04-17-2012 03:28 AM - edited 04-17-2012 03:30 AM
ugh i cant tell whats wrong any more.
I tried to TFTP from another computer, change the LAN port on the router ... and TFTP reported successful all the time...
I even waited 30 min - 1 hr after each flash (i can bring it to work) ...
I also posted on OpenWRT forum, seems like there was another one who ran into this problem. But no reply there so far. That guy also stated that many time the flashing did not work...
Im afraid it may be bricked, if not you wouldnt have a whole guide to debrick it using a serial cable to run console ...
05-03-2012 04:43 PM
Yet another request. Hopefully I give just the right amount of info about what I've tried. BTW, I have a WZR-G300NHv1 (A0 D0).
I have followed your tftp instructions (basicallly, though I did add some "improvements"). I used linux, and used the following tftp params: rexmt 1, binary, verb, trace, timeout 1000. I was connected to port 4 (right next to the WAN port). Before doing all this, I set the computer's ethernet interface to 100T/full duplex/no autonegotiation, and I set a static IP address on my computer's eth0 port, and a static arp mapping of the router's IP to the router's MAC.
When I start the put command and plug in the router, the tftp attempts to retransmit 1000 times at 1 second intervals, but never sends a byte. During the tftp put attempts, I can verify that the interface settings are all still correct (computer interface is up and the IP address is set, arp map is correct, route shows route to router ip over eth0). The tftp put command times out.
I have repeated this using router IP addresses 192.168.11.1 and 192.168.1.1 (with matching computer IP addresses of 192.168.11.2 and 192.168.11.1 respectively) and router MAC addresses (the one on the router label, 02:aa:bb:cc:20, and 02:aa:bb:cc:1a) in all combinations sequentially with the same result. From the outside, it appears as though the router is booting the bootloader (the diag light comes on after 2 seconds, and stays solid for ~10 seconds, then flashes twice every three seconds forever). However, no tftp connection is ever made. Can you refer me to JTAG pinout data and JTAG client software, or serial debricking instructions? Or perhaps I've done something stupid?
05-03-2012 10:07 PM
Not exactly that you did something stupid, you just didn't follow my guide the way it is. Your 'improvements' may be the culprit, who knows *shrug*
One thing for sure is the timing and using a hardware switch in-between. Beyond this, i am not sure what exactly you are doing wrong.
Also AFAIK, there is no jtag recovery with this unit. Serial only. So one thing is very important here, that you didn't mess up the bootloader.
05-04-2012 11:59 AM
First, thank you for your help and advice.
I don't think the "improvements" are to blame -- they just take the timing out of the equation by repeating the connection attempt every second for 1000 seconds (which makes it very hard to miss a 4 second window). I avoid having to use a switch by setting the speed of the i/f to 100BaseT, disabling autonegotiation of data rate, and placing a static arp table entry for the router and ip address on the interface. That way the interface doesn't go down and have to come back up when the router comes alive. These are improvements recommended on various sites, including the OpenWRT site you linked. (See the tftp method instructions for Linux).
I don't know what I could have done to mess up the bootloader, since I used the web interface to flash it (with OpenWRT). I left it for an hour, but it never rebooted.
Do you know a reference for using the serial pins to reflash it? Is it possible if the bootloader doesn't setup the ethernet ports for some reason?
05-04-2012 08:28 PM
The reference was the openwrt link i posted, it has the pinouts for the serial connection. Another interesting factor i am curious to know, what is the name of the file you are using to recover with?
05-05-2012 02:20 PM
I tried both of the following files:
Does the tftp server check filenames? With 'trace' on my tftp client, I should see data transferred, but none ever is. So the router isn't downloading then rejecting the image -- it just simply never accepts the image at all. It's like either the ethernet port is not set up by uboot, or there is no tftp server running at all on the router. Even if it were only a 2 second window, I should still hit it 100% of the time with a rexmt rate of 1 second.
Yes, I saw the pinout diagram, but don't know what to do once I get a serial console on the bootloader, assuming I'm successful. (It was awfully clever of Buffalo to put security hex screws in the cover. I wonder how I'll get it open.) Are there instructions somewhere for reflashing from a serial terminal?
BTW, I started wireshark, and see that the router never sends any local network discovery packets, either (e.g. arp). Should it?
05-05-2012 04:40 PM - edited 05-05-2012 04:43 PM
To answer your question about wireshark, no, if the unit is bricked which we already know it is, then no it won't send anything out.
Here is the guide on how to de-brick your router via serial console, assuming that like i said, your bootloader isn't fubar...
Also one interesting fact that you seem to never list here, how originally did you brick the unit? And be honest, because if you leave out any important details, i won't be able to know exactly how bad off your are here.
05-09-2012 11:01 AM
Sorry for the hiatus.
I compiled OpenWRT trunk, built an image using imagebuilder, and attempted to flash it to the router using the web interface of a previous OpenWRT installation. It never rebooted, even after an hour.
Thanks for the link.