霸王硬上弓's Blog

磊科235W 236W 1.7正式版固件会修改CFE，致使非磊科机器成砖，只能jtag或者编程器。所以在刷1.7正式版前需要升级你的CFE。网上有VBS脚本，不过Win8下无效，实际过程与如下一样。

HG320刷磊科1.7正式版之前的固件，这里以磊科之前的固件为例。你的电脑网卡需与路由LAN口连接

1.下载CFE和TFTP服务器文件：点我下载

2.登陆磊科telnet，地址：192.168.1.1 端口为5357，用户名和密码皆为guest，进入tmp目录。

3.关闭系统防火墙，运行tftp.exe，在telnet窗口中输入tftp -g -r 236wcfe.bin 192.168.1.2 236wcfe.bin，可输入ls查看文件是否已经下载到tmp目录中。

4.写入CFE，输入mtd_write boot 236wcfe.bin 0 131072 。完成后输入reboot，如果能正常重启则写入成功 就可以在管理页面中刷入1.7正式版的固件。

备注：刷入此CFE后刷入磊科固件网口是相反的。

附V1.4固件的TTL启动信息

CFE version 5.60.120.9 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 2011骞05鏈04鏃鏄熸湡涓15:32:36 CST (root@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 131072(0x20000)
Found a 16MB ST compatible serial flash
[CFE][boot][ST Serial flash offset 00000000 size 128KB]
[CFE][trx][ST Serial flash offset 00020000 size 1KB]
[CFE][os][ST Serial flash offset 0002001C size 16224KB]
[CFE][nvram][ST Serial flash offset 00FF8000 size 32KB]
[CFE][boot][ST Serial flash offset 00000000 size 128KB]
[CFE][trx0][ST Serial flash offset 00020000 size 1KB]
[CFE][os0][ST Serial flash offset 0002001C size 8832KB]
[CFE][trx1][ST Serial flash offset 008C0000 size 1KB]
[CFE][os1][ST Serial flash offset 008C001C size 7392KB]
[CFE][nvram][ST Serial flash offset 00FF8000 size 32KB]
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.120.9
CPU type 0x19749: 500MHz
Tot mem: 65536 KBytes

CFE mem: 0x80700000 – 0x8079A7D0 (632784)
Data: 0x807306D0 – 0x80733850 (12672)
BSS: 0x80733850 – 0x807347D0 (3968)
Heap: 0x807347D0 – 0x807987D0 (409600)
Stack: 0x807987D0 – 0x8079A7D0 (8192)
Text: 0x80700000 – 0x807306C8 (198344)

Device eth0: hwaddr 00-90-4C-21-60-01, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
cur=
buf=go;
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
Boot from big image !!
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ……. 3682438 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
Linux version 2.6.22 (root@zzyy) (gcc version 4.2.3) #83 PREEMPT Tue May 29 14:42:14 CST 2012
CPU revision is: 00019749
Found an ST compatible serial flash with 256 64KB blocks; total size 16MB
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Initrd not found or empty – disabling initrd
Built 1 zonelists. Total pages: 16256
Kernel command line: root=/dev/mtdblock2 console=ttyS0,115200 init=/sbin/preinit
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 256 (order: 8, 1024 bytes)
CPU: BCM5357 rev 1 at 500 MHz
Using 250.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 60592k/65536k available (2838k kernel code, 4880k reserved, 529k data, 228k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI: no core
PCI: no core
PCI: Fixing up bus 0
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
fuse init (API version 7.8)
io scheduler noop registered (default)
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
loop: module loaded
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.4
pflash: found no supported devices
Boot partition size = 131072(0x20000)
sflash: squash filesystem with lzma found at block 21
Creating 4 MTD partitions on “sflash”:
0x00000000-0x00020000 : “boot”
0x00020000-0x00ff0000 : “linux”
0x0015b684-0x00ff0000 : “rootfs”
0x00ff0000-0x01000000 : “nvram”
nflash: found no supported devices
hbwrr_reg:0
u32 classifier
nf_conntrack version 0.5.0 (1280 buckets, 10240 max)
nf_ct_ftp: registering helper for pf: 2 port: 21
nf_ct_ftp: registering helper for pf: 10 port: 21
ip_tables: (C) 2000-2006 Netfilter Core Team
ClusterIP Version 0.8 loaded successfully
mid :0, nr = 6
mid :1, nr = 12
mid :2, nr = 2
mid :3, nr = 10
mid :4, nr = 34
mid :5, nr = 15
mid :6, nr = 25
mid :7, nr = 12
mid :8, nr = 3
net sniffer init ok.
igd_port_trigger_init:[559]register port trigger
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
mirror create proc success
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
NETCORE fastpath V0.03
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 228k freed
Failed to execute /init
Failed to execute /sbin/preinit. Attempting defaults…
init started: BusyBox v1.1.2 (2012.04.13-06:36+0000) multi-call binary
Starting pid 15, console /dev/ttyS0: ‘/etc/rcS’
Algorithmics/MIPS FPU Emulator v1.5
/etc/rcS: /etc/rcS: 2: /var/run: not found
file /var/parame/parame/param.tmp size error 0
emf: module license ‘Proprietary’ taints kernel.
et_module_init: passivemode set to 0x0
et_module_init: et_txq_thresh set to 0x0
mirror create proc success
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.100.138.22
wl_module_init: passivemode set to 0x0
eth1: Broadcom BCM4347 802.11 Wireless Controller 5.100.138.22
device vlan1 entered promiscuous mode
device eth1 entered promiscuous mode
vlan1: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
br0: port 2(eth1) entering learning state
br0: port 1(vlan1) entering learning state
br0: topology change detected, propagating
br0: port 2(eth1) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
cp: /tmp/log: No such file or directory
cp: /bin/ntpara: No such file or directory
parame restroe default
tar: /tmp/param.file: No such file or directory
tar: Error exit delayed from previous errors
[tar_flag : 706] : tar OK !

Starting Protocol Module: procfs … OK!
/bin/envram get et0macaddr > /tmp/sbmac =00:90:4c:21:60:01

DEBUG:genmac:57 sizeof retval=4
DEBUG:genmac:66 d=23077196
DEBUG:genmac:75 MAC:00904c216001
DEBUG:genmac:66 d=39854412
DEBUG:genmac:75 MAC:00904c216002
DEBUG:genmac:66 d=56631628
DEBUG:genmac:75 MAC:00904c216003
DEBUG:genmac:66 d=73408844
DEBUG:genmac:75 MAC:00904c216004
Starting Protocol Module: igd interface … OK!
Starting Protocol Module: ifstate … OK!
Starting Protocol Module: misc … OK!
Starting Protocol Module: ddns … OK!
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
RTNETLINK answers: No such file or directory
Starting Protocol Module: route … OK!
Starting Protocol Module: storm … OK!
Starting Protocol Module: igd filter … OK!
Starting Protocol Module: webs … OK!
Starting Protocol Module: dhcp … OK!
Starting Protocol Module: nat … OK!
Starting Protocol Module: DNS … OK!
Starting Protocol Module: arp … OK!
Starting Protocol Module: dnsmasq … OK!
Starting Protocol Module: log … OK!
Starting Protocol Module: WIFI_BCM … OK!
Register Hardware Module: bcm535x bsp … Oigd_filter_netlink_rcvmsg[line=7518] no such type, type = 20
k!
Starting Prigd_filter_netlink_rcvmsg[line=7518] no such type, type = 25
otocol Module: Port … OK!
Register Hardware Moduligd_filter_netlink_rcvmsg[line=7518] no such type, type = 26
e: Port driver igd_filter_netlink_rcvmsg[line=7518] no such type, type = 26
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 22
… Ok!
Stigd_filter_netlink_rcvmsg[line=7518] no such type, type = 22
arting Protocol Module: host … OK!
Starting Protocol Module: igd pppoe server … OK!
Starting Protocol Module: igd ip pool … OK!
check this:igd_ip_pool_proc[268]msg 5 doesn’t support

check this:iigd_filter_netlink_rcvmsg[line=7518] no such type, type = 32
gd_generic_load_param[879]/tmp/igd_ip_pool.file read error, restore default

disable mirror wifi
check this:igd_iport_mir=00
p_pool_proc[268]0 = 0
msg 5 doesn’t su1 = 0
pport

