Rescue mode for Fonera+ (FON2201) Wi-Fi router / OpenWRT / Redboot / Wlan-si

Running customized OpenWRT/Wlan-SI image for a long time and then upgrading the router caused it to crash, the error was probably triggered with the telnet/ssh timeouts and probably a high CPU load on the router which disconnected me several times before I managed to write in the image. As suggested on Wlan-SI website, you should upgrade this type of router (and others) using their “nodeupgrade” [1] application. If you fail to boot into the new image, there is one thing you can still do to reflash over ethernet. A good idea is to put Redboot as the rescue method prior to flashing (but this manual won’t cover that step). So considering that Redboot is already installed here is how to proceed:

1. Install required  packages on a PC.

# apt-get install tftpd-hpa tftp telnet netcat

Configure tftpd-hpa download directory in /etc/default/tftpd-hpa where you will put firmware images.

2. Set your PC to listen on 192.168.1.2/255.255.255.0. Connect your PC ethernet port with any of the two ethernet ports on Fonera router.

3. If Redboot is installed on Fonera router, it will listen for a few seconds on IP 192.168.1.1 or 192.168.1.254 port 9000, simply telnet there [2] , you will see a message like this one:

== Executing boot script in 8.530 seconds - enter ^C to abort
^C
RedBoot>

Press Ctrl+c in your terminal to enter

If you have problems here that Ctrl+c doesn't work 
(and router therefore already bypasses the escape sequence into failed boot mode) you can try the following trick [3]:

# echo -e "\0377\0364\0377\0375\0006" >break.bin 
# nc 192.168.1.1 9000 <break.bin

Just press "enter" or telnet again to 192.168.1.1 9000, and you entered Redboot.

4. Installing firmware into Redboot [4]

RedBoot> 
RedBoot> ip_address -l 192.168.1.1/24
IP: 192.168.1.1/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.254
RedBoot> ip_address -h 192.168.1.2
IP: 192.168.1.1/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.2
RedBoot> fis init
About to initialize [format] FLASH image system - continue (y/n)? y
*** Initialize FLASH Image System
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot> load -r -v -b 0x80041000 foneraplus-v2_0b_33_gbb622cc-kernel.lzma
Using default protocol (TFTP)
-
Raw file loaded 0x80041000-0x800f0fff, assumed entry at 0x80041000
RedBoot> fis create kernel
... Erase from 0xa8030000-0xa80e0000: ...........
... Program from 0x80041000-0x800f1000 at 0xa8030000: ...........
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot> load -r -v -b 0x80041000 foneraplus-v2_0b_33_gbb622cc-root.jffs2-64k
Using default protocol (TFTP)
|
Raw file loaded 0x80041000-0x80360fff, assumed entry at 0x80041000
RedBoot> fis create rootfs
... Erase from 0xa80e0000-0xa8400000: ..................................................
... Program from 0x80041000-0x80361000 at 0xa80e0000: ..................................................
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot> fconfig
Run script at boot: true
Boot script: 
.. fis load -l kernel
.. exec
Enter script, terminate with empty line
>> fis load -l kernel
>> exec
>> (press enter here with a blank line)
Boot script timeout (1000ms resolution): 10
Use BOOTP for network configuration: false
Gateway IP address: 
Local IP address: 192.168.1.1
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.254
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot> reset

This is all, wait some minutes then replug router in electricity.

Additionally:
Instead of image name foneraplus-v2_0b_33_gbb622cc-kernel.lzma 
you can use openwrt-atheros-vmlinux.lzma
Instead of image name foneraplus-v2_0b_33_gbb622cc-root.jffs2-64k 
you can use openwrt-atheros-root.squashfs

Download the OpenWRT firmwares here.

Manuals used in this procedure:

1. https://dev.wlan-si.net/wiki/Flashing/Nodeupgrade

2. http://wiki.openwrt.org/doc/techref/bootloader/redboot

3. http://www.dd-wrt.com/phpBB2/viewtopic.php?p=81815&sid=81c212ea61683ac3bbb9b626bc553ecd

4. http://wiki.openwrt.org/toh/fon/fonera2#method_1_with_tftp_server

I take no responsibility if you break the router using this manual (it has only been tested once), do it on your own risk !