Bootvorgang
From DD-WRT Wiki
Contents |
Ich hab hier mal einen WRT54g V 2.2 mit einer Seriellen Schnittstelle versehen, um mir mal die originalen Einstellungen anzusehen.
Warum das Alles?
... ich weiß noch nicht! Vielleicht gibt es ja was zu entdecken.
Der WRT war original verpackt.
Es geht los, mit den allerersten Bootvorgang
[edit] Erster Bootvorgang
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 18 14:27:36 CST 2004 (root@me)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena.
Initializing Devices.
No DPN
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.13.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29007: 200MHz
Total memory: 0x1000000 bytes (16MB)
Total memory used by CFE: 0x80300000 - 0x8043EB40 (1305408)
Initialized Data: 0x80338DB0 - 0x8033B160 (9136)
BSS Area: 0x8033B160 - 0x8033CB40 (6624)
Local Heap: 0x8033CB40 - 0x8043CB40 (1048576)
Stack Area: 0x8043CB40 - 0x8043EB40 (8192)
Text (code) segment: 0x80300000 - 0x80338DB0 (232880)
Boot area (physical): 0x0043F000 - 0x0047F000
Relocation Factor: I:00000000 - D:00000000
Boot version: v3.4
The boot is CFE
mac_init(): Find mac [00:12:17:DD:DE:3F] in location 0
Nothing...
eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0: hwaddr 00-12-17-DD-DE-3F, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ...... 1564672 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kb, linesize 16 bytes (2 ways)
Primary data cache 4kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (root@me) (gcc version 3.2.3 with Broadcom modifications) #
5 Mon Oct 18 14:26:19 CST 2004
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
CPU: BCM4712 rev 1 at 200 MHz
Calibrating delay loop... 199.47 BogoMIPS
Memory: 14444k/16384k available (1333k kernel code, 1940k reserved, 108k data, 6
4k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
PCI: Disabled
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en
abled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
HDLC line discipline: version $Revision: 1.1.1.4 $, maxframe=4096
N_HDLC line discipline registered.
PPP generic driver version 2.4.2
Flash device: 0x400000 at 0x1c000000
Physically mapped flash: cramfs filesystem found at block 910
Creating 4 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003f0000 : "linux"
0x000e3938-0x003f0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-o
nly
0x003f0000-0x00400000 : "nvram"
sflash: found no supported devices
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (128 buckets, 1024 max) - 344 bytes per conntrack
ip_conntrack_pptp version 1.9 loaded
ip_nat_pptp version 1.5 loaded
ip_tables: (C) 2000-2002 Netfilter core team
ipt_time loading
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (cramfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 64k freed
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o
Using /lib/modules/2.4.20/kernel/drivers/net/wl/wl.o
Hit enter to continue...The boot is CFE
The chipset is BCM4712L BCM5325E
Set name-type for VLAN subsystem. Should be visible in /proc/net/vlan/config
Added VLAN with VID == 0 to IF -:eth0:-
Added VLAN with VID == 1 to IF -:eth0:-
WARNING: VLAN 1 does not work with many switches,
consider another number if you have problems.
Using /lib/modules/2.4.20/kernel/drivers/net/mac/writemac.o
killall: httpd: no process killed
The chipset is BCM4712L BCM5325E
name=[vlan0] lan_ifname=[br0]
The chipset is BCM4712L BCM5325E
=====> set br0 hwaddr to vlan0
name=[eth1] lan_ifname=[br0]
The chipset is BCM4712L BCM5325E
Write wireless mac
Write wireless mac successfully
br0: No such file or directory
name=[eth2] lan_ifname=[br0]
The chipset is BCM4712L BCM5325E
eth2: No such device
br0: No such device
interface eth2 does not exist!
name=[eth3] lan_ifname=[br0]
The chipset is BCM4712L BCM5325E
eth3: No such device
br0: No such device
interface eth3 does not exist!
lo: File exists
The boot is CFE
tftp server started
tftpd: standalone socket
info, udhcp server (v0.9.8) started
zebra disabled.
No interface specified. Quitting...
calling upnp_main
Using /lib/modules/2.4.20/kernel/drivers/net/mac/writemac.o
Input=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd
951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a
940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da81
14b903c8b247ad68c2ffe711
Output=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fab
d951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172
a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8
114b903c8b247ad68c2ffe711
Generate hash of public key:
CF 6C 9C 50 2A 61 09 B4 4D 63 59 46 39 79 F6 2F - 89 F4 63 34
The EoU is not already configured
command_buf[]=-63-75-73-74-6f-6d-5f-69-65-00-00-02-01-1d-00-03-47-02-02-01-01
-03-14-cf-6c-9c-50-2a-61-09-b4-4d-63-59-46-39-79-f6-2f-89-f4-63-34-00-00-00
Input length = 129
Input=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd
951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a
940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da81
14b903c8b247ad68c2ffe711
Output=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fab
d951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172
a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8
114b903c8b247ad68c2ffe711
Input length = 128
Input=9c6123d75bf3991ff7d8abae53582c8884d95da44e844f29ad8e2d985516cc84b46b4d91f2
92a218e1bef28e3e7bb39cc0d8bd012c611ffb45db1d3347f7bd726688e1c55b3dc08597d4021090
38af542723870efe389d3b1df38c296afabddd76c401491bf835b6bf86c7f8bcea68514c7ac018ca
ded85b22bda030114edee10
Output=9c6123d75bf3991ff7d8abae53582c8884d95da44e844f29ad8e2d985516cc84b46b4d91f
292a218e1bef28e3e7bb39cc0d8bd012c611ffb45db1d3347f7bd726688e1c55b3dc08597d402109
038af542723870efe389d3b1df38c296afabddd76c401491bf835b6bf86c7f8bcea68514c7ac018c
aded85b22bda030114edee100
g_timeout_limit_tick = 720
Child process ID = 54
Parent process ID = 53
ASSOCIATE COUNT SETTING COMPLETED!!!
EoU start time : Thu Jan 1 00:00:03 1970
EXPIRED_LIMIT = 720(Ticks)
CHECK_PERIOD = 1(Minutes); 60(Seconds)
COUNT_PERIOD = 6(Minutes); 360(Seconds)
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
Hit enter to continue...info, udhcp client (v0.9.8) started
No interface specified. Quitting...
Hit enter to continue...
BusyBox v0.60.0 (2004.10.18-05:39 0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
#
#
[edit] CFE
Abbruch des zweiten Bootvorgangs mit "Strg C", um den Bootloader "CFE" näher zu untersuchen.
Die Power-LED blinkt ca. 4-5 Mal/Sekunde und die DMZ-LED bleibt an.
eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0: hwaddr 00-12-17-DD-DE-3F, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Automatic startup canceled via Ctrl-C
CFE>
Der CFE sollte eigentlich immer gleich bleiben. Egal, welche Firmware später mal geflasht wird.
Die Eingabe von "help" zeigt weiter Optionen.
CFE> help Available commands: rndis Broadcom USB RNDIS utility. et Broadcom Ethernet utility. nvram NVRAM utility. reboot Reboot. flash Update a flash memory device memtest Test memory. f Fill contents of memory. e Modify contents of memory. d Dump memory. u Disassemble instructions. autoboot Automatic system bootstrap. batch Load a batch file into memory and execute it go Verify and boot OS image. boot Load an executable file into memory and execute it load Load an executable file into memory without executing it save Save a region of memory to a remote file via TFTP ping Ping a remote IP host. arp Display or modify the ARP Table ifconfig Configure the Ethernet interface show devices Display information about the installed devices. unsetenv Delete an environment variable. printenv Display the environment variables setenv Set an environment variable. help Obtain help for CFE commands For more information about a command, enter 'help command-name' *** command status = 0 CFE>
[edit] rndis
Das USB-Pinout des Broadcom Chips ist leider physikalisch nicht anzapfbar.
....aber vorhanden :-)
CFE> help rndis
SUMMARY
Broadcom USB RNDIS utility.
USAGE
rndis command [args..]
Configures the specified Broadcom USB RNDIS interface.
OPTIONS
-i=* Specifies the interface
dump Dump driver information
msglevel Sets the driver message level
*** command status = 0
CFE> rndis dump
addr 00:ff:12:34:56:78 rxq 0/128
rx_packets 0 tx_packets 0 rx_errors 0 tx_errors 0 tx_dropped 0
*** command status = 0
CFE>
CFE> rndis msglevel
*** command status = -8
CFE>
[edit] et
CFE> help et
SUMMARY
Broadcom Ethernet utility.
USAGE
et command [args..]
Configures the specified Broadcom Ethernet interface.
OPTIONS
-i=* Specifies the interface
up Activate the specified interface
down Deactivate the specified interface
loop Sets the loopback mode (0,1)
dump Dump driver information
msglevel Sets the driver message level
promisc Sets promiscuous mode
*** command status = 0
CFE>
[edit] nvram
Hier findet mann auch die beliebte boot_wait-Variable.
CFE> help nvram
SUMMARY
NVRAM utility.
USAGE
nvram [command] [args..]
Access NVRAM.
OPTIONS
get [name] Gets the value of the specified variable
set [name=va Sets the value of the specified variable
unset [name] Deletes the specified variable
commit Commit variables to flash
erase Erase all nvram
show Shows all variables
*** command status = 0
CFE> nvram get boot_wait
off
*** command status = 0
CFE> nvram set boot_wait="on"
*** command status = 0
CFE> nvram commit
*** command status = 0
CFE> nvram get boot_wait
on
*** command status = 0
CFE>
[edit] flash
CFE> help flash
SUMMARY
Update a flash memory device
USAGE
flash [options] filename [flashdevice]
Copies data from a source file name or device to a flash memory device.
The source device can be a disk file (FAT filesystem), a remote file
(TFTP) or a flash device. The destination device may be a flash or eeprom.
If the destination device is your boot flash (usually flash0), the flash
command will restart the firmware after the flash update is complete
OPTIONS
-noerase Don't erase flash before writing
-offset=* Begin programming at this offset in the flash device
-size=* Size of source device when programming from flash to flash
-ctheader Check header of CyberTAN
-noheader Override header verification, flash binary without checking
*** command status = 0
CFE>
[edit] memtest
CFE> help memtest
SUMMARY
Test memory.
USAGE
memtest [options] addr length
This command tests memory. It is a very crude test, so don't
rely on it for anything really important. Addr and length are in hex
OPTIONS
-p Address is an uncached physical address
-v Address is a kernel virtual address
-loop Loop till keypress
*** command status = 0
CFE>
Ich hab mal "memtest -loop" ausprobiert:
CFE> memtest -loop Pass 0 Pattern: A000000000000000 Pattern: 0000000000000000 Pattern: FFFFFFFFFFFFFFFF Pattern: 5555555555555555 Pattern: AAAAAAAAAAAAAAAA Pattern: FF00FF00FF00FF00 Pattern: 00FF00FF00FF00FF Pass 1 Pattern: A000000000000000 Pattern: 0000000000000000 Pattern: FFFFFFFFFFFFFFFF Pattern: 5555555555555555 Pattern: AAAAAAAAAAAAAAAA Pattern: FF00FF00FF00FF00 Pattern: 00FF00FF00FF00FF Pass 2 Pattern: A000000000000000 Pattern: 0000000000000000 Pattern: FFFFFFFFFFFFFFFF Pattern: 5555555555555555 Pattern: AAAAAAAAAAAAAAAA Pattern: FF00FF00FF00FF00 Pattern: 00FF00FF00FF00FF
[edit] f
CFE> help f
SUMMARY
Fill contents of memory.
USAGE
f [-b|-h|-w|-q] addr length pattern
This command modifies the contents of memory. You can specify the
starting address, length, and pattern of data to fill (in hex)
OPTIONS
-b Edit memory as bytes
-h Edit memory as halfwords (16-bits)
-w Edit memory as words (32-bits)
-q Edit memory as quadwords (64-bits)
-p Address is an uncached physical address
-v Address is a kernel virtual address
*** command status = 0
CFE>
[edit] e
CFE> help e
SUMMARY
Modify contents of memory.
USAGE
e [-b|-h|-w|-q] [addr [data...]]
This command modifies the contents of memory. If you do not specify
data on the command line, CFE will prompt for it. When prompting for
data you may enter '-' to back up, '=' to dump memory at the current
location, or '.' to exit edit mode.
OPTIONS
-b Edit memory as bytes
-h Edit memory as halfwords (16-bits)
-w Edit memory as words (32-bits)
-q Edit memory as quadwords (64-bits)
-p Address is an uncached physical address
-v Address is a kernel virtual address
*** command status = 0
CFE>
[edit] d
CFE> help d
SUMMARY
Dump memory.
USAGE
d [-b|-h|-w|-q] [addr [length]]
This command displays data from memory as bytes, halfwords, words,
or quadwords. ASCII text, if present, will appear to the right of
the hex data. The dump command remembers the previous word size,
dump length and last displayed address, so you can enter 'd' again
to continue a previous dump request.
OPTIONS
-b Dump memory as bytes
-h Dump memory as halfwords (16-bits)
-w Dump memory as words (32-bits)
-q Dump memory as quadwords (64-bits)
-p Address is an uncached physical address
-v Address is a kernel virtual address
*** command status = 0
CFE>
[edit] u
CFE> help u
SUMMARY
Disassemble instructions.
USAGE
u [addr [length]]
This command disassembles instructions at the specified address.
CFE will display standard register names and symbolic names for
certain CP0 registers. The 'u' command remembers the last address
that was disassembled so you can enter 'u' again with no parameters
to continue a previous request.
OPTIONS
-p Address is an uncached physical address
-v Address is a kernel virtual address
*** command status = 0
CFE>
[edit] autoboot
CFE> help autoboot
SUMMARY
Automatic system bootstrap.
USAGE
autoboot [dev]
The 'autoboot' command causes an automatic system bootstrap from
a predefined list of devices and boot files. This list is
specific to the board and port of CFE. To try autobooting from
a specific device, you can specify the CFE device name on the command line.
OPTIONS
-forever Loop over devices until boot is successful
-interruptib Scan console between devices, drop to prompt if key pressed
*** command status = 0
CFE>
[edit] batch
CFE> help batch
SUMMARY
Load a batch file into memory and execute it
USAGE
batch [-options] host:filename|dev:filename
This command loads and executes a batch file from a boot device
OPTIONS
-z Load compessed file
-tftp Load the file using the TFTP protocol
-fatfs Load the file from a FAT file system
-rawfs Load the file from an unformatted file system
-fs=* Specify CFE file system name
*** command status = 0
CFE>
[edit] go
... na endlich die Stelle gefunden, an der sich entscheidet, ob man per TFTP flashen kann oder nicht.
Ich habe boot_wait vorhin mit nvram set boot_wait="on" angeschaltet. Mal sehen, wie sich das auf den zweiten Bootvorgang auswirkt.
CFE> help go
SUMMARY
Verify and boot OS image.
USAGE
go
Boots OS image if valid. Waits for a new OS image if image is invalid
or boot_wait is unset or not on.
*** command status = 0
CFE>
[edit] load
Auch interessant :-)
aus dem Netz booten????
CFE> help load
SUMMARY
Load an executable file into memory without executing it
USAGE
load [-options] host:filename|dev:filename
This command loads an executable file into memory, but does not
execute it. It can be used for loading data files, overlays or
other programs needed before the 'boot' command is used. By
default, 'load' will load a raw binary at virtual address 0x20000000.
OPTIONS
-elf Load the file as an ELF executable
-srec Load the file as ASCII S-records
-raw Load the file as a raw binary
-z Load compessed file
-loader=* Specify CFE loader name
-tftp Load the file using the TFTP protocol
-fatfs Load the file from a FAT file system
-rawfs Load the file from an unformatted file system
-fs=* Specify CFE file system name
-max=* Specify the maximum number of bytes to load (raw only)
-addr=* Specify the load address (hex) (raw only)
*** command status = 0
CFE>
[edit] save
CFE> help save
SUMMARY
Save a region of memory to a remote file via TFTP
USAGE
save [-options] host:filename startaddr length
*** command status = 0
CFE>
[edit] ping
CFE> help ping
SUMMARY
Ping a remote IP host.
USAGE
ping [-t] remote-host
This command sends an ICMP ECHO message to a remote host and waits for
a reply. The network interface must be configured and operational for
this command to work. If the interface is configured for loopback mode
the packet will be sent through the network interface, so this command
can be used for a simple network test.
OPTIONS
-t Ping forever, or until the ENTER key is struck
-x Exit immediately on first error (use with -f or -t)
-f Flood ping (use carefully!) - ping as fast as possible
-s=* Specify the number of ICMP data bytes
-c=* Specify number of packets to echo
-A don't abort even if key is pressed
-E Require all packets sent to be returned, for successful return
status
*** command status = 0
CFE> ping 192.168.1.100 -t
Press ENTER to stop pinging
192.168.1.100 (192.168.1.100) is alive (seq=0)
192.168.1.100 (192.168.1.100) is alive (seq=1)
192.168.1.100 (192.168.1.100) is alive (seq=2)
192.168.1.100 (192.168.1.100) is alive (seq=3)
192.168.1.100 (192.168.1.100) is alive (seq=4)
192.168.1.100 (192.168.1.100): 5 packets sent, 5 received
*** command status = 0
CFE> ^C
CFE>
[edit] arp
CFE> help arp
SUMMARY
Display or modify the ARP Table
USAGE
arp [-d] [ip-address] [dest-address]
Without any parameters, the arp command will display the contents of the
arp table. With two parameters, arp can be used to add permanent arp
entries to the table (permanent arp entries do not time out)
OPTIONS
-d Delete the specified ARP entry. If specified, ip-address
may be * to delete all entries.
*** command status = 0
CFE>
[edit] ifconfig
CFE> help ifconfig
SUMMARY
Configure the Ethernet interface
USAGE
ifconfig device [options..]
Activates and configures the specified Ethernet interface and sets its
IP address, netmask, and other parameters. The -auto switch can be used
to set this information via DHCP.
OPTIONS
-auto Configure interface automatically via DHCP
-off Deactivate the specified interface
-addr=* Specifies the IP address of the interface
-mask=* Specifies the subnet mask for the interface
-gw=* Specifies the gateway address for the interface
-dns=* Specifies the name server address for the interface
-domain=* Specifies the default domain for name service queries
-speed=* Sets the interface speed (auto,10fdx,10hdx,
100fdx,
100hdx,1000fdx,1000hdx)
-loopback=* Sets the loopback mode (off,internal,external) External
loopback causes the phy to be placed in loopback mode
-hwaddr=* Sets the hardware address (overrides environment)
*** command status = 0
CFE>
[edit] show devices
eth1 ist das W-LAN- Interface....was hat das mit USB zu tun?
CFE> show devices Device Name Description ------------------- --------------------------------------------------------- uart0 NS16550 UART at 0x18000300 uart1 NS16550 UART at 0x18000400 flash0.boot New CFI flash at 1C000000 offset 00000000 size 256KB flash0.trx New CFI flash at 1C000000 offset 00040000 size 1KB flash0.os New CFI flash at 1C000000 offset 0004001C size 3808KB flash0.nvram New CFI flash at 1C000000 offset 003F8000 size 32KB flash1.boot New CFI flash at 1C000000 offset 00000000 size 256KB flash1.trx New CFI flash at 1C000000 offset 00040000 size 3808KB flash1.nvram New CFI flash at 1C000000 offset 003F8000 size 32KB flash0 New CFI flash at 1C000000 size 4096KB eth0 Broadcom BCM47xx 10/100 Mbps Ethernet Controller eth1 Broadcom USB RNDIS Network Adapter (P-t-P) *** command status = 0 CFE>
[edit] printenv
CFE> printenv Variable Name Value -------------------- -------------------------------------------------- BOOT_CONSOLE uart0 CFE_VERSION 1.0.37 CFE_BOARDNAME BCM947XX CFE_MEMORYSIZE 16 NET_DEVICE eth0 NET_IPADDR 192.168.1.1 NET_NETMASK 255.255.255.0 NET_GATEWAY 0.0.0.0 NET_NAMESERVER 0.0.0.0 STARTUP go; *** command status = 0 CFE>
[edit] Zweiter Bootvorgang
Das ist die Interessante Stelle!
Reading :: Failed.: Timeout occured
Hier wartet der CFE einige Sekunden, ob per TFTP eine neue Firmware angeboten wird.
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 18 14:27:36 CST 2004 (root@me)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena.
Initializing Devices.
No DPN
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.13.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29007: 200MHz
Total memory: 0x1000000 bytes (16MB)
Total memory used by CFE: 0x80300000 - 0x8043EB40 (1305408)
Initialized Data: 0x80338DB0 - 0x8033B160 (9136)
BSS Area: 0x8033B160 - 0x8033CB40 (6624)
Local Heap: 0x8033CB40 - 0x8043CB40 (1048576)
Stack Area: 0x8043CB40 - 0x8043EB40 (8192)
Text (code) segment: 0x80300000 - 0x80338DB0 (232880)
Boot area (physical): 0x0043F000 - 0x0047F000
Relocation Factor: I:00000000 - D:00000000
Boot version: v3.4
The boot is CFE
mac_init(): Find mac [00:12:17:DD:DE:3F] in location 0
Nothing...
eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0: hwaddr 00-12-17-DD-DE-3F, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Reading :: Failed.: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ...... 1564672 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kb, linesize 16 bytes (2 ways)
Primary data cache 4kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (root@me) (gcc version 3.2.3 with Broadcom modifications) #5 Mon Oct 18 14:26:19 CST 2004
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
CPU: BCM4712 rev 1 at 200 MHz
Calibrating delay loop... 199.47 BogoMIPS
Memory: 14444k/16384k available (1333k kernel code, 1940k reserved, 108k data, 64k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
PCI: Disabled
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
HDLC line discipline: version $Revision: 1.1.1.4 $, maxframe=4096
N_HDLC line discipline registered.
PPP generic driver version 2.4.2
Flash device: 0x400000 at 0x1c000000
Physically mapped flash: cramfs filesystem found at block 910
Creating 4 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003f0000 : "linux"
0x000e3938-0x003f0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "nvram"
sflash: found no supported devices
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (128 buckets, 1024 max) - 344 bytes per conntrack
ip_conntrack_pptp version 1.9 loaded
ip_nat_pptp version 1.5 loaded
ip_tables: (C) 2000-2002 Netfilter core team
ipt_time loading
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (cramfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 64k freed
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o
Using /lib/modules/2.4.20/kernel/drivers/net/wl/wl.o
Hit enter to continue...The boot is CFE
The chipset is BCM4712L BCM5325E
Set name-type for VLAN subsystem. Should be visible in /proc/net/vlan/config
Added VLAN with VID == 0 to IF -:eth0:-
Added VLAN with VID == 1 to IF -:eth0:-
WARNING: VLAN 1 does not work with many switches,
consider another number if you have problems.
Using /lib/modules/2.4.20/kernel/drivers/net/mac/writemac.o
killall: httpd: no process killed
The chipset is BCM4712L BCM5325E
name=[vlan0] lan_ifname=[br0]
The chipset is BCM4712L BCM5325E
=====> set br0 hwaddr to vlan0
name=[eth1] lan_ifname=[br0]
The chipset is BCM4712L BCM5325E
Write wireless mac
Write wireless mac successfully
br0: No such file or directory
name=[eth2] lan_ifname=[br0]
The chipset is BCM4712L BCM5325E
eth2: No such device
br0: No such device
interface eth2 does not exist!
name=[eth3] lan_ifname=[br0]
The chipset is BCM4712L BCM5325E
eth3: No such device
br0: No such device
interface eth3 does not exist!
lo: File exists
The boot is CFE
tftp server started
tftpd: standalone socket
info, udhcp server (v0.9.8) started
zebra disabled.
Using /lib/modules/2.4.20/kernel/drivers/net/mac/writemac.o
calling upnp_main
No interface specified. Quitting...
Input=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8114b903c8b247ad68c2ffe711
Output=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8114b903c8b247ad68c2ffe711
Generate hash of public key:
CF 6C 9C 50 2A 61 09 B4 4D 63 59 46 39 79 F6 2F - 89 F4 63 34
The EoU is not already configured
command_buf[]=-63-75-73-74-6f-6d-5f-69-65-00-00-02-01-1d-00-03-47-02-02-01-01
-03-14-cf-6c-9c-50-2a-61-09-b4-4d-63-59-46-39-79-f6-2f-89-f4-63-34-00-00-00
Input length = 129
Input=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8114b903c8b247ad68c2ffe711
Output=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8114b903c8b247ad68c2ffe711
Input length = 128
Input=9c6123d75bf3991ff7d8abae53582c8884d95da44e844f29ad8e2d985516cc84b46b4d91f292a218e1bef28e3e7bb39cc0d8bd012c611ffb45db1d3347f7bd726688e1c55b3dc08597d402109038af542723870efe389d3b1df38c296afabddd76c401491bf835b6bf86c7f8bcea68514c7ac018caded85b22bda030114edee1
Output=9c6123d75bf3991ff7d8abae53582c8884d95da44e844f29ad8e2d985516cc84b46b4d91f292a218e1bef28e3e7bb39cc0d8bd012c611ffb45db1d3347f7bd726688e1c55b3dc08597d402109038af542723870efe389d3b1df38c296afabddd76c401491bf835b6bf86c7f8bcea68514c7ac018caded85b22bda030114edee100
g_timeout_limit_tick = 720
Child process ID = 55
Parent process ID = 53
ASSOCIATE COUNT SETTING COMPLETED!!!
EoU start time : Thu Jan 1 00:00:03 1970
EXPIRED_LIMIT = 720(Ticks)
CHECK_PERIOD = 1(Minutes); 60(Seconds)
COUNT_PERIOD = 6(Minutes); 360(Seconds)
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
Hit enter to continue...info, udhcp client (v0.9.8) started
No interface specified. Quitting...
Hit enter to continue...
BusyBox v0.60.0 (2004.10.18-05:39 0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
#
[edit] ps -aux
Was ist eou?
Cisco meint: "eou stands for EAP over UDP, the authentication protocol used by NAC",
was sich auch mit den eou-Sachen beim Booten decken würde.
# ps -aux
PID Uid Stat Command
1 0 S init noinitrd
2 0 S [keventd]
3 0 S [ksoftirqd_CPU0]
4 0 S [kswapd]
5 0 S [bdflush]
6 0 S [kupdated]
7 0 S [mtdblockd]
21 0 S resetbutton
36 0 S cron
37 0 S tftpd -s /tmp -c -l
42 0 S httpd
43 0 S udhcpd /tmp/udhcpd.conf
48 0 S upnp -D -L br0 -W vlan1
53 0 S eou eth1
55 0 S eou eth1
59 0 S udhcpc -i vlan1 -p /var/run/udhcpc.pid -s /tmp/udhcpc
62 0 S /bin/sh
151 0 R ps -aux
#
[edit] eou-status
Was ist das???
# eou_status STATUS : Not Configured (Next index is 1) DEVICE_ID : HB7GHK7Q OWNERSHIP_KEY : PRIVATE_KEY : 9c6123d75bf3991f- f7d8abae53582c88- 84d95da44e844f29- ad8e2d985516cc84- b46b4d91f292a218- e1bef28e3e7bb39c- c0d8bd012c611ffb- 45db1d3347f7bd72- 6688e1c55b3dc085- 97d402109038af54- 2723870efe389d3b- 1df38c296afabddd- 76c401491bf835b6- bf86c7f8bcea6851- 4c7ac018caded85b- 22bda030114edee1- PUBLIC_KEY : b13ae45a79474724- 3b06a0703c52dd23- 413a9d53d073d12f- 3c29ab241c2ae7c9- 994668fabd951e1c- 330b9b6e028c31f5- eba04dabff18bdd8- 825ebab195d48161- 3003ec017aee3faf- e971a6172a940aaa- 0571ab29bb515699- 89ab5daf743882f5- 90874d2228ea7cc8- 14b96d7421848c44- 9b6907da8114b903- c8b247ad68c2ffe7- 11 #
[edit] Werkzeugkiste
Mal sehen, mit welchen Bordmitteln die Original-Firmware daher kommt.
[edit] busybox
# busybox
BusyBox v0.60.0 (2004.10.18-05:39 0000) multi-call binary
Usage: busybox [function] [arguments]...
or: [function] [arguments]...
BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use, and BusyBox
will act like whatever it was invoked as.
Currently defined functions:
[, busybox, cat, chmod, cp, date, echo, false, free, grep, ifconfig,
insmod, kill, killall, klogd, ln, ls, lsmod, mkdir, more, msh,
mv, pgrep, ping, ps, reboot, rm, rmdir, rmmod, route, sh, sleep,
sync, syslogd, tail, test, touch, true, vi
#
[edit] wl
# wl Usage: wl [-a|i <adapter>] [-hu] <command> [arguments] -a, -i adapter name or number -h, -u this message ver get version information cmds generate a short list of available commands up reinitialize and mark adapter up (operational) down reset and mark adapter down (disabled) out mark adapter down but do not reset hardware(disabled) On dualband cards, cards must be bandlocked before use. clk set board clock state. return error for set_clk attempt if the driver is not down 0: clock off 1: clock on restart Restart driver. Driver must already be down. reboot Reboot platform ucflags Get/Set ucode flags radio Set the radio on or off. "on" or "off" dump print driver software state and chip registers to stdout srdump print contents of SPROM to stdout nvdump print nvram variables to stdout nvset set an nvram variable name=value (no spaces around '=') nvget get the value of an nvram variable revinfo get hardware revision information msglevel set driver console debugging message bitvector type 'wl msglevel ?' for values PM set driver power management mode: 0: CAM (constantly awake) 1: PS (power-save) 2: FAST PS mode wake set driver power-save mode sleep state: 0: core-managed 1: awake promisc set promiscuous mode ethernet address reception 0 - disable 1 - enable monitor set monitor mode 0 - disable 1 - enable active monitor mode (interface still operates) frag Set the fragmentation threshhold. (integer [256, 2346]) rts Set the RTS threshhold. (integer [0, 2347]) cwmin Set the cwmin. (integer [1, 255]) cwmax Set the cwmax. (integer [256, 2047]) srl Set the short retry limit. (integer [1, 255]) lrl Set the long retry limit. (integer [1, 255]) rate force a fixed rate: valid values for 802.11a are (6, 9, 12, 18, 24, 36, 48, 54) valid values for 802.11b are (1, 2, 5.5, 11) valid values for 802.11g are (1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, 54) -1 (default) means automatically determine the best rate mrate force a fixed multicast rate: valid values for 802.11a are (6, 9, 12, 18, 24, 36, 48, 54) valid values for 802.11b are (1, 2, 5.5, 11) valid values for 802.11g are (1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, 54) -1 (default) means automatically determine the best rate infra Set Infrastructure mode: 0 (IBSS) or 1 (Infra BSS) ap Set AP mode: 0 (STA) or 1 (AP) bssid Get the BSSID value, error if STA and not associated channel Set the channel: valid channels for 802.11b/g (2.4GHz band) are 1 through 14 valid channels for 802.11a (5 GHz band) are: 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116,120, 124, 128, 132, 136, 140, 149, 153, 157, 161, 184, 188, 192, 196, 200, 204, 208, 212, 216 tssi Get the tssi value from radio txpwr Set tx power in milliwatts. Range [1, 84]. (Deprecated: Use txpwr1 instead) txpwr1 Set tx power in in various units. Choose one of (default: dbm): -d dbm units -q quarter dbm units -m milliwatt units Can be combined with: -o turn on override to disable regulatory and other limitations txpathpwr Turn the tx path power on or off on 2050 radios txpwrlimit Return current tx power limit powerindex Set the transmit power for A band(0-63). -1 - default value atten Set the transmit attenuation for B band. Args: bb radio txctl1. auto to revert to automatic control phyreg Get/Set a phy register. radioreg Get/Set a radio register. shmem Get/Set a shared memory location. macreg Get/Set any mac registers(include IHR and SB) macreg offset size[2,4] [value] antdiv Set antenna diversity for rx 0 - force use of antenna 0 1 - force use of antenna 1 3 - automatic selection of antenna diversity txant Set the transmit antenna 0 - force use of antenna 0 1 - force use of antenna 1 3 - use the RX antenna selection that was in force during the most recently received good PLCP header plcphdr Set the plcp header. "long" or "auto" or "debug" phytype Get phy type scbdump print driver scb state to stdout ratedump print driver rate selection tunables and per-scb state to stdout, valid scb values are 0 through NSCB-1 rateparam set driver rate selection tunables arg 1: tunable id arg 2: tunable value wepstatus Set or Get WEP status wepstatus [on|off] primary_key Set or get index of primary key addwep Set an encryption key. The key must be 5, 13 or 16 bytes long, or 10, 26, 32, or 64 hex digits long. The encryption algorithm is automatically selected based on the key size. keytype is accepted only when key length is 16 bytes/32 hex digits and specifies whether AES-OCB or AES-CCM encryption is used. Default is ccm. addwep <keyindex> <keydata> [ocb | ccm] [notx] [xx:xx:xx:xx:xx:xx] rmwep Remove the encryption key at the specified key index. wep Set WEP options. wl wep [options] [on|enable|1] enable WEP [off|disable|0] disable WEP [sw|software] perform WEP in software [hw|hardware] perform WEP in hardware tkip Set TKIP options. wl tkip [options] [on|enable|1] enable TKIP [off|disable|0] disable TKIP [sw|software] perform TKIP in software [hw|hardware] perform TKIP in hardware aes Set AES options. wl aes [options] [on|enable|1] enable AES [off|disable|0] disable AES [sw|software] perform AES in software [hw|hardware] perform AES in hardware keys Prints a list of the current WEP keys tsc Print Tx Sequence Couter for key at specified key index. wsec_test Generate wsec errors wsec_test <test_type> <keyindex|xx:xx:xx:xx:xx:xx> type 'wl wsec_test ?' for test_types tkip_countermeasures Enable or disable TKIP countermeasures (TKIP-enabled AP only) 0 - disable 1 - enable wsec_restrict Drop unencrypted packets if WSEC is enabled 0 - disable 1 - enable eap restrict traffic to 802.1X packets until 802.1X authorization succeeds 0 - disable 1 - enable authorize restrict traffic to 802.1X packets until 802.1X authorization succeeds deauthorize do not restrict traffic to 802.1X packets until 802.1X authorization succeeds deauthenticate deauthenticate a STA from the AP with optional reason code (AP ONLY) wsec wireless security bit vector 1 - WEP enabled 2 - TKIP enabled 4 - AES enabled 8 - WSEC in software wpa_auth WPA authorization mode [none|0] none [unspecified|1] WPA 802.1X [psk|2] WPA PSK [disable|255] disable WPA set_pmk Set passphrase for PMK in driver-resident supplicant. scan Initiate a scan. Default an active scan across all channels for any SSID. Optional arg: SSID, the SSID to scan. Options: -s S, --ssid=S SSID to scan -t ST, --scan_type=ST [active|passive] scan type --bss_type=BT [bss/infra|ibss/adhoc] bss type to scan -b MAC, --bssid=MAC particular BSSID MAC address to scan, xx:xx:xx:xx:xx:xx -n N, --nprobes=N number of probes per scanned channel -a N, --active=N dwell time per channel for active scanning -p N, --passive=N dwell time per channel for passive scanning -h N, --home=N dwell time for the home channel between channel scans -c L, --channels=L comma or space separated list of channels to scan passive Puts scan engine into passive mode regulatory Get/Set regulatory domain mode (802.11d). Driver must be down. spect Get/Set 802.11h Spectrum Management mode. 0 - Off 1 - Loose interpretation of spec - may join non-11h APs 2 - Strict interpretation of spec - may not join non-11h APs scanresults Return results from last scan. assoc Print information about current network association. (also known as "status") status Print information about current network association. (also known as "assoc") disassoc Disassociate from the current BSS/IBSS. chanlist Return valid channels for the current settings. channels Return valid channels for the current settings. channels_in_country Return valid channels for the country specified. Arg 1 is the country abbreviation Arg 2 is the band(a or b) curpower Return current tx power settings scansuppress Suppress all scans for testing. 0 - allow scans 1 - suppress scans evm Start an EVM test on the given channel, or stop EVM test. Arg 1 is channel number 1-14, or "off" or 0 to stop the test. Arg 2 is optional rate (1, 2, 5.5 or 11) rateset Returns or sets the supported and basic rateset, (b) indicates basic With no args, returns the rateset. Args are rateset "default" | "all" | <arbitrary rateset> default - driver defaults all - all rates are basic rates arbitrary rateset - list of rates List of rates are in Mbps and each rate is optionally followed by "(b)" or "b" for a Basic rate. Example: 1(b) 2b 5.5 11 At least one rate must be Basic for a legal rateset. roam_trigger Set the roam trigger RSSI threshold. (integer) roam_delta Set the roam candidate qualification delta. (integer) roam_scan_period Set the roam candidate qualification delta. (integer) suprates Returns or sets the 11g override for the supported rateset With no args, returns the rateset. Args are a list of rates, or 0 or -1 to specify an empty rateset to clear the override. List of rates are in Mbps, example: 1 2 5.5 11 scan_channel_time Get/Set scan channel time scan_unassoc_time Get/Set unassociated scan channel dwell time scan_home_time Get/Set scan home channel dwell time scan_passive_time Get/Set passive scan channel dwell time scan_nprobes Get/Set scan parameter for number of probes to use per channel scanned prb_resp_timeout Get/Set probe response timeout channel_qa Get last channel quality measurment channel_qa_start Start a channel quality measurment country Select Country code for use with 802.11d Use either long name or abbreviation from ISO 3166. Use 'wl country list [band(a or b)]' for the list of supported countries locale OBSOLETE: use "wl country" Select the country: Worldwide Thailand Israel Jordan China Japan USA/Canada/ANZ Europe USAlow JapanHigh All join Join a specified network SSID. Join syntax is: join <ssid> [key xxxxx] [imode bss|ibss] [amode open|shared|wpa|wpapsk|wpanone] ssid Set or get the current SSID. Setting will initiate an assoication attempt if in infrastructure mode, or join/creation of an IBSS if in IBSS mode, or creation of a BSS if in AP mode. mac Set or get the list of source MAC address matches. wl mac xx:xx:xx:xx:xx:xx [xx:xx:xx:xx:xx:xx ...] To Clear the list: wl mac none macmode Set the mode of the MAC list. 0 - Disable MAC address matching. 1 - Deny association to stations on the MAC list. 2 - Allow association to stations on the MAC list. wds Set or get the list of WDS member MAC addresses. Set using a space separated list of MAC addresses. wl wds xx:xx:xx:xx:xx:xx [xx:xx:xx:xx:xx:xx ...] lazywds Set or get "lazy" WDS mode (dynamically grant WDS membership to anyone). noise Get noise (moving average) right after tx in dBm fqacurcy Manufacturing test: set frequency accuracy mode. freqacuracy syntax is: fqacurcy <channel> Arg is channel number 1-14, or 0 to stop the test. crsuprs Manufacturing test: set carrier suppression mode. carriersuprs syntax is: crsuprs <channel> Arg is channel number 1-14, or 0 to stop the test. int Interrupt Test - remember to precede by 'wl down' and follow by 'wl up' lbt Loopback Test - remember to precede by 'wl down' and follow by 'wl up' band Returns or sets the current band auto - auto switch between available bands (default) a - force use of 802.11a band b - force use of 802.11b band bands Return the list of available 802.11 bands phylist Return the list of available phytypes shortslot Get/Set 11g Short Slot Timing mode. (-1=auto, 0=long, 1=short) shortslot_override Get/Set 11g Short Slot Timing mode override. (-1=auto, 0=long, 1=short) shortslot_restrict Get/Set AP Restriction on associations for 11g Short Slot Timing capable STAs. 0 - Do not restrict association based on ShortSlot capability 1 - Restrict association to STAs with ShortSlot capability ignore_bcns AP only (G mode): Check for beacons without NONERP element (0=Examine beacons, 1=Ignore beacons) pktcnt Get the summary of good and bad packets. upgrade Upgrade the firmware on an embedded device gmode Set the 54g Mode (LegacyB|Auto||GOnly|BDeferred|Performance|LRS|Afterburner) gmode_protection Get G protection mode. (0=disabled, 1=enabled) gmode_protection_control Get/Set 11g protection mode control alg. (0=always off, 1=monitor local association, 2=monitor overlapping BSS) gmode_protection_cts Get/Set 11g protection type to CTS (0=disable, 1=enable) gmode_protection_override Get/Set 11g protection mode override. (-1=auto, 0=disable, 1=enable) legacy_erp Get/Set 11g legacy ERP inclusion (0=disable, 1=enable) scb_timeout AP only: inactivity timeout value for authenticated stas assoclist AP only: Get the list of associated MAC addresses. rssi Get the current RSSI val, for an AP you must specify the mac addr of the STA isup Get driver operational state (0=down, 1=up) fasttimer Get/Set High frequency watchdog timeout (tx_power) [15 sec] slowtimer Get/Set Low frequency watchdog timeout (nrssislope) [60 sec] glacialtimer Get/Set Very Low frequency watchdog timeout (measurelo) [120 sec] radar Enable/Disable radar rssidump Dump rssi values from aci scans interference Get/Set interference mitigation mode. Choices are: 0 = none 1 = non wlan 2 = wlan manual 3 = wlan automatic aciargs Get/Set various aci tuning parameters. Choices are: enter: CRS glitch trigger level to start detecting ACI exit: CRS glitch trigger level to exit ACI mode glitch Seconds interval between ACI scans when glitchcount is continuously high spin: Num microsecs to delay between rssi samples Usage: wl aciargs [enter x][exit x][spin x][glitch x] frameburst Disable/Enable frameburst mode pwr_percent Get/Set power output percentage wet Get/Set wireless ethernet bridging mode dtim Get/Set DTIM wds_remote_mac Get WDS link remote endpoint's MAC address wds_wpa_role_old Get WDS link local endpoint's WPA role (old) wds_wpa_role Get/Set WDS link local endpoint's WPA role authe_sta_list Get authenticated sta mac address list autho_sta_list Get authorized sta mac address list measure_req Send an 802.11h measurement request. Usage: wl measure_req <type> <target MAC addr> Measurement types are: TPC, Basic, CCA, RPI Target MAC addr format is xx:xx:xx:xx:xx:xx quiet Send an 802.11h quiet command. Usage: wl quiet <TBTTs until start>, <duration (in TUs)>, <offset (in TUs)> csa Send an 802.11h channel switch anouncement Usage wl csa <mode> <when (in TBTTs)> <channel> constraint Send an 802.11h Power Constraint IE Usage: wl constraint 1-255 db rm_req Request a radio measurement of type basic, cca, or rpi specify a series of measurement types each followed by options. example: wl rm_req cca -c 1 -d 50 cca -c 6 cca -c 11 Options: -t n numeric token id for measurement set or measurement -c n channel -d n duration in TUs (1024 us) -p parallel flag, measurement starts at the same time as previous Each measurement specified uses the same channel and duration as the previous unless a new channel or duration is specified. rm_rep Get current radio measurement report wme Set WME (Wireless Multimedia Extensions) mode (0=off, 1=on) sta_info wl sta_info <xx:xx:xx:xx:xx:xx> cap wl cap will dispaly WL Capabilities
[edit] /sbin
# ls write reboot ipupdated filtersync syslogd rc insmod filter stats qos init erase site_suvery process_monitor ifconfig eou_status rmmod ntpd hotplug disconnected_pppoe restore lsmod hb_disconnect ddns_success resetbutton listen hb_connect check_ps redial klogd gpio #
[edit] offene ports
192.168. 1. 1: 80 [TCP] open -> http 192.168. 1. 1: 389 [TCP] open -> ldap 192.168. 1. 1: 1002 [TCP] open 192.168. 1. 1: 5431 [TCP] open -> park-agent
[edit] Upgrade
Bei der Originalfirmware gibt es nicht besonders viele Spielmöglichkeiten.
Deswegen erstmal DD-WRT prefinal4 über die Weboberfläche geflasht und über die serielle Schnittstelle aufgezeichnet
[edit] Flashvorgang
# The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
Upgrading
upgrade_ver[v-5.0.0] upgrade_ver[-50000] intel_ver[14108] 4712_ver[15000]
code pattern error!
.freeram=[7303168] bufferram=[1343488]
The free memory is enough, writing image once.
...............................Upgrading from web (http) now, quiet exit....
check_ps: nothing to do...
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
........................................................sum=[2985984]
..linux: CRC OK
Writing image to flash, waiting a monent...
done
The chipset is BCM4712L BCM5325E
The chipset is BCM4712L BCM5325E
Terminated....................................
The chipset is BCM4712L BCM5325E
Sending SIGTERM to all processes
info, Received SIGTERM
Sending SIGKILL to all processesRestarting system.
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 18 14:27:36 CST 2004 (root@me)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena.
Initializing Devices.
No DPN
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.13.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29007: 200MHz
Total memory: 0x1000000 bytes (16MB)
Total memory used by CFE: 0x80300000 - 0x8043EB40 (1305408)
Initialized Data: 0x80338DB0 - 0x8033B160 (9136)
BSS Area: 0x8033B160 - 0x8033CB40 (6624)
Local Heap: 0x8033CB40 - 0x8043CB40 (1048576)
Stack Area: 0x8043CB40 - 0x8043EB40 (8192)
Text (code) segment: 0x80300000 - 0x80338DB0 (232880)
Boot area (physical): 0x0043F000 - 0x0047F000
Relocation Factor: I:00000000 - D:00000000
Boot version: v3.4
The boot is CFE
mac_init(): Find mac [00:12:17:DD:DE:3F] in location 0
Nothing...
eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0: hwaddr 00-12-17-DD-DE-3F, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Reading :: Failed.: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ....... 2031616 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kb, linesize 16 bytes (2 ways)
Primary data cache 4kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (root@colinux) (gcc version 3.2.3 with Broadcom modificatio
ns) #235 Thu Apr 21 20:50:49 UTC 2005
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs noinitrd console=tt
yS0,115200
CPU: BCM4712 rev 1 at 200 MHz
Calibrating delay loop... 199.47 BogoMIPS
Memory: 13952k/16384k available (1762k kernel code, 2432k reserved, 128k data, 7
6k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
PCI: Disabled
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en
abled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
HDLC line discipline: version $Revision: 1.1.1.4 $, maxframe=4096
N_HDLC line discipline registered.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
imq driver loaded.
Universal TUN/TAP device driver 1.5 (C)1999-2002 Maxim Krasnyansky
Flash device: 0x400000 at 0x1c000000
Physically mapped flash: squashfs filesystem found at block 1016
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003f0000 : "linux"
0x000fe004-0x003178b5 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-o
nly
0x003f0000-0x00400000 : "nvram"
0x00320000-0x003f0000 : "ddwrt"
sflash: found no supported devices
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (512 buckets, 4096 max) - 368 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
IPP2P v0.7.1 loading
ipt_random match loaded
netfilter PSD loaded - (c) astaro AG
ipt_osf: Startng OS fingerprint matching module.
ipt_time loading
ipt_IPV4OPTSSTRIP loaded
arp_tables: (C) 2002 David S. Miller
ip_queue: failed to register queue handler
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
IPsec over IPv4 tunneling driver
Ebtables v2.0 registered<6>NET4: Ethernet Bridge 008 for NET4.0
Bridge firewalling registered
802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
cryptoapi: loaded
cryptoapi: Registered aes-ecb (0)
cryptoapi: Registered aes-cbc (65536)
cryptoapi: Registered aes-cfb (131072)
cryptoapi: Registered aes-ctr (262144)
cryptoapi: Registered aes-rtc (524288)
cryptoapi: Registered 3des-ecb (0)
cryptoapi: Registered 3des-cbc (65536)
cryptoapi: Registered 3des-cfb (131072)
cryptoapi: Registered 3des-ctr (262144)
cryptoapi: Registered 3des-rtc (524288)
cryptoapi: Registered md5 (0)
cryptoapi: Registered sha1 (0)
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 76k freed
Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o
Warning: loading et will taint the kernel: no license
See http://www.tux.org/lkml/#export-tainted for information about tainted modu
les
Using /lib/modules/2.4.20/kernel/drivers/net/wl/wl.o
Warning: loading wl will taint the kernel: no license
See http://www.tux.org/lkml/#export-tainted for information about tainted modu
les
insmod: writemac.o: no module by that name found
nvram_commit(): start
nvram_commit(): end
nvram_commit(): start
nvram_commit(): end
mkdir: Cannot create directory `/var/log': File exists
killall: httpd: no process killed
br0: No such device
wlconf: vlan0 failed (-1)
br0: No such device
eth2: No such device
eth3: No such device
wlconf: br0 failed (1)
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
killall: telnetd: no process killed
tftp server started
tftpd: standalone socket
nvram_commit(): start
nvram_commit(): end
killall: upnp: no process killed
calling upnp_main
killall: nas: no process killed
killall: nas: no process killed
zebra disabled.
killall: wland: no process killed
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_pptp.o
starting cron
killall: pptpd: no process killed
killall: snmpd: no process killed
killall: wol: no process killed
killall: nas: no process killed
killall: nas: no process killed
sh: /tmp/.rc_startup: not found
nvram_commit(): start
nvram_commit(): start
nvram_commit(): start
nvram_commit(): start
nvram_commit(): start
mkdir: Cannot create directory `/jffs/tmp': Read-only file system
mkdir: Cannot create directory `/jffs/tmp/ipkg': No such file or directory
nvram_commit(): end
nvram_commit(): end
nvram_commit(): end
nvram_commit(): end
nvram_commit(): end
BusyBox v1.00 (2005.04.16-19:38 0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
/ #
/ #
[edit] First Boot
/ # reboot
Terminated....................................
Sending SIGTERM to all processes
Terminated
/ # Sending SIGKILL to all processesRestarting system.
CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 18 14:27:36 CST 2004 (root@me)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena.
Initializing Devices.
No DPN
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.13.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29007: 200MHz
Total memory: 0x1000000 bytes (16MB)
Total memory used by CFE: 0x80300000 - 0x8043EB40 (1305408)
Initialized Data: 0x80338DB0 - 0x8033B160 (9136)
BSS Area: 0x8033B160 - 0x8033CB40 (6624)
Local Heap: 0x8033CB40 - 0x8043CB40 (1048576)
Stack Area: 0x8043CB40 - 0x8043EB40 (8192)
Text (code) segment: 0x80300000 - 0x80338DB0 (232880)
Boot area (physical): 0x0043F000 - 0x0047F000
Relocation Factor: I:00000000 - D:00000000
Boot version: v3.4
The boot is CFE
mac_init(): Find mac [00:12:17:DD:DE:3F] in location 0
Nothing...
eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0: hwaddr 00-12-17-DD-DE-3F, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Reading :: Failed.: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ....... 2031616 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kb, linesize 16 bytes (2 ways)
Primary data cache 4kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (root@colinux) (gcc version 3.2.3 with Broadcom modificatio
ns) #235 Thu Apr 21 20:50:49 UTC 2005
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs noinitrd console=tt
yS0,115200
CPU: BCM4712 rev 1 at 200 MHz
Calibrating delay loop... 199.47 BogoMIPS
Memory: 13952k/16384k available (1762k kernel code, 2432k reserved, 128k data, 7
6k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
PCI: Disabled
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en
abled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
HDLC line discipline: version $Revision: 1.1.1.4 $, maxframe=4096
N_HDLC line discipline registered.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
imq driver loaded.
Universal TUN/TAP device driver 1.5 (C)1999-2002 Maxim Krasnyansky
Flash device: 0x400000 at 0x1c000000
Physically mapped flash: squashfs filesystem found at block 1016
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003f0000 : "linux"
0x000fe004-0x003178b5 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-o
nly
0x003f0000-0x00400000 : "nvram"
0x00320000-0x003f0000 : "ddwrt"
sflash: found no supported devices
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (512 buckets, 4096 max) - 368 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
IPP2P v0.7.1 loading
ipt_random match loaded
netfilter PSD loaded - (c) astaro AG
ipt_osf: Startng OS fingerprint matching module.
ipt_time loading
ipt_IPV4OPTSSTRIP loaded
arp_tables: (C) 2002 David S. Miller
ip_queue: failed to register queue handler
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
IPsec over IPv4 tunneling driver
Ebtables v2.0 registered<6>NET4: Ethernet Bridge 008 for NET4.0
Bridge firewalling registered
802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
cryptoapi: loaded
cryptoapi: Registered aes-ecb (0)
cryptoapi: Registered aes-cbc (65536)
cryptoapi: Registered aes-cfb (131072)
cryptoapi: Registered aes-ctr (262144)
cryptoapi: Registered aes-rtc (524288)
cryptoapi: Registered 3des-ecb (0)
cryptoapi: Registered 3des-cbc (65536)
cryptoapi: Registered 3des-cfb (131072)
cryptoapi: Registered 3des-ctr (262144)
cryptoapi: Registered 3des-rtc (524288)
cryptoapi: Registered md5 (0)
cryptoapi: Registered sha1 (0)
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 76k freed
Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o
Warning: loading et will taint the kernel: no license
See http://www.tux.org/lkml/#export-tainted for information about tainted modu
les
Using /lib/modules/2.4.20/kernel/drivers/net/wl/wl.o
Warning: loading wl will taint the kernel: no license
See http://www.tux.org/lkml/#export-tainted for information about tainted modu
les
insmod: writemac.o: no module by that name found
[: missing ]
[: missing ]
mkdir: Cannot create directory `/var/log': File exists
killall: httpd: no process killed
br0: No such device
wlconf: vlan0 failed (-1)
br0: No such device
eth2: No such device
eth3: No such device
wlconf: br0 failed (1)
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
killall: telnetd: no process killed
tftp server started
tftpd: standalone socket
killall: upnp: no process killed
calling upnp_main
killall: nas: no process killed
killall: nas: no process killed
zebra disabled.
killall: wland: no process killed
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_pptp.o
starting cron
killall: pptpd: no process killed
killall: snmpd: no process killed
killall: wol: no process killed
killall: nas: no process killed
killall: nas: no process killed
sh: /tmp/.rc_startup: not found
[: missing ]
mkdir: Cannot create directory `/jffs/tmp': Read-only file system
mkdir: Cannot create directory `/jffs/tmp/ipkg': No such file or directory
BusyBox v1.00 (2005.04.16-19:38 0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
/ #
/ #