[belezao]

I tried update the wrt350nv1 dd-wrt to openwrt. Result Bricked

I found an original firmware v1.058beta and flashed it by tftp and serial console.(flash -noheader : flash1.trx). Router worked, but without wireless signal! I flashed it again, flash -ctheader : flash1.trx. Now router is bricked again and I can't flash.
Serial Console:


CFE version 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Mon Oct 30 23:22:44 CST 2006 (root@linux)
Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena
Initializing PCI. [normal]
PCI: Initializing host
SB PCI init done

0x3c = 0x00000100
PCI bus 0 slot 0/0: vendor 0x14e4 product 0x0800 (flash memory, rev 0x02)
PCI bus 0 slot 1/0: vendor 0x14e4 product 0x471f (ethernet network, rev 0x02)
PCI bus 0 slot 2/0: vendor 0x14e4 product 0x471a (USB serial bus, interface 0x10, rev 0x02)
PCI bus 0 slot 2/1: vendor 0x14e4 product 0x471a (USB serial bus, interface 0x20, rev 0x02)
PCI bus 0 slot 3/0: vendor 0x14e4 product 0x471b (USB serial bus, rev 0x02)
PCI bus 0 slot 4/0: vendor 0x14e4 product 0x0804 (PCI bridge, rev 0x02)
PCI bus 0 slot 5/0: vendor 0x14e4 product 0x0816 (MIPS processor, rev 0x02)
PCI bus 0 slot 6/0: vendor 0x14e4 product 0x471d (IDE mass storage, rev 0x02)
PCI bus 0 slot 7/0: vendor 0x14e4 product 0x4718 (network/computing crypto, rev 0x02)
PCI bus 0 slot 8/0: vendor 0x14e4 product 0x080f (RAM memory, rev 0x02)
PCI bus 0 slot 9/0: vendor 0x14e4 product 0x471e (class 0xfe, subclass 0x00, rev 0x02)
PCI bus 1 slot 0/0: vendor 0x14e4 product 0x4785 (host bridge, rev 0x02)
Initializing Devices.

No DPN
This is a Parallel Flash
Partition information:
boot #00 00000000 -> 0003FFFF (262144)
trx #01 00040000 -> 0004001B (2
os #02 0004001C -> 007F7FFF (8093668)
nvram #03 007F8000 -> 007FFFFF (32768)
Partition information:
boot #00 00000000 -> 0003FFFF (262144)
trx #01 00040000 -> 007F7FFF (8093696)
nvram #02 007F8000 -> 007FFFFF (32768)
PCI bus 0 slot 1/0: _pci_map_mem: attempt to map 64-bit region tag =0x800 @ addr=18010004
PCI bus 0 slot 1/0: _pci_map_mem: addr=0x18010004 pa=0x18010000 pci_mem_space_pci_base=0x40000000 pci_mem_space=0x8000000
mcfg = 000810fe
ge0: BCM5750 Ethernet at 0x18010000
CPU type 0x2901A: 300MHz
Total memory: 32768 KBytes

Total memory used by CFE: 0x80300000 - 0x803A7AB0 (686768)
Initialized Data: 0x8033C900 - 0x8033FCB0 (13232)
BSS Area: 0x8033FCB0 - 0x80341AB0 (7680)
Local Heap: 0x80341AB0 - 0x803A5AB0 (409600)
Stack Area: 0x803A5AB0 - 0x803A7AB0 (8192)
Text (code) segment: 0x80300000 - 0x8033C900 (248064)
Boot area (physical): 0x003A8000 - 0x003E8000
Relocation Factor: I:00000000 - D:00000000

Boot version: v4.2
The boot is CFE

mac_init(): Find mac [00:1D:7E:4A:9F:1E] in location 0
Nothing...

eou_key_init(): Find key pair in location 4
The eou device id is same
The eou public key is same
The eou private key is same
CMD: [ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0]
bcm5700: no firmware rendevous


Can I recover it?
30-30-30 did not work
CTRL + C did not work

[belezao]

Today I tried tjtag, I made one 15cm cable and 5 resistors 100 Ohms (there aren't new, I removed from some older power supplies, they have 100 Ohms, but are very, very small)

DB 25 WRT350n V1
Pin 2 ----- Pin 3 With res of 100Ohms
Pin 3 ----- Pin 9 With res of 100Ohms
Pin 4 ----- Pin 7 With res of 100Ohms
Pin 5 res of 100Ohms --- NC ****
Pin 13 ----- Pin 5 With res of 100Ohms
Pin 18-25 Pin 2

**** I tried pin 5 without res too (same result)



Led status when I plug power

Power --- flashing
ETH 1-4, Internet,USB --- ON
Wifi,Security --- OFF

After 1 or 2 seconds all OFF, just power continues flashing

Test one:

Version ???

C:\tjtag>w -probeonly
====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 00000100011110000101000101111111 (0478517F)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
1) WRT54G/GS is not Connected.
2) WRT54G/GS is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.







Version 3.02

C:\tjtag>tjtag -probeonly

==============================================
EJTAG Debrick Utility v3.0.2 RC2-1 Tornado-MOD
==============================================

Selected port = 0x378

Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete

Detected IR chain length = 0
Number of device(s) = 0

Probing bus ... Done

Instruction Length set to 5

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** Unknown or NO CPU Chip ID Detected ***

*** Possible Causes:
1) Device is not Connected.
2) Device is not Powered On.
3) Improper JTAG Cable.
4) Unrecognized CPU Chip ID.






Test two:

Version ???

C:\tjtag>w -probeonly /skipdetect

====================================
WRT54G/GS EJTAG Debrick Utility v4.8
====================================

Probing bus ... Done

Instruction Length set to 0

CPU Chip ID: 00000000000000000000000000000000 (00000000)
*** CHIP DETECTION OVERRIDDEN ***

- EJTAG IMPCODE ....... : 00000000000000000000000000000000 (00000000)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor did NOT enter Debug Mode!> ... Done
Clearing Watchdog ... Done

Probing Flash at (Flash Window: 0x1fc00000) ... Done

*** Unknown or NO Flash Chip Detected ***

*** REQUESTED OPERATION IS COMPLETE ***


In this test, power led change to ON and usb led change to flashing






Version 3.02

C:\tjtag>tjtag -probeonly /skipdetect

==============================================
EJTAG Debrick Utility v3.0.2 RC2-1 Tornado-MOD
==============================================

Selected port = 0x378

Intial value of Control register is 000000CC
Intial value of status register is 0000007F
01111111 (0000007F)

Status bit 7 Busy Inverted pin 11 = 1
Status bit 6 *Ack pin 10 = 1
Status bit 5 Paper-out pin 12 = 1
Status bit 4 Select pin 13 = 1
Status bit 3 *Error pin 15 = 1
* means low = true, e.g., *Error

VCC connected
values of Control register after init 0x000000CC
value of status register after init 0x0000007F
system reset complete

Detected IR chain length = 0
Number of device(s) = 0

Probing bus ... Done

Instruction Length set to 0

CPU Chip ID: 11111111111111111111111111111111 (FFFFFFFF)
*** CHIP DETECTION OVERRIDDEN ***

- EJTAG IMPCODE ....... : 11111111111111111111111111111111 (FFFFFFFF)
- EJTAG Version ....... : Unknown (7 is a reserved value)
- EJTAG DMA Support ... : No
- EJTAG Implementation flags: R3k DINTsup ASID_8 ASID_6 MIPS16 NoDMA MIPS64

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Skipped
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Init PrAcc ...

Here no leds changes (just power led flashing). I wait 2 min and no change in "Init PrAcc ..." I stoped it ctrl + c



As I had a lot of resistors I made another cable, same configuration and same results. (if configuration is correct, the cable should be OK, but if configuration is wrong, both cables are wrongs)

I didn't have jtag pinout of the wrt350n V1, so I did like WRT54G. I don't know if is correct.

I tried in two desktops, winXP Pro, lpt1 on board

[barryware]

with the newer tjtag, you need to use the /cable:dlc5 switch when using an un-buffered cable.

