Bootloop Investigation for Netgear R8300 and R8500 routers

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2, 3, 4
Author Message
deslatha
DD-WRT User


Joined: 12 Jul 2016
Posts: 186

PostPosted: Sat Sep 08, 2018 11:47    Post subject: Reply with quote
Here pin out of other pci-e switch but not far from pex8603. PE_RST like and wl pci card, it may reset eeprom of pex8603.


pin_out.png
 Description:
 Filesize:  181.97 KB
 Viewed:  6383 Time(s)

pin_out.png



ASM1061_Data Sheet_R1_8.pdf
 Description:

Download
 Filename:  ASM1061_Data Sheet_R1_8.pdf
 Filesize:  336.49 KB
 Downloaded:  403 Time(s)

Sponsor
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7209
Location: Columbus, Ohio

PostPosted: Sat Sep 08, 2018 11:56    Post subject: Reply with quote
This is all above my head. Especially when I have a hard time understanding your English.
No offense meant.

_________________
I am far from a guru, I'm barely a novice.
deslatha
DD-WRT User


Joined: 12 Jul 2016
Posts: 186

PostPosted: Sat Sep 08, 2018 13:02    Post subject: Reply with quote
Malachi wrote:
This is all above my head. Especially when I have a hard time understanding your English.
No offense meant.

By the way, in my mind, my English is my second language. How ever, i am not learnning so well because it is not really a logical systematic language but so ww. ( that may be reason why science belong to logical obsevered so need and great ). aka if your body bigger and activer than other than the challenge you like to live in norther land due to cool weather.

Then here the bootlog with running from r6300v2.

CFE for Foxconn Router R7800/R8500 version: v1.0.5

Build Date: Tue Jun 30 20:39:15 CST 2015

Init Arena

Init Devs.

Boot up from NAND flash...

Bootcode Boot partition size = 524288(0x80000)

DDR Clock: 400 MHz

Info: DDR frequency set from clkfreq=1200,*800*

Warning: invalid DDR setting of 800 MHz ignored. DDR frequency will be set to 400 MHz.

Warning: invalid CPU setting of 1200 MHz ignored. armclock frequency will be set to 800 MHz.

et2: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.121 (r552363)

CPU type 0x0: 800MHz

Tot mem: 262144 KBytes



Committing NVRAM...done

Waiting for reset button release...donDigital core power voltage set to 0.9375V

Decompressing...done





CFE for Foxconn Router R7800/R8500 version: v1.0.5

Build Date: Tue Jun 30 20:39:15 CST 2015

Init Arena

Init Devs.

Boot up from NAND flash...

Bootcode Boot partition size = 524288(0x80000)

DDR Clock: 400 MHz

Info: DDR frequency set from clkfreq=1200,*800*

Warning: invalid DDR setting of 800 MHz ignored. DDR frequency will be set to 400 MHz.

Warning: invalid CPU setting of 1200 MHz ignored. armclock frequency will be set to 100 MHz.

et2: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.121 (r552363)

CPU type 0x0: 100MHz

Tot mem: 262144 KBytes



Device eth0: hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0

gateway not set, nameserver not set

Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinuz Options:(null)

Loading: Failed.

Could not load 192.168.1.2:vmlinuz: Timeout occured

Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)

Loading: ..... 5470272 bytes read

Entry at 0x00008000

Closing network.

Starting program at 0x00008000

[ 2.310000] console [ttyS0] enabled, bootconsole disabled

[ 2.320000] serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550

[ 2.380000] brd: module loaded

[ 2.400000] loop: module loaded

[ 2.410000] pflash: found no supported devices

[ 2.410000] bcmsflash: found no supported devices

[ 3.210000] Boot partition size = 524288(0x80000)

[ 3.220000] lookup_nflash_rootfs_offset: offset = 0x200000

[ 3.220000] nflash: squash filesystem with lzma found at block 32

[ 3.230000] Creating 17 MTD partitions on "nflash":

[ 3.240000] 0x000000000000-0x000000080000 : "boot"

[ 3.250000] 0x000000080000-0x000000200000 : "nvram"

[ 3.270000] 0x000000200000-0x000006f00000 : "linux"

[ 3.950000] 0x00000041ab5c-0x000006f00000 : "rootfs"

