Recovering a bricked E2500 from bad build (Success!)

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
rrauenza
DD-WRT Novice


Joined: 04 May 2014
Posts: 9

PostPosted: Sun May 04, 2014 20:56    Post subject: Recovering a bricked E2500 from bad build (Success!) Reply with quote
I have a Linksys E2500 (V2)

I started the process of flashing it with the recommended trail build dd-wrt.v24-21061_NEWD-2_K2.6_mini-e2500.bin, and that flashed fine.

I then have been trying the recommended build (21061), which also flashed fine, but ssh is not working and more importantly, I'm unable to clone/change the wireless MAC address.

So I tried some other builds... and managed to flash one that failed to boot.

I'm following the peacock tftp instructions and managed to tftp both the recommended 21061 and then the trail build -- dd-wrt.v24-21061_NEWD-2_K2.6_mini-e2500.bin

Both seem to transfer succesfully, but afterwards the ping's continue, but the power light just flashes.

After a reboot (I waited 5+mins) , the power light just stays on, the ethernet port flashes with traffic and I only get 3 pings with a TTL of 100, then ping time outs. I've done a 30:30:30 with no success.

I also tried tftp'ing the vendor's firmware I was running before.

What should I try next? It seems like jtag is only needed when I can't actually tftp... which I can.

Rich


Last edited by rrauenza on Sun May 11, 2014 6:24; edited 2 times in total
Sponsor
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7113
Location: Columbus, Ohio

PostPosted: Sun May 04, 2014 21:47    Post subject: Reply with quote
Check to see if you can log into the GUI wirelessly. I flashed a linksys e3000 that was acting the same not responding to pings.
I noticed that it was broadcasting a wireless signal. I connected to it, telnet to it at 192.168.1.1 and type erase nvram, enter, then type reboot and enter.
See if that works. If not google dd-wrt serial recovery, not jtag.

_________________
I am far from a guru, I'm barely a novice.
rrauenza
DD-WRT Novice


Joined: 04 May 2014
Posts: 9

PostPosted: Sun May 04, 2014 22:16    Post subject: Reply with quote
I'm also finding some threads (specifically about the E2500) that talk about quickly telneting in -- I'll try those, too.
rrauenza
DD-WRT Novice


Joined: 04 May 2014
Posts: 9

PostPosted: Mon May 05, 2014 2:07    Post subject: Reply with quote
Haven't picked up any opportunity to telnet in during the 3 seconds of successful pings. I've tried running the telnet in a loop.

So, after the tftp (which says success!) it is still pingable, but power led blinks. No port 80 (http), no port 23 (telnet).

On reboot, solid power light, ping timeouts, three TTL=100 pings, then ping timeouts.

During all times the switch port flickers from network activity...

(and no wifi shows up)

Maybe I'll try cisco/linksys support...
Murrkf
DD-WRT Guru


Joined: 22 Sep 2008
Posts: 12680

PostPosted: Mon May 05, 2014 16:32    Post subject: Reply with quote
See peacock note 6. You will likely need a serial cable to fix.
_________________
SIG:
I'm trying to teach you to fish, not give you a fish. If you just want a fish, wait for a fisherman who hands them out. I'm more of a fishing instructor.
LOM: "If you show that you have not bothered to read the forum announcements or to follow the advices in them then the level of help available for you will drop substantially, also known as Murrkf's law.."
rrauenza
DD-WRT Novice


Joined: 04 May 2014
Posts: 9

PostPosted: Tue May 06, 2014 1:02    Post subject: Reply with quote
I've got it cracked open and three wires attached -- well, holding them down with one hand.

Turns out there are two sets of 5 holes on the device (v2).

Both give me garbage at power up (115200 N81)... one of them responds with garbage when I hit return.

But it seems like the bps rate is wrong somehow. I've tried other values...

Sample garbage: •3üŸŸŸŸŸŸŸŸÊëÜ¿¿¿¿‹~ŸŸŸŸŸŸŸŸüŸ™™9=Ÿ~ŸŸŸŸŸŸŸŸüŸŸŸŸŸŸŸŸÊëܝ›¿¿¿‹~ŸŸŸŸŸŸŸŸüŸŸŸŸŸŸŸŸ~ŸŸŸŸŸŸŸŸüŸŸŸŸŸŸŸŸÊëܝ“¿¿¿‹ü•7•9ŸüŸ•3‘ŸüŸŸŸŸüŸ—“ŸŸŸŸÊëÜ›Ÿ¿¿¿‹üŸŸŸŸŸŸ™9ü3333333—~ŸŸŸŸŸŸŸŸüŸŸŸŸŸŸŸŸÊëÜ›—¿¿¿‹üŸŸŸŸŸŸŸüŸŸŸŸŸŸŸŸü¿¿¿¿¿¿¿¿ü¿¿¿¿¿¿¿¿

Enter responds with: Cÿ

Other letters also respond similarly with a character followed by ÿ.

I'm using a usb/serial adapter I've used before for various things. Windows says the driver is Prolific.
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7113
Location: Columbus, Ohio

PostPosted: Tue May 06, 2014 1:24    Post subject: Reply with quote
Probably the same as the v1. Look here, post 7
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=152122&postdays=0&postorder=asc&start=15

_________________
I am far from a guru, I'm barely a novice.
rrauenza
DD-WRT Novice


Joined: 04 May 2014
Posts: 9

PostPosted: Wed May 07, 2014 14:34    Post subject: Reply with quote
Yup, that's the post I'm referencing for attaching the serial cable.

I'm assuming I have the right pins or I wouldn't get any traffic at all. 115200 N81.

Is it possible I need one of those USB TTL converter headers instead?
Murrkf
DD-WRT Guru


Joined: 22 Sep 2008
Posts: 12680

PostPosted: Wed May 07, 2014 16:22    Post subject: Reply with quote
Has to be level shifting ttl....see the wiki.
_________________
SIG:
I'm trying to teach you to fish, not give you a fish. If you just want a fish, wait for a fisherman who hands them out. I'm more of a fishing instructor.
LOM: "If you show that you have not bothered to read the forum announcements or to follow the advices in them then the level of help available for you will drop substantially, also known as Murrkf's law.."
rrauenza
DD-WRT Novice


Joined: 04 May 2014
Posts: 9

PostPosted: Wed May 07, 2014 17:02    Post subject: Reply with quote
Something like this?

http://www.amazon.com/CP2102-Module-Download-Serial-Converter/dp/B009T2ZR6W/

or

http://www.amazon.com/Kootek-PL2303-Serial-Converter-Adapter/dp/B00FEAMUOK/ref=pd_cp_pc_1

or

http://www.amazon.com/SMAKN-PL2303HX-RS232-module-Converter/dp/B00H2BSX7M/ref=sr_1_1

if I want just a cable...

Is leveling an implied feature of devices like these? Or does it need to be explicitly in the specs?

Thanks for the help!
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7113
Location: Columbus, Ohio

PostPosted: Wed May 07, 2014 19:33    Post subject: Reply with quote
The first 2 ok, the last one I'd skip. I've tried 3 of that style and none work.
_________________
I am far from a guru, I'm barely a novice.
rrauenza
DD-WRT Novice


Joined: 04 May 2014
Posts: 9

PostPosted: Wed May 07, 2014 22:09    Post subject: Reply with quote
Thanks -- I'll try one of those modules and try again in a couple of days. Will post my results.
rrauenza
DD-WRT Novice


Joined: 04 May 2014
Posts: 9

PostPosted: Sun May 11, 2014 5:14    Post subject: Reply with quote
Progress:

One port says this on bootup:

Quote:

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 10/09/12 18:45:18 CST (root@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
This is a Serial Flash
Boot partition size = 262144(0x40000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.127.2901 @VERSION_TYPE@
CPU type 0x19749: 300MHz
Tot mem: 65536 KBytes

CFE mem: 0x80700000 - 0x807A2680 (665216)
Data: 0x807351A0 - 0x807391C0 (16416)
BSS: 0x807391C0 - 0x8073C680 (13504)
Heap: 0x8073C680 - 0x807A0680 (409600)
Stack: 0x807A0680 - 0x807A2680 (8192)
Text: 0x80700000 - 0x80735194 (217492)

Boot version: v5.00
The boot is CFE
Nothing...
The country is same

### CLKDIV= 0x80e0842, SFlashClkDiv=8 clkdivsf=2 ###

### Change it to 0x20e0842 (2) ###
Device eth0: hwaddr <redacted>, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Header CRC: 0x7569F471
Calculate CRC: 0x7569F471
Image 1 is OK
Try to load image 1.
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3916 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
Linux version 2.6.24.111 (root@dd-wrt.buildserver) (gcc version 4.5.4 20110526 (prerelease) (Linaro GCC 4.5-2011.06-0) ) #18519 Tue Dec 24 02:25:01 CET 2013
CPU revision is: 00019749
Found a 8MB ST compatible serial flash
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0 -> 16384
HighMem 16384 -> 16384
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0 -> 16384
Built 1 zonelists in Zone order. Total pages: 16384
Kernel command line: console=ttyS0,115200 root=1f02 rootfstype=squashfs noinitrd
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 512 (order: 9, 2048 bytes)
CPU: BCM5357 rev 2 at 300 MHz
Using 150.000 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 58744k/65536k available (3387k kernel code, 6732k reserved, 1368k data, 212k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Generic PHY: Registered new driver
PCI: no core
PCI: no core
PCI: Fixing up bus 0
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 8006ac14, ra == 8006c294
Oops[#1]:
Cpu 0
$ 0 : 00000000 11008000 8111f800 00000000
$ 4 : 00000000 0059f780 0000059f 00000000
$ 8 : 00000000 8033ca90 00000000 00000000
$12 : 00000000 00000000 00000000 00000000
$16 : 8115d5c0 8059f780 11008001 80460000
$20 : 0000003c fffffff4 00000000 00000000
$24 : 00000008 00000000
$28 : 8058e000 8058fe60 00000000 8006c294
Hi : 00000008
Lo : 00000000
epc : 8006ac14 Not tainted
ra : 8006c294 Status: 11008002 KERNEL EXL
Cause : 00000008
BadVA : 00000000
PrId : 00019749
Modules linked in:
Process swapper (pid: 1, threadinfo=8058e000, task=8058d988)
Stack : 00000000 8035358c 00000000 8115d5c0 8115d5c0 8059f780 00000000 8006c294
81112580 81112580 fffffff4 00000000 8115d5c0 00040000 8042b500 00000004
80500000 80460000 00000348 8006c4e4 800b946c 00000000 804257e8 00000004
8115d5c0 8115d5c0 00040000 8006c908 804c0000 800892f0 81114420 8045d8e0
8058feec 8058fee8 000000cb 00000008 00000010 3ffffffd 00000000 80500000
...
Call Trace:[<8006c294>][<8006c4e4>][<800b946c>][<8006c908>][<804c0000>][<800892f0>][<804c0000>][<804c0000>][<804b9b40>][<804b9228>][<804a73d0>][<804a72e4>][<8000bc20>]

Code: 8c42000c 8c440018 8c430000 <8c900000> 8e020000 8e030004 0043182b 14600005 24430004
Kernel panic - not syncing: Attempted to kill init!


I can issue ^C and get a CFE prompt.

I need to solder some pins now -- can't hold the wires in place with one hand and type with the other Smile

The other, btw, says:

Quote:

RTE (usbrdl) v5.100 (TOB) running on BCM43236 r2 @ 20/120/120 MHz.
rdl0: Broadcom USB Remote Download Adapter
ei 1, ebi 2, ebo 1

>
>
>
>


...and responds with >'s to kb input.
rrauenza
DD-WRT Novice


Joined: 04 May 2014
Posts: 9

PostPosted: Sun May 11, 2014 6:22    Post subject: Success with unbricking a Linksys e2500! Reply with quote
Now that I have serial, I tried again using the regular tftp method, but monitored the serial console:

Quote:

The boot is CFE
Update lan mac from [xxxxx] to [yyyyy]
Update country from [] to [US]
Committing NVRAM...done
Waiting for reset button release...done

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 10/09/12 18:45:18 CST (root@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
This is a Serial Flash
Boot partition size = 262144(0x40000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.127.2901 @VERSION_TYPE@
CPU type 0x19749: 300MHz
Tot mem: 65536 KBytes

CFE mem: 0x80700000 - 0x807A2680 (665216)
Data: 0x807351A0 - 0x807391C0 (16416)
BSS: 0x807391C0 - 0x8073C680 (13504)
Heap: 0x8073C680 - 0x807A0680 (409600)
Stack: 0x807A0680 - 0x807A2680 (8192)
Text: 0x80700000 - 0x80735194 (217492)

Boot version: v5.00
The boot is CFE
Nothing...
The country is same

### CLKDIV= 0x80e0842, SFlashClkDiv=8 clkdivsf=2 ###

### Change it to 0x20e0842 (2) ###
Device eth0: hwaddr 48-F8-B3-4F-9D-8F, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Header CRC: 0x7569F471
Calculate CRC: 0x7569F471
Image 1 is OK
Try to load image 1.
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: .. 3544064 bytes read
Entry at 0x807a2680
Loader:raw Filesys:memory Dev:eth0 File::0x807a2680 Options:(null)
Loading: . 0 bytes read
Failed.
Could not load :0x807a2680: Error
CFE>


Who knows why THAT doesn't work...

But I then tried the console initiated tftp per the serial recovery dd-wrt wiki:

Quote:

CFE> flash -ctheader : flash1.trx
Reading :: CODE Pattern is CORRECT!
upgrade_ver[v4.20.6] upgrade_ver[42006] 4712_ver[0]
Done. 3544064 bytes read
fname=flash1.trx
CODE Pattern is correct! (E25X)
Programming...done. 3544032 bytes written
*** command status = 0
CFE> nvram erase
*** command status = 0
CFE> reboot


And it worked.

For future reference:

    - This is an e2500 v2.
    - I used a $7 "CP2102 Module STC Download Cable USB 2.0 to TTL 6PIN Serial Converter For STC" from Amazon.
    - 115200 N81
    - I used the pin holes next to the power adapter
    - I connected GRND, TX and RX per the pictures in this thread: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=152122
    - I hit ^C during boot, did nvram erase a few times, and then the flash command at the console prompt while also initiating a tftp to 192.168.1.1
    - I reflashed it with the recommended flash from the e2500 wiki (dd-wrt.v24-21061_NEWD-2_K2.6_mini-e2500.bin)
    - Upon reboot, I had 192.168.1.1 web accessible again
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum