Ramroot の散歩


Ramroot/EM Mode を散歩する


root@LS-XHL-EMDDB:~# ps
  PID  Uid        VSZ Stat Command
    1 root       3364 S   init
    2 root            SW< [kthreadd]
    3 root            SWN [ksoftirqd/0]
    4 root            SW< [events/0]
    5 root            SW< [khelper]
   34 root            SW< [kblockd/0]
   48 root            SW  [crypto]
   49 root            SW  [crypto_ret]
   54 root            SW  [pdflush]
   55 root            SW  [pdflush]
   56 root            SW< [kswapd0]
   57 root            SW< [aio/0]
   58 root            SW< [xfslogd/0]
   59 root            SW< [xfsdatad/0]
  238 root            SW< [scsi_eh_0]
  239 root            SW< [scsi_eh_1]
  249 root            SW< [mtdblockd]
  250 root            SW< [nftld]
  256 root            SW< [kcryptd/0]
  310 root       3364 S   /usr/sbin/telnetd
  704 root       1856 S   syslogd -m 0
  706 root       2364 S   klogd
  709 root       2268 S   /bin/sh /usr/local/sbin/kernelmon
  728 root            SW< [khubd]
  780 root       2060 S   /usr/local/sbin/clientUtil_server -i eth1
  784 root       1740 S   /usr/local/sbin/daemonwatch -a /etc/daemonwatch.list
  824 root       3364 R   /usr/sbin/telnetd
  903 root       3232 S   cat /proc/buffalo/kernevnt
  917 root       1620 S   /sbin/dhcpcd -L /etc/dhcpc -h LS-XHL-EMDDB -t 15 -x -y -z 140 eth1
  971 root       2652 S   -sh
 1041 root       3364 S   /sbin/getty -L ttyS0 115200 vt100
 1046 root       3368 R   ps
いつも通り、ttyS0 で getty が動いている。
通信速度は 115200


root@LS-XHL-EMDDB:~# dmesg
Linux version (root@build2.dd-hot24.nas.buffalo.local) (gcc version 4.2.0 20070413 (prerelease)) #108 Fri Dec 26 14:19:54 JST 2008
CPU: ARM926EJ-S [56251311] revision 1 (ARMv5TE), cr=00053977
Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 65536
  DMA zone: 512 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 65024 pages, LIFO batch:15
  Normal zone: 0 pages used for memmap
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Built 1 zonelists.  Total pages: 65024
Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,32M panic=5 BOOTVER=0.07 tftpboot=yes
PID hash table entries: 1024 (order: 10, 4096 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 256MB 0MB 0MB 0MB = 256MB total
Memory: 222720KB available (3776K code, 300K data, 124K init)
メモリは 256MB。これまでの2倍
Calibrating delay loop... 1199.30 BogoMIPS (lpj=5996544)
400MHz の LS-GL の BogoMIPS が 266.24なので、約 4.5 倍。
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16

CPU Interface
SDRAM_CS0 ....base 00000000, size 256MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e8000000, size 128MB
PEX0_IO ....base f2000000, size   1MB
INTER_REGS ....base f1000000, size   1MB
NFLASH_CS ....base fa000000, size   2MB
SPI_CS ....base f4000000, size  16MB
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB

  Marvell Development Board (LSP Version KW_LSP_4.2.6)-- MVLSXH  Soc: 88F6281 A0 LE

 Detected Tclk 200000000 and SysClk 400000000
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c282d600
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled
SCSI subsystem initialized
NET: Registered protocol family 2
Time: kw_clocksource clocksource has been installed.
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 32768K
RTC registered
MICON ctrl (C) BUFFALO INC. V.1.00 installed.
Buffalo Gpio Control Driver (C) BUFFALO INC. Ver.1.00 installed.
Buffalo CPU Inerupts Driver (C) BUFFALO INC. Ver.0.01 alpha1 installed.
Kernel event proc (C) BUFFALO INC. V.1.00 installed.
Use the XOR engines (acceleration) for enhancing the following functions:
  o RAID 5 Xor calculation
  o kernel memcpy
  o kenrel memzero
Number of XOR engines to use: 4
mvCesaInit: sessions=640, queue=64, pSram=f0000000
MV Buttons Driver Load
VFS: Disk quotas dquot_6.5.1
Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
JFFS2 version 2.2. (NAND) 誕 ・001-2006 Red Hat, Inc.
SGI XFS with ACLs, large block numbers, no debug enabled
SGI XFS Quota Management subsystem
io scheduler noop registered
io scheduler anticipatory registered (default)
RAMDISK driver initialized: 2 RAM disks of 32768K size 1024 blocksize
loop: module loaded
Loading Marvell Ethernet Driver:
  o Cached descriptors in DRAM
  o DRAM SW cache-coherency
  o Single RX Queue support - ETH_DEF_RXQ=0
  o Single TX Queue support - ETH_DEF_TXQ=0
  o TCP segmentation offload enabled
  o Receive checksum offload enabled
  o Transmit checksum offload enabled
  o Network Fast Processing (Routing) supported
  o Driver ERROR statistics enabled
  o Driver INFO statistics enabled
  o Proc tool API enabled
  o Rx descripors: q0=128
  o Tx descripors: q0=532
  o Loading network interface(s):
    o eth0, ifindex = 1, GbE port = 0
    o eth1, ifindex = 2, GbE port = 1

mvFpRuleDb (c2044000): 2048 entries, 8192 bytes
Integrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
scsi 0:0:0:0: Direct-Access     Hitachi  HDP725050GLA360  GM4O PQ: 0 ANSI: 5
sd 0:0:0:0: [sda] 976773168 512-byte hardware sectors (500108 MB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Mode Sense: 23 00 10 00
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, supports DPO and FUA
sd 0:0:0:0: [sda] 976773168 512-byte hardware sectors (500108 MB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Mode Sense: 23 00 10 00
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, supports DPO and FUA
 sda: unknown partition table
やっぱり unknown partition table と
sd 0:0:0:0: [sda] Attached SCSI disk
sd 0:0:0:0: Attached scsi generic sg0 type 0
NFTL driver: nftlcore.c $Revision: 1.98 $, nftlmount.c $Revision: 1.41 $
SPI Serial flash detected @ 0xf4000000, 512KB (8sec x 64KB)
NAND init: NAND device not found on board
mice: PS/2 mouse device common for all mice
Linux telephony interface: v1.00
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
raid6: int32x1     98 MB/s
raid6: int32x2    123 MB/s
raid6: int32x4    125 MB/s
raid6: int32x8    111 MB/s
raid6: using algorithm int32x4 (125 MB/s)
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
raid5: measuring checksumming speed
   arm4regs  :  1090.000 MB/sec
   8regs     :   758.800 MB/sec
   32regs    :   904.400 MB/sec
raid5: using function: arm4regs (1090.000 MB/sec)
device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-devel@redhat.com
dm_crypt using the OCF package.
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
RAMDISK: Compressed image found at block 0
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 124K
Warning: unable to open an initial console.
eth1: link down
eth1: started
eth1: link up, full duplex, speed 1 Gbps
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver
USB Universal Host Controller Interface driver v3.0
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
bfSetMagicKey > Changed to 0x71 from 0x5c
eth1: stopped
eth1: link down
eth1: started
eth1: link up, full duplex, speed 1 Gbps


root@LS-XHL-EMDDB:~# cat /proc/cpuinfo
Processor       : ARM926EJ-S rev 1 (v5l)
BogoMIPS        : 1199.30
Features        : swp half thumb fastmult edsp
CPU implementer : 0x56
CPU architecture: 5TE
CPU variant     : 0x2
CPU part        : 0x131
CPU revision    : 1
Cache type      : write-back
Cache clean     : cp15 c7 ops
Cache lockdown  : format C
Cache format    : Harvard
I size          : 16384
I assoc         : 4
I line length   : 32
I sets          : 128
D size          : 16384
D assoc         : 4
D line length   : 32
D sets          : 128

Hardware        : Feroceon-KW
Revision        : 0000
Serial          : 0000000000000000


root@LS-XHL-EMDDB:~# cat /proc/meminfo
MemTotal:       255772 kB
MemFree:        206868 kB
Buffers:         32768 kB
Cached:           4888 kB
SwapCached:          0 kB
Active:           6660 kB
Inactive:        33008 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               8 kB
Writeback:           0 kB
AnonPages:        2028 kB
Mapped:           1604 kB
Slab:             7732 kB
SReclaimable:      500 kB
SUnreclaim:       7232 kB
PageTables:        180 kB
NFS_Unstable:        0 kB
Bounce:              0 kB
CommitLimit:    127884 kB
Committed_AS:     5320 kB
VmallocTotal:   385024 kB
VmallocUsed:     16704 kB
VmallocChunk:   360444 kB


root@LS-XHL-EMDDB:~# cat /proc/buffalo/firmware
BUILDDATE=2008/12/26 14:19:42


LinkStation/玄箱 をハックしよう

ファームウェア 1.02 のインストール

Copyright (C) 2003-2009 Yasunari Yamashita. All Rights Reserved.
yasunari @ yamasita.jp 山下康成@京都府向日市