OpenWrt Forum Archive

Post #1

jintao

3 Nov 2010, 16:47

Dear all,

I tried reflashing the WRT160NL router with sysupgrade.

It works when config files is not saved over flashing.

It always bricks the router if I choose to save config files.

I also tried flashing from LuCI and selected "save config files", and router got bricked.

I accessed the serial console, the bootloader complains about bad CRC

U-Boot 1.1.6 (May 12 2009 - 07:52:28)

DRAM: ar7100_ddr_initial_config(237) enter!
ar7100_ddr_initial_config(269) exit!

U-Boot 1.1.6 (May 12 2009 - 07:52:28)

AP81 (ar7100) U-boot
sri
32 MB
WRT160NL u-boot version: 1.0.0
Top of RAM usable for U-Boot at: 82000000
Reserving 279k for U-Boot at: 81fb8000
Reserving 192k for malloc() at: 81f88000
Reserving 44 Bytes for Board Info at: 81f87fd4
Reserving 36 Bytes for Global Data at: 81f87fb0
Reserving 128k for boot params() at: 81f67fb0
Stack Pointer at: 81f67f98
Now running in RAM - U-Boot at: 81fb8000
id read 0x100000ff
flash size 8MB, sector count = 128
Flash: 8 MB
*** Warning - bad CRC, using default environment

In: serial
Out: serial
Err: serial
Net: ag7100_enet_initialize...
ag7100 get ethaddr for device eth0
Fetching MAC Address from 0x81feb1e0

--------***** Get the RTL8306SD Manufactory ID=379c *****-------
Reg6: speed=0 nway=1 duplex=0
Reg5: speed=0 nway=0 duplex=0
Reg1: a1=7fd9 a2=30e0 a3=15ac a4=30e0 a5=0
Reg1: a1=7fd9 a2=30e0 a3=15ac a4=30e0
Reg1: a1=7fd9 a2=30e0 a3=15ac a4=30e0
Reg1: a1=7fd9 a2=30e0 a3=15ac a4=30e0
Reg1: a1=7fd9 a2=30e0 a3=15ac a4=30e0
eth0: 00:25:9c:d8:e9:41
eth0 up
eth0
### main_loop entered: bootdelay=1

Hit any key to stop autoboot: 0
## Booting WRT160NL ...
Application code length 0x00310000
Bad CRC: trx.crc32 0x9d594875 calculate 0x499b6ce2
check link duplex:Full/speed:100
dup 1 speed 100
Tftpd start listening on port[69]!

Does sysupgrade support WRT160NL model? Is there any work around to flash this router with config files saved?

Thanks tons in advance!

(Last edited by jintao on 3 Nov 2010, 16:50)

Post #2

nextsux

10 Nov 2010, 18:29

Hi,

did you solved this problem? I've got a same one I've just debricked my wrt160nl via U-Boot

I would not be concerned about that CRC warning. This warning is shown on mine every boot (even with wiped config):

U-Boot 1.1.5 (Apr  6 2009 - 13:54:11)                                                                                                     
                                                                                                                                          
DRAM:  ar7100_ddr_initial_config(237) enter!                                                                                              
ar7100_ddr_initial_config(269) exit!                                                                                                      
                                                                                                                                          
                                                                                                                                          
U-Boot 1.1.5 (Apr  6 2009 - 13:54:11)                                                                                                     
                                                                                                                                          
AP81 (ar7100) U-boot                                                                                                                      
sri                                                                                                                                       
32 MB                                                                                                                                     
WRT160NL u-boot version: 1.0.0                                                                                                            
Top of RAM usable for U-Boot at: 82000000                                                                                                 
Reserving 277k for U-Boot at: 81fb8000                                                                                                    
Reserving 192k for malloc() at: 81f88000                                                                                                  
Reserving 44 Bytes for Board Info at: 81f87fd4                                                                                            
Reserving 36 Bytes for Global Data at: 81f87fb0                                                                                           
Reserving 128k for boot params() at: 81f67fb0                                                                                             
Stack Pointer at: 81f67f98                                                                                                                
Now running in RAM - U-Boot at: 81fb8000                                                                                                  
id read 0x100000ff                                                                                                                        
flash size 8MB, sector count = 128                                                                                                        
Flash:  8 MB                                                                                                                              
*** Warning - bad CRC, using default environment                                                                                          
                                                                                                                                          
In:    serial                                                                                                                             
Out:   serial                                                                                                                             
Err:   serial                                                                                                                             
Net:   ag7100_enet_initialize...                                                                                                          
ag7100 get ethaddr for device eth0                                                                                                        
Fetching MAC Address from 0x81feaf20                                                                                                      
                                                                                                                                          
 --------***** Get the RTL8306SD Manufactory ID=34dc *****-------                                                                         
 Reg6: speed=0 nway=1 duplex=1                                                                                                            
 Reg5: speed=0 nway=0 duplex=0                                                                                                            
 Reg1: a1=7fd9 a2=2890 a3=115c a4=2890 a5=0                                                                                               
 Reg1: a1=7fd9 a2=2890 a3=115c a4=2890                                                                                                    
 Reg1: a1=7fd9 a2=2890 a3=115c a4=2890                                                                                                    
 Reg1: a1=7fd9 a2=2890 a3=115c a4=2890                                                                                                    
 Reg1: a1=7fd9 a2=2890 a3=115c a4=2890

I've noticed that corruption happens immediately after sysupgrade tries to restore config files but there are some warnings about mounting overlay first. I'll post sysupgrade output later.

I think we should look for problem somewhere around /lib/upgrade/common.sh:137

jffs2_copy_config() {
    if grep rootfs_data /proc/mtd >/dev/null; then
        # squashfs+jffs2
        mtd -e rootfs_data jffs2write "$CONF_TAR" rootfs_data
    else
        # jffs2
        mtd jffs2write "$CONF_TAR" rootfs
    fi
}

Post #3

nextsux

10 Nov 2010, 18:53

Well this is wierd. I'm running now my "restore" build based on Backfire (10.03, r20728). It seems not to suffer by this problem!

etc/dropbear/dropbear_dss_host_key
etc/group
etc/passwd
etc/config/wireless
etc/config/uhttpd
etc/config/system
etc/config/ucitrack
etc/config/network
etc/config/dropbear
etc/config/firewall
etc/config/luci
etc/config/dhcp
Switching to ramdisk...
mount: mounting mini_fo:/overlay on /mnt failed: Function not implemented
Performing system upgrade...
Unlocking firmware ...
Writing from <stdin> to firmware ...  [w]
Appending jffs2 data from /tmp/sysupgrade.tgz to firmware...
Upgrade completed
Rebooting system...
Terminated

"error" is there, but system did not get bricked, everything worked. Thus I assume bug appeared very recently

Post #4

nextsux

10 Nov 2010, 20:07

I've tracked problem down to commit 22881 in /package/mtd/src
When I reverted this commit, I was able successfully sysupgrade with keeping my config without bricking my WRT160NL

Can you confirm this works?

Post #5

jintao

7 Dec 2010, 18:15

Hi nextsux,

I will try this tonight. Will get back to you with how it goes for me. Thanks in advance!

jt

nextsux wrote:

I've tracked problem down to commit 22881 in /package/mtd/src
When I reverted this commit, I was able successfully sysupgrade with keeping my config without bricking my WRT160NL
Can you confirm this works?

Post #6

jintao

29 Dec 2010, 18:25

Hi,

Sorry for the late response. Just got chance to try this out. Unfortunately it doesn't work for me. I reverted package/mtd to several old revisions, none of them works. still bricked the router each time.

will keep looking for the solution

Post #7

neutronscott

19 Jan 2011, 02:06

Look for this. During a boot, see where your MTD partitions are at. do a sysupgrade without config files. Now look where your MTD partitions are at. Did rootfs_data move? If so, the problem is that sysupgrade rewrites the configs into the old rootfs_data partition before rebooting, which may be overwriting your squashfs if the new image is larger!!

edit: you look at "dmesg" output for something like this

Creating 3 MTD partitions on "adm8668-nor":
0x000000040000-0x000000800000 : "linux"
0x000000120000-0x000000800000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=270000, len=590000 
0x000000270000-0x000000800000 : "rootfs_data"
0x000000020000-0x000000040000 : "uboot_env"

(Last edited by neutronscott on 19 Jan 2011, 02:10)

Post #8

nextsux

25 Jan 2011, 14:21

I have new wrt160nl in here now and I have same problem as you are. Only difference between model I used to use earlier and now are versions of U-boot. Older one have 1.1.5, new have 1.1.6. Maybe this is our problem.

Post #9

nextsux

25 Jan 2011, 19:24

Hi again,

try this UGLY patch

Index: package/base-files/files/lib/upgrade/common.sh
===================================================================
--- package/base-files/files/lib/upgrade/common.sh    (revision 23944)
+++ package/base-files/files/lib/upgrade/common.sh    (working copy)
@@ -174,6 +174,10 @@
             jffs2_copy_config
         fi
     }
+
+    echo "fixing TRX"
+    mtd fixtrx -o 32 firmware
+
     v "Upgrade completed"
     [ -n "$DELAY" ] && sleep "$DELAY"
     ask_bool 1 "Reboot" && {

it worked for me. It seems like appending jffs2 data corrupts TRX CRC32.

Post #10

WTGPhoben

2 Mar 2011, 14:58

nextsux wrote:

Hi again,

try this UGLY patch

Index: package/base-files/files/lib/upgrade/common.sh
===================================================================
--- package/base-files/files/lib/upgrade/common.sh    (revision 23944)
+++ package/base-files/files/lib/upgrade/common.sh    (working copy)
@@ -174,6 +174,10 @@
             jffs2_copy_config
         fi
     }
+
+    echo "fixing TRX"
+    mtd fixtrx -o 32 firmware
+
     v "Upgrade completed"
     [ -n "$DELAY" ] && sleep "$DELAY"
     ask_bool 1 "Reboot" && {

it worked for me. It seems like appending jffs2 data corrupts TRX CRC32.

This worked for me as well, but not until the code was in the image on the router. Manually adding the lines to common.sh file before running sysupgrade does not seem to work. (in both cases the code was in the new image).

Can someone confirm that this makes sense?

Also, has anyone posted this as a bug yet?

Post #11

nextsux

2 Mar 2011, 15:31

I think that better way is to fix mtd utility. I've tried that but I'm not strong at C, so it did not worked.
No I have not posted this as bug yet.

Post #12

WTGPhoben

2 Mar 2011, 18:03

nextsux wrote:

I think that better way is to fix mtd utility. I've tried that but I'm not strong at C, so it did not worked.
No I have not posted this as bug yet.

I don't doubt you're right...

Update on my question above, some more testing has me convinced that you can, in fact, change the script in the running config and the sysupgrade successfully. I rebooted after changing the file this time. Not sure why that would matter, but it works consistently

Posted the issue as a bug: https://dev.openwrt.org/ticket/8960 so someone who knows mtd can take a look

Post #13

lc

3 May 2011, 09:02

Seems the ticket has not yet been processed. Just tried the latest snapshop r26806. After sysupgrade the WRT160NL has to be reflashed using tftp.

root@openWRT:/tmp# sysupgrade -v http://downloads.openwrt.org/snapshots/trunk/ar71xx/openwrt-ar71xx-generic-wrt160nl-squashfs-sysupgrade.bin
Saving config files...
etc/sysctl.conf
etc/shells
etc/rc.local
etc/profile
etc/passwd
etc/inittab
etc/hosts
etc/group
etc/firewall.user
etc/dropbear/dropbear_rsa_host_key
etc/dropbear/dropbear_dss_host_key
etc/config/wireless
etc/config/timeserver
etc/config/system
etc/config/network
etc/config/firewall
etc/config/dropbear
etc/config/dhcp
Switching to ramdisk...
Performing system upgrade...
Unlocking firmware ...

Writing from <stdin> to firmware ...     
Appending jffs2 data from /tmp/sysupgrade.tgz to firmware...TRX header not found
Error fixing up TRX header
    
Upgrade completed
Rebooting system...

Post #14

beppealf

7 Nov 2011, 23:38

I just bricked my 160nl going through a sysupgrade.

I repeatedly tried to unbrick via tftp and using the serial console. It accepts the code.bin file, erases flash, rewrites it, but afterwards always reports

Bytes transferred = 2771818 (2a4b6a hex)                                            
load addr= 0x80060000                                                               
boot file= CODE.BIN                                                                 
NetBootFileXferSize= 002a4b6a                                                       
Erase linux kernel block !!                                                         
From bf040000 To bf7dffff                                                           
Erase Flash from 0xbf040000 to 0xbf7dffff in Bank # 1                               
First 0x4 last 0x7d sector size 0x10000                                             
 125                                                                                
Erased 122 sectors                                                                  
Programming.........                                                                
Copy to Flash... write addr: bf040000                                               
done                                                                                
## Booting WRT160NL ...                                                             
Application code length 0x002a0000                                                  
Bad CRC: trx.crc32 0x58c0b426 calculate 0xdd4f53d2

I tried several firmwares including the Linksys original stock one without success.

My U-boot is 1.1.6.

May I ask you how you manged to succesfully debrick it every time?

Thx

Post #15

v.90

8 Nov 2011, 14:22

Just out curiosity have you named the file code.bin before you push it?

Here's what my last output looked like:

ar7100> upgrade code.bin
check link duplex:Full/speed:100
dup 1 speed 100
Tftpd start listening on port[69]!
Load address: 0x80060000
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Receiving firmware [code.bin] from [192.168.1.88]
Write File : CODE.BIN
#
Current Code Pattern:NL1X , Upgrade Code Pattern:NL1X
Code Pattern is correct!
################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#########################################
done
Bytes transferred = 3867648 (3b0400 hex)
load addr= 0x80060000
boot file= CODE.BIN
NetBootFileXferSize= 003b0400
Erase linux kernel block !!
From bf040000 To bf7dffff
Erase Flash from 0xbf040000 to 0xbf7dffff in Bank # 1
First 0x4 last 0x7d sector size 0x10000
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125
Erased 122 sectors
Programming.........
Copy to Flash... write addr: bf040000
done
ar7100> go
## Booting WRT160NL ...
Code pattern OK: NL1X Expect: NL1X
Application code length 0x003b0000
CRC OK
## Booting image at bf04003c ...