Web Caster 7000 [Computer and Networking ]

セコハンショップでゲットした NTT の多機能ブロードバンドルータ、Web Caster 7000 をいじってみた。AC アダプタをつないで起動するとステータス LED が点灯しない。リセットボタン+電源投入による初期化をおこなうと、ステータス LED が点滅するが、結局消灯し Ether で PC を接続をするとそれぞれのポートに応じた LED は点灯するが、DHCP 機能が働いておらず、接続した PC に IP アドレスは割り当てられない。ハズレだったかと半ばあきらめつつ分解掃除してみたところ、なんとか復活した。ファームは最新の 1.2.42 が入っていて、写真のように USB メモリをつなげばファイルサーバにもなる。この製品については「槻ノ木隆の NEW PRODUCTS IMPRESSION / NTT東日本/西日本 Web Caster 7000 ～インテルのIXP425を搭載する多機能ルータ～ [BB Watch]」に詳しい。

基板上にシリアル信号ピンが出ているので、レベル変換器を介してモニタしてみた。写真赤丸内のピンは右から GND, RxD, TxD, Vcc で接続条件は 8bit non Parity 115200bps。なお、青丸内のジャンパピンは当初 "VoIP" 側になっていたが、これを "Console" 側に差し替えないとシリアルポートをコンソールとして使えなかった。

Uncompressing Linux......................................... done, booting the kernel.
Press ESC to enter BOOT MENU mode.
RGLoader 2.3.17
Booting an active image in 3 seconds
Uncompressing Linux........................................................................................................................................................................................................................................................ done, booting the kernel.
Linux version 2.4.21openrg-rmk1 #224 2005?? 4月 16日 土曜日 17:33:17 JST
CPU: XScale-IXP4xx/IXC11xx revision 1
Machine: Intel IXP425 Bamboo
Memory range 0x3fff000-0x4000000 is excluded because of PCI DMA bug
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: console=ttyS1,115200 root=/dev/ram0 rw nohalt
Using IXP425 Timer 0 as timer source
Calibrating delay loop... 266.24 BogoMIPS
Memory: 64MB = 64MB total
Memory: 56748KB available (1544K code, 6434K data, 64K init)
XScale Cache/TLB Locking Copyright(c) 2001 MontaVista Software, Inc.
Dentry cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.

Random: 0x5802e244
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xff000003 (irq = 15) is a XScale UART
ttyS01 at 0xff001003 (irq = 13) is a XScale UART
Uniform Multi-Platform E-IDE driver Revision: 6.31
ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
data_port: 0x1f0
ctrl_port: 0x1fe
 + ideprobe_init 
 + probe_hwif 
 + hwif_check_regions 
 - hwif_check_regionsLine:521 
 + probe_for_drive 
 + do_probe 
 - do_probeLine:387 * 
 + do_probe 
 - do_probeLine:387 * 
 - probe_for_driveLine:472 * 
 + probe_for_drive 
 + do_probe 
 - do_probeLine:387 * 
 + do_probe 
 - do_probeLine:387 * 
 - probe_for_driveLine:472 * 
 - probe_hwifLine:647 
 + probe_hwif 
 - probe_hwifLine:578 * 
 + probe_hwif 
 - probe_hwifLine:578 * 
 + probe_hwif 
 - probe_hwifLine:578 * 
 + hwif_init 
 + hwif_init 
 + hwif_init 
 + hwif_init 
 - ideprobe_initLine:1085 
ide-floppy driver 0.99.newide
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
loop: loaded (max 8 devices)
ide-floppy driver 0.99.newide
SCSI subsystem driver Revision: 1.00
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
ov511.c: Error: /proc/video/ does not exist
usb.c: registered new driver ov511
ov511.c: v1.65 : ov511 USB Camera Driver
Linux video capture interface: v1.00
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 8192)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 180K
VFS: Mounted root (ext2 filesystem).
Freeing init memory: 64K
Mounting cramfs image at 'cramfs'
insmod: add-symbol-file PATH/kos_lib.o 0xc4981060 -s .data 0xc49859b8 -s .bss 0xc4985b50
insmod: add-symbol-file PATH/ixp425_flash_mod.o 0xc4988060 -s .dcfi_cmdset_0001: Erase suspend on write enabled
ata 0xc49883d8 -s .bss 0xc498848c
Using buffer write method
Using predefined MTD partitions.
Creating 3 MTD partitions on "ixp425 Flash":
0x00000000-0x01000000 : "openrg"
0x00120000-0x00800000 : "flash_fs1"
0x00820000-0x00f00000 : "flash_fs2"
Press ESC to enter BOOT MENU mode.
Can't load valid rg_conf - using defaults
wbc version       1.2.42
saved wbc version 1.2.42
rg version        3.7.33
saved rg version  3.7.33
insmod: add-symbol-file PATH/pcmcia_core.o 0xc59ac060 -s .data 0xc59b558c -s .bss 0xc59b55e0
Linux Kernel Card Services 3.1.22
  options:  [pci] [cardbus]
insmod: add-symbol-file PATH/yenta_socket.o 0xc59b7060 -s .data PCI: enabling device 00:15.0 (0140 -> 0143)
0xc59b8dd8 -s .bss 0xc59b9010
PCI: enabling device 00:15.1 (0140 -> 0143)
Yenta IRQ list 0000, PCI irq6
Socket status: 30000086
Yenta IRQ list 0000, PCI irq6
Socket status: 30000086
insmod: add-symbol-file PATH/ds.o 0xc59bf060 -s .data 0xc59c0a88 -s .bss 0xc59c0af8
insmod: add-symbol-file PATH/csr.o 0xc59c2060 -s .data 0xc59e4ed4 -s .bss 0xc59ee710
Module init.
insmod: add-symbol-file PATH/ixp425_csr_init_mod.o 0xc5a50060 -s .data 0xc5a50478 -s .bss 0xc5a50490
Intel CSR QMGR & NPE(s) init done.
insmod: add-symbol-file PATH/ixp425_eth_mod.o 0xc5a52060 -s .datInitializing ixp425_eth driver 0.0.8
a 0xc5a53e60 -s .bss 0xc5a53ed8
Found PHY 0 at 1
PHY 0 MAC address is:	04:04:04:04:04:04
PHY 1 MAC address is:	06:06:06:06:06:06
insmod: add-symbol-file PATH/igmp_proxy_mod.o 0xc5a56060 -s .data 0xc5a57488 -s .bss 0xc5a57504
insmod: add-symbol-file PATH/log_chardev.o 0xc5a59060 -s .data 0xc5a59ad0 -s .bss 0xc5a59bf0
failed ipc connect Network is unreachable
failed ipc connect Network is unreachable
insmod: add-symbol-file PATH/rg_bridge.o 0xc5a5c060 -s .data 0xc5a60424 -s .bss 0xc5a60450
insmod: add-symbol-file PATH/bridge.o 0xc5a63060 -s .data 0xc5a66f30 -s .bss 0xc5a66f64
NET4: Ethernet Bridge 008 for NET4.0
insmod: add-symbol-file PATH/tcp_mss.o 0xc5a69060 -s .data 0xc5a69310 -s .bss 0xc5a6932c
insmod: add-symbol-file PATH/jfw.o 0xc5a6b060 -s .data 0xc5a814e8 -s .bss 0xc5a82ea8
insmod: add-symbol-file PATH/rg_dhcp_pktfil.o 0xc5a91060 -s .data 0xc5a919f0 -s .bss 0xc5a91ae0
insmod: add-symbol-file PATH/btn.o 0xc5a93060 -s .data 0xc5a93548 -s .bss 0xc5a935e0
insmod: add-symbol-file PATH/rg_ipv4.o 0xc5a95060 -s .data 0xc5aIPV4 device driver registered
95220 -s .bss 0xc5a9525e
insmod: add-symbol-file PATH/krgldr_module.o 0xc5a97060 -s .data 0xc5a97240 -s .bss 0xc5a97268
insmod: add-symbol-file PATH/kleds_mod.o 0xc5a99060 -s .data 0xc5a997e8 -s .bss 0xc5a99844
insmod: add-symbol-file PATH/at93cxx_mod.o 0xc5a9b060 -s .data 0xc5a9b6dc -s .bss 0xc5a9b6dc
insmod: add-symbol-file PATH/adm6996_mod.o 0xc5a9d060 -s .data 0Initializing switch in normal mode
xc5a9d1e0 -s .bss 0xc5a9d38f
insmod: add-symbol-file PATH/nb_rt.o 0xc5a9f060 -s .data 0xc5a9f480 -s .bss 0xc5a9f4d4
insmod: add-symbol-file PATH/pppoe_relay.o 0xc5aa1060 -s .data 0xc5aa3b78 -s .bss 0xc5aa3d80
