大容量Nand Flash 光猫固件备份方法

jiuweiljp

  F1 ^* L! o, H5 i0 K使用条件：
* w  Z  P5 A) w& c     1、有usb接口并且能驱动U pan的无视这个方法；
, {: W% D8 l  G+ I! d     2、光猫不能telnet，并没有tftp或者wget、chmod命令也可以不用看；

正文如下
手上有一个闲置的中兴光猫F657GV9，焊接TTL线后启动信息如下（可无视）：
  Z0 |! }% G& }3 Y- e3 p8 \

1. U-Boot 2013.04 (Sep 11 2021 - 00:00:57)
   
2. 
   
3. CPU  : ZX279127S@A9,1000MHZ
   
4. Board: ZXIC zx279127sevb
   # R& e% D" Y* s) q! J8 A; W7 T. |
5. 127s product_vid = 158
   / v' G, a) V1 ^9 b( }
6. DRAM:  256 MiB
   
7. 127s product_vid = 158
   ; P" F" Z$ R' ^8 W* d
8. ,10000000,50000000
   2 ~6 C' y* h) n, @& y3 s8 x
9. cpuid=27912710
   
10. 127s pinmux: 3f7ffffa  3ffffeff  19ff0555  6be1b
    ( }6 A: n# [; _4 s/ x
11. 127s product_vid = 158
    
12. bootsel=3
    
13. NAND:  
    
14. Manu ID: 0x2c, Chip ID: 0x24 (Micron SPI NAND MT29F2G01ABAGDWB  256MiB 3,3V)
    
15. 256 MiB
    
16. <nand_read_skip_bad_,447>!mtdpart=0x1,offset=0x0,mtdpartoffset=0x180000,mtdPartsize=0x80000,length=0x20000
    5 q! w4 U$ \: h8 C; B4 W% Y9 L
17. In:    serial
    
18. Out:   serial
    . i) M" ~& i4 j" z
19. Err:   serial
    
20. clk_pll env is not setted, core clk won't change
    : G* b2 }$ X, U0 [9 i: v6 k& m) f
21. Net:   enter ref_clk_set.. mode = 0 .
    " J" d0 c4 Q% N1 n) c! W" u  P
22. enter pll_cfg_fractional
    
23. ref_clk_set success!
    5 i+ L# t) {" h& s8 q- Q
24. gpon serdes init
    
25. addr 0x9400002c before value is 11000013
    
26. addr 0x9400004c after value is 11003ff3
    
27. eth0
    0 X. ]* D3 q. I6 z$ @& P
28. sec mode!
    
29. 
    + C" f$ L: Z. n( S$ K" i/ \
30. Hit 1 to upgrade software version
    
31. Hit any key to stop autoboot:  0
    . g. v0 U, p# i3 S) t# o
32. addr=1200000
    
33. addr=4200000
    
34. select=0x0
    ; h2 Q- B" P- Y2 ]4 {/ X+ T
35. search=0x2
    
36. <nand_read_skip_bad_,447>!mtdpart=0x6,offset=0x0,mtdpartoffset=0x200000,mtdPartsize=0x200000,length=0x1000
    * v: y, }# |/ M5 S
37. tmp=0x00000000, value=0
    $ @, C% K0 z, P+ }+ v
38. select=0x0
    
39. search=0x2
    " s1 S5 D$ Y- ~+ K" K% Q. O% r' d
40. search->result[0].entry=1200240
    : \# `  o; w+ A% ^) }* R
41. <nand_read_skip_bad_,447>!mtdpart=0x2,offset=0x0,mtdpartoffset=0x1200000,mtdPartsize=0x3000000,length=0x23e0000
    
42. RSA Verify OK
    . x) o3 s3 ?( g
43. 
    
44. ---mtdparts_init--current_mtd_partnum=0-
    0 J0 V; i/ s' z
45. dev id: type = 2, num = 0, size = 0xffffffff, mtd_id = single part
    
46. part  : name = rootfs0, size = 0x023c0000, offset = 0x01220000
    
47. part  : name = rootfs1, size = 0x023c0000, offset = 0x04220000
    1 U, A4 ~1 X& P) l
48. 
    
49. --- jffs2_part_info: partition number 0 for device nand0 (single part)
    * }8 }1 g6 I2 K9 f2 S- H* A( ]
50. jffs2_part_info:rootfs0,1220000
    5 [6 ^5 D3 o) i6 Y2 x2 e3 F, p
51. ### JFFS2 loading '0uImage' to 0x44000000
    
52. Scanning JFFS2 FS: ..................... done.
    
53. ### JFFS2 load complete: 4344391 bytes loaded to 0x44000000
    / G' K2 t& i" S- p' f& h
54. 127s product_vid = 158
    
55. <nand_read_skip_bad_,447>!mtdpart=0x0,offset=0x0,mtdpartoffset=0x0,mtdPartsize=0x180000,length=0x100000
    
56. lseek=0x42080800
    % Y3 X4 Z1 Y+ j5 O9 O5 y) c
57. cmdline=U-Boot V1.0.0P1N1 20210911001937
    ! q, c* G- `" P! s. \
58. output gpio:58, value=1, 0
    0 g: X5 a; M3 ^) |& V+ D+ N# A
59. output gpio:59, value=1, 0
    6 I) S$ a8 r) J3 `0 g: j* ]; F( V9 ^
60. ## Booting kernel from Legacy Image at 44000000 ...
    " {/ M! q& j4 ^- N) E" q
61.    Image Name:   Linux Kernel Image
    
62.    Image Type:   ARM Linux Kernel Image (uncompressed)
    ! L6 f0 |/ d" ^4 M( M
63.    Data Size:    4344327 Bytes = 4.1 MiB
    
64.    Load Address: 40008000
    
65.    Entry Point:  40008000
    
66.    Verifying Checksum ... OK
    
67.    Loading Kernel Image ... OK
    
68. OK
    
69. ----------------------
    1 ]4 v3 Z) l1 a) W  |
70. |-->setup versioninfo tag...
    ( H/ ~1 s' c+ Y" ]
71. 
    ( a! K) Y- Y! A. p( Q# C
72. Starting kernel ...

复制代码

根据启动信息可以得知
cpu（ZX279127S@A9,1000MHZ）后面再吐槽它，内存（DRAM: 256 MiB），闪存用的美光（Micron SPI NAND MT29F2G01ABAGDWB 256MiB 3,3V）其实这个光猫也有USB接口，我测量过没有5V输出，如果想USB好用需要补元件。
3 G3 @! D& c5 K" s- [
使用工具软件打开光猫telnet并登录后查看mtd信息

1. / # cat /proc/mtd
   - R0 J+ G5 u- x* r. @
2. dev:    size   erasesize  name
   
3. mtd0: 10000000 00020000 "whole flash"
   
4. mtd1: 00200000 00020000 "u-boot"
   " B+ I" z. c  P  z7 R2 m
5. mtd2: 00200000 00020000 "others"
   ' {3 c8 [0 g3 k% E; d; _! D
6. mtd3: 00200000 00020000 "parameter tags"
     t* s$ ?+ q! {5 ?- A5 {' x/ c# g
7. mtd4: 00200000 00020000 "wlan"
   
8. mtd5: 00800000 00020000 "usercfg"
   
9. mtd6: 00200000 00020000 "middleware"
   
10. mtd7: 03000000 00020000 "kernel1"
    , m4 n: y  R1 s: {: n3 X
11. mtd8: 03000000 00020000 "kernel2"
    
12. mtd9: 01000000 00020000 "framework1"
    
13. mtd10: 01000000 00020000 "framework2"
    
14. mtd11: 01800000 00020000 "preplugin_data"
    
15. mtd12: 05600000 00020000 "plugin_data"
    
16. mtd13: 02fe0000 00020000 "rootfs"

复制代码

可以看见有一个MTD0它就是一个完整的nand flash影像把它拷贝出来就是一个完整且连续的flash备份，有人会说下面不是有MTD1-13,分别拷贝不方便点吗？
1、mtd1-13 加起来是超过256MB的；
: u. }7 q# z3 o8 D2、你不知道它mtd1-13在flash存储地址是不是按1-13这个编号连续分布的；
8 D, \: a6 o3 S: _- L1 n% [
我查过启动信息如下：（我没看出来有MTD地址分布信息）

1. /opt/cu/apps # ./busybox1 dmesg
   
2. NET: Registered protocol family 24
   1 W# g+ J% m' O6 \
3. p p t p driver version 0.8.5
   
4. 127s doesn't have USB3.0,just return -ENODEV
   ( p2 n3 p0 d5 a- ]* j+ b
5. **********TOP_CRM_BASE+0x2c=0x11393ff3******
   
6. **********TOP_CRM_BASE+0x2c=0x113f3ff3******
   . Z3 |1 x! r5 S: }1 E$ E
7. dwc2 9000000.usb: 1792 invalid for host_rx_fifo_size. Check HW configuration.
   ( c& m! ^- X2 V; K6 u2 U! H9 `' R
8. dwc2 9000000.usb: 1024 invalid for host_nperio_tx_fifo_size. Check HW configuration.
   
9. dwc2 9000000.usb: 1024 invalid for max_packet_count. Check HW configuration.
   4 D# L6 ~5 u$ O4 U5 D6 N+ I& z0 j
10. dwc2 9000000.usb: DWC OTG Controller
    $ ?& J  [: F0 V1 ~2 `, f# G
11. dwc2 9000000.usb: new USB bus registered, assigned bus number 1
    ; D! H1 I% U% i
12. dwc2 9000000.usb: irq 60, io mem 0x00000000
    3 ?& H# [2 Z8 j# n  I% h
13. usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
    
14. usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
    $ z; ~% S; N" t: T
15. usb usb1: Product: DWC OTG Controller
    1 i) m# ~( `9 r" [
16. usb usb1: Manufacturer: Linux 4.1.25 dwc2_hsotg
    
17. usb usb1: SerialNumber: 9000000.usb
    - I- ~( X+ w$ o% p0 U' D
18. hub 1-0:1.0: USB hub found
    4 x6 i6 A' ^* c* R2 s: H8 V, h
19. hub 1-0:1.0: 1 port detected
    5 P: F, l5 P- Q/ r
20. usbcore: registered new interface driver cdc_acm
    ! @0 @: N* X' J3 \6 G: O
21. cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
    
22. usbcore: registered new interface driver usbserial
    
23. usbcore: registered new interface driver usbserial_generic
    8 r8 }. A/ M2 e. y% W
24. usbserial: USB Serial support registered for generic
    7 h: C9 S) }4 O6 B  S! o
25. usbcore: registered new interface driver ch341
    
26. usbserial: USB Serial support registered for ch341-uart
    
27. usbcore: registered new interface driver cp210x
    2 a& o7 p/ J, Y9 M
28. usbserial: USB Serial support registered for cp210x
    , g( F9 n5 ]! Q! |7 A
29. usbcore: registered new interface driver pl2303
    $ Z4 G% }/ B3 V3 \+ P6 F9 z
30. usbserial: USB Serial support registered for pl2303
    3 t% g+ g/ A' g8 O, ~; R, I
31. mousedev: PS/2 mouse device common for all mice
    
32. I2C probe start!
    6 R! [  I6 r" J( l9 @: Q
33. zx_i2c_probe i2c-1 i2c-1->clk is ccdce7c0 ,clk rate is 100000000
    
34. I2C probe successed!
    , j; Y! A- E. C4 X8 c- d
35. usbcore: registered new interface driver usbhid
    2 l6 x: q! c2 B9 W. ?
36. usbhid: USB HID core driver
    / R& O: m3 Q, Z% L
37. zx tempsensor: zx_bsp_tempsensor.regs = 0xf0500034,&(zx_bsp_tempsensor.regs->cfg)= 0xf0500034
    
38. bsp_temp_start,val = 0x2ef
    
39. (458):creat proc files for temper sensor!!!
    
40. (463):temper sensor is running...
    0 Q. G4 @( E+ p/ `& `) U# ]! f1 A+ \
41. zx tempsensor: work clock 0
    
42. zx tempsensor: selector0's int num 27 allocated.
    
43. zx tempsensor: selector1's int num 28 allocated.
    
44. zx tempsensor: selector2's int num 29 allocated.
    ; D4 p4 Y! c6 i0 E. @9 q3 g
45. Netfilter messages via NETLINK v0.30.
    
46. nf_conntrack version 0.5.0 (3372 buckets, 60000 max)
    ( d6 _& _8 `5 Z' K
47. ip_set: protocol 6
    ; ]1 Y( h& F$ P  V
48. gre: GRE over IPv4 demultiplexor driver
    
49. ip_tables: (C) 2000-2006 Netfilter Core Team
    
50. NET: Registered protocol family 10
    / q5 T( a# V8 b6 {
51. ip6_tables: (C) 2000-2006 Netfilter Core Team
    
52. sit: IPv6 over IPv4 tunneling driver
      z$ d- R; w6 O; t
53. NET: Registered protocol family 17
    2 u9 m$ U8 q" P$ }4 P; o1 q
54. bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
    ) N- ^, v1 m% U6 ^, C
55. Bridge firewalling registered
    
56. Ebtables v2.0 registered
    
57. l2tp_core: L2TP core driver, V2.0
    2 L7 j" k1 d4 ?- b8 l% C' P  X
58. l2tp_ppp: PPPoL2TP kernel driver, V2.0
    
59. 8021q: 802.1Q VLAN Support v1.8
    0 k% V4 b: ^' S$ o) a+ M
60. systools version:v0.7.5
    
61. zte--oss cpu usage module init
    
62. DPI interface Loaded
    * i" x0 y' E, M- g
63. e8_init OK!
    3 g4 f& l0 A8 A* G4 x
64. Registering SWP/SWPB emulation handler
    6 N6 M% p! d1 Z- Y' x$ y4 d
65. FLowRL module init
    0 r+ _8 x) n# O" a
66. DevBw module init
    & F' E$ E# L; L! C( W; [
67. jffs2: notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    % J/ v, w; P' P3 Q6 h
68. VFS: Mounted root (jffs2 filesystem) readonly on device 31:13.
    9 u' Q- s8 _( c, @0 ~7 |# O) T& l
69. Freeing unused kernel memory: 212K (c07d3000 - c0808000)
    3 _% N# B" ~  X9 ~
70. This architecture does not have kernel memory protection.
    
71. jffs2: notice: (532) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    2 K8 e; q3 \: \: [5 Q
72. jffs2: notice: (577) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    
73. jffs2: notice: (585) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    
74. jffs2: notice: (587) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    
75. 11930:23:02 [Klogfile][Error] [(1348)CheckLogConfFile] CheckLogConfFile%CheckRestartCntConfFile
    
76. 
    
77. jffs2: notice: (578) check_node_data: wrong data CRC in data node at 0x006d5d7c: read 0x19d3a03, calculated 0x1e78a0ef.
    
78. ubi0: attaching mtd12
    ) x. W4 M( \+ B9 [. I# O; e
79. ubi0: scanning is finished
    
80. ubi0: attached mtd12 (name "plugin_data", size 86 MiB)
    
81. ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
    
82. ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
    , T2 A# A% i3 d' v2 L
83. ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
    
84. ubi0: good PEBs: 688, bad PEBs: 0, corrupted PEBs: 0
    3 S% ]" R+ f# R
85. ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
    
86. ubi0: max/mean erase counter: 14/9, WL threshold: 4096, image sequence number: 2012089330
    " _/ b3 b1 |' ?
87. ubi0: available PEBs: 0, total reserved PEBs: 688, PEBs reserved for bad PEB handling: 16
    
88. ubi0: background thread "ubi_bgt0d" started, PID 601
    * {8 N- k) o) q9 `
89. UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 607
    
90. UBIFS (ubi0:0): recovery needed
    
91. UBIFS (ubi0:0): recovery completed
    4 o8 K  y% ^. G1 ?9 W4 E7 [
92. UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "plugin_ubifs"
    
93. UBIFS (ubi0:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
    
94. UBIFS (ubi0:0): FS size: 83423232 bytes (79 MiB, 657 LEBs), journal size 4190208 bytes (3 MiB, 33 LEBs)
    9 Y/ V, x& h: {/ Z1 j+ }
95. UBIFS (ubi0:0): reserved for root: 3940284 bytes (3847 KiB)
    
96. UBIFS (ubi0:0): media format: w4/r0 (latest is w4/r0), UUID 156BD46D-0725-43B0-AA2C-8A8DCD1D83F4, small LPT model
    
97. jffs2: notice: (618) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
    
98. lo up
    ( D6 M- _" N* k, I
99. mux[0]=3f7ffffa
    
100. mux[1]=3ffffeff
     
101. mux[2]=19ff0555
     & L! H; }- v- K% A: X
102. mux[3]=6be1b
     
103. storage_wakeup_proc_create success!
     
104. verinfo=U-Boot V1.0.0P1N1 20210911001937 0x1200000 0x0 0x8f 0x83
     
105. can find /usr/java/osgi_verosgi_version_info_get error!
     / t! w! n7 [: A0 r4 n2 u3 j9 c$ B9 P
106. data_in=0x0
     
107. data_in=0x0
     
108. >>TagaramodInit the typeindex:  5
     
109. >>TagaramodInit the board_name:  F657GV9 ,wan=0x40
     
110. pon init
     
111. ZX_PA_BUF_BASE0=4dea0000
     
112. ZX_VA_BUF_BASE0=cdea0000
     
113. ZX_BP_BUFFER_BASE=4dec0000
     ' F6 v4 ]" Z- ~2 {  D8 |/ w) X
114. ZX_DESC_BASE=4ee80000
     
115. ZX_TX_UP_DESC_BASE=4ef40000
     ( a3 k5 z! X1 S# A2 P
116. ZX_TX_DN_DESC_BASE=4ef50000
     
117. ZX_BPPE_SW_BASE=4dea0000
     
118. ZX_BP_BUFFER_SW_BASE=4dec0000
     , o* J6 R9 c4 l" i3 r1 N
119. ZX_DESC_SW_BASE=4ea00000
     + C% H# d/ r3 q) T) e
120. ZX_TX_UP_DESC_SW_BASE=4eac0000
     
121. ZX_BPPE_BASE_127S=4eae0000
     
122. ZX_BP_BUFFER_BASE_127S=4eb02000
     
123. BP_BUFFER_SIZE_127S=b40000
     ' ^; F5 p* Y  }) C7 M4 E7 P! P
124. ZX_VA_TX_DN_DESC_BASE=cef50000
     
125. BPPE_POOL_SIZE=1c00
     ! S0 `" i; k5 M- @2 L; H
126. NORMAL_BP_BUFFER_SIZE=fc0000
     
127. JUMBO_BP_SIZE=2800
     
128. JUMBO_BPPE_POOL_SIZE=0
     
129. BP_BUFFER_SIZE=fc0000
     ( ?* x5 _4 a5 K
130. lan_up=0, lan_up_port=0
     ) r7 |8 t2 L* p3 N8 u3 u  u2 y
131. the pon mode is 40
     5 y7 ~& \9 m' G6 {
132. lan_up=0, lan_up_port=0
     
133. g_pon_irq=36,d1000000,f0400000,f0500000,f0600000,d0e00000
     
134. get npp irq succeed,g_npp_irq:38
     
135. get tm irq succeed,g_tm_irq:41 tm_base:0xf4340000
     9 w. l; ^* m; R  T. U8 m
136. get pp irq succeed,g_pp_irq:37
     
137. get idm irq succeed,g_idm_irq:39
     
138. enter ref_clk_set.. mode = 0 .
     
139. enter pll_cfg_fractional
     
140. ref_clk_set success!
     
141. serdes band cpu_temper:32 coarse:0x29
     3 R4 f. {+ v. m, G5 C
142. band calc fin
     
143. pon tm init
     + s) g4 G: ~" y* r  c0 o+ y
144. enter pon_tm_bppe_pool_init
     & n/ t) k0 A' ^' Q; v$ p  j" p' x' v
145. bppe_va_addr = 0xceae0000
     
146. jumbo_bppe_va_addr = 0xceaf0000
     
147. BMU_JUMBO_BPPE_SW_PTR  =0x0    (JUMBO_BPPE_SW_POOL_SIZE)<<16=0x0
     
148. netif_napi_add() called with weight 512 on device pon
     0 S6 m8 P/ X: t: p
149. DMA_UP_DESC_CNT = 0x0
     : q: s/ k& x+ d* b, q
150. pon_tm net init ok,272/176
     3 o9 R$ d& @$ \; I
151. pon_pp init
     2 {( {+ G3 u2 i" b; E
152. pon_npp init
     
153. idm_status_proc success!
     * l( Z4 k( H3 w5 ?" G: C) ?/ P/ c8 w
154. idm_desc_init d0c35000/4c980000
     
155. request idm irq succeed
     
156. idm net init ok
     
157. switch_phy_int_check 0
     
158. mac 0 link down
     ( J+ A$ k  ?1 l. s0 Q
159. switch_phy_int_check 1
     . m7 P4 t( K1 b/ D1 ^$ Q
160. mac 1 link down
     
161. switch_phy_int_check 2
     
162. mac 2 link down
     
163. switch_phy_int_check 3
     , `; b+ I$ l* G# w/ k' {, R+ T: R
164. mac 3 link down
     
165. register fpga driver success, major=222
     
166. register peripheral success, major = 106
     
167. = TM Module SYS FS Init ended successfully =
     2 D# C' ?6 O, @- q$ _# Q
168. tm_initModule begin...
     
169. enter tm_sdk_init  
     7 `% |& U) n$ V& k1 @: Y
170. api lock init!!
     
171. tm_initModule end...
     0 X- \+ {7 Z8 |! l
172. hw_power_optx_get_fordg:txdisable=0
     
173. Kmodule ZX279511.ko insmod successfully !
     
174. bob is not GN25L95: 40
       D4 P; L$ Z; S! s" k, e  q( F! f
175. pon up
       l  T0 q6 @7 L! S6 f
176. ethdriver_init....
     % W  h: z' @  l( {- M# V
177. g_mii_dev_name[0]  sw
     / Z& E% O' f  {( K
178. g_mii_dev_name[1]  pon
     
179. sw up
     
180. zteGpmac_devReg begin...
     
181. zteGpmac_devReg end...
     
182. enter zteGponCpuTypeAddrSet
     : O0 C/ T" d7 J" V7 i
183. *
     * h4 n/ d' w( {  D' q# E
184. asicGlbDb[97], 0x46,0x31007,0x0
     * b6 `. r0 |& v4 h' }/ @. Z3 O
185. zteGpmac_initModule begin...
       A5 Q5 E5 \. u4 z* M
186. === GponMac Supported MaxTcont: 16 MaxPLI: 800B ===
     
187. htb debug 1 =====> inCnt =0,outCnt=0
     
188. ##huoqf zteGponAsicStarttimeChkResultInit write cfg=10
     
189. ##huoqf zteGponAsicStarttimeChkResultInit read cfg=10
     . F" i; I& l7 }
190. = PON Module Operate ended successfully =
     3 v/ {& V$ q$ }& \9 ]  h
191. DEbug: GPON PIN_MUX_REG2:(0x19ff0555)
     
192. DEbug: GPON GPIO_PDD_REG:(0xfac)
     
193. DEbug: GPON GPIO_POSEDGE_REG:(0x4)
     
194. DEbug: GPON PIN_MUX_REG3:(0x2be1b)
     & m' J3 j# A' A) H8 L" `9 C
195. create zteGpon_rei_task ok!
     # r9 l5 y+ k* ^+ W+ k) P) Q
196. = GMAC Module SYS FS Init ended successfully =
     
197. zteGpmac_initModule end...
     
198. gpon_Init ok
     0 s7 Z0 w1 H; i4 q" n& _& Y
199. gpondrv g_OnuType is 2
     
200. 11930:23:06 [KMONITOR][Warn] [monitor.c(607)MontorSendMsg] netlink_unicast failedmsgid = 0xa5c2, ptr = bf26dd20, len = 4
     " y) m& t- p) h; a
201. omci up
       c( k. ^" Q0 a7 g3 S
202. Init switch module
     
203. unicnt 4, wancnt 1, wifi cnt 0, all ports 5, portmask 0x0000002f
     
204.   Onu type is 1,Wan type is 4
     8 O6 h! p+ L: `6 z/ u/ H& Y9 S1 Q
205. switch config GPON HGU mode!
     ( `- D; ^+ E, h# x' e8 i
206. protocol fail, error deal 66
     9 V0 T% C: N5 B; _% V; G# k
207. [TM][dpa_set_protocol_type_i_act] failed
     
208. protocol fail, error deal 65
     3 w& |+ N$ M' H4 @+ u4 C' W0 |* x8 f7 P
209. [TM][dpa_set_protocol_type_i_act] failed
     
210. -------chip_tm_init end-----
     , L6 n  D8 }$ n& d0 L: B3 ?
211. [SW][sw_init_switch] l2_fast init
     , V0 \7 `3 F9 R. }' B( n: X. c
212. [SW]set cpu queue rate limit to 8000pps
     
213. tm_port_egress_traffic_sharp_set p_port:5 p_ena:1 p_band_width:2048
     
214. 
     
215. Capacity=256000tm_port_egress_traffic_sharp_set p_port:6 p_ena:1 p_band_width:2048
     
216. 
     : ^4 v1 s6 v' ?5 ?& i( U
217. Capacity=256000[SW][sw_init_switch] reg hff
     
218. [SW][sw_init_switch] reg get statistics
     ; N& `1 V; T# |+ f2 C& S' F
219. Init switch module Success
     2 S- m3 o& Q9 {" [
220. bsp_i2c_probe 0x50 success!
     
221. vendor name = ZTE_PX20+_G
     , |' `' ]8 |2 y6 v9 W' T# a1 s4 R
222. optical PN(0x60) =
     
223. optical PN(0x28) = ZX279511
     9 X; l8 a- B9 B; e
224. tdm: exports duplicate symbol tdm_ch_close (owned by kernel)
     ! \# G$ ~2 |, s+ O
225. udpwatchd inited!
     . e" G+ B; v- s+ N4 G
226. kudp  inited!
     7 ]# e& x. ?, |, J5 }! ~! \& D4 A
227. Init codec v2.3(2019-05-17)!
       \2 O7 y+ A: C  C# R$ J, }
228. idm0 up
     
229. idm1 up
     
230. redirusb_init,no usb dev!
     
231. random: dbus-uuidgen urandom read with 47 bits of entropy available
     " C- G: J. Z5 x$ o
232. gpondrvCfgXGRegInfoAdapter not support now!
     
233. === GponMac Supported MaxTcont: 8 MaxPLI: 1536B ===
     1 Z7 g$ X9 t4 U9 j$ t4 l
234. htb debug 1 =====> inCnt =0,outCnt=0
     - O  S$ G* ?0 j
235. IPv6: ADDRCONF(NETDEV_UP): br0: link is not ready
     % G9 g: T. F1 q+ t4 ?* A* \
236. br0 up
     
237. ethdrv_dev_ioctl  ,brdev_set.port_id 0 ,brdev_set.name eth0 ,brdev_set.flag 0
     2 ^. d6 v. l1 k0 j, [( f
238. eth0 up
     2 U# O& }5 u+ E+ E/ P" U1 Y  m8 i
239. ethdrv_dev_ioctl  ,brdev_set.port_id 1 ,brdev_set.name eth1 ,brdev_set.flag 0
     7 i1 |3 c) V, q, ~- K8 n
240. eth1 up
     
241. ethdrv_dev_ioctl  ,brdev_set.port_id 2 ,brdev_set.name eth2 ,brdev_set.flag 0
     * W# M# l9 o4 G0 s8 _- e
242. eth2 up
     : H+ J: P  e% M# I. Z2 F1 \1 a
243. ethdrv_dev_ioctl  ,brdev_set.port_id 3 ,brdev_set.name eth3 ,brdev_set.flag 0
     
244. eth3 up
     & f6 d( w4 C. H* k+ |& T" l
245. tm_port_egress_traffic_sharp_set p_port:3 p_ena:0 p_band_width:0
     
246. 
     8 f" u2 r3 T3 o* r) t6 }  e
247. Capacity=200000tm_port_egress_traffic_sharp_set p_port:2 p_ena:0 p_band_width:0
     
248. 
     1 m& t4 w( |: Z* G  x+ d- _/ y3 Q
249. Capacity=200000tm_port_egress_traffic_sharp_set p_port:1 p_ena:0 p_band_width:0
     
250. 
     
251. Capacity=200000tm_port_egress_traffic_sharp_set p_port:0 p_ena:0 p_band_width:0
     
252. 
     
253. Capacity=200000
     
254. switch_phy_int_check 1
     * S! u9 t* ~' c9 B6 p/ {2 K8 D2 D+ O
255. pon0 up
     + Q. m, J0 v. R# P( g+ J: N
256. set_netdev_type dev (pon0) type (300) vendor name = ZTE_PX20+_G
     8 P% x6 T! p6 x
257. optical PN(0x60) =
     ' s1 b. v( |; }+ \( |
258. optical PN(0x28) = ZX279511
     ' V3 ]* W- u  V# j$ o6 }1 ^
259. device eth0 entered promiscuous mode
     
260. set_netdev_type dev (eth0) type (800)
     
261. device eth1 entered promiscuous mode
     8 }$ C5 s/ G& [1 s4 Q7 R
262. set_netdev_type dev (eth1) type (800)
     
263. device eth2 entered promiscuous mode
     
264. br0: port 3(eth2) entered forwarding state
     ; ?# d! L/ T) q2 K+ [( v4 u+ d
265. br0: port 3(eth2) entered forwarding state
     / F. R3 ^% p, U9 k
266. IPv6: ADDRCONF(NETDEV_CHANGE): br0: link becomes ready
     
267. set_netdev_type dev (eth2) type (800)
     
268. device eth3 entered promiscuous mode
     , l/ T$ G5 q0 W' f8 x, u( e
269. set_netdev_type dev (eth3) type (800) set_netdev_type dev (pon0) type (300) set_netdev_type dev (pon0) type (300) set_netdev_type dev (pon0) type (300)
     5 I- {3 f- P( X
270. ch:0 pcm mode:G711A_U
     2 k# [1 \: \2 g; J  u
271. Siliconlab chip id error! 0x0
     
272. cmd [ck 1389 1] not found
     3 r& l  j4 ?$ D/ j2 e
273. ====EVENT_O7_STATE_SAVE OFF====
       k/ ?1 V! {8 D: R: q0 s* s
274. cmd [ck 1392 1] not found
     " r* |% g, Q0 r. _+ b
275. cmd [ck 1387 1] not found
     
276. random: nonblocking pool is initialized
     9 K- m) z1 b  X; H# h( n! G
277. device br0 entered promiscuous mode
     $ r5 u2 A  @' a) e8 d6 z
278. tm_port_egress_traffic_sharp_set p_port:5 p_ena:0 p_band_width:0
     1 v0 \4 z" {" r: u. F
279. 
     
280. Capacity=200000tm_port_egress_traffic_sharp_set p_port:6 p_ena:0 p_band_width:0
     
281. 
     ( l0 Y- e: C& P6 b7 f$ i
282. Capacity=200000
     9 j0 F& X: d8 c; j7 X
283. overlayfs: missing 'workdir'

复制代码

' F: g7 n# A. k/ O" m- v# w但是将这个mtd0自接考出来是不容易的，因为它的内存也就256MB，临时分区也容不下这个falsh影像
# V9 Y, L4 r7 c" p- R/ c3 o

1. /opt/cu/apps # df
   
2. Filesystem           1024-blocks    Used Available Use% Mounted on
   0 e* x/ H8 t; G) e6 |0 r
3. /dev/root                49024     37824     11200  77% /
   # u# t, D2 K8 c; C/ F1 m+ R
4. /dev/mtdblock3            2048       404      1644  20% /tagparam
   
5. cgroup_root             108016         0    108016   0% /sys/fs/cgroup
   
6. none                     21604         0     21604   0% /run
   
7. none                      5120         0      5120   0% /run/lock
   " H0 O/ g: l! p5 v# t2 d
8. none                    108016         0    108016   0% /run/shm
   
9. tmpfs                    20480       448     20032   2% /var
   9 [9 u# C7 B4 q* ]) t0 a* @
10. tmpfs                    81920      2800     79120   3% /upgtempfile
    
11. tmpfs                     2048         0      2048   0% /mnt
    & W1 Q9 Z. v! r5 `  l
12. tmpfs                    15360         4     15356   0% /tmp
    * Q7 m- f8 m2 _' D2 _
13. /dev/mtdblock5            8192       640      7552   8% /userconfig
    $ A- [9 C7 g( f6 K0 ~
14. /dev/mtdblock6            2048       384      1664  19% /usr/local/ct
    0 ^/ ^0 h1 G% j* W  N  _% c! I# p
15. /dev/mtdblock11          24576      6232     18344  25% /usr/tmp
    / F. I2 A" O) s, l# S: _4 J3 l4 x; _
16. /dev/loop0                5376      5376         0 100% /usr/pre_plugin
    ' @  \0 v! N5 V+ |: R- ]
17. ubi0_0                   74660      2864     67948   4% /opt/cu/apps
    + z+ t% L2 }5 i8 o4 |, K
18. /dev/mtdblock4            2048       436      1612  21% /wlan
    & Q2 K0 P2 @& P9 O
19. overlay                  74660      2864     67948   4% /CuInform
    3 z9 O! C% S- Y1 @! p$ I
20. tmpfs                     5240        24      5216   0% /CuInform/tmp
    
21. overlay                  74660      2864     67948   4% /usr/sbin
    1 O# ~; `, ]7 m5 T3 ~: X  B5 E
22. /dev/mtdblock9            4352      4352         0 100% /opt/cu/framework

复制代码

可以看见也就/upgtempfile 文件夹可用，大小为80MB，远远不能满足需求。
2 \9 M# Z" D6 l+ Z2 C3 S' V
9 W$ U3 s% o. g0 Z& W2 Z: O以上都是分析，下面是操作步骤：
$ I" Y2 J( h7 |* {) p5 f/ u方法一：采用压缩方法在拷贝flash的时候边拷贝边压缩，然后将压缩后的文件传给电脑：

1. dd if=/dev/mtd0 | gzip > /upgtempfile/mtd0.gz

复制代码

我使用上述方法临时目录还是无法容纳，只有用更强的压缩方式，linux中有一个.xz文件它使用LZMA的压缩方式，LZMA压缩比相比较zip高不少，但在busybox中的命令xz只能解压这种文件，无法压缩。只能从网上下载完整代码自己编译一个。
; j$ P9 Y* R! Y# X# W/ ^

1. /opt/cu/apps # ./xz-v5 -H
   / p9 s+ K, j6 D  l( ?1 Q
2. Usage: ./xz-v5 [OPTION]... [FILE]...
   
3. Compress or decompress FILEs in the .xz format.
   
4. 
   
5. Mandatory arguments to long options are mandatory for short options too.
   7 F5 @' y1 Q" Q& e4 o" Q* L
6. 
   ' u" \$ k0 `; m+ ]- D2 b
7. Operation mode:
   
8.   -z, --compress      force compression
   
9.   -d, --decompress    force decompression
   ) o" l1 v1 W0 F/ H: ~6 \5 x* z" M
10.   -t, --test          test compressed file integrity
    ( \* N  P6 Q- A8 q0 S" u
11.   -l, --list          list information about .xz files
    6 `5 e5 q0 I/ C/ x
12. 
    
13. Operation modifiers:
    * ?6 m5 p' W5 j/ a
14.   -k, --keep          keep (don't delete) input files
    ' t3 T7 e  N; ~
15.   -f, --force         force overwrite of output file and (de)compress links
    6 Y( L5 y9 w* m" G0 y3 p4 I
16.   -c, --stdout        write to standard output and don't delete input files
    
17.       --single-stream decompress only the first stream, and silently
    + O$ k/ F3 t8 d: ]" `
18.                       ignore possible remaining input data
    
19.       --no-sparse     do not create sparse files when decompressing
    
20.   -S, --suffix=.SUF   use the suffix `.SUF' on compressed files
    
21.       --files[=FILE]  read filenames to process from FILE; if FILE is
    
22.                       omitted, filenames are read from the standard input;
    
23.                       filenames must be terminated with the newline character
    - N1 S, }0 ~6 Y, |  e
24.       --files0[=FILE] like --files but use the null character as terminator
    " `1 v8 a! E) i; O
25. 
    
26. Basic file format and compression options:
    2 Z2 p2 h4 e1 ?  x- u7 ~
27.   -F, --format=FMT    file format to encode or decode; possible values are
    & {; k- v  m$ [6 _9 u
28.                       `auto' (default), `xz', `lzma', and `raw'
    8 b. r$ L* f- @! L$ g; X
29.   -C, --check=CHECK   integrity check type: `none' (use with caution),
    $ _5 t* x& e8 l/ ^
30.                       `crc32', `crc64' (default), or `sha256'
    
31.       --ignore-check  don't verify the integrity check when decompressing
    
32.   -0 ... -9           compression preset; default is 6; take compressor *and*
    2 [& K/ d% y5 q8 q" |
33.                       decompressor memory usage into account before using 7-9!
    0 \4 G/ M7 J1 M9 n
34.   -e, --extreme       try to improve compression ratio by using more CPU time;
    
35.                       does not affect decompressor memory requirements
    / a& e$ |+ ]1 t- m5 I
36.   -T, --threads=NUM   use at most NUM threads; the default is 1; set to 0
    5 u4 W9 M3 ]/ Z4 v
37.                       to use as many threads as there are processor cores
    
38.       --block-size=SIZE
    
39.                       start a new .xz block after every SIZE bytes of input;
    & T4 @" N! d0 \- X5 L
40.                       use this to set the block size for threaded compression
    " s! x  l6 T( e% K' \5 t& R
41.       --block-list=SIZES
    
42.                       start a new .xz block after the given comma-separated
    . b6 X5 R9 i) L4 Z6 O) R+ T4 U
43.                       intervals of uncompressed data
    ; l/ b0 T* P$ M! |; C# d6 U: X
44.       --flush-timeout=TIMEOUT
    ! d) P# U9 @3 J, N
45.                       when compressing, if more than TIMEOUT milliseconds has
    
46.                       passed since the previous flush and reading more input
    
47.                       would block, all pending data is flushed out
    , E8 @9 A; `/ N# n8 e
48.       --memlimit-compress=LIMIT
    + s$ h( J$ r0 g# @8 V0 `
49.       --memlimit-decompress=LIMIT
    7 f% z1 T* q' u
50.   -M, --memlimit=LIMIT
    
51.                       set memory usage limit for compression, decompression,
    4 `7 Q( u# `) n
52.                       or both; LIMIT is in bytes, % of RAM, or 0 for defaults
    
53.       --no-adjust     if compression settings exceed the memory usage limit,
    
54.                       give an error instead of adjusting the settings downwards
    
55. 
    & D% c( c! Y3 Z& y; _: T$ Z
56. Custom filter chain for compression (alternative for using presets):
    * S. a" W* P: o9 @
57.   --lzma1[=OPTS]      LZMA1 or LZMA2; OPTS is a comma-separated list of zero or
    
58.   --lzma2[=OPTS]      more of the following options (valid values; default):
    
59.                         preset=PRE reset options to a preset (0-9[e])
    . Q9 @+ D4 V  P+ X
60.                         dict=NUM   dictionary size (4KiB - 1536MiB; 8MiB)
    + R6 v4 p( c1 V2 L2 e  w2 i
61.                         lc=NUM     number of literal context bits (0-4; 3)
    
62.                         lp=NUM     number of literal position bits (0-4; 0)
    
63.                         pb=NUM     number of position bits (0-4; 2)
    
64.                         mode=MODE  compression mode (fast, normal; normal)
    
65.                         nice=NUM   nice length of a match (2-273; 64)
    
66.                         mf=NAME    match finder (hc3, hc4, bt2, bt3, bt4; bt4)
    
67.                         depth=NUM  maximum search depth; 0=automatic (default)
    ) Q& Z, O. U. c! ]6 m6 {
68. 
    
69.   --x86[=OPTS]        x86 BCJ filter (32-bit and 64-bit)
    
70.   --powerpc[=OPTS]    PowerPC BCJ filter (big endian only)
    + P9 J# G% ?1 }# B! G* a+ l7 C
71.   --ia64[=OPTS]       IA-64 (Itanium) BCJ filter
    
72.   --arm[=OPTS]        ARM BCJ filter (little endian only)
    
73.   --armthumb[=OPTS]   ARM-Thumb BCJ filter (little endian only)
    
74.   --sparc[=OPTS]      SPARC BCJ filter
    
75.                       Valid OPTS for all BCJ filters:
    - y' T2 ?0 X! n; e- A6 Z' T, H. s
76.                         start=NUM  start offset for conversions (default=0)
    
77. 
    
78.   --delta[=OPTS]      Delta filter; valid OPTS (valid values; default):
    
79.                         dist=NUM   distance between bytes being subtracted
    ( U  c7 H$ I  r8 J
80.                                    from each other (1-256; 1)
    9 v  x2 G1 W$ p2 J" O
81. 
    # [5 ^& d8 X2 b9 T& c: ~
82. Other options:
    1 u  D2 _" @5 N! v
83. 
    
84.   -q, --quiet         suppress warnings; specify twice to suppress errors too
    * U+ Z8 ~+ C" }! S
85.   -v, --verbose       be verbose; specify twice for even more verbose
    , c* |% V! v2 j% ]0 B& K  Q
86.   -Q, --no-warn       make warnings not affect the exit status
    % d  r/ N* @' q! i7 W3 `- |
87.       --robot         use machine-parsable messages (useful for scripts)
    / ]+ s) H8 r# a6 }! D$ A' l
88. 
    8 [$ ?* {- Z. ~( W. U* N
89.       --info-memory   display the total amount of RAM and the currently active
      J( i- S# E3 p3 `* J  r5 m
90.                       memory usage limits, and exit
    4 q4 Y, C/ e1 n* r) [; t4 N* }
91.   -h, --help          display the short help (lists only the basic options)
    
92.   -H, --long-help     display this long help and exit
    ! v4 `; x" @; D4 t0 ^% w2 `
93.   -V, --version       display the version number and exit
    
94. 
    
95. With no FILE, or when FILE is -, read standard input.
    
96. 
    ( Y6 r* j8 \: W# t6 T  p
97. Report bugs to <lasse.collin@tukaani.org> (in English or Finnish).
    
98. XZ Utils home page: <https://tukaani.org/xz/>

复制代码

    到这个地方我走了一段弯路，这里要吐槽这个中兴的这个 ARM cpu （ZX279127S@A9,1000MHZ）TNN的看名字用的是A9并且查看cpu信息用的是ARMv7 指令集，编译好的文件在板子上就是不能跑，查了不短的时间才发现这个cpu要用ARMv5 指令集方式编译才能跑起来，典型的挂羊头卖狗肉。
! h& N3 |  y4 h9 }

1. /opt/cu/apps # cat /proc/cpuinfo
     ~& k2 a% f( ?, }: w9 v7 e
2. processor       : 0
   
3. model name      : ARMv7 Processor rev 1 (v7l)
   . W* Y( q6 F2 j0 A& B1 Y
4. BogoMIPS        : 1987.37
   
5. Features        : half fastmult edsp tls
   
6. CPU implementer : 0x41
   % e9 i4 D5 l( c9 ]3 g7 g& D, n
7. CPU architecture: 7
   7 `! x' t: ~5 x2 O1 }  W
8. CPU variant     : 0x4
   5 {, T: C7 W. M3 m
9. CPU part        : 0xc09
   ' n! V+ I0 s" y0 Q. y
10. CPU revision    : 1
    & S; x- @" ~/ u  H0 z: t4 D
11. 
    - W5 f, q/ _) v$ V
12. Hardware        : ZTE ZX27912X (Device Tree)
    7 i& ^" R* c( z6 n2 k. @0 J
13. Revision        : 0000
    
14. Serial          : 0000000000000000

复制代码

( v" X$ c/ G' C' g后面就简单了， 压缩后的文件为76.1 MB (79,894,956 字节)
$ \5 w# `1 x9 H

1. /opt/cu/apps/busybox1 dd if=/dev/mtd0 |/opt/cu/apps/xz-v5 -M32MB>/upgtempfile/mtd0.xz    （边拷贝边压缩，用-M32MB参数是因为LZMA压缩特别占用内存，如果不限制使用内存，光猫在拷贝过程后期可能因为内存溢出而重启，我这款就重启了2次，后来加了参数就ok了）

复制代码

这个busybox1 文件也是我传到光猫的，光猫内置busybox文件很简化（有tftp及chmod ），但没有包含dd命令
2 q' P  W8 J  C$ M
  H: w" D, ~+ w方法二：
在以上过程中我还参考网上信息Linux 下的dd命令使用详解以及dd if=/dev/zero of=的含义发现有另外一种方式使用netcat（简称nc）传数据，这是个非常有名的工具在busybox中集成了它的简化版，busybox windows版本也可以在 https://frippery.org/files/busybox/ 下载到

1、先在windows中执行命令：（接收数据端）
& S3 @& o% ?: o- h5 q& I

1. busybox nc -l -p 12345 >mtd0

复制代码

2、在光猫中执行命令：（传输数据端）
7 N; y# k0 w; r8 Q6 [( v" g2 o6 v- f

1. /opt/cu/apps/busybox1 dd if=/dev/mtd0 | /opt/cu/apps/busybox1 nc 192.168.1.2 12345

复制代码

我这里每秒能传300-400KB的数据，整个传输过程大约需要13分钟。


最后留下文件：
busybox for windows
4 e+ U1 K7 M2 B) m
, K- D5 i3 R3 k' s

busybox for Arm 使用静态编译，文件较大，但无需另外的库支撑，直接使用


" V. X  h9 c  e. A
- n* I- m' K; Yxz for Arm 使用静态编译，文件较大，但无需另外的库支撑，直接使用

/ h) B4 b+ {& \" O0 ]' [+ k8 `
' y+ f; l$ L2 B4 x

撒大地方

大神牛逼

v208cgd

感谢！为技术网添砖加瓦！

qq519948746

我去 有必要这么麻烦么，光猫都带tftp小型文件传输服务，在dev目录下 执行tftp -pl mtd0 你电脑的IP   在电脑上打开tftp服务端  想备份哪个都可以啊

jiuweiljp

qq519948746 发表于 2024-3-4 17:41
我去 有必要这么麻烦么，光猫都带tftp小型文件传输服务，在dev目录下 执行tftp -pl mtd0 你电脑的IP   在电 ...

受教了。这个办法好，测试了下每秒约800+KB/S，256MB需要约6分钟。

stanmcquay

谢谢楼主分享