Bricked Buffalo WBR-G54 while setting up OpenVPN server

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
xnok
DD-WRT Novice


Joined: 03 Jun 2008
Posts: 15

PostPosted: Tue Jun 03, 2008 4:13    Post subject: Bricked Buffalo WBR-G54 while setting up OpenVPN server Reply with quote
I just bricked a Buffalo wbr-g54 that was running v24-vpn variant when trying to follow the instructions on the tutorials page to setup a OpenVPN between two sites. It never came out of the reboot after saving the commands. This was to be the server side device.

Anyone else have this problem? The router is practically dead and I am going to try the JTAG revival method. TFTP methods do not work.

Thanks,
xnok
Sponsor
mtspace
DD-WRT Novice


Joined: 24 Feb 2009
Posts: 4

PostPosted: Tue Feb 24, 2009 5:20    Post subject: Another bricked WBR-G54 Reply with quote
I too have bricked my WBR-G54 (v24 vpn) after following the Wiki howto for OpenVPN with certificates. Symtoms are:

1. Power light + all 4 LAN lights go on briefly when power cable is plugged in.

2. Power light and LAN lights for any connected ports remain on. The remaining LAN lights go out and no other lights go on. Crucially, the red diagnostic light NEVER lights up. This usually lights up on power up and when the reset button has been depressed for a while.

4. LAN lights for connected ports flicker if the router is pinged but it never responds, ping return messages are "destination host unreachable", "hardware error" or "request timed out", depending on point in the 30-30-30 hard reboot cycle. Trying to upload a .bin via TFTP on power up times out (as expected with no ping response).

There is a warning in the Wiki that the configuration file with the certificates and keys in it exceeds NVRAM but another note states that bricking has only previously been reported for WRT54Gv1 & v2. I think we can definitely add the Buffalo WBR-G54 to that list now :o/

I was very wary of exceeding the available NVRAM space, and checked the available NVRAM with "nvram show | grep size" prior to saving the startup script. I got 9,544 bytes, which I thought was more than sufficient for my 4,377 byte script. I'd just reflashed the router and had not rebooted since making some configuration changes, including setting up my wifi key, so I don't know if there were things still to be written to NVRAM. Even so, I can't imagine my changes to the settings requiring an extra 500kB of NVRAM.

I was experimenting with both the dd-wrt.v24_vpn_generic.bin (config screen for OpenVPN certs/keys/config) and dd-wrt.v24-9517_VINT_openvpn.bin builds. I had trouble getting the router to work as a wifi client bridge using the vpn_generic build, so I switched back to the VINT_openvpn build for my bricking incident. [EDIT: the exact build (from About.htm after de-bricking) is: DD-WRT v24 (05/20/08) vpn (SVN revision 9517M Eko)]

I'm thinking about getting a JTAG cable and soldering iron to de-brick my router, but don't want to spend £20 on it if it's never going to be able to run OpenVPN.

xnok - did you manage to debrick your router and get it working with OpenVPN? Has anyone else got a WBR-G54 working with OpenVPN - with or without an intermediate bricking :o). I have seen several success stories with other 4MB NVRAM routers so can't help but think it must be possible on this one. Is there an agressively minimal config script for Open VPN on 4MB? The wiki mentions storing the scrift in jffs, but this appears not to be available in the vpn build.


Last edited by mtspace on Thu Feb 26, 2009 2:57; edited 1 time in total
xnok
DD-WRT Novice


Joined: 03 Jun 2008
Posts: 15

PostPosted: Wed Feb 25, 2009 3:39    Post subject: Debricking the Buffalo WBR-G54 Reply with quote
I never got the router unbricked, even with the JTAG. I made a passive JTAG cable according to the specs available here somewhere, and that did not work either. I do know that the JTAG cable works because I have since upgraded three WRT-54 T-mobile routers using this cable successfully.

