so i finally managed to have some spare time to try unbrick my Belkin F5D8235-4 v1 using the serial port and a tftp server to load the .bin!
> ============================================
> Ralink UBoot Version: 2.0
> --------------------------------------------
> ASIC 2880_MP (MAC to GigaMAC Mode)
> DRAM COMPONENT: 128Mbits
> DRAM BUS: 32BIT
> Total memory: 32Mbytes
> Date:Jun 12 2008 Time:15:40:46
> ============================================
> D-CACHE set to 4 way
> I-CACHE set to 4 way
>
> ##### The CPU freq = 266 MHZ ####
>
> SDRAM bus set to 32 bit
> SDRAM size =32 Mbytes
>
> Please choose the operation:
> 1: Load system code to SDRAM via TFTP.
> 2: Load system code then write to Flash via TFTP.
> 3: Boot system code via Flash (default).
> 4: Entr boot command line interface.
> 5: Load ucos code to SDRAM via TFTP.
>
> You choosed 2
> 0
> Net:
> eth_register
> Eth0 (10/100-M)
> enetvar=ethaddr,Eth addr:00:AA:BB:CC:DD:18
> 00:AA:BB:CC:DD:18:
>
> eth_current->name = Eth0 (10/100-M)
>
>
> 2: System Load Linux Kernel then write to Flash via TFTP.
> Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
> Please Input new ones /or Ctrl-C to discard
> Input device IP (10.10.10.123) ==:192.168.2.109
> Input server IP (10.10.10.3) ==:192.168.2.35
> Input Linux Kernel filename () ==:test.bin
>
> netboot_common, argc= 3
> *************buf = 0x8bfcce80
> **********NexTxPacket = 8bfe4f40
>
> NetTxPacket = 0x8BFE4F40
>
> NetRxPackets[0] = 0x8BFE5540
>
> NetRxPackets[1] = 0x8BFE5B40
>
> NetRxPackets[2] = 0x8BFE6140
>
> NetRxPackets[3] = 0x8BFE6740
>
> NetRxPackets[4] = 0x8BFE6D40
>
> NetRxPackets[5] = 0x8BFE7340
>
> NetRxPackets[6] = 0x8BFE7940
>
> NetRxPackets[7] = 0x8BFE7F40
>
> NetRxPackets[8] = 0x8BFE8540
>
> NetRxPackets[9] = 0x8BFE8B40
>
> NetRxPackets[10] = 0x8BFE9140
>
> NetRxPackets[11] = 0x8BFE9740
>
> NetRxPackets[12] = 0x8BFE9D40
>
> NetRxPackets[13] = 0x8BFEA340
>
> NetRxPackets[14] = 0x8BFEA940
>
> NetRxPackets[15] = 0x8BFEAF40
>
> NetRxPackets[16] = 0x8BFEB540
>
> NetRxPackets[17] = 0x8BFEBB40
>
> NetRxPackets[18] = 0x8BFEC140
>
> NetRxPackets[19] = 0x8BFEC740
>
> KSEG1ADDR(NetTxPacket) = 0xABFE4F40
>
> NetLoop,call eth_halt !
> STOP_RT2880_ETH
>
> NetLoop,call eth_init !
> Trying Eth0 (10/100-M)
>
> Waitting RT2880_RX_DMA_BUSY status Start... done
>
> Mac to giga Mac mode
>
> rx_ring = ABFCD2A0, tx_ring0 = ABFCD160
>
> Header Payload scatter function is Disable !!
>
> RT2880_PDMA_GLO_CFG=00000020
>
> *************************************************
>
> RT2880_RX_CALC_IDX0=19
>
> RT2880_RX_DRX_IDX0 = 0
>
> *************************************************
>
> ETH_STATE_ACTIVE!!
> Using Eth0 (10/100-M) device
> TFTP from server 192.168.2.35; our IP address is 192.168.2.109
> Filename 'test.bin'.
