じゃんぱら2号店にTWR-350が8.8kであった。微妙に悩んだものの、無線付いて安いSTR9105デバイスということと、mountrootまで来た記念に買ってきた。いわゆるイーモバ用アクセスポイントルータ。OEMはCWR-635M。
いつものように電源入れてみる前に分解。

Mini PCI bus に Ralink の RT2561 が刺さってる。ホットボンドで固定してあったけどパリっと綺麗に取れたので好きなカード刺し放題でなんにでも使えそう。

シリアルっぽいピンにMAX232Cを繋ぐ。(電源入れる前)


TXとRXはどちらかわからないので、一度継いでから電源入れつつシリアルのスピードを9600〜115200まで変えてみて、
ダメだったらTXとRX入れ変えて再度スピード特定。

スピードは38400bps、ピン配置は、外側から順に、RX、VCC、TX、GNDの順でした。(※初出ピンの順序間違えてたので修正しました)
中身は ARMBoot + Linux。

ARMboot 1.1.0 (Dec 20 2005 - 16:07:00)

PEK maintain version 1.3.100000000
ARMboot code: 00000000 -> 00016900

DDR SDRAM Configuration with DDRC Data Bus Width x16:
DDR Bank #0: 00000000 32 MB

*** Using default environment
init pgtable
ttb is at: 40000
pgtconf...
ttbSet
ttbSet OK...

Hit any key to stop autoboot:  0 
done.
## Starting application at 0x0cf00000 ...
Uncompressing Linux............................................................................. done, booting the kernel.
paging_init()....OK
request_standard_resources()....OK
Linux version 2.4.27-uc0-pek3 (stone@user-desktop) (gcc version 3.3.6) #6 篋 9 26 13:58:46 CST 2008
CPU: Faraday FA526id(wb) revision 1
ICache:16KB enabled, DCache:16KB enabled, BTB support
Machine: STAR_STR9100
alloc_bootmem_low
memtable_init
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram0 mem=32M panic=1
IRQ Timer1 at interrupt number 0x0 and clock 100000000(Hz)
Calibrating delay loop... 153.60 BogoMIPS
Memory: 32MB = 32MB total
Memory: 25460KB available (1905K code, 536K data, 64K init)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
POSIX conformance testing by UNIFIX
PCI: bus0: Fast back to back transfers disabled
pci bridge found 
AHB to bridge interrupt status : 24200000
pci_enable: bus: 0 devfn: 0
pci_enable: bus: 0 devfn: 10
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Journalled Block Device driver loaded
i2c-core.o: i2c core module version 2.6.1 (20010830)
i2c-dev.o: i2c /dev entries driver module version 2.6.1 (20010830)
i2c-proc.o version 2.6.1 (20010830)
Str9100 Serial Driver version 5.05c (2001-07-08) with no serial options enabled
ttyS00 at 0xf7800000 (irq = 10) is a Star_UART
STAR star9100 Driver, v1.9pek-d20cm (11/03/2005) - by PEK & Star Semi.
RAMDISK driver initialized: 16 RAM disks of 14336K size 1024 blocksize
PPP generic driver version 2.4.2
PPP MPPE compression module registered
PPP Deflate Compression module registered
SCSI subsystem driver Revision: 1.00
kmod: failed to exec /sbin/modprobe -s -k scsi_hostadapter, errno = 2
kmod: failed to exec /sbin/modprobe -s -k scsi_hostadapter, errno = 2
physmap flash device: 800000 at 10000000
phys_mapped_flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
phys_mapped_flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
kmod: failed to exec /sbin/modprobe -s -k cmdlinepart, errno = 2
cmdlinepart partition parsing not available
kmod: failed to exec /sbin/modprobe -s -k RedBoot, errno = 2
RedBoot partition parsing not available
Using physmap partition definition
Creating 3 MTD partitions on "phys_mapped_flash":
0x00000000-0x00040000 : "bootROM"
0x00040000-0x007c0000 : "bootpImage"
0x007c0000-0x00800000 : "User FS"
Linux Kernel Card Services 3.1.22
  options:  [pci] [cardbus]
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
hcd.c: ehci_hcd @ EHCI, EHCI_HCdriver
hcd.c: irq 24, pci mem c3005000
usb.c: new USB bus registered, assigned bus number 1
USB f.c enabled, EHCI 1.00, driver 2003-Dec-29/2.4
hub.c: USB hub found
hub.c: 2 ports detected
host/usb-ohci_STR.c: USB OHCI at membase 0xc700c000, IRQ 23
host/usb-ohci_STR.c: usb-OHCI, OHCI_HCdriver
usb.c: new USB bus registered, assigned bus number 2
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver acm
acm.c: v0.21:USB Abstract Control Model driver for USB modems and ISDN adapters
usb.c: registered new driver usblp
printer.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
Linux video capture interface: v1.00
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
ip_conntrack version 2.1 (256 buckets, 2048 max) - 328 bytes per conntrack
ip_conntrack_pptp version $Revision: 1.61 $ loaded
ip_nat_pptp version $Revision: 1.61 $ loaded
ip_tables: (C) 2000-2002 Netfilter core team
ipt_recent v0.3.1: Stephen Frost <sfrost@snowman.net>.  http://snowman.net/projects/ipt_recent/
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
Ebtables v2.0 registered
NET4: Ethernet Bridge 008 for NET4.0
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
Other stuff added by David S. Miller <davem@redhat.com>
NetWinder Floating Point Emulator V0.97 (double precision)
ds: no socket drivers loaded!
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 4349K
VFS: Mounted root (ext2 filesystem) readonly.
Freeing init memory: 64K
UART IRQ_ports = c0264e18
UART IRQ at interrupt number 0xa
e2fsck 1.25 (20-Sep-2001)
/dev/mtdblock3: clean, 12/32 files, 26/256 blocks
e2fsck 1.25 (20-Sep-2001)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/mtdblock3: 12/32 files (0.0% non-contiguous), 26/256 blocks
mount: Mounting /dev/mtdblock3 on /mount failed: Device or resource busy
cp: /mount/nasmac: No such file or directory
cp: `/mount/..' and `/cfg/..' are the same file
crc_sum[fbdd567e]
crc_x[fbdd567e]
cmd[ifconfig eth0 hw ether 0008a1c0457e0008a1c0457f]
SIOCSIFHWADDR: Success
cmd[ifconfig eth1 hw ether 0008a1c0457f]
SIOCSIFHWADDR: Success
check switch mode start
SW_PW
cp: /home/httpd/cgi-bin/welcome_router.html: No such file or directory
check switch mode end
enter SW_MID SW_PW
Using /bin/ovcamchip.o
ovcamchip_core.c: v2.28 : OV camera chip I2C driver
Using /bin/ov511.o
usb.c: registered new driver ov511
ov511_core.c: v2.28 : ov511 USB Camera Driver
Using /bin/pwc.o
pwc Philips webcam module version 9.0.2 loaded.
pwc Supports Philips PCA645/646, PCVC675/680/690, PCVC720[40]/730/740/750 & PCVC830/840.
pwc Also supports the Askey VC010, various Logitech Quickcams, Samsung MPC-C10 and MPC-C30,
pwc the Creative WebCam 5 & Pro Ex, SOTEC Afina Eye and Visionite VCS-UC300 and VCS-UM100.
usb.c: registered new driver Philips webcam
Using /bin/pwcx.o
Warning: loading pwcx will taint the kernel: non-GPL license - Proprietary. See http:pwc Philips webcam decompressor routines version 9.0-BETA-2
//pwc Supports all cameras supported by the main module (pwc).
www.smcc.demon.nl/webcam/tainting.html
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
Using /bin/spca5xx.o
usb.c: registered new driver spca5xx
spca5xxx.c: spca5xx driver 00.60.01 registered
Using /bin/rt61ap.o
Warning: loading rt61ap will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
we are now in Router mode!
device eth0 entered promiscuous mode
device ra0 entered promiscuous mode
killall: pekcmd: no process killed
bre0: port 2(ra0) entering learning state
bre0: port 1(eth0) entering learning state
killall: rt61apd: no process killed
bre0: port 2(ra0) entering disabled state
bre0: port 2(ra0) entering disabled state
device ra0 left promiscuous mode
Using /bin/rt61ap.o
Warning: loading rt61ap will taint the kernel: no license
  See http://www.tux.org/lkml/#export-tainted for information about tainted modules
AuthMode:AuthMode=OPEN
Key1Str=2004012677
Key2Str=2004012677
Key3Str=2004012677
Key4Str=2004012677
DefaultKeyID=1
device ra0 entered promiscuous mode
bre0: port 2(ra0) entering learning state
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
switch_mode=[router]
55555------rmmod usbserial-----
rmmod: usbserial: No such file or directory
USB device changed!
debug FTP: looks like FTP server already DISABLED.
cp: `/cfg/..' and `/mount/..' are the same file

Welcome to
 _____    ____  ___   __
|  __ \  / ___| | |  / /
| | | | | |     | | / /
| | | | | |__   | |/ /
| |_| | |  __|  |    \     Linux (Router with NAS)
|  ___/ | |     |  /\ \
| |     | |___  | |  \ \_
|_|     \_____| |_|   \ _\

STAR(R) STR910x

USB device changed!
dnsmasq: started, version 2.22 cachesize 150
dnsmasq: cleared cache
dnsmasq: reading /etc/resolv.conf

pek>info, udhcpd (v0.9.9-pre) started
error, max_leases value (254) not sane, setting to 251 instead
error, Unable to open /etc/udhcpd.leases.bre0 for reading
bre0: port 1(eth0) entering forwarding state
bre0: topology change detected, propagating
bre0: port 2(ra0) entering forwarding state
bre0: topology change detected, propagating