K3C-UBOOT对比-113-175 顺便救砖且成功

独爱***

不扯废话了，拆了两台k3c都是三星颗粒，一台原厂113版本固件，可以直接降级到93版本，这台有2个坏块。另一台原厂175版本固件，不能降级，会出现无限重启现象，这台有7个坏块。发两份启动的ttl信息对比，各位大佬与看官可以拿去研究。助力175版本可以顺利降级刷固件
不好意思，搞错版本号了不是173，是175，已修正
正在折腾降级，替换uboot中

更新下，把113的前4个分区替换到175路由里面，直接挂掉不启动了，不清楚到底是修改了什么东西，等待救砖工具的到来
目前只有上电信息，其他全无，手残党

1. ROM VER: 2.1.0
   
2. CFG 0a
   
3. B
   
4. .
   
5. .

复制代码

***续续续续续***
27楼一片报废nand的生成方法，手动笑哭电梯直达27楼
K3C救砖成功，按照@jbzzz 坛友K3C做 NAND编程器这个帖子也增加了个nand底座，成为了编程器。
ROM VER: 2.1.0
CFG 0a
B
.
.


U-Boot 2010.06-00044-gb399a23-LANTIQ-v-2.3.136 (Jul 24 2017 - 10:45:54)

interAptiv
cps cpu/ddr run in 800/666 Mhz
DRAM:  224 MiB
NAND:  Could not find valid JEDEC parameter page; aborting
NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
128 MiB
Bad block table found at page 65408, version 0x01
Bad block table found at page 65344, version 0x01
nand_read_bbt: Bad block at 0x000001500000       这里的几个坏块是三星颗粒的坏块
nand_read_bbt: Bad block at 0x000001580000
nand_read_bbt: Bad block at 0x000003000000
nand_read_bbt: Bad block at 0x000003520000
nand_read_bbt: Bad block at 0x000003540000
nand_read_bbt: Bad block at 0x000003560000
nand_read_bbt: Bad block at 0x000003580000
nand_read_bbt: Bad block at 0x000004060000
nand_read_bbt: Bad block at 0x000007fe0000
ecc failure @ page 512, retrying with retry mode 0
ecc failure @ page 513, retrying with retry mode 0
ecc failure @ page 514, retrying with retry mode 0
ecc failure @ page 515, retrying with retry mode 0
ecc failure @ page 516, retrying with retry mode 0
ecc failure @ page 517, retrying with retry mode 0
ecc failure @ page 518, retrying with retry mode 0
ecc failure @ page 519, retrying with retry mode 0
NAND read from offset 100000 failed -77
No Valid Environment Area Found
ecc failure @ page 640, retrying with retry mode 0
ecc failure @ page 641, retrying with retry mode 0
ecc failure @ page 642, retrying with retry mode 0
ecc failure @ page 643, retrying with retry mode 0
ecc failure @ page 644, retrying with retry mode 0
ecc failure @ page 645, retrying with retry mode 0
ecc failure @ page 646, retrying with retry mode 0
ecc failure @ page 647, retrying with retry mode 0
NAND read from offset 140000 failed -77
No Valid Reundant Environment Area Found
In:    serial
Out:   serial
Err:   serial
Net:   multi type
Internal phy firmware version: 0x853c
GRX500 Switch

Type "run flash_nfs" to mount root filesystem over NFS


Press press hardware button for more than 4 seconds to run web failsafe mode



Catution: hardware button wasn't pressed or not long enough!
Continuing normal boot...

Hit any key to stop autoboot:  0
GRX500 #
运行到这里以后就带电扒开nand座子更换颗粒，然后按照@paldier 大佬的救砖教程继续操作
先擦除一遍nand
GRX500 #nand erase
然后通过tftp刷入uboot
GRX500 # run update_nandboot      
Using GRX500 Switch device
TFTP from server 192.168.2.100; our IP address is 192.168.2.1
Filename 'u-boot-nand.bin'.
Load address: 0x80800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##################################
done
Bytes transferred = 1835008 (1c0000 hex)
device 0 offset 0x0, size 0x180000

device 0 offset 0x1340000, size 0x6c00000
Skipping bad block at  0x01500000    这里显示的坏块数量不用管，因为这还是原先那片三星颗粒的坏块位置信息
Skipping bad block at  0x01580000
Skipping bad block at  0x03000000
Skipping bad block at  0x03520000
Skipping bad block at  0x03540000
Skipping bad block at  0x03560000
Skipping bad block at  0x03580000
Skipping bad block at  0x04060000


NAND write: device 0 offset 0x0, size 0x1c0000
0x1c0000 bytes written: OK

刷完uboot以后重启
GRX500 # reset
ROM VER: 2.1.0
CFG 0a
B
.
.


