Help: ADSL2MUE Not booting anymore

All about firmwares for routers. Support for RouterTech firmwares is here too.
mstombs
RouterTech Team
RouterTech Team
Posts: 3753
Joined: Wed Jan 10, 2007 11:54 pm

Post by mstombs » Fri Feb 02, 2007 1:03 am

For the benefit of myself in the future and others in this thread above, I have had no problem connecting to my ADSL2MUE with a couple of PCTOOLs, as long a your directly connected PC network card is forced into 10MBPS HALF DUPLEX (and software firewalls turned off!) AND your bootloader is intact. I haven't tried uploading from the tools, but once you see the timing you do not need the tool, you can use Command line FTP (I guess this is what the tool does but the mtd variables might not get set correctly coz they are not designed for the ADSL2MUE).

When you power the ADSL2MUE you have about 5 secs after the ADSL2MUE Ethernet light comes on to give the command from a dos cmd line ftp session

ftp> open 192.161.1.1

[Assuming that's the configured IP, if the config partition gets wiped the IP address defaults to 169.254.87.1 (and console serial port to 9600,N,8,1)]

which stops the autoboot process

username adam2
password adam2

A user called Mr Gamer has posted the original Linksys 4.12 firmware and bootloader on eSnips in a file 412_full.zip (Google it! to get to site then search for ADSL2MUE) (mtd0,1,2 seem identical to mine).

The instructions posted elsewhere on the net to manually upload the firmware are

Code: Select all

ftp> quote MEDIA FLSH
200 Media set to FLSH.
ftp> bin
200 Type set to I.
ftp> put fs412.img "fs mtd0"
...
ftp> put knl412.img "krn mtd1"
I failed to put the config file in using this method probably because it is actually stored with an offset, and the ADSL2MUE wouldn't let me delete the first few bytes?

DO NOT ATTEMPT to ftp to mtd2 - the transfer will fail and will brick the router and require JTAG to repair (been there done that...)

Should your config get wiped then the following script which can be pasted into a HyperTerminal serial console session (with 10ms character delay) seems to restore the adam2/pspboot environment section of the 4.12 configuration

Code: Select all

setenv IPA 192.168.1.1
setenv MODETTY0 38400,n,8,1,hw
setenv MODETTY1 38400,n,8,1,hw
setenv MAC_PORT 0
setenv mtd0 0x900a0000,0x90400000
setenv mtd1 0x90020000,0x900a0000
setenv mtd2 0x90000000,0x90010000
setenv mtd3 0x90010000,0x90020000
setenv autoload 1
setenv BOOTCFG m:f:"mtd1"
setenv USB_VID 0x0451
setenv USB_PID 0x6060
setenv HWA_RNDIS 00:E0:A6:66:41:EB
setenv HWA_HRNDIS 00:E0:A6:66:41:E1
setenv usb_vid 0x13b1
setenv usb_pid 0x000f
setenv usb_prod Linksys RNDIS Network Adapter
setenv connection0 0
setenv HWA_0 00:12:17:xx.yy.zz
xx.yy.zz the MAC on your ADSL2MUE label

PS My ADSL Link still broken - so can't be 100% sure the modem still works, but it seems to!
Last edited by mstombs on Tue Feb 06, 2007 2:47 pm, edited 2 times in total.
^Albe^
Regular
Regular
Posts: 50
Joined: Sun Oct 29, 2006 2:17 pm

Post by ^Albe^ » Sun Feb 04, 2007 4:40 pm

thx again for the help:
here i have 2 different adsl2mue one bricked ( like said before: i took and put the wrong routertech firm ... ) and one works
with the working one , the pctools (and obv the pspboot connection: i used times ago the mrgamer method for recover one) works
but no chance at all to connect to the bricked one :( , so the boot is gone for sure :(
unlucky the jtag device i have is a bit different from the needed one :(
i read that with the serial interface there's not a chance to reput the firm/bottloader (i have around an unused old nokia dku-5 cable, and the chance to connect it to my adsl2mue sounds good, but unlucky seems to be useless)
so i must build a new jtag interface ... some day perhaps.. :(

thx again to all
User avatar
thechief
RouterTech Team
RouterTech Team
Posts: 12067
Joined: Wed Feb 01, 2006 10:22 pm
Location: England, the Centre of Africa
Contact:

Post by thechief » Sun Feb 04, 2007 5:10 pm

Good luck! I am still a bit demused about how a firmware upgrade can trash the bootloader. That is most unlikely, unless you specifically did something to the mtd2 partition. The web upgrade routine will not do anything to your mtd2 partition, and neither will the pctool (as far as I am aware). How did you try to flash the firmware onto the bricked router?
The Chief: :afro: Be sure to read the Firmware FAQ and do a Forum Search before posting!
No support via PM. Ask all questions on the open forum.
mstombs
RouterTech Team
RouterTech Team
Posts: 3753
Joined: Wed Jan 10, 2007 11:54 pm

Post by mstombs » Sun Feb 04, 2007 7:59 pm

I now have a working JTAG connection to a broken ADSL2MUE I have acquired (I now know its a hardware fault coz it has identical flash memory contents to my working one!) - I didn't risk my believed working one!

It took ages to remove the solder from the 14 holes using solder sucker and wick, and I had to cut down my 14 way connector to fit in next to the nearest LED.

I made a HairyDairyMaid parallel port JTAG cable - NB the pictures in the guide must be connections to a female D socket, after much research I used the pin numbers on the male connector I had which is a mirror image to those in the pictures!

Compared to the Linksys WRT54G the extra connection is required from Vcc (+3.3V) on JTAG pin 14 to TRST on JTAG pin 1 using a 100 ohm resistor.

Using the HairyDairyMaid WRT54G utility with /nodma worked, but was very slow. It took 1144 seconds (nearly 20 mins!) to flash the 64k PSP bootsector. Only took 135 seconds to flash the 64k config MTD3, because most of it is blank - lots of 1's.

NB to flash Linksys V4.22 beta firmware the following additional environment variables need to be set (to make it the same as as a clean installed version)

Code: Select all

setenv mtd4 0x90020000,0x90400000
setenv vcc_encaps0 0.0
setenv vcc_encaps1 0.0
setenv vcc_encaps2 0.0
setenv vcc_encaps3 0.0
setenv vcc_encaps4 0.0
setenv vcc_encaps5 0.0
setenv vcc_encaps6 0.0
setenv vcc_encaps7 0.0
setenv modulation MMODE
And to flash the Routertech 2.1 firmware (mtd4 by ftp), config by JTAG the following environment variables need to be changed

Code: Select all

setenv mtd1 0x90020090,0x90097000
setenv mtd0 0x90097000,0x90400000
I could take pictures of my lash-up if anyone is interested but to be honest I don't think the procedure is worth it! - If your ADSL2MUE is dead throw it away and buy a different make! There are lots of reports on the net of failed ADSL2MUE - I now suspect not just firmware.

I also agree with thechief, flashing firmware should not corrupt the bootloader, I had to try to replace the bootloader via ftp to destroy it. I'm pretty sure all AR7's have the bootloader as the first 64k of flash so variants of PCTool should not corrupt this (but they could set non-linksys values for the locations of the other memory blocks).

PS I'm still looking at PSU requirements for the ADSL2MUE, the 3.3V regulator is an LD1117 A33ARL which may cope with up to 15V input, but there are 8 2200uF 10V capacitors on the incoming supply, so no chance of upping the supply voltage to 12V! [edit] I think my 3.3V regulator is duff - monitoring the voltage on the serial port connector the modem reboots when the voltage drops to 2.7V, so its either the regulator or some device sucking all the power when enabled.
Last edited by mstombs on Mon Sep 29, 2008 11:01 pm, edited 3 times in total.
User avatar
thechief
RouterTech Team
RouterTech Team
Posts: 12067
Joined: Wed Feb 01, 2006 10:22 pm
Location: England, the Centre of Africa
Contact:

Post by thechief » Sun Feb 04, 2007 9:51 pm

Congratulations on your success! It would be good (for posterity and for the curious) if you could post the technical details and screenies ...
The Chief: :afro: Be sure to read the Firmware FAQ and do a Forum Search before posting!
No support via PM. Ask all questions on the open forum.
^Albe^
Regular
Regular
Posts: 50
Joined: Sun Oct 29, 2006 2:17 pm

Post by ^Albe^ » Mon Feb 05, 2007 1:20 am

mstombs wrote: Compared to the Linksys WRT54G the extra connection is required from Vcc (+3.3V) on JTAG pin 14 to TRST on JTAG pin 1 using a 100 ohm resistor.
so the simple jtag works?
i read in the wrt wiki around the ejtag buffered for the 14 pins jtag connector, and that one sounds a bit complex..

NICE! so simply to build this one.. :wink:
mstombs plz stay connected for any further help!! :wink: :D

for the firmware/bootloader question i'm pretty sure that the adsl2mue works well before, i took the wrong rt firmware (for different loader) and after the flash the adsl2mue gone bricked
obv first try was the mrgamers method (as said before already used on my adsl2mue) but no chance.. after i tryed with the ti utility but same results
for a good test i retryed both (ti utility and ssh/telnet connection) to another adsl2mue and no prob at all there (connection ok)
can be that the loader was already erased before the flash? but in this case the adsl2mue can startup ?
^Albe^
Regular
Regular
Posts: 50
Joined: Sun Oct 29, 2006 2:17 pm

Post by ^Albe^ » Mon Feb 05, 2007 7:16 pm

ok! the simple jtag is here : i hope with the true pinout :lol:
connected to the adsl2mue and no explosion at the moment :wink:
downloaded the windows exe v418 for recover the wrt54
test in progress...................

edit1: first try .. houston we have a problem

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***
*** Possible Causes:
1) WRT54G/GS is not Connected.
2) WRT54G/GS is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.

(the same as jtag disconnected..)
the jtag pinout:
connector "jp1"
looking the board with leds near the observer and on the left of the jp1 connector, and.. assuming the square (the nearest to the led and "the more external of the board") like pin 1, the internal one pin 2 and so for the other

jtag pin 1- res 100ohm - jtag pin 14
jtag pin 3- res - lpt 2
jtag pin 5- res - lpt 13
jtag pin 7- res - lpt 4
jtag pin 9- res - lpt 3
jtag pin 2(only pin 2)- lpt 20/25

is that true?
sorry my real poor english , i hope you can understand
mstombs
RouterTech Team
RouterTech Team
Posts: 3753
Joined: Wed Jan 10, 2007 11:54 pm

Post by mstombs » Mon Feb 05, 2007 8:33 pm

Albe,

You are faster than me at posting!

Some useful, but sometimes conflicting! Internet references used

[see picture down at bottom]

http://nuwiki.openwrt.org/oldwiki/AR7Port#jtag
http://nuwiki.openwrt.org/oldwiki/openw ... to.debrick
http://nuwiki.openwrt.org/oldwiki/OpenW ... JTAG_Cable

http://www.linux-mips.org/wiki/JTAG
http://www.linux-mips.org/wiki/ADSL2MUE ... _JTAG_port

http://en.wikipedia.org/wiki/JTAG

Approach similar to the "very poorman interface here" but note I used 50cm ribbon cable, HairyDairyMaid states 75cm but clearly uses a round extension.
http://ar7.wikispaces.com/JTAG

Your pinout looks good here's what I used ADSL2MUE end

Code: Select all

|                                         |
|                      JP1 JTAG           |
|             Vcc +3.3V Pin 14,13         |
|                 GND   Pin 12,11         |
|                 GND   Pin 10,9  TCK     |        Front of ADSL2MUE
|                 GND   Pin 8,7   TMS     |
|                 GND   Pin 6,5   TDO     |
|                 GND   Pin 4,3   TDI     |
|                 GND   Pin 2,1   TRST    |
|                                         led
Parallel Port DB25 ---- > JTAG Pin

2 ---100R---TDI---3
3 ---100R---TCK---9
4 ---100R---TMS---7
13--100R---TDO---5
20,25----GND---8 (could have also used 2,4,10,12 all connected at ADSL2MUE end)

plus

JTAG Pin 1 TRST ---100R---JTAG PIN 14 (Vcc+3.3V)

PC Parallel Port left at its bios default ECP+EPP,0x378

Attached are a couple of pictures of my 'lash up'.

A couple of quick points

1. I used the WRT54G util v 4.8
2. I used Windows version (XP PRO SP2) - you have to use loaddrv.eve and then select the full pathname of giveio.sys before running WRT54G. loaddrv.exe is a bit quirky, have to click install (already done?) then start!

NB "WRT54G -probeonly" should correctly identify the cpu but hangs trying to probe the memory so just CTRL-C to cancel.

Code: Select all

C:\flash>wrt54g -probeonly

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7300GDU Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
    - EJTAG Version ....... : 2.6
    - EJTAG DMA Support ... : No

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x1fc00000) ... ^C
Attachments
adsl2muejtag2.JPG
ADSL2MUE JTAG plugged in
(89.91 KiB) Downloaded 2123 times
adsl2muejtag1.JPG
ADSL2MUE JTAG uplugged
(95.35 KiB) Downloaded 1088 times
Last edited by mstombs on Mon Oct 05, 2009 6:41 pm, edited 6 times in total.
Reason: fixing broken links
^Albe^
Regular
Regular
Posts: 50
Joined: Sun Oct 29, 2006 2:17 pm

Post by ^Albe^ » Mon Feb 05, 2007 9:23 pm

YES!!! thx for the confirm, aftyer read it and after a little control to the bios settings, AND repassed with the solder the jtag connector: all seems ok with the "-probeonly" option

C:\win>wrt54g -probeonly
====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================
Probing bus ... Done
Instruction Length set to 5
CPU Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7300GDU Rev 1 CPU chip ***
- EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
- EJTAG Version ....... : 2.6
- EJTAG DMA Support ... : No
Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Probing Flash at (Flash Window: 0x1fc00000) ... Done
*** Unknown or NO Flash Chip Detected ***
*** REQUESTED OPERATION IS COMPLETE ***

now i must try with the " -flash:custom /noreset /nobreak /nodma /fc:29 /window:0x90000000 /start:0x90000000 /length:0x10000 " ???

aehmm :P custom.bin... which file u suggest?
mstombs
RouterTech Team
RouterTech Team
Posts: 3753
Joined: Wed Jan 10, 2007 11:54 pm

Post by mstombs » Mon Feb 05, 2007 9:29 pm

Great - well done!

yes, NB you need a copy of the 64k pspboot.img, make a copy of it called
CUSTOM.BIN then do:

Code: Select all

wrt54g -flash:custom /noerase /nobreak /nodma /window:0x90000000 /start:0x90000000 /length:0x10000 /nocwd
when I moved on to the config environment it wouldn't work with /noerase so I made a copy of conf.img as CUSTOM.BIN and used the following after power cycling the modem, to always starts at the same point!

Code: Select all

C:\flash>wrt54g -flash:custom /nodma /window:0x90010000 /start:0x90010000 /length:0x10000 /nocwd

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000000000000000001000000001111 (0000100F)
*** Found a TI AR7WRD TNETD7300GDU Rev 1 CPU chip ***

    - EJTAG IMPCODE ....... : 01000001010000000100000000000000 (41404000)
    - EJTAG Version ....... : 2.6
    - EJTAG DMA Support ... : No
    *** DMA Mode Forced Off ***

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Skipped

Probing Flash at (Flash Window: 0x90010000) ... Done

Flash Vendor ID: 00000000000000000000000011000010 (000000C2)
Flash Device ID: 00000000000000000010001010101000 (000022A8)
*** Found a MX29LV320B 2Mx16 BotB      (4MB) Flash Chip ***

    - Flash Chip Window Start .... : 90010000
    - Flash Chip Window Length ... : 00400000
    - Selected Area Start ........ : 90010000
    - Selected Area Length ....... : 00010000

*** You Selected to Flash the CUSTOM.BIN ***

=========================
Flashing Routine Started
=========================
Total Blocks to Erase: 8

Erasing block: 1 (addr = 90010000)...Done
Erasing block: 2 (addr = 90012000)...Done
Erasing block: 3 (addr = 90014000)...Done
Erasing block: 4 (addr = 90016000)...Done
Erasing block: 5 (addr = 90018000)...Done
Erasing block: 6 (addr = 9001a000)...Done
Erasing block: 7 (addr = 9001c000)...Done
Erasing block: 8 (addr = 9001e000)...Done

Loading CUSTOM.BIN to Flash Memory...
[  0% Flashed]   90010000: 4e454954 382e3056 ffffff00 ffffffff
...
[ 99% Flashed]   9001fff0: ffffffff ffffffff ffffffff ffffffff
Done  (CUSTOM.BIN loaded into Flash Memory OK)

=========================
Flashing Routine Complete
=========================
elapsed time: 205 seconds


 *** REQUESTED OPERATION IS COMPLETE ***
That was an RT2.1 config mtd3 by the way!
Last edited by mstombs on Mon Mar 31, 2008 3:56 pm, edited 3 times in total.
^Albe^
Regular
Regular
Posts: 50
Joined: Sun Oct 29, 2006 2:17 pm

Post by ^Albe^ » Mon Feb 05, 2007 9:34 pm

yes and thx to your help
argh so i need to find and solder another connector to the second adsl2mue and read it? :?
mstombs
RouterTech Team
RouterTech Team
Posts: 3753
Joined: Wed Jan 10, 2007 11:54 pm

Post by mstombs » Mon Feb 05, 2007 9:47 pm

^Albe^ wrote:...
argh so i need to find and solder another connector to the second adsl2mue and read it? :?
No, you can either get the pspboot.img from the link on esnips or from your own working adsl2mue using the following from a telnet session into your modem [copied from a post over at linksysinfo].

Make a copy of mtd2 as a file using

Code: Select all

# dd if=/dev/mtdblock/2 of=/var/psp.img
then start a web server on the modem to view the directory contents

Code: Select all

# /usr/sbin/thttpd -g -d /var -u root -p 88
point your PC browser at

http:/192.168.1.1:88/

and click on the file to save to your hard-disk

[NB you can get the other flash blocks the same way, but only 2,3,4, not 0 and 1 when using the RT2.1 firmware]
Last edited by mstombs on Mon Mar 31, 2008 3:56 pm, edited 3 times in total.
^Albe^
Regular
Regular
Posts: 50
Joined: Sun Oct 29, 2006 2:17 pm

Post by ^Albe^ » Mon Feb 05, 2007 9:57 pm

ok, is the same dump so
connecting the second one......... ;)
ty
^Albe^
Regular
Regular
Posts: 50
Joined: Sun Oct 29, 2006 2:17 pm

Post by ^Albe^ » Tue Feb 06, 2007 8:17 pm

yesterday was a bit tired... and i was not able to connect with the adsl2mue :P :lol: :lol: for took the bootloader :lol: :lol:
saved the bootloader (mtd2), and like you say only the command

Code: Select all

-flash:custom /nodma /window:0x90010000 /start:0x90010000 /length:0x10000 /nocwd
works, the other seems to lock or during the watchdog unlock or during the flash probing

unlucky after the succesful flash (or so reported by the utility) the ethernet cable seems not connected to the adsl2mue : :(

a question: i haven't understand this part of yours post
when I moved on to the config environment it wouldn't work with /noerase so I made a copy of conf.img as CUSTOM.BIN and used the following after power cycling the modem, to always starts at the same point!
can u explain it using other words?
thx
^Albe^
Regular
Regular
Posts: 50
Joined: Sun Oct 29, 2006 2:17 pm

Post by ^Albe^ » Tue Feb 06, 2007 10:57 pm

just tryed with an 64k adam2 bootloader (downloaded around in the net), and with it i can see the bootloader ffp server on my adsl2mue:
can be that the dump of /dev/mtdblock/2 using the ssh have a different format of a jtag one?
Post Reply