I have a Motorola WR850G v2 that had the v4.03 firmware on it, and I tried to flash it to the experimental SquashFS build.  I made sure boot_wait was turned on and then I ran the firmware upgrade page and everything seemed to go ok, but when I unplugged it and re-plugged it to try it out, nothing worked.  I couldn't ping it (its IP is supposed to be 192.168.1.200) and I couldn't telnet to it.  When I turn it on, only the power light comes on, then if I plug in a cable, the light for that cable comes on as well.  The Wireless light never turns on.  If I press the reset button on the back, the 4 LAN lights turn orange for as long as I hold it, then when I release, the lights go out, and about one second later, all the lights turn orange (except for wireless which stays off) then green.  The lights stay green even when nothing is plugged into their ports.  If I plug a cable in the light turns orange.  Despite the change in light patterns, I am still unable to ping or telnet into the device after having pressed the reset button.  If I hold the reset button while powering on the device (supposedly entering failsafe mode) it does the same thing with the lights I described above and I still can't telnet or ping it.  Any suggestions for getting this thing back on its feet?  At this point, I'd be happy just having the Motorola firmware back.

did your set your pc's ip 192.168.1.xx/24

your router must have 192.168.1.1/24

green light must flash 3 times per second i think.

I set my PC's IP to be 192.168.1.150 when I was trying to communicate with the router.  I changed the IP to 192.168.1.200 on the router when I was using it before (worked fine that way).  How would it now be 192.168.1.1?  The Motorola's default is 192.168.10.1.  Should I be trying 192.168.10.1 instead?  Also, which light are you referring to that needs to flash 3 times per second?

You want to try to communicate with the WR850G during boot_wait at 192.168.10.1 - this is the IP the motorola's always have during boot_wait.

Also, the LED's on the Motorola don't flash meaningfully.

Ok, I set my IP to 192.168.10.150 and tried the same procedure as above (pinging/telnetting 192.168.10.1 instead) with no change in results.  Any other suggestions, or is this thing toast?

(Last edited by CEpeep on 18 May 2005, 22:00)

The WR850G's tend to reset their boot_wait if you're not careful. 

Fortunately the WR850G's have a serial console which you can attach to and issue commands to put everything back where it needs to be.

Unfortunately I know nothing about soldering or anything like that.  I'd have no clue how to build a cable for anything.  Is there anything I can do that doesn't require opening it up?

You could (dishonestly) return it and exchange for a new one.

That's not the kind of thing I do.

Is there anywhere (or anyone) I could buy the cable I'd need from?  I also read I might be able to fix it by shorting some pins (but the posts on this forum don't say which pins for the WR850G).  Do you have info on either of these?

I don't have any hands on WR850G you must use serial or some kind of a connection to reflash your router, I know it pain....

Joe

I think I already knew this from what NateTrue posted for me.  I was asking if anyone knew where I could buy a pre-made cable or knew which pins I had to short.

The data cable for the Nokia 3595/6010 cell phones is a usb-to-serial converter with the requisite three lines and proper voltage converter for use as a serial console.  When you have this cable, all you'll have to do is chop off the phone end of it and solder three wires to the requisite points on the WR850G motherboard.  This is a very simple task.

I have a v.1 motorola WR850G router and almost bricked it some weeks ago. I tried the pin-shorting procedure described in some websites, with no luck. Desperately, I just shorted a lot of random pins on the flash chip while the router was on, until the router answered to pings.

When I bricked the router, it kept the Power led blinking every 6 seconds, and no ping got any response.
After shorting some of the pins (don't know exactly which, as I slided a little screwdriver over all the pins of the flash IC - pins 24 to 1. This is absolutely dangerous, but worked for me), the power led remained lit, without blinking and pings started to respond. That was the moment I started a tftp transfer with the v4.03 motorola firmware and brought the router again to life. I cannot say which pins do the work (and I think i'm not going to test again now that I've managed to put openwrt in it). The only thing I can tell is what I did, thinking that I wouldn't be able to recover the router. I kept sending pings until the led pattern changed and pings got a response.

Good luck with your router.
LtGoose.

I tried opening it up carefully to give the pins a shot, but I can't get the screw off.  Any tips on taking this apart without breaking anything?

Nate,

Can you tell us which wires go where?

Thanks!

CEpeep,

You need a Torx size 8 driver.  Once you get the screw out, pop off the LED lens cover (push sides in, I think) and pull REALLY hard to get the top of the case off.  Up front there is one clip on each side that is very strong.

