Topic: Backfire 10.03.1 Install on Linksys WRT300v1.1 backfires into "brick"

The content of this topic has been archived on 29 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 1

Post #1

boblfoot

6 Jan 2012, 08:26

I could use some help and suggestions for resurrecting my bricked Linksys WRT300nv1.1 router.

First some background information.
The unit was purchased in late 2007 / early 2008 IIRC and run on Linksys/Cisco firmware being upgraded maybe a half dozen times.
In fall of 2010 I flashed it to DD-WRT build 13064, because at the time Open_WRT did not support this router according to the tables.
In fall of 2011 I began to read on getting IPv6 going on my lan and certified through Hurricane Electric.
Over Christmas-New Years of 2011 I played with several editions of DD_WRT flashing the device probably 2 dozen times trying to find a version of their firmware which would support IPv6 on my router. After about 1o days and no success I revisited the OpenWRT website and was skeptically overjoyed to see http://downloads.openwrt.org/backfire/1 … uashfs.bin listed for the latest stable Backfire. I spent the next two days reading through the documentation so I was sure I understood all that I could do.
On January 4th, 2012 I opened firefox on my Centos 6.2 client PC and connected to the DD-WRT Administration page of my router. I had the file http://downloads.openwrt.org/backfire/1 … uashfs.bin on the hard drive of my PC and proceeded to upgrade firmware. The web page responded that the update had occurred successfully. I rebooted and tried to telnet to 192.168.1.1 without success.
Present condition is that when powered up the switch lights behave normally, the power light goes through fast blink, no blink, fast blink and then solid on phases. IIRC this should mean it has fully booted the new Open WRT squash fs firnware. But DHCP requests to the router fail and attempts to connect to 192.168.1.1 from the Centos PC with static IP 192.168.1.100 fail also.
Now I can open a terminal on PC-192.168.1.100 and issue the commands as follows:
# tftp 192.168.1.1
tftp> binary
tftp> rexmt 1
tftp> timeout 90
tftp> trace
tftp> put "a firmware binary file name"
Cycling power while tftp is trying to connect results in tftp transferring the bin file during the boot wait, but the new binary fails to boot just like the original Open WRT.

I have tried two different DD-WRT firmwares which worked in the past but now fail to boot. I tried the http://downloads.openwrt.org/backfire/1 … uashfs.bin again by tftp. and while it loads it does not compelte boot. I thought about trying original linksys firmware or http://downloads.openwrt.org/backfire/1 … uashfs.bin since I was running the 2.4 kernel dd-wrt stuff.

Suggestions are more than welcome.

I must say from the website and documentation side of things Open-WRT is running circles around DD-WRT; I can only hope your actual product can eventually do the same for me.

Post #2

jow

6 Jan 2012, 12:51

Known problem. The generic images do not contain a suitable ethernet driver.
I suggest to use the image generator and assamble an image tailored for this unit:

make image PROFILE=WRT300Nv11

Make sure it lists "kmod-brcm-wl-mimo" and "kmod-brcm-57xx" when assembling the image.
See http://wiki.openwrt.org/doc/howto/obtai … e.generate for further information.

Post #3

boblfoot

6 Jan 2012, 15:32

SO WHY POST A BUSTED SQUASHFS.BIN IN THE STABLE DOWNLOAD TREE ???

I've spent the morning trying to find my linksys firmware, flashing different versions of wrt300nv1.1 firmware.

And all because an advertised "STABLE" file is broken.

Yes I ranted a little sorry. The Image Generator is downloading now. Unfortunately there is not x86_64 Image Generator for Backfire 10.03.01 and the Broadcom 47xx chips. Guess I'l have to build on my i686 snail box.

Post #4

jow

6 Jan 2012, 15:48

You should be able to run it just fine on x64 after installing ia32-libs or whatever the CentOS equivalent is.

Edit: seems one should install "glibc.i686" and "zlib.i686" on CentOS / Fedora.

Post #5

boblfoot

6 Jan 2012, 21:46

Image Builder for brcm74xx runs just fine, but no packages named kmod-brcm-wl-mimo or kmod-brcm-57xx exists in the 10.03.01 packages folder to be downloaded or installed. The bin file built by the PROFILE=WRT300Nv11 command in Image Builder brcm47xx behaves no differently than the stock ones downloaded from the website. I am downloading the 2.4 Image Builder now as it has the kmod-brcm-wl-mimo and kmod-brcm-57xx image files in it's directory. Maybe a 2.4 build will work better. Time will tell.

Noe zlibc and glibc along with the default "Development Tools" group from yum groupinstall "Developement Tools" were already loaded on my x86_64 Centos 6.2 system which runs Image Builder.

(Last edited by boblfoot on 6 Jan 2012, 21:47)

Post #6

boblfoot

7 Jan 2012, 05:41

Thanks for all the assistance jow.

So far here's what I've tried without success to recover the unit.

tftp transferred successfully under full file name and as code.bin
Backfire 10.03.01 - BRCM47xx - wrrt300nv11 from Downloads
Backfire 10.03 - BRCM47xx - wrrt300nv11 from Downloads
Backfire 10.03.01 - BRCM2.4 - wrrt300nv11 from Downloads
Backfire 10.03 - BRCM2.4 - wrrt300nv11 from Downloads
Kamakazie 8.09.02 - BRCM47xx - wrrt300nv11 from Downloads
Kamakazie 8.09.02 - BRCM2.4 - wrrt300nv11 from Downloads
but none would provide a working router. The Power light appeared to have gone through normal boot functions ending Always ON.

Downloaded Backfire 10.03.01 - BRCM47xx Image Generator -
Downloaded Backfire 10.03.01 - BRCM2.4 Image Generator -
Installed both generators on a Centos 6.2_x86_64 and a Centos 6.2_i686 system.
run the following to generate test binaries.
Make Clean
Make Image Profile=WRT300NV11
tftp install the WRT300NV11.bin file bith by name and as code.bin
but none would provide a working router. The Power light appeared to have gone through normal boot functions ending Always ON.

Tried via tftp to isntall DD-WRT V2.4 builds 13064 and 14929.
Tried via tftp to install Linksys firmware for WRT350N-v1 {it is allegedly the same hdwe as the 300N V1.1

I have not lost the ability to tftp a file successfully, but nothing I tftp will produce a working system.

I am almost ready to build a JTAG Cable and open my first router for surgery, but wouldn't know what to do next.

I'd like to get this box working as a Dual Stack IPV4/IPV6 wired/wireless router someday.

Eureka - I stumbled across a copy of the Original linksys Firmware still out there on the net. I'll try flashing it after virus checking 6 ways to Sunday of course. Let's hope that gets me back to usable.

(Last edited by boblfoot on 7 Jan 2012, 09:37)

Post #7

boblfoot

7 Jan 2012, 14:37

Well the "Linksys" firmware I found at http://download.modem-help.co.uk/mfcs-L … 1/r1-51-2/ behaves no different than the OPENWRT and DD-WRT firmware I've tried to flash. Oh Well -- I can use a new paperweight for a little while longer.

Post #8

boblfoot

19 May 2012, 00:17

Ok I know it has been 4 months but I finally got a USB to Serial Adapter and wired up the Linksys WRT300v1.1 Serial Port. What appears "bricked" from the ethernet side looks like it booted normally from the serial port. Any ideas what I am missing or where to go next?

-

the serial port bootup output

Start to blink diag led ...

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Tue Feb 27 19:35:53 CST 2007 (root@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.
Initializing Arena
Initializing PCI. [normal]
PCI bus 0 slot 0/0: vendor 0x14e4 product 0x0800 (flash memory, rev 0x02)
PCI bus 0 slot 1/0: vendor 0x14e4 product 0x471f (ethernet network, rev 0x02)
PCI bus 0 slot 2/0: vendor 0x14e4 product 0x471a (USB serial bus, interface 0x10, rev 0x02)
PCI bus 0 slot 2/1: vendor 0x14e4 product 0x471a (USB serial bus, interface 0x20, rev 0x02)
PCI bus 0 slot 3/0: vendor 0x14e4 product 0x471b (USB serial bus, rev 0x02)
PCI bus 0 slot 4/0: vendor 0x14e4 product 0x0804 (PCI bridge, rev 0x02)
PCI bus 0 slot 5/0: vendor 0x14e4 product 0x0816 (MIPS processor, rev 0x02)
PCI bus 0 slot 6/0: vendor 0x14e4 product 0x471d (IDE mass storage, rev 0x02)
PCI bus 0 slot 7/0: vendor 0x14e4 product 0x4718 (network/computing crypto, rev 0x02)
PCI bus 0 slot 8/0: vendor 0x14e4 product 0x080f (RAM memory, rev 0x02)
PCI bus 0 slot 9/0: vendor 0x14e4 product 0x471e (class 0xfe, subclass 0x00, rev 0x02)
Initializing Devices.
No DPN
This is a Parallel Flash
Partition information:
boot #00 00000000 -> 0003FFFF (262144)
trx #01 00040000 -> 0004001B (28)
os #02 0004001C -> 007F7FFF (8093668)
nvram #03 007F8000 -> 007FFFFF (32768)
Partition information:
boot #00 00000000 -> 0003FFFF (262144)
trx #01 00040000 -> 007F7FFF (8093696)
nvram #02 007F8000 -> 007FFFFF (32768)
Reset switch via GPIO 8 ...
PCI bus 0 slot 1/0: pci_map_mem: attempt to map 64-bit region tag=0x800 @ addr=18010004
PCI bus 0 slot 1/0: pci_map_mem: addr=0x18010004 pa=0x18010000
ge0: BCM5750 Ethernet at 0x18010000
CPU type 0x2901A: 300MHz
Total memory: 32768 KBytes
Total memory used by CFE: 0x80600000 - 0x806A1900 (661760)
Initialized Data: 0x80636C40 - 0x80639BE0 (12192)
BSS Area: 0x80639BE0 - 0x8063B900 (7456)
Local Heap: 0x8063B900 - 0x8069F900 (409600)
Stack Area: 0x8069F900 - 0x806A1900 (8192)
Text (code) segment: 0x80600000 - 0x80636C40 (224320)
Boot area (physical): 0x006A2000 - 0x006E2000
Relocation Factor: I:00000000 - D:00000000
Boot version: v4.4
The boot is CFE
mac_init(): Find mac [00:1d:7e:1c:38:9a] in location 0
Nothing...
CMD: [ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0]
eth0: Link speed: 100BaseT FDX
Device eth0: hwaddr 00-1D-7E-1C-38-9A, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
CMD: [go;]
Check CRC of image1
Len: 0xDB000 (897024) (0xBC040000)
Offset0: 0x1C (28) (0xBC04001C)
Offset1: 0x974 (2420) (0xBC040974)
Offset2: 0xDB000 (897024) (0xBC11B000)
Header CRC: 0x292ED801
Calculate CRC: 0x292ED801
Image 1 is OK
Try to load image 1.
Waiting for 3 seconds to upgrade ...
CMD: [load -raw -addr=0x806a1900 -max=0xf70000 :]
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: _tftpd_open(): retries=0/3
_tftpd_open(): retries=1/3
_tftpd_open(): retries=2/3
Failed.
Could not load :: Timeout occured
CMD: [boot -raw -z -addr=0x80001000 -max=0xf70000 flash0.os:]
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 4092 bytes read
Entry at 0x80001000
Closing network.
eth0: cannot clear 1400/00000002
Starting program at 0x80001000
Linux version 2.6.32.27 (jow@nd-build-02.linux-appliance.net) (gcc version 4.3.3 (GCC) ) #5 Wed Dec 21 05:56:26 CET 2011
CPU revision is: 0002901a (Broadcom BCM3302)
ssb: chipcommon status is 0x0
ssb: Initializing MIPS core...
ssb: set_irq: core 0x080b, irq 4 => 2
ssb: set_irq: core 0x081f, irq 5 => 4
ssb: set_irq: core 0x0819, irq 3 => 5
ssb: after irq reconfiguration
ssb: core 0x0800, irq : 2(S)* 3 4 5 6 D I
ssb: core 0x081f, irq : 2(S) 3 4* 5 6 D I
ssb: core 0x0819, irq : 2(S) 3 4 5* 6 D I
ssb: core 0x081a, irq : 2(S)* 3 4 5 6 D I
ssb: core 0x0804, irq : 2(S) 3 4 5 6* D I
ssb: core 0x0816, irq : 2(S)* 3 4 5 6 D I
ssb: core 0x081d, irq : 2(S) 3 4 5 6 D* I
ssb: core 0x080b, irq : 2(S)* 3 4 5 6 D I
ssb: core 0x080f, irq : 2(S) 3 4 5 6 D I*
ssb: core 0x081e, irq : 2(S)* 3 4 5 6 D I
ssb: Sonics Silicon Backplane found at address 0x18000000
Serial init done.
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Memory: 29496k/32768k available (2332k kernel code, 3272k reserved, 355k data, 136k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
console [ttyS0] enabled
Calibrating delay loop... 299.00 BogoMIPS (lpj=598016)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
ssb: PCIcore in host mode found
ssb: CardBus slot detected
PCI: Fixing up bridge 0000:00:00.0
PCI: Fixing up device 0000:00:00.0
PCI: Fixing latency timer of device 0000:00:00.0 to 168
pci 0000:01:00.0: PME# supported from D3hot D3cold
pci 0000:01:00.0: PME# disabled
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering mini_fo version $Id$
JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
msgmni has been set to 57
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0xb8000300 (irq = 2) is a 16550A
serial8250: ttyS1 at MMIO 0xb8000400 (irq = 2) is a 16550A
serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2) is a 16550A
serial8250.0: ttyS1 at MMIO 0xb8000400 (irq = 2) is a 16550A
flash init: 0x1c000000 0x02000000
Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
CFI mfr 0x000000ec
CFI id 0x000022e2
Amd/Fujitsu Extended Query Table at 0x0040
Fixed Samsung's Amd/Fujitsu Extended Query version from 0.0 to 1.0.
Amd/Fujitsu Extended Query version 1.0.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Flash device: 0x800000 at 0x1fc00000
bootloader size: 262144
Creating 4 MTD partitions on "Physically mapped flash":
0x000000000000-0x000000040000 : "cfe"
0x000000040000-0x0000007f0000 : "linux"
0x00000011b000-0x0000007f0000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=300000, len=4F0000
0x000000300000-0x0000007f0000 : "rootfs_data"
0x0000007f0000-0x000000800000 : "nvram"
BCM47xx Watchdog Timer enabled (30 seconds, nowayout)
TCP westwood registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 136k freed
Please be patient, while OpenWrt loads ...
diag: Detected 'Linksys WRT300N V1.1'
roboswitch: Probing device eth0: No such device
roboswitch: Probing device eth1: No such device
roboswitch: Probing device eth2: No such device
roboswitch: Probing device eth3: No such device
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
switching to jffs2
mini_fo: using base directory: /
mini_fo: using storage directory: /overlay
- init -
Please press Enter to activate this console. Compat-wireless backport release: compat-wireless-2011-11-08-1-g4ab9b62
Backport based on wireless-testing.git master-2011-11-15
cfg80211: Calling CRDA to update world regulatory domain
roboswitch: Probing device eth0: No such device
roboswitch: Probing device eth1: No such device
roboswitch: Probing device eth2: No such device
roboswitch: Probing device eth3: No such device
cfg80211: World regulatory domain updated:
cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
Broadcom 43xx driver loaded [ Features: PL ]
Broadcom 43xx-legacy driver loaded [ Features: PLID ]
PPP generic driver version 2.4.2
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 24
nf_conntrack version 0.5.0 (463 buckets, 1852 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.

BusyBox v1.15.3 (2011-11-24 04:30:44 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
Backfire (10.03.1, r29592) ------------------------
* 1/3 shot Kahlua In a shot glass, layer Kahlua
* 1/3 shot Bailey's on the bottom, then Bailey's,
* 1/3 shot Vodka then Vodka.
---------------------------------------------------
root@OpenWrt:/#

Post #9

nlh

19 May 2012, 05:08

It appears that you don't have a working ethernet driver. I have a Linksys E3000, and was never able to upload a replacement firmware via TFTP without serial access. You should be able to watch what is happening with the failing TFTP upload now that you have serial access. I suspect that (but have never confirmed) this would work with a tiny/minimal image (less than 2MB); but you would have to build this yourself, or you might find one at DD-WRT.

What works on the Linksys E3000 is to interrupt the boot (CTRL-C) from the serial console while it is still in the CFE, almost immediately after powering on. You should get a "CFE> " command prompt at that point. If you type in "help", it should list the commands that are available (try "help upgrade"). The command that I use is "upgrade code.bin". Once I do that, I am able to TFTP a new image to the device (stock firmware, or appropriate openwrt-xxxxx.bin) using the following command from my Linux box:

tftp -4 -m octet 192.168.1.1 -c put <openwrt-xxxxx.bin>

When it's all done, simply type in "reboot" at the serial console, or power cycle the router

As these instructions are for a different device (same CFE version 1.0.37, but much newer build date), use at your own risk. Try searching the forums and/or WIKI for "upgrade code.bin", or maybe Google for more info.

If coming from DD-WRT, I would recommend flashing the stock firmware, restore factory defaults from within the stock firmware, reboot, and then flash OpenWRT (this should reset the NVRAM back to factory settings).

Hope this is helpful,

Nathan

Post #10

boblfoot

30 May 2012, 04:48

Well some good news. I was able to flash to the original Linksys Firmware.

Next step was image builder built a WRT300Nv1.1.bin file and tftp installed it ok.

Telnet was able to connect and set the root passwd.

Connected by ssh/putty and was able to get in.

The web interface of 192.168.1.1 will not load.

opkg shows the ulci and libuci packages exist

Something is missing for http access. Not sure what but that's for another day..

Post #11

boblfoot

30 May 2012, 21:43

Well talk about learning "on the fly". I've been playing with Image Generator and found out that the brcm47xx images using the 2.6 kernel while they boot and access the serial port do not have the drivers for the ethernet or wireless in my Linksys WRT300N, that or I've not specified the correct packages. Now the brcm-2.4 images work great and with tweaking of the profile I can add the uhttpd and ipv6 modules I want to use without having to download them from the wild wild web. As this stands I just flashed an image which should give me an http web page for config. Time will tell.

Post #12

boblfoot

31 May 2012, 20:58

Success and closure. The Linksys WRT300Nv1.1 is now 10.03.1 with ipv6 and a web page for configuration.

Bottom Line as of 2012-06-04 only the 2.4 kernel version of backfire with broadcom-57xx module if built from image generator or build root works with my Linksys WRT300Nv1.1. Date of Manufacture 9/2007.

(Last edited by boblfoot on 5 Jun 2012, 22:55)

The discussion might have continued from here.

Page 1 of 1