Hi guys

first of all I'm not 100% sure this is the right place for starting this thread so please if there is any other place
please move it!!!!

I bricked my WRT54G V2 a week ago when trying to flash the Linksys original 4.21 FW. I did click on the WIFI
auto connect SES and it never came back so I unplugged and finally bricked the box....

I have tried the pin shortcut method (I know that I shouldn't but I read that later) with no success however
when looking at the pins with a magnifying glass they look ok...

I have tried then with a Siemens ME45 Serial and an Ericsson T28 cable (based on MAX3232 IC) which
according to wiki should work but I never get anything from the box unless I play around shortcutting the TX
and RX pins... In those cases I sometimes get CFE> but I cannot send any command or at least I don't get
any answer.... here you have the cables pinouts:

http://pinouts.ru/CellularPhones-A-N/er … nout.shtml

http://www.hardwarebook.info/Siemens_C25/S25

As I understand the CFE through serial console should work no matter the pins are damaged or not so I must
be geting something from there!!!! Just for you to know I'm using Hyperterminal with 115200 8N1 but I have
also tried with PuTTY...

Does anyone have any idea why I'm not getting anything on the console?????

Many thanks in advance!!

(Last edited by karmacoma on 24 Feb 2008, 14:17)

I don't think this is the whole answer, but you must make sure to DISABLE hardware flow control, otherwise you will not be able to send anything to the router.

Be sure "Flow Control" is set to NONE (I recall somewhere seeing differently).

BUT... I have also seen some drivers (talking about the PC you're using) do "NONE" improperly which is why you'll see the connections: 4-to-6 and 7-to-8 (on the female/DB9F into the adapter).  This makes your PC end happy when it doesn't know what no-hardware-flow-control means.  If those adapters actively use those pins you might consider disconnecting and wiring directly.  Long shot if NONE still doesn't work.

Sanity check...

JP2-2 +3.3V
JP2-4  Data TO the PC
JP2-6  Data FROM the PC
JP2-10 GND

Just curious exactly what you mean by "shortcutting the TX and RX pins".  You got the CFE> prompt.

I got it going last summer and wrote in my notes to hit Ctrl-C early after power on - but I think this may be unique to me (I use a MAX3233 with a low-power mode I've been meaning to disable, the activity wakes it up).  I next see "Please press Enter to activate this console." but this is a WRT54G v4 so it may differ in your V2.  If I do not activate into CFE it still screams the boot messages at me.

Have you tried setting up some box in 192.168.1.x and ping 192.168.1.1 during boot?  If you see 1 or more replies you might be able to use the tftp flash method (which has bailed me out many times).  After religiously making sure the "boot_wait" variable is always set I recently caught that isn't always true.

HTH
Bill

(Last edited by Bill_MI on 24 Feb 2008, 16:52)

hi guys!!!

first of all thanks for such quick answers!!!

I have tried the ping thing several times with no success, maybe I have to do it faster
but having ping -t running, the cable connected and connecting the power on the box
never gives you any answer....

I'm also wiring directly since it was faster, I would later think about installing the DB9
connector. However I'm wiring to the pins 1, 4, 6 and 9 since 1 and 2 are Vcc and 9
and 10 GND.... According to the T28 cable pinout (see link above) and the JP1 connector
layout:

JP2-2 +3.3V                     ====>>> Pin 11
JP2-4  Data TO the PC      ====>>> Pin 5
JP2-6  Data FROM the PC  ====>>> Pin 4
JP2-10 GND                     ====>>> Pin 10

I have tried with and without flow control but no answer at all....

As I mentioned I'm using hyperterminal in my W2k laptop  and I have also tried an
XP box just in case but I'm not sure if the driver is good enough to handle the
"No flow Control" properly.... Shall I use a different program (I tried with Putty as
well).

One more thing in the V2 at least it should be JP1 since JP2 is having 12pins and I
understood that is for JTAG.....

When I shortcut TX and RX in the cable I sometimes get strange characters in the
Hyerterminal and sometimes I get CFE> propmt or Invalid command or things like
that, for example:

Invalidà þ«üþ   Ã¾Ã¾2@[ $[d#I'

so it looks like the cable is somehow working. I tried then to change pins 4 and 5
above but nothing came (not even with the little shortcuts...).

Thanks once more!

Thoughts at large...

You're likely correct about JP1/JP2 - I have no experience with V2.  Pins 1-2 and 9-10 are both +3.3V and GND respectively on my V4.

I've never used puTTY for serial but your 115.2K/N/8/1 is verified for my V4.  I've used mostly Hyperterminal on Win2K and changed flash in the CFE but never loaded firmware via serial.

Touching the RX/TX together can create that jibberish all by itself.  No surprises there.  The router may not even have to be powered on to get that.

I must admit I've never trusted "NO FLOW CONTROL" based on very very old stuff and always connected the pins I mentioned.  This may be nothing at all.  Those connections simply never failed for me.

From your description I'm not sure what is happening.  Maybe the adapter doesn't have power (I notice the Erickson setup steals power from any USB port).  Maybe the adapter is driving the flow-control pins wrong (I still suggest getting them off the port and replaced with the connections above).  Maybe connections are bad (how's your circuit skill?).

Hopefully, if there's a big difference on a V2 someone will jump in with it.

Something to test if you can...

Instead of connecting to the WRT's pins 4 and 6, connect those data wires only to each other.

Now, with NO local echo in Hyperterminal, the connection should simply loop back.  This means if Hyperterminal happens to have local echo on you SHOULD see double characters you type and it'll go away if those wires are disconnected from each other.  If local echo is OFF then you only see the looped-back characters you type and nothing if disconnected.

If you can't get this to work then the adapter has something wrong.  If this works fine then the focus shifts to the WRT.  You're testing the whole data conversion both ways.

Hope I'm making sense.

Also, best I can tell tracing all signals your pin connections are correct.  The AFMS/RTS and CTS/ONREQ concerns me (CTS/RTS are flow control) and may need to simply connect together... pins 2 and 3 on the 11-pin Erickson.

(Last edited by Bill_MI on 25 Feb 2008, 04:43)

hi Bill!!!

Shall I take both CTS and RTS to Vcc in the cable? or just connect them together?? Could you
please clarify??

I will try both things (Rx-Tx together and see the echo, as well as CTS-RTS in the cable) as soon
as possible.

Just for you to know I'm always using the 3,3V connection towards the adapter since it is the
only way I get the jibberish, no way if the cable is disconnected from the WRT...

thanks a lot!

I was thinking of connecting RTS-CTS together because, although RS-232 is well defined, you really cannot trust those names unless that interface is really really correct (some aren't).  RS232 is funny in how ends are defined.  One end plays modem and one plays terminal - and the PC will be terminal.  But so many ends/chips play terminal anyway and the names get swapped.  This long horror story started in the 1960s.

Connecting together doesn't matter which is really in and which is really out.  RTS (RequestToSend) should be from terminal and CTS (ClearToSend) from modem.  But the logic levels at the WRT are inverted so CTS to GND should be right (be leery of my fuzzy memory) but who knows...

The adapter will need 3.3V somehow for the echo to work.  The WRT should is fine for that.  And I found echo buried in Hyperterminal under Settings tab, ASCII setup - looks like default to off so loopback will reply with typed characters.

I hope something sparks it working but I don't want you to blow anything.  Logic is pretty robust but some things may not be.

(Last edited by Bill_MI on 25 Feb 2008, 13:34)

Hi Bill

ok I've tried the following:

1.- shortcut pins 2-3 in the Ericsson connector absolutely nothing came out, not even when trying to
shortcut 5 and 4

2.- I have found out which were the cables to shortcut in the other end of the DB9 connector
according to web:

http://www.linksysinfo.org/forums/showt … hp?t=47535

and shortcut pins 7 and 8 in the other end of the DB9, this should in my opinion avoid the
question about taking 2-3 in the Ericsson connector to Vcc or GND.... but nothing at all
came out again...

3.- I have shortcut the pins 2-3 in the connector and checked I was receiving the echo
twice (when echo is set in the Hyperterminal)

I have then shortcut the 4-5 in the ericsson connector but nothing came back....

It's clear to me the ericsson cable needs the 3.3V on the other side otherwise it looks like nothing
happens...

Just to clarify, the Ericsson cable has this shape

WRT54G connector ------------------------ Cable circuit  --------------------------------------------- DB9 connector
                                                       (where the connector
                                                    to the mobile was placed)

I also have a Siemens ME45 cable. As I understand from the pinout:

http://www.hardwarebook.info/Siemens_C25/S25

I have connected hem in the following way:

JP2-2 +3.3V                     ====>>> Pin 4 (white)
JP2-4  Data TO the PC      ====>>> Pin 5 (red)
JP2-6  Data FROM the PC  ====>>> Pin 6 (orange)
JP2-10 GND                     ====>>> Pin 1 (black)

and finally works!!!!!!!!!

Now I need help with finding what to do, shall I open a new topic????

Many thanks!!!!!

Hi Bill

Just in case you can help, here you have what I get when powering on:

CFE version 1.0.37 for BCM947XX (32bit,SP,LE)

Build Date: Fri Feb 27 15:23:38 CST 2004 (root@honor)

Copyright (C) 2000,2001,2002,2003 Broadcom Corporation.

Initializing Arena.

Initializing Devices.

CPU type 0x29007: 192MHz

Total memory: 0x2000000 bytes (32MB)

Total memory used by CFE:  0x80334DC0 - 0x8043A310 (1070416)

Initialized Data:          0x80334DC0 - 0x80336F40 (8576)

BSS Area:                  0x80336F40 - 0x80338310 (5072)

Local Heap:                0x80338310 - 0x80438310 (1048576)

Stack Area:                0x80438310 - 0x8043A310 (8192)

Text (code) segment:       0x80300000 - 0x8030F220 (61984)

Boot area (physical):      0x0043B000 - 0x0047B000

Relocation Factor:         I:00000000 - D:00000000

Boot version: v2.3

The boot is CFE

mac_init(): Find mac [00:xx:xx:xx:xx:xx] in location 0

Nothing...

Reading :: Failed.: Error

CFE>

I cannot set any interface to 192.168.1.1 as

http://wiki.openwrt.org/OpenWrtDocs/Troubleshooting

suggests, any ideas??

thanks once more!!!!

(Last edited by karmacoma on 28 Feb 2008, 13:49)

How about the boot_wait=on then using tftp?

EDIT: I notice typing "help" without the quotes gives you a list of CFE commands.
Also, that :: Failed :: seems to be normal when interrupting it for CFE.

(Last edited by Bill_MI on 27 Feb 2008, 00:08)

Hi Bill!!!

I set boot_wait=on properly or at least it accepts the command.... Unfortunately I cannot
paste the result here right now...

I have tried "nvram show" as well for example but it hangs at some stage as if it cannot read
any longer, I will paste this asap as well but I'm afraid the NVRAM might be somehow
damaged...

Many thanks once more

PD: for some reason my last posts appear twice I don't know why.....

Yes, it sounds like NVRAM corruption.  I'm not sure how safe it is on your v2 to erase NVRAM which should trigger an initialization of all NVRAM values.  But a brick could be the result.  Maybe, if we can somehow figure out what value is corrupt maybe it could be fixed.

EDIT: horrible hasty spelling.

(Last edited by Bill_MI on 28 Feb 2008, 13:28)

According to: http://wiki.openwrt.org/OpenWrtDocs/Har … sys/WRT54G erasing NVRAM is safe on the V2.  On a v4, CFE help on the nvram says:

CFE> help nvram

  SUMMARY

     NVRAM utility.

  USAGE

     nvram [command] [args..]

     Access NVRAM.

  OPTIONS

     get [name]   Gets the value of the specified variable
     set [name=va Sets the value of the specified variable
     unset [name] Deletes the specified variable
     commit       Commit variables to flash
     erase        Erase all nvram
     show         Shows all variables

If you have time on your side you can proceed more cautiously and see if someone can confirm this is a feasible way.

Hi Bill

yes I see, I was able to get the complete nvram show printout by setting the variable
giving problems to 0, it was "sshd_hostkey" so I don't think it is needed at this stage....

However I still get the same problem when booting:

Boot version: v2.3

The boot is CFE

mac_init(): Find mac [00:xx:xx:xx:xx:xx] in location 0

Nothing...

Reading :: Failed.: Error

I have tried to set the proper value  (the one in the sticker) in the nvram
however it still doesn't work and the reset button doesn't seem to have
any effect on the nvram either, do you have by chance a default nvram
setting, I have been looking for it through the threads but no success...

The nvram command looks the same in the V2...

Do you think a JTAG cable could help better at this stage????

Thanks!!!

Hi Bill

I finally managed to get it back working, these are the setting I think made it work:

et0macaddr=00:xx:xx:xx:xx:xx
et0mdcport=0
et0phyaddr=30
vlan0hwname=et0
vlan1hwname=et0

the missing one was et0phyaddr, I compare my NVRAM setting with the
ones in the following post:

http://forum.openwrt.org/viewtopic.php?id=14271

and found et0phyaddr was missing, i just set it and it started working back,
I didn't even need to reflash since the FW was still there!!!

Thanks a lot Bill I don't think I could have made it without your help!

(Last edited by karmacoma on 28 Feb 2008, 14:47)

Thanks for the good news!