Upgrading OpenWrt on Linksys 32x - debrick required?

Hello,

i found an old Linksys 32x in the basement and I knew there was some kind of OpenWRT installed... I think it was an old david502c image version.

Model: Linksys WRT32X
Architecture: ARMv7 Processor rev 1 (v7l)
Firmware Version: OpenWrt SNAPSHOT r11829-e3e939d8e6 / LuCI Master git-19.363.49060-3593790
Kernel Version: 4.19.91

Now I wanted to upgrade to the latest OpenWRT stable. Flashing sysupgrade over webinterface presented me the following message with a force upgrade checkbox:

Device linksys,venom not supported by this image Supported devices: linksys,wrt32x armada-385-linksys-venom linksys,venom - Image version mismatch: image 2.0, device 1.0. Please wipe config during upgrade (force required) or reinstall. Reason: Partition design has changed compared to older versions (up to 19.07) due to kernel size restrictions. Upgrade via sysupgrade mechanism is not possible, so new installation via factory style image is required. Image check failed.

The uploaded image file does not contain a supported format. Make sure that you choose the generic image format for your platform.

So I forced the upgrade, but after reboot it booted in the same image as before.

After finding out the device has dual flash layout, I tried to switch partitions:

root@OpenWrt:/etc# /usr/sbin/fw_printenv -n boot_part
2

root@OpenWrt:/etc# /usr/sbin/fw_setenv boot_part 1
Read error on /dev/mtd1: No error information
Error: can't write fw_env to flash

I have no idea, what is happening, but somewhere I read about U-Boot environment is damaged.

root@OpenWrt:/etc# fw_printenv
CASset=max
MALLOC_len=5
MPmode=SMP
SMT-2D=XXX
altFwSize=0x7B00000
altKernAddr=0x8400000
altKernSize=0x0600000
altnandboot=setenv bootargs console=ttyS0,115200 root=/dev/mtdblock8;nand read $defaultLoadAddr $altKernAddr $altKernSize; bootz $defaultLoadAddr 
autoload=no
baudrate=115200
boot_order=hd_scr usb_scr mmc_scr hd_img usb_img mmc_img pxe net_img net_scr
boot_part_ready=3
bootargs_dflt=$console $nandEcc $mtdparts_lgcy $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel
bootargs_end=:10.4.50.254:255.255.255.0:Armada38x:eth0:none
bootargs_root=root=/dev/nfs rw
bootcmd_auto=stage_boot $boot_order
bootcmd_fdt=tftpboot 0x2000000 $image_name;tftpboot $fdtaddr $fdtfile;setenv bootargs $console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel; bootz 0x2000000 - $fdtaddr;
bootcmd_fdt_boot=tftpboot 0x2000000 $image_name; setenv bootargs $console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel; bootz 0x2000000 - $fdtaddr;
bootcmd_fdt_edit=tftpboot $fdtaddr $fdtfile; fdt addr $fdtaddr; setenv bootcmd $bootcmd_fdt_boot
bootcmd_lgcy=tftpboot 0x2000000 $image_name;setenv bootargs $console $nandEcc $mtdparts_lgcy $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end  video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel;  bootm $loadaddr; 
bootdelay=3
cacheShare=no
console=console=ttyS0,115200
defaultLoadAddr=0x2000000
device_partition=0:1
disaMvPnp=no
eeeEnable=no
enaClockGating=no
enaCpuStream=no
enaFPU=yes
enaMonExt=no
enaWrAllo=no
eth1addr=XXX
eth1mtu=1500
eth2addr=XXX
eth2mtu=1500
eth3addr=XXX
eth3mtu=1500
ethact=egiga0
ethaddr=XXX
ethmtu=1500
ethprime=egiga0
fdt_addr=2040000
fdt_skip_update=no
fdtaddr=0x1000000
fdtfile=armada-38x-modular.dtb
fileaddr=1000000
filesize=21E0000
firmwareName=venom.img
flash_alt_image=tftpboot $defaultLoadAddr $firmwareName && nand erase $altKernAddr $altFwSize && nand write $defaultLoadAddr $altKernAddr $filesize
flash_pri_image=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAddr $priFwSize && nand write $defaultLoadAddr $priKernAddr $filesize
ide_path=/
image_name=uImage
initrd_name=uInitrd
ipaddr=192.168.1.1
kernel_addr_r=2080000
lcd0_enable=0
lcd0_params=640x480-16@60
lcd_panel=0
limit_dram_size=yes
loadaddr=0x02000000
loads_echo=0
mtddevname=uboot
mtddevnum=0
mtdids=nand0=armada-nand
mtdparts=mtdparts=armada-nand:2048K(uboot)ro,128K(u_env),256K(s_env),256K@8064K(devinfo),123m@9m(firmware1),123m@132m(firmware2)
mvNetConfig=mv_net_config=4,(xxx,0:1:2:3),mtu=1500
mv_pon_addr=xxx
nandEcc=nfcConfig=4bitecc
nandboot=setenv bootargs console=ttyS0,115200 root=/dev/mtdblock6;nand read $defaultLoadAddr $priKernAddr $priKernSize; bootz $defaultLoadAddr 
netbsd_en=no
netmask=255.255.255.0
netretry=no
partition=nand0,0
pcieTune=no
pexMode=RC
priFwSize=0x7B00000
priKernAddr=0x0900000
priKernSize=0x0600000
pxe_files_load=:default.arm-armadaxp-db:default.arm-armadaxp:default.arm
pxefile_addr_r=3100000
ramdisk_addr_r=2880000
rootpath=/srv/nfs/
run_script=no
sata_delay_reset=0
sata_dma_mode=yes
script_addr_r=3000000
script_name=boot.scr
sd_detection_dat3=no
serverip=192.168.1.254
silent=1
standalone=fsload 0x2000000 $image_name;setenv bootargs $console $nandEcc $mtdparts_lgcy root=/dev/mtdblock0 rw ip=$ipaddr:$serverip$bootargs_end; bootm 0x2000000;
stderr=serial
stdin=serial
stdout=serial
update_both_images=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAddr $priFwSize && nand erase $altKernAddr $altFwSize && nand write $defaultLoadAddr $priKernAddr $filesize && nand write $defaultLoadAddr $altKernAddr $filesize
usb0Mode=host
usbActive=0
usbType=2
vxworks_en=no
yuk_ethaddr=XX
boot_part=2
bootcmd=run altnandboot
auto_recovery=yes

What would be the easiest way to recover this device with latest OpenWRT stable?

The available kernel space has been updated since then on your device IIRC.You need to use factory.img.

2 Likes

Thanks for your quick response. I already tried that... with factory and with Linksys stock firmware...

root@OpenWrt:/tmp# sysupgrade -F -n openwrt-21.02.3-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.im
g 
Image metadata not found
Image check failed but --force given - will update anyway!
Commencing upgrade. Closing all shell sessions.
Connection to 192.168.7.1 closed by remote host.
Connection to 192.168.7.1 closed.

But unfortunately that leads to the same issue... after reboot everything feels "untouched". Still same openwrt, no new firmware, no config reset, everything is as before.

I don't know what to do any more... I found this:

  Most newer devices (mostly those with decent amount of flash ROM) have 2 independent firmware partitions. A usage strategy could be, to install OpenWrt only into one of the 2 partitions and leave the vendor firmware in the other partition. No further tools are required to toggle between the two partitions.

Procedure, to manually toggle between the two firmware partitions:

    Switch device power off.
    3x Switch device power on for 2 seconds, then off again.
    Switch device power on, the device should now boot to the alternative partition.

When successfully booted into any of the two partitions, a triggered firmware update will flash the other, secondary partition. The partition that is currently booted, stays untouched. 

Unfortunately there is NO advice, how to get in to failsafe / recovery and flash a stock image or a factory image... maybe someone can help me out?

Let's see what's on the other partition.

Make sure you are wired to the router.

On the Linksys WRT series,

  • Power Sw OFF
  • Sw ON & wait for right side ethx led to flash and quickly
  • Power Sw OFF

Repeat the above at least 3-4 times and then let the router boot. It should come up on the alternate partition. Not knowing the firmware history, it could be OpenWrt or Linksys OEM.

1 Like

Your sysupgrade -F -n with factory should work. It looks ok.

Some ideas for you:

  • use luci-app-advanced-reboot to see what it thinks to be the contents of the other partition. I assume that it contains the OpenWrt you flashed, but that it doesn't boot.

  • Note: Changing just boot_part is not enough. You would need to change also "bootcmd". ( But those are automatically changed by the sysupgrade, so it should be unnecessary )

  • One possible reason for the boot failure is a bad block in the kernel area in the nonfunctional partition. That would cause factory image to get flashed wrongly, but a normal sysupgrade would work. (See
    Increasing mamba and venom kernel partition to 6MB - #122 by bmork for discussion).
    You might overcome that if you first sysupgrade normally again with the newest 19.07 sysupgrade image, so that you could sysupgrade normally and the boot gets switched to the other (now nonfunctional) partition. Then you could try force flashing again the 21.02.3 factory image (to the current partition) in hope of this being intact. (Sysupgrade is always round-robin in your router, so the next flash goes to the other partition.)

2 Likes

Unfortunately that did not do anything. Tried multiple times...

Thank you. That worked, I'm now on 19.07.9 stock:

 OpenWrt 19.07.9, r11405-2a3558b0de
 -----------------------------------------------------
root@OpenWrt:~# /usr/sbin/fw_printenv -n boot_part
1

That did not work... sticks to partition 1 now as it seems. Even flashing 19.07.9 again round robin via factory does not go back to the second partition...

root@OpenWrt:/tmp# sysupgrade -F -n openwrt-19.07.9-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.im
g 
Image metadata not found
Image check failed but --force given - will update anyway!
Commencing upgrade. Closing all shell sessions.
Connection to 192.168.7.1 closed by remote host.
Connection to 192.168.7.1 closed.

After trying 19.07.9 for the other partition luci-app-advanced-reboot shows 19.07.9 for both partitions - when trying to flash 21.02.3, it also shows this version. Trying to boot to any of the partitions shows:

Unable to set firmware environment variable: to .

Maybe there is something wrong with the uboot environment - maybe from an old lede flash or something.

Is there any way I reliably can get to 21.02.3? Maybe first using the factory default image from Linksys? Or completely overwrite the whole flash including uboot and everything?

I somehow managed to get this working. So, here is what I did:

  1. Flashed factory image 19.07.9 via sysupgrade -F -n openwrt-19.07.9-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.img
  2. After reboot, the 19.07.9 should be available, otherwise use the 3 times turn-off and on strategy to switch partitions
  3. Flashed factory image 21.02.3 via sysupgrade -F -n openwrt-21.02.3-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.img
  4. use the 3 times turn-off and on strategy to switch partitions
  5. AGAIN Flashed factory image 21.02.3 via sysupgrade -F -n openwrt-21.02.3-mvebu-cortexa9-linksys_wrt32x-squashfs-factory.img to overwrite the other partition

Now the auto partition switch should work again (somehow it does with the latest version).

Thanks @RuralRoots and @hnyman for your help.

Great that you got it working.

Sounds like there has been something inconsistent in the u-boot variables, and flashing both partition s straightened it up.

But it could also be that there is something wrong still, and the problem may materialise with flashing then. You might then need to switch paritions and flash the current one from the other.

1 Like

Yeah unfortunately I don't know how to fix it without a lot of effort (opening the device, attach USB Serial and reset / restore the boot loader)...

Maybe I'll try an unofficial image like this: https://github.com/DevOpenWRT-Router/Action_OpenWRT_AutoBuild_Linksys_Devices

There is a forum thread here: PureFusion - wrt3200acm, wrt32x, wrt1200ac, wrt1900acs, wrt1900acV1, wrt1900acV2 Builds - #145 by Eliminater74

You should also look at another community build for these devices:
https://forum.openwrt.org/t/divested-wrt-no-nonsense-hardened-builds-for-linksys-wrt-series/80522/840

Both builds are well received by the community.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.