研究了一个星期的TTL，终于把斐讯705刷成了Openwrt
本帖最后由 Night_Chen 于 2014-4-1 14:45 编辑需要的工具有：TFTP32，SecureCRT，TTL线，网线一根。
首先把电脑的IP地址改为192.168.1.100
网关改为192.168.1.1
U-Boot 1.1.3 (Jun 14 2012 - 07:15:37)
SoC:Ralink RT335x
Memory Testing.65536K OK.
DRAM:64 MB
relocate_code Pointer at: 83770000
spi_wait_nsec: 3c
spi device id: c2 20 17 c2 20 (2017c220)
Flash:MX25L6405D Size:8MB(64K*128blocks)
raspi_read: from:30000 len:10000
.*** Warning - bad CRC, using default environment
______________________________________________________
| ____ ____ |
||_ \ _ __ _____ _ _ __ ___ | __ )_______|
|| | | | '__/ _ \/ _` | '_ ` _ \|_ \ / _ \ \/ /|
|| |_| | | |__/ (_| | | | | | | |_) | (_) >< |
||____/|_|\___|\__,_|_| |_| |_|____/ \___/_/\_\|
| |
| http://www.openwrt.org.cn |
| Board:Zyxel WAP120NF |
| |
| lintel<linte.huang@gmail.com> |
|____________________________________________________|
ASIC 3352_MP (Port5<->None)
DRAM_CONF_FROM: Boot-Strapping
DRAM: DDR2 64 MByte16 bits
Flash component: SPI Flash
Build Date:Jun 14 2012Time:07:15:37
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 400 MHZ ####
estimate memory size =64 Mbytes
GPIO Init:
UARTF_SHARE_MODE:GPIO
GPIO_MODE_REG status:0x40039c
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
You choosed 2
0
eth_register
Eth0 (10/100-M)
enetvar=ethaddr,Eth addr:00:0C:43:09:26:BB
eth_current->name = Eth0 (10/100-M)
2: System Load Linux Kernel then write to Flash via TFTP.
Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.1.1) ==:192.168.1.1
Input server IP (192.168.1.100) ==:192.168.1.100
Input Linux Kernel filename () ==:op.bin
netboot_common, argc= 3
*************buf = 0x8378e520
**********NexTxPacket = 837a66c0
NetTxPacket = 0x837A66C0
NetRxPackets = 0x837A6CC0
NetRxPackets = 0x837A72C0
NetRxPackets = 0x837A78C0
NetRxPackets = 0x837A7EC0
NetRxPackets = 0x837A84C0
NetRxPackets = 0x837A8AC0
NetRxPackets = 0x837A90C0
NetRxPackets = 0x837A96C0
NetRxPackets = 0x837A9CC0
NetRxPackets = 0x837AA2C0
NetRxPackets = 0x837AA8C0
NetRxPackets = 0x837AAEC0
NetRxPackets = 0x837AB4C0
NetRxPackets = 0x837ABAC0
NetRxPackets = 0x837AC0C0
NetRxPackets = 0x837AC6C0
NetRxPackets = 0x837ACCC0
NetRxPackets = 0x837AD2C0
NetRxPackets = 0x837AD8C0
NetRxPackets = 0x837ADEC0
NetRxPackets = 0x837AE4C0
NetRxPackets = 0x837AEAC0
NetRxPackets = 0x837AF0C0
NetRxPackets = 0x837AF6C0
KSEG1ADDR(NetTxPacket) = 0xA37A66C0
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start... done
Header Payload scatter function is Disable !!
ETH_STATE_ACTIVE!!
Using Eth0 (10/100-M) device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'op.bin'.
TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: Got ARP REPLY, set server/gtwy eth addr (b8:88:e3:3c:79:0d)
Got it
Got ARP REQUEST, return our IP
test print
192.168.1.1test print NetServerIP
192.168.1.100Got ARP REQUEST, return our IP
test print
192.168.1.1test print NetServerIP
192.168.1.100Got ARP REQUEST, return our IP
test print
192.168.1.1test print NetServerIP
192.168.1.100Got ARP REQUEST, return our IP
test print
192.168.1.1test print NetServerIP
192.168.1.100T Got ARP REQUEST, return our IP
test print
192.168.1.1test print NetServerIP
192.168.1.100Got ARP REQUEST, return our IP
test print
192.168.1.1test print NetServerIP
192.168.1.100Got ARP REQUEST, return our IP
test print
192.168.1.1test print NetServerIP
192.168.1.100T #
first block received
################################################################
##################Got ARP REQUEST, return our IP
test print
192.168.1.1test print NetServerIP
192.168.1.100###############################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
################
done
Bytes transferred = 3407876 (340004 hex)
NetBootFileXferSize= 00340004
raspi_erase_write: offs:50000, count:340004
raspi_erase: offs:50000 len:340000
....................................................
raspi_write: to:50000 len:340000
....................................................
raspi_read: from:50000 len:10000
.raspi_read: from:60000 len:10000
.raspi_read: from:70000 len:10000
.raspi_read: from:80000 len:10000
.raspi_read: from:90000 len:10000
.raspi_read: from:a0000 len:10000
.raspi_read: from:b0000 len:10000
.raspi_read: from:c0000 len:10000
.raspi_read: from:d0000 len:10000
.raspi_read: from:e0000 len:10000
.raspi_read: from:f0000 len:10000
.raspi_read: from:100000 len:10000
.raspi_read: from:110000 len:10000
.raspi_read: from:120000 len:10000
.raspi_read: from:130000 len:10000
.raspi_read: from:140000 len:10000
.raspi_read: from:150000 len:10000
.raspi_read: from:160000 len:10000
.raspi_read: from:170000 len:10000
.raspi_read: from:180000 len:10000
.raspi_read: from:190000 len:10000
.raspi_read: from:1a0000 len:10000
.raspi_read: from:1b0000 len:10000
.raspi_read: from:1c0000 len:10000
.raspi_read: from:1d0000 len:10000
.raspi_read: from:1e0000 len:10000
.raspi_read: from:1f0000 len:10000
.raspi_read: from:200000 len:10000
.raspi_read: from:210000 len:10000
.raspi_read: from:220000 len:10000
.raspi_read: from:230000 len:10000
.raspi_read: from:240000 len:10000
.raspi_read: from:250000 len:10000
.raspi_read: from:260000 len:10000
.raspi_read: from:270000 len:10000
.raspi_read: from:280000 len:10000
.raspi_read: from:290000 len:10000
.raspi_read: from:2a0000 len:10000
.raspi_read: from:2b0000 len:10000
.raspi_read: from:2c0000 len:10000
.raspi_read: from:2d0000 len:10000
.raspi_read: from:2e0000 len:10000
.raspi_read: from:2f0000 len:10000
.raspi_read: from:300000 len:10000
.raspi_read: from:310000 len:10000
.raspi_read: from:320000 len:10000
.raspi_read: from:330000 len:10000
.raspi_read: from:340000 len:10000
.raspi_read: from:350000 len:10000
.raspi_read: from:360000 len:10000
.raspi_read: from:370000 len:10000
.raspi_read: from:380000 len:10000
.raspi_read: from:390000 len:10000
.raspi_erase: offs:390000 len:10000
.
raspi_write: to:390000 len:10000
.
raspi_read: from:390000 len:10000
.Done!
## Booting image at bc050000 ...
raspi_read: from:50000 len:40
. Image Name: MIPS OpenWrt Linux-3.10.18
Created: 2013-11-1916:08:17 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 976081 Bytes = 953.2 kB
Load Address: 80000000
Entry Point:80000000
raspi_read: from:50040 len:ee4d1
............... Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64
Starting kernel ...
[ 0.000000] Linux version 3.10.18 (apple@apple-ThinkCentre) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2013.05 r38780) ) #1 Wed Nov 20 00:06:07 CST 2013
[ 0.000000] SoC Type: Ralink RT3352 id:1 rev:4
[ 0.000000] bootconsole enabled
[ 0.000000] CPU revision is: 0001964c (MIPS 24KEc)
[ 0.000000] MIPS: machine is WAP120NF
[ 0.000000] Determined physical RAM map:
[ 0.000000]memory: 04000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0:
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on.Total pages: 16256
[ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Writing ErrCtl register=00000003
[ 0.000000] Readback ErrCtl register=00000003
[ 0.000000] Memory: 61844k/65536k available (2135k kernel code, 3692k reserved, 534k data, 208k init, 0k highmem)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:128
[ 0.000000] CPU Clock: 400MHz
[ 0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
[ 0.080000] pid_max: default: 32768 minimum: 301
[ 0.090000] Mount-cache hash table entries: 512
[ 0.100000] pinctrl core: initialized pinctrl subsystem
[ 0.110000] NET: Registered protocol family 16
[ 0.150000] bio: create slab <bio-0> at 0
[ 0.160000] rt2880_gpio 10000600.gpio: registering 24 gpios
[ 0.170000] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[ 0.180000] Switching to clocksource MIPS
[ 0.190000] NET: Registered protocol family 2
[ 0.200000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[ 0.220000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[ 0.230000] TCP: Hash tables configured (established 512 bind 512)
[ 0.240000] TCP: reno registered
[ 0.250000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.260000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.270000] NET: Registered protocol family 1
[ 0.280000] rt-timer 10000100.timer: maximum frequncy is 8138Hz
[ 0.320000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.340000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.360000] msgmni has been set to 120
[ 0.370000] io scheduler noop registered
[ 0.370000] io scheduler deadline registered (default)
[ 0.390000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 0.400000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20) is a 16550A
[ 0.420000] console enabled, bootconsole disabled
[ 0.420000] console enabled, bootconsole disabled
[ 0.450000] m25p80 spi32766.0: mx25l6405d (8192 Kbytes)
[ 0.460000] 4 ofpart partitions found on MTD device spi32766.0
[ 0.470000] Creating 4 MTD partitions on "spi32766.0":
[ 0.480000] 0x000000000000-0x000000030000 : "u-boot"
[ 0.490000] 0x000000030000-0x000000040000 : "u-boot-env"
[ 0.510000] 0x000000040000-0x000000050000 : "factory"
[ 0.520000] 0x000000050000-0x000000800000 : "firmware"
[ 0.530000] 0x00000013e511-0x000000800000 : "rootfs"
[ 0.540000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 0.570000] mtd: device 4 (rootfs) set to be root filesystem
[ 0.580000] mtd: partition "rootfs_data" created automatically, ofs=0x360000, len=0x4a0000
[ 0.600000] 0x000000360000-0x000000800000 : "rootfs_data"
[ 0.620000] eth0: done loading
[ 0.630000] rt2880_wdt 10000120.watchdog: Initialized
[ 0.640000] TCP: cubic registered
[ 0.650000] NET: Registered protocol family 17
[ 0.660000] 8021q: 802.1Q VLAN Support v1.8
[ 0.680000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[ 0.700000] Freeing unused kernel memory: 208K (8029c000 - 802d0000)
[ 2.240000] rt305x-esw 10110000.esw: link changed 0x08
Console is alive
procd: Console is alive
- watchdog -
procd: - watchdog -
[ 4.820000] leds-gpio gpio-leds.3: pins are not configured from the driver
kmod: ran 7 iterations
- preinit -
procd: - preinit -
[ 5.450000] rt305x-esw 10110000.esw: link changed 0x00
Press the key and hit to enter failsafe mode
[ 7.570000] rt305x-esw 10110000.esw: link changed 0x08
mount_root: jffs2 is not ready - EOF marker found
- early -
procd: - early -
- watchdog -
procd: - watchdog -
- init -
procd: - init -
Please press Enter to activate this console.
[ 11.490000] NET: Registered protocol family 10
[ 11.530000] nf_conntrack version 0.5.0 (969 buckets, 3876 max)
[ 11.550000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 11.660000] u32 classifier
[ 11.670000] input device check on
[ 11.680000] Actions configured
[ 11.690000] Mirror/redirect action on
[ 11.720000] Loading modules backported from Linux version master-2013-06-27-0-gdcfa6d5
[ 11.740000] Backport generated by backports.git backports-20130617-4-ge3220f5
[ 11.770000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 11.920000] xt_time: kernel timezone is -0000
[ 11.970000] cfg80211: Calling CRDA to update world regulatory domain
[ 11.990000] cfg80211: World regulatory domain updated:
[ 12.000000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 12.010000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 12.030000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 12.040000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 12.060000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 12.070000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 12.150000] PPP generic driver version 2.4.2
[ 12.160000] NET: Registered protocol family 24
[ 12.220000] rt2800_wmac 10180000.wmac: failed to load eeprom property
[ 12.230000] ieee80211 phy0: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
[ 12.410000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 3352, rev 0200 detected
[ 12.430000] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 000c detected
[ 16.870000] rt305x-esw 10110000.esw: link changed 0x00
[ 18.520000] device eth0.1 entered promiscuous mode
[ 18.530000] device eth0 entered promiscuous mode
[ 18.560000] br-lan: port 1(eth0.1) entered forwarding state
[ 18.570000] br-lan: port 1(eth0.1) entered forwarding state
[ 18.680000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[ 19.140000] rt305x-esw 10110000.esw: link changed 0x08
[ 20.570000] br-lan: port 1(eth0.1) entered forwarding state
[ 32.210000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[ 32.230000] jffs2_build_filesystem(): unlocking the mtd device... done.
[ 32.240000] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
[ 71.860000] jffs2: notice: (1005) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
procd: - init complete -
当然你需要 SecureCRT才能看到， 下载地址：http://dlsw.baidu.com/sw-search-sp/soft/a9/13503/scrt712-x86.exe?version=3352426872
波特率57600，
注意看启动信息的红色部分，这是关键所在。
ralink的uboot中断一般是2~4.我们这里是按2.
中断后问你是否擦除flash？
这里按Y，接下来连击两下Enter。
其中出现Input device IP (192.168.1.1) ==:192.168.1.1
Input server IP (192.168.1.100) ==:192.168.1.100
接下来出现Input Linux Kernel filename () ==:
这里你要打开安装好的TFTP32软件，选好固件。
固件名称务必要改简单些，好了。
接下来在Input Linux Kernel filename () ==:的后面输入你刚刚在TFTP32软件中选择的固件，例如：op.bin
;P插好网线;P
点击Enter。接下来会出现一大堆的##################################################################################################################################################################################################################################################################################################################################################################################.
当进度条走完后，等待跳动的英文停止。
这时，重启。
好了，输入192.168.1.1进入你的openwrt的设置界面吧！
注意：从斐讯705原版固件刷的IP地址应为10.10.10.123
网关应为10.10.10.3
附加斐讯705的TTL接口定义：
本帖最后由 Night_Chen 于 2014-4-1 11:25 编辑
如果还有人要其他固件，到这里下载。
1. 登录原生固件后台
2. 访问http://192.168.1.1/goform/Diagnosis?pingAddr=192.168.1.100|echo""|telnetd
3. telnet 192.168.1.1
cd /tmp
wget http://192.168.1.100/firmware.bin
mtd_write -r write firmware.bin Kernel
完成后会自动重启
可以直接刷成openwrt, 不用ttl拆机了，不过4Mflash , 16M 内存确实跑得吃力，感谢楼主的固件包。 问题是bug多嘛？ 能挂卡PIN不？ 我也有一个……据说4m+32m的 学习一下了 xtwjwl 发表于 2014-4-1 11:17 static/image/common/back.gif
能挂卡PIN不？
这货没有USB，需要刮U！ 529929 发表于 2014-4-1 11:19 static/image/common/back.gif
我也有一个……据说4m+32m的
4M+16M的！ 感谢分享啊 有线能正常使用吗:o a372374665 发表于 2014-4-1 12:19 static/image/common/back.gif
有线能正常使用吗
没问题 Night_Chen 发表于 2014-4-1 11:22 static/image/common/back.gif
如果还有人要其他固件，到这里下载。
感谢分享。请问DD中继稳定吗