Technicolor DPC3848VE

USB BDM software. Bug report.
Post Reply
edushmix
Junior Member
Posts: 23
Joined: Wed Mar 25, 2015 8:56 pm
Location: Rosario

Technicolor DPC3848VE

Post by edushmix »

Image
Image
wdt: reset type = 0, reset reason = 0
wdt: acboot win1 end, counter=297957

AC_BOOT
POST: 0xc02
cefdk_rom_base_addr: 0x00280800
POST: 0xc1f
wdt: acboot win2 end, counter=1435291
POST: 0xf02
Warning: No device found in chip select 0
Spi Flash Init Failed and disable SPI Fl
Intel(R) Consumer Electronics Firmware Development Kit (Intel(R) CEFDK)
Copyright (C) 1999-2012 Intel Corporation. All rights reserved.
Build Time (07/23/13 11:26:44).
POST: 0xf07
Set flash layout to Intel 128MB layout Rev 2
POST: 0xf10
GPIO_100 pcie_reset low
GPIO_088 pcie_power low - 800ms
GPIO_088 pcie_power high - 300ms
POST: 0xf11
GPIO_100 pcie_reset high
POST: 0xf19
Waiting for 5 sec for DOCSIS PLL1 ready...
DOCSIS PLL1 ready
POST: 0xfa0
SMM: Ok
POST: 0xf24
ACPI Init: finished with table region from 00011ab0 to 00018000
acpi: Created tables at 00011ab0-00018000
POST: 0xf29
============== Cisco-Boot 3.4.20.6 ==============


CEFDK Version : CE2600 build (SMP enabled)
Built from SDK : IntelCE-31.0.13302.338160
8051 Firmware : A0-1.0.9 (0x00050000)
8051 FW I/O Module :
Silicon Stepping : D0
Silicon SKU : 0x14F
Board Set As : Harbor Park - MG
CPU Threads : 2
CPU Multiplier : 12
CPU Bus Speed : 100 MHz
Memory Size : 512 MB
Memory Type & Speed : x16 DDR3-1333 (10-10-10)
Trusted Boot : Untrusted
Boot Mode : eMMC-NAND
Registered net controller: e1000
Init External Switch for board Type: 1
Timing data c003
ESWITCH ID 1721
SWITCH LEDS ALL ON
1000M FD Link is ready!
Configure IP via static IP.
Mac address is : 00:50:F..........
Host IP address is: 192.168.100.100
Subnet Mask is : 255.255.255.0
Gateway address is: 192.168.100.1


================================================
WARNING:
Please make sure the board type and DOCSIS DDR offset/size are set correctly,
otherwise DOCSIS subsystem won't boot!
If not sure, please use "settings" shell command to show the setup menu,
then check "Advanced Features".
================================================


Press 'Enter' within 2 seconds to disable automatic boot.
Hit a key to start the shell...
shell> help
bootata - Boots from the primary master ATA device.
ymodem - Receive a file from serial using YMODEM.
lspci - Displays PCI device info.
ord[2|4] - Read or write to memory.
pci[2|4] - Read or write to PCI configuration space.
port[2|4] - Read or write to I/O port.
goto - goto to specific IP to run code.
crc32 - compute crc32 sum of a bulk memory
netserver - net server service for external clients
ramdisk - set ramdisk start address and length
delay - delay some time
mmap - Displays a system memory map.
bootkernel - Boot Linux kernel from flash.
mfh - manage the MFH on flash devices
sha - Calculate a SHA sum for an input data string.
md5 - Calculate a MD5 sum for an input data string.
emmc - Auxiliary shell command to handle eMMC
spi_flash - Auxiliary shell command to handle SPI Flash
aid - manage the Active Image Designator
8051 - 8051 specific commands
svmem - Perform SV memory test
ata-map - Sets the ATA geometry mapping.
cache - Manipulate the processor cache.
ping - Ping destination [Ping count number]
tftp - Download/upload file from/to server via TFTP.
ip - Configure CEFDK static IP address, Subnet Mask and Gateway address.
settings - BIOS Settings
i2c - I2C buses read and write (SV ver).
script - Switch on/off the automatic shell script.
hwmutex - Auxiliary shell command to help check hw mutex status
load - load from storage meida.
sleep - Suspend and resume utilities
gpio - gpio commands
fll - flash layout list according to settings.
iosf - Read/write 32 bit register on IOSF sideband port.
wdt - Configure watchdog timers.
help - Displays this screen.
exit - Stops the shell.
shell>
Cat Mountain D0- Boot Ram.
Version: 0.1.14 (Apr 8 2013, 10:30:47)

Boot Param memory dump:
[0x1FFC] - 0x00010014
[0x1FF8] - 0x00000001
[0x1FF4] - 0x00000001
[0x1FF0] - 0x00000002
[0x1FEC] - 0x00000001
[0x1FE8] - 0x10000000
[0x1FE4] - 0x10000000
[0x1FE0] - 0x0021F000
[0x1FDC] - 0x0023F000
[0x1FD8] - 0x030A0000
[0x1FD4] - 0x00040000
[0x1FD0] - 0x030E0000
[0x1FCC] - 0x030E0000
[0x1FC8] - 0x00020000
[0x1FC4] - 0x00000000
[0x1FC0] - 0x00000000
[0x1FBC] - 0x00000000
[0x1FB8] - 0x00000000
[0x1FB4] - 0x00000000
[0x1FB0] - 0x00000000
[0x1FAC] - 0x00000000
[0x1FA8] - 0x00000000
[0x1FA4] - 0x00000000
[0x1FA0] - 0x00000000
[0x1F9C] - 0x0D0C0908
[0x1F98] - 0x010A0F0E
[0x1F94] - 0x0B050302
[0x1F90] - 0x00000002
[0x1F8C] - 0x0000000C
[0x1F88] - 0x000528F0
[0x1F84] - 0x00200000
[0x1F80] - 0x00000070
[0x1F7C] - 0x00220000
[0x1F78] - 0x00020000
[0x1F74] - 0x00000020
[0x1F70] - 0x00080800
[0x1F6C] - 0x00010000
[0x1F68] - 0x00090800
[0x1F64] - 0x00009400
[0x1F60] - 0x00099C00
[0x1F5C] - 0x00065400
[0x1F58] - 0x000FF800
[0x1F54] - 0x00000800
[0x1F50] - 0x00100000
[0x1F4C] - 0x00000800
[0x1F48] - 0x000FF000
[0x1F44] - 0x00000800
[0x1F40] - 0x00000000
Load U-Boot from eMMC/NAND Flash
eMMC/NAND copy from 0x030A0000 to 0x51FB0000 (len:262144).
Done.




U-Boot 1.2.0-dirty (Aug 05 2015 - 09:08:07) Cisco-Boot 3.4.20.6


DRAM: 256 MB
*** Warning - Unsupported Flash detected, flash is unusable


Manufacturer ID: 0xFF
Type: 0xFF
Density: 0xFF
Extended ID: {0xFF, 0xFF}
failed to probe Flash (bank 0)
Error: failed to probe Flash
Flash: 0 kB
MMC: sdhci_puma6: 0
MMC info:
Manufacturer ID: 0
OEM ID: 0
Name: MMC128
MMC version 4.4
High Capacity: No
Dual Data Rate (DDR): No
Bus Width: 8-bit
Clock: 50000000
Rd Block Len: 512
Capacity: 112.4 MB (117833728 bytes)
In: serial
Out: serial
Err: serial
Setting Board-Type to 2
Read AID 2
set ACTIMAGE to 1
Press SPACE to abort autoboot in 2 second(s)
=> help
? - alias for 'help'
autoscr - run script from memory
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bpinfo - Print Docsis IP Boot Parameters
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dcache - enable or disable data cache
echo - echo args to console
erase - erase FLASH memory
eval - return addition/subraction
exit - exit script
flinfo - print FLASH memory information
flmode - Change Flash Addressing mode
flwr - Flash Write and Read utility commands
go - start application at address 'addr'
help - print online help
hwmutex - Use the HW Mutex [t/r] [mmc/spi/mail]
icache - enable or disable instruction cache
iminfo - print header information for application image
imls - list all images found in flash
incomm - InComm test.
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mmc - MMC subsystem commands
mmcaddr2blk - convert address to blocks, save results in 'blocksize'
mmcinfo - display MMC info
mmcpart - set MMC partition info to environment variables
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
printenv- print environment variables
protect - enable or disable FLASH write protection
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
signature - Program Puma6 image signatures.
sleep - delay execution for some time
spim - Change SPI and Flash Addressing mode
spireg - Prints SPI Registers
sspi - SPI utility commands
test - minimal test like /bin/sh
update - Program Puma6 image to flash.
version - print monitor version
=>

Someone saw this modem. It occurs to them where to be able to connect the usbjtag. Is PUMA6 the chipset
cheeto
Junior Member
Posts: 93
Joined: Fri Aug 01, 2008 6:14 pm

Post by cheeto »

USBBDM,
I too would be very interested in possible solution to this modem.
Can it be flashed?

Thanks guys!
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

I do not see any JTAG port. I assume you want to program via serial port.
cheeto
Junior Member
Posts: 93
Joined: Fri Aug 01, 2008 6:14 pm

Post by cheeto »

So, in this particular case, the USBJTAG cannot be used?
As that my seem to be the case, can you recommend any kind of serial port programming hardware?
thx
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

Any USB-TTL cable should work and one program you can use is putty.
PAPAUKA
Junior Member
Posts: 105
Joined: Tue Mar 31, 2009 10:25 am

Post by PAPAUKA »

cheeto wrote:So, in this particular case, the USBJTAG cannot be used?
As that my seem to be the case, can you recommend any kind of serial port programming hardware?
thx

as usbbdm said:

http://www.putty.org/ (putty)
or
https://sourceforge.net/projects/realterm/ (realterm)

and usb-ttl
http://www.ebay.com/itm/FT232RL-FTDI-US ... 1821751277
cheeto
Junior Member
Posts: 93
Joined: Fri Aug 01, 2008 6:14 pm

Post by cheeto »

My apologies for the silly question, but how do I know where to connect the serial onto the board?
Thx
edushmix
Junior Member
Posts: 23
Joined: Wed Mar 25, 2015 8:56 pm
Location: Rosario

Post by edushmix »

Mi pregunta es que comandos usar para acceder al nonvol y sacar el factory key
cheeto
Junior Member
Posts: 93
Joined: Fri Aug 01, 2008 6:14 pm

Post by cheeto »

English version of the above text:

Can anyone tell me what commands I'm supposed to use in order to access nonvol and from there extract the factory key?

Cheers
cheeto
Junior Member
Posts: 93
Joined: Fri Aug 01, 2008 6:14 pm

Post by cheeto »

Hey guys,
Has anyone had any success with this modem?

Cheers
edushmix
Junior Member
Posts: 23
Joined: Wed Mar 25, 2015 8:56 pm
Location: Rosario

Post by edushmix »

edushmix wrote:Mi pregunta es que comandos usar para acceder al nonvol y sacar el factory key
estoy en la busqueda de que alguien me diga por donde buscar los certificados he probado de todo pero sigo sin suerte
household2
Junior Member
Posts: 53
Joined: Thu Mar 18, 2010 5:47 pm

Post by household2 »

mira go to forocable.com
Lebzul
Junior Member
Posts: 10
Joined: Fri Jan 24, 2014 1:31 pm

Post by Lebzul »

cheeto wrote:My apologies for the silly question, but how do I know where to connect the serial onto the board?
Thx
That is the question.
Post Reply

Who is online

Users browsing this forum: No registered users and 11 guests