Belkin RT3200/Linksys E8450 WiFi AX discussion

Hi @alexgill,

You can run $ mtd erase.dontskipbad spi-nand0 $ nand dump.raw 0x80000 $ nand dump.raw 0xa0000 $ nand dump.raw 0xc0000 $ nand dump.raw 0xe0000 $ nand dump.raw 0x100000

before you recover your OKDed router with UART.
This can help Mediatek engeneer to track the issue. Unforunatly so far we have just one log and several recovered router (without generating the log) reported here.
Please take some minutes to get the log, so we can help eachother.
Thanks
Kr
K

All those are supposed to be run on U-Boot shell after booting into U-Boot via mtk_uartboot.

And you need to have backups!!!

What you are going to do is basically erasing the whole flash and then checking if the erase worked reliable.

6 Likes

@Underworld has outlined the steps. You will need to connect it to a serial adapter as described here: https://openwrt.org/toh/linksys/e8450#serial_recovery

You should do the steps from @Underworld before doing the read/write steps in the wiki, as those will actually fix the problem and to get logs you don't want to fix it yet.

Uhhhh... and what would one do now, if they ran those commands not knowing they needed to have backups? :laughing:

I ran the commands that had recovered me from OKD before, but they didn't seem to work and I didn't have time to troubleshoot further.

If you ran the mtd erase and nand dump commands, the goal of that would be to collect logs that might help find a solution to the problem. So in that case you'd need to post the logs somewhere.

The only backup you really need is mtd2. Everything else can be restored using other methods. If you didn't take any backups before the OpenWRT install, or after, then :person_shrugging:

Then you got yourself a new doorstop.

--
At least the wireless functionality will be shot, setting sensible values for MAC addresses and other device specifics necessary for wired-only functionality is non-trivial, but possible. But the -then lost- wireless calibration data cannot be recovered without backups from your device, it's device specific and determined/ written to flash in the factory, using six figure+ calibration gear and proprietary tools.

The good news is that the MT7622 (2.4GHz wifi chip) will run without its EEPROM, but the MT7915 (5GHz wifi) will not. However, after a quick review of the driver code for the MT7915 chip and comparison to the EEPROM data on my bench router, I didn't actually see any calibration data present where it looked like it should have been placed. Given that other OpenWRT-supported devices appear to be using similar chips but don't have EEPROM in flash, it looks to me like it might be possible to produce a neutral BLOB that contains the device configuration parameters that the driver requires and either write it back into flash from there or potentially store it in the rootfs. I could try my hand at this, but I suspect it might be better off in the hands of someone with much greater familiarity with the driver and more time than I have.

2 Likes

Hi. A few weeks ago w my E8450, I erased everything -- all the mtd partitions, and I was stuck... I managed to get it to boot up, but wifi was non-operational...
So I then backed up form a working RT3200 and restored to it. Both bands have been working fine since then, except for the duplicated MAC (which I see instructions for updating higher on this thread).
Might take some fiddling, but should be salvageable :smiley:

1 Like

Can you please help me recovering my bricked e8450?

I had OKD and before recovery, I ran the commands shared by @underworld for getting logs to help diagnose OKD issue. I was able to successfully run the commands and while copying the logs, something went wrong and the router rebooted. After rebooting I'm getting this error

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.
No ethernet found.

Error: ethernet@1b100000 No valid MAC address found.

Error: ethernet@1b100000 No valid MAC address found.
Wrong Image Format for bootm command
ERROR: can't get kernel image!
MT7622> ubi ist
Error, no UBI device selected!
MT7622> mtd read fip $loadaddr 0x0 0x140000 && mtd write fip $loadaddr 0x0 0x140000
MTD device fip not found, ret -19
MT7622> ubi list
Error, no UBI device selected!
MT7622> ubi remove rootfs_data ; ubi read $loadaddr fip && ubi write $loadaddr fip $filesize
Error, no UBI device selected!
Error, no UBI device selected!

I've the factory partition backed up, if required, to restore everything from start.

Hard recovery of the e8450 / RT-3200

If the router's firmware has been damaged beyond the point of simple patching and operation, you can still restore the router to full function as long as you have previously taken a backup of your factory partition. The instructions for doing so are below. Be warned that if something goes wrong with the below, it could leave your router unable to boot and without data at all. Therefore, the steps below should only be followed if you know what you are doing or if you're sure the data has been corrupted beyond resolution by normal firmware installation process and the normal OKD recovery steps.

Additional: If your router really has reached the point that the below is necessary, please consider first submitting the logs as requested a few posts up (Belkin RT3200/Linksys E8450 WiFi AX discussion - #5088 by Underworld) before completing the restoration.

Complete recovery instructions

These instructions are based under the following assumptions:

  1. The router and your computer are connected to the same network and you can communicate between them.
  2. The router (through U-Boot) will default to the IP address 192.168.1.1.
  3. The router expects your computer to be located at IP address 192.168.1.254.
  4. Your computer must be configured with a TFTP server.
  5. You have a basic working knowledge of (and access to) the U-Boot prompt.

