全志R40使用UMS烧写/备份镜像

qianfan · 2021-06-16 17:02:15

全志的BSP使用的内核比较老, 在我的二手笔记本上面编译整个镜像特别慢, 但是好处是能够使用usb直接烧写EMMC. 如果使用Linux主线内核, 没有凤凰刷机工具的支持, 很难直接将镜像烧写至EMMC中, 搜索目前网上的开源板卡, 类似bananapi等板子, 都需要使用TF卡做媒介去烧写. 对于我这种懒人, 这种方式太麻烦了.并且不是所有的板子都存在TF卡接口.

sunxi-tools提供的sunxi-fel工具能够直接启动u-boot, 并且u-boot支持ums命令, 能够使用usb模拟storage, 使用这种方式能够直接在电脑上通过usb读写EMMC, 简直是解决这个问题的完美方案. 但是目前u-boot, linux的主线代码中usb部分并不支持R40这颗芯片, 反反复复改动多次之后, 修改了一份能够支持usb的u-boot, 已经提交patch到u-boot的mail list中了, 等待回复. 这里上传一个编译好的固件.u-boot-sunxi-with-spl.zip, 可以使用sunxi-fel运行u-boot镜像:

(我在window上面使用cygwin运行sunxi-fel, 因为在linux下, 总担心dd的时候, 把系统的磁盘给刷了, 所以编译了一份sunxi-fel在window上面用, 另外window上面可以使用Win32DiskImager等工具刷物理磁盘)

➜  ~ sunxi-fel uboot ./u-boot-sunxi-with-spl.bin

sunxi-fel启动u-boot之后, 在bpi的串口上可以看到u-boot的启动信息, 按任意按键可以进入u-boot的控制台, 使用mmc list查看可用的mmc媒介:
(在bpi板子上面, TF卡是mmc 0, emmc是mmc 1)

U-Boot SPL 2021.07-rc4-19023-gf87fd00f01 (Jun 16 2021 - 09:36:39 +0800)
DRAM: 2048 MiB
Trying to boot from FEL


U-Boot 2021.07-rc4-19023-gf87fd00f01 (Jun 16 2021 - 09:36:39 +0800) Allwinner Technology

CPU:   Allwinner R40 (SUN8I 1701)
Model: Banana Pi BPI-M2-Ultra
I2C:   ready
DRAM:  2 GiB
MMC:   mmc@1c0f000: 0, mmc@1c10000: 2, mmc@1c11000: 1
Loading Environment from FAT... Unable to use mmc 1:1... In:    serial@1c28000
Out:   serial@1c28000
Err:   serial@1c28000
Allwinner mUSB OTG (Peripheral)
Net:   phy interface8
eth0: ethernet@1c50000, eth1: usb_ether
starting USB...
Bus usb@1c19000: USB EHCI 1.00
Bus usb@1c19400: USB OHCI 1.0
Bus usb@1c1c000: USB EHCI 1.00
Bus usb@1c1c400: USB OHCI 1.0
scanning bus usb@1c19000 for devices... 1 USB Device(s) found
scanning bus usb@1c19400 for devices... 1 USB Device(s) found
scanning bus usb@1c1c000 for devices... 1 USB Device(s) found
scanning bus usb@1c1c400 for devices... 1 USB Device(s) found
       scanning usb for storage devices... 0 Storage Device(s) found
Hit any key to stop autoboot:  0
=>  mmc list
mmc@1c0f000: 0
mmc@1c10000: 2
mmc@1c11000: 1 (eMMC)
=>

使用ums命令可以启动usb storage程序:

=> ums 0 mmc 1
UMS: LUN 0, dev mmc 1, hwpart 0, sector 0x0, count 0xe90000
\musb-hdrc: peripheral reset irq lost!
\

该命令运行之后, 在window下面可以识别出一个可移动设备, 这时候就可以使用Win32DiskImager刷镜像了. 我使用的板子是bananapi M2U, 从https://mirrors.bfsu.edu.cn/armbian-releases/bananapim2ultra/archive/选择一个最新的armbian镜像, 解压之后1.3G, 刷整个镜像大约在3分钟左右, 速度可以到7MB每秒, 这个烧写速度和全志的凤凰工具差不了太多.

刷完镜像之后, 对板子重新上电, armbian就可以愉快启动了. (armbian的内核启动没有开启log, 需要耐心等待一会)

U-Boot SPL 2021.04-armbian (May 06 2021 - 16:44:35 +0000)
DRAM: 2048 MiB
Trying to boot from MMC2


U-Boot 2021.04-armbian (May 06 2021 - 16:44:35 +0000) Allwinner Technology

CPU:   Allwinner R40 (SUN8I 1701)
Model: Banana Pi BPI-M2-Ultra
I2C:   ready
DRAM:  2 GiB
MMC:   mmc@1c0f000: 0, mmc@1c10000: 2, mmc@1c11000: 1
Loading Environment from FAT... Unable to use mmc 1:1... In:    serial@1c28000
Out:   serial@1c28000
Err:   serial@1c28000
Net:   phy interface7
eth0: ethernet@1c50000
starting USB...
Bus usb@1c19000: ehci_generic usb@1c19000: failed to get usb phy
Port not available.
Bus usb@1c19400: ohci_generic usb@1c19400: failed to get usb phy
Port not available.
Bus usb@1c1c000: ehci_generic usb@1c1c000: failed to get usb phy
Port not available.
Bus usb@1c1c400: ohci_generic usb@1c1c400: failed to get usb phy
Port not available.
Autoboot in 1 seconds, press <Space> to stop
switch to partitions #0, OK
mmc1(part 0) is current device
Scanning mmc 1:1...
Found U-Boot script /boot/boot.scr
3967 bytes read in 1 ms (3.8 MiB/s)
## Executing script at 43100000
U-boot loaded from eMMC or secondary SD
MMC: no card present
Boot script loaded from mmc
203 bytes read in 1 ms (198.2 KiB/s)
9931681 bytes read in 494 ms (19.2 MiB/s)
7973464 bytes read in 396 ms (19.2 MiB/s)
Found mainline kernel configuration
34090 bytes read in 5 ms (6.5 MiB/s)
Failed to load '/boot/dtb/overlay/sun8i-r40-fixup.scr'
## Loading init Ramdisk from Legacy Image at 43300000 ...
   Image Name:   uInitrd
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    9931617 Bytes = 9.5 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 43000000
   Booting using the fdt blob at 0x43000000
   Loading Ramdisk to 49687000, end 49fffb61 ... OK
   Loading Device Tree to 49616000, end 49686fff ... OK

Starting kernel ...


bananapim2ultra login: root (automatic login)

Last login: Fri May  7 18:09:37 UTC 2021 on tty1
 ____  ____  _   __  __ ____  _   _
| __ )|  _ \(_) |  \/  |___ \| | | |
|  _ \| |_) | | | |\/| | __) | | | |
| |_) |  __/| | | |  | |/ __/| |_| |
|____/|_|   |_| |_|  |_|_____|\___/

Welcome to Armbian 21.05.1 Buster with Linux 5.10.34-sunxi

No end-user support: community creations

System load:   43%              Up time:       0 min
Memory usage:  6% of 1.97G      IP:
CPU temp:      48°C             Usage of /:    17% of 7.0G
RX today:      n/a

New to Armbian? Documentation: https://docs.armbian.com Support: https://forum.armbian.com

New root password: *******
Repeat password: *******

Choose default system command shell:

1) bash
2) zsh

有时候, 捡垃圾的时候需要备份镜像, 或者破解root密码, 这时候可以使用ums搭配win32diskimager来备份整个磁盘, 另外可以在linux环境下挂载目标板的文件系统, 读取shadow文件, 并交给专业的破解工具跑字典:

➜  u-boot-r40 git:(allwinner-r40-usb-otg) ls /dev/sd*
/dev/sda  /dev/sda1  /dev/sda2  /dev/sdb  /dev/sdb1
➜  u-boot-r40 git:(allwinner-r40-usb-otg) sudo mount /dev/sdb1 /tmp/sdb
➜  u-boot-r40 git:(allwinner-r40-usb-otg) cd /tmp/sdb
➜  sdb ls
bin  boot  dev  etc  home  lib  lost+found  media  mnt  opt  proc  root  run  sbin  selinux  srv  sys  tmp  usr  var
➜  sdb cat etc/shadow
cat: etc/shadow: Permission denied
➜  sdb sudo cat etc/shadow
root:$6$kKnH/usEh6bKkLfS$0XAZmPD.uBmlEQnGwl69rXnTPAVGqgaLORdQaEpcRrtMVMPHpFTPswnXjn0mSeqzgpeLVTclyLibGZYhfqyPX1:18754:0:99999:7:::
daemon:*:18752:0:99999:7:::
bin:*:18752:0:99999:7:::
sys:*:18752:0:99999:7:::
sync:*:18752:0:99999:7:::
games:*:18752:0:99999:7:::
man:*:18752:0:99999:7:::
lp:*:18752:0:99999:7:::
mail:*:18752:0:99999:7:::
news:*:18752:0:99999:7:::
uucp:*:18752:0:99999:7:::
proxy:*:18752:0:99999:7:::
www-data:*:18752:0:99999:7:::
backup:*:18752:0:99999:7:::
list:*:18752:0:99999:7:::
irc:*:18752:0:99999:7:::
gnats:*:18752:0:99999:7:::
nobody:*:18752:0:99999:7:::
_apt:*:18752:0:99999:7:::
systemd-timesync:*:18752:0:99999:7:::
systemd-network:*:18752:0:99999:7:::
systemd-resolve:*:18752:0:99999:7:::
messagebus:*:18752:0:99999:7:::
vnstat:*:18752:0:99999:7:::
_chrony:*:18752:0:99999:7:::
avahi-autoipd:*:18752:0:99999:7:::
sshd:*:18752:0:99999:7:::
systemd-coredump:!!:18754::::::
qianfan:$6$x6S1dlRjgmA2O9ov$rI946/qO6uhy6rTzAd7LiuaVRnwgDBcEWCnkVwZShTI8/uSbAJ2RTSSZG962rm.KK7v2yafwb7Hs7wumv9JeZ1:18754:0:99999:7:::
➜  sdb

qianfan · 2022-03-01 08:31:27

sniper 说：

请问你的uboot 是怎么配置的？我想启用 ums 功能，但是编译会报错。
可以发一份你的 config给我吗？

u-boot的代码里面没有R40支持, 需要修改代码.

http://patchwork.ozlabs.org/project/uboot/patch/20210616023326.18135-1-qianfanguijin@163.com/

这是之前做的patch, 后来不用R40了, 也就没有更近. 另外, 也没有R40的手册, 很难去弄了.

WhyCan Forum(哇酷开发者社区)

楼主 # 2021-06-16 17:02:15 分享评论

全志R40使用UMS烧写/备份镜像

楼主 #2 2022-03-01 08:31:27 分享评论

Re: 全志R40使用UMS烧写/备份镜像

页脚