Convert Actility Kerlink gateway to TTN

If you happen to have a Kerlink gateway that is configured for Actility, you would realise that it is completely locked down, and you can not reconfigure it for a different network. After some debugging and a lot of assitance from @kersing we were able to resurrect the “bricked” Kerlink of mine and get it back up on TTN.

You will need:

Connect to the gateway using the debug interface. You should have a terminal open and see the log output and login prompt for the gateway.

Confirming that you can send commands to the gateway over the debug interface and receive responses back, like try to log in and see it fail because we do not know the root password. Now, while still looking at the terminal output press the reset button on the gateway. You should see the following output:

WirmaV2 kickstart svn1607 (Dec  3 2014 - 14:04:05)
CPU 266MHz
NAND: Micron On-Die ECC

U-Boot 2009.03-2009.03-klk1 (Dec 27 2016 - 16:23:47)

DRAM:  128 MB
NAND:  MICRON      MT29F1G08ABBDAH4   
NAND:  On-Die ECC
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
MAC:   02:4B:08:0E:xx:xx
Product: WirmaV2 lora V4
WARNING: Machine type unknown, set default wirmaV2 Module
Autoboot in 10 seconds, enter Password:

As soon as you see Autoboot in 10 seconds, enter Password: start hitting the k key on your keyboard. After about 8 times you will be dropped to the U-Boot command prompt.

Now as quickly as possible type watchdog disable and hit enter. If you wait too long the gateway will reset and you will have to do the k-hitting thing again. You should see a message that the watchdog was successfully disabled.

Make sure the USB Flash drive with the firmware update on it is plugged in. Then execute the following commands in the U-Boot command prompt:
setenv produsb 1
saveenv
reset

After execting the reset command the gateway should restart. This time when Linux boots up it will show a message that it is in Produsb update mode. In this mode it looks for update files on the USB flash drive and installs them. Because we have a firmware update on the flash drive, the firmware upgrade will be installed, overriding all the Actility software.

After one more reboot the terminal will show a login prompt for the gateway. If the reflash of firmware was successful you should be able to log in using the default Kerlink login details for the v3 firmware:
Username: root
Password: pdmk-08… (On v3.3 the letter after 08 should be lower case. Newer version need it to be upper case.)

If you are still unable to log in it means the Actility password change script was executed, and therefore not overridden during our firmware upgrade. Try following the same method to flash the recovery partition (https://www.thethingsnetwork.org/docs/gateways/kerlink/firmware-updates.html#recovery).

If you are able to log in successfully we can continue setting up the packet forwarder for TTN. At this point you can continue installing the TTN packet forwarder (https://www.thethingsnetwork.org/docs/gateways/kerlink/config.html) or you can install and use the default Kerlink packet forwarder.

To install the Kerlink Simple Packet Forwarder (SPF) you will need to follow the steps outlined on the Kerlink Wiki (http://wikikerlink.fr/lora-station/doku.php?id=wiki:lora_modem_management). In essence it boils down to installing the Semtech HAL using a Dota file, then installing the SPF. After these two are installed you will need to make sure the correct global_conf.json file is used by checking where the symlink /mnt/fsuser-1/spf/etc/global_conf.json points to. By default it points to /mnt/fsuser-1/spf/etc/global_conf_EU868.json. Change the symlink to the correct frequency plan for your area. You might need to check the radio frequencies and channel IF values, but for the EU region the defaults are correct. All you need to do is edit the global_conf.json file and change the server address from lns to router.eu.thethings.network or the router for you region. Also make sure the up and down ports are 1700. After this restart the gateway and it should forward packets to TTN.

4 Likes

Hi,
what would be the case if autoboot in 1 second is shown and I am unable to enter 8 times the letter k in one second ?

(my gateway appears to have been flashed with “different firmware” by our system integrator and I try to USB flash it but I get no other leds after pressing 1 minute on the test button nor does anything indicate that the USB flash process is started. No log file on the USB, no signs of update process in the Putty serial terminal.

Thanks,
Ben

The url to the recovery partition does give a 404 error and I cannot locate it with the search function by the way.

You just need to press repeatedly the key k on your keyboard. One press in one second is enough.

Hi Guys,

I seem to have bricked a Kerlink in an attempt to upgrade the firmware, and this thread seems to have some knowledgable authors.

The Kerlink had a factory default firmware: 2.x.
After plugging in the USB stick the firmware, the process started by looking at the blinking leds. After some time the blinking stopped, and that was where it got bricked.

After some digging around I found this threat and with a serial interface connected to the Kerlink I am able to get into the Uboot command structure.
Below output is keeping repeated:

Autoboot in 5 seconds, enter Password:

NAND read: device 0 offset 0xc0000, size 0x20000
 131072 bytes read: OK
## Executing script at 82000000
 === Script begin ===
Saving Environment to NAND...
Erasing Nand...
Erasing at 0x80000 -- 100% complete.
Writing to Nand... done
 ==============================
 ===   !!!! WARNING !!!!    ===
 === Rescue Mode Programmed ===
 ==============================
 === An image is corrupted, use rescue images ===

NAND read: device 0 offset 0x420000, size 0x2a0000
 2752512 bytes read: OK

NAND read: device 0 offset 0x9e0000, size 0x260000
 2490368 bytes read: OK
## Booting kernel from Legacy Image at 80010000 ...
   Image Name:   Linux-3.10.104-3.10.104-klk6
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1940241 Bytes =  1.9 MB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... Bad Data CRC
ERROR: can't get kernel image!
 === Board will reboot ===

WirmaV2 kickstart svn1607 (Dec  3 2014 - 14:04:05)
CPU 266MHz
NAND: Micron On-Die ECC


U-Boot 2009.03-2009.03-klk1 (Dec 27 2016 - 16:23:47)

DRAM:  128 MB
NAND:  MICRON      MT29F1G08ABBDAH4
NAND:  On-Die ECC
NAND:  128 MiB
In:    serial
Out:   serial
Err:   serial
MAC:   02:X:Y:Z
Product: WirmaV2 lora V4
WARNING: Machine type unknown, set default wirmaV2 Module
Autoboot in 5 seconds, enter Password:

After looking around in Uboot, and fiddling some, I am a bit stuck.

What does work, is a TFTP boot from the ‘uImage’ file (which is in the usbflashdrive_wirmav2_wirnet_v3 package).
However, after the TFTP boot loading, I start this image with ‘boots’ , the kernel starts loading, but hangs/panics with the following lines:

KLK-Uboot> bootm
## Booting kernel from Legacy Image at 80010000 ...
   Image Name:   Linux-3.10.104-3.10.104-klk7
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1939881 Bytes =  1.9 MB
   Load Address: 80008000
   Entry Point:  80008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
�[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 3.10.104-3.10.104-klk7 (drd@drdgen) (gcc version 4.9.3 (Buildroot 2016.05v1.13) ) #1 PREEMPT Mon Feb 25 17:52:44 CET 2019
[    0.000000] CPU: ARM926EJ-S [41069264] revision 4 (ARMv5TEJ), cr=00053177
[    0.000000] CPU: VIVT data cache, VIVT instruction cache
[    0.000000] Machine: LPC32XX SoC (Flattened Device Tree), model: Kerlink WirmaV2 based on NXP LPC3250
[    0.000000] Memory policy: ECC disabled, Data cache writeback
[    0.000000] DT missing boot CPU MPIDR[23:0], fall back to default cpu_logical_map
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 31616
[    0.000000] Kernel command line: console=ttyS0,115200n81 ethaddr=02:X.Y.Z mtdparts=lpc32xx_nand:256k(Bootstrap),256k(Bootloader),256k(U-Boot_Env),12m(Kernel-initramfs),12m(RescueFS),36m(rootfs),-(userFS) ip=192.168.60.81 micondie=1
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
..
..
..
[    2.290000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

Now what I guess needs to happen, is that I need to have the image/ramdisk files from the USB stick, to be programmed onto the NAND filesystem in the Kerlink. However, I am not sure what is the correct procedure here.

Maybe @kersin could help a bit out here?

Many thanks in advance,

Ron

@kersing

You might well have a gateway where the flash is beyond repair. Sorry but can’t help you. I suggest you contact support and ask them how to proceed from here.

Kerlink Support would be your best bet here. I agree with Kersing that the flash seems to be either broken, or corrupt. I remember that Kerlink changed the filesystem they used for the flash between firmware v2 and v3. Maybe it is worth trying to flash a v2 image and see if that can detect the filesystem.

Hi Guys,

Thanks for the feedback.

I have tried to to understand how the uBoot works, and how I could program the nand/flash with the file I loaded in ram from TFTPboot. I guess there is the uImage (kernel) and initramfs.cpio.gz.uboot (filesystem) to be taken care of.

There are some examples on the internet which look quite similar, but I am not entirely sure about the hex addresses used.

One the best website I found solar :

Any help on how to flash with uBoot are more hen welcome!