From your backups, place a copy of the backed-up factory partition for this router in the TFTP folder with the name factory.bin. To find the right backup file, you'll need to know where the factory partition data was stored. The stock and non-UBI OpenWRT firmwares stored the factory data in mtd4. The stable 23.0x OpenWRT e8450 UBI firmwares stored the factory data in mtd2, and the 2024+ snapshot and newer OpenWRT UBI firmwares store it as a UBI volume. In most cases, the factory data will be 1MiB in size.

From the OpenWRT firmware selector, select the e8450 UBI and firmware version 22.03.7. We need the following:

  • Download the "preloader.bin" and place it in the TFTP folder with name openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin.
    Note: The preloader is being taken from release 22.03.7 and not from 23.05.x! The reason for this is because as of 2024-08-16, the 23.05.x preloader builds all suffer from the condition known as OKD.

From the OpenWRT firmware selector, select the e8450 UBI and firmware version 23.05.4. We need the following:

  • Download the "BL31-UBOOT.FIP" and place it in the TFTP folder with name openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip.
  • Download the "kernel" and place it in the TFTP folder with name openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb.
  • Download the sysupgrade file to your preferred download location. This will not be used in TFTP, but will be uploaded via the web interface or via the OpenWRT command line (your preference).

Using the mtk_uartboot tool as per the wiki (https://openwrt.org/toh/linksys/e8450#recovery_from_openwrt_kiss_of_death_okd), follow the steps marked 'did not run the v1.1.1 UBI installer' until you get to a U-Boot prompt.

One at a time, run the below commands to restore data to the necessary partitions. If a step fails, you need to troubleshoot it. Do not proceed on to the next step unless you have received a confirmation message that the data has been written.
Restoring the preloader (BL2)

run boot_tftp_write_bl2

Restoring the fip (and U-Boot)

run boot_tftp_write_fip

Restoring the factory partition
The below instruction will restore your factory partition from the backup. If you are using the surrogate binary from below or a partition from a donor device and wish to retain your original MAC addresses, please instead skip the below command and use the factory restoration steps under the section "Recovery without factory partition".

tftpboot factory.bin && mtd erase factory && mtd write factory $loadaddr 0 $filesize

If you needed to use the alternate steps under "Recovery without factory partition", you would now resume the recovery process here.

Restoring the recovery environment

run boot_tftp_recovery

At the end of the final step, the router may automatically launch the OpenWRT recovery environment. If it does not, it is now safe to issue the reset command and the router will reboot. If all went well, you should now be in the 'initramfs' recovery environment and should upload the sysupgrade file either by web (luci) or by the command line, whichever you prefer. Once the sysupgrade file has been loaded, the router is restored and ready for use.

Recovery without factory partition

If you don't have a backup of your factory partition, you'll need a donor or surrogate in order to recover full functionality. The below linked file is a rebuilt factory partition based around the documentation and data present in the wifi drivers. Please note that it does NOT contain any MAC addresses, and therefore, your router will still randomly assign them.

Since this surrogate is rebuilt from driver information and does not contain all of the data present in a true factory partition, there's a chance that some functionality might not be there or it might not work properly on your device at all. It might even break at some point in the future, should a new driver suddenly require data that isn't there. In other words, this surrogate is for an emergency recovery when all other options fail.

The good news is that it has been tested far enough to ensure it will make and allow connections from devices, and that it lists the same support as was present by the factory.

Place the following file on your TFTP server with the name factory.bin.
https://github.com/grauerfuchs/owrt_device_support/raw/main/e8450_factory_emergency.bin

You can use the file as-is with the recovery instructions above if you don't care about having stable MAC addresses or if you prefer to assign them directly in OpenWRT. However, if you do want to permanently restore your MAC addresses, you'll need to properly update and use the below commands to restore the factory partition instead.

To load the surrogate partition into memory on the router for editing:

tftpboot 0x48000000 factory.bin

Editing a MAC address in device memory through the U-Boot console
The editor commands listed below will set the MAC address byte by byte in an as-displayed order. The last parameter passed to each command is the data that will be set. The addresses are written and stored as hexadecimal values. Please don't forget this when computing the new values.

By default, the MAC address on the router's sticker is the WAN address. From there, increment each address' final value by one to get the LAN, then the 2.4GHz, then the 5GHz addresses.

Setting the WAN MAC address

mw.b 0x4807FFFA 0xe8
mw.b 0x4807FFFB 0x9f
mw.b 0x4807FFFC 0x80
mw.b 0x4807FFFD 0x00
mw.b 0x4807FFFE 0x00
mw.b 0x4807FFFF 0x00

Setting the LAN MAC address

mw.b 0x4807FFF4 0xe8
mw.b 0x4807FFF5 0x9f
mw.b 0x4807FFF6 0x80
mw.b 0x4807FFF7 0x00
mw.b 0x4807FFF8 0x00
mw.b 0x4807FFF9 0x01

Setting the 2.4GHz WiFi MAC address

mw.b 0x48000004 0xe8
mw.b 0x48000005 0x9f
mw.b 0x48000006 0x80
mw.b 0x48000007 0x00
mw.b 0x48000008 0x00
mw.b 0x48000009 0x02

Setting the 5GHz WiFi MAC address

mw.b 0x48005004 0xe8
mw.b 0x48005005 0x9f
mw.b 0x48005006 0x80
mw.b 0x48005007 0x00
mw.b 0x48005008 0x00
mw.b 0x48005009 0x03

Writing the updated factory partition to flash

mtd erase factory && mtd write factory 0x48000000 0 0x80000

From here, continue with the above instructions for restoring the recovery environment.

