华为EC2108机顶盒

来自IPTV爱好者
跳转至: 导航搜索

概述

设置密码: 8288

保存密码: 3008

Telnet用户名:sunniwell,密码是82883008

广东电信认证服务器:http://eds.iptv.gd.cn:8082/EDS/jsp/AuthenticationURL

广东电信升级服务器:http://eds.iptv.gd.cn:8082/

浙江电信认证服务器:http://itv.zj.vnet.cn:8082/EDS/jsp/AuthenticationURL

浙江电信升级服务器:http://itv.zj.vnet.cn:8082/

MTD分区信息:

0x0000000000000000-0x0000000007f00000 : "whole"		/dev/mtdblock0		flash1.whole
0x0000000000400000-0x0000000000a00000 : "boot1"		/dev/mtdblock1		flash0.root1
0x0000000003d00000-0x0000000004300000 : "boot2"		/dev/mtdblock2		flash0.root2
0x0000000000a00000-0x0000000003a00000 : "app"		/dev/mtdblock3		flash0.app
0x0000000000000000-0x0000000000400000 : "loader"	/dev/mtdblock4		flash0.loader
0x0000000003a00000-0x0000000003b00000 : "logo"		/dev/mtdblock5		flash0.logo
0x0000000003b00000-0x0000000003c00000 : "param1"	/dev/mtdblock6		flash0.param1
0x0000000007400000-0x0000000007500000 : "param2"	/dev/mtdblock7		flash0.param2
0x0000000003c00000-0x0000000003d00000 : "playlist"	/dev/mtdblock8		flash0.playlist
0x0000000007600000-0x0000000007f00000 : "swfs"		/dev/mtdblock9		flash0.swfs
0x0000000007300000-0x0000000007400000 : "logo2"		/dev/mtdblock10		flash0.logo2
0x0000000004300000-0x0000000007300000 : "app2"		/dev/mtdblock11		flash0.app2
0x0000000007500000-0x0000000007600000 : "playlist2"	/dev/mtdblock12		flash0.playlist2

EC2108内核分析

CFE下刷Flash:

用ifconfig启动网卡:

ifconfig eth0 -auto

第一次时可能会出现错误,因为还没有设置MAC地址,先运行下面的命令:(可能会出现死机的状况,实际已经设置完成了,硬件重启一下)

macprog2 1a-2b-3c-4d-5e-6f

从TFTP服务器下载BIN文件,刷Flash的示例命令:

flash -noheader -offset=0x0 192.168.1.100:mtdblock1 flash0.root1
flash -noheader -offset=0x0 192.168.1.100:mtdblock2 flash0.root2
flash -noheader -offset=0x0 192.168.1.100:mtdblock3 flash0.app
flash -noheader -offset=0x0 192.168.1.100:mtdblock11 flash0.app2

192.168.1.100是TFTP服务器的IP地址。Windows下的CISCO TFTP服务器可在这里下载http://www.skycn.com/soft/18565.html

Bootloader

CFE启动信息

BCM74130011
012
K1
K2

K3

K4

K5

Shmoo Version=3.8
DDR Freq=0x0000014D
%00000001%
RC1=00000003
WC1=FFFFFFE4
RC2=0000001B
WC2=00000028
RC3=0000000F
WC3=FFFFFFE4
RC4=0000000F
WC4=00000041
NWC=00000012
RC5=00000003
WC5=00000012
RC6=0000001A
WC6=00000012
NRC=0000000E
RW=00000018
WW=0000005E
G=00000000 R=0000000E W=00000012
BL=00000000
RC1=00000004
RC2=00000019

BL=00000001
RC1=00000002
RC2=00000019

BL=00000002
RC1=00000002
RC2=00000019

BL=00000003
RC1=00000003
RC2=00000019

BL=00000004
RC1=00000002
RC2=00000019

BL=00000005
RC1=00000002
RC2=0000001A

BL=00000006
RC1=00000000
RC2=00000018

BL=00000007
RC1=00000002
RC2=00000019
3
COPY CODE
A567

BCM97413B1 CFE v2.26, CFE core v2.12, Endian Mode: Little
Build Date: Wed Jul 21 17:04:52     2010 (Administrator@microsof-3f012c)
Copyright (C) Broadcom Corporation.

******************************************
Automatic startup canceled via Ctrl-C
******************************************

read E2PROM param flag=ffff
loader version is : 1020040 r1

read E2PROM startup boot1
read E2PROM startup logo1
read E2PROM startup App1
App version is : 7133061

read E2PROM startup MAC=00:07:63:35:fb:38
DDR Freq:      333MHz
CPU speed:     405MHz
Memory Config: 64-bit UMA
Device Tech:   512Mb
Total memory:  256MB
Boot Device:   NAND
Total flash:   128MB

Initializing USB.
USB: Locating Class 09 Vendor 0000 Product 0000: USB Hub

CFE initialized.
Starting splash screen.
stb startup gif_logo info width : 720, height : 576

CFE> help
Available commands:

ts                  Time stamp utility
write_phys_badblock erase block until the block is a block
bws                 block write spare
beb                 block erase
brb                 read block content
read_param          read flash0.param1
write_param         write flash0.param1
bgs                 show block status
poll_eeprom_ready   test poll_eeprom_ready function
cpu_count_get       test cpu_count_get function
erase_eeprom_all    erase all data of  EEPROM with 9bits to 16bits width address
write_eeprom        write some data into EEPROM with 9bits to 16bits width address
read_eeprom         read out some data from EEPROM with 9bits to 16bits width address
info                Show CFE configuration information
loop                Loop a command
reboot              Reboot the system
dir                 List the directory of a FAT file system
macprog             Program MAC addresses.
macprog2            Program a specific MAC address.
flash               Update a flash memory device
memtest             Test memory.
f                   Fill contents of memory.
e                   Modify contents of memory.
d                   Dump memory.
u                   Disassemble instructions.
batch               Load a batch file into memory and execute it
go                  Start a previously loaded program.
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
boot                Load an executable file into memory and execute it
ping                Ping a remote IP host.
ifconfig            Configure the Ethernet interface
sleep               Sleep for specified milliseconds.
waitusb             Wait for USB device to be installed.
show usb            Display devices connected to USB bus.
show heap           Display information about CFE's heap
show memory         Display the system physical memory map.
show devices        Display information about the installed devices.
unsetenv            Delete an environment variable.
printenv            Display the environment variables
setenv              Set an environment variable.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0
CFE> show devices
Device Name          Description
-------------------  ---------------------------------------------------------
              uart0  16550 DUART at 0xB0400B00 channel 0
      flash0.loader  New NAND flash at 00000000 offset 00000000 size 4096KB
       flash0.root1  New NAND flash at 00000000 offset 00400000 size 6144KB
         flash0.app  New NAND flash at 00000000 offset 00A00000 size 49152KB
        flash0.logo  New NAND flash at 00000000 offset 03A00000 size 1024KB
      flash0.param1  New NAND flash at 00000000 offset 03B00000 size 1024KB
    flash0.playlist  New NAND flash at 00000000 offset 03C00000 size 1024KB
       flash0.root2  New NAND flash at 00000000 offset 03D00000 size 6144KB
        flash0.app2  New NAND flash at 00000000 offset 04300000 size 49152KB
       flash0.logo2  New NAND flash at 00000000 offset 07300000 size 1024KB
      flash0.param2  New NAND flash at 00000000 offset 07400000 size 1024KB
   flash0.playlist2  New NAND flash at 00000000 offset 07500000 size 1024KB
        flash0.swfs  New NAND flash at 00000000 offset 07600000 size 9216KB
       flash1.whole  New NAND flash at 00000000 offset 00000000 size 131072KB
               eth0  BCM7038 Internal Ethernet at 0xB0080000
           usbdisk0  USB Disk unit 0
*** command status = 0


CFE> info
========================================================================
DDR Freq:      333MHz
CPU speed:     405MHz
Memory Config: 64-bit UMA
Device Tech:   512Mb
Total memory:  256MB
Boot Device:   NAND
Total flash:   128MB

Total memory used by CFE:  0x87000000 - 0x87062998 (403864)
Initialized Data:          0x8705A200 - 0x87061F20 (32032)
BSS Area:                  0x87061F20 - 0x87062998 (2680)
Local Heap:                0x87062C00 - 0x87162C00 (1048576)
Stack Area:                0x87162C00 - 0x87164C00 (8192)
Text (code) segment:       0x87000000 - 0x87016880 (92288)

CFE driver build information:
LDR:     ELF   1; BIN   1; SREC  1
UI:      LEVEL 3; MIN   0
FS:      FAT   1; FAT32 1
NET:     STACK 1; ENET  1; TCP   0
USB:     STACK 1; ETH   1; DISK  1; SERIAL   1; HID 1
FLASH:   NAND
SPLASH:  1024*1024; flash0.splash
========================================================================
*** command status = 0

Linux

Linux启动信息:

cfe boot parameter :
	boot -elf -rawfs flash0.root1: 
Executing STARTUP...

linux kernel boot parameter :

	root=/dev/mtdblock3 rootfstype=cramfs ro fes=128 nandflashpartitions=v2
	Partition[13] -> &0:0:1024 &2:32:48 &3:488:48 &4:80:384 &1:0:32 &6:464:8 &7:472:8 &8:928:8 &10:480:8 &11:944:72 &16:920:8 &17:536:384 &18:936:8 
	MAC Address : 01:07:63:35:FB:38		mem=114M tmem=256M
cmd params:
root=/dev/mtdblock3 rootfstype=cramfs ro fes=128 nandflashpartitions=v2&0:0:1024&2:32:48&3:488:48&4:80:384&1:0:32&6:464:8&7:472:8&8:928:8&10:480:8&11:944:72&16:920:8&17:536:384&18:936:8 mac=00:07:63:35:fb:38 mem=114M tmem=256M net_type=0
Loading: 0x80001000/5199572 0x804f66d4/186688 Entry address is 0x8040f000
TP1 Entry Address at 0x80000ffc = 8040f000
Starting program at 0x8040f000

<5>Linux version 2.6.18-7.5 (ljl@ubuntu) (gcc version 4.2.0 20070124 (prerelease) - BRCM 10ts-20080721) #1 SMP Thu Dec 16 03:24:25 GMT 2010
Fetching vars from bootloader... OK (E,D,B,C)
Detected 256 MB on MEMC0 (strap 0x23240012)
g_board_RAM_size=256MB
Options: sata=0 enet=1 emac_1=1 no_mdio=0 docsis=0 ebi_war=0 pci=1 smp=1
CPU revision is: 0002a044
FPU revision is: 00130001
Primary instruction cache 32kB, physically tagged, 2-way, linesize 64 bytes.
Primary data cache 64kB, 4-way, linesize 64 bytes.
<6>Synthesized TLB refill handler (23 instructions).
<6>Synthesized TLB load handler fastpath (37 instructions).
<6>Synthesized TLB store handler fastpath (37 instructions).
<6>Synthesized TLB modify handler fastpath (36 instructions).
Determined physical RAM map:
 memory: 10000000 @ 00000000 (usable)
User-defined physical RAM map:
node [00000000, 07200000: RAM]
node [07200000, 08e00000: RSVD]
<5>Reserving 142 MB upper memory starting at 07200000
<7>On node 0 totalpages: 65536
<7>  DMA zone: 65536 pages, LIFO batch:15
Built 1 zonelists.  Total pages: 65536
<5>Kernel command line: root=/dev/mtdblock3 rootfstype=cramfs ro fes=128 nandflashpartitions=v2&0:0:1024&2:32:48&3:488:48&4:80:384&1:0:32&6:464:8&7:472:8&8:928:8&10:480:8&11:944:72&16:920:8&17:536:384&18:936:8 mac=00:07:63:35:fb:38 mem=114M tmem=256M net_type=0 console=ttyS0,115200
PID hash table entries: 2048 (order: 11, 8192 bytes)
Found MIPS counter frequency: 203 Mhz
Using 202.501 MHz high precision timer.
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 108928k/262144k available (3402k kernel code, 152996k reserved, 747k data, 928k init, 0k highmem)
Calibrating delay loop... 402.43 BogoMIPS (lpj=201216)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
plat_prepare_cpus: ENABLING 2nd Thread...
TP0: prom_boot_secondary: Kick off 2nd CPU...
CPU revision is: 0002a044
FPU revision is: 00130001
Primary instruction cache 32kB, physically tagged, 2-way, linesize 64 bytes.
Primary data cache 64kB, 4-way, linesize 64 bytes.
Synthesized TLB refill handler (23 instructions).
Calibrating delay loop... 404.48 BogoMIPS (lpj=202240)
Brought up 2 CPUs
migration_cost=1000
NET: Registered protocol family 16
PCI->SDRAM window size: 512MB
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 4096)
TCP reno registered
brcm-pm: disabling power to USB block
brcm-pm: disabling power to ENET block
brcm-pm: disabling power to SATA block
JFFS2 version 2.2. (NAND) (SUMMARY)  (C) 2001-2006 Red Hat, Inc.
Initializing Cryptographic API
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
Serial: 8250/16550 driver $Revision: 1.90 $ 3 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 22) is a 16550A
serial8250: ttyS1 at MMIO 0x0 (irq = 66) is a 16550A
serial8250: ttyS2 at MMIO 0x0 (irq = 67) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 8704K size 1024 blocksize
loop: loaded (max 8 devices)
special_igmpv3 initialised
********************flag_net_switch=-2143826347********************
,flag_net_switch<6>brcm-pm: enabling power to ENET block
MAC Address: 00:07:63:35:FB:38
Broadcom BCM7413 P21 Ethernet Network Device v2.0 Dec 16 2010 03:21:08
Config Internal PHY Through MDIO: Auto-negotiation timed-out
: 10 MB Half-Duplex (assumed)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
libata version 2.00 loaded.
usbmon: debugfs is not available
ehci_hcd_brcm_init: Initializing 2 EHCI controller(s)
brcm-pm: enabling power to USB block
10 Dec 2004 USB 2.0 'Enhanced' Host Controller (EHCI) Driver (EHCI-brcm-0)
drivers/usb/host/ehci-brcm.c: starting brcm EHCI USB Controller
 - USB h/w setup mode <F>
 - USB power enable set for active LOW mode
brcm-ehci brcm-ehci.0: BRCM EHCI
brcm-ehci brcm-ehci.0: new USB bus registered, assigned bus number 1
brcm-ehci brcm-ehci.0: irq 62, io mem 0x10480300
brcm-ehci brcm-ehci.0: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
10 Dec 2004 USB 2.0 'Enhanced' Host Controller (EHCI) Driver (EHCI-brcm-1)
drivers/usb/host/ehci-brcm.c: starting brcm EHCI USB Controller
brcm-ehci-1 brcm-ehci-1.1: BRCM EHCI
brcm-ehci-1 brcm-ehci-1.1: new USB bus registered, assigned bus number 2
brcm-ehci-1 brcm-ehci-1.1: irq 57, io mem 0x10480500
brcm-ehci-1 brcm-ehci-1.1: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
ohci_hcd_brcm_init: Initializing 2 OHCI controller(s)
2005 April 22 USB 1.1 'Open' Host Controller (OHCI) Driver (OHCI-brcm-0)
drivers/usb/host/ohci-brcm.c: starting brcm OHCI USB Controller
 - Resetting at b0480408
<-- brcm_start_hc
brcm-ohci-0 brcm-ohci-0.0: BRCM OHCI
brcm-ohci-0 brcm-ohci-0.0: new USB bus registered, assigned bus number 3
brcm-ohci-0 brcm-ohci-0.0: irq 63, io mem 0x10480400
usb 1-1: new high speed USB device using brcm-ehci and address 2
usb usb3: configuration #1 chosen from 1 choice
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 2 ports detected
usb 1-1: configuration #1 chosen from 1 choice
2005 April 22 USB 1.1 'Open' Host Controller (OHCI) Driver (OHCI-brcm-1)
drivers/usb/host/ohci-brcm.c: starting brcm OHCI USB Controller
 - Resetting at b0480608
<-- brcm_start_hc
brcm-ohci-1 brcm-ohci-1.1: BRCM OHCI
brcm-ohci-1 brcm-ohci-1.1: new USB bus registered, assigned bus number 4
brcm-ohci-1 brcm-ohci-1.1: irq 64, io mem 0x10480600
usb usb4: configuration #1 chosen from 1 choice
hub 4-0:1.0: USB hub found
hub 4-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...
scsi0 : SCSI emulation for USB Mass Storage devices
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
usb-storage: device found at 2
usb-storage: waiting for device to settle before scanning
usbcore: registered new driver hiddev
usbcore: registered new driver usbhid
drivers/usb/input/hid-core.c: v2.6:USB HID core driver
pegasus: v0.6.13 (2005/11/13), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new driver pegasus
drivers/usb/net/rtl8150.c: rtl8150 based usb-ethernet driver v0.6.2 (2004/08/27)
usbcore: registered new driver rtl8150
usbcore: registered new driver asix
usbcore: registered new driver cdc_ether
usbcore: registered new driver net1080
usbcore: registered new driver zaurus
usbcore: registered new driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered for DeLorme Earthmate USB
drivers/usb/serial/usb-serial.c: USB Serial support registered for HID->COM RS232 Adapter
drivers/usb/serial/usb-serial.c: USB Serial support registered for Nokia CA-42 V2 Adapter
usbcore: registered new driver cypress
drivers/usb/serial/cypress_m8.c: Cypress USB to Serial Driver v1.09
i8042.c: i8042 controller self test timeout.
mice: PS/2 mouse device common for all mice
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Freeing unused kernel memory: 928k freed
Broadcom STB NAND controller (BrcmNand Controller)

Mtd version : 5
i=0, CS[0] = 0
NAND_CS_NAND_XOR=00000000
Disabling XOR on CS#0
brcmnand_probe: CS0: dev_id=adf1001d
After: NandSelect=40000101, nandConfig=15142200
NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11
busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
timing1 not adjusted: 5363444f
timing2 not adjusted: 00000fc6
BrcmNAND mfg ad f1 Hynix HY27UF081G2A 128MB

Found NAND: ACC=d7001010, cfg=15142200, flashId=adf1001d, tim1=5363444f, tim2=00000fc6
BrcmNAND version = 0x0302 128MB @00000000
brcmnand_probe: CS0: dev_id=adf1001d
After: NandSelect=40000101, nandConfig=15142200
Found NAND chip on Chip Select 0, chipSize=128MB, usable size=128MB, base=0x
brcmnand_scan: B4 nand_select = 40000101
brcmnand_scan: After nand_select = 40000101
page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
Brcm NAND controller version = 3.2 NAND flash size 128MB @18000000
mtd->oobsize=64, mtd->eccOobSize=16
brcmnand_scan:  mtd->oobsize=64
brcmnand_scan: oobavail=50, eccsize=512, writesize=2048
brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=15, eccbytes=3
brcmnand_default_bbt: bbt_td = bbt_main_descr
Bad block table found at page ffc0, version 0x01
Bad block table found at page ff80, version 0x01
nand_read_bbt: Bad block at 0x068c0000
        numchips=1, size=8000000
<-- brcmnanddrv_setup_mtd_partitions, device_size=8000000
Creating 13 MTD partitions on "bcm7xxx-nand.0":
0x0000000000000000-0x0000000007f00000 : "whole"
0x0000000000400000-0x0000000000a00000 : "boot1"
0x0000000003d00000-0x0000000004300000 : "boot2"
0x0000000000a00000-0x0000000003a00000 : "app"
0x0000000000000000-0x0000000000400000 : "loader"
0x0000000003a00000-0x0000000003b00000 : "logo"
0x0000000003b00000-0x0000000003c00000 : "param1"
0x0000000007400000-0x0000000007500000 : "param2"
0x0000000003c00000-0x0000000003d00000 : "playlist"
0x0000000007600000-0x0000000007f00000 : "swfs"
0x0000000007300000-0x0000000007400000 : "logo2"
0x0000000004300000-0x0000000007300000 : "app2"
0x0000000007500000-0x0000000007600000 : "playlist2"
yaffs Dec 16 2010 03:17:18 Installing. 
usbcore: registered new driver rt73
bcmdriver: module license 'Proprietary' taints kernel.
BCMDRV: Initializing bcmdriver version $ 12 $
BCMDRV: Using Interrupt Definition for 7405d0-smp (uname -a)
BCMDRV: Total intc words=3,Total Irqs=97
BCMDRV: Global Interrupt Mask 0:0xD3DF7FFF,1:0x1CBF95F3,2:0x00000008,3:0x00000000
BCMDRV: Initialization complete...
[SWSYSDRV]Init swsys driver
yaffs: dev is 32505865 name is "mtdblock9"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.9, "mtdblock9"
yaffs: restored from checkpoint
yaffs_read_super: isCheckpointed 1
isa bounce pool size: 16 pages
  Vendor: Kingston  Model: DataTraveler G2   Rev: 1.00
  Type:   Direct-Access                      ANSI SCSI revision: 02
SCSI device sda: 7555528 512-byte hdwr sectors (3868 MB)
sda: Write Protect is off
sda: Mode Sense: 16 24 09 51
sda: assuming drive cache: write through
SCSI device sda: 7555528 512-byte hdwr sectors (3868 MB)
sda: Write Protect is off
sda: Mode Sense: 16 24 09 51
sda: assuming drive cache: write through
 sda: sda1
sd 0:0:0:0: Attached scsi removable disk sda
sd 0:0:0:0: Attached scsi generic sg0 type 0
usb-storage: device scan complete
[sw_sys_print fix block]
[sw_sys_print fix block]
[sw_sys_print fix block]
eth0: no IPv6 routers present
[sw_sys_print fix block]
[sw_sys_print fix block]
[sw_sys_print fix block]