E1000 confusion

Discussion in 'Tomato Firmware' started by Mangix, Aug 1, 2012.

  1. Mangix

    Mangix Networkin' Nut Member

    I have two E1000, a v1 and a v2. The v2 i recently flashed to the mini build. Only problem is, I want IPv6 as well but the MiniIPv6 builds is over 4000 kB which should be above what can actually be placed on the router. So can I? Or do I have to flash an RT build? Will that even work?

    Ditto for the E1000v1. Can I flash it with an RT-N build?
  2. Mangix

    Mangix Networkin' Nut Member

    like an idiot, I flashed an RT build onto the E1000v2 and bricked it. I hope serial recovery works. Now if I only had a Security Torx screwdriver...
  3. imcamper

    imcamper Networkin' Nut Member

    Sorry about that but thanks for the post. I have an E1000 v 2.1 and have been wondering what I can flash (if anything). I was thinking that this build would work:


    But is this the one you flashed and bricked your router?

    Can I flash this one:

  4. Mangix

    Mangix Networkin' Nut Member

    no. I flashed a similar RT (not -N) build and bricked it.

    Your only choice is Mini or Tiny. RT-N build of course.

    If you're flashing from the stock linksys firmware, flash a build with E1000v2 in the name. If you're flashing from tomato or dd-wrt, flash a regular one.
    imcamper likes this.
  5. imcamper

    imcamper Networkin' Nut Member

    Ah, please ignore my last comment in the other thread about getting my E1000 flashed to free up a WNR2000 for testing. This answers that. Thanks!!!
  6. imcamper

    imcamper Networkin' Nut Member

    After bricking my WNR2000 at some point during my flash fest, I came across this post that explained how to unbrick a WNR2000. I didn't have a small Torx screwdriver either but managed to use a small flat blade eyeglass screwdriver that fit between two of the torx points and got it open.

    I'm also happy to report that the info in that thread got me going again. For me, I had to short the pins just after powering on. Took a few tries but when I got it right, the power light blinked green right away.
  7. imcamper

    imcamper Networkin' Nut Member

    Well now I've done it. I'm an idiot. In trying to flash my E1000, I mixed up firmware and flashed the RT build instead of RT-N. Thus I'm now in the same position as you. Guess I need a security torx as well... :(

    Please let me know if you find a way to unbrick short of opening and figuring out how the serial cable thing works. I'll do the same for you.

  8. Mangix

    Mangix Networkin' Nut Member

    yep. at least JTAG isn't required to fix it. I bought a pack of security bits so fixing it should be fun.
  9. Mangix

    Mangix Networkin' Nut Member

    update: serial worked.

    you're not going to find any way to fix it short of serial. the LAN ports don't work and neither does the wireless.
  10. imcamper

    imcamper Networkin' Nut Member

    Thanks for the update. I've been reading. It seems that I need to solder the proper wires of a Nokia CA-2 cable to the right pins of a 5 pin header and then shove that header into the 5 holes near the processor? I guess I have it right. Still trying to figure out where to get the Nokia cable. Is this what you did?

    Nice thing is that if I really screw it up, I'll just hope to find another refurb for $20. Obviously this is becoming more of a learning exercise for next time than about saving a $20 router since I already spend $25 on a bit set. :)
  11. Mangix

    Mangix Networkin' Nut Member

  12. imcamper

    imcamper Networkin' Nut Member

    Thank you. That looks much easier. I'll see if my local electronics supply has these parts or if I need to order.
  13. whoisnader

    whoisnader Networkin' Nut Member

    I just looked at Build 100 compared to 95 of Shibby Tomato for the E1000v2 and it is getting bigger, not smaller. There appears to be no chance of ever getting MiniIPv6 on these routers.

    Shibby can something be removed from the builds to reduce the size of MiniIPv6 so that it can be installed on the E1000v2 router.
  14. imcamper

    imcamper Networkin' Nut Member

    I finally got back to this. Soldered the header onto the board. Used a USB TTL adapter as suggested by Mangix.

    I think I have it all soldered and connected correctly as I get the following output when booting the router:

