Recovering Bricked HD Phone

If a phone has been interrupted while upgrading its firmware, it can get into a "bricked" state.  (Note a network interruption should not cause this because the phones verify the downloaded file).  When bricked, the phone may partially boot, some lights may lamp, and the LCD may be backlit but the phone will not boot fully. Generally it will say "Initializing, Please Wait".Below are steps to resolve this.

Note on Newer Bootloader for V2 Phones

On newer V2 phones, IP410v2, IP320v2 IP620v2 and IP330v2.

You can press '#' when the lights flash as the phone boots up, this will display: NOTE: It is very important to press pound when you see this lights all light on the phone. Hold the # key until you see something change on the display.

Security Mode

If the phone shows "Security Mode" as in the image below, you will need to do the following:

You will then see a menu presenting options for setting the network. 

Select Menu, then View Network. 

You can then view the phone's IP address. If the phone does not have an IP address, you can set one.

Log in to the phone at this IP address and you will see a web page allowing you to upload phone firmware. This firmware is downloaded from the PBX, found under PBX Setup=>Services=>TFTP Files.

Video of unbricking with # key https://www.youtube.com/watch?v=WxBzEi5bYA8&feature=youtube_gdata

Manually Un-bricking HD phones

Kernel Download

If the phone shows "kernel download" as in the image below, you will need to do the following:

Reboot the phone, and when its lights come on, press and hold '#'. If you watch the Pumpkin server window, you should see a request from 192.168.0.200, downloading the kernel first, then the application, and the phone's screen should indicate that it is downloading or applying each of these files. Let this process run, and the phone should automatically recover.

Blank/lit screen with no text

When holding # on bootup, you get just a blank screen, either lit, or in the case of a color phone, a solid color, the phone may still have set itself to 192.168.0.200

Open up a command prompt window using “cmd” from the Run screen. For Windows 7 users you might have to enable “telnet” from the control panel settings (http://www.wikihow.com/Activate-Telnet-in-Windows-7). With the corrupted phone powered up on the network type the following command “telnet 192.168.0.200”. You should see a login prompt, login with root and for the password use root. This will display a “ # “ for the prompt. Open up My Computer and find the folder from the C drive tftpboot . Highlight the firmware filename and do copy, move back to the command line window, and at the pound type “upload.sh < then do paste of the file name > 192.168.0.20. This address will be your PC where the TFTP server is running. Wait for the upload to begin with four or five different things happing. After the upload is completed it will show “Connection Lost” which means the phone is rebooting. The phone should come up with the original extension number. On it’s own it might load the configuration and even an upgrade. At this point do not remove power or try to make calls. When update itself this could take three or four minutes.

Setting up a TFTP server

1: Create a folder from the “C:\ “, then name it “tftpboot” on your PC.

2: Log into the PBX and navigate down to PBX Setup > Services page, locate the TFTP Files section , select the blue file link. In this section as an example for an IP320 V1 model phone select the file name “S_IP320_IPITOMY_version2.2.9.3-3889 ”. Then copy it into the “tftpboot” folder. You may add other firmware files to this folder as needed from the PBX. For V2 models the file name would be “S2_IP320N_version2.2.9.2-3412”. You will also need to locate the kernel file in the TFTP files section. For an IP320 V2 model, for example, the file would be "K2_uImage_100N_v2.6.4". Download both the firmware and the kernel, put both in your tftpboot folder, and rename them as follows. The firmware will be renamed to "application". The kernel will be renamed to "kernel".

3: Down load “Pumpkin” from here File:Pumpkin-2.7.3.zip

4: After downloading Pumpkin, install and run the program.

5: Select “Options” under the Server tab at the top of the screen and look for the heading, “ TFTP filesystem root (download path)”. Using the button browse to the right, change the setting for “C:\tftpboot”. This will set the path for the HD phones to retrieve their firmware. Check in the lower right hand corner there is a check mark for “server is running.

6: In the same screen for the “Read Request Behavior” and “Write Request Behavior” below, change the settings to “Give all files and Take all files”. This will eliminate the prompts from Pumpkin when the phone retrieves the firmware.

7: On your PC bring up “Control Panel” > Network Connections > Local Area Connection > Properties > Internet Protocol [TCP/IP], select Properties. Change the settings from “ Obtain an IP address automatically” to “Use the following IP address”. The static address should be “192.168.0.201” with a Subnet mask of “255.255.255.0 and a Default gateway of “192.168.0.1 on your PC. The phone will fall back to an address of “192.168.0.200” when the firmware becomes corrupt. Some times the address could fall back to “192.168.0.202”, but it is rare.

Firmware Versions

Model	Hardware Version	Kernel CFG	Firmware CFG	Kernel File	Firmware File Prefix	IPitomy Prov String
IP210	1	k000200.cfg	k000300.cfg	K_uImage_200.bin	S_IP210_IPITOMY_version	IP210
IP310	1	k000300.cfg	f000300.cfg	K_uImage_300.bin	S_IP310_IPITOMY_version	IP310
IP320	1	k000300.cfg	f000320.cfg	K_uImage_300.bin	S_IP320_IPITOMY_version	IP320
IP410	1	k000400.cfg	f000400.cfg	K_uImage_400.bin	S_IP410_IPITOMY_version	IP410
IP620	1	k000600.cfg	f000600.cfg	K_uImage_600.bin	S_IP620_IPITOMY_version	IP620
WI320	1	k000300.cfg	f0ws320.cfg	K_uImage_300.bin	S_WS320_IPITOMY_version	WS320
IP330	1	k000330.cfg	f000330.cfg	K_uImage_330.bin	S_IP330_IPITOMY_version	IP330
ALL	2	Same as v1 but kdXXXXXX.cfg	Same as v1 but fdXXXXXX.cfg	One Kernel File for all models	Same as V1 but starts with S2	Same as V1