De Brick or Un Bricking a WRT Series Router

Wiki.TerraBase.info
Revision as of 19:18, 26 September 2021 by Root (talk | contribs)
Jump to navigation Jump to search

This article was written for the WRT32X. The WRT3200ACM and various iterations of the WRT1900AC, WRT1900ACS, etc. are similar. The intent is to save a router and make it useful again. It is not intended to facilitate recovery of settings. Just a re-installation or installation of a working OpenWRT image.

There are certain assumptions made (and not covered) in this article (sorry, it's for advanced users, but take heart novices or beginners, search for the below items then come back here);

  • Familiarity with the WRT series of routers, Linux, etc.
  • Serial / TTL access has been connected / configured / setup, etc. (Remember, this router has a connector for Serial / TTL output which gives full command line access to the router without needing network connectivity)
  • The U-Boot / Das Boot (Marvell Version of them that is) is functional
  • A TFTP Server is available and functional on the same network as the router

Recovery

  • Enter the U-Boot command line in the three second boot pause window: Start pressing enter when you see the initial boot up message and the line that shows "MMC: mv_sdh:0" (about 2 seconds after turning the router on)
  • Below is the typical output from a WRT32X as it boots up
BootROM - 1.73
Booting from NAND flash

General initialization - Version: 1.0.0
AVS selection from EFUSE disabled (Skip reading EFUSE values)
mvSysEnvIsFlavourReduced: TWSI Read of 'flavor' failed
Detected Device ID 6820
High speed PHY - Version: 2.0

Init RD NAS topology Serdes Lane 3 is USB3
Serdes Lane 4 is SGMII
board SerDes lanes topology details:
 | Lane # | Speed|    Type     |
 ------------------------------|
 |   0    |  6   |  SATA0      |
 |   1    |  5   |  PCIe0      |
 |   2    |  6   |  SATA1      |
 |   3    |  5   |  USB3 HOST1 |
 |   4    |  5   |  PCIe1      |
 |   5    |  0   |  SGMII2     |
 -------------------------------
:** Link is Gen1, check the EP capability 
PCIe, Idx 0: Link upgraded to Gen2 based on client cpabilities 
:** Link is Gen1, check the EP capability 
PCIe, Idx 1: remains Gen1
High speed PHY - Ended Successfully
DDR3 Training Sequence - Ver TIP-1.46.0
mvSysEnvGetTopologyUpdateInfo: TWSI Read failed
DDR3 Training Sequence - Switching XBAR Window to FastPath Window 
DDR3 Training Sequence - Ended Successfully
Not detected suspend to RAM indication
BootROM: Image checksum verification PASSED


U-Boot 2013.01 (May 18 2017 - 16:37:44) Marvell version: 2015_T1.QA.0p16

Boot version : v2.0.9

Board: RD-NAS-88F6820-DDR3
SoC:   MV88F6820 Rev A0
       running 2 CPUs
CPU:   ARM Cortex A9 MPCore (Rev 1) LE
       CPU 0
       CPU    @ 1866 [MHz]
       L2     @ 933 [MHz]
       TClock @ 200 [MHz]
       DDR3    @ 933 [MHz]
       DDR3 32 Bit Width,FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM:  512 MiB
NAND:  256 MiB
MMC:   mv_sdh: 0
Venom>>
  • You'll get the above Venom>> command prompt after pressing enter when the MMC: mv_sdh: 0 line is displayed (or a second or two afterwards)
  • Get the proper firmware file;
    • Start Here: https://downloads.openwrt.org/releases/
    • Pick a firmware version version (usually the latest one, 21.02.0 as of the writing of this article)
    • Navigate through the Directories: targets, mvebu (which stands for something like Marvell Business Unit), corexa9 (the SoC technology the WRT32X is based on)
    • Select the SquashFS - Factory Image - IMG Firmware File (openwrt-21.02.0-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.img as of this writing)
  • Set the IP Address of the Router: setenv ipaddr 192.168.1.1 (the IP Address is just an example, and is also the default)
  • Set the IP Address of the TFTP Server: setenv serveip 192.168.1.254 (the IP Address is just an example, and is also the default)
  • Set the name of the firmware image file: setenv venom.img (it can be any name, including the default one from OpenWRT, but it's easier to rename the original file)
  • Run the "installation script": run update_both_images (The update_both_images "script" is actually an environmental variable set by LinkSys in the U-Boot partition stored on the router's "disk drive" (AKA NAND memory), with all of the $ items being other variables that are set elsewhere, type: printenv for a full list of the environment variables)
update_both_images=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAddr $priFwSize && nand erase $altKernAddr $altFwSize && nand write $defaultLoadAddr $priKernAddr $filesize && nand write $defaultLoadAddr $altKernAddr $filesize

If everything was typed correctly, then messages are displayed: loading of image, ...erase, ...write, etc.

  • When the "script" is done and the Venom>> command prompt is available, type: reset (equivalent to "reboot")

At this point, it should reboot and start the OpenWRT firmware (which will be available on both partitions)

Special Thanks To...

Usori's post was the 'starting hint': https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=311272&view=next&sid=f4fceb306811c819d84fc1c6a1d34fc0(...it wasn't a step by step set of instructions from him, but he included all the command line output, which was enough of a hint, specifically the line(s) right after "MMC: mv_sdh: 0, Venom>>

An Oddity Worth Noting

It cannot be an coincidence that the WRT32X, black in color with a code name of "Venom" and a SoC from Marvell, isn't somehow named after the 2018 Marvel movie, Venom.