1 (edited by derdigge 2013-01-01 08:47:12)

Topic: WZR-HP-AG300h Bricked, serial is up tftp fails

Hi Community!

I have badflashed a WZR-HP-AG300h I connected a serial Adapter, uboot is up.
I can ping 192.168.11.2 from uboot .. so conection = check.

On my ubuntu machine i set an arp :

/home/derdigge/tftpd# cat /proc/net/arp
IP address       HW type     Flags       HW address            Mask     Device
192.168.11.1     0x1         0x6         10:6f:3f:7f:xx:xx     *        eth1

But the tftp allway timeouts. I tried curl and tftp.
Any Ideas on This? Or how do i Recover it anotherway using serial console?

http://imageshack.us/photo/my-images/545/bildbi.jpg/

regards
derdigge

EDIT:

The mac Adress shown in uboot is 02:AA:BB:CC:DD:20
That makes me really wonder. I tried to arp this mac, with same result

2 (edited by hnyman 2013-01-01 10:17:29)

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

derdigge wrote:

The mac Adress shown in uboot is 02:AA:BB:CC:DD:20
That makes me really wonder.

Matches the wiki...
http://wiki.openwrt.org/toh/buffalo/wzr … ftp.method

EDIT: you might try the newest official Buffalo firmware to see if the problem is in the Openwrt packaging.

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

Thaks for your reply. It indeed this MAC. I often flashed Buffalos with tftp.
All of them need unique Mac adress.

But it still Fails i can Load an Image throgh the Router that way:

ar7100> tftp
Using eth0 device
TFTP from server 192.168.11.2; our IP address is 192.168.11.1
Filename 'buf'.
Load address: 0x84000000
Loading: #################################################################
                    SNIP
         ################################################
done
Bytes transferred = 15221244 (e841fc hex)
ar7100>

But it isnt booting then. It stoods still at promt.
Can i boot it now somehow manually?
I am a little afraid so verry carefully. I am afraid to brick it
totally by input wron commands:

Aviable commands :

ar7100> help
autoscr - run script from memory
?       - alias for 'help'
TFTPS   - boot image via network as TFTP server
base    - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
iminfo  - print header information for application image
imls    - list all images found in flash
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
phyreg - read/write phyreg
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progmac - Set ethernet MAC addresses
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
set_mtest  - set mtest parameters. (for next bootup)
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
version - print monitor version

derdigge

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

Still nothing.... No matter what Image i try ....

ar7100> tftp
Using eth0 device
TFTP from server 192.168.11.2; our IP address is 192.168.11.1
Filename 'buf'.
Load address: 0x84000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######################################################
done
Bytes transferred = 3932196 (3c0024 hex)
ar7100> go 0x84000000
## Starting application at 0x84000000 ...
FREEZES HERE

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

With Windows tfpt i get : (Buffalo FW)

tftp -i 192.168.11.1 PUT wzr-hp-ag300h-pro-v24sp2-16519.enc
Fehler auf Server : Unsupport REGION

While in console shows:
enet0 port3 up
pll reg 0x18050010: 0x110000
tftp server(receive) go, waiting:4[sec]
Load address: 0x84000000
$ # LED(0x2) Blink[2] (Please press 'Ctrl+c' to stop)

With openwrt tftp an image to Router works but wont boot:

enet0 port3 up
pll reg 0x18050010: 0x110000
tftp server(receive) go, waiting:4[sec]
Load address: 0x84000000
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
         $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
tftp server done
Bytes transferred = 3932196 (3c0024 hex)
change bootargs
console=ttyS0,115200 root=31:03 rootfstype=jffs2 init=/sbin/init mtdparts=ar7100-nor0:256k(u-boot),64k(u-boot-env),1152k@384k(uImage),6592k@1536k(rootfs),64@320k(ART),64k@8128k(properties),8192k@8192k(flash1),16384k@16384k(flash2) mem=128M
## Booting image at bf060000 ...
Bad Magic Number
# LED(0x2) Blink[2] (Please press 'Ctrl+c' to stop)

Bad Header Checksum
# LED(0x2) Blink[2] (Please press 'Ctrl+c' to stop)

   Image Name:   WZR-HP-AG300H
   Created:      2007-11-08  15:50:08 UTC
   Image Type:   Invalid CPU Invalid OS Invalid Image (uncompressed)
   Data Size:    1207959552 Bytes = 1152 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... crc32_fw: bf060040 - 0706003f (len:48000000) calc...
crc32_fw: range1 bf060040 - bf04ffff, range2 bf060000 - 0707003f
Bad Data CRC


There must be a way to solve this! Please someone help me.
Otherwise my 90€ for that device are gone ....

6 (edited by hnyman 2013-01-02 17:08:22)

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

derdigge wrote:

With Windows tfpt i get : (Buffalo FW)

tftp -i 192.168.11.1 PUT wzr-hp-ag300h-pro-v24sp2-16519.enc
Fehler auf Server : Unsupport REGION
...
There must be a way to solve this! Please someone help me.
Otherwise my 90€ for that device are gone ....

That "Unsupport REGION" sounds like there country-based versions for the firmware and you are trying to flash country Y's firmware to a device requiring country X. (E.g. my Netgear wndr3700 has "North America" version and "rest of the world" version.) Try to find out if there is something like that for your device. You might need to download the firmware from Buffalo's site for the correct country. (Although I am not quite sure, from where you are getting that error...)

The advice regarding a device's specific firmware and uboot commands is so device-specific that it is really hard to give any advice without having experience from the same device. That is one reason why you aren't getting more advice.

You have access to the device, so most likely you will be able to solve the thing, but you might need to search the forum (and internet) more and try to find wzr-hp-ag300h specific u-boot advice.

EDIT:
E.g.
https://forum.openwrt.org/viewtopic.php … 18#p139518
https://forum.openwrt.org/viewtopic.php … 55#p145555
Those indicate that the basic advice is to power the router after starting TFTP transfer from the other end...

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

Ok Man you got me in right Direction!!
Its debricked now!

Download Image from here:

ftp://188.65.163.247/

This is how to do from Serialconsole:
Hold the STRG+C pressed while poweron the Router.

After prompt apears do:

setenv accept_open_rt_fmt 1
setenv region EU
saveenv
reset
(it reboots now)

After Reboot Power your Device down!
Set Your LAN IP to 192.168.11.2
In Windows cmd put that Line:

arp -s 192.168.11.1 02-AA-BB-CC-DD-20
tftp -i 192.168.11.1 PUT wzrhpag300h-pro-v24sp2-19154.enc  (dont hit enter)

Power on the Device and 10 Seconds after that hit enter in Windows CMD
(it tooks about ten Minutes to Complete the flash procedure)

done.

The Links you Posted were allready known but thanks!!
BTW How to but this to the WIKI??

8 (edited by hnyman 2013-01-03 08:17:12)

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

derdigge wrote:

The Links you Posted were allready known but thanks!!
BTW How to but this to the WIKI??

Just register to the wiki site and edit the article for that router by adding the relevant informtion. It is rather simple.
EDIT: I added the first version... http://wiki.openwrt.org/toh/buffalo/wzr … ong.region

9 (edited by derdigge 2013-01-03 11:51:03)

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

I am Registered now for the next time smile

Thank you Sir

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

derdigge wrote:

Ok Man you got me in right Direction!!
Its debricked now!

Download Image from here:

ftp://188.65.163.247/

This is how to do from Serialconsole:
Hold the STRG+C pressed while poweron the Router.

After prompt apears do:

setenv accept_open_rt_fmt 1
setenv region EU
saveenv
reset
(it reboots now)

After Reboot Power your Device down!
Set Your LAN IP to 192.168.11.2
In Windows cmd put that Line:

arp -s 192.168.11.1 02-AA-BB-CC-DD-20
tftp -i 192.168.11.1 PUT wzrhpag300h-pro-v24sp2-19154.enc  (dont hit enter)

Power on the Device and 10 Seconds after that hit enter in Windows CMD
(it tooks about ten Minutes to Complete the flash procedure)

done.

The Links you Posted were allready known but thanks!!
BTW How to but this to the WIKI??

Dear.
I connected rouet AG300H with series adapter USB and plug it. But I not see:
"Power on the router and wait until you see "Load address" appear shortly after the tftp message:
tftp server(receive) go, waiting:4[sec]
...
Load address: 0x84000000"

Best Regard

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

tftp server(receive) go, waiting:4[sec]
eth0 link down
Load address: 0x84000000

Abort
no file was loaded.
ar7100>

Dear
I can not see:
setenv accept_open_rt_fmt 1
setenv region EU
saveenv
reset
(it reboots now)

12 (edited by thinhnhan 2017-12-14 15:34:17)

Re: WZR-HP-AG300h Bricked, serial is up tftp fails

BUFFALO U-BOOT Ver 1.00                       
  == CPU:680MHz, DDR:340MHz, AHB:170MHz ==                                         
AP96 (ar7100) U-boot 0.0.1                         
DRAM:  128 MB             
Top of RAM usable for U-Boot at: 84000000                                         
Reserving 265k for U-Boot at: 83fbc000                                     
Reserving 192k for malloc() at: 83f8c000                                       
Reserving 44 Bytes for Board Info at: 83f8bfd4                                             
Reserving 36 Bytes for Global Data at: 83f8bfb0                                               
Reserving 128k for boot params() at: 83f6bfb0                                             
Stack Pointer at: 83f6bf98                         
Now running in RAM - U-Boot at: 83fbc000                                       
flash bank #0 found 16 MB flash [MX25L128-45E, blk:0x10000, sectors:256]                                                                       
flash bank #1 found 16 MB flash [MX25L128-45E, blk:0x10000, sectors:256]                                                                       
Flash: 32 MB           
In:    serial             
Out:   serial             
Err:   serial             
Memory Test           
uboot use  83F6BFB0 - 84000000                             
Memory Test start(80000000) end(83F00000) size(03F00000)                                                       
Pattern 00000000  Writing...  Reading...                                       
Memory Test start(84000000) end(88000000) size(04000000)                                                       
Pattern 00000000  Writing...  Reading...                                       
Memory Test OK             
### buf_ver=[1.00] U-Bo                     
### build_date(env)=[Jun  1 2010 - 13:48:44] build_date(bin)=[Jun  1 2010 - 13:4                                                                               
8:44]     
ag7100_enet_initialize...                         
Reading MAC Address from ENV(0x83f8c2d3)                                       
Port 0, Neg Success                   
Port 1, Neg Success                   
Port 2, Neg Success                   
Port 3, Neg Success                   
eth0: Phy Specific Status=0010                             
eth0: Phy Specific Status=0010                             
eth0: Phy Specific Status=0010                             
eth0: Phy Specific Status=0010;4eth0: 02:aa:bb:cc:dd:20                                                       
eth0 up       
Reading MAC Address from ENV(0x83f8c2d3)                                       
Port 4, Neg Success                   
eth1: Phy Specific Status=0010                             
eth1: 02:aa:bb:cc:dd:21                       
eth1 up       
eth0  02:AA:BB:CC:DD:20                       
, eth1  02:AA:BB:CC:DD:21                         

eth0 link down             

tftp server(receive) go, waiting:4[sec]                                       

enet0 port3 up             
pll reg 0x18050010: 0x110000  Load address: 0x84000000                                                     
checksum bad           
checksum bad           
checksum bad           
checksum bad           

TftpServer Timeout;                   
no file was loaded.                   
change bootargs               
console=ttyS0,115200 root=31:03 rootfstype=jffs2 init=/sbin/init mtdparts=ar7100                                                                               
-nor0:256k(u-boot),64k(u-boot-env),1152k@384k(uImage),6592k@1536k(rootfs),64k@32                                                                               
0k(ART),64k@8128k(properties),8192k@8192k(flash1),16384k@16384k(flash2) m                                                                       

## Booting image at bf060000 ...                               
   Image Name:   MIPS OpenWrt Linux-3.10.49                                           
   Created:      2014-10-02   6:59:12 UTC                                         
   Image Type:   MIPS Linux Kernel Image (lzma compressed)                                                         
   Data Size:    1107053 Bytes =  1.1 MB                                       
   Load Address: 80060000                         
   Entry Point:  80060000                         
   Verifying Checksum ... crc32_fw: bf060040 - bf16e4ac (len:0010e46d) calc...                                                                             
crc32_fw: range1 bf060040 - bf16e4ac                                   
OK 
   Uncompressing Kernel Image ... OK                                   
No initrd         
## Transferring control to Linux (at address 80060000) ...                                                         
## Giving linux memsiz                     

Starting kernel ...                   

[    0.000000] Linux version 3.10.49 (bb@builder1) (gcc version 4.8.3 (OpenWrt/L                                                                               
inaro GCC 4.8-2014.04 r42625) ) #3 Wed Oct 1 14:00:51 CEST 2014                                                               
[    0.000000] bootconsole [early0] enabled                                           
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)                                                   
[    0.000000] SoC: Atheros AR7161 rev 2                                       
[    0.000000] Clocks: CPU:680.000MHz, DDR:340.000MHz, AHB:170.000MHz, Ref:40.00                                                                               
0MHz   
[    0.000000] Determined physical RAM map:                                           
[    0.000000]  memory: 08000000 @ 00000000 (usable)                                                   
[    0.000000] Initrd not foun                             
[    0.000000] Zone ranges:                           
[    0.000000]   Normal   [mem 0x00000000-0x07ffffff]                                                     
[    0.000000] Movable zone start for each node                                               
[    0.000000] Early memory node ranges                                       
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]                                                     
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.                                                                             
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32                                                                               
bytes     
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pag                                                                               
es: 32512         
[    0.000000] Kernel command line:  board=WZR-HP-G300NH console=ttyS0,115200 ro                                                                               
otfstype=squashfs,jffs2 noinitrd                               
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)                                                                 
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)                                                                             
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)                                                                           
[    0.000000] Writing ErrCtl register=00000000                                               
[    0.000000] Readback ErrCtl register=00000000                                               
[    0.000000] Memory: 126052k/131072k available (2369k kernel code, 5020k reser                                                                               
ved, 621k data, 272k init, 0k highmem)                                     
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1                                                                         
[    0.000000] NR_IRQS:51                         
[    0.000000] Calibrating delay loop... 452.19 BogoMIPS (lpj=2260992)                                                                     
[    0.060000] pid_max: default: 32768 minimum: 301                                                   
[    0.060000] Mount-cache hash table entries: 512                                                 
[    0.070000] NET: Registered protocol family 16                                                 
[    0.070000] MIPS: machine is Buffalo WZR-HP-G300NH                                                     
[    0.080000] rtl8366_smi: gpio_request failed for 19, err=-517                                                               
[    2.380000] Kernel bug detected[                                 
[    2.380000] CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.49 #3                                                                 
[    2.380000] task: 87828000 ti: 87822000 task.ti: 87822000                                                           
[    2.380000] $ 0   : 00000000 00000061 00000000 802f0000                                                         
[    2.380000] $ 4   : bfff1000 00000000 00000000 8008da20                                                         
[    2.380000] $ 8   : 00000001 0000002c 8780a000 ffffff80                                                         
[    2.380000] $12   : 00000014 0000000e 00000007 00000001                                                         
[    2.380000] $16   : bfff1000 00000000 803b0000 00000000                                                         
[    2.380000] $20   : 00000022 80330000 80374ec4 8034c20c                                                         
[    2.380000] $24   : 80313150 801                                 
[    2.380000] $28   : 87822000 87823e40 00000000 8035882c                                                         
[    2.380000] Hi    : 00000000                               
[    2.380000] Lo    : 8ddbeb00                               
[    2.380000] epc   : 80351fd0 ath79_register_wmac+0x274/0x278                                                               
[    2.380000]     Not tainted                             
[    2.380000] ra    : 8035882c wzrhpg300nh_setup+0xdc/0x178                                                           
[    2.380000] Status: 1000c003 KERNEL EXL IE                                             
[    2.380000] Cause : 10800024                               
[    2.380000] PrId  : 00019374 (MIPS 24Kc)                                           
[    2.380000] Modules linked in:                                 
[    2.380000] Process swapper (pid: 1, threadinfo=87822000, task=87828000, tls=                                                                               
00000000)         
[    2.380000] Stack : 00000003 80338f64 00000018 00000000 00000000 00000000 803                                                                               
74ef4 8035882c             
          00000000 80343bf4 00000000 8008da20 8034e9f8 8034ea20 00000000 801d8cd                                                                               
4
          00000000 00000022 80330000 8011ba60 00000001 00000003 00000003 0000000
0
          00000003 80374ef4 80383104 803c0000 00000003 80374ef4 80383108 803c000
0
          00000022 8034ca80 00000000 00000000 00000000 00000022 00000003 0000000
3
          ...
[    2.380000] Call Trace:
[    2.380000] [<80351fd0>] ath79_register_wmac+0x274/0x278
[    2.380000] [<8035882c>] wzrhpg300nh_setup+0xdc/0x178
[    2.380000] [<8034ea20>] ath79_setup+0x28/0x38
[    2.380000] [<8011ba60>] do_one_initcall+0xf0/0x198
[    2.380000] [<8034ca80>] kernel_init_freeable+0x150/0x208
[    2.380000] [<80064bc8>] kernel_init+0x10/0x10c
[    2.380000] [<80060878>] ret_from_kernel_thread+0x14/0x1c
[    2.380000]
[    2.380000]
Code: 24030001  080d47be  a0431015 <000c000d> 27bdffe8  00002021  afbf0014  0c0d
4757  00002821
[    2.390000] ---[ end trace e8b9f53008653965 ]---
[    2.390000] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00
00000b
[    2.390000]

Please help Me.