De Brick or Un Bricking a WRT Series Router
This article was written for the WRT32X. The WRT3200ACM and various iterations of the WRT1900AC, WRT1900ACS, etc. are similar. The intent is to save a router and make it useful again. It is not intended to facilitate recovery of settings. Just a re-installation or installation of a working OpenWRT image.
It is also a great method of flashing a router with the factory / OEM Linksys firmware. Using the below directions from the "Venom Command Prompt" (read below and you'll understand) on a WRT32X router it took less than 10 seconds to download and flash both partitions with the latest version of OpenWRT. Wow! That beats doing via GUI any day. But of course it does require a "Serial / TTL" connection too (that's more difficult).
There are certain assumptions made (and not covered) in this article (sorry, it's for advanced users, but take heart novices or beginners, search for the below items then come back here);
- Familiarity with the WRT series of routers, Linux, etc.
- Serial / TTL access has been connected / configured / setup, etc. (Remember, this router has a connector for Serial / TTL output which gives full command line access to the router without needing network connectivity)
- The U-Boot / Das Boot (Marvell Version of them that is) is functional
- A TFTP Server is available and functional on the same network as the router
Quick D (AKA Information)
The absolute first best thing one can do to avoid bricking a WRT / AC Series router, is to utilize the /overlay functionality and have all the important stuff stored in that manner. Look up the /overlay thing if you're not familiar with it for more details. In short, the boot process starts from the internal "disk drive", AKA NAND 'disk', then mounts an external USB Flash Drive or eSATA drive and continues from there based on Operating System files and settings stored on the flash drive. That way the internal "disk drive" acts only in a similar fashion to GRUB (again, look it up). The result of this configuration method is that the entire internal "disk drive" is disposable, can be wiped out, re-flashed, with nothing lost (except the need to install the software to recognize a USB Flash Drive and the setting to boot from it).
Below are some quick tips (not a step by step) that are good for bringing a 'dead' Linksys router back from the grave.
- OpenWRT Firmware for AC Series of Routers: https://downloads.openwrt.org/releases/19.07.3/targets/mvebu/cortexa9/
- OpenWRT De-Bricking Information: https://openwrt.org/toh/linksys/wrt3200acm#Debricking. Below are the key commands (run being the command and what comes after it being a script stored as a variable)
- run nandboot (script for booting the router from the MTD5 Partition)
- run altnandboot (script for booting the router from the MTD7 Partition, AKA the 'alternate')
- GOTCHA!: One really big "gotcha" from using the above commands relates to upgrading firmware. When booting using the altnandboot script from above, when flashing a new image it will flash it to the current partition. This is counter to the usual behavior where OpenWRT will flash a new image to the other parition.
- A Recommendation: Configure the MTD6 Partition as the primary partition that boots the /overlay, and leave the secondary MTD8 partition configured to NOT boot an overlay. This allows the MTD8 partition to function without a USB flash drive
Flashing Firmware
Even though this article is about "de bricking" a router, it is also the fastest way to install firmware on both partitions of any WRT / AC Series router from the stock Linksys firmware. But it does require having console access to the router via a Serial / TTL cable.
Recovery
- Enter the U-Boot command line in the three second boot pause window: Start pressing enter when you see the initial boot up message and the line that shows "MMC: mv_sdh:0" (about 2 seconds after turning the router on)
- Below is the typical output from a WRT32X as it boots up
BootROM - 1.73
Booting from NAND flash
General initialization - Version: 1.0.0
AVS selection from EFUSE disabled (Skip reading EFUSE values)
mvSysEnvIsFlavourReduced: TWSI Read of 'flavor' failed
Detected Device ID 6820
High speed PHY - Version: 2.0
Init RD NAS topology Serdes Lane 3 is USB3
Serdes Lane 4 is SGMII
board SerDes lanes topology details:
| Lane # | Speed| Type |
------------------------------|
| 0 | 6 | SATA0 |
| 1 | 5 | PCIe0 |
| 2 | 6 | SATA1 |
| 3 | 5 | USB3 HOST1 |
| 4 | 5 | PCIe1 |
| 5 | 0 | SGMII2 |
-------------------------------
:** Link is Gen1, check the EP capability
PCIe, Idx 0: Link upgraded to Gen2 based on client cpabilities
:** Link is Gen1, check the EP capability
PCIe, Idx 1: remains Gen1
High speed PHY - Ended Successfully
DDR3 Training Sequence - Ver TIP-1.46.0
mvSysEnvGetTopologyUpdateInfo: TWSI Read failed
DDR3 Training Sequence - Switching XBAR Window to FastPath Window
DDR3 Training Sequence - Ended Successfully
Not detected suspend to RAM indication
BootROM: Image checksum verification PASSED
U-Boot 2013.01 (May 18 2017 - 16:37:44) Marvell version: 2015_T1.QA.0p16
Boot version : v2.0.9
Board: RD-NAS-88F6820-DDR3
SoC: MV88F6820 Rev A0
running 2 CPUs
CPU: ARM Cortex A9 MPCore (Rev 1) LE
CPU 0
CPU @ 1866 [MHz]
L2 @ 933 [MHz]
TClock @ 200 [MHz]
DDR3 @ 933 [MHz]
DDR3 32 Bit Width,FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM: 512 MiB
NAND: 256 MiB
MMC: mv_sdh: 0
Venom>>- You'll get the above Venom>> command prompt after pressing enter when the MMC: mv_sdh: 0 line is displayed (or a second or two afterwards)
- Get the proper firmware file;
- Start Here: https://downloads.openwrt.org/releases/
- Pick a firmware version version (usually the latest one, 21.02.0 as of the writing of this article)
- Navigate through the Directories: targets, mvebu (which stands for something like Marvell Business Unit), corexa9 (the SoC technology the WRT32X is based on)
- Select the SquashFS - Factory Image - IMG Firmware File (openwrt-21.02.0-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.img as of this writing)
- Set the IP Address of the Router: setenv ipaddr 192.168.1.1 (the IP Address is just an example, and is also the default)
- Probably no need to set subnet mask as the default is 255.255.255.0, common to most private IP Address ranges (subnet is the name of the variable to set, if needed)
- Set the IP Address of the TFTP Server: setenv serverip 192.168.1.254 (the IP Address is just an example, and is also the default)
- Set the name of the firmware image file: setenv firmwareName venom.img (...the CAPITAL N is not a mistake, the name can be any name, including the default one from OpenWRT, but it's easier to rename the original file)
- Run the "installation script": run update_both_images (The update_both_images "script" is actually an environmental variable set by LinkSys in the U-Boot partition stored on the router's "disk drive" (AKA NAND memory), with all of the $ items being other variables that are set elsewhere, type: printenv for a full list of the environment variables)
update_both_images=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAddr $priFwSize && nand erase $altKernAddr $altFwSize && nand write $defaultLoadAddr $priKernAddr $filesize && nand write $defaultLoadAddr $altKernAddr $filesizeIf everything was typed correctly, then messages are displayed: loading of image, ...erase, ...write, etc.
- When the "script" is done and the Venom>> command prompt is available, type: reset (equivalent to "reboot")
At this point, it should reboot and start the OpenWRT firmware (which will be available on both partitions)
Special Thanks To...
Usori's post was the 'starting hint': https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=311272&view=next&sid=f4fceb306811c819d84fc1c6a1d34fc0(...it wasn't a step by step set of instructions from him, but he included all the command line output, which was enough of a hint, specifically the line(s) right after "MMC: mv_sdh: 0, Venom>>
An Oddity Worth Noting
It cannot be an coincidence that the WRT32X, black in color with a code name of "Venom" and a SoC from Marvell, isn't somehow named after the 2018 Marvel movie, Venom.
Boot Errors
NAND read: device 0 offset 0x900000, size 0x600000
6291456 bytes read: OK
Bad Linux ARM zImage magic!Gotcha
...see above sections.