タグ: WN-G300DGR

WN-G300DGR

作業した時期が非常に古く、メモを取っていなかったので今更ながら書き出し。なお、既に散々弄った状態であるためオリジナルとは異なっていたり、破損個所が存在する可能性に注意すること。

MAC

  • LAN: 00:A0:B0:xx:xx:AC (u-boot-env, ethaddr (text))
  • WAN: 00:A0:B0:xx:xx:AB (u-boot-env, wanaddr (tex))
  • 2.4G: 00:A0:B0:xx:xx:AC (Factory, 0x4 (hex))

※Flash: Parallel-NOR (CFI) 4MiB (MX29LV320E)

U-Boot

  • help
    RT3052 # help
    rf      - read/write rf register
    ?       - alias for 'help'
    bootm   - boot application image from memory
    cp      - memory copy
    erase   - erase FLASH memory
    go      - start application at address 'addr'
    help    - print online help
    loadb   - load binary file over serial line (kermit mode)
    loopback   - Ralink eth loopback test !!
    md      - memory display
    mdio   - Ralink PHY register R/W command !!
    mm      - memory modify (auto-incrementing)
    mw      - memory write (fill)
    nm      - memory modify (constant address)
    printenv- print environment variables
    protect - enable or disable FLASH write protection
    reset   - Perform RESET of the CPU
    saveenv - save environment variables to persistent storage
    setenv  - set environment variables
    spicmd  - read/write data from/to eeprom or vtss
    tftpboot- boot image via network using TFTP protocol
    version - print monitor version
    

  • version

    RT3052 # version
    
    U-Boot 1.1.3 (Jun  1 2011 - 15:30:20)
    

  • printenv

    RT3052 # printenv
    bootcmd=tftp
    bootdelay=5
    baudrate=57600
    ethaddr="00:A0:B0:**:**:**"
    sn=00024936I
    hw_ver=1.0.0
    pro_id=000
    country=000
    domain=1
    wanaddr=00:A0:B0:**:**:**
    wlanaddr=00:AA:BB:CC:DD:12
    fwaddr=00:AA:BB:CC:DD:13
    eth_en=0
    snextra=00000000000000000000
    preboot=echo;echo
    ramargs=setenv bootargs root=/dev/ram rw
    addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
    addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
    flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
    kernel_addr=BFC40000
    u-boot=u-boot.bin
    load=tftp 8A100000 $(u-boot)
    u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
    loadfs=tftp 8A100000 root.cramfs
    u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
    test_tftp=tftp 8A100000 root.cramfs;run test_tftp
    hw_id=030A003E
    ethact=Eth0 
    filesize=26c36d
    fileaddr=80800000
    ipaddr=192.168.99.9
    serverip=192.168.99.8
    autostart=no
    bootfile=uImageWN-G300DGR
    uboot_ver=1.0.6.20
    op_mode=1
    stdin=serial
    stdout=serial
    stderr=serial
    
    Environment size: 1066/4092 bytes
    

Kernel

  • uname -a

    # uname -a
    Linux WN-G300DGR 2.6.21 #3 Tue Mar 17 09:25:56 CST 2015 mips unknown
    

  • cat /proc/version

    # cat /proc/version
    Linux version 2.6.21 (root@******-******-******-******) (gcc version 3.4.6) #3 Tue Mar 17 09:25:56 CST 2015
    

  • cat /proc/cpuinfo

    # cat /proc/cpuinfo
    system type             : Ralink SoC
    processor               : 0
    cpu model               : MIPS 24K V4.12
    BogoMIPS                : 255.48
    wait instruction        : yes
    microsecond timers      : yes
    tlb_entries             : 32
    extra interrupt vector  : yes
    hardware watchpoint     : yes
    ASEs implemented        : mips16 dsp
    VCED exceptions         : not available
    VCEI exceptions         : not available
    

  • cat /proc/meminfo

    # cat /proc/meminfo
    MemTotal:        29696 kB
    MemFree:         15092 kB
    Buffers:          1096 kB
    Cached:           5616 kB
    SwapCached:          0 kB
    Active:           3860 kB
    Inactive:         4216 kB
    SwapTotal:           0 kB
    SwapFree:            0 kB
    Dirty:               0 kB
    Writeback:           0 kB
    AnonPages:        1372 kB
    Mapped:           1920 kB
    Slab:             3684 kB
    SReclaimable:      464 kB
    SUnreclaim:       3220 kB
    PageTables:        412 kB
    NFS_Unstable:        0 kB
    Bounce:              0 kB
    CommitLimit:     14848 kB
    Committed_AS:     3692 kB
    VmallocTotal:  1048404 kB
    VmallocUsed:     18468 kB
    VmallocChunk:  1029828 kB
    

  • cat /proc/mtd

    # cat /proc/mtd
    dev:    size   erasesize  name
    mtd0: 00020000 00010000 "Bootloader"
    mtd1: 00010000 00010000 "backup"
    mtd2: 00010000 00010000 "Config "
    mtd3: 00010000 00010000 "Factory"
    mtd4: 000b0000 00010000 "Kernel"
    mtd5: 002b0000 00010000 "app"
    mtd6: 001a0000 00010000 "cb-app"
    mtd7: 00040000 00010000 "manufacture"
    mtd8: 00010000 00002000 "storage"
    

  • bootlog

    U-boot Ver:1.0.6.20 2011/06/01
    
    
    Board: Ralink APSoC DRAM:  32 MB  2*16 MB
    ============================================ 
    ASIC 3052_MP2 (Port5GigaSW)
    Product Name: WN-G300DGR
    SDRAM CAS = 3(d1835272) 
    ============================================ 
    
    Please choose the operation: 
       1: Load system code to SDRAM via TFTP. 
    
    LINUX started...
    
     THIS IS ASIC
    init started: BusyBox v1.7.5 (2015-03-17 09:22:54 CST)
    starting pid 151, tty '/dev/console': '/sbin/config_init'
    mknod: /dev/ttyS0: File exists
    mknod: /dev/ttyS1: File exists
    Config Init version: 1.15.000.113 date: 2015/03/17
    Thu Jan  1 00:00:00 UTC 2015
    mount: can't find /sys in /etc/fstab or /etc/mtab
    ln: /lib/./modules: File exists
    switch reg write offset=94, value=7f00
    Could not find Watchdog driver (/apps/lib/modules/2.6.21/kernel/arch/mips/rt2880/rt_timer.ko)
    Application Ver:1.15.000.113             Date:2015/03/17
    
    starting pid 211, tty '/dev/ttyS1': '/sbin/config_term'
    ************************************************************************
    *                               WN-G300DGR                             *
    ************************************************************************
    
    KernelApp/Ramdisk Ver:1.15.000.113                       Date:2015/03/17
    cat: can't open '/apps/lib/modules/2.6.21/modulesApp.dep': No such file or directory
    ln: /sbin/apps_init: File exists
    ln: /sbin/opmode.sh: File exists
    password: createShareMem keyid 7001 shmId 0
    Set Int value 0 but not in rage 1000 to 50000
    checkpApCfg i=746 [wan2_dl_bw]
    Set Int value 0 but not in rage 1000 to 50000
    checkpApCfg i=762 [wan2_ul_bw]
    checkpApCfg error!!
    CTRL_INTERFACE:[/var/sysconfd_if]  CTRL_INTERFACE_IF:[if0]
    
    System Monitoring
    *********************************************************************
    Initializing system environment
    Setting up /tmp directory ...
    Setting up loopback device ...
    ***************************************************
    System is in    AP Router Mode [0]
    ***************************************************
    SEM_GETID got id -1
    Mac: 0, rtcTime:1420070401
    Starting system logging daemon ...OK
    Setting up Ethernet devices ...
    OK
    Configuring Bridge device ...          OK
    Setting the host&domain name ...Finished.
    Configuring net ...          OK
    Configuring LAN device ...          OK
    getRegularDomain,0
    Configuring RT28XX device ...Wlan is in AP Mode
    Using fixWDSLowTP function.
    sh: cannot create /proc/netpktconfig/config_interface: nonexistent directory
    Wan Manager...
    Configuring WAN device[WAN0] ...
    Obtaining IP address from DHCP ... 
    wan is Ready
    Set Domain Routing for FLET'S Square Connection...            
    Starting DNS Proxy ...            FAILED
    Starting DHCP(udhcpd) server ...            OK
    Starting ntpclient ...            
    Setup tc for QoS ... Disabled
    
    SCHEDULE, ServiceWlanLowRateInit ...service_index[0].
    
    SCHEDULE, ServiceWlsRadioOffInit ...service_index[1].
    
    SCHEDULE, ServiceLedOffInit ...service_index[2].
    
    SCHEDULE, ServiceLanOffInit ...service_index[3].
    
    SCHEDULE, ServiceWanOffInit ...service_index[4].
    
    SCHEDULE, ServiceLanLowRateInit ...service_index[5].
    
    SCHEDULE, ServicePowerLedInit ...service_index[6].
    
    
    Schedule starting  [scheduleOpen], ...wait result..
    Schedule result :[Disable (No rules)]. 
    Configuring network routing and filtering ...Iptable restart VPN ACL ...VPN ACL ...
    OK
    Starting SiteBlock server ...            
    Netpacket Filter Open ....              sysGetKernelInfo: netv :1.0
    Kernel netpkt ver netv: 1.0
    OK
    Starting DDNS  ...  Disabled
    Starting UPNPD  ...  WAN Speed = 10 Mbps
    FAILED
    Starting HTTPD server ...           OK
    Staring ALG...           OK
    Starting LLTD ...           OK
    Starting netbios daemon ...  OK
    Initialization has completed
    *We used 6.210000 seconds to initialize all modules*
    pSEM_GETID got id 32769
    [RMGMT DBG] RMGMT_VERSION: 3.42.32
    NewWAN0:[192.168.1.25]  LastWAN0:[0.0.0.0]
    wan0Configuring ...
    Wan IP was changed, Reload related module**
    *** PROCESS MANAGER Starts ***
    Processmanager update modules
    Restarting Iptables ....Clean iptable...OK
    Configuring network routing and filtering ...Iptable restart VPN ACL ...VPN ACL ...
    OK
    OK
    QoS, Stopping
    Setup tc for QoS ... Disabled
    Reloading dnsProxy ...            Stopping DNS Proxy ...            OK
    Set Domain Routing for FLET'S Square Connection...            
    Starting DNS Proxy ...            wan0Configuring ...
    OK
    Stopping igmpProxy ...            OK
    Starting IGMP Proxy ...  OK
    Starting UPNPD  ...  WAN Speed = 1000 Mbps
    OK
    RMMOD ALG H323 [ip_nat_h323]
    RMMOD ALG MMS [ip_nat_mms]
    RMMOD 2nd ALG TFTP [ip_nat_tftp]
    RMMOD ALG TFTP [ip_conntrack_tftp]
    RMMOD ALG Egg [ip_conntrack_egg]
    RMMOD ALG IRC [ip_nat_irc]
    RMMOD ALG Quake3 [ip_nat_quake3]
    RMMOD ALG Talk [ip_nat_talk]
    RMMOD ALG PPTP [ip_nat_pptp]
    RMMOD ALG SNMP [ip_nat_snmp_basic]
    RMMOD ALG FTP [ip_nat_ftp]
    RMMOD 2nd ALG SIP [ip_nat_sip]
    RMMOD ALG SIP [ip_conntrack_sip]
    RMMOD 2nd ALG RTSP [ip_nat_rtsp]
    RMMOD ALG RTSP [ip_conntrack_rtsp]
    Staring ALG...           OK
    Processmanager update modules
    VPN, WAN_IP_CHANGED event received ...Closing ntpclient ...            Starting ntpclient ...            
    Stopping DDNS ...            OK
    Starting DDNS  ...  Disabled
    
    SCHEDULE, ServiceWlanLowRateInit ...service_index[0].
    
    SCHEDULE, ServiceWlsRadioOffInit ...service_index[1].
    
    SCHEDULE, ServiceLedOffInit ...service_index[2].
    
    SCHEDULE, ServiceLanOffInit ...service_index[3].
    
    SCHEDULE, ServiceWanOffInit ...service_index[4].
    
    SCHEDULE, ServiceLanLowRateInit ...service_index[5].
    
    SCHEDULE, ServicePowerLedInit ...service_index[6].
    
    
    Schedule starting  [scheduleOpen], ...wait result..
    Schedule result :[Disable (No rules)]. 
    ==>error
    

広告

WN-G300DGRのMTDパーティション

前に書いた WN-G300DGRメモ に関して、Kernelの前に本来存在するらしき0xB0000のパーティションを追加する修正を行い、実機で動作確認した。

が。

どうも再起動すると設定が保存されない。そこでコンソールを確認すると、

jffs2: Too few erase blocks (2)

のログが。これは、Flashに空きスペースが無く、空き領域を確保できない場合に出る。
と、ここで重大なことに気付く。

そりゃ修正前の “firmware” パーティション(Kernel+RootFS)が0x3B0000(≒3,866KB?)で空き領域200KB程度だったのに、Kernelの前に存在するらしきパーティションで0xB0000(≒720KB?)も持っていかれて “firmware” パーティションが0x300000(≒3,145KB?)では全く足りてないよな…

という。
上記の修正を行った場合、ramips + U-BootにおけるLEDE (OpenWrt) ファームのお馴染み “27 05 19 56” が公式ファームと同じ位置に来るためU-BootにBad Magic Numberを出されないほか、公式ファームへ戻す際にも0xB0000分paddingする必要が無く簡単なものの、このままではLEDE (OpenWrt)で設定が保存できない。
そのため、再起動するたびにリセットされ設定し直す羽目になるので、パーティション修正は諦め変更を破棄して元の構成に差し戻した。

やはりFlash 4MBでは厳しい。正直パーティション構成を正確に調べたかったものの、Flashのサイズや筐体の形(湾曲していて扱いづらい)など厳しい点がどうしても多いため追加で購入するのは見送って、この機種に関してはあとUSB周り調べる程度かな、と思う。

WN-G300DGRメモ

弄る中で気付いたことメモ

  • Kernelの前にパーティション有
    • シリアルコンソール用のシェルが存在?
  • GPIO#7はrebootに使用
  • U-Bootの環境変数op_modeをデフォルトの0から1に変更すると、Kernelが起動後詳細なログをコンソールに吐く
  • console pass: admin ?

パーティション構成
現状での予想。これ以外にも存在する可能性あり

パーティション名 領域 (HEX) サイズ (HEX)
u-boot 0x0 – 0x30000 0x30000
u-boot-env 0x30000 – 0x40000 0x10000
factory 0x40000 – 0x50000 0x10000
console? 0x50000 – 0x100000 0xb0000
firmware (Kernel + RootFS) 0x100000 – 0x400000 0x300000
————- ↓firmware ————– ——————————— ———————-
kernel 0x100000 – 0x2c0000 0x1c0000
rootfs 0x2c0000 – 0x400000 0x140000