Help unbricking aLinksys E3000

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2, 3, 4
Author Message
phoenix127
DD-WRT User


Joined: 02 Jan 2011
Posts: 79
Location: UK

PostPosted: Fri May 27, 2011 14:11    Post subject: Progress.. Reply with quote
Hi Barryware. Thanks for the quick response.

Some progress. I've successfully changed NVRAM with the /byte_mode and /fc:43 for my FLASH device and although the console hasn't come back up yet, I now get a full set of LED's flashing on reboot, not just the power and wireless that I had before.

Also managed to erase the bad kernel image - to try and force recovery mode.

If I can't get the console to come back up, I may try and push the stock Linksys firmware back in via JTAG. Slow, but perhaps it will get me there ..
Sponsor
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Fri May 27, 2011 14:20    Post subject: Re: Progress.. Reply with quote
phoenix127 wrote:
Hi Barryware. Thanks for the quick response.

Some progress. I've successfully changed NVRAM with the /byte_mode and /fc:43 for my FLASH device and although the console hasn't come back up yet, I now get a full set of LED's flashing on reboot, not just the power and wireless that I had before.

Also managed to erase the bad kernel image - to try and force recovery mode.

If I can't get the console to come back up, I may try and push the stock Linksys firmware back in via JTAG. Slow, but perhaps it will get me there ..


/fc:43 is wrong (bottom vs top boot) /fc:44 would be the correct fc but the chip is not supported cuz it is a revision D. I have gone over this with tornado.

Jtag looks like it is working but is not.

Use /fc:107. You will see the diff. Jtag will take a bit longer.. It is actually erasing nvram.

EDIT: the fc's might be diff between jtag versions. I used the latest posted, 3.0.2 - rc2 I believe with a wiggler (tornado's diy adapter)

_________________
[Moderator Deleted] Shocked
phoenix127
DD-WRT User


Joined: 02 Jan 2011
Posts: 79
Location: UK

PostPosted: Fri May 27, 2011 15:01    Post subject: Debricked Reply with quote
Success ! Smile))

Could not do anything over serial, the port is completely dead. so I couldn't do the serial recovery. So I did this instead.

tjtag -erase:nvram /fc:43 /byte_mode
tjtag -erase:kernel /fc:43 /byte_mode

This erased both NVRAM and Kernel (using tjtag 3.0.2) byte_mode seems to be the key here.

Powered router off

Powered up - Now all the LED's flash, instead of the two that had been before. The first part of progress.

I attempted recovery mode - power off, power on. Wait 2.5 seconds, hold in reset button for 5 seconds.

The router flashed some LED's, so recovery mode was working and the device became pingable on 192.168.1.1, but no web interface on http://192.168.1.1.

So, I fired up Pumpkin TFTP (http://kin.klever.net/pumpkin).
Renamed the stock Cisco firmware as kernel.bin and sent it to 192.168.1.1

Pumpkin showed the progress on transfer and it completed.
Now you need to wait for about 3-5 minutes until all of the LED's flashed on the router.

The device will reboot and will be back on stock Cisco firmware on 192.168.1.1 and ready for a DD-WRT update again (this time using the correct firmware !).

I'd already used /FC:43 by the time your posting came in. Are you sure you are right on the /fc:43 ? According to the Macronix data sheet for the device, its an "EB" version, which makes it bottom boot. Anyhow, either way it worked and its not a brick any more Smile and the passive JTAG cable worked OK.

BTW - your last posting has disappeared - the one that gives the serial recovery and JTAG options, would be good to get this back on the thread for completeness.

Thanks for your help on this. Now to re-image DD-WRT onto it and make the changes I planned a couple of days ago.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Fri May 27, 2011 15:35    Post subject: Reply with quote
does serial work now? do you get output?
_________________
[Moderator Deleted] Shocked
phoenix127
DD-WRT User


Joined: 02 Jan 2011
Posts: 79
Location: UK

PostPosted: Fri May 27, 2011 16:08    Post subject: serial down Reply with quote
Nope, serial is still down, think its bust.

I found is a previous post on 610Nv2 that says shorting TXD to VDD on the serial port kills the driver (which makes sense), so its possible during my time creating a suitable plug for the WAN port serial that I may have shorted it. Alternately, it may have never worked from the factory.

I started with Eko's 4 pin ribbon cable console hack and moved to an RJ45 socket that I removed the cente from and cut down to get the springy contacts in a fairly robust header per a suggestion from another posting.

This worked well and reliably connects to the 610Nv1 I have. The only limitation is having to wedge it in with some sleeving off a CAT5 cable to stop the header from popping out while your doing something else.

If only I'd have found the serial pads on the bottom of the PCB first ...

Suppose it doesn't really matter as I've always got the recovery process above to fall back on and can use SSH to do everything I need to from within the box.
barryware
DD-WRT Guru


Joined: 26 Jan 2008
Posts: 13049
Location: Behind The Reset Button

PostPosted: Fri May 27, 2011 16:14    Post subject: Reply with quote
glad it worked out..

fc:43 vs fc:44.. 43=top boot, 44=bottom boot. The chip is a bottom boot.

_________________
[Moderator Deleted] Shocked
lightix
DD-WRT User


Joined: 03 Dec 2008
Posts: 111

PostPosted: Mon Jun 20, 2011 15:00    Post subject: Reply with quote
Hi! Where I can download TJTAG version, working with Linksys E3000?
Thanks.

_________________
DD-WRT v24 sp2 MEGA on ASUS wl-520gc [with USB]
Striek
DD-WRT Novice


Joined: 20 Jun 2011
Posts: 2

PostPosted: Thu Jul 07, 2011 17:34    Post subject: Re: Some progress - E3000 / JTAG - part 1 Reply with quote
phoenix127 wrote:
I've bridged the JTAG pads on the PCB (http://www.dd-wrt.com/phpBB2/viewtopic.php?t=75073) and agree with barryware that its very difficult, even for an experienced person (it took hours). The easiest way I found was to take a piece of ribbon cable, strip a wire off, then using just a a single strand from that wire, tin the strand, then tin the pads on the PCB and *briefly* heat the PCB. A good magnifying glass and a scalpel for moving the wires helps a lot. You also need a very fine tip on your iron.

If you lift a pad, then scrape the etch resist from the track and solder directly to that - using less heat and time !!

If you're not really good with an iron then don't attempt this.

The JTAG pinout is as per other Linksys devices, taking 1 from the square pad on JB3 is as follows

nTRST 1 2 GND
TDI 3 4 GND
TDO 5 6 GND
TMS 7 8 GND
TCK 9 10 GND



I bricked my E3000 - think the NVRAM is fscked. It keeps rebooting and never takes a CTRL-C (the serial console works so I can see it reboot every second).

It took seven or eight hours to bridge those five pads. It's like gluing a strand of hair to a grain of salt using a hot glue gun. Using a single strand of wire from an old IDE cable works well - I tinned the end of a strand, and used that to first tin the pads, which limits the solder used. Once the pads were tinned, I cut the strand, tinned another one, and left the strand on the cable to solder it to the PCB - it's easier to hold that way, and functions as a light duty heatsink as well. I managed to do it with a basic soldering iron - a finer point would have made a huge difference.

I only lifted one of the pads (the last one! grr!) and managed to solder directly to the track. Touch the iron to the PCB for maybe half a second. Anything more and you risk damaging it. There's not much solder to heat up anyway.

The key here is to take your time. If your hand is shaking too much, just wait. Once you have a soldered joint, don't move the wire - there's so little solder it's quite easy to break the weld. Leave it for five seconds or so. Once it's soldered to the board and the joint is cool, I just cut the strand with a scalpel - the wire is thin enough it takes very little effort to cut it with a sharp scalpel. Check your work with a multimeter - make sure both sides of the pads you bridged have continuity to the JTAG header.

And after all that, I realized I don't have a DB25 plug Mad
majsterko
DD-WRT Novice


Joined: 12 Sep 2015
Posts: 3

PostPosted: Sat Sep 12, 2015 0:55    Post subject: THX gents = SUCESS Reply with quote
wrt610nv2 boot loop, power led flashing. No luck with serial and ctrl+c;

soldered JTAG, well, you all complain, it took me 10 minutes or so, however, without this post I would be lost, so thanks Smile

DB25 soldered according this schematics:
http://wiki.openwrt.org/doc/hardware/port.jtag.cable.unbuffered

Software downloaded from:
http://ie.archive.ubuntu.com/disk1/disk1/download.sourceforge.net/pub/sourceforge/z/zj/zjtag/TJTAG/v3.0.2-Final/
tjtag-302-win32.zip

commands used (hitting enter multiple times, as router was constantly rebooting and did not get tjtag to stop it on 1st hit):

tjtag3 -probeonly /cable:dlc5 /fc:43

tjtag3 -backup:nvram /cable:dlc5 /fc:43

tjtag3 -erase:nvram /cable:dlc5 /fc:43 /byte_mode

C:\>tjtag3 -erase:nvram /cable:dlc5 /fc:43 /byte_mode

================================================
EJTAG Debrick Utility v3.0.2.1 Tornado-MOD
================================================

Selected port = 0x378

Detected IR chain length = 5
Number of device(s) = 1

IDCODE for device 1 is 0x0008C17F

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000010001100000101111111 (0008C17F)
*** Found a Broadcom BCM4716 Rev 1 CPU in MIPS MODE chip ***

- EJTAG IMPCODE ....... : 01100000010000010100000000000000 (60414000)
- EJTAG Version ....... : 3.1
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R4k ASID_8 MIPS16 NoDMA MIPS32

Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ... Done
Clearing Watchdog ... Done


Chip ID 4716
Chip Rev 1
Package Options a
Number of Cores 9
Core Revision 79
Core Type 710
Core Vendor ID 19a10000
Flash Type 700
Flash Type = PFLASH
Flash bus is 8 bits
Dest is bits 0
Flash is byteswapped 0
Endian Type is LE 0
PLL Type 00000000

Manual Flash Selection ... Done

Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001011001001 (000022C9)
*** Manually Selected a MX29LV640B 4Mx16 TopB (8MB) Flash Chip ***

- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 1C7E0000
- Selected Area Length ....... : 00020000

*** You Selected to Erase the NVRAM.BIN ***

=========================
Erasing Routine Started
=========================
Total Blocks to Erase: 9

Erasing block: 127 (addr = 1C7E0000)...
Erasing in Byte_Mode
Done
Erasing block: 128 (addr = 1C7F0000)...
Erasing in Byte_Mode
Done
Erasing block: 129 (addr = 1C7F2000)...
Erasing in Byte_Mode
Done
Erasing block: 130 (addr = 1C7F4000)...
Erasing in Byte_Mode
Done
Erasing block: 131 (addr = 1C7F6000)...
Erasing in Byte_Mode
Done
Erasing block: 132 (addr = 1C7F8000)...
Erasing in Byte_Mode
Done
Erasing block: 133 (addr = 1C7FA000)...
Erasing in Byte_Mode
Done
Erasing block: 134 (addr = 1C7FC000)...
Erasing in Byte_Mode
Done
Erasing block: 135 (addr = 1C7FE000)...
Erasing in Byte_Mode
Done
=========================
Erasing Routine Complete
=========================



jtag3.jpg
 Description:
 Filesize:  84.96 KB
 Viewed:  7598 Time(s)

jtag3.jpg



jtag2.jpg
 Description:
 Filesize:  74.26 KB
 Viewed:  7598 Time(s)

jtag2.jpg



jtag1.jpg
 Description:
 Filesize:  261.97 KB
 Viewed:  7598 Time(s)

jtag1.jpg


majsterko
DD-WRT Novice


Joined: 12 Sep 2015
Posts: 3

PostPosted: Sat Sep 12, 2015 1:32    Post subject: more Reply with quote
for jtag VCC I have used 3.3v pad off the serial port on the side with 100Ohm resistor


jtag6.jpg
 Description:
 Filesize:  198.09 KB
 Viewed:  7597 Time(s)

jtag6.jpg



jtag5.jpg
 Description:
 Filesize:  110.31 KB
 Viewed:  7597 Time(s)

jtag5.jpg


majsterko
DD-WRT Novice


Joined: 12 Sep 2015
Posts: 3

PostPosted: Thu Jan 31, 2019 10:42    Post subject: update Reply with quote
wrt610nv2 or e3000 corrupted flash update.

I have done +-15 routers sofar, wrt610nv2 or e3000. Actually, there is no need for JTAG for unbricking whatsoever unless somebody erased CFE intentionally.

The reason why nvram gets corrupt is the heat. To place it straight, the 470uF 10V cap for 1.284V circuit (placed in the middle of the board gets a lot of heat and just dies) is the culprit of corrupted nvram.

No JTAG not even serial is needed to fix corrupted nvram (power button blinks forewer) on these routers.

Just replace the mentioned cap and you are done. Sometimes, you might experience a cfe boot loop but pressing the reset button at power-up will erase nvram, just like serial or jtag will.

good luck
Goto page Previous  1, 2, 3, 4 Display posts from previous:    Page 4 of 4
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum