Check Point V-80をいじり倒す
まだWIP
U-Bootなんもわからん
最終目標はDebianを入れてDockerを動かす
U-Boot sysbootを使えるようにする
簡素な設定ファイルを使用してU-Bootからディストリビューションのカーネルなどを起動できる機能
本体の公式FWを起動してexpertシェルから設定を投入する。
USBメモリの/にextlinux.confがある想定だがパスを変えれば/bootとかに置いたものも認識する
run bootcmd_ow_usb; run bootcmd_ow_emmcはOpenWRT用の設定
# fw_setenv bootcmd_ow_sysboot 'usb start; sysboot usb 0:1 any ${loadaddr} /extlinux.conf;'
# fw_setenv bootcmd 'set cp_quiet; run set_bootargs_vx; run bootcmd_ow_sysboot; run bootcmd_ow_usb; run bootcmd_ow_emmc; run bootcmd_part${activePartition};'
extlinux.confのサンプル
- ここで指定するファイルはmkimageで作ったuimageではなく生イメージでOK
- kernelはgzip圧縮したもの（vmlinuz）はダメなので解凍する
label debian
kernel /boot/vmlinux-6.6.51-mvebu-cortexa72
initrd /boot/initrd.img-6.6.51-mvebu-cortexa72
fdt /boot/armada-7040-v-80.dtb
append console=ttyS0,115200 earlycon=uart8250,mmio32,0xf0512000 earlyprink root=/dev/sda2 rw rootwait mvpp2x.queue_mode=1 ethaddr=${ethaddr} eth1addr=${eth1addr} eth2addr=${eth2addr} eth3addr=${eth3addr}
Debianのカーネル
OpenWRTのカーネルを基にDebianで必要っぽい機能を有効化したもの
https://github.com/junk-labs/debian-mvebu_cortexa72/releases/tag/Releasefornow
DebianにおけるNICの認識順序
- lan1～lan5＝筐体の印字
- eth0 DSAの根本(lan1~lan5の状態に応じて自動的に構成されるので触らない)
- eth1 WANポート
ethtoolを使えば設定変更できるかも
auto lo iface lo inet loopback # WAN Port allow-hotplug eth1 iface eth1 inet dhcp # LAN PORT allow-hotplug lan1 iface lan1 inet dhcp allow-hotplug lan2 iface lan2 inet dhcp allow-hotplug lan3 iface lan3 inet dhcp allow-hotplug lan4 iface lan4 inet dhcp allow-hotplug lan5 iface lan5 inet dhcp
U-Boot fw_printenvの中身
openwrtをUSBメモリとemmcにインストールするための設定済
activeConfig=1
activePartition=1
adsl_partition_mmc_blk=0x4E1800
adsl_partition_mmc_blk_cnt=0x800
adsl_reserved_space=1
arch=arm
baudrate=115200
board=mvebu_armada-8k
board_name=mvebu_armada-8k
bootaddr=0x6000200
bootcmd=set cp_quiet; run set_bootargs_vx; run bootcmd_ow_usb; run bootcmd_ow_emmc; run bootcmd_part${activePartition};
bootcmd_legacy=run get_images; run set_bootargs; booti $kernel_addr $ramfs_addr $fdt_addr
bootcmd_ow_emmc=run set_mmc_internal; mmc read ${loadaddr} ${prim_header_mmc_blk} 4 && source ${loadaddr}
bootcmd_ow_usb=usb start; load usb 0:1 ${loadaddr} boot.scr && source ${loadaddr}
bootcmd_part1=run set_bootargs_vx; run cpboot_prim;
bootcmd_part2=run set_bootargs_vx; run cpboot_sec;
bootdelay=2
bootfile=fw1_vx_dep_R80_992001653_20.img
bootloader_version=992000129
brandingFileExtracted=0
burn_default=run set_mmc_internal ; mmc write ${kern_src_addr} ${def_kern_dest_mmc_blk} ${kern_blk_count}; mmc write ${dtb_src_addr} ${def_dtb_dest_mmc_blk} ${dtb_blk_count}; mmc write ${rootfs_src_addr} ${def_rootfs_dest_mmc_blk} ${rootfs_blk_count};
burn_primary=run set_mmc_internal ; mmc write ${loadaddr} ${prim_header_mmc_blk} 1; mmc write ${kern_src_addr} ${prim_kern_dest_mmc_blk} ${kern_blk_count}; mmc write ${dtb_src_addr} ${prim_dtb_dest_mmc_blk} ${dtb_blk_count}; mmc erase ${prim_rootfs_dest_mmc_blk} ${min_erase_blk_cnt};
change_config=run switch_config set_bootcmd_normal bootcmd
confirm_boot=run set_bootcmd_normal bootcmd
console=console=ttyS0,115200 earlycon=uart8250,mmio32,0xf0512000
cp_boot_mode=1
cp_boot_no_console_output=0
cp_quiet=quiet
cp_uboot=true
cpboot_prim=run set_mmc_internal; mmc read ${kernel_addr_r} ${prim_kern_dest_mmc_blk} ${kernel_partition_block_count}; mmc read ${fdt_addr_r} ${prim_dtb_dest_mmc_blk} ${dtb_partition_block_count}; booti ${kernel_addr_r} - ${fdt_addr_r}
cpboot_sec=run set_mmc_internal; mmc read ${kernel_addr_r} ${secondary_kern_dest_mmc_blk} ${kernel_partition_block_count}; mmc read ${fdt_addr_r} ${secondary_dtb_dest_mmc_blk} ${dtb_partition_block_count}; booti ${kernel_addr_r} - ${fdt_addr_r}
cpnumofcores=maxcpus=4
cpu=armv8
crash_kernel=crashkernel=30M
def_rootfs_blk_offset=9960
def_sw_blk_cnt=0x96000
def_sw_dest_mmc_blk=0x306000
default_sw_reserved_space=300
dmz_mac_addr=00:00:00:00:00:00
dsl2_mac_addr=00:00:00:00:00:00
dsl3_mac_addr=00:00:00:00:00:00
dsl_action=5
dsl_mac_addr=00:00:00:00:00:00
dtb_blk_count=32
dtb_partition_block_count=0x800
dtb_reserved_space=1
dtb_src_addr=f397fdb
erase_default_sw=run set_mmc_internal; mmc erase ${def_sw_dest_mmc_blk} ${min_erase_blk_cnt}
erase_primary_secondary=run primary_part_erase; run secondary_part_erase
erase_storage=run set_mmc_internal; mmc erase ${storage_partition_mmc_blk} ${min_erase_blk_cnt}
eth1addr=00:1C:7F:**:**:1F
eth2addr=00:51:82:**:**:02
eth3addr=00:51:82:**:**:03
ethact=mvpp2-1
ethaddr=00:1C:7F:9C:0F:20
ethprime=eth1
extra_params=pci=pcie_bus_safe
fdt_addr_r=0x6f00000
fdt_high=0xffffffffffffffff
fdt_name=fdt.dtb
fdtcontroladdr=7f5cdcb0
fileaddr=6000000
filesize=93ae76c
flash_erase=run erase_default_sw; run erase_storage
flash_secondary_erase=run secondary_part_erase; run erase_storage; run logs_erase
format_fs_parts=0
format_pfrm_part=0
fwtmp_dir_size=60
gatewayip=10.4.50.254
hardware_capabilities=0
hostname=marvell
hw_mac_addr=00:1C:7F:9C:0F:1F
image_header_blk_cnt=0x1
initrd_addr=0xa00000
initrd_size=0x2000000
ipaddr=192.168.1.1
kern_blk_count=9959
kern_reserved_space=48
kern_src_addr=60003a0
kernel_addr_r=0x7000000
kernel_partition_block_count=0x18000
lan1_mac_addr=00:1C:7F:9C:0F:20
lan2_mac_addr=00:1C:7F:9C:0F:20
lan3_mac_addr=00:1C:7F:9C:0F:20
lan4_mac_addr=00:1C:7F:9C:0F:20
lan5_mac_addr=00:1C:7F:9C:0F:20
loadaddr=0x6000000
logs_erase=run set_mmc_internal; mmc erase ${logs_partition_mmc_blk} ${min_erase_blk_cnt}
logs_partition_mmc_blk=0x39C000
logs_partition_mmc_blk_cnt=0x145000
logs_reserved_space=650
marketing_capabilities=0
marketing_name=1550
mgmt_opq=s/43sT9JjwQ=:vzslyrP2LOE=:Xx2Cb
mgmt_signature=V/kSoeWB06ElMO17bN7ESCGNR/32qjV1H1FxbdntF3Q8FQSDLz+zCnuCMpK6q9bkDaXR5OoHXTxxHCKvHnZxWA==
mgmt_signature_ver=1
min_erase_blk_cnt=0x400
mmc_blk_dev=1
mmc_load=ext4load mmc 1:1
mmc_start_reserved_space=10
mtc_mode_rst_cnt=0
netdev=eth1
netmask=255.255.255.0
num_of_flash_writes=166768336
preset=0
preset_cfg_reserved_space=1
prim_dtb_dest_mmc_blk=0x1D000
prim_header_mmc_blk=0x5000
prim_kern_dest_mmc_blk=0x5001
prim_rootfs_dest_mmc_blk=0x1D800
prim_rootfs_partition_size=0x168000
primary_part_erase=run set_mmc_internal; mmc erase ${prim_header_mmc_blk} ${min_erase_blk_cnt}
ramdisk_addr_r=0x8000000
ramfs_name=-
recoverFlag=0
recover_boot=run switch_active ; run set_recover_flags ; run set_bootcmd_normal bootcmd
reset_to_default_finalize=run secondary_part_erase; run erase_storage; run logs_erase
return_to_default=cp_reset_to_default
rootfs_blk_count=40366
rootfs_reserved_space=720
rootpath=/srv/nfs/
secondary_dtb_dest_mmc_blk=0x19D800
secondary_header_mmc_blk=0x185800
secondary_kern_dest_mmc_blk=0x185801
secondary_part_erase=run set_mmc_internal; mmc erase ${secondary_header_mmc_blk} ${min_erase_blk_cnt}
serial_number=WA20C01731
serverip=192.168.0.2
set_bootargs=setenv bootargs ttyS0,115200 earlycon=uart8250,mmio32,0xf0512000 earlyprink root=/dev/mmcblk1p1 rw rootwait
set_bootargs_vx=run set_console ; setenv bootargs $console $crash_kernel mvpp2x.queue_mode=1 ${cp_quiet} blkdevparts=mmcblk${mmc_blk_dev}:${kern_reserved_space}M@${mmc_start_reserved_space}M(kernel-1),${dtb_reserved_space}M(dtb-1),${rootfs_reserved_space}M(rootfs-1),${kern_reserved_space}M(kernel-2),${dtb_reserved_space}M(dtb-2),${rootfs_reserved_space}M(rootfs-2),${default_sw_reserved_space}M(default_sw),${logs_reserved_space}M(logs),${preset_cfg_reserved_space}M(preset_cfg),${adsl_reserved_space}M(adsl),-(storage) ${cpnumofcores}
set_bootcmd_normal=setenv bootcmd "run bootcmd_part$activePartition "; saveenv
set_bootcmd_recover=setenv bootcmd run recover_boot ; saveenv
set_console=setenv console console=ttyS0,${baudrate} earlycon=uart8250,mmio32,0xf0512000
set_mmc_internal=mmc dev 1
set_recover_flags=setenv recoverFlag 1 ; setenv upgradeFlag 0
soc=mvebu
stderr=serial@512000
stdin=serial@512000
stdout=serial@512000
storage_partition_mmc_blk=0x4E2000
storage_partition_mmc_blk_cnt=0x1F4000
sub_hw_ver=MRV
switch_active=run switch_active_from_$activePartition
switch_active_from_1=setenv activePartition 2 ; saveenv
switch_active_from_2=setenv activePartition 1 ; saveenv
switch_config=run switch_config_from_$activeConfig
switch_config_from_1=setenv activeConfig 2 ; saveenv
switch_config_from_2=setenv activeConfig 1 ; saveenv
tmp_dir_size=20
unitModel=V0
unitVer=1
upgradeFlag=0
upgrade_boot=run switch_active ; run set_bootcmd_recover ; setenv upgradeFlag 1 ; saveenv ; run bootcmd_part$activePartition
usb_filename=fw1_vx_dep_R80_992001682_20.img
vendor=Marvell
U-Boot Help
? - alias for 'help' avs - Set/Get Adaptive Voltage Scaling (AVS) value base - print or set address offset bdinfo - print Board Info structure blkcache- block cache diagnostics and control boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootefi - Boots an EFI payload from memory bootelf - Boot from an ELF image in memory booti - boot arm64 Linux Image image from memory bootm - boot application image from memory bootp - boot image via network using BOOTP/TFTP protocol bootvx - Boot vxWorks from an ELF image bubt - Burn a u-boot image to flash cmp - memory compare coninfo - print console devices and information cp - memory copy cp_blob_update- cp_blob_update - set blob params from uboot enviroment. cp_reset_to_default- cp_reset_to_default - restore default image. crc32 - checksum calculation dcache - enable or disable data cache dhcp - boot image via network using DHCP/TFTP protocol dm - Driver model low level access echo - echo args to console editenv - edit environment variable env - environment handling commands ethsw - Ethernet l2 switch commands exit - exit script ext2load- load binary file from a Ext2 filesystem ext2ls - list files in a directory (default /) ext4load- load binary file from a Ext4 filesystem ext4ls - list files in a directory (default /) ext4size- determine a file's size ext4write- create a file in the root directory false - do nothing, unsuccessfully fatinfo - print information about filesystem fatload - load binary file from a dos filesystem fatls - list files in a directory (default /) fatsize - determine a file's size fdt - flattened device tree utility commands fstype - Look up a filesystem type go - start application at address 'addr' gpio - query and control gpio pins gzwrite - unzip and write memory to block device help - print command description/usage i2c - I2C sub-system icache - enable or disable instruction cache iminfo - print header information for application image imxtract- extract a part of a multi-image init_88e6352- init 88e6352 init_88e6352_factory- init 88e6352_factory ir - ir - Reading and changing internal register values. itest - return true/false on integer compare ledCtl - ledCtl <LED> <color> <blink> load - load binary file from a filesystem loadb - load binary file over serial line (kermit mode) loads - load S-Record file over serial line loadx - load binary file over serial line (xmodem mode) loady - load binary file over serial line (ymodem mode) loop - infinite loop on address range ls - list files in a directory (default /) lzmadec - lzma uncompress a memory region map - Display address decode windows md - memory display mdio - MDIO utility commands menu - menu mii - MII utility commands mm - memory modify (auto-incrementing address) mmc - MMC sub system mmcinfo - display MMC info mv_fw_info- Prints service CPU firmware information mv_get_counters- Get gop counters mvsw_reg- marvell 88e6352 switch register access mw - memory write (fill) network - network [enable|disable|status] nfs - boot image via network using NFS protocol nm - memory modify (constant address) part - disk partition related commands pci - list and access PCI Configuration Space phy_fw_down- phy_fw_down - Downloads x3220/3310 Ethernet transceiver PHY firmware. ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables pxe - commands to get and boot from pxe files regulator- uclass operations reset - Perform RESET of the CPU run - run commands in an environment variable sata - SATA sub-system save - save file to a filesystem saveenv - save environment variables to persistent storage scsi - SCSI sub-system scsiboot- boot from SCSI device setenv - set environment variables sf - SPI flash sub-system showvar - print local hushshell variables size - determine a file's size sleep - delay execution for some time source - run script from memory sspi - SPI utility command switch - Switch Access commands sysboot - command to get and boot from syslinux files test - minimal test like /bin/sh tftpboot- boot image via network using TFTP protocol time - run commands and summarize execution time true - do nothing, successfully tsen - tsen - Display the SoC temperature. unzip - unzip a memory region usb - USB sub-system usbboot - boot from USB device v0_eth_led_test- v0 eth led test tool version - print monitor, compiler and linker version