As far the WBR-G54, RIP. Sad
mtspace
DD-WRT Novice


Joined: 24 Feb 2009
Posts: 4

PostPosted: Thu Feb 26, 2009 2:08    Post subject: JTAG looking promising Reply with quote
xnok Did you manage to communicate with your WBR-G54 at all using your JTAG cable? I built a JTAG cable today and have so far managed to successfully backup my cfe, nvram and kernel. I'm doing a wholeflash backup now and then hope to debrick my router (fingers crossed). However, I had two major issues before I communicated successfully with my router via JTAG.

Problem 1: "Unknown or NO CPU Chip ID Detected"

When picking up the bits for my cable today I managed to come away with 1k ohm resistors rather than 100 ohm resistors Embarassed. Of course, that didn't stop me building the cable anyway Wink. Needless to say, the cable didn't work with 1k resistors. I got the following "Unknown or NO CPU Chip ID Detected" error (I didn't copy my exact error message, so the reported CPU chip ID may not have been the same - I got the all 1's ID from running the program with the cable disconnected but I think it was the same with the 1k resistors):

Quote:

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
1) WRT54G/GS is not Connected.
2) WRT54G/GS is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.


Solution 1: Don't have any resistors in the JTAG cable

I remembered reading in the wiki that the Buffalo WHR-HP-G54 already had resistors on the PCB
Quote:
forget the resistors the PCB already has them
(Source: http://www.dd-wrt.com/wiki/index.php/Recover_from_a_Bad_Flash#Open_Buffalo_WHR-G54S_and_Buffalo_WHR-HP-G54)

I checked just upstream of the JTAG pins on my WBR-G54 with my multimeter and sure enough there were resistors of 850-1450 ohms upstream of pins 3,5,7,9 (actually I think they're diodes of some sort as I can only get a measurement with my multimeter leads one way round).

Inspired by this (and driven by the type of stubborness one gets from having your plans derailed by your own mistake Wink) I shorted across the resistors in my JTAG cable with some wires and tried again. This was much more promising. My chipset was now recognised! However...

Problem 2: The debricking utility stalls at the "Clearing Watchdog ..." step
Quote:

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000100011100010000000101111111 (0471017F)
*** Found a Broadcom BCM4702 Rev 1 CPU chip ***

- EJTAG IMPCODE ....... : 00000000100000000000100100001000 (00800908)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ...

After reading around on the forum briefly, I tried skipping the watchdog clearing step with the /nocwd flag, but then it just stalled at the next command.
Quote:

Clearing Watchdog ... Skipped

Probing Flash at (Flash Window: 0x1fc00000) ...

Then I remembered reading something about the watchdog timer in HairyDairyMaid's debrick guide.

Quote:

You need to type the requested command line option in completely and just before hitting <ENTER> plug in the power cable to the WRT54G. In other words – have the JTAG cable hooked up to both the PC and router with the router’s power off and then type the command line you wish and plug in the router and hit <ENTER>. The command should start working and progress will be seen on screen.

*** IMPORTANT NOTE ***
Anytime you re-run the program, follow the above step – it is important since the WRT54G v2 has a Watchdog Timer built into it that will reset things at a very inappropriate time in the flash process if it cannot be disabled quickly by the software.


I think what was happening was that the watchdog timer on the WBR-54G "times out" (or whatever it is watchdog timers do Confused) very quickly and the debrick utility needs to send the "clear watchdog" command before this or the program can't get beyond identifying the chip. Basically, the program needs to be run in the very short space of time after plugging in the power when all 4 LAN lights are on.

Solution 2: Have the wrt54g command already typed at the command line when you power on the router and hit enter immediately after plugging in (while all the LAN lights are still on)

My wholeflash backup has just completed so I'm off to erase my NVRAM and hopefully debrick my router. I'll let you know how I get on.
mtspace
DD-WRT Novice


Joined: 24 Feb 2009
Posts: 4

PostPosted: Thu Feb 26, 2009 2:51    Post subject: Sucessful debrick with JTAG Reply with quote
YaaaaaaaaaaaaaaaY!! Very Happy Very Happy Very Happy

Just accessed the web config page of my WBR-G54 - all I had to do was erase the NVRAM.

