If this were a live FonBar, you would log in to the hotspot through the form above.
 

Flashing La Fonera over Serial Port

Here are instructions for restoring your FON firmware entirely through the serial connector. Most instructions which i’ve seen on the web assume that you have telnet over Ethernet access to Redboot, which is a chicken and egg problem!

EDIT: ChrisPHL points out that I can enable telnet over Ethernet before I even init or flash any firmware by using the RedBoot FCONFIG command: FreeWLAN.info. So why follow this tutorial? While serial console may be slower than uploading via Ethernet, you’ll save time because you won’t need to set up TFTP server, manually configure TCP/IP, rearrange cords, change cords back, reconfigure DHCP, etc.

This tutorial worked just fine for my La Fonera 1.0 (FON2100). If you have the La Fonera 1.1 (FON2200), 1.5 (FON2201), or 2.0 (FON2202), you may find that telnet over Ethernet is allready enabled! One reader has informed me that his newer FON2200 seems to have an *older* version of RedBoot (V1.00 – built 10:37:27, Dec 12 2006) installed on it than mine (V1.3.0), and that the memory range begins at a different address. If this tutorial doesn’t seem to do the trick, try k0k0′s German tutorial, which uses different addresses starting with the second ‘load’ command. FON2201 and FON2202 use different firmware and are based on yet another circuit board. They will certainly require different load addresses.

It is possible to transfer the files using XMODEM or YMODEM if you use a terminal emulator like HyperTerminal. ZMODEM would be even faster and more accurate, but I was unable to get that to work. When I used HyperTerminal, I am pretty sure I used hardware handshaking, but k0k0, administrator of FreeWLAN’s forums recommends setting this to NO handshaking. This may be necessary if you can receive text from the serial port, but cannot get it to respond to keystrokes.

The two firmware files, rootfs.squashfs and kernel.lzma were aquired from this archive, and are stored on my local hard drive. I did not set up a TFTP or web server, as that would require a network connection, and is again, a chicken and the egg problem. :wink:

To start with, I have built a working serial voltage adapter, as seen in my previous post, interrupted the bootup with CTL-C, and executed the following commands in Redboot:

1) RedBoot> baudrate 115200 (much faster connection, but I needed to close and restart HyperTerminal using the new speed)

2) RedBoot> fis init -f (this deletes all of the onboard firmware!)

typical response from RedBoot:
About to initialize [format] FLASH image system – continue (y/n)? y
*** Initialize FLASH Image System
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

The following commands and memory addresses are taken directly from the DD-WRT tutorial on “Reflashing LaFonera original firmware“, except that i’ve gotten the files I need by other means, and i’ve adjusted the commands for using YMODEM over the serial console instead of TFTP server at a fixed IP. You may use XMODEM if you choose instead, but it is a bit slower. If you must use XMODEM, and it will not start, try switching your terminal emulator from hardware handshaking to XON/XOFF – or vice-versa.

3) RedBoot> load -r -m ymodem rootfs.squashfs -b 0×80040450

typical response from RedBoot:
CCCCRaw file loaded 0×80040450-0x801c044f, assumed entry at 0×80040450
xyzModem – CRC mode, 2(SOH)/1536(STX)/0(CAN) packets, 6 retries

Whew! That was fun! I haven’t used YMODEM since the early 1980′s! As you see “xyzModem” implies that ZMODEM is supported, but the command “-m ZMODEM” is rejected by RedBoot. YMODEM and XMODEM may sit idle for a while before they start transferring. Be patient. :lol:

4) RedBoot> fis create -b 0×80040450 -f 0xA8030000 -l 0×00700000 -e 0×00000000 rootfs

typical response from RedBoot: (THIS CAN TAKE A LONG TIME!)
… Erase from 0xa8030000-0xa8730000: ……………………………………
…………………………………………………………….
… Program from 0×80040450-0×80740450 at 0xa8030000: ……………………..
……………………………………………………………………..
……
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

5) RedBoot> load -r -m ymodem -b %{FREEMEMLO} kernel.lzma

typical response from RedBoot:
CCRaw file loaded 0×80040800-0x800c07ff, assumed entry at 0×80040800
xyzModem – CRC mode, 2(SOH)/512(STX)/0(CAN) packets, 4 retries

6) RedBoot> fis create -r 0×80041000 -e 0×80041000 vmlinux.bin.l7

typical response from RedBoot:
… Erase from 0xa8730000-0xa87b0000: ……..
… Program from 0×80040800-0x800c0800 at 0xa8730000: ……..
… Erase from 0xa87e0000-0xa87f0000: .
… Program from 0x80ff0000-0×81000000 at 0xa87e0000: .

7) RedBoot> fis load -l vmlinux.bin.l7

typical response from RedBoot (after a really long pause):
Image loaded from 0×80041000-0x801ba000

8) RedBoot> exec

typical response from RedBoot:
Now booting linux kernel:
Base address 0×80030000 Entry 0×80041000
Cmdline

At this point the serial connection froze. I powercycled La Fonera and observed Redboot come up, and then the serial connection froze again shortly after stating that it was booting the linux kernel… but Wireless Connection Manager showed that MyPlace had been created and I was able to access the onboard web admin. The router is now factory-fresh, circa firmware version 0.7.1 r1! 8)

Next, i’ll leave the Ethernet disconnected, and configure the fonware over a wifi connection to load FreeWLAN. Once that is working, then i’ll install the CAMICIA modified bootloader over SSH *before* I begin experimenting with configuration changes again. ;)

EDIT: The following page of RedBoot Command Line Options helped me a lot in making this tutorial: AdvancedRelay

0 Responses to Flashing La Fonera over Serial Port

  1. jdawg00 says:

    Well done AustinTX, I enjoyed reading your last two blog entries.

  2. Dieter says:

    Hi,

    I realise this post is quite old, but since the internet ain’t that good at serving an answer for this particular problem, I want to ask you.

    In step 8, your router froze after the exec command, like it couldn’t execute the firmware. I have this problem too, but my wlan light won’t go on and I don’t see any new wireless network. Did you do something special after this to get it working?

    Dieter

  3. austintx says:

    Hi Dieter! The reason my router’s serial output “freezes” after installing the new firmware, is because that particular build doesn’t have a startup command to define the serial port as a terminal device. The original firmware did. This only applies to the particular firmware I chose to flash onto the router, and other firmwares probably support using the serial port as a terminal. If you’re using a firmware that doesn’t support this, then you need to switch to a web-gui, telnet or SSH session via the Ethernet or WLAN at this point.

  4. sbugiardo says:

    WOOOOO THANK YOU! My bricked Fonera has come back to life! 🙂
    I never used ymodem before, but it was a lot of fun indeed.
    (tiny note: for setting the baudrate I used “baudrate -b 115200”)

  5. austintx says:

    sbugiardo: Glad to hear it! And thanks for the tip! 🙂

  6. redt says:

    You need in tutorial to execute: “fis init” before (6)

  7. austintx says:

    Redt: oh boy. I hope no-one has lost a router due to a mistake in my instructions. It’s been 3 years, so….

    I’m largely rewriting and clarifying the tutorial found here:
    http://www.dd-wrt.com/wiki/index.php/LaFonera_Software_Flashing#Reflashing_LaFonera_original_firmware

    It gives different steps for FON2100 and FON2200, and mentions “fis init” in a different order for each one. If I understand correctly, “fis init” just zeroes out, and perhaps tests a range of memory. It’s a very good idea, but perhaps not absolutely necessary. If you load something over this area without having initialized it, it should still overwrite what was previously there. I’ll add a note in the tutorial for good measure.