|
|
本帖最后由 dalingo 于 2024-4-7 15:26 编辑
* F1 P0 ]; N% b" Y( A
! c+ h) i, ?0 c7 o0 k本人比较喜欢折腾电子产品，因为学的不是相关专业，技术有限，都是一边折腾一边摸索。* a8 [3 s8 ~, }- U6 a, V' y
最近闲来无事看见咸鱼卖移动光猫F7610m比较便宜（30-50元之间），我猜想应该和联通光猫F7610u硬件（80元左右）是一样的，我这是联通宽带，就想着能不能买个F7610m，ttl刷联通固件改成F7610u。& D0 k' H+ B, Y) A, D6 p
花38元淘来一个，就开始折腾，结果发现碰见不少问题，想来请教各位大神帮忙。
+ |# [7 q. j5 {8 b0 r2 @. n9 d, x1 M: e" Z
% g- b" p( R' o! z+ Z+ N( ?4 v2 m9 s( x& |
' ? }: l( M" H5 o" o3 a7 s1、拆机" O/ a1 U' a2 o* T. P3 T
底部四个螺丝，用十字螺丝刀取下，背面右边有个缺口，用一字螺丝刀一撬就打开了2 A: o+ P W& t% F
( g" T$ w! a9 u7 d. J0 b% `
内部图片，中间下面有一排四个孔就是TTL，从左到右分别是GND、TX、RX、VCC（3.3V）
% i+ z6 y _, ?# O, ]! G% t下边有几个印刷字 73030F7610U_201900，从这个字推测这款光猫与联通F7610u是一样。
1 n8 c7 K. {7 s5 f3 K6 `3 K) f' N/ a, A: r; Q
5 u& b' C$ E" O: r
我焊接了4根插针，方便后面折腾的时候接线，没有焊接经验，第一次GND还虚焊了，折腾了好一会才发现。
4 k0 R$ M3 G7 Q9 N8 I( ?) D% d" a) y( x/ U
背面这个芯片应该是闪存
3 f" @* O5 n' \ O9 L6 E2 T+ K% l( d5 _7 G9 S
( p' a! V" O2 }5 K" b芯片屏蔽罩没有拆开，嫌麻烦，借用一下别人的拆机图看下
- U9 _# k0 v" h2 M+ j* m2 c* V* a- B/ E# k
7 u/ x6 b5 Z5 o- v) @0 s+ p
. c* {/ ?2 \; R; N: [- O* ]2 E+ U7 X
2 r$ D+ S" ?5 j- E" m
2、TTL进uboot很顺利，默认中断时间是1秒，输入任意键就可中断进入uboot：
5 d. v; l$ C8 k# m8 t# ^Boot SPI NAND
/ i: s g; s% kenter bootloader...
8 q' G6 F1 T$ L& N$ Rsecure uboot
' w4 c5 B+ }6 e$ }- a# nverify aes key OK! o( J: Z5 g' `( V& i& o# |
verify puk OK!
4 b0 m/ m7 u& Sverify uboot OK!: I1 y5 K* u+ H
verify pub_n OK!
* Z4 q" D/ s7 Y) }Jump$ u0 W3 _' O- x" A+ \
ddr init
1 @% l0 X5 A- ^2 P, a( Z* J# p& hok$ S, \6 O5 s- w X# |3 D5 I
6 C' B9 w+ D( e; {9 d* u- b" nU-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)( D* h3 j% `" q
% H$ z% D+ e, t/ O, A
CPU : ZX279131@A53,900MHZ
( L( I* e& L/ g+ J+ j ^2 zBoard: ZTE zx279131evb
. U% |: L$ n) Z' X1 [DRAM: 512 MiB( _6 f4 |. R2 v# X. ~8 n
product_vid = 130
+ @2 ]% y( O1 ~5 B1 c" }vid=130-F7610M2 ~, e6 R# ?: C7 C- H
mtk reset,60; j" l4 I# ~2 c0 N2 S/ o. A, `0 J
bootsel=3
3 Y7 ^/ g" T. c$ MNAND: bootsel=3% P# H' w4 V5 _3 X& s
manuid=c9,52' B `5 o1 O0 |* p( M W+ y- Y
HY SPI NAND HYF2GQ4UAACAE 256MiB 3,3V
' Y6 `. k% L$ m' r& ]256 MiB, MLC, erase size: 128 KiB, page size: 2048, OOB size: 644 N& D+ a% ?6 \) t* S0 v& I
256 MiB7 V+ N7 J6 G5 U3 X6 O k
In: serial
* K& C5 Z6 p4 b2 n, t7 ZOut: serial
- u. Q* F9 q! d# W2 [Err: serial) c- Q, l- J2 e7 M% l
usb3.0-reset3 H! [) \5 Z7 A7 T9 c# Q2 n
clk_pll env is not setted, core clk won't change
) Z q! B4 z# G* E7 YNet: mdio_miiphy_initialize
8 ~1 f2 T: H2 A& Y: X8 oaddr 0x10e1004c before value is ff7 r6 G) h7 _1 Y/ d
addr 0x10e1004c after value is ff80ff7 z; ]8 P# o/ p( ?& Z# Z' x! r
after mdio_miiphy_initialize, H( n' v4 V# d/ [+ @1 Q
ref_clk_set success!
