ISL
3893

hacking isl3893

Serial port

The j303 connector (red connector)is in fact a serial port. You can connect a 3.3v adaptor in making the following schema based on a MAX3232:



Kernel and system messages

mm-armv.c 578

Rescueing Boot for the ISL3893, version 0.5.2.0
Copyright (C) 1993-2002 Intersil Americas Inc. All Rights Reserved.
MAC Address: 00.09.5b.5b.b8.05
Forcing soft reset from Bootloaderÿ
Rescueing Boot for the ISL3893, version 0.5.2.0
Copyright (C) 1993-2002 Intersil Americas Inc. All Rights Reserved.
MAC Address: 00.09.5b.5b.b8.05

Boot: start searching for image... Found
Boot: Checking Image CRC32...  Okay.
OKA
Uncompressing Linux (bzip2)... done, booting the kernel.
Linux version 2.4.19-uc1 (changcs@sw2lab1) (gcc version 2.95.3.2 20010315 (release)) #1 Fri Aug 29 14:06:46 CST 2003
Processor: ARM ARM946 revision 1
Architecture: ISL3893
Boot Struct at 0003f000
Boot parameter block at 0003ffc8
SRAM size 0x7b7b40
On node 0 totalpages: 2039
zone(0): 0 pages.
zone(1): 2039 pages.
zone(2): 0 pages.
Kernel command line:
Calibrating delay loop... 71.88 BogoMIPS
Memory: 7MB = 7MB total
Memory: 4456KB available (1225K code, 2058K data, 52K init)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
POSIX conformance testing by UNIFIX
isl38xx_init: 007f2280
pci_arch_init : 00000000
PCI: bus0: Fast back to back transfers disabled
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
JFFS version 1.0, (C) 1999, 2000  Axis Communications AB
pty: 256 Unix98 ptys configured
ISL3893 UART serial driver version 1.0 (2002-07-11) with no serial options enabled
ttyS00 at 0xc0000500 (irq = 8) is a ISL3893 UART
eth0: Prism Embedded MVC v2 packet IF version 0.4.0.0 found,Macaddress = 00:09:5b:5b:b8:05
eth1: Prism Embedded MVC v2 packet IF version 0.4.0.0 found,Macaddress = 00:09:5b:5b:b8:05
eth2: Prism Embedded MVC v2 packet IF version 0.4.0.0 found,Macaddress = 00:09:5b:5b:b8:05
prism_uap_probe(eth3)
prism_uap_probe(eth3)
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 182AA4-3262A3 [VIRTUAL 182AA4-3262A3] (RO)
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
physmap flash device: 400000 at 8000000
 Amd/Fujitsu Extended Query Table v1.0 at 0x0040
Physically mapped flash: JEDEC Device ID is 0xC4. Assuming broken CFI table.
Physically mapped flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
Creating 3 MTD partitions on "Physically mapped flash":
0x00000000-0x00010000 : "Bootloader"
0x00010000-0x001b0000 : "Access Point Firmware"
0x001b0000-0x00200000 : "Flash Filesystem"
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 512)
ip_conntrack (63 buckets, 504 max)
PPTP netfilter connection tracking: registered
PPTP netfilter NAT helper: registered
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
cramfs: wrong magic
JFFS: Trying to mount a non-mtd device.
VFS: Mounted root (romfs filesystem) readonly.
^@Mounting proc on /proc
Bummer, can't write to log on /dev/tty5!
console=/dev/ttyS0
init started:  BusyBox v0.51 (2003.08.29-06:03+0000) multi-call binary
# interface eth3 does not exist!
device eth1 entered promiscuous mode
device eth0 entered promiscuous mode
can't find port eth3 in bridge br0
Jan  1 00:00:02 ucd-snmp[65]: UCD-SNMP version 4.2.6

(Re)starting paed
paed uses obsolete (PF_INET,SOCK_PACKET)
paed (re)started succesfully
TFTP Upgrade Server v0.0.2 (2003.08.29-06:04+0000) started
/bin/shelld: not found
(Re)starting wins
wins (re)started succesfully
Can't read configure file.
Failed opening device /usr/etc/images/webfileset.img: No such file or directory
Cannot get ifindex of interface eth3: No such device
Failed to build PIMFOR packet
Get: send_rcv failed
PDR_INTERFACE_LIST not present for interface 5, assuming ERP  OFDM
mod_dni_ifdata.c:195 SIOCGIFNETMASK: Cannot assign requested address
mod_dni_ifdata.c:199 Interface is not ethernet
mod_dni_ifdata.c:195 SIOCGIFNETMASK: Cannot assign requested address
mod_dni_ifdata.c:199 Interface is not ethernet
RunAndRead: execv failed
PDA 10:00:00:00
mod_dni_ifdata.c:195 SIOCGIFNETMASK: Cannot assign requested address
mod_dni_ifdata.c:199 Interface is not ethernet
mod_dni_ifdata.c:195 SIOCGIFNETMASK: Cannot assign requested address
mod_dni_ifdata.c:199 Interface is not ethernet
paed stopped succesfully
Failed to get SNMP password
Error, couldn't open SNMP passwd file
iptables: not found
/bin/iptables-restore: not found
killall: pptp_callmgr: no process killed
killall: pppoe: no process killed
killall: pppd: no process killed
paed stopped succesfully
killall: pptp: no process killed
dhcpcd not running on interface eth2
(Re)starting paed
/bin/iptables: not found
(Re)starting wins
paed (re)started succesfully
wins (re)started succesfully
eth2: link up
SIOCDELRT: No such process
dhcpcd not running on interface br0
killall: autoip: no process killed
SIOCADDRT: No such device
killall: udhcpd: no process killed
Cannot get ifindex of interface eth3: No such device
Failed to build PIMFOR packet
Set: send_rcv failed
Cannot get ifindex of interface eth3: No such device
Failed to build PIMFOR packet
Set: send_rcv failed
br0: port 1(eth1) entering listening state
eth1: link up
br0: port 2(eth0) entering listening state
eth1: link up
eth1: link up
wins stopped succesfully
eth1: link up
eth1: link up
eth1: link up

Accepting connections on port 1122

br0: port 2(eth0) entering learning state
br0: port 1(eth1) entering learning state
(Re)starting wins
wins (re)started succesfully
Jan  1 00:00:18 dhcpcd[194]: timed out waiting for a valid DHCP server response

Jan  1 00:00:18 dhcpcd[194]: dhcpStop: ioctl SIOCSIFFLAGS: %m

br0: port 2(eth0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth1) entering forwarding state
br0: topology change detected, propagating

JTAG access

There's JTAG connector on most access points, I will try to find the BSDL file so as to get access directly to the flash...