GM MDI Info

Information and discussion of EFI hardware and specifications
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

GM MDI Info

Post by antus »

This is a strip down and info dump about a GM MDI interface purchased from ali express.

Note that this is just fun and games and this post is for the hackers out there (both of these definitions of hacker...) http://en.wikipedia.org/wiki/Hacker_%28 ... culture%29 http://en.wikipedia.org/wiki/Hacker_%28hobbyist%29 :lol:

It turns out these interfaces run Linux which makes them very hackable. Should be lots of good times in the future.

Note that it is very easy to damage or destroy your MDI when using these tools. Use this information and shell or u-boot access at your own risk.

The main board includes an sdcard, which includes a linux filesystem. At run time this mounts under /usr/local/. Once the filesystem is mounted you can enter bin and rename telnetd.sh-disable to telnetd.sh. Now reboot and check your MDIs IP address, and telnet in. You will be dumped straight to a root prompt. Set a nicer prompt like this:

Code: Select all

bash-3.2# export PS1='[\u@mdi \W]\$ '
[root@mdi /]#
Now were in lets check the kernel version and the hardware.

Code: Select all

[root@mdi /]# uname -a
Linux (none) 2.6.24.4-etas-08apr25 #1 PREEMPT Tue Feb 18 16:17:00 PST 2014 armv5tel unknown

[root@mdi /]# cat /proc/cpuinfo
Processor       : XScale-PXA270 rev 7 (v5l)
BogoMIPS        : 517.73
Features        : swp half fastmult edsp iwmmxt
CPU implementer : 0x69
CPU architecture: 5TE
CPU variant     : 0x0
CPU part        : 0x411
CPU revision    : 7
Cache type      : undefined 5
Cache clean     : undefined 5
Cache lockdown  : undefined 5
Cache format    : Harvard
I size          : 32768
I assoc         : 32
I line length   : 32
I sets          : 32
D size          : 32768
D assoc         : 32
D line length   : 32
D sets          : 32

Hardware        : KARO electronics Triton-270 on Starterkit 3
Revision        : 0000
Serial          : 0000000000000000

[root@mdi /]# free
              total         used         free       shared      buffers
Mem:       127028        39332        87696            0        25116
Swap:            0            0            0
Total:       127028        39332        87696
So, its little endian arm, with 128mb of ram.

What about storage?

Code: Select all

[root@mdi /]# mount
/dev/root on / type ext2 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
none on /dev/pts type devpts (rw)
tmpfs on /tmp type tmpfs (rw)
/dev/mmcblk0p1 on /usr/local type ext3 (rw,noatime,data=ordered)
/dev/mmcblk0p2 on /usr/local/data type ext3 (rw,data=ordered)
So the SDCard's 2 partitions are mounted to /usr/local and /usr/local/data

Code: Select all

[root@mdi /]# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "boot"
mtd1: 00020000 00020000 "bootvars"
mtd2: 00180000 00020000 "linux1"
mtd3: 00600000 00020000 "initrd1"
mtd4: 00180000 00020000 "linux2"
mtd5: 00600000 00020000 "initrd2"
mtd6: 00020000 00020000 "linuxvars1"
mtd7: 00020000 00020000 "linuxvars2"
mtd8: 00008000 00020000 "serialnum"
mtd9: 00008000 00020000 "macaddress"

[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd1
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 131072 (128K)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd2
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 1572864 (1M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd3
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 6291456 (6M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd4
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 1572864 (1M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd5
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 6291456 (6M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd6
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 131072 (128K)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd7
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 131072 (128K)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd8
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 32768 (32K)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0

[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd9
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 32768 (32K)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0
There is a file bootvars, it appears to be a u-boot configuration.

Code: Select all

bootargs=root=/dev/ram init=/linuxrc console=ttyS0,38400 rw ramdisk_size=24576 ip=10.103.98.238:10.103.98.205:10.103.98.129:255.255.255.128::eth0:no ethaddr=0x02:0x03:0x04:0x05:0x06:0x07 mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress)
baudrate=38400
board=etasvci
rev=13006
FLBLOCKSZ=128k
INITRD=0xa0a30000
autoload=no
altbootcmd=bootm linux2 initrd2
stopretry=setenv bootretry -1
loadsdargs=setenv bootargs root=/dev/ram rw ramdisk_size=24576
addinit=setenv bootargs ${bootargs} init=/linuxrc
addinitsd=setenv bootargs ${bootargs} init=/loadsdrc
addconsole=setenv bootargs ${bootargs} console=ttyS0,${baudrate}
addip=setenv bootargs ${bootargs} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}::eth0:no
addeth=setenv bootargs ${bootargs} ethaddr=${rbethaddr}
addprimary=setenv bootargs ${bootargs} bootmode=primary
addbackup=setenv bootargs ${bootargs} bootmode=backup
reprogram_uboot=tftpboot scratch u-boot/u-boot.bin.test;protect off all;erase boot;cp.b scratch boot ${filesize}
eraseenv=protect off all;erase bootvars
setbootargsloadsd=run loadsdargs addinitsd addconsole addip addeth addprimary;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress);
setbootargsprimary=run normalargs addinit addconsole addeth addprimary;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress);
setbootargsbackup=run normalargs addinit addconsole addeth addbackup;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress);
setbootcmdnormal=setenv bootcmd 'run setbootargsprimary; flock; bootm linux1 initrd1 || echo Primary boot failed. Using backup boot.; run setbootargsbackup; bootm linux2 initrd2'
setbootcmdloadsd=setenv bootcmd 'run setbootargsloadsd; flock; bootm linux1 initrd1'
flash_loadsd=run setbootcmdloadsd; run bootcmd
flash_normal=run setbootcmdnormal; run bootcmd
ethaddr=00:90:7e:0d:14:13
rbethaddr=0x00:0x90:0x7e:0x0d:0x14:0x13
vcihcr=0x207
vcitype=MDI
dhcp_vendor-class-identifier=etas.vci.mdi
vcieth=SMSC9116
vcidimm=TRITON270II
serialnumber=1220-22129579
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.1.4 (Dec 21 2007 - 12:11:55) ETAS VCI (r13006)
serverip=192.168.222.1
buildscript=u-boot/script.mdi.u-boot
bootcmd=run setbootargsprimary; flock; bootm linux1 initrd1 || echo Primary boot failed. Using backup boot.; run setbootargsbackup; bootm linux2 initrd2
kfile1=u-boot/zImage-primary.u-boot
ksize1=134220
kfile2=u-boot/zImage-recovery.u-boot
ksize2=13421C
pfile=u-boot/initrd-primary.u-boot
psize=28903A
rfile=u-boot/initrd-recovery.u-boot
rsize=431658
filesize=431658
fileaddr=A2000000
gatewayip=192.168.222.1
netmask=255.255.255.0
ipaddr=192.168.222.144
normalargs=setenv bootargs root=/dev/ram rw ramdisk_size=24576 quiet
verify=no
bootdelay=3
What about the kernel config? This is super long so attached as a file.
mdi kernel config.txt
(34.73 KiB) Downloaded 682 times
And what about kernel messages?

Code: Select all

Jan  1 00:00:03 (none) syslogd 1.5.0: restart.
Jan  1 00:00:03 (none) kernel: net_namespace: 64 bytes
Jan  1 00:00:03 (none) kernel: NET: Registered protocol family 16
Jan  1 00:00:03 (none) kernel: CONFIG_ETAS is set
Jan  1 00:00:03 (none) kernel: 9215I byte test=0x87654321
Jan  1 00:00:03 (none) kernel: karo_read_board_type: type_found MDI
Jan  1 00:00:03 (none) kernel: karo_init: Unknown MDI type, enabling CPUCLK
Jan  1 00:00:03 (none) kernel: karo_init: hw_id: 0x0, using gpio table_index: 0
Jan  1 00:00:03 (none) kernel: Failed to verify module type; kernel configuration doesn't match HW or HW failure
Jan  1 00:00:03 (none) kernel: karo_set_features: Setting up HW features for Triton-270 (0x73)
Jan  1 00:00:03 (none) kernel: Board type is: 0x14
Jan  1 00:00:03 (none) kernel: karo_set_features: Setting up HW features for KARO Starterkit 3 (0x14)
Jan  1 00:00:03 (none) kernel: karo_mod_conf: using gpio table_index: 0
Jan  1 00:00:03 (none) kernel: karo_init: Skipping platform device[0]: karo-ide
Jan  1 00:00:03 (none) kernel: karo_init: Registering platform device[1]: smsc911x
Jan  1 00:00:03 (none) kernel: karo_init: Skipping platform device[2]: smc91x_pcmcia
Jan  1 00:00:03 (none) kernel: karo_init: Skipping platform device[3]: cs89x0
Jan  1 00:00:03 (none) kernel: usbcore: registered new interface driver usbfs
Jan  1 00:00:03 (none) kernel: usbcore: registered new interface driver hub
Jan  1 00:00:03 (none) kernel: usbcore: registered new device driver usb
Jan  1 00:00:03 (none) kernel: NET: Registered protocol family 2
Jan  1 00:00:03 (none) kernel: Time: oscr0 clocksource has been installed.
Jan  1 00:00:03 (none) kernel: IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
Jan  1 00:00:03 (none) kernel: TCP established hash table entries: 4096 (order: 3, 32768 bytes)
Jan  1 00:00:03 (none) kernel: TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
Jan  1 00:00:03 (none) kernel: TCP: Hash tables configured (established 4096 bind 4096)
Jan  1 00:00:03 (none) kernel: TCP reno registered
Jan  1 00:00:03 (none) kernel: Freeing initrd memory: 2810K
Jan  1 00:00:03 (none) kernel: pxa_cpufreq_init: board_id: 0xffffffff, using CPU max_freq: 520001
Jan  1 00:00:03 (none) kernel: Run Mode clock: 208.00MHz (*16)
Jan  1 00:00:03 (none) kernel: Turbo Mode clock: 520.00MHz (*2.5, active)
Jan  1 00:00:03 (none) kernel: Memory clock: 208.00MHz (/2)
Jan  1 00:00:03 (none) kernel: System bus clock: 208.00MHz 
Jan  1 00:00:03 (none) kernel: PXA CPU frequency change support initialized
Jan  1 00:00:03 (none) kernel: NetWinder Floating Point Emulator V0.97 (double precision)
Jan  1 00:00:03 (none) kernel: JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
Jan  1 00:00:03 (none) kernel: io scheduler noop registered
Jan  1 00:00:03 (none) kernel: io scheduler anticipatory registered (default)
Jan  1 00:00:03 (none) kernel: io scheduler deadline registered
Jan  1 00:00:03 (none) kernel: io scheduler cfq registered
Jan  1 00:00:04 (none) kernel: pxa2xx-uart.0: ttyS0 at MMIO 0x40100000 (irq = 22) is a FFUART
Jan  1 00:00:04 (none) kernel: console [ttyS0] enabled
Jan  1 00:00:04 (none) kernel: pxa2xx-uart.1: ttyS1 at MMIO 0x40200000 (irq = 21) is a BTUART
Jan  1 00:00:04 (none) kernel: pxa2xx-uart.2: ttyS2 at MMIO 0x40700000 (irq = 20) is a STUART
Jan  1 00:00:04 (none) kernel: RAMDISK driver initialized: 16 RAM disks of 24576K size 1024 blocksize
Jan  1 00:00:04 (none) kernel: smsc911x: Driver version 2008-06-02.
Jan  1 00:00:04 (none) kernel: eth0: SMSC911x MAC Address: 00:90:7e:0d:14:13
Jan  1 00:00:04 (none) kernel: console [netcon0] enabled
Jan  1 00:00:04 (none) kernel: netconsole: network logging started
Jan  1 00:00:04 (none) kernel: flash0: Found 1 x16 devices at 0x0 in 16-bit bank
Jan  1 00:00:04 (none) kernel: NOR chip too large to fit in mapping. Attempting to cope...
