OpenWrt Forum Archive

Topic: Help with debricking a WAP54G V3.1

The content of this topic has been archived on 10 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hello all,

I recently purchased a WAP54G V3.1.  Managed to install OpenWRT (WhiteRussian RC5) on it ok via the firmware upgrade in the LinkSys web interface.  So far so good.  Then I went off to try and get the WAP to work essentially like a NAT-only AP (i.e. hand out 10.0.0.x on WiFi, NAT that over to LAN port).  Started my modifying the firewall.user script, but at this point it was obviously far too late at night and I got something wrong, since after a reboot I could ping the AP on the LAN port, but no longer SSH to it. 

At this point I bashed myself on the head to be silly enough to not have set boot_wait=on and went to bed.

Tried various things today but could not access the AP even though it would boot (I could see remote syslog messages on the address I had previously configured).  Failsafe mode did not work, recvudp got the message but holding down reset produced no result.  Eventually the AP (without my intervention other than possibly holding down reset too early after being frustrated with failsafe not working) got itself into a state where it would no longer boot or respond to anything.  Only other visible symptoms are: POWER and LINK LEDs on, but no link on the switch that the LAN is connected to.

Tried the debricking method on the HOWTO page (connect pin 16 of the SST FLASH chip and GND).  Seems to work, can ping bootloader on 192.168.1.245.  Tried flashing both the original Linksys 3.04 TRX image and a fresh copy of openwrt-brcm-2.4-squashfs.trx.  The file is TFTPd to the WAP fine, but it still does not boot, even after waiting >10 minutes to be sure that the flash programming is complete.

The only other interesting behaviour is that if I flash the original Linksys TRX to the WAP, at some point after TFTP has completed the SES LED will light.  This will not happen with the OpenWRT TRX.

Any ideas?  I guess I could dust off my soldering skills and connect up a serial console...

Please help :-)  I have another WAP54G that I'd really like to use OpenWRT on as I describe above, but I'm not going to touch it until I have some idea of what happened to this one...

Thanks

-mato

Did some more hunting around on the forum, and went and looked at the saved syslog messages I have from when OpenWRT would still boot on the WAP.  Notably, this topic:

WAP54G v3, v3.1 trouble on RC4

Looking at my syslog messages, I can see that the unit had similar problems before it died:

Jun 24 14:50:54 host116.moloch.sk  kernel: SQUASHFS error: lzma returned unexpected result 0x1
Jun 24 14:50:54 host116.moloch.sk  kernel: SQUASHFS error: Unable to read fragment cache block [ba924]
Jun 24 14:50:54 host116.moloch.sk  kernel: SQUASHFS error: Unable to read page, block ba924, size 4d93

So I'm guessing that the NVRAM is hosed and I need a way to set correct settings/clean it up.

The board I have has two unpopulated headers on it:

RJP1
  x
x x
x x
x x
x x
   <
x x x x x x<
x x x x x x CONN 1

If I understand this correctly RJP1 is the serial header and CONN1 is the JTAG header. Does anyone know the definite pinout of the serial header which I could use to hook up a serial console to talk to the bootloader with?

Thanks again

-mato

Some more progress on this:

- Have soldered an IDC header to the PCB.  Closer inspection of J5 with a multimeter reveals that the pinout is likely quite different to the WRT54G V3 serial header.

- Tried using an old Nokia DAU-9 cable to do the TTL<->RS232 voltage conversion, but it looks like the cable is no good for this purpose.  It appears to be one of the "jumperless" FBUS/MBUS cables using a LTC1386 transciever chip (AFAICS equivalent to a MAX3232).  Given that there is no FBUS/MBUS switch it looks like the MBUS functionality is getting in the way of a usable connection since plugging the cable in was giving me local echo on the port which is what I'd expect MBUS to do.

- Am going to hunt around for a suitable kit to make a cable.  Looks like the one on www.picbasic.it should do the trick.

- Can someone advise if the sdram_config/init/ncdl values posted in skrzyp's thread (which I reference in my original post) are in fact correct?  The SDRAM on my V3.1 board is a EtronTech EM638165TS-6G. I'd like to try OpenWRT on the other (working, untouched) unit I have but I'd rather not brick that too.

Thanks

-mato

Confused; why are you messing with sdram timings?

Let me recap:

1. Got new WRT54G V3.1 unit from the store
2. Setup a loghost on it while still running original Linksys firmware
3. Flashed OpenWRT RC5 micro image on it, everything seemed fine (stupidly did not set boot_wait as first thing)
4. Managed to firewall self out of unit by breaking firewall.user script (can't get in via WLAN either since I stupidly set a key which I now can't recover)
5. Tried booting into failsafe multiple times, did not work (got "Press reset now" message from recvudp, but not "Entering failsafe" message).  Some tries later the unit would no longer boot at all.
6. Tried forcing CFE into TFTP receive by grounding pin 16 of the flash, this worked, CFE received TFTP image but unit will not boot (either OpenWRT or original Linksys firmware)
7. Found skrzyp's thread mentioning problems running OpenWRT on WAP54G V3.1.  Went back and looked at messages logged on loghost, and can see numerous instances of jffs2 corruption + what looks like bits of oopses.

My working assumptions are that:

a) The unit is still alive in the sense that CFE is there and boots into TFTP receive when forced to by grounding pin 16 of SST flash.
b) It's possible that the V3.1 hardware is sufficiently different from V3 and OpenWRT is misconfiguring it.
c) The flash and NVRAM (this is also stored in the flash right?) are most likely corrupted which is causing the unit to fail to boot.

So, I reckon that the unit died either due to the failsafe boot zonking the flash, or (possibly in combination with) b) above, i.e. OpenWRT is using incorrect SDRAM timings for this PCB rev.  The latter would correspond with the problems skrzyp saw.

I have a second WRT54G V3.1 unit which I have not touched and is still running the Linksys firmware.  However I'd like to get your opinion on whether or not to boot OpenWRT on this unit also and if so, whether what skrzyp writes about SDRAM timings may in fact be the cause of my problems. The other option is to wait while I get a proper serial console working on the bricked unit to see what state it's in.

Is there anyone else here who is successfully running OpenWRT RC5 on a WRT54G V3.1?

If there are people successfully running OpenWRT RC5 on a WRT54G v3.1, there's not many. What I would like to know is how to set up serial console in order to set the proper nvram variables, for I've bricked my v3.1 device. I've done serial console to embedded devices before, it's just I can't find the correct pins that work. Not to mention I've locked myself out of the ethernet interface, so serial is my only viable option. Unless anybody has JTAG info?

So, any progress on this? I'd really appreciate it, since I got a WAP54G v3.1 for the sole purpose of running openwrt on it. All I saw was "V3" on the label, stopped reading, and mistakenly thought it was V3, not V3.1.

So yes, any help would be incredibly & awesomely supertastic!

The discussion might have continued from here.