It's works!
uboot patched.
steps:
0. It's very dangerous! you must be ready to replace flash chip if something wrong.
1. Download uboot partition to file. Get uimage from this file (it begin with 27 05 19 56)
2. find lzma image and unpack it. use binwalk and lzma.
3. change “bootcmd=bootm 0x9f070000”. to “bootcmd=bootm 0x9f030000”
4. pack it by lzma 4.65.
5. create uimage by mkimage. "mkimage -A mips -T firmware -C lzma -n 'u-boot image' -a 0x80010000 -e 0x80010000 -d file.lzma uboot.uimg"
6. write this image to the same place in original uboot file.
7. connect to router by UART console.
7. write uboot it to flash.
8. write openwrt image to flash.
I remove "language" and "nvram" partitions.
cat /proc/mtd
dev: size erasesize name
mtd0: 00010000 00010000 "u-boot"
mtd1: 00010000 00010000 "art"
mtd2: 00010000 00010000 "mac"
mtd3: 000f0000 00010000 "kernel"
mtd4: 002e0000 00010000 "rootfs"
mtd5: 00070000 00010000 "rootfs_data"
mtd6: 003d0000 00010000 "firmware"
also you need to patch /trunk/target/linux/ar71xx/image/Makefile
diff Makefile Makefile.orig
253c253
< cameo933x_mtdlayout=mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,64k(mac)ro,960k(kernel),2944k(rootfs),3904k@0x30000(firmware)
---
> cameo933x_mtdlayout=mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,64k(mac)ro,64k(nvram)ro,192k(language)ro,896k(kernel),2752k(rootfs),3648k@0x70000(firmware)
255c255
< $(call Image/Build/CameoHornet,$(1),$(2),$(3),$(cameo933x_mtdlayout),983040,3014656,$(4))
---
> $(call Image/Build/CameoHornet,$(1),$(2),$(3),$(cameo933x_mtdlayout),917504,2818048,$(4))
(Last edited by supaplexin on 29 Dec 2012, 17:45)