포고플러그 공통: 시리얼 케이블을 이용한 ssh 활성화

2016년 언젠가부터 펌웨어 업데이트가 되지 않은 포고플러그는 홈페이지 또는 백도어를 통한 SSH 활성화가 안된다. 구 펌웨어의 SSL 버전이 너무 낮아서 포고플러그와 홈페이지 간 https 연결이 안되어서 그렇다고 한다. 그런데 한편 펌웨어를 업데이트 하려면 SSH가 필요한 애석한 상황이라고..

1. USB to TTL 컨버터

이럴때 사용하는 것이 시리얼 케이블인데, 포고플러그의 배를 가르고 시리얼통신 케이블을 연결해서 직접 터미널 접속을 한다. 이 때 필요한 것이 USB to TTL 변환기인데 이렇게 생겼다.

열관리가 안되서 그런지 포고플러그 쓰다 보면 어느날 갑자기 부팅이 안되는 경우가 있는데, 이럴 때 아주 요긴하니 하나쯤 있으면 좋다.

CH340G 칩을 사용한 제품과 PL-2303HX 칩을 사용한 제품(아마도 둘 다 짝퉁칩)을 하나씩 가지고 있는데, 무슨 차이인지는 모르겠지만 CH340G의 경우 포고플러그 V4에는 잘 사용했으나, 프로(V3)에서는 송신(컴퓨터→포고)이 안되더라. 인터넷을 열~심히 뒤져보니 나와 상황이 똑같은 사람이 있긴하더라.

한편 PL-2303HX 짝퉁은 포고플러그 프로와 연결 시에도 정상 작동했으나, 윈도우10에서 드라이버가 제대로 동작하지 않았다. 뭐 쿨하게 리눅스가 깔려있는 다른 컴퓨터에서 사용했기 때문에 윈도우용 드라이버를 찾아보지는 않았다.

아래는 내가 구입한 두 제품의 링크
- CH340G: 알리익스프레스, 1달러, 무료배송, 한달 걸림
- PL-2303HX: 11번가, 1800원, 2500원, 다음날 도착

2. 케이블 연결 방법

- 포고플러그 E02, V3, PRO: 케이블 연결방법, 분해방법
  내부에 핀헤더가 있어서 땜질없이 연결할 수 있다. CD롬 아날로그 케이블이 있으면 더욱 쉽다.

- 포고플러그 V4, Mobile: 분해 및 케이블 연결
  안타깝게도 V4와 Mobile은 납땜을 해야한다. 핀헤더를 아예 붙일 경우 2mm 4pin 헤더가 필요하다.

모든 모델이 공통적으로 3.3V를 사용하나, RX, TX, Ground 세 선만 연결하면 되고 전원선은 연결할 필요가 없다. 그리고 포고플러그와 USB 컨버터 간 RX, TX는 서로 반대로 연결되어야 한다. 즉, 포고의 TX는 USB 컨버터의 RX로, USB 컨버터의 TX는 포고의 RX로 연결한다. 한 놈이 보낸 건 다른 놈이 받아줘야하니, 입장 바꿔 생각하면 어렵지 않다. ^^

3. 접속하기

- 윈도우: putty를 사용하면 되고, 아래 그림 한 장이 모든 것을 설명해준다.

- 리눅스: picocom -b 115200 /dev/ttyUSB0

putty나 picocom으로 통신 열어둔 후 포고플러그 전원을 연결하면 부팅 메시지를 볼 수 있다. 부팅이 완료된 후 엔터 한번 쳐 주면 root 유저의 터미널로 진입할 수 있다.

