If you like BoxMatrix then please contribute Supportdata, Supportdata2, Firmware and/or Hardware (get in touch).
My metamonk@yahoo.com is not reachable by me since years. Please use hippie2000@webnmail.de instead.
Property:cefdk (partition)
| BoxMatrix >> System >> cefdk (partition) | @ BoxMatrix - IRC-Chat - Translate: de es fr it nl pl |
| News | Selectors | Models | Accessories | Components | Environment | Config | Commands | System | Webif | Software | Develop | Lexicon | Community | Project | Media |
| Devices | Filesystems | Partitions | Sockets | Netlink | Pipes | Interfaces | Bridges | Ports | Events | Sources | Sinks | AVMIPC | Processes | Watchdogs | Memory | Slab | Vmalloc | ProcFS | SysFS | Research |
 |
Name-Collision - multiple objects in this wiki use the name cefdk!
|
Linux-Partition
| Partition: | cefdk (partition) - type Part | Wiki | Freetz | IPPF | whmf | AVM | Web |
| Location: | System >> Linux-Partitions - Origin: AVM | ||||||
| Device: | mtdblock3, mtdblock4, mtdblock5 | ||||||
| Properties: | Firmware: 6.08 - 7.29 | ||||||
| Function: | Intel CEFDK partition on Puma6 models. | ||||||
Goto: Dependencies - Model-Matrix - Missing Supportdata - SMW-Browser
Details
cefdk is the 512 KB Intel CEFDK partition on Puma6 models.
CEFDK is the abbreviation for Consumer Electronics Firmware Development Kit.
Intel(R) Consumer Electronics Firmware Development Kit (Intel(R) CEFDK) Copyright (C) 1999-2012 Intel Corporation. All rights reserved.
It is a 3 stage Bootloader started on the ARM of the Puma6. Note that the Puma5 by TI only had an ARM.
The entire DOCSIS stack was written for ARM and Intel added the ATOM as an APP-CPU after they bought Puma5.
This means the entire story starts on ARM, the NP-CPU and the ATOM was not really needed.
Stage1 (64 KB) initializes and tests the hardware and creates and tests an APPCPU-NPCPU Mailbox.
A Mailbox is an asynchronous Inter-CPU communication mechanism widely used in embedded systems.
Once the ATOM is known to be alive the Stage2 signature is tested and launched on success.
Stage2 (37 KB) verifies some settings and fuses and tests tge Stage3 signature and launches it on success.
Stage3 (405 KB) contains the real magic. It contains the main CEFDK part and the EVA for the ARM merged into it.
EVA for ATOM is on the 128 KB urlader partition.
See also the cefdk (chipcmd) updater for this partition.
Splitting
According to the bootparams it consists of 6 parts summing up to 512 KB:
CEFDK S1 Offset .............. 0x00000000 CEFDK S1 Size ................ 0x00010000 - 64 KB CEFDK S2 Offset .............. 0x00010000 CEFDK S2 Size ................ 0x00009400 - 37 KB CEFDK S3 Offset .............. 0x00019400 CEFDK S3 Size ................ 0x00065400 - 405 KB CEFDK S1H Offset ............. 0x0007F000 CEFDK S1H Size ............... 0x00000800 - 2 KB CEFDK S2H Offset ............. 0x0007F800 CEFDK S2H Size ............... 0x00000800 - 2 KB CEFDK S3H Offset ............. 0x0007E800 CEFDK S3H Size ............... 0x00000800 - 2 KB
Let's split it:
# dd if=mtd4.bin of=cefdk_s1.bin bs=256 skip=$((0x000000)) count=$((0x000100)) # dd if=mtd4.bin of=cefdk_s2.bin bs=256 skip=$((0x000100)) count=$((0x000094)) # dd if=mtd4.bin of=cefdk_s3.bin bs=256 skip=$((0x000194)) count=$((0x000654)) # dd if=mtd4.bin of=cefdk_s1h.bin bs=256 skip=$((0x0007F0)) count=$((0x000008)) # dd if=mtd4.bin of=cefdk_s2h.bin bs=256 skip=$((0x0007F8)) count=$((0x000008)) # dd if=mtd4.bin of=cefdk_s3h.bin bs=256 skip=$((0x0007E8)) count=$((0x000008)) # ls -lh cefdk* -rw-r--r-- 1 root users 64.0K Nov 24 00:00 cefdk_s1.bin -rw-r--r-- 1 root users 2.0K Nov 24 00:05 cefdk_s1h.bin -rw-r--r-- 1 root users 37.0K Nov 24 00:02 cefdk_s2.bin -rw-r--r-- 1 root users 2.0K Nov 24 00:06 cefdk_s2h.bin -rw-r--r-- 1 root users 405.0K Nov 24 00:04 cefdk_s3.bin -rw-r--r-- 1 root users 2.0K Nov 24 00:07 cefdk_s3h.bin
Analyzing
File does not find anything:
# file cefdk* cefdk_s1.bin: data cefdk_s1h.bin: data cefdk_s2.bin: data cefdk_s2h.bin: data cefdk_s3.bin: data cefdk_s3h.bin: data
Stage 3 405.0K cefdk_s3.bin is the blob of interest:
# binwalk cefdk_s3.bin DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 51004 0xC73C JFFS2 filesystem, little endian 380259 0x5CD63 Copyright string: "Copyright (C) 1999-2012 Intel Corporation. All rights reserved." 387216 0x5E890 CRC32 polynomial table, little endian 388524 0x5EDAC Copyright string: "Copyright 2005 AVM Date: %s Time: %s " 389972 0x5F354 CRC32 polynomial table, little endian
It obviously contains EVA:
# strings cefdk_s3.bin | grep EVA [%s] DOCSIS already running, Leaving EVA! [%s] No valid default-config found in ARM image, Leaving EVA! (AVM) EVA Revision: %s Version: %d Leaving EVA, starting DOCSIS! 215 AVM EVA Version %d.%s 0x%x 0x%x%s
Source
rst@weed:~/tftp/arm$ strings cefdk_s3*.bin | grep '\.c$' 8254.c # Programmable Interval Timer 8259.c # Programmable Interrupt Controller addr_map.c ce2600_ata.c # Atom Processor CE 2600 kbd_mgr.c # 8051 Keyboard Microcontroller pci_alloc.c straps.c
Dependencies
Daily updated index of all dependencies of this partition. Last update: GMT.
A * in the Mod column marks info from Supportdata-Probes, which will always stay incomplete.
A ** in the Mod column marks info from Supportdata2 probes, which by their nature will stay way more incomplete.
A - in the Mod column marks manual research, the Firmware then shows where the item occurs, not the Relation.
| Relation | Typ | Object | Mod | Firmware | Info | Origin |
|---|---|---|---|---|---|---|
| 0 dependencies for this partition | ||||||
Model-Matrix
Daily updated index of the presence, path and size of this partition for each model. Last update: 2024-12-21 07:02 GMT.
Showing all models using this partition. Click any column header (click-wait-click) to sort the list by the respective data.
The (main/scrpn/boot/arm/prx/atom/rtl) label in the Model column shows which CPU is meant for Multi-Linux models.
Note that this list comes from Supportdata-Probes, which can have arbitrary settings and come from different firmware versions.
It doesn't say much if a model is not listed here. It may be a missing supportdata file or just a disabled feature.
| Model | Firmware | Device | Size |
|---|---|---|---|
| FRITZ!Box 6430 Cable (arm) | 6.87 - 7.29 | mtdblock4 | 000 - 512k |
| FRITZ!Box 6430 Cable (atom) | 6.87 - 7.29 | mtdblock4, mtdblock5 | 512k |
| FRITZ!Box 6490 Cable (arm) | 6.08 - 7.24 | mtdblock3, mtdblock4 | 000 - 512k |
| FRITZ!Box 6490 Cable (atom) | 6.24 - 7.24 | mtdblock4, mtdblock5 | 000 - 512k |
| FRITZ!Box 6590 Cable (arm) | 6.87 | mtdblock4 | 000 - 512k |
| FRITZ!Box 6590 Cable (atom) | 6.87 | mtdblock4, mtdblock5 | 512k |
| 6 models use this partition | |||
Missing Supportdata
The data in this article is incomplete due to missing Supportdata-Probes for the models listed below.
If you own any of these models and would like to help then please get in touch.
| Model | Method | Info |
|---|---|---|
| FRITZ!Box WLAN 3270 IT | lua | http://fritz.box/support.lua |
| FRITZ!Box Fon ata | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon ata 1020 | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon 5010 | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon 5012 | html | http://fritz.box/html/support.html |
| FRITZ!Box Fon WLAN 7113 INT | html | http://fritz.box/html/support.html |
| Speedport W 501V | telnet | |
| Speedport W 722V | console | |
| Eumex 300 IP | telnet | |
| 9 models without supportdata probes | ||
