Comments on: La guida definitiva al debrick della fonera

By: matteo

matteo — Sun, 28 Nov 2010 16:23:46 +0000

Ciao, Scusa l'enorme ritardo nella risposta... Puoi dare un occhio qui o Mandi!

By: Giusepe

Giusepe — Wed, 17 Nov 2010 22:58:30 +0000

Salve Matteo! Ho un grosso problema facendo la tua procedura sembra andare tutto ok.. ma la fonera non si avvia con la seriale, se invece setto la scrittura del redboot sull’indirizzo 1c000000 anzichè a8000000 parte il redboot ma scrivendo il comando “fis list” non mi dà nessuna tabella partizioni, come faccio a ricostruirla??
Grazie anticipatamente!

By: matteo

matteo — Sat, 02 Oct 2010 08:05:49 +0000

No idea, maybe it would.

By: Ian

Ian — Mon, 27 Sep 2010 12:54:56 +0000

Probably a stupid question but would a parallel blackcat cable work for a buffered cable if i redirect the jtag output to the correct pins on the fon board.

By: matteo

matteo — Mon, 27 Sep 2010 09:41:42 +0000

The cable is very critical, so
* when building it, do very good solderings
* keep it very short (no more than 20 cm)
* keep it away from any other cables (ethernet, usb, and especially power cords)
* don’t turn on/off devices with electrical motors while using the cable

If all this does not work you should use a buffered cable.

By: Ian

Ian — Sun, 26 Sep 2010 18:08:43 +0000

Humm I think I have a problem with my cable. If I backup my flash it is all 0`s ive even connected pin 5 to the NC jtag and it hasnt made a difference. As far as I can tell the connections and cable all seem ok but it doesnt detect the flash though i have to force it with fc:25. Can you suggest any tips ?

By: matteo

matteo — Fri, 24 Sep 2010 07:33:51 +0000

The 25 80 bytes you found can be anything

I’m not sure where the baud rate setting is stored, but you can try to write your backup. If something goes wrong, you can always debrick your fonera using the whole procedure I described.

By: Ian

Ian — Thu, 23 Sep 2010 21:56:26 +0000

I was using an open wrt flash with jasager to compare against. But i have since reflashed that with the latest dd-wrt and doing a cat /proc/mtd now gives me
dev: size erasesize name
mtd0: 00030000 00010000 “RedBoot”
mtd1: 007a0000 00010000 “linux”
mtd2: 00550000 00010000 “rootfs”
mtd3: 00170000 00010000 “ddwrt”
mtd4: 00010000 00010000 “nvram”
mtd5: 00010000 00010000 “FIS directory”
mtd6: 00010000 00010000 “board_config”
mtd7: 00800000 00010000 “fullflash”
Is mtd6 the same as board_config_template.bin and will writing your file fix my console baud rate in redboot ?
if i do cp /dev/mtdblock/5 /tmp/mtd5 and look at the file at location 0xf2fe this is the value 25 80 (9600) this last 4k of the file was the same as the redboot_config i extracted from my open-wrt flash previously.
At location 0×100 is also lists the address 0xA87EF000 for redboot config
Could i write the mtd5 backup to my bricked fon at 0xA87E0000?

By: matteo

matteo — Thu, 23 Sep 2010 07:38:51 +0000

Uhm, how did you figure out that the baud rate setting is stored at 0x2fc in the redboot_config?

The redboot configuration should be stored in mtd6 and not mtd5, and the start address should be 0xA87EF000.

At http://www.rigacci.org/wiki/doku.php/doc/appunti/hardware/la_fonera_openwrt you can find the memory map.

By: Ian

Ian — Wed, 22 Sep 2010 21:20:29 +0000

I was stupid when reflashing my fon and tried to set the console baud rate in redboot to 115200 using fconfig… It wouldnt change it properly so now i have a bricked fon. I have a 2nd fon that i extracted the redboot_config from the dev/mtd5/ in the shell and is 4096 bytes I located the baud rate bytes at 0x2fc… Am i correct to think that the flash address of the redboot_config is this 0xa87e0000-0xa87f0000..?
I want to try reflash only that area.