help 命令
IPQ6018# help
? - alias for 'help'
aq_load_fw- LOAD aq-fw-binary
aq_phy_restart- Restart Aquantia phy
base - print or set address offset
bdinfo - print Board Info structure
bootelf - Boot from an ELF image in memory
bootipq - bootipq from flash device
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
bootvx - Boot vxWorks from an ELF image
bootz - boot Linux zImage image from memory
canary - test stack canary
chpart - change active partition
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - boot image via network using DHCP/TFTP protocol
dm - Driver model low level access
echo - echo args to console
editenv - edit environment variable
env - environment handling commands
erase - erase FLASH memory
exectzt - execute TZT
exit - exit script
false - do nothing, unsuccessfully
fdt - flattened device tree utility commands
flash - flash part_name
flash part_name load_addr file_size
flasherase- flerase part_name
flinfo - print FLASH memory information
fuseipq - fuse QFPROM registers from memory
go - start application at address 'addr'
help - print command description/usage
i2c - I2C sub-system
imxtract- extract a part of a multi-image
ipq_mdio- IPQ mdio utility commands
is_sec_boot_enabled- check secure boot fuse is enabled or not
itest - return true/false on integer compare
loop - infinite loop on address range
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nm - memory modify (constant address)
part - disk partition related commands
pci - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset - Perform RESET of the CPU
run - run commands in an environment variable
runmulticore- Enable and schedule secondary cores
saveenv - save environment variables to persistent storage
secure_authenticate- authenticate the signed image
setenv - set environment variables
setexpr - set environment variable as the result of eval expression
sf - SPI flash sub-system
showvar - print local hushshell variables
sleep - delay execution for some time
smeminfo- print SMEM FLASH information
source - run script from memory
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
tftpsrv - act as a TFTP server and boot the first received file
true - do nothing, successfully
tzt - load and run tzt
uart - UART sub-system
ubi - ubi commands
usb - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
常用指令
printenv // 列印環境變數
setenv ipaddr X.X.X.X // 設定環境變數 - 自己的 ip
serenv serverip X.X.X.X // 設定環變數 - tftp server 的 ip
saveenv // 儲存環境變數
tftpboot file.img // 從指定的 tftp server 下載 file.img
flasherase rootfs // 清空 mtd 分區名稱為 rootfs 的分區
flash rootfs // 將 file.img 寫入 mtd 分區名稱為 rootfs 的分區 (此命令已包含清空)
nand erase [0x4000000(目的位址)] [0x3f00000(長度)] // 清空位址內容
nand write [0x44000000(來源位址)] [0x4000000(目的位址)] [0x3f00000(長度)] // 寫入位址內容
nand read [目的位址] [來源位址] [長度] // 讀取位址內容
tftpput [來源位址] [長度] [tftpServer的檔名] // 上傳位址內容 (需在server端先建立好檔名，並給寫入權限)
bootm 0x44000000 // 直接跳到 0x44000000 的位址進行開機
bootm // 從預設位址開機 (通常是 0x44000000)
reset // 重開機
mw [位址] [值] [長度] // 設定記憶體中的值
md [位址] [長度] // 讀取記憶體中的值
讀取"裝備樹" & 顯示文字 (轉成 dts 格式)
tftpboot ipq6018-cp01-c3.dtb
fdt addr 0x44000000
fdt header
fdt printer
從 u-boot 備份 mtd 分區
kernel 的 mtd 分區訊息
[ 1.533431] 0x000000000000-0x000000180000 : "0:SBL1"
[ 1.540837] 0x000000180000-0x000000280000 : "0:MIBIB"
...
[ 1.601482] 0x000000d00000-0x000007700000 : "rootfs"
命令
setenv ipaddr X.X.X.X // 設定自己的 ip
serenv serverip X.X.X.X // 設定 tftp server 的 ip
nand read 0x44000000 0 0x180000
tftpput 0x44000000 0x180000 mtd.p1
nand read 0x44000000 0x180000 0x100000
tftpput 0x44000000 0x100000 mtd.p2
// rttofs 太大了，要分兩次
nand read 0x44000000 0xd00000 0x3000000
tftpput 0x44000000 0x3000000 mtd.p14-1
nand read 0x44000000 0x3d00000 0x3A00000
tftpput 0x44000000 0x3A00000 mtd.p14-2
在 u-boot 指定 mtd 分區範例
setenv bootargs ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait mtdparts="spi32766.0:640k(0:SBL1)ro,64k(0:MIBIB)ro,128k(0:BOOTCONFIG)ro,128k(0:BOOTCONFIG1)ro,1472k(0:QSEE)ro,64k(0:DEVCFG)ro,128k(0:RPM)ro,64k(0:CDT)ro,64k(0:APPSBLENV),640k(0:APPSBL)ro,256k(0:ART)ro,448k(flash)ro;qcom_nand.0:64M(rootfs_1),64M(rootfs)"
saveenv
在 kernel 指定 mtd 分區範例
在 kernel/drivers/of/fdt.c Func：early_init_dt_scan_chosen 裡的 bootargs-append & strlcat 之後，加入以下代碼：
if(!strstr((char *)data, "mtdparts")) {
//char *my_bootargs = "ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait mtdparts=\"spi32766.0:640k(0:SBL1)ro,64k(0:MIBIB)ro,128k(0:BOOTCONFIG),128k(0:BOOTCONFIG1),1472k(0:QSEE)ro,64k(0:DEVCFG)ro,128k(0:RPM)ro,64k(0:CDT)ro,64k(0:APPSBLENV),640k(0:APPSBL)ro,256k(0:ART)ro,448k(flash)ro;qcom_nand.0:64M(rootfs_1),64M(rootfs)\" swiotlb=1 coherent_pool=2M ";
char *my_bootargs = "console=ttyMSM0,115200n8 cnss2.bdf_pci0=0xa0 ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs rootwait mtdparts=\"qcom_nand.0:1536k(0:SBL1)ro,1024k(0:MIBIB)ro,512k(0:BOOTCONFIG)ro,512k(0:BOOTCONFIG1)ro,3584k(0:QSEE)ro,512k(0:DEVCFG)ro,512k(0:RPM)ro,512k(0:CDT)ro,512k(0:APPSBLENV)ro,1536k(0:APPSBL)ro,512k(0:ART)ro,1024k(hwconfig)ro,1024k(swconfig)ro,106M(rootfs),512k(0:ETHPHYFW)ro,64M(image)\" swiotlb=1 coherent_pool=2M ";
strlcpy(data, my_bootargs, min((int)strlen(my_bootargs), COMMAND_LINE_SIZE));
}
分區大小內容要自行修改
(或者修改 kernel 的 .config 參數，也可達到效果。
在 [Boot options -> Default kernel command string] (CONFIG_CMDLINE))
在 u-boot 更新 openwrt XXXX-single.img 的下法
setenv ipaddr 192.168.1.1 // 自己的ip
setenv serverip 192.168.1.2 // tftp server 的 ip
setenv machid 8030002 // 非必要
set bootargs console=ttyMSM0,115200n8 // 非必要
tftpboot XXXX-single.img
imgaddr=$fileaddr && source $imgaddr:script
reset
走過的坑
原本以為mtd分區像下面這樣的，u-boot是可以燒失敗的。失敗之後在最前面的boot(SBL1)可以救得起來。
[ 1.527278] Creating 16 MTD partitions on "qcom_nand.0":
[ 1.533431] 0x000000000000-0x000000180000 : "0:SBL1"
[ 1.540837] 0x000000180000-0x000000280000 : "0:MIBIB"
[ 1.545288] 0x000000280000-0x000000300000 : "0:BOOTCONFIG"
[ 1.549853] 0x000000300000-0x000000380000 : "0:BOOTCONFIG1"
[ 1.555234] 0x000000380000-0x000000700000 : "0:QSEE"
[ 1.563234] 0x000000700000-0x000000780000 : "0:DEVCFG"
[ 1.565949] 0x000000780000-0x000000800000 : "0:RPM"
[ 1.570904] 0x000000800000-0x000000880000 : "0:CDT"
[ 1.575552] 0x000000880000-0x000000900000 : "0:APPSBLENV"
[ 1.580434] 0x000000900000-0x000000a80000 : "0:APPSBL" <<<<< 這裡是 u-boot
[ 1.586834] 0x000000a80000-0x000000b00000 : "0:ART"
但我把 openwrt 的 XXX-single.img 燒進 APPSBL 之後，就停在
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.0.3-00100-IPQ60xxLZB-1
S - IMAGE_VARIANT_STRING=IPQ6018LA
S - OEM_IMAGE_VERSION_STRING=crm-ubuntu124
S - Boot Interface: NAND
S - Secure Boot: Off
S - Boot Config @ 0x000a602c = 0x000002e5
S - JTAG ID @ 0x000a607c = 0x0013a0e1
S - OEM ID @ 0x000a6080 = 0x00000000
S - Serial Number @ 0x000a4128 = 0x51f6e1ae
S - OEM Config Row 0 @ 0x000a4188 = 0x0000000000000000
S - OEM Config Row 1 @ 0x000a4190 = 0x0000000000000000
S - Feature Config Row 0 @ 0x000a4130 = 0x0000000008000001
S - Feature Config Row 1 @ 0x000a4138 = 0x02c3e83383000009
S - PBL Patch Ver: 1
S - I-cache: On
S - D-cache: On
B - 3413 - PBL, Start
B - 592 - bootable_media_detect_entry, Start
B - 4339 - bootable_media_detect_success, Start
B - 5147 - elf_loader_entry, Start
B - 5319 - auth_hash_seg_entry, Start
B - 7786 - auth_hash_seg_exit, Start
B - 8283 - elf_segs_hash_verify_entry, Start
B - 103647 - elf_segs_hash_verify_exit, Start
B - 107839 - auth_xbl_sec_hash_seg_entry, Start
B - 107985 - auth_xbl_sec_hash_seg_exit, Start
B - 114537 - xbl_sec_segs_hash_verify_entry, Start
B - 114538 - xbl_sec_segs_hash_verify_exit, Start
B - 115468 - PBL, End
B - 97386 - SBL1, Start
B - 240279 - GCC [RstStat:0x0, RstDbg:0x600000] WDog Stat : 0x4
B - 242719 - clock_init, Start
D - 3751 - clock_init, Delta
B - 252296 - boot_flash_init, Start
D - 30378 - boot_flash_init, Delta
B - 284961 - sbl1_ddr_set_default_params, Start
D - 274 - sbl1_ddr_set_default_params, Delta
B - 291580 - boot_config_data_table_init, Start
D - 4941 - boot_config_data_table_init, Delta - (575 Bytes)
B - 301675 - CDT Version:2,Platform ID:8,Major ID:3,Minor ID:0,Subtype:2
B - 306250 - Image Load, Start
D - 6588 - OEM_MISC Image Loaded, Delta - (0 Bytes)
B - 315583 - Image Load, Start
D - 5063 - PMIC Image Loaded, Delta - (0 Bytes)
B - 323452 - sbl1_ddr_set_params, Start
B - 328454 - CPR configuration: 0x366
B - 331657 - Pre_DDR_clock_init, Start
D - 213 - Pre_DDR_clock_init, Delta
D - 0 - sbl1_ddr_set_params, Delta
B - 366732 - Image Load, Start
D - 518 - APDP Image Loaded, Delta - (0 Bytes)
B - 385245 - Image Load, Start
D - 519 - QTI_MISC Image Loaded, Delta - (0 Bytes)
B - 387777 - Image Load, Start
D - 885 - Auth Metadata
D - 671 - Segments hash check
D - 23668 - QSEE Dev Config Image Loaded, Delta - (37154 Bytes)
B - 413336 - Image Load, Start
D - 6619 - Auth Metadata
D - 10279 - Segments hash check
D - 362798 - QSEE Image Loaded, Delta - (1439116 Bytes)
B - 776652 - Image Load, Start
D - 702 - Auth Metadata
D - 1007 - Segments hash check
D - 36844 - RPM Image Loaded, Delta - (102800 Bytes)
B - 814868 - Image Load, Start
D - 30 - Auth
然後就沒有後續了...
我的變磚戰蹟又加一了......
所以 SBL1 並無法拯救壞掉的 u-boot，跟以前一樣不能用壞 u-boot ....
沒有留言:
張貼留言