wgr614v8 / wgr614L bricked after enabling jffs

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Author Message
kingsmill
DD-WRT User


Joined: 20 May 2008
Posts: 79

PostPosted: Thu Aug 20, 2009 10:21    Post subject: wgr614v8 / wgr614L bricked after enabling jffs Reply with quote
I have bricked my WGR614v8 netgear routers multiple times after enabling jffs. For the most recent bricking I was using eko dd-wrt.v24-12476_NEWD_std-nokaid_nohotspot_nostor.bin. I have not had a problem actually loading the firmware itself, the problem has occurred either directly after initializing jffs or after doing some customizations shortly after enabling jffs. I have also seen the same problem with other recent versions of dd-wrt.

I have experienced two different problems.
- All lights on the router are either on with normal brightness or are very dim. In this case the router is totally bricked due to a corrupt cfe boot loader. I have been able to recover this by reloading cfe128.bin.
- the routers MAC address is set to FF:FF:FF:FF:FF:FF which means that the router lights will look correct but the network will not work. On a WGR614v8 the mac address is stored in the bdata partition so something obviously overwrote this area. To recover I had to temporarily set the network mac address and netgear boardid, reload the Netgear firmware, use burnethermac to set the mac address and burnboardid to set the board id to U12H072T00_NETGEAR and then reinstall dd-wrt. Further details below.

I have not seen the problem when running the mini version of dd-wrt. I have only seen the problem when running the standard version of dd-wrt when jffs is enabled. That is not to say that the mini version does not have the problem, just that I have not seen the failure running the mini version of dd-wrt.

It certainly looks like something is going wrong with the jffs initialization. I have reported this bug at http://www.dd-wrt.com/dd-wrtv2/bugtracker/view.php?id=3708. If you experience the same problem or have anything further to add then please update this case.

MORE DETAILS ON RECOVERING FROM A BRICKED WGR614V8:

To recover from this error you will need to connect a serial console to the wgr614 router. Details on doing this can be found at http://www.myopenrouter.com/article/10341/Recover-Your-WGR614L-Using-a-Serial-Console-Windows/

When you power on the router you should see the following message printed on the console:-

CFE for WGR514v8 version 1.3
Build Date: Fri Apr 20 14:04:44 CST 2007
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.138.1.0
Device eth0: hwaddr 00-1e-2a-54-27-5e, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
CFE> ^C
CFE>

If you see nothing or either all lights are on or dim then cfe is more than likely corrupt and cfe will need to be reloaded.

This will require a JTAG connector be soldered onto the motherboard and a JTAG cable connected to the parallel port on your computer. For details on doing this see
http://www.myopenrouter.com/article/10935/Creating-a-JTAG-Cable-For-WGR614L-Access-The-Flash-Directly/ and http://www.dd-wrt.com/phpBB2/viewtopic.php?p=236257

Details on loading cfe can be found elsewhere in this this forum. The cfe binary file can be found at http://www.dd-wrt.com/phpBB2/viewtopic.php?p=279885&sid=60ab24ce92db26ef21c048aa22c4e036
The wgr614v8 contains two different types of Macronix flash chips. Some have a MX25L3205D flash chip which is recognized by tjtag3 while others have a MX25L3205A which is not recognized by tjtag. As such it may be necessary to manually define the type of flash chip. In brief, the command to reload the cfe is
tjtag3 -flash:cfe128.bin /fc:21 /noreset

If you do get a CFE boot message on the serial console but you then see a MAC address of FF-FF-FF-FF-FF-FF then you will need to change the MAC address in order to talk to it over the network since all F's is invalid. In most instances where the MAC address has been wiped out the Board ID has also been wiped out. The Board ID is required to validate the downloaded firmware. The commands required to temporarily set the mac address and board id are shown in the following example. You should substitute the MAC address shown in this example with the MAC address written on the bottom of the router.

