rajibprince
DD-WRT Novice
Joined: 31 Jul 2021
Posts: 1
|
 Posted: Sat Jul 31, 2021 18:07 Post subject: Help unbricking the Belkin F5D8235-4 v2 |
 |
REF:
1) https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=53235&postdays=0&postorder=asc&start=375
2) https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=53235&postdays=0&postorder=asc&start=90
| lobotron wrote: | OK, I finally succeeded in debricking my F5D8235-4 which was a lengthy task.
After flashing directly from stock to 22118 the device showed 1 lamp and did nothing. So I had to solder to the serial console. First I tried to connect a self build ca42 cable which gave me a garbage console. Weeks later I found the time to solder this Serial to DB9F RS232 Cable and It gave me a working console and the device shows all it's blue led's (I really like blue LED's).
I found:
## Booting image at bf050000 ...
Bad Magic Number,42E147A2
-> No easy way out!
I wasted a lot time trying tftp flash, perhaps I did it wrong but I never got a ping back.
So I put the file test.bin with kermit to the router which is the webrevert file, cut the first 19 bytes off starting with 27 05 19 56 saved to test.bin (cooked out of Page 7 here)
I used minicom performing these instructions and hassled with hex as I had to find out what to erase and where to write(DO NOT COPY TO A DIFFERENT SET). Here is what I did shortened as I forgot to log the session so I copied the basics:
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
You choosed 4
RT3052 #erase 0xBF050000 0xBF66FFFF
....
erase sector = 109
sect = 109,s_last = 109,erase poll = 930873
done
Erased 98 sectors
RT3052 #loadb
## Ready for binary (kermit) download to 0x80100000 at 57600 bps...
<INTERRUPT>
RT3052 # cp.b 0x80100000 0xBF050000 0x5BF000
Copy to Flash...
Copy 6025216 byte to Flash...
addr = 0xBF0A409C ,cnt=5680996
RT3052 # bootd
Interrupt Kermit ( CTRL+C ) after successful file transfer which took approximately 25 minutes. If it doesn't report a status it doesn't do!
The unit booted into the Belkin Webif, then flashed successful BS 22118 this time. 
minirc.dfl
| Code: | # Machine-generated file - use "minicom -s" to change parameters.
pu port /dev/ttyS0
pu baudrate 57600
pu bits 8
pu parity N
pu stopbits 1
pu updir /root
pu downdir /root
pu rtscts No
|
.kermrc
| Code: |
set carrier-watch off
set handshake none
set flow-control none
robust
set file type bin
set rec pack 1000
set send pack 1000
set window 5
|
Note: If the kernel panics it gives you flashing LED's |
I did the same thing with tere term but it gives me kernel panic
U-Boot 1.1.3 (Nov 7 2008 - 00:24:27)
Board: Ralink APSoC DRAM: 32 MB
relocate_code Pointer at: 81fa0000
=====config_usbotg =====
flash_protect ON: from 0xBF000000 to 0xBF02F0F7
protect on 0
protect on 1
protect on 2
protect on 3
protect on 4
protect on 5
protect on 6
protect on 7
protect on 8
protect on 9
flash_protect ON: from 0xBF030000 to 0xBF03FFFF
protect on 10
============================================
Ralink UBoot Version: 3.2
--------------------------------------------
ASIC 3052_MP2 (Port5<->GigaSW)
DRAM COMPONENT: 128Mbits
DRAM BUS: 32BIT
Total memory: 32 MBytes
Date:Nov 7 2008 Time:00:24:27
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384
##### The CPU freq = 384 MHZ ####
SDRAM bus set to 32 bit
SDRAM size =32 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
You choosed 3
0
3: System Boot system code via Flash.
## Booting image at bf050000 ...
Image Name: Linux Kernel Image
Created: 2009-11-23 9:20:42 UTC
System Control Status = 0x30440000
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1178700 Bytes = 1.1 MB
Load Address: 80000000
Entry Point: 80364000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80364000) ...
## Giving linux memsize in MB, 32
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.21 (root@localhost.localdomain) (gcc version 3.4.2) #10 Thu Nov 12 19:16:47 CST 2009
The CPU feqenuce set to 384 MHz
CPU revision is: 0001964c
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Built 1 zonelists. Total pages: 8128
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock2
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 90800020, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calculating r4koff... 00177000(1536000)
CPU frequency 384.00 MHz
Using 192.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 28756k/32768k available (2833k kernel code, 4012k reserved, 634k data, 132k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.
io scheduler noop registered (default)
FLASH_API: MAN_ID=C2 DEV_ID=22CB SIZE=8MB
Ralink RT2880 gpio driver initialized
Gemtek LED init...
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
smi_major=249
0 smi_init check[0x05c]1=0x5937
rdm_major = 254
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v1.60 128 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, weight = 0, Tx Ring = 128, Rx Ring = 128
GDMA1_MAC_ADRH -- : 0x0000000c
GDMA1_MAC_ADRL -- : 0x43305277
PROC INIT OK!
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
ralink flash device: 0x1000000 at 0xbf000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 5 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00050000 : "uboot"
0x00050000-0x007e0000 : "Kernel and Rootfs"
0x00190000-0x007e0000 : "Rootfs"
0x007e0000-0x007f0000 : "Nvram"
0x007f0000-0x00800000 : "Factory"
block2mtd: version $Revision: 1.1.1.1 $
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Fully Cone
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
tunl0: Disabled Privacy Extensions
Mobile IPv6
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
NET: Registered protocol family 17
create_proc_read_write_entry: fail
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
SQUASHFS error: sb_bread failed reading block 0x11f4
SQUASHFS error: Unable to read cache block [47d1d5:80a]
SQUASHFS error: Unable to read inode [47d1d5:80a]
VFS: Cannot open root device "mtdblock2" or unknown-block(31,2)
Please append a correct "root=" boot option
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2
can u help me? |
|
