Flashed wrong image to devolo WiFi pro 1200i

Hey, as a long term OpenWrt user, i now have a problem i've never had before.
Because i was dumb and stupid, and didn't check twice which image i am going to flash,
i flashed a devolo WiFi pro 1200e image to a devolo WiFi pro 1200i (notice the e and i).

Now, the devolo boots, but i can't access it in any way to try to restore it.

I tried pinging on 192.168.0.1, and 192.168.1.1 as well as flashing per tftp. No success.
I can however access the serial terminal over the dupont breakout pins on the board.

But as good as that looked, i can't interact with the shell. I've tried to set the flow control to either "None" or "XON/XOFF" with no success.

Is there any way to restore either the oem image, or flash the correct one now? Would be a shame to have my first device bricked unrecoverable. Thanks in advance.

This is the output while booting:

U-Boot 1.1.4-g99c02335 (Feb 24 2016 - 14:41:06)
ELX version: 1.0.2

7479PLC - Scorpion 1.0DRAM:
sri
Scorpion 1.0
ath_ddr_initial_config(178): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x5, 0x1b)
Tap values = (0x10, 0x10, 0x10, 0x10)
128 MB
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
Flash [MX25L12845E] sectors: 256
Flash: 16 MB
*** Warning *** : PCIe_2 WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
Fetching MAC Address from 0x87fee8dc
<0>ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->8035 PHY*
AR8035 PHY reg init
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:aa:bb:cc:dd:00
AR8035 found!
[0:4]Phy ID 4d:d072
Port 0, Neg Success
eth0 up
eth0
Setting 0x18116290 to 0x458ba14f

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.                                                                                                                                                                                                    0

3: System Boot system code via Flash.
## Booting image at 9f070000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.162
   Created:      2020-01-06  16:47:09 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1595734 Bytes =  1.5 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f070040 ...OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 4.14.162 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r10860-a3ffeb413b)) #0 Mon Jan 6 16:47:09 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is devolo WiFi pro 1200e
[    0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] random: get_random_bytes called from 0x804fd740 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 123300K/131072K available (4027K kernel code, 156K rwdata, 532K rodata, 1228K init, 212K bss, 7772K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 720.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns
[    0.000007] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns
[    0.008296] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[    0.074984] pid_max: default: 32768 minimum: 301
[    0.080067] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.087103] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.098093] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.108591] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.115151] pinctrl core: initialized pinctrl subsystem
[    0.122590] NET: Registered protocol family 16
[    0.129608] PCI host bridge /ahb/apb/pcie-controller@180c0000 ranges:
[    0.136517]  MEM 0x0000000010000000..0x0000000011ffffff
[    0.142071]   IO 0x0000000000000000..0x0000000000000000
[    0.161981] PCI host bridge to bus 0000:00
[    0.166344] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.173692] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.179618] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.186845] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.195691] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    0.203514] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
[    0.213748] clocksource: Switched to clocksource MIPS
[    0.219948] NET: Registered protocol family 2
[    0.225325] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.232745] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.239554] TCP: Hash tables configured (established 1024 bind 1024)
[    0.246430] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.252657] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.259543] NET: Registered protocol family 1
[    0.266913] Crashlog allocated RAM at address 0x3f00000
[    0.273517] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    0.284521] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.290721] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.308878] io scheduler noop registered
[    0.313049] io scheduler deadline registered (default)
[    0.320383] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[    0.328734] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.337511] console [ttyS0] disabled
[    0.341347] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[    0.350562] console [ttyS0] enabled
[    0.350562] console [ttyS0] enabled
[    0.357990] bootconsole [early0] disabled
[    0.357990] bootconsole [early0] disabled
[    0.373694] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[    0.378901] 5 fixed-partitions partitions found on MTD device spi0.0
[    0.385359] Creating 5 MTD partitions on "spi0.0":
[    0.390227] 0x000000000000-0x000000040000 : "u-boot"
[    0.395940] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.401932] 0x000000050000-0x000000060000 : "art"
[    0.407377] 0x000000060000-0x000000070000 : "art_bak"
[    0.413133] 0x000000070000-0x000001000000 : "firmware"
[    0.422161] 2 uimage-fw partitions found on MTD device firmware
[    0.428218] Creating 2 MTD partitions on "firmware":
[    0.433257] 0x000000000000-0x000000190000 : "kernel"
[    0.438941] 0x000000190000-0x000000f90000 : "rootfs"
[    0.444585] mtd: device 6 (rootfs) set to be root filesystem
[    0.450367] 1 squashfs-split partitions found on MTD device rootfs
[    0.456679] 0x000000430000-0x000000f90000 : "rootfs_data"
[    0.463683] libphy: Fixed MDIO Bus: probed
[    0.805455] libphy: ag71xx_mdio: probed
[    0.904246] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:04 [uid=004dd072, driver=Atheros 8035 ethernet]
[    0.915000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii
[    1.255445] libphy: ag71xx_mdio: probed
[    1.260415] ag71xx 1a000000.eth: connected to PHY at mdio-bus.1:01 [uid=00000000, driver=Generic PHY]
[    1.270345] eth1: Atheros AG71xx at 0xba000000, irq 5, mode: sgmii
[    1.277034] ath79-wdt 18060008.wdt: unable to register misc device, err=-16
[    1.284150] ath79-wdt: probe of 18060008.wdt failed with error -16
[    1.291735] NET: Registered protocol family 10
[    1.300236] Segment Routing with IPv6
[    1.304086] NET: Registered protocol family 17
[    1.308635] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.321795] 8021q: 802.1Q VLAN Support v1.8
[    1.327354] hctosys: unable to open rtc device (rtc0)
[    1.338477] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
[    1.350020] Freeing unused kernel memory: 1228K
[    1.354647] This architecture does not have kernel memory protection.
[    2.052800] init: Console is alive
[    2.056521] init: - watchdog -
[    2.489807] random: fast init done
^@[    3.140373] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.398512] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.406830] init: - preinit -
[    4.561629] random: jshn: uninitialized urandom read (4 bytes read)
[    4.806345] random: jshn: uninitialized urandom read (4 bytes read)
[    4.839893] random: jshn: uninitialized urandom read (4 bytes read)
[    5.000542] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    8.322944] jffs2: notice: (458) jffs2_build_xattr_subsystem: complete building xattr subsystem, 27 of xdatum (0 unchecked, 25 orphan) and 94 of xref (19 dead, 58 orphan) found.
[    8.340873] mount_root: switching to jffs2 overlay
[    8.364311] overlayfs: upper fs does not support tmpfile.
[    8.376234] urandom-seed: Seeding with /etc/urandom.seed
[    8.484435] procd: - early -
[    8.487445] procd: - watchdog -
[    9.107636] procd: - watchdog -
[    9.111098] procd: - ubus -
[    9.172506] urandom_read: 5 callbacks suppressed
[    9.172513] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.296979] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.304632] procd: - init -
Please press Enter to activate this console.
[   10.002712] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.028493] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   10.050400] Loading modules backported from Linux version v4.19.85-0-gc63ee2939dc1
[   10.058122] Backport generated by backports.git v4.19.85-1-0-g8a8be258
[   10.085643] ip_tables: (C) 2000-2006 Netfilter Core Team
[   10.109848] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[   10.145186] urngd: v1.0.0 started.
[   10.201121] xt_time: kernel timezone is -0000
[   10.297865] PPP generic driver version 2.4.2
[   10.314510] NET: Registered protocol family 24
[   10.356253] ath10k 4.19 driver, optimized for CT firmware, probing pci device: 0x3c.
[   10.384399] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[   10.390305] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   10.406115] random: crng init done
[   10.667385] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/fwcfg-pci-0000:00:00.0.txt failed with error -2
[   10.678109] ath10k_pci 0000:00:00.0: Falling back to user helper
[   10.876994] firmware ath10k!fwcfg-pci-0000:00:00.0.txt: firmware_loading_store: map pages failed
[   10.886185] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:00:00.0.bin failed with error -2
[   10.897068] ath10k_pci 0000:00:00.0: Falling back to user helper
[   11.077227] firmware ath10k!pre-cal-pci-0000:00:00.0.bin: firmware_loading_store: map pages failed
[   11.087995] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/ct-firmware-5.bin failed with error -2
[   11.099147] ath10k_pci 0000:00:00.0: Falling back to user helper
[   11.280740] firmware ath10k!QCA988X!hw2.0!ct-firmware-5.bin: firmware_loading_store: map pages failed
[   11.290391] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/ct-firmware-2.bin failed with error -2
[   11.301541] ath10k_pci 0000:00:00.0: Falling back to user helper
[   11.484339] firmware ath10k!QCA988X!hw2.0!ct-firmware-2.bin: firmware_loading_store: map pages failed
[   11.493963] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-6.bin failed with error -2
[   11.504846] ath10k_pci 0000:00:00.0: Falling back to user helper
[   11.688559] firmware ath10k!QCA988X!hw2.0!firmware-6.bin: firmware_loading_store: map pages failed
[   11.697931] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-5.bin failed with error -2
[   11.708814] ath10k_pci 0000:00:00.0: Falling back to user helper
[   11.891282] firmware ath10k!QCA988X!hw2.0!firmware-5.bin: firmware_loading_store: map pages failed
[   11.900639] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-4.bin failed with error -2
[   11.911521] ath10k_pci 0000:00:00.0: Falling back to user helper
[   12.094156] firmware ath10k!QCA988X!hw2.0!firmware-4.bin: firmware_loading_store: map pages failed
[   12.103474] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/firmware-3.bin failed with error -2
[   12.114357] ath10k_pci 0000:00:00.0: Falling back to user helper
[   12.295036] firmware ath10k!QCA988X!hw2.0!firmware-3.bin: firmware_loading_store: map pages failed
[   12.506585] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043202ff sub 0000:0000
[   12.515984] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   12.528406] ath10k_pci 0000:00:00.0: firmware ver 10.1-ct-8x-__fW-022-b0e1b7cd api 2 features wmi-10.x,has-wmi-mgmt-tx,mfp,txstatus-noack,wmi-10.x-CT,ratemask-CT,txrate-CT,get-temp-CT,tx-rc-CT,cust-stats-CT,retry-gt2-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT crc32 1e527180
[   12.580804] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/board-2.bin failed with error -2
[   12.591410] ath10k_pci 0000:00:00.0: Falling back to user helper
[   12.685319] firmware ath10k!QCA988X!hw2.0!board-2.bin: firmware_loading_store: map pages failed
[   12.694582] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[   13.636268] ath10k_pci 0000:00:00.0: 10.1 wmi init: vdevs: 16  peers: 127  tid: 256
[   13.653731] ath10k_pci 0000:00:00.0: wmi print 'P 128 V 8 T 410'
[   13.660063] ath10k_pci 0000:00:00.0: wmi print 'msdu-desc: 1424  sw-crypt: 0 ct-sta: 0'
[   13.668216] ath10k_pci 0000:00:00.0: wmi print 'alloc rem: 20904 iram: 26056'
[   13.736267] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 2 htt-op 2 cal file max-sta 128 raw 0 hwcrypto 1
[   13.749067] ath10k_pci 0000:00:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000
[   13.979768] ieee80211 phy1: Atheros AR9550 Rev:0 mem=0xb8100000, irq=13
[   14.061450] kmodloader: done loading kernel modules from /etc/modules.d/*
[   24.255711] br-lan: port 1(eth0) entered blocking state
[   24.261020] br-lan: port 1(eth0) entered disabled state
[   24.266597] device eth0 entered promiscuous mode
[   24.286920] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   24.328430] br-lan: port 2(eth1) entered blocking state
[   24.333735] br-lan: port 2(eth1) entered disabled state
[   24.339333] device eth1 entered promiscuous mode

Flow control should be set to "None." Does the boot stop if you hit 1 or 4 when that menu comes up? That is in the bootloader not the firmware.

Even with Flow control "None" i can't interact with the shell. I've tried HTerm and Termite too, nothing happens. I can see the point where it says "1 to tftp..." but that goes away in a sec, autoselecting 3.

I can enter Failsafe Mode by holding the Reset Button at the right time, but the shell just stands there and
my input is not going to do anything. I've read that forcing "echo" helps, but that didn't do anything either.

Looks to me that the TX cable is not working properly, hence you can see input from the device, but you cannot send anything to it.
Can you verify that it is seated properly, or test it on another device?

I've tried now to swap the cables, and use different lengths. I've tried the loopback test, connecting the wires on RX and TX of the FTDI does work, i can see my typing in the returned echo. But no success with the Serial on the Accesspoint. Could it be that the tx to the AP isn't even accessible by design? If so, do i have another chance to fix this somehow? Can someone read anything out of the logs if there is a possibility to access the device via LAN?

I have found a solution. I've tried another USB2UART connector, and this time it worked. Although i still couldn't enter tftp flashing on boot, i was able to open a wifi connection over the serial tty and flash the correct image from there. It's now working beautifully.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.