Hello all, my laziness got the best of me and caused me to brick my router.
The WRT32x I had was loaded with dd-wrt firmware. I just wanted to jump straight over to openwrt so I thought to myself
"I think I can make an attempt to do a serial recovery but do it with openwrt firmware instead of using factory stock firmware!!"
Now I actually had forgotten how to do a proper serial recovery so I just went off some random instructions I found online which involved me typing this command that involves copying the openwrt firmware files to /tmp/, erasing the linux partition, and then attempting to write to the linux 1 and 2 partitions.
it wasnt working so I tried another method I cannot recall which was "nand erase 2000000" and "nand write 2000000 0 2000000"
I am now getting "boot rom: Bad header" followed by "trying uart".
Did I completely destroy this router or is there another tool I need to buy? If I do need to buy another tool, how would I use it to recover this router?
Also, I have in my possession a "FT232R" USB-TTL device if thats of any use.
If so, you're still kind of in luck with mvebu, as it does offer the possibility to transfer a bootloader over the serial console, using kwboot (for the details you will have to search the web, but this keyword should help you). While you seem to have broken the flash badly, this SOC is fortunately pretty resilient and should still allow you recover completely.
'good', in the sense that kwboot should still work (even though you did break it thoroughly, most other targets -apart from lantiq, which has a similar serial based failsafe mechanism- would be dead and completely bricked at this point).
So at first, it stopped while saying "warning, bad CRC using defaults" or something like that. it was taking a long time so I restarted it and now its stuck at this part.
Just so you all know, I installed kwboot via "sudo apt install u-boot-tools" because the link in the wiki is broken but not for the boot loader. so I downloaded the one specifically for the wrt32x.
I did try to boot it normally as well but I am still getting the same bootrom bad header error message.
EDIT: wanted to add that im doing this from ubuntu linux. may try doing it from debian later if it makes a difference.
So from what I am seeing here and with what the instructions are telling me...
its loading the bootrom into ram first and then I would use the bootloader thats now loaded into ram to load the boat loader again but this time into nand.
when it gets around the part where im about to reach the "venom" console part, it freezes.
I also tried to use putty for linux to see if it would still show the same error message like it would in windows, but nothing. all settings are the same as they are in windows and I get nothing.
So I think it might be a linux thing. Makes me wish KWboot worked in windows.
Bad blocks shouldn't display this result, to me (again, never had any mvebu devices, so no personal experience) it looks rather fine from the kwboot side. It's only the uploaded u-boot that seems to be problematic, either because it's "a wrong one" - or because you didn't interrupt it early enough, to keep it from trying to boot from the (empty) NAND. I'd continue experimenting in this direction - both the interrupting early enough, as well as with different u-boot variants (as the hardware is identical, you may try both rango or venom one - use the right one for flashing, but trying over kwboot should be fine).
The mcdebian howto referenced by anomeome looks quit straight forward though.
it worked! I mashed the esc key fast right when I saw it about to hit the venom prompt.
however, the commands "run linksysnandboot" and "linksysaltnandboot" are not working. they return errors.
EDIT: these are the errors
Venom>> run linksysnandboot
## Error: "linksysnandboot" not defined
I tried the command
run update_both_images
and it went through fine. but its still getting stuck at the part where im supposed to hit the enter key. I will keep trying. but now the boot loader is in the routers nand
EDIT2:
Heres what I got so far
U-Boot 2013.01 (May 18 2017 - 16:37:44) Marvell version: 2015_T1.QA.0p16
Boot version : v2.0.9
Board: RD-NAS-88F6820-DDR3
SoC: MV88F6820 Rev A0
running 2 CPUs
CPU: ARM Cortex A9 MPCore (Rev 1) LE
CPU 0
CPU @ 1866 [MHz]
L2 @ 933 [MHz]
TClock @ 200 [MHz]
DDR3 @ 933 [MHz]
DDR3 32 Bit Width,FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM: 512 MiB
NAND: 256 MiB
MMC: mv_sdh: 0 ' - try 'help'
Venom>> command '' - try 'help'
Venom>> command '' - try 'help'
Venom>> command '' - try 'help'
Venom>> command '' - try 'help'
Venom>> asdfand '
Unknown command 'asdf' - try 'help'
Venom>> setenv serverip 192.168.1.254
Venom>> setenv firmwareName FWWRT32X.img
Venom>> setenv netmask 255.255.255.0
Venom>> tftp FWWRT32X.img
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'FWWRT32X.img'.
Load address: 0x2000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################
6.3 MiB/s
done
Bytes transferred = 10741760 (a3e800 hex)
Venom>> run update_both_images
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'FWWRT32X.img'.
Load address: 0x2000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################
6.4 MiB/s
done
Bytes transferred = 10741760 (a3e800 hex)
NAND erase: device 0 offset 0x900000, size 0x7b00000
Erasing at 0x83e0000 -- 100% complete.
OK
NAND erase: device 0 offset 0x8400000, size 0x7b00000
Erasing at 0xfee0000 -- 100% complete.
OK
NAND write: device 0 offset 0x900000, size 0xa3e800
10741760 bytes written: OK
NAND write: device 0 offset 0x8400000, size 0xa3e800
10741760 bytes written: OK
Venom>> run linksysnandboot
## Error: "linksysnandboot" not defined
Venom>> run_linksysnandboot
Unknown command 'run_linksysnandboot' - try 'help'
Venom>> run_linksysaltnandboot
Unknown command 'run_linksysaltnandboot' - try 'help'
Venom>> reset
resetting ...
BootROM - 1.73
Booting from NAND flash
General initialization - Version: 1.0.0
AVS selection from EFUSE disabled (Skip reading EFUSE values)
mvSysEnvIsFlavourReduced: TWSI Read of 'flavor' failed
Detected Device ID 6820
High speed PHY - Version: 2.0
Init RD NAS topology Serdes Lane 3 is USB3
Serdes Lane 4 is SGMII
board SerDes lanes topology details:
| Lane # | Speed| Type |
------------------------------|
| 0 | 6 | SATA0 |
| 1 | 5 | PCIe0 |
| 2 | 6 | SATA1 |
| 3 | 5 | USB3 HOST1 |
| 4 | 5 | PCIe1 |
| 5 | 0 | SGMII2 |
-------------------------------
:** Link is Gen1, check the EP capability
PCIe, Idx 0: Link upgraded to Gen2 based on client cpabilities
:** Link is Gen1, check the EP capability
PCIe, Idx 1: remains Gen1
High speed PHY - Ended Successfully
DDR3 Training Sequence - Ver TIP-1.46.0
mvSysEnvGetTopologyUpdateInfo: TWSI Read failed
DDR3 Training Sequence - Switching XBAR Window to FastPath Window
DDR3 Training Sequence - Ended Successfully
Not detected suspend to RAM indication
BootROM: Image checksum verification PASSED
U-Boot 2013.01 (May 18 2017 - 16:37:44) Marvell version: 2015_T1.QA.0p16
Boot version : v2.0.9
Board: RD-NAS-88F6820-DDR3
SoC: MV88F6820 Rev A0
running 2 CPUs
CPU: ARM Cortex A9 MPCore (Rev 1) LE
CPU 0
CPU @ 1866 [MHz]
L2 @ 933 [MHz]
TClock @ 200 [MHz]
DDR3 @ 933 [MHz]
DDR3 32 Bit Width,FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM: 512 MiB
NAND: 256 MiB
MMC: mv_sdh: 0
��
BootROM - 1.73
Booting from NAND flash
General initialization - Version: 1.0.0
AVS selection from EFUSE disabled (Skip reading EFUSE values)
mvSysEnvIsFlavourReduced: TWSI Read of 'flavor' failed
Detected Device ID 6820
High speed PHY - Version: 2.0
Init RD NAS topology Serdes Lane 3 is USB3
Serdes Lane 4 is SGMII
board SerDes lanes topology details:
| Lane # | Speed| Type |
------------------------------|
| 0 | 6 | SATA0 |
| 1 | 5 | PCIe0 |
| 2 | 6 | SATA1 |
| 3 | 5 | USB3 HOST1 |
| 4 | 5 | PCIe1 |
| 5 | 0 | SGMII2 |
-------------------------------
:** Link is Gen1, check the EP capability
PCIe, Idx 0: Link upgraded to Gen2 based on client cpabilities
:** Link is Gen1, check the EP capability
PCIe, Idx 1: remains Gen1
High speed PHY - Ended Successfully
DDR3 Training Sequence - Ver TIP-1.46.0
mvSysEnvGetTopologyUpdateInfo: TWSI Read failed
DDR3 Training Sequence - Switching XBAR Window to FastPath Window
DDR3 Training Sequence - Ended Successfully
Not detected suspend to RAM indication
BootROM: Image checksum verification PASSED
l
U-Boot 2013.01 (May 18 2017 - 16:37:44) Marvell version: 2015_T1.QA.0p16
Boot version : v2.0.9
Board: RD-NAS-88F6820-DDR3
SoC: MV88F6820 Rev A0
running 2 CPUs
CPU: ARM Cortex A9 MPCore (Rev 1) LE
CPU 0
CPU @ 1866 [MHz]
L2 @ 933 [MHz]
TClock @ 200 [MHz]
DDR3 @ 933 [MHz]
DDR3 32 Bit Width,FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM: 512 MiB
NAND: 256 MiB
MMC: mv_sdh: 0
Venom>>boot
Unknown command 'oot' - try 'help'
Venom>> boot
NAND read: device 0 offset 0x900000, size 0x600000
6291456 bytes read: OK
Bad Linux ARM zImage magic!
Venom>>
help should tell you what features are implemented in this OEM u-boot, my approach would have probably been to tftpboot OpenWrt and to look further from there, but great that it worked.
Reader, Just to clarify on what the solution was, right after the transfer completes at the 99 percent part, and before you see the uboot prompt like this one
