赤を黒に

例によって、よーわからんタイトルだが、、、

HD-LAN V2 と玄箱

先日、ハードウェアのページを更新するために、 HD-LAN V2（赤）と玄箱（黒）のマザーボードを見比べていたのだが、、、

	HD-LAN V2	玄箱
CPU	PowerPC	PowerPC
CPU	MPC8241LZQ200D	MPC8241LZQ200D
CPU Clock	200MHz	200MHz
FLASH ROM	4MB	4MB
	Fujitsu 29PL32TM-90PFTN	Fujitsu 29PL32TM-90PFTN
	HDL005	HDH004
D-RAM	64MB	64MB
D-RAM	Hynix HY57V281620HCT-H	K4S561632D-TC75
USB Port	-	1
USB Port		NEC D720101GJ
MiniPCI	-	-
Network	10BASE-T 100BASE-TX	10BASE-T 100BASE-TX
Network	AN983B	AN983B
IDE	Sil0680ACL144	Sil0680ACL144
AVR	AT90S2313-4SC	AT90S2313-4SC
AVR	NAS003	NAS004

と、

D-RAM のチップが違う

USB 関連が違う

ファームウェア（AVR/Flash）のリビジョンが違う

だけで、ほとんど同じであった。

赤を玄に？

HD-LAN V2 で玄箱のファームが動くんでは？

Flash ROM のメモリマップが一致していないかも→レンガと化す

AVR のコマンドが違うかも→HD-LAN V2 の apservd を使えばよい

　　：
いろいろ不安要素はあるが、、、

HD-LAN V2 の玄箱化

こういうことするには、シリアルコンソール必須。
なので、いまさらながらシリアルコンソールをつけたのであった。

HD-LAN V2 にログイン

シリアルコンソールから、HD-LAN V2 にログインする

BUFFALO INC. LinkStation series HD-LAN(IEYASU)

hackkit login: root
PAM_unix[652]: (login) session opened for user root by LOGIN(uid=0)
Linux (none) 2.4.17_mvl21-sandpoint #866 2004年 5月 18日 火曜日 21:22:06 JST ppc unknown
login[652]: ROOT LOGIN on `console'

root@hackkit:~#

HD-LAN V2 に玄箱のファームを転送

玄箱 1.02 の firmimg.bin を HD-LAN V2 に ftp で転送する

HD-LAN V2 に玄箱のファームを書く

root@hackkit:/tmp# ls -l /dev/fl1
brw-rw-r--    1 root     root     250,   1 Nov 28  2002 /dev/fl1
root@hackkit:/tmp# cat firmimg.bin > /dev/fl1
root@hackkit:/tmp#
root@hackkit:/tmp# /mnt/HackKit/usr/bin/cmp firmimg.bin /dev/fl1
cmp: EOF on firmimg.bin

ドキドキ、ハラハラ

HD-LAN V2 で玄箱のファームを起動

電源ボタン長押しで電源OFF

root@hackkit:/tmp#
Broadcast message from root Mon Dec  6 00:06:33 2004...

The system is going down for system halt NOW !!
INIT: Switching to runlevel: 0
INIT: Sending processes the TERM signal
INIT: Sending processeStopping atd: [  OK  ]
Shutting down SMB services: [  OK  ]
Shutting down NMB services: [  OK  ]
Stopping crond: [  OK  ]
Shutting down dhcpd: [  OK  ]
Stopping INET services: [  OK  ]
Shutting down ntpd: [FAILED]
Saving random seed:  [  OK  ]
Shutting down kernel logger: [  OK  ]
Shutting down system logger: [  OK  ]
Shutting down interface eth0:  [  OK  ]
Shutting down loopback interface:  [  OK  ]
Stopping periodic command scheduler: cron.
Stopping internet superserver: inetd.
Stop services: thttpd
Stop servecies: atalkd afpd
Can't unregister hackkit:Workstation@*
Can't unregister hackkit:netatalk@*
Stopping system log daemon: klogd syslogd.
Stop services: smbd nmbd
Stop services: ppc_uartd
Sending all processes the TERM signal... done.
Sending all processes the KILL signal... done.
Deactivating swap... done.
Unmounting local filesystems... done.
flushing ide devices: hda
Power down.

再度電源ボタンを押して HD-LAN V2 を起動する。

******* Product Information *******
----------------------------------
Product Name: KURO-BOX(IETSUNA)
          VER: 1.02
         Date: 2004/4/16 11:46:41
----------------------------------
Firmware check:done.

>>
Now Loading...done.
Now Booting
Memory BAT mapping: BAT2=64Mb, BAT3=0Mb, residual: 0Mb
Linux version 2.4.17_kuro-box (root@toda_dev.melcoinc.co.jp) (gcc version 2.95.3 20010315 (release/MontaVista)) #4 2004年 4
月 16日 金曜日 11:45:05 JST
KURO-BOX (C) 2004 KUROUTO-SHIKOU.
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/hda1
OpenPIC Version 1.2 (1 CPUs and 139 IRQ sources) at 80040000
decrementer frequency = 24.485953 MHz 
rtc sec count 1102259279
Calibrating delay loop... 130.25 BogoMIPS
Memory: 60532k available (1124k kernel code, 520k data, 188k init, 0k highmem)
Dentry-cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode-cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
PCI: Probing PCI hardware
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Disabling the Out Of Memory Killer
Journalled Block Device driver loaded
pty: 256 Unix98 ptys configured
BUFFALO INC. RTC driver ver 1.00
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0x80004600 (irq = 138) is a 16550A
ttyS01 at 0x80004500 (irq = 137) is a 16550A
block: 128 slots per queue, batch=32
RAMDISK driver initialized: 16 RAM disks of 10000K size 1024 blocksize
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
CMD680: IDE controller on PCI bus 00 dev 60
CMD680: chipset revision 2
CMD680: 100% native mode on irq 17
    ide0: BM-DMA at 0xbffed0-0xbffed7, BIOS settings: hda:pio, hdb:pio
    ide1: BM-DMA at 0xbffed8-0xbffedf, BIOS settings: hdc:pio, hdd:pio
hda: FUJITSU M1636TAU, ATA DISK drive
ide0 at 0xbffef8-0xbffeff,0xbffef6 on irq 17
hda: 2511840 sectors (1286 MB) w/128KiB Cache, CHS=2491/16/63, DMA
Partition check:
 hda: hda1 hda2 hda3
loop: loaded (max 8 devices)
FLASHDISK:Initialized [FUJITSU MBM29PL32TM] 
Linux Tulip driver version 0.9.15-pre9 (Nov 6, 2001)
tulip0:  MII transceiver #1 config 3100 status 7849 advertising 05e1.
eth0: ADMtek Comet rev 17 at 0xbfff00, 00:07:40:59:xx:yy, IRQ 16.
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: AppleTalk 0.18a for Linux NET4.0
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 2077k freed
Boot from /dev/hda1.
EXT2-fs warning: checktime reached, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Boot from /dev/hda1.
kjournald starting.  Commit interval 5 seconds
EXT3-fs: mounted filesystem with ordered data mode.
VFS: Mounted root (ext3 filesystem) readonly.
change_root: old root has d_count=2
Trying to unmount old root ... okay
Freeing unused kernel memory: 188k init
Warning: unable to open an initial console.
No /sbin/init found.
No /bin/init found.
No /etc/init found.
No /bin/sh found.
No init found.  Try passing init= option to kernel.

カーネルは立ち上がってきた！！！

ハックキットの起動

ハックキットをインストールした HDD を接続して、再起動する。


******* Product Information *******
----------------------------------
Product Name: KURO-BOX(IETSUNA)
          VER: 1.02
         Date: 2004/4/16 11:46:41
----------------------------------
Firmware check:done.

>>
Now Loading...done.
Now Booting
Memory BAT mapping: BAT2=64Mb, BAT3=0Mb, residual: 0Mb
Linux version 2.4.17_kuro-box (root@toda_dev.melcoinc.co.jp) (gcc version 2.95.3 20010315 (release/MontaVista)) #4 2004年 4
月 16日 金曜日 11:45:05 JST
KURO-BOX (C) 2004 KUROUTO-SHIKOU.
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/hda1
OpenPIC Version 1.2 (1 CPUs and 139 IRQ sources) at 80040000
decrementer frequency = 24.595618 MHz 
rtc sec count 1102259536
Calibrating delay loop... 131.07 BogoMIPS
Memory: 60532k available (1124k kernel code, 520k data, 188k init, 0k highmem)
Dentry-cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode-cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
PCI: Probing PCI hardware
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Disabling the Out Of Memory Killer
Journalled Block Device driver loaded
pty: 256 Unix98 ptys configured
BUFFALO INC. RTC driver ver 1.00
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0x80004600 (irq = 138) is a 16550A
ttyS01 at 0x80004500 (irq = 137) is a 16550A
block: 128 slots per queue, batch=32
RAMDISK driver initialized: 16 RAM disks of 10000K size 1024 blocksize
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
CMD680: IDE controller on PCI bus 00 dev 60
CMD680: chipset revision 2
CMD680: 100% native mode on irq 17
    ide0: BM-DMA at 0xbffed0-0xbffed7, BIOS settings: hda:pio, hdb:pio
    ide1: BM-DMA at 0xbffed8-0xbffedf, BIOS settings: hdc:pio, hdd:pio
hda: IBM-DAQA-33240, ATA DISK drive
ide0 at 0xbffef8-0xbffeff,0xbffef6 on irq 17
hda: 6346368 sectors (3249 MB) w/96KiB Cache, CHS=6296/16/63, DMA
Partition check:
 hda: hda1 hda2 hda3
loop: loaded (max 8 devices)
FLASHDISK:Initialized [FUJITSU MBM29PL32TM] 
Linux Tulip driver version 0.9.15-pre9 (Nov 6, 2001)
tulip0:  MII transceiver #1 config 3100 status 7849 advertising 05e1.
eth0: ADMtek Comet rev 17 at 0xbfff00, 00:07:40:59:xx:yy, IRQ 16.
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: AppleTalk 0.18a for Linux NET4.0
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 2077k freed
Boot from initrd.
EXT2-fs warning: checktime reached, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Boot from initrd.
VFS: Mounted root (ext2 filesystem).
change_root: old root has d_count=5
Trying to unmount old root ... <3>error -16
Change root to /initrd: error -2
Freeing unused kernel memory: 188k init
kmod: failed to exec /sbin/modprobe -s -k char-major-4, errno = 2
INIT: version 2.78 booting
[: 0: unexpected operator
Mounting local filesystems...
none on /dev/pts type devpts (rw,gid=5,mode=20)
Cleaning: /tmp .
Configuration network interface: lo eth0
Starting system log daemon: syslogd klogd.
INIT: Entering runlevel: 2
Starting AP serv daemon:AP serv starting on eth0
Starting internet superserver: inetd.
Start services: ppc_uartd

Kroutoshikou KURO-BOX (IETSUNA)
kernel 2.4.17-kuro-box on ppc

KURO-BOX-EM login:

POWER LED が点滅。
DIAG LED も７回点滅を繰り返している。基板異常とか。
電源ボタンの長押しも効かない。

数分して、電源が落ちた。

余談：今まで気が付かなかったが "Kroutoshikou"。

Kroutoshikou KURO-BOX (IETSUNA)
kernel 2.4.17-kuro-box on ppc

KURO-BOX-EM login: root
Password:
# ps -aux
  PID TTY     Uid        Size State Command
    1         root       1448   S   init
    2         root          0   S   [keventd]
    3         root          0   R   [ksoftirqd_CPU0]
    4         root          0   S   [kswapd]
    5         root          0   S   [bdflush]
    6         root          0   S   [kupdated]
   39         root       1436   S   dhcpcd -h KURO-BOX-EM -t 3 eth0
   57         root       1732   S   /sbin/syslogd
   59         root       1500   S   /sbin/klogd
   67         root       1592   S   /usr/sbin/ap_servd -i eth0 -c
   72         root       1552   S   /usr/sbin/inetd
   76         root       1420   S   /usr/sbin/ppc_uartd
   83 ttyS0   root       1536   S   -ash
   87 ttyS0   root       1852   R   ps -aux

write_ok を実行

# write_ok
argv: write_ok
# dd if=/dev/fl3 bs=2 count=2
OKOK2+0 records in
2+0 records out
#

再起動する

#
******* Product Information *******
----------------------------------
Product Name: KURO-BOX(IETSUNA)
          VER: 1.02
         Date: 2004/4/16 11:46:41
----------------------------------
Firmware check:done.