10 Likes

Thank you so much for the steps.

I was able to follow the instructions, however, for the factory partition, I see files as follows:

Name Size
Mtd0. 512kb
Mtd1. 1.25MB
Mtd2. 1MB
Mtd3. 2 MB

Which one should I select and rename as factory.bin?

Also, please see the logs below

Logs

Hi,

Hoping someone can please help.

I have Linksys E8450 (UBI) and have been on Firmware Version OpenWrt 22.03.5 r20134 'forever'.

The router has been pretty stable. The only issue I had was trying to get AX to work, I can't remember the issue so I just stuck to AC. (BTW I have a 1GB down and 100Mb up).

I saw OpenWrt 23.05 is available and would like to upgrade. Its just that the process isn't clear to me.

Users already running OpenWrt 23.05.x or older, or snapshots before 2024-02-15 also need to re-run the installer yet another time to move fip and factory partitions into UBI volumes before running snapshots after 2024-02-15 as well as upcoming releases. Upgrading to release 23.05.3 does NOT require that you re-run the installer.

Does that mean I have to 'rerun' the installer because I am on 22.03.5 ? Can someone please provide clear steps on how I can get to 23.05? Its been a long time since I ran the installer the first time and I don't want to brick the router.

'Users already running OpenWrt 23.05.x or older, or snapshots before 2024-02-15 also need to re-run the installer yet another time' - Which installer ? After running 'installer' what are the next steps?

'Upgrading to release 23.05.3 does NOT require that you re-run the installer.' - this contradicts the suggestion above of having to rerun the installer.

Its just confusing to me, please can someone clarify

OK, this much I think I have worked out, can someone please confirm,

  1. From System- Flash Firmware menu, click Flash Image and upload of the recovery-installers from the following link. But which one version, signed or not ?
    https://github.com/dangowrt/owrt-ubi-installer/releases

Is this the correct one
https://github.com/dangowrt/owrt-ubi-installer/releases/download/v1.0.3/openwrt-23.05.0-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer_signed.itb

  1. Reboot

  2. From System- Flash Firmware menu, flash
    https://github.com/dangowrt/owrt-ubi-installer/releases/download/v1.0.3/openwrt-23.05.0-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb

  3. Reboot

I am assuming I will lose all configuration during this, so I should generate a backup before I start and restore at the end of the upgrade.

Many Thanks

No need for you to run the installer again if you plan to upgrade to 23.05. Re-running the latest installer is only required for anyone upgrading from 23.05 or earlier builds to snapshot builds after 2024-02-15.

Thanks for that, sorry I am just being simple and still confused;

I am on OpenWrt 22.03.5 which IS earlier than 23.05. Or is it that I am not upgrading to an Snapshot builds, which means I do Not need to re-run the installer?

I can simply flash directly to

https://github.com/dangowrt/owrt-ubi-installer/releases/download/v1.0.3/openwrt-23.05.0-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb

This also added confusion. But Again, is it because I am not upgrading to snapshot (whatever that is!)- I'm good !?
https://www.reddit.com/r/openwrt/comments/1b9lpo6/rt3200_important_updateinfo/

This is correct.

If your router is stable, do not run anymore installer versions, even if it’s not the latest.

Installer v1.1.x and later made changes to the router flash storage that made it incompatible with firmware releases v23.05.x and earlier. Running the latest installer and running any builds earlier than snapshot builds prior to 2024-02-15 will render your router losing WiFi capability and MAC address.

The experts are currently trying to figure out the serious bricking issues of RT3200/E8450 known as the OKD. It is not known at the moment if the issue is cause by later versions of the installer or not.

So if you have a stable router, just upgrade the firmware and stay off running the installer. You are good to upgrade up to firmware releases v23.05.x.

Hope this helps,

Thanks.

Your explanation was informative and easy to understand !

Did the upgrade and it works flawlessly. Now will see if I can get AX working reliably. I will be staying on this 23.x for a while

1 Like

If you're coming from the stable OpenWRT e8450 UBI firmware, mtd2 is both the right partition number and size for the factory partition.

1 Like

Thank you so much. It worked. I was able to restore it fully.

2 Likes

Instead of using the dangowrt github image, it would be better to use the official openwrt image, which is version 23.05.3:
https://downloads.openwrt.org/releases/23.05.3/targets/mediatek/mt7622/openwrt-23.05.3-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb

I think I used dangowrt github image, any benefit to re flashing the official WRT image ?.

BTW, enabling WED makes huge difference to webpages loading