insmod: add-symbol-file PATH/ppp.o 0xc5ab8060 -s .data 0xc5ac2e20 -s .bss 0xc5ac32e0
insmod: add-symbol-file PATH/usb-uhci.o 0xc5ac5060 -s .data 0xc5aca0cc -s .bss 0xc5aca5a8
usb-uhci.c: $Revision: 1.3.12.1 $ time 18:43:33 Mar 31 2005
usb-uhci.c: High bandwidth mode enabled
usb-uhci.c: USB UHCI at I/O 0xffffffe0, IRQ 7
usb-uhci.c: Detected 2 ports
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb-uhci.c: USB UHCI at I/O 0xffffffc0, IRQ 7
usb-uhci.c: Detected 2 ports
failed ipc connect Network is unreachable
usb.c: new USB bus registered, assigned bus number 2
hub.c: USB hub found
hub.c: 2 ports detected
usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
insmod: add-symbol-file PATH/ehci-hcd.o 0xc5b14060 -s .data 0xc5b18af8 -s .bss 0xc5b18b94
ehci_hcd 00:14.2: VIA Technologies, Inc. USB 2.0
ehci_hcd 00:14.2: irq 7, pci mem c5b1af00
usb.c: new USB bus registered, assigned bus number 3
PCI: 00:14.2 PCI cache line size set incorrectly (0 bytes) by BIOS/FW.
PCI: 00:14.2 PCI cache line size corrected to 32.
ehci_hcd 00:14.2: USB 2.0 enabled, EHCI 0.95, driver 2003-Dec-29/2.4
failed ipc connect Network is unreachable
hub.c: USB hub found
hub.c: 4 ports detected
insmod: add-symbol-file PATH/usb-storage.o 0xc5b22060 -s .data 0xc5b26ae0 -s .bss 0xc5b27cdc
Initializing USB Mass Storage driver...
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
failed ipc connect Network is unreachable
insmod: add-symbol-file PATH/rtp.o 0xc5b2a060 -s .data 0xc5b2b030 -s .bss 0xc5b2b030
insmod: add-symbol-file PATH/codec.o 0xc5b2d060 -s .data 0xc5b2f0f0 -s .bss 0xc5b2f24c
Going to create bridge br0
PHY 0 MAC address is:	00:90:xx:xx:xx:xx
PHY 0 MAC address is:	00:90:xx:xx:xx:xx
ixp0: Entering promiscuous mode
device ixp0 entered promiscuous mode
interface wlan0 does not exist!
failed ipc connect Connection refused
interface wlan1 does not exist!
SIOCSIFADDR: No such device
SIOCSIFADDR: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device
PHY 1 MAC address is:	00:90:xx:xx:xx:xx
PHY 1 MAC address is:	00:90:xx:xx:xx:xx
ixp1: Entering promiscuous mode
device ixp1 entered promiscuous mode
br0: port 1(ixp0) entering learning state
br0: port 1(ixp0) entering forwarding state
br0: topology change detected, propagating
PHY 0 MAC address is:	00:90:xx:xx:xx:xx
edgram_multicast_join:208: Failed to join multicast group.
ipv6 bridge is enabled
insmod: add-symbol-file PATH/rg_ipv6_bridge.o 0xc5b31060 -s .data 0xc5b31248 -s .bss 0xc5b31298
Username: admin
Password: 
OpenRG> help
exit                  Exit from the current cli
die                   <ret> 
                      Exit from Web Caster 7000 and return ret
ps                    Print Web Caster 7000's tasks
rg_conf_print         <root> 
                      Print Web Caster 7000 configuration starting from root - use / for the whole 
                      configuration
rg_conf_set           <path> <value> 
                      Set Web Caster 7000 configuration path to value
rg_conf_set_obscure   <path> <value> 
                      Set Web Caster 7000 configuration path to an obscured value
rg_conf_del           <path> 
                      Delete subtree beginning at path from Web Caster 7000 configuration
rg_conf_ram_set       <path> <value> 
                      Set Web Caster 7000 dynamic configuration path to value
rg_conf_ram_print     <root> 
                      Print Web Caster 7000's dynamic configuration starting from root - use / for 
                      the whole configuration
reconf                <flash_delay 1(=NOW) to 4> 
                      Reconfigure the system according to the current Web Caster 7000 configuration
entity_close          <entity_ptr> 
                      Close an entity
host                  <name> 
                      Resolve host by name
fw_restart            Activate Firewall & NAT
fw_stop               Deactivate Firewall & NAT
fw_nat_only           NAT without FW
fw_dump               [-v] [-ah|-hi] [-c chain | -h address | -i index] [-pr|-ps|-ph|-pp] 
                      Display firewall rule tree
fw_variable           [-v] [-a] [-i index | -n name] 
                      Display variables of the firewall rules
fw_trace              Usage: fw_trace <code> - where code is 0 (off), 1 (full), 2 (partial).
flash_commit          Save Web Caster 7000 configuration to flash
restore_default       [-d] to avoid rebooting after 
                      Restore default configuration
reboot                Reboot the system
log_lev_on            <severity> 
                      Redirect rg_error output equal to or higher than severity to the current 
                      console.