; a2 k9 V3 f! }5 C. k' i! feth0
; c/ w6 }) t& X7 }' V8 P' n### main_loop entered: bootdelay=1* i* ~6 s& k& z+ K; m- z1 B: j: E5 W
: C. i) L6 Z. Q* |, x+ L
版本信息：0 G3 }( o0 W/ ~; D5 w2 j+ O4 |
=> version" ]2 I; N) v) a7 z' C7 _
U-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800): w% O. m! E5 r& `% K( Q# ~* t* L
/ i- e: B) b1 {$ vaarch64-linux-gcc.br_real (Buildroot 2017.05-svn2186) 5.3.1 201604128 w9 l6 U W& ~! A; ^; k
GNU ld (GNU Binutils) 2.27/ Y4 I8 L3 K, h$ W n% H* Q9 r
1 r% {$ c" o$ ?+ x% Y+ K主板信息：
- C% C$ T5 N: `9 I. E+ ?=> bdinfo# A' S4 l( Z! x- }5 f/ H7 W% u
arch_number = 0x0004425B# f( ~0 N$ x0 g$ D2 z* R) M( }% @# @
boot_params = 0x80000100
m' C& G% ^' sDRAM bank = 0x00000000# K$ `% I: f( u
-> start = 0x800000006 @' T6 K1 z4 O7 p3 L5 F* m8 ^
-> size = 0x20000000
7 b" c# n) Q9 n- T; b) i& l; A2 deth0name = eth0
) \9 v# g! V' n) qethaddr = 00:41:71:00:00:50
' k/ u2 Y# V5 c+ _' vcurrent eth = eth0
2 k$ J5 |! I G6 L7 Kip_addr = 192.168.1.1. B; s9 I v; Z0 N- M/ k6 i' L0 v7 x$ [
baudrate = 115200 bps
8 c( `# c% d. w4 k/ V3 yTLB addr = 0x9FDF0000% _0 ^: W2 [! z! U5 j
relocaddr = 0x9FD87000
9 ^) @5 \7 J- S: creloc off = 0x17D87000
# V5 p2 T" n1 C) {# x3 Wirq_sp = 0x9F346E30
l3 d) \( w6 m% K1 u# hsp start = 0x9F346E30
; z" f1 _# @6 {( [$ R- l: u
& @+ ]$ _- b. \7 \2 C变量信息：
+ C$ [; L' [; |=> print/ T, i8 g2 O4 G, m1 ~, T
baudrate=1152008 E1 q" w( Z7 j% N; k
bootcmd=setenv bootargs console=$(console) swiotlb=128 root=/dev/mtdblock12 ro rootfstype=jffs2 mem=$(memsize);bootm 0x88000000;3 n# \9 v0 C; q$ M! G. p& q
bootdelay=1% h3 u3 z; J6 ?6 z9 {
bootfile=uboot.bin$ e! r: a$ v& x1 ?4 V+ _+ h9 z/ c ?/ j
bootromfile=bootrom.bin5 ` C- U" i7 T" y9 [
console=ttyAMA0,115200n8
) ^) A% x7 N- O6 ]9 Ienv_na==@@;! o: y5 F+ \8 z/ c" k; ]
env_pa==@@;- i9 g5 [ c4 E0 F
ethact=eth0
5 x+ T% y2 \0 C5 S& p& [. B/ Fethaddr=00:41:71:00:00:50
- j* L( E1 v" L2 o# O; Y3 Mfilesize=43720f
5 a& l7 b& C$ W) I! `2 j0 v3 B) Xfullfile=upgrade.bin
7 d. c `0 M7 u) Tgatewayip=192.168.1.1. u, m3 [2 T* p& K
hostname=unknown
5 N9 P1 K' N, c( U ?& \ipaddr=192.168.1.1+ v' [# L" A& F+ Y, l
linuzfile=vmlinuz.bin/ _ p; |' W6 u
memsize=512M1 }% ?8 M, t9 N8 j
netmask=255.255.255.0
7 i# i$ s3 } C/ knetretry=5
- I) P5 p% u! N2 s8 Z( ^serverip=192.168.1.100
8 Y. B* g! r7 R2 ostderr=serial9 y+ p7 J t" b6 H! i+ X! X
stdin=serial
( t8 \8 D* \5 istdout=serial) T. _/ f/ w3 z
ver=U-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)8 Q0 K6 _$ D) J; b1 y
versioninfo=U-Boot V2.3.0P1N9 20220823211658 0x680000 0x0 0x8f 0x83
; g$ \$ I6 _& U9 Z. O2 m' uEnvironment size: 688/131068 bytes; @% y5 {) ?' v$ Y7 D5 X1 d
# N' E- k* F! Z" {( b/ T9 F
命令：1 |1 |% t2 ^" d% B- ]
=> help) k/ N; u6 z4 Y, ^0 C
? - alias for 'help'
, Z& [( v3 M8 o# }) \bdinfo - print Board Info structure
/ [3 a; g/ g1 \bootk - boot kernel
, m J8 q, u9 @7 x H# [& g" H q% bbootm - boot application image from memory
. x; Q$ s! d' X1 D; ubootzpon- Boot zte pon img from flash device
' d% x: e1 X" w) C: [# i* }$ |$ _cmp - memory compare M4 [% \6 S0 `+ n
cp - memory copy
7 l" n2 ^5 Q, m; Ndownver - upgrade software downloaded from TFTP server# }( t0 I( ?0 k( Z
env - environment handling commands- ^- _' W2 A+ h `" T; z$ Y
fdt - flattened device tree utility commands
1 \" {& h9 @/ \ z Q8 \fsinfo - print information about filesystems
/ i1 j8 P. [( S/ Rfsload - load binary file from a filesystem image# Q8 K" z1 }: Q" y: {6 N: A% X
go - start application at address 'addr'
" d& \& G% b5 R: v& agpiotest- gpiotest dir [num] [in/out];gpiotest value [num] [1/0];gpiotest gvalue [num]
4 j) Z$ B# d; _5 [& g4 d# b) Khelp - print command description/usage1 }- x9 j1 O! n& p* C) W7 b
ls - list files in a directory (default /)
) Y$ K! z0 S; W+ q, J9 [) cmd - memory display
: U! x' s/ w0 i K. A6 x' S6 Mmii - MII utility commands
6 B6 G5 U% P! |$ K9 m: zmt - memory test) E: G& H% C! |' y& q$ N8 z
mw - memory write (fill)
+ T" Q* U+ b9 A% v6 ~! a- E- x0 Jnand - NAND sub-system
* {4 @, z, o# K# g$ G- Knetdebug- set net debug count6 w! M5 n K1 U1 t |* O& r1 ~
phy_init- phy_init
5 O6 X! Z% P4 [, n5 w! i7 Dping - send ICMP ECHO_REQUEST to network host. v0 ?- y/ Y9 ~. X5 b7 w0 O
printenv- print environment variables# {3 L! [# C* ~: h$ F" P" S
reset - Perform RESET of the CPU" {" d/ ]. D; x
run - run commands in an environment variable
% Y7 k; p) |* b5 ?1 c5 ^3 `( J6 ]saveenv - save environment variables to persistent storage; V: L6 c4 u' p( S: N
setenv - set environment variables
; Y/ f1 h9 _1 Stftp - boot image via network using TFTP protocol3 [' t- ?) z, E8 ~5 X) w
tftpput - TFTP put command, for uploading files to a server
) e. Q2 |. D( n% L- N3 `version - print monitor, compiler and linker version
v3 @1 [: Q2 n+ Txmodem - xmodem, g! F7 d: |2 W' }
/ W! o( K% ]4 N, p3、但是TTL进root就被屏蔽了，好像运行到启动内核时，TTL就中断显示输出了
4 E; m1 h8 v7 y* Q+ p) l0 n, t; @! F" D- ?- T& ?5 j2 z
1 I# H5 U, d# z: W4 S0 s' _1 WBoot SPI NAND) s0 E8 w4 V. ^ X) q
enter bootloader...- ^# B/ P" F+ A' w
secure uboot& `( J( C7 {8 p
verify aes key OK!
/ ~! ^/ U: N4 P+ c: ]9 ?verify puk OK!. X4 W$ g& p0 p1 e# t7 q
verify uboot OK!
