中兴zxv10 h608b V2 配置为16MBflash和 32MB DDR内存，它采用的是英飞凌 PSB7200ZDW + ADM6996M的解决方案，无线芯片为TNETE1350A,跟中兴W300 “商务@宽带”的一款以及531B小白版在硬件上极为相似.
英飞凌收购德州仪器公司的DSL客户端设备， PSB7200ZDW就是原来的TNETD7200ZDW ，属于AR7系列 ,openwrt支持该芯片。
连上USB转TTL线后，通电启动后按下ESC键，可以看到：
Basic POST completed... Success.
Last reset cause: Software reset (memory controller also reset)
ZXV10 HomeGateway bootloader version: 1.4.4.3
Board hardware version: 2.0.6
Flash size: 16M
Memory size: 32M
(c) Copyright 2004-2007 ZTE CORPORATION. All Rights Reserved.
Press ESC for monitor...
ZXV10 HGW>
bootloader为德州仪器的ADAM2 ，可以通过FTP刷openwrt
ADAM2看看有那些命令：
ZXV10 HGW> help
reboot printenv ledtest keytest
setenv unsetenv fmt boot
help
用printenv看看系统配置，
ZXV10 HGW> printenv
BUILD_OPS 0x601
bootloaderVersion 1.4.4.3
ProductID ZXV10 HGW
eoc_vendor_id 3902
IPA 192.168.1.1
IPA_SVR 192.168.1.245
mtd2 0x90000000,0x90020000
mtd3 0x90020000,0x90060000
mtd5 0x90060000,0x90080000
mtd1 0x90080000,0x90160000
mtd0 0x90160000,0x90560000
mtd4 0x90080000,0x90560000
mtd6 0x90560000,0x90580000
mtd7 0x90b00000,0x91000000
BOOTCFG m:f:"mtd1"
UPMODE adsl
MAC_PORT 0
MODETTY0 115200,n,8,1,hw
MODETTY1 115200,n,8,1,hw
CPUFREQ 211968000
MIPSFREQ 211968000
SYSFREQ 125000000
mtd10 0x90580000,0x905a0000
mtd11 0x905a0000,0x905e0000
mtd13 0x905e0000,0x90600000
mtd9 0x90600000,0x906E0000
mtd8 0x906E0000,0x90aE0000
mtd12 0x90600000,0x90aE0000
mtd14 0x90aE0000,0x90b00000
BOOTCFG_A m:f:"mtd1"
BOOTCFG_B m:f:"mtd9"
HWVersion 2.0.6
MEMSZ 0x02000000
FLASHSZ 0x01000000
PROMPT ZXV10 HGW>
有15个分区，有系统备份，难怪它刷不会变砖头。
现在刷openwrt,通用固件openwrt-ar7-squashfs.bin可以在以下地址下载：
http://downloads.openwrt.org/backfire/10.03/ar7/
英文原版安装说明地址如下：
http://oldwiki.openwrt.org/OpenWrtDocs(2f)InstallingAR7.html
1.用fmt干掉系统及备份，注意千万不要干掉mtd2，否者的话就会变砖头。板上有JTAG接口，但好像有问题。
ZXV10 HGW> fmt mtd0
ZXV10 HGW> fmt mtd1
ZXV10 HGW> fmt mtd3
.
.
.
ZXV10 HGW> fmt mtd14
2.新建mtd15分区,地址就是原mtd0和mtd1加在一起，用fmt擦出mtd15
ZXV10 HGW> setenv mtd15 0x90080000,0x90560000
ZXV10 HGW> fmt mtd15
3.连上网线用FTP登录路由器,电脑IP为192.168.1.X (X为2-253).用户为adam2,密码为adam2
# ftp 192.168.1.1
Connected to 192.168.1.1 (192.168.1.1).
220 ADAM2 FTP Server ready.
Name (192.168.1.1:root): adam2
530 Please login with USER and PASS.
SSL not available
331 Password required for adam2.
Password:
230 User adam2 successfully logged in.
Remote system type is UNIX.
ftp>
4.开始刷新固件，注意把通用固件openwrt-ar7-squashfs.bin放在当前目录，否者的 FTP会找不到文件。
ftp> binary
200 Type set to I.
ftp> quote MEDIA FLSH
200 Media set to FLSH.
ftp> put "openwrt-ar7-squashfs.bin" "openwrt-ar7-squashfs.bin mtd15"
local: openwrt-ar7-squashfs.bin remote: openwrt-ar7-squashfs.bin mtd15
200 Port command successful.
120 service ready in 41 seconds.
150 Opening BINARY mode data connection for file transfer.
2752516 bytes sent in 100 secs (27 Kbytes/sec)
ftp> quote REBOOT
226 Transfer complete.
ftp> quit
221-Thank you for using the FTP service on ADAM2.
221 Goodbye.
刷新固件后路由器自动重启，在 TTL终端下可以看到：
Booting...
Linux version 2.6.32.10 (openwrt@wrt1.marcant.net) (gcc version 4.3.3 (GCC) ) #21 Tue Apr 6 14:55:04 CEST 2010
bootconsole [early0] enabled
CPU revision is: 00018448 (MIPS 4KEc)
TI AR7 (TNETD7200), ID: 0x002b, Revision: 0x11
Determined physical RAM map:
memory: 02000000 @ 14000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00014000 -> 0x00016000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00014000 -> 0x00016000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: BOOTCFG_A 00110011 0 1 8 9 console=ttyS0,115200n8
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 8kB, 4-way, VIPT, no aliases, linesize 16 bytes
Memory: 28620k/32768k available (2247k kernel code, 4148k reserved, 353k data, 136k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:256
Calibrating delay loop... 149.50 BogoMIPS (lpj=747520)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Clocks: Async mode
Clocks: Setting DSP clock
Clocks: base = 25000000, frequency = 125000000, prediv = 1, postdiv = 2, postdiv2 = 1, mul = 10
Clocks: Setting CPU clock
Adjusted requested frequency 211000000 to 211968000
Clocks: base = 35328000, frequency = 211968000, prediv = 1, postdiv = 1, postdiv2 = -1, mul = 6
Clocks: Setting USB clock
Adjusted requested frequency 48000000 to 48076920
Clocks: base = 125000000, frequency = 48000000, prediv = 13, postdiv = 1, postdiv2 = -1, mul = 5
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY) ?? 2001-2006 Red Hat, Inc.
msgmni has been set to 55
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x8610e00 (irq = 15) is a 16550A
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
physmap platform flash device: 00800000 at 10000000
physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank
NOR chip too large to fit in mapping. Attempting to cope...
Amd/Fujitsu Extended Query Table at 0x0040
physmap-flash.0: CFI does not contain boot bank location. Assuming top.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Reducing visibility of 16384KiB chip to 8192KiB
cmdlinepart partition parsing not available
RedBoot partition parsing not available
4 ar7part partitions found on MTD device physmap-flash.0
Creating 4 MTD partitions on "physmap-flash.0":
0x000000000000-0x000000020000 : "loader"
0x000000060000-0x000000080000 : "config"
0x000000080000-0x000000800000 : "linux"
0x000000160000-0x000000800000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=320000, len=4E0000
0x000000320000-0x000000800000 : "rootfs_data"
Fixed MDIO Bus: probed
cpmac-mii: probed
cpmac: device eth0 (regs: 08610000, irq: 27, phy: 0:00, mac: 00:00:a0:00:00:00)
ar7_wdt: timer margin 59 seconds (prescale 65535, change 57180, freq 62500000)
Registered led device: status
vlynq0: regs 0x08611800, irq 29, mem 0x04000000
Found a VLYNQ device: 00000029
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
Freeing unused kernel memory: 136k freed
Please be patient, while OpenWrt loads ...
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
jffs2 not ready yet; using ramdisk
mini_fo: using base directory: /
mini_fo: using storage directory: /tmp/root
- init -
Please press Enter to activate this console. device eth0 entered promiscuous mode
br-lan: port 1(eth0) entering forwarding state
PHY: 0:00 - Link is Up - 100/Full
NET: Registered protocol family 8
NET: Registered protocol family 20
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
nf_conntrack version 0.5.0 (449 buckets, 1796 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
acx: this driver is still EXPERIMENTAL
acx: reading README file and/or Craig's HOWTO is recommended, visit http://acx100.sf.net in case of further questions/discussn
acx: compiled to use 32bit I/O access. I/O timing issues might occur, such as non-working firmware upload. Report them
acx: running on a little-endian CPU
acx: PCI/VLYNQ module v0.3.37 initialized, waiting for cards to probe...
Driver found for VLYNQ device: 00000029
acx: found TI TNETW1350-based wireless network card at <NULL>, irq:80, phymem:0x4000000, mem:0xa4000000
initial debug setting is 0x000A
using IRQ 80
acx: eCPU is already running. reset_dev() FAILED
registered device TI Avalanche SAR
Ohio250(7200/7100A2) detected
requesting firmware image "ar0700xx.bin"
avsar: firmware: requesting ar0700xx.bin
Creating new root folder avalanche in the proc for the driver stats
Texas Instruments ATM driver: version:[7.03.01.00]
jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
jffs2_build_filesystem(): unlocking the mtd device... done.
jffs2_build_filesystem(): erasing all blocks after the end marker... done.
mini_fo: using base directory: /
mini_fo: using storage directory: /overlay
ar7_wdt: timer margin 59 seconds (prescale 65535, change 57180, freq 62500000)
ar7_wdt: timer margin 59 seconds (prescale 65535, change 57180, freq 62500000)
BusyBox v1.15.3 (2010-04-06 03:13:44 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
Backfire (10.03, r20728) --------------------------
* 1/3 shot Kahlua In a shot glass, layer Kahlua
* 1/3 shot Bailey's on the bottom, then Bailey's,
* 1/3 shot Vodka then Vodka.
---------------------------------------------------
root@OpenWrt:/#
root@OpenWrt:/# uname -p
unknown
root@OpenWrt:/# uname -a
Linux OpenWrt 2.6.32.10 #21 Tue Apr 6 14:55:04 CEST 2010 mips GNU/Linux
root@OpenWrt:/#
这个版本有以下问题USB和无线不可用估计是没安装好驱动。ADSL可以用。
