Bootvorgang

From DD-WRT Wiki

Revision as of 20:36, 15 June 2006 by 84.161.64.160 (Talk)
Jump to: navigation, search

Contents


Ich hab hier mal einen WRT54g V 2.2 mit einer Seriellen Schnittstelle versehen, um mir mal die originalen Einstellungen anzusehen.
Warum das Alles?
... ich weiß noch nicht! Vielleicht gibt es ja was zu entdecken.
Der WRT war original verpackt.
Es geht los, mit den allerersten Bootvorgang

Erster Bootvorgang

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 18 14:27:36 CST 2004 (root@me)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.

No DPN
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.13.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29007: 200MHz
Total memory: 0x1000000 bytes (16MB)

Total memory used by CFE:  0x80300000 - 0x8043EB40 (1305408)
Initialized Data:          0x80338DB0 - 0x8033B160 (9136)
BSS Area:                  0x8033B160 - 0x8033CB40 (6624)
Local Heap:                0x8033CB40 - 0x8043CB40 (1048576)
Stack Area:                0x8043CB40 - 0x8043EB40 (8192)
Text (code) segment:       0x80300000 - 0x80338DB0 (232880)
Boot area (physical):      0x0043F000 - 0x0047F000
Relocation Factor:         I:00000000 - D:00000000

Boot version: v3.4
The boot is CFE

mac_init(): Find mac [00:12:17:DD:DE:3F] in location 0
Nothing...

eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0:  hwaddr 00-12-17-DD-DE-3F, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ...... 1564672 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kb, linesize 16 bytes (2 ways)
Primary data cache 4kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (root@me) (gcc version 3.2.3 with Broadcom modifications) #
5 Mon Oct 18 14:26:19 CST 2004
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
CPU: BCM4712 rev 1 at 200 MHz
Calibrating delay loop... 199.47 BogoMIPS
Memory: 14444k/16384k available (1333k kernel code, 1940k reserved, 108k data, 6
4k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: Disabled
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en
abled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
HDLC line discipline: version $Revision: 1.1.1.4 $, maxframe=4096
N_HDLC line discipline registered.
PPP generic driver version 2.4.2
Flash device: 0x400000 at 0x1c000000
Physically mapped flash: cramfs filesystem found at block 910
Creating 4 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003f0000 : "linux"
0x000e3938-0x003f0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-o
nly
0x003f0000-0x00400000 : "nvram"
sflash: found no supported devices
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (128 buckets, 1024 max) - 344 bytes per conntrack
ip_conntrack_pptp version 1.9 loaded
ip_nat_pptp version 1.5 loaded
ip_tables: (C) 2000-2002 Netfilter core team
ipt_time loading
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (cramfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 64k freed
The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o
Using /lib/modules/2.4.20/kernel/drivers/net/wl/wl.o
Hit enter to continue...The boot is CFE
The chipset is BCM4712L + BCM5325E
Set name-type for VLAN subsystem. Should be visible in /proc/net/vlan/config
Added VLAN with VID == 0 to IF -:eth0:-
Added VLAN with VID == 1 to IF -:eth0:-
WARNING:  VLAN 1 does not work with many switches,
consider another number if you have problems.
Using /lib/modules/2.4.20/kernel/drivers/net/mac/writemac.o
killall: httpd: no process killed
The chipset is BCM4712L + BCM5325E
name=[vlan0] lan_ifname=[br0]
The chipset is BCM4712L + BCM5325E
=====> set br0 hwaddr to vlan0
name=[eth1] lan_ifname=[br0]
The chipset is BCM4712L + BCM5325E
Write wireless mac
Write wireless mac successfully
br0: No such file or directory
name=[eth2] lan_ifname=[br0]
The chipset is BCM4712L + BCM5325E
eth2: No such device
br0: No such device
interface eth2 does not exist!
name=[eth3] lan_ifname=[br0]
The chipset is BCM4712L + BCM5325E
eth3: No such device
br0: No such device
interface eth3 does not exist!
lo: File exists
The boot is CFE
tftp server started
tftpd: standalone socket
info, udhcp server (v0.9.8) started
zebra disabled.
No interface specified. Quitting...
calling upnp_main
Using /lib/modules/2.4.20/kernel/drivers/net/mac/writemac.o

Input=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd
951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a
940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da81
14b903c8b247ad68c2ffe711

Output=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fab
d951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172
a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8
114b903c8b247ad68c2ffe711
Generate hash of public key:
CF 6C 9C 50 2A 61 09 B4 4D 63 59 46 39 79 F6 2F - 89 F4 63 34

The EoU is not already configured

command_buf[]=-63-75-73-74-6f-6d-5f-69-65-00-00-02-01-1d-00-03-47-02-02-01-01
-03-14-cf-6c-9c-50-2a-61-09-b4-4d-63-59-46-39-79-f6-2f-89-f4-63-34-00-00-00

Input length = 129
Input=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd
951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a
940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da81
14b903c8b247ad68c2ffe711

Output=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fab
d951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172
a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8
114b903c8b247ad68c2ffe711

Input length = 128
Input=9c6123d75bf3991ff7d8abae53582c8884d95da44e844f29ad8e2d985516cc84b46b4d91f2
92a218e1bef28e3e7bb39cc0d8bd012c611ffb45db1d3347f7bd726688e1c55b3dc08597d4021090
38af542723870efe389d3b1df38c296afabddd76c401491bf835b6bf86c7f8bcea68514c7ac018ca
ded85b22bda030114edee10

Output=9c6123d75bf3991ff7d8abae53582c8884d95da44e844f29ad8e2d985516cc84b46b4d91f
292a218e1bef28e3e7bb39cc0d8bd012c611ffb45db1d3347f7bd726688e1c55b3dc08597d402109
038af542723870efe389d3b1df38c296afabddd76c401491bf835b6bf86c7f8bcea68514c7ac018c
aded85b22bda030114edee100

g_timeout_limit_tick = 720

Child process ID = 54

Parent process ID = 53

ASSOCIATE COUNT SETTING COMPLETED!!!

EoU start time : Thu Jan  1 00:00:03 1970

EXPIRED_LIMIT  = 720(Ticks)
CHECK_PERIOD   = 1(Minutes); 60(Seconds)
COUNT_PERIOD   = 6(Minutes); 360(Seconds)
The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
Hit enter to continue...info, udhcp client (v0.9.8) started
No interface specified. Quitting...
Hit enter to continue...


BusyBox v0.60.0 (2004.10.18-05:39+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

#
#


CFE

Abbruch des zweiten Bootvorgangs mit "Strg+C", um den Bootloader "CFE" näher zu untersuchen.
Die Power-LED blinkt ca. 4-5 Mal/Sekunde und die DMZ-LED bleibt an.

eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0:  hwaddr 00-12-17-DD-DE-3F, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Automatic startup canceled via Ctrl-C
CFE>

Der CFE sollte eigentlich immer gleich bleiben. Egal, welche Firmware später mal geflasht wird.
Die Eingabe von "help" zeigt weiter Optionen.

CFE> help
Available commands:

rndis               Broadcom USB RNDIS utility.
et                  Broadcom Ethernet utility.
nvram               NVRAM utility.
reboot              Reboot.
flash               Update a flash memory device
memtest             Test memory.
f                   Fill contents of memory.
e                   Modify contents of memory.
d                   Dump memory.
u                   Disassemble instructions.
autoboot            Automatic system bootstrap.
batch               Load a batch file into memory and execute it
go                  Verify and boot OS image.
boot                Load an executable file into memory and execute it
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
ping                Ping a remote IP host.
arp                 Display or modify the ARP Table
ifconfig            Configure the Ethernet interface
show devices        Display information about the installed devices.
unsetenv            Delete an environment variable.
printenv            Display the environment variables
setenv              Set an environment variable.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0
CFE>

rndis

Das USB-Pinout des Broadcom Chips ist leider physikalisch nicht anzapfbar.
....aber vorhanden :-)

CFE> help rndis

  SUMMARY

     Broadcom USB RNDIS utility.

  USAGE

     rndis command [args..]

     Configures the specified Broadcom USB RNDIS interface.

  OPTIONS

     -i=*         Specifies the interface
     dump         Dump driver information
     msglevel     Sets the driver message level

*** command status = 0
CFE> rndis dump
addr 00:ff:12:34:56:78 rxq 0/128
rx_packets 0 tx_packets 0 rx_errors 0 tx_errors 0 tx_dropped 0
*** command status = 0
CFE>
CFE> rndis msglevel
*** command status = -8
CFE>

et

CFE> help et

  SUMMARY

     Broadcom Ethernet utility.

  USAGE

     et command [args..]

     Configures the specified Broadcom Ethernet interface.

  OPTIONS

     -i=*         Specifies the interface
     up           Activate the specified interface
     down         Deactivate the specified interface
     loop         Sets the loopback mode (0,1)
     dump         Dump driver information
     msglevel     Sets the driver message level
     promisc      Sets promiscuous mode

*** command status = 0
CFE>

nvram

Hier findet mann auch die beliebte boot_wait-Variable.

CFE> help nvram

  SUMMARY

     NVRAM utility.

  USAGE

     nvram [command] [args..]

     Access NVRAM.

  OPTIONS

     get [name]   Gets the value of the specified variable
     set [name=va Sets the value of the specified variable
     unset [name] Deletes the specified variable
     commit       Commit variables to flash
     erase        Erase all nvram
     show         Shows all variables

*** command status = 0
CFE> nvram get boot_wait
off
*** command status = 0
CFE> nvram set boot_wait="on"
*** command status = 0
CFE> nvram commit
*** command status = 0
CFE> nvram get boot_wait
on
*** command status = 0
CFE>

nvram show

flash

CFE> help flash

  SUMMARY

     Update a flash memory device

  USAGE

     flash [options] filename [flashdevice]

     Copies data from a source file name or device to a flash memory device.
     The source device can be a disk file (FAT filesystem), a remote file
     (TFTP) or a flash device.  The destination device may be a flash or eeprom.

     If the destination device is your boot flash (usually flash0), the flash
     command will restart the firmware after the flash update is complete

  OPTIONS

     -noerase     Don't erase flash before writing
     -offset=*    Begin programming at this offset in the flash device
     -size=*      Size of source device when programming from flash to flash
     -ctheader    Check header of CyberTAN
     -noheader    Override header verification, flash binary without checking

*** command status = 0
CFE>

memtest

CFE> help memtest

  SUMMARY

     Test memory.

  USAGE

     memtest [options] addr length

     This command tests memory.  It is a very crude test, so don't
     rely on it for anything really important.  Addr and length are in hex

  OPTIONS

     -p           Address is an uncached physical address
     -v           Address is a kernel virtual address
     -loop        Loop till keypress

*** command status = 0
CFE>

Ich hab mal "memtest -loop" ausprobiert:

CFE> memtest -loop
Pass 0
Pattern: A000000000000000
Pattern: 0000000000000000
Pattern: FFFFFFFFFFFFFFFF
Pattern: 5555555555555555
Pattern: AAAAAAAAAAAAAAAA
Pattern: FF00FF00FF00FF00
Pattern: 00FF00FF00FF00FF
Pass 1
Pattern: A000000000000000
Pattern: 0000000000000000
Pattern: FFFFFFFFFFFFFFFF
Pattern: 5555555555555555
Pattern: AAAAAAAAAAAAAAAA
Pattern: FF00FF00FF00FF00
Pattern: 00FF00FF00FF00FF
Pass 2
Pattern: A000000000000000
Pattern: 0000000000000000
Pattern: FFFFFFFFFFFFFFFF
Pattern: 5555555555555555
Pattern: AAAAAAAAAAAAAAAA
Pattern: FF00FF00FF00FF00
Pattern: 00FF00FF00FF00FF

f

CFE> help f

  SUMMARY

     Fill contents of memory.

  USAGE

     f [-b|-h|-w|-q] addr length pattern

     This command modifies the contents of memory.  You can specify the
     starting address, length, and pattern of data to fill (in hex)

  OPTIONS

     -b           Edit memory as bytes
     -h           Edit memory as halfwords (16-bits)
     -w           Edit memory as words (32-bits)
     -q           Edit memory as quadwords (64-bits)
     -p           Address is an uncached physical address
     -v           Address is a kernel virtual address

*** command status = 0
CFE>

e

CFE> help e

  SUMMARY

     Modify contents of memory.

  USAGE

     e [-b|-h|-w|-q] [addr [data...]]

     This command modifies the contents of memory.  If you do not specify
     data on the command line, CFE will prompt for it.  When prompting for
     data you may enter '-' to back up, '=' to dump memory at the current
     location, or '.' to exit edit mode.

  OPTIONS

     -b           Edit memory as bytes
     -h           Edit memory as halfwords (16-bits)
     -w           Edit memory as words (32-bits)
     -q           Edit memory as quadwords (64-bits)
     -p           Address is an uncached physical address
     -v           Address is a kernel virtual address

*** command status = 0
CFE>

d

CFE> help d

  SUMMARY

     Dump memory.

  USAGE

     d [-b|-h|-w|-q] [addr [length]]

     This command displays data from memory as bytes, halfwords, words,
     or quadwords.  ASCII text, if present, will appear to the right of
     the hex data.  The dump command remembers the previous word size,
     dump length and last displayed address, so you can enter 'd' again
     to continue a previous dump request.

  OPTIONS

     -b           Dump memory as bytes
     -h           Dump memory as halfwords (16-bits)
     -w           Dump memory as words (32-bits)
     -q           Dump memory as quadwords (64-bits)
     -p           Address is an uncached physical address
     -v           Address is a kernel virtual address

*** command status = 0
CFE>

u

CFE> help u

  SUMMARY

     Disassemble instructions.

  USAGE

     u [addr [length]]

     This command disassembles instructions at the specified address.
     CFE will display standard register names and symbolic names for
     certain CP0 registers.  The 'u' command remembers the last address
     that was disassembled so you can enter 'u' again with no parameters
     to continue a previous request.

  OPTIONS

     -p           Address is an uncached physical address
     -v           Address is a kernel virtual address

*** command status = 0
CFE>

autoboot

CFE> help autoboot

  SUMMARY

     Automatic system bootstrap.

  USAGE

     autoboot [dev]

     The 'autoboot' command causes an automatic system bootstrap from
     a predefined list of devices and boot files.  This list is
     specific to the board and port of CFE.  To try autobooting from
     a specific device, you can specify the CFE device name on the command line.


  OPTIONS

     -forever     Loop over devices until boot is successful
     -interruptib Scan console between devices, drop to prompt if key pressed

*** command status = 0
CFE>

batch

CFE> help batch

  SUMMARY

     Load a batch file into memory and execute it

  USAGE

     batch [-options] host:filename|dev:filename

     This command loads and executes a batch file from a boot device

  OPTIONS

     -z           Load compessed file
     -tftp        Load the file using the TFTP protocol
     -fatfs       Load the file from a FAT file system
     -rawfs       Load the file from an unformatted file system
     -fs=*        Specify CFE file system name

*** command status = 0
CFE>

go

... na endlich die Stelle gefunden, an der sich entscheidet, ob man per TFTP flashen kann oder nicht.
Ich habe boot_wait vorhin mit nvram set boot_wait="on" angeschaltet. Mal sehen, wie sich das auf den zweiten Bootvorgang auswirkt.

CFE> help go

  SUMMARY

     Verify and boot OS image.

  USAGE

     go

     Boots OS image if valid. Waits for a new OS image if image is invalid
     or boot_wait is unset or not on.

*** command status = 0
CFE>

load

Auch interessant :-)
aus dem Netz booten????

CFE> help load

  SUMMARY

     Load an executable file into memory without executing it

  USAGE

     load [-options] host:filename|dev:filename

     This command loads an executable file into memory, but does not
     execute it.  It can be used for loading data files, overlays or
     other programs needed before the 'boot' command is used.  By
     default, 'load' will load a raw binary at virtual address 0x20000000.

  OPTIONS

     -elf         Load the file as an ELF executable
     -srec        Load the file as ASCII S-records
     -raw         Load the file as a raw binary
     -z           Load compessed file
     -loader=*    Specify CFE loader name
     -tftp        Load the file using the TFTP protocol
     -fatfs       Load the file from a FAT file system
     -rawfs       Load the file from an unformatted file system
     -fs=*        Specify CFE file system name
     -max=*       Specify the maximum number of bytes to load (raw only)
     -addr=*      Specify the load address (hex) (raw only)

*** command status = 0
CFE>

save

CFE> help save

  SUMMARY

     Save a region of memory to a remote file via TFTP

  USAGE

     save [-options] host:filename startaddr length


*** command status = 0
CFE>

ping

CFE> help ping

  SUMMARY

     Ping a remote IP host.

  USAGE

     ping [-t] remote-host

     This command sends an ICMP ECHO message to a remote host and waits for
     a reply.  The network interface must be configured and operational for
     this command to work.  If the interface is configured for loopback mode
     the packet will be sent through the network interface, so this command
     can be used for a simple network test.

  OPTIONS

     -t           Ping forever, or until the ENTER key is struck
     -x           Exit immediately on first error (use with -f or -t)
     -f           Flood ping (use carefully!) - ping as fast as possible
     -s=*         Specify the number of ICMP data bytes
     -c=*         Specify number of packets to echo
     -A           don't abort even if key is pressed
     -E           Require all packets sent to be returned, for successful return
 status

*** command status = 0
CFE> ping 192.168.1.100 -t
Press ENTER to stop pinging
192.168.1.100 (192.168.1.100) is alive (seq=0)
192.168.1.100 (192.168.1.100) is alive (seq=1)
192.168.1.100 (192.168.1.100) is alive (seq=2)
192.168.1.100 (192.168.1.100) is alive (seq=3)
192.168.1.100 (192.168.1.100) is alive (seq=4)
192.168.1.100 (192.168.1.100): 5 packets sent, 5 received
*** command status = 0
CFE> ^C
CFE>

arp

CFE> help arp

  SUMMARY

     Display or modify the ARP Table

  USAGE

     arp [-d] [ip-address] [dest-address]

     Without any parameters, the arp command will display the contents of the
     arp table.  With two parameters, arp can be used to add permanent arp
     entries to the table (permanent arp entries do not time out)

  OPTIONS

     -d           Delete the specified ARP entry.  If specified, ip-address
                  may be * to delete all entries.

*** command status = 0
CFE>

ifconfig

CFE> help ifconfig

  SUMMARY

     Configure the Ethernet interface

  USAGE

     ifconfig device [options..]

     Activates and configures the specified Ethernet interface and sets its
     IP address, netmask, and other parameters.  The -auto switch can be used
     to set this information via DHCP.

  OPTIONS

     -auto        Configure interface automatically via DHCP
     -off         Deactivate the specified interface
     -addr=*      Specifies the IP address of the interface
     -mask=*      Specifies the subnet mask for the interface
     -gw=*        Specifies the gateway address for the interface
     -dns=*       Specifies the name server address for the interface
     -domain=*    Specifies the default domain for name service queries
     -speed=*     Sets the interface speed (auto,10fdx,10hdx,
                  100fdx,
                  100hdx,1000fdx,1000hdx)
     -loopback=*  Sets the loopback mode (off,internal,external)  External
                  loopback causes the phy to be placed in loopback mode
     -hwaddr=*    Sets the hardware address (overrides environment)

*** command status = 0
CFE>

show devices

eth1 ist das W-LAN- Interface....was hat das mit USB zu tun?

CFE> show devices
Device Name          Description
-------------------  ---------------------------------------------------------
uart0                NS16550 UART at 0x18000300
uart1                NS16550 UART at 0x18000400
flash0.boot          New CFI flash at 1C000000 offset 00000000 size 256KB
flash0.trx           New CFI flash at 1C000000 offset 00040000 size 1KB
flash0.os            New CFI flash at 1C000000 offset 0004001C size 3808KB
flash0.nvram         New CFI flash at 1C000000 offset 003F8000 size 32KB
flash1.boot          New CFI flash at 1C000000 offset 00000000 size 256KB
flash1.trx           New CFI flash at 1C000000 offset 00040000 size 3808KB
flash1.nvram         New CFI flash at 1C000000 offset 003F8000 size 32KB
flash0               New CFI flash at 1C000000 size 4096KB
eth0                 Broadcom BCM47xx 10/100 Mbps Ethernet Controller
eth1                 Broadcom USB RNDIS Network Adapter (P-t-P)
*** command status = 0
CFE>

printenv

CFE> printenv
Variable Name        Value
-------------------- --------------------------------------------------
BOOT_CONSOLE         uart0
CFE_VERSION          1.0.37
CFE_BOARDNAME        BCM947XX
CFE_MEMORYSIZE       16
NET_DEVICE           eth0
NET_IPADDR           192.168.1.1
NET_NETMASK          255.255.255.0
NET_GATEWAY          0.0.0.0
NET_NAMESERVER       0.0.0.0
STARTUP              go;
*** command status = 0
CFE>

Zweiter Bootvorgang

Das ist die Interessante Stelle!
Reading :: Failed.: Timeout occured
Hier wartet der CFE einige Sekunden, ob per TFTP eine neue Firmware angeboten wird.


CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 18 14:27:36 CST 2004 (root@me)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.

No DPN
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.13.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29007: 200MHz
Total memory: 0x1000000 bytes (16MB)

Total memory used by CFE:  0x80300000 - 0x8043EB40 (1305408)
Initialized Data:          0x80338DB0 - 0x8033B160 (9136)
BSS Area:                  0x8033B160 - 0x8033CB40 (6624)
Local Heap:                0x8033CB40 - 0x8043CB40 (1048576)
Stack Area:                0x8043CB40 - 0x8043EB40 (8192)
Text (code) segment:       0x80300000 - 0x80338DB0 (232880)
Boot area (physical):      0x0043F000 - 0x0047F000
Relocation Factor:         I:00000000 - D:00000000

Boot version: v3.4
The boot is CFE

mac_init(): Find mac [00:12:17:DD:DE:3F] in location 0
Nothing...

eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0:  hwaddr 00-12-17-DD-DE-3F, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Reading :: Failed.: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ...... 1564672 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007

Primary instruction cache 8kb, linesize 16 bytes (2 ways)

Primary data cache 4kb, linesize 16 bytes (2 ways)

Linux version 2.4.20 (root@me) (gcc version 3.2.3 with Broadcom modifications) #5 Mon Oct 18 14:26:19 CST 2004

Determined physical RAM map:

 memory: 01000000 @ 00000000 (usable)

On node 0 totalpages: 4096

zone(0): 4096 pages.

zone(1): 0 pages.

zone(2): 0 pages.

Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200

CPU: BCM4712 rev 1 at 200 MHz

Calibrating delay loop... 199.47 BogoMIPS

Memory: 14444k/16384k available (1333k kernel code, 1940k reserved, 108k data, 64k init, 0k highmem)

Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)

Inode cache hash table entries: 1024 (order: 1, 8192 bytes)

Mount-cache hash table entries: 512 (order: 0, 4096 bytes)

Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)

Page-cache hash table entries: 4096 (order: 2, 16384 bytes)

Checking for 'wait' instruction...  unavailable.

POSIX conformance testing by UNIFIX

PCI: Disabled

PCI: Fixing up bus 0

Linux NET4.0 for Linux 2.4

Based upon Swansea University Computer Society NET3.039

Initializing RT netlink socket

Starting kswapd

devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)

devfs: boot_options: 0x1

pty: 256 Unix98 ptys configured

Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled

ttyS00 at 0xb8000300 (irq = 3) is a 16550A

ttyS01 at 0xb8000400 (irq = 0) is a 16550A

HDLC line discipline: version $Revision: 1.1.1.4 $, maxframe=4096

N_HDLC line discipline registered.

PPP generic driver version 2.4.2

Flash device: 0x400000 at 0x1c000000

Physically mapped flash: cramfs filesystem found at block 910

Creating 4 MTD partitions on "Physically mapped flash":

0x00000000-0x00040000 : "pmon"

0x00040000-0x003f0000 : "linux"

0x000e3938-0x003f0000 : "rootfs"

mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only

0x003f0000-0x00400000 : "nvram"

sflash: found no supported devices

NET4: Linux TCP/IP 1.0 for NET4.0

IP Protocols: ICMP, UDP, TCP, IGMP

IP: routing cache hash table of 512 buckets, 4Kbytes

TCP: Hash tables configured (established 1024 bind 2048)

Linux IP multicast router 0.06 plus PIM-SM

ip_conntrack version 2.1 (128 buckets, 1024 max) - 344 bytes per conntrack

ip_conntrack_pptp version 1.9 loaded

ip_nat_pptp version 1.5 loaded

ip_tables: (C) 2000-2002 Netfilter core team

ipt_time loading

NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.

NET4: Ethernet Bridge 008 for NET4.0

802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com>

All bugs added by David S. Miller <davem@redhat.com>

VFS: Mounted root (cramfs filesystem) readonly.

Mounted devfs on /dev

Freeing unused kernel memory: 64k freed

The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o
Using /lib/modules/2.4.20/kernel/drivers/net/wl/wl.o
Hit enter to continue...The boot is CFE
The chipset is BCM4712L + BCM5325E
Set name-type for VLAN subsystem. Should be visible in /proc/net/vlan/config
Added VLAN with VID == 0 to IF -:eth0:-
Added VLAN with VID == 1 to IF -:eth0:-
WARNING:  VLAN 1 does not work with many switches,
consider another number if you have problems.
Using /lib/modules/2.4.20/kernel/drivers/net/mac/writemac.o
killall: httpd: no process killed
The chipset is BCM4712L + BCM5325E
name=[vlan0] lan_ifname=[br0]
The chipset is BCM4712L + BCM5325E
=====> set br0 hwaddr to vlan0
name=[eth1] lan_ifname=[br0]
The chipset is BCM4712L + BCM5325E
Write wireless mac
Write wireless mac successfully
br0: No such file or directory
name=[eth2] lan_ifname=[br0]
The chipset is BCM4712L + BCM5325E
eth2: No such device
br0: No such device
interface eth2 does not exist!
name=[eth3] lan_ifname=[br0]
The chipset is BCM4712L + BCM5325E
eth3: No such device
br0: No such device
interface eth3 does not exist!
lo: File exists
The boot is CFE
tftp server started
tftpd: standalone socket
info, udhcp server (v0.9.8) started
zebra disabled.
Using /lib/modules/2.4.20/kernel/drivers/net/mac/writemac.o
calling upnp_main
No interface specified. Quitting...

Input=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8114b903c8b247ad68c2ffe711

Output=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8114b903c8b247ad68c2ffe711
Generate hash of public key:
CF 6C 9C 50 2A 61 09 B4 4D 63 59 46 39 79 F6 2F - 89 F4 63 34 

The EoU is not already configured

command_buf[]=-63-75-73-74-6f-6d-5f-69-65-00-00-02-01-1d-00-03-47-02-02-01-01
-03-14-cf-6c-9c-50-2a-61-09-b4-4d-63-59-46-39-79-f6-2f-89-f4-63-34-00-00-00

Input length = 129
Input=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8114b903c8b247ad68c2ffe711

Output=b13ae45a794747243b06a0703c52dd23413a9d53d073d12f3c29ab241c2ae7c9994668fabd951e1c330b9b6e028c31f5eba04dabff18bdd8825ebab195d481613003ec017aee3fafe971a6172a940aaa0571ab29bb51569989ab5daf743882f590874d2228ea7cc814b96d7421848c449b6907da8114b903c8b247ad68c2ffe711

Input length = 128
Input=9c6123d75bf3991ff7d8abae53582c8884d95da44e844f29ad8e2d985516cc84b46b4d91f292a218e1bef28e3e7bb39cc0d8bd012c611ffb45db1d3347f7bd726688e1c55b3dc08597d402109038af542723870efe389d3b1df38c296afabddd76c401491bf835b6bf86c7f8bcea68514c7ac018caded85b22bda030114edee1  

Output=9c6123d75bf3991ff7d8abae53582c8884d95da44e844f29ad8e2d985516cc84b46b4d91f292a218e1bef28e3e7bb39cc0d8bd012c611ffb45db1d3347f7bd726688e1c55b3dc08597d402109038af542723870efe389d3b1df38c296afabddd76c401491bf835b6bf86c7f8bcea68514c7ac018caded85b22bda030114edee100

g_timeout_limit_tick = 720

Child process ID = 55

Parent process ID = 53

ASSOCIATE COUNT SETTING COMPLETED!!!

EoU start time : Thu Jan  1 00:00:03 1970

EXPIRED_LIMIT  = 720(Ticks)
CHECK_PERIOD   = 1(Minutes); 60(Seconds)
COUNT_PERIOD   = 6(Minutes); 360(Seconds)
The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
Hit enter to continue...info, udhcp client (v0.9.8) started
No interface specified. Quitting...
Hit enter to continue...


BusyBox v0.60.0 (2004.10.18-05:39+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

#

ps -aux

Was ist eou?
Cisco meint: "eou stands for EAP over UDP, the authentication protocol used by NAC",
was sich auch mit den eou-Sachen beim Booten decken würde.

# ps -aux
  PID  Uid     Stat Command
    1 0         S    init noinitrd
    2 0         S    [keventd]
    3 0         S    [ksoftirqd_CPU0]
    4 0         S    [kswapd]
    5 0         S    [bdflush]
    6 0         S    [kupdated]
    7 0         S    [mtdblockd]
   21 0         S    resetbutton
   36 0         S    cron
   37 0         S    tftpd -s /tmp -c -l
   42 0         S    httpd
   43 0         S    udhcpd /tmp/udhcpd.conf
   48 0         S    upnp -D -L br0 -W vlan1
   53 0         S    eou eth1
   55 0         S    eou eth1
   59 0         S    udhcpc -i vlan1 -p /var/run/udhcpc.pid -s /tmp/udhcpc
   62 0         S    /bin/sh
  151 0         R    ps -aux
#

eou-status

Was ist das???

# eou_status
STATUS : Not Configured (Next index is 1)
DEVICE_ID : HB7GHK7Q
OWNERSHIP_KEY :
PRIVATE_KEY :
9c6123d75bf3991f- f7d8abae53582c88-
84d95da44e844f29- ad8e2d985516cc84-
b46b4d91f292a218- e1bef28e3e7bb39c-
c0d8bd012c611ffb- 45db1d3347f7bd72-
6688e1c55b3dc085- 97d402109038af54-
2723870efe389d3b- 1df38c296afabddd-
76c401491bf835b6- bf86c7f8bcea6851-
4c7ac018caded85b- 22bda030114edee1-


PUBLIC_KEY :
b13ae45a79474724- 3b06a0703c52dd23-
413a9d53d073d12f- 3c29ab241c2ae7c9-
994668fabd951e1c- 330b9b6e028c31f5-
eba04dabff18bdd8- 825ebab195d48161-
3003ec017aee3faf- e971a6172a940aaa-
0571ab29bb515699- 89ab5daf743882f5-
90874d2228ea7cc8- 14b96d7421848c44-
9b6907da8114b903- c8b247ad68c2ffe7-
11
#

Werkzeugkiste

Mal sehen, mit welchen Bordmitteln die Original-Firmware daher kommt.

busybox

# busybox
BusyBox v0.60.0 (2004.10.18-05:39+0000) multi-call binary

Usage: busybox [function] [arguments]...
   or: [function] [arguments]...

        BusyBox is a multi-call binary that combines many common Unix
        utilities into a single executable.  Most people will create a
        link to busybox for each function they wish to use, and BusyBox
        will act like whatever it was invoked as.

Currently defined functions:
        [, busybox, cat, chmod, cp, date, echo, false, free, grep, ifconfig,
        insmod, kill, killall, klogd, ln, ls, lsmod, mkdir, more, msh,
        mv, pgrep, ping, ps, reboot, rm, rmdir, rmmod, route, sh, sleep,
        sync, syslogd, tail, test, touch, true, vi

#

wl

# wl
Usage: wl [-a|i <adapter>] [-hu] <command> [arguments]

  -a, -i	adapter name or number
  -h, -u	this message

ver	get version information

cmds	generate a short list of available commands

up	reinitialize and mark adapter up (operational)

down	reset and mark adapter down (disabled)

out	mark adapter down but do not reset hardware(disabled)
	On dualband cards, cards must be bandlocked before use.

clk	set board clock state. return error for set_clk attempt if the driver is not down
	0: clock off
	1: clock on

restart	Restart driver.  Driver must already be down.

reboot	Reboot platform

ucflags	Get/Set ucode flags

radio	Set the radio on or off.
	"on" or "off"

dump	print driver software state and chip registers to stdout

srdump	print contents of SPROM to stdout

nvdump	print nvram variables to stdout

nvset	set an nvram variable
	name=value (no spaces around '=')


nvget	get the value of an nvram variable


revinfo	get hardware revision information


msglevel
	set driver console debugging message bitvector
	type 'wl msglevel ?' for values

PM	set driver power management mode:
	0: CAM (constantly awake)
	1: PS  (power-save)
	2: FAST PS mode

wake	set driver power-save mode sleep state:
	0: core-managed
	1: awake

promisc	set promiscuous mode ethernet address reception
	0 - disable
	1 - enable

monitor	set monitor mode
	0 - disable
	1 - enable active monitor mode (interface still operates)

frag	Set the fragmentation threshhold.  (integer [256, 2346])

rts	Set the RTS threshhold. (integer [0, 2347])

cwmin	Set the cwmin.  (integer [1, 255])

cwmax	Set the cwmax.  (integer [256, 2047])

srl	Set the short retry limit.  (integer [1, 255])

lrl	Set the long retry limit.  (integer [1, 255])

rate	force a fixed rate:
	valid values for 802.11a are (6, 9, 12, 18, 24, 36, 48, 54)
	valid values for 802.11b are (1, 2, 5.5, 11)
	valid values for 802.11g are (1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, 54)
	-1 (default) means automatically determine the best rate

mrate	force a fixed multicast rate:
	valid values for 802.11a are (6, 9, 12, 18, 24, 36, 48, 54)
	valid values for 802.11b are (1, 2, 5.5, 11)
	valid values for 802.11g are (1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, 54)
	-1 (default) means automatically determine the best rate

infra	Set Infrastructure mode: 0 (IBSS) or 1 (Infra BSS)

ap	Set AP mode: 0 (STA) or 1 (AP)

bssid	Get the BSSID value, error if STA and not associated

channel	Set the channel:
	valid channels for 802.11b/g (2.4GHz band) are 1 through 14
	valid channels for 802.11a  (5 GHz band) are:
		36, 40, 44, 48, 52, 56, 60, 64,
		100, 104, 108, 112, 116,120, 124, 128, 132, 136, 140,
		149, 153, 157, 161,
		184, 188, 192, 196, 200, 204, 208, 212, 216

tssi	Get the tssi value from radio

txpwr	Set tx power in milliwatts.  Range [1, 84]. (Deprecated: Use txpwr1 instead)

txpwr1	Set tx power in in various units. Choose one of (default: dbm): 
	-d dbm units
	-q quarter dbm units
	-m milliwatt units
Can be combined with:
	-o turn on override to disable regulatory and other limitations

txpathpwr
	Turn the tx path power on or off on 2050 radios

txpwrlimit
	Return current tx power limit

powerindex
	Set the transmit power for A band(0-63).
	-1 - default value

atten	Set the transmit attenuation for B band. Args: bb radio txctl1.
	auto to revert to automatic control

phyreg	Get/Set a phy register.

radioreg
	Get/Set a radio register.

shmem	Get/Set a shared memory location.

macreg	Get/Set any mac registers(include IHR and SB)
	macreg offset size[2,4] [value]

antdiv	Set antenna diversity for rx
	0 - force use of antenna 0
	1 - force use of antenna 1
	3 - automatic selection of antenna diversity

txant	Set the transmit antenna
	0 - force use of antenna 0
	1 - force use of antenna 1
	3 - use the RX antenna selection that was in force during
	    the most recently received good PLCP header

plcphdr	Set the plcp header.
	"long" or "auto" or "debug"

phytype	Get phy type

scbdump	print driver scb state to stdout

ratedump
	print driver rate selection tunables and
	per-scb state to stdout, valid scb values are
	0 through NSCB-1

rateparam
	set driver rate selection tunables
	arg 1: tunable id
	arg 2: tunable value

wepstatus
	Set or Get WEP status
	wepstatus [on|off]

primary_key
	Set or get index of primary key

addwep	Set an encryption key.  The key must be 5, 13 or 16 bytes long, or
	10, 26, 32, or 64 hex digits long.  The encryption algorithm is
	automatically selected based on the key size. keytype is accepted
	only when key length is 16 bytes/32 hex digits and specifies
	whether AES-OCB or AES-CCM encryption is used. Default is ccm.
	addwep <keyindex> <keydata> [ocb | ccm] [notx] [xx:xx:xx:xx:xx:xx]

rmwep	Remove the encryption key at the specified key index.

wep	Set WEP options.
	wl wep [options]
	[on|enable|1]	enable WEP
	[off|disable|0]	disable WEP
	[sw|software]	perform WEP in software
	[hw|hardware]	perform WEP in hardware

tkip	Set TKIP options.
	wl tkip [options]
	[on|enable|1]	enable TKIP
	[off|disable|0]	disable TKIP
	[sw|software]	perform TKIP in software
	[hw|hardware]	perform TKIP in hardware

aes	Set AES options.
	wl aes [options]
	[on|enable|1]	enable AES
	[off|disable|0]	disable AES
	[sw|software]	perform AES in software
	[hw|hardware]	perform AES in hardware

keys	Prints a list of the current WEP keys

tsc	Print Tx Sequence Couter for key at specified key index.

wsec_test
	Generate wsec errors
	wsec_test <test_type> <keyindex|xx:xx:xx:xx:xx:xx>
	type 'wl wsec_test ?' for test_types

tkip_countermeasures
	Enable or disable TKIP countermeasures (TKIP-enabled AP only)
	0 - disable
	1 - enable

wsec_restrict
	Drop unencrypted packets if WSEC is enabled
	0 - disable
	1 - enable

eap	restrict traffic to 802.1X packets until 802.1X authorization succeeds
	0 - disable
	1 - enable

authorize
	restrict traffic to 802.1X packets until 802.1X authorization succeeds

deauthorize
	do not restrict traffic to 802.1X packets until 802.1X authorization succeeds

deauthenticate
	deauthenticate a STA from the AP with optional reason code (AP ONLY)

wsec	wireless security bit vector
	1 - WEP enabled
	2 - TKIP enabled
	4 - AES enabled
	8 - WSEC in software

wpa_auth
	WPA authorization mode
	[none|0]	none
	[unspecified|1]	WPA 802.1X
	[psk|2]		WPA PSK
	[disable|255]	disable WPA

set_pmk	Set passphrase for PMK in driver-resident supplicant.

scan	Initiate a scan.
	Default an active scan across all channels for any SSID.
	Optional arg: SSID, the SSID to scan.
	Options:
	-s S, --ssid=S		SSID to scan
	-t ST, --scan_type=ST	[active|passive] scan type
	--bss_type=BT		[bss/infra|ibss/adhoc] bss type to scan
	-b MAC, --bssid=MAC	particular BSSID MAC address to scan, xx:xx:xx:xx:xx:xx
	-n N, --nprobes=N	number of probes per scanned channel
	-a N, --active=N	dwell time per channel for active scanning
	-p N, --passive=N	dwell time per channel for passive scanning
	-h N, --home=N		dwell time for the home channel between channel scans
	-c L, --channels=L	comma or space separated list of channels to scan

passive	Puts scan engine into passive mode

regulatory
	Get/Set regulatory domain mode (802.11d). Driver must be down.

spect	Get/Set 802.11h Spectrum Management mode.
	0 - Off
	1 - Loose interpretation of spec - may join non-11h APs
	2 - Strict interpretation of spec - may not join non-11h APs

scanresults
	Return results from last scan.

assoc	Print information about current network association.
	(also known as "status")

status	Print information about current network association.
	(also known as "assoc")

disassoc
	Disassociate from the current BSS/IBSS.

chanlist
	Return valid channels for the current settings.

channels
	Return valid channels for the current settings.

channels_in_country
	Return valid channels for the country specified.
	Arg 1 is the country abbreviation
	Arg 2 is the band(a or b)

curpower
	Return current tx power settings

scansuppress
	Suppress all scans for testing.
	0 - allow scans
	1 - suppress scans

evm	Start an EVM test on the given channel, or stop EVM test.
	Arg 1 is channel number 1-14, or "off" or 0 to stop the test.
	Arg 2 is optional rate (1, 2, 5.5 or 11)

rateset	Returns or sets the supported and basic rateset, (b) indicates basic
	With no args, returns the rateset. Args are
	rateset "default" | "all" | <arbitrary rateset>
		default - driver defaults
		all - all rates are basic rates
		arbitrary rateset - list of rates
	List of rates are in Mbps and each rate is optionally followed
	by "(b)" or "b" for a Basic rate. Example: 1(b) 2b 5.5 11
	At least one rate must be Basic for a legal rateset.

roam_trigger
	Set the roam trigger RSSI threshold.  (integer)

roam_delta
	Set the roam candidate qualification delta.  (integer)

roam_scan_period
	Set the roam candidate qualification delta.  (integer)

suprates
	Returns or sets the 11g override for the supported rateset
	With no args, returns the rateset. Args are a list of rates,
	or 0 or -1 to specify an empty rateset to clear the override.
	List of rates are in Mbps, example: 1 2 5.5 11

scan_channel_time
	Get/Set scan channel time

scan_unassoc_time
	Get/Set unassociated scan channel dwell time

scan_home_time
	Get/Set scan home channel dwell time

scan_passive_time
	Get/Set passive scan channel dwell time

scan_nprobes
	Get/Set scan parameter for number of probes to use per channel scanned

prb_resp_timeout
	Get/Set probe response timeout

channel_qa
	Get last channel quality measurment

channel_qa_start
	Start a channel quality measurment

country	Select Country code for use with 802.11d
	Use either long name or abbreviation from ISO 3166.
	Use 'wl country list [band(a or b)]' for the list of supported countries

locale	OBSOLETE: use "wl country"
	Select the country:
	Worldwide
	Thailand
	Israel
	Jordan
	China
	Japan
	USA/Canada/ANZ
	Europe
	USAlow
	JapanHigh
	All

join	Join a specified network SSID.
	Join syntax is: join <ssid> [key xxxxx] [imode bss|ibss] [amode open|shared|wpa|wpapsk|wpanone]

ssid	Set or get the current SSID.
	Setting will initiate an assoication attempt if in infrastructure mode,
	or join/creation of an IBSS if in IBSS mode,
	or creation of a BSS if in AP mode.

mac	Set or get the list of source MAC address matches.
	wl mac xx:xx:xx:xx:xx:xx [xx:xx:xx:xx:xx:xx ...]
	To Clear the list: wl mac none

macmode	Set the mode of the MAC list.
	0 - Disable MAC address matching.
	1 - Deny association to stations on the MAC list.
	2 - Allow association to stations on the MAC list.

wds	Set or get the list of WDS member MAC addresses.
	Set using a space separated list of MAC addresses.
	 wl wds xx:xx:xx:xx:xx:xx [xx:xx:xx:xx:xx:xx ...]

lazywds	Set or get "lazy" WDS mode (dynamically grant WDS membership to anyone).

noise	Get noise (moving average) right after tx in dBm

fqacurcy
	Manufacturing test: set frequency accuracy mode.
	freqacuracy syntax is: fqacurcy <channel>
	Arg is channel number 1-14, or 0 to stop the test.

crsuprs	Manufacturing test: set carrier suppression mode.
	carriersuprs syntax is: crsuprs <channel>
	Arg is channel number 1-14, or 0 to stop the test.

int	Interrupt Test - remember to precede by 'wl down' and follow by 'wl up'

lbt	Loopback Test - remember to precede by 'wl down' and follow by 'wl up'

band	Returns or sets the current band
	auto - auto switch between available bands (default)
	a - force use of 802.11a band
	b - force use of 802.11b band

bands	Return the list of available 802.11 bands

phylist	Return the list of available phytypes

shortslot
	Get/Set 11g Short Slot Timing mode. (-1=auto, 0=long, 1=short)

shortslot_override
	Get/Set 11g Short Slot Timing mode override. (-1=auto, 0=long, 1=short)

shortslot_restrict
	Get/Set AP Restriction on associations for 11g Short Slot Timing capable STAs.
	0 - Do not restrict association based on ShortSlot capability
	1 - Restrict association to STAs with ShortSlot capability

ignore_bcns
	AP only (G mode): Check for beacons without NONERP element (0=Examine beacons, 1=Ignore beacons)

pktcnt	Get the summary of good and bad packets.

upgrade	Upgrade the firmware on an embedded device

gmode	Set the 54g Mode (LegacyB|Auto||GOnly|BDeferred|Performance|LRS|Afterburner)

gmode_protection
	Get G protection mode. (0=disabled, 1=enabled)

gmode_protection_control
	Get/Set 11g protection mode control alg. (0=always off, 1=monitor local association, 2=monitor overlapping BSS)

gmode_protection_cts
	Get/Set 11g protection type to CTS (0=disable, 1=enable)

gmode_protection_override
	Get/Set 11g protection mode override. (-1=auto, 0=disable, 1=enable)

legacy_erp
	Get/Set 11g legacy ERP inclusion (0=disable, 1=enable)

scb_timeout
	AP only: inactivity timeout value for authenticated stas

assoclist
	AP only: Get the list of associated MAC addresses.

rssi	Get the current RSSI val, for an AP you must specify the mac addr of the STA

isup	Get driver operational state (0=down, 1=up)

fasttimer
	Get/Set High frequency watchdog timeout (tx_power) [15 sec]

slowtimer
	Get/Set Low frequency watchdog timeout (nrssislope) [60 sec]

glacialtimer
	Get/Set Very Low frequency watchdog timeout (measurelo) [120 sec]

radar	Enable/Disable radar

rssidump
	Dump rssi values from aci scans

interference
	Get/Set interference mitigation mode. Choices are:
	0 = none
	1 = non wlan
	2 = wlan manual
	3 = wlan automatic

aciargs	Get/Set various aci tuning parameters.  Choices are:
	enter:	CRS glitch trigger level to start detecting ACI
	exit:	CRS glitch trigger level to exit ACI mode
	glitch	Seconds interval between ACI scans when glitchcount is continuously high
	spin:	Num microsecs to delay between rssi samples
	Usage: wl aciargs [enter x][exit x][spin x][glitch x]

frameburst
	Disable/Enable frameburst mode

pwr_percent
	Get/Set power output percentage

wet	Get/Set wireless ethernet bridging mode

dtim	Get/Set DTIM

wds_remote_mac
	Get WDS link remote endpoint's MAC address

wds_wpa_role_old
	Get WDS link local endpoint's WPA role (old)

wds_wpa_role
	Get/Set WDS link local endpoint's WPA role

authe_sta_list
	Get authenticated sta mac address list

autho_sta_list
	Get authorized sta mac address list

measure_req
	Send an 802.11h measurement request.
	Usage: wl measure_req <type> <target MAC addr>
	Measurement types are: TPC, Basic, CCA, RPI
	Target MAC addr format is xx:xx:xx:xx:xx:xx

quiet	Send an 802.11h quiet command.
	Usage: wl quiet <TBTTs until start>, <duration (in TUs)>, <offset (in TUs)>

csa	Send an 802.11h channel switch anouncement
	Usage wl csa <mode> <when (in TBTTs)> <channel>

constraint
	Send an 802.11h Power Constraint IE
	Usage: wl constraint 1-255 db

rm_req	Request a radio measurement of type basic, cca, or rpi
	specify a series of measurement types each followed by options.
	example: wl rm_req cca -c 1 -d 50 cca -c 6 cca -c 11
	Options:
	-t n  numeric token id for measurement set or measurement
	-c n  channel
	-d n  duration in TUs (1024 us)
	-p    parallel flag, measurement starts at the same time as previous

	Each measurement specified uses the same channel and duration as the
	previous unless a new channel or duration is specified.

rm_rep	Get current radio measurement report

wme	Set WME (Wireless Multimedia Extensions) mode (0=off, 1=on)

sta_info
	wl sta_info <xx:xx:xx:xx:xx:xx>

cap	wl cap will dispaly WL Capabilities

/sbin

# ls
write               reboot              ipupdated           filtersync
syslogd             rc                  insmod              filter
stats               qos                 init                erase
site_suvery         process_monitor     ifconfig            eou_status
rmmod               ntpd                hotplug             disconnected_pppoe
restore             lsmod               hb_disconnect       ddns_success
resetbutton         listen              hb_connect          check_ps
redial              klogd               gpio
#

offene ports

192.168.  1.  1:   80 [TCP] open -> http
192.168.  1.  1:  389 [TCP] open -> ldap
192.168.  1.  1: 1002 [TCP] open
192.168.  1.  1: 5431 [TCP] open -> park-agent

Upgrade

Bei der Originalfirmware gibt es nicht besonders viele Spielmöglichkeiten.
Deswegen erstmal DD-WRT prefinal4 über die Weboberfläche geflasht und über die serielle Schnittstelle aufgezeichnet

Flashvorgang

# The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
Upgrading
upgrade_ver[v-5.0.0] upgrade_ver[-50000] intel_ver[14108] 4712_ver[15000]
code pattern error!
.freeram=[7303168] bufferram=[1343488]
The free memory is enough, writing image once.
...............................Upgrading from web (http) now, quiet exit....
check_ps: nothing to do...
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
................................................................................
........................................................sum=[2985984]
..linux: CRC OK
Writing image to flash, waiting a monent...
done
The chipset is BCM4712L + BCM5325E
The chipset is BCM4712L + BCM5325E
Terminated....................................
The chipset is BCM4712L + BCM5325E
Sending SIGTERM to all processes
info, Received SIGTERM
Sending SIGKILL to all processesRestarting system.


CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 18 14:27:36 CST 2004 (root@me)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.

No DPN
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.13.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29007: 200MHz
Total memory: 0x1000000 bytes (16MB)

Total memory used by CFE:  0x80300000 - 0x8043EB40 (1305408)
Initialized Data:          0x80338DB0 - 0x8033B160 (9136)
BSS Area:                  0x8033B160 - 0x8033CB40 (6624)
Local Heap:                0x8033CB40 - 0x8043CB40 (1048576)
Stack Area:                0x8043CB40 - 0x8043EB40 (8192)
Text (code) segment:       0x80300000 - 0x80338DB0 (232880)
Boot area (physical):      0x0043F000 - 0x0047F000
Relocation Factor:         I:00000000 - D:00000000

Boot version: v3.4
The boot is CFE

mac_init(): Find mac [00:12:17:DD:DE:3F] in location 0
Nothing...

eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0:  hwaddr 00-12-17-DD-DE-3F, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Reading :: Failed.: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ....... 2031616 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kb, linesize 16 bytes (2 ways)
Primary data cache 4kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (root@colinux) (gcc version 3.2.3 with Broadcom modificatio
ns) #235 Thu Apr 21 20:50:49 UTC 2005
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs noinitrd console=tt
yS0,115200
CPU: BCM4712 rev 1 at 200 MHz
Calibrating delay loop... 199.47 BogoMIPS
Memory: 13952k/16384k available (1762k kernel code, 2432k reserved, 128k data, 7
6k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: Disabled
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en
abled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
HDLC line discipline: version $Revision: 1.1.1.4 $, maxframe=4096
N_HDLC line discipline registered.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
imq driver loaded.
Universal TUN/TAP device driver 1.5 (C)1999-2002 Maxim Krasnyansky
Flash device: 0x400000 at 0x1c000000
Physically mapped flash: squashfs filesystem found at block 1016
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003f0000 : "linux"
0x000fe004-0x003178b5 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-o
nly
0x003f0000-0x00400000 : "nvram"
0x00320000-0x003f0000 : "ddwrt"
sflash: found no supported devices
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (512 buckets, 4096 max) - 368 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
IPP2P v0.7.1 loading
ipt_random match loaded
netfilter PSD loaded - (c) astaro AG
ipt_osf: Startng OS fingerprint matching module.
ipt_time loading
ipt_IPV4OPTSSTRIP loaded
arp_tables: (C) 2002 David S. Miller
ip_queue: failed to register queue handler
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
IPsec over IPv4 tunneling driver
Ebtables v2.0 registered<6>NET4: Ethernet Bridge 008 for NET4.0
Bridge firewalling registered
802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
cryptoapi: loaded
cryptoapi: Registered aes-ecb (0)
cryptoapi: Registered aes-cbc (65536)
cryptoapi: Registered aes-cfb (131072)
cryptoapi: Registered aes-ctr (262144)
cryptoapi: Registered aes-rtc (524288)
cryptoapi: Registered 3des-ecb (0)
cryptoapi: Registered 3des-cbc (65536)
cryptoapi: Registered 3des-cfb (131072)
cryptoapi: Registered 3des-ctr (262144)
cryptoapi: Registered 3des-rtc (524288)
cryptoapi: Registered md5 (0)
cryptoapi: Registered sha1 (0)
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 76k freed
Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o
Warning: loading et will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information about tainted modu
les
Using /lib/modules/2.4.20/kernel/drivers/net/wl/wl.o
Warning: loading wl will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information about tainted modu
les
insmod: writemac.o: no module by that name found
nvram_commit(): start
nvram_commit(): end
nvram_commit(): start
nvram_commit(): end
mkdir: Cannot create directory `/var/log': File exists
killall: httpd: no process killed
br0: No such device
wlconf: vlan0 failed (-1)
br0: No such device
eth2: No such device
eth3: No such device
wlconf: br0 failed (1)
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
killall: telnetd: no process killed
tftp server started
tftpd: standalone socket
nvram_commit(): start
nvram_commit(): end
killall: upnp: no process killed
calling upnp_main
killall: nas: no process killed
killall: nas: no process killed
zebra disabled.
killall: wland: no process killed
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_pptp.o
starting cron
killall: pptpd: no process killed
killall: snmpd: no process killed
killall: wol: no process killed
killall: nas: no process killed
killall: nas: no process killed
sh: /tmp/.rc_startup: not found
nvram_commit(): start
nvram_commit(): start
nvram_commit(): start
nvram_commit(): start
nvram_commit(): start
mkdir: Cannot create directory `/jffs/tmp': Read-only file system
mkdir: Cannot create directory `/jffs/tmp/ipkg': No such file or directory
nvram_commit(): end
nvram_commit(): end
nvram_commit(): end
nvram_commit(): end
nvram_commit(): end



BusyBox v1.00 (2005.04.16-19:38+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ #
/ #

First Boot

/ # reboot
Terminated....................................
Sending SIGTERM to all processes
Terminated
/ # Sending SIGKILL to all processesRestarting system.


CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 18 14:27:36 CST 2004 (root@me)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.

No DPN
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.60.13.0
rndis0: Broadcom USB RNDIS Network Adapter (P-t-P)
CPU type 0x29007: 200MHz
Total memory: 0x1000000 bytes (16MB)

Total memory used by CFE:  0x80300000 - 0x8043EB40 (1305408)
Initialized Data:          0x80338DB0 - 0x8033B160 (9136)
BSS Area:                  0x8033B160 - 0x8033CB40 (6624)
Local Heap:                0x8033CB40 - 0x8043CB40 (1048576)
Stack Area:                0x8043CB40 - 0x8043EB40 (8192)
Text (code) segment:       0x80300000 - 0x80338DB0 (232880)
Boot area (physical):      0x0043F000 - 0x0047F000
Relocation Factor:         I:00000000 - D:00000000

Boot version: v3.4
The boot is CFE

mac_init(): Find mac [00:12:17:DD:DE:3F] in location 0
Nothing...

eou_key_init(): Find key pair in location 0
The eou device id is same
The eou public key is same
The eou private key is same
Device eth0:  hwaddr 00-12-17-DD-DE-3F, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Reading :: Failed.: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ....... 2031616 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kb, linesize 16 bytes (2 ways)
Primary data cache 4kb, linesize 16 bytes (2 ways)
Linux version 2.4.20 (root@colinux) (gcc version 3.2.3 with Broadcom modificatio
ns) #235 Thu Apr 21 20:50:49 UTC 2005
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs noinitrd console=tt
yS0,115200
CPU: BCM4712 rev 1 at 200 MHz
Calibrating delay loop... 199.47 BogoMIPS
Memory: 13952k/16384k available (1762k kernel code, 2432k reserved, 128k data, 7
6k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: Disabled
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en
abled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
HDLC line discipline: version $Revision: 1.1.1.4 $, maxframe=4096
N_HDLC line discipline registered.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
imq driver loaded.
Universal TUN/TAP device driver 1.5 (C)1999-2002 Maxim Krasnyansky
Flash device: 0x400000 at 0x1c000000
Physically mapped flash: squashfs filesystem found at block 1016
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003f0000 : "linux"
0x000fe004-0x003178b5 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-o
nly
0x003f0000-0x00400000 : "nvram"
0x00320000-0x003f0000 : "ddwrt"
sflash: found no supported devices
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (512 buckets, 4096 max) - 368 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
IPP2P v0.7.1 loading
ipt_random match loaded
netfilter PSD loaded - (c) astaro AG
ipt_osf: Startng OS fingerprint matching module.
ipt_time loading
ipt_IPV4OPTSSTRIP loaded
arp_tables: (C) 2002 David S. Miller
ip_queue: failed to register queue handler
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
IPsec over IPv4 tunneling driver
Ebtables v2.0 registered<6>NET4: Ethernet Bridge 008 for NET4.0
Bridge firewalling registered
802.1Q VLAN Support v1.7 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
cryptoapi: loaded
cryptoapi: Registered aes-ecb (0)
cryptoapi: Registered aes-cbc (65536)
cryptoapi: Registered aes-cfb (131072)
cryptoapi: Registered aes-ctr (262144)
cryptoapi: Registered aes-rtc (524288)
cryptoapi: Registered 3des-ecb (0)
cryptoapi: Registered 3des-cbc (65536)
cryptoapi: Registered 3des-cfb (131072)
cryptoapi: Registered 3des-ctr (262144)
cryptoapi: Registered 3des-rtc (524288)
cryptoapi: Registered md5 (0)
cryptoapi: Registered sha1 (0)
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 76k freed
Using /lib/modules/2.4.20/kernel/drivers/net/et/et.o
Warning: loading et will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information about tainted modu
les
Using /lib/modules/2.4.20/kernel/drivers/net/wl/wl.o
Warning: loading wl will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information about tainted modu
les
insmod: writemac.o: no module by that name found
[: missing ]
[: missing ]
mkdir: Cannot create directory `/var/log': File exists
killall: httpd: no process killed
br0: No such device
wlconf: vlan0 failed (-1)
br0: No such device
eth2: No such device
eth3: No such device
wlconf: br0 failed (1)
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
killall: telnetd: no process killed
tftp server started
tftpd: standalone socket
killall: upnp: no process killed
calling upnp_main
killall: nas: no process killed
killall: nas: no process killed
zebra disabled.
killall: wland: no process killed
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_proto_gre.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_conntrack_pptp.o
Using /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ip_nat_pptp.o
starting cron
killall: pptpd: no process killed
killall: snmpd: no process killed
killall: wol: no process killed
killall: nas: no process killed
killall: nas: no process killed
sh: /tmp/.rc_startup: not found
[: missing ]
mkdir: Cannot create directory `/jffs/tmp': Read-only file system
mkdir: Cannot create directory `/jffs/tmp/ipkg': No such file or directory



BusyBox v1.00 (2005.04.16-19:38+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ #
/ #


Mateng