WSR-300HPは蟹さんRTL8198

WSR-300HPをTwitter上で見かけたので数か月前に開封したものの蟹さんだったのでそっと閉じてしまった記録を出してみます。
Buffalo WSR-300HPは安価モデルにしては珍しく1000BASE-T搭載モデルになっています。
そろそろ安価モデルも1000BASE-T化される時期という事でしょうか。
無線は802.11nまでとなっているので古さを感じてしまうが価格を考えれば、ある意味割り切った製品の様に思える。
ケース自体は他の製品同様のデザイン、おそらく使いまわしと思われる。


他のルータと大きく異なるのは有線ポートが4ポートとなっている点。
意識しないと買うまで気にもしない点だが、最近は3ポート構成のルータ等も増えてきたので、買う際にはポート数も気にする様にしたい処。


ここまでくるとみたいのは基板。
やっぱり開きますよね。ぱかっとなぁ。
SoCはRTL8198。蟹さんです。
WSRシリーズはMediaTekチップを採用しているモデルだったので期待していたのですが、期待が見事に外れてしまいました。
きっとハックしてくれる人は現れると思っているのですが。
アンテナ線はコネクタ接続ではなく、はんだ付けされています。（コスト対策ですかね。
メタルのカバーを付けるパターンも存在していますが付いていません。


シリアルのピンは始めから建っていたのか自分で建てたのか記憶が薄いです。（たぶん始めから建ってた、と思う
シリアルは、シルクの丸印側からVCC、TX、RX、GND。速度は38,400です。
FlashはMX25L12835F(MX25L12805D互換かな)、16MBなのでサイズは嬉しいですね。
ほんと蟹さんなのが残念。


コンソールにパスワードは掛っていないのでそのままコマンド実行可能です。
また、ブートローダのコマンドモードにも入れますので腕に自信のある方はハックを試してみてはいかが？

Booting...

BUFFALO WSR-300HP version:1.11 at (2014.11.21-14:46+0800) [16bit] 
RTL8198 CPU Speed :620MHz ,DDR2 DRAM Size :64M ,DRAM Speed :125MHz ,Flash Size :16M

eth0 Mac address: cc e1 d5 f6 55 e6
Memory Test Start
Pattern: 55555555
Pattern: aaaaaaaa
Pattern: 00000000
Memory Test Pass 


### Press down Esc key to escape booting by user!! ###
Checking Bank1 Image .....
Flash image address 00010000 
bank1_kernel_checksum = 00002f2b
bank1_rootfs_checksum = 0000bc0f
Bank1 Image is good
Checking Bank2 Image ...
Flash image address 00750000 
bank2_kernel_checksum = 00002f2b
bank2_rootfs_checksum = 0000bc0f
Bank2 Image is good
Bank1 Image the same as Bank2 Image 
Boot from Bank1 Image
Jump to image start=0x80500000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x80003750
CPU revision is: 0000dc02
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,38400 root=/dev/mtdblock3
icache: 16kB/32B, dcache: 8kB/32B, scache: 0kB/0B
NR_IRQS:48
PID hash table entries: 256 (order: 8, 1024 bytes)
console handover: boot [early0] -> real [ttyS0]
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 56512k/65536k available (2498k kernel code, 8952k reserved, 887k data, 108k init, 0k highmem)
Calibrating delay loop... 617.67 BogoMIPS (lpj=3088384)
Mount-cache hash table entries: 512
net_namespace: 540 bytes
NET: Registered protocol family 16
bio: create slab  at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 110
io scheduler noop registered
io scheduler cfq registered (default)
Realtek GPIO Driver for Flash Reload Default
ABCD-org: MUX(0x36), CNR(0x0), DIR(0x0), DAT(0xFF000100)
EFGG-org: MUX(0xF0F), CNR(0xF8FFE600), DIR(0xC0010FF), DAT(0x70001FE)
ABCD-new: MUX(0x36), CNR(0x0), DIR(0x0), DAT(0xFF000100)
EFGG-new: MUX(0xF0F), CNR(0xF8FFE600), DIR(0xC0010FF), DAT(0x70001FE)
dni-buttond driver 0.1.
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x18002000 (irq = 8) is a 16550A
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Realtek WLAN driver - version 1.6 (2013-02-21)
 wlan_index:0  0, 134,0xb9000000,0xb8b10000,11
=====>>INSIDE rtl8192cd_init_one <<=====
PCIE reset (0) 
Do MDIO_RESET
98 - 40MHz Clock Source
Find Port=0 Device:Vender ID=818b10ec
vendor_deivce_id=818b10ec
HalAssociateNic OK 


#######################################################
SKB_BUF_SIZE=2408 MAX_SKB_NUM=480
#######################################################

=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====



Probing RTL8186 10/100 NIC-kenel stack size order[3]...
chip name: 8196C, chip revid: 0
==Set GPHY Parameter OK
NOT YET
Set threshould idx 0
eth0 added. vid=9 Member port 0x1...
eth1 added. vid=8 Member port 0x10...
eth2 added. vid=9 Member port 0x2...
eth3 added. vid=9 Member port 0x4...
eth4 added. vid=9 Member port 0x8...
eth5 added. vid=9 Member port 0x0...
[peth0] added, mapping to [eth1]...
SPI INIT
 ------------------------- Force into Single IO Mode ------------------------ 
|No chipID  Sft chipSize blkSize secSize pageSize sdCk opCk      chipName    |
| 0 c22018h  0h 1000000h  10000h   1000h     100h   50    0   MX25L12805D/45E|
 ---------------------------------------------------------------------------- 
SPI flash(MX25L12805D/45E) was found at CS0, size 0x1000000
Creating 13 MTD partitions on "flash_bank_1":
0x000000000000-0x00000000e000 : "boot+cfg"
0x00000000e000-0x000000010000 : "dnicfg"
0x000000010000-0x000000150000 : "linuxA"
0x000000150000-0x000000750000 : "rootfsA"
0x000000750000-0x000000890000 : "linuxB"
0x000000150000-0x000000750000 : "rootfsB"
0x000000e90000-0x000000ea0000 : "lang"
0x000000ea0000-0x000000ee0000 : "nvram"
0x000000ee0000-0x000000ee2000 : "traffic_meter"
0x000000ee2000-0x000000ee4000 : "pot"
0x000000ee4000-0x000000ee6000 : "pppoe"
0x000000ee6000-0x000000ee8000 : "wifical"
0x000000ee8000-0x000001000000 : "flatfs"
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
Ebtables v2.0 registered
Netlink[Kernel] create socket for igmp ok.
Realtek FastPath:v1.03
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
Freeing unused kernel memory: 108k freed
mount: 
Cannot read /etc/fstab: No such file or directory
rootdir=/
table='/etc/device_table.txt'
/etc/rc.d/rc: 60: cannot create /proc/wan_port: Directory nonexistent
/etc/rc.d/rc: 61: cannot create /proc/sys/net/core/hot_list_length: Directory nonexistent
mtd = /dev/nvram 
flatfsd: flat1_checkfs 4, hdr.magic=cafe2345, hdr.length=23044, hdr.chksum=1936463

flatfsd: Created 5 configuration files (22850 bytes)
115+0 records in
115+0 records out
WSR-300HP
Wed Jan  1 00:00:00 UTC 2014
firmware_version = 2.10_0.01JP
br10_ip: Module loaded.
/etc/rc.d/rc: 241: cannot create /proc/mem_write: Directory nonexistent
dni-buttond: , delay 1 sec, inspect Disable
killall: alarm: no process killed
Current_mode=1
HW switch in auto mode
* recover action=6:switch_mode:autoforce *
killall: alarm: no process killed
mtd = /dev/nvram 
flatfsd: Wrote 23076 bytes to flash in 0 seconds
device eth0 entered promiscuous mode
br0: port 1(eth0) entering forwarding state

Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).
$Starting Service: 
httpaccess.sh stop

httpaccess.sh start

$Starting uhttpd: 
uhttpd: version 1.0
httpd server started at port 80
httpd server (ssl support) started at port 443
uhttpd: can't open IPv6 http socket
open socket on port = 443
Update string table successfully, memory usage: 44KB.
Generating RSA private key, 1024 bit long modulus
..................++++++
..++++++
unable to write 'random state'
e is 65537 (0x10001)
The httpd server is running ...
http login timeout is 600 secs

$Starting syslogd: 
br0 hwaddr: cc:e1:d5:f6:55:e6

route: SIOC[ADD|DEL]RT: No such process
$wan_proto invalid: easy
$Starting miniigd: 

MiniIGD v1.07 (2015.06.11-02:21+0000).

$Starting : 
/etc/rc.d/mini_upnp.sh: 67: cannot create : Directory nonexistent

$Starting dnsmasq: 

$Starting udhcpd: 
info, 
udhcpd (v0.9.9-pre) started
cat: /tmp/ntp_status: No such file or directory
stop crond !!
killall: crond: no process killed
$Starting crond conf_dir: /tmp/etc/crontabs
/etc/rc.d/service_start.sh: 347: /usr/sbin/telnetenable: not found
Using intrapositioned negation (`--option ! this`) is deprecated in favor of extrapositioned (`! --option this`).
flash:: open /tmp/upnp_portmap failed
$Static routes setting:
rtl_policy_acl_write 13812 acl setting mac_acl 0 CC:E1:D5:F6:55:E6 0
The attached devices demo is Running ...

$Starting /usr/sbin/lld2d: 

TC.sh stop:
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
/etc/rc.d/TC.sh: 552: cannot create /proc/MFS: Directory nonexistent
/etc/rc.d/TC.sh: 552: cannot create /proc/qos_su_ip: Directory nonexistent
run NTP client wan no ip.
$Shutting down ntpclient: 
killall: ntpclient: no process killed

$Starting ntpclient: 
ntpclient -d -z 56 -x 0 -h ntp.jst.mfeed.ad.jp -i 600 -m 2400 -p 123 -s 2 -t 86400


Configuration:
  -c probe_count       1
  -d (debug)           1
  -h hostname          ntp.jst.mfeed.ad.jp
  -b second hostname   ntp.jst.mfeed.ad.jp
  -i interval(min)     600
  -m interval(max)     2400
  -p local_port        123
  -s set_clock         1
  -t update interval   86400
NTP no check Wan.
Configuration:
  Probe count          1
  Debug                1
  NTP server           ntp.jst.mfeed.ad.jp
  Interval             600
  Local port           123
  Set clock            1
ntp.jst.mfeed.ad.jp: Unknown host
Auto switch: Start router mode! ---------------
$Disable igmpsnooping: 

$Enable igmpsnooping: 

Wireless is disabled
IF_handle stop....
stopping app
Shutdown repeater...
wps stop
kill: 3225: kill 10539: No such process
IF_handle start....
device wlan0 entered promiscuous mode
InitPON OK
InitMAC OK
InitHCIDMAReg OK
InitDownload FW OK 
[TXPWR_LMT_92EE_new]
8192E LCK done!!
8192E hp !!!
br0: port 2(wlan0) entering forwarding state
wps start

WiFi Simple Config v2.14-wps1.0 (2015.06.11-02:23+0000).

starting app
IPTV Setup: Guest2:[] Guest3:[] Guest4:[]
@Ignore switch power button.
@setRtlOnOff,,0@@
main: cmdline setRtlOnOff
Remove IPv6 passthrough ...
device peth0 is not a slave of br0
Set IPv6 passthrough ...


BusyBox v1.01 (2015.06.11-02:20+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # *** auto mode detect ***
Inet start: start
Inet start: detmode
Inet start: eth of wan plug out
##### break;
detect auto router
mtd = /dev/nvram 
flatfsd: Wrote 23044 bytes to flash in 1 seconds

/ #