-gbobcat

I am unable to type anything when using serial console, 115k  8-n-1. Only getting garbage characters when typing. Same result on windows hyperterminal and linux minicom
Cable is usb-to-serial prolific pl2303. What am I doing wrong here?
Here is the output:

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Tue Jan 13 14:34:16 CST 2004 (xavier@localhost.localdomain)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.
Initializing Devices.
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 3.50.21.0
CPU type 0x29007: 200MHz
Total memory: 0x2000000 bytes (32MB)

Total memory used by CFE:  0x8032BAD0 - 0x804313F0 (1071392)
Initialized Data:          0x8032BAD0 - 0x8032E040 (9584)
BSS Area:                  0x8032E040 - 0x8032F3F0 (5040)
Local Heap:                0x8032F3F0 - 0x8042F3F0 (1048576)
Stack Area:                0x8042F3F0 - 0x804313F0 (8192)
Text (code) segment:       0x80300000 - 0x80309510 (38160)
Boot area (physical):      0x00432000 - 0x00472000
Relocation Factor:         I:00000000 - D:00000000

Device eth0:  hwaddr 00-11-22-33-44-55, ipaddr 192.168.10.1, mask 255.255.255.0
        gateway not set, nameserver not set

    *CFE for Motorola WR850G v2.03, Release date: Jan. 13, 2004

Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .... 3704 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
CPU revision is: 00029007
Primary instruction cache 8kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 4kB, 2-way, linesize 16 bytes.
Linux version 2.4.30 (root@reboot2.lan) (gcc version 3.4.3) #1 Wed May 25 16:25:
58 EDT 2005
Determined physical RAM map:
memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/pre
init noinitrd console=ttyS0,115200
CPU: BCM4712 rev 1 at 200 MHz
Using 100.000 MHz high precision timer.
Calibrating delay loop... 199.47 BogoMIPS
Memory: 14048k/16384k available (1512k kernel code, 2336k reserved, 104k data, 8
8k init, 0k highmem)
Dentry cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
Checking for 'wait' instruction...  unavailable.
POSIX conformance testing by UNIFIX
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Fixing up bus 1
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
Squashfs 2.1-r2 (released 2004/12/15) (C) 2002-2004 Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI en
abled
ttyS00 at 0xb8000300 (irq = 3) is a 16550A
ttyS01 at 0xb8000400 (irq = 0) is a 16550A
Software Watchdog Timer: 0.05, timer margin: 60 sec
loop: loaded (max 8 devices)
cfi_cmdset_0001: Erase suspend on write enabled
Using buffer write method
Flash device: 0x400000 at 0x1c000000
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x003e0000 : "linux"
0x000bea4c-0x001b3000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-o
nly
0x003e0000-0x00400000 : "nvram"
0x001c0000-0x003e0000 : "OpenWrt"
Initializing Cryptographic API
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
ip_conntrack version 2.1 (5953 buckets, 5953 max) - 316 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
Freeing unused kernel memory: 88k freed
Algorithmics/MIPS FPU Emulator v1.5
Using /lib/modules/2.4.30/diag.o
diag boardtype: 00000101
Unlocking OpenWrt ...
{{{s{umount: /rom/dev: Device or resource busy
init started:  BusyBox v1.00 (2005.05.25-20:30+0000) multi-call binary
Bummer, could not run '/etc/in
Please press Enter to activate this console.

Ratbug, I just think it's cool that you got the serial thing goin.  I thought I bricked my WR850G today (again).  But, this thing appears to be indestructible.  I had a heck of a time tryin to get the failsafe mode to kick in.

I also had a time getting the case open (I thought I was gonna have to short the pins or something).  I believe it's pretty much impossible to open it without damaging the case a little bit.  Truly the snaps on the front are a miracle of plastic molding technology.  They were incredibly difficult to remove.  I just bit the bullet and yanked (I broke one of the snaps.

Though it's a pain, I'm gonna look into the serial connection.  If anyone would like to post the solder points, with pictures/diagrams, that would be nice.  I'll try to remember to post the ones I took of the guts today.  I want to try the sveasoft firmware on my wr850g. (http://www.dslreports.com/forum/remark, … ite=wr850g)

I just recommend not giving up and considering a (WRT) router bricked.  They're resiliant.  I'm not sure about all the buttons, I just held the reset in for about a minute, powered off, etc.  And be sure to give it time to boot up.  If you can get a ping, you definitely have hope.  If not you still have a good chance.

oobx

(Last edited by oobx on 9 Aug 2005, 06:09)

The OpenWRT firmware chokes on leftover data in the NVRAM area.   You will have to erase it before flashing and rebooting.  This is most easily done in the serial console, but can be done through telnet or even with a JTAG connector and the HairyDairyMaid software.

>> I want to try the sveasoft firmware on my wr850g.

Don't bother -- it doesn't work (wrong GPIO port mappings).

Hi ratbug.

Can you describe how you managed to do your serial console and if the solution finally worked for you?

Regards,
Krissi

Admittedly I'm new to this.  I have a moto wr850g, I upgraded to the dd-wrt firmware, things went ok.  I was trying to change settings to use the router as a repeater when, nothing.  It stopped responding. Now all I have is the power light and after a few minutes the wireless light.  Neither flashes (the wireless led used to), and plugging in Ethernet cables elicits no responses. 

If you could redirect me to any links or tutorials explaining how to ping with telnet, or any useful programs for determining the status of my router, it would be appreciated.