After erasing the NVRAM, the little red diagnostic light started flashing merrily away when I next plugged the router in. For any pedants who come across this thread, it flashes once about 10 seconds after reboot and then a further three times in quick succession after a further 5 seconds or so.

I forgot to see if I could ping the router or access the web config page straight after erasing the nvram and jumped straight into a 30-30-30 hard reset (I blame an overdose of subliminal peacock messages quietly brainwashing me during my late night trawls of the forum for debricking advice Wink). The red light magic was back during the hard reboot as well, and I could ping the router and access the web config page after the reboot. Up til now I'd always associated red lights with Bad Stuff (TM), but now I know red lights are our friends :D

Now I'm going to grab a beer and see if I can get OpenVPN working with certificates without bricking my router again Very Happy
redhawk0
DD-WRT Guru


Joined: 04 Jan 2007
Posts: 10882
Location: Wherever the wind blows- North America

PostPosted: Thu Feb 26, 2009 13:05    Post subject: Re: Sucessful debrick with JTAG Reply with quote
mtspace wrote:
YaaaaaaaaaaaaaaaY!! Very Happy Very Happy Very Happy

Just accessed the web config page of my WBR-G54 - all I had to do was erase the NVRAM.

After erasing the NVRAM, the little red diagnostic light started flashing merrily away when I next plugged the router in. For any pedants who come across this thread, it flashes once about 10 seconds after reboot and then a further three times in quick succession after a further 5 seconds or so.

I forgot to see if I could ping the router or access the web config page straight after erasing the nvram and jumped straight into a 30-30-30 hard reset (I blame an overdose of subliminal peacock messages quietly brainwashing me during my late night trawls of the forum for debricking advice Wink). The red light magic was back during the hard reboot as well, and I could ping the router and access the web config page after the reboot. Up til now I'd always associated red lights with Bad Stuff (TM), but now I know red lights are our friends :D

Now I'm going to grab a beer and see if I can get OpenVPN working with certificates without bricking my router again Very Happy


Don't use the V24-Final or V24-SP1 builds...they had VPN problems.

Give the latest build a try.
http://www.dd-wrt.com/dd-wrtv2/downloads/others/eko/BrainSlayer-V24-preSP2/210209/broadcom/dd-wrt.v24_vpn_generic.bin

If by some chance (xnok) that you need a CFE for this unit...I have one from my working unit that I can provide....just send me a PM with your MAC address.

redhawk

_________________
I currently test dd-wrt on Asus, Buffalo, Linksys, and Netgear. Too many to list.

Looking for more test units (newer models) for the project...got a brick?...PM me to make a donation. (USA) A donation is not a debricking service....it is a way to "Give back" to the dd-wrt project.

I do NOT provide personal assistance through chat or phone....so please don't ask.
mtspace
DD-WRT Novice


Joined: 24 Feb 2009
Posts: 4

PostPosted: Thu Feb 26, 2009 23:29    Post subject: OpenVPN on WBR-G54 Reply with quote
Quote:

Don't use the V24-Final or V24-SP1 builds...they had VPN problems.

Give the latest build a try.
http://www.dd-wrt.com/dd-wrtv2/downloads/others/eko/BrainSlayer-V24-preSP2/210209/broadcom/dd-wrt.v24_vpn_generic.bin


redhawk: Thanks for the advice and link to the updated build. I managed to get OpenVPN working with a static key last night using the DD-WRT v24 (05/20/08) vpn (SVN revision 9517M Eko) build I previously bricked trying to get certificates working. I was going to avoid playing with certificates until I'd had the time to do some more research on the best build and script/certificate loading technique. I'll try OpenVPN with certificates on the preSP2 build you suggested and let you know how it goes. However, it might be a week or so before I can get round to it.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum