G-CONNECT - Starting the Hacking...

This connector really took my sleep...
Let's begin the investigation!



Using the technique described in this awesome article:


Let's measure the voltage of the pins. First with the device turned off and OK! I found the GND pin:


          JP2
[o] [o] [o] [o]  
      GND  


I turned on the device to check the voltage of the pins. Beginning by the first pin I found 3.3v Dammit!! I was thinking in use a Arduino to decode the serial, but the Arduino serial uses 5v.
Measuring the other ports I found 3.3v also with small variations, my multimeter is not good enough to find a truly small variation.

My bet to this connector is:

          JP2
[o] [o] [o] [o]  
3.3v GND RX TX

My home bench is not full of tools. I was thinking in use some of this cables to read this serial: 
Once convert an Arduino to operate using 3.3v instead 5v is not a easy task I thought in the last cable option... If the cable read the serial and a serial is a bidirectional connection, I probably can read this port using my Raspberry Pi.  First I measured the voltage of Raspberry and it's really 3.3v.

So I connected the wires and I started the baudrate (https://code.google.com/p/baudrate/) python app to try to sniff some characters. After some seconds, I didn't get anything in my screen. For sure I was not in lucky.. My first thought was "Let's invert the RX and TX cables..."

JP2
[o] [o] [o] [o]  
3.3v GND TX RX

And after restart Raspberry pi and baudrate Hey!!!  I got some junk using 115200 bps... Let's turn off the G-Connect and turn on to try to catch the boot messages.

OBS: You really need invert TX and RX... So RX in Raspy is TX in G-connect and TX in Raspy is RX in G-Connect.
I didn't use the resistor... (pin position didn't represent the G-Connect)
Take a look on this article: http://johanbijker.blogspot.com.br/2012/07/tp-link-mr3420-serial-connection-with.html


Using this configuration on minicom:

########################################################################
# Minicom configuration file - use "minicom -s" to change parameters.
pu port             /dev/ttyAMA0
pu baudrate         115200
pu bits             8
pu parity           N
pu stopbits         1
pu rtscts           No
########################################################################

I turned on G-Connect again and I got this messages!!!!






@@@@@@@@@@@@@@@@@@@@@ Baudrate: 115200 @@@@@@@@@@@@@@@@@@@@@

                    e           

               e      e                       ee ee    ?e            

                   ?e e   e?ee               ?ee     ?e                
                  ee ?e                           e   ?e e             
                       ?ee ?e               ?e ?e  ?e                     
                      e    ?e  ?e    ?ee ?e  ?ee?e?e  ?e                
                  e      ee  ee?e?ee ?ee  ?e ?e    e               
                  e           ?ee e?e    ?e  ?e   e   ee             
                                   e?eee?e  e?e   ?e                   
                                      ?e   ee  ?ee ee                 
                                  ?e eee ?ee ee                      
                             ?e    ?eeee  ?ee          e              
                         ?e e e  eee?e                                
                     ee  e ?e   ee                                    
                       e?e e ?e                                          
                  e       e                                              
                                                               e          
                                                                           
              e                                                           
                  e                                                       
                  e                                           e          
              e                                                           
                                                                           
                     e                                         e         
              e ?e    e    e                  ?e?e?e?e?e?e?e            
                                                                           
                              e                  e   e         e e    
                e         e  e                               e e      
               ee e       e     e         e          e e           
        e    e        e    e e        e  ?e  e         ?e  e       
          e                   e  e     e  ?ee      ee       e      
                                         e e       e             e     
                                                                           
                                                                           
                                                                           
_   _     ____              _
| | | |   | __ )  ___   ___ | |_
| | | |___|  _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
\___/    |____/ \___/ \___/ \__|
** MARVELL BOARD: MinAik-88F6281 LE

U-Boot 1.1.4 (Aug 17 2011 - 00:12:36) Marvell version: 3.6.0 1bitECC enhanced

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00

Soc: 88F6281 A1CPU running @ 800Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 166Mhz

DRAM (DDR2) CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000   size 256MB
DRAM Total size 256MB  16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
Flash:  0 kB

CPU : Marvell Feroceon (Rev 1)

