Topic: Asus WL-330N3G version (FW 1.0.3.4) not flashable in recovery mode

The content of this topic has been archived on 4 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 1

Post #1

docbee

31 Jan 2015, 00:48

While I had done flashing of OPENWRT to WL-330N3G by using the recovery mode and TFTP binary transfer fine in the past,
the newest versions of WL-330N3G with firmware 1.0.3.4 (or newer) don't allow that kind of firmware update anymore.
From the outside the units are identical, no new version number on the sticker.

TFTP upload to the unit works fine, but when it is expected to start flashing the loaded data, it takes just a few seconds until it reboot and still has old firmware installed. Flashing the unit back to older stock firmware does not help. Looks like they changed something in the boot process.

Did anybody also came across this new problem?

Post #2

docbee

31 Jan 2015, 10:58

I managed to put a serial console to it and when it starts with button pressed (to enter recovery mode I get these results...

U-Boot 1.1.3 (Jul  6 2010 - 14:04:15)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81b80000
spi_wait_nsec: 3e 
spi deice id: 1 2 15 4d 0 (2154d00)
Warning: un-recognized chip ID, please update bootloader!
raspi_read: from:30000 len:1000 
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 3.3
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->None)
DRAM component: 256 Mbits SDR
DRAM bus: 16 bit
Total memory: 32 MBytes
Flash component: SPI Flash
Date:Jul  6 2010  Time:14:04:15
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 320 MHZ #### 

SDRAM bus set to 16 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
   
3: System Boot system code via Flash.

before LEDON:
data:3786

EZSetup buootn pressed!
 
## Enter Rescue Mode ##

 NetTxPacket = 0x81BB4240 

 KSEG1ADDR(NetTxPacket) = 0xA1BB4240 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done

 Header Payload scatter function is Disable !! 

 ETH_STATE_ACTIVE!! 
switch prereq:0
tftpd start
Using Eth0 (10/100-M) device

Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
T T T Got ARP REQUEST, return our IP
T T #
 First block received  
################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##########################################
done
RAMtoFLASH
Chk trx magic
Download of 0x360004 bytes completed
Check TRX and write it to FLASH 
Solve TRX
verify is 1
## load addr bf050000 ...
   Image Name:   MIPS OpenWrt Linux-3.3.8
   Created:      2015-01-30  20:50:54 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    839174 Bytes = 819.5 kB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... Bad Data CRC
first e_end is bf3b0004

 Erase kernel block !!
 From bf050000 To bf3b0004 (3538948/h:360004)
raspi_erase_write: offs:50000, count:360004
Abort: image size larger than 1769472!

done. 3538948 bytes written

RT2880 SYSTEM RESET!!!

Two messages at the end look like explanation what goes wrong.

1) "Verifying Checksum ... Bad Data CRC"
Does that mean that now a crc is done on the to be flashed data? Or is that meaningless and can be ignored?

2) "Abort: image size larger than 1769472!"
Do we have a firmware size limit of 1.7 MB? But that will rule out any OpenWRT porting.

Any idea is welcome

(Last edited by docbee on 31 Jan 2015, 11:04)

Post #3

docbee

31 Jan 2015, 11:28

Did the same on one of my older WL-330N3G ans there it works:

U-Boot 1.1.4 (Dec 26 2012 - 10:11:15)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81b80000
config usb..timeout, ignore...(0x00000000)

spi_wait_nsec: 3e 
spi deice id: c2 20 16 c2 20 (2016c220)
find flash: mx25l3205d
raspi_read: from:30000 len:1000 
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 3.3
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->None)
DRAM component: 256 Mbits SDR
DRAM bus: 16 bit
Total memory: 32 MBytes
Flash component: SPI Flash
Date:Dec 26 2012  Time:10:11:15
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 320 MHZ #### 

SDRAM bus set to 16 bit 
 SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   8: Load Boot Loader code to SDRAM via TFTP. 
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
   
3: System Boot system code via Flash.

before LEDON:
data:3786

EZSetup buootn pressed!
 
## Enter Rescue Mode ##

 NetTxPacket = 0x81BB4700 

 KSEG1ADDR(NetTxPacket) = 0xA1BB4700 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done

 Header Payload scatter function is Disable !! 

 ETH_STATE_ACTIVE!! 
switch prereq:0
tftpd start
Using Eth0 (10/100-M) device

Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
T T T T T T T T Got ARP REPLY, set server/gtwy eth addr (bc:5f:f4:db:58:a5)
Got it
T #
 First block received  
################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##########################################
done
RAMtoFLASH
Chk trx magic
Download of 0x360004 bytes completed
Check TRX and write it to FLASH 
Solve TRX
verify is 1
## load addr bf050000 ...
   Image Name:   MIPS OpenWrt Linux-3.3.8
   Created:      2015-01-30  20:50:54 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    839174 Bytes = 819.5 kB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... Bad Data CRC
first e_end is bf3b0004

 Erase kernel block !!
 From bf050000 To bf3b0004 (3538948/h:360004)
raspi_erase_write: offs:50000, count:360004
raspi_erase: offs:50000 len:360000
raspi_write: to:50000 len:360000 
raspi_read: from:3b0000 len:10000 
raspi_erase: offs:3b0000 len:10000
raspi_write: to:3b0000 len:10000 
Done!
done. 3538948 bytes written

RT2880 SYSTEM RESET!!!

1) Here also the CRC error is prompted, so that shouldn't alarm anyone.

2) The message "Abort: image size larger than 1769472!" does not show up,
so the problem might be located around that.

Any ideas?

Post #4

docbee

31 Jan 2015, 11:34

Looking into the uboot environment we get

OLD WL-330N3G:

RT3052 # printenv
bootcmd=tftp
bootdelay=5
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=192.168.1.1
serverip=192.168.1.20
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
stdin=serial
stdout=serial
stderr=serial
ethact=Eth0 (10/100-M)

Environment size: 766/4092 bytes

NEW WL-330N3G:

RT3052 # printenv
bootcmd=tftp
bootdelay=5
baudrate=57600
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=192.168.1.1
serverip=192.168.1.20
ramargs=setenv bootargs root=/dev/ram rw
addip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off
addmisc=setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1
flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)
kernel_addr=BFC40000
u-boot=u-boot.bin
load=tftp 8A100000 $(u-boot)
u_b=protect off 1:0-1;era 1:0-1;cp.b 8A100000 BC400000 $(filesize)
loadfs=tftp 8A100000 root.cramfs
u_fs=era bc540000 bc83ffff;cp.b 8A100000 BC540000 $(filesize)
test_tftp=tftp 8A100000 root.cramfs;run test_tftp
stdin=serial
stdout=serial
stderr=serial
ethact=Eth0 (10/100-M)

Environment size: 766/4092 bytes

Both are exactly the same.

(Last edited by docbee on 31 Jan 2015, 11:35)

Post #5

docbee

31 Jan 2015, 13:24

I finally tried to flash a ASUS stock firmware via rescue mode to the device and this also fails. Looks like they have ruined this important feature by accident, even for their own stuff.

EZSetup buootn pressed!
 
## Enter Rescue Mode ##

 NetTxPacket = 0x81BB4240 

 KSEG1ADDR(NetTxPacket) = 0xA1BB4240 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done

 Header Payload scatter function is Disable !! 

 ETH_STATE_ACTIVE!! 
switch prereq:0
tftpd start
Using Eth0 (10/100-M) device

Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
T Got ARP REPLY, set server/gtwy eth addr (bc:5f:f4:db:58:a5)
Got it
T T T Got ARP REQUEST, return our IP
T T T T #
 First block received  
################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################
done
RAMtoFLASH
Chk trx magic
Download of 0x3921d5 bytes completed
Check TRX and write it to FLASH 
Solve TRX
verify is 1
## load addr bf050000 ...
   Image Name:   
   Created:      2013-08-08  11:00:09 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3744149 Bytes =  3.6 MB
   Load Address: 80000000
   Entry Point:  8034f000
   Verifying Checksum ... Bad Data CRC
first e_end is bf3e21d5

 Erase kernel block !!
 From bf050000 To bf3e21d5 (3744213/h:3921d5)
raspi_erase_write: offs:50000, count:3921d5
Abort: image size larger than 1769472!

done. 3744213 bytes written

RT2880 SYSTEM RESET!!!

Post #6

docbee

11 Mar 2015, 12:19

After a lengthy and annoying mail conversation with friendly ASUS "support", they stated that they don't see a defect here and everything is fine from their perspective.

As a consequence these nice little units are no longer convertible to an OPENWRT system without soldering a serial console to the PCB and typing in TFTP and flash commands in there manually. So be warned!

Post #7

ashokjp

18 Apr 2015, 19:35

Can someone help me with flashing openwrt on asus 3l 330N3G

I see in this topic you have succeessfully done it

I have opened it, and i have board, i have got the RX and TX connectors

I connected my USB - UART to it by

1. Connected RX to board TX
2. Connected TX to Board RX

I am connecting to serial port at 57600 N8 with no flow control

I am getting some random characters on screen and no readable output (as below)
sûï
yOo>óIåþþþÿ÷ÿÿÿidº eö²þÿÎ¿þûûû¿þÂòòr÷¿ï9óûÿÿÿí¿½ûêïëûÿþÿþþÿïïÿ¯ï¯ï¯ïïïÒÏÿÿïÿ;úÿßÿÎ¹Ï¿ÿs«
>¾½ºr½÷ÿ{ÿÿÿsÏß·ÿ{ëÿÿwßß³oÿÿtË²¹çïÿÿv»ÿÿÿÿï»7¾·þæ¿ÿÿÿ¯½¹é>û

Is it because of VCC, GND, 3.3v pin connections missing. The board has only RX and TX solderpads, what am i missing ?

The discussion might have continued from here.

Page 1 of 1