Check Point V-80をいじり倒す

まだWIP

U-Bootなんもわからん

最終目標はDebianを入れてDockerを動かす

簡素な設定ファイルを使用してU-Bootからディストリビューションのカーネルなどを起動できる機能

本体の公式FWを起動してexpertシェルから設定を投入する。

USBメモリの/にextlinux.confがある想定だがパスを変えれば/bootとかに置いたものも認識する

run bootcmd_ow_usb; run bootcmd_ow_emmcはOpenWRT用の設定

OpenWRTインストール手順

# fw_setenv bootcmd_ow_sysboot 'usb start; sysboot usb 0:1 any ${loadaddr} /extlinux.conf;'
# fw_setenv bootcmd 'set cp_quiet; run set_bootargs_vx; run bootcmd_ow_sysboot; run bootcmd_ow_usb; run bootcmd_ow_emmc; run bootcmd_part${activePartition};'

• ここで指定するファイルはmkimageで作ったuimageではなく生イメージでOK
• kernelはgzip圧縮したもの（vmlinuz）はダメなので解凍する

label debian
    kernel /boot/vmlinux-6.6.51-mvebu-cortexa72
    initrd /boot/initrd.img-6.6.51-mvebu-cortexa72
    fdt /boot/armada-7040-v-80.dtb
    append console=ttyS0,115200 earlycon=uart8250,mmio32,0xf0512000 earlyprink root=/dev/sda2 rw rootwait mvpp2x.queue_mode=1 ethaddr=${ethaddr} eth1addr=${eth1addr} eth2addr=${eth2addr}  eth3addr=${eth3addr}

OpenWRTのカーネルを基にDebianで必要っぽい機能を有効化したもの

https://github.com/junk-labs/debian-mvebu_cortexa72/releases/tag/Releasefornow

• lan1～lan5＝筐体の印字
• eth0 DSAの根本(lan1~lan5の状態に応じて自動的に構成されるので触らない)
• eth1 WANポート

ethtoolを使えば設定変更できるかも

auto lo
iface lo inet loopback

# WAN Port
allow-hotplug eth1
iface eth1 inet dhcp

# LAN PORT
allow-hotplug lan1
iface lan1 inet dhcp

allow-hotplug lan2
iface lan2 inet dhcp

allow-hotplug lan3
iface lan3 inet dhcp

allow-hotplug lan4
iface lan4 inet dhcp

allow-hotplug lan5
iface lan5 inet dhcp

openwrtをUSBメモリとemmcにインストールするための設定済

activeConfig=1
activePartition=1
adsl_partition_mmc_blk=0x4E1800
adsl_partition_mmc_blk_cnt=0x800
adsl_reserved_space=1
arch=arm
baudrate=115200
board=mvebu_armada-8k
board_name=mvebu_armada-8k
bootaddr=0x6000200
bootcmd=set cp_quiet; run set_bootargs_vx; run bootcmd_ow_usb; run bootcmd_ow_emmc; run bootcmd_part${activePartition};
bootcmd_legacy=run get_images; run set_bootargs; booti $kernel_addr $ramfs_addr $fdt_addr
bootcmd_ow_emmc=run set_mmc_internal; mmc read ${loadaddr} ${prim_header_mmc_blk} 4 && source ${loadaddr}
bootcmd_ow_usb=usb start; load usb 0:1 ${loadaddr} boot.scr && source ${loadaddr}
bootcmd_part1=run set_bootargs_vx; run cpboot_prim;
bootcmd_part2=run set_bootargs_vx; run cpboot_sec;
bootdelay=2
bootfile=fw1_vx_dep_R80_992001653_20.img
bootloader_version=992000129
brandingFileExtracted=0
burn_default=run set_mmc_internal ; mmc write ${kern_src_addr} ${def_kern_dest_mmc_blk} ${kern_blk_count}; mmc write ${dtb_src_addr} ${def_dtb_dest_mmc_blk} ${dtb_blk_count}; mmc write ${rootfs_src_addr} ${def_rootfs_dest_mmc_blk} ${rootfs_blk_count};
burn_primary=run set_mmc_internal ; mmc write ${loadaddr} ${prim_header_mmc_blk} 1; mmc write ${kern_src_addr} ${prim_kern_dest_mmc_blk} ${kern_blk_count}; mmc write ${dtb_src_addr} ${prim_dtb_dest_mmc_blk} ${dtb_blk_count}; mmc erase ${prim_rootfs_dest_mmc_blk} ${min_erase_blk_cnt};
change_config=run switch_config set_bootcmd_normal bootcmd
confirm_boot=run set_bootcmd_normal bootcmd
console=console=ttyS0,115200 earlycon=uart8250,mmio32,0xf0512000
cp_boot_mode=1
cp_boot_no_console_output=0
cp_quiet=quiet
cp_uboot=true
cpboot_prim=run set_mmc_internal; mmc read ${kernel_addr_r} ${prim_kern_dest_mmc_blk} ${kernel_partition_block_count}; mmc read ${fdt_addr_r} ${prim_dtb_dest_mmc_blk} ${dtb_partition_block_count}; booti ${kernel_addr_r} - ${fdt_addr_r}
cpboot_sec=run set_mmc_internal; mmc read ${kernel_addr_r} ${secondary_kern_dest_mmc_blk} ${kernel_partition_block_count}; mmc read ${fdt_addr_r} ${secondary_dtb_dest_mmc_blk} ${dtb_partition_block_count}; booti ${kernel_addr_r} - ${fdt_addr_r}
cpnumofcores=maxcpus=4
cpu=armv8
crash_kernel=crashkernel=30M
def_rootfs_blk_offset=9960
def_sw_blk_cnt=0x96000
def_sw_dest_mmc_blk=0x306000
default_sw_reserved_space=300
dmz_mac_addr=00:00:00:00:00:00
dsl2_mac_addr=00:00:00:00:00:00
dsl3_mac_addr=00:00:00:00:00:00
dsl_action=5
dsl_mac_addr=00:00:00:00:00:00
dtb_blk_count=32
dtb_partition_block_count=0x800
dtb_reserved_space=1
dtb_src_addr=f397fdb
erase_default_sw=run set_mmc_internal; mmc erase ${def_sw_dest_mmc_blk} ${min_erase_blk_cnt}
erase_primary_secondary=run primary_part_erase; run secondary_part_erase
erase_storage=run set_mmc_internal; mmc erase ${storage_partition_mmc_blk} ${min_erase_blk_cnt}
eth1addr=00:1C:7F:**:**:1F
eth2addr=00:51:82:**:**:02
eth3addr=00:51:82:**:**:03
ethact=mvpp2-1
ethaddr=00:1C:7F:9C:0F:20
ethprime=eth1
extra_params=pci=pcie_bus_safe
fdt_addr_r=0x6f00000
fdt_high=0xffffffffffffffff
fdt_name=fdt.dtb
fdtcontroladdr=7f5cdcb0
fileaddr=6000000
filesize=93ae76c
flash_erase=run erase_default_sw; run erase_storage
flash_secondary_erase=run secondary_part_erase; run erase_storage; run logs_erase
format_fs_parts=0
format_pfrm_part=0
fwtmp_dir_size=60
gatewayip=10.4.50.254
hardware_capabilities=0
hostname=marvell
hw_mac_addr=00:1C:7F:9C:0F:1F
image_header_blk_cnt=0x1
initrd_addr=0xa00000
initrd_size=0x2000000
ipaddr=192.168.1.1
kern_blk_count=9959
kern_reserved_space=48
kern_src_addr=60003a0
kernel_addr_r=0x7000000
kernel_partition_block_count=0x18000
lan1_mac_addr=00:1C:7F:9C:0F:20
lan2_mac_addr=00:1C:7F:9C:0F:20
lan3_mac_addr=00:1C:7F:9C:0F:20
lan4_mac_addr=00:1C:7F:9C:0F:20
lan5_mac_addr=00:1C:7F:9C:0F:20
loadaddr=0x6000000
logs_erase=run set_mmc_internal; mmc erase ${logs_partition_mmc_blk} ${min_erase_blk_cnt}
logs_partition_mmc_blk=0x39C000
logs_partition_mmc_blk_cnt=0x145000
logs_reserved_space=650
marketing_capabilities=0
marketing_name=1550
mgmt_opq=s/43sT9JjwQ=:vzslyrP2LOE=:Xx2Cb
mgmt_signature=V/kSoeWB06ElMO17bN7ESCGNR/32qjV1H1FxbdntF3Q8FQSDLz+zCnuCMpK6q9bkDaXR5OoHXTxxHCKvHnZxWA==
mgmt_signature_ver=1
min_erase_blk_cnt=0x400
mmc_blk_dev=1
mmc_load=ext4load mmc 1:1
mmc_start_reserved_space=10
mtc_mode_rst_cnt=0
netdev=eth1
netmask=255.255.255.0
num_of_flash_writes=166768336
preset=0
preset_cfg_reserved_space=1
prim_dtb_dest_mmc_blk=0x1D000
prim_header_mmc_blk=0x5000
prim_kern_dest_mmc_blk=0x5001
prim_rootfs_dest_mmc_blk=0x1D800
prim_rootfs_partition_size=0x168000
primary_part_erase=run set_mmc_internal; mmc erase ${prim_header_mmc_blk} ${min_erase_blk_cnt}
ramdisk_addr_r=0x8000000
ramfs_name=-
recoverFlag=0
recover_boot=run switch_active ; run set_recover_flags ; run set_bootcmd_normal bootcmd
reset_to_default_finalize=run secondary_part_erase; run erase_storage; run logs_erase
return_to_default=cp_reset_to_default
rootfs_blk_count=40366
rootfs_reserved_space=720
rootpath=/srv/nfs/
secondary_dtb_dest_mmc_blk=0x19D800
secondary_header_mmc_blk=0x185800
secondary_kern_dest_mmc_blk=0x185801
secondary_part_erase=run set_mmc_internal; mmc erase ${secondary_header_mmc_blk} ${min_erase_blk_cnt}
serial_number=WA20C01731
serverip=192.168.0.2
set_bootargs=setenv bootargs ttyS0,115200 earlycon=uart8250,mmio32,0xf0512000 earlyprink root=/dev/mmcblk1p1 rw rootwait
set_bootargs_vx=run set_console ; setenv bootargs $console $crash_kernel mvpp2x.queue_mode=1 ${cp_quiet} blkdevparts=mmcblk${mmc_blk_dev}:${kern_reserved_space}M@${mmc_start_reserved_space}M(kernel-1),${dtb_reserved_space}M(dtb-1),${rootfs_reserved_space}M(rootfs-1),${kern_reserved_space}M(kernel-2),${dtb_reserved_space}M(dtb-2),${rootfs_reserved_space}M(rootfs-2),${default_sw_reserved_space}M(default_sw),${logs_reserved_space}M(logs),${preset_cfg_reserved_space}M(preset_cfg),${adsl_reserved_space}M(adsl),-(storage) ${cpnumofcores}
set_bootcmd_normal=setenv bootcmd "run bootcmd_part$activePartition "; saveenv
set_bootcmd_recover=setenv bootcmd run recover_boot ; saveenv
set_console=setenv console console=ttyS0,${baudrate} earlycon=uart8250,mmio32,0xf0512000
set_mmc_internal=mmc dev 1
set_recover_flags=setenv recoverFlag 1 ; setenv upgradeFlag 0
soc=mvebu
stderr=serial@512000
stdin=serial@512000
stdout=serial@512000
storage_partition_mmc_blk=0x4E2000
storage_partition_mmc_blk_cnt=0x1F4000
sub_hw_ver=MRV
switch_active=run switch_active_from_$activePartition
switch_active_from_1=setenv activePartition 2 ; saveenv
switch_active_from_2=setenv activePartition 1 ; saveenv
switch_config=run switch_config_from_$activeConfig
switch_config_from_1=setenv activeConfig 2 ; saveenv
switch_config_from_2=setenv activeConfig 1 ; saveenv
tmp_dir_size=20
unitModel=V0
unitVer=1
upgradeFlag=0
upgrade_boot=run switch_active ; run set_bootcmd_recover ; setenv upgradeFlag 1 ; saveenv ; run bootcmd_part$activePartition
usb_filename=fw1_vx_dep_R80_992001682_20.img
vendor=Marvell

• 外部リンク

  ?       - alias for 'help'
  avs     - Set/Get Adaptive Voltage Scaling (AVS) value

  base    - print or set address offset
  bdinfo  - print Board Info structure
  blkcache- block cache diagnostics and control
  boot    - boot default, i.e., run 'bootcmd'
  bootd   - boot default, i.e., run 'bootcmd'
  bootefi - Boots an EFI payload from memory
  bootelf - Boot from an ELF image in memory
  booti   - boot arm64 Linux Image image from memory
  bootm   - boot application image from memory
  bootp   - boot image via network using BOOTP/TFTP protocol
  bootvx  - Boot vxWorks from an ELF image
  bubt    - Burn a u-boot image to flash
  cmp     - memory compare
  coninfo - print console devices and information
  cp      - memory copy
  cp_blob_update- cp_blob_update  - set blob params from uboot enviroment.

  cp_reset_to_default- cp_reset_to_default - restore default image.

  crc32   - checksum calculation
  dcache  - enable or disable data cache
  dhcp    - boot image via network using DHCP/TFTP protocol
  dm      - Driver model low level access
  echo    - echo args to console
  editenv - edit environment variable
  env     - environment handling commands
  ethsw   - Ethernet l2 switch commands
  exit    - exit script
  ext2load- load binary file from a Ext2 filesystem
  ext2ls  - list files in a directory (default /)
  ext4load- load binary file from a Ext4 filesystem
  ext4ls  - list files in a directory (default /)
  ext4size- determine a file's size
  ext4write- create a file in the root directory
  false   - do nothing, unsuccessfully
  fatinfo - print information about filesystem
  fatload - load binary file from a dos filesystem
  fatls   - list files in a directory (default /)
  fatsize - determine a file's size
  fdt     - flattened device tree utility commands
  fstype  - Look up a filesystem type
  go      - start application at address 'addr'
  gpio    - query and control gpio pins
  gzwrite - unzip and write memory to block device
  help    - print command description/usage
  i2c     - I2C sub-system
  icache  - enable or disable instruction cache
  iminfo  - print header information for application image
  imxtract- extract a part of a multi-image
  init_88e6352- init 88e6352
  init_88e6352_factory- init 88e6352_factory
  ir      - ir    - Reading and changing internal register values.

  itest   - return true/false on integer compare
  ledCtl  - ledCtl <LED> <color> <blink>

  load    - load binary file from a filesystem
  loadb   - load binary file over serial line (kermit mode)
  loads   - load S-Record file over serial line
  loadx   - load binary file over serial line (xmodem mode)
  loady   - load binary file over serial line (ymodem mode)
  loop    - infinite loop on address range
  ls      - list files in a directory (default /)
  lzmadec - lzma uncompress a memory region
  map     - Display address decode windows

  md      - memory display
  mdio    - MDIO utility commands
  menu    - menu

  mii     - MII utility commands
  mm      - memory modify (auto-incrementing address)
  mmc     - MMC sub system
  mmcinfo - display MMC info
  mv_fw_info- Prints service CPU firmware information
  mv_get_counters- Get gop counters
  mvsw_reg- marvell 88e6352 switch register access
  mw      - memory write (fill)
  network - network [enable|disable|status]

  nfs     - boot image via network using NFS protocol
  nm      - memory modify (constant address)
  part    - disk partition related commands
  pci     - list and access PCI Configuration Space
  phy_fw_down- phy_fw_down - Downloads x3220/3310 Ethernet transceiver PHY firmware.

  ping    - send ICMP ECHO_REQUEST to network host
  printenv- print environment variables
  pxe     - commands to get and boot from pxe files
  regulator- uclass operations
  reset   - Perform RESET of the CPU
  run     - run commands in an environment variable
  sata    - SATA sub-system
  save    - save file to a filesystem
  saveenv - save environment variables to persistent storage
  scsi    - SCSI sub-system
  scsiboot- boot from SCSI device
  setenv  - set environment variables
  sf      - SPI flash sub-system
  showvar - print local hushshell variables
  size    - determine a file's size
  sleep   - delay execution for some time
  source  - run script from memory
  sspi    - SPI utility command
  switch  - Switch Access commands
  sysboot - command to get and boot from syslinux files
  test    - minimal test like /bin/sh
  tftpboot- boot image via network using TFTP protocol
  time    - run commands and summarize execution time
  true    - do nothing, successfully
  tsen    - tsen - Display the SoC temperature.

  unzip   - unzip a memory region
  usb     - USB sub-system
  usbboot - boot from USB device
  v0_eth_led_test- v0 eth led test tool
  version - print monitor, compiler and linker version