OUR NETWORK:TouchSmart Community TiVo Community TechLore Sling Community My DigitalEntertainer See all... About UsAdvertiseContact Us
Previous Thread | Next Thread

 
Learn about scoring Forum's Raw Score: 219830.0
October 29, 2008 05:22 PM

Categories: WGR614L Open Source Router

Rating (0 votes)
  • 1
  • 2
  • 3
  • 4
  • 5
Rate This!

Member Avatar

Fmay

  Member
Joined: 10/17/2008

Hi,

 I am trying to do work JFFS modifying some MTD functions (maps and device). In one test I flashed a partition mistake avoiding a new firmware update as follow:

 --------------------------------------------------------------------------

CFE for WGR614v8 version: 1.3
Build Date: Wed Apr  4 11:00:42 CST 2007
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.138.1.0
Device eth0:  hwaddr FF-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
Loading .
Image chksum: 0xFFFFFFFF
Calc  chksum: 0x00000000
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: . 0 bytes read
Failed.
Could not load flash0.os:: Error
CFE>

CFE> ifconfig eth0 -hwaddr=001f33cf3250 192.168.1.1
Device eth0:  hwaddr 00-1F-33-CF-32-50, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
*** command status = 0
CFE> tftpd
Start TFTP server
Reading :: Done. 3211322 bytes read
Board ID : �

Image ID : U12H072T00_NETGEAR
Reading :: Done. 3211322 bytes read
Board ID : �

Image ID : U12H072T00_NETGEAR
Reading ::

----------------------------------------------------------------------------

I would like to know what can I do to recover, something know one hint to recover my..router.

Thanks a lot.

Discussion:    Add a Comment | Comments 1-25 of 39 | Latest Comment | 1 2 Next »

Tathagata Das Avatar
NETGEAR
Answers Post October 30, 2008 1:51 AM

You have taken right approach to recover this board. You can do this following steps to recover the board.
1. Please find out the MAC address of your board. It should be written on the backside cover of that WGR614L board. I have assumed it as 001122334455.
2. Go to CFE prompt and write this command
ifconfig eth0 -hwaddr=00:01:02:03:05:05 -addr=192.168.1.1
3. start tftd at CFE
4. upload original WGR614L firmware.
5. Boot the board.
6. After login execute these commands into shell
burnethermac 001122334455
burnboardid U12H072T00_NETGEAR
bunsn . Again you will find this serial number onto the backside cover of the board.

Reboot the board. You board is now recovered properly. You can upload other firmware also.

Generic Member Avatar
  Member
October 30, 2008 5:46 AM updated: October 30, 2008 6:06 AM

Dear Das,

I've applied your tips without success. The original Firmware (wgr614v8_1_1_11_6_0_36_na.chk) seems that was loaded with the same result.


-----------------------------------------------
CFE> ifconfig eth0 -hwaddr=001f33cf3250 -addr=192.168.1.1
Device eth0: hwaddr 00-1F-33-CF-32-50, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
*** command status = 0

CFE> tftpd
Start TFTP server
Reading :: Done. 3518522 bytes read
Board ID : �

Image ID : U12H072T00_NETGEAR
Reading :: Done. 3518522 bytes read
Board ID : �

Image ID : U12H072T00_NETGEAR
Reading ::
---------------------------------


Thanks for the reply.

Generic Member Avatar
  Member
October 30, 2008 7:05 AM updated: November 7, 2008 5:32 AM

Das, your tips are correct, so that you need to add the following command before doing tftpd:

CFE> setenv BOARD_ID U12H072T00_NETGEAR

Thanks a lot.

Generic Member Avatar
  Member
October 30, 2008 7:05 AM updated: October 30, 2008 7:16 AM

...

bzing2 Avatar
  Member
October 30, 2008 7:21 AM

Fmay, oh dear looks like you have scrambled your board info. Not 100% sure any of this will work, but I have some suggestions.

Looking at your post above I think I understand why you cant upload the original image. The .chk file contains the target board id, U12H072T00_NETGEAR in this case. Unfortunately it looks like the boot loader has a corrupted idea of its board id. Hence why thats not working for you...

At the CFE prompt you have access to the nvram command (Netgear some docs on the commands that work would be massively helpful). Now that means you can do a "nvram set". I had a poke around with my CFE partition and perhaps setting some of the following may help you! Its a long shot, but you never know.


boardtype=0x048e
boardnum=01
boardrev=0x11
boardflags=0x750
boardflags2=0


If you really cant get that to fly then there is another way. This one is a little more involved. CFE can tftp a kernel image and execute it, assuming you have some form of filing system you can get it booted into something. I guess you could even NFS root the filling system (not tried that). I have gotten this to work with a kernel compiled from OpenWRT. Command you want is:

boot -z -elf -tftp 192.168.1.2:vmlinux.gz


If you manage to get into a shell you should a) be able to write a TRX to the flash, so you have something to boot in, and b) fix anything thats broken with the CFE.

As I said, don't know if any of that will work/help, but good luck!

Tathagata Das Avatar
NETGEAR
October 30, 2008 11:03 PM

Dear Fmay,
Good to know that my tips help you to recover the board. Thanks for telling us one important point of setting environment variable before doing tftpd.

Generic Member Avatar
  Member
November 6, 2008 12:22 PM updated: November 6, 2008 1:25 PM

Excuse me, I am a novice with these routers, I need some help...

What is the meaning of the following message:::::

CFE> boot -z -elf -tftp 192.168.1.2:vmlinux.lzma
Loader:elf Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinux.lzma Options:(null)
Loading: Failed.
Could not load 192.168.1.2:vmlinux.lzma: I/O error
*** command status = -4

AND:

CFE> tftpd
Start TFTP server
Reading :: Done. 3268666
Board ID : ������������������������������
�����������������������������������������
�����������������������������������������
�����������������������������������������
�����������������������������������������
�����������....
.
.
.
�����������������������������������������FLSH



Something know if it could be possible to recovery!!

Thanks for any help

bzing2 Avatar
  Member
November 6, 2008 12:57 PM

Well the first bit was all about getting the router to download, via tftp, a kernel to boot. I should point out that it would appear that your attempting to load a lzma image, when you have specified a gziped image. The following would be better.


CFE> boot -z -elf -tftp 192.168.1.2:vmlinux.gz


As for the second bit it looks like you either the router has lost the board id (which I think was the problem you had above) or the CHK file you have given it has a broken header. What tool did you use to create the CHK file?

Generic Member Avatar
  Member
November 6, 2008 1:17 PM updated: November 6, 2008 1:18 PM

 

bzing2 said: Well the first bit was all about getting the router to download, via tftp, a kernel to boot. I should point out that it would appear that your attempting to load a lzma image, when you have specified a gziped image. The following would be better. 
		CFE> boot -z -elf -tftp 192.168.1.2:vmlinux.gz
As for the second bit it looks like you either the router has lost the board id (which I think was the problem you had above) or the CHK file you have given it has a broken header. What tool did you use to create the CHK file?

 

I was thinking the same as you, so that always return the same result without programming. I did use the packet tool as follow:

 

packet -k linux-wgr614v8.trx -f emptyfile -b comp-wgr614v8.txt -ok kernel_image -oall linux-wgr614v8 -or rootfs_image -i emptyfile

 

Thanks.

bzing2 Avatar
  Member
November 6, 2008 1:35 PM

Can you send me the output of the following:


hexdump -C -n 58 linux-wgr614v8.chk

Generic Member Avatar
  Member
November 7, 2008 3:55 AM

[rock@fmay wgr614v8]$ hexdump -C -n 58 linux-wgr614v8.chk
00000000 2a 23 24 5e 00 00 00 3a 00 00 00 00 ff 01 00 00 |*#$^...:........|
00000010 60 79 b4 82 00 00 00 00 00 30 00 00 00 00 00 00 |`y.......0......|
00000020 60 79 b4 82 1c ea 0b 09 55 31 32 48 30 37 32 54 |`y......U12H072T|
00000030 30 30 5f 4e 45 54 47 45 41 52 |00_NETGEAR|
0000003a
[rock@fmay wgr614v8]$ hexdump -C -n 58 netgear-fw/wgr614v8_1_1_1_1_0_20_na.chk
00000000 2a 23 24 5e 00 00 00 3a 02 01 01 01 01 00 14 00 |*#$^...:........|
00000010 7a cd 1d 4f 00 00 00 00 00 31 e0 00 00 00 00 00 |z..O.....1......|
00000020 7a cd 1d 4f fa 13 0a 4c 55 31 32 48 30 37 32 54 |z..O...LU12H072T|
00000030 30 30 5f 4e 45 54 47 45 41 52 |00_NETGEAR|
0000003a

bzing2 Avatar
  Member
November 7, 2008 4:31 AM

Well the good news is that your CHK files seem fine! Which probably means you have a problem with the bootloader, or what its reading; not so good.

I take it you have tried to put back one of the original Netgear images? Or do you get the same problem if you do?

Generic Member Avatar
  Member
November 7, 2008 5:14 AM updated: November 7, 2008 6:23 AM

Really I have had three experiences:

At the first, I tried to install OpenWrt Firmware only with sflash mtd modification and without any modifications of the MTD size partitions. It is the last case of the conversation.

At the the second, I tried to increase the MTD-4 to an erroneus size. It is the first solved case of the forum. It was tested in other AP.

At the third: I changed the sflash Numblocks of 64 to 66 in order to increase the free space. During the test It seems works Ok, so that at the next boot, it dead without power led and CFE option.



Since I have two AP and one seems dead, I have to recover the AP of the first test.

I am using the netgear Firmware to recovery with the same result.

Thanks.

bzing2 Avatar
  Member
November 7, 2008 5:40 AM

Ok lets try an work through those one at a time.

First case: OpenWRT firmware without other modifications. This is the first thing I attempted, and I got the same problem, as in a bricked router! I suggest you look at your System.map and see what the address of kernel_entry is. I am assuming your using the compiled kernel directly here. Have a look at Booting OpenWRT - From the correct address. There is a good chance your jumping to a random location in the kernel, hence wierd output. If you have a serial port then try and CTRL-C on startup!

Second case; well that sounds fixed.

Third case; I am assuming that your have changed /arch/mips/bcm947xx/sflash.c somewhere in sflash_init??

Generic Member Avatar
  Member
November 7, 2008 6:50 AM updated: November 7, 2008 7:03 AM

You are right. The first case was solved with the last test and like the forum link was described in.

The Third case, you are correct, it was the function modified.

Good news, I got TFTP boot vmlinux.gz. I am on linux enviroment. I want to apply the mtd write command. Please can you verify if it is Ok:

mtd write wgr614v8_1_1_1_1_0_20_na.chk linux -r

Thanks again.

bzing2 Avatar
  Member
November 7, 2008 7:11 AM

Great, well at least you have something working.

Ok you cannot use "mtd write" to write a CHK file to the flash. You can however use that utility to write a TRX file to the flash; but with one problem. There is a seperate checksum which is outside of the TRX. I suggest you have a look at Netgear Flash Utility for WGR614L. This will allow you to set the other checksum to something sensible (use -a) before you do an "mtd write".

Given you have a tftp environment working, why not just push a .chk file?

As for your modifying of sflash_init I think you have most probably briked that one! You cannot make the flash bigger than it really is, and I have no idea what that will have done (probably upset the bootloader). You will need to find some one from Netgear to answer that one!

Generic Member Avatar
  Member
November 7, 2008 12:11 PM updated: November 8, 2008 5:47 AM

----------

Generic Member Avatar
  Member
November 11, 2008 12:24 PM

Something know how can i recovery the memory integrity?


rock@fmay:/# dmesg
ernel code, 2088k reserved, 100k data, 92k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
PCI: no core
PCI: Fixing up bus 0
Linux NET4.0 for Linux 2.4
Based upon Swansea������‚���������������������������5)������������������������������Ł����������������������������������������Ց��5)���������э����������с�������������������������������Ս����������Ł����݅��5)!������������5)1������������5)������͕�����������5)A�%�������������5)Aɽ���́��͵��Ł�������ɱ��х����������������5)Mх��遁�����Ʌ�������ى�����������Ɂ�����Ņс�������Ձ�������Ձ��������5)�����������������Ł�������с����������������Ł�������Ł�����������������5)�������э��������������������������������э�����������������������������5)��������������Ց������ٕ������ō�݅��������͍�����э�Ձ�������������э��5)��������Ձ�������������Ց�������������������Ł����э�������QɅ��遁�m����ى����u�m����ٕ����u�m����ّ����u�m����������u�m�������ݍ�u5)�m����ݕ����u�m�������Ս�u�m������ő��u�m������ŕ��u�m����������u�m����������u5)�m����ŕ�ō�u�m����������u�m�����݉���u�m����������u�m�������͍�u�m����������u5)�m����Չ����u5)5���������őő���݅�������ᙅ���ፁ�����������ᙅ����၁�������݁�ᙅ���ፁ�ᙅ����с�ᙅ������5)�����%�55)ݱ���ݱ�}��х��遍���ɕف́��ɕչ�с����ɕɕف�́�������������ŕ������������������Ձ�����ɹ�����ɹ��5)AAA�����ɥ���



rock@fmay:/# nvram show | grep ram
size: 1293 bytes (31475 left)
os_ram_addr=80001000
sdram_config=0x0032
sdram_refresh=0x0
sdram_ncdl=0x30a2a
sdram_init=0x000A
dl_ram_addr=a0001000


rock@fmay:/# nvram get boardrev
0x10
rock@fmay:/# nvram get boardflags
0x0750
rock@fmay:/# nvram get boardflags2
0
rock@fmay:/# nvram get boardnum
0123
rock@fmay:/# nvram get boardtype
0x48E

Thanks for any help.

Generic Member Avatar
  Member
November 11, 2008 12:37 PM

Sorry, The last message was my noise circuit.

Generic Member Avatar
  Member
November 12, 2008 2:23 PM updated: November 13, 2008 4:37 AM

Something know how to activate the programming part of tftpd?

CFE for WGR614v8 version: 1.3
Build Date: Wed Apr 4 11:00:42 CST 2007
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.138.1.0
Device eth0: hwaddr FF-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
CFE> ^C
CFE> setenv BOARD_ID U12H072T00_NETGEAR
*** command status = 0
CFE> fconfig eth0 -hwaddr=00AADBDA38YY -addr=192.168.1.1
Invalid command: "fconfig"
Available commands: et, go, nvram, reboot, tftpd, flash, autoboot, batch, boot, load, save, ifconfig, unsetenv, printenv, setenv, help

*** command status = -1
CFE> ifconfig eth0 -hwaddr=00AADBDA38YY -addr=192.168.1.1
Device eth0: hwaddr 00-AA-DB-DA-38-YY, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
*** command status = 0
CFE> tftpd
Start TFTP server
Reading :: Done. 3080286 bytes read


After that, do nothing!!!! It is needing the programming part.


Thanks for any help.

bzing2 Avatar
  Member
November 13, 2008 2:19 AM

What image are you tftp putting? Does it have a correct CHK header?

Generic Member Avatar
  Member
November 13, 2008 5:30 AM updated: December 8, 2008 7:03 AM

Problem solved putting wgr614v8_1_1_1_1_0_20_na.chk as follow:


CFE> ifconfig eth0 -hwaddr=00AADBDA38YY -addr=192.168.1.1
Device eth0: hwaddr 00-AA-DB-DA-38-YY, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
*** command status = 0
CFE> setenv BOARD_ID U12H072T00_NETGEAR
CFE> nvram set boardid=U12H073T00_NETGEAR
CFE> nvram commit
CFE> tftpd
Start TFTP server
Reading :: Done. 3268666 bytes read
Loading ......................................
Programming...done. 3268666 bytes written
Write len/chksum offset @ 0x0038FFF8...done.


After booting the configuration looked as follow:

# burnethermac
LAN mac address - FFFFFFFFFFFF
WAN mac address - FFFFFFFFFFFF
# burnboardid
Board ID - ���������������������������������������������������������������
# burnrf
invalid RF magic!
# burnsn
serial number - ��������������������������������


Thanks

bzing2 Avatar
  Member
November 13, 2008 7:35 AM

Yes you have a problem with the boot loader variables; you have clearly been putting an mtd partition over them, causing them to be corrupted! When you boot a netgear version you can restore those variables (as you have show above).

These are what your probably falling over.


#define KERNEL_LEN_ADDR    0x3afff8
#define KERNEL_CHKSUM_ADDR 0x3afffc
#define BOARD_DATA_ADDR    0x3e0000


This is my working MTD layout:

0x00000000-0x00020000 : "cfe"
0x00020000-0x003f0000 : "linux"
0x0009a400-0x00220000 : "rootfs"
0x00220000-0x00380000 : "rootfs_data"
 ---- NOTE DEAD SPOT HERE ---
0x003f0000-0x00400000 : "nvram"

Generic Member Avatar
  Member
November 13, 2008 8:31 AM

Bzing2, thanks for the collaboration.

As you show at the above message, the MTD partition seems an Openwrt environment. I am working with openwrt to. Have you the same result of JFFS that me as follow?:


---firstboot


Unlocking rootfs_data ...
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0xaaaa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x2aaa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0x0aaa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000000c: 0x2aa2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0xaaa2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000014: 0xaeaa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0xaaa2 instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000001c: 0x8aaa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000020: 0xbaaa instead
jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000024: 0xaaaa instead
Further such events for this erase block will not be printed
JFFS2: Erase block at 0x00000000 is not formatted. It will be erased
JFFS2: Erase block at 0x00010000 is not formatted. It will be erased
jffs2_scan_empty(): Empty block at 0x0009000c ends at 0x0009fff8 (with 0x002f0000)! Marking dirty
jffs2_scan_inode_node(): Data CRC failed on node at 0x000aa0ac: Read 0x28639b3d, calculated 0x5bbf8dbe
jffs2_scan_inode_node(): Data CRC failed on node at 0x000aaaac: Read 0x28639b3d, calculated 0x5bbf8dbe
Eep. Child "test" (ino #642) of dir ino #37 doesn't exist!
Eep. Child "nslookup" (ino #630) of dir ino #37 doesn't exist!
Unlocking rootfs_data ...
Erasing rootfs_data ...
mount: Mounting /proc on /jffs/proc failed: No such file or directory
firstboot has already been run
jffs2 partition is mounted, only resetting files
creating directories... done
setting up symlinks... Data CRC 28639b3d != calculated CRC 5bbf8dbe for node at 0009a0ac
cp: unable to preserve ownership of `./usr/bin/nslookup': Input/output error
Data CRC 28639b3d != calculated CRC 5bbf8dbe for node at 0009aaac
cp: unable to preserve ownership of `./usr/bin/test': Input/output error
done


--- Next boot

Unlocking rootfs_data ...
jffs2_scan_inode_node(): Data CRC failed on node at 0x0009a0ac: Read 0x28639b3d, calculated 0x5bbf8dbe
jffs2_scan_inode_node(): Data CRC failed on node at 0x0009aaac: Read 0x28639b3d, calculated 0x5bbf8dbe
jffs2_scan_empty(): Empty block at 0x0009d520 ends at 0x0009fff8 (with 0x00000004)! Marking dirty
Eep. Child "test" (ino #642) of dir ino #37 doesn't exist!
Eep. Child "nslookup" (ino #630) of dir ino #37 doesn't exist!

Thanks for any commentary

bzing2 Avatar
  Member
November 13, 2008 8:44 AM

You appear to have created a slightly duff image. Your problem is the way OpenWRT creates its images and places the jffs2 erase markers. I have already solved all of these problems!!!

My suggestion download my OpenWRT environment for the WGR614L. It will produce an image that you can use without the problems your having.

Specifically it does the following:
* Apply's the kernel patches
* Adds a tool to create CHK images
* Build CHK images correctly for the board
* Add a ngr-flash tool you can use at runtime.

If you want to use OpenWRT I would seriously suggest you give that a shot first! The other patches on this site are only for the kernel, and not the build environment! Hence why your having such a hard time of things!

So again download my OpenWRT environment for the WGR614L. If you find problems with it I can fix it...

Discussion:    Add a Comment | Back to Top | Comments 1-25 of 39 | Latest Comment | 1 2 Next »

Add Your Reply

(will not be displayed)

Email me when comments are added to this thread

 
 

Please log in or register to participate in this community!

Log In

Remember

Not a member? Sign up!

Did you forget your password?

You can also log in using OpenID.

close this window
close this window