Severity level values are:
	0: Prints debugging messages.
	1: 
                      Prints informational messages.
	2: Prints warning messages.
	3: Prints error 
                      messages.
	4: Prints fatal error messages.
	5: Prints fatal error messages 
                      and reboot.

log_lev_off           Stop rg_error redirection to the current console
exec                  <path> 
                      Execute path
rmt_upd               Remotely upgrade the box
rmt_upd_wget_close    Kill a remote upgrade process
rg_ifconfig           <details_level> 
                      
cat                   <file> 
                      Print file contents to console
shell                 Spawn busybox shell in foreground
cat_log               [fw|varlog] | e[#buf_num] 
                      Print contents of log to console
bridge_info           Print bridge information
flash_layout          Print the flash layout and content
flash_erase           [-d] <section> 
                      Erase a given section in the flash
flash_dump            [-s section | -r address] [-l length] [-1|2|4] 
                      Dump the flash content
bset                  Configure bootloader
ifconfig              Configure network interface
ping                  <ip> 
                      Test network connectivity
route                 Print route table
boot                  [-g] [-s section | -r address]  
                      Boot the system. Use -g to boot with kgdb
load                  [-u url] [-s section | -r address] 
                      Load and burn image
dyn_route_print       Print Dynamic Routes
dyn_route_del         Delete Dynamic Routes
vlan_add              Add VLAN interface
file_server_disks     Print all connected disks and file shares
ver                   Display version information
etask_list_dump       Dump back trace of all etasks
lock                  <addr> <len> 
                      Lock mtd region
unlock                <addr> <len> 
                      Unlock mtd region
help                  Print this menu
Returned 0
OpenRG> 

このように Linux (Linux NET4.0 for Linux 2.4 Based upon Swansea University Computer Society NET3.039)であることが判る。Jungo 社の OpenRG らしい。日付はずれている。当初は "insmod: add-symbol-file PATH/btn.o" の辺りでカーネルデバッガに落ちていた。ゴミでも入ってリセットスイッチでもショートしていたのだろうか。デフォルトのアカウントは admin/パスワードなし。ログインすると通常の shell ではないコマンドインタプリタモードになる。ここから shell と打てば busybox に組み込まれた shell が起動する。

電源投入直後にシリアルコンソールで ESC キーを叩くと "Boot Menu" モードに入る。通常起動時のものに比べてコマンドが少ない。

Uncompressing Linux......................................... done, booting the kernel.
Press ESC to enter BOOT MENU mode.
RGLoader 2.3.17
Booting an active image in 3 seconds
Boot aborted
Restoring OpenRG's defaults
OpenRG boot> help
ps:	Print main-task tasks
rg_conf_print:	rg_conf_print <root> - Print OpenRG configuration
	starting from <root> - use / for the whole configuration
rg_conf_set:	rg_conf_set <path> <value> - Set rg_conf path to a value
rg_conf_del:	rg_conf_del <path> - Del subtree path from rg_conf
reconf:	reconf <flash_delay 1(=NOW) to 4> - Reconfigure the 
	system according to the current rg_conf
entity_close:	entity_close <entity ptr> - Close an entity
host:	host <name> - Resolve host by name
flash_commit:	Save configuration to flash
restore_default:	restore_defaults [-d] - Restore default configuration
	(use -d to avoid rebooting after)
reboot:	Reboot the system
log_lev_on:	log_lev_on <severity> - redirect rg_error output from severity
	equal or higher to <sevrerity> to the current cli
log_lev_off:	Stop rg_error redirection to the current cli
cat:	Print file contents on console
shell:	Spawn busybox shell in foreground
flash_layout:	Prints the flash layout and content
flash_erase:	flash_erase [-d] <section> - erases a given section in the flash
flash_dump:	flash_dump [-s <section> | -r <address>] [-l <length>] [-1|2|4] - dumps the flash content
bset:	Configure bootloader
ifconfig:	Configure network interface
ping:	Test network connectivity
boot:	boot -g {-s <section> | -r <address>} - Boot the system (-g boot with kgdb)
load:	load -u <url> {-s <section> | -r <address>} - Load and burn image
help:	Print this menu
Returned 0
OpenRG boot>

「空転亭・日記」に解析情報あり。製品レビューは「PHPも動作! 簡易サーバ機能を搭載した多機能ルータ「Web Caster 7000 [マイコミジャーナル]」など。

カバーを開けるのは結構面倒。プラスチックカバーはツメで留めてあるだけだが、ばらす際に何箇所か折ってしまった。基板はネジ留め。OpenRG の公開ソースだけだと再構築は厳しそうだ。購入したジャンク品は 1,280 円。AC アダプタと WiFi カード付きは 2,980 円だった。

2008.08.23 Web Caster 7000 (2) - 続き。

Posted by masato at 02:53 PM