LEDE 17.01.5 bricks Linksys E2000 (Kernel hangs)

Hi, I tried to upgrade to LEDE 17.01.5 from 17.01.4, but it bricked my router.
After connecting the serial console, i found the kernel hang after
"[ 1.079877] Freeing unused kernel memory: 188K"

Then I have to interrupt the CFE and reflash the 17.01.4 version..

Full 17.01.5 log:

Programming...done. 3739648 bytes written
Check CRC of image1
  Len:     0x391000     (3739648)       (0xBC040000)
  Offset0: 0x1C         (28)            (0xBC04001C)
  Offset1: 0x924        (2340)  (0xBC040924)
  Offset2: 0x127C00     (1211392)       (0xBC167C00)
  Header CRC:    0x3CD1BFBF
  Calculate CRC: 0x3CD1BFBF
Image 1 is OK
Try to load image 1.
CMD: [boot -raw -z -addr=0x80001000 -max=0x6ff000 flash0.os:]
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3864 bytes read

### Start=-1540134652 E=-1539400839 Delta=733813 ###
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
[    0.000000] Linux version 4.4.140 (buildbot@builds-02.infra.lede-project.org) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3104-41de9a2) ) #0 Fri Jul 13 19:25:14 2018
[    0.000000] CPU0 revision is: 00019740 (MIPS 74Kc)
[    0.000000] bcm47xx: Using bcma bus
[    0.000000] bcma: bus0: Found chip with id 0x4716, rev 0x01 and package 0x09
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line:  noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 28388K/32768K available (3006K kernel code, 139K rwdata, 368K rodata, 188K init, 294K bss, 4380K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:128
[    0.000000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x1F, class 0x0)
[    0.000000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x11, class 0x0)
[    0.000000] bcma: bus0: Core 2 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x00, class 0x0)
[    0.000000] bcma: bus0: Core 3 found: MIPS 74K (manuf 0x4A7, id 0x82C, rev 0x01, class 0x0)
[    0.000000] bcma: bus0: Core 4 found: USB 2.0 Host (manuf 0x4BF, id 0x819, rev 0x04, class 0x0)
[    0.000000] bcma: bus0: Core 5 found: PCIe (manuf 0x4BF, id 0x820, rev 0x0E, class 0x0)
[    0.000000] bcma: bus0: Core 6 found: DDR1/DDR2 Memory Controller (manuf 0x4BF, id 0x82E, rev 0x01, class 0x0)
[    0.000000] bcma: bus0: Core 7 found: Internal Memory (manuf 0x4BF, id 0x80E, rev 0x07, class 0x0)
[    0.000000] bcma: bus0: Core 8 found: I2S (manuf 0x4BF, id 0x834, rev 0x00, class 0x0)
[    0.000000] bcma: bus0: Found M25P64 serial flash (size: 8192KiB, blocksize: 0x10000, blocks: 128)
[    0.000000] bcma: bus0: Early bus registered
[    0.000000] MIPS: machine is Linksys E2000 V1
[    0.000000] bcm47xx: Setting up vectored interrupts
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 10798081617 ns
[    0.000020] sched_clock: 32 bits at 177MHz, resolution 5ns, wraps every 12132675581ns
[    0.000109] Calibrating delay loop... 176.53 BogoMIPS (lpj=882688)
[    0.070062] pid_max: default: 32768 minimum: 301
[    0.070386] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.070427] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.075432] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.075502] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.077078] NET: Registered protocol family 16
[    0.078382] Can't analyze schedule() prologue at 800077c8
[    0.103997] clocksource: Switched to clocksource MIPS
[    0.106695] NET: Registered protocol family 2
[    0.108779] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.108854] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.108905] TCP: Hash tables configured (established 1024 bind 1024)
[    0.109114] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.109179] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.109744] NET: Registered protocol family 1
[    0.174175] bcma: bus0: PCIEcore in host mode found
[    0.174199] bcma: bus0: This PCIE core is disabled and not working
[    0.176094] bcma: bus0: Bus registered
[    0.177860] Crashlog allocated RAM at address 0x1f00000
[    0.219991] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.220033] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.226594] io scheduler noop registered
[    0.226640] io scheduler deadline registered (default)
[    0.227125] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.233654] console [ttyS0] disabled
[    0.253970] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2, base_baud = 1250000) is a U6_16550A
[    0.701827] console [ttyS0] enabled
[    0.729337] 6 bcm47xxpart partitions found on MTD device bcm47xxsflash
[    0.736082] Creating 6 MTD partitions on "bcm47xxsflash":
[    0.741607] 0x000000000000-0x000000040000 : "boot"
[    0.752006] 0x000000040000-0x0000007f0000 : "firmware"
[    0.761309] 0x0000007f0000-0x000000800000 : "nvram"
[    0.770305] 0x00000004001c-0x000000040924 : "loader"
[    0.779403] 0x000000040924-0x000000167c00 : "linux"
[    0.788495] 0x000000167c00-0x0000007f0000 : "rootfs"
[    0.797620] mtd: device 5 (rootfs) set to be root filesystem
[    0.803445] 1 squashfs-split partitions found on MTD device rootfs
[    0.809896] 0x000000390000-0x0000007f0000 : "rootfs_data"
[    0.823599] libphy: Fixed MDIO Bus: probed
[    0.828246] bgmac_bcma bcma0:2: Found PHY addr: 30 (NOREGS)
[    0.838253] libphy: bcma_mdio mii bus: probed
[    0.842742] bgmac_bcma bcma0:2: Support for Roboswitch not implemented
[    1.001205] b53_common: found switch: BCM53115, rev 8
[    1.008180] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded
[    1.014819] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds)
[    1.025508] NET: Registered protocol family 10
[    1.037913] NET: Registered protocol family 17
[    1.042628] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.055588] 8021q: 802.1Q VLAN Support v1.8
[    1.071003] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    1.079877] Freeing unused kernel memory: 188K

Does anyone have solution to this problem?
Thank you!

The 17.01.4 (which is working) log belog:

[    0.000000] Linux version 4.4.92 (buildbot@builds-02.infra.lede-project.org) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3104-41de9a2) ) #0 Tue Oct 17 17:46:20 2017
[    0.000000] CPU0 revision is: 00019740 (MIPS 74Kc)
[    0.000000] bcm47xx: Using bcma bus
[    0.000000] bcma: bus0: Found chip with id 0x4716, rev 0x01 and package 0x09
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] On node 0 totalpages: 8192
[    0.000000] free_area_init_node: node 0, pgdat 8034e4c0, node_mem_map 81000000
[    0.000000]   Normal zone: 64 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 8192 pages, LIFO batch:0
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line:  noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 28452K/32768K available (2979K kernel code, 134K rwdata, 368K rodata, 156K init, 294K bss, 4316K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:128
[    0.000000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x1F, class 0x0)
[    0.000000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x11, class 0x0)
[    0.000000] bcma: bus0: Core 2 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x00, class 0x0)
[    0.000000] bcma: bus0: Core 3 found: MIPS 74K (manuf 0x4A7, id 0x82C, rev 0x01, class 0x0)
[    0.000000] bcma: bus0: Core 4 found: USB 2.0 Host (manuf 0x4BF, id 0x819, rev 0x04, class 0x0)
[    0.000000] bcma: bus0: Core 5 found: PCIe (manuf 0x4BF, id 0x820, rev 0x0E, class 0x0)
[    0.000000] bcma: bus0: Core 6 found: DDR1/DDR2 Memory Controller (manuf 0x4BF, id 0x82E, rev 0x01, class 0x0)
[    0.000000] bcma: bus0: Core 7 found: Internal Memory (manuf 0x4BF, id 0x80E, rev 0x07, class 0x0)
[    0.000000] bcma: bus0: Core 8 found: I2S (manuf 0x4BF, id 0x834, rev 0x00, class 0x0)
[    0.000000] bcma: bus0: Found rev 5 PMU (capabilities 0x11242C05)
[    0.000000] bcma: bus0: Found serial flash
[    0.000000] bcma: bus0: Found M25P64 serial flash (size: 8192KiB, blocksize: 0x10000, blocks: 128)
[    0.000000] bcma: bus0: Early bus registered
[    0.000000] MIPS: machine is Linksys E2000 V1
[    0.000000] bcm47xx: Setting up vectored interrupts
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 10798081617 ns
[    0.000020] sched_clock: 32 bits at 177MHz, resolution 5ns, wraps every 12132675581ns
[    0.000107] Calibrating delay loop... 176.53 BogoMIPS (lpj=882688)
[    0.070071] pid_max: default: 32768 minimum: 301
[    0.070396] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.070434] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.075364] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.075432] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.076992] NET: Registered protocol family 16
[    0.078305] Can't analyze schedule() prologue at 800077c8
[    0.103750] clocksource: Switched to clocksource MIPS
[    0.106493] NET: Registered protocol family 2
[    0.108590] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.108664] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.108717] TCP: Hash tables configured (established 1024 bind 1024)
[    0.108933] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.108996] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.109557] NET: Registered protocol family 1
[    0.109678] PCI: CLS 0 bytes, default 32
[    0.174369] bcma: bus0: Using SPROM revision 8 provided by platform.
[    0.174422] bcma: bus0: PMU resource config unknown or not needed for device 0x4716
[    0.176443] bcma: bus0: Workarounds unknown or not needed for device 0x4716
[    0.176467] bcma: bus0: Initializing MIPS core...
[    0.176494] bcma: bus0: Moved i2s interrupt to oob line 7 instead of 8
[    0.176528] bcma: bus0: set_irq: core 0x0812, irq 3 => 3
[    0.176558] bcma: bus0: set_irq: core 0x082d, irq 4 => 4
[    0.176587] bcma: bus0: set_irq: core 0x0819, irq 5 => 5
[    0.176616] bcma: bus0: set_irq: core 0x0820, irq 6 => 6
[    0.176644] bcma: bus0: set_irq: core 0x0800, irq 2 => 2
[    0.176672] bcma: bus0: set_irq: core 0x0834, irq 0 => 2
[    0.176691] bcma: bus0: IRQ reconfiguration done
[    0.176713] bcma: core 0x0800, irq : 2(S)* 3  4  5  6  D  I 
[    0.176776] bcma: core 0x0812, irq : 2(S)  3* 4  5  6  D  I 
[    0.176833] bcma: core 0x082d, irq : 2(S)  3  4* 5  6  D  I 
[    0.176889] bcma: core 0x082c, irq : 2(S)  3  4  5  6  D  I*
[    0.176945] bcma: core 0x0819, irq : 2(S)  3  4  5* 6  D  I 
[    0.177002] bcma: core 0x0820, irq : 2(S)  3  4  5  6* D  I 
[    0.177059] bcma: core 0x082e, irq : 2(S)  3  4  5  6  D* I 
[    0.177114] bcma: core 0x080e, irq : 2(S)  3  4  5  6  D  I*
[    0.177169] bcma: core 0x0834, irq : 2(S)* 3  4  5  6  D  I 
[    0.177227] bcma: bus0: PCIEcore in host mode found
[    0.177248] bcma: bus0: This PCIE core is disabled and not working
[    0.179168] bcma: bus0: Bus registered
[    0.180925] Crashlog allocated RAM at address 0x1f00000
[    0.221354] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.221397] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.227843] io scheduler noop registered
[    0.227890] io scheduler deadline registered (default)
[    0.228426] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.235125] console [ttyS0] disabled
[    0.255430] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2, base_baud = 1250000) is a U6_16550A
[    0.702773] console [ttyS0] enabled
[    0.747795] 6 bcm47xxpart partitions found on MTD device bcm47xxsflash
[    0.754533] Creating 6 MTD partitions on "bcm47xxsflash":
[    0.760061] 0x000000000000-0x000000040000 : "boot"
[    0.770384] 0x000000040000-0x0000007f0000 : "firmware"
[    0.779637] 0x0000007f0000-0x000000800000 : "nvram"
[    0.788616] 0x00000004001c-0x00000004091c : "loader"
[    0.797678] 0x00000004091c-0x000000166000 : "linux"
[    0.806736] 0x000000166000-0x0000007f0000 : "rootfs"
[    0.815783] mtd: device 5 (rootfs) set to be root filesystem
[    0.821603] 1 squashfs-split partitions found on MTD device rootfs
[    0.828041] 0x000000380000-0x0000007f0000 : "rootfs_data"
[    0.841805] libphy: Fixed MDIO Bus: probed
[    0.846421] bgmac_bcma bcma0:2: Found PHY addr: 30 (NOREGS)
[    0.856469] libphy: bcma_mdio mii bus: probed
[    0.860952] bgmac_bcma bcma0:2: Support for Roboswitch not implemented
[    1.021054] b53_common: found switch: BCM53115, rev 8
[    1.028036] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded
[    1.034648] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds)
[    1.045345] NET: Registered protocol family 10
[    1.057751] NET: Registered protocol family 17
[    1.062467] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.075427] 8021q: 802.1Q VLAN Support v1.8
[    1.089292] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
**[    1.097909] Freeing unused kernel memory: 156K**
[    2.792434] init: Console is alive
[    2.796609] init: - watchdog -
[    3.971149] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.126856] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.136616] init: - preinit -
[    4.771371] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    6.393855] bgmac_bcma bcma0:2 eth0: Link is Up - 1Gbps/Full - flow control off