If you were using a buffered cable (wiggler), no need to use the /cable switch as that is the default.

>tjtag -probeonly /cable:dlc5

Your connection is working. With the older version of jtag, it sees the processor. It just does not know what it is.

And.. In regard to your wireless not working.. The 350 has a pcmcia card for the radio.. I know this because I retrofitted a different card into it to support 5ghz.. And.. It worked.

Point: remove the card and re-seat it. Don't f$ck it up.. It is easy to insert the card one pin row off (ask me how I know).

If I recall (it has been a while), I had to remove the card to install the jtag header..

You can search the forum for the threads and pics..

That said, newer builds do not support the pcmcia card. I do not recall what build I used at the time..

Just worthless info.. tjtag will work as long as you use the /cable:dlc5 switch..

[belezao]

Thank you for the reply! Added /cable:dlc5 didn't work, with or without it the result is the same... BUT... as you said the cable was correct I focused in the software and found this another version brjtag..

C:\brjtag\win32>brjtag -probeonly

===============================================
Broadcom EJTAG Debrick Utility v2.0.5-hugebird
===============================================

Probing bus ... Done

Detected IR Length is 8

CPU assumed running under LITTLE endian

CPU Chip ID: 00000100011110000101000101111111 (0478517F)
*** Found a Broadcom manufactured BCM4705|4785 REV 01 CPU ***

- EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped

Probing Flash at Address: 0x1FC00000 ...
Detected pFlash Chip ID (VenID:DevID = 0089 : 0017)
*** Found a (8MB) CFI Compatiable Flash Chip from Intel



*** REQUESTED OPERATION IS COMPLETE ***


and ...


C:\brjtag\win32>brjtag -erase:nvram

===============================================
Broadcom EJTAG Debrick Utility v2.0.5-hugebird
===============================================

Probing bus ... Done

Detected IR Length is 8

CPU assumed running under LITTLE endian

CPU Chip ID: 00000100011110000101000101111111 (0478517F)
*** Found a Broadcom manufactured BCM4705|4785 REV 01 CPU ***

- EJTAG IMPCODE ....... : 00000000100000010000100100000100 (00810904)
- EJTAG Version ....... : 1 or 2.0
- EJTAG DMA Support ... : Yes
- EJTAG Implementation flags: R4k MIPS16 MIPS32

Issuing Processor / Peripheral Reset ... Done
Enabling Memory Writes ... Done
Halting Processor ... <Processor Entered Debug Mode!> ... Done
Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped

Probing Flash at Address: 0x1FC00000 ...
Detected pFlash Chip ID (VenID:DevID = 0089 : 0017)
*** Found a (8MB) CFI Compatiable Flash Chip from Intel

- Flash Chip Window Start .... : 1C000000
- Flash Chip Window Length ... : 00800000
- Selected Area Start ........ : 1C7E0000
- Selected Area Length ....... : 00020000

*** You Selected to Erase the NVRAM.BIN ***

=========================
Erasing Routine Started
=========================
Total Blocks to Erase: 1

Erasing block: 64 (addr = 1C7E0000)...Done
=========================
Erasing Routine Complete
=========================
elapsed time: 1 seconds


*** REQUESTED OPERATION IS COMPLETE ***


After I did an erase:kernel too and put dd-wrt mini and mega build 29218

Router is working again!! Wireless is Working Again!!!

Just an issue, when I try access it by 192.168.1.1, I can't, it shows "http://192.168.1.1/cgi-bin/luci" , but 192.168.1.1/index.asp it's OK.

Take a look in the boot, has warnings, are there problems?
Sorry my bad English


Boot version: v4.2
The boot is CFE

mac_init(): Find mac [00:1D:7E:4A:9F:1E] in location 0
Nothing...

eou_key_init(): Find key pair in location 4
The eou device id is same
The eou public key is same
The eou private key is same
CMD: [ifconfig eth0 -addr=192.168.1.1 -mask=255.255.255.0]
bcm5700: no firmware rendevous
eth0: Link speed: 1000BaseT FDX
Device eth0: hwaddr 00-1D-7E-4A-9F-1E, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
CMD: [go;]
Check CRC of image1
Len: 0x780000 (7864320) (0xBC040000)
Offset0: 0x1C (2 (0xBC04001C)
Offset1: 0x9D0 (2512) (0xBC0409D0)
Offset2: 0xE5000 (937984) (0xBC125000)
Header CRC: 0xAAB1D44C
Calculate CRC: 0xAAB1D44C
Image 1 is OK
Try to load image 1.
CMD: [load -raw -addr=0x803a7ab0 -max=0x3a0000 :]
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
CMD: [boot -raw -z -addr=0x80001000 -max=0x3a0000 flash0.os:]
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3916 bytes read
Entry at 0x80001000
Starting program at 0x80001000
CPU ProcId is: 0x0002901a, options: 0x0000004d
Linux version 2.4.37 (root@nmndev) (gcc version 3.4.6 (OpenWrt-2.0)) #43463 Mon Mar 7 04:05:46 CET 2016
Setting the PFC to its default value
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
CPU: BCM4785 rev 2 at 300 MHz
Using 150.000 MHz high precision timer.
Calibrating delay loop... 299.82 BogoMIPS
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
Checking for 'wait' instruction... unavailable.
POSIX conformance testing by UNIFIX
PCI: Initializing host
PCI: Enabling CardBus
PCI: Ignoring BAR0-1 of IDE controller 00:06.0
PCI: Fixing up bus 0
PCI: Fixing up bridge
PCI: Setting latency timer of device 01:00.0 to 64
PCI: Fixing up bus 1
Initializing RT netlink socket
Starting kswapd
devfs: v1.12c (20020818) Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
squashfs: version 3.0 (2006/03/15) Phillip Lougher
pty: 256 Unix98 ptys configured
Serial driver version 5.05c (2001-07-0 with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xb8000300 (irq = 2) is a 16550A
ttyS01 at 0xb8000400 (irq = 2) is a 16550A
PCI: Setting latency timer of device 01:01.0 to 64
PCI: Enabling device 01:01.0 (0004 -> 0006)
PPPoL2TP kernel driver, V0.13
Universal TUN/TAP device driver 1.5 (C)1999-2002 Maxim Krasnyansky
Physically mapped flash: Found an alias at 0x800000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x1000000 for the chip at 0x0
Physically mapped flash: Found an alias at 0x1800000 for the chip at 0x0
cfi_cmdset_0001: Erase suspend on write enabled
0: offset=0x0,size=0x20000,blocks=64
Using buffer write method
Flash device: 0x800000 at 0x1c000000
bootloader size: 262144
Physically mapped flash: Filesystem type: squashfs, size=0x684dab
partition size = 6926336
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "cfe"
0x00040000-0x007e0000 : "linux"
0x00125000-0x007c0000 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x007e0000-0x00800000 : "nvram"
0x007c0000-0x007e0000 : "ddwrt"
sflash not supported on this router
Initializing Cryptographic API
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
ip_conntrack version 2.1 (512 buckets, 4096 max) - 336 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
ipt_random match loaded
netfilter PSD loaded - (c) astaro AG
ipt_osf: Startng OS fingerprint matching module.
ipt_IPV4OPTSSTRIP loaded
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
WRT350N GPIO Init
VFS: Mounted root (squashfs filesystem) readonly.
Mounted devfs on /dev
start service
starting Architecture code for broadcom
done
Booting device: Linksys WRT350N
Broadcom Gigabit Ethernet Driver bcm5700 ver. 8.3.14 (11/2/05)
PHY ID unknown, assume it is a copper PHY.
bcm_robo_attach: devid read succesfully via mii: 0x97
bcm_robo_attach: mii access to switch works
bcm_robo_attach: Resetting 539x robo switch
Enable WRT350 LED fix
eth1: Broadcom BCM4785 10/100/1000 Integrated Controller found at mem 18010000, IRQ 5, node addr 001d7e4a9f1e
eth1: tranceiver BC050CD0
eth1: tbiflags 0
eth1: Unknown transceiver found
eth1: Scatter-gather ON, 64-bit DMA ON, Tx Checksum ON, Rx Checksum ON, 802.1Q VLAN ON, NAPI ON
roboswitch: Probing device eth0: <3>roboswitch: [switch-robo.c:132] SIOCGETCPHYRD failed!
roboswitch: [switch-robo.c:132] SIOCGETCPHYRD failed!
No Robo switch in managed mode found, phy_id = 0xffffffff
roboswitch: Probing device eth1: found a 5397!
eth1: Using PCI INTX interrupt
[USB] checking...
usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
ehci_hcd 00:02.1: PCI device 14e4:471a
ehci_hcd 00:02.1: irq 3, pci mem b8002800
usb.c: new USB bus registered, assigned bus number 1
ehci_hcd 00:02.1: illegal capability!
ehci_hcd 00:02.1: USB 0.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
hub.c: USB hub found
hub.c: 2 ports detected
usb-uhci.c: $Revision: 1.275 $ time 04:04:46 Mar 7 2016
usb-uhci.c: High bandwidth mode enabled
usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
usb-ohci.c: USB OHCI at membase 0xb8002000, IRQ 3
usb-ohci.c: usb-00:02.0, PCI device 14e4:471a
usb.c: new USB bus registered, assigned bus number 2
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver usblp
printer.c: v0.13: USB Printer Device Class driver
cannot open /proc/sys/net/bridge/bridge-nf-call-arptables
cannot open /proc/sys/net/bridge/bridge-nf-call-ip6tables
cannot open /proc/sys/net/bridge/bridge-nf-call-iptables
removing lockfile
sh: can't create /sys/devices/virtual/net/br0/bridge/multicast_snooping: nonexistent directory
device br0 entered promiscuous mode
br0: No such file or directory
vlan1: dev_set_promiscuity(master, 1)
device eth1 entered promiscuous mode
device vlan1 entered promiscuous mode
br0: No such file or directory
eth0: Operation not supported
eth0: Numerical result out of range
nbw = 20
eth0: Operation not supported
eth0: Operation not supported
eth0: Operation not supported
eth0: Operation not supported
eth0: Invalid argument
eth0: Invalid argument
eth0: Operation not supported
eth0: Operation not supported
eth0: Operation not supported
eth0: Operation not supported
eth0: Operation not supported
eth0: Operation not supported
device eth0 entered promiscuous mode
device br0 left promiscuous mode
device br0 entered promiscuous mode
device br0 left promiscuous mode
mknod: No such file or directory
mknod: No such file or directory
mknod: No such file or directory
cannot open /proc/irq/163/smp_affinity
cannot open /proc/irq/169/smp_affinity
device vlan2 entered promiscuous mode
ip_conntrack_pptp version 1.9 loaded
ip_nat_pptp version 1.5 loaded
cannot open /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeouts
vlan2: Setting MAC address to 00 1d 7e 4a 9f 1f.
vlan2: dev_set_promiscuity(master, 1)
vlan2: dev_set_allmulti(master, 1)
vlan2: dev_set_promiscuity(master, -1)
device vlan2 left promiscuous mode
vlan2: dev_set_allmulti(master, -1)
iptables v1.3.7: can't initialize iptables table `raw': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
vlan2: No such process
ip_nat_pptp version 1.5 unloaded
ip_conntrack_pptp version 1.9 unloaded
ip_conntrack_pptp version 1.9 loaded
ip_nat_pptp version 1.5 loaded
cannot open /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeouts
Radio: 0 currently turned off
/opt/etc/init.d/rcS: No such file or directory
/jffs/etc/init.d/rcS: No such file or directory
/mmc/etc/init.d/rcS: No such file or directory
The Milkfish Router Services
ERROR: Necessary service setting not found: milkfish_username - aborting.
The Milkfish Router Services
Restoring SIP ddsubscriber database from NVRAM...
Empty.
The Milkfish Router Services
Restoring SIP ddaliases database from NVRAM...
Empty.
/mnt/smbshare