bla bla von ТИАГРА

This post has evolved due to user demand and suggestions into some kind of Guide to Your Fonera, so it now resides on it’s own page: Fonera – Debricking and more! Feel free to comment below.


  1. March 13, 2007    

    chris: the only thing i can think of, is that your TX is not wired up correctly as you can see boot messages via serial console running, yes? check again, wiring setup is in the datasheet and some guy posted nice links about this some comments above, too. i also once encountered broken serial port on computer and usb2serial adapter. other than that… don’t know :/


  2. og style og style
    March 15, 2007    

    Thanks for the great rightup. I have set my up using tftp and I have transfered the extracted fw to the router. After it transfers I get the message “Raw file loaded 0x80040800-0x801c07ff, assumed entry at 0x800408”. On the directions it says that the last set of numbers should be 0x80040800. I type fis create rootfs and wait about 5 min for it to finish the reboot by unpluging and by typing reset. The router still won’t fully boot up. Here is a list of my final commands.

    RedBoot> ip_addr -h -l
    IP:, Gateway:
    Default server:
    RedBoot> load -r -b %{FREEMEMLO} rootfs.squashfs
    Using default protocol (TFTP)
    Raw file loaded 0x80040800-0x801c07ff, assumed entry at 0x800408
    RedBoot> fis create rootfs
    An image named ‘rootfs’ exists – continue (y/n)? y
    … Erase from 0xa8030000-0xa8730000: ……………………………………
    … Program from 0x80040800-0x801c0800 at 0xa8030000: ……………………
    …àErase from 0xa87e0000-0xa87f0000: .
    … Programàfrom 0x80ff0000-0x81000000 at 0xa87e0000: .

    Here is what I get on bootup

    +PHY ID is 0022:5521
    Ethernet eth0: MACàaddress 00:18:84:26:03:68
    IP:, Gateway:
    Default server:

    RedBoot(tm)àbootstrap andàdebug environment [ROMRAM]
    Non-certified release, version v1.3.0 – builtà16:57:58, Aug 7 2006

    Copyright (C) 2000, 2001, 2002, 2003, 2004àRed Hat, Inc.

    Board: ap51
    RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available
    FLASH: 0xa8000000 – 0xa87f0000, 128 blocks of 0x00010000 bytesàeach.
    == Executing boot script in 1.000 seconds – enterà^C to abort
    RedBoot> fis load -l vmlinux.bin.l7
    stream version is not supported.
    lzma_decode failed. res=1
    RedBoot> exec
    Now booting linux kernel:
    àBase address 0x80030000 Entry 0x80041000
    Cmdline :

    Can anyone tell me what I am doing wrong?

  3. March 15, 2007    

    hey og style, it looks like the file you uploaded differs from mine! that might have 2 reasons: you used a different version of firmware than I did, or you unpacked it somehow differently and that resulted in different file size – that’s why it starts at the same block but ends at another. As you can see in your boot messages, the line “lzma_decode failed. res=1” says what happens: your file can’t be decompressed, meaning it is broken :) btw, in my setup the image’s name is “rootfs”, so it seems to me you are trying to put some different firmware on the fonera… now i know what you’re doing wrong: you’re trying to spoil the system? :P

  4. og style og style
    March 15, 2007    

    I tried it 2x with 7.1.1 and the last post I tried it with 7.2.2. As for decompressing I used “dd if=fonera_0.7.1.1.fon of=fonera.tar.gz bs=519 skip=1”.

  5. March 15, 2007    

    og: anyway i wonder where i got the vmlinuz stuff… i just downloaded the latest from fon – it seems to be fonera_0.7.1.2.fon (where did u get 7.2.2?!) – cut off the 519 bytes and unpacked the tar.gz. in there i don’t see vmlinuz – i only see rootfs.squashfs amongst other stuff – maybe you’ll try that again? i emailed it to you… good luck.


  6. og style og style
    March 15, 2007    

    Sorry about the fw typo it is 7.1.2 and 7.1.1

    I have tried it will a different file and It still won’t fully boot. The 1st light wont light up. Here is my cmd line.

    RedBoot(tm) bootstrap and debug environment [ROMRAM]58, Aug 7 2006
    Non-certified release, version v1.3.0 – built 16:57:58, Aug 7 2006,à2004 Red Hat,àInc.

    Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.0000,à[0x80040450-0x80fe1000]àavailable

    Board: ap51
    RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] availables of 0x00010000 bytes each.
    FLASH: 0xa8000000 – 0xa87f0000, 128 blocks of 0x00010000 bytes each.seconds – enter ^C to abort
    == Executing boot script in 1.000 seconds – enter ^C to abortsà- enter ^C toàabort
    RedBoot> ip_addr -h -l – enter ^Executing boot scriptàin 1.00
    IP:, Gateway:
    0 seconds – enterà^Càtoàabo
    Default server: 192.168.0.

    == Executing boot script in 0.370 second
    RedBoot> fis create rootfs
    An image named ‘rootfs’ exists – continue (y/n)? yvmlinux.bin.l7

    … Erase from 0xa8030000-0xa8730000: ……………………………………
    … Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
    RedBoot> reset
    +PHY ID is 0022:5521
    Ethernet eth0: MAC address 00:18:84:26:03:68
    IP:, Gateway:
    Default server:

    RedBoot(tm) bootstrap and debug environment [ROMRAM]
    Non-certified release, version v1.3.0 – built 16:57:58, Aug 7 2006

    Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

    Board: ap51
    RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available
    FLASH: 0xa8000000 – 0xa87f0000, 128 blocks of 0x00010000 bytes each.
    == Executing boot script in 1.000 seconds – enter ^C to abort
    RedBoot> fis load -l vmlinux.bin.l7
    stream version is not supported.
    lzma_decode failed. res=1
    RedBoot> exec
    Now booting linux kernel:
    Base address 0x80030000 Entry 0x80041000
    Cmdline :


  7. Chris Chris
    March 16, 2007    

    I solved my problem with “iwconfig txpower”. My other fonera had an ivalid ntpserver entry at crontab. For some reason it did not work with this setting. Now it works!

  8. March 16, 2007    

    @chris: thanx for the feedback, finally something positive in here :)

    @og: unfortunately i already dumped my bootlog, so i can’t compare to mine… maybe someone else can do it… it seems to be sort of a memory error… the new firmware ends at a different block and therefore something else gets scambled – somehow the whole thing needs to be erased and completely restructured. i looked in my demsg where it creates all the new partitions… seems to me all that needs to be recreated, too? sorry, my fonera is running ever since, haven’t gotten much deeper into it, i guess i can’t help you with it :/

    good luck, maybe someone else reading these comments can give you a hint. i’d appreciate some feedback in case u manage to solve the issue – i might put it in the instructions if it is a commonly reproduceable problem…



  9. og style og style
    March 16, 2007    

    Thanks for all the help. On post #57 where it says “iwconfig txpower” Don’t have to be in a different command other than redboot?

  10. og style og style
    March 16, 2007    

    I just got my brothers router from him is there a way to dump the software in his and put it on mine?

  11. March 16, 2007    
  12. og style og style
    March 17, 2007    

    Thanks for the post tiagra. I just tried the link. When I follow all those steps and type exec at the end the router fully boots up. Then when I reboot it gives me error

    == Executing boot script in 1.000 seconds – enter ^C to abort
    RedBoot> fis load -l vmlinux.bin.l7
    No image ‘vmlinux.bin.l7’ found
    RedBoot> exec
    Can’t execute Linux – invalid entry address


  13. og style og style
    March 17, 2007    

    Thanks every one for the help. I have found the problem. I was typing vmlinux.bin.17 instead of vmlinux.bin.l7 On the l7 I was using 17. Now it work. Thanks again.

  14. og style og style
    March 17, 2007    

    FYI for anyone who ran this command on there fon.

    cd /tmp
    mtd -e vmlinux.bin.l7 write openwrt-ar531x-2.4-vmlinux-CAMICIA.lzma vmlinux.bin.l7

    and now it won’t load up l7 not 17. it is a letter and number not two numbers

  15. Picto Picto
    March 18, 2007    

    hey managed to follow your tut up to the point where i connect the fon via ethernet, where it goes crazy, just keeps spewing this lot out.

    RedBoot> exec
    Can’t execute Linux – invalid entry address
    RedBoot> /home/lihong/Projects/MR3201A/src/Redboot/ecos/packages/devs/eth/mips/a
    r531x/current/src/ae531xecos.c#632:ae531x_poll Bad receive. rxDesc=0x80037d50
    rent/src/ae531xecos.c#632:ae531x_poll Bad receive. rxDesc=0x80037d64 cmdsts=0x

    Ethernet came out while i was executing this code

    load -r -v -b 0x80041000 vmlinux.bin.l7

    I think ive messed up beyond recovery

  16. manii manii
    March 19, 2007    

    I have a problem with telnet. I followed this video tutorial:…era/fonera.htm. Everything happened according to the video, except the guy in the video got into redboot instantly. I got stuck at that part and I did everything up till that specific part properly. I am not able to telnet into the fon? Can someone guide me? perhaps add me on msn and give me some ideas. i would greatly appreciate it. I also have a bricked fon that i need assistance with. thanks in advance…

  17. Deko Deko
    March 19, 2007    


    Anyone reckon I can load maybe the Siemens firmware into this device, it looks like a PFS file system ?

    or maybe the Phillips firmware.

  18. jay jay
    March 23, 2007    

    i had some errors on xmodem transfer, but as the xmodem protocoll uses crc, they were corrected by resending of packets.
    anyhow, thank you a lot for this great howto.
    besides, I have one remark for you: even if many companies claim so, and also FON does, the warranty is not voided if you open a device. Even not if there is any seal on the device claiming so. I just love the German law ;-)

  19. March 23, 2007    

    hey, great that the howto helped you! looking at the latest comments a had the feeling that the world is made of bricked foneras and nothing will ever help again… thanx for your report, it will smooth my dreams :)


  20. March 26, 2007    

    Hi tiagra

    The reason i am asking if its possible to load other commercial FW onto this devices is plain curiosuty nothing else.

    i have dd-wrt installed on my fon and its fine, but wanted to try some other commercial FW for this device.

    but it seems it hasn’t ever been done.

  21. March 27, 2007    

    you would need to find a comercial firmware that has been developed for exactly this piece have hardware. at least same CPU etc. then you’d probably have to build your own drivers for missing hardware, which – of course – should be possible in an open-source world. but in the end you’d have your own firmware and not some commercial. as easy as that: as long as no other company manufactures the exact same device with their own commercial firmware, you’ll never be able to do what you sugggested.

  22. Deko Deko
    April 2, 2007    

    tiagra. it seems the fon is the same as

    ACCTON MR3201A
    FON FON2100A,B,C and F
    Edge-Core WA3101
    Philips SNR6500
    Siemens Gigaset Wlan repeater 108


    so i was looking tp ut either the simens or philips firmware on the device.. i just wasn’t sure as the philips seems to be using some other kind of firmware not based on linux.

  23. April 4, 2007    

    Hi guys,

    i had the same problem of veke (February 6th, 2007 at 5:14:42 pm)

    i resolved the problem by injecting Ctrl+C code in the Fonera
    i wrote a little article on my website see

  24. Ethan Ethan
    April 6, 2007    

    Hey guys, do I have to make a serial console?

    Right now I can connect via ethernet crossover cable, when I telnet to fonera it gives me that “executing boot script enter ^C to abort”.

    However, pressing ^C does nothing, it doesn’t bring me to redboot promt.

    Here’s my console transcript:

    Last login: Fri Apr 6 10:37:13 on ttyp1
    Welcome to Darwin!
    *******************:~ ethan$ telnet 9000
    telnet: connect to address No route to host
    telnet: Unable to connect to remote host
    *******************:~ ethan$ telnet 9000
    Connected to
    Escape character is ‘^]’.
    == Executing boot script in 8.750 seconds – enter ^C to abort
    Connection closed by foreign host.
    *******************:~ ethan$

  25. April 6, 2007    

    Ethan, your telnet client doesn’t support CTRL+C, see comment above yours – it presents a possible solution to your problem.

  26. HoogiesNgrinderz HoogiesNgrinderz
    April 17, 2007    

    No board config data found!
    +PHY ID is 0022:5521
    … waiting for BOOTP information
    Ethernet eth0: MAC address b1:00:34:84:00:04
    Can’t get BOOTP info for device!

    RedBoot(tm) bootstrap and debug environment [ROMRAM]
    Non-certified release, version v1.3.0 – built 16:57:58, Aug 7 2006

    Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

    Board: ap51
    RAM: 0x80000000-0x81000000, [0x80040450-0x80fe1000] available
    FLASH: 0xa8000000 – 0xa87f0000, 128 blocks of 0x00010000 bytes each.

    What the heck happened? I have a serial connection using a DS275 chip. My other Fon runs fine, but this one decided to crap out on me.

  27. Nico Nico
    April 17, 2007    

    hi, fo me it was load -r -b %{FREEMEMLO} /rootfs.squashfs -m HTTP -h

    i got alaway na error when i jus used rootfs.squashfs, the slash / in front of it was necessary for me

  28. April 18, 2007    

    nico: yes, that depends on your webserver i guess… and where exactly you put it there :) anyway, nice that it worked out…


  29. Tina Tina
    April 18, 2007    

    regarding the +5V: finding it in fonera is not a big deal … just use the one that comes directly from the power supply :) works perfect!

  30. June 15, 2007    

    Hi, I have used a serial port data cable for the Siemens C55, and hooked it up to the Fonera. Everything seems to be working, the console gives output, except the output is made up of all weird characters like boxes, lines, weird letters and stuff. It’s almost as if it is using the wrong ASCII table.
    I have tried different baud rates, different parity settings etc… but all i get is other weird characters…
    Any ideas?

  31. June 16, 2007    

    Hi Yako, that sounds very much like wrong baudrate to me… what kind of terminal program are you using? maybe even a font issue? :)) though i suppose ALL fonts support 7-bit ASCII… Sorry, I don’t know, can you compare the results with a proper serial adapter and the same software and/or the other way around? Thanx, Martin

  32. June 16, 2007    

    Hi tiagra,
    I have tried PuTTY and HyperTerminal on Windows, and they both give me the same. I also tried minicom on debian on a different PC, but that one doesn’t give me anything, just a blank screen.
    I am using a MAX202 chip by the way, and I have quadriple checked that I have connected the Ground, TX and RX correctly to the Fonera.
    I don’t have another serial adapter, so I haven’t tested it with other hardware. Any ideas?
    Do I maybe need some modifications for the MAX202 chip?

    Thanks and regards,

  33. June 16, 2007    

    Hmm… do you have 100nF capacitors? Are they very close to the chip? Any sources of interference close to the chip? I honestly don’t have the faintest idea what else might be going wrong, if your circuit in general is set up properly…



  34. June 16, 2007    

    Well I used a non-official Siemens C55 data cable. It has the MAX202 with capacitors embedded in the D-SUB connector. The wires attached to the PCB have been labeled, I connected those labeled GND, RX and TX to the Fonera.

    By the way, I bricked the router using an “ipkg upgrade” mistake, which is of course stupid to do. But I think the thing is booting, as the Internet LED starts blinking after a while, and it stays on if I connect it to my laptop using an ethernet cable. But no telnet, ssh, http or anything.
    So I hoped to save it using the serial console, but that might as well be broken… Though the bootloader should work as it tries to bring eth0 up. Is this true?


  35. Yako Yako
    June 16, 2007    

    Here’s a sample of the output it gives:
    By the way, I also tested it with Gtkterm on a Kubuntu machine, same result

  36. June 24, 2007    

    Well, it appeared I used a wrong cable. The MAX202 didn’t appear to work correctly in the end. So I ordered a DS232 (MAX232 equivalent) including capacitors and soldered my own cable. This worked, so my fonera is functional again! As original fonera with enabled shh, of course.
    Thanks for the help though. :)

  37. June 24, 2007    

    … nice, it seems to me that was my first guess :D good luck, original fonera with ssh enabled is the best anyway :)


  38. ddetra ddetra
    June 25, 2007    


    thanks for mantaining this useful site.
    Concerning the TX Power tweak, I was wondering if it is possible to increase it ove 18 dbm instead of decreasing it. Do you think La Fonera could get up to 100mw?

  39. June 25, 2007    

    You’re welcome! Concerning TX-Power: Just try it! If i remember right, the tool won’t let you set values other than mentioned… i guess the Atheros chip itself would need to be flashed to a different firmware, if it is capable of delivering more power at all… Can’t help you with that, though, don’t know ANYthing about the chip’s specifics… :)


  40. uk uk
    July 6, 2007    

    when happend this “update” from fon?
    can you give me some date like nov06 or jan07
    for example?
    regards ulf

  41. July 6, 2007    

    puh… i don’t remember. i think it was the update from rev1 to rev2 – look it up on the fon-website when it came out! :) not i have rev3 – which i accepted manually after checking the contents – and haven’t gotten anything else to far… for some months pretty quiet now :))


  42. August 8, 2007    

    excuse me guy, i had changed my wiki url.
    Now, the available url is :

  43. October 12, 2007    

    I also bricked my fon, by uploading HTTP errors, and trying to flash them instead of the actual vmlinux and root.fs files. I had done a right-click save-as with the HTTP links, which saved an error message, rather than the actual files. Not paying attention, I simply tossed them into my /tftpboot directory, and happily followed the instructions. I didn’t realize this until I got some sort of strange error, and investigated much further.

    Some of the links in the instructions I followed at were out of date. I also substituted some of the initial unix bits to match my environment.

    What I do is start up a ping to in one window, and open another window, and start watching the timeouts. Then I power-up my fonera, and wait. When I see that the pings are being answered, I immediately start a telnet at port 9000, which gets me into redboot. Redboot asks me to hit Ctrl-C to abort the startup script, but when I do, the pings stop answering while the thing reboots.

    I haven’t seen anything in this messageboard which states a solution. I am hoping that there is a method of hooking up a serial port, and feeding the flash and filesystem information over the serial port.

  44. October 12, 2007    

    hmm… i wonder how you came here? the actual tutorial is ONLY about the serial port solution… see here:
    ciao, martin

  45. pirast pirast
    October 26, 2007    

    hi, i just bought a serial datacable for the siemens m 50 to connect to my la fonera.

    in it there are cables in the following colors: organge white black green blue yellow.

    i tried to conect it to my la fonera but it does not work. i used white for rx, organge for tx, black for gnd and red for vcc. how can i find out what the right combination is? thanks

  46. October 26, 2007    

    hey, you can’t just go by the colors!! the colors are a pure coincidence, as i happened to have this kind of cable flying around! you should look at the pinpout of the M50 connector and check for RX, TX and GND lines! Look here: seems like you need 5,6 and 1. Good luck…


  47. Luca Luca
    November 5, 2007    
  48. JJ JJ
    January 16, 2008    

    Hello :
    I tried many times can’t “^C” to access Redboot. Do you know any reason ?

    thanks !!

  49. February 27, 2008    


    I made my fonera successfully working with your instructions… Thank you at all!
    I made a discrete interface (non IC, MAX, Dallas, etc.) found on, powered by the fonera 3,3V itself.

    If you authorize me, I would gladly make a translation of your article in hungarian, and post on my site []. Of course linking this original page.
    I also make some addings, which I send you in english, if you require it. (And why don’t you do that? :D )
    If your permission is granted, email me pls! Address: 04ahgy [at]
    Thank you, and everybody hav the same successes with FONERA, as me!

    Bye-bye: HGyu

  50. DarkFader DarkFader
    April 22, 2008    

    That picture could be better. Next time, photograph it more from above.
    You also could mention pinnumbers somewhere:
    1 VCC, 2 GND, 6 TXD, 8 RXD

Need something?