wz161996 发表于 2022-1-8 11:49

网件R6900/R7000还原备份的CFE后变砖，修复记录见3楼

本帖最后由 wz161996 于 2022-1-8 12:53 编辑

先说下背景：
之前为了体验AImesh，刷了1.3.0.7的CFE，之后可以成功的刷ac68u的官方固件。后来换了tplink的易展路由，这个就闲置了。最近没事，就想还原到官方的固件，降级到384固件后开启ssh，直接刷入之前备份的CFE，完成后reboot重启路由。

现状：
进不去系统，直接拆机，接TTL，尝试中断启动后，TFTP方式刷入固件，上传成功后，一直卡在reading，包括ac68u固件，网件官方固件，TT-WRT固件等等。。手动重启，30-30-30，各种方式都尝试了，均无效。

TTL不中断，日志输出到最后，一直打印以下内容：
starting...
Couldn't get the enabled rules of Parental-control correctly!
rc: ==> binding interface(vlan1,eth1,eth2,wds0.*,wds1.*,wds2.*) for lldpd
RAST 18: ROAMAST Start...
wanduck: delay 4 seconds before the first detect...
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed


修复前的完整日志：
Digital core power voltage set to 1.0V
Decompressing...done
Digital core power voltage set to 1.0V

SHMOO VER 1.13

PKID07DC06011801080000000000001A103F01000000

S300001D7
00001360


RDLYW0 00000004

RDENW0 00000035

RDQSW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
00 --++++++++++++++++++++++++++X++++++++++++++++++++++++++---------
01 --------+++++++++++++++++++++++++X++++++++++++++++++++++++------
02 -----+++++++++++++++++++++++++X++++++++++++++++++++++++---------
03 ----+++++++++++++++++++++++++X++++++++++++++++++++++++----------
04 --++++++++++++++++++++++++X++++++++++++++++++++++++-------------
05 ------++++++++++++++++++++++++++X+++++++++++++++++++++++++------
06 --++++++++++++++++++++++++X++++++++++++++++++++++++-------------
07 -------++++++++++++++++++++++++++X++++++++++++++++++++++++++----
08 ---++++++++++++++++++++++++X+++++++++++++++++++++++-------------
09 ---------+++++++++++++++++++++++++X++++++++++++++++++++++++-----
10 ----++++++++++++++++++++++++X++++++++++++++++++++++++-----------
11 -----------++++++++++++++++++++++++X++++++++++++++++++++++++----
12 ---++++++++++++++++++++++++X++++++++++++++++++++++++------------
13 ------------++++++++++++++++++++++++X+++++++++++++++++++++++----
14 ------++++++++++++++++++++++++X++++++++++++++++++++++++---------
15 -----------+++++++++++++++++++++++++X++++++++++++++++++++++++---


P   W0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
00 --++++++++++++++++++++++++++X++++++++++++++++++++++++++---------
01 --------++++++++++++++++++++++++X++++++++++++++++++++++++-------
02 -----+++++++++++++++++++++++++X+++++++++++++++++++++++++--------
03 ----++++++++++++++++++++++++++X+++++++++++++++++++++++++--------
04 -+-+++++++++++++++++++++++++X++++++++++++++++++++++++-----------
05 -----++++++++++++++++++++++++++X+++++++++++++++++++++++++-------
06 --+++++++++++++++++++++++++X+++++++++++++++++++++++++-----------
07 --------++++++++++++++++++++++++++X+++++++++++++++++++++++++----
08 --++++++++++++++++++++++++X++++++++++++++++++++++++-------------
09 --------+++++++++++++++++++++++++X+++++++++++++++++++++++++-----
10 --+++++++++++++++++++++++++X+++++++++++++++++++++++++-----------
11 ----------+++++++++++++++++++++++++X++++++++++++++++++++++++----
12 -++++++++++++++++++++++++++X+++++++++++++++++++++++++-----------
13 ----------+++++++++++++++++++++++++X++++++++++++++++++++++++----
14 -----+++++++++++++++++++++++++X++++++++++++++++++++++++---------
15 ----------+++++++++++++++++++++++++X+++++++++++++++++++++++++---


N   W0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
00 -+++++++++++++++++++++++++++X++++++++++++++++++++++++++---------
01 -------+++++++++++++++++++++++++X+++++++++++++++++++++++++------
02 ----+++++++++++++++++++++++++X+++++++++++++++++++++++++---------
03 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++----------
04 --++++++++++++++++++++++++X++++++++++++++++++++++++-------------
05 -----++++++++++++++++++++++++++X+++++++++++++++++++++++++-------
06 --++++++++++++++++++++++++X++++++++++++++++++++++++-------------
07 ------+++++++++++++++++++++++++++X+++++++++++++++++++++++++++---
08 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++----------
09 ---------+++++++++++++++++++++++++++X+++++++++++++++++++++++++--
10 ---++++++++++++++++++++++++++X+++++++++++++++++++++++++---------
11 -----------+++++++++++++++++++++++++X++++++++++++++++++++++++---
12 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++----------
13 -----------+++++++++++++++++++++++++X++++++++++++++++++++++++---
14 ------+++++++++++++++++++++++++X+++++++++++++++++++++++++-------
15 -----------++++++++++++++++++++++++++X+++++++++++++++++++++++++-


WRDQW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
00 +++++++++++++++++++++++X+++++++++++++++++++++++------++++++++++-
01 ++++++++++++++++++++++++X++++++++++++++++++++++++-------+++++++-
02 ++++++++++++++++++++++++X+++++++++++++++++++++++------+++++++++-
03 ++++++++++++++++++++++++X+++++++++++++++++++++++------+++++++++-
04 +++++++++++++++++++++X++++++++++++++++++++----------+++++++++++-
05 +++++++++++++++++++++++X+++++++++++++++++++++++------++++++++++-
06 ++++++++++++++++++++++X+++++++++++++++++++++---------++++++++++-
07 ++++++++++++++++++++++++X++++++++++++++++++++++++------++++++++-
08 ++++++++++++++++++++++X++++++++++++++++++++++--------++++++++++-
09 -++++++++++++++++++++++++X+++++++++++++++++++++++----------++++-
10 +++++++++++++++++++++++X+++++++++++++++++++++++-------+++++++++-
11 -++++++++++++++++++++++++X+++++++++++++++++++++++-----------+++-
12 +++++++++++++++++++++++X++++++++++++++++++++++------+++++++++++-
13 -++++++++++++++++++++++++X+++++++++++++++++++++++-----------+++-
14 ++++++++++++++++++++++++X+++++++++++++++++++++++---------++++++-
15 -++++++++++++++++++++++++X+++++++++++++++++++++++----------++++-


WRDMW0 00000023
WRDMW0 00000024


ADDR

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
00 +++++++++++++++++++S+++++++++++X++++++++++++++++++++++++++++++++

Decompressing...done


CFE for Foxconn Router R7000 version: v1.0.22
Build Date: Wed Mar 19 11:14:20 CST 2014
Init Arena
Init Devs.
Boot up from NAND flash...
Bootcode Boot partition size = 524288(0x80000)
DDR Clock: 800 MHz
Info: DDR frequency set from clkfreq=1000,*800*
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.15.1 (r407936)
et1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.15.1 (r407936)
CPU type 0x0: 1000MHz
Tot mem: 262144 KBytes

Device eth0:hwaddr 00-46-BC-8D-5E-71, ipaddr 192.168.1.1, mask 255.255.255.0
      gateway not set, nameserver not set
Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: .... 4068064 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000
console enabled, bootconsole disabled
serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
brd: module loaded
loop: module loaded
pflash: found no supported devices
bcmsflash: found no supported devices
Boot partition size = 524288(0x80000)
lookup_nflash_rootfs_offset: offset = 0x200000
nflash: squash filesystem with lzma found at block 28
Creating 4 MTD partitions on "nflash":
0x000000000000-0x000000080000 : "boot"
0x000000080000-0x000000200000 : "nvram"
0x000000200000-0x000004000000 : "linux"
0x00000039fb10-0x000004000000 : "rootfs"
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
Mirror/redirect action on
u32 classifier
    Performance counters on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (3991 buckets, 15964 max)
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Registering the dns_resolver key type
Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012
NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
Spare area=64 eccbytes 56, ecc bytes located at:
2 3 4 5 6 7 8 9 10 11 12 13 14 15 18 19 20 21 22 23 24 25 26 27 28 29 30 31 34 35 36 37 38 39 40 41 42 43 44 45 46 47 50 51 52 53 54 55 56 57 58 59 60 61 62 63
Available 7 bytes at (off,len):
(1,1) (16,2) (32,2) (48,2) (0,0) (0,0) (0,0) (0,0)
Scanning device for bad blocks
Options: NO_AUTOINCR,NO_READRDY,BBT_SCAN2NDPAGE,
Creating 2 MTD partitions on "brcmnand":
0x000004000000-0x000007ec0000 : "brcmnand"
0x000007ec0000-0x000008000000 : "asus"
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
devtmpfs: mounted
Freeing init memory: 212K
init_main start

1: set_action 0


Hit ENTER for console...

firmware version: 384.12_0
init_nvram for model(49)
usage: nvram
usage: nvram

FA on.
Override FA nvram...
ctf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
et_module_init: passivemode set to 0x0
et_module_init: txworkq set to 0x1
et_module_init: et_txq_thresh set to 0xce4
aux0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.126 (r561982)
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.126 (r561982)
et_probe: mvlan vid: 0
et_probe: mvlan vid: 0

et_probe: mvlan en 0
eth1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.126 (r561982)
set_wltxpower(0x022d): unit: 0, txpower: 100
set_wltxpower(0x022d): unit: 1, txpower: 100
dpsta_init: msglevel set to 0x1
hotplug net INTERFACE=aux0 ACTION=add
hotplug net INTERFACE=eth1 ACTION=add
hotplug net INTERFACE=eth0 ACTION=add
hotplug net INTERFACE=dpsta ACTION=add
wl_module_init: passivemode set to 0x0
wl_module_init: igs set to 0x0
wl_module_init: txworkq set to 0x1
eth2: Broadcom BCM4360 802.11 Wireless Controller 6.37.14.126 (r561982)
hotplug net INTERFACE=eth2 ACTION=add
eth3: Broadcom BCM4360 802.11 Wireless Controller 6.37.14.126 (r561982)
hotplug net INTERFACE=eth3 ACTION=add
hotplug net: add net eth3.
hotplug net(eth3): skip 2. usb_path /sys/devices/pci0002:00/0002:00:00.0/0002:02:00.0.
1: check_action 0: 1(preinit)
start jffs2: 4, 65798144
Empty flash at 0x006c6434 ends at 0x006c6800
Empty flash at 0x006d2118 ends at 0x006d2800
Empty flash at 0x010119d0 ends at 0x01012000
Empty flash at 0x0101e648 ends at 0x0101e800
Empty flash at 0x02354a0c ends at 0x02355000
Empty flash at 0x031a9a0c ends at 0x031aa000
Empty flash at 0x031b7430 ends at 0x031b7800
JFFS2 warning: (104) jffs2_do_read_inode_internal: no data nodes found for ino #73930
/jffs/.asusrouter killdon: errno: 3 pid 125
1: check_action 0: 1(preinit)
JFFS2 warning: (1) jffs2_do_read_inode_internal: no data nodes found for ino #73930
start_logger:
_ifconfig: name=eth1 flags=1043 IFUP addr= netmask=
et0: et_mvlan_netdev_event: event 16 for vlan1 mvlan_en 0
et0: et_mvlan_netdev_event: event 5 for vlan1 mvlan_en 0
hotplug net INTERFACE=vlan1 ACTION=add
et0: et_mvlan_netdev_event: event 16 for vlan2 mvlan_en 0
et0: et_mvlan_netdev_event: event 5 for vlan2 mvlan_en 0
hotplug net INTERFACE=vlan2 ACTION=add
update_lan_state(lan_, 0, 0)
generate_wl_para(0x0c15): unit 0 subunit -1
generate_wl_para(0x0fde): bw: 0
generate_wl_para(0x0fe0): chanspec: 0
generate_wl_para(0x0fe1): bw_cap: 3
generate_wl_para(0x0fe7): obss_coex: 1
wlconf_pre(0x114f): set vhtmode 1
generate_wl_para(0x0c15): unit 1 subunit -1
generate_wl_para(0x0fde): bw: 0
generate_wl_para(0x0fe0): chanspec: 0
generate_wl_para(0x0fe1): bw_cap: 7
generate_wl_para(0x0fe7): obss_coex: 0
wlconf_pre(0x114f): set vhtmode 1
vlan1et0: et_mvlan_netdev_event: event 13 for vlan1 mvlan_en 0
: cmd=14 et0: et_mvlan_netdev_event: event 1 for vlan1 mvlan_en 0
(errno 95): Operation not supported
_ifconfig: name=vlan1 flags=1243 IFUP addr= netmask=
hotplug net INTERFACE=br0 ACTION=add
_ifconfig: name=eth1 flags=1243 IFUP addr= netmask=
_ifconfig: name=eth2 flags=1243 IFUP addr= netmask=
generate_wl_para(0x0c15): unit 0 subunit -1
generate_wl_para(0x0fde): bw: 0
generate_wl_para(0x0fe0): chanspec: 0
generate_wl_para(0x0fe1): bw_cap: 3
generate_wl_para(0x0fe7): obss_coex: 1
generate_wl_para(0x0c15): unit 0 subunit 1
generate_wl_para(0x0c15): unit 0 subunit 2
generate_wl_para(0x0c15): unit 0 subunit 3

start_lan: setting MAC address of bridge br0 as 00:46:BC:8D:5E:71
_ifconfig: name=br0 flags=1243 IFUP addr=192.168.1.1 netmask=255.255.255.0
_ifconfig: name=lo flags=1043 IFUP addr=127.0.0.1 netmask=255.0.0.0
_ifconfig: name=lo:0 flags=1043 IFUP addr=127.0.1.1 netmask=255.0.0.0
route_manip: cmd=ADD name=lo addr=127.0.0.0 netmask=255.0.0.0 gateway=0.0.0.0 metric=0
update_lan_state(lan_, 2, 0)
nat_rule: stop_nat_rules 1.
stop_nat_rules: apply the redirect_rules state 0 ret 0
start_lan 2965
# wanduck: Got LAN(-1) information:
wanduck: delay 1 seconds before the first detect...
wanduck: delay 2 seconds before the first detect...
begin
begin
begin
end
end
begin
end
start_lan_port(0) 1
illegal, cannot enable DualWAN
wanduck: delay 3 seconds before the first detect...
TZ watchdog
msgget ok
disk_monitor: starting...
disk_monitor: day=5, week=6, time=13:5.
disk_monitor: decide if scan the target...
disk_monitor: 0: wait_second=36000...
disk_monitor: 1: wait_second=36000...
disk_monitor: wait_second=36000...
disk_monitor: Pause...

starting...
Couldn't get the enabled rules of Parental-control correctly!
rc: ==> binding interface(vlan1,eth1,eth2,wds0.*,wds1.*,wds2.*) for lldpd
RAST 18: ROAMAST Start...
wanduck: delay 4 seconds before the first detect...
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
wanduck: delay 5 seconds before the first detect...
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
button RESET pressed
wanduck(0): NC send SYS_WAN_MODEM_OFFLINE_EVENT.
button RESET pressed

# Enable direct rule
wanduck(0): NC send SYS_WAN_CABLE_UNPLUGGED_EVENT.
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
vlan1: cmd=14 (errno 95): Operation not supported
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
: WIF, idx
rssi threshold:
rssi hit count:
idle period:
idle rate:
: WIF, idx
rssi threshold: [-55]
rssi hit count:
idle period:
idle rate:
: TotalWI

RAST 21: ipc accept socket...
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
init
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
start_wan: start_waet0: et_mvlan_netdev_event: event 8 for vlan2 mvlan_en 0
n_if(0)!
[1 preinit:start_wan_if +et0: et_mvlan_netdev_event: event 13 for vlan2 mvlan_en 0
22] unit=0.
et0: et_mvlan_netdev_event: event 1 for vlan2 mvlan_en 0

update_wan_state(wan0_, 0, 0)
convert_wan_nvram(wan0_)
** wan_ifname: vlan2 is NOT UP
_ifconfig: name=vlan2 flags=1043 IFUP addr= netmask=
update_wan_state(wan0_, 1, 0)
start_wan_if(0x0697): ifup:vlan2
_ifconfig: name=vlan2 flags=1043 IFUP addr= netmask=
start_wan_if(0x06ad): start auth:0
start_auth:: done
start_wan_if(0x06b7): start udhcpc:vlan2, 0
start_wan_if(): End.
udhcpc_wan:: deconfig
_ifconfig: name=vlan2 flags=1043 IFUP addr=0.0.0.0 netmask=
wan_down(vlan2)
wan_down(vlan2): .
stop_auth:: done
route_manip: cmd=DEL name=vlan2 addr=0.0.0.0 netmask=0.0.0.0 gateway=(null) metric=0
update_wan_state(wan0_, 3, 0)
update_wan_state(wan0_, 4, 3)
udhcpc:: deconfig done
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
Enable USB power.
Start USB with the original procedure.
start_usb
no tune_bdflush
button RESET pressed
You can release RESET button now!
xhci_hcd 0000:00:0c.0: Failed to enable MSI-X
xhci_hcd 0000:00:0c.0: failed to allocate MSI entry
usb usb1: No SuperSpeed endpoint companion for config 1interface 0 altsetting 0 ep 129: using minimum values
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
csw_retry 100
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!
button RESET pressed
You can release RESET button now!



wz161996 发表于 2022-1-8 11:53

TTL里中断启动，CFE下输入help无效，应该是CFE未解锁，是不是只能改SPI启动或者更换NAND闪存来救砖了

wz161996 发表于 2022-1-8 12:58

本帖最后由 wz161996 于 2022-1-8 13:02 编辑

刚发完贴，在论坛网件板块闲逛，无意中看到一帖子，突发灵感尝试一下，竟然成功了。。
原贴地址：https://www.right.com.cn/forum/thread-7510553-1-1.html

帖子中说可以在CFE下刷CFE，就在终端中CFE下试了一下flash命令，结果
竟然响应了flash命令的使用方法，有希望。。于是继续查资料，结合论坛里K3改双启动后刷入CFE的命令，以及上面帖子中的命令，最终使用之前刷的1.3.0.7版本CFE，在CFE下成功刷入，然后nvram erase，reboot，成功开机。

willcy 发表于 2022-8-29 08:17

我的R7000改AC68U后，想还原成R7000，也是刷入自己备份的CFE成砖了，我对比了一下备份的CFE和论坛的，应该是备份不对。刚买了TTL-USB线，目前正在找攻略。

willcy 发表于 2022-8-30 15:58

wz161996 发表于 2022-1-8 12:58
刚发完贴，在论坛网件板块闲逛，无意中看到一帖子，突发灵感尝试一下，竟然成功了。。
原贴地址：https:// ...

能具体说下这个流程吗？谢谢！

a1387186244 发表于 2022-9-1 22:08

编程器救砖

flice 发表于 2023-3-9 22:01

本帖最后由 flice 于 2023-3-15 00:20 编辑

willcy 发表于 2022-8-30 15:58
能具体说下这个流程吗？谢谢！网上资料搜到的，证实可用。
tftpserver下放cfe，直接cfe下刷
flash -noheader 192.168.1.22:cfe.bin flash0.boot

935173815 发表于 2023-8-17 12:16

a1387186244 发表于 2022-9-1 22:08
编程器救砖

有编程器固件吗？求分享
页: [1]
查看完整版本: 网件R6900/R7000还原备份的CFE后变砖，修复记录见3楼