるので、「ファームウェア更新」を実行する。
「HDD のパーティション情報が確認できませんでした・・」には「はい」
今度は、ドライブのフォーマットが始まった。

しばらくして、 今度は「LS-WSGL/R1 のアップデートは完了しました」となった。

セキュリティホールの確認

クラックを試みたが、LS-WSGL ファームウェア 1.06 に 当該セキュリティホールはない

'09/5/6 追記
LS-WSGL ファームウェア 1.06 には セキュリティホールが存在します。



LinkStation Mini
LS-WSGL
バッファローダイレクト
楽天市場
Amazon
Yahoo!ショッピング
Livedoor デパート
Sofmap
ムラウチドットコム
ヤマダ電機WEB
パソQ


まっさらにする
ハックの記録
LinkStation/玄箱 をハックしよう

まっさらにする

Copyright (C) 2003-2009 Yasunari Yamashita. All Rights Reserved.
yasunari @ yamasita.jp 山下康成@京都府向日市