大容量Nand Flash 光猫固件备份方法

jiuweiljp

使用条件：
* K. v4 C( g  i     1、有usb接口并且能驱动U pan的无视这个方法；
; Y' B! a1 j( A: ~/ _     2、光猫不能telnet，并没有tftp或者wget、chmod命令也可以不用看；

正文如下
手上有一个闲置的中兴光猫F657GV9，焊接TTL线后启动信息如下（可无视）：

1. U-Boot 2013.04 (Sep 11 2021 - 00:00:57)
   
2. 
   ( z' N; H. ?- p0 m) P
3. CPU  : ZX279127S@A9,1000MHZ
   
4. Board: ZXIC zx279127sevb
   
5. 127s product_vid = 158
   
6. DRAM:  256 MiB
   / V4 W7 ~, d5 D5 b6 T& \
7. 127s product_vid = 158
   1 X. h( M) t% e% A3 w( L  e
8. ,10000000,50000000
   9 k1 H: {0 c( M# }2 _& C" }6 a- n7 f; A
9. cpuid=27912710
   
10. 127s pinmux: 3f7ffffa  3ffffeff  19ff0555  6be1b
    # O: S0 ?- W& b/ w3 i( O
11. 127s product_vid = 158
    
12. bootsel=3
    
13. NAND:  
    4 p, Q+ ?/ N; ?" b' {
14. Manu ID: 0x2c, Chip ID: 0x24 (Micron SPI NAND MT29F2G01ABAGDWB  256MiB 3,3V)
    2 S+ ]7 I7 O. A1 b9 b6 I
15. 256 MiB
    
16. <nand_read_skip_bad_,447>!mtdpart=0x1,offset=0x0,mtdpartoffset=0x180000,mtdPartsize=0x80000,length=0x20000
    ( S6 Z' b0 p8 S% K
17. In:    serial
    
18. Out:   serial
    
19. Err:   serial
    7 J2 |' ~( {5 U- U
20. clk_pll env is not setted, core clk won't change
    
21. Net:   enter ref_clk_set.. mode = 0 .
    6 S6 E' B; b3 K* _
22. enter pll_cfg_fractional
    
23. ref_clk_set success!
    
24. gpon serdes init
    + X, H0 ?5 x6 u
25. addr 0x9400002c before value is 11000013
    
26. addr 0x9400004c after value is 11003ff3
    
27. eth0
    
28. sec mode!
    : _/ ]) n+ z) |- G8 B4 V; C; L
29. 
    2 a. _' ~! s' n  l# b6 E! l
30. Hit 1 to upgrade software version
    ) ~4 J/ G) D& S* B% }
31. Hit any key to stop autoboot:  0
    
32. addr=1200000
    9 ?: o- V/ r! L5 o% ^- N
33. addr=4200000
    
34. select=0x0
    
35. search=0x2
    
36. <nand_read_skip_bad_,447>!mtdpart=0x6,offset=0x0,mtdpartoffset=0x200000,mtdPartsize=0x200000,length=0x1000
    : n$ \0 {! X; w
37. tmp=0x00000000, value=0
    
38. select=0x0
    ' U3 s- t7 ]4 q. o3 |* P
39. search=0x2
    8 L- m1 Q) k9 `) t+ ?6 K7 j
40. search->result[0].entry=1200240
    
41. <nand_read_skip_bad_,447>!mtdpart=0x2,offset=0x0,mtdpartoffset=0x1200000,mtdPartsize=0x3000000,length=0x23e0000
    6 X2 ?4 B* J1 |& y8 b8 L
42. RSA Verify OK
    
43. 
    
44. ---mtdparts_init--current_mtd_partnum=0-
    . D/ D! V) U( M0 g3 n; j
45. dev id: type = 2, num = 0, size = 0xffffffff, mtd_id = single part
    
46. part  : name = rootfs0, size = 0x023c0000, offset = 0x01220000
    " [0 i6 m1 m' E
47. part  : name = rootfs1, size = 0x023c0000, offset = 0x04220000
    & M4 l3 M; H$ U
48. 
    
49. --- jffs2_part_info: partition number 0 for device nand0 (single part)
    % f6 X+ K. N1 r( h5 f+ r2 H, f( N! y+ @
50. jffs2_part_info:rootfs0,1220000
    8 F' `& |3 w* T/ {2 j+ Y* _. Y# C
51. ### JFFS2 loading '0uImage' to 0x44000000
    8 {3 K% }5 h/ j4 h& W8 @: E
52. Scanning JFFS2 FS: ..................... done.
    
53. ### JFFS2 load complete: 4344391 bytes loaded to 0x44000000
    
54. 127s product_vid = 158
    
55. <nand_read_skip_bad_,447>!mtdpart=0x0,offset=0x0,mtdpartoffset=0x0,mtdPartsize=0x180000,length=0x100000
    
56. lseek=0x42080800
    * z& C% _) D: B  W4 L7 \
57. cmdline=U-Boot V1.0.0P1N1 20210911001937
    
58. output gpio:58, value=1, 0
    9 k+ ~# v" A5 }3 Y2 n5 _
59. output gpio:59, value=1, 0
    " N% I, v5 W& b3 x7 y0 R5 t
60. ## Booting kernel from Legacy Image at 44000000 ...
    1 y! k9 o! J) O: u" }
61.    Image Name:   Linux Kernel Image
    ' [- z9 k: R) Q2 p& J
62.    Image Type:   ARM Linux Kernel Image (uncompressed)
    
63.    Data Size:    4344327 Bytes = 4.1 MiB
    
64.    Load Address: 40008000
    $ J( C; S4 k. R: F/ n) m- E
65.    Entry Point:  40008000
    
66.    Verifying Checksum ... OK
    
67.    Loading Kernel Image ... OK
    ! S* `+ K9 \4 @2 g& l, y  ~
68. OK
    
69. ----------------------
    2 J% W: s4 O, S
70. |-->setup versioninfo tag...
    
71. 
    
72. Starting kernel ...

复制代码

根据启动信息可以得知
7 A% q3 E1 E! \+ e2 Z0 w! U% k/ ocpu（ZX279127S@A9,1000MHZ）后面再吐槽它，内存（DRAM: 256 MiB），闪存用的美光（Micron SPI NAND MT29F2G01ABAGDWB 256MiB 3,3V）其实这个光猫也有USB接口，我测量过没有5V输出，如果想USB好用需要补元件。

使用工具软件打开光猫telnet并登录后查看mtd信息

1. / # cat /proc/mtd
   
2. dev:    size   erasesize  name
   % j+ B1 N/ T5 e' Z
3. mtd0: 10000000 00020000 "whole flash"
   ) r* _) h. L. @; |+ x# B4 m
4. mtd1: 00200000 00020000 "u-boot"
   ) C4 {; E; ~6 G
5. mtd2: 00200000 00020000 "others"
   
6. mtd3: 00200000 00020000 "parameter tags"
   5 N1 ~" [8 h9 X$ A5 ]" k# [6 ~
7. mtd4: 00200000 00020000 "wlan"
   " ?4 @% r, u" }
8. mtd5: 00800000 00020000 "usercfg"
   
9. mtd6: 00200000 00020000 "middleware"
   
10. mtd7: 03000000 00020000 "kernel1"
    
11. mtd8: 03000000 00020000 "kernel2"
    
12. mtd9: 01000000 00020000 "framework1"
    
13. mtd10: 01000000 00020000 "framework2"
    ' {: Z4 U6 `4 a1 t" H- ?
14. mtd11: 01800000 00020000 "preplugin_data"
    
15. mtd12: 05600000 00020000 "plugin_data"
    ' i; X+ T, V9 }/ u; r: W
16. mtd13: 02fe0000 00020000 "rootfs"

复制代码

可以看见有一个MTD0它就是一个完整的nand flash影像把它拷贝出来就是一个完整且连续的flash备份，有人会说下面不是有MTD1-13,分别拷贝不方便点吗？
4 V6 X% p% N$ w/ S- \4 S- O3 H( N, n1、mtd1-13 加起来是超过256MB的；
2、你不知道它mtd1-13在flash存储地址是不是按1-13这个编号连续分布的；
2 K; S4 y$ G1 F- ?1 j7 D* W
+ e! F  N1 q6 w+ D: I8 P我查过启动信息如下：（我没看出来有MTD地址分布信息）
9 `, Y1 [/ D8 }

1. /opt/cu/apps # ./busybox1 dmesg
   
2. NET: Registered protocol family 24
   1 f+ e' R- H, \0 k; f' Z
3. p p t p driver version 0.8.5
   
4. 127s doesn't have USB3.0,just return -ENODEV
   2 {. K% Z! P% v! i- E
5. **********TOP_CRM_BASE+0x2c=0x11393ff3******
   
6. **********TOP_CRM_BASE+0x2c=0x113f3ff3******
   
7. dwc2 9000000.usb: 1792 invalid for host_rx_fifo_size. Check HW configuration.
   + t7 C( i4 H3 ~+ J; `, a8 G
8. dwc2 9000000.usb: 1024 invalid for host_nperio_tx_fifo_size. Check HW configuration.
   
9. dwc2 9000000.usb: 1024 invalid for max_packet_count. Check HW configuration.
   
10. dwc2 9000000.usb: DWC OTG Controller
      a1 z, F3 s! a- L
11. dwc2 9000000.usb: new USB bus registered, assigned bus number 1
    8 \; |. k" f# a( D8 P; x# }
12. dwc2 9000000.usb: irq 60, io mem 0x00000000
    
13. usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
    8 g/ [6 V& i  [. k& a
14. usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
    . h/ w0 A+ F% u" y: G, a1 O! n+ G1 K$ W# {
15. usb usb1: Product: DWC OTG Controller
    ' q. w. {7 V" Z+ x" h+ k
16. usb usb1: Manufacturer: Linux 4.1.25 dwc2_hsotg
    
17. usb usb1: SerialNumber: 9000000.usb
    6 o2 ], ~' r6 O; p, G
18. hub 1-0:1.0: USB hub found
    
19. hub 1-0:1.0: 1 port detected
    
20. usbcore: registered new interface driver cdc_acm
    + X1 u, z. b+ y2 a/ R7 ~
21. cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
    5 W4 {- s0 k1 O  i5 F
22. usbcore: registered new interface driver usbserial
    
23. usbcore: registered new interface driver usbserial_generic
    ) |; g6 M' V  S" D) O$ Y7 ~! ^3 m
24. usbserial: USB Serial support registered for generic
    6 ^8 s; }) E7 }9 {8 _! Z; F
25. usbcore: registered new interface driver ch341
    
26. usbserial: USB Serial support registered for ch341-uart
    & J/ K) T9 k1 \) O/ Q% b6 k. {' @
27. usbcore: registered new interface driver cp210x
    8 V5 z) t) L3 P; Y4 F
28. usbserial: USB Serial support registered for cp210x
    
29. usbcore: registered new interface driver pl2303
    
30. usbserial: USB Serial support registered for pl2303
    1 p; ^% V: s0 L6 |# u2 U
31. mousedev: PS/2 mouse device common for all mice
    
32. I2C probe start!
    
33. zx_i2c_probe i2c-1 i2c-1->clk is ccdce7c0 ,clk rate is 100000000
    
34. I2C probe successed!
    
35. usbcore: registered new interface driver usbhid
    
36. usbhid: USB HID core driver
    : b# i2 }) ?1 M( J1 u% a
37. zx tempsensor: zx_bsp_tempsensor.regs = 0xf0500034,&(zx_bsp_tempsensor.regs->cfg)= 0xf0500034
    ( k  H) I! ~+ z, J. j
38. bsp_temp_start,val = 0x2ef
    
39. (458):creat proc files for temper sensor!!!
    7 I( Q& r5 D! h9 W- R2 ]
40. (463):temper sensor is running...
    - p1 h8 N8 S$ i9 w# C3 F" z
41. zx tempsensor: work clock 0
    & F$ [- _8 [2 G
42. zx tempsensor: selector0's int num 27 allocated.
    - i2 e$ q3 L& N; \+ T3 m) [
43. zx tempsensor: selector1's int num 28 allocated.
    * T' K/ u0 m6 v# x6 n5 s
44. zx tempsensor: selector2's int num 29 allocated.
    ) h2 ]$ m6 R. \' t1 e
45. Netfilter messages via NETLINK v0.30.
    
46. nf_conntrack version 0.5.0 (3372 buckets, 60000 max)
    - Q+ s6 M! ^& _9 V/ `  S# N
47. ip_set: protocol 6
    1 J9 R, s6 i. R" n5 a4 B( s) Y
48. gre: GRE over IPv4 demultiplexor driver
    
49. ip_tables: (C) 2000-2006 Netfilter Core Team
    
50. NET: Registered protocol family 10
    2 \* U' m# ^/ H, I3 `" E* l0 N. D- n
51. ip6_tables: (C) 2000-2006 Netfilter Core Team
    
52. sit: IPv6 over IPv4 tunneling driver
    & |3 k" y. ^/ [% N2 |
53. NET: Registered protocol family 17
    ' A( J5 D- v$ Z4 v
54. bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
    
55. Bridge firewalling registered
    
56. Ebtables v2.0 registered
    
57. l2tp_core: L2TP core driver, V2.0
    8 w! K  |# B5 V4 ?
58. l2tp_ppp: PPPoL2TP kernel driver, V2.0
    
59. 8021q: 802.1Q VLAN Support v1.8
    7 M/ @/ W+ A  Z; P* F- Q; z. j4 @
60. systools version:v0.7.5
    ; l0 h( `2 d. j. H
61. zte--oss cpu usage module init
    
62. DPI interface Loaded
    $ u8 e! W- f7 W) O# d/ j- P( k
63. e8_init OK!
    1 {( U/ F4 r- A
64. Registering SWP/SWPB emulation handler
    
65. FLowRL module init
    $ O9 a( c& P& @1 \/ `
66. DevBw module init
    
67. jffs2: notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    + _2 U. @0 a9 }) Z
68. VFS: Mounted root (jffs2 filesystem) readonly on device 31:13.
    1 a4 o8 i( p! W1 F% Y! n. m& S8 r
69. Freeing unused kernel memory: 212K (c07d3000 - c0808000)
    
70. This architecture does not have kernel memory protection.
    
71. jffs2: notice: (532) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    4 P2 s" |, t5 `. C
72. jffs2: notice: (577) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    ( x% V1 H9 [. w7 M9 V! L) ]
73. jffs2: notice: (585) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    
74. jffs2: notice: (587) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    . ~" f: j# g1 }% m
75. 11930:23:02 [Klogfile][Error] [(1348)CheckLogConfFile] CheckLogConfFile%CheckRestartCntConfFile
    
76. 
    7 |' M% W; v# J* H, l# W' Q. S
77. jffs2: notice: (578) check_node_data: wrong data CRC in data node at 0x006d5d7c: read 0x19d3a03, calculated 0x1e78a0ef.
    
78. ubi0: attaching mtd12
    . H2 @6 l5 h' g+ {  A/ J
79. ubi0: scanning is finished
    
80. ubi0: attached mtd12 (name "plugin_data", size 86 MiB)
    
81. ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
    
82. ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
    8 k- q6 q; P  Y$ a& Z3 _
83. ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
    
84. ubi0: good PEBs: 688, bad PEBs: 0, corrupted PEBs: 0
    
85. ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
    
86. ubi0: max/mean erase counter: 14/9, WL threshold: 4096, image sequence number: 2012089330
    8 z3 O$ m1 ^& u3 ?8 G% y& C" Q
87. ubi0: available PEBs: 0, total reserved PEBs: 688, PEBs reserved for bad PEB handling: 16
    + L) J  U6 y$ O7 p2 O# V6 s3 D
88. ubi0: background thread "ubi_bgt0d" started, PID 601
    6 Q2 A/ [: Y( [1 x
89. UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 607
    
90. UBIFS (ubi0:0): recovery needed
    
91. UBIFS (ubi0:0): recovery completed
    
92. UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "plugin_ubifs"
    - b4 B" j. F! K. \" T/ g( H
93. UBIFS (ubi0:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
    
94. UBIFS (ubi0:0): FS size: 83423232 bytes (79 MiB, 657 LEBs), journal size 4190208 bytes (3 MiB, 33 LEBs)
    
95. UBIFS (ubi0:0): reserved for root: 3940284 bytes (3847 KiB)
    % |' T2 Y$ k2 \! _. V: L
96. UBIFS (ubi0:0): media format: w4/r0 (latest is w4/r0), UUID 156BD46D-0725-43B0-AA2C-8A8DCD1D83F4, small LPT model
    
97. jffs2: notice: (618) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    2 p; E- l4 E! D* z! ^
98. lo up
    
99. mux[0]=3f7ffffa
    ' m; w: |& T: Y. u6 x
100. mux[1]=3ffffeff
     , j9 C2 \: l* f: V6 c
101. mux[2]=19ff0555
     " g& X: y& g) g' |
102. mux[3]=6be1b
     
103. storage_wakeup_proc_create success!
     
104. verinfo=U-Boot V1.0.0P1N1 20210911001937 0x1200000 0x0 0x8f 0x83
     
105. can find /usr/java/osgi_verosgi_version_info_get error!
     
106. data_in=0x0
     $ X3 G* _$ V/ K% f. H' I7 v
107. data_in=0x0
       M% a% X: [! O6 V% o) a5 e
108. >>TagaramodInit the typeindex:  5
     
109. >>TagaramodInit the board_name:  F657GV9 ,wan=0x40
     
110. pon init
     
111. ZX_PA_BUF_BASE0=4dea0000
     % _/ Y5 |, ]8 q0 t" V
112. ZX_VA_BUF_BASE0=cdea0000
     
113. ZX_BP_BUFFER_BASE=4dec0000
     ; w6 v" V/ r  \% V  u
114. ZX_DESC_BASE=4ee80000
     
115. ZX_TX_UP_DESC_BASE=4ef40000
     
116. ZX_TX_DN_DESC_BASE=4ef50000
     
117. ZX_BPPE_SW_BASE=4dea0000
     ! y+ c; e# T& p  T2 E; b+ x
118. ZX_BP_BUFFER_SW_BASE=4dec0000
     
119. ZX_DESC_SW_BASE=4ea00000
     
120. ZX_TX_UP_DESC_SW_BASE=4eac0000
     
121. ZX_BPPE_BASE_127S=4eae0000
     4 ]9 W7 {! O; p# U
122. ZX_BP_BUFFER_BASE_127S=4eb02000
     0 u; Q8 v6 s1 N' m8 O8 i" J
123. BP_BUFFER_SIZE_127S=b40000
     
124. ZX_VA_TX_DN_DESC_BASE=cef50000
     
125. BPPE_POOL_SIZE=1c00
     2 L% n5 c. |6 H2 f7 K# k; [, w
126. NORMAL_BP_BUFFER_SIZE=fc0000
     ' }/ c/ n! a! g
127. JUMBO_BP_SIZE=2800
     
128. JUMBO_BPPE_POOL_SIZE=0
     
129. BP_BUFFER_SIZE=fc0000
     " z# l5 W4 M. F  H  `
130. lan_up=0, lan_up_port=0
     7 {" X: u$ g2 F: ?! }- v
131. the pon mode is 40
     # d3 f  b4 k6 \4 R; C
132. lan_up=0, lan_up_port=0
     4 }3 E7 y0 Y  z5 ~. F9 t
133. g_pon_irq=36,d1000000,f0400000,f0500000,f0600000,d0e00000
     & A& r, J* c# R% I
134. get npp irq succeed,g_npp_irq:38
     
135. get tm irq succeed,g_tm_irq:41 tm_base:0xf4340000
     / G: x8 q' E& Z9 D
136. get pp irq succeed,g_pp_irq:37
     : }: r: G2 D# z  M# G
137. get idm irq succeed,g_idm_irq:39
     
138. enter ref_clk_set.. mode = 0 .
     
139. enter pll_cfg_fractional
     1 m5 n& C+ n, V! `' b$ B
140. ref_clk_set success!
     3 D& O/ \3 i8 f5 _+ G3 z  s  [
141. serdes band cpu_temper:32 coarse:0x29
     ; F9 v# X; Z/ [
142. band calc fin
     ; Q, c: Q: ?& o/ D" A6 i
143. pon tm init
     
144. enter pon_tm_bppe_pool_init
     # P& u2 V+ k! ]" O4 I2 z7 |3 P
145. bppe_va_addr = 0xceae0000
     
146. jumbo_bppe_va_addr = 0xceaf0000
     
147. BMU_JUMBO_BPPE_SW_PTR  =0x0    (JUMBO_BPPE_SW_POOL_SIZE)<<16=0x0
     
148. netif_napi_add() called with weight 512 on device pon
     2 H2 b5 @- p# Q7 P
149. DMA_UP_DESC_CNT = 0x0
     
150. pon_tm net init ok,272/176
     1 j/ n  U# t1 F/ U
151. pon_pp init
     
152. pon_npp init
     
153. idm_status_proc success!
     % Z  L* c3 }0 N& p5 C& S9 p
154. idm_desc_init d0c35000/4c980000
     " u  h8 _' Q. H! |  J
155. request idm irq succeed
     ) e- N  M3 i" d
156. idm net init ok
     
157. switch_phy_int_check 0
     - S3 h. u7 s% G2 r6 p6 S
158. mac 0 link down
     / v* H2 `, j7 Z7 g6 Q
159. switch_phy_int_check 1
     
160. mac 1 link down
     
161. switch_phy_int_check 2
     7 B9 w6 {! @; ^3 m1 f. S
162. mac 2 link down
     
163. switch_phy_int_check 3
     
164. mac 3 link down
     
165. register fpga driver success, major=222
     
166. register peripheral success, major = 106
     
167. = TM Module SYS FS Init ended successfully =
     
168. tm_initModule begin...
     
169. enter tm_sdk_init  
     ( F* q5 p3 ?; o& j& n  C/ S
170. api lock init!!
     5 {9 I8 ]  e- t, B: ?* f/ G
171. tm_initModule end...
     0 Q% Q1 H. P! M/ J
172. hw_power_optx_get_fordg:txdisable=0
     & f- J2 y2 C; @$ z' s) c
173. Kmodule ZX279511.ko insmod successfully !
     5 E& C. d1 \1 V3 d  d
174. bob is not GN25L95: 40
     ' m/ }) z7 v0 @' N0 H0 j2 n
175. pon up
     
176. ethdriver_init....
     
177. g_mii_dev_name[0]  sw
     3 b( b& x1 K  F
178. g_mii_dev_name[1]  pon
     
179. sw up
     
180. zteGpmac_devReg begin...
     
181. zteGpmac_devReg end...
     . a. l2 E# D+ |6 n4 B& \
182. enter zteGponCpuTypeAddrSet
     0 |5 D) ~9 z. o
183. *
     ! u& s: K' p) ~% M( e1 j
184. asicGlbDb[97], 0x46,0x31007,0x0
     
185. zteGpmac_initModule begin...
     ! Y, q8 o# s8 f1 b* E0 Q$ K4 o
186. === GponMac Supported MaxTcont: 16 MaxPLI: 800B ===
     
187. htb debug 1 =====> inCnt =0,outCnt=0
     1 C- T0 q2 T4 }8 C
188. ##huoqf zteGponAsicStarttimeChkResultInit write cfg=10
     / M- `, _% h1 \% X; J1 ?' n
189. ##huoqf zteGponAsicStarttimeChkResultInit read cfg=10
     % e% o- F; i. o" `+ H8 v; z
190. = PON Module Operate ended successfully =
     * ?. X3 R, M) U$ C1 q2 _8 ^! I
191. DEbug: GPON PIN_MUX_REG2:(0x19ff0555)
     " f% H% S/ l1 H, r$ R) K
192. DEbug: GPON GPIO_PDD_REG:(0xfac)
     4 C) G  ^" o' S8 A3 P: ^& I
193. DEbug: GPON GPIO_POSEDGE_REG:(0x4)
     
194. DEbug: GPON PIN_MUX_REG3:(0x2be1b)
     / w3 m7 M3 V( \1 d1 r
195. create zteGpon_rei_task ok!
     7 x' B$ e( R# w# z9 B
196. = GMAC Module SYS FS Init ended successfully =
     3 U$ V+ M8 U7 n0 e9 |; x
197. zteGpmac_initModule end...
     ; B! J7 {: \1 x# o: U) G( k
198. gpon_Init ok
     $ S! S" u0 ]6 v! }8 N
199. gpondrv g_OnuType is 2
     : J+ t5 [) v% u) S4 u$ @) P* C! v8 S$ a
200. 11930:23:06 [KMONITOR][Warn] [monitor.c(607)MontorSendMsg] netlink_unicast failedmsgid = 0xa5c2, ptr = bf26dd20, len = 4
     * c7 H- }0 H( s! I' Q+ V
201. omci up
     
202. Init switch module
     
203. unicnt 4, wancnt 1, wifi cnt 0, all ports 5, portmask 0x0000002f
     7 b+ E* a, K! f' U$ L
204.   Onu type is 1,Wan type is 4
     
205. switch config GPON HGU mode!
     
206. protocol fail, error deal 66
     
207. [TM][dpa_set_protocol_type_i_act] failed
     
208. protocol fail, error deal 65
     + N$ [+ [  p. U- X
209. [TM][dpa_set_protocol_type_i_act] failed
     ( R6 S9 P, N& }. r% [" [
210. -------chip_tm_init end-----
     " M6 R( r  ?9 ~  u8 f2 V3 k, A, Q
211. [SW][sw_init_switch] l2_fast init
       q7 ~8 e7 M- k; ]4 T
212. [SW]set cpu queue rate limit to 8000pps
     - d6 s$ h9 y0 Q% J0 x; Z' k) k. S
213. tm_port_egress_traffic_sharp_set p_port:5 p_ena:1 p_band_width:2048
     
214. 
     
215. Capacity=256000tm_port_egress_traffic_sharp_set p_port:6 p_ena:1 p_band_width:2048
     
216. 
     8 ^, e- q0 o; p- B9 Z+ S% I
217. Capacity=256000[SW][sw_init_switch] reg hff
     
218. [SW][sw_init_switch] reg get statistics
     * {5 g" l8 D  v, q
219. Init switch module Success
     4 e( E/ W' Y) s* K
220. bsp_i2c_probe 0x50 success!
     
221. vendor name = ZTE_PX20+_G
     - ~1 i3 L& e1 {$ k2 O4 N
222. optical PN(0x60) =
     ! C# {9 K# q# \3 G, \
223. optical PN(0x28) = ZX279511
     ' z6 x- h6 ^) W! i* j
224. tdm: exports duplicate symbol tdm_ch_close (owned by kernel)
     
225. udpwatchd inited!
     
226. kudp  inited!
     
227. Init codec v2.3(2019-05-17)!
     % _  S- K2 D) Z+ y
228. idm0 up
     
229. idm1 up
     
230. redirusb_init,no usb dev!
     
231. random: dbus-uuidgen urandom read with 47 bits of entropy available
     
232. gpondrvCfgXGRegInfoAdapter not support now!
     , ^6 Q; c% n+ q+ F# [
233. === GponMac Supported MaxTcont: 8 MaxPLI: 1536B ===
     
234. htb debug 1 =====> inCnt =0,outCnt=0
     
235. IPv6: ADDRCONF(NETDEV_UP): br0: link is not ready
     , [8 t$ r  A% [  R" ?
236. br0 up
     4 k; {& T5 u5 G' \( {3 T
237. ethdrv_dev_ioctl  ,brdev_set.port_id 0 ,brdev_set.name eth0 ,brdev_set.flag 0
     
238. eth0 up
     
239. ethdrv_dev_ioctl  ,brdev_set.port_id 1 ,brdev_set.name eth1 ,brdev_set.flag 0
     5 c" ]+ x4 X1 a
240. eth1 up
     
241. ethdrv_dev_ioctl  ,brdev_set.port_id 2 ,brdev_set.name eth2 ,brdev_set.flag 0
     
242. eth2 up
     ) E- L$ d+ u$ I" @. f6 D
243. ethdrv_dev_ioctl  ,brdev_set.port_id 3 ,brdev_set.name eth3 ,brdev_set.flag 0
     
244. eth3 up
     5 L- |# \  j! l$ ]$ o# {
245. tm_port_egress_traffic_sharp_set p_port:3 p_ena:0 p_band_width:0
     , p. v/ Z$ Z) S# H  ?% p# J9 v
246. 
       u+ ?: m- ]' E& _' O
247. Capacity=200000tm_port_egress_traffic_sharp_set p_port:2 p_ena:0 p_band_width:0
     5 \; i9 T. f5 d( k& w% X2 w6 r
248. 
     
249. Capacity=200000tm_port_egress_traffic_sharp_set p_port:1 p_ena:0 p_band_width:0
     + b1 A  g9 r" T! {6 g( k1 [$ h
250. 
     + ^1 [( C1 B( i) |2 h/ l8 i
251. Capacity=200000tm_port_egress_traffic_sharp_set p_port:0 p_ena:0 p_band_width:0
     
252. 
     
253. Capacity=200000
     # U9 G6 a* L" b# o
254. switch_phy_int_check 1
     
255. pon0 up
     0 r- B9 X6 x) l! {  L& o( ~
256. set_netdev_type dev (pon0) type (300) vendor name = ZTE_PX20+_G
     
257. optical PN(0x60) =
     " W% z" ]2 ~: s) \
258. optical PN(0x28) = ZX279511
       @* t2 F7 J4 P! V  u1 ]3 A/ U" o
259. device eth0 entered promiscuous mode
     
260. set_netdev_type dev (eth0) type (800)
     
261. device eth1 entered promiscuous mode
     & V/ [# S* U. x, j
262. set_netdev_type dev (eth1) type (800)
     
263. device eth2 entered promiscuous mode
     
264. br0: port 3(eth2) entered forwarding state
     8 F+ \; m- A" Y/ H. Q  W* ~
265. br0: port 3(eth2) entered forwarding state
     
266. IPv6: ADDRCONF(NETDEV_CHANGE): br0: link becomes ready
     % ^4 d5 r6 x$ V. u) i; W# f9 e
267. set_netdev_type dev (eth2) type (800)
     + R/ u2 `' q4 [0 o# g: Z
268. device eth3 entered promiscuous mode
     
269. set_netdev_type dev (eth3) type (800) set_netdev_type dev (pon0) type (300) set_netdev_type dev (pon0) type (300) set_netdev_type dev (pon0) type (300)
       p' B& ?- T' B! g
270. ch:0 pcm mode:G711A_U
     / Y; l6 K1 G% P0 _- ?6 A1 n
271. Siliconlab chip id error! 0x0
     
272. cmd [ck 1389 1] not found
     6 G" h- E8 u8 h% i# R1 _
273. ====EVENT_O7_STATE_SAVE OFF====
     * o# w1 x3 W/ U% c
274. cmd [ck 1392 1] not found
     
275. cmd [ck 1387 1] not found
     
276. random: nonblocking pool is initialized
     
277. device br0 entered promiscuous mode
     
278. tm_port_egress_traffic_sharp_set p_port:5 p_ena:0 p_band_width:0
     / A, ^; H. p0 A% e) z
279. 
     6 {/ G+ b* R0 N" o' u+ {
280. Capacity=200000tm_port_egress_traffic_sharp_set p_port:6 p_ena:0 p_band_width:0
     8 @) K' C  j$ H
281. 
     
282. Capacity=200000
     
283. overlayfs: missing 'workdir'

复制代码

4 j; J0 F4 O8 o8 N2 _但是将这个mtd0自接考出来是不容易的，因为它的内存也就256MB，临时分区也容不下这个falsh影像
) N, r1 j: @+ ~0 {

1. /opt/cu/apps # df
   
2. Filesystem           1024-blocks    Used Available Use% Mounted on
   7 e4 ^+ O$ Y( S/ p
3. /dev/root                49024     37824     11200  77% /
   
4. /dev/mtdblock3            2048       404      1644  20% /tagparam
   
5. cgroup_root             108016         0    108016   0% /sys/fs/cgroup
   8 I, O- c( R( X/ R! E
6. none                     21604         0     21604   0% /run
   7 E& |6 [2 n3 a: s( d0 S2 m
7. none                      5120         0      5120   0% /run/lock
   
8. none                    108016         0    108016   0% /run/shm
   
9. tmpfs                    20480       448     20032   2% /var
   
10. tmpfs                    81920      2800     79120   3% /upgtempfile
    6 C0 w% n# @" z; [  M
11. tmpfs                     2048         0      2048   0% /mnt
    # k+ B( s2 B4 I+ P. W2 L7 x
12. tmpfs                    15360         4     15356   0% /tmp
    . A( ]5 Y/ x% \
13. /dev/mtdblock5            8192       640      7552   8% /userconfig
    : f* w5 D+ H% m
14. /dev/mtdblock6            2048       384      1664  19% /usr/local/ct
    
15. /dev/mtdblock11          24576      6232     18344  25% /usr/tmp
    5 v) k: S0 M# ], p  R5 n
16. /dev/loop0                5376      5376         0 100% /usr/pre_plugin
    " ^0 a& A5 m; f. q" l  r' Q7 b; I% a
17. ubi0_0                   74660      2864     67948   4% /opt/cu/apps
    
18. /dev/mtdblock4            2048       436      1612  21% /wlan
    
19. overlay                  74660      2864     67948   4% /CuInform
    
20. tmpfs                     5240        24      5216   0% /CuInform/tmp
      w5 E/ j6 `! F6 L; q; p! ~+ a% Q% u
21. overlay                  74660      2864     67948   4% /usr/sbin
    ) N) s& O* a* y/ C* T
22. /dev/mtdblock9            4352      4352         0 100% /opt/cu/framework

复制代码

可以看见也就/upgtempfile 文件夹可用，大小为80MB，远远不能满足需求。
$ {  w) `/ Z+ {) N+ a* ?6 ?
以上都是分析，下面是操作步骤：
方法一：采用压缩方法在拷贝flash的时候边拷贝边压缩，然后将压缩后的文件传给电脑：
; h  Y1 @( ?3 k- ]2 I- p: Q

1. dd if=/dev/mtd0 | gzip > /upgtempfile/mtd0.gz

复制代码

我使用上述方法临时目录还是无法容纳，只有用更强的压缩方式，linux中有一个.xz文件它使用LZMA的压缩方式，LZMA压缩比相比较zip高不少，但在busybox中的命令xz只能解压这种文件，无法压缩。只能从网上下载完整代码自己编译一个。

1. /opt/cu/apps # ./xz-v5 -H
   
2. Usage: ./xz-v5 [OPTION]... [FILE]...
   
3. Compress or decompress FILEs in the .xz format.
   ) F; ], \7 x- J6 G+ e7 R
4. 
   
5. Mandatory arguments to long options are mandatory for short options too.
   
6. 
   / h& Z, X3 E& u& \" V& V; p
7. Operation mode:
   ( q! ?$ k2 D! Q- K* t/ d. S
8.   -z, --compress      force compression
   : |. ?7 Z# G1 G8 {2 d4 ^
9.   -d, --decompress    force decompression
   0 U* m4 f& ]3 w2 _* S( R
10.   -t, --test          test compressed file integrity
    
11.   -l, --list          list information about .xz files
    
12. 
    + l6 Q1 o6 v  d! U  X
13. Operation modifiers:
    ) k5 n5 p' \  e" S# G" r
14.   -k, --keep          keep (don't delete) input files
    ) ~1 [+ b# X6 [6 u& f0 P
15.   -f, --force         force overwrite of output file and (de)compress links
    # s; O6 m9 H1 i
16.   -c, --stdout        write to standard output and don't delete input files
    
17.       --single-stream decompress only the first stream, and silently
    
18.                       ignore possible remaining input data
    
19.       --no-sparse     do not create sparse files when decompressing
    6 n/ D, M! \0 d% K& q# `- u
20.   -S, --suffix=.SUF   use the suffix `.SUF' on compressed files
    : {6 W% Q2 F+ I0 E( c
21.       --files[=FILE]  read filenames to process from FILE; if FILE is
    5 w9 ?. f6 x3 P$ n- c7 h4 y
22.                       omitted, filenames are read from the standard input;
    
23.                       filenames must be terminated with the newline character
    
24.       --files0[=FILE] like --files but use the null character as terminator
    , T, v) w: D+ }/ Z  Y& I2 G
25. 
    
26. Basic file format and compression options:
    1 \. ~* a9 l) E
27.   -F, --format=FMT    file format to encode or decode; possible values are
    * x4 F/ P" |; D3 @0 X. f
28.                       `auto' (default), `xz', `lzma', and `raw'
    
29.   -C, --check=CHECK   integrity check type: `none' (use with caution),
    
30.                       `crc32', `crc64' (default), or `sha256'
    
31.       --ignore-check  don't verify the integrity check when decompressing
    
32.   -0 ... -9           compression preset; default is 6; take compressor *and*
    
33.                       decompressor memory usage into account before using 7-9!
    
34.   -e, --extreme       try to improve compression ratio by using more CPU time;
    
35.                       does not affect decompressor memory requirements
    
36.   -T, --threads=NUM   use at most NUM threads; the default is 1; set to 0
      `% @, }# |, B- y1 E) E$ M
37.                       to use as many threads as there are processor cores
    
38.       --block-size=SIZE
    
39.                       start a new .xz block after every SIZE bytes of input;
    
40.                       use this to set the block size for threaded compression
    
41.       --block-list=SIZES
    
42.                       start a new .xz block after the given comma-separated
    : h+ U# L- }. K& U' C8 i
43.                       intervals of uncompressed data
    
44.       --flush-timeout=TIMEOUT
    
45.                       when compressing, if more than TIMEOUT milliseconds has
      g! s: f( u+ ~2 s" v
46.                       passed since the previous flush and reading more input
    
47.                       would block, all pending data is flushed out
    
48.       --memlimit-compress=LIMIT
    
49.       --memlimit-decompress=LIMIT
    
50.   -M, --memlimit=LIMIT
    
51.                       set memory usage limit for compression, decompression,
    
52.                       or both; LIMIT is in bytes, % of RAM, or 0 for defaults
    % j3 p$ N$ o( Q1 w
53.       --no-adjust     if compression settings exceed the memory usage limit,
    % a* Z1 S, y2 |0 n+ h! p2 r$ x; I
54.                       give an error instead of adjusting the settings downwards
    
55. 
    & D7 G2 }. L# @% W1 d
56. Custom filter chain for compression (alternative for using presets):
    - F1 z3 }) e* v' X9 N: w; z
57.   --lzma1[=OPTS]      LZMA1 or LZMA2; OPTS is a comma-separated list of zero or
    
58.   --lzma2[=OPTS]      more of the following options (valid values; default):
    % {  I. S" y2 K# H' R
59.                         preset=PRE reset options to a preset (0-9[e])
    + x' @/ `3 n. p* [. {
60.                         dict=NUM   dictionary size (4KiB - 1536MiB; 8MiB)
    
61.                         lc=NUM     number of literal context bits (0-4; 3)
    
62.                         lp=NUM     number of literal position bits (0-4; 0)
    
63.                         pb=NUM     number of position bits (0-4; 2)
    5 c8 m. _8 `0 [
64.                         mode=MODE  compression mode (fast, normal; normal)
    
65.                         nice=NUM   nice length of a match (2-273; 64)
    
66.                         mf=NAME    match finder (hc3, hc4, bt2, bt3, bt4; bt4)
    
67.                         depth=NUM  maximum search depth; 0=automatic (default)
    , c; M1 t8 o% R' W
68. 
    - _! r7 v3 D+ r" W
69.   --x86[=OPTS]        x86 BCJ filter (32-bit and 64-bit)
    9 I8 n: k6 e- {. V# K( O; J: o
70.   --powerpc[=OPTS]    PowerPC BCJ filter (big endian only)
    & D: s( [& k' J, c/ ^  S$ Y: R# k
71.   --ia64[=OPTS]       IA-64 (Itanium) BCJ filter
    6 b  d6 ~% f, w9 x6 |
72.   --arm[=OPTS]        ARM BCJ filter (little endian only)
    
73.   --armthumb[=OPTS]   ARM-Thumb BCJ filter (little endian only)
    2 P0 ?# y5 r9 z+ Y2 r8 m. M
74.   --sparc[=OPTS]      SPARC BCJ filter
    / a& _: I$ Q; E; ~$ b9 k* s" W
75.                       Valid OPTS for all BCJ filters:
    # i8 K2 ^% Z/ F4 c& P( D
76.                         start=NUM  start offset for conversions (default=0)
    
77. 
    - v" S* O1 v- m& g: ^! H
78.   --delta[=OPTS]      Delta filter; valid OPTS (valid values; default):
    ; a- z0 ]( F: {& i. j. M. C  `# G
79.                         dist=NUM   distance between bytes being subtracted
    
80.                                    from each other (1-256; 1)
    
81. 
    9 s/ M+ C6 `% m- L
82. Other options:
    . G& H& b  |% b+ c# k& S0 u" s- }: x
83. 
    
84.   -q, --quiet         suppress warnings; specify twice to suppress errors too
    3 [6 A4 {1 u% b$ W' ?
85.   -v, --verbose       be verbose; specify twice for even more verbose
    % g; F: ~8 z% w9 a) Q  q
86.   -Q, --no-warn       make warnings not affect the exit status
    + s+ k; S  d5 F- q& k/ J, }. m4 `
87.       --robot         use machine-parsable messages (useful for scripts)
    
88. 
    ! _6 w6 Y# r& c% g4 G
89.       --info-memory   display the total amount of RAM and the currently active
    5 K* N- D9 g5 K1 {6 |3 P, Q1 ]4 A
90.                       memory usage limits, and exit
    
91.   -h, --help          display the short help (lists only the basic options)
    3 T# k1 o% e7 R
92.   -H, --long-help     display this long help and exit
    
93.   -V, --version       display the version number and exit
    2 J( a4 {, K/ l4 m0 A& H: b
94. 
    3 l1 O; F' t7 |, D& C$ Y4 ?
95. With no FILE, or when FILE is -, read standard input.
    
96. 
    
97. Report bugs to <lasse.collin@tukaani.org> (in English or Finnish).
    
98. XZ Utils home page: <https://tukaani.org/xz/>

复制代码

    到这个地方我走了一段弯路，这里要吐槽这个中兴的这个 ARM cpu （ZX279127S@A9,1000MHZ）TNN的看名字用的是A9并且查看cpu信息用的是ARMv7 指令集，编译好的文件在板子上就是不能跑，查了不短的时间才发现这个cpu要用ARMv5 指令集方式编译才能跑起来，典型的挂羊头卖狗肉。

1. /opt/cu/apps # cat /proc/cpuinfo
   ; g$ b! h# X3 a2 F% }$ b( |: L
2. processor       : 0
   # S8 _2 K$ d6 k0 O6 k: a
3. model name      : ARMv7 Processor rev 1 (v7l)
   
4. BogoMIPS        : 1987.37
   
5. Features        : half fastmult edsp tls
   8 e6 M, U, E, s" M: \! Q6 e! p
6. CPU implementer : 0x41
   1 I$ ]& g' n, J4 O( G+ [! c
7. CPU architecture: 7
     n# b$ i! I) m2 {( s' H
8. CPU variant     : 0x4
   
9. CPU part        : 0xc09
   
10. CPU revision    : 1
    * [" j! W* Y# l) o
11. 
    
12. Hardware        : ZTE ZX27912X (Device Tree)
    
13. Revision        : 0000
    # l  g0 m: V. ]- S& z' [6 W+ T* U
14. Serial          : 0000000000000000

复制代码

5 Y, I; _) u) l+ m后面就简单了， 压缩后的文件为76.1 MB (79,894,956 字节)
& I; ?6 b: O; x

1. /opt/cu/apps/busybox1 dd if=/dev/mtd0 |/opt/cu/apps/xz-v5 -M32MB>/upgtempfile/mtd0.xz    （边拷贝边压缩，用-M32MB参数是因为LZMA压缩特别占用内存，如果不限制使用内存，光猫在拷贝过程后期可能因为内存溢出而重启，我这款就重启了2次，后来加了参数就ok了）

复制代码

这个busybox1 文件也是我传到光猫的，光猫内置busybox文件很简化（有tftp及chmod ），但没有包含dd命令

方法二：
在以上过程中我还参考网上信息Linux 下的dd命令使用详解以及dd if=/dev/zero of=的含义发现有另外一种方式使用netcat（简称nc）传数据，这是个非常有名的工具在busybox中集成了它的简化版，busybox windows版本也可以在 https://frippery.org/files/busybox/ 下载到

1、先在windows中执行命令：（接收数据端）

1. busybox nc -l -p 12345 >mtd0

复制代码

2、在光猫中执行命令：（传输数据端）

1. /opt/cu/apps/busybox1 dd if=/dev/mtd0 | /opt/cu/apps/busybox1 nc 192.168.1.2 12345

复制代码

我这里每秒能传300-400KB的数据，整个传输过程大约需要13分钟。


最后留下文件：
/ h7 b, q# b; E: U- U: _busybox for windows
5 L1 }8 @$ ]- H( H
0 x8 B1 n& x: ^8 k

busybox for Arm 使用静态编译，文件较大，但无需另外的库支撑，直接使用

! D# K9 ]  D$ v7 |
" b# {) I6 |. a/ e
9 J: G; s# A% u1 J/ ^" I0 pxz for Arm 使用静态编译，文件较大，但无需另外的库支撑，直接使用
; z( G& j+ i9 r+ e' L

撒大地方

大神牛逼

v208cgd

感谢！为技术网添砖加瓦！

qq519948746

我去 有必要这么麻烦么，光猫都带tftp小型文件传输服务，在dev目录下 执行tftp -pl mtd0 你电脑的IP   在电脑上打开tftp服务端  想备份哪个都可以啊

jiuweiljp

qq519948746 发表于 2024-3-4 17:41
我去 有必要这么麻烦么，光猫都带tftp小型文件传输服务，在dev目录下 执行tftp -pl mtd0 你电脑的IP   在电 ...

  t3 v- ~0 r; ?" t8 k  ], g受教了。这个办法好，测试了下每秒约800+KB/S，256MB需要约6分钟。

stanmcquay

谢谢楼主分享