아래는 시리얼 통신으로 연결해서 확인한 순정 포고플러그 프로의 부트로그

# picocom -b 115200 /dev/ttyUSB0
picocom v1.7

port is        : /dev/ttyUSB0
flowcontrol    : none
baudrate is    : 115200
parity is      : none
databits are   : 8
escape is      : C-a
local echo is  : no
noinit is      : no
noreset is     : no
nolock is      : no
send_cmd is    : sz -vv
receive_cmd is : rz -vv
imap is        :
omap is        :
emap is        : crcrlf,delbs,

Terminal ready
Stage-1 Bootloader Thu Jul 29 19:36:02 PDT 2010
Attempting to set PLLA to 700MHz ...
  plla_ctrl0 : 0x0000000A
  plla_ctrl1 : 0x000E0000
  plla_ctrl2 : 0x001C01A0
  plla_ctrl3 : 0x00000016
PLLA Set

Setup memory, testing
Reading NAND, Image 0
  Hdr len: 0x0001C030
  Hdr CRC: 0x39F6D832
 OK


U-Boot 1.1.2 (Jul 29 2010 - 19:36:07)

U-Boot code: 60D00000 -> 60D1C030  BSS: -> 60D21800
RAM Configuration:
        Bank #0: 60000000 128 MB
SRAM Configuration:
        64KB at 0x50000000
NAND:128 MiB
In:    serial
Out:   serial
Err:   serial
Setting Linux mem= boot arg value
Hit any key to stop autoboot:  0

Loading from device 0: 128MiB 3,3V 8-bit (offset 0x200000)
   -- Using 1bit ECC style encoding
   Image Name:   Linux-2.6.31.6_SMP_820
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2259760 Bytes =  2.2 MB
   Load Address: 60008000
   Entry Point:  60008000
## Booting image at 60500000 ...
   Image Name:   Linux-2.6.31.6_SMP_820
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2259760 Bytes =  2.2 MB
   Load Address: 60008000
   Entry Point:  60008000
   Verifying Checksum ... OK
OK

Starting kernel ...

Uncompressing Linux.................................................................................... done, booting the kernel.
[    0.000000] Linux version 2.6.31.6_SMP_820 (bdietrich@brad-ux) (gcc version 4.4.1 (Sourcery G++ Lite 2009q3-67) ) #16 SMP Mon Aug 23 17:41:28 PDT 2010
[    0.000000] CPU: ARMv6-compatible processor [410fb025] revision 5 (ARMv7), cr=00c5387f
[    0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[    0.000000] Machine: Oxsemi NAS
[    0.000000] 1 memory region
[    0.000000] Ignoring unrecognised tag 0x00000000
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: root=ubi0:rootfs ubi.mtd=2,512 rootfstype=ubifs console=ttyS0,115200 elevator=cfq mac_adr=0x00,0x30,0xe0,0x00,0x00,0x01 mem=128M poweroutage=yes
[    0.000000] PID hash table entries: 512 (order: 9, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 128MB = 128MB total
[    0.000000] Memory: 125496KB available (3720K code, 274K data, 124K init, 0K highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:96
[    0.000000] OX820_RPS_init_irq: interrupts 64 to 96
[    0.010000] Console: colour dummy device 80x30
[    0.010000] console [ttyS0] enabled
[    0.020000] Calibrating delay loop... 279.34 BogoMIPS (lpj=1396736)
[    0.260000] Security Framework initialized
[    0.260000] Mount-cache hash table entries: 512
[    0.270000] CPU: Testing write buffer coherency: ok
[    0.270000] Calibrating local timer... 349.99MHz.
[    0.340000] CPU1: Booted secondary processor
[    0.440000] Calibrating delay loop... 279.34 BogoMIPS (lpj=1396736)
[    0.670000] Brought up 2 CPUs
[    0.680000] SMP: Total of 2 processors activated (558.69 BogoMIPS).
[    0.690000] NET: Registered protocol family 16
[    0.690000] Number of DMA channels = 4, version = 4
[    0.700000] Reserving a DMA channel for DirectRAID
[    0.700000] Allocating 389 SRAM generic DMA descriptors
[    1.210000] PCIeA version/deviceID 082510b5
[    1.210000] PCIeB version/deviceID 082510b5
[    4.240000] ox820_pci_preinit() PCIEB link up timeout (00001814)
[    4.240000] ox820_pcie_setup_resources() Enabling PCIe Pre-Emphasis
[    4.250000] ox820_pciea_setup_resources() resource c781b2c0
[    4.250000] ox820_pciea_setup_resources()    io:      0x4a800000 - 0x4affffff
[    4.260000] ox820_pciea_setup_resources()    non-pre: 0x48000000 - 0x497fffff
[    4.270000] ox820_pciea_setup_resources()    pre:     0x49800000 - 0x4a7fffff
[    4.270000] PCI: bus0: Fast back to back transfers disabled
[    4.280000] PCI: bus1: Fast back to back transfers enabled
[    4.300000] bio: create slab <bio-0> at 0
[    4.300000] SCSI subsystem initialized
[    4.330000] NET: Registered protocol family 2
[    4.330000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    4.340000] Switched to NOHz mode on CPU #0
[    4.340000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    4.340000] Switched to NOHz mode on CPU #1
[    4.350000] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[    4.360000] TCP: Hash tables configured (established 4096 bind 4096)
[    4.360000] TCP reno registered
[    4.370000] NET: Registered protocol family 1
[    4.370000] Create fragment cache
[    4.380000] fuse init (API version 7.12)
[    4.380000] msgmni has been set to 245
[    4.390000] alg: No test for stdrng (krng)
[    4.390000] io scheduler noop registered
[    4.400000] io scheduler anticipatory registered
[    4.400000] io scheduler deadline registered
[    4.410000] io scheduler cfq registered (default)
[    4.430000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    4.440000] serial8250: ttyS0 at MMIO 0x44200000 (irq = 55) is a 16550A
[    4.460000] brd: module loaded
[    4.460000] loop: module loaded
[    4.470000] ox820sata: OX820 sata core.
[    4.470000] scsi0 : oxnassata
[    4.480000] scsi1 : oxnassata
[    4.480000] ata1: SATA max UDMA/133 irq 50
[    4.480000] ata2: SATA max UDMA/133 irq 50
[    4.490000] ox820sata: reseting SATA core
[    4.850000] ata1: SATA link down (SStatus 0 SControl 300)
[    4.850000] ox820sata: reseting SATA core
[    5.210000] ata2: SATA link down (SStatus 0 SControl 300)
[    5.210000] tun: Universal TUN/TAP device driver, 1.6
[    5.220000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    5.220000] NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix NAND 128MiB 3,3V 8-bit)
[    5.230000] Scanning device for bad blocks
[    5.240000] Bad eraseblock 97 at 0x000000c20000
[    5.310000] Creating 2 MTD partitions on "NAND 128MiB 3,3V 8-bit":
[    5.320000] 0x000000000000-0x000000e00000 : "boot"
[    5.320000] 0x000000e00000-0x000008000000 : "rootfs"
[    5.330000] UBI: attaching mtd2 to ubi0
[    5.330000] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    5.340000] UBI: logical eraseblock size:    129024 bytes
[    5.350000] UBI: smallest flash I/O unit:    2048
[    5.350000] UBI: sub-page size:              512
[    5.360000] UBI: VID header offset:          512 (aligned 512)
[    5.360000] UBI: data offset:                2048
[    5.770000] UBI: attached mtd2 to ubi0
[    5.780000] UBI: MTD device name:            "rootfs"
[    5.780000] UBI: MTD device size:            114 MiB
[    5.790000] UBI: number of good PEBs:        912
[    5.790000] UBI: number of bad PEBs:         0
[    5.790000] UBI: max. allowed volumes:       128
[    5.800000] UBI: wear-leveling threshold:    4096
[    5.800000] UBI: number of internal volumes: 1
[    5.810000] UBI: number of user volumes:     1
[    5.810000] UBI: available PEBs:             0
[    5.820000] UBI: total number of reserved PEBs: 912
[    5.820000] UBI: number of PEBs reserved for bad PEB handling: 9
[    5.830000] UBI: max/mean erase counter: 2/0
[    5.830000] UBI: image sequence number: 0
[    5.840000] UBI: background thread "ubi_bgt0d" started, PID 278
[    5.840000] mice: PS/2 mouse device common for all mice
[    5.850000] TCP cubic registered
[    5.850000] NET: Registered protocol family 10
[    5.860000] NET: Registered protocol family 17
[    5.860000] RPC: Registered udp transport module.
[    5.870000] RPC: Registered tcp transport module.
[    5.990000] UBIFS: recovery needed
[    6.170000] UBIFS: recovery completed
[    6.170000] UBIFS: mounted UBI device 0, volume 0, name "rootfs"
[    6.180000] UBIFS: file system size:   114573312 bytes (111888 KiB, 109 MiB, 888 LEBs)
[    6.190000] UBIFS: journal size:       9033728 bytes (8822 KiB, 8 MiB, 71 LEBs)
[    6.190000] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    6.200000] UBIFS: default compressor: zlib
[    6.200000] UBIFS: reserved for root:  0 bytes (0 KiB)
[    6.210000] VFS: Mounted root (ubifs filesystem) on device 0:10.
[    6.210000] Freeing init memory: 124K
/dev/mem opened.
Memory mapped at address 0x40024000.
Value at address 0x44A00000 (0x40024000): 0x0
Written 0x14; readback 0x0
/dev/mem opened.
Memory mapped at address 0x40024000.
Value at address 0x44A00004 (0x40024004): 0x0
Written 0x4CE10; readback 0x0
/dev/mem opened.
Memory mapped at address 0x40024000.
Value at address 0x44A00004 (0x40024004): 0x0
Written 0x2CE10; readback 0x0
/dev/mem opened.
Memory mapped at address 0x40024000.
Value at address 0x44A00000 (0x40024000): 0x0
Written 0x2004; readback 0x100000
/dev/mem opened.
Memory mapped at address 0x40024000.
Value at address 0x44A00004 (0x40024004): 0x0
Written 0x482C7; readback 0x0
/dev/mem opened.
Memory mapped at address 0x40024000.
Value at address 0x44A00004 (0x40024004): 0x0
Written 0x282C7; readback 0x0
[    7.130000] gmac_phy_init() invoked
[    7.130000] Probing for Synopsis GMAC, unit 0
[    7.130000] eth0: Tuning GMAC 0 RGMII timings
[    7.140000] eth0: PHY is Realtek RTL8211D, type 0x001cc914
[    7.150000] eth0: GMAC ver = 53, vendor ver = 18 at 0xe1400000, IRQ 40
[    7.150000] eth0: Found PHY at address 3, type 0x001cc914 -> 10/100/1000
[    7.160000] eth0: Ethernet addr: 00:30:e0:00:00:00
[    7.670000] PCI: enabling device 0000:00:00.0 (0140 -> 0142)
[    7.680000]
[    7.680000]
[    7.680000] === pAd = e0aee000, size = 516032 ===
[    7.680000]
[    7.690000] <-- RTMPAllocAdapterBlock, Status=0
[    7.690000] pAd->CSRBaseAddress =0xe9000000, csr_addr=0xe9000000!
[    7.780000] eth0: PHY is Realtek RTL8211D, type 0x001cc914
[    7.780000] Offload is not active on eth0
[    7.780000] Alloc'ing ARM descs 10240 bytes
[    7.790000] eth0: Resetting GMAC
[    7.790000] eth0: GMAC reset complete
[    7.800000] eth0: Setting Rx flow control thresholds for LAN port
udhcpc (v1.16.1) started
HWADDR 00 0x25 0x31 0x00 0x?? 0x??
PIP0 241
PIP1 135
cat: can't open '/etc/resolv.conf': No such file or directory
route: SIOCDELRT: No such process
grep: /etc/resolv.conf: No such file or directory
Sending discover...
[    8.350000] eth0: PHY is Realtek RTL8211D, type 0x001cc914
[    8.850000] eth0: link down
Sending discover...
Sending discover...
HWADDR 00 0x25 0x31 0x00 0x?? 0x??
PIP0 241
PIP1 135
No lease, forking to background
[   17.660000] RX DESC ffc13000  size = 2048
[   17.670000] <-- RTMPAllocTxRxRingMemory, Status=0
[   17.680000] Key1Str is Invalid key length(0) or Type(0)
[   17.690000] Key2Str is Invalid key length(0) or Type(0)
[   17.690000] Key3Str is Invalid key length(0) or Type(0)
[   17.700000] Key4Str is Invalid key length(0) or Type(0)
[   17.700000] 1. Phy Mode = 9
[   17.710000] 2. Phy Mode = 9
[   17.710000] NVM is Efuse and its size =2d[2d0-2fc]
[   17.720000] RTMPSetPhyMode: channel is out of range, use first channel=1
[   17.720000] 3. Phy Mode = 9
[   18.140000] RTMPFilterCalibration - can't find a valid value, loopcnt=102 stop calibrating
[   18.180000] MCS Set = ff 00 00 00 01
[   18.190000] <==== rt28xx_init, Status=0
[   18.190000] 0x1300 = 00064300
[   18.190000]  AUX_CTRL = 0x                            4c02
[   18.200000]  Read AUX_CTRL = 0x4c02
[   18.200000]  Write AUX_CTRL = 0x5c02
[   18.210000]  OSC_CTRL = 0x3ff11
[   18.210000] ====> rt30xx Read PowerLevelMode =  0x3.
[   18.210000] ====> rt30xx F Write 0x83 Command = 0x3.
[   18.400000] usbcore: registered new interface driver usbfs
[   18.410000] usbcore: registered new interface driver hub
[   18.420000] usbcore: registered new device driver usb
[   18.470000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[   18.480000] oxnas-ehci oxnas-ehci.0: OXNAS EHCI Host Controller
[   18.490000] oxnas-ehci oxnas-ehci.0: new USB bus registered, assigned bus number 1
[   18.520000] oxnas-ehci oxnas-ehci.0: irq 39, io mem 0x00000000
[   18.540000] oxnas-ehci oxnas-ehci.0: USB 0.0 started, EHCI 1.00
[   18.550000] usb usb1: configuration #1 chosen from 1 choice
[   18.550000] hub 1-0:1.0: USB hub found
[   18.560000] hub 1-0:1.0: 2 ports detected
[   18.650000] Initializing USB Mass Storage driver...
[   18.660000] usbcore: registered new interface driver usb-storage
[   18.670000] USB Mass Storage support registered.
[   18.880000] usb 1-1: new high speed USB device using oxnas-ehci and address 2
[   19.040000] usb 1-1: configuration #1 chosen from 1 choice
[   19.050000] hub 1-1:1.0: USB hub found
[   19.060000] hub 1-1:1.0: 4 ports detected
[   19.090000] ufsd: module license 'Commercial product' taints kernel.
[   19.100000] Disabling lock debugging due to kernel taint
[   19.140000] ufsd: driver 8.1 (033_A) LBD=OFF with ioctl loaded at bf17a000
[   19.140000] NTFS read/write support included
[   19.140000] Hfs+/HfsX read/write support included
Loading xce.ko:              [   19.180000] Cloud Engines XCE Init [Version: 2.4.9.6]
[   19.180000] XCE: CPU MEMORY MAP:
[   19.190000] XCE:   -- 0x00001000 - 0xbeffffff (3055 MB)  User Space Mappings
[   19.190000] XCE:   -- 0xbf000000 - 0xbfffffff (  16 MB)  Kernel module space
[   19.200000] XCE:   -- 0xc0000000 - 0xc7ffffff ( 128 MB)  Kernel direct-mapped ram
[   19.210000] XCE:   -- 0xe0800000 - 0xe0ffffff (   8 MB)  Kernel vmalloc space
[   19.210000] XCE:   -- 0xe1000000 - 0xfeffffff ( 479 MB)  Kernel platform space
[   19.220000] XCE: CPU FEATURES:
[   19.230000] XCE:   -- I Cache:         enabled
[   19.230000] XCE:   -- D Cache:         enabled
[   19.230000] XCE:   -- Branch Predict:  disabled
[   19.240000] XCE:   -- MMU:             enabled
[   19.240000] XCE:   -- Alignment Abort: disabled
[   19.250000] XCE: BLPARAMS: Locating parameter block...
[   19.250000] XCE: BLPARAMS: reading 2048 bytes @ a0000
[   19.260000] XCE: Loaded Property Size: 2048
[   19.260000] XCE:    - 'cesvcid' -> '??????????????????????????'
[   19.270000] XCE:    - 'ceboardver' -> 'PPRO1'
[   19.270000] XCE: Current GPIO State:
[   19.280000] XCE:  GPIO A input:        0xf679fff7
[   19.280000] XCE:  GPIO A OE status:    0x00000000
[   19.290000] XCE:  GPIO A IRQ enable:   0x00000000
[   19.290000] XCE:  GPIO A IRQ event:    0x00000000
[   19.300000] XCE:  GPIO A output state: 0x00000000
[   19.300000] XCE:  GPIO B input:        0x0003bfff
[   19.310000] XCE:  GPIO B OE status:    0x00030000
[   19.310000] XCE:  GPIO B IRQ enable:   0x00000000
[   19.320000] XCE:  GPIO B IRQ event:    0x00000000
[   19.320000] XCE:  GPIO B output state: 0x00030000
Success
Starting hbplug:             Success
/ # [   19.420000] XCE: BLPARAMS: Locating parameter block...
[   19.430000] XCE: BLPARAMS: reading 2048 bytes @ a0000
[   19.440000] XCE: BLPARAMS: reading 2048 bytes @ a0800
[   19.440000] XCE: BLPARAMS: reading 2048 bytes @ a1000
[   19.450000] XCE: BLPARAMS: reading 2048 bytes @ a1800
[   24.860000] XCE: XCE: LED -> DISCONNECTED
[   24.950000] rt28xx_close call RT28xxPciAsicRadioOff fail !!
[   24.970000] RX DESC ffc13000  size = 2048
[   24.970000] <-- RTMPAllocTxRxRingMemory, Status=0
[   24.980000] CfgSetCountryRegion():CountryRegion in eeprom was programmed
[   24.990000] CfgSetCountryRegion():CountryRegion in eeprom was programmed
[   25.000000] Key1Str is Invalid key length(0) or Type(0)
[   25.000000] Key2Str is Invalid key length(0) or Type(0)
[   25.010000] Key3Str is Invalid key length(0) or Type(0)
[   25.010000] Key4Str is Invalid key length(0) or Type(0)
[   25.020000] 1. Phy Mode = 9
[   25.020000] 2. Phy Mode = 9
[   25.020000] NVM is Efuse and its size =2d[2d0-2fc]
[   25.030000] RTMPSetPhyMode: channel is out of range, use first channel=1
[   25.040000] 3. Phy Mode = 9
[   25.100000] MCS Set = ff 00 00 00 01
[   25.110000] <==== rt28xx_init, Status=0
[   25.110000] 0x1300 = 00064300
[   25.120000]  AUX_CTRL = 0x                            5d42
[   25.120000]  Read AUX_CTRL = 0x5d42
[   25.130000]  Write AUX_CTRL = 0x5d42
[   25.130000]  OSC_CTRL = 0x3ff11
[   25.130000] ====> rt30xx Read PowerLevelMode =  0x3.
[   25.140000] ====> rt30xx F Write 0x83 Command = 0x3.

/ # whoami
root

4. SSH 살리기

순정 OS는 sshd로 dropbear를 사용한다. 아래 명령으로 데몬을 실행해주면 즉시 ssh 접속을 할 수 있다.

# /usr/sbin/dropbear

재부팅 후에도 계속 ssh를 열어두려면 아래와 같이 /etc/init.d/rcS 에 dropbear를 등록해준다. 원할경우 포고플러그 순정 서비스 비활성화도 이참에 같이 할 수 있으나, 중요치는 않다.

# /etc/init.d/hbmgr.sh start                           : 순정 서비스 비활성화
/usr/sbin/dropbear                                     : ssh daemon 실행

이후 ifconfig로 ip를 확인한 후 ssh 접속하여 제대로 활성화 되었는지 확인하자.