U-Boot 2010.06-00044-gb399a23-LANTIQ-v-2.3.136 (Jul 24 2017 - 10:45:54)

interAptiv
cps cpu/ddr run in 800/666 Mhz
DRAM:  224 MiB
NAND:  ONFI flash detected
ONFI param page 0 valid
NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD S34ML01G2)
128 MiB
Bad block table not found for chip 0
Bad block table not found for chip 0
Bad block table written to 0x000007fe0000, version 0x01
Bad block table written to 0x000007fc0000, version 0x01
In:    serial
Out:   serial
Err:   serial
Net:   multi type
Internal phy firmware version: 0x853c
GRX500 Switch

Type "run flash_nfs" to mount root filesystem over NFS


Press press hardware button for more than 4 seconds to run web failsafe mode



Catution: hardware button wasn't pressed or not long enough!
Continuing normal boot...

Hit any key to stop autoboot:  0
GRX500 #
然后继续按照教程输入fullimage.img uImage_bootcore uImage三个文件
GRX500 # run update_fullimage
Creating 1 MTD partitions on "nand0":
0x000001340000-0x000007f40000 : "mtd=8"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: empty MTD device detected
UBI: create volume table (copy #1)
UBI: create volume table (copy #2)
UBI: attached mtd1 to ubi0
UBI: MTD device name:            "mtd=8"
UBI: MTD device size:            108 MiB
UBI: number of good PEBs:        864
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     0
UBI: available PEBs:             852
UBI: total number of reserved PEBs: 12
UBI: number of PEBs reserved for bad PEB handling: 8
UBI: max/mean erase counter: 1/0
Using GRX500 Switch device
TFTP from server 192.168.2.100; our IP address is 192.168.2.1
Filename 'fullimage.img'.
Load address: 0x80800000
Loading: #################################################################
         省略若干#号
         ######
done
Bytes transferred = 25985160 (18c8088 hex)
Image contains header with name [LTQCPE RootFS]
rootfsB volume not found
Creating dynamic volume rootfsB of size 22970368 and volume id 4
Volume "rootfsB" found at volume id 4
Erasing redundant Nand...

Writing to redundant Nand... done
Image contains header with name [MIPS LTQCPE Linux-3.10.102]
kernelB volume not found
Creating dynamic volume kernelB of size 3014656 and volume id 3
Volume "kernelB" found at volume id 3
Erasing Nand...

Writing to Nand... done
Image contains header with name [LTQCPE RootFS]
rootfsA volume not found
Creating dynamic volume rootfsA of size 22970368 and volume id 1
Volume "rootfsA" found at volume id 1
Erasing redundant Nand...

Writing to redundant Nand... done
Image contains header with name [MIPS LTQCPE Linux-3.10.102]
kernelA volume not found
Creating dynamic volume kernelA of size 3014656 and volume id 0
Volume "kernelA" found at volume id 0
Erasing Nand...

Writing to Nand... done
GRX500 # run update_kernel
UBI: mtd1 is detached from ubi0
Creating 1 MTD partitions on "nand0":
0x000001340000-0x000007f40000 : "mtd=8"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd1 to ubi0
UBI: MTD device name:            "mtd=8"
UBI: MTD device size:            108 MiB
UBI: number of good PEBs:        864
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     4
UBI: available PEBs:             442
UBI: total number of reserved PEBs: 422
UBI: number of PEBs reserved for bad PEB handling: 8
UBI: max/mean erase counter: 13/1
Using GRX500 Switch device
TFTP from server 192.168.2.100; our IP address is 192.168.2.1
Filename 'uImage'.
Load address: 0x80800000
Loading: #################################################################
         省略若干#号
         ####
done
Bytes transferred = 3014656 (2e0000 hex)
Image contains header with name [MIPS LTQCPE Linux-3.10.102]
Volume kernelB found at valid 3
remove UBI volume kernelB (id 3)
Creating dynamic volume kernelB of size 3014656 and volume id 3
Volume "kernelB" found at volume id 3
Erasing redundant Nand...

Writing to redundant Nand... done
Image contains header with name [MIPS LTQCPE Linux-3.10.102]
Volume kernelA found at valid 0
remove UBI volume kernelA (id 0)
Creating dynamic volume kernelA of size 3014656 and volume id 0
Volume "kernelA" found at volume id 0
Erasing Nand...

Writing to Nand... done
GRX500 # run update_bootcore
UBI: mtd1 is detached from ubi0
Creating 1 MTD partitions on "nand0":
0x000001340000-0x000007f40000 : "mtd=8"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd1 to ubi0
UBI: MTD device name:            "mtd=8"
UBI: MTD device size:            108 MiB
UBI: number of good PEBs:        864
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     4
UBI: available PEBs:             442
UBI: total number of reserved PEBs: 422
UBI: number of PEBs reserved for bad PEB handling: 8
UBI: max/mean erase counter: 21/1
Using GRX500 Switch device
TFTP from server 192.168.2.100; our IP address is 192.168.2.1
Filename 'uImage_bootcore'.
Load address: 0x80800000
Loading: #################################################################
         省略若干#号
         ############################################################
done
Bytes transferred = 1966272 (1e00c0 hex)
Image contains header with name [MIPS 4Kec Bootcore]
bootcoreB volume not found
Creating dynamic volume bootcoreB of size 1966272 and volume id 7
Volume "bootcoreB" found at volume id 7
Erasing redundant Nand...

Writing to redundant Nand... done
Image contains header with name [MIPS 4Kec Bootcore]
bootcoreA volume not found
Creating dynamic volume bootcoreA of size 1966272 and volume id 6
Volume "bootcoreA" found at volume id 6
Erasing Nand...

Writing to Nand... done
GRX500 #


到此输入reset重启，成功进入ISDK系统


***以下为首发图文未改动***
一、原厂113版本的启动TTL信息，主要看uboot部分

1. ROM VER: 2.1.0
   
2. CFG 0a
   
3. B
   
4. .
   
5. .
   
6. 
   
7. 
   
8. U-Boot 2010.06-00044-gb399a23-LANTIQ-v-2.3.136 (Jul 24 2017 - 10:45:54)
   
9. 
   
10. interAptiv
    
11. cps cpu/ddr run in 800/666 Mhz
    
12. DRAM:  224 MiB
    
13. NAND:  Could not find valid JEDEC parameter page; aborting
    
14. NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
    
15. 128 MiB
    
16. Bad block table found at page 65408, version 0x01
    
17. Bad block table found at page 65344, version 0x01
    
18. nand_read_bbt: Bad block at 0x000004060000
    
19. nand_read_bbt: Bad block at 0x000007fe0000
    
20. In:    serial
    
21. Out:   serial
    
22. Err:   serial
    
23. Net:   multi type
    
24. Internal phy firmware version: 0x853c
    
25. GRX500 Switch
    
26. 
    
27. Type "run flash_nfs" to mount root filesystem over NFS
    
28. 
    
29. 
    
30. Press press hardware button for more than 4 seconds to run web failsafe mode
    
31. 
    
32. 
    
33. 
    
34. Catution: hardware button wasn't pressed or not long enough!
    
35. Continuing normal boot...
    
36. 
    
37. Hit any key to stop autoboot:  0
    
38. Creating 1 MTD partitions on "nand0":
    
39. 0x000001340000-0x000007f40000 : "mtd=8"
    
40. UBI: attaching mtd1 to ubi0
    
41. UBI: physical eraseblock size:   131072 bytes (128 KiB)
    
42. UBI: logical eraseblock size:    126976 bytes
    
43. UBI: smallest flash I/O unit:    2048
    
44. UBI: VID header offset:          2048 (aligned 2048)
    
45. UBI: data offset:                4096
    
46. UBI: attached mtd1 to ubi0
    
47. UBI: MTD device name:            "mtd=8"
    
48. UBI: MTD device size:            108 MiB
    
49. UBI: number of good PEBs:        863
    
50. UBI: number of bad PEBs:         1
    
51. UBI: max. allowed volumes:       128
    
52. UBI: wear-leveling threshold:    4096
    
53. UBI: number of internal volumes: 1
    
54. UBI: number of user volumes:     7
    
55. UBI: available PEBs:             301
    
56. UBI: total number of reserved PEBs: 562
    
57. UBI: number of PEBs reserved for bad PEB handling: 8
    
58. UBI: max/mean erase counter: 5517/4280
    
59. Volume bootcoreA found at volume id 4
    
60. read 0 bytes from volume 4 to a0400000(buf address)
    
61. Read [2666496] bytes
    
62. Volume kernelA found at volume id 0
    
63. read 0 bytes from volume 0 to 80800000(buf address)
    
64. Read [3047424] bytes
    
65. ## Booting kernel from Legacy Image at 80800000 ...
    
66.    Image Name:   MIPS LTQCPE Linux-3.10.102
    
67.    Created:      2017-09-19   8:11:32 UTC
    
68.    Image Type:   MIPS Linux Kernel Image (lzma compressed)
    
69.    Data Size:    3014592 Bytes = 2.9 MiB
    
70.    Load Address: a0020000
    
71.    Entry Point:  a002df00
    
72.    Verifying Checksum ... OK
    
73.    Uncompressing Kernel Image ... OK
    
74. 
    
75. Starting kernel ...

复制代码

二、原厂175版本的启动TTL信息，主要看uboot部分

1. ROM VER: 2.1.0
   
2. CFG 0a
   
3. B
   
4. .
   
5. .
   
6. 
   
7. 
   
8. U-Boot 2010.06-00096-g44de763-LANTIQ-v-2.3.136 (Sep 19 2017 - 16:01:02)
   
9. 
   
10. interAptiv
    
11. cps cpu/ddr run in 800/666 Mhz
    
12. DRAM:  224 MiB
    
13. NAND:  Could not find valid JEDEC parameter page; aborting
    
14. NAND device: Manufacturer ID: 0xec, Chip ID: 0xf1 (Samsung NAND 128MiB 3,3V 8-bit)
    
15. 128 MiB
    
16. Bad block table found at page 65408, version 0x01
    
17. Bad block table found at page 65344, version 0x01
    
18. nand_read_bbt: Bad block at 0x000004060000
    
19. nand_read_bbt: Bad block at 0x0000050a0000
    
20. nand_read_bbt: Bad block at 0x000005120000
    
21. nand_read_bbt: Bad block at 0x000005e00000
    
22. nand_read_bbt: Bad block at 0x000006860000
    
23. nand_read_bbt: Bad block at 0x0000068e0000
    
24. nand_read_bbt: Bad block at 0x000007fe0000
    
25. In:    serial
    
26. Out:   serial
    
27. Err:   serial
    
28. Net:   multi type
    
29. Internal phy firmware version: 0x8547
    
30. GRX500 Switch
    
31. 
    
32. Type "run flash_nfs" to mount root filesystem over NFS
    
33. 
    
34. Erasing Nand...
    
35. 
    
36. Writing to Nand... done
    
37. 
    
38. Press press hardware button for more than 4 seconds to run web failsafe mode
    
39. 
    
40. 
    
41. 
    
42. Catution: hardware button wasn't pressed or not long enough!
    
43. Continuing normal boot...
    
44. 
    
45. Hit any key to stop autoboot:  0
    
46. Creating 1 MTD partitions on "nand0":
    
47. 0x000001340000-0x000007f40000 : "mtd=8"
    
48. UBI: attaching mtd1 to ubi0
    
49. UBI: physical eraseblock size:   131072 bytes (128 KiB)
    
50. UBI: logical eraseblock size:    126976 bytes
    
51. UBI: smallest flash I/O unit:    2048
    
52. UBI: VID header offset:          2048 (aligned 2048)
    
53. UBI: data offset:                4096
    
54. UBI: attached mtd1 to ubi0
    
55. UBI: MTD device name:            "mtd=8"
    
56. UBI: MTD device size:            108 MiB
    
57. UBI: number of good PEBs:        858
    
58. UBI: number of bad PEBs:         6
    
59. UBI: max. allowed volumes:       128
    
60. UBI: wear-leveling threshold:    4096
    
61. UBI: number of internal volumes: 1
    
62. UBI: number of user volumes:     7
    
63. UBI: available PEBs:             326
    
64. UBI: total number of reserved PEBs: 532
    
65. UBI: number of PEBs reserved for bad PEB handling: 8
    
66. UBI: max/mean erase counter: 7/2
    
67. Volume bootcoreA found at volume id 4
    
68. read 0 bytes from volume 4 to a0400000(buf address)
    
69. Read [2666496] bytes
    
70. Volume kernelA found at volume id 0
    
71. read 0 bytes from volume 0 to 80800000(buf address)
    
72. Read [3014656] bytes
    
73. ## Booting kernel from Legacy Image at 80800000 ...
    
74.    Image Name:   MIPS LTQCPE Linux-3.10.102
    
75.    Created:      2017-09-19   8:11:32 UTC
    
76.    Image Type:   MIPS Linux Kernel Image (lzma compressed)
    
77.    Data Size:    3014592 Bytes = 2.9 MiB
    
78.    Load Address: a0020000
    
79.    Entry Point:  a002df00
    
80.    Verifying Checksum ... OK
    
81.    Uncompressing Kernel Image ... OK
    
82. 
    
83. Starting kernel ...

复制代码

siyo***

这两个和我的一摸一样
nand_read_bbt: Bad block at 0x000004060000
nand_read_bbt: Bad block at 0x000007fe0000

pal***

卧槽新版uboot，难怪不能降级，uboot备份发上来吧，uboot以加密，无解，只有刷老版本

pal***

谁能搞到斐讯uboot的配置，有必要出第三方uboot了

siyo***

paldier 发表于 2017-11-15 21:00
卧槽新版uboot，难怪不能降级，uboot备份发上来吧，uboot以加密，无解，只有刷老版本

175 uboot （大神发现这固件是113的，可是我系统已经升级到175了）
http://pan.baidu.com/s/1b1lDam

密码 yge8

pal***

phy firmware version: 0x8547 更新了...................不知道175有线体验怎么样，如果好的话可以提出来给大家刷，来吧，非官改175来反馈下有线怎么样

siyo***

5G 不错，2.4G信号渣渣，比K2P差很多

独爱***

paldier 发表于 2017-11-15 21:29
phy firmware version: 0x8547 更新了...................不知道175有线体验怎么样，如果好的话可以提出来 ...

5g六六六，2.4g有点渣，不如k2，有线没发现任何问题，曾经我开机连续开机过15天+正常

new***

同个房间间隔大概10M 5G信号比2.4G还强，5G很稳定，2.4G时不时断流不知道为什么

pal***

你是今天第二个什么都不知道就开始作的，uboot没了之后只有返厂和拆nand两条路，自己选吧

new***

siyo2001 发表于 2017-11-15 21:30
5G 不错，2.4G信号渣渣，比K2P差很多

独爱***

paldier 发表于 2017-11-15 23:46
你是今天第二个什么都不知道就开始作的，uboot没了之后只有返厂和拆nand两条路，自己选吧

返厂与拆nand，这还需要选择嘛，当然是选择后者，拆nand，还请大佬带领，换新nand后我知道只刷uboot（前4个分区）。我如果从其他 低版本路由拿出来这4个分区刷进去是否可行

pal***

独爱你一人 发表于 2017-11-16 18:48
返厂与拆nand，这还需要选择嘛，当然是选择后者，拆nand，还请大佬带领，换新nand后我知道只刷uboot ...

可以啊，目前新版uboot只是要匹配那4个分区就行，主要你是没完全刷进去你就重启了

独爱***

paldier 发表于 2017-11-16 21:27
可以啊，目前新版uboot只是要匹配那4个分区就行，主要你是没完全刷进去你就重启了

cat /mtd0 > /dev/mtd0
cat /mtd1 > /dev/mtd1。。。。。。。。。
不会还需要 sync吧，这步还真没做

pal***

cat /mtd0 > /dev/mtd0
写空数据到mtd0.....................你很666666666