CFE for WGR514v8 version 1.3
Build Date: Fri Apr 20 14:04:44 CST 2007
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.138.1.0
Device eth0: hwaddr FF-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
CFE> ^c
CFE> ifconfig eth0 -hwaddr=00-1e-2a-54-27-5e
CFE> setenv BOARD_ID U12H072T00_NETGEAR
CFE> nvram set board_id=U12H072T00_NETGEAR
(where 0 is the number zero)
CFE> nvram commit
CFE> tftpd

You can now load the wgr614v8 firmware using a tftp client under windows or linux. You will need to first download the Netgear firmware from http://kb.netgear.com/app/answers/detail/a_id/8320. The tftp command will vary based on the tftp client but will be similar to this.
tftp -i 192.168.1.1 put WGR614v8-V1.1.24_14.0.43.chk

Once the NETGEAR firmware is flashed and the router boots you need to permanently define the MAC address and boardid on the bdata partition. The commands to do this on the serial console are.
burnethermac 00-1e-2a-54-27-5e
burnboardid U12H072T00_NETGEAR
(where 0 is the number zero)

The router should now boot normally. Once booted you can then re-install dd-wrt. Until the firmware corruption problem is resolved, either don't use jffs or if you do then use the mini version of dd-wrt rather than the standard version. I have not seen the firmware corruption while running the mini version of dd-wrt with jffs enabled but cannot say for sure that flash corruption will not occur.

The instructions listed above are not a step by step guide but should point you in the right direction to resolve any flash corruption problems on a Netgear WGR614v8 or WGR614L.

Geoff..
Sponsor
madscientist
DD-WRT User


Joined: 25 Jul 2008
Posts: 54

PostPosted: Thu Aug 20, 2009 10:40    Post subject: Reply with quote
Great! That's some really useful information. But I still have questions:
1) Have you been able to un-brick both of your 614l/v8?
In this topic:
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=22655
on page 51 you were still stuck with tjtagv3 not recognizing the flash chip.
2) For setting MAC and boardid do I really need serial or is it also possible via tjtag?

Cheers
Frank
madscientist
DD-WRT User


Joined: 25 Jul 2008
Posts: 54

PostPosted: Tue Aug 25, 2009 15:48    Post subject: Reply with quote
I successfully unbricked my 614L. For more info read:
http://www.dd-wrt.com/phpBB2/viewtopic.php?t=57044
myeyre
DD-WRT Novice


Joined: 26 Mar 2009
Posts: 31

PostPosted: Sat Jan 02, 2010 15:19    Post subject: Great thanks. Reply with quote
I got my v8 bricked a couple days ago, today I managed to solder a jtag connector, but to find I got MX25L3205A flash chip which is not recognized by tjtag3.01.

I'm hasitating about using the /fc:21 switch, thanks for your tip, I'll give it a try tommorow.
myeyre
DD-WRT Novice


Joined: 26 Mar 2009
Posts: 31

PostPosted: Sun Jan 03, 2010 6:28    Post subject: Reply with quote
I tried "tjtag3 -flash:cfe128 /fc:21 /noreset" with "v8_cfe_1_3 with swapped byte order" several times today but still noluck. I even erased the kernel and nvram several times.

In my situation, I got MX25L3205A instead of MX25L3205D, then WAN and LAN lit normal brightness, TEST and Wireless lit dim, while Power only lit when reset button pressed.

This v8 was bricked when upgrading to Tomato from OpenWrt in Web GUI, and then a Power cycle. Both firmwares download from myopenrouter.com.

What should I do now:( HELP!!
myeyre
DD-WRT Novice


Joined: 26 Mar 2009
Posts: 31

PostPosted: Tue Jan 05, 2010 16:45    Post subject: Reply with quote
OK. My Fault.

I read Madscientist's thread "Madscientist's quest for the successful jtag recovery":

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=57044

and found my every cfe backup got different hashes, so, of course, the cfe could not be flashed properly.

I realized there should be something wrong with my cable, then I wrapped the JTAG cable with some chewing gum wrappers... IT WORKS!!

Now I can access the cfe using serial console, but after tftp firmware file, it keeps reporting invalid boot file:

Quote:

CFE for WGR614v8 version: 1.3
Build Date: Wed Apr 4 11:00:42 CST 2007
et0: Broadcom BCM47xx 10/100 Mbps Ethernet Controller 4.138.1.0
Device eth0: hwaddr FF-FF-FF-FF-FF-FF, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
Loading .
Image chksum: 0xFFFFFFFF
Calc chksum: 0x00000000
Boot program checksum is invalid
Start TFTP server
Reading ::


I think I may need the wgrv8data.bin?? Any ideas??
myeyre
DD-WRT Novice


Joined: 26 Mar 2009
Posts: 31

PostPosted: Thu Jan 07, 2010 13:08    Post subject: Reply with quote
Now my v8 is up and running DD-WRT again, after flashed wgrv8bdata.bin provided by redhawk0.

redhawk0 also sent me his cfe backup which is 1.5 other than 1.3, both versions worked for me.

Great thanks to redhawk0.
redhawk0
DD-WRT Guru


Joined: 04 Jan 2007
Posts: 11563
Location: Wherever the wind blows- North America

PostPosted: Thu Jan 07, 2010 13:11    Post subject: Reply with quote
Glad to hear you got it going....these a tricky little units due to the byteswap'd data.

Nice work....congrats.

redhawk

_________________
The only stupid question....is the unasked one.
myeyre
DD-WRT Novice


Joined: 26 Mar 2009
Posts: 31

PostPosted: Sun Mar 07, 2010 5:47    Post subject: Bricked again:( Reply with quote
I upgrade to 02-23-10-r13972 std without noticing its size(3,743,744 bytes) exceeded the max firmware a WGR614v8 can handle(3735552 bytes).

After unbricking using TTL and relashed DD-WRT it runs but complains "nvram_commit: write error" when saving changes.

I tried cfe 1.3 and 1.5 found in forum, and even a different cfe 1.3 dumped from another v8. I tried erase the wholeflash. I tried different DD-WRT builds.

But no lock:( sometimes even "VFS: Cannot open root device "mtdblock2" or 1f:02" or similar error.

flash layout turned to be currupted under some circumstances but not always:

Creating 5 MTD partitions on "sflash":
0x00000000-0x00020000 : "cfe"
0x00020000-0x003f0000 : "linux"
0x00104c00-0x003b0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "nvram"
0x003b0000-0x003f0000 : "ddwrt"

But it should be, cause there are boardata and etc at 0x003b0000-0x003f0000:

Creating 5 MTD partitions on "sflash":
0x00000000-0x00020000 : "cfe"
0x00020000-0x003b0000 : "linux"
0x00104c00-0x00320000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x003f0000-0x00400000 : "nvram"
0x00320000-0x003a0000 : "ddwrt"


Official Netgear firmware flash layout:

Creating 8 MTD partitions on "sflash":
0x00000000-0x00020000 : "boot"
0x00020000-0x003b0000 : "linux"
0x0009b98c-0x003b0000 : "rootfs"
0x003b0000-0x003c0000 : "T_Meter1"
0x003c0000-0x003d0000 : "T_Meter2"
0x003d0000-0x003e0000 : "POT"
0x003e0000-0x003f0000 : "board_data"
0x003f0000-0x00400000 : "nvram"

What am I supposed to do now??

----------------------------------------------

I post the cfe dumped from another v8 here: http://www.dd-wrt.com/phpBB2/viewtopic.php?p=417089#417089
myeyre
DD-WRT Novice


Joined: 26 Mar 2009
Posts: 31

PostPosted: Sat Apr 10, 2010 10:55    Post subject: Reply with quote
It seems to be a hardware problem. There are bad blocks in the nvram part of the flash.

Today I managed to replace the flash chip with a new one. Now it is up and running DD-WRT again.

The original chip model is MX25L3205A, but the replacement is MX25L3205D, everything seems fine at the moment.

Great thanks to Lin who did the soldering work for me. Thanks.
bullfrog528
DD-WRT Novice


Joined: 16 Jan 2009
Posts: 26

PostPosted: Thu Apr 29, 2010 15:36    Post subject: Reply with quote
myeyre wrote:


The original chip model is MX25L3205A, but the replacement is MX25L3205D, everything seems fine at the moment.



Hi
I've been trying to track down a supply of these flash chips. If you don't mind me asking where did you get them from?

Thanks

Bullfrog
tenho
DD-WRT Novice


Joined: 16 Mar 2009
Posts: 16

PostPosted: Thu Sep 16, 2010 9:39    Post subject: Reply with quote
I am also very interested on where to get such flash chip? Rolling Eyes

Cheers!
papagogo
DD-WRT Novice


Joined: 15 Sep 2007
Posts: 8

PostPosted: Fri Oct 05, 2012 11:37    Post subject: Reply with quote
Thank you very much.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum