OpenWrt Forum Archive

Topic: sysupgrade bug on WRT160NL

The content of this topic has been archived on 23 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Dear all,

I tried reflashing the WRT160NL router with sysupgrade. 

It works when config files is not saved over flashing.

It always bricks the router if I choose to save config files.   

I also tried flashing from LuCI and selected "save config files", and router got bricked.

I accessed the serial console, the bootloader complains about bad CRC

U-Boot 1.1.6 (May 12 2009 - 07:52:28)                                           
                                                                               
DRAM:  ar7100_ddr_initial_config(237) enter!                                   
ar7100_ddr_initial_config(269) exit!                                           
                                                                               
                                                                               
U-Boot 1.1.6 (May 12 2009 - 07:52:28)                                           
                                                                               
AP81 (ar7100) U-boot                                                           
sri                                                                             
32 MB                                                                           
WRT160NL u-boot version: 1.0.0                                                 
Top of RAM usable for U-Boot at: 82000000                                       
Reserving 279k for U-Boot at: 81fb8000                                         
Reserving 192k for malloc() at: 81f88000                                       
Reserving 44 Bytes for Board Info at: 81f87fd4                                 
Reserving 36 Bytes for Global Data at: 81f87fb0                                 
Reserving 128k for boot params() at: 81f67fb0                                   
Stack Pointer at: 81f67f98                                                     
Now running in RAM - U-Boot at: 81fb8000                                       
id read 0x100000ff                                                             
flash size 8MB, sector count = 128                                             
Flash:  8 MB                                                                   
*** Warning - bad CRC, using default environment                               
                                                                               
In:    serial                                                                   
Out:   serial                                                                   
Err:   serial                                                                   
Net:   ag7100_enet_initialize...                                               
ag7100 get ethaddr for device eth0                                             
Fetching MAC Address from 0x81feb1e0                                           
                                                                               
--------***** Get the RTL8306SD Manufactory ID=379c *****-------               
Reg6: speed=0 nway=1 duplex=0                                                 
Reg5: speed=0 nway=0 duplex=0                                                 
Reg1: a1=7fd9 a2=30e0 a3=15ac a4=30e0 a5=0                                     
Reg1: a1=7fd9 a2=30e0 a3=15ac a4=30e0                                         
Reg1: a1=7fd9 a2=30e0 a3=15ac a4=30e0                                         
Reg1: a1=7fd9 a2=30e0 a3=15ac a4=30e0                                         
Reg1: a1=7fd9 a2=30e0 a3=15ac a4=30e0                                         
eth0: 00:25:9c:d8:e9:41                                                         
eth0 up                                                                         
eth0                                                                           
### main_loop entered: bootdelay=1                                             
                                                                               
Hit any key to stop autoboot:  0                                               
## Booting WRT160NL ...                                                         
Application code length 0x00310000                                             
Bad CRC: trx.crc32 0x9d594875 calculate 0x499b6ce2                             
check link duplex:Full/speed:100                                               
dup 1 speed 100                                                                 
Tftpd start listening on port[69]!

Does sysupgrade support WRT160NL model? Is there any work around to flash this router with config files saved?

Thanks tons in advance!

(Last edited by jintao on 3 Nov 2010, 17:50)

Hi,

did you solved this problem? I've got a same one sad I've just debricked my wrt160nl via U-Boot

I would not be concerned about that CRC warning. This warning is shown on mine every boot (even with wiped config):

U-Boot 1.1.5 (Apr  6 2009 - 13:54:11)                                                                                                     
                                                                                                                                          
DRAM:  ar7100_ddr_initial_config(237) enter!                                                                                              
ar7100_ddr_initial_config(269) exit!                                                                                                      
                                                                                                                                          
                                                                                                                                          
U-Boot 1.1.5 (Apr  6 2009 - 13:54:11)                                                                                                     
                                                                                                                                          
AP81 (ar7100) U-boot                                                                                                                      
sri                                                                                                                                       
32 MB                                                                                                                                     
WRT160NL u-boot version: 1.0.0                                                                                                            
Top of RAM usable for U-Boot at: 82000000                                                                                                 
Reserving 277k for U-Boot at: 81fb8000                                                                                                    
Reserving 192k for malloc() at: 81f88000                                                                                                  
Reserving 44 Bytes for Board Info at: 81f87fd4                                                                                            
Reserving 36 Bytes for Global Data at: 81f87fb0                                                                                           
Reserving 128k for boot params() at: 81f67fb0                                                                                             
Stack Pointer at: 81f67f98                                                                                                                
Now running in RAM - U-Boot at: 81fb8000                                                                                                  
id read 0x100000ff                                                                                                                        
flash size 8MB, sector count = 128                                                                                                        
Flash:  8 MB                                                                                                                              
*** Warning - bad CRC, using default environment                                                                                          
                                                                                                                                          
In:    serial                                                                                                                             
Out:   serial                                                                                                                             
Err:   serial                                                                                                                             
Net:   ag7100_enet_initialize...                                                                                                          
ag7100 get ethaddr for device eth0                                                                                                        
Fetching MAC Address from 0x81feaf20                                                                                                      
                                                                                                                                          
 --------***** Get the RTL8306SD Manufactory ID=34dc *****-------                                                                         
 Reg6: speed=0 nway=1 duplex=1                                                                                                            
 Reg5: speed=0 nway=0 duplex=0                                                                                                            
 Reg1: a1=7fd9 a2=2890 a3=115c a4=2890 a5=0                                                                                               
 Reg1: a1=7fd9 a2=2890 a3=115c a4=2890                                                                                                    
 Reg1: a1=7fd9 a2=2890 a3=115c a4=2890                                                                                                    
 Reg1: a1=7fd9 a2=2890 a3=115c a4=2890                                                                                                    
 Reg1: a1=7fd9 a2=2890 a3=115c a4=2890

I've noticed that corruption happens immediately after sysupgrade tries to restore config files but there are some warnings about mounting overlay first. I'll post sysupgrade output later.

I think we should look for problem somewhere around /lib/upgrade/common.sh:137

jffs2_copy_config() {
    if grep rootfs_data /proc/mtd >/dev/null; then
        # squashfs+jffs2
        mtd -e rootfs_data jffs2write "$CONF_TAR" rootfs_data
    else
        # jffs2
        mtd jffs2write "$CONF_TAR" rootfs
    fi
}

Well this is wierd. I'm running now my "restore" build based on Backfire (10.03, r20728). It seems not to suffer by this problem!

etc/dropbear/dropbear_dss_host_key
etc/group
etc/passwd
etc/config/wireless
etc/config/uhttpd
etc/config/system
etc/config/ucitrack
etc/config/network
etc/config/dropbear
etc/config/firewall
etc/config/luci
etc/config/dhcp
Switching to ramdisk...
mount: mounting mini_fo:/overlay on /mnt failed: Function not implemented
Performing system upgrade...
Unlocking firmware ...
Writing from <stdin> to firmware ...  [w]
Appending jffs2 data from /tmp/sysupgrade.tgz to firmware...
Upgrade completed
Rebooting system...
Terminated

"error" is there, but system did not get bricked, everything worked. Thus I assume bug appeared very recently

I've tracked problem down to commit 22881 in /package/mtd/src
When I reverted this commit, I was able successfully sysupgrade with keeping my config without bricking my WRT160NL

Can you confirm this works?

Hi nextsux,

I will try this tonight.  Will get back to you with how it goes for me.  Thanks in advance!

jt

nextsux wrote:

I've tracked problem down to commit 22881 in /package/mtd/src
When I reverted this commit, I was able successfully sysupgrade with keeping my config without bricking my WRT160NL

Can you confirm this works?

Hi,

Sorry for the late response. Just got chance to try this out.  Unfortunately it doesn't work for me.  I reverted package/mtd to several old revisions, none of them works. still bricked the router each time.

will keep looking for the solution

Look for this. During a boot, see where your MTD partitions are at. do a sysupgrade without config files. Now look where your MTD partitions are at. Did rootfs_data move? If so, the problem is that sysupgrade rewrites the configs into the old rootfs_data partition before rebooting, which may be overwriting your squashfs if the new image is larger!!

edit: you look at "dmesg" output for something like this

Creating 3 MTD partitions on "adm8668-nor":
0x000000040000-0x000000800000 : "linux"
0x000000120000-0x000000800000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
mtd: partition "rootfs_data" created automatically, ofs=270000, len=590000 
0x000000270000-0x000000800000 : "rootfs_data"
0x000000020000-0x000000040000 : "uboot_env"

(Last edited by neutronscott on 19 Jan 2011, 03:10)

I have new wrt160nl in here now and I have same problem as you are. Only difference between model I used to use earlier and now are versions of U-boot. Older one have 1.1.5, new have 1.1.6. Maybe this is our problem.

Hi again,

try this UGLY patch

Index: package/base-files/files/lib/upgrade/common.sh
===================================================================
--- package/base-files/files/lib/upgrade/common.sh    (revision 23944)
+++ package/base-files/files/lib/upgrade/common.sh    (working copy)
@@ -174,6 +174,10 @@
             jffs2_copy_config
         fi
     }
+
+    echo "fixing TRX"
+    mtd fixtrx -o 32 firmware
+
     v "Upgrade completed"
     [ -n "$DELAY" ] && sleep "$DELAY"
     ask_bool 1 "Reboot" && {

it worked for me. It seems like appending jffs2 data corrupts TRX CRC32.

nextsux wrote:

Hi again,

try this UGLY patch

Index: package/base-files/files/lib/upgrade/common.sh
===================================================================
--- package/base-files/files/lib/upgrade/common.sh    (revision 23944)
+++ package/base-files/files/lib/upgrade/common.sh    (working copy)
@@ -174,6 +174,10 @@
             jffs2_copy_config
         fi
     }
+
+    echo "fixing TRX"
+    mtd fixtrx -o 32 firmware
+
     v "Upgrade completed"
     [ -n "$DELAY" ] && sleep "$DELAY"
     ask_bool 1 "Reboot" && {

it worked for me. It seems like appending jffs2 data corrupts TRX CRC32.

This worked for me as well, but not until the code was in the image on the router.  Manually adding the lines to common.sh file before running sysupgrade does not seem to work.  (in both cases the code was in the new image). 

Can someone confirm that this makes sense?

Also, has anyone posted this as a bug yet?

I think that better way is to fix mtd utility. I've tried that but I'm not strong at C, so it did not worked.
No I have not posted this as bug yet.

nextsux wrote:

I think that better way is to fix mtd utility. I've tried that but I'm not strong at C, so it did not worked.
No I have not posted this as bug yet.

I don't doubt you're right... 

Update on my question above, some more testing has me convinced that you can, in fact, change the script in the running config and the sysupgrade successfully.  I rebooted after changing the file this time.  Not sure why that would matter, but it works consistently

Posted the issue as a bug: https://dev.openwrt.org/ticket/8960 so someone who knows mtd can take a look

Seems the ticket has not yet been processed. Just tried the latest snapshop r26806. After sysupgrade the WRT160NL has to be reflashed using tftp.

root@openWRT:/tmp# sysupgrade -v http://downloads.openwrt.org/snapshots/trunk/ar71xx/openwrt-ar71xx-generic-wrt160nl-squashfs-sysupgrade.bin
Saving config files...
etc/sysctl.conf
etc/shells
etc/rc.local
etc/profile
etc/passwd
etc/inittab
etc/hosts
etc/group
etc/firewall.user
etc/dropbear/dropbear_rsa_host_key
etc/dropbear/dropbear_dss_host_key
etc/config/wireless
etc/config/timeserver
etc/config/system
etc/config/network
etc/config/firewall
etc/config/dropbear
etc/config/dhcp
Switching to ramdisk...
Performing system upgrade...
Unlocking firmware ...

Writing from <stdin> to firmware ...     
Appending jffs2 data from /tmp/sysupgrade.tgz to firmware...TRX header not found
Error fixing up TRX header
    
Upgrade completed
Rebooting system...

I just bricked my 160nl going through a sysupgrade.

I repeatedly tried to unbrick via tftp and using the serial console. It accepts the code.bin file, erases flash, rewrites it, but afterwards always reports

Bytes transferred = 2771818 (2a4b6a hex)                                            
load addr= 0x80060000                                                               
boot file= CODE.BIN                                                                 
NetBootFileXferSize= 002a4b6a                                                       
Erase linux kernel block !!                                                         
From bf040000 To bf7dffff                                                           
Erase Flash from 0xbf040000 to 0xbf7dffff in Bank # 1                               
First 0x4 last 0x7d sector size 0x10000                                             
 125                                                                                
Erased 122 sectors                                                                  
Programming.........                                                                
Copy to Flash... write addr: bf040000                                               
done                                                                                
## Booting WRT160NL ...                                                             
Application code length 0x002a0000                                                  
Bad CRC: trx.crc32 0x58c0b426 calculate 0xdd4f53d2

I tried several firmwares including the Linksys original stock one without success.

My U-boot is 1.1.6.

May I ask you how you manged to succesfully debrick it every time?

Thx

Just out curiosity have you named the file code.bin before you push it?

Here's what my last output looked like:

ar7100> upgrade code.bin

check link duplex:Full/speed:100
dup 1 speed 100
Tftpd start listening on port[69]!
Load address: 0x80060000
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Receiving firmware [code.bin] from [192.168.1.88]
Write File : CODE.BIN
#

Current Code Pattern:NL1X , Upgrade Code Pattern:NL1X

Code Pattern is correct!
################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#########################################
done
Bytes transferred = 3867648 (3b0400 hex)
load addr= 0x80060000
boot file= CODE.BIN
NetBootFileXferSize= 003b0400
Erase linux kernel block !!
From bf040000 To bf7dffff
Erase Flash from 0xbf040000 to 0xbf7dffff in Bank # 1
First 0x4 last 0x7d sector size 0x10000
   4   5   6   7   8   9  10  11  12  13  14  15  16  17  18  19  20  21  22  23  24  25  26  27  28  29  30  31  32  33  34  35  36  37  38  39  40  41  42  43  44  45  46  47  48  49  50  51  52  53  54  55  56  57  58  59  60  61  62  63  64  65  66  67  68  69  70  71  72  73  74  75  76  77  78  79  80  81  82  83  84  85  86  87  88  89  90  91  92  93  94  95  96  97  98  99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125
Erased 122 sectors
Programming.........
Copy to Flash... write addr: bf040000
done
ar7100> go

## Booting WRT160NL ...
Code pattern OK: NL1X  Expect: NL1X
Application code length 0x003b0000
CRC OK
## Booting image at bf04003c ...

The discussion might have continued from here.