FON2305Eのシリアルコンソール

構成がFON2405Eにそっくりなことに気がついたので、FON2305Eも入手して調べてみた。
たいへん鬱陶しいことに、FON2405Eとはシリアルコンソールの配列が違う。

1 +3.3
2 RX
3 GND
4 TX

という具合にTXとGNDが逆になっている。コンソールの出力はFON2405Eとほとんど同じ。何故か定期的に文字化けするので、以下はFON2405Eの情報をもとに補正してある(ので、一部は嘘)。

U-Boot 1.1.3 (Nov 29 2009 - 20:59:38)

Board: Fonera
DRAM:  32 MB
relocate_code Pointer at: 81fac000
spi_wait_nsec: 3e
spi deice id: c2 20 15 c2 20 (2015c220)
find flash: mx25l1605d
raspi_read: from:41030000 len:1000
Using default environment

##### The CPU freq = 320 MHZ ####

SDRAM bus set to 16 bit
SDRAM size =32 Mbytes

Please choose the operation:
  1: Boot system code via Flash (default).
  2: Load system code then write to Flash via TFTP.
  3: Entr boot command line interface.

booting from flash
## Booting image at bf020000 ...
raspi_read: from:20000 len:40
  Image Name:   MIPS OpenWrt Linux-2.6.21
  Created:      2010-01-15  17:37:49 UTC
  Image Type:   MIPS Linux Kernel Image (lzma compressed)
  Data Size:    613655 Bytes = 599.3 kB
  Load Address: 80000000
  Entry Point:  80000000
raspi_read: from:20040 len:95d17
  1Verifying Checksum ... OK
  Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

THIS IS ASIC
Linux version 2.6.21 (blogic@blap4) (gcc version 4.1.2) #143 Thu Jan 15 09:09:18 CET 2010

The CPU feqenuce set to 320 MHz
CPU revision is: 0001964c
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 4064
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 init=/sbin/preinit
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 800060, status = 1100ff00
PID hash table entries: 64 (order: 6, 256 bytes)
calculating r4koff... 0030d400(3200000)
CPU frequency 320.00 MHz
Using 160.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 14172k/16384k available (1689k kernel code, 2212k reserved, 186k data, 100k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
was not able to assign mahjor 200 to button chardev
ramips_gpio: done
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered
io scheduler deadline registered (default)
ramips_wdt: loaded
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
PPP generic driver version 2.4.2
NET: Registered protocol family 24
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky 
deice id : c2 20 15 c2 20 (2015c220)
mx25l3205d(c2 20160000) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
ramips_mtd: kernel size is 613719
padded kernel is 00096000
Creating 6 MTD partitions on "raspi":
0x00000000-0x00010000 : "uboot"
0x00010000-0x00020000 : "boardconfig"
0x00020000-0x00200000 : "image"
0x00020000-0x000b6000 : "linux"
mtd: partition "linux" doesn't end on an erase block -- force read-only
0x000b6000-0x001f0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
mtd: partition "rootfs" set to be root filesystem
0x001f0000-0x00200000 : "uci_overlay"
Registered led device: power
Registered led device: wps
Registered led device: wlan
nf_conntrack version 0.5.0 (128 buckets, 1024 max)
IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear 
All bugs added by David S. Miller 
ramips: ethernet loaded
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 100k freed
Warning: unable to open an initial console.
Preinit complete, spawning microd
found uci_overlay -> /dev/mtd5
i found OPENWRT_UCI_OVERLAY inside /dev/mtd5
loading file zepttho 275
loading file wireless 696
loading file user 70
loading file system 72
loading file reg 16
loading file network 473
loading file led 342
loading file lang 33
loading file form 4768
loading file fonsmcd 290
loading file fon 406
loading fileAlgorithmics/MIPS FPU Emulator v1.5
firewall 907
loading file passwd 149
loading file chilli.conf 566
loading fon config
Spawning syslogd
registering led wps -> /sys/class/leds/wps/
registering led wlan -> /sys/class/leds/wlan/
registering led power -> /sys/class/leds/power/
loading base firewall ...iptables: Chain already exists
done
adding zone wannet
adding zone lan
adding zone wan
adding zone hotspotwifi
adding zone hotspot
adding forwarding lan->wan
adding forwarding hotspot->wan
interface loopback
 proto = static
 ipaddr = 127.0.0.1
 netmask = 255.0.0.0
 ifname = lo
interface lan
 proto = static
 ipaddr = 192.168.10.1
 netmask = 255.255.255.0
 ifname = eth0.1
 type = bridge
interface wan
 proto = dhcp
 ifname = eth0.2
interface hotspot
 ifname = tun0
interface hotspotwifi
 proto = none
 ifname = ra1
net event up loopback ...bringing up lo
done
net event up lan ...bringing up eth0.1
eth0.1: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
device eth0.1 entered promiscuous mode
br-lan: port 1(eth0.1) entering learning state
adding br-lan to zone lan
done
net event up wan ...bringing up eth0.2
Spawning udhcpc for eth0.2
adding eth0.2 to zone wan
udhcpc (v0.9.9-pre) started
Trying to connect...
sending -> "udhcpc|deconfig|eth0.2|"
Sending discover...
done
wifi device rt305x
 type = rt305x
 channel = 11
 mode = 9
wifi interface public
 ifname = ra1
 ssid = FON_FREE_INTERNET
 encryption = none
 network = hotspotwifi
 device = rt305x
 isolate = 1
 auto = 1
wifi interface private
 ifname = ra0
 ssid = MyPlace
 encryption = wpa-wpa2
 key = 4141414141
 password = iXHH3iPCI9
 wpa_crypto = mixed
 network = lan
 device = rt305x
 channel = 0
 mode = bgn
 txpower = 100
br-lan: topology change detected, propagating
br-lan: port 1(eth0.1) entering forwarding state
rt2860v2_ap: module license 'unspecified' taints kernel.
Sending discover...
WSending discover...
0x1300 = 00064380
bringing up rt30device ra0 entered promiscuous mode
5x ...done
br-lan: port 2(ra0) entering learning state
Terminate the task(RtmpCmdQTask) with pid(202)!
Terminate the task(RtmpWscTask) with pid(203)!
br-lan: port 2(ra0) entering disabled state
W0x1300 = 00064380
br-lan: port 2(ra0) entering learning state
Trying to connect...
sending -> "udhcpc|leasefail|eth0.2|"
br-lan: topology change detected, propagating
br-lan: port 2(ra0) entering forwarding state
bringing up private ...done
configured coova for mac 00:18:84:AF:38:71
Spawning dnsmasq
DHCP server is enabled
Spawning fonsmcd
Spawning zepttho
Spawning Onlined
 _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
         |__| W I R E L E S S   F R E E D O M
KAMIKAZE (bleeding edge, r3201) -------------------
 * 10 oz Vodka       Shake well with ice and strain
 * 10 oz Triple sec  mixture into 10 shot glasses.
 * 10 oz lime juice  Salute!
---------------------------------------------------
I booted userland in 13 seconds
System bring up complete
syslogd: Jan  1 00:00:03 udhcpc[183]: udhcpc (v0.9.9-pre) started
deconfigure eth0.2
syslogd: Jan  1 00:00:03 udhcpc[183]: Sending discover...
syslogd: Jan  1 00:00:05 udhcpc[183]: Sending discover...
syslogd: Jan  1 00:00:07 udhcpc[183]: Sending discover...
syslogd: Nov  5 20:07:16 syslog: starting onlined

Now serving files from /www on :80
syslogd: Nov  5 20:07:16 dnsmasq[208]: started, version 2.45 cachesize 150
syslogd: Nov  5 20:07:16 dnsmasq[208]: compile time options: IPv6 GNU-getopt ISC-leasefile no-DBus no-I18N no-TFTP
syslogd: Nov  5 20:07:16 dnsmasq[208]: DHCP, IP range 192.168.10.50 -- 192.168.10.250, lease time 12h
syslogd: Nov  5 20:07:16 syslog: ERROR: unable access whitelist file: /etc/fon/whitelist.dnsmasq
syslogd: Nov  5 20:07:16 dnsmasq[208]: using local addresses only for domain lan
syslogd: Nov  5 20:07:16 dnsmasq[208]: reading /tmp/resolv.conf
syslogd: Nov  5 20:07:16 dnsmasq[208]: using nameserver 192.168.1.1#53
syslogd: Nov  5 20:07:16 dnsmasq[208]: using local addresses only for domain lan
syslogd: Nov  5 20:07:16 dnsmasq[208]: read /etc/hosts - 2 addresses
syslogd: Nov  5 20:07:16 dnsmasq[208]: failed to read /etc/ethers:No such file or directory
fonsmcd[209]: (Main)  WARNING: SMC_find_boarddata: found board config /dev/mtd1ro
SMC_init(): called
fonsmcd[209]: (Main)  MESSAGE: SMC_reload()
.W.....W.....fonsmcd[209]: (Main)  WARNING: SMC_add_host: Error resolving host [cthulhu.fon.com], will try later
fonsmcd[209]: (Main)  MESSAGE: SMC_retrieve_query_data()
fonsmcd[209]: (Main)  WARNING: SMC_find_boarddata: found board config /dev/mtd1ro
wlanmac [00-18-84-af-38-71]
key_number [22aa6bec0e62fbb9abbff19646cb3cb3cf88e515560b58b7e5cc2dc11258d732]
fonsmcd[209]: (Main)  WARNING: SMC_find_boarddata: found board config /dev/mtd1ro
W.....W.....W..fonsmcd[209]: (Main) CRITICAL: SMC_send_buffer: Error resolving host [cthulhu.fon.com]
...W.....W.....W...fonsmcd[209]: (Main) CRITICAL: SMC_send_buffer: Error resolving host [cthulhu.fon.com]
..W..

FON2405Eもそうなのだが、ブートセレクタやログインのプロンプトが一切出ない。コンソールから中身をいじる方法が何かあるのだろうか。

PR-S300SEのloaderモード？

基板に「loader」と印刷してある部分があって、ジャンパーをつけたらいかにも何かがおこりそうだったので、試してみた。ブートメッセージのみが表示されて進まなくなったのであせったが、タスクを見てみるとtftpdが走っているようだ。ということは、なにかファイルを読ませて実行できるのだろう。どういうレベルで何をしてくれるのかいまいちよくわからないが、楽しげな機能である。

-> i

 NAME        ENTRY       TID    PRI   STATUS      PC       SP     ERRNO  DELAY
---------- ------------ -------- --- ---------- -------- -------- ------- -----
tExcTask   excTask      87de87f0   0 PEND       800ff97c 87de8690       0     0
tShell     shell        870b8040   1 READY      80109bb0 870b7c10       0     0
tNetTask   netTask      87de3120  50 PEND       800bf1b0 87de3050       0     0
tFtpdTask  80092f10     870bbf80  55 PEND       800bf1b0 870bbd90       0     0
macStat0   800483e8     863a27d0  90 PEND       800ff97c 863a2680       0     0
tPhyInt    80047798     863a0530 180 PEND+T     800bf1b0 863a0450  3d0004   106
value = 0 = 0x0
-> pwd
/tmp
value = 5 = 0x5
-> ls
/tmp/  - disk check in progress ...
dosChkLib : CLOCK_REALTIME is being reset to THU DEC 27 00:00:00 1990
Value obtained from file system volume descriptor pointer: 0x87dfd7f0
The old setting was THU JAN 01 00:01:18 1970
Accepted system dates are greater than THU DEC 27 00:00:00 1990
/tmp/  - Volume is OK

         total # of clusters:  13,229
          # of free clusters:  13,227
           # of bad clusters:  0
            total free space:  13,227 Kb
    max contiguous free space:  13,544,448 bytes
                  # of files:  0
                # of folders:  0
        total bytes in files:  0
            # of lost chains:  0
  total bytes in lost chains:  0
value = 0 = 0x0
-> ls
value = 0 = 0x0
->

PR-S300SEのコンソールコマンド

RXのラインをつないでリターンキーを叩いてみるとプロンプト"->"が出た。VxWorksはさわったことがないのだが、helpとやれば何とかなるだろう、とやってみたら成功。
いくつかのコマンド群についてもヘルプがあるようなのでひととおり叩いてみた。実装されていないものもある。

-> help

help                           Print this list
ioHelp                         Print I/O utilities help info
dbgHelp                        Print debugger help info
nfsHelp                        Print nfs help info
netHelp                        Print network help info
spyHelp                        Print task histogrammer help info
timexHelp                      Print execution timer help info
h         [n]                  Print (or set) shell history
i         [task]               Summary of tasks' TCBs
ti        task                 Complete info on TCB for task
sp        adr,args...          Spawn a task, pri=100, opt=0x19, stk=20000
taskSpawn name,pri,opt,stk,adr,args... Spawn a task
td        task                 Delete a task
ts        task                 Suspend a task
tr        task                 Resume a task
d         [adr[,nunits[,width]]] Display memory
m         adr[,width]          Modify memory
mRegs     [reg[,task]]         Modify a task's registers interactively
pc        [task]               Return task's program counter

Type  to continue, Q to stop:

iam       "user"[,"passwd"]     Set user name and passwd
whoami                         Print user name
devs                           List devices
ld        [syms[,noAbort][,"name"]] Load stdin, or file, into memory
                              (syms = add symbols to table:
                              -1 = none, 0 = globals, 1 = all)
lkup      ["substr"]         List symbols in system symbol table
lkAddr    address              List symbol table entries near address
checkStack  [task]             List task stack sizes and usage
printErrno  value              Print the name of a status value
period    secs,adr,args... Spawn task to call function periodically
repeat    n,adr,args...    Spawn task to call function n times (0=forever)
version                        Print VxWorks version info, and boot line

NOTE:  Arguments specifying 'task' can be either task ID or name.

value = 1 = 0x1
-> ioHelp

cd        "path"             Set current working path
pwd                            Print working path
ls        ["wpat"[,long]]    List contents of directory
ll        ["wpat"]           List contents of directory - long format
lsr       ["wpat"[,long]]    Recursive list of directory contents
llr       ["wpat"]           Recursive detailed list of directory
rename    "old","new"      Change name of file
copy      ["in"][,"out"]   Copy in file to out file (0 = std in/out)
cp        "wpat","dst"      Copy many files to another dir
xcopy     "wpat","dst"      Recursively copy files
mv        "wpat","dst"      Move files into another directory
xdelete   "wpat"             Delete a file, wildcard list or tree
attrib    "path","attr"    Modify file attributes
xattrib   "wpat","attr"    Recursively modify file attributes
chkdsk    "device", L, V     Consistency check of file system
diskInit  "device"           Initialize file system on disk
diskFormat "device"          Low level and file system disk format

"attr" contains one or more of: " + - A H S R" characters

Type  to continue, Q to stop:

"wpat" may be name of a file, directory or wildcard pattern
in which case "dst" must be a directory name
chkdsk() params: L=0, check only, L=2, check and fix, V=0x200 verbose

value = 1 = 0x1
-> dbgHelp

dbgHelp                         Print this list
dbgInit                         Install debug facilities
b                               Display breakpoints and eventpoints
b         addr[,task[,count]]   Set breakpoint
e         addr[,eventNo[,task[,func[,arg]]]]] Set eventpoint
bd        addr[,task]           Delete breakpoint
bdall     [task]                Delete all breakpoints and eventpoints
c         [task[,addr[,addr1]]] Continue from breakpoint
cret      [task]                Continue to subroutine return
s         [task[,addr[,addr1]]] Single step
so        [task]                Single step/step over subroutine
l         [adr[,nInst]]         List disassembled memory
tt        [task]                Do stack trace on task
bh addr[,access[,task[,count[,quiet]]]] Set hardware breakpoint
       access :      1 - write            2 - read
                     3 - read/write        For R4650 processors:
       access :      0 - instruction      1 - write
                     2 - read             3 - read/write
value = 293 = 0x125
-> nfsHelp
undefined symbol: nfsHelp
-> netHelp


hostAdd   "hostname","inetaddr"    - add a host to remote host table;
                                    "inetaddr" must be in standard
                                    Internet address format e.g. "90.0.0.4"
hostShow                           - print current remote host table
netDevCreate "devname","hostname",protocol
                                  - create an I/O device to access files
                                    on the specified host
                                    (protocol 0=rsh, 1=ftp)
routeAdd     "destaddr","gateaddr" - add route to route table
routeDelete  "destaddr","gateaddr" - delete route from route table

routeShow                          - print current route table
iam          "usr"[,"passwd"]      - specify the user name by which you
                                    will be known to remote hosts
                                    (and optional password)
whoami                             - print the current remote ID
rlogin       "host"                - log in to a remote host;
                                    "host" can be inet address or
                                    host name in remote host table

Type  to continue, Q to stop:



ifShow       ["ifname"]            - show info about network interfaces
inetstatShow                       - show all Internet protocol sockets
tcpstatShow                        - show statistics for TCP
udpstatShow                        - show statistics for UDP
ipstatShow                         - show statistics for IP
icmpstatShow                       - show statistics for ICMP
arptabShow                         - show a list of known ARP entries
mbufShow                           - show mbuf statistics

EXAMPLE:   -> hostAdd "wrs", "90.0.0.2"
          -> netDevCreate "wrs:", "wrs", 0
          -> iam "fred"
          -> copy           -> rlogin "wrs"            /* rlogin to host "wrs" */

value = 1 = 0x1
-> spyHelp
spy not configured into this system.
value = 37 = 0x25 = '%'
-> timeHelp
undefined symbol: timeHelp

ここでひとまずタスク(UNIXのプロセスに相当)の一覧をとってみる。ルーターらしいタスクがいろいろ走っている模様。

-> i

 NAME        ENTRY       TID    PRI   STATUS      PC       SP     ERRNO  DELAY
---------- ------------ -------- --- ---------- -------- -------- ------- -----
tExcTask   excTask      87de8450   0 PEND       80b30674 87de82f0       0     0
tLogTask   logTask      87de5610   0 PEND       80b30674 87de54b0       0     0
tShell     shell        8721b2b0   1 READY      80b3e7c0 8721ae80       0     0
voipStartTa80453e20     843866d0   1 PEND       80b30674 84386540       0     0
tIpsec     ssh_ipsecpm_ 834ae390  49 PEND+T     80b08360 834adee0  3d0002     6
tNetTask   netTask      87ddeda0  50 READY      80b08360 87ddecd0  6d0002     0
teMngTask  teMngTask    845f4a50  52 PEND+T     80b30674 845f48c0  3d0004    72
wzcTask    80acd990     8468b3a0  55 READY      80b08360 8468b070  3d0004     0
rt4Task    803a82e0     8463bab0  55 PEND       80b30674 8463b930       0     0
tDhcpsTask dhcpsStart   844ae430  56 PEND       80b08360 844ae1a0  3d0002     0
tDhcpcState80135828     84499a60  56 PEND       80b08360 84499970       0     0
tDhcpcReadTdhcpcRead    84491540  56 PEND       80b08360 844912b0  3d0002     0
tDhcpsMngTa8017b890     844a5f10  57 PEND       80b30674 844a5cb0       0     0
vpnSigTask 808edb50     843b8800  57 PEND       80b30674 843b8650       0     0
tDhcp6c    802082d0     845d3470  58 PEND       80b08360 845d3180  3d0002     0
tIpv6Info  dhcp6cApiTas 87210f00  59 PEND       80b30674 87210da0       0     0
IPsecMngTasipsecMngTask 84664e40  60 PEND       80b30674 84664c80       0     0
tJavavmWdtT80a42398     836b9950  64 DELAY      8006af90 836b9890       0    19
tJavavmTask80a40d80     836a9410  65 READY      80b08360 836a9210  3d0004     0
pthr6      8004b750     83699170  65 PEND       80b08360 83699060  3d0004     0
pthr7      8004b750     83690ed0  66 PEND       80b08360 83690d50       0     0
pthr8      8004b750     83688c30  66 PEND       80b08360 83688ab0       0     0
Uni1ModeMng8067ca60     84fc28e0  70 PEND       80b30674 84fc2750       0     0
SYS_PPP_C_18063a8a8     84659040  80 PEND       80b08360 84658f20       0     0
tpppcMng   8064b808     8431c6f0  81 PEND       80b30674 8431c580  3d0001     0
ipv4AddrDupipv4AddrDupl 845c2880  82 PEND       80b30674 845c2740       0     0
macStat0   80073e88     84fb91a0  90 PEND       80b30674 84fb9050       0     0
wlanMngTaskwlanMngTask  845e4010  90 PEND       80b30674 845e3e90       0     0
ARP_REQ_T  arp_req_task 8459de40  90 PEND       80b08360 8459dd60       0     0
linkMng    8023e420     84fbe0c0 100 PEND       80b30674 84fbdef0       0     0
lanPhyMon  8023c6e8     84693900 100 PEND       80b30674 84693780       0     0
wanPhyMon  8023c6e8     8466d910 100 PEND       80b30674 8466d790       0     0
tRtAdv     rtadv_start  845dbaf0 100 DELAY      8006af90 845daca0       0    39
tDnsPro    80233468     8444df40 100 READY      80b08360 8444daf0  3d0004     0