Ron

Hi Guys,

After some time and fiddling with the settings in the boot (with tips from the Kerlink Wiki site), I did get the Kerlink to boot on a version 3.1:

FILESYSTEM_VER=2016.05v1.5

However, there is 1 error in the log/dmesg which worries me. It seems there is an issue with the USB port, however this might also be caused by the half-succeeded upgrade:

[    2.080000] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001
[    2.080000] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    2.090000] usb usb1: Product: nxp OHCI
[    2.090000] usb usb1: Manufacturer: Linux 3.10.104-3.10.104-klk6 ohci_hcd
[    2.100000] usb usb1: SerialNumber: 31020000.ohci
[    2.110000] hub 1-0:1.0: USB hub found
[    2.110000] hub 1-0:1.0: 2 ports detected

[    3.930000] hub 1-0:1.0: Cannot enable port 1.  Maybe the USB cable is bad?
[    5.130000] hub 1-0:1.0: Cannot enable port 1.  Maybe the USB cable is bad?
[    6.330000] hub 1-0:1.0: Cannot enable port 1.  Maybe the USB cable is bad?
[    7.530000] hub 1-0:1.0: Cannot enable port 1.  Maybe the USB cable is bad?
[    7.530000] hub 1-0:1.0: unable to enumerate USB device on port 1

Due to this, I cannot upgrade with USB to correct things.

I did read something about possibilities to upgrade the firmware over the network, I will have to take a look at that…

On the filesystem, there is nothing in /mnt/f-user-1:

[root@Wirgrid ~]# ls -al /mnt/fsuser-1/
drwxr-xr-x    3 root     root           224 May 22 04:13 .
drwxrwxrwt    3 root     root            60 May 26 16:09 ..
drwxr-xr-x    3 root     root           232 May 22 04:13 jvm

Best regards,

Ron

2 Likes

You could download a firmware upgrade DOTA from the wiki and place it in /mnt/fsuser-1/dota (create the folder) and reboot. It should reinstall and fix the system.

Otherwise, please contact Kerlink support@kerlink.com

Hi,

I have 2 Kerlink iBTS Compact from Actility and would like to upgrade the firmware. I tried the same method. However, when I hit reset button on the gateway, I got “U-Boot SPL 2015.04 (Jul 21 2017 - 14:39:44)” insteady of “U-Boot 2009.03-2009.03-klk1 (Dec 27 2016 - 16:23:47)” (Full log below). And hitting ‘k’ on keyboard did nothing to the boot process. Can anyone help me on this please?

Thanks & have a great day!

Rebooting... [   49.129042] imx2-wdt 20bc000.wdog: Device shutdown: Expect reboot!
[   49.136146] reboot: Restarting system

U-Boot SPL 2015.04 (Jul 21 2017 - 14:39:44)
SEC: RNG instantiated
[rpmb] not configuring the rpmb while in non-secure mode
[rpmb] the secure storage will be installed in the USER partition
[rpmb] rng vector just fine avg:133 var:8
[rpmb] setup complete
hab fuse not enabled
Authenticating TZSW succeeded
hab fuse not enabled
Authenticating u-boot.img succeeded

Copyright (c) 2014-2017, Prove & Run and/or its affiliates. All rights reserved.
ProvenCore (May 03 2017 - 09:57:17 +0200)

i.MX6: SoloX rev 1.3
  PL310:   PL310: ARM, id: 0x0, part 0x3, rtl 0x8
Parsed init/build/init with header at 0x40027200
Parsed init/build/hello with header at 0x4002fc00
Parsed uart/build/uart with header at 0x40037200
Parsed mmc/build/mmc with header at 0x40042e00
Parsed ssto/build/ssto with header at 0x40058200
Parsed ssto/build/ssto_user with header at 0x40069c00
Parsed ssto/build/ssto_rpmb with header at 0x4007a800
Parsed ree/build/ree with header at 0x4008c200
Parsed uart_ctrl/build/uart_ctrl with header at 0x40094e00
Parsed caam/build/caam with header at 0x4009c600
Parsed auth/build/auth with header at 0x400aa600
Parsed syield/build/syield with header at 0x400bae00
Parsed strongswan/build/strongswan with header at 0x400c2400
Parsed openvpn/build/openvpn with header at 0x401cca00
Loaded 14 ELFs from archive...
Booted 1 core in supervisor mode.


CPU info:
  Implementer: ARM
  Variant: 0x2
  Architecture: 0xf
  Primary Part Number: 0xc09
  Revision: 0xa

MIDR: 0x412fc09a, REVIDR: 0x412fc09a


U-Boot 2015.04 (Jul 21 2017 - 14:39:44)

CPU:   Freescale i.MX6SX rev1.3 at 792 MHz
CPU:   Temperature 52 C
Reset cause: WDOG
       Watchdog enabled
I2C:   ready
DRAM:  240 MiB
MMC:   FSL_SDHC: 0
Using default environment

In:    serial
Out:   serial
Err:   serial
bootcause = SW
bootmode = nominal
Net:   FEC0
Normal Boot
10870816 bytes read in 558 ms (18.6 MiB/s)
u-boot: Authenticating image in DDR at address 0x87900000 (size = 10861376 bytes)
Secure monitor authentication return 0x87901000

boot_log.txt (152.6 KB)