[ 3.970000] 0x000007400000-0x000007480000 : "board_data"

[ 3.980000] 0x000007480000-0x000007580000 : "POT1"

[ 4.000000] 0x000007580000-0x000007680000 : "POT2"

[ 4.020000] 0x000007680000-0x000007940000 : "T_Meter1"

[ 4.050000] 0x000007940000-0x000007c00000 : "T_Meter2"

[ 4.080000] 0x000007c00000-0x000007c80000 : "ML1"

[ 4.090000] 0x000007c80000-0x000007d00000 : "ML2"

[ 4.110000] 0x000007d00000-0x000007d80000 : "ML3"

[ 4.120000] 0x000007d80000-0x000007e00000 : "ML4"

[ 4.140000] 0x000007e00000-0x000007e80000 : "ML5"

[ 4.150000] 0x000007e80000-0x000007f00000 : "ML6"

[ 4.170000] 0x000007f00000-0x000007f80000 : "ML7"

[ 4.180000] 0x000007f80000-0x000008000000 : "DebugMsg"

[ 4.200000] PPP generic driver version 2.4.2

[ 4.210000] PPP MPPE Compression module registered

[ 4.210000] NET: Registered protocol family 24

[ 4.220000] PPPoL2TP kernel driver, V0.17

[ 4.220000] tun: Universal TUN/TAP device driver, 1.6

[ 4.230000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>

[ 4.240000] csw_retry 100

[ 4.240000] Initializing USB Mass Storage driver...

[ 4.240000] usbcore: registered new interface driver usb-storage

[ 4.250000] USB Mass Storage support registered.

[ 4.260000] usbcore: registered new interface driver usbserial

[ 4.260000] USB Serial support registered for generic

[ 4.270000] usbcore: registered new interface driver usbserial_generic

[ 4.280000] usbserial: USB Serial Driver core

[ 4.280000] USB Serial support registered for GSM modem (1-port)

[ 4.290000] usbcore: registered new interface driver option

[ 4.290000] option: v0.7.2:USB Driver for GSM modems

[ 4.300000] USB Serial support registered for Sierra USB modem

[ 4.310000] usbcore: registered new interface driver sierra

[ 4.310000] sierra: v.1.7.16:USB Driver for Sierra Wireless USB modems

[ 4.320000] u32 classifier

[ 4.320000] Actions configured

[ 4.330000] nf_conntrack version 0.5.0 (3969 buckets, 15876 max)

[ 4.340000] IPv4 over IPv4 tunneling driver

[ 4.340000] GRE over IPv4 tunneling driver

[ 4.350000] ip_tables: (C) 2000-2006 Netfilter Core Team

[ 4.360000] TCP cubic registered

[ 4.370000] NET: Registered protocol family 10

[ 4.380000] lo: Disabled Privacy Extensions

[ 4.380000] tunl0: Disabled Privacy Extensions

[ 4.390000] IPv6 over IPv4 tunneling driver

[ 4.390000] sit0: Disabled Privacy Extensions

[ 4.400000] ip6tnl0: Disabled Privacy Extensions

[ 4.410000] NET: Registered protocol family 17

[ 4.410000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>

[ 4.420000] All bugs added by David S. Miller <davem@redhat.com>

[ 4.480000] Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012

[ 4.490000] NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8 -bit)

[ 4.490000] Spare area=64 eccbytes 56, ecc bytes located at:

[ 4.500000] 2 3 4 5 6 7 8 9 10 11 12 13 14 15 18 19 20 21 22 23 24 25 26 27 28 29 30 31 34 35 36 37 38 39 40 41 42 43 44 45 46 47 50 51 52 53 54 55 56 57 58 59 60 61 62 63

[ 4.520000] Available 7 bytes at (off,len):

[ 4.520000] (1,1) (16,2) (32,2) (48,2) (0,0) (0,0) (0,0) (0,0)

[ 4.530000] Scanning device for bad blocks

[ 5.350000] Options: NO_AUTOINCR,NO_READRDY,BBT_SCAN2NDPAGE,

[ 5.360000] Creating 2 MTD partitions on "brcmnand":

[ 5.360000] 0x000003400000-0x000006f00000 : "brcmnand"

[ 5.370000] 0x000006f00000-0x000007400000 : "OpenVPN"

[ 5.400000] SQUASHFS error: Xattrs in filesystem, these will be ignored

[ 5.420000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.