Jan  1 00:00:04 (none) kernel:  Intel/Sharp Extended Query Table at 0x010A
Jan  1 00:00:04 (none) last message repeated 4 times
Jan  1 00:00:04 (none) kernel: Using buffer write method
Jan  1 00:00:04 (none) kernel: cfi_cmdset_0001: Erase suspend on write enabled
Jan  1 00:00:04 (none) kernel: Reducing visibility of 16384KiB chip to 1024KiB
Jan  1 00:00:04 (none) kernel: flash0: Found 1 x16 devices at 0x0 in 16-bit bank
Jan  1 00:00:04 (none) kernel:  Intel/Sharp Extended Query Table at 0x010A
Jan  1 00:00:04 (none) last message repeated 4 times
Jan  1 00:00:04 (none) kernel: Using buffer write method
Jan  1 00:00:04 (none) kernel: cfi_cmdset_0001: Erase suspend on write enabled
Jan  1 00:00:04 (none) kernel: KARO flash: CFI device at 0x00000000, 16MiB, 16-bit
Jan  1 00:00:04 (none) kernel: 10 cmdlinepart partitions found on MTD device flash0
Jan  1 00:00:04 (none) kernel: KARO flash: using dynamic partition definition
Jan  1 00:00:04 (none) kernel: Creating 10 MTD partitions on "flash0":
Jan  1 00:00:04 (none) kernel: 0x00000000-0x00040000 : "boot"
Jan  1 00:00:04 (none) kernel: 0x00040000-0x00060000 : "bootvars"
Jan  1 00:00:04 (none) kernel: 0x00060000-0x001e0000 : "linux1"
Jan  1 00:00:04 (none) kernel: 0x001e0000-0x007e0000 : "initrd1"
Jan  1 00:00:04 (none) kernel: 0x007e0000-0x00960000 : "linux2"
Jan  1 00:00:04 (none) kernel: 0x00960000-0x00f60000 : "initrd2"
Jan  1 00:00:04 (none) kernel: 0x00f60000-0x00f80000 : "linuxvars1"
Jan  1 00:00:04 (none) kernel: 0x00f80000-0x00fa0000 : "linuxvars2"
Jan  1 00:00:04 (none) kernel: 0x00ff0000-0x00ff8000 : "serialnum"
Jan  1 00:00:04 (none) kernel: mtd: partition "serialnum" doesn't start on an erase block boundary -- force read-only
Jan  1 00:00:04 (none) kernel: 0x00ff8000-0x01000000 : "macaddress"
Jan  1 00:00:04 (none) kernel: ess" doesn't start on an erase block boundary -- force read-only
Jan  1 00:00:04 (none) kernel: mice: PS/2 mouse device common for all mice
Jan  1 00:00:04 (none) kernel: Run Mode clock: 208.00MHz (*16)
Jan  1 00:00:04 (none) kernel: Turbo Mode clock: 520.00MHz (*2.5, active)
Jan  1 00:00:04 (none) kernel: Memory clock: 208.00MHz (/2)
Jan  1 00:00:04 (none) kernel: System bus clock: 208.00MHz 
Jan  1 00:00:04 (none) kernel: pxamci_probe: irq = 23
Jan  1 00:00:04 (none) kernel: karo_read_board_type: type_found MDI
Jan  1 00:00:04 (none) kernel: TCP cubic registered
Jan  1 00:00:04 (none) kernel: NET: Registered protocol family 1
Jan  1 00:00:04 (none) kernel: NET: Registered protocol family 17
Jan  1 00:00:04 (none) kernel: XScale iWMMXt coprocessor detected.
Jan  1 00:00:04 (none) kernel: karo_freq_to_voltage: Freq: 520.000(416.000..520.000)MHz, core voltage 1.450
Jan  1 00:00:04 (none) kernel: karo_pm_init: Registering core power change notifier
Jan  1 00:00:04 (none) kernel: karo_pm_init: skipping initial set_core(1450)
Jan  1 00:00:04 (none) kernel: RAMDISK: Compressed image found at block 0
Jan  1 00:00:04 (none) kernel: VFS: Mounted root (ext2 filesystem).
Jan  1 00:00:04 (none) kernel: Freeing init memory: 100K
Jan  1 00:00:04 (none) kernel: mmc0: new SD card at address c9fb
Jan  1 00:00:04 (none) kernel: mmcblk0: mmc0:c9fb SD02G 1966080KiB 
Jan  1 00:00:04 (none) kernel:  mmcblk0: p1 p2
Jan  1 00:00:04 (none) kernel: kjournald starting.  Commit interval 5 seconds
Jan  1 00:00:04 (none) kernel: EXT3 FS on mmcblk0p1, internal journal
Jan  1 00:00:04 (none) kernel: EXT3-fs: recovery complete.
Jan  1 00:00:04 (none) kernel: EXT3-fs: mounted filesystem with ordered data mode.
Jan  1 00:00:05 (none) exiting on signal 15
Jan  1 00:00:05 (none) syslogd 1.5.0: restart.
Jan  1 00:00:05 (none) kernel: pxa27x_udc: version 01-01-2006
Jan  1 00:00:05 (none) kernel: ether gadget: using random self ethernet address
Jan  1 00:00:05 (none) kernel: ether gadget: using random host ethernet address
Jan  1 00:00:05 (none) kernel: usb0: Ethernet Gadget, version: May Day 2005
Jan  1 00:00:05 (none) kernel: usb0: using pxa27x_udc, OUT ep2out-bulk IN ep1in-bulk STATUS ep3in-intr
Jan  1 00:00:05 (none) kernel: usb0: MAC 2e:8d:70:9b:95:af
Jan  1 00:00:05 (none) kernel: usb0: HOST MAC 42:3b:92:63:d8:41
Jan  1 00:00:05 (none) kernel: usb0: RNDIS ready
Jan  1 00:00:05 (none) kernel: udc: USB reset
Jan  1 00:00:05 (none) kernel: udc: USB reset
Jan  1 00:00:05 (none) kernel: usb0: full speed config #2: 100 mA, Ethernet Gadget, using RNDIS
Jan  1 00:00:05 (none) post: POST version: 2.6 
Jan  1 00:00:05 (none) post: GM MDI 
Jan  1 00:00:05 (none) post: Hardware Configuration ID = 0x207  
Jan  1 00:00:05 (none) post: VIO Board Rev = 7, CPU Board Rev = 2  
Jan  1 00:00:05 (none) post: New DIMM, 128Mb, SMSC9116 
Jan  1 00:00:05 (none) post: MDIManagerInfo FPGA:   2012/09/20, Version: 1.0.1.0 
Jan  1 00:00:05 (none) post: MDIManagerInfo CAN:   2012/04/13 
Jan  1 00:00:05 (none) post: MDIManagerInfo J1850: 2012/02/08 
Jan  1 00:00:05 (none) post: MDIManagerInfo UART:  2012/04/20 
Jan  1 00:00:07 (none) kernel: FPGA probe date 0x09202012 version 0x0fffffff
Jan  1 00:00:07 (none) kernel: etas_mux: module license 'Proprietary' taints kernel.
Jan  1 00:00:07 (none) kernel: ETAS MUX driver init
Jan  1 00:00:07 (none) kernel: mux_module_init() etas_fpga_device_register=>0
Jan  1 00:00:07 (none) kernel: MDIManagerInfo Date= 0x2b0c0400 Version= 0x2020100 Desc= Comm Port Resource Multiplexor Driver
Jan  1 00:00:07 (none) kernel:   Board ID: 0x207, Exp Board ID: 0xff
Jan  1 00:00:07 (none) kernel: mux driver registered properly
Jan  1 00:00:07 (none) kernel: udc: USB reset
Jan  1 00:00:07 (none) kernel: udc: USB reset
Jan  1 00:00:07 (none) kernel: ETAS TIMER driver init
Jan  1 00:00:07 (none) kernel: MDIManagerInfo Date= 0x2b030600 Version= 0x30300 Desc= Timer Driver
Jan  1 00:00:07 (none) kernel: TIMER Driver: Major == 195, Minor == 0
Jan  1 00:00:07 (none) kernel: Vetronix TIMER Driver v0.3.3: Initialization Successful
Jan  1 00:00:07 (none) kernel: MDIManagerInfo Date= 0x2a082400 Version= 0x40000 Desc= LED Driver
Jan  1 00:00:07 (none) kernel: ETAS LED Driver:led_driver_probe
Jan  1 00:00:07 (none) kernel: Major#==198 Minor#==0
Jan  1 00:00:07 (none) kernel: ETAS LED Driver v0.4.0 LOADED
Jan  1 00:00:07 (none) kernel: led driver registered properly
Jan  1 00:00:07 (none) kernel: MDIManagerInfo Date= 0x2a030e00 Version= 0x30300 Desc= Speaker Driver
Jan  1 00:00:07 (none) kernel: ETAS SPEAKER Driver:speaker_driver_probe
Jan  1 00:00:07 (none) kernel: Major#==199 Minor#==0
Jan  1 00:00:07 (none) kernel: ETAS SPEAKER Driver v0.3.1 LOADED
Jan  1 00:00:07 (none) kernel: speaker driver registered properly
Jan  1 00:00:08 (none) kernel: udc: USB reset
Jan  1 00:00:08 (none) last message repeated 3 times
Jan  1 00:00:08 (none) kernel: usb0: full speed config #2: 100 mA, Ethernet Gadget, using RNDIS
Jan  1 00:00:08 (none) kernel: kjournald starting.  Commit interval 5 seconds
Jan  1 00:00:08 (none) kernel: EXT3 FS on mmcblk0p2, internal journal
Jan  1 00:00:08 (none) kernel: EXT3-fs: recovery complete.
Jan  1 00:00:08 (none) kernel: EXT3-fs: mounted filesystem with ordered data mode.
Jan  1 00:00:10 (none) kernel: eth0: SMSC911x/921x identified at 0xc8860000, IRQ: 116
Jan  1 00:00:10 (none) kernel: eth0: link down
Jan  1 00:00:11 (none) kernel: ETAS Status Driver version v7.0.0 - date 08/20/2008
Jan  1 00:00:11 (none) kernel: MDIManagerInfo Date= 0x2b060e00 Version= 0x1000600 Desc= J1850 Controller Driver
Jan  1 00:00:11 (none) kernel: J1850 Controller Driver: Major == 196, Minor == 0
Jan  1 00:00:11 (none) kernel: insert_resource fpga-j1850: start: 0x10000400, end: 0x1000041f
Jan  1 00:00:11 (none) kernel: insert_resource fpga-j1850: start: 0xa1, end: 0xa1
