Joe Sixpack
DD-WRT Novice
Joined: 14 May 2015
Posts: 36
|
 Posted: Fri Aug 05, 2016 22:33 Post subject: Well.. it was looking hopeful.. then I killed it :( |
 |
Well I was digging around in my router box and found this puppy again.
I gave up last year on it but finding it got me wanting to take a 2nd look.
I opened it up and soldered on headers for serial and thru caution to the wind..
I tired the most current k3.0 builds (Aug 4th)
dd-wrt.v24-27506_NEWD-2_K3.x_mega-nv64k
Nope still broken.
So I decided to try a MIPSr2 64k build of tomato.
nope, booted but broken wifi.
So after looking at other routers with similar hardware It seemed like the linksys e2000 was'nt far off.. except it uses 60k nvram not 64k.. how far wrong could it go?
So I tried a kong build of dd-wrt for e2000.
http://www.desipro.de/ddwrt/K26/dd-wrt.v24-K26_e2000.bin
Well It kinda worked, Radio actually works in this build.. you can see other 5ghz AP's on site survey.. and you can even get it to show up on a AP scan but only with WPA1&2, open and wep make it invisible.
But even with WPA1&2 you can see it but can't connect.. at least with my galaxy s4 which I used for testing.
Having been encouraged by the progress with a e2000 build of a firmware I went back to Tomato this time: tomato-E2000-NVRAM60K-1.28.RT-MIPSR2-132-Max
But because it had ddwrt on it last it was a bit confused.. it still called it self ddwrt and the password did not work.. I could see on the serial console though that wifi was not recognized..
So I decided to reset nvram using reset button.. well.. the reset button is very deep on on these and apparently it shifted inside just enough to get 'stuck' down..
the serial console kept showing it rebooting in a loop so I tried tftp'ing kong back on it.. at first it did not wanna take it.. eventually in the process I realized the problem with the rest button.. fixed that.
then stripped the header off the kong build so it would take it over tftp.. this time it took it and showed it was programing got to the point where it could reboot.. and that's that.. dead.. no serial console.. nothing.. status lights are solid and dim.
ethernet port activity light still works but no ping.. double checked serial connection.. fine.. double checked reset button.. fine.
Not sure what happen here.. Im thinking either something vital in NVRAM is messed up.. but I would think i'd still get something out of the serial console and it is 100% dead, the SoC hardly even gets warm 
Im thinking somehow the botolaoder got toasted, luckly I do have a backup.. but that means JTAG if im right and while I have a cable I've never actually used one and have no idea the pinout on this device.
I tried to figure out what went wrong...
only thing I can see is looking at where programing started it looks like it started at 2mb? unless im reading that wrong.. but... I looked back at prior flashing and it had the same start address.
I did use a 4kb block size on tftp but I do not see how that could have effected anything.
I went ahead and checked what I can only assume is a 12pin jtag.. and here's what I came up with
Pins in the top row have 3.21volts on them when powered, 1300ohm resistance when off.
Not sure how to map out which pin does what though.
The bottom row of pins are clearly grounds.
Pin 11 & 12 appear to be not connected.
anyone recognize this pinout? I went on google but found enough different pinouts to fill a book.
| Code: | 11 9 7 5 3 1
NC 3.21v 3.21v 3.21v 3.21v 3.21v
12 10 8 6 4 2
NC Grd Grd Grd Grd Grd |
| Code: | Decompressing...done
CFE version 5.11.128.6 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Wed Sep 7 00:26:21 CST 2011 (root@FC8_Dumas3)
Copyright (C) 2000-2008 Broadcom Corporation.
Init Arena
Init Devs.
Boot partition size = 131072(0x20000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.11.128.6
CPU type 0x19740: 354MHz
Tot mem: 65536 KBytes
CFE mem: 0x80700000 - 0x807A2F70 (667504)
Data: 0x807356F0 - 0x807384C0 (11728)
BSS: 0x807384C0 - 0x8073CF70 (19120)
Heap: 0x8073CF70 - 0x807A0F70 (409600)
Stack: 0x807A0F70 - 0x807A2F70 (8192)
Text: 0x80700000 - 0x807356E8 (218856)
Device eth0: hwaddr BC-C8-10-EA-00-69, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Open the flash0.os to check CRC...Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
linux_first_size is not set, set to 4063232
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3916 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
Linux version 2.6.24.111 (bluebat@opensuse) (gcc version 4.1.2) #61 Fri Dec 26 21:21:46 CET 2014
CPU revision is: 00019740
Found a 8MB ST compatible serial flash
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0 -> 16384
HighMem 16384 -> 16384
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0 -> 16384
Built 1 zonelists in Zone order. Total pages: 16384
Kernel command line: console=ttyS0,115200 root=1f02 rootfstype=squashfs noinitrd
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 512 (order: 9, 2048 bytes)
CPU: BCM4716 rev 1 at 354 MHz
Using 177.000 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 58628k/65536k available (3490k kernel code, 6844k reserved, 1369k data, 216k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
PCI: Using membase 8000000
PCI: Disabled
PCI: no core
PCI: Fixing up bus 0
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered
io scheduler deadline registered (default)
HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a 16550A
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
et_module_init: passivemode set to 0x0
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.100.138.9
pflash: found no supported devices
bootloader size: 196608
nvram size: 61440
sflash: Filesystem type: squashfs, size=0x5f8a6c
partition size = 6300672
Creating 5 MTD partitions on "sflash":
0x00000000-0x00030000 : "cfe"
0x00030000-0x007f0000 : "linux"
0x0018dc00-0x00790000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x007f0000-0x00800000 : "nvram"
0x00790000-0x007f0000 : "ddwrt"
Broadcom Watchdog Timer: 0.07 initialized.
u32 classifier
Performance counters on
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
ctnetlink v0.93: registering with nfnetlink.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
ClusterIP Version 0.8 loaded successfully
TCP bic registered
TCP cubic registered
TCP westwood registered
TCP highspeed registered
TCP hybla registered
TCP htcp registered
TCP vegas registered
TCP scalable registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Welcome to PF_RING 3.2.1
(C) 2004-06 L.Deri <deri@ntop.org>
NET: Registered protocol family 27
PF_RING: bucket length 128 bytes
PF_RING: ring slots 4096
PF_RING: sample rate 1 [1=no sampling]
PF_RING: capture TX No [RX only]
PF_RING: transparent mode Yes
PF_RING initialized correctly.
PF_RING: registered /proc/net/pf_ring/
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
decode 1f02
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 216k freed
start service
starting Architecture code for broadcom
done
Booting device: Linksys WRT54G/GL/GS
loading switch-core
loading switch-robo
roboswitch: Probing device eth0: Failed to enable switch
roboswitch: Probing device eth1: <3>roboswitch: [drivers/net/switch/switch-robo.c:133] SIOCGETCPHYRD failed!
roboswitch: [drivers/net/switch/switch-robo.c:133] SIOCGETCPHYRD failed!
No Robo switch in managed mode found, phy_id = 0xffffffff
roboswitch: Probing device eth2: No such device
roboswitch: Probing device eth3: No such device
boardflags are 0x000F
enable Afterburner, boardflags are 0x020F
[USB] checking...
Some error found, we want to reboot!.....................
kill -15 -1: No such file or directory
sleep 3: No such file or directory
kill -9 -1: No such file or directory
umount -a -r: No such file or directory
/etc/preinit: line 44: can't create /proc/sys/net/ipv4/ip_conntrack_max: nonexistent directory
/etc/preinit: line 44: can't create /proc/sys/net/ipv4/ip_conntrack_max: nonexistent directory
eth1: Operation not supported
wl0.1: No such device
wl0.2: No such device
wl0.3: No such device
eth1: Operation not permitted
eth1: Invalid argument
eth1: Invalid argument
nbw = 40
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Invalid argument
eth1: Operation not supported
eth1: Operation not supported
/bin/sh: can't create /proc/sys/net/bridge/bridge-nf-call-arptables: nonexistent directory
/bin/sh: can't create /proc/sys/net/bridge/bridge-nf-call-ip6tables: nonexistent directory
/bin/sh: can't create /proc/sys/net/bridge/bridge-nf-call-iptables: nonexistent directory
br0: Dropping NETIF_F_UFO since no NETIF_F_HW_CSUM feature.
/bin/sh: can't create /sys/devices/virtual/net/br0/bridge/multicast_snooping: nonexistent directory
device br0 entered promiscuous mode
br0: Invalid argument
device eth0 entered promiscuous mode
br0: port 1(eth0) entering learning state
device br0 left promiscuous mode
device br0 entered promiscuous mode
device br0 left promiscuous mode
function start_hwmon not found
Sending SIGTERM to all processes
BCMDOG: WDT device closed unexpectedly. WDT will not stop!
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
Sending SIGKILL to all processes
Restarting system.
Please stand by while rebooting the system...
|
|
|
