If you take a look on the console when I assume z-boot is doing it's stuff, you will see :
- Code: Select all
Processing vmlinux_xload.zbf (start: 0x01740090, size: 0x002baca4)
Checking zboot file signature .. OK.
Warning: header version mismatched.
*** Fully Encrypted.
I've had a look around for the format of .zbf (Z-Boot file Header). It would seem our friends over at opentvixdev have the source for genzbf. From the source you can see there is a 32 byte header made up of 8x 32 bit longs added to the encrypted & compressed kernel. The 2nd long after the magic 'FNIB' is an Attributes flag which specifies if the attached kernel is compressed and/or encrypted. In the case of stock standard Western Digital firmware both the encrypted and compressed flags are set, hence the message *** Fully Encrypted.
Now while I haven't yet had a chance to try, at the moment I can't see why we can't create a compressed kernel (I believe compressed means gzip) but not encrypted and have the bootloader load it, provided we don't set the encrypted flag.
Looking a bit further at the console messages, you will see z-boot copies the contents of vmlinux_xload.zbf out of the romfs in flash and over to DRAM. It then spawns x-loader which decompressed the kernel to 0x84000000 and executes it from 0x84444000. The start address of 0x84444000 is in the .zbf header, but it is also in the elf header of the kernel. If you build the kernel and run readelf -h vmlinux, it will report the entry point address is 0x84444000 which is all consistent.
YAMON allows you to load a kernel via TFTP into DRAM and execute it.
To bring up an ethernet interface:
- Code: Select all
YAMON> net init
Ethernet driver for SMP86XX (v1.0)
(MAC 00:90:a9:90:92:91)
em86xx_eth0 - full-duplex mode
em86xx_eth0 - 100 Mbit/s
em86xx_eth0 ethernet start
DHCP was successfully configured.
ipaddr: 192.168.0.50
subnetmask: 255.255.255.0
gateway: 192.168.0.254
Then you will want to load the kernel into DRAM :
- Code: Select all
YAMON> load -b tftp://192.168.0.251/vmlinux 0x84000000
About to load tftp://192.168.0.251/vmlinux
Press Ctrl-C to break
................................................................
................................................................
.......................................
Start = 0x84000000, range = (0x84000000,0x84539573), format = BINARY
Length = 0x539574 (5477748)
Checksum = 0x1c67d95a (10'476567898)
And finally execute it :
- Code: Select all
YAMON> go 0x84444000 console=ttyS0
em86xx_eth0 ethernet stop
But at this stage, I get nothing. It's like the console is not working properly.
If I try to start execution from a random addresses (e.g. 0x84000000) YAMON throws a reserved instruction exception, so to some degree I reasonably confident something is happening, just the console is not working. Under kernel hacking in the kernel configuration menu, the default kernel command string is console=ttyS0, so I don't think I have to pass any kernel parameters. I've also tried building with registering an early kernel, but no luck yet.
I know b-rad and some other individual's have tried kexec, so that might be my next point of call just to verify the kernel image is fine.
I believe there are some issues with kexec, so hopefully if we load a kernel image (and rootnfs) via YAMON we can verify a kernel and then move onto the next stage of compressing it and adding the .zbf header.
Any thoughts?
