[研究]关于刷CFE变砖

cmheia

前几日给HG320换系统，要先换CFE，
上一次刷CFE已经记不清是多久以前了，
步骤忘得差不多了，
结果还真刷砖了，
刚才用编程器读取了刷砖的这片Flash。
前面128K不就是CFE嘛，
跟用来刷的CFE对比了下，二进制相同……
也就是说，CFE是刷好了的，
但是启动的时候灯微亮，TTL无输出，
猜测是刷之前没清空nvram，
新CFE读取了旧的配置，才挂了……
改天再多做几次实验验证下~

ARM

关注一下楼主的帖子，我的路由器也挂了。不知道问题出在哪，新手，拆机都不会。

chaohua27

烧纸，跟你分享下，据我表哥说：写入flash的数据，不一定是按顺序写进去的，也有可能前面引导的程序一部分在最后。

这是我上次也跟你一样，都不知道多久没刷机了，结果直接刷了磊科的固件，砖了，在他家救砖的时候他跟我说的。

cmheia

chaohua27 发表于 2014-2-23 16:35
烧纸，跟你分享下，据我表哥说：写入flash的数据，不一定是按顺序写进去的，也有可能前面引导的程序一部 ...

这……
公司专业搞arm-linux的同事说uboot之类的启动器都是放f前面的。
而且我去年有试过用winhex把cfe和固件拼装到16M的文件里烧入FLASH（其它空间填0xFF或0x00），开机就正常用了。
我这回是在原有235V1.8b4下TTL刷cfe挂的，
我把0~0x1FFFF位置的CFE和0x20000开始的6631424字节（0x20000~0x672FFF）固件分别保存到新文件，
跟新刷的CFE、原先很早以前刷入的固件netcore(NR235W)CN-V1.8(beta4).130815.bin分别对比，
结果……MD5是相同的。
也就是说，原有固件还在，CFE已经换成新的。

这块FLASH的内容如下：
0~0x1FFFF新刷进去的CFE（TT用的），
0x20000~0x672FFF原来的固件（netcore(NR235W)CN-V1.8(beta4).130815.bin），
0x680000~0x6C084D是第一堆乱糟糟的数据，
0x6C084E~0x6C0FFF是0x00，
0x6C1000~0x6CCFFFF是0xFF，
0x6D0000~0x7EFFFF是第二堆乱糟糟的数据，
0x7F0000~0x7F140F是第一处NVRAM内容，
0x7F1410~0x7F7FFF又是0xFF，
0x7F8000~0x7F863B是第二处NVRAM内容……
0x7F863C~0x7FFFFF（文件尾）又是0xFF。

0x680000~0x7FFFFF这段空间里没有第二份CFE……
改天有空把这块FLASH里的两处“NVRAM内容”分别填充0xFF，看看是谁在作怪。

824626242

cmheia 发表于 2014-2-23 18:28
这……
公司专业搞arm-linux的同事说uboot之类的启动器都是放f前面的。
而且我去年有试过用winhex把cfe ...

我和你差不多
RG200E-CA收来时是236W 1.8 用只能脚本刷 由于自作聪明换了tomato固件，导致走到一半没刷进去，就按脚本命令手动更新了固件，但是cfe没更新！重启一直在miniweb，还好有miniweb，利用miniweb输网址大法刷好独舞cfe，重启直接能用TT了

cmheia

824626242 发表于 2014-2-23 20:10
我和你差不多
RG200E-CA收来时是236W 1.8 用只能脚本刷 由于自作聪明换了tomato固件，导致走到一半 ...

差很多，谢谢

ljj818

楼主推断有道理  我也是刷挂以后 用热拔插刷 cfe就是起不来  得把flash清空才能起来  

cmheia

ljj818 发表于 2014-2-23 22:36
楼主推断有道理  我也是刷挂以后 用热拔插刷 cfe就是起不来  得把flash清空才能起来

噢，你不说我都忘咯，我这片F刷挂了后也有试过“热插拔”重刷CFE的（我的HG320改装了双FLASH，用跳线切换，另一片是16M的FLASH，刷的楼顶所述CFE），好几次呢，没有探究这个是否真的刷进去了（我这8/16M双FLASH组合，“热插拔”极有可能是刷不进去的）。
如果（热插拔）真的刷进去了，那么同理可以通过nvram erase救砖了，你不妨试下。

ljj818

cmheia 发表于 2014-2-23 22:45
噢，你不说我都忘咯，我这片F刷挂了后也有试过“热插拔”重刷CFE的（我的HG320改装了双FLASH，用跳线切换 ...

同一个cfe  同一个flash芯片 只要是刷完固件重启变砖的  热拔插就是起不来  把芯片用编程器清空  再热拔插 就能起来  热拔插cfe肯定是写入了 用编程器读出就知道   同样 换一个非空的flash 热拔插也能起来   我得出的结论跟你说的差不多  就是一但闪存里有变砖的固件  热拔插写入的cfe也会再次被引导入砖

cmheia

ljj818 发表于 2014-2-23 22:56
同一个cfe  同一个flash芯片 只要是刷完固件重启变砖的  热拔插就是起不来  把芯片用编程器清空  再热拔 ...

嗯，要不再砖一次试验下热插拔清nvram救砖？
翻了下以前的旧帖子，也有提到JTAG救砖非得清NVRAM才成功的：
https://www.right.com.cn/forum/thread-119073-1-1.html

失、语

幼稚好牛逼。膜拜。。。。。

cmheia

今晚见鬼了，用CFE和固件拼装到8M的0xFF文件里构成编程器固件，刷入开机……出了几十行文字就砖了……根据这些信息，初步判定是……这个16M的CFE不能用于8M的FLASH，否则……分区表错误，死

1. Decompressing...done
   
2. 
   
3. 
   
4. CFE version 5.60.120.9  based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
   
5. Build Date: 2011年 05月 04日 星期三 15:32:36 CST (root@localhost.localdomain)
   
6. Copyright (C) 2000-2008 Broadcom Corporation.
   
7. 
   
8. Init Arena
   
9. Init Devs.
   
10. Boot partition size = 131072(0x20000)
    
11. Found a 8MB ST compatible serial flash
    
12. [CFE][boot][ST Serial flash offset 00000000 size 128KB]
    
13. [CFE][trx][ST Serial flash offset 00020000 size 1KB]
    
14. [CFE][os][ST Serial flash offset 0002001C size 8032KB]
    
15. [CFE][nvram][ST Serial flash offset 007F8000 size 32KB]
    
16. [CFE][boot][ST Serial flash offset 00000000 size 128KB]
    
17. [CFE][trx0][ST Serial flash offset 00020000 size 1KB]
    
18. [CFE][os0][ST Serial flash offset 0002001C size 8832KB]
    
19. [CFE][trx1][ST Serial flash offset 008C0000 size 1KB]
    
20. [CFE][os1][ST Serial flash offset 008C001C size 4294966497KB]
    
21. [CFE][nvram][ST Serial flash offset 007F8000 size 32KB]
    
22. et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.120.9
    
23. CPU type 0x19749: 133MHz
    
24. Tot mem: 65536 KBytes
    
25. 
    
26. CFE mem:    0x80700000 - 0x8079A7D0 (632784)
    
27. Data:       0x807306D0 - 0x80733850 (12672)
    
28. BSS:        0x80733850 - 0x807347D0 (3968)
    
29. Heap:       0x807347D0 - 0x807987D0 (409600)
    
30. Stack:      0x807987D0 - 0x8079A7D0 (8192)
    
31. Text:       0x80700000 - 0x807306C8 (198344)
    
32. 
    
33. Committing NVRAM...done
    
34. Waiting for reset button release...done

复制代码

还好今天我已经把这320改装成了不死之身！
稍后继续试验

cmheia

把刚砖的这片FLASH读取出来了，发现7F8000-7F863B位置生成了一段nvram内容，与上一次砖的同样位置的内容一样……
另外，据bank说，这是CFE指定了分区表导致的……
那么，待会再找那个64k nvram的CFE试试。

cmheia

果然是CFE的分区表有问题
刷上64k nvram的 CFE开机了

1. Decompressing.............done
   
2. Start to blink diag led ...
   
3. 
   
4. 
   
5. CFE version 5.60.120.19  based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
   
6. Build Date: 01/16/11 02:17:41 CST (work@seal3.fedora10)
   
7. Copyright (C) 2000-2008 Broadcom Corporation.
   
8. 
   
9. Initializing Arena
   
10. Initializing Devices.
    
11. 
    
12. No DPN
    
13. This is a Serial Flash
    
14. Boot partition size = 262144(0x40000)
    
15. Found a 8MB ST compatible serial flash
    
16. Partition information:
    
17. boot    #00   00000000 -> 0003FFFF  (262144)
    
18. trx     #01   00040000 -> 0004001B  (28)
    
19. os      #02   0004001C -> 007EFFFF  (8060900)
    
20. nvram   #03   007F0000 -> 007FFFFF  (65536)
    
21. Partition information:
    
22. boot    #00   00000000 -> 0003FFFF  (262144)
    
23. trx     #01   00040000 -> 007EFFFF  (8060928)
    
24. nvram   #02   007F0000 -> 007FFFFF  (65536)
    
25. BCM47XX_GMAC_ID
    
26. et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.120.19
    
27. CPU type 0x19749: 500MHz
    
28. Total memory: 65536 KBytes
    
29. 
    
30. CFE mem:    0x80700000 - 0x807B0790 (722832)
    
31. Data:       0x80745AA0 - 0x80749AD0 (16432)
    
32. BSS:        0x80749AD0 - 0x8074A790 (3264)
    
33. Heap:       0x8074A790 - 0x807AE790 (409600)
    
34. Stack:      0x807AE790 - 0x807B0790 (8192)
    
35. Text:       0x80700000 - 0x80745A94 (285332)
    
36. 
    
37. Boot version: v5.3.3
    
38. The boot is CFE
    
39. No mac find, use default mac
    
40. 
    
41. ### CLKDIV= 0x80e0842, SFlashClkDiv=8 clkdivsf=0 ###
    
42. CMD: [ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0]
    
43. Device eth0:  hwaddr 00-0A-C2-01-01-01, ipaddr 192.168.1.1, mask 255.255.255.0
    
44.         gateway not set, nameserver not set
    
45. CMD: [go;]
    
46. Check CRC of image1
    
47. 
    
48. Err invalid Boot magic -1 810697800
    
49. Invalid boot block on disk
    
50. AP code error! boot_from(0)
    
51. CMD: [flash -ctheader -https : flash1.trx]
    
52. Reading :: http_fileop_read = 59046000
    
53. HTTP server listening...(type 'quit' to quit)
    
54. post upgrade.cgi
    
55. content length == 7808465, 2d 2d 2d 2d 2d 2d 2d 2d
    
56. 222content length == 7807065, rxlen == 1400, jj == 1400
    
57. H, D, R, 0, 00, 20, 77, 00
    
58. Last : 0d, 0a, 2d, 2d, 2d, 2d, 2d, 2d
    
59. len == 150
    
60. filename = F:\router\Tools\cmh\hg320-test\flash\tomato-NVRAM64K-1.28.115-MIPSR2-20140114.Hyzoom.RT_N5x-8M-virtual**-AR.bin
    
61. receive data count == 7807968
    
62. code pattern : HDR0
    
63. firmware version : -25.00.00
    
64. (net_https) http_fileop_read, 758
    
65. post upgrade.cgi
    
66. content length == 7808506, 2d 2d 2d 2d 2d 2d 2d 2d
    
67. 222content length == 7807106, rxlen == 1400, jj == 1400
    
68. E, 1, 5, 0, 00, 00, 00, 00
    
69. Last : 0d, 0a, 2d, 2d, 2d, 2d, 2d, 2d
    
70. len == 150
    
71. filename = F:\router\Tools\cmh\hg320-test\flash\tomato-E1500USB-NVRAM64K-1.28.115-MIPSR2-20140114.Hyzoom.RT_N5x-8M-virtual**-AR.bin
    
72. receive data count == 7808000
    
73. code pattern : E150
    
74. firmware version : 4.20.06
    
75. http finished its job, now it is flash driver's turn!bang, bang....
    
