Belkin RT3200/Linksys E8450 WiFi AX discussion

After flashing openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer_signed.itb I seem to be permanently stuck in recovery (initramfs) mode:

BusyBox v1.36.1 (2024-02-18 11:23:19 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r25239-a3a33f02ce
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# cat /sys/fs/pstore/*
Panic#1 Part1
<6>[    0.786088] mtk_soc_eth 1b100000.ethernet eth0: mediatek frame engine at 0xffffffc011ca0000, irq 37
<6>[    0.797054] i2c /dev entries driver
<6>[    0.801511] mtk-wdt 10212000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
<6>[    0.813031] NET: Registered protocol family 10
<6>[    0.818207] Segment Routing with IPv6
<6>[    0.821909] NET: Registered protocol family 17
<6>[    0.826416] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
<6>[    0.839518] 8021q: 802.1Q VLAN Support v1.8
<6>[    0.844999] pstore: Using crash dump compression: deflate
<6>[    0.860529] mtk-pcie 1a143000.pcie: host bridge /pcie@1a143000 ranges:
<7>[    0.867105] mtk-pcie 1a143000.pcie: Parsing ranges property...
<6>[    0.872939] mtk-pcie 1a143000.pcie:      MEM 0x0020000000..0x0027ffffff -> 0x0020000000
<6>[    0.907489] mtk-pcie 1a143000.pcie: PCI host bridge to bus 0000:00
<6>[    0.913678] pci_bus 0000:00: root bus resource [bus 00-ff]
<6>[    0.919222] pci_bus 0000:00: root bus resource [mem 0x20000000-0x27ffffff]
<7>[    0.926096] pci_bus 0000:00: scanning bus
<6>[    0.930143] pci 0000:00:00.0: [14c3:3258] type 01 class 0x060400
<6>[    0.936175] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x1ffffffff 64bit pref]
<7>[    0.945091] pci_bus 0000:00: fixups for bus
<7>[    0.949282] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 0
<6>[    0.955982] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
<7>[    0.963990] pci 0000:00:00.0: scanning [bus 00-00] behind bridge, pass 1
<7>[    0.970839] pci_bus 0000:01: scanning bus
<6>[    0.975077] pci 0000:01:00.0: [14c3:7915] type 00 class 0x000280
<6>[    0.981260] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
<6>[    0.988585] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
<6>[    0.995910] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
<6>[    1.003871] pci 0000:01:00.0: supports D1 D2
<6>[    1.008138] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
<7>[    1.014767] pci 0000:01:00.0: PME# disabled
<6>[    1.019252] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
<7>[    1.056151] pci_bus 0000:01: fixups for bus
<7>[    1.060339] pci_bus 0000:01: bus scan returning with max=01
<6>[    1.065924] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
<7>[    1.072535] pci_bus 0000:00: bus scan returning with max=01
<6>[    1.078151] pci 0000:00:00.0: BAR 0: no space for [mem size 0x200000000 64bit pref]
<6>[    1.085805] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x200000000 64bit pref]
<6>[    1.093801] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
<6>[    1.100591] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
<6>[    1.108416] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
<6>[    1.116243] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
<6>[    1.124060] pci 0000:00:00.0: PCI bridge to [bus 01]
<6>[    1.129026] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
<3>[    1.135908] pcieport 0000:00:00.0: of_irq_parse_pci: failed with rc=-22
<7>[    1.142514] pcieport 0000:00:00.0: assign IRQ: got 0
<6>[    1.147488] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
<7>[    1.153592] pcieport 0000:00:00.0: enabling bus mastering
<6>[    1.159527] mtk-pcie 1a145000.pcie: host bridge /pcie@1a145000 ranges:
<7>[    1.166086] mtk-pcie 1a145000.pcie: Parsing ranges property...
<6>[    1.171921] mtk-pcie 1a145000.pcie:      MEM 0x0028000000..0x002fffffff -> 0x0028000000
<6>[    1.280140] mtk-pcie 1a145000.pcie: Port1 link down
<6>[    1.285155] mtk-pcie 1a145000.pcie: PCI host bridge to bus 0001:00
<6>[    1.291333] pci_bus 0001:00: root bus resource [bus 00-ff]
<6>[    1.296829] pci_bus 0001:00: root bus resource [mem 0x28000000-0x2fffffff]
<7>[    1.303696] pci_bus 0001:00: scanning bus
<7>[    1.308854] pci_bus 0001:00: fixups for bus
<7>[    1.313031] pci_bus 0001:00: bus scan returning with max=00
<6>[    1.318946] mtk_hsdma 1b007000.dma-controller: Using 3 as missing dma-requests property
<6>[    1.327245] mtk_hsdma 1b007000.dma-controller: MediaTek HSDMA driver registered
<6>[    1.385470] mt7530 mdio-bus:00 lan1 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=145)
<6>[    1.405349] mt7530 mdio-bus:00 lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=146)
<6>[    1.425202] mt7530 mdio-bus:00 lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=147)
<6>[    1.445032] mt7530 mdio-bus:00 lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=148)
<6>[    1.465064] mt7530 mdio-bus:00 wan (uninitialized): PHY [mt7530-0:04] driver [MediaTek MT7531 PHY] (irq=149)
<6>[    1.476789] mt7530 mdio-bus:00: configuring for fixed/2500base-x link mode
<6>[    1.483858] DSA: tree 0 setup
<6>[    1.484038] mt7530 mdio-bus:00: Link is Up - 2.5Gbps/Full - flow control rx/tx
<6>[    1.487638] xhci-mtk 1a0c0000.usb: xHCI Host Controller
<6>[    1.499339] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 1
<6>[    1.508423] xhci-mtk 1a0c0000.usb: hcc params 0x01403198 hci version 0x96 quirks 0x0000000000210010
<6>[    1.517515] xhci-mtk 1a0c0000.usb: irq 31, io mem 0x1a0c0000
<6>[    1.523656] hub 1-0:1.0: USB hub found
<6>[    1.527451] hub 1-0:1.0: 2 ports detected
<6>[    1.531733] xhci-mtk 1a0c0000.usb: xHCI Host Controller
<6>[    1.536989] xhci-mtk 1a0c0000.usb: new USB bus registered, assigned bus number 2
<6>[    1.544388] xhci-mtk 1a0c0000.usb: Host supports USB 3.0 SuperSpeed
<6>[    1.550702] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
<6>[    1.559120] hub 2-0:1.0: USB hub found
<6>[    1.562897] hub 2-0:1.0: 1 port detected
<5>[    1.567915] UBI: auto-attach mtd3
<5>[    1.571244] ubi0: attaching mtd3
<5>[    1.957880] ubi0: scanning is finished
<4>[    1.965087] ubi0 warning: 0xffffffc01052c160: cannot reserve enough PEBs for bad PEB handling, reserved 2, need 20
<5>[    1.976452] ubi0: attached mtd3 (name "ubi", size 125 MiB)
<5>[    1.981941] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
<5>[    1.988830] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
<5>[    1.995619] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
<5>[    2.002570] ubi0: good PEBs: 1000, bad PEBs: 0, corrupted PEBs: 0
<5>[    2.008662] ubi0: user volume: 8, internal volumes: 1, max. volumes count: 128
<5>[    2.015885] ubi0: max/mean erase counter: 11/7, WL threshold: 4096, image sequence number: 1411994629
<5>[    2.025099] ubi0: available PEBs: 0, total reserved PEBs: 1000, PEBs reserved for bad PEB handling: 2
<5>[    2.034319] ubi0: background thread "ubi_bgt0d" started, PID 856
<7>[    2.035405] FIT: Default configuration: "config-1" (OpenWrt linksys_e8450-ubi)
<7>[    2.047568] FIT:           kernel sub-image 0x00001000..0x004da3dc "kernel-1" (ARM64 OpenWrt Linux-5.10.120) 
<7>[    2.057494] FIT:          flat_dt sub-image 0x004db000..0x004e25b4 "fdt-1" (ARM64 OpenWrt linksys_e8450-ubi device tree blob) 
<7>[    2.068890] FIT:       filesystem sub-image 0x004e3000..0x009c2fff "rootfs-1" (ARM64 OpenWrt linksys_e8450-ubi rootfs) 
<7>[    2.079676] FIT: selecting configured loadable "rootfs-1" to be root filesystem
<6>[    2.086980]  ubiblock0_5: p1(rootfs-1)
<6>[    2.087290] block ubiblock0_5: created from ubi0:5(fit)
<6>[    2.097519] F2FS-fs (ubiblock0_5p1): Magic Mismatch, valid(0xf2f52010) - read(0xffffffff)
<3>[    2.105729] F2FS-fs (ubiblock0_5p1): Can't find valid F2FS filesystem in 1th superblock
<6>[    2.113748] F2FS-fs (ubiblock0_5p1): Magic Mismatch, valid(0xf2f52010) - read(0xffffffff)
<3>[    2.121950] F2FS-fs (ubiblock0_5p1): Can't find valid F2FS filesystem in 2th superblock
<7>[    2.130051] List of all partitions:
<7>[    2.133543] 1f00             512 mtdblock0 
<7>[    2.133545]  (driver?)
<7>[    2.140088] 1f04            1280 mtdblock1 
<7>[    2.140090]  (driver?)
<7>[    2.146620] 1f08            1024 mtdblock2 
<7>[    2.146621]  (driver?)
<7>[    2.153144] 1f0c          128000 mtdblock3 
<7>[    2.153145]  (driver?)
<7>[    2.159674] 103:00000      10044 ubiblock0_5 
<7>[    2.159675]  (driver?)
<7>[    2.166376]   103:00001       4992 ubiblock0_5p1 
<7>[    2.166378] 
<7>[    2.172551] No filesystem could mount root, tried: 
<7>[    2.172553]  ext3
<7>[    2.177427]  ext2
<7>[    2.179342]  ext4
<7>[    2.181257]  squashfs
<7>[    2.183172]  f2fs
<7>[    2.185439] 
<0>[    2.188835] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(259,1)
<2>[    2.197264] SMP: stopping secondary CPUs
<0>[    2.201179] Kernel Offset: disabled
<0>[    2.204659] CPU features: 0x0000002,04002004
<0>[    2.208918] Memory Limit: none
root@OpenWrt:~# 

Neither serial recovery nor mtk_uartboot seemed to help. Any thoughts?

Do I have superfluous and/or wrong mt7xxx drivers installed?

In the firmware selector for RT3200 (UBI, SNAPSHOT), it lists only kmod-mt7622-firmware and kmod-mt7915-firmware, but here's what I have installed:

Also trying to figure out why there's always two dropdown choices on my Attended Sysupgrade page (even though they appear identical):

Not an answer to your question, but I caution against upgrading to MAIN SNAPSHOT r25433-1f5fd5cb97. I saw very high ping to my router (GL-MT6000). https://github.com/openwrt/openwrt/commit/1f5fd5cb971166ba57996d41b7ce71e697c186b2#commitcomment-139577735

1 Like

alright, so i managed to compile mtk_uartboot for arm for use with my raspberry pi 4 (link if anyone wants it, maybe @981213 can add it to the release page for anyone else who wants to use it with a Pi 3/4)

(i was running 23.05.0 when it bricked)

used this command:

/mtk_uartboot -s /dev/ttyAMA1 -p bl2-mt7622-1ddr-ram.bin -a -f openwrt-23.05.2-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip

that got the router booting and i was able to flash the new installer from there

pic of the serial connection: (UART4 on the PI):


both my rt3200's are up and running now on the new layout

3 Likes

What you're seeing is the correct behavior. The firmware builder only lists end packages and critical system packages that are required to operate. Some of those packages have their own dependencies, so they'll bring in the additional packages on build.

What I see in your screenshot looks correct for the E8450. The additional packages are dependencies and are absolutely required for the radios to work properly.

As for the attendedsysupgrade app, you'll often see the "current" (installed) build and then the "latest" (head) build when you're running on snapshot. Since both are the same right now, you're seeing the same revision/commit numbers. This edge case might be something that could be scripted out in the future, but it's cosmetic and a low priority target.

1 Like

It looks like the full image isn't installed. After flashing the installer, did you then follow up by flash the matching sysupgrade file? Did you re-flash the installer on accident?

Either way, it looks like you have a viable recovery environment running, so you might still be able to solve this by flashing a matching or newer sysupgrade from the snapshot.

1 Like

As pointed out by @odrt you can still find it sometimes but it is always sold by 3rd party sellers. On the other hand Belkin refuses to honor warranty. I got my Belkin RT3200 in September, it died (no power lights problem) in December. I thought I'll try Belkinwarranty despite having converted it to openwrt. Belkin rep told me that the router is too outdated and they do not service it.

In the EU that would be illegal -- what counts for warranty is that date of the sale, 1 year is the legal minimum for goods sold as "new". And it's the seller who is liable for warranty and not the manufacturer.

Anyway, in case you want to dig into it and repair yourself (most likely this will be possible using mtk_uartboot unless something bigger has gone south...) let me know, happy to help with that.

Thanks. Depending on what's involved, I would like to try.

Yeah, that's because the others are installed as dependencies, e.g.:

$ opkg depends kmod-mt7622-firmware
kmod-mt7622-firmware depends on:
        kernel (= 5.15.137-1-01c22519ce836afade4e782169e44ead)
        kmod-mac80211
        kmod-mt7615e
1 Like

I am one of those that grabbed the snapshot, and force flashed it while only having dangowrt's 1.0.3, with no backups of anything. If you are in the same boat, here is what I did step by step to get unbricked. Some of these steps may not be necessary, but again, this worked for me.

  • All done on a Lubuntu Debian Bookworm distro fresh install on an ancient laptop
    • mtk-uartboot and necessary files (links in post 4220)
    • tftp server set up at 192.168.1.254 (laptop set to this address manually)
      -I put the dangowrt 1.0.3 recovery and sysupgrade files in here (you need the 1.1.1 recovery-installer eventually as well)
  • USB to UART connector (I used this one: https://www.ebay.com/itm/296088445653 )
    • https://openwrt.org/toh/linksys/e8450 shows the correct pins to connect to, remember that tx from router needs to go to rx of uart connector, and rx of router needs to go to tx of uart connector

Luckily I have 4 of these RT3200's, so I grabbed the mtd0 - mtd3 files off of one by ssh'ing into a working router:

mkdir /tmp/boot_backup
mount -t ubifs ubi0:boot_backup /tmp/boot_backup

Then, copy the files under /tmp/boot_backup using scp to your computer:
scp [file_name] remoteuser@remotehost:/remote/directory

Now that we have all of the requirements out of the way, connect the bricked router to your uart connector (no power) and head to your mtk_uartboot directory and type:

sudo ./mtk_uartboot -p bl2-mt7622-1ddr-ram.bin -a -f openwrt-23.05.2-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip && sudo screen /dev/ttyUSB0 115200

if should state that its waiting for a handshake, at this point power on the router and you should get to an OpenWRT U-Boot menu. I chose to load recovery from tftp, and also load production from tftp (it will show you the file name its looking for, rename your 1.0.3 files to what it is looking for), then boot into recovery, which allowed me to move the mtd files back on to the router. From the laptop I went to the directory I had the mtd files in, and entered:

scp mtd0 root@192.168.1.1:/tmp
scp mtd1 root@192.168.1.1:/tmp
scp mtd2 root@192.168.1.1:/tmp
scp mtd3 root@192.168.1.1:/tmp

I opted to ssh into root@192.168.1.1 via ethernet for the following commands:

ubidetach -d 0
insmod mtd-rw i_want_a_brick=1
mtd write /tmp/mtd0 /dev/mtd0
mtd write /tmp/mtd1 /dev/mtd1
mtd write /tmp/mtd2 /dev/mtd2
mtd write /tmp/mtd3 /dev/mtd3

I then went into my browser to 192.168.1.1 and flashed the 1.0.3 sysupgrade file.
Back into the terminal screen to watch the UART communication, router booted up into something called the U-Boot SPI NAND Menu. From here, I chose option 1, something about loading into SDRAM, where I then put the 1.1.1 recovery-installer into the tftp server directory, named it something short like installer.itb , and let it do its thing. UART terminal screen left untouched so that it would do its default boot. Router proceeded to load the 1.1.1 recovery-installer and boot from it. Back to the browser and I am running the 6.1.x kernel, where I flashed the 1.1.1 sysupgrade, where it shouldnt throw any warnings to you at this point. You should now be booting up on the snapshot but you wont have the luci gui so you cant use your browser to access a gui.

Connect the router to something with internet, ssh into it:

opkg update
opkg install luci

at this point you should be able to use the browser to access 192.168.1.1, grab the latest openwrt snapshot if you want, and flash that with no warnings (if you do update again you will need to do the opkg update, opkg install luci again).

Hope this helps someone, like I said, some of these steps may be completely unneccessary, but this is what worked for me who completely screwed up the router by blindly force upgrading with no backups.

3 Likes

Important notes: The recovery image you are loading via TFTP is from 23.05.x release, otherwise this can't work as you won't have /dev/mtd2 and /dev/mtd3.

Another important thing is that following this procedure you will end up with a perfect clone of the device you copied the backup from -- including MAC addresses, which is definitely not what you want in case you ever want to use them again on the same network.

However, you can edit mtd2 file before writing in hex-editor to place the correct MAC addresses for both WiFi interfaces as well as LAN and WAN.

4 Likes

@981213
Thank you for the mtk_uartboot utility. After trying some USB to Serial adapters that didn't work, I finally got ones that do AND it worked.
I have recovered from (no LEDs, no signs of any life on the router) the BL2 error.
And flashed a snapshot (latest kernel) because my device died after the updated installer.

It's working and booting/rebooting again without the utility.
Amazing. I hope I don't need it again but nice to know I have the option if it fails again.

1 Like

I can get the uboot menu but when I load recovery from tftp none of the interfaces come up and the ip a only has loopback.I have tried multiple times to write the recovery and production.

I recovered one dead router but the second one has a different boot error than the first.

F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0400 0041 [0000]
G0: 1190 0000
T0: 0000 02F0 [000F]
Jump to BL

NOTICE:  BL2: v2.9.0(release):OpenWrt v2023-10-13-0ea67d76-1 (mt7622-snand-ubi-1ddr)
NOTICE:  BL2: Built : 15:28:57, Mar  4 2024
NOTICE:  WDT: Cold boot
NOTICE:  CPU: MT7622
NOTICE:  WDT: disabled
NOTICE:  SPI-NAND: FM35Q1GA (128MB)
NOTICE:  UBI: scanning [0x80000 - 0x8000000] ...
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   UBI error: No volume named fip could be found
NOTICE:  UBI: scanning [0x80000 - 0x8000000] ...
NOTICE:  UBI: scanning is finished
NOTICE:  UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
NOTICE:  UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
ERROR:   UBI error: No volume named fip could be found
ERROR:   BL2: Failed to load image id 3 (-2)

Can you share what UART adapter worked and which ones didn't? And what OS you were using?

# AITRIP 4pcs 3.3V 5V FT232RL FTDI Mini USB to TTL Serial

I was able to figure out what the problem was. I flashed the 24 snapshot uboot/preload to get the message above and it would not do any recovery of any version.

I ended up going back to 23.05.2 and reflashed the uboot/preload and was able to get the recovery to load correctly and finally got everything flashed and working.

The key difference is the
BL2: v2.9.0(release):OpenWrt v2023-10-13-0ea67d76-1 (mt7622-snand-ubi-1ddr)
vs
BL2: v2.9(release):OpenWrt v2023-07-24-00ac6db3-2 (mt7622-snand-1ddr)
work differently. even though the system information in luci says it is UBI and we used Writing to 'openwrt-23.05.2-90f73925a1a3-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb'

So now both routers have been recovered.

2 Likes

@daniel could this be part of a recipe for converting a running 23.05.0 raw-flash system to UBI without the installer? i.e. convert to new layout remotely via wan.

No. You can't do this without at least one intermediate boot to an initramfs image with already has the new layout defined in its device tree.
If you really have no other choice than doing that remotely, I recommend you to create a custom version of the v1.1.1 installer which includes what ever is needed for you to then access the device again and flash the updated production image (which then also already needs to be prepared with a built-in configuration).

1 Like

You are trying to load bl2 which expects FIP to be in UBI to a device which apparently has never been converted to the new layout and hence still has FIP located in a raw MTD partition. That can't work.

Then there's no way to avoid the possible fail at the first stage reboot.

That was my plan until your post about flashing the early stage images got me curious about doing it "live."

I'll probably fix it with FedEx :sweat_smile: