[SOLVED] Bricked linksys wrt1200ac, recover when both firmwares are corrupt

reza · February 8, 2023, 7:53am

I had an issue with my router (linksys 1200ac) config so I tried to edit a file on the alternate partition (re-enabling dnsmasq) for that I ubiattach (or something like that) the mtd5 and 7 and many others. then I mounted mtd5 and edited the config. when via addvanced-reboot to the alternative partition which was shown as number and for its OS it said linksys/unknown (I think) , I rebooted the alternative partition.
now my device is bricked.
it just shows a power LED blinking every second.

can someone help me with de-bricking this device?

I am trying to connect to my device via usb-uart .
I have several problems.
first, the pre-requisite files for de-bricking on the device wiki are gone (website shows 404)

can someone upload them somewhere?

also I am not that pro with serial and flashing, but I have a "CP2102 USB to UART Bridge Controller" usb to serial that I used for my tplink before but I have forgotten how it works.

I have opened the device and I have connected the GND and TRX and RX pins but when I power on the device with serial connected the device's eSATA LED powers on and power led always stays on and nothing happens.

reza · February 8, 2023, 8:30am

update:
by just using trx and rx (without gnd wire) and setting the baudrate to 115200 I could get this:

BootROM - 1.73
Booting from NAND flash

General initialization - Version: 1.0.0
Detected Device ID 6820
High speed PHY - Version: 2.0

Init RD NAS topology Serdes Lane 3 is USB3
Serdes Lane 4 is SGMII
board SerDes lanes topology details:
 | Lane #  | Speed |  Type       |
 --------------------------------
 |   0    |  06   |  SATA0      |
 |   1    |  05   |  PCIe0      |
 |   2    |  06   |  SATA1      |
 |   3    |  05   |  USB3 HOST1 |
 |   4    |  05   |  PCIe1      |
 |   5    |  00   |  SGMII2     |
 --------------------------------
:** Link is Gen1, check the EP capability
PCIe, Idx 0: Link upgraded to Gen2 based on client cpabilities
:** Link is Gen1, check the EP capability
PCIe, Idx 1: remains Gen1
High speed PHY - Ended Successfully
DDR3 Training Sequence - Ver TIP-1.26.0
mvSysEnvGetTopologyUpdateInfo: TWSI Read failed
DDR3 Training Sequence - Switching XBAR Window to FastPath Window
DDR3 Training Sequence - Ended Successfully
Not detected suspend to RAM indication
BootROM: Image checksum verification PASSED

 __   __                      _ _
|  \/  | __ _ _ ____   _____| | |
| |\/| |/ _` | '__\ \ / / _ \ | |
| |  | | (_| | |   \ V /  __/ | |
|_|  |_|\__,_|_|    \_/ \___|_|_|
         _   _     ____              _
        | | | |   | __ )  ___   ___ | |_
        | | | |___|  _ \ / _ \ / _ \| __|
        | |_| |___| |_) | (_) | (_) | |_
         \___/    |____/ \___/ \___/ \__|
 ** LOADER **


U-Boot 2013.01 (Mar 27 2015 - 16:55:31) Marvell version: 2014_T3.0p6

Boot version : v2.0.13

Board: RD-NAS-88F6820-DDR3
SoC:   MV88F6820 Rev A0
       running 2 CPUs
CPU:   ARM Cortex A9 MPCore (Rev 1) LE
       CPU 0
       CPU    @ 1332 [MHz]
       L2     @ 666 [MHz]
       TClock @ 200 [MHz]
       DDR    @ 666 [MHz]
       DDR 32 Bit Width, FastPath Memory Access, DLB Enabled, ECC Disabled
DRAM:  512 MiB

Map:   Code:                    0x1fea9000:0x1ff7632c
       BSS:                     0x1ffef6b4
       Stack:                   0x1f9a8f20
       Heap:                    0x1f9a9000:0x1fea9000
raise: Signal # 8 caught
U-ENV offset == 0x200000
raise: Signal # 8 caught
U-ENV offset == 0x200000
       U-Boot Environment:      0x00200000:0x00220000 (NAND)

NAND:  128 MiB
MMC:   mv_sdh: 0
DEVINFO offset == 0x900000
U-ENV offset == 0x200000
U-ENV offset == 0x200000
S-ENV offset == 0x240000


#### auto_recovery ####
[u_env] get auto_recovery == yes
[u_env] get auto_recovery == yes
[u_env] get boot_part == 1
[u_env] get boot_part_ready == 3
auto_recovery enabled:1, boot_part:1, boot_part_ready:3

S-ENV offset == 0x240000
[boot_count_read] block:0x240000, size:128KB, records:64
[boot_count_read_record] boot_count:2, next_record:6

[boot_count_write] erase:0, auto_recovery->block_offset:0x240000 offset=0x243000

Updating boot_count ...
[boot_count_write] offset:0x243000 , length:2048
done

PCI-e 0 (IF 0 - bus 0) Root Complex Interface, Detected Link X1, GEN 2.0
PCI-e 1 (IF 1 - bus 1) Root Complex Interface, Detected Link X1, GEN 1.1
USB2.0 0: Host Mode
USB3.0 1: Host Mode
USB3.0 0: Host Mode
Board configuration detected:
mvEthE6171SwitchBasicInit init
Net:
|  port  | Interface | PHY address  |
|--------|-----------|--------------|
| egiga0 |   RGMII   |     0x01     |
| egiga1 |   SGMII   |     0x00     |
egiga0 [PRIME], egiga1
auto_recovery_check changes bootcmd: run nandboot
Hit any key to stop autoboot:  0

NAND read: device 0 offset 0xa00000, size 0x600000
 6291456 bytes read: OK
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Marvell>>

but when I type the characters are not correctly shown:
for example when I keep down the 'a' key on keyboard for I get this:

 ▒▒▒aaaaaaaaaaaaaaa▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒c▒▒▒▒▒▒▒▒▒▒▒a▒▒▒▒aaaaaaaaaaaaa▒aaaaaaa▒▒▒▒▒▒▒▒▒▒▒▒▒aaaaaaaaaaaaaaaaaa▒▒▒▒▒▒▒▒aaaaaa▒aa▒▒aaaa▒aaa▒▒▒▒▒▒▒▒▒▒▒▒▒c▒▒▒▒▒▒▒▒▒▒c▒▒c▒▒▒▒▒▒▒▒▒▒▒▒

frollic · February 8, 2023, 8:49am

and if you connect the GND after the device started the boot sequence ?

reza · February 8, 2023, 8:57am

thanks.
before you said that I tried that and it worked.
but now how do I get my device to work?
tftp?
can you explain it to me?

frollic · February 8, 2023, 9:14am

do the first three commands of 7, then jump to 9, I guess.

reza · February 8, 2023, 10:19am

I have tftp running.
do I have to write the that bin boot file?

I dont get this part:
Download firmware image for your device and save it to tftpboot/:

Issue the following at the Marvell » prompt:
tftp 192.168.1.254

frollic · February 8, 2023, 10:22am

I'd say no, you're already talking to uboot, same version even - 2.0.13.

Elaborate.
Put the image on the TFTP server, and run the tftp and get commands on the router.
latest openwrt images for your device are in https://downloads.openwrt.org/releases/22.03.2/targets/mvebu/cortexa9/

reza · February 8, 2023, 10:35am

I asked because it says marvell prompt and not openwrt.
like here:

and not this:

reza · February 8, 2023, 10:37am

tftp 192.168.1.254
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename '192.168.1.254'.
Load address: 0x2000000
Loading: *
TFTP error: 'File not found' (1)
Not retrying...

frollic · February 8, 2023, 10:40am

your device is soft bricked, that's why you're talking to uboot, it's the pre OS boot loader.

that could be OK, then do the get.

reza · February 8, 2023, 10:40am

I think it meant to be
tftp imagename
and that loads a file.

 tftp image.img
Using egiga0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'image.img'.
Load address: 0x2000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###############
         5.6 MiB/s
done
Bytes transferred = 28835840 (1b80000 hex)

like so.

but after that

Marvell>> run_linksysnandboot
Unknown command 'run_linksysnandboot' - try 'help'
Marvell>> run_linksysaltnandboot
Unknown command 'run_linksysaltnandboot' - try 'help'

reza · February 8, 2023, 10:43am

Marvell>> get
Unknown command 'get' - try 'help'

reza · February 8, 2023, 10:44am

you mean when It is soft bricked it would use a marvel uboot even though I have installed openwrt before and was using it?

frollic · February 8, 2023, 10:46am

the uboot's always there, no matter what FW you have installed

.did you already try the serial recovery in https://openwrt.org/toh/linksys/wrt1200ac#firmware_recovery ?

reza · February 8, 2023, 10:49am

yes.

Marvell>> run nandboot

NAND read: device 0 offset 0xa00000, size 0x600000
 6291456 bytes read: OK
Wrong Image Format for bootm command
ERROR: can't get kernel image!


Marvell>> run altnandboot

NAND read: device 0 offset 0x3200000, size 0x600000
 6291456 bytes read: OK
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Marvell>>

reza · February 8, 2023, 10:56am

from here:

and renaming the image to caiman.img
and running
run update_both_images

it seems to have given me openwrt.



BusyBox v1.35.0 (2023-02-03 13:20:33 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 22.03.2, r19803-9a599fee93
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.

frollic · February 8, 2023, 10:58am

Awesome!

Seems the proper TFTP recovery isn't documented for the 1200AC, good find and good luck.

FYI, i'm going to change your topic, since the issue wasn't really about the missing files.

tmomas · February 8, 2023, 11:11am

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks!

reza · February 8, 2023, 11:22am

can I edit wiki?
I think this needs to be added to wiki.
also some of the wiki links to the old lede-project websites.

and I still didnt find those files that are needed if I mess with boots.

frollic · February 8, 2023, 11:27am

yes, if you apply for an account here.

those files aren't hosted by openwrt, and unfortunately out of our control,
but I guess every user with the specific device can generate them, by dd:ing
the right partition to a file.