基本概况
Hi3796mv100为wahway出品的一款面向stb的soc芯片，网上有流出的android或linux sdk，型号形如HiSTBAndroidV600R003C01或HiSTBLinuxV100R005C00SPC041B020。目前可找的的最新linux sdk为4.4.35的HiSTBLinuxV100R005C00SPC050。
引导程序
fastboot大概就是uboot换皮，但由于这款芯片主要面向stb市场，所以他确实支持fastboot协议。
接ttl后所谓按ctrl c中断启动从未成功，若有人成功烦请告知。
短接J16从U盘读取fastboot.bin（fastboot随后读取bootargs.bin、recovery.img）引导。
引导参数中除了blkdevparts规定了mmc分区外，另一个有用的参数是mmz=ddr,0,0,400M指定了gpu内存，此内存将被gpu kmod划走从而kernel无法使用。读源代码发现bootargs中的blkdevparts可能规定了fastboot分区，但由于我是高安版从而无法验证。
破解高安版详看上一贴。
userspace
fastboot可接受的启动格式为
uImage: u-boot legacy uImage, Linux, Linux/ARM, OS Kernel Image (Not compressed), ? bytes, ?, Load Address: 0X2000000, Entry Point: 0X2000000, Header CRC: ?, Data CRC: ?
或
recovery.img: Android bootimg, kernel (0x3e08000), ramdisk (0x4e00000), page size: 2048
可以使用命令mkimage -A arm -O linux -T kernel -C none -a 0X2000000 -e 0X2000000 -n <name> -d zImage-dtb uImage或mkbootimg --kernel uImage --ramdisk ramdisk.cpio.xz --base 0 --kernel_offset 0x3e08000 --ramdisk_offset 0x4e00000 -o recovery.img制作。地址其实可以不同，但我没datashit因此无法准确验证。
制作initramfs的方式
find . -print0 | cpio --null --create --verbose --format=newc > ramdisk.cpio
gzip -9 < ramdisk.cpio > ramdisk.cpio.gz
xz --check=crc32 -T0 -9 < ramdisk.cpio > ramdisk.cpio.xz
没有ramdisk去 https://mirrors.ustc.edu.cn/openwrt/releases/22.03.3/targets/armvirt/32/ 偷，注意下rootfs.cpio.gz。rootfs-ext4.img.gz会假设rootfs为持久存储，然后就会写入第一次配置后重启。
支持的文件系统：
$ cat /proc/filesystems
nodev sysfs
nodev rootfs
nodev tmpfs
nodev bdev
nodev proc
nodev configfs
nodev debugfs
nodev tracefs
nodev sockfs
nodev pipefs
nodev ramfs
nodev rpc_pipefs
nodev devpts
ext3
ext4
ext2
cramfs
squashfs
vfat
msdos
iso9660
nodev nfs
nodev jffs2
fuseblk
nodev fuse
nodev fusectl
udf
nodev oprofilefs
nodev ubifs
使用sdk
去 https://github.com/tegzwn/HiSTBLinuxV100R005C00SPC050 下载sdk。我们主要是要out/hi3798mv100/hi3798mdmo1g/obj/source/kernel/linux-4.4.y/.config，有这个文件就可以退出了。
将source/kernel/linux-4.4.y移动出来，塞进.config后执行以下命令编译：
# apt install gcc make gettext bison flex bc zlib1g-dev libncurses5-dev lzma # 基本kernel编译依赖
# apt install gcc-arm-linux-gnueabi # 交叉工具链
# apt install ccache # 推荐，加速再次编译
$ export PATH="/usr/lib/ccache:$PATH" # 如安装ccache需使用这条命令启用
$ make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- menuconfig
$ make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- -j$(nproc)
要上gcc 12需要打以下补丁：
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 35c9db85..7f87c7e1 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -238,49 +238,23 @@ extern int __put_user_2(void *, unsigned int);
extern int __put_user_4(void *, unsigned int);
extern int __put_user_8(void *, unsigned long long);
-#define __put_user_x(__r2, __p, __e, __l, __s) \
- __asm__ __volatile__ ( \
- __asmeq("%0", "r0") __asmeq("%2", "r2") \
- __asmeq("%3", "r1") \
- "bl __put_user_" #__s \
- : "=&r" (__e) \
- : "0" (__p), "r" (__r2), "r" (__l) \
- : "ip", "lr", "cc")
-
-#define __put_user_check(x, p) \
+#define __put_user_check(__pu_val, __ptr, __err, __s) \
({ \
- unsigned long __limit = current_thread_info()->addr_limit - 1; \
- const typeof(*(p)) __user *__tmp_p = (p); \
- register const typeof(*(p)) __r2 asm("r2") = (x); \
- register const typeof(*(p)) __user *__p asm("r0") = __tmp_p; \
+ unsigned long __limit = TASK_SIZE - 1; \
+ register typeof(__pu_val) __r2 asm("r2") = __pu_val; \
+ register const void __user *__p asm("r0") = __ptr; \
register unsigned long __l asm("r1") = __limit; \
register int __e asm("r0"); \
- unsigned int __ua_flags = uaccess_save_and_enable(); \
- switch (sizeof(*(__p))) { \
- case 1: \
- __put_user_x(__r2, __p, __e, __l, 1); \
- break; \
- case 2: \
- __put_user_x(__r2, __p, __e, __l, 2); \
- break; \
- case 4: \
- __put_user_x(__r2, __p, __e, __l, 4); \
- break; \
- case 8: \
- __put_user_x(__r2, __p, __e, __l, 8); \
- break; \
- default: __e = __put_user_bad(); break; \
- } \
- uaccess_restore(__ua_flags); \
- __e; \
+ __asm__ __volatile__ ( \
+ __asmeq("%0", "r0") __asmeq("%2", "r2") \
+ __asmeq("%3", "r1") \
+ "bl __put_user_" #__s \
+ : "=&r" (__e) \
+ : "0" (__p), "r" (__r2), "r" (__l) \
+ : "ip", "lr", "cc"); \
+ __err = __e; \
})
-#define put_user(x, p) \
- ({ \
- might_fault(); \
- __put_user_check(x, p); \
- })
-
#else /* CONFIG_MMU */
/*
@@ -298,7 +272,7 @@ static inline void set_fs(mm_segment_t fs)
}
#define get_user(x, p) __get_user(x, p)
-#define put_user(x, p) __put_user(x, p)
+#define __put_user_check __put_user_nocheck
#endif /* CONFIG_MMU */
@@ -389,36 +363,54 @@ do { \
#define __get_user_asm_word(x, addr, err) \
__get_user_asm(x, addr, err, ldr)
+
+#define __put_user_switch(x, ptr, __err, __fn) \
+ do { \
+ const __typeof__(*(ptr)) __user *__pu_ptr = (ptr); \
+ __typeof__(*(ptr)) __pu_val = (x); \
+ unsigned int __ua_flags; \
+ might_fault(); \
+ __ua_flags = uaccess_save_and_enable(); \
+ switch (sizeof(*(ptr))) { \
+ case 1: __fn(__pu_val, __pu_ptr, __err, 1); break; \
+ case 2: __fn(__pu_val, __pu_ptr, __err, 2); break; \
+ case 4: __fn(__pu_val, __pu_ptr, __err, 4); break; \
+ case 8: __fn(__pu_val, __pu_ptr, __err, 8); break; \
+ default: __err = __put_user_bad(); break; \
+ } \
+ uaccess_restore(__ua_flags); \
+ } while (0)
+
+#define put_user(x, ptr) \
+({ \
+ int __pu_err = 0; \
+ __put_user_switch((x), (ptr), __pu_err, __put_user_check); \
+ __pu_err; \
+})
+
#define __put_user(x, ptr) \
({ \
long __pu_err = 0; \
- __put_user_err((x), (ptr), __pu_err); \
+ __put_user_switch((x), (ptr), __pu_err, __put_user_nocheck); \
__pu_err; \
})
#define __put_user_error(x, ptr, err) \
({ \
- __put_user_err((x), (ptr), err); \
+ __put_user_switch((x), (ptr), (err), __put_user_nocheck); \
(void) 0; \
})
-#define __put_user_err(x, ptr, err) \
-do { \
- unsigned long __pu_addr = (unsigned long)(ptr); \
- unsigned int __ua_flags; \
- __typeof__(*(ptr)) __pu_val = (x); \
- __chk_user_ptr(ptr); \
- might_fault(); \
- __ua_flags = uaccess_save_and_enable(); \
- switch (sizeof(*(ptr))) { \
- case 1: __put_user_asm_byte(__pu_val, __pu_addr, err); break; \
- case 2: __put_user_asm_half(__pu_val, __pu_addr, err); break; \
- case 4: __put_user_asm_word(__pu_val, __pu_addr, err); break; \
- case 8: __put_user_asm_dword(__pu_val, __pu_addr, err); break; \
- default: __put_user_bad(); \
- } \
- uaccess_restore(__ua_flags); \
-} while (0)
+#define __put_user_nocheck(x, __pu_ptr, __err, __size) \
+ do { \
+ unsigned long __pu_addr = (unsigned long)__pu_ptr; \
+ __put_user_nocheck_##__size(x, __pu_addr, __err); \
+ } while (0)
+
+#define __put_user_nocheck_1 __put_user_asm_byte
+#define __put_user_nocheck_2 __put_user_asm_half
+#define __put_user_nocheck_4 __put_user_asm_word
+#define __put_user_nocheck_8 __put_user_asm_dword
#define __put_user_asm(x, __pu_addr, err, instr) \
__asm__ __volatile__( \
diff --git a/include/linux/log2.h b/include/linux/log2.h
index fd7ff3d9..9f30d087 100644
--- a/include/linux/log2.h
+++ b/include/linux/log2.h
@@ -1,12 +1,8 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
/* Integer base 2 logarithm calculation
*
* Copyright (C) 2006 Red Hat, Inc. All Rights Reserved.
* Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
*/
#ifndef _LINUX_LOG2_H
@@ -15,12 +11,6 @@
#include <linux/types.h>
#include <linux/bitops.h>
-/*
- * deal with unrepresentable constant logarithms
- */
-extern __attribute__((const, noreturn))
-int ____ilog2_NaN(void);
-
/*
* non-constant log of base 2 calculators
* - the arch may override these in asm/bitops.h if they can be implemented
@@ -28,7 +18,7 @@ int ____ilog2_NaN(void);
* - the arch is not required to handle n==0 if implementing the fallback
*/
#ifndef CONFIG_ARCH_HAS_ILOG2_U32
-static inline __attribute__((const))
+static __always_inline __attribute__((const))
int __ilog2_u32(u32 n)
{
return fls(n) - 1;
@@ -36,26 +26,30 @@ int __ilog2_u32(u32 n)
#endif
#ifndef CONFIG_ARCH_HAS_ILOG2_U64
-static inline __attribute__((const))
+static __always_inline __attribute__((const))
int __ilog2_u64(u64 n)
{
return fls64(n) - 1;
}
#endif
-/*
- * Determine whether some value is a power of two, where zero is
+/**
+ * is_power_of_2() - check if a value is a power of two
+ * @n: the value to check
+ *
+ * Determine whether some value is a power of two, where zero is
* *not* considered a power of two.
+ * Return: true if @n is a power of 2, otherwise false.
*/
-
static inline __attribute__((const))
bool is_power_of_2(unsigned long n)
{
return (n != 0 && ((n & (n - 1)) == 0));
}
-/*
- * round up to nearest power of two
+/**
+ * __roundup_pow_of_two() - round up to nearest power of two
+ * @n: value to round up
*/
static inline __attribute__((const))
unsigned long __roundup_pow_of_two(unsigned long n)
@@ -63,8 +57,9 @@ unsigned long __roundup_pow_of_two(unsigned long n)
return 1UL << fls_long(n - 1);
}
-/*
- * round down to nearest power of two
+/**
+ * __rounddown_pow_of_two() - round down to nearest power of two
+ * @n: value to round down
*/
static inline __attribute__((const))
unsigned long __rounddown_pow_of_two(unsigned long n)
@@ -73,19 +68,16 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
}
/**
- * ilog2 - log of base 2 of 32-bit or a 64-bit unsigned value
- * @n - parameter
- *
- * constant-capable log of base 2 calculation
- * - this can be used to initialise global variables from constant data, hence
- * the massive ternary operator construction
+ * const_ilog2 - log base 2 of 32-bit or a 64-bit constant unsigned value
+ * @n: parameter
*
- * selects the appropriately-sized optimised version depending on sizeof(n)
+ * Use this where sparse expects a true constant expression, e.g. for array
+ * indices.
*/
-#define ilog2(n) \
+#define const_ilog2(n) \
( \
__builtin_constant_p(n) ? ( \
- (n) < 1 ? ____ilog2_NaN() : \
+ (n) < 2 ? 0 : \
(n) & (1ULL << 63) ? 63 : \
(n) & (1ULL << 62) ? 62 : \
(n) & (1ULL << 61) ? 61 : \
@@ -148,18 +140,32 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
(n) & (1ULL << 4) ? 4 : \
(n) & (1ULL << 3) ? 3 : \
(n) & (1ULL << 2) ? 2 : \
- (n) & (1ULL << 1) ? 1 : \
- (n) & (1ULL << 0) ? 0 : \
- ____ilog2_NaN() \
- ) : \
- (sizeof(n) <= 4) ? \
- __ilog2_u32(n) : \
- __ilog2_u64(n) \
+ 1) : \
+ -1)
+
+/**
+ * ilog2 - log base 2 of 32-bit or a 64-bit unsigned value
+ * @n: parameter
+ *
+ * constant-capable log of base 2 calculation
+ * - this can be used to initialise global variables from constant data, hence
+ * the massive ternary operator construction
+ *
+ * selects the appropriately-sized optimised version depending on sizeof(n)
+ */
+#define ilog2(n) \
+( \
+ __builtin_constant_p(n) ? \
+ ((n) < 2 ? 0 : \
+ 63 - __builtin_clzll(n)) : \
+ (sizeof(n) <= 4) ? \
+ __ilog2_u32(n) : \
+ __ilog2_u64(n) \
)
/**
* roundup_pow_of_two - round the given value up to nearest power of two
- * @n - parameter
+ * @n: parameter
*
* round the given value up to the nearest power of two
* - the result is undefined when n == 0
@@ -168,7 +174,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
#define roundup_pow_of_two(n) \
( \
__builtin_constant_p(n) ? ( \
- (n == 1) ? 1 : \
+ ((n) == 1) ? 1 : \
(1UL << (ilog2((n) - 1) + 1)) \
) : \
__roundup_pow_of_two(n) \
@@ -176,7 +182,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
/**
* rounddown_pow_of_two - round the given value down to nearest power of two
- * @n - parameter
+ * @n: parameter
*
* round the given value down to the nearest power of two
* - the result is undefined when n == 0
@@ -189,6 +195,12 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
__rounddown_pow_of_two(n) \
)
+static inline __attribute_const__
+int __order_base_2(unsigned long n)
+{
+ return n > 1 ? ilog2(n - 1) + 1 : 0;
+}
+
/**
* order_base_2 - calculate the (rounded up) base 2 order of the argument
* @n: parameter
@@ -202,7 +214,45 @@ unsigned long __rounddown_pow_of_two(unsigned long n)
* ob2(5) = 3
* ... and so on.
*/
+#define order_base_2(n) \
+( \
+ __builtin_constant_p(n) ? ( \
+ ((n) == 0 || (n) == 1) ? 0 : \
+ ilog2((n) - 1) + 1) : \
+ __order_base_2(n) \
+)
-#define order_base_2(n) ilog2(roundup_pow_of_two(n))
+static inline __attribute__((const))
+int __bits_per(unsigned long n)
+{
+ if (n < 2)
+ return 1;
+ if (is_power_of_2(n))
+ return order_base_2(n) + 1;
+ return order_base_2(n);
+}
+/**
+ * bits_per - calculate the number of bits required for the argument
+ * @n: parameter
+ *
+ * This is constant-capable and can be used for compile time
+ * initializations, e.g bitfields.
+ *
+ * The first few values calculated by this routine:
+ * bf(0) = 1
+ * bf(1) = 1
+ * bf(2) = 2
+ * bf(3) = 2
+ * bf(4) = 3
+ * ... and so on.
+ */
+#define bits_per(n) \
+( \
+ __builtin_constant_p(n) ? ( \
+ ((n) == 0 || (n) == 1) \
+ ? 1 : ilog2(n) + 1 \
+ ) : \
+ __bits_per(n) \
+)
#endif /* _LINUX_LOG2_H */
diff --git a/scripts/dtc/dtc-lexer.lex.c_shipped b/scripts/dtc/dtc-lexer.lex.c_shipped
index 11cd78e7..5898cccd 100644
--- a/scripts/dtc/dtc-lexer.lex.c_shipped
+++ b/scripts/dtc/dtc-lexer.lex.c_shipped
@@ -637,7 +637,7 @@ char *yytext;
#include "srcpos.h"
#include "dtc-parser.tab.h"
-YYLTYPE yylloc;
+extern YYLTYPE yylloc;
extern bool treesource_error;
/* CAUTION: this will stop working if we ever use yyless() or yyunput() */
注意有时需要参考 https://github.com/glinuz/hi3798mv100 的linux-3.18.y。wahway自己代码都能写糊（例如ir驱动），令人汗颜。
menuconfig提示：
- 可以选择
General setup -> Kernel compression mode -> XZ。
- 选上
CONFIG_USB_EHCI_HCD_PLATFORM=y和CONFIG_USB_OHCI_HCD_PLATFORM=y！！！不然开机找不到usb设备。
拿到arch/arm/boot/zImage-dtb即可组装uImage和bootimg。
重放到4.4.35
主要的改动在arch/arm，drivers/hisilicon，drivers/net/nand，drivers/mtd，drivers/net，include/dt-bindings/clock，include/linux/hisilicon。drivers/usb/gadget/udc/hiudc为hisi usb sysfs接口，drivers/common和drivers/msp为gpu驱动，drivers/bluetooth_usb和drivers/wifi为rtlwifi驱动，可删除（另，闭源驱动无法修改mac，使用nm需关闭随机化mac扫描功能）。
注意drivers/mmc/card/block.c为mmc添加了GENHD_FL_EXT_DEVT，因此可以突破CONFIG_MMC_BLOCK_MINORS默认8的限制（否则mmc part只能识别到7），解决方法建议暂时调大CONFIG_MMC_BLOCK_MINORS。
自此我们拿到了距主线差距最小的补丁集，接下来就是...
升级！
4.5
drivers/net/ethernet/hieth/mdio.c:153:18: error: assignment to expression with array type
153 | bus->irq = kmalloc(sizeof(int) * PHY_MAX_ADDR, GFP_KERNEL);
| ^
int *irq;变成了int irq[PHY_MAX_ADDR];，删除即可。
drivers/net/ethernet/hieth/hieth.c:1076:32: error: ‘struct phy_device’ has no member named ‘addr’
1076 | port, priv->phy->addr, priv->phy->drv->name);
| ^~
不会弄，先删除。
4.7
drivers/hisilicon/clk/clk-hisi.c:177:22: error: ‘CLK_IS_ROOT’ undeclared (first use in this function)
177 | init.flags = CLK_IS_ROOT | CLK_IS_BASIC | CLK_GET_RATE_NOCACHE;
| ^~~~~~~~~~~
删除。
drivers/mmc/host/himciv200/himciv200.c:504:35: error: ‘MMC_DATA_STREAM’ undeclared (first use in this function); did you mean ‘MMC_DATA_READ’?
504 | if (data->flags & MMC_DATA_STREAM) {
| ^~~~~~~~~~~~~~~
| MMC_DATA_READ
删除。
drivers/net/ethernet/hieth/hieth.c:656:12: error: ‘struct net_device’ has no member named ‘trans_start’
656 | dev->trans_start = jiffies;
| ^~
改成netif_trans_update(dev);。
arm-linux-gnueabi-ld: drivers/built-in.o:(___ksymtab+gpio_chips+0x0): undefined reference to `gpio_chips'
删除。
...后面就无聊了，不写了