>
> TIMEOUT_COUNT=10,Load address: 0x8a100000
> Loading: Got ARP REPLY, set server/gtwy eth addr (00:26:b9:7e:2f:1b)
> Got it
> checksum bad
> checksum bad
> checksum bad
> checksum bad
> checksum bad
> checksum bad
> T #
> first block received
> ################################################################
> #################################################################
> #################################################################
> #################################################################
> #################################################################
> #################################################################
> #################################################################
> #################################################################
> #################################################################
> #################################################################
> ################
> done
> Bytes transferred = 3407876 (340004 hex)
> STOP_RT2880_ETH
> NetBootFileXferSize= 00340004
> Erase linux kernel block !!
> From 0xBC450000 To 0xBC79FFFF
>
> b_end =BC7FFFFF
> Erase Flash from 0xbc450000 to 0xbc79ffff in Bank # 1
>
> erase sector = 76
> sect = 76,s_last = 128,erase poll = 853171
>
> erase sector = 77
> sect = 77,s_last = 128,erase poll = 818746
>
> erase sector = 78
> *sect = 78,s_last = 128,erase poll = 829096
>
> erase sector = 79
> sect = 79,s_last = 128,erase poll = 818684
>
> erase sector = 80
> *sect = 80,s_last = 128,erase poll = 853824
>
> erase sector = 81
> sect = 81,s_last = 128,erase poll = 837821
>
> erase sector = 82
> sect = 82,s_last = 128,erase poll = 827118
>
> erase sector = 83
> *sect = 83,s_last = 128,erase poll = 815942
>
> erase sector = 84
> sect = 84,s_last = 128,erase poll = 833039
>
> erase sector = 85
> *sect = 85,s_last = 128,erase poll = 850683
>
> erase sector = 86
> sect = 86,s_last = 128,erase poll = 805807
>
> erase sector = 87
> sect = 87,s_last = 128,erase poll = 841458
>
> erase sector = 88
> *sect = 88,s_last = 128,erase poll = 833863
>
> erase sector = 89
> sect = 89,s_last = 128,erase poll = 857943
>
> erase sector = 90
> *sect = 90,s_last = 128,erase poll = 841770
>
> erase sector = 91
> sect = 91,s_last = 128,erase poll = 869053
>
> erase sector = 92
> *sect = 92,s_last = 128,erase poll = 824152
>
> erase sector = 93
> sect = 93,s_last = 128,erase poll = 805680
>
> erase sector = 94
> sect = 94,s_last = 128,erase poll = 828133
>
> erase sector = 95
> *sect = 95,s_last = 128,erase poll = 845296
>
> erase sector = 96
> sect = 96,s_last = 128,erase poll = 839405
>
> erase sector = 97
> *sect = 97,s_last = 128,erase poll = 829904
>
> erase sector = 98
> sect = 98,s_last = 128,erase poll = 848322
>
> erase sector = 99
> sect = 99,s_last = 128,erase poll = 841408
>
> erase sector = 100
> *sect = 100,s_last = 128,erase poll = 837454
>
> erase sector = 101
> sect = 101,s_last = 128,erase poll = 816257
>
> erase sector = 102
> *sect = 102,s_last = 128,erase poll = 833574
>
> erase sector = 103
> sect = 103,s_last = 128,erase poll = 816168
>
> erase sector = 104
> *sect = 104,s_last = 128,erase poll = 863494
>
> erase sector = 105
> sect = 105,s_last = 128,erase poll = 816234
>
> erase sector = 106
> sect = 106,s_last = 128,erase poll = 817755
>
> erase sector = 107
> *sect = 107,s_last = 128,erase poll = 843748
>
> erase sector = 108
> sect = 108,s_last = 128,erase poll = 820467
>
> erase sector = 109
> *sect = 109,s_last = 128,erase poll = 833028
>
> erase sector = 110
> sect = 110,s_last = 128,erase poll = 837731
>
> erase sector = 111
> sect = 111,s_last = 128,erase poll = 846586
>
> erase sector = 112
> *sect = 112,s_last = 128,erase poll = 831149
>
> erase sector = 113
> sect = 113,s_last = 128,erase poll = 828357
>
> erase sector = 114
> *sect = 114,s_last = 128,erase poll = 840085
>
> erase sector = 115
> sect = 115,s_last = 128,erase poll = 838758
>
> erase sector = 116
> sect = 116,s_last = 128,erase poll = 828173
>
> erase sector = 117
> *sect = 117,s_last = 128,erase poll = 875531
>
> erase sector = 118
> sect = 118,s_last = 128,erase poll = 834336
>
> erase sector = 119
> *sect = 119,s_last = 128,erase poll = 847611
>
> erase sector = 120
> sect = 120,s_last = 128,erase poll = 882802
>
> erase sector = 121
> *sect = 121,s_last = 128,erase poll = 845999
>
> erase sector = 122
> sect = 122,s_last = 128,erase poll = 817037
>
> erase sector = 123
> sect = 123,s_last = 128,erase poll = 833925
>
> erase sector = 124
> *sect = 124,s_last = 128,erase poll = 821016
>
> erase sector = 125
> sect = 125,s_last = 128,erase poll = 836713
>
> erase sector = 126
> *sect = 126,s_last = 128,erase poll = 805758
>
> erase sector = 127
> sect = 127,s_last = 128,erase poll = 827933
>
> erase sector = 128
> sect = 128,s_last = 128,erase poll = 835754
> done
> Erased 53 sectors
>
> Copy linux image[3407876 byte] to Flash[0xBC450000]....
> Copy to Flash...
> Copy 3407876 bytes to Flash...
> addr = 0xBC4A2D70 ,cnt=3068564
> addr = 0xBC4F5AE2 ,cnt=2729250
> addr = 0xBC548854 ,cnt=2389936
> addr = 0xBC59B5C6 ,cnt=2050622
> addr = 0xBC5EE338 ,cnt=1711308
> addr = 0xBC6410AA ,cnt=1371994
> addr = 0xBC693E1C ,cnt=1032680
> addr = 0xBC6E6B8E ,cnt=693366
> addr = 0xBC739900 ,cnt=354052
> addr = 0xBC78C672 ,cnt=14738 ## Booting image at bc450000 ...
> Image Name: MIPS OpenWrt Linux-3.18.23
> Created: 2016-02-02 12:56:53 UTC
>
> System Control Status = 0x02910084
> Image Type: MIPS Linux Kernel Image (lzma compressed)
> Data Size: 1123014 Bytes = 1.1 MB
> Load Address: 88000000
> Entry Point: 88000000
> Verifying Checksum ... OK
> Uncompressing Kernel Image ... OK
> No initrd
> ## Transferring control to Linux (at address 88000000) ...
> ## Giving linux memsize in MB, 32
>
> Starting kernel ...
>
> [ 0.000000] Linux version 3.18.23 (buildbot@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r47269) ) #1 Sun Jan 31 14:39:09 CET 2016
> [ 0.000000] SoC Type: Ralink RT2880 id:2 rev:1
> [ 0.000000] bootconsole [early0] enabled
> [ 0.000000] CPU0 revision is: 0001906c (MIPS 4KEc)
> [ 0.000000] MIPS: machine is Belkin F5D8235 v1
> [ 0.000000] Determined physical RAM map:
> [ 0.000000] memory: 02000000 @ 08000000 (usable)
> [ 0.000000] Wasting 1048576 bytes for tracking 32768 unused pages
> [ 0.000000] Initrd not found or empty - disabling initrd
> [ 0.000000] Zone ranges:
> [ 0.000000] Normal [mem 0x08000000-0x09ffffff]
> [ 0.000000] Movable zone start for each node
> [ 0.000000] Early memory node ranges
> [ 0.000000] node 0: [mem 0x08000000-0x09ffffff]
> [ 0.000000] Initmem setup node 0 [mem 0x08000000-0x09ffffff]
> [ 0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.
> [ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 16 bytes
> [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
> [ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
> [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
> [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
> [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
> [ 0.000000] Memory: 28956K/32768K available (2506K kernel code, 124K rwdata, 488K rodata, 136K init, 185K bss, 3812K reserved)
> [ 0.000000] SLUB: HWalign=16, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
> [ 0.000000] NR_IRQS:256
> [ 0.000000] CPU Clock: 266MHz
> [ 0.000000] Calibrating delay loop... 265.42 BogoMIPS (lpj=1327104)
> [ 0.080000] pid_max: default: 32768 minimum: 301
> [ 0.090000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
> [ 0.100000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
> [ 0.110000] pinctrl core: initialized pinctrl subsystem
> [ 0.120000] NET: Registered protocol family 16
> [ 0.130000] rt2880-pinmux pinctrl: invalid group "rgmii" for function "gpio"
> [ 0.140000] rt2880-pinmux pinctrl: invalid group "uartf" for function "gpio"
> [ 0.160000] rt2880_gpio 300600.gpio: registering 24 gpios
> [ 0.170000] Switched to clocksource MIPS
> [ 0.180000] NET: Registered protocol family 2
> [ 0.190000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
> [ 0.200000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
> [ 0.210000] TCP: Hash tables configured (established 1024 bind 1024)
> [ 0.230000] TCP: reno registered
> [ 0.230000] UDP hash table entries: 256 (order: 0, 4096 bytes)
> [ 0.250000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
> [ 0.260000] NET: Registered protocol family 1
> [ 0.270000] futex hash table entries: 256 (order: -1, 3072 bytes)
> [ 0.310000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
> [ 0.320000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
> [ 0.380000] msgmni has been set to 56
> [ 0.390000] io scheduler noop registered
> [ 0.390000] io scheduler deadline registered (default)
> [ 0.400000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
> [ 0.430000] console [ttyS0] disabled
> [ 0.430000] 300c00.uartlite: ttyS0 at MMIO 0x300c00 (irq = 16, base_baud = 8333333) is a 16550A
> [ 0.450000] console [ttyS0] enabled
> [ 0.450000] console [ttyS0] enabled
> [ 0.460000] bootconsole [early0] disabled
> [ 0.460000] bootconsole [early0] disabled
> [ 0.480000] 1f000000.cfi: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022cb
> [ 0.500000] Amd/Fujitsu Extended Query Table at 0x0040
> [ 0.510000] Amd/Fujitsu Extended Query version 1.1.
> [ 0.520000] number of CFI chips: 1
> [ 0.560000] 4 ofpart partitions found on MTD device 1f000000.cfi
> [ 0.580000] Creating 4 MTD partitions on "1f000000.cfi":
> [ 0.590000] 0x000000000000-0x000000030000 : "uboot"
> [ 0.600000] 0x000000030000-0x000000040000 : "uboot-env"
> [ 0.610000] 0x000000040000-0x000000050000 : "factory"
> [ 0.620000] 0x000000050000-0x000000400000 : "linux"
> [ 0.640000] ralink_soc_eth 400000.ethernet: using fixed link parameters
> [ 0.650000] ralink_soc_eth 400000.ethernet eth0 (uninitialized): link up (1000Mbps/Full duplex)
> [ 0.670000] ralink_soc_eth 400000.ethernet eth0: ralink at 0xa0400000, irq 5
> [ 0.690000] rt2880_wdt 300120.watchdog: Initialized
> [ 0.700000] TCP: cubic registered
> [ 0.700000] NET: Registered protocol family 17
> [ 0.710000] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
> [ 0.740000] Bridge firewalling registered
> [ 0.750000] 8021q: 802.1Q VLAN Support v1.8
> [ 0.770000] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
> [ 0.790000] Please append a correct "root=" boot option; here are the available partitions:
> [ 0.810000] 1f00 192 mtdblock0 (driver?)
> [ 0.820000] 1f01 64 mtdblock1 (driver?)
> [ 0.830000] 1f02 64 mtdblock2 (driver?)
> [ 0.840000] 1f03 3776 mtdblock3 (driver?)
> [ 0.850000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
> [ 0.850000] ---[ end Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
there is some checksum error at first, but it loads the new .bin onto flash! later at boot, it goes kernel panic!
i've tried:
openwrt-18.06.1-ramips-rt288x-f5d8235-v1-squashfs-sysupgrade.bin
latest openwrt firmware for Belkin F5D8235-4 v1
f5d8235v1_ww_1.01.28.bin
original Belkin F5D8235-4 v1 firmware
any thoughts?