Maxtor factory firmware

On this page…

Extracting the firmware
Source code
Misc commands
1. 3.1 Timezone
2. 3.2 Telnet
Hidden commands not available in the web gui
NFS on the MSS
Boot messages

Extracting the firmware

Linux kernel:

 dd if=mss_v_1_2_0.bin of=part1 bs=1 skip=173 count=1151805

Mini root fs (cramfs):

 dd if=mss_v_1_2_0.bin of=part2 bs=1 skip=1151981 count=466112

Main root fs (cramfs):

 dd if=mss_v_1_2_0.bin of=part3 bs=1 skip=1618093

On the MSS itself, you can extract the cramfs from the disk via this command:

 dd if=/dev/ide/host2/bus0/target0/lun0/part1 of=part1

There are actually two partitions containing the cramfs on the MSS. Partition 1 contains the newest firmware, partition 2 contains the previous firmware. I have _not_ upgraded my MSS after I got it it, even thought there are two different firmwares on it :) Firmware 1.2.0 on partition 1 and firmware 1.1.6 on partition 2.

You can select the order to boot these partitions by modifying the following nvram parameters:

 pivot_root_current=1
 pivot_partition_size=8192
 pivot_root_1=/dev/ide/host2/bus0/target0/lun0/part1
 pivot_root_2=/dev/ide/host2/bus0/target0/lun0/part2

More in deep info about the firmware format can be found at the Firmware extract page

Source code

Update: Firmware is now released. It is not on the web pages of Maxtor yet. Maxtor allowed me to publish the url on my pages. The address is ftp://ftpdownload.maxtor.com/pub/. The source code does seem to be stripped down and does not include all the original files from Broadcom. More info will come later when I have been able to take a more deeper look into the files.

Other info:

 - CFE bootloader. Code can be downloaded from Broadcom
   The source for CFE does not seem to contain all the necessary code for our Chipset thought.
 - Toolchain to compile for this CPU can be used from the LinkSys WRT54GS

Misc commands

Timezone

The timezone webpage does not work. It reverts back to US format when changing to Europe. By typing these commands from the console and reboot the MSS, I was able to change the timezone correctly:

 # nvram set time_zone=CET-1CETDST
 # nvram commit
 # ntpclient -h 129.240.12.4 -s
 # reboot

The clock seems to be backed up by the battery you see on the backside of the circuit board.

Telnet

Telnet daemon can be started from console by typing

 # utelnetd &

To have telnet running permanent on boot, you can enable it by replacing the current running firmware. For more information about replacement firmware, please look in the forum.

Information about replacing a cramfs image on the harddrive manualy: Make sure that the rest of the system is also running 1.2.0 before you do this. The image can be found here: mss1_2_0_telnet.cramfs

- Get current running partition:

 nvram get pivot_root_current

- Write the mss1_2_0_telnet.cramfs image to the other partition. In my case current partition was 1, so I wrote the image to partition 2.

 Partition 1: dd if=mss_1_2_0_telnet.cramfs of=/dev/ide/host2/bus0/target0/lun0/part1
 Partition 2: dd if=mss_1_2_0_telnet.cramfs of=/dev/ide/host2/bus0/target0/lun0/part2

- Activate the partition you just wrote the cramfs to. In this example partition 2 is the one we are activating:

 nvram set pivot_root_current=2
 nvram commit

- Reboot the Mss and telnet should be enabled…

Hidden commands not available in the web gui

The distro seems to include full support for encrypting the partitions using the hardware accelerated encryption engine in the NAS chip.

The shared partition is mounted like this: encryption device → software raid device → physical partition. you can tune the encryption device by using the tool called se_util

The kernel seems to have full nfs support builtin. All required commands for exporting a nfs filesystem seems to be present!
The distro also contains the usual wireless commands to controll broadcom wireless devices.

And a whole lot more…

NFS on the MSS

The following commands enables nfs server and exports the path /shares/mss-hdd with read only access to host 192.168.1.6

 portmap
 rpc.mountd
 rpc.nfsd
 exportfs -io ro,no_root_squash 192.168.1.6:/shares/mss-hdd

Boot messages

Waiting for GPIO 0 to toggle...
GPIO 0 has toggled, continuing.


CFE version 1.2.11 for BCM94780 (32bit,SP,LE)
Build Date: Mon Jan 17 22:33:44 PST 2005 (builder@nlab-sv1-builder)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.13.0
CPU type 0x29006: 264MHz
Total memory: 0x2000000 bytes (32MB)

Total memory used by CFE:  0x80300000 - 0x80442910 (1321232)
Initialized Data:          0x8033CD30 - 0x8033F560 (10288)
BSS Area:                  0x8033F560 - 0x80340910 (5040)
Local Heap:                0x80340910 - 0x80440910 (1048576)
Stack Area:                0x80440910 - 0x80442910 (8192)
Text (code) segment:       0x80300000 - 0x8033CD30 (249136)
Boot area (physical):      0x00443000 - 0x00483000
Relocation Factor:         I:00000000 - D:00000000

Device eth0:  hwaddr 00-10-75-FF-C8-7F, ipaddr 169.254.119.49, mask 255.255.0.0
        gateway not set, nameserver not set
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 2658304 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029006
Primary instruction cache 16kb, linesize 16 bytes (2 ways)
Primary data cache 16kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (root@localhost.localdomain) (gcc version 3.0 20010422 (prerelease) 
with bcm4710a0 modifications) #2 Thu Mar 24 18:59:47 PST 2005
BCM47XX ChipID = 0x4704, RevisionID = 8, Options = 0x2
Setting GPIO 6 to output of 1.
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
CPU: BCM4704 rev 8 at 264 MHz
Calibrating delay loop... 263.78 BogoMIPS
Memory: 29532k/32768k available (2358k kernel code, 3236k reserved, 132k data, 84k init, 0k highmem)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Fixing up bus 1
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
NTFS driver v1.1.22 [Flags: R/O]
i2c-core.o: i2c core module
i2c-dev.o: i2c /dev entries driver module
i2c-core.o: driver i2c-dev dummy driver registered.
i2c-algo-bit.o: i2c bit algorithm module
i2c-proc.o version 2.6.1 (20010825)
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
Generic MIPS RTC Driver v1.0
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
AEC6265: IDE controller on PCI bus 01 dev 10
PCI: Enabling device 01:02.0 (0000 -> 0001)
AEC6265: chipset revision 7
AEC6265: not 100% native mode: will probe irqs later
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
AEC6265: ROM disabled at 0x00000000
Enabling AEC GPO for HD power.
    ide2: BM-DMA at 0x0120-0x0127, BIOS settings: hde:pio, hdf:pio
    ide3: BM-DMA at 0x0128-0x012f, BIOS settings: hdg:pio, hdh:pio
hde: Maxtor 6B300R0, ATA DISK drive
ide2 at 0x100-0x107,0x10a on irq 2
blk: queue 802b9488, I/O limit 4095Mb (mask 0xffffffff)
hde: 586114704 sectors (300091 MB) w/16384KiB Cache, CHS=36483/255/63, (U)DMA
Partition check:
 /dev/ide/host2/bus0/target0/lun0: p1 p2 p3 p63<6>PPP generic driver version 2.4.2
SCSI subsystem driver Revision: 1.00
scsi0 : SCSI host adapter emulation for IDE ATAPI devices
 Amd/Fujitsu Extended Query Table v1.0 at 0x0040
number of CFI chips: 1
Flash device: 0x200000 at 0x1c000000
Physically mapped flash: cramfs filesystem found at block 1380
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "cfe"
0x00040000-0x001e0000 : "linux"
0x0015935c-0x001e0000 : "rootfs"
0x001e0000-0x001f0000 : "nvramcopy"
0x001f0000-0x00200000 : "nvram"
sflash: found no supported devices
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
PCI: Enabling device 01:03.2 (0000 -> 0002)
ehci_hcd 01:03.2: PCI device 1106:3104
ehci_hcd 01:03.2: irq 2, pci mem c000f000
usb.c: new USB bus registered, assigned bus number 1
ECHI PCI device 31041106 found.
ECHI reg 0x49 = 80233220
ECHI reg 0x49 changed to = 80233200
ECHI reg 0x4b = 80233209
ECHI reg 0x4b changed to = 80233229
PCI: 01:03.2 PCI cache line size set incorrectly (0 bytes) by BIOS/FW, correcting to 32
ehci_hcd 01:03.2: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
hub.c: USB hub found
hub.c: 4 ports detected
host/usb-uhci.c: $Revision: 1.275 $ time 18:59:55 Mar 24 2005
host/usb-uhci.c: High bandwidth mode enabled
PCI: Enabling device 01:03.0 (0000 -> 0001)
ECHI PCI device 30381106 found.
UCHI reg 0x41 = 10
UCHI reg 0x41 changed to = 0
host/usb-uhci.c: USB UHCI at I/O 0x140, IRQ 2
host/usb-uhci.c: Detected 2 ports
usb.c: new USB bus registered, assigned bus number 2
hub.c: USB hub found
hub.c: 2 ports detected
PCI: Enabling device 01:03.1 (0000 -> 0001)
ECHI PCI device 30381106 found.
UCHI reg 0x41 = 10
UCHI reg 0x41 changed to = 0
host/usb-uhci.c: USB UHCI at I/O 0x160, IRQ 2
host/usb-uhci.c: Detected 2 ports
hub.c: port 3 over-current change
usb.c: new USB bus registered, assigned bus number 3
hub.c: port 4 over-current change
hub.c: USB hub found
hub.c: 2 ports detected
host/usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
host/usb-ohci.c: USB OHCI at membase 0xb8003000, IRQ 6
host/usb-ohci.c: usb-00:03.0, PCI device 14e4:4715
usb.c: new USB bus registered, assigned bus number 4
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver usblp
printer.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
md: linear personality registered as nr 1
md: raid0 personality registered as nr 2
md: raid1 personality registered as nr 3
md: md driver 0.90.0 MAX_MD_DEVS=256, MD_SB_DISKS=27
md: Skipping autodetection of RAID arrays.
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
VFS: Mounted root (cramfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 84k freed
Algorithmics/MIPS FPU Emulator v1.5

pivot_rc starting...
pivot_rc proceeding to boot from disk...
pivot_rc complete -> calling /sbin/init...

Using /lib/modules/2.4.20/kernel/arch/mips/brcm-boards/bcm947xx/bcmserbus.o
Using /lib/modules/2.4.20/kernel/drivers/i2c/bcm2wire.o
Using /lib/modules/2.4.20/kernel/arch/mips/brcm-boards/bcm947xx/bcmrtcst4181.o
Using /lib/modules/2.4.20/kernel/arch/mips/brcm-boards/bcm947xx/bcmlm63.o
Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o
Using /lib/modules/2.4.20/kernel/drivers/scsi/frodo/frodo.o
insmod: init_module: frodo: Device or resource busy
Using /lib/modules/2.4.20/kernel/arch/mips/brcm-boards/bcm947xx/bcmgpio.o
Using /lib/modules/2.4.20/security/sec.o
Using /lib/modules/2.4.20/kernel/drivers/se/bcm_se.o
Checking to see that USB initialization is done...
Turning on swapping...
handling MD device /dev/md/0
analyzing super-block
disk 1: /dev/null, failed
disk 2: /dev/null, failed
disk 3: /dev/null, failed
disk 4: /dev/null, failed
disk 5: /dev/null, failed
disk 6: /dev/null, failed
disk 7: /dev/null, failed
Setting up swapspace version 1, size = 511995904 bytes
handling MD device /dev/md/1
analyzing super-block
Mounting /dev/se/2 on /shares/mss-hdd.
Hit enter to short-circuit regular system start-up...No SATA controller found.
eth0: No such process
eth1: No such device
eth0: No such device
info, udhcp client (v0.9.8) started
debug, Sending discover...
killall: udhcpd: no process killed
debug, Sending select for 62.101.237.155...
info, Lease of 62.101.237.155 obtained, lease time 604800
killall: udhcpd: no process killed
info, udhcp server (v0.9.8) started
error, SIOCGIFADDR failed, is the interface up and configured?: No such device
killall: dnsmasq: no process killed
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
connect: Network is unreachable
Network configuration has changed. Restarting services.
eth0: No such process
eth1: No such device
killall: udhcpd: no process killed
killall: udhcpd: no process killed
info, udhcp server (v0.9.8) started
error, SIOCGIFADDR failed, is the interface up and configured?: No such device
killall: dnsmasq: no process killed
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
httpd pid is 88.
info, udhcp server (v0.9.8) started
error, SIOCGIFADDR failed, is the interface up and configured?: No such device
No interface specified. Quitting...
sensord pid is 0.
eth0: No such process
eth1: No such device
killall: udhcpd: no process killed
killall: udhcpd: no process killed
info, udhcp server (v0.9.8) started
error, SIOCGIFADDR failed, is the interface up and configured?: No such device
killall: dnsmasq: no process killed
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
iptables who? (do you need to insmod?)
Deleting user note pool_mss-hdd_unmounted.
Deleting user note pool_mss-hdd_unmounted.
Deleting user note pool_mss-hdd_unmounted.
Maxtor HNS initialization
[: netwebhooks: unknown operand
Starting restore...
Done.
Starting fan control script...
Done.
Starting Inet daemon...
Done.
Starting Discovery daemon...
Done.
LEDs stuff...
Done.
Starting E'net link script...
Done.
Hit enter to continue...rc restarting syslogd.
killall: klogd: no process killed
killall: syslogd: no process killed
eth0: Link up.



BusyBox v1.00-pre2 (2005.03.25-02:49+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

#

General

Hardware

OpenMSS Firmware

Original Firmware

Development

Related