PQI Air Penからシリアルを引き出す。

u-bootにアクセスする為に、とりあえず分解しました。
バッテリー搭載モデルなので分解時にバッテリーを傷付け無い様注意してください。
ケース自体は、超音波溶着なので、カッター等でぺりぺりと剥がすしかないです。
一度開封すると戻せないので、戻せない事を考えた上で開封する事になります。
バッテリーを傷付けて爆発したとか責任とれないので、すべて自己責任とご理解下さい。


バッテリーは3本線で半田付けされています。
ハック中に不要なトラブルを避ける為、今回は取り外して動作確認を進めました。
線はホットボンドで固定されているので、ホットボンドも丁寧に除去します。
バッテリーを戻す気もないのであれば、線を切ってしまうのもありかと。
USBは、コネクタ接続なので抜けば問題ないです。


バッテリーは怖いので、ショートしてしまわない様に、テープで一時的に別けておきました。
OpenWrt対応した後にバッテリー含めての動作確認の為に、綺麗に残しておきます。


金属カバーが少し浮いてますが、カバー外す前に写真撮るの忘れました。
2ヶ所半田固定されているので、半田を吸い取ってカバーも外します。
SoC等の目視確認が必要ないのであれば、カバーを外すメリットは何もありません。
半田固定はゆるいので、簡単にはずれます。


SPI FlashはWSON8パッケージの物が採用されている。(ICクリップで挟めないから嫌いです。)
W25Q64FVという事で、8MBしかないのが残念。
8MBしかないのにDualImage構成を取っていたり、普通にmtdをマウントしていたり、作りこんでいるのか、手抜きしているのか、判断できない造りになっています。
配線さえ伸ばせば、一般的なROMライタでも読み出せるでしょう。



搭載SoCは、AR9331。
OpenWrtでも多くのデバイスがサポートされているので、起動させるのは簡単でした。
面倒だったのは、未開封でDualImageを壊しつつ、OpenWrt化を行う手順化だけでした。



シリアルは、写真上側に線を伸ばしていますが、黒線がGNDで、白TX、緑RXになります。
115200でu-bootへアクセス可能です。

U-Boot 1.1.4-g5eca71af-dirty (Jan  3 2013 - 16:27:19)

Air Pen U-boot Ver.1.12

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 148k for U-Boot at: 83fd8000
Reserving 192k for malloc() at: 83fa8000
Reserving 44 Bytes for Board Info at: 83fa7fd4
Reserving 36 Bytes for Global Data at: 83fa7fb0
Reserving 128k for boot params() at: 83f87fb0
Stack Pointer at: 83f87f98
Now running in RAM - U-Boot at: 83fd8000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8388608, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot:  1  0 
## Booting image at 9f070000 ...
   Image Name:   Linux Kernel Image
   Created:      2013-01-03   8:27:24 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1155555 Bytes =  1.1 MB
   Load Address: 80002000
   Entry Point:  8025fe60
   Verifying Checksum at 0x9f070040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8025fe60) ...
## Giving linux memsize in bytes, 67108864

Starting kernel ...

Booting AR9330(Hornet)...
Linux version 2.6.31.AirPen_V0.1.22-g5eca71a (dio@dio) (gcc version 4.3.3 (GCC) ) #319 Thu Jan 3 16:27:02 CST 2013
flash_size passed from bootloader = 8
arg 1: console=ttyS0,115200
arg 2: root=31:05
arg 3: rootfstype=squashfs
arg 4: init=/sbin/init
arg 5: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),64k(ART),64k(NVRAM),1280k(uImage),2560k(rootfs),1280k(uImage2),2560k(rootfs2),64k(CONF)
arg 6: mem=64M
CPU revision is: 00019374 (MIPS 24Kc)
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:05 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),64k(ART),64k(NVRAM),1280k(uImage),2560k(rootfs),1280k(uImage2),2560k(rootfs2),64k(CONF) mem=64M 
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 61492k/65536k available (2438k kernel code, 3976k reserved, 723k data, 136k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 232.96 BogoMIPS (lpj=465920)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
===== ar7240_platform_init: 0
bio: create slab  at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Sangoma WANPIPE Router v1.1 (c) 1995-2000 Sangoma Technologies Inc.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
AR7240 GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/W].
fuse init (API version 7.12)
msgmni has been set to 120
io scheduler noop registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
ttyS0: detected caps 00000000 should be 00000100
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
brd: module loaded
PPP generic driver version 2.4.2
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver zaurus
usbcore: registered new interface driver sierra_net
9 cmdlinepart partitions found on MTD device ar7240-nor0
Creating 9 MTD partitions on "ar7240-nor0":
0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000050000 : "u-boot-env"
0x000000050000-0x000000060000 : "ART"
0x000000060000-0x000000070000 : "NVRAM"
0x000000070000-0x0000001b0000 : "uImage"
0x0000001b0000-0x000000430000 : "rootfs"
0x000000430000-0x000000570000 : "uImage2"
0x000000570000-0x0000007f0000 : "rootfs2"
0x0000007f0000-0x000000800000 : "CONF"
usbmon: debugfs is not available
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
USB Serial support registered for Sierra USB modem
usbcore: registered new interface driver sierra
sierra: v.1.3.7:USB Driver for Sierra Wireless USB modems
Linux video capture interface: v2.00
usbcore: registered new interface driver uvcvideo
USB Video Class driver (v0.1.0)
u32 classifier
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
IPVS: Registered protocols ()
IPVS: Connection hash table configured (size=4096, memory=32Kbytes)
IPVS: ipvs loaded.
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear 
All bugs added by David S. Miller 
lib80211: common routines for IEEE802.11 drivers
arch/mips/ar7240/gpio.c (ar7240_simple_config_init) AP_RESET_GPIO: 12
arch/mips/ar7240/gpio.c (ar7240_simple_config_init) JUMPSTART_GPIO: 11

ar7240: simple_config callback..sc 1, irq 0, ignorepb 0, jiffies 4294892426

ar7240: calling simple_config callback.. push dur in sec 0

ar7240: simple_config callback..sc 1, irq 0, ignorepb 1, jiffies 4294892429
Hook callback function gpio_read for gpio6
Hook callback function gpio_write for gpio7
Hook callback function gpio_read for gpio8
Hook callback function gpio_read for gpio12
Hook callback function gpio_read for gpio22
Hook callback function gpio_write for gpio23
Hook callback function gpio_write for gpio27
ar7240wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing unused kernel memory: 136k freed
init started:  BusyBox v1.01 (2013.01.03-08:27+0000) multi-call binary
init started:  BusyBox v1.01 (2013.01.03-08:27+0000) multi-call binary
Starting pid 185, console /dev/ttyS0: '/etc/rc.d/rcS'
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004 
ar7240-ehci ar7240-ehci.0: ATH EHCI
ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000 
ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000 
ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: ATH EHCI
usb usb1: Manufacturer: Linux 2.6.31.AirPen_V0.1.22-g5eca71a ehci_hcd
usb usb1: SerialNumber: platform
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
**** drop_caches_sysctl_handler: all done timer added ...**** 
Starting pid 202, console /dev/t
 (none) mips #319 Thu Jan 3 16:27:02 CST 2013 (none)
(none) login: ATHR_GMAC: Length per segment 1536
ATHR_GMAC: fifo cfg 3 01f00140
ATHR_GMAC: Mac address for unit 0:8384de80
ATHR_GMAC: 80:db:31:01:5e:78 
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   252
ATHR_GMAC: Mac capability flags    :   4403
ATHR_GMAC: Mac address for unit 1:8384de80
ATHR_GMAC: 80:db:31:01:5e:78 
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   96
ATHR_GMAC: Mac capability flags    :   4D83
athr_gmac_ring_alloc Allocated 640 at 0x839e6000
athr_gmac_ring_alloc Allocated 4032 at 0x83961000
Setting Drop CRC Errors, Pause Frames and Length Error frames 
Setting PHY...
asf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 9.2.0_U10.1020 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
Bootstrap clock 25MHz
ar9300RadioAttach: Need analog access recipe!!
Restoring Cal data from Flash
ath_get_caps[5105] rx chainmask mismatch actual 1 sc_chainmak 0
ath_get_caps[5080] tx chainmask mismatch actual 1 sc_chainmak 0
SC Callback Registration for wifi0
wifi0: Atheros 9380: mem=0xb8100000, irq=2
wlan_vap_create : enter. devhandle=0x83b4c2c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x83b4c2c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created 
 
 DES SSID SET=PQI Air Pen 
device ath0 entered promiscuous mode
br0: port 1(ath0) entering learning state
 ieee80211_ioctl_siwmode: imr.ifm_active=393856, new mode=3, valid=1 
 Scan in progress.. Cancelling it 
br0: port 1(ath0) entering disabled state
 DEVICE IS DOWN ifname=ath0
 DEVICE IS DOWN ifname=ath0
br0: port 1(ath0) entering learning state
br0: port 1(ath0) entering forwarding state

 (none) mips #319 Thu Jan 3 16:27:02 CST 2013 (none)