EA7500 v1 flash and boot problems

I have what is supposed to be a US version of EA7500 v1. I was able to flash a snapshot and had been unsinging without any problems. Of course using a snapshot, I had to occasionally upload a new snapshot to keep pkgs updated. The last time I flash it through lcui something went wrong an I can no longer boot router.

I have been able to flash non-us images from Linksys but US versions will not boot. The only way I can boot is to serial into router and issue bootipq. Otherwise every time I power on router it fails to load spiflash and boots to IPQ prompt.

Here is a serial print

U-Boot .07 [Standard IPQ806X.LN,r40331] (Nov 05 2015 - 14:44:22)

CBT U-Boot ver: 1.1.4

smem ram ptable found: ver: 0 len: 5
DRAM:  235 MiB
NAND:  SF: Unsupported manufacturer 00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
128 MiB
MMC:
PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
cdp: get part failed for 0:HLOS
Net:   MAC1 addr:0:3:7f:ba:db:1
athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init  done
MAC2 addr:0:3:7f:ba:db:2
eth0
Warning: eth0 MAC addresses don't match:
Address in SROM is         00:03:7f:ba:db:01
Address in environment is  00:06:3b:01:41:00
, eth1

Updating boot_count ... done

Hit any key to stop autoboot:  0
Write Reg: 0x00000660: Oldval = 0x00140002 Newval = 0x0014007e
Write Reg: 0x0000066c: Oldval = 0x00140001 Newval = 0x0014007d
Write Reg: 0x00000678: Oldval = 0x00140078 Newval = 0x0014007b
Write Reg: 0x00000684: Oldval = 0x00140074 Newval = 0x00140077
Write Reg: 0x00000690: Oldval = 0x0014006c Newval = 0x0014006f
Write Reg: 0x0000069c: Oldval = 0x0014005c Newval = 0x0014005f
Write Reg: 0x000006a8: Oldval = 0x0014003c Newval = 0x0014003f
Write Reg: 0x00000420: Oldval = 0x00020001 Newval = 0x00010001
Write Reg: 0x00000428: Oldval = 0x00020001 Newval = 0x00010001
Write Reg: 0x00000430: Oldval = 0x00010001 Newval = 0x00010001
Write Reg: 0x00000438: Oldval = 0x00010001 Newval = 0x00010001
Write Reg: 0x00000440: Oldval = 0x00010001 Newval = 0x00010001
Write Reg: 0x00000448: Oldval = 0x00010001 Newval = 0x00010001
Write Reg: 0x00000450: Oldval = 0x00010001 Newval = 0x00010001
(IPQ) #

printenv:

altkern=3780000
auto_recovery=yes
autostart=yes
baudrate=115200
boot_part=2
boot_part_ready=2
boot_ver=1.1.4
bootargs=console=ttyHSL1,115200n8 init=/sbin/init rootfstype=squashfs ubi.mtd=14,2048 ubi.block=0,0 root=/dev/ubiblock0_0 rootwait ro
bootcmd=bootipq
bootdelay=2
ethact=eth0
ethaddr=00:06:3b:01:41:00
fileaddr=42000000
filesize=1660000
flashimg=tftp $loadaddr $image && nand erase $prikern $imgsize && nand write $loadaddr $prikern $filesize
flashimg2=tftp $loadaddr $image && nand erase $altkern $imgsize && nand write $loadaddr $altkern $filesize
fsbootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
image=macan.bin
imgsize=2800000
ipaddr=192.168.1.1
loadaddr=42000000
machid=1260
netmask=255.255.255.0
partbootargs=console=ttyHSL1,115200n8 init=/sbin/init rootfstype=squashfs ubi.mtd=14,2048 ubi.block=0,0 root=/dev/ubiblock0_0 rootwait ro
partbootargs2=console=ttyHSL1,115200n8 init=/sbin/init rootfstype=squashfs ubi.mtd=16,2048 ubi.block=0,0 root=/dev/ubiblock0_0 rootwait ro
prikern=f80000
serverip=192.168.1.254
stderr=serial
stdin=serial
stdout=serial

Now when I flash a world version with bootipq I can get things running. I can then updatge firmware via webgui. I can update firmware to a US version and then it will boot img with bootipq command. But every time I power cycle the router It still boots into IPQ propmt. Seems like I am stuck in a recovery mode and have sf settings mismatch.

any ideas

update Now I can boot non us versions. It gets stuck at

[ 2.736894] Waiting for root device /dev/ubiblock0_0...

it appears my whole ubi is messed up. Now I cant boot anything. All I get is a image fail or it hangs after flash.

OK so I did mess up some of my variables which caused some flashing problems. Here are the correct ones.

(IPQ) # printenv
altkern=3780000
auto_recovery=yes
baudrate=115200
boot_part=1
boot_part_ready=3
boot_ver=1.1.4
bootargs=consele=ttyHSL1,115200n8
bootcmd=bootipq
bootdelay=2
ethact=eth0
ethaddr=00:06:3b:01:41:00
fileaddr=42000000
filesize=1428642
flashimg=tftp $loadaddr $image && nand erase $prikern $imgsize && nand write $loadaddr $prikern $filesize
flashimg2=tftp $loadaddr $image && nand erase $altkern $imgsize && nand write $loadaddr $altkern $filesize
fsbootargs=ubi.mtd=rootfs root=mtd:ubi_rootfs rootfstype=squashfs
image=macan.bin
imgsize=2800000
ipaddr=192.168.1.1
loadaddr=42000000
machid=1260
netmask=255.255.255.0
partbootargs=console=ttyHSL1,115200n8 init=/sbin/init rootfstype=squashfs ubi.mtd=14,2048 ubi.block=0,0 root=/dev/ubiblock0_0 rootwait ro
partbootargs2=console=ttyHSL1,115200n8 init=/sbin/init rootfstype=squashfs ubi.mtd=16,2048 ubi.block=0,0 root=/dev/ubiblock0_0 rootwait ro
prikern=f80000
serverip=192.168.1.254
stderr=serial
stdin=serial
stdout=serial

Environment size: 1027/262140 bytes

My other problems is that you can not flash the US versions via TFTP because they are encrypted.

world ver
https://downloads.linksys.com/downloads/firmware/FW_EA7500_1.1.2.172843_prod.img

US ver
https://downloads.linksys.com/downloads/firmware/FW_EA7500_1.1.2.172843_prod..gpg.img
Notice the gpg.img vrs just prod.img. This means its GPG encrypted. You need to flash the world vrs first and then via webGUI you can flash the US vrs. Do this two times so both boot img are the same. Or you can bitwalk the world img and extract the /etc/keydata and then use gpg to decrypt the us img, but the first way is easier. Part of the linksys flash process will take care of decrypting img.

And last my boot hang up was because I had signal noise on my RX pin. This was causing it to register a boot stop on startup. remove serial wire from RX line before boot and vala. Only wasted a week on a stupid problem. Goes to show, when all else fails, go back to the basics and check voltages.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.