[igd_i2 = 0
ptc_lan2lan:12753 = 0
]
check this:ig4 = 0
d_ip_pool_proc[2wlan_cap1 0
68]msg 5 doesn’tnf_ct_ftp: port already exist! port = 21
support

check this:igd_geneigd_filter_netlink_rcvmsg[line=7518] no such type, type = 32
ric_load_param[879]/tmp/igd_ip_pool.file read error, restore default

check this:igd_ip_pool_proc[268]msg 5 doesn’t support

Starting Protocol Module: QOS … OK!
/bin/envram get et0macaddr > /tmp/sbmac =00:90:4c:21:60:01

DEBUG:genmac:57 sizeof retval=4
DEBUG:genmac:66 d=23077196
DEBUG:genmac:75 MAC:00904c216001
DEBUG:genmac:66 d=39854412
DEBUG:genmac:75 MAC:00904c216002
DEBUG:genmac:66 d=56631628
DEBUG:genmac:75 MAC:00904c216003
DEBUG:genmac:66 d=73408844
DEBUG:genmac:75 MAC:00904c216004
if_set_ispmap_by_if_id:isp = 0, currently ifmap = 0x1.

if_set_ispmap_by_if_id:isp = 0, currently ifmap = 0x3.

br0: port 2(eth1) entering disabled state
br0: port 1(vlan1) entering disabled state
br0: port 2(eth1) entering learning state
br0: port 1(vlan1) entering learning state
br0: topology change detected, propagating
br0: port 2(eth1) entering forwarding state
br0: topology change detected, propagating
br0: port 1(vlan1) entering forwarding state
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 28
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 27
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 27
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 28
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 28
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 28
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 27
DEBUG:arp_socket_init:90 ifindex = 10
device br0 entered promiscuous mode
DEBUG:arp_socket_init:145 sock=11
DEBUG:nb_socket_init:87 nb_socket=12
DEBUG:port_fsm:2135 WAN1 INIT -> DOWN
DEBUG:port_fsm:2138 vlan2,vlan2
DEBUG:port_fsm:2135 WAN2 INIT -> DOWN
DEBUG:port_fsm:2138 vlan3,vlan3
Nothing to flush.
Nothing to flush.
Nothing to flush.
Nothing to flush.
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 28
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 27
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 27
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 27
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 27
#WIFI_HW_WARNING#:[igd_wifi_load_param:2562] #Wifi WARNING#:Wifi parameter load default!

#WIFI_HW_DEBUG#:[hw_bcm_get_region:2708] wl0 region:HK
envram get error

envram get error

DEBUG:igd_wifi_apply:1576 uiname:WIFI1,ifname:eth1
[HwBCMWifi_Module:2781]

#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2236] uiname:WIFI1;nvram_name:wl0;work_mode:0;radio:1
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2286] Start mode AP
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2301] Set vifs nvram:wl0.1 ifname:wl0.1 AP
#WIFI_HW_DEBUG#:[hw_bcm_advance_apply:2143] channel:0

#WIFI_HW_DEBUG#:[hw_bcm_advance_apply:2143] channel:0

#WIFI_HW_DEBUG#:[hw_bcm_wds_apply:2015] Start wds apply wl0
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2530] Nvram set wl0_hwaddr:00:90:4C:21:60:04
#WIFI_HW_DEBUG#:[hw_bcm_ap_apply:1898] Start ap apply wl0
[switch_ssid_utf8_2_gb2312:129:bcm_wifi_hw.c], gb2312 ssid = Netcore
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2549] Nvram set wl0.1_hwaddr:02:90:4C:21:60:05
#WIFI_HW_DEBUG#:[hw_bcm_ap_apply:1905] Start ap apply wl0.1
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2555] ifname:wl0.1,enable:0,j=0
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2568] value is 02:90:4C:21:60:05,j=0
killall: nas: no process killed
killall: eapd: no process killed
interface wl0.1 does not exist!
SIOCGIFFLAGS: No such device
br0: port 2(eth1) entering disabled state
device eth1 left promiscuous mode
br0: port 2(eth1) entering disabled state
#WIFI_HW_DEBUG#:[__bcm_stop_service:1506] Unload wl.ko

wl_module_init: passivemode set to 0x0
eth1: Broadcom BCM4347 802.11 Wireless Controller 5.100.138.22
#WIFI_HW_DEBUG#:[__bcm_start_service:1543] Reload wl.ko

#WIFI_HW_DEBUG#:[start_eapd:289] Start eapd
device eth1 entered promiscuous mode
#WIFI_HW_DEBUG#:[__bcm_start_service:1585] Start eth1 up mac:00:90:4C:21:60:04
br0: port 2(eth1) entering learning state
br0: topology change detected, propagating
br0: port 2(eth1) entering forwarding state
eth1: Operation not permitted
wlconf: PHYTYPE: 4
eth1: Invalid argument
eth1: Invalid argument
eth1: Operation not supported
eth1: Operation not supported
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
COEX: downgraded chanspec 0x2e06 to 0x2b08: channel 1 used by exiting BSSs
COEX: downgraded chanspec 0x2e0b to 0x2b0d: channel 6 used by exiting BSSs
COEX: downgraded chanspec 0x2d03 to 0x2b01: channel 2 used by exiting BSSs
COEX: downgraded chanspec 0x2d05 to 0x2b03: channel 1 used by exiting BSSs
#WIFI_HW_DEBUG#:[__bcm_start_service:1720] Begin starting wps
#WIFI_HW_WARNING#:[igd_wifi_start_wps:2387] #Wifi WARNING#:Start wps

DEBUG:igd_wifi_load_param:2579 WIFI applied uiname:WIFI1,ifname:eth1
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 28
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 27
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 28
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 27
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 28
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 28
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 28
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 27
DEBUG:nb_socket_fini:113 close nb_socket :12
DEBUG:arp_socket_init:90 ifindex = 10
DEBUG:arp_socket_init:145 sock=11
DEBUG:nb_socket_init:87 nb_socket=12
Starting Protocol Module: NET tools … OK!
Starting Protocol Module: PPTP Server … OK!
check this:igd_generic_load_param[879]/tmp/igd_wake_up_param.file read error, restore default

DEBUG:igd_wifi_watch_fun:301
DEBUG:igd_wifi_apply:1576 uiname:WIFI1,ifname:eth1
[HwBCMWifi_Module:2781]

#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2236] uiname:WIFI1;nvram_name:wl0;work_mode:0;radio:1
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2286] Start mode AP
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2301] Set vifs nvram:wl0.1 ifname:wl0.1 AP
#WIFI_HW_DEBUG#:[hw_bcm_advance_apply:2143] channel:8

#WIFI_HW_DEBUG#:[hw_bcm_advance_apply:2143] channel:8

#WIFI_HW_DEBUG#:[hw_bcm_wds_apply:2015] Start wds apply wl0
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2530] Nvram set wl0_hwaddr:00:90:4C:21:60:04
#WIFI_HW_DEBUG#:[hw_bcm_ap_apply:1898] Start ap apply wl0
[switch_ssid_utf8_2_gb2312:129:bcm_wifi_hw.c], gb2312 ssid = Netcore
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2549] Nvram set wl0.1_hwaddr:02:90:4C:21:60:05
#WIFI_HW_DEBUG#:[hw_bcm_ap_apply:1905] Start ap apply wl0.1
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2555] ifname:wl0.1,enable:0,j=0
#WIFI_HW_DEBUG#:[__bcm535x_hw_apply:2568] value is 02:90:4C:21:60:05,j=0
Create daemon…
Create server…
Please press Enter to activate this console. #WIFI_HW_WARNING#:[igd_wifi_stop_wps:2356] #Wifi WARNING#:Stop wps

br0: port 2(eth1) entering disabled state
br0: port 2(eth1) entering learning state
br0: topology change detected, propagating
br0: port 2(eth1) entering forwarding state
wlconf: PHYTYPE: 4
igd_filter_netlink_rcvmsg[line=7518] no such type, type = 33

Starting pid 143, console /dev/ttyS0: ‘/bin/sh’

BusyBox v1.1.2 (2012.04.13-06:36+0000) Built-in shell (ash)
Enter ‘help’ for a list of built-in commands.

/ $