Hello,

I need some help. I did a "chmod 644" on the file /etc/init.d/network. I Kamikaze 7.06 2.6 kernel. Since wireless does not work with kernel 2.6, I thought I could disable this script. In the script there was only wireless related code. That is why I did what I did. I guess I was wrong. Since I was lock out of another different (wrt54gs) router before and was able to fix it by shorting pins 5-6 and tftping image, I thought I could fix this one. However, this one is hard than the first. This is what I did.

Tried pins 5-6. with no ping reply
Tried pins 1-2 I got ping reply. However the image would not tftp over. These are my tftp commands

#tftp 192.168.1.1
>binary
>rexmt 1
>timeout 60
>trace
> put image_file.bin

So what I did next, while ping was still occurring, was to telnet in. I thought if I am pinging it I should be able to connect. I tried to ssh in, but did not work. Telnet into 192.168.1.1 worked. However,all of my configurations were gone. It looked like everything was restored to original. I edited /etc/config/network file. I changed the ip of the lan config to static 192.168.0.4 and wan to static 192.168.0.7, which are valid IPs on my network. However, upon reboot nothing worked. I tried to short pins 1-2 again, but I can not get it to ping, I tried all the pins on that same side and no ping. I guess I could try the other side, but it began to ping before on pins 1-2. Can anyone please help?

Shorting pins is never a good solution, there is always a better way to recover.  One of the primary issues with shorting pins is exactly what has occured here: "Oh pins x and y don't work, lets try shorting random pins to see if that makes it better." In reality it is quite possible you've ruined the flash chip.

The reason that pin shorting can work has been discussed previously so I'm not going to go into it.  The standard order for attempting to connect to an "unconnectable" router -- I hate the term "bricked," most of the time it can be recovered -- are as follows:
1) Failsafe.  This allows you to get back into OpenWrt, mount the writable partition and correct your mistake.
2) TFTP'ing a new image (since you should have boot_wait enabled.)
3) Serial Console.  Open the case up and connect to the serial console, either to connect to OpenWrt once it has booted, or directly to the bootloader.  Again, this can allow you to see what went wrong, and fix it.  If you already have a pin header installed and have serial access I would use this before TFTP or Failsafe.
4) JTAG.  A last resort, if the bootloader is messed up, JTAG can be used to flash a new bootloader, then a firmware image can be sent via TFTP.

All the above methods are mentioned on the Troubleshooting page

In your case all bets are off.  If you have killed the flash chip there you will have to replace it to fix the router. When pin shorting (or other hardware failure) is not involved the above steps should always be able to recover the device.

(Last edited by Bartman007 on 22 Jan 2008, 07:54)

Bartman,

I have Kamikaze 7.06 and kernel 2.6 on the wrtsl54gs router.

Boot wait does not work on 2.6 kernel as you mention in a different post. Therefore tftping does not work upon boot. I guess I could continue to try tfting,  Plus the DMZ led never lights up as needed, which is mentioned in wiki failsafe troubleshooting. I am not sure how the serial console works. I have a usb connection on my wrtsl54gs. I am not sure if this help because I see they talk about usb connection in the serial console troubleshooting wiki. I do not think JTAG will help since the problem is an edited script no the boot loader. So my qustion is do you think there is any chance of fixing the router or do you think it is dead? Thanks

The USB port and the serial console are not the same thing.  Something is obviously broken during the boot process, you need to be able to access the serial console in order to see what is happening, and more importantly, do something about it.

Info on adding a serial console on the WRTSL54GS is here, some info on reflashing via the CFE is here.

Posting the output of the serial console while it boots would be helpful at this point.  Do not try shorting any more pins, as far as I know this doesn't work on this model (different flash chip) and as Bartman said it's entirely possible that the flash chip is damaged at this point.

Thanks. I will try to do the serial mod. Once I get it working again if I can, How can I turn on boot_wait for Kamikaze to make sure this does not happen to me again? Thanks for all your help Bartman & JimWright.

Hey mike123,

I'm also going to be working on a serial port mod for my WRTSL54GS.  I decided to go the TTL-232R-3V3-AJ route as shown on the WRTSL54GS wiki page, so I just ordered one of those, and am now trying to hunt down a stereo jack to use with it. 

My original thread is over here.

Let me know if you are successful and what works for you, and I'll do the same.

Cheers,
Ben

benwei,
Does the serial mod work with bricked router that had Kamikaze installed? Or is it irrelevant? The reason I ask is because of the "nvram" commands I see once one connects via serial. I read that nvram commands are only related to White Russian. Is this true?  I am so new at this hardware mod thing. However the pics of the TTL-232R-3V3-AJ method does not seem to hard. Once the hardware is done and you plug the usb into your computer, what application does one use to connect ( control + c upon router boot )?

(Last edited by mike123 on 23 Jan 2008, 04:40)

Kamikaze is irrelevant.  Check the CFE link in my post above, you'll see the command there.  This will execute before any firmware loads.

Depends on just how 'bricked' it is.  If the CFE is still running at boot, then you've got a good chance of getting it running again.  If there is a hardware fault, then you're probably sunk, but that's rare.

The CFE does use some NVRAM commands (boot_wait, etc), but kamikaze will ignore those once it loads in favor of its own config files, I believe.

JimWright,

Thanks Jim. That gives a better understanding. However, from what application do I connect to router by pressing Control + c from my other linux machine once serial mod is  done? Is it just a terminal window. I thought I read in one of the threads that a hyperterminal was used, or is that just a windows thing?

Yes, Hyperterminal is a windows app.

When running linux, you can choose from minicom, microcom, picocom, screen, Komport (KDE) and I assume there are many others.  minicom seems to be the defacto standard but I prefer picocom because it is small and simple.
Starting up a picocom session is as simple as

picocom -b 115200 /dev/ttySx

where ttySx is the serial port the router is connected to, may be in the form of ttyS0, ttyS1, ttyUSB0, etc...
Might have to change the baud rate around if it doesn't work; ctrl-a ctrl-u to increase it and ctrl-a ctrl-d to decrease it.

Exactly, any terminal application that will talk with a serial (rs232) type device should work.  I'm a Mac user, and have always been partial to Zterm, but I've used screen from the command line also and it worked fine.

benwei,

Where are you getting the wire from? I have ordered the TTL-232R-3V3-AJ and Female 1/8" Stereo Chassis-Mount Connector. Is the wire something I could pick up at Radio Shack?

Hey mike123,

I'm not quite sure which wire you are referring to, but I assume you mean the one that is soldered from the circuit board to the 1/8" stereo jack.  I'm not sure where I will get the wire, but looking at the photos on the wiki page, I thought I might just scavenge an audio connection wire from an old computer (the kind with the flat connectors that connects your CD-ROM to your soundcard so that you can play audio CD's directly) because it looks fairly similar to the one in the photo.  Failing that, I'll probably just try to find something at Radio Shack.

Ben

Bartman,

You mentioned in another post that boot wait does not work yet in Kamikaze 2.6 kernel. However, If the nvram commands that one runs run serial console session is independent of Kamikaze as JimWright says, how does Kamikaze play a part? Do you mean that in kernel 2.6 while logged on one cannot configure boot wait? While logged on in 2.4 one can? Are these issues while logged on, and the serial console method of enabling boot wait is independent on kernel version?

CFE> nvram set boot_wait=on
*** command status = 0
CFE> nvram commit
*** command status = 0

nvram can't be accessed in the 2.6 kernel.  This means that you cannot view, or modify the value of the boot_wait variable.  boot_wait is a function of the bootloader, only available for a brief time after power on, before OpenWrt begins booting.  If it was previously enabled, boot_wait will still work when Kamikaze brcm47xx-2.6 is installed, but it cannot be enabled/disabled.  brcm-2.4 can manipulate nvram using the `nvram' command.

The CFE> prompt is part of CFE, the bootloader, the firmware installed has effect on this prompt.  You will always be able to manipulate nvram from here. You can also reflash directly from CFE.

Actually, the wire I used was just a short length of a telephone cord that I had surplus, solid core, not stranded.  You'll want something small gauge so that it will poke through the board when soldering.

Woohoo!  I got it working today.  I had a friend do the soldering for me, and he was having trouble getting the ground wire soldered onto the PCB, so he just soldered ground onto the RF shield, which seems to work fine. 

So now I've got minicom fired up and I can see the boot messages from CFE, and it tells me "Boot program checksum is invalid".  Time to do some more digging and see what that is all about.

Ben

So it looks like I may have fried my flash chip by trying to do the pin-shorting trick.  Here is what I get on the console when I try to do a flash via tftp:

Boot program checksum is invalid
Reading :: CODE Pattern is CORRECT!
upgrade_ver[v4.20.6] upgrade_ver[42006] 4712_ver[15000]
Done. 2556928 bytes read
fname=flash1.trx 
CODE Pattern is correct! (W54U)
Programming...

... and then it just sits there.  Still responds to pings, I believe, but doesn't do anything else until I power-cycle it.  Has anybody encountered this before? 

So let this be a lesson to you -- don't short the pins on your flash chip.

benwei,

Sorry to hear it is not working. I am still waiting for parts. I will let you know how it goes and post what I see.

To all,
I the serial mod is complete. However, I am not sure I am doing the right thing as to get the CFE> prompt. I did the following:

1. Connected TTL-232R-3V3-AJ to computer and router. I saw that dmesg noticed the TTL-232R-3V3-AJ.
2. Installed picocom on my Linux machine.
3. I did not know which was the serial port (ttySx). I tried ttyS0, ttyS1, ttyS2, and ttyUSB0. ttyS0 and ttyUSB0 got the response of "terminal ready."
4. On both of these ports I powered the router and quickly began pressing ctrl +c. I did not get any response from both. I could not type after I got message terminal ready. The other ttySx got a failed message when I tried to connect. So I figured those are not the right ones. Determining the port was done while the router was powered down.

What am I doing wrong? I know that maybe the router is gone. However, I would think I would get some response.

(Last edited by mike123 on 30 Jan 2008, 00:00)

All my attemps to get some output via serial mod have failed.

On my machine (OS X), in /dev, my serial port appears as tty.usbserial-FTD37301, the last several digits there corresponding to the serial number built into the cable.

Did you install the FTDI drivers for Linux?

Good to hear you got serial installed okay.

It's a valuable skill.  I try to install one of these kits on EVERY single SL & GL router that passes through my hands now.  It's quite easy to do after you've done a couple, and all you really need is a cheap low-watt soldering pencil, a solder sucker, and non-spastic hands.  Just about anyone can learn to add the 2x5 header to the PCB, and should in my opinion.

What?!?  I didn't have to have the office buy me a Weller WD1000M soldering station just for this?  NOW you tell me...