[    6.401446] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    6.882612] random: procd: uninitialized urandom read (4 bytes read, 11 bits of entropy available)
[   10.407794] jffs2: notice: (307) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   10.426985] mount_root: overlay filesystem has not been fully initialized yet
[   10.441304] mount_root: switching to jffs2 overlay
[   10.458357] urandom-seed: Seed file not found (/etc/urandom.seed)
[   10.815073] procd: - early -
[   10.818330] procd: - watchdog -
[   11.604035] procd: - watchdog -
[   11.608176] procd: - ubus -
[   11.762191] random: ubusd: uninitialized urandom read (4 bytes read, 19 bits of entropy available)
[   11.773524] random: ubusd: uninitialized urandom read (4 bytes read, 19 bits of entropy available)
[   11.784026] random: ubusd: uninitialized urandom read (4 bytes read, 19 bits of entropy available)
[   11.793304] random: ubusd: uninitialized urandom read (4 bytes read, 19 bits of entropy available)
[   11.803579] random: ubusd: uninitialized urandom read (4 bytes read, 19 bits of entropy available)
[   11.812977] random: ubusd: uninitialized urandom read (4 bytes read, 19 bits of entropy available)
[   11.822860] random: ubusd: uninitialized urandom read (4 bytes read, 19 bits of entropy available)
[   11.832754] random: ubusd: uninitialized urandom read (4 bytes read, 19 bits of entropy available)
[   11.843124] procd: - init -
[   12.988949] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.004562] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   13.035252] Loading modules backported from Linux version wt-2017-01-31-0-ge882dff19e7f
[   13.043422] Backport generated by backports.git backports-20160324-13-g24da7d3c
[   13.057821] ip_tables: (C) 2000-2006 Netfilter Core Team
[   13.079536] nf_conntrack version 0.5.0 (447 buckets, 1788 max)
[   13.156406] xt_time: kernel timezone is -0000
[   13.267468] PPP generic driver version 2.4.2
[   13.277520] NET: Registered protocol family 24
[   13.306333] b43-phy0: Broadcom 4716 WLAN found (core revision 17)
[   13.313735] b43-phy0: Found PHY: Analog 8, Type 4 (N), Revision 5
[   13.320087] b43-phy0: Found Radio: Manuf 0x17F, ID 0x2056, Revision 7, Version 0
[   13.328452] Broadcom 43xx driver loaded [ Features: NL ]
[   13.339840] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   13.483984] kmodloader: done loading kernel modules from /etc/modules.d/*
[   15.618355] random: jshn: uninitialized urandom read (4 bytes read, 25 bits of entropy available)

I have experienced the same issue. I was just upgrading an E2000 from ChaosCalmer to the latest and I successfully installed 18.06.0rc1. When I tried to update it to 18.06.0rc2, it failed but the tftp server was still running. So, IIRC, I tried 17.01.4 which worked, then 17.01.5 kinda bricked the unit... tftp server was running but didn't seem to really be accepting the image (it would accept files, but still wouldn't boot properly even if I used 17.01.4 or even the stock firmware)... Then I tried installing DD-WRT (recommended as a potential de-brick method) and it totally hosed it. Now it doesn't seem to bring up the TFTP server anymore, so I'll have to attempt a serial recovery when I have some time to mess with it.

Interestingly, I also had an E3000 lying around and had the same issues, but managed to get 17.01.4 back on it and running properly. I think it is likely that there is something broken in both 17.01.5 and 18.06.0rc2 that affects these older devices.

I opened a bug report:
https://bugs.openwrt.org/index.php?do=details&task_id=1697

1 Like

Thanks for the report, fix pushed to the lede-17.01 branch. We'll have to wait for the 17.01.6.