    Start to blink diag led ...
    CFE version  based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
    Build Date: 12/03/10 16:33:20 CST (wzh@cybertan)
    Copyright (C) 2000-2008 Broadcom Corporation.
    Initializing Arena
    Initializing Devices.
    No DPN
    This is a Serial Flash
    Boot partition size = 262144(0x40000)
    Found a 4MB ST compatible serial flash
    Partition information:
    boot    #00  00000000 -> 0003FFFF  (262144)
    trx    #01  00040000 -> 0004001B  (28)
    os      #02  0004001C -> 003F7FFF  (389  #01  00040000 -> 003F7FFF  (3899392)
    nvram  #02  003F8000 -> 003FFFFF  (32768)
    et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller
    CPU type 0x19749: 300MHz
    Total memory: 32768 KBytes
    CFE mem:    0x80700000 - 0x807A7E70 (687728)
    Data:      0x8073DF70 - 0x807411B0 (12864)
    BSS:        0x807411B0 - 0x80741E70 (3264)
    Heap:      0x80741E70 - 0x807A5E70 (409600)
    Stack:      0x807A5E70 - 0x807A7E70 (8192)
    Text:      0x80700000 - 0x8073DF6C (253804)
    Boot version: v5.1.8
    The boot is CFE
    mac_init(): Find mac [c0:c1:c0:a6:cc:bc] in location 0
    CMD: [ifconfig eth0 -addr= -mask=]
    Device eth0:  hwaddr C0-C1-C0-A6-CC-BC, ipaddr, mask
            gateway not set, nameserver not set
    CMD: [go;]
    Check CRC of image1
      Len:    0x3A9000    (3837952)      (0xBC040000)
      Offset0: 0x1C        (28)            (0xBC04001C)
      Offset1: 0xAD8        (2776)  (0xBC040AD8)
      Offset2: 0xE3C00      (932864)        (0xBC123C00)
      Header CRC:    0xA7A3BC6D
      Calculate CRC: 0xA7A3BC6D
    Image 1 is OK
    Try to load image 1.
    Waiting for 5 seconds to upgrade ...
    CMD: [load -raw -addr=0x807a7e70 -max=0x1858190 :]
    Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
    Loading: _tftpd_open(): retries=0/5
    _tftpd_open(): retries=1/5
    _tftpd_open(): retries=2/5
    _tftpd_open(): retries=3/5
    _tftpd_open(): retries=4/5
    ### Start=649117360 E=1611102632 Delta=961985272 ###
    Could not load :: Timeout occured
    CMD: [boot -raw -z -addr=0x80001000 -max=0x6ff000 flash0.os:]
    Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
    Loading: .. 5192 bytes read
    ### Start=1615440410 E=1617565972 Delta=2125562 ###
    Entry at 0x80001000
    Closing network.
    Starting program at 0x80001000
    Linux version (root@tomato) (gcc version 4.2.4) #25 Fri Jun 15 22:45:15 ICT 2012
    CPU revision is: 00019749
    Found a 4MB ST compatible serial flash
    Determined physical RAM map:
    memory: 02000000 @ 00000000 (usable)
    Zone PFN ranges:
      Normal          0 ->    8192
      HighMem      8192 ->    8192
    early_node_map[1] active PFN ranges
        0:        0 ->    8192
    Built 1 zonelists.  Total pages: 8192
    Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
    Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
    Primary data cache 32kB, 4-way, linesize 32 bytes.
    Synthesized TLB refill handler (20 instructions).
    Synthesized TLB load handler fastpath (32 instructions).
    Synthesized TLB store handler fastpath (32 instructions).
    Synthesized TLB modify handler fastpath (31 instructions).
    PID hash table entries: 256 (order: 8, 1024 bytes)
    CPU: BCM5357 rev 1 pkg 8 at 80 MHz
    Using 40.000 MHz high precision timer.
    console [ttyS0] enabled
    Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
    Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
    Memory: 28664k/32768k available (33k kernel code, 4088k reserved, 2669k data, 124k init, 0k highmem)
    Mount-cache hash table entries: 512
    NET: Registered protocol family 16
    PCI: no core
    PCI: Fixing up bus 0
    Time: MIPS clocksource has been installed.
    NET: Registered protocol family 2
    IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
    TCP established hash table entries: 1024 (order: 1, 8192 bytes)
    TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
    TCP: Hash tables configured (established 1024 bind 1024)
    TCP reno registered
    squashfs: version 3.0 (2006/03/15) Phillip Lougher
    io scheduler noop registered (default)
    HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
    N_HDLC line discipline registered.
    Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
    serial8250: ttyS0 at MMIO 0xb8000300 (irq = 8) is a 16550A
    PPP generic driver ver7
    PPTP driver version 0.8.5
    pflash: found no supported devices
    Creating 5 MTD partitions on "sflash":
    0x00000000-0x00040000 : "pmon"
    0x00040000-0x003f0000 : "linux"
    0x00123c00-0x003f0000 : "rootfs"
    0x003f0000-0x00400000 : "jffs2"
    0x003f0000-0x00400000 : "nvram"
    u32 classifier
        OLD policer on
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (512 buckets, 4096 max)
    ip_tables: (C) 2000-2006 Netfilter Core Team
    ipt_account 0.1.21 : Piotr Gasidlo <quaker@barbara.eu.org>, http://www.barbara.eu.org/~quaker/ipt_account/
    net/ipv4/netfilter/tomato_ct.c [Jun 15 2012 22:44:52]
    NET: Registered protocol family 1
    NET: Registered protocol family 10
    ip6_tables: (C) 2000-2006 Netfilter Core Team
    NET: Registered protocol family 17
    802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
    All bugs added by David S. Miller <davem@redhat.com>
    VFS: Mounted root (squashfs filesystem) readonly.
    Freeing unused kernel memory: 124k freed
    Warning: unable to open an initial console.
    emf: module license 'Proprietary' taints kernel.
    eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller
    eth%d: driver failed with code 12
    / # vlan0: No such device
    eth1: No such device
    eth2: No such device
    eth3: No such device
    lo: File exists
    This page says I have to break the boot cycle by pressing CTL-C quite quickly. Then at a CFE prompt I can "nvram erase" to clear. However I can't seem to get to a CFE prompt. I have tried many times. Even pressing CTL-C repeatedly while powering up the router. No luck.

    Any suggestions? Am I missing any steps?


  15. Mangix

    Mangix Networkin' Nut Member

    When i got a serial console, i waited until the firmware fully booted up. If you flashed the bad build of tomato properly, you should get access to tomato's shell, usually without login. I then typed reboot, hit enter, and started hitting Ctrl+C like crazy. Worked fine for me.

    I have to mention. Do NOT type 'go' after flashing the firmware through TFTP. Either type reboot or power cycle the router. Typing 'go' will cause a brick. That's what happened to my E1500 when I tried serial recovery on it.
  16. imcamper

    imcamper Networkin' Nut Member

    OK, I finally got my e1000 working again via serial access. You have to be *really* fast with the ctrl-C. And in my experience you have to get it before the "go" command executes or else the flash command will never work. And even at that, you have to try tftp many times because it is so fast as well. Bottom line is that it took me several hours of messing around. I had to flash an old DD-WRT (build 16968) to avoid error messages from the CFE prompt. Then after flashing that, I was able to flash newer versions of both DD-WRT or Tomato. And remember to issue 'nvram erase' after each flash or you may have weird issues.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice