【备份贴】一款MT7621 Uboot源码，感觉像H大的不死breed，备份一下

gd***

上一周手残把公司的wayos fbm220g 搞砖了，没有任何备份，在救砖过程中买了TTL+spi flash编程器且google找了很久uboot资料及编译方法，发现一款MT7621 Uboot编译的源码，感觉像H大的不死breed，备份一下

ps:为啥发到小米版块，是因为我家里用小米r3p，好像r3p也是mt7621的cpu

变砖设备：维盟 wayos fbm220g 路由器 1wan 4lan
http://www.wayos.com/products/FBM220G.html


CPU: MT7621AT （MIPS 1004KC）

FLASH:winbond W25Q128JVSQ spi flash
https://www.winbond.com/resource-files/w25q128jv%20revf%2003272018%20plus.pdf


内存：128M DDR3 (NT5CB64M16GP) Nanya Technology Corporation.
https://html.alldatasheet.com/html-pdf/1145459/NANYA/NT5CB64M16GP/737/4/NT5CB64M16GP.html


反正死马当活马医，刷了H大好几个breed，wndr3700v5版的breed 能启动，但是识别不了flash
CPU        MediaTek MT7621A ver 1, eco 3
内存        128MB DDR3
Flash        无有效 Flash @ 0MHz (0B)
以太网        MediaTek MT7530 Gigabit switch
时钟频率        CPU: 880MHz, DDR: 1066MHz, Bus: 293MHz, Ref: 40MHz
编译日期        2020-01-14 [git-b25d507]
版本        1.1 (r1280)

1. 
   
2. Copyright (C) 2020 HackPascal <hackpascal@gmail.com>
   
3. Build date 2020-01-14 [git-b25d507]
   
4. Version 1.1 (r1280)
   
5. 
   
6. DRAM: 128MB
   
7. Platform: MediaTek MT7621A ver 1, eco 3
   
8. Board: Netgear WNDR3700 v5
   
9. Clocks: CPU: 880MHz, DDR: 1066MHz, Bus: 293MHz, Ref: 40MHz
   
10. Flash: no flash present on mt7621-spi.0
    
11. rt2880-eth: MAC address from EEPROM is invalid, using default settings.
    
12. rt2880-eth: Using MAC address 00:0c:43:00:00:01
    
13. eth0: MediaTek MT7530 Gigabit switch
    
14. 
    
15. Network started on eth0, inet addr 192.168.1.1, netmask 255.255.255.0
    
16. 
    
17. Press any key to interrupt autoboot ... 2   
    
18. Autoboot aborted due to button press.
    
19. 
    
20. Starting breed built-in shell
    
21. 
    
22. breed>
    
23. Platform: MediaTek MT7621A ver 1, eco 3
    
24. Board: Netgear WNDR3700 v5
    
25. Clocks: CPU: 880MHz, DDR: 1066MHz, Bus: 293MHz, Ref: 40MHz
    
26. Relocate Offset: 07eb8000
    
27. 
    
28. DRAM size: 128MB
    
29. DRAM range: 80000000 - 87ffffff
    
30. 
    
31. Kernel size: 281KB
    
32. Kernel range: 87fb8000 - 87ffe76f
    
33. 
    
34. Kernel symbol table size: 17KB
    
35. Kernel symbol table range: 87fb3b70 - 87fb7ffc
    
36. 
    
37. Managed memory size: 2MB
    
38. Managed memory range: 87db3a70 - 87fb3a6f
    
39. Managed memory used: 278.03KB (13.57%)
    
40. 
    
41. Boot parameter size: 256KB
    
42. Boot parameter range: 87d73970 - 87db396f
    
43. 
    
44. Unused memory size: 125MB
    
45. Unused memory range: 80001000 - 87d7296f

复制代码

后面发现了这款MT7621的uboot源码：https://github.com/pinney/MT7621-u-boot-mod
我编译过程中遇到过几个问题：
1、编译环境问题:
报错完全看不懂，我先根据教程（https://p3terx.com/archives/build-openwrt-with-docker.html）搭了docker编译lean大的openwrt环境
再模拟编译教程（https://p3terx.com/archives/open ... s-and-commands.html）编译uboot
期间发现一个报错像是bc命令不存在，sudo apt install bc后，能编译uboot了

2、tftp\http上传都报文件超过大小问题: google了一天，发现与问题3是同一个问题，按照教程，打印出jedec后，把chip信息写到源码里再编译就不报错了。
3、uboot 识别不了flash问题：Warning: un-recognized chip ID, please update bootloader!
https://blog.csdn.net/huangkaiyue1/article/details/518113614、但是还是刷不回原厂固件，还没尝试编译Openwrt固件刷机


写得有点乱，目的是自己备份下这些资料，有了这款uboot源码，虽然还没搞成，但感觉离修好不远了。









下面是这个大神的原版Uboot

https://github.com/pepe2k/u-boot_mod
https://code.google.com/archive/p/wr703n-uboot-with-web-failsafe/
https://forum.archive.openwrt.org/viewtopic.php?id=43237

醉***

本来就有的界面，可以更新uboot，固件，art什么的

afe***

不错，支持你一个

fyi***

搞砖了也多半不是Bootloader的问题啊！上编程器有无先备份？至少应该先看看TTL log，否则一步错，步步错

Netgear WNDR3700 v5 专用，DDR2 内存适用

DDR 时钟频率1066也高了点，933只能下修至800

得先知道闪存布局 "/proc/mtd"，挑选适合的Breed为本体，再魔改內存頻率參數/DDR 時序參數/串口波特率

官方固件uImage起始于0x4c (2705 1956)

HC5961路由256M nand芯片 512M内存杂交breed的问题?
基于r3g的r3p breed

gd***

fyi2000 发表于 2020-3-18 14:57
搞砖了也多半不是Bootloader的问题啊！上编程器有无先备份？至少应该先看看TTL log，否则一步错，步步错

...

之前是没有root密码进不去，所以没有备份。。。然后我ttl瞎刷刷砖了。。我再看看你的杂交breed是怎么玩的。。非常感谢指导

fyi***

我说的是上编程器就先备份，一般来说，u-boot & 固件只会坏其一，不会全坏，重要的还有uboot-env & Factory

刚才看到某网友因疫情严重而失业了，你要保重！别再瞎搞！

gd***

@fyi2000 TFTP\HTTP刷wndr3700 v5 sysupgrade貌似linux启动了一段然后又重启了。。不知道后面怎么搞。。另外就是这个uboot的ddr我改成800mhz了。。还是有一个bad crc 不知道什么问题

1. U-Boot 1.1.3 (Mar 18 2020 - 16:23:30)
   
2. 
   
3. Board: Ralink APSoC DRAM:  128 MB
   
4. relocate_code Pointer at: 87fb4000
   
5. 
   
6. Config XHCI 40M PLL
   
7. ******************************
   
8. Software System Reset Occurred
   
9. ******************************
   
10. flash manufacture id: ff, device id ff ff
    
11. find flash: W25Q128JVSQ
    
12. <font color="#ff0000"><b>*** Warning - bad CRC, using default environment</b></font>
    
13. 
    
14. ============================================
    
15. Pinney UBoot Version: 1.0
    
16. --------------------------------------------
    
17. ASIC MT7621A DualCore (MAC to MT7530 Mode)
    
18. DRAM_CONF_FROM: Auto-Detection
    
19. DRAM_TYPE: DDR3
    
20. DRAM bus: 16 bit
    
21. Xtal Mode=3 OCP Ratio=1/3
    
22. Flash component: SPI Flash
    
23. Date:Mar 18 2020  Time:16:23:30
    
24. ============================================
    
25. icache: sets:256, ways:4, linesz:32 ,total:32768
    
26. dcache: sets:256, ways:4, linesz:32 ,total:32768
    
27. set LAN/WAN WLL
    
28. 
    
29. 
    
30.        _           _____         _____
    
31.        /           /    )        /    )
    
32.       /           /    /        /____/   o   ___   ___   __
    
33.      /           /    /        /        /   /   ) /   ) /__)  /   /
    
34.    _/____/ o    /____/ o      /        /   /   / /   / (_    (___/
    
35.                                                                 /
    
36.                                                           _____/
    
37. -------------------------------------------------------------------------
    
38.              https://github.com/pinney/MT7621-u-boot-mod
    
39. -------------------------------------------------------------------------
    
40. 
    
41. Please choose the operation:
    
42.    1: Load system code to SDRAM via TFTP.
    
43.    2: Load system code then write to Flash via TFTP.
    
44.    3: Boot system code via Flash (default).
    
45.    4: Entr boot command line interface.
    
46.    5: Load system code then write to Flash via Httpd.
    
47.    7: Load Boot Loader code then write to Flash via Serial.
    
48.    9: Load Boot Loader code then write to Flash via TFTP.
    
49. 
    
50. You chose 1
    
51. 
    
52. 0
    
53. 
    
54.    
    
55. 1: System Load Linux to SDRAM via TFTP.
    
56. Please Input new ones /or Ctrl-C to discard
    
57.         Input device IP (192.168.1.1) ==:192.168.1.1
    
58.         Input server IP (192.168.1.2) ==:192.168.1.2
    
59.         Input Linux Kernel filename ==:wndr3700v5-sysupgrade.bin
    
60. Erasing SPI Flash...
    
61. .
    
62. Writing to SPI Flash...
    
63. .
    
64. done
    
65. 
    
66. netboot_common, argc= 3
    
67. 
    
68. NetTxPacket = 0x87FE6FC0
    
69. 
    
70. KSEG1ADDR(NetTxPacket) = 0xA7FE6FC0
    
71. 
    
72. NetLoop,call eth_halt !
    
73. Trying Eth0 (10/100-M)
    
74. Waitting for RX_DMA_BUSY status Start...
    
75. done
    
76. 
    
77. Using Eth0 (10/100-M) device
    
78. TFTP from server 192.168.1.2; our IP address is 192.168.1.1
    
79. Filename 'wndr3700v5-sysupgrade.bin'.
    
80. 
    
81. TIMEOUT_COUNT=10,Load address: 0x80a00000
    
82. Loading: checksum bad
    
83. checksum bad
    
84. checksum bad
    
85. checksum bad
    
86. checksum bad
    
87. Got ARP REPLY, set server/gtwy eth addr (00:e0:4c:36:1a:23)
    
88. Got it
    
89. #################################################################
    
90.          #################################################################
    
91.          #################################################################
    
92.          #################################################################
    
93.          #################################################################
    
94.          #################################################################
    
95.          #################################################################
    
96.          #################################################################
    
97.          #################################################################
    
98.          ###Got ARP REQUEST, return our IP
    
99. ##############################################################
    
100.          #################################################################
     
101.          #################################################################
     
102.          #################################################################
     
103.          ####################################################
     
104. done
     
105. Bytes transferred = 4587788 (46010c hex)
     
106. NetBootFileXferSize= 0046010c
     
107. Erasing SPI Flash...
     
108. .
     
109. Writing to SPI Flash...
     
110. .
     
111. done
     
112. Automatic boot of image at addr 0x80A00000 ...
     
113. ## Booting image at 80a00000 ...
     
114.    Image Name:   MIPS OpenWrt Linux-4.14.171
     
115.    Image Type:   MIPS Linux Kernel Image (lzma compressed)
     
116.    Data Size:    1873476 Bytes =  1.8 MB
     
117.    Load Address: 80001000
     
118.    Entry Point:  80001000
     
119.    Verifying Checksum ... OK
     
120.    Uncompressing Kernel Image ... OK
     
121. No initrd
     
122. ## Transferring control to Linux (at address 80001000) ...
     
123. ## Giving linux memsize in MB, 128
     
124. 
     
125. Starting kernel ...
     
126. 
     
127. [    0.000000] Linux version 4.14.171 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r10947-65030d81f3)) #0 SMP Thu Feb 27 21:05:12 2020
     
128. [    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
     
129. [    0.000000] bootconsole [early0] enabled
     
130. [    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
     
131. [    0.000000] MIPS: machine is Netgear WNDR3700v5
     
132. [    0.000000] Determined physical RAM map:
     
133. [    0.000000]  memory: 08000000 [url=home.php?mod=space&uid=162986]@[/url] 00000000 (usable)
     
134. [    0.000000] Initrd not found or empty - disabling initrd
     
135. [    0.000000] VPE topology {2,2} total 4
     
136. [    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
     
137. [    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
     
138. [    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
     
139. [    0.000000] Zone ranges:
     
140. [    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
     
141. [    0.000000]   HighMem  empty
     
142. [    0.000000] Movable zone start for each node
     
143. [    0.000000] Early memory node ranges
     
144. [    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
     
145. [    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
     
146. [    0.000000] random: get_random_bytes called from 0x80575744 with crng_init=0
     
147. [    0.000000] percpu: Embedded 14 pages/cpu s26224 r8192 d22928 u57344
     
148. [    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32512
     
149. [    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
     
150. [    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
     
151. [    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
     
152. [    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
     
153. [    0.000000] Writing ErrCtl register=00020000
     
154. [    0.000000] Readback ErrCtl register=00020000
     
155. [    0.000000] Memory: 122508K/131072K available (4746K kernel code, 241K rwdata, 588K rodata, 1260K init, 255K bss, 8564K reserved, 0K cma-reserved, 0K highmem)
     
156. [    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
     
157. [    0.000000] Hierarchical RCU implementation.
     
158. [    0.000000] NR_IRQS: 256
     
159. [    0.000000] CPU Clock: 1000MHz
     
160. [    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns
     
161. [    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 3822520893 ns
     
162. [    0.000011] sched_clock: 32 bits at 500MHz, resolution 2ns, wraps every 4294967295ns
     
163. [    0.015536] Calibrating delay loop... 666.41 BogoMIPS (lpj=3332096)
     
164. [    0.087852] pid_max: default: 32768 minimum: 301
     
165. [    0.097180] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
     
166. [    0.110197] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
     
167. [    0.126177] Hierarchical SRCU implementation.
     
168. [    0.135702] smp: Bringing up secondary CPUs ...
     
169. [    0.146052] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
     
170. [    0.146061] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
     
171. [    0.146073] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
     
172. [    0.146227] CPU1 revision is: 0001992f (MIPS 1004Kc)
     
173. [    0.205055] Synchronize counters for CPU 1: done.
     
174. [    0.275216] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
     
175. [    0.275225] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
     
176. [    0.275233] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
     
177. [    0.275304] CPU2 revision is: 0001992f (MIPS 1004Kc)
     
178. [    0.326025] Synchronize counters for CPU 2: done.
     
179. [    0.386948] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
     
180. [    0.386956] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
     
181. [    0.386962] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
     
182. [    0.387054] CPU3 revision is: 0001992f (MIPS 1004Kc)
     
183. [    0.445588] Synchronize counters for CPU 3: done.
     
184. [    0.505189] smp: Brought up 1 node, 4 CPUs
     
185. [    0.517013] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
     
186. [    0.536501] futex hash table entries: 1024 (order: 3, 32768 bytes)
     
187. [    0.548985] pinctrl core: initialized pinctrl subsystem
     
188. [    0.561000] NET: Registered protocol family 16
     
189. [    0.576696] pull PCIe RST: RALINK_RSTCTRL = 4000000
     
190. [    0.886774] release PCIe RST: RALINK_RSTCTRL = 7000000
     
191. [    0.896836] ***** Xtal 40MHz *****
     
192. [    0.903570] release PCIe RST: RALINK_RSTCTRL = 7000000
     
193. [    0.913771] Port 0 N_FTS = 1b102800
     
194. [    0.920673] Port 1 N_FTS = 1b102800
     
195. [    0.927599] Port 2 N_FTS = 1b102800
     
196. [    2.086522] PCIE0 no card, disable it(RST&CLK)
     
197. [    2.095204] PCIE1 no card, disable it(RST&CLK)
     
198. [    2.104007] PCIE2 no card, disable it(RST&CLK)
     
199. [    2.123034] mt7621_gpio 1e000600.gpio: registering 32 gpios
     
200. [    2.134391] mt7621_gpio 1e000600.gpio: registering 32 gpios
     
201. [    2.145598] mt7621_gpio 1e000600.gpio: registering 32 gpios
     
202. [    2.160379] clocksource: Switched to clocksource GIC
     
203. [    2.172022] NET: Registered protocol family 2
     
204. [    2.181450] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
     
205. [    2.195204] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
     
206. [    2.207801] TCP: Hash tables configured (established 1024 bind 1024)
     
207. [    2.220563] UDP hash table entries: 256 (order: 1, 8192 bytes)
     
208. [    2.232067] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
     
209. [    2.244764] NET: Registered protocol family 1
     
210. [    2.480344] 4 CPUs re-calibrate udelay(lpj = 3325952)
     
211. [    2.491878] Crashlog allocated RAM at address 0x3f00000
     
212. [    2.502591] workingset: timestamp_bits=30 max_order=15 bucket_order=0
     
213. [    2.519566] random: fast init done
     
214. [    2.528828] squashfs: version 4.0 (2009/01/31) Phillip Lougher
     
215. [    2.540379] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
     
216. [    2.563465] io scheduler noop registered
     
217. [    2.571156] io scheduler deadline registered (default)
     
218. [    2.582538] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
     
219. [    2.598360] console [ttyS0] disabled
     
220. [    2.605452] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud = 3125000) is a 16550A
     
221. [    2.623366] console [ttyS0] enabled
     
222. [    2.623366] console [ttyS0] enabled
     
223. [    2.637149] bootconsole [early0] disabled
     
224. [    2.637149] bootconsole [early0] disabled
     
225. [    2.655568] MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
     
226. [    2.669985] spi-mt7621 1e000b00.spi: sys_freq: 250000000
     
227. [    2.681482] m25p80 spi0.0: unrecognized JEDEC id bytes: ff, ff, ff
     
228. [    2.693869] m25p80: probe of spi0.0 failed with error -2
     
229. [    2.705138] libphy: Fixed MDIO Bus: probed
     
230. [    2.782144] mtk_soc_eth 1e100000.ethernet: generated random MAC address 5a:21:d5:18:13:a4
     
231. [    2.798619] libphy: mdio: probed
     
232. [    4.204672] mtk_soc_eth 1e100000.ethernet: loaded mt7530 driver
     
233. [    4.217265] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 21
     
234. [    4.236694] NET: Registered protocol family 10
     
235. [    4.247283] Segment Routing with IPv6
     
236. [    4.254762] NET: Registered protocol family 17
     
237. [    4.263700] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
     
238. [    4.289490] 8021q: 802.1Q VLAN Support v1.8
     
239. [    4.300587] hctosys: unable to open rtc device (rtc0)
     
240. [    4.310939] usb_vbus: disabling
     
241. <font color="#ff0000"><b>[    4.317759] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6</b></font>
     
242. [    4.332664] Please append a correct "root=" boot option; here are the available partitions:
     
243. [    4.349291] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

复制代码

fyi***

看清楚4楼的红字

1. 有无官方固件Bootlog？
2. 为何不刷官方固件而选wndr3700v5？
3. 改动哪些闪存分区？

yy5***

wayos 的固件flash都不是普通的芯片，写有隐含分区数据的，并且有CRC校验，一般来说只能克隆同款产品数据恢复。

baf***

220G和541G好像一毛一样。只是一个外置电源。一个外置电源

fyi***

1. Clocks: CPU: 880MHz, DDR: 1066MHz, Bus: 293MHz, Ref: 40MHz

复制代码

1. [    0.000000] CPU Clock: 1000MHz

复制代码

总之，巧妇难为无米之炊

gd***

bafnczy 发表于 2020-3-19 08:55
220G和541G好像一毛一样。只是一个外置电源。一个外置电源

老哥，看了下541G参数好像有戏，太好了，去试试，刚好坛子有人发过固件https://www.right.com.cn/FORUM/thread-168794-1-1.html

gd***

网盘资源挂了

fyi***

7620 wayos FBM-541

楼主能否认真点？

baf***

gdli 发表于 2020-3-19 17:55
老哥，看了下541G参数好像有戏，太好了，去试试，刚好坛子有人发过固件https://www.right.com.cn/FORUM/t ...

这个链接是541的不是541g，两个硬件不一样