Как прошить ZTE 531b по UART

[olbush]

После прошивки ZTE531b на 5 версию не могу связаться ни по LAN,ни по USB,ни по WiFi.
Спаял COM-UART.Подскажите, пожалуйста,как перепрошить ТОЛЬКО с его помощью.
(как через WEB и тд знаю) Ниже лог reboot и help BusyBox-а ,полученные через HyperTerminal :
#reboot
#
The system is going down NOW !!

Sending SIGTERM to all processes.

Sending SIGKILL
Please stand by while rebooting the system.
Restarting system.
я

CFE version 1.0.37-10.2.1 for BCM96348 (32bit,SP,BE)
Build Date: Wed Aug 22 13:57:15 CST 2007 (michaelc)

Flash Config: CS0(1fc00009,1f),Base(bfc00000),Size(4MB)
b1@8
b3@1
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.2
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name :
Default host flash file name : bcmModelName_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id Name (A-G) : RTA1025W_16
Number of MAC Addresses (1-32) : 4
Ethernet MAC Address : 00:1b:9e:54:2e:c2
PSI Size (1-64) KBytes : 24
Serial Number :

==== Press space key to stop auto run (1 seconds) ====
Auto run second count down(before hit space key): 110
Code Address: 0x80010000, Entry Address: 0x801b5018
Decompression OK!
Entry at 0x801b5018
Closing network.
Starting program at 0x801b5018
Linux version 2.6.8.1 ( Compiled by lourel_cao) (gcc version 3.4.2) #1 Fri May 22 10:22:33 CST 2009

Flash Config: CS0(1fc00009,1f),Base(bfc00000),Size(4MB)

Parallel flash device: name AM29LV320MB, id 0x2200, size 4096KB

using old scheme mem size is 16 Mbytes

CPU revision is: 00029107

Determined physical RAM map:

memory: 00fa0000 @ 00000000 (usable)

On node 0 totalpages: 4000

DMA zone: 4000 pages, LIFO batch:1

Normal zone: 0 pages, LIFO batch:1

HighMem zone: 0 pages, LIFO batch:1

Built 1 zonelists

Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200

brcm mips: enabling icache and dcache...

Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.

Primary data cache 8kB 2-way, linesize 16 bytes.

PID hash table entries: 64 (order 6: 512 bytes)

Using 120.000 MHz high precision timer.

Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)

Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)

Memory: 13896k/16000k available (1468k kernel code, 2084k reserved, 211k data, 72k init, 0k highmem)

KLOB Pool 1 Initialized: 1048576 bytes <0x80e00000 ... 0x80f00000>

Calibrating delay loop... 239.20 BogoMIPS

Mount-cache hash table entries: 512 (order: 0, 4096 bytes)

Checking for 'wait' instruction... unavailable.

NET: Registered protocol family 16

Total Flash size: 4096K with 71 sectors, flash base bfc00000

using old scheme mem size is 16 Mbytes

Can't analyze prologue code at 8017db34

Initializing Cryptographic API

PPP generic driver version 2.4.2

NET: Registered protocol family 24

Using noop io scheduler

bcm963xx_mtd driver v1.0

rootfs_addr 0bfc10100

No BinFs

brcmboard: brcm_board_init entry

using old scheme mem size is 16 Mbytes

Serial number:

Serial: BCM63XX driver $Revision: 1.1.1.1 $

ttyS0 at MMIO 0xfffe0300 (irq = 10) is a BCM63XX

NET: Registered protocol family 2

IP: routing cache hash table of 512 buckets, 4Kbytes

TCP: Hash tables configured (established 512 bind 1024)

Initializing IPsec netlink socket

NET: Registered protocol family 1

NET: Registered protocol family 17

NET: Registered protocol family 15

Ebtables v2.0 registered

NET: Registered protocol family 8

NET: Registered protocol family 20

802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>

All bugs added by David S. Miller <davem@redhat.com>

VFS: Mounted root (squashfs filesystem) readonly.

Freeing unused kernel memory: 72k freed


init started: BusyBox v1.00 (2009.05.22-03:00+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5



BusyBox v1.00 (2009.05.22-03:00+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.


Loading drivers and kernel modules...

atmapi: module license 'Proprietary' taints kernel.

adsl: adsl_init entry

blaadd: blaa_detect entry

Broadcom BCMPROCFS v1.0 initialized

External Switch Mode 00007547 !!

Broadcom BCM6348B0 Ethernet Network Device v0.3 May 22 2009 10:21:16

Config Ethernet Switch Through SPI Slave Select 0

dgasp: kerSysRegisterDyingGaspHandler: eth0 registered

eth0: MAC Address: 00:1B:9E:54:2E:C2

Broadcom BCM6348B0 USB Network Device v0.4 May 22 2009 10:21:17

usb0: MAC Address: 00 1B 9E 54 2E C3

usb0: Host MAC Address: 00 1B 9E 54 2E C4

USB Vendor id=069a, USB Product id=0311

PCI: Setting latency timer of device 0000:00:01.0 to 64

PCI: Enabling device 0000:00:01.0 (0004 -> 0006)

wl: srom not detected, using main memory mapped srom info (wombo board)

wl0: wlc_attach: use mac addr from the system pool by id: 0x776c0000

wl0: MAC Address: 00:1B:9E:54:2E:C5

wl0: Broadcom BCM4318 802.11 Wireless Controller 4.150.10.5.cpe2.0

dgasp: kerSysRegisterDyingGaspHandler: wl0 registered

BcmAdsl_Initialize=0xC005E878, g_pFnNotifyCallback=0xC0077E44

AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00000980 adsl2=0x00000000

pSdramPHY=0xA0FFFFF8, 0x67732 0xDEADBEEF

AdslCoreHwReset: AdslOemDataAddr = 0xA0FFB114

AnnexCParam=0x7FFF7EB8 AnnexAParam=0x00000980 adsl2=0x00000000

dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered

ATM proc init !!!


==> ADSL2+ Router Software Version: ZXDSL 531BIIV5.1.0c_B09_RU_A2pB021c.d20h  <==

m_wlMssidVar[0].wlSsid
SIGSEGV
# help

Built-in commands:
----------
. : break cd continue eval exec exit export help login newgrp
read readonly set shift times trap umask wait [ busybox cat chmod
date df dmesg echo expr false ifconfig init insmod kill killall
klogd linuxrc ln logger logread mkdir mount msh ping ps pwd reboot
rm rmmod route sendarp sh sysinfo syslogd test tftp tftpd top
true tty vconfig

#

[kalobyte]

он прошивается по сети через тфпт, надо только в консоли выбрать команды в загрузчике
в загрузчик войти можно, если включить при нажатой кнопке сброса или типа того
может быть загрузчик ждет пару секунд нажатия кнопки, он там писать должен

[olbush]

Сеть молчит!(см. начало) Могу "разговаривать" с модемом только через UART.Дан лог команды reboot и
команды help

[kalobyte]

там же написано то, о чем я тебе говорил
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.2 Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name :
Default host flash file name : bcmModelName_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id Name (A-G) : RTA1025W_16
Number of MAC Addresses (1-32) : 4
Ethernet MAC Address : 00:1b:9e:54:2e:c2
PSI Size (1-64) KBytes : 24
Serial Number :

==== Press space key to stop auto run (1 seconds) ====

[olbush]

Повторяю вопрос: Можно ли прошить ТОЛЬКО(ТОЛЬКО! ТОЛЬКО! ТОЛЬКО!) через UART!!!???
И если можно,то как?(ну не пингуется ни по LAN,ни по USB,ни по WiFi

[kalobyte]

ты читать умееш вообще?
зайди в меню загрузчика и посмотри опцию загрузки через ком
если загрузчик работает, то все там по сети работает, а пинговаться оно не обязано - лишний код ицмп не нужен в загрузчике

[olbush]

Ну и как этим:
Built-in commands:
----------
. : break cd continue eval exec exit export help login newgrp
read readonly set shift times trap umask wait [ busybox cat chmod
date df dmesg echo expr false ifconfig init insmod kill killall
klogd linuxrc ln logger logread mkdir mount msh ping ps pwd reboot
rm rmmod route sendarp sh sysinfo syslogd test tftp tftpd top
true tty vconfig

дотянуться до файла прошивки на ком-пе(подробнее пл-ста)?

[kalobyte]

это команды прошивки, а не загрузчика
==== Press space key to stop auto run (1 seconds) ====
как увидиш эту надпись, то жми на пробел