Jan  1 00:00:11 (none) kernel: Vetronix J1850 Controller Driver v1.0.6: Initialization Successful
Jan  1 00:00:11 (none) kernel: sja: banner_(78)
Jan  1 00:00:11 (none) kernel: sja: banner_(80)
Jan  1 00:00:11 (none) kernel: sja: +on_init(): vers: fpga:[9/20/2012 0x0ffff #fff]
Jan  1 00:00:11 (none) kernel: MDIManagerInfo Date= 0x2b091e00 Version= 0x80400 Desc= SJA CAN Driver
Jan  1 00:00:11 (none) kernel: .info@c7ca3eb4 .std.id@c7ca3eb5 .std.data@c7ca3eb7
Jan  1 00:00:11 (none) kernel: # CAN controllers = 3
Jan  1 00:00:11 (none) kernel: insert_resource sja1000.0: start: 0x10000100, end: 0x100001ff
Jan  1 00:00:11 (none) kernel: insert_resource sja1000.0: start: 0x9d, end: 0x9d
Jan  1 00:00:11 (none) kernel: insert_resource sja1000.1: start: 0x10000200, end: 0x100002ff
Jan  1 00:00:11 (none) kernel: insert_resource sja1000.1: start: 0x9e, end: 0x9e
Jan  1 00:00:11 (none) kernel: insert_resource sja1000.2: start: 0x10000300, end: 0x100003ff
Jan  1 00:00:11 (none) kernel: insert_resource sja1000.2: start: 0x9f, end: 0x9f
Jan  1 00:00:11 (none) kernel: DAC Driver: Major == 193, Minor == 0
Jan  1 00:00:11 (none) kernel: MDIManagerInfo Date= 0x2a090400 Version= 0x30100 Desc= Analog to Digital Converter Driver
Jan  1 00:00:11 (none) kernel: Vetronix DAC Driver v0.3.1 Date: 9/04/2012: Initialization Successful
Jan  1 00:00:12 (none) kernel: UART Protocol driver init
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= UART Protocol Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KW71 UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW71 UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2a011200 Version= 0x40300 Desc= UART Protocol Driver J2740 Line Discipline
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0e00 Version= 0x40500 Desc= UART Protocol Driver J1708 Line Discipline
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x26091d00 Version= 0x1000 Desc= UART Protocol Driver SUBARU Start-Stop Line Discipline
Jan  1 00:00:12 (none) kernel: UBP UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x29041500 Version= 0x40400 Desc= UBP UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: SCI UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x29030e00 Version= 0x40000 Desc= SCI UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: UART logger line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x29030e00 Version= 0x40000 Desc= UART LOGGER LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KW71 UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW71 UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KW71 UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW71 UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KWU UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: KW71 UART line discipline version
Jan  1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW71 UART LINE DISCIPLINE Driver
Jan  1 00:00:12 (none) kernel: Version Info Date= 0x29080100 Version= 0x40000 Desc= UART Protocol Driver FPGA Interface
Jan  1 00:00:12 (none) kernel: insert_resource fpga-uart.0: start: 0x10000080, end: 0x100000bf
Jan  1 00:00:12 (none) kernel: insert_resource fpga-uart.0: start: 0x49, end: 0x49
Jan  1 00:00:12 (none) kernel: insert_resource fpga-uart.1: start: 0x100000c0, end: 0x100000ff
Jan  1 00:00:12 (none) kernel: insert_resource fpga-uart.1: start: 0xaa, end: 0xaa
Jan  1 00:00:12 (none) kernel: ETAS FPGA UART Driver version 0.4.0: Initialization successful.
Jan  1 00:00:12 (none) kernel: Vetronix FPGA Input Capture Driver v0.0.2.2: Initialization Successful
Jan  1 00:00:12 (none) kernel: eth0: link up, 100Mbps, full-duplex, lpa 0x85E1
Jan  1 00:00:16 (none) linuxrc: Starting pid 997, console /dev/ttyS0: '/sbin/getty'
Overall its a good and fast little linux system. I experimented around with it and compared to many firmwares ive played with this one was quite nice. :thumbup:

So, lets go deeper. Its got U-Boot, and I want in. I managed to trace the data across the board, and find it on the mini din 8 connector on the outside of the case labeled "RS232 (for future use)". I guess this means they can reflash it from factory without opening the case. I tested with the scope and found tx and rx pins. You can make up a connector from your pc connecting to these pins:
serial connector external.png
serial connector external.png (245.2 KiB) Viewed 35026 times
Once done, set your terminal app to 38400,8,n,1 and click reset.

Code: Select all

U-Boot 1.1.4 (Dec 21 2007 - 12:11:55) ETAS VCI (r13006)

U-Boot code: A3F00000 -> A3F218F0  BSS: -> A3F27524
RAM Configuration: TRITON 270 II
Bank #0: a0000000 64 MB
Bank #1: a4000000 64 MB
HW Configuration: (0x207) MDI VCI with SMSC9116
Found P30 Flash, unlocking all blocks: 130
Flash: 16 MB

In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0
$
$
$ help
?       - alias for 'help'
askenv  - get environment variables from stdin
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
flinfo  - print FLASH memory information
flock  - physical lock of Strataflash
funlock  - physical unlock of Strataflash
go      - start application at address 'addr'
help    - print online help
iminfo  - print header information for application image
imls    - list all images found in flash
increnv  - increment environment variables
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
macaddr  - display or store MAC address in Strataflash
mapadd - add a memory map item
mapdel - delete a memory map item
mapinfo - display the memory map information
md      - memory display
mm      - memory modify (auto-incrementing)
mmcinfo - get info on mmc(sd) card
mtest   - simple RAM test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
pinit   - PCMCIA sub-system
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
version - print monitor version

$ bdinfo
arch_number = 0x000000BE
env_t       = 0x00000000
boot_params = 0xA0001000
DRAM bank   = 0x00000000
-> start    = 0xA0000000
-> size     = 0x04000000
DRAM bank   = 0x00000001
-> start    = 0xA4000000
-> size     = 0x04000000
ethaddr     = 00:90:7E:0D:14:13
ip_addr     = 10.103.98.238
baudrate    = 38400 bps

$ flinfo
Bank # 1: CFI conformant FLASH (16 x 16)  Size: 16 MB in 131 Sectors
 Erase timeout 4096 ms, write timeout 0 ms, buffer write timeout 1024 ms, buffer size 64
  Sector Start Addresses:
    00000000 (RO) 00008000 (RO) 00010000 (RO) 00018000 (RO) 00020000 (RO)
    00040000 (RO) 00060000      00080000      000A0000      000C0000
    000E0000      00100000      00120000      00140000      00160000
    00180000      001A0000      001C0000      001E0000      00200000
    00220000      00240000      00260000      00280000      002A0000
    002C0000      002E0000      00300000      00320000      00340000
    00360000      00380000      003A0000      003C0000      003E0000
    00400000      00420000      00440000      00460000      00480000
    004A0000      004C0000      004E0000      00500000      00520000
    00540000      00560000      00580000      005A0000      005C0000
    005E0000      00600000      00620000      00640000      00660000
    00680000      006A0000      006C0000      006E0000      00700000
    00720000      00740000      00760000      00780000      007A0000
    007C0000      007E0000      00800000      00820000      00840000
    00860000      00880000      008A0000      008C0000      008E0000
    00900000      00920000      00940000      00960000      00980000
    009A0000      009C0000      009E0000      00A00000      00A20000
    00A40000      00A60000      00A80000      00AA0000      00AC0000
    00AE0000      00B00000      00B20000      00B40000      00B60000
    00B80000      00BA0000      00BC0000      00BE0000      00C00000
    00C20000      00C40000      00C60000      00C80000      00CA0000
    00CC0000      00CE0000      00D00000      00D20000      00D40000
    00D60000      00D80000      00DA0000      00DC0000      00DE0000
    00E00000      00E20000      00E40000      00E60000      00E80000
    00EA0000      00EC0000      00EE0000      00F00000      00F20000
    00F40000      00F60000      00F80000      00FA0000      00FC0000
    00FE0000
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: GM MDI Info

Post by antus »

And the data sheet for the so-dimm socket computer module.
Attachments
T270-Datasheet.pdf
(370.27 KiB) Downloaded 709 times
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
VX L67 Getrag
Posts: 2877
Joined: Sun Aug 02, 2009 9:16 pm
Location: Bayside, Melbourne, Victoria
Contact:

Re: GM MDI Info

Post by VX L67 Getrag »

WOW that looks very interesting, it's all over my head but sounds like it could be very useful to get 1 of these now!

Nice work Antus!
ejukated
Posts: 443
Joined: Wed Mar 04, 2009 8:52 pm

Re: GM MDI Info

Post by ejukated »

now THATS cool!
User avatar
Holden202T
Posts: 10311
Joined: Sat Feb 28, 2009 9:05 pm
Location: Tenambit, NSW
Contact:

Re: GM MDI Info

Post by Holden202T »

yeah plenty of useful info there for those with the skills :)
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: GM MDI Info

Post by antus »

Although if you have the skills, the only bits you would want to know before you jumped in are that its linux, and that you can get in to the os via filesystem mods on the sdcard, or in to the bootloader via a cable to those specs. The rest is for you guys to use as a learning guide :) New time you get curious about what makes it work, google a topic from above you dont understand and dive in. I think it also it conveys the complexity of these systems. If your thinking of saying "can you just....." it helps to convey the work required. I can guarantee lots of people around the world will make up that cable, hopefully some of them are kind enough to share their projects and additions back here.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
kojab
Posts: 440
Joined: Sun Mar 22, 2009 11:52 am
cars: VT V6 supercharged in a corolla
Location: Sydney
Contact:

Re: GM MDI Info

Post by kojab »

Very impressive Antus
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM MDI Info

Post by Tazzi »

antus wrote: Note that this is just fun and games and this post is for the hackers out there (both of these definitions of hacker...) http://en.wikipedia.org/wiki/Hacker_%28 ... culture%29 http://en.wikipedia.org/wiki/Hacker_%28hobbyist%29 :lol:
Ant, you are the definition of hacker :thumbup:

Dont think I know anyone else with the balls to tinker with their newly purchased unit!
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
User avatar
festy
Posts: 1039
Joined: Sat Apr 30, 2011 6:27 pm
cars: Alfa Romeos
Location: Narellan, NSW

Re: GM MDI Info

Post by festy »

Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW71 UART LINE DISCIPLINE Driver
KWP71? You've got my attention... :mrgreen:
Looks like the protocol drivers are implemented on a fpga rather than software?
Is the USB bus conveniently exposed anywhere? Seems a waste to only use it for ethernet :twisted:
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: GM MDI Info

Post by Tazzi »

festy wrote:
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW71 UART LINE DISCIPLINE Driver
KWP71? You've got my attention... :mrgreen:
Looks like the protocol drivers are implemented on a fpga rather than software?
Is the USB bus conveniently exposed anywhere? Seems a waste to only use it for ethernet :twisted:
Sure is. :thumbup:
Image
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
Post Reply