8 a+ D0 |0 [, b3 y2 r: t- iverify pub_n OK! q) {+ [! w9 Q1 {+ i- t5 I7 q7 D
Jump
6 H+ ~( R1 T1 S$ |0 e8 l8 rddr init
1 q$ W! ~# \3 }8 Y+ r+ Pok
/ @+ P3 ~# `$ i8 K' n- G7 q2 A+ }' B3 G; d% z
1 w% Y* a: N( P+ x
U-Boot 2016.01-rc3 (Nov 29 2022 - 23:23:55 +0800)1 s1 ?7 o6 @! C. D: @# i( @2 N
% o9 B6 a7 n& H5 |- \6 w' H
CPU : ZX279131@A53,900MHZ
" a- U4 h" ^. `) i& y2 eBoard: ZTE zx279131evb ?( a9 m: Q: C4 r7 `
DRAM: 512 MiB1 c% U6 R$ ]8 x
product_vid = 130
% d( h& M2 K& Y y9 Vvid=130-F7610M+ B1 B/ n9 ]5 F; c* n3 W7 }1 P9 W
mtk reset,60
5 o+ M5 ^" ^+ r% Obootsel=3
) z6 H1 T, M( d( _! jNAND: bootsel=3
! |% u; W6 ^; E0 ^ Omanuid=c9,526 k$ g5 n; v" @; V
HY SPI NAND HYF2GQ4UAACAE 256MiB 3,3V% M5 v. g) r5 ]# Z1 g8 b- y
256 MiB, MLC, erase size: 128 KiB, page size: 2048, OOB size: 64; {/ ^; M3 L2 K1 G& \0 @
256 MiB) p; y5 B x0 J4 L
In: serial( o& r, }6 P& `! f' T3 n
Out: serial
0 j' w d8 W6 tErr: serial' |! a8 u0 |) c, Y& K8 u
usb3.0-reset
; @4 | Q; `4 ]+ uclk_pll env is not setted, core clk won't change
6 p0 z3 Z* g7 N' g7 QNet: mdio_miiphy_initialize
5 k9 R$ q" n Y. raddr 0x10e1004c before value is ff! g4 m' B |5 W2 L
addr 0x10e1004c after value is ff80ff
5 H* E' S8 H; ? ^9 x2 _$ ~' Bafter mdio_miiphy_initialize$ H U3 G0 M# N* W% |( h) @
ref_clk_set success!0 M$ t- l P. Y
eth0
! O1 J4 W# v. I$ P9 Z2 R### main_loop entered: bootdelay=17 _+ a C. ?8 c' }# V
3 } Z5 c- k3 @5 x& A8 @6 |! d' e
Hit any key to stop autoboot: 0
) T* F* ]7 q8 Pzboot info init done!9 F y, T# U0 l
skip bad block...addr=0x1000000
$ x+ [* G* I& \4 {4 i# ?select=0x0
0 G2 E( I K; C<nand_read_skip_bad_,1128>!mtdpart=0x6,offset=0x0,mtdpartoffset=0x100000,mtdPartsize=0x80000,length=0x1000
7 {/ U$ z! P8 i. Mtmp=0x00000000, value=01 ~, M, |2 \, J" S( y: _
select=0x0
2 d# [7 y( L0 k/ v" N& A: P- isearch=0x2
, |3 J% |% d6 X3 Z, p( b: Psearch->result[0].entry=680240,offset=2404 G& J" P+ T; H# G" b9 O; x8 h
<nand_read_skip_bad_,1128>!mtdpart=0x2,offset=0x0,mtdpartoffset=0x680000,mtdPartsize=0x2300000,length=0x1ee0000* \$ V" J0 t$ c2 j
<nand_read_skip_bad_,1148>!Skipping bad block 0x10000009 o; q; d, t! l" F& T
RSA Verify OK& }& W" T! A/ V3 t8 F; Y4 |
verify vmlinuz success!!
! U- z) \, T8 r5 M
. m0 D: r! d6 u0 K* N7 e---mtdparts_init--current_mtd_partnum=0-9 y4 {# T; ~+ I5 Z. T/ P
dev id: type = 2, num = 0, size = 0xffffffff, mtd_id = single part
( Z" N0 e* r" S' Y5 dpart : name = rootfs0, size = 0x1ec0000, offset = 0x6a0000
: Y% R, \% e E& }. Ypart : name = rootfs1, size = 0x1ec0000, offset = 0x29a00000 U' E v; n" G% u5 }! e5 J
, P" h' g! T8 r--- jffs2_part_info: partition number 0 for device nand0 (single part)
( |" p+ `* Y2 U! n4 E$ rjffs2_part_info:rootfs0,6a0000
8 g- s K0 P3 c# ]* p/ N6 G### JFFS2 loading '0uImage' to 0x88000000 T, c& n& J3 ^, V8 }% e H
Scanning JFFS2 FS: .. fsload_skip_bad_offset=ll1000000 ............... done.
, }6 z1 {. K1 m/ u7 l### JFFS2 load complete: 4420111 bytes loaded to 0x88000000
. }. Z5 F5 Z' B1 [! r+ o<nand_read_skip_bad_,1128>!mtdpart=0x0,offset=0x0,mtdpartoffset=0x20000,mtdPartsize=0xa0000,length=0x800007 o$ z5 j. m6 C- B5 V6 e
lseek=0x8c064800
, L7 V- v, a! T3 acmdline=U-Boot V2.3.0P1N9 20220823211658$ b" k) x5 t2 n$ }; t
kernel start step1..images->state:70f5 e2 Q% L$ r# T+ F5 n ]2 g: Y
==BOOTM_STATE_START:12 h& r* C, Y. L# x/ p% ~0 o% i
==BOOTM_STATE_FINDOS:2
& a- e4 a& Q ?) f, |! k4 x## Loading kernel from FIT Image at 88000000 ...3 \6 I: M. z3 L. c! c& s0 u
Using 'conf@131G' configuration
2 K+ j! `+ T- T/ N2 d$ H Trying 'kernel@A53' kernel subimage6 w3 i0 O& u, F, t0 |/ v4 j6 W, D' n
Description: Unify(TODO) Linux kernel for project-131G
4 W0 G2 M' ?! e! a8 F5 T: I Type: Kernel Image
+ c3 Y( v# ^/ P2 O# y d' k- P Compression: gzip compressed
; q: r- X7 v2 T Data Start: 0x880000f8
) L+ X& O! N2 ~/ o6 |* F Data Size: 4410949 Bytes = 4.2 MiB
6 G3 c; L! O2 O0 t; h7 G$ J Architecture: AArch649 B6 F. a. v7 s3 u3 N) ]9 l
OS: Linux
3 |# D6 k8 | X" B8 P5 o Load Address: 0x80080000
9 I: j4 l* j. _- i1 N( D. R. B' t6 F Entry Point: 0x80080000
1 e; u) w5 W; Z! X# f8 M6 L+ p Verifying Hash Integrity ... OK9 @. ?* T' Z. Z7 h q
==BOOTM_STATE_FINDOTHER:4' ?& ^, ?; n5 s Z' ?$ p
## Loading fdt from FIT Image at 88000000 ...5 g+ q& Q& t9 ?1 a: z% t
Using 'conf@131G' configuration
- N. Z# y- t1 W, ]6 N B0 E2 ] Trying 'fdt@131G' fdt subimage# d* { Z/ }! p
Description: Flattened Device Tree blob for project-131G
' G% J- Q* ]6 @' a Type: Flat Device Tree k( ^6 P' M$ {% C% J6 V6 }
Compression: uncompressed
$ d" C% k" s. c( B1 l% m* N3 e Data Start: 0x88435010/ }" m' T# D7 a( _; | V
Data Size: 7859 Bytes = 7.7 KiB
! V* |+ {- s2 a0 i Architecture: AArch64
$ |; J& B; b( T" k+ k Verifying Hash Integrity ... OK
7 y+ A- Z; Y" I Booting using the fdt blob at 0x88435010
% x. s. ~, {: I+ h. j/ | ==BOOTM_STATE_LOADOS:8
2 W7 @9 F3 K4 p, z1 U/ n Uncompressing Kernel Image ... OK
) M. c, h- Q9 @4 L. n" d/ C# Pkernel start step6..* }) a5 z' {3 ?& _- ?2 [3 M4 U- ~. T
Loading Device Tree to 0000000083ffb000, end 0000000083fffeb2 ... OK; H4 ~( c7 B, r9 N; I3 h5 f
# W& i, P! G$ N, Q
Starting kernel ...
3 }' y' u& v4 r# l: M+ q1 f0 b5 v' A- [- r) h2 W3 E# Z
CPUID:0 try wake up secondary cpu from rom.
0 m; R; W W0 [1 b' G- c0 ?CPUID:1 wake up from rom.
7 y$ s3 G. L0 Z7 p/ a+ k5 Tinit psci ok!!
; w& W7 T( Y; k- g! C/ I) t. M+ [/ v; Z) X' c; Y7 B
到这就没有任何输出了，也无法输入，TTL进入root开启telnet的路给堵死了，有知道的大神给个指点。
+ \3 x" x* |4 O8 R4 [6 e/ g2 e
" O+ p* h7 D% z* b0 L3、开启telnet$ h+ T& b% o: ]8 N6 R* N, H8 B- R0 S
那只能工具开启临时telnet，幸好在论坛找到了mayi5147大神的telnet工具可以开启，也顺利的固化了telnet。6 A; ?7 o- a& O3 R
1 \$ u! d0 e" y3 t! A5 c/ X; Z/ # cat /proc/mtd
+ @# G4 o) Q" o2 S) e) n& Ddev: size erasesize name
. {/ n. P* i' C" ?mtd0: 10000000 00020000 "whole flash"
9 s' b$ T. L: X' O0 wmtd1: 000e0000 00020000 "u-boot"
2 U% p ], P* q Cmtd2: 00080000 00020000 "others"# w3 p: C0 t* N0 D( ]2 v" c
mtd3: 00100000 00020000 "parameter tags"
# T. W' @, f9 H O# C" u7 tmtd4: 00100000 00020000 "wlan"
- t! _" ^ {: I! b: q. s; xmtd5: 00200000 00020000 "usercfg" c7 F9 M# _# {3 ]; V: y; V
mtd6: 00100000 00020000 "middle"
3 r( N/ p6 d9 Y4 m. l7 F: cmtd7: 02300000 00020000 "kernel1"
g n) i" ?9 w# }6 Bmtd8: 02300000 00020000 "kernel2" h0 T2 y: ]' A' T& L( W- z, Z! v
mtd9: 03900000 00020000 "osgi1"
" u e+ C) H5 L- Tmtd10: 03900000 00020000 "osgi2"
/ ^) {7 j2 J5 r" A4 P0 \mtd11: 04180000 00020000 "plugin_data"' k6 S% F2 X/ z/ v) R
mtd12: 022e0000 00020000 "rootfs"
( S- f5 W: _0 g( {; T: D! c& Cmtd13: 00020000 00020000 "bootrom"/ x, _% \3 Q( F% e$ ~% l; `
2 a6 |9 G" J0 v/ # cat /proc/csp/versionstates
8 E: M4 M' V# C7 M" }baseaddress : 0x680000
* Q/ t+ i; m, r8 S# s1 `current : 04 V+ Z0 Y" o9 d2 p1 E
version1states : 0x8f
# }9 m7 W6 [4 W. W3 Fversion2states : 0x83) @8 ]' E" v: M
____________________________________________________
0 J- U9 Y: Z6 OIndex Running Latest CRC Integrality Type
$ u& A& w- H2 W4 r( s5 H4 e----------------------------------------------------
6 u( l+ I5 {! ^9 R: n0 Y Y Y Y Upg5 K6 V8 T! h1 c$ B: N9 V8 U" Y( X
1 N Y N Y Upg, e* N& l2 u) V; l2 p3 @" [
----------------------------------------------------0 U0 ^& s0 Y7 Z2 A7 @4 r
( x0 \* B' ?) R0 i b- H4 o# q# j' {
/proc # cat cpuinfo$ t7 c7 ]4 t+ p) ^
processor : 0: k5 [* B, d% U& }7 C4 C! V
BogoMIPS : 50.004 d! c/ W N9 Y2 f j- ?
Features : fp asimd crc32# [0 O: O( |: V
CPU implementer : 0x41
- m: ?+ t. W8 h8 JCPU architecture: 83 g! O) D2 G4 Y7 |. G
CPU variant : 0x01 {) q1 d* N% r/ M, j
CPU part : 0xd035 P1 ?0 T( d! p' \
CPU revision : 4
+ W2 n% I2 F! O0 i6 I0 p. W' t- L$ M M. h
processor : 1: r% F7 K/ M9 F- H0 j0 g% A0 M4 H
BogoMIPS : 50.00; t0 ], D k3 P7 p, \# F
Features : fp asimd crc32
( Q; u6 s+ e+ } e6 f2 fCPU implementer : 0x41
$ ?+ ? R; B7 V- A# eCPU architecture: 8
! E5 k( t" J) |$ Q/ ICPU variant : 0x0
+ K' _# Z- n& {CPU part : 0xd03
