Bricked WRT32X


Solved
U-boot wasn't broken in my case, I had to spam more times with keystrokes upon booting and got prompt back. From there it was as easy as setting up TFTP again, and flashing correct image venom.img.

Big thanks for @lantis1008 !


Hello there!

I have bricked my WRT32X by flashing over OEM firmware (from linksys downloads page) not a flat one (people mention around).

Steps of destruction I took:

  • Flash OpenWRT on WRT32X
  • Use it for some days
  • Bricked it (After I run telegraf binary router stopped working. Removal attempt bricked OpenWRT to the state router couldn't assign an IP or boot anymore, weird.. I know)
  • I have connected it via serial and.. flashed over by TFTP FW_WRT32X_1.0.180404.58.img (which is normal firmware... not flat one)

Current state, Serial is working but there's no prompt at the end.

From what I saw on ValCher1961/McDebian_WRT3200ACM it's possible to recover u-boot on this device, I would like to know if it's good direction and what should I do after it to install on my router either:

  • OEM Firmware
  • OpenWRT

All things I did to brick my device

BootROM - 1.73
Booting from NAND flash

General initialization - Version: 1.0.0
AVS selection from EFUSE disabled (Skip reading EFUSE values)
mvSysEnvIsFlavourReduced: TWSI Read of 'flavor' failed
Detected Device ID 6820
High speed PHY - Version: 2.0

Init RD NAS topology Serdes Lane 3 is USB3
Serdes Lane 4 is SGMII
board SerDes lanes topology details:
 | Lane # | Speed|    Type     |
 ------------------------------|
 |   0    |  6   |  SATA0      |
 |   1    |  5   |  PCIe0      |
 |   2    |  6   |  SATA1      |
 |   3    |  5   |  USB3 HOST1 |
 |   4    |  5   |  PCIe1      |
 |   5    |  0   |  SGMII2     |
 -------------------------------
:** Link is Gen1, check the EP capability
PCIe, Idx 0: Link upgraded to Gen2 based on client cpabilities
:** Link is Gen1, check the EP capability
PCIe, Idx 1: remains Gen1
High speed PHY - Ended Successfully
DDR3 Training Sequence - Ver TIP-1.46.0
mvSysEnvGetTopologyUpdateInfo: TWSI Read failed
DDR3 Training Sequence - Switching XBAR Window to FastPath Window
DDR3 Training Sequence - Ended Successfully
Not detected suspend to RAM indication
BootROM: Image checksum verification PASSED


U-Boot 2013.01 (May 18 2017 - 16:37:44) Marvell version: 2015_T1.QA.0p16

Boot version : v2.0.9

Board: RD-NAS-88F6820-DDR3
SoC:   MV88F6820 Rev A0
       running 2 CPUs
CPU:   ARM Cortex A9 MPCore (Rev 1) LE
       CPU 0
       CPU    @ 1866 [MHz]
       L2     @ 933 [MHz]
       TClock @ 200 [MHz]
       DDR3    @ 933 [MHz]
       DDR3 32 Bit Width,FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM:  512 MiB
NAND:  256 MiB
MMC:   mv_sdh: 0
Venom>> <INTERRUPT>
Venom>> <INTERRUPT>
Venom>> setenv ipaddr 192.168.1.1
Venom>> setenv severip 192.168.1.2
Venom>> set
  setdevinfo setenv setsenv
Venom>> setenv netmask 255.255.255.0
Venom>> setenv firmwareName link.img
Venom>> run update_both_images
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'link.img'.
Load address: 0x2000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
Venom>> run update_both_images
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'link.img'.
Load address: 0x2000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
Venom>> setenv severip 192.168.1.254
Venom>> run update_both_images
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'link.img'.
Load address: 0x2000000
Loading: T T T T T T T T T T
Retry count exceeded; starting again
Venom>> setenv ipaddr 192.168.1.212
Venom>> setenv severip 192.168.1.1
Venom>> setenv firmwareName link.img
Venom>> run update_both_images
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.212
Filename 'link.img'.
Load address: 0x2000000
Loading: T T T T T T T
Abort
Venom>> setenv severip 192.168.1.1

                                  <INTERRUPT>
Venom>> setenv serverip 192.168.1.254
Venom>> run update_both_images
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.212
Filename 'link.img'.
Load address: 0x2000000
Loading: T
Abort
Venom>> setenv serverip 192.168.1.1
Venom>> e
  echo editenv eeprom env exit ext2load ext2ls ext4load ext4ls ext4write
Venom>> env
env - environment handling commands

Usage:
env default [-f] -a - [forcibly] reset default environment
env default [-f] var [...] - [forcibly] reset variable(s) to their default values
env delete [-f] var [...] - [forcibly] delete variable(s)
env edit name - edit environment variable
env export [-t | -b | -c] [-s size] addr [var ...] - export environment
env import [-d] [-t | -b | -c] addr [size] - import environment
env print [-a | name ...] - print environment
env run var [...] - run commands in an environment variable
env save - save environment
env set [-f] name [arg ...]

Venom>> env print
CASset=max
MALLOC_len=5
MPmode=SMP
SMT-2D=NK90I0202810X01
altFwSize=0x7B00000
altKernAddr=0x8400000
altKernSize=0x0600000
altnandboot=setenv bootargs console=ttyS0,115200 root=/dev/mtdblock8;nand read $defaultLoadAddr $altKernAddr $altKernSize; bootz $defaultLoadAddr
auto_recovery=yes
autoload=no
baudrate=115200
boot_order=hd_scr usb_scr mmc_scr hd_img usb_img mmc_img pxe net_img net_scr
boot_part=1
boot_part_ready=3
bootargs_dflt=$console $nandEcc $mtdparts_lgcy $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel
bootargs_end=:10.4.50.254:255.255.255.0:Armada38x:eth0:none
bootargs_root=root=/dev/nfs rw
bootcmd=run altnandboot
bootcmd_auto=stage_boot $boot_order
bootcmd_fdt=tftpboot 0x2000000 $image_name;tftpboot $fdtaddr $fdtfile;setenv bootargs $console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel; bootz 0x2000000 - $fdtaddr;
bootcmd_fdt_boot=tftpboot 0x2000000 $image_name; setenv bootargs $console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel; bootz 0x2000000 - $fdtaddr;
bootcmd_fdt_edit=tftpboot $fdtaddr $fdtfile; fdt addr $fdtaddr; setenv bootcmd $bootcmd_fdt_boot
bootcmd_lgcy=tftpboot 0x2000000 $image_name;setenv bootargs $console $nandEcc $mtdparts_lgcy $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end  video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel;  bootm $loadaddr;
bootdelay=3
cacheShare=no
console=console=ttyS0,115200
defaultLoadAddr=0x2000000
device_partition=0:1
disaMvPnp=no
eeeEnable=no
enaClockGating=no
enaCpuStream=no
enaFPU=yes
enaMonExt=no
enaWrAllo=no
eth1addr=60:38:E0:CE:60:70
eth1mtu=1500
eth2addr=60:38:E0:CE:60:70
eth2mtu=1500
eth3addr=60:38:E0:CE:60:70
eth3mtu=1500
ethact=egiga0
ethaddr=60:38:E0:CE:60:70
ethmtu=1500
ethprime=egiga0
fdt_addr=2040000
fdt_skip_update=no
fdtaddr=0x1000000
fdtfile=armada-38x-modular.dtb
fileaddr=2000000
filesize=C20000
firmwareName=link.img
flash_alt_image=tftpboot $defaultLoadAddr $firmwareName && nand erase $altKernAddr $altFwSize && nand write $defaultLoadAddr $altKernAddr $filesize
flash_pri_image=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAddr $priFwSize && nand write $defaultLoadAddr $priKernAddr $filesize
ide_path=/
image_name=uImage
initrd_name=uInitrd
ipaddr=192.168.1.212
kernel_addr_r=2080000
lcd0_enable=0
lcd0_params=640x480-16@60
lcd_panel=0
limit_dram_size=yes
loadaddr=0x02000000
loads_echo=0
mtddevname=uboot
mtddevnum=0
mtdids=nand0=armada-nand
mtdparts=mtdparts=armada-nand:2048K(uboot)ro,128K(u_env),256K(s_env),256K@8064K(devinfo),123m@9m(firmware1),123m@132m(firmware2)
mvNetConfig=mv_net_config=4,(00:50:43:11:11:11,0:1:2:3),mtu=1500
mv_pon_addr=00:50:43:db:f5:00
nandEcc=nfcConfig=4bitecc
nandboot=setenv bootargs console=ttyS0,115200 root=/dev/mtdblock6;nand read $defaultLoadAddr $priKernAddr $priKernSize; bootz $defaultLoadAddr
netbsd_en=no
netmask=255.255.255.0
netretry=no
partition=nand0,0
pcieTune=no
pexMode=RC
priFwSize=0x7B00000
priKernAddr=0x0900000
priKernSize=0x0600000
pxe_files_load=:default.arm-armadaxp-db:default.arm-armadaxp:default.arm
pxefile_addr_r=3100000
ramdisk_addr_r=2880000
rootpath=/srv/nfs/
run_script=no
sata_delay_reset=0
sata_dma_mode=yes
script_addr_r=3000000
script_name=boot.scr
sd_detection_dat3=no
serverip=192.168.1.1
severip=192.168.1.1
silent=1
standalone=fsload 0x2000000 $image_name;setenv bootargs $console $nandEcc $mtdparts_lgcy root=/dev/mtdblock0 rw ip=$ipaddr:$serverip$bootargs_end; bootm 0x2000000;
stderr=serial
stdin=serial
stdout=serial
update_both_images=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAddr $priFwSize && nand erase $altKernAddr $altFwSize && nand write $defaultLoadAddr $priKernAddr $filesize && nand write $defaultLoadAddr $altKernAddr $filesize
usb0Mode=host
usbActive=0
usbType=2
vxworks_en=no
yuk_ethaddr=00:00:00:EE:51:81