tDnsProWan 80235290     84445a20 100 READY      80b08360 84445540  3d0004     0
tMldProxy  mldproxy_mai 84334ed0 100 PEND+T     80b08360 84334af0  3d0002    36
lltdTask   event_mainlo 838ce410 100 PEND+T     80b08360 838ce1b0  3d0002   130
dhcpcMngTas80147750     84489020 101 PEND       80b30674 84488e80       0     0
tMLDSnoop  803957e0     8433d170 101 PEND       80b08360 8433d050       0     0
ntpcMngTaskntpcMngTask  845ec530 104 PEND       80b30674 845ec3b0       0     0
tDhcp6s    80215908     845cae10 106 PEND       80b08360 845ca460  3d0002     0
natTask    natTask      84606580 110 PEND       80b30674 84606410       0     0
ipfilterTasipFilterTask 8460eaa0 111 PEND       80b30674 8460e930       0     0
SecureBind_secureBindMn 8364da80 120 PEND       80b30674 8364d8f0       0     0
tIrdaJava  80a24528     833bfb00 128 DELAY      8006af90 833bfa60       0 86386930
pthr9      8004b750     833f0d60 128 PEND       80b08360 833f09e0       0     0
pthr10     8004b750     833e8ac0 128 SUSPEND    8006b988 833e87e0       0     0
pthr11     8004b750     833e0820 128 READY      80b08360 833e0580  3d0004     0
pthr12     8004b750     833d8580 128 READY      8006af90 833d8460       0     0
pthr13     8004b750     837ae980 128 PEND       80b08360 837ae710  3d0002     0
brCfgTask  8064ed10     84633590 150 PEND       80b30674 84633440  6d0002     0
FdbTask    806565e8     83776720 150 DELAY      8006af90 83776660       0 15116
tPhyInt    80072fb0     84fb6be0 180 READY      8006af90 84fb6b00       0     0
wpsEventTas80a68458     84682880 190 READY      80b30674 84682700  3d0004     0
wpsTimerTas80a79938     8467a360 200 PEND+T     80b30674 8467a1d0  3d0004    15
httpd      httpdTask    8446e9d0 200 PEND       80b08360 8446e6d0  3d0002     0
autoUpdateTautoUpdateTa 84376430 200 PEND       80b30674 84376150       0     0
tRemoteMntBremoteMntBne 84324990 200 PEND       80b08360 84324890       0     0
tQcNotif   ssh_if_chg_n 834b6be0 200 PEND+T     80b08360 834b6550  3d0002   239
httpPLTask httpProxyTas 8432cc30 201 PEND+T     80b08360 8432c420  3d0002 15111
rtspPTask  rtspProxyTas 83821d60 201 READY      80b08360 83820c90  3d0004     0
tDevInfo   uni2infoMngT 8382a000 208 DELAY      8006af90 83829f60       0  2809
tIrDApp    80a24ec0     84303f10 210 PEND       80b30674 84303430       0     0
dnsProxyMsg80229d60     83819ac0 210 PEND       80b30674 83819920       0     0
tDlnaDmcEve809eb058     836ddd40 211 PEND       80b30674 836ddbc0       0     0
tDlnaDmc   809e81b8     836d57e0 211 PEND       80b08360 836d5710       0     0
pthr4      8004b750     836cd1b0 211 READY      80b08360 836cc840  3d0004     0
tDlnaIpcSer809e7568     8430c1b0 220 DELAY      8006af90 8430c100       0 86385102
pthr3      8004b750     836e6ce0 220 READY      80b08360 836e6360  3d0004     0
pthr5      8004b750     836c28d0 220 READY      80b08360 836c2630  3d0004     0
upnpGwSockTupnpGwSockTa 838b48f0 228 READY      80b08360 838b44b0  3d0004     0
logStoreTas80349780     8523d350 230 PEND       80b08360 8523ce50  380003     0
cnfStoreTas800c1910     84fd0b80 230 PEND       80b08360 84fd0ac0       0     0
tUPnPc     upnpDevMngMa 838ac650 230 READY      8006af90 838abdb0  3d0002     0
launchd    80a519a0     84314450 239 DELAY      8006af90 84314360       0     2
tRomTask   AllegroTask  845fe060 240 READY      8006af90 845fdfa0  3d0002     0
tFfsBgCache80a7b698     83678220 243 DELAY      8006af90 83678160       0   246
tWolrelay  wolRelayTask 838c6170 245 PEND       80b08360 838c5ee0  3d0002     0
javaPingTas80a44d08     8363e6e0 245 PEND       80b30674 8363e490       0     0
tJavaCbkMng80a43b10     836b16b0 251 PEND       80b30674 836b1560       0     0
netTaskAid 800f6d90     87de02c0 255 READY      800f6dfc 87de0230       0     0
value = 0 = 0x0

デバイスの一覧も見る。UNIXとは名前の流儀が違うようだ。

-> devs
drv name
 0 /null
 1 /tyCo/0
 1 /tyCo/1
 5 /dev/flash0
 6 /effs
 3 /tmp
 3 /var
 3 /apps
 7 /proc
 3 /java
 3 /PreOSGi
 8 /dev/selwakeup
 9 /dev/wan/mac0
10 /dev/lan/sw0
11 /dev/lan/phy0
11 /dev/lan/phy1
11 /dev/lan/phy2
11 /dev/lan/phy3
12 /dev/wan/phy0
13 /dev/fastpath
 2 /pipe/dhcp6cSignal
 2 /pipe/dhcp6sSignal
14 /bpf/dhcps
14 /bpf/dhcpc/0
14 /bpf/dhcpc-arp
 2 /pipe/lltd
 2 /pipe/upnpGwSockMsg
 2 /pipe/mldproxySignal
15 /ipsec
16 /ssh/wakeup
 2 pQcNotif
 3 /nfwdir
 2 /pipe/jbedWakeUp
value = 25 = 0x19

ネットワークデバイスの一覧。

-> ifconfig
lo0:  flags=c8249 mtu 1536 
       inet 127.0.0.1 netmask 0xff000000
       inet6 ::1 prefixlen 128
       inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
       inet 127.0.0.100 netmask 0xff000000
lan0:  flags=68343 mtu 1500 
       inet6 fe80::20b:a2ff:fedb:50af%lan0 prefixlen 64 tentative scopeid 0x2
       inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
       ether 00:0b:a2:db:50:af
wan1:  flags=28243 mtu 1500 
       inet6 fe80::20b:a2ff:fedb:50ae%wan1 prefixlen 64 tentative scopeid 0x3
       ether 00:0b:a2:db:50:ae
ppp0:  flags=390d1 mtu 1500 
ppp1:  flags=390d1 mtu 1500 
ppp2:  flags=390d1 mtu 1500 
ppp3:  flags=390d1 mtu 1500 
ppp4:  flags=390d1 mtu 1500 
ppp5:  flags=390d1 mtu 1500 
ppp6:  flags=390d1 mtu 1500 
lan1:  flags=e9143 mtu 1500 
       ether 00:0b:a2:db:50:af
lan2:  flags=e9143 mtu 1500 
       ether 00:0b:a2:db:50:af
lan3:  flags=e9143 mtu 1500 
       ether 00:0b:a2:db:50:af
lan4:  flags=e9143 mtu 1500 
       ether 00:0b:a2:db:50:af
lan5:  flags=e9143 mtu 1500 
       ether 00:0b:a2:db:50:af
pxy0:  flags=8 mtu 1500 
ssgw0:  flags=40049 mtu 1500 
       inet 127.0.0.10 netmask 0xff000000
value = 0 = 0x0

ファイルシステムもあるが、ディレクトリをうまくたどれなかった。

-> pwd
/java/NFW/osap
value = 15 = 0xf
-> ls
.
..
config
args.txt
jvm_args
osap.policy
sys.properties
value = 0 = 0x0

PR-S300SEのシリアルコンソール

PR-S300SEのシリアルコンソールを覗いてみた。

DBG2というパターンがいかにもそれっぽい。定番からいくと
1: +3.3V
2: RX
3: TX
4: GND
で、+3.3VとGNDは確認できた。TXはテスターで確認できる。データが出ていれば普段は3.3V、出力がある時は不規則に電圧が下がるはずだ。ところが、実際にあたってみると0V付近で微妙にふらついている。どうも接続から浮いているようだ。

パターンを睨むと、R93のパターン(チップは載っていない)を介してどこかに繋がっているように見える。R93の左側をあたってみると、上記の特徴に一致する信号が出ていた。そこで115,200の8N1でつないでみると起動メッセージが確認できた。VxWorksらしいがかなり手ごわそうだ。

「LOADER」と印字のあるJ6をショートすると何かがおこりそうな気もする。
また、左上の6つのテストポイントはいかにもJTAG絡みだったり、いろいろ遊べそうだ。

R93,R96は単にショートすればDBG2が活きるはず。チップ部品(おそらく1005)の0Ωか、適当な電線をはんだ付けすればよさそうだが、パターンが非常に細かいので難易度高し。

Attaching interface lo0... done


]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
     ]]]]]]]]]]]  ]]]]     ]]]]]]]]]]       ]]              ]]]]         (R)
]     ]]]]]]]]]  ]]]]]]     ]]]]]]]]       ]]               ]]]]
]]     ]]]]]]]  ]]]]]]]]     ]]]]]] ]     ]]                ]]]]
]]]     ]]]]] ]    ]]]  ]     ]]]] ]]]   ]]]]]]]]]  ]]]] ]] ]]]]  ]]   ]]]]]
]]]]     ]]]  ]]    ]  ]]]     ]] ]]]]] ]]]]]]   ]] ]]]]]]] ]]]] ]]   ]]]]
]]]]]     ]  ]]]]     ]]]]]      ]]]]]]]] ]]]]   ]] ]]]]    ]]]]]]]    ]]]]
]]]]]]      ]]]]]     ]]]]]]    ]  ]]]]]  ]]]]   ]] ]]]]    ]]]]]]]]    ]]]]
]]]]]]]    ]]]]]  ]    ]]]]]]  ]    ]]]   ]]]]   ]] ]]]]    ]]]] ]]]]    ]]]]
]]]]]]]]  ]]]]]  ]]]    ]]]]]]]      ]     ]]]]]]]  ]]]]    ]]]]  ]]]] ]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]]]       Development System
]]]]]]]]]]]]]]]]]]]]]]]]]]]]
]]]]]]]]]]]]]]]]]]]]]]]]]]]       VxWorks version 5.5.1
]]]]]]]]]]]]]]]]]]]]]]]]]]       KERNEL: WIND version 2.6
]]]]]]]]]]]]]]]]]]]]]]]]]       Copyright Wind River Systems, Inc., 1984-2003

                              CPU: Cavium Octeon.  Processor #0/400MHz.
                             Memory Size: 0x7e00000.  BSP version 2.0/1.

-> Copy OK: 11214 bytes copied
InterfacesInit_RGMII: interface 0 configured
PortsInit_RGMII: port 0, mac 0:b:a2:db:50:ae
PortsInit_RGMII: port 0 configured
PortsInit_RGMII: port 1, mac 0:b:a2:db:50:af
PortsInit_RGMII: port 1 configured
DataCacheInit: flow_cache created
commandChannelInit: called
PortsEnable_RGMII: port 1 enabled
PortsEnable_RGMII: port 0 enabled
IP Filter: v3.4.32 initialized.  Default = pass all, Logging = disabled
vxworks_muxAttach(438) endFindByName ERROR [vp0][vp]
vxworks_muxAttach(438) endFindByName ERROR [vp1][vp]
moving file dms.tmp -> dms.xml
ipsec: Initializing crypto library...
ipsec: Connecting to engine...
ipsec: Network interfaces:
0: lo0:
     127.0.0.1/255.0.0.0 [127.0.0.1]
     ::1/128
     fe80::1%1/64
     127.0.0.100/255.0.0.0 [127.0.0.100]
1: lan0:
     fe80::20b:a2ff:fedb:50af%2/64
     192.168.1.1/255.255.255.0 [192.168.1.255]
2: wan1:
     fe80::20b:a2ff:fedb:50ae%3/64
16: ssgw0:
     127.0.0.10/255.0.0.0 [127.0.0.10]
ipsec: Loading policy rules...
ipsec: Policy rules loaded
wait irda server...
irda server start...

PR-S300SEはSoCとしてCavium Octeon CN5020を採用している。MIPS64ベースのデュアルコア構成らしい。実際に開けて確かめた偉大な先達の記事参照。

FON2405Eの中身

Softbankと「Wi-Fiバリュープラン」を契約したらLa Foneraが送られてきたので開けてみた。足4枚がネジ穴のシールを兼ねているので、はがしてT9のトルクス(ヘックスローブ)ドライバーでネジを除くだけ。

SoCはRalinkのRT3050F。MIPS 24KEcベース(MIPS32の割と新しい世代)のSoCで、シリアル、Ethernetなどルーターに必要なインターフェースがひととおり載っているらしい。

シリアルコンソールはJ2で、パラメーターは57,600の8N1。
1: +3.3V
2: RX
3: TX
4: GND
ピンの穴があいていないので、接続にはコンタクトピン(ポゴピン)を使用するなど工夫が必要。

起動メッセージは以下のとおり。U-Boot + LinuxベースのOpenWRT、というわけでいじるのは容易だろう。

U-Boot 1.1.3 (Jan  6 2010 - 07:10:30)

Board: Fonera
DRAM:  32 MB
relocate_code Pointer at: 81fac000
spi_wait_nsec: 3e
spi deice id: c2 20 15 c2 20 (2015c220)
find flash: mx25l1605d
raspi_read: from:41030000 len:1000
Using default environment


 ##### The CPU freq = 320 MHZ ####

SDRAM bus set to 16 bit
 SDRAM size =32 Mbytes

Please choose the operation:
   1: Boot system code via Flash (default).
   2: Load system code then write to Flash via TFTP.
   3: Entr boot command line interface.

booting from flash
## Booting image at bf020000 ...
raspi_read: from:20000 len:40
   Image Name:   MIPS OpenWrt Linux-2.6.21
   Created:      2010-02-11   8:09:34 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    613723 Bytes = 599.3 kB
   Load Address: 80000000
   Entry Point:  80000000
raspi_read: from:20040 len:95d5b
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 32

Starting kernel ...


LINUX started...

 THIS IS ASIC
Linux version 2.6.21 (blogic@blap4) (gcc version 4.1.2) #143 Thu Feb 11 09:09:18 CET 2010

 The CPU feqenuce set to 320 MHz
CPU revision is: 0001964c
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock4 init=/sbin/preinit
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 9080002c, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 0030d400(3200000)
CPU frequency 320.00 MHz
Using 160.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 30416k/32768k available (1689k kernel code, 2352k reserved, 186k data, 100k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
was not able to assign mahjor 200 to button chardev
ramips_gpio: done
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
io scheduler noop registered
io scheduler deadline registered (default)
ramips_wdt: loaded
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
PPP generic driver version 2.4.2
NET: Registered protocol family 24
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky 
deice id : c2 20 15 c2 20 (2015c220)
mx25l3205d(c2 20160000) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
ramips_mtd: kernel size is 613787
padded kernel is 00096000
Creating 6 MTD partitions on "raspi":
0x00000000-0x00010000 : "uboot"
0x00010000-0x00020000 : "boardconfig"
0x00020000-0x00200000 : "image"
0x00020000-0x000b6000 : "linux"
mtd: partition "linux" doesn't end on an erase block -- force read-only
0x000b6000-0x001f0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
mtd: partition "rootfs" set to be root filesystem
0x001f0000-0x00200000 : "uci_overlay"
Registered led device: power
Registered led device: wps
Registered led device: wlan
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear 
All bugs added by David S. Miller 
ramips: ethernet loaded
ramips_eth: loaded
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 100k freed
Warning: unable to open an initial console.
Preinit complete, spawning microd
found uci_overlay -> /dev/mtd5
i found OPENWRT_UCI_OVERLAY inside /dev/mtd5
loading file zepttho 275
loading file wireless 696
loading file user 70
loading file system 72
loading file reg 16
loading file network 473
loading file led 342
loading file lang 33
loading file form 4768
loading file fonsmcd 290
loading file fon 4Algorithmics/MIPS FPU Emulator v1.5
07
loading file firewall 907
loading file passwd 149
loading file chilli.conf 566
loading fon config
Spawning syslogd
registering led wps -> /sys/class/leds/wps/
registering led wlan -> /sys/class/leds/wlan/
registering led power -> /sys/class/leds/power/
loading base firewall ...iptables: Chain already exists
done
adding zone wannet
adding zone lan
adding zone wan
adding zone hotspotwifi
adding zone hotspot
adding forwarding lan->wan
adding forwarding hotspot->wan
interface loopback
  proto = static
  ipaddr = 127.0.0.1
  netmask = 255.0.0.0
  ifname = lo
interface lan
  proto = static
  ipaddr = 192.168.10.1
  netmask = 255.255.255.0
  ifname = eth0.1
  type = bridge
interface wan
  proto = dhcp
  ifname = eth0.2
interface hotspot
  ifname = tun0
interface hotspotwifi
  proto = none
  ifname = ra1
net event up loopback ...bringing up lo
done
net event up lan ...bringing ueth0.1: dev_set_promiscuity(master, 1)
p eth0.1
device eth0 entered promiscuous mode
device eth0.1 entered promiscuous mode
br-lan: port 1(eth0.1) entering learning state
adding br-lan to zone lan
done
net event up wan ...bringing up eth0.2
Spawning udhcpc for eth0.2
udhcpc (v0.9.9-pre) started
Trying to connect...
sending -> "udhcpc|deconfig|eth0.2|"
adding eth0.2 to zone wan
Sending discover...
done
wifi device rt305x
  type = rt305x
  channel = 11
  mode = 9
wifi interface public
  ifname = ra1
  ssid = FON_FREE_INTERNET
  encryption = none
  network = hotspotwifi
  device = rt305x
  isolate = 1
  auto = 1
wifi interface private
  ifname = ra0
  ssid = MyPlace
  encryption = wpa-wpa2
  key = 4141414141
  password = rahthuagho
  wpa_crypto = mixed
  network = lan
  device = rt305x
  channel = 0
  mode = bgn
  txpower = 100
br-lan: topology change detected, propagating
br-lan: port 1(eth0.1) entering forwarding state
rt2860v2_ap: module license 'unspecified' taints kernel.
Sending discover...
WSending discover...
0x1300 = 00064380
bringing up rt30device ra0 entered promiscuous mode
5x ...done
br-lan: port 2(ra0) entering learning state
Terminate the task(RtmpCmdQTask) with pid(202)!
Terminate the task(RtmpWscTask) with pid(203)!
br-lan: port 2(ra0) entering disabled state
W0x1300 = 00064380
br-lan: port 2(ra0) entering learning state
Trying to connect...
sending -> "udhcpc|leasefail|eth0.2|"
br-lan: topology change detected, propagating
br-lan: port 2(ra0) entering forwarding state
bringing up private ...done
configured coova for mac 00:18:84:45:F2:D9
Spawning dnsmasq
DHCP server is enabled
Spawning fonsmcd
Spawning zepttho
Spawning Onlined
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r3313) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
I booted userland in 13 seconds
System bring up complete
syslogd: Jan  1 00:00:03 udhcpc[183]: udhcpc (v0.9.9-pre) started
deconfigure eth0.2
syslogd: Jan  1 00:00:03 udhcpc[183]: Sending discover...
syslogd: Jan  1 00:00:05 udhcpc[183]: Sending discover...
syslogd: Jan  1 00:00:07 udhcpc[183]: Sending discover...
syslogd: Nov  5 20:07:16 syslog: starting onlined

Now serving files from /www on :80
syslogd: Nov  5 20:07:16 dnsmasq[208]: started, version 2.45 cachesize 150
syslogd: Nov  5 20:07:16 dnsmasq[208]: compile time options: IPv6 GNU-getopt ISC-leasefile no-DBus no-I18N no-TFTP
syslogd: Nov  5 20:07:16 dnsmasq[208]: DHCP, IP range 192.168.10.50 -- 192.168.10.250, lease time 12h
syslogd: Nov  5 20:07:16 syslog: ERROR: unable access whitelist file: /etc/fon/whitelist.dnsmasq
syslogd: Nov  5 20:07:16 dnsmasq[208]: using local addresses only for domain lan
syslogd: Nov  5 20:07:16 dnsmasq[208]: reading /tmp/resolv.conf
syslogd: Nov  5 20:07:16 dnsmasq[208]: using nameserver 192.168.1.1#53
syslogd: Nov  5 20:07:16 dnsmasq[208]: using local addresses only for domain lan
syslogd: Nov  5 20:07:16 dnsmasq[208]: read /etc/hosts - 2 addresses
syslogd: Nov  5 20:07:16 dnsmasq[208]: failed to read /etc/ethers:No such file or directory
fonsmcd[209]: (Main)  WARNING: SMC_find_boarddata: found board config /dev/mtd1ro
SMC_init(): called
fonsmcd[209]: (Main)  MESSAGE: SMC_reload()
.W.....W.....fonsmcd[209]: (Main)  WARNING: SMC_add_host: Error resolving host [cthulhu.fon.com], will try later
fonsmcd[209]: (Main)  MESSAGE: SMC_retrieve_query_data()
fonsmcd[209]: (Main)  WARNING: SMC_find_boarddata: found board config /dev/mtd1ro
wlanmac [00-18-84-45-f2-d9]
key_number [faebf127810b7a43e861018282881b5c03143e37abaf66a8582bec6f64dea46a]
fonsmcd[209]: (Main)  WARNING: SMC_find_boarddata: found board config /dev/mtd1ro
W.....W.....W..fonsmcd[209]: (Main) CRITICAL: SMC_send_buffer: Error resolving host [cthulhu.fon.com]
...W.....W.....W...fonsmcd[209]: (Main) CRITICAL: SMC_send_buffer: Error resolving host [cthulhu.fon.com]
..W..
-------
load 7968 2752 800
ram 24072192/31248384
uptime 0 - 00:00:59
...W.....W....fonsmcd[209]: (Main) CRITICAL: SMC_send_buffer: Error resolving host [cthulhu.fon.com]
.WSending discover...
syslogd: Nov  5 20:08:13 udhcpc[183]: Sending discover...
..Sending discover...
syslogd: Nov  5 20:08:15 udhcpc[183]: Sending discover...
..Sending discover...
syslogd: Nov  5 20:08:17 udhcpc[183]: Sending discover...
W....Trying to connect...
sending -> "udhcpc|leasefail|eth0.2|"
.W...

なお、先行してでまわっているFON2305EはSoCが共通なので、FON2405Eにソフトウェア的にかぎりなく近そうだ。こちらはシリアルコンソールやJTAGのピンを立てる穴のほか、USBのパターンもついている。ネットオークションなどで安価で出回っているので、新規に入手するならFON2405Eを選ぶ理由はないだろう。

FON2305Eについては偉大な先達の記事を参照。