# _# I7 \, l! F. ~* m3 C: PCPU revision : 4, j5 f0 |4 R4 ` [
5 r. t0 I3 |( I: _# O2 V$ E
- F+ d$ ~, ~8 s8 A( ~6 n
4、使用dd备份分区：4 a2 d4 h# h% n7 M* W
dd if=/dev/mtd1 of=/mnt/usb1_1/mtd1.bin
) z% {% b+ ^ V+ t' N1 [1 }dd if=/dev/mtd2 of=/mnt/usb1_1/mtd2.bin
# j! r1 K4 \. ~! y' w& jdd if=/dev/mtd3 of=/mnt/usb1_1/mtd3.bin- e1 L5 T2 o2 b: L9 ?! @
dd if=/dev/mtd4 of=/mnt/usb1_1/mtd4.bin
9 |- }# k& _" B3 W8 Ddd if=/dev/mtd5 of=/mnt/usb1_1/mtd5.bin
8 O. _& G7 ]( T; S2 W9 q& gdd if=/dev/mtd6 of=/mnt/usb1_1/mtd6.bin
' H; `8 l$ l' J% C) s+ E2 R7 X$ Pdd if=/dev/mtd7 of=/mnt/usb1_1/mtd7.bin
/ T1 x: t% d, v6 P% o8 M- E0 R& Mdd if=/dev/mtd8 of=/mnt/usb1_1/mtd8.bin
7 _) U$ H& w5 Kdd if=/dev/mtd9 of=/mnt/usb1_1/mtd9.bin
! l1 P. ~; n' X! t8 Jdd if=/dev/mtd10 of=/mnt/usb1_1/mtd10.bin
; }2 C& C; N, y2 Vdd if=/dev/mtd11 of=/mnt/usb1_1/mtd11.bin" C; a! Q& A- Z N( w& _
dd if=/dev/mtd12 of=/mnt/usb1_1/mtd12.bin% ]% j, b5 L+ v; J" I3 p6 m
& s+ ~4 V5 p# {& M: O& w
以上备份都能正常执行，但是mtd0全区备份，mtd13备份出错，具体原因不知。
# D( G& h6 S0 w' N% S/proc # dd if=/dev/mtd0 of=/mnt/usb1_1/mtd0.bin
$ O/ z) U7 Z0 o% \dd: /dev/mtd0: Invalid argument
% x5 e* q9 N! T5 P8 k. f% H* q6 t/proc # dd if=/dev/mtd13 of=/mnt/usb1_1/mtd13.bin
. D5 r2 b0 ]4 q5 F5 _. \7 ^0 X8 cdd: /dev/mtd13: Invalid argument' l; L& O9 ]+ W3 T C+ o
3 j m$ M/ {: x j: Y1 C$ f7 ~! A软件版本号V2.3.0P1T10: r3 s% b- h$ D1 w) @
备份的分区：链接：https://pan.baidu.com/s/1JW22fVaciXBW6F_gj98_7A?pwd=vx9q 提取码：vx9q
7 g% f2 t4 ?- e" l/ P" T5 U T8 @" F4 U$ r
5、TTL刷联通固件
G( g( B- e% N. y- y+ E/ ]我的想法是，mtd1"u-boot"分区不动，其他分区全部刷成联通的分区，不知道这个想法可行，但是也没有F7610U的分区，只能到此了。
0 Z" ?6 z }0 h9 _& c) C1 J7 a6 W: n" l1 Q: r. [3 t: b$ P6 s
500猫粮悬赏
1 F/ q, Y, W. n( |8 G求中兴F7610u光猫分区备份3 x2 S9 ?7 A3 W! e
https://www.chinadsl.net/forum.php?mod=viewthread&tid=176942; w5 C7 ~# K/ T: X
8 b- R: O2 \; o6 Z H1 ?' _补充：% U6 F' G- r& q
6、提取编程器固件
8 u: \3 F" z2 j6 q0 {F7610m的闪存芯片是HYF2GQ4UAACAE，封装类型是wson8，芯片大小是8mm*6mm，于是我就买了一个wson8转dip8的探针，用编译器ch341a提取了固件，已经分享在百度云网盘中。探针要用手扶着，提取花了45分钟，手都快残废了，于是自己利用家里能找到的材料做了一个简易的夹子，终于解放了双手。/ h7 R1 U' j. M8 P6 j% N
( R! V# h: X2 i( ?
% x" a+ s( U; u+ F0 k4 }
' n# C* u% z- V3 i u) u# ?* X6 q8 l5 k( ^" R
2024.4.7 uboot下刷写分区# ]" y3 c9 X' M, U' P
网友分享了F7610u的kernel、framework分区备份文件，为了保险起见，我在u-boot下刷写了备用分区mtd8、mtd10分区。
: e+ C; S8 @9 A* ]: {# }# I h0 h# Y' P) S8 O' u* U
+ k% O: j3 h; M$ Q" d
tftp 0x88000000 kernel.bin9 ~ A& D( B( u
擦除mtd8：nand erase 0x02980000 0x02300000
" L' B; H4 n, k- s7 s从内存写入mtd8：nand write 0x88000000 0x02980000 0x023000004 C+ f3 P1 [( Y1 H% B- }
% `" o$ m9 e5 v; \
tftp 0x88000000 framework.bin+ F- R# O% z* ?; Q. r1 v2 ?
擦除mtd10：nand erase 0x09180000 0x03900000
1 X/ G! ]9 @4 j$ q) H( @从内存写入mtd10：nand write 0x88000000 0x09180000 0x03900000
. e8 d Q8 \7 R- o
5 F% M# q+ Z0 U( \5 \/ U) d B! g重启光猫后，使用upgradetest switchver 1 切换成备用分区启动，但是启动失败，仅仅替换kernel、framework分区不可行！
! M8 f( T+ q$ f' q5 H也许必须用编程器刷写F7610U的编程器固件才行。, ^# L, ?7 F' J% C$ ?! W/ o
/ B8 j V4 v9 F( w5 l& E
另外： o: D% ^1 I3 f
F7610m在TTL下屏蔽了kernel启动信息，看不到各分区的地址信息，我根据编程器提取的固件，推算了各个分区的地址，如下：$ F) b: E& M, C) y7 U: d2 q' a
, D: J7 ^6 B- J: [5 `- n- u w
8 D$ D. ~0 P" h- O1 X
dev: size erasesize name
! ^( M! o: ^, m0 tmtd0: 10000000 00020000 "whole flash"* `9 |! F+ E- M% u
mtd1: 000e0000 00020000 "u-boot" 0x00020000-0x00100000 ok0 a; M. b! ^4 s! z7 [; |- @
mtd2: 00080000 00020000 "others" 0x00100000-0x00180000 ok
. d. F; H8 h4 |4 N; k5 y- [mtd3: 00100000 00020000 "parameter tags" 0x00180000-0x00280000 ok: Q) J: ~. w8 V4 z$ L9 ]
mtd4: 00100000 00020000 "wlan" 0x00280000-0x00380000 ok5 X A) t% F/ |, ^
mtd5: 00200000 00020000 "usercfg" 0x00380000-0x00580000 ok
' k( t9 P+ r& {+ @mtd6: 00100000 00020000 "middle" 0x00580000-0x00680000 ok9 N' r/ J' u2 j) U) T- M" l I) {
mtd7: 02300000 00020000 "kernel1" 0x00680000-0x02980000 ok
8 S/ n& D7 ^9 D7 D i& b7 f, ?1 Tmtd8: 02300000 00020000 "kernel2" 0x02980000-0x05280000 ok
, U% \9 u3 V |+ e7 gmtd9: 03900000 00020000 "osgi1" 0x05280000-0x09180000 ok
. O5 d' \7 c& b8 pmtd10: 03900000 00020000 "osgi2" 0x09180000-0x0ca80000 ok
3 m9 U7 U- W8 H& b3 k; S/ imtd11: 04180000 00020000 "plugin_data" 0x0ca80000-0x10c00000 mtd0大小只有10000000，地址是我推算出来的，超出了10000000不知道为什么？, e; L% { t' Y, D
mtd12: 022e0000 00020000 "rootfs" 0x10c00000-0x12ee0000 mtd0大小只有10000000，地址是我推算出来的，超出了10000000不知道为什么？- \1 q8 p% L) E' [/ p
mtd13: 00020000 00020000 "bootrom" 0x00000000-0x00020000 ok. J: T( h" V% }7 N6 v
" w6 K( M+ j: K( ~5 [* C6 C8 J, i2 Q
& \4 k3 A/ Y5 M7 `; g' T% R8 M6 j& `
, Z9 _% F4 A" i6 h# h6 l+ k* Z; E
~/ B7 }9 V, k5 _3 h9 B
9 ]0 }+ j/ \# T0 t; m! H. v& o/ v# R
% d/ w" B5 M. j. V( ^; {8 r: _/ r) D
5 B2 ]+ N. n ~$ _! X; I: K
' w* ?8 {9 Y0 t# { a5 l* I1 @4 Y: q2 j" o. g6 J9 q; m2 K
4 \ d' {+ b! f0 f# |% L& Q" X
+ A# o$ Q2 @2 J) k
$ J3 E/ z7 g6 S
1 k) D" t" m% U" C. b$ x4 S9 a2 ?
3 ~$ @ L W7 o8 a- Y# C |
本帖子中包含更多资源
您需要 登录 才可以下载或查看，没有账号？注册
×
|
粤公网安备44152102000001号 
发表于 2024-4-2 12:21:55