TTL修复刷机失败的TP-LINK WR720N

　　前阵子在刷回tp-link官方固件时候下错版本，导致路由器无法启动，表现为插电后LED一强一弱循环闪，复位键也无效，于是采用TTL接线来修复。
　　拆开TP-LINK WR70N（吐槽：TP-LINK做工极差，外壳采用一次性封装，完全不顾及可修复性），找到后背的TP_IN和TP_OUT触点，接上USB-TTL版的RXD，TXD接线。本来还需要GND，但我这里路由器的供电和TTL小板接到了同一个USB集线器，故无须使用GND。

RXD : TP_IN
TXD : TP_OUT

　　电脑上使用SecureCRT打开对应的串口（PuTTY乱码），波特率：115200，取消RTS/CTS流控。连接正确后可以看到路由器U-Boot的日志：

Autobooting in 1 seconds
## Booting image at 9f020000 …
Uncompressing Kernel Image … Too big uncompressed streamLZMA ERROR 1 – must RESET

　　可以看到是在解压内核镜像的时候出问题了，too big，并且不断的重启。这个固件是官方TL-WR720N V3_120913标准版，比120620确实大了一些，不知为何会成这样。看来TP-LINK也犯傻了。作罢，还是刷回自己编译的OpenWrt。电脑上开启Tftpd32，设置本地连接地址为：192.168.1.10

在U-Boot界面快速按tpl三个键可以进入一个命令行模式，显示为hornet>，输入以下命令：

设置tftp服务器地址
hornet> setenv serverip 192.168.1.10

通过tftp下载固件
hornet> tftpboot 0x80000000 1.bin
eth1 link down
dup 1 speed 100
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.111
Filename ‘1.bin’.
Load address: 0x80000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################################################
done
Bytes transferred = 3932160 (3c0000 hex)

擦除内存
hornet> erase 0x9f020000 +0x3c0000
First 0x2 last 0x3d sector size 0x10000
61
Erased 60 sectors

拷贝固件到内存位置
hornet> cp.b 0x80000000 0x9f020000 0x3c0000
Copy to Flash… write addr: 9f020000
done

引导系统
hornet> bootm 0x9f020000
## Booting image at f020000b …

重启路由器应该就OK了。

—————————————————————–

附修复后的完整引导日志

U-Boot 1.1.4 (Jun 20 2012 – 17:03:09)

AP121 (ar9330) U-boot

DRAM: 32 MB
led turning on for 1s…
id read 0x100000ff
flash size 4194304, sector count = 64
Flash: 4 MB
Using default environment

In: serial
Out: serial
Err: serial
Net: ag7240_enet_initialize…
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
ag7240_phy_setup
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
ag7240_phy_setup
eth1 up
eth0, eth1
Autobooting in 1 seconds
## Booting image at 9f020000 …
Uncompressing Kernel Image … OK

Starting kernel …

[ 0.000000] Linux version 3.6.11 (steven@dorole.com) (gcc version 4.6.4 20121106 (prerelease) (Linaro GCC 4.6-2012.11) ) #1 Sat Dec 29 11:58:22 CST 2012
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[ 0.000000] SoC: Atheros AR9330 rev 1
[ 0.000000] Clocks: CPU:400.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 02000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty – disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x01ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x01ffffff]
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
[ 0.000000] Kernel command line: board=TL-WR720N console=ttyATH0,115200 rootfstype=squashfs,jffs2 noinitrd
[ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.000000] __ex_table already sorted, skipping sort
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 29140k/32768k available (2099k kernel code, 3628k reserved, 394k data, 212k init, 0k highmem)
[ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:51
[ 0.000000] Calibrating delay loop… 265.42 BogoMIPS (lpj=1327104)
[ 0.080000] pid_max: default: 32768 minimum: 301
[ 0.080000] Mount-cache hash table entries: 512
[ 0.090000] NET: Registered protocol family 16
[ 0.090000] MIPS: machine is TP-LINK TL-WR720N v3
[ 0.550000] bio: create slab at 0
[ 0.550000] Switching to clocksource MIPS
[ 0.560000] NET: Registered protocol family 2
[ 0.560000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[ 0.570000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.570000] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.580000] TCP: reno registered
[ 0.580000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.590000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.600000] NET: Registered protocol family 1
[ 0.620000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.620000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.630000] msgmni has been set to 56
[ 0.640000] io scheduler noop registered
[ 0.640000] io scheduler deadline registered (default)
[ 0.650000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.650000] ar933x-uart: ttyATH0 at MMIO 0x18020000 (irq = 11) is a AR933X UART
[ 0.660000] console [ttyATH0] enabled, bootconsole disabled
[ 0.660000] console [ttyATH0] enabled, bootconsole disabled
[ 0.670000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[ 0.680000] m25p80 spi0.0: found s25sl032a, expected m25p80
[ 0.680000] m25p80 spi0.0: s25sl032a (4096 Kbytes)
[ 0.690000] 5 tp-link partitions found on MTD device spi0.0
[ 0.690000] Creating 5 MTD partitions on “spi0.0”:
[ 0.700000] 0x000000000000-0x000000020000 : “u-boot”
[ 0.700000] 0x000000020000-0x0000000fe974 : “kernel”
[ 0.710000] mtd: partition “kernel” must either start or end on erase block boundary or be smaller than an erase block — forcing read-only
[ 0.720000] 0x0000000fe974-0x0000003f0000 : “rootfs”
[ 0.730000] mtd: partition “rootfs” must either start or end on erase block boundary or be smaller than an erase block — forcing read-only
[ 0.740000] mtd: partition “rootfs” set to be root filesystem
[ 0.740000] mtd: partition “rootfs_data” created automatically, ofs=390000, len=60000
[ 0.750000] 0x000000390000-0x0000003f0000 : “rootfs_data”
[ 0.760000] 0x0000003f0000-0x000000400000 : “art”
[ 0.760000] 0x000000020000-0x0000003f0000 : “firmware”
[ 0.790000] libphy: ag71xx_mdio: probed
[ 0.790000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[ 1.350000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd041, driver=Generic PHY]
[ 1.360000] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[ 1.910000] eth1: Found an AR7240/AR9330 built-in switch
[ 2.950000] TCP: cubic registered
[ 2.950000] NET: Registered protocol family 17
[ 2.950000] 8021q: 802.1Q VLAN Support v1.8
[ 2.970000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[ 2.970000] Freeing unused kernel memory: 212k freed
– preinit –
Press the [f] key and hit [enter] to enter failsafe mode
– regular preinit –
[ 8.550000] jffs2: notice: (418) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 9.580000] SCSI subsystem initialized
[ 9.820000] usbcore: registered new interface driver usbfs
[ 9.820000] usbcore: registered new interface driver hub
[ 9.830000] usbcore: registered new device driver usb
[ 9.990000] ehci_hcd: USB 2.0 ‘Enhanced’ Host Controller (EHCI) Driver
[ 9.990000] ehci-platform ehci-platform: Generic Platform EHCI Controller
[ 10.000000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[ 10.040000] ehci-platform ehci-platform: irq 3, io mem 0x1b000000
[ 10.060000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[ 10.060000] hub 1-0:1.0: USB hub found
[ 10.060000] hub 1-0:1.0: 1 port detected
[ 10.180000] ohci_hcd: USB 1.1 ‘Open’ Host Controller (OHCI) Driver
[ 10.270000] uhci_hcd: USB Universal Host Controller Interface driver
[ 10.290000] Initializing USB Mass Storage driver…
[ 10.290000] usbcore: registered new interface driver usb-storage
[ 10.300000] USB Mass Storage support registered.
switching to jffs2
– init –
[ 32.720000] Compat-drivers backport release: compat-drivers-2012-12-04
[ 32.720000] Backport based on wireless-testing.git master-2012-12-06
[ 32.730000] compat.git: wireless-testing.git
[ 32.760000] cfg80211: Calling CRDA to update world regulatory domain
[ 32.770000] cfg80211: World regulatory domain updated:
[ 32.770000] cfg80211: (start_freq – end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 32.780000] cfg80211: (2402000 KHz – 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 32.790000] cfg80211: (2457000 KHz – 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 32.800000] cfg80211: (2474000 KHz – 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 32.800000] cfg80211: (5170000 KHz – 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 32.810000] cfg80211: (5735000 KHz – 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 33.610000] ieee80211 phy0: Atheros AR9330 Rev:1 mem=0xb8100000, irq=2
[ 33.620000] cfg80211: Calling CRDA for country: US
[ 33.620000] cfg80211: Regulatory domain changed to country: US
[ 33.630000] cfg80211: (start_freq – end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 33.630000] cfg80211: (2402000 KHz – 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm)
[ 33.640000] cfg80211: (5170000 KHz – 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm)
[ 33.650000] cfg80211: (5250000 KHz – 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 33.660000] cfg80211: (5490000 KHz – 5600000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 33.670000] cfg80211: (5650000 KHz – 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 33.670000] cfg80211: (5735000 KHz – 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm)
[ 33.720000] NTFS driver 2.1.30 [Flags: R/O MODULE].
[ 34.130000] PPP generic driver version 2.4.2
[ 34.180000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 34.310000] NET: Registered protocol family 24
[ 34.470000] nf_conntrack version 0.5.0 (458 buckets, 1832 max)
[ 35.470000] usbcore: registered new interface driver ums-alauda
[ 35.490000] usbcore: registered new interface driver ums-cypress
[ 35.510000] usbcore: registered new interface driver ums-datafab
[ 35.530000] usbcore: registered new interface driver ums-freecom
[ 35.540000] usbcore: registered new interface driver ums-isd200
[ 35.560000] usbcore: registered new interface driver ums-jumpshot
[ 35.580000] usbcore: registered new interface driver ums-karma
[ 35.600000] usbcore: registered new interface driver ums-sddr09
[ 35.620000] usbcore: registered new interface driver ums-sddr55
[ 35.640000] usbcore: registered new interface driver ums-usbat
[ 35.660000] fuse init (API version 7.20)

Please press Enter to activate this console.

[ 41.990000] device eth1 entered promiscuous mode
[ 45.890000] device wlan0 entered promiscuous mode
[ 45.990000] br-lan: port 2(wlan0) entered forwarding state
[ 45.990000] br-lan: port 2(wlan0) entered forwarding state
[ 47.990000] br-lan: port 2(wlan0) entered forwarding state