Streaming disabled
Write allocate disabled

Module 0 is RGMII
Module 1 is TDM

USB 0: host mode
PEX 0: PCI Express Root Complex Interface
PEX interface detected Link X1
Net:   egiga0, egiga1 [PRIME]
Hit any key to stop autoboot:  0

NAND read: device 0 offset 0x100000, size 0x400000

Reading data from 0x4ff800 -- 100% complete.
4194304 bytes read: OK
## Booting image at 00800000 ...
  Image Name:   Linux-2.6.31.8
  Created:      2011-07-25  17:46:14 UTC
  Image Type:   ARM Linux Kernel Image (uncompressed)
  Data Size:    2959448 Bytes =  2.8 MB
  Load Address: 00008000
  Entry Point:  00008000
  Verifying Checksum ... OK
OK

Starting kernel ...

Uncompressing Linux.......................................................................................................................................................................... done, booting the kernel.
Linux version 2.6.31.8 (ramang@es5x86.axentra.com) (gcc version 4.3.2 (sdk3.3-ct-ng-1.4.1) ) #1 Mon Jul 25 13:46:05 EDT 2011
CPU: Feroceon 88FR131 [56251311] revision 1 (ARMv5TE), cr=00053977
CPU: VIVT data cache, VIVT instruction cache
Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 65024
Kernel command line: console=ttyS0,115200 ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs
PID hash table entries: 1024 (order: 10, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 256MB = 256MB total
Memory: 248064KB available (4472K code, 269K data, 688K init, 0K highmem)
Hierarchical RCU implementation.
NR_IRQS:128
Console: colour dummy device 80x30
Calibrating delay loop... 794.62 BogoMIPS (lpj=3973120)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
Feroceon L2: Enabling L2
Feroceon L2: Cache support initialised.

CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 256MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e0000000, size 128MB
PEX0_IO ....base f2000000, size   1MB
PEX1_MEM ....no such
PEX1_IO ....no such
INTER_REGS ....base f1000000, size   1MB
NFLASH_CS ....base fa000000, size   2MB
SPI_CS ....base f4000000, size  16MB
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size   2MB

 Marvell Development Board (LSP Version KW_LSP_5.1.3_patch29)-- RD-88F6281A  Soc: 88F6281 A1 LE

Detected Tclk 166666667 and SysClk 400000000
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c8054740
PEX0 interface detected Link X1
pci 0000:00:01.0: PME# supported from D0 D1 D3hot
pci 0000:00:01.0: PME# disabled
PCI: bus0: Fast back to back transfers disabled
mvPexLocalBusNumSet: ERR. Invalid PEX interface 1
bio: create slab <bio-0> at 0
SCSI subsystem initialized
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
NET: Registered protocol family 1
rtc mv_rtc: rtc core: registered kw-rtc as rtc
RTC registered
cpufreq: Init kirkwood cpufreq driver
XOR registered 4 channels
XOR 2nd invalidate WA enabled
cesadev_init(c000d884)
mvCesaInit: sessions=640, queue=64, pSram=f0000000
Warning: TS unit is powered off.
MV Buttons Driver Load
SGI XFS with security attributes, large block/inode numbers, no debug enabled
msgmni has been set to 484
alg: No test for cipher_null (cipher_null-generic)
alg: No test for ecb(cipher_null) (ecb-cipher_null)
alg: No test for digest_null (digest_null-generic)
alg: No test for compress_null (compress_null-generic)
alg: No test for stdrng (krng)
alg: No test for hmac(digest_null) (hmac(digest_null-generic))
Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
io scheduler noop registered
io scheduler anticipatory registered (default)
Initializing ths8200_init
Initializing dove_adi9889_init
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
console [ttyS0] enabled
Integrated Sata device found
IRQ 21/mvSata: IRQF_DISABLED is not guaranteed on shared IRQs
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
scsi 0:0:0:0: Direct-Access     Hitachi  HTS545050A7E380  GG2O PQ: 0 ANSI: 5
sd 0:0:0:0: [sda] Sector size 0 reported, assuming 512.
sd 0:0:0:0: [sda] 976773168 512-byte logical blocks: (500 GB/465 GiB)
sd 0:0:0:0: [sda] 0-byte physical blocks
sd 0:0:0:0: Attached scsi generic sg0 type 0
Loading Marvell Ethernet Driver:
 o Cached descriptors in DRAM
 o DRAM SW cache-coherency
 o 2 Giga ports supported
 o Single RX Queue support - ETH_DEF_RXQ=0
 o Single TX Queue support - ETH_DEF_TXQ=0
 o TCP segmentation offload (TSO) supported
 o Receive checksum offload supported
 o Transmit checksum offload supported
 o Network Fast Processing (Routing) supported - (Disabled)
 o Driver ERROR statistics enabled
 o Proc tool API enabled
 o SKB Reuse supported - (Disabled)
 o SKB Recycle supported - (Disabled)
 o Rx descripors: q0=128
 o Tx descripors: q0=532
 o Loading network interface(s):
    o register under mv88fx_eth platform
sd 0:0:0:0: [sda] Write Protect is off
    o eth0, ifindex = 2, GbE port = 0
    o eth1, ifindex = 3, GbE port = 1

