Welcome! Log In Create A New Profile

Advanced

Linksys WRT1900ACS v2 MVEBU - looking for kwboot

Posted by slushendale 
Forum List Message List New Topic
slushendale
Linksys WRT1900ACS v2 MVEBU - looking for kwboot
June 17, 2024 03:45AM
Hello Community,
i come from OpenWrt's Wiki Site for the 1900ACS v2 "debricking bootloader"
Quote

https://openwrt.org/toh/linksys/wrt_ac_series#corrupt_bootloader_recovery
but these kwboot links are offline.

I searched a way to "unbrick" my bootloader because i think he is broken. Its a too long story to describe it here.
I only get once to the marvel> prompt and this without input from me and no bootscreen before this, thats strange.

Than i tried to flash both bootpartitions with the original Firmware, i set before all enviroments with setenv for example "setenv serverip" but ping failed to the tftp server with the firmware image and whats strange the bootloader dont knew the command to flash but every how-to i found said it was that command. i think it was "run flash_both_images" but really not sure. At least i did a fw_setenv bootpart 2 and could suddenly boot to the "half broken firmware with bugs" but i couldnt flash any routerfirmware. Somehow i get to the nonbootable partition again no serial connection or with that kwboot (Debian 12) method (which dont have the -e option).

i did a printenv as i could boot into the one bootable partition i think :
Quote

bootcmd=bootp; setenv bootargs root=/dev/nfs nfsroot=${serverip}:${rootpath} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off; bootm
bootdelay=5
baudrate=115200
boot_part=2

for example when i do a printenv on an Linksys 1200AC v2 (even mvebu):
Quote

~# fw_printenv
CASset=max
MALLOC_len=5
MPmode=SMP
SMT-2D=NGVIG330161EX01
altFwSize=0x2800000
altKernAddr=0x3200000
altKernSize=0x0600000
altnandboot=setenv bootargs console=ttyS0,115200 root=/dev/mtdblock7 ro rootdelay=1 rootfstype=jffs2 earlyprintk $mtdparts;nand read $defaultLoadAddr $altKernAddr $altKernSize; bootm $defaultLoadAddr
auto_recovery=yes
autoload=no
baudrate=115200
boot_order=hd_scr usb_scr mmc_scr hd_img usb_img mmc_img pxe net_img net_scr
bootargs_dflt=$console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel
bootargs_end=:10.4.50.254:255.255.255.0:Armada38x:eth0:none
bootargs_root=root=/dev/nfs rw
bootcmd="run altnandboot"
bootcmd_auto=stage_boot $boot_order
bootcmd_fdt=tftpboot 0x2000000 $image_name;tftpboot $fdtaddr $fdtfile;setenv bootargs $console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel; bootz 0x2000000 - $fdtaddr;
bootcmd_fdt_boot=tftpboot 0x2000000 $image_name; setenv bootargs $console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel; bootz 0x2000000 - $fdtaddr;
bootcmd_fdt_edit=tftpboot $fdtaddr $fdtfile; fdt addr $fdtaddr; setenv bootcmd $bootcmd_fdt_boot
bootcmd_lgcy=tftpboot 0x2000000 $image_name; setenv bootargs $bootargs_dflt; bootm 0x2000000;
bootdelay=3
cacheShare=no
console=console=ttyS0,115200
defaultLoadAddr=0x2000000
device_partition=0:1
disaMvPnp=no
eeeEnable=no
enaClockGating=no
enaCpuStream=no
enaFPU=yes
enaMonExt=no
enaWrAllo=no
eth1addr=00:50:43:13:8d:95
eth1mtu=1500
eth2addr=00:50:43:13:41:95
eth2mtu=1500
eth3addr=00:50:43:8d:41:13
eth3mtu=1500
ethact=egiga0
ethaddr=60:38:E0:0E:66:33
ethmtu=1500
ethprime=egiga0
fdt_addr=2040000
fdt_skip_update=no
fdtaddr=0x1000000
fdtfile=armada-38x-modular.dtb
fileaddr=1000000
filesize=1EC0000
firmwareName=caiman.img
flash_alt_image=tftpboot $defaultLoadAddr $firmwareName && nand erase $altKernAddr $altFwSize && nand write $defaultLoadAddr $altKernAddr $filesize
flash_pri_image=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAddr $priFwSize && nand write $defaultLoadAddr $priKernAddr $filesize
ide_path=/
image_name=uImage
initrd_name=uInitrd
ipaddr=192.168.1.1
kernel_addr_r=2080000
lcd0_enable=0
lcd0_params=640x480-16@60
lcd_panel=0
loadaddr=0x02000000
loads_echo=0
mtddevname=uboot
mtddevnum=0
mtdids=nand0=armada-nand
mtdparts=mtdparts=armada-nand:2048K(uboot)ro,256K(u_env),256K(s_env),1m@9m(devinfo),40m@10m(kernel),34m@16m(rootfs),40m@50m(alt_kernel),34m@56m(alt_rootfs),80m@10m(ubifs),-@90m(syscfg)
mvNetConfig=mv_net_config=4,(00:50:43:11:11:11,0:1:2:3),mtu=1500
mv_pon_addr=00:50:43:95:41:13
nandEcc=nfcConfig=4bitecc
nandboot=setenv bootargs console=ttyS0,115200 root=/dev/mtdblock5 ro rootdelay=1 rootfstype=jffs2 earlyprintk $mtdparts;nand read $defaultLoadAddr $priKernAddr $priKernSize; bootm $defaultLoadAddr
netbsd_en=no
netmask=255.255.255.0
netretry=no
partition=nand0,0
pcieTune=no
pexMode=RC
priFwSize=0x2800000
priKernAddr=0x0a00000
priKernSize=0x0600000
pxe_files_load=:default.arm-armadaxp-db:default.arm-armadaxp:default.arm
pxefile_addr_r=3100000
ramdisk_addr_r=2880000
rootpath=/srv/nfs/
sata_delay_reset=0
sata_dma_mode=yes
script_addr_r=3000000
script_name=boot.scr
serverip=192.168.0.103
standalone=fsload 0x2000000 $image_name;setenv bootargs $console $nandEcc $mtdparts root=/dev/mtdblock0 rw ip=$ipaddr:$serverip$bootargs_end; bootm 0x2000000;
stderr=serial
stdin=serial
stdout=serial
update_both_images=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAddr $priFwSize && nand erase $altKernAddr $altFwSize && nand write $defaultLoadAddr $priKernAddr $filesize && nand write $defaultLoadAddr $altKernAddr $filesize
usb0Mode=host
usbActive=0
usbType=2
vxworks_en=no
yuk_ethaddr=00:00:00:EE:51:81
boot_part_ready=3
boot_part=1

there is a lot missing so something most be wrong !?

Sorry for my english.

Have you an idea how to fix this ? I would use that project too its looking really interesting. I already had MCDebian installed but it was too old.

thanks for any answers.....
Reply Quote
bodhi
Re: Linksys WRT1900ACS v2 MVEBU - looking for kwboot
June 17, 2024 02:00PM
slushendale,

The latest kwboot binary is here:

https://forum.doozan.com/read.php?3,27280

You need to find stock u-boot for this WRT1900ACS v2 box. And run kwboot with it to unbrick.

What is the booting behavior now? when you connect serial console, and power up, do you see any output?

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
slushendale
Re: Linksys WRT1900ACS v2 MVEBU - looking for kwboot
June 17, 2024 03:36PM
When i boot with serial insert i dont see anything with "screen 115200 /dev/ttyUSB0" or with putty with all settings set like stopbit and so on: no output. Sometimes the sata led is lightning together with the blinking power, lan ports are always on when have a plugged cable. My UART Stick has the chip CH340 i dont have a plan from all that.

On the OpenWrt Wiki site there is a link with a .bin file what you schould boot with the -p option.
i looked into help menu but there stands no -e option but the description i read somewhere sounded very important.

i will try your Download (thank you).
Reply Quote
slushendale
Re: Linksys WRT1900ACS v2 MVEBU - looking for kwboot
June 19, 2024 04:43AM
I try to repair my U-Boot via this file on this how-to site 1900ACS:

https://openwrt.org/toh/linksys/wrt_ac_series#prerequisites

From that Downloadlink you gave me it was hard to find kwboot but i fjnally found an archive with three files from 2024.
Because there stands ARM i used my Linksys WRT1200AC v2 to try to recover the bootloader from the bricked 1900ACS.
Only the one with static in his name was executable on my Router.

The -p option is missing too in this Version.....
First attempts with that command from the link above with addedd -B option:

"chmod 666 /dev/ttyUSB0
Boot router using UART image and power on router:
./kwboot -t /dev/ttyUSB0 -b *WRT1900*.bin -B 115200 "

kwboot discovers something in the image and than there stands i should reboot device.
Tried the timing around fifteen times nothing happend.

Than i tried a few options to swap -b *.bin > -D *.bin and he began to flash but than after ~10 seconds he
errors with xmodem protocol error.

I think its something with the cables or stick with ch340 chip. But iam so unexperienced in that so i dont know nearly what it could be. I tried to short tx rx and i got output on screen than tried to switch tx wiith rx and rx with tx but nothing.
The 3,3 Volt or 5V i never used of course.

Would be very thankfull when someone have a tipp for me. Should i buy another stick with cables ?
Reply Quote
slushendale
Re: Linksys WRT1900ACS v2 MVEBU - looking for kwboot
June 19, 2024 10:22AM
kwboot identifies the image as kwbboot v1 file and want to write it to NAND.
But nothing happens ....
Reply Quote
bodhi
Re: Linksys WRT1900ACS v2 MVEBU - looking for kwboot
June 19, 2024 02:07PM
slushendale,

> From that Downloadlink you gave me it was hard to
> find kwboot but i fjnally found an archive with
> three files from 2024.

They are attached to the post.

> The -p option is missing too in this Version.....

-p option is deprecated, and will do nothing if you use it.

> Than i tried a few options to swap -b *.bin > -D
> *.bin and he began to flash but than after ~10
> seconds he
> errors with xmodem protocol error.

That's not too bad. It means the handshake was successful. But some other reason has caused the handshake to go bad.

Don't worry about the timing. The new kwboot code is very robust when running with Armada 38x SoC targets.

> Would be very thankfull when someone have a tipp
> for me. Should i buy another stick with cables ?

Probably. But before doing that, try:

- Make sure the 3 wires GND, TX, and RX are away from the power cord.

- Run kwboot, when you see xmodem protocol errror, type up-arrow to recall the kwboot command and execute it again. Do this as many times as you can, perhaps up to 20 times.

======

Here is the thread where we discussed serial console converters and what to use:

https://forum.doozan.com/read.php?8,13263

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
slushendale
Re: Linksys WRT1900ACS v2 MVEBU - looking for kwboot
July 03, 2024 06:46AM
I think the router is unrecoverable. I tried many times with different cables absolutely no output to terminal.
The only difference is when i start kwboot together with the router the esata lights constantly and the power too. When just starting the router the power blinks .....

i think that was it right no options anymore !?
Reply Quote
bodhi
Re: Linksys WRT1900ACS v2 MVEBU - looking for kwboot
July 03, 2024 01:48PM
slushendale,

As I mentioned,

Quote

> Than i tried a few options to swap -b *.bin > -D
> *.bin and he began to flash but than after ~10
> seconds he
> errors with xmodem protocol error.

That's not too bad. It means the handshake was successful. But some other reason has caused the handshake to go bad.

Please post the log of this (the kwboot command and any output on the serial terminal).

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)
Reply Quote
Newer Topic Older Topic
Author:

Your Email:


Subject:
Spam prevention:
Please, enter the code that you see below in the input field. This is for blocking bots that try to post this form automatically. If the code is hard to read, then just try to guess it right. If you enter the wrong code, a new image is created and you get another chance to enter it right.
Message: