Planex USB WiFi プリントサーバ Mini-102MG をHack

お手軽Linuxマシンとして、 [twitter:@chikuta] 氏に #MOM01 で見せてもらった
Planex Mini-102MG を入手。早速、Hacking.

ボードの角にあるポートに RS-232レベルコンバータをつないでみた。

ちょっとはんだづけに苦労したが(特にGND)ポートの構成は

-


















    1  2  3  4   x |
1 = tx(232コンバータへ入力）
2 = GND
3 = rx(232コンバータからの出力)
4 = VCC(3.3V)





































-

のようである。115.2k でシリアル接続すると、以下のブートメッセージが得られた。

Decompressing..........done


CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: ､ｭ 11､・30 21:57:42 CST 2007 (root@Hinet)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing Devices.
Boot partition size = 131072(0x20000)
et0: Broadcom BCM47xx 100/100 Mbps Ethernet Controller 4.130.25.0
CPU type 0x29029: 240MHz
Total memory: 32768 KBytes

Total memory used by CFE:  0x80300000 - 0x8039A300 (631552)
Initialized Data:          0x803302C0 - 0x80332890 (9680)
BSS Area:                  0x80332890 - 0x80334300 (6768)
Local Heap:                0x80334300 - 0x80398300 (409600)
Stack Area:                0x80398300 - 0x8039A300 (8192)
Text (code) segment:       0x80300000 - 0x803302C0 (197312)
Boot area (physical):      0x0039B000 - 0x003DB000
Relocation Factor:         I:00000000 - D:00000000

Device eth0:  hwaddr 00-22-CF-XX-XX-XX, ipaddr 192.168.2.2, mask 255.255.255.0
        gateway not set, nameserver not set
get id=650
Open device flash0.setting success
upgrade flag=0
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured*************
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ......... 2785280 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029029
Primary instruction cache 16kb, linesize 16 bytes (4 ways)
Primary data cache 16kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (root@localhost.localdomain) (gcc version 2.96 20000731 (Red Hat Linux 7.3 2.96-110.1)) #727 三 5月 14 12:11:14 CST 2008
Setting the PFC to its default value
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initial ramdisk at: 0x8019a000 (1106169 bytes)
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS0,115200
CPU: BCM5354 rev 3 at 240 MHz
Calibrating delay loop... 237.56 BogoMIPS
Memory: 29460k/32768k available (1437k kernel code, 3308k reserved, 1192k data, 68k init, 0k highmem)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: no core
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x0
squashfs: version 3.1 (2006/08/19) Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 8192K size 1024 blocksize
eth0: Broadcom BCM47xx 100/100 Mbps Ethernet Controller 4.130.25.0
 Amd/Fujitsu Extended Query Table v1.0 at 0x0040
number of CFI chips: 1
Flash device: 0x200000 at 0x1c000000
Physically mapped flash: Couldn't find valid ROM disk image
Creating 4 MTD partitions on "Physically mapped flash":
0x00000000-0x00200000 : "boot"
0x00000000-0x001f0000 : "linux"
0x00000000-0x00200000 : "rootfs"
0x001f0000-0x00200000 : "nvram"
ftl_cs: FTL header not found.
ftl_cs: FTL header not found.
ftl_cs: FTL header not found.
ftl_cs: FTL header not found.
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
ehci_hcd 00:03.1: PCI device 14e4:471a
ehci_hcd 00:03.1: irq 6, pci mem b8003800
usb.c: new USB bus registered, assigned bus number 1
ehci_hcd 00:03.1: illegal capability!
PCI: 00:03.1 PCI cache line size set incorrectly (0 bytes) by BIOS/FW, correcting to 32
ehci_hcd 00:03.1: USB 0.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
Manufacturer: Linux 2.4.20 ehci_hcd
Product: PCI device 14e4:471a
SerialNumber: 00:03.1
hub.c: USB hub found
hub.c: 2 ports detected
host/usb-ohci.c: USB OHCI at membase 0xb8003000, IRQ 6
host/usb-ohci.c: usb-00:03.0, PCI device 14e4:471a
usb.c: new USB bus registered, assigned bus number 2
Product: USB OHCI Root Hub
SerialNumber: b8003000
hub.c: USB hub found
hub.c: 2 ports detected
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
NET4: Linux IPX 0.47 for NET4.0
IPX Portions Copyright (c) 1995 Caldera, Inc.
IPX Portions Copyright (c) 2000, 2001 Conectiva, Inc.
NET4: AppleTalk 0.18a for Linux NET4.0
802.1Q VLAN Support v1.7 Ben Greear 
All bugs added by David S. Miller 
RAMDISK: LZMA image found at block 0
RAMDISK: LZMA lc=3,lp=0,pb=2,dictSize=8388608,origSize=5017600
LZMA initrd by Ming-Ching Tiew  .............................................................................
LZMA initrd loaded successfully
Freeing initrd memory: 1080k freed
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 68k freed
init started:  BusyBox v1.03 (2007.08.23-03:21+0000) multi-call binary
Starting pid 14, console /dev/ttyS0: '/etc/init.d/rcS'

Starting pid 17, console /dev/ttyS0: '/bin/sh'
size: 745 bytes (64791 left)
size: 745 bytes (64791 left)
size: 745 bytes (64791 left)
Using /sbin/wl.o
eth1: Broadcom BCM4318 802.11 Wireless Controller 4.130.28.0
Setup bridge....
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
Algorithmics/MIPS FPU Emulator v1.5
Setting country code using abbreviation: "JP"
Auto but wired cable connect !
br0: port 1(eth0) entering learning state
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
 *************** dump_flash.sh start **************
 *************** dump_flash.sh end **************
Program started! 4 4
 ********** start up job schedule ************
Create ThreadLanUrb port0 Running!
Create ThreadUrbProcess port 0 Running!
Create hThreadCheckPendingUrbProcess port 0 Running!
p4 = 0
gateway:0.0.0.0
MF265683
threadLanUrb 0, ready for accepting...
ARPING to 255.255.255.0 from 255.255.255.0 via br0
Sent 1 probes (1 broadcast(s))
Received 0 reply
init_usb_hotplug 0





>status = 0


init_occupy_flag 0
Using /sbin/printer.o
usb.c: registered new driver usblp
printer.c: v0.13: USB Printer Device Class driver
usb.c: deregistering driver usblp
First time to create printerstuts!
rm: cannot remove `/tmp/p0_id': No such file or directory
string_id= length=0

Please enter your user name and password!!

Login:

さて、ここからどうすればいいのかな？
OpenWRT , DD-WRT などを調べるってのは分かっているのだが。

http://mizupc8.bio.mie-u.ac.jp/pukiwiki/?OpenWrt%2FWL-500gP#q7b075ee
を見るとCFEのブート中に Ctrl-Cで止まる、とのこと。
おおお、実際に止まった。これでとりあえずファームの入替はできそう。
こんな感じ

Automatic startup canceled via Ctrl-C
CFE> ^C
CFE> ^C
CFE> help
Available commands:

et                  Broadcom Ethernet utility.
go                  Verify and boot OS image.
nvram               NVRAM utility.
reboot              Reboot.
flash               Update a flash memory device
autoboot            Automatic system bootstrap.
batch               Load a batch file into memory and execute it
boot                Load an executable file into memory and execute it
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
ping                Ping a remote IP host.
arp                 Display or modify the ARP Table
ifconfig            Configure the Ethernet interface
unsetenv            Delete an environment variable.
printenv            Display the environment variables
setenv              Set an environment variable.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
 *** command status = 0
CFE>

ifconfig でちゃんとネットワーク設定までできる。
saveを使うとメモリダンプができるようだ。

開発環境の整備が必要か。。。