Environment size: 4453/131068 bytes
Venom>> run update_both_images
Using egiga0 device
TFTP from server 192.168.1.1; our IP address is 192.168.1.212
Filename 'link.img'.
Load address: 0x2000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################
         2 MiB/s
done
Bytes transferred = 10741760 (a3e800 hex)

NAND erase: device 0 offset 0x900000, size 0x7b00000
Erasing at 0x83e0000 -- 100% complete.
OK

NAND erase: device 0 offset 0x8400000, size 0x7b00000
Skipping bad block at  0x09260000
Erasing at 0xfee0000 -- 100% complete.
OK

NAND write: device 0 offset 0x900000, size 0xa3e800
 10741760 bytes written: OK

NAND write: device 0 offset 0x8400000, size 0xa3e800
 10741760 bytes written: OK
Venom>> reset
  reset resetenv
Venom>> reset
resetting ...

BootROM - 1.73
Booting from NAND flash

General initialization - Version: 1.0.0
AVS selection from EFUSE disabled (Skip reading EFUSE values)
mvSysEnvIsFlavourReduced: TWSI Read of 'flavor' failed
Detected Device ID 6820
High speed PHY - Version: 2.0

Init RD NAS topology Serdes Lane 3 is USB3
Serdes Lane 4 is SGMII
board SerDes lanes topology details:
 | Lane # | Speed|    Type     |
 ------------------------------|
 |   0    |  6   |  SATA0      |
 |   1    |  5   |  PCIe0      |
 |   2    |  6   |  SATA1      |
 |   3    |  5   |  USB3 HOST1 |
 |   4    |  5   |  PCIe1      |
 |   5    |  0   |  SGMII2     |
 -------------------------------
:** Link is Gen1, check the EP capability
PCIe, Idx 0: Link upgraded to Gen2 based on client cpabilities
:** Link is Gen1, check the EP capability
PCIe, Idx 1: remains Gen1
High speed PHY - Ended Successfully
DDR3 Training Sequence - Ver TIP-1.46.0
mvSysEnvGetTopologyUpdateInfo: TWSI Read failed
DDR3 Training Sequence - Switching XBAR Window to FastPath Window
DDR3 Training Sequence - Ended Successfully
Not detected suspend to RAM indication
BootROM: Image checksum verification PASSED


U-Boot 2013.01 (May 18 2017 - 16:37:44) Marvell version: 2015_T1.QA.0p16

Boot version : v2.0.9

Board: RD-NAS-88F6820-DDR3
SoC:   MV88F6820 Rev A0
       running 2 CPUs
CPU:   ARM Cortex A9 MPCore (Rev 1) LE
       CPU 0
       CPU    @ 1866 [MHz]
       L2     @ 933 [MHz]
       TClock @ 200 [MHz]
       DDR3    @ 933 [MHz]
       DDR3 32 Bit Width,FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM:  512 MiB
NAND:  256 MiB
MMC:   mv_sdh: 0

BootROM - 1.73
Booting from NAND flash

General initialization - Version: 1.0.0
AVS selection from EFUSE disabled (Skip reading EFUSE values)
mvSysEnvIsFlavourReduced: TWSI Read of 'flavor' failed
Detected Device ID 6820
High speed PHY - Version: 2.0

Init RD NAS topology Serdes Lane 3 is USB3
Serdes Lane 4 is SGMII
board SerDes lanes topology details:
 | Lane # | Speed|    Type     |
 ------------------------------|
 |   0    |  6   |  SATA0      |
 |   1    |  5   |  PCIe0      |
 |   2    |  6   |  SATA1      |
 |   3    |  5   |  USB3 HOST1 |
 |   4    |  5   |  PCIe1      |
 |   5    |  0   |  SGMII2     |
 -------------------------------
:** Link is Gen1, check the EP capability
PCIe, Idx 0: Link upgraded to Gen2 based on client cpabilities
:** Link is Gen1, check the EP capability
PCIe, Idx 1: remains Gen1
High speed PHY - Ended Successfully
DDR3 Training Sequence - Ver TIP-1.46.0
mvSysEnvGetTopologyUpdateInfo: TWSI Read failed
DDR3 Training Sequence - Switching XBAR Window to FastPath Window
DDR3 Training Sequence - Ended Successfully
Not detected suspend to RAM indication
BootROM: Image checksum verification PASSED


U-Boot 2013.01 (May 18 2017 - 16:37:44) Marvell version: 2015_T1.QA.0p16

Boot version : v2.0.9

Board: RD-NAS-88F6820-DDR3
SoC:   MV88F6820 Rev A0
       running 2 CPUs
CPU:   ARM Cortex A9 MPCore (Rev 1) LE
       CPU 0
       CPU    @ 1866 [MHz]
       L2     @ 933 [MHz]
       TClock @ 200 [MHz]
       DDR3    @ 933 [MHz]
       DDR3 32 Bit Width,FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM:  512 MiB
NAND:  256 MiB
MMC:   mv_sdh: 0

Current output from Serial

BootROM - 1.73
Booting from NAND flash

General initialization - Version: 1.0.0
AVS selection from EFUSE disabled (Skip reading EFUSE values)
mvSysEnvIsFlavourReduced: TWSI Read of 'flavor' failed
Detected Device ID 6820
High speed PHY - Version: 2.0

Init RD NAS topology Serdes Lane 3 is USB3
Serdes Lane 4 is SGMII
board SerDes lanes topology details:
| Lane # | Speed| Type |
------------------------------|
| 0 | 6 | SATA0 |
| 1 | 5 | PCIe0 |
| 2 | 6 | SATA1 |
| 3 | 5 | USB3 HOST1 |
| 4 | 5 | PCIe1 |
| 5 | 0 | SGMII2 |
-------------------------------
:** Link is Gen1, check the EP capability
PCIe, Idx 0: Link upgraded to Gen2 based on client cpabilities
:** Link is Gen1, check the EP capability
PCIe, Idx 1: remains Gen1
High speed PHY - Ended Successfully
DDR3 Training Sequence - Ver TIP-1.46.0
mvSysEnvGetTopologyUpdateInfo: TWSI Read failed
DDR3 Training Sequence - Switching XBAR Window to FastPath Window
DDR3 Training Sequence - Ended Successfully
Not detected suspend to RAM indication
BootROM: Image checksum verification PASSED


U-Boot 2013.01 (May 18 2017 - 16:37:44) Marvell version: 2015_T1.QA.0p16

Boot version : v2.0.9

Board: RD-NAS-88F6820-DDR3
SoC: MV88F6820 Rev A0
running 2 CPUs
CPU: ARM Cortex A9 MPCore (Rev 1) LE
CPU 0
CPU @ 1866 [MHz]
L2 @ 933 [MHz]
TClock @ 250 [MHz]
DDR3 @ 933 [MHz]
DDR3 32 Bit Width,FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM: 512 MiB
NAND: 256 MiB
MMC: mv_sdh: 0

These devices intentionally hide the serial console from you. Note that in your printenv, "silent=1". You need to get rid of that variable, or set it to 0, and then see what is actually going on with your router. Otherwise you'll be flying completely blind. Alternatively, if you interrupt the boot process at serial and then "run nandboot" or "run altnandboot" the silent variable is ignored.

There's a "factory" image available on the ddwrt forums that would get you out of trouble too. All of the firmwares available from linksys are in "sysupgrade" format.

1 Like

@lantis1008 silent=1 was there before flashing stock (sysupgrade) firmware, yet I was able to see a content and use prompt on Serial before flashing.
To get rid of this variable I have to use kwboot to run uboot ?
I wasn't able to find this factory image for wrt32x yet, I'll keep looking though.

Thanks for response!

If you interrupt the boot, the serial console is of course visible. But during the regular boot process it is not due to silent.
Therefore you cannot see where the boot is failing. Although I think we can assume the error will be “Bad image magic, no zimage”.

1 Like

Got it.
After successful connection via serial I should flash OEM firmware and after that OpenWRT (by web sysupgrade)?
I mean I shouldn't flash anything else than big flat oem image at this moment, right?
Also, I will need any manual corrections to env?

Yes just the factory image to recover at the moment.
Then you can sysupgrade regularly.

No env should be fine unless you have modified boot params

1 Like

Putting all together.

Steps to take:

  • Run u-boot using kwboot
  • change silent variable using setenv silent=0
  • put flat image venom.img on TFTP server
  • configure IP's and firmware_name to venom.img and TFTP server
  • execute run update_both_images

After that I should be on stock firmware, and no futher actions are needed from serial. Is that correct?
I saw few more commands on ValCher1961/McDebian_WRT3200ACM but I guess my u-boot is not broken so they are not needed?

Out of curiosity:

  • What Telegraf binary? To my knowledge, there is no specific Openwrt binary for it. Note that Openwrt uses musl-libc, a reduced libc, so a standard Linux binary for ARM will likely not work.
  • How did you brick the router in the recovery? The simplest thing would be to enter the Openwrt failsafe mode at boot, mount root and issue "firstboot" command to clear the overlay and leave the plain clean firmware intact for the next boot. (Openwrt has the flashed firmware rom + the read-write overlay with your package, so reverting to the clean firmware should always be possible.) Or alternatively, use the WRTxxxx specific three-times power trick to boot the alternative firmware and continue from there.

Bricking the device pretty much requires some non-standard recovery attempt deviating from the easy alternatives, so it would be great to understand your "bricking method" to help others to avoid that in future.

I have used elegraf-1.9.1_linux_armhf.tar.gz (now I'm aware it was wrong choice), unpacked it to own directories. After that I run it and my router stopped responding. After hard restart (poweroff, poweron) of device I started removing those files on SSH (I'm sure that I didn't removed anything else than telegraf files itself) after it router stopped responding, hard restart didn't worked, IP wasn't assigned for clients.

Well... I wasn't able to restore by using RESET button, so I used serial method and flashed over OEM firmware (not flat one).

Stupid choices, lack of knowledge and research.
Don't do it that way :slight_smile:

ive struggled through this silent issue a few times.
questions:

  1. is it possible to set silent=0 in uboot itself? i have tried editting the binary uboot file and reflashing, but i bricked the router becasue i think uboot has does an internal checksum check before booting - which i wrecked by binary editting. is there another approach?
  2. is 'silent=1' required by the stock OEM or openwrt 'advanced-reboot' modules?
  3. is there a windows verion of kwboot (i couldnt find one)

i thank all contributors on this forum.

I don’t understand why you’re trying to reflash the uboot? It sounds intact. Just boot into the serial console normally

Then from there you can change the silent variable. The OEM firmware won’t care what it is set to.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.