76. Develop.....  | http_fileop_close
    
77. Develop.....  | http_fileop_uninit
    
78. Done. 7808000 bytes read, fname=flash1.trx
    
79. CODE Pattern is correct! (E150)
    
80. Invalid header length.  This is not a TRX image.
    
81. The file transferred is not a valid firmware image.
    
82. CFE> quit
    
83. CMD: [quit]
    
84. Invalid command: "quit"
    
85. Available commands: upgrade, et, modify, nvram, reboot, flash, memtest, f, e, d, u, batch, go, boot, load, save, ttcp, tcp, rlogin, client, ping, arp, ifconfig, show, unsetenv, printenv, setenv, help
    
86. 
    
87. *** command status = -1
    
88. CFE> nvram erase
    
89. CMD: [nvram erase]
    
90. *** command status = 0
    
91. CFE> flash -ctheader : flash1.trx
    
92. CMD: [flash -ctheader : flash1.trx]
    
93. Reading :: _tftpd_open(): retries=0/3
    
94. Done. 3544064 bytes read, fname=flash1.trx
    
95. CODE Pattern is correct! (E150)
    
96. it's code.bin
    
97. 
    
98. TRX file size = 3543040
    
99. Burning code image.
    
100. Programming...done. 3543040 bytes written
     
101. *** command status = 0
     
102. CFE> flash -noerase -noheader : flash1.trx
     
103. CMD: [flash -noerase -noheader : flash1.trx]
     
104. Reading :: _tftpd_open(): retries=0/3
     
105. Done. 7807968 bytes read, fname=flash1.trx
     
106. Programming...done. 7807968 bytes written
     
107. *** command status = 0
     
108. CFE> reboot
     
109. ompressing.............done
     
110. Start to blink diag led ...
     
111. 
     
112. 
     
113. CFE version 5.60.120.19  based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
     
114. Build Date: 01/16/11 02:17:41 CST (work@seal3.fedora10)
     
115. Copyright (C) 2000-2008 Broadcom Corporation.
     
116. 
     
117. Initializing Arena
     
118. Initializing Devices.
     
119. 
     
120. No DPN
     
121. This is a Serial Flash
     
122. Boot partition size = 262144(0x40000)
     
123. Found a 8MB ST compatible serial flash
     
124. Partition information:
     
125. boot    #00   00000000 -> 0003FFFF  (262144)
     
126. trx     #01   00040000 -> 0004001B  (28)
     
127. os      #02   0004001C -> 007EFFFF  (8060900)
     
128. nvram   #03   007F0000 -> 007FFFFF  (65536)
     
129. Partition information:
     
130. boot    #00   00000000 -> 0003FFFF  (262144)
     
131. trx     #01   00040000 -> 007EFFFF  (8060928)
     
132. nvram   #02   007F0000 -> 007FFFFF  (65536)
     
133. BCM47XX_GMAC_ID
     
134. et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.120.19
     
135. CPU type 0x19749: 500MHz
     
136. Total memory: 65536 KBytes
     
137. 
     
138. CFE mem:    0x80700000 - 0x807B0790 (722832)
     
139. Data:       0x80745AA0 - 0x80749AD0 (16432)
     
140. BSS:        0x80749AD0 - 0x8074A790 (3264)
     
141. Heap:       0x8074A790 - 0x807AE790 (409600)
     
142. Stack:      0x807AE790 - 0x807B0790 (8192)
     
143. Text:       0x80700000 - 0x80745A94 (285332)
     
144. 
     
145. Boot version:  ==> v5.3.3
     
146. The boot is CFE
     
147. No mac find, use default mac
     
148. Committing NVRAM...done
     
149. Decompressing.............donese...done
     
150. Start to blink diag led ...
     
151. 
     
152. 
     
153. CFE version 5.60.120.19  based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
     
154. Build Date: 01/16/11 02:17:41 CST (work@seal3.fedora10)
     
155. Copyright (C) 2000-2008 Broadcom Corporation.
     
156. 
     
157. Initializing Arena
     
158. Initializing Devices.
     
159. 
     
160. No DPN
     
161. This is a Serial Flash
     
162. Boot partition size = 262144(0x40000)
     
163. Found a 8MB ST compatible serial flash
     
164. Partition information:
     
165. boot    #00   00000000 -> 0003FFFF  (262144)
     
166. trx     #01   00040000 -> 0004001B  (28)
     
167. os      #02   0004001C -> 007EFFFF  (8060900)
     
168. nvram   #03   007F0000 -> 007FFFFF  (65536)
     
169. Partition information:
     
170. boot    #00   00000000 -> 0003FFFF  (262144)
     
171. trx     #01   00040000 -> 007EFFFF  (8060928)
     
172. nvram   #02   007F0000 -> 007FFFFF  (65536)
     
173. BCM47XX_GMAC_ID
     
174. et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.120.19
     
175. CPU type 0x19749: 500MHz
     
176. Total memory: 65536 KBytes
     
177. 
     
178. CFE mem:    0x80700000 - 0x807B0790 (722832)
     
179. Data:       0x80745AA0 - 0x80749AD0 (16432)
     
180. BSS:        0x80749AD0 - 0x8074A790 (3264)
     
181. Heap:       0x8074A790 - 0x807AE790 (409600)
     
182. Stack:      0x807AE790 - 0x807B0790 (8192)
     
183. Text:       0x80700000 - 0x80745A94 (285332)
     
184. 
     
185. Boot version: v5.3.3
     
186. The boot is CFE
     
187. No mac find, use default mac
     
188. 
     
189. ### CLKDIV= 0x80e0842, SFlashClkDiv=8 clkdivsf=0 ###
     
190. CMD: [ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0]
     
191. Device eth0:  hwaddr 00-0A-C2-01-01-01, ipaddr 192.168.1.1, mask 255.255.255.0
     
192.         gateway not set, nameserver not set
     
193. CMD: [go;]
     
194. Check CRC of image1
     
195.   Len:     0x772000     (7806976)       (0xBC040000)
     
196.   Offset0: 0x1C         (28)            (0xBC04001C)
     
197.   Offset1: 0xA8C        (2700)  (0xBC040A8C)
     
198.   Offset2: 0xD7000      (880640)        (0xBC117000)
     
199.   Header CRC:    0xE77C24EB
     
200.   Calculate CRC: 0xE77C24EB
     
201. Image 1 is OK
     
202. Try to load image 1.
     
203. Waiting for 3 seconds to upgrade ...
     
204. CMD: [load -raw -addr=0x807b0790 -max=0x384f870 :]
     
205. Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
     
206. Loading: _tftpd_open(): retries=0/3
     
207. _tftpd_open(): retries=1/3
     
208. _tftpd_open(): retries=2/3
     
209. 
     
210. ### Start=1564817915 E=2100414961 Delta=535597046 ###
     
211. Failed.
     
212. Could not load :: Timeout occured
     
213. CMD: [boot -raw -z -addr=0x80001000 -max=0x6ff000 flash0.os:]
     
214. Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
     
215. Loading: .. 5100 bytes read
     
216. 
     
217. ### Start=2105540456 E=2106825584 Delta=1285128 ###
     
218. Entry at 0x80001000
     
219. Closing network.
     
220. Starting program at 0x80001000
     
221. Linux version 2.6.22.19 (root@tomato) (gcc version 4.2.4) #17 Tue Jan 14 10:37:16 CST 2014
     
222. CPU revision is: 00019749
     
223. Determined physical RAM map:
     
224. memory: 04000000 @ 00000000 (usable)
     
225. Zone PFN ranges:
     
226.   Normal          0 ->    16384
     
227.   HighMem     16384 ->    16384
     
228. early_node_map[1] active PFN ranges
     
229.     0:        0 ->    16384
     
230. Built 1 zonelists.  Total pages: 16384
     
231. Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
     
232. Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
     
233. Primary data cache 32kB, 4-way, linesize 32 bytes.
     
234. Synthesized TLB refill handler (20 instructions).
     
235. Synthesized TLB load handler fastpath (32 instructions).
     
236. Synthesized TLB store handler fastpath (32 instructions).
     
237. Synthesized TLB modify handler fastpath (31 instructions).
     
238. PID hash table entries: 512 (order: 9, 2048 bytes)
     
239. CPU: BCM5357 rev 2 pkg 9 at 500 MHz
     
240. Using 250.000 MHz high precision timer.
     
241. console [ttyS0] enabled
     
242. Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
     
243. Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
     
244. Memory: 61408k/65536k available (32k kernel code, 4072k reserved, 2602k data, 120k init, 0k highmem)
     
245. Mount-cache hash table entries: 512
     
246. NET: Registered protocol family 16
     
247. PCI: no core
     
248. PCI: no core
     
249. PCI: Fixing up bus 0
     
250. NET: Registered protocol family 2
     
251. Time: MIPS clocksource has been installed.
     
252. IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
     
253. TCP established hash table entries: 2048 (order: 2, 16384 bytes)
     
254. TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
     
255. TCP: Hash tables configured (established 2048 bind 2048)
     
256. TCP reno registered
     
257. squashfs: version 3.0 (2006/03/15) Phillip Lougher
     
258. io scheduler noop registered (default)
     
259. HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
     
260. N_HDLC line discipline registered.
     
261. Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
     
262. serial8250: ttyS0 at MMIO 0xb8000300 (irq = 8) is a 16550A
     
263. PPP generic driver version 2.4.2
     
264. MPPE/MPPC encryption/compression module registered
     
265. NET: Registered protocol family 24
     
266. PPPoL2TP kernel driver, V0.18.3
     
267. PPTP driver version 0.8.5
     
268. pflash: found no supported devices
     
269. Found an ST compatible serial flash with 128 64KB blocks; total size 8MB
     
270. Creating 5 MTD partitions on "sflash":
     
271. 0x00000000-0x00040000 : "pmon"
     
272. 0x00040000-0x007f0000 : "linux"
     
273. 0x00117000-0x007c0000 : "rootfs"
     
274. 0x007c0000-0x007f0000 : "jffs2"
     
275. 0x007f0000-0x00800000 : "nvram"
     
276. _nvram_init: allocat header: 2150694912, size= 65536
     
277. u32 classifier
     
278.     OLD policer on
     
279. Netfilter messages via NETLINK v0.30.
     
280. nf_conntrack version 0.5.0 (512 buckets, 4096 max)
     
281. ip_tables: (C) 2000-2006 Netfilter Core Team
     
282. ipt_account 0.1.21 : Piotr Gasidlo <quaker@barbara.eu.org>, http://www.barbara.eu.org/~quaker/ipt_account/
     
283. net/ipv4/netfilter/tomato_ct.c [Jan 14 2014 10:00:11]
     
284. NET: Registered protocol family 1
     
285. NET: Registered protocol family 10
     
286. ip6_tables: (C) 2000-2006 Netfilter Core Team
     
287. NET: Registered protocol family 17
     
288. 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
     
289. All bugs added by David S. Miller <davem@redhat.com>
     
290. VFS: Mounted root (squashfs filesystem) readonly.
     
291. Freeing unused kernel memory: 120k freed
     
292. Warning: unable to open an initial console.
     
293. Restarting system.
     
294. Please stand by while rebooting the system...
     
295. Decompressing.............done
     
296. Start to blink diag led ...
     
297. 
     
298. 
     
299. CFE version 5.60.120.19  based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
     
300. Build Date: 01/16/11 02:17:41 CST (work@seal3.fedora10)
     
301. Copyright (C) 2000-2008 Broadcom Corporation.
     
302. 
     
303. Initializing Arena
     
304. Initializing Devices.
     
305. 
     
306. No DPN
     
307. This is a Serial Flash
     
308. Boot partition size = 262144(0x40000)
     
309. Found a 8MB ST compatible serial flash
     
310. Partition information:
     
311. boot    #00   00000000 -> 0003FFFF  (262144)
     
312. trx     #01   00040000 -> 0004001B  (28)
     
313. os      #02   0004001C -> 007EFFFF  (8060900)
     
314. nvram   #03   007F0000 -> 007FFFFF  (65536)
     
315. Partition information:
     
316. boot    #00   00000000 -> 0003FFFF  (262144)
     
317. trx     #01   00040000 -> 007EFFFF  (8060928)
     
318. nvram   #02   007F0000 -> 007FFFFF  (65536)
     
319. BCM47XX_GMAC_ID
     
320. et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.120.19
     
321. CPU type 0x19749: 500MHz
     
322. Total memory: 65536 KBytes
     
323. 
     
324. CFE mem:    0x80700000 - 0x807B0790 (722832)
     
325. Data:       0x80745AA0 - 0x80749AD0 (16432)
     
326. BSS:        0x80749AD0 - 0x8074A790 (3264)
     
327. Heap:       0x8074A790 - 0x807AE790 (409600)
     
328. Stack:      0x807AE790 - 0x807B0790 (8192)
     
329. Text:       0x80700000 - 0x80745A94 (285332)
     
330. 
     
331. Boot version: v5.3.3
     
332. The boot is CFE
     
333. No mac find, use default mac
     
334. 
     
335. ### CLKDIV= 0x80e0842, SFlashClkDiv=8 clkdivsf=0 ###
     
336. CMD: [ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0]
     
337. Device eth0:  hwaddr 00-0A-C2-01-01-01, ipaddr 192.168.1.1, mask 255.255.255.0
     
338.         gateway not set, nameserver not set
     
339. CMD: [go;]
     
340. Check CRC of image1
     
341.   Len:     0x772000     (7806976)       (0xBC040000)
     
342.   Offset0: 0x1C         (28)            (0xBC04001C)
     
343.   Offset1: 0xA8C        (2700)  (0xBC040A8C)
     
344.   Offset2: 0xD7000      (880640)        (0xBC117000)
     
345.   Header CRC:    0xE77C24EB
     
346.   Calculate CRC: 0xE77C24EB
     
347. Image 1 is OK
     
348. Try to load image 1.
     
349. Waiting for 3 seconds to upgrade ...
     
350. CMD: [load -raw -addr=0x807b0790 -max=0x384f870 :]
     
351. Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
     
352. Loading: _tftpd_open(): retries=0/3
     
353. _tftpd_open(): retries=1/3
     
354. _tftpd_open(): retries=2/3
     
355. 
     
356. ### Start=1564857287 E=2100415190 Delta=535557903 ###
     
357. Failed.
     
358. Could not load :: Timeout occured
     
359. CMD: [boot -raw -z -addr=0x80001000 -max=0x6ff000 flash0.os:]
     
360. Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
     
361. Loading: .. 5100 bytes read
     
362. 
     
363. ### Start=2105540386 E=2106825561 Delta=1285175 ###
     
364. Entry at 0x80001000
     
365. Closing network.
     
366. Starting program at 0x80001000
     
367. Linux version 2.6.22.19 (root@tomato) (gcc version 4.2.4) #17 Tue Jan 14 10:37:16 CST 2014
     
368. CPU revision is: 00019749
     
369. Determined physical RAM map:
     
370. memory: 04000000 @ 00000000 (usable)
     
371. Zone PFN ranges:
     
372.   Normal          0 ->    16384
     
373.   HighMem     16384 ->    16384
     
374. early_node_map[1] active PFN ranges
     
375.     0:        0 ->    16384
     
376. Built 1 zonelists.  Total pages: 16384
     
377. Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
     
378. Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
     
379. Primary data cache 32kB, 4-way, linesize 32 bytes.
     
380. Synthesized TLB refill handler (20 instructions).
     
381. Synthesized TLB load handler fastpath (32 instructions).
     
382. Synthesized TLB store handler fastpath (32 instructions).
     
383. Synthesized TLB modify handler fastpath (31 instructions).
     
384. PID hash table entries: 512 (order: 9, 2048 bytes)
     
385. CPU: BCM5357 rev 2 pkg 9 at 500 MHz
     
386. Using 250.000 MHz high precision timer.
     
387. console [ttyS0] enabled
     
388. Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
     
389. Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
     
390. Memory: 61408k/65536k available (32k kernel code, 4072k reserved, 2602k data, 120k init, 0k highmem)
     
391. Mount-cache hash table entries: 512
     
392. NET: Registered protocol family 16
     
393. PCI: no core
     
394. PCI: no core
     
395. PCI: Fixing up bus 0
     
396. NET: Registered protocol family 2
     
397. Time: MIPS clocksource has been installed.
     
398. IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
     
399. TCP established hash table entries: 2048 (order: 2, 16384 bytes)
     
400. TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
     
401. TCP: Hash tables configured (established 2048 bind 2048)
     
402. TCP reno registered
     
403. squashfs: version 3.0 (2006/03/15) Phillip Lougher
     
404. io scheduler noop registered (default)
     
405. HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
     
406. N_HDLC line discipline registered.
     
407. Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
     
408. serial8250: ttyS0 at MMIO 0xb8000300 (irq = 8) is a 16550A
     
409. PPP generic driver version 2.4.2
     
410. MPPE/MPPC encryption/compression module registered
     
411. NET: Registered protocol family 24
     
412. PPPoL2TP kernel driver, V0.18.3
     
413. PPTP driver version 0.8.5
     
414. pflash: found no supported devices
     
415. Found an ST compatible serial flash with 128 64KB blocks; total size 8MB
     
416. Creating 5 MTD partitions on "sflash":
     
417. 0x00000000-0x00040000 : "pmon"
     
418. 0x00040000-0x007f0000 : "linux"
     
419. 0x00117000-0x007c0000 : "rootfs"
     
420. 0x007c0000-0x007f0000 : "jffs2"
     
421. 0x007f0000-0x00800000 : "nvram"
     
422. _nvram_init: allocat header: 2150694912, size= 65536
     
423. u32 classifier
     
424.     OLD policer on
     
425. Netfilter messages via NETLINK v0.30.
     
426. nf_conntrack version 0.5.0 (512 buckets, 4096 max)
     
427. ip_tables: (C) 2000-2006 Netfilter Core Team
     
428. ipt_account 0.1.21 : Piotr Gasidlo <quaker@barbara.eu.org>, http://www.barbara.eu.org/~quaker/ipt_account/
     
429. net/ipv4/netfilter/tomato_ct.c [Jan 14 2014 10:00:11]
     
430. NET: Registered protocol family 1
     
431. NET: Registered protocol family 10
     
432. ip6_tables: (C) 2000-2006 Netfilter Core Team
     
433. NET: Registered protocol family 17
     
434. 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
     
435. All bugs added by David S. Miller <davem@redhat.com>
     
436. VFS: Mounted root (squashfs filesystem) readonly.
     
437. Freeing unused kernel memory: 120k freed
     
438. Warning: unable to open an initial console.
     
439. emf: module license 'Proprietary' taints kernel.
     
440. eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.100.138.20
     
441. wl_module_init: passivemode set to 0x0
     
442. eth1: Broadcom BCM4347 802.11 Wireless Controller 5.100.138.20
     
443. / # lo: File exists
     
444. No such device
     
445. No such device
     
446. No such device
     
447. System halted.
     
448. System halted
     

复制代码

cmheia

这会儿又换了Arctic更早发的老CFE，也好使，刷上MultiWAN开机了