>>
Now Loading...done.
Now Booting
Memory BAT mapping: BAT2=64Mb, BAT3=0Mb, residual: 0Mb
Linux version 2.4.17_kuro-box (root@toda_dev.melcoinc.co.jp) (gcc version 2.95.3 20010315 (release/MontaVista)) #4 2004年 4月 16日 金曜日 11:45:05 JST
KURO-BOX (C) 2004 KUROUTO-SHIKOU.
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/hda1
OpenPIC Version 1.2 (1 CPUs and 139 IRQ sources) at 80040000
decrementer frequency = 24.564319 MHz
rtc sec count 1102260193
Calibrating delay loop... 130.66 BogoMIPS
Memory: 60532k available (1124k kernel code, 520k data, 188k init, 0k highmem)
Dentry-cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode-cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
PCI: Probing PCI hardware
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Disabling the Out Of Memory Killer
Journalled Block Device driver loaded
pty: 256 Unix98 ptys configured
BUFFALO INC. RTC driver ver 1.00
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0x80004600 (irq = 138) is a 16550A
ttyS01 at 0x80004500 (irq = 137) is a 16550A
block: 128 slots per queue, batch=32
RAMDISK driver initialized: 16 RAM disks of 10000K size 1024 blocksize
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
CMD680: IDE controller on PCI bus 00 dev 60
CMD680: chipset revision 2
CMD680: 100% native mode on irq 17
    ide0: BM-DMA at 0xbffed0-0xbffed7, BIOS settings: hda:pio, hdb:pio
    ide1: BM-DMA at 0xbffed8-0xbffedf, BIOS settings: hdc:pio, hdd:pio
hda: IBM-DAQA-33240, ATA DISK drive
ide0 at 0xbffef8-0xbffeff,0xbffef6 on irq 17
hda: 6346368 sectors (3249 MB) w/96KiB Cache, CHS=6296/16/63, DMA
Partition check:
 hda: hda1 hda2 hda3
loop: loaded (max 8 devices)
FLASHDISK:Initialized [FUJITSU MBM29PL32TM]
Linux Tulip driver version 0.9.15-pre9 (Nov 6, 2001)
tulip0:  MII transceiver #1 config 3100 status 7849 advertising 05e1.
eth0: ADMtek Comet rev 17 at 0xbfff00, 00:07:40:59:xx:yy, IRQ 16.
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 4096)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: AppleTalk 0.18a for Linux NET4.0
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 2077k freed
Boot from /dev/hda1.
EXT2-fs warning: checktime reached, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Boot from /dev/hda1.
kjournald starting.  Commit interval 5 seconds
EXT3-fs: mounted filesystem with ordered data mode.
VFS: Mounted root (ext3 filesystem) readonly.
change_root: old root has d_count=2
Freeing unused kernel memory: 188k init
modprobe: modprobe: Can't open dependencies file /lib/modules/2.4.17_kuro-box/modules.dep (No such file or directory)
INIT: version 2.78 booting
                        Welcome to Vine Linux
                Press 'I' to enter interactive startup.
Mounting proc filesystem:  [  OK  ]
Unmounting initrd:  [  OK  ]
Configuring kernel parameters:  [  OK  ]
hwclock: ioctl() to /dev/rtc to turn on update interrupts failed unexpectedly, errno=515: Unknown error 515.
Setting clock  (localtime): Mon Dec  6 00:23:21 JST 2004 [  OK  ]
Activating swap partitions:  [  OK  ]
Setting hostname hackkit:  [  OK  ]
modprobe: Can't open dependencies file /lib/modules/2.4.17_kuro-box/modules.dep (No such file or directory)
Checking root filesystem
/dev/hda1: clean, 24761/378624 files, 103921/755992 blocks
[/sbin/fsck.ext3 (1) -- /] fsck.ext3 -a /dev/hda1
[  OK  ]
Remounting root filesystem in read-write mode:  [  OK  ]
Finding module dependencies:  depmod: Can't open /lib/modules/2.4.17_kuro-box/modules.dep for writing
[FAILED]
modprobe: Can't open dependencies file /lib/modules/2.4.17_kuro-box/modules.dep (No such file or directory)
modprobe: Can't open dependencies file /lib/modules/2.4.17_kuro-box/modules.dep (No such file or directory)
Checking filesystems
Checking all file systems.
[  OK  ]
Mounting local filesystems:  [  OK  ]
Enabling local filesystem quotas:  [  OK  ]
Enabling swap space:  [  OK  ]
INIT: Entering runlevel: 3
Entering non-interactive startup
Setting network parameters:  [  OK  ]
Bringing up loopback interface:  [  OK  ]
Bringing up interface eth0:  [  OK  ]
Starting system logger: [  OK  ]
Starting kernel logger: [  OK  ]
Initializing random number generator:  [  OK  ]
Mounting other filesystems:  [  OK  ]
Starting ntpd: [  OK  ]
Start services: ppc_uartd
Starting INET services: [  OK  ]
Starting keytable:  [  OK  ]
Starting httpd: [  OK  ]
Starting ProFTPd: [  OK  ]
Starting crond: [  OK  ]
Starting atd: [  OK  ]
INIT: no more processes left in this runlevel

今度はハックキットが立ち上がってきた。
でも、DIAG LED の点滅はとまらなひ。

楽し！

←
HD-LAN V2 シリアルコンソール

ハックの記録
LinkStation／玄箱をハックしよう

→
赤を黒に（２）