mvFpRuleDb (c877e000): 2048 entries, 8192 bytes
Counter=0, opIdx=6, overhead=16
Counter=1, opIdx=2, overhead=0
Counter=2, opIdx=1, overhead=18
Counter=3, opIdx=2, overhead=0
Intel(R) PRO/1000 Network Driver - version 7.3.21-k3-NAPI
Copyright (c) 1999-2006 Intel Corporation.
sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
sd 0:0:0:0: [sda] Sector size 0 reported, assuming 512.
e1000e: Intel(R) PRO/1000 Network Driver - 1.0.2-k2
e1000e: Copyright (c) 1999-2008 Intel Corporation.
e100: Intel(R) PRO/100 Network Driver, 3.5.24-k2-NAPI
e100: Copyright(c) 1999-2006 Intel Corporation
Using Hamming 1-bit ECC for NAND device
NAND device: Manufacturer ID: 0xad, Chip ID: 0xda (Hynix NAND 256MiB 3,3V 8-bit)
Scanning device for bad blocks
Using static partition definition
Creating 3 MTD partitions on "nand_mtd":
0x000000000000-0x000000100000 : "u-boot"
sda:
0x000000100000-0x000000700000 : "uImage"
0x000000700000-0x000010000000 : "root"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
sda1
sd 0:0:0:0: [sda] Sector size 0 reported, assuming 512.
sd 0:0:0:0: [sda] Attached SCSI disk
UBI: attached mtd2 to ubi0
UBI: MTD device name:            "root"
UBI: MTD device size:            249 MiB
UBI: number of good PEBs:        1992
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 1992
UBI: number of PEBs reserved for bad PEB handling: 38
UBI: max/mean erase counter: 1/0
UBI: image sequence number: 688630409
UBI: background thread "ubi_bgt0d" started, PID 445
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
TCP cubic registered
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
rtc mv_rtc: setting system clock to 2014-07-14 13:58:45 UTC (1405346325)
Freeing init memory: 688K
Reset button not pressed
Proceeding normally.
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   239857664 bytes (234236 KiB, 228 MiB, 1889 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: zlib
UBIFS: reserved for root:  0 bytes (0 KiB)
INIT: version 2.86 booting
Welcome to HipServ
Press 'I' to enter interactive startup.
Setting clock  (utc): Mon Jul 14 09:58:47 GMT+4 2014 [  OK  ]
Untar /dev.Done
Setting hostname axentraserver.localdomain:  [  OK  ]
Checking filesystems
Checking all file systems.
[  OK  ]
Mounting local filesystems:  mount: sysfs already mounted or /sys busy
mount: according to mtab, /sys is already mounted on /sys
[FAILED]
Enabling /etc/fstab swaps:  [  OK  ]
INIT: Entering runlevel: 3
Entering non-interactive startup
ath0erv startup:[  OK  ]

Bringing up loopback interface:  [  OK  ]
Bringing up interface eth0:  
Determining IP information for eth0... failed; no link present.  Check cable?
Applying iptables firewall rules: [  OK  ]
Loading additional iptables modules: nf_conntrack_ftp nf_conntrack_irc nf_conntrack_sip nf_conntrack_proto_gre nf_conntrack_pptp nf_conntrack_h323 nf_nat_ftp nf_nat_irc nf_nat_sip nf_nat_proto_gre nf_nat_pptp nf_nat_h323 [  OK  ]
Applying iptables firewall rules: Flushing firewall rules: [  OK  ]
Setting chains to policy ACCEPT: nat filter [  OK  ]
[  OK  ]
Loading additional iptables modules: nf_conntrack_ftp nf_conntrack_irc nf_conntrack_sip nf_conntrack_proto_gre nf_conntrack_pptp nf_conntrack_h323 nf_nat_ftp nf_nat_irc nf_nat_sip nf_nat_proto_gre nf_nat_pptp nf_nat_h323 [  OK  ]
[  OK  ]
Starting system logger: [  OK  ]
Starting kernel logger: [  OK  ]
Starting system message bus: [  OK  ]
Starting hostapd: /etc/hostapd/hostapd.confConfiguration file: /etc/hostapd/hostapd.conf
ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1
DEVICE IS DOWN ifname=ath0
Could not connec DEVICE IS DOWN ifname=ath0
t to kernel driver.
Using interface ath0 with hwaddr XXX MAC ERASED XXX and ssid 'G-CONNECT-XXXX'
DES SSID SET=G-CONNECT-YHKC
random: Cannot read from /dev/random: Resource temporarily unavailable
random: Only 0/20 bytes of strong random data available from /dev/random
random: Not enough entropy pool available for secure operations
WPA: Not enough entropy in random pool for secure operations - update keys later when the first station connects
[  OK  ]
Starting ntpd: [  OK  ]
Starting httpd: [  OK  ]
Starting OEone System Proxy: SPD starting....log level=1, uid=0

[  OK  ]
Starting Avahi daemon... [  OK  ]
dnsdomainname: Host name lookup failure
Starting dnsmasq: [  OK  ]
0
   HipServ - Checking if RAID needs to be rebuilt
       HipServ - No RAID found
   HipServ - Updating date...
Error : Name or service not known
14 Jul 09:59:16 ntpdate[1375]: can't find host 0.pool.ntp.org

14 Jul 09:59:16 ntpdate[1375]: no servers can be used, exiting
       success
   HipServ - Enabling swap
   HipServ - Cleaning USB mountpoints
   HipServ - Mounting USB devices
ufsd: driver 8.4 (008_A)  LBD=ON with ioctl loaded at bf27c000
NTFS read/write support included
Hfs+/HfsX read/write support included
   HipServ -  Checking for FTPS certificate
       HipServ - Found vsftpd key file
   HipServ -  Ensuring that table structures are up-to-date
Stopping redis-server: [FAILED]
Starting redis-server: [  OK  ]
Starting hdexd server: [  OK  ]
Starting hdexqin server: [  OK  ]
GbE port 0: TxEnable WA - Enabled, deep=1, tx_en_bk=1

   HipServ - Checking for updates...
       success
HipServ - boot complete
Starting guelph-lifecycle:[  OK  ]
Starting sshd: [  OK  ]
Starting appserver: [  OK  ]
Starting crond: [  OK  ]
Starting mynetworkd:[  OK  ]

axentraserver.localdomain login:


 


I tried to type in terminal, but I got no response... looks like the serial terminal is not started.
Let me turn off the WiFi to check the messages...





eth0: stopped                                                                                         

eth0: started




Humm some feedback.. probably changing the network speed..
Let's try access SSH with a different user then root.




Alignment trap: not handling swp instruction
Alignment trap: not handling instruction e1043090 at [<4038ba0c>]
Unhandled fault: alignment exception (0x801) at 0x464c457f




Weird...
Ok let's turn off the device to check the shutdown messages


                                                                                       
Sending all processes the KILL signal...                                                              

Saving random seed:                                                          
Syncing hardware clock to system time                                        
Turning off swap:                       
Unmounting file systems:                
                                       
/dev/sda:                               
issuing standby command                
Halting system...                       
sd 0:0:0:0: [sda] Synchronizing SCSI cache
System halted.
3.10140 = 20





Some pictures of the serial connection:

Notice the first hole without connection (3.3v)


 

Next post... Investigate the boot messages!!!