[ 5.450000] devtmpfs: mounted

[ 5.460000] Freeing init memory: 292K

[sighandler]: No more events to be processed, quitting.

[cleanup]: Waiting for children.

[cleanup]: All children terminated.

Restoring defaults...Reading board data...

PIN number not found!

WSC UUID: 0xd1c9a172b5f7b72f35bb4cf0531b0ec8

wps_uuid=0xd1c9a172b5f7b72f35bb4cf0531b0ec8

read_board_data(682) region_num=65535 0 ()

NTP synchronized date/time: 00-00-00

MAC address of 1st STA connected: 00-00-00-00-00-00

Internet Time date/time: 00-00-00

abGpioPhy none exist GPIO -1 !!!

invalid RF magic!

### main:1691 Set Normal Power!

Doing nvram commit by pid 1 !

done

Reading board data...

PIN number not found!

WSC UUID: 0xd1c9a172b5f7b72f35bb4cf0531b0ec8

wps_uuid=0xd1c9a172b5f7b72f35bb4cf0531b0ec8

read_board_data(682) region_num=65535 0 ()

NTP synchronized date/time: 00-00-00

MAC address of 1st STA connected: 00-00-00-00-00-00

Internet Time date/time: 00-00-00

abGpioPhy none exist GPIO -1 !!!

invalid RF magic!

### main:1691 Set Normal Power!

[ 46.030000] Initialise conn table 2048 entries

Commit new ethernet config...

Doing nvram commit by pid 1 !

[ 47.370000] bcm_robo_config_vlan 2475 is_erobo=0 vid=1 untag|member=0x17DBE ports=1 2 3 4 5 7 8*<

[ 47.390000] bcm_robo_config_vlan 2475 is_erobo=0 vid=2 untag|member=0x20301 ports=0 8 u<

[ 47.690000] bcm_robo_config_vlan 2475 is_erobo=0 vid=1 untag|member=0x17DBE ports=1 2 3 4 5 7 8*<

[ 47.700000] bcm_robo_config_vlan 2475 is_erobo=0 vid=2 untag|member=0x20301 ports=0 8 u<

insmod: dpsta.ko: no module by that name found

insmod: cannot insert '/lib/modules/2.6.36.4brcmarm+/kernel/drivers/net/dhd/dhd.ko': Ope ration not permitted (-1): Operation not permitted

insmod: usbcore.ko: no module by that name found

insmod: cannot insert '/lib/modules/2.6.36.4brcmarm+/kernel/drivers/usb/host/ehci-hcd.ko ': Unknown symbol in module (-1): No such file or directory

insmod: wl_high.ko: no module by that name found

eth1: cmd=14: No such device

wl-1 not up in 3 sec

Creating device nodes...

Insert IDP engine...

Running rule agent to setup signature file /tmp/trend/rule.trf...

[main(247)]: kaStartup() passed

[main(258)]: GetPolicy() passed (ret=600209)

[main(265)]: Loading policy succeeded

[main(270)]: Signature version: major = 1, minor = 170

[main(288)]: Enable IPS!

[main(293)]: IPS enable = 1

[main(299)]: IPS-0.0.11

[main(320)]: kaShutDown()

Insert UDB ...

Insert forward module /tmp/trend/tdts_udbfw.ko with param - dev_wan=eth0...

Unload fw_mod...

Unload udb_mod...

Unload idp_mod...

Remove device nodes...

[ 99.270000] Sorry, registering the character device failed with 0

Hit enter to continue...[ 101.310000] bcm_robo_config_vlan 2475 is_erobo=0 vid=1 untag| member=0x17DBE ports=1 2 3 4 5 7 8*<

[ 101.320000] bcm_robo_config_vlan 2475 is_erobo=0 vid=2 untag|member=0x20301 ports=0 8 u<

[ 101.580000] bcm_robo_config_vlan 2475 is_erobo=0 vid=1 untag|member=0x17DBE ports=1 2 3 4 5 7 8*<

[ 101.590000] bcm_robo_config_vlan 2475 is_erobo=0 vid=2 untag|member=0x20301 ports=0 8 u<

WARNING: console log level set to 1

killall: upnp: no process killed

upnp: No such file or directory

Doing nvram commit by pid 19626 !

Setup RRB socket, interface name=br0

ACSD >>main(681): No interface specified, exiting...wl: wl driver adapter not found

wl: wl driver adapter not found

wl: wl driver adapter not found

wl: wl driver adapter not found

wl: wl driver adapter not found

ACSD start_wl 1427 force edcrs == 1

wl: wl driver adapter not found

wl: wl driver adapter not found

wl: wl driver adapter not found

wl: wl driver adapter not found

wl: wl driver adapter not found

wl: wl driver adapter not found

wl: wl driver adapter not found



--------------------isDhdReady()------------------------

eth1: No such device

isDhdReady 5042 could not found eth1 ret=0x13

eth2: No such device

isDhdReady 5042 could not found eth2 ret=0x13

eth3: No such device

isDhdReady 5042 could not found eth3 ret=0x13



-------------------isDhdReady flag=3-----------------------------

DHD didn't bring up all the interfaces!

reboot: rmmod dhd failed: No such file or directory

Terminated

Sending SIGTERM to all processes

Sending SIGKILL to all processes

[ 117.120000] Restarting system.

CFE for Foxconn Router R7800/R8500 version: v1.0.5

Build Date: Tue Jun 30 20:39:15 CST 2015

Init Arena

Init Devs.

Boot up from NAND flash...

Bootcode Boot partition size = 524288(0x80000)

DDR Clock: 400 MHz

Info: DDR frequency set from clkfreq=1200,*800*

Warning: invalid DDR setting of 800 MHz ignored. DDR frequency will be set to 400 MHz.

Warning: invalid CPU setting of 1200 MHz ignored. armclock frequency will be set to 100 MHz.

et2: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.121 (r552363)

CPU type 0x0: 100MHz

Tot mem: 262144 KBytes



Device eth0: hwaddr 00-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0

gateway not set, nameserver not set

Startup canceled

-------------------------------------------------------------------------
after all, netgear has no more hidden syntax help on cfe and cpu able to run @ 100 mhz (minimum speed).

abGpioPhy none exist GPIO -1 !!!

invalid RF magic!

what is GPIO -1 !!! // is this turn on and debug PEX 8603 chipset???

if anyone are interesting then i can post whole nand image.
Ja
DD-WRT Novice


Joined: 13 Aug 2018
Posts: 11

PostPosted: Sun Sep 09, 2018 10:20    Post subject: Reply with quote
deslatha

Thanks for the info. Unfortunately, the disconnection of individual bands did not bring results

In the sense the router did not cover them anymore but it was restarting



I'll see what happens when I turn off the radio on a working router.


Which router do you have copies of nanad from?


Further, I think that this is a failure of the wifi / PEX system ultimately the CPU

No communication with wifi radios


I just do not know how to check with which of the three can't get a connect


There is access to errors on mtdblock 16


PCI_PROBE: bus 3, slot 0,vendor 14E4, device 4365(good PCI location).<4>[ 13.500000] dhdpcie_init: can't find adapter info for this chip



Kernel crash log.txt
 Description:

Download
 Filename:  Kernel crash log.txt
 Filesize:  165.76 KB
 Downloaded:  444 Time(s)

routerhacker
DD-WRT Novice


Joined: 20 Jul 2018
Posts: 34

PostPosted: Mon Sep 10, 2018 2:18    Post subject: Reply with quote
I had an extra hour or so and thought I would try to add the missing capacitor that so many of these boards are missing. The reference photos of this board on the FCC site shows the capacitor in place, but it is missing from the board I have and many others I gather. Bad or missing caps can lead to some pretty strange stuff... boot looping is a common one. Anyhow, I solder on the needee 330uf/25v cap next to the power plug and button and fired up the board. immediately, I noticed the LEDS were slightly "stronger" and more as I would have thought. Before, they were a little dim and kinda oscillated ever so faintly if you looked really close. Signs of something power related. Anyhow, the big moment... and same problem: rebooting after hitting and trying to initialize the wifi chips.

That got me thinking that perhaps all of this started for everyone with these issue withe power related issues (perhaps to missing caps) and that did something to the wifi chips and/or PEX pci bridge along the lines were Deslatha was heading.

So in looking at the Product Brief for the PEX8603 chip, I see the following:

Quote:
Power Management and Reference Clock Buffers
The PEX8603 supports the following power management states: L0, L0s, L1, L2/L3 Ready, L2 and L3. Moreover, the PEX8603 supports Vaux along with the external signal WAKE# and the in-band Beacon for the PCIe endpoints to use to inform the system host to exit the low power savings mode.
The PEX 8603 supports two pairs of buffered, 100 MHz HCSL output clocks, one pair for each downstream port of the switch. Each clock output pair can be disabled by software or serial EEPROM when not in use, for additional power savings. This feature greatly reduces system BOM cost by eliminating the need for extra clock buffers on the PCB.


I don't know anything about that PEX8603 chip but is it possible one of the "clock output pairs" got disabled in serial EEPROM? That is wild speculation of course but could that be determined and/or changed?

I will look for real PEX8603 datasheet, but that may be hard to come by as Broadcom is a real PITA about that.
deslatha
DD-WRT User


Joined: 12 Jul 2016
Posts: 186

PostPosted: Mon Sep 10, 2018 4:41    Post subject: Reply with quote
13.500000] PCI_PROBE: bus 3, slot 0,vendor 14E4, device 4365(good PCI location)
//Detect and assign 5 High ghz on bus 3 as 4365.

[ 14.750000] PCI_PROBE: bus 4, slot 0,vendor 14E4, device 4365(good PCI location).<4>
[ 14.750000] dhdpcie_init: can't find adapter info for this chip.
//Detect and assign 5 Low ghz on bus 4 as 4365 but no info???

Enabling device 0002:03:00.0 (0140 -> 0142).<4>
// setting device wl

[ 13.450000] DHD: dongle ram size is set to 1343488(orig 1343488) at 0x200000.
// reserver for digital HD

[ 13.460000] dhd_attach(): thread:dhd_watchdog_thread:2975 started.<4>
// watchdog start for monitor if not then disable or shut down

[ 13.460000] dhd_deferred_work_init: work queue initialized .<4>
//Start to fetch firmware of PEX 8603
[ 13.460000] dhd_bus_download_firmware: firmware path=, nvram path=.<4>
// down load FW from nvram path to bus

[ 13.460000] dhdpcie_ramsize_adj: Enter.<4>
[ 13.460000] select_fd_image: Dongle image not available for chipid = 0x4366 chiprev = 4 chippkg = 4.<4>
// then no image ??? there are and should be in first original OEM fw.

[ 13.460000] select_fd_image: Dongle image not available for chipid = 0x4366 chiprev = 4 chippkg = 4.<4>
//Dongle image=image+token for each router . these key "get married" with router mac id.
As you see, router finds no dongle key then it down load a FW support to be to genarate new key but not available.

traceback to github if dts of firmware. since load third party fw is out of warranty.
If router has same trouble if it is running OEM then complain to consumer protection office. As on digital key or mouser these chipset is obsolete.
routerhacker
DD-WRT Novice


Joined: 20 Jul 2018
Posts: 34

PostPosted: Mon Sep 10, 2018 5:19    Post subject: Reply with quote
The dhd.ko module contains the firmware image for the 4366 chip. They changed version revs of the chip along the way and the 4366c0 rev4 chip firmware in the dhd.ko module did not appear until delivered firmware version 1.0.2... As I recall. You can run strings on the dhd.ko module and see the included firmware like below:

strings dhd.ko | grep -i 4366

You'll see the names/versions of supported chip firmware embedded in the dhd.ko module.
spectral
DD-WRT Novice


Joined: 23 Dec 2018
Posts: 1

PostPosted: Sun Dec 23, 2018 0:23    Post subject: Re: Bootloop Investigation for Netgear R8300 and R8500 route Reply with quote
Hi friends.
Anyone can share R8300(R8500) NAND dump binary with me? Have empty nand and unable to find bootloader code anywhere. Idea Please.
ComProf
DD-WRT Novice


Joined: 09 Dec 2010
Posts: 3

PostPosted: Fri Feb 01, 2019 6:17    Post subject: Reply with quote
thanks guys,you are awesome
i repaired my r8500 (boot loop)
but temps are scaring me
may be someone can say what pads be on stock?



Screenshot_76.png
 Description:
 Filesize:  5.36 KB
 Viewed:  5700 Time(s)

Screenshot_76.png


Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7209
Location: Columbus, Ohio

PostPosted: Fri Feb 01, 2019 10:18    Post subject: Reply with quote
Those temps are fine.
_________________
I am far from a guru, I'm barely a novice.
PITABoy
DD-WRT User


Joined: 07 Jun 2006
Posts: 186

PostPosted: Fri Feb 01, 2019 13:07    Post subject: Reply with quote
I just fixed my router too!!! Thanks to everyone on these forums... I am posting what I did to do it.

How I fixed the r8500
Note: I had a full brick bought on ebay.

Boot to CFE and stop with Ctrl-C
Code:
nvram erase
reboot

Power cycle with power cord

Boot to CFE and stop with Ctrl-C
Code:
tftpd

TFTP latest dd-wrt image to router I used 01-31-2019
Wait for full reboot. (router should still be crashing)

Boot to CFE and stop with Ctrl-C
Code:
nvram erase
reboot

Power cycle with power cord

Boot to CFE and stop with Ctrl-C
Code:
nvram show
go

Congrats dd-wrt should now boot!!!

I played with this for hours and for some reason the "go" command seems to do the magic.

Also I found that the reboot command was necessary to get nvram to erase.

YMMV but I hope that this helps others.
ComProf
DD-WRT Novice


Joined: 09 Dec 2010
Posts: 3

PostPosted: Sat Feb 02, 2019 11:44    Post subject: Reply with quote
Malachi wrote:
Those temps are fine.

max temp what not normal, are?
if i add cooler cpu is max 45...

PITABoy wrote:
I just fixed my router too!!!

Good. But boot loop is about a hardvare problem. it says what some interface are broken. it must be reflow soldering or re soldering or replace. mine must be re soldered.

so left bcm4366 is 2.4Ghz right 5Ghz its from pex
middle 5Ghz from cpu.

So as I can see it`s realy HOT. Cpu 74-75, wifi 50-52 celsius. Whey die if been work on what temps.

upd 10.02.2019 Yeap. Worked a week when died again.
I removed broken chip. Yeap its broken inside, so i need new. anyway ddwrt didnt want to work normaly after what because of some missed info in nvram. He always clear nvram after reboot. So i`ll go to koolshare its work normal.
vital2k
DD-WRT Novice


Joined: 27 Apr 2019
Posts: 1

PostPosted: Mon Apr 29, 2019 16:27    Post subject: Debricked R8300 with Koolshare_Merlin_Legacy_380/Netgear/R85 Reply with quote
Thank you for your posts.

I managed to debrick R8300 router with Koolshare_Merlin_Legacy_380/Netgear/R8500 firmware.

Original Netgear always ends up with an error - not loading all interfaces, going into reboot. Koolshare loaded router but only with two WiFi frequencies 2.4 and 5 MH. One frequency is missing, only one 5 MH working, but it is fine. The router up and running again.
phoenix127
DD-WRT User


Joined: 02 Jan 2011
Posts: 80
Location: UK

PostPosted: Tue Jan 04, 2022 0:33    Post subject: A bit more info from another failing unit Reply with quote
Hi all,

I know this is an old thread, but providing a bit more info ready for the next guy.

I've had an R8500 for about 5 years now that's been working fairly well since the initial efforts to get these units understood better. I even stumbled across a number of the old threads discussing hardware variants and WIFI issues back then ..
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=286232&postdays=0&postorder=asc&start=150. Its good to see some of the old handles are still active, although sadly not Kong.

Well, it seems that my unit is also afflicted with the same problem now. I got complaints that WIFI was not good around the house, so I boosted that with a HH5A running OpenWRT at the other end of the house and and things have been OK except for bad power bricks on those units, but that's another story. I had noticed that some radios were disappearing and changing order in the UI in the R8500, with config parameters moving between them. I noticed this as I have different SSID's for each radio. For example, the 5G radio was broadcasting the 2.4G SSID. My thinking was that at boot the detection wasn't always getting them in the same order, so possibly firmware or something. Once I couldn't get WIFI in my office where the unit lives and had to deploy another HH5A for coverage there, I knew I had to deal with the problem.

Starting with the easiest things first, I ordered a replacement AC adapter and have tested both old and new on an active load and both are delivering good clean power up to their rated specification, so the problem is not the DC power into the units. When I can get a suitably sized DC connector, I will try a good lab grade power supply on a short cable into the router and see what it shows.

I was also far behind on builds, since my config is fairly complex. I took the plunge and updated a lot (9 months worth of updates) with a few stumbles through intermediate builds to stop the unit failing with presumably changes in NVRAM in between and the obvious change to swconfig for ethernet config. My hope was that a firmware change may have improved things. Either way, I'm now running the latest build with a migrated, not clean config. The serial console was connected during this to help out and I noticed the errors that indicated that certain hardware could not be seen - presumably the radios as there are lots of wl[x] related messages and invalid zero responses from things, etc. Its a shame that lspci is not in the standard build.

I was thinking start simple and check DC power rails. I decided to have a look and check for aged hardware - failing capacitors for example and I removed the 330uf cap next to the DC input, this looked OK (not bulged) and tested OK on an ESR meter, it was also a bit of a pain to get out as its obviously connected into ground and power planes on the PCB, so getting enough heat into it to get it out took a minute with a bigger (hotter) tip on the iron.

The cap tested OK and due to the lack of new similar shaped caps, the old one went back in. I could have put a larger one laying down across another chip but that could cause heat dissipation issues for that chip so I didn't do it. I'll order some spares anyhow next time I'm ordering components. I stumbled across a similarly thinking thread this evening, so good to see I'm not the first to think about this https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=309602&sid=7ebf9d0eee95444091b3e8592f13d71a. I can't see any other bulk capacitors on the board, at least not without a lot of stripping down, so I looked at the FCC ID pictures of the unit at https://fccid.io/PY315200309/Internal-Photos/Internal-Photos-pdf-2709621.pdf, I can't see anything else obvious in terms of bulk capacitance and haven't had the time to look for other regulators on the board.

I have also noticed that the wall that the unit is mounted on, which I decorated only 2 years ago, is showing a discolouration patch the size of the unit, hence showing that the unit is pushing out a fair amount of heat into the wall. I have also noticed that the radios seem to be temperature sensitive, for example, after reassembly, I saw three radios for a short time, before one disappeared again. Only the 2.4GHz one seems to be reliably appearing and even that now stops broadcasting its SSID sometimes.

I support the thinking of the PCI multiplexer being the likely cause as its in the right place, but I remain open on why its not happy - hardware failure, temperature, power stability, etc.

I've got a second hand R8000 coming my way at the moment so that I can swap out the R8500 and take a more leisurely look at it without the family complaining about Internet problems.

What is interesting is that if you erase the nvram and reboot, you do get the 3 radios showing up for a bit in the UI, but none of the 5GHz SSID's are broadcasting - as validated with InSSIDer, so again this would support some form of power related issue as the chip is being detected sometimes, but not working. This implies that the multiplexer is there and something else is wrong.

My plan is that once the R8000 appears and gets the config rebuilt onto it, I'll swap units and see what I can find with no time pressure and as insurance against the R8500 failing completely into boot loop mode, which seems to be the next step. I'm thinking this could indicate a power issue, or the PCI chip dying and crippling the bus for the CPU or perhaps a thermal issue such as the conductive paste drying out under the heat sink, so I'll check that and get the freezer spray out too and see what happens.

The only thing that doesn't sit right with me is that there are too many related problems for it to be one chip causing all the problems.

On related thinking, I've realised that the port mapping on the R8500 is not logical across the back panel, GUI and swconfig, so I think I've figured out how its all wired together, I'll post that in a separate thread in case anyone is interested and still has a working R8500 Smile. What may be relevant to this discussion though is that there are three ethernet adapters - eth1, eth2 and eth3 which correspond to the wl0, wl1, wl2 adapters, when a device disappears, then the related eth[x] adapter also disappears from the OS

The other thing I realised is that if the unit is dying, then there is not a logical next router to move to, nothing seems to have a similar / better spec than the R8500 and the Asus porcupine AC5300 looks to be an R8500 in a new box and from a different vendor, just with a far inflated price tag and all the existing 12 aerials separated out to make it look fancy. Does anyone have any info on if these are better / suffer the same problems. Can we learn anything from the internals of that unit ?
Goto page Previous  1, 2, 3, 4 Display posts from previous:    Page 4 of 4
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum