Linksys EA6900 seems to be bricked [SOLVED]

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Author Message
joncl
DD-WRT Novice


Joined: 13 Aug 2022
Posts: 4

PostPosted: Sat Aug 13, 2022 6:34    Post subject: Linksys EA6900 seems to be bricked [SOLVED] Reply with quote
I started with a EA6900 v1.1 with newer stock and locked firmware. I decided to try and load FreshTomato using this guide:

https://www.linksysinfo.org/index.php?threads/xvortex-or-advancedtomato-on-ea6900-v1-v1-1-without-32k-bug-renew.74084/

Using TFTP at boot (getting TTL=100 pings), I could not get linksys_ea6900_ddwrt.bin to complete successfully. (erroring out at 75-90%). After many attempts, I managed to successfully flash linksys-ea6900-webflash.bin, so I went with that.

I don't recall the exact steps, but basically I created a new CFE bin file following the guide, copied it over via SSH, and then attempted to install it with:

mtd unlock /dev/mtd0
cd /tmp/root
mtd write -f new-cfe.bin mtd0

mtd unlock gave an error, so after researching, it was mentioned that dd does the same thing, so I ran:

dd if=new-cfe.bin of=/dev/mtd0

This is where things went south. From then on, I no longer got TTL=100 pings. The bootup went straight to TTL=64, and the web page no longer loaded.

Without the ability to try another TFTP flash, I decided to try through a serial connection, which I was able to establish. I can see the boot sequence over the serial connection (running Putty), and I can stop the boot sequence with CTRL+C to get to a CFE prompt. At this point, I get TTL=100 pings again. However, I still cannot flash linksys_ea6900_ddwrt.bin, but I was able to flash
FW_EA6900_1.1.42.158863_prod.img. Unfortunately, the web UI does not load.

If I let the router boot without stopping at the CFE prompt, I can login to BusyBox with root/admin (but there are a lot of error messages such as "wl: wl driver adapter not found").

I tried to copy over my new-cfe.bin file and a mtd-write file using TeraTerm send command, but mtd-write needs a library file, which probably won't work in BuysBox I guess. Trying with dd again gives an error saying permission denied on /proc/mtd0.

I'm trying to basically write a new CFE, but it seems the BusyBox environment won't work.

Does anyone have any ideas on how to flash a new CFE to this EA6900? Confused


Last edited by joncl on Sat Aug 13, 2022 21:59; edited 1 time in total
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12835
Location: Netherlands

PostPosted: Sat Aug 13, 2022 9:42    Post subject: Reply with quote
I do not have any other help to offer then point to our documentation which you probably already have found:
https://wiki.dd-wrt.com/wiki/index.php/Linksys_EA6900
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=291230#291230


It is a pity I still use one with the new CFE and it works well.

Are you sure the new CFE did not "take" if it did pressing the reset button before powering up and keep it pressed should get into Asus recovery:
https://www.asus.com/us/support/FAQ/1000814/

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
joncl
DD-WRT Novice


Joined: 13 Aug 2022
Posts: 4

PostPosted: Sat Aug 13, 2022 14:03    Post subject: Reply with quote
Thanks you egc! Yes, when holding reset, the serial console gives over and over:

Code:
Reading ::
TFTP Server.
..tftp retry wait 0
Failed.: Timeout occured


LED is flashing slowly and ping now shows TTL=100! So that's different.

Still when I try to TFTP2 linksys_ea6900_ddwrt.bin (23,680 Kb), the blue bar gets ~75% across and serial output shows:

Code:
Reading ::
TFTP Server.
..tftp retry wait 0
break!! reach max retry!!
Failed.: I/O error
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)


Flashing FW_EA6900_1.1.42.158863_prod.img (14,421 Kb) with TFTP2, it flashes successfully:

Code:
Reading ::
TFTP Server.
..tftp retry wait 0
- last blk -
- Last block -
Done. 14766336 bytes read
Download of 0xe15100 bytes completed
Write kernel and filesystem binary to FLASH
Programming...copysize=14766336, amtcopy=14766336
done. 14766336 bytes written


I then hold the WPA until LED flashes quickly. I still get a this kind of stuff in the serial console, and also blank web page:

Code:
wl: wl driver adapter not found
wl: wl driver adapter not found
wifi, user vap eth2 is up
wifi, guest_enabled is set to 0, do not enable 2.4GHz guest
wifi, guest_enabled is set to 0, do not enable 5GHz guest
wl: wl driver adapter not found
wl: wl driver adapter not found
wl: wl driver adapter not found
wl: wl driver adapter not found
eth1: cmd=14: No such device
eth1: WLC_SET_VAR(pref_chanspec): No such device
eth1: WLC_GET_VAR(obss_coex): No such device
eth1: WLC_SET_VAR(chanim_sample_period): No such device
eth1: WLC_SET_VAR(noise_metric): No such device
eth1: WLC_GET_VAR(scb_assoced): No such device
eth1: WLC_GET_VAR(scb_assoced): No such device
eth1: WLC_GET_VAR(scb_assoced): No such device
wl: wl driver adapter not found
wl: wl driver adapter not found
wl: wl driver adapter not found
wl: wl driver adapter not found
eth1: WLC_GET_VAR(scb_assoced): No such device
eth1: WLC_GET_VAR(chanspec): No such device
eth1: WLC_GET_VAR(scb_assoced): No such device


Attached is entire output after successful flash of FW_EA6900_1.1.42.158863_prod.img.

Any hope here?

Thanks!



output.txt
 Description:

Download
 Filename:  output.txt
 Filesize:  28.96 KB
 Downloaded:  57 Time(s)

joncl
DD-WRT Novice


Joined: 13 Aug 2022
Posts: 4

PostPosted: Sat Aug 13, 2022 18:26    Post subject: Reply with quote
Reading in another thread, someone mentioned their MACs are all the same. Well, mine are too! Below is output from "ifconfig" after letting the router boot to BusyBox. What is it supposed to look like? How to fix?

Quote:
~ #ifconfig
br0 Link encap:Ethernet HWaddr 14:91:82:32:EC:58
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::1691:82ff:fe32:ec58/64 Scope:Link
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:296 errors:0 dropped:0 overruns:0 frame:0
TX packets:286 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:40294 (39.3 KiB) TX bytes:36626 (35.7 KiB)

eth0 Link encap:Ethernet HWaddr 14:91:82:32:EC:58
inet6 addr: fe80::1691:82ff:fe32:ec58/64 Scope:Link
UP BROADCAST RUNNING PROMISC ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:310 errors:0 dropped:0 overruns:0 frame:0
TX packets:304 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:48396 (47.2 KiB) TX bytes:39470 (38.5 KiB)
Interrupt:179 Base address:0x4000

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:28 errors:0 dropped:0 overruns:0 frame:0
TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:7427 (7.2 KiB) TX bytes:7427 (7.2 KiB)

vlan1 Link encap:Ethernet HWaddr 14:91:82:32:EC:58
inet6 addr: fe80::1691:82ff:fe32:ec58/64 Scope:Link
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:309 errors:0 dropped:0 overruns:0 frame:0
TX packets:293 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:42766 (41.7 KiB) TX bytes:38428 (37.5 KiB)

vlan2 Link encap:Ethernet HWaddr 14:91:82:32:EC:58
inet6 addr: fe80::1691:82ff:fe32:ec58/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:424 (424.0 B)
joncl
DD-WRT Novice


Joined: 13 Aug 2022
Posts: 4

PostPosted: Sat Aug 13, 2022 21:58    Post subject: Reply with quote
Ok, got it unbricked. Cool This one was a real head-banger. What fixed it for me was the ASUS Firmware Restoration tool. Documenting here in case it helps someone.

Wanted to load Fresh Tomato, started here: https://wiki.freshtomato.org/doku.php/hardware_compatibility

There, for the EA6900, you have the link for the CFE 32KB bug: https://www.linksysinfo.org/index.php?threads/guide-flash-linksys-ea6300v1-ea6400-ea6500v2-ea6700-ea6900v1-0-1-1-with-tomato.73877/

Followed that guide, made a new CFE with updated MAC addresses, and no other changes. I was not able to flash linksys_ea6900_ddwrt.bin for some reason (TFTP2 kept erroring out at 75%). If I recall, the router was still on FW_EA6900_1.1.42.158863_prod.img, so enabled SSH from the webui, copied over new-cfe.bin, but mtd unlock did not work. So skipping any backup step (not smart), I ran:

Code:
dd if=new-cfe.bin of=/dev/mtd0


After that, nothing would flash successfully, except for the smallest firmwares (FW_EA6900_1.1.42.158863_prod.img and FW_EA6900_1.1.42.161129_prod.img).

THE FIX for me was following this post: https://www.linksysinfo.org/index.php?threads/asuswrt-merlin-build-384-5-or-later-on-linksys-ea6900-or-ea6700.74209/post-329854

I grabbed ASUS FW_RT_AC68U_300438643129, and the Firmware Restoration 2102.

Hold RESET, power on until you get the LED steady flash. It helps to have a serial console running so you can see the TFTP server running on the router. You also get TTL=100 pings.

Run the Firmware Restoration. At first, it could not find the router, I figured maybe because the model info in the Vortex CFE was for the EA6900?

So went back to the CFE prompt in the serial console (smash CTRL+C at power on). Then set ASUS AC68U values from step 5 in the guide above:

Code:
nvram set odmpid=RT-AC66U_B1
nvram set model=RT-AC68U
nvram set ATEMODE=0
nvram commit


Note that in that guide, he is running CFE version 1.3.0.7, but mine is 1.0.37 which I guess does not matter.

Then do the reset-power-on thing again, until TTL=100 shows up (TFTP server is running in the serial console). Now the Firmware Restoration tool was able to find the router and flash FW_RT_AC68U_300438643129 successfully!!

Unfortunately, https://192.168.1.1 still did not load, but the missing device errors I had before in the serial output were gone, and there was also a new mtd5 "asus" partition that was not there before.

Next, to revert those nvram commands above, I cleared nvram with the WPS button (power-on with WPS button held until the LED flashed rapidly, and you get a message in the serial console saying waiting for WPS button release).

I repeated reset-power-on to get the TFTP server running again with the TTL=100 pings, loaded the mini flash page at http://192.168.1.1, and was able to successfully flash Xvortex EA6900_380.57_0.trx, and after a reboot, the ASUS UI showed up at https://192.168.1.1 !!

Finally, I used the ASUS UI to flash freshtomato-EA6900-ARM_NG-2022.5-AIO-64K.trx, and I now have the latest Fresh Tomato running on my previously bricked EA6900.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum