既に記事があるM8eGやM24eGと同様に、Realtek SoCを搭載するスイッチングハブを調べた際に見つけた機種。
最近深夜になんとなくヤフオクであまり期待せずに "M48eG" を検索したところ、これまで見掛けたことが無い "PN28480K" を見つけ、送料別8,000弱であったことから衝動的に購入してしまったもの。手が滑った
まとめていきます。
U-Boot
help
RTL839x# # help ? - alias for 'help' alphachk - check image header and verify imgae in RAM [srcaddr] [imagetype] alphadec - decompress image[filename] from temp memory[srcaddr] to boot address[dstaddr] base - print or set address offset boardid - boardid - Get/Set board model id boota - boota - boot application image from one of dual images partition automatically bootelf - Boot from an ELF image in memory bootm - boot application image from memory bootp - boot image via network using BOOTP/TFTP protocol bootvx - Boot vxWorks from an ELF image cmp - memory compare cp - memory copy crc32 - checksum calculation eepw - eepw - EEPROM write all env - environment handling commands erase - erase FLASH memory ffsfmt - ffs format ffsls - ffs ls ffsmount - mount ffs ffsrdm - read file to memory from ffs ffsrm - FFS rm ffsumount - unmount ffs ffswrm - write file from memory to ffs flinfo - print FLASH memory information go - start application at address 'addr' help - print command description/usage iminfo - print header information for application image loadb - load binary file over serial line (kermit mode) loady - load binary file over serial line (ymodem mode) loop - infinite loop on address range lzmadec - decompress lzma image from src to dst md - memory display memalloc - memory allocate test mm - memory modify (auto-incrementing address) mtest - simple RAM read/write test mw - memory write (fill) nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv - print environment variables printsys - printsys - print system information variables protect - enable or disable FLASH write protection reset - Perform RESET of the CPU rtk - rtk - Realtek commands run - run commands in an environment variable saveenv - save environment variables to persistent storage savesys - savesys - save system information variables to persistent storage setenv - set environment variables setsys - setsys - set system information variables sf - SPI flash sub-system showsub - show u-boot sub version sleep - delay execution for some time tftpboot - boot image via network using TFTP protocol updatert - update runtime firmware updateub - update u-boot firmware version - print monitor, compiler and linker versionversion
RTL839x# # version U-Boot 2011.12.46351-1.00.09-svn5722 (Mar 12 2015 - 20:08:54) mips-linux-uclibc-gcc (GCC) 3.4.4 mipssde-6.03.00-20051020 GNU ld version 2.15.94 mipssde-6.03.00-20051020printenv
少々厄介なことに、printenvでのethaddrはFlash内にバイナリとして埋め込まれたMACアドレスが常に表示される。その上、何も触れていない完全な初期状態では、U-Bootの環境変数領域にはSDKデフォルトで個体固有ではないと思われるMACアドレスが格納されている。また、setenvでethaddrを設定した場合、U-Bootの環境変数領域のethaddrに加え、Flash内に埋め込まれているアドレスにも適用され変更される。
Flash内に埋め込まれたアドレスとU-Boot環境変数内のアドレスが異なる状態でethaddrのsetenvをせずにsaveenvした場合、埋め込まれたアドレスがU-Bootの環境変数におけるethaddrにも書き込まれる。RTL839x# # printenv baudrate=9600 boardmodel=RTL8393M_8218B_8218FB_2SFP bootcmd=ffsrdm c:/runtime.had 0x81000000;alphadec c:/runtime.had 0x81000240 0x80010000; bootdelay=3 diagmode=4 ethact=rtl8390#0 ethaddr=00:50:40:**:**:b6 file_linux=vmlinux.bix file_linux2=vmlinux.bix file_uboot=u-boot.bin flashoffset_env=0x80000 flashoffset_linux=0x5a0000 flashoffset_linux2=0xc50000 flashoffset_uboot=0x0 freemem=0x81000000 ipaddr=192.168.1.1 load_addr=0xb4100000 nuke_env=sf probe 0; sf erase $(flashoffset_env) +$(ssize_env) rtkon=rtk network on;ping $(serverip) serverip=192.168.1.111 ssize_env=0x10000 ssize_linux=0x6b0000 ssize_linux2=0x6b0000 ssize_uboot=0x80000 stderr=serial stdin=serial stdout=serial up_linux=sf probe 0;sf read $(freemem) $(flashoffset_linux) $(ssize_linux);bootm $(freemem) update_linux=tftp $(freemem) $(file_linux);sf probe 0;sf erase $(flashoffset_linux) $(ssize_linux);sf write $(fileaddr) $(flashoffset_linux) $(ssize_linux) update_linux2=tftp $(freemem) $(file_linux2);sf probe 0;sf erase $(flashoffset_linux2) $(ssize_linux2);sf write $(fileaddr) $(flashoffset_linux2) $(ssize_linux2) update_uboot=tftp $(freemem) $(file_uboot);sf probe 0;sf erase $(flashoffset_uboot) $(ssize_uboot);sf write $(fileaddr) $(flashoffset_uboot) $(ssize_uboot) Environment size: 1310/65532 bytesprintsys
stockではbootaを利用していないので、関連する "sys" 領域もたぶん利用されていない
RTL838x# # printsys Invalid system informationhelp rtk
RTL839x# # help rtk rtk - rtk - Realtek commands Usage: rtk object action - SOC commands. rtk network on - Enable the networking function rtk netowkr off - Disable the networking function rtk testmode [mode] [port] - Set default value for specific testing rtk ext-pinGet [pinNum] - get external 8231 GPIO pin status rtk ext-pinSet [pinNum] [status] - set external 8231 GPIO pin status rtk smi list - list all smi group rtk smi init [group_id] [sck_pin] [sda_pin] [8/16 access type] [chipid] [delay] [name] - create a smi group and init rtk smi read [group_id] [reg] rtk smi write [group_id] [reg] [data] rtk pinGet [pinNum] - get internal GPIO pin status rtk pinSet [pinNum] [status] - set internal GPIO pin status rtk poe probe - probe poe device rtk ledtest [port] [led_index] - led test rtk loopback ext [port-start] [port-end] [round] - port traffic external loopback test rtk loopback int [port-start] [port-end] [round] - port traffic internal loopback testrtk smi list
RTL839x# # rtk smi list Index SCK_DEV SCK_PIN SDA_DEV SDA_PIN TYPE ID Delay Name ================================================================= 00 00 16 00 17 16_1R 75 04000 PCA9539 01 00 14 00 15 8_0R 70 04000 PCA9545 02 00 16 00 17 16_1R 20 04000 PCA9555 03 00 14 00 15 8_0R 50 04000 GBIC-A0H 04 00 14 00 15 8_0R 51 04000 GBIC-A2Hrtk pinGet 0-32
RTL839x# # rtk pinGet 0 pin0: 0 RTL839x# # rtk pinGet 1 pin1: 1 RTL839x# # rtk pinGet 2 pin2: 1 RTL839x# # rtk pinGet 3 pin3: 0 RTL839x# # rtk pinGet 4 pin4: 0 RTL839x# # rtk pinGet 5 pin5: 0 RTL839x# # rtk pinGet 6 pin6: 0 RTL839x# # rtk pinGet 7 pin7: 0 RTL839x# # rtk pinGet 8 pin8: 1 RTL839x# # rtk pinGet 9 pin9: 1 RTL839x# # rtk pinGet 10 pin10: 0 RTL839x# # rtk pinGet 11 pin11: 0 RTL839x# # rtk pinGet 12 pin12: 1 RTL839x# # rtk pinGet 13 pin13: 1 RTL839x# # rtk pinGet 14 pin14: 1 RTL839x# # rtk pinGet 15 pin15: 1 RTL839x# # rtk pinGet 16 pin16: 1 RTL839x# # rtk pinGet 17 pin17: 1 RTL839x# # rtk pinGet 18 pin18: 1 RTL839x# # rtk pinGet 19 pin19: 0 RTL839x# # rtk pinGet 20 pin20: 1 RTL839x# # rtk pinGet 21 pin21: 1 RTL839x# # rtk pinGet 22 pin22: 1 RTL839x# # rtk pinGet 23 pin23: 1 RTL839x# # rtk pinGet 24 pin24: 0 RTL839x# # rtk pinGet 25 pin25: 0 RTL839x# # rtk pinGet 26 pin26: 0 RTL839x# # rtk pinGet 27 pin27: 0 RTL839x# # rtk pinGet 28 pin28: 0 RTL839x# # rtk pinGet 29 pin29: 0 RTL839x# # rtk pinGet 30 pin30: 0 RTL839x# # rtk pinGet 31 pin31: 0 RTL839x# # rtk pinGet 32 pin32: 0tftpboot
RTL839x# # tftpboot *** Warning: no boot file name; using '0101A8C0.img' Using rtl8390#0 device TFTP from server 192.168.1.111; our IP address is 192.168.1.1 Filename '0101A8C0.img'. Load address: 0xb4100000 Loading: *ffsmount, ffsls
RTL839x# # ffsmount c:/ File system initialization done RTL839x# # ffsls c:/ -rw- 3346740 runtime.had -rw- 2 runtime_checksum -rw- 3346740 runtime_2.had -rw- 2 runtime_2_checksum -rw- 2167 config.cfg -rw- 2 config.cks -rw- 2167 config_2.cfg -rw- 2 config_2.cksmd.l 0x1b000280, md.l 0x1b000290
0x1b000274, 0x1b000284 にそれぞれ 1 を書き込んで有効化すると温度2カ所を読めるようになる
RTL839x# # md.l 0x1b000280 1 1b000280: 00000000 .... RTL839x# # mw.l 0x1b000274 1 RTL839x# # md.l 0x1b000280 1 1b000280: 00000122 ..."RTL839x# # md.l 0x1b000290 1 1b000290: 00000000 .... RTL839x# # mw.l 0x1b000284 1 RTL839x# # md.l 0x1b000290 1 1b000290: 00000123 ...#temp (hex) = val & 0x3F
Kernel
KernelはLinuxではなくVxWorks。Flash内にファイルシステムが形成されており、その中にKernelイメージが配置されている。
bootlog
U-Boot 2011.12.46351-1.00.09-svn5722 (Mar 12 2015 - 20:08:54) Board: RTL839x CPU:700MHz LXB:200MHz MEM:400MHz DRAM: 128 MB SPI-F: 1x32 MB Loading 65536B env. variables from offset 0x80000 #### Periphery Devices Init Successfully #### Switch Model: RTL8393M_8218B_8218FB_2SFP (Port Count: 48) Switch Chip: RTL8393M Model Info: 83936802 ### RTL8218B config - MAC ID = 0 ### ### RTL8218B config - MAC ID = 8 ### ### RTL8218B config - MAC ID = 16 ### ### RTL8218B config - MAC ID = 24 ### ### RTL8218B config - MAC ID = 32 ### ### RTL8218FB config - MAC ID = 40 ### PHY[0]: disable EEE PHY[1]: disable EEE PHY[2]: disable EEE PHY[3]: disable EEE PHY[4]: disable EEE PHY[5]: disable EEE File system initialization done Start to check runtime code(1) ## Booting kernel from Legacy Image Verifying Checksum ... OK Uncompressing Kernel Image ... OK ## Starting program UART init . ................................................ 100 % Starting runtime image .................................... |100 % Configuration init ........................................ |/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|100 % [2J[0m[2J[1;1H ============================================================================== PN28480K Local Management System Version 3.0.0.02 MAC Address: 00:50:40:**:**:B6 ============================================================================== Login Menu Login:
