Help with Flashing OpenWrt on Linksys EA7300 V2 via Serial

uruzFR · December 20, 2024, 1:50pm

Hello everyone,

I'm having trouble flashing OpenWrt on my Linksys EA7300 V2 router through the serial interface. Here's the rundown of what I've done so far:

Router Details:

Model: Linksys EA7300 V2

Firmware Details:

Filename: openwrt-23.05.4-ramips-mt7621-linksys_ea7300-v2-initramfs-kernel.bin
Size: 5759521 bytes
Image Type: MIPS Linux Kernel Image (uncompressed)

Setup:

PC connected to router via USB-to-serial adapter.
Using PuTTY for serial communication.
TFTP server IP set to 192.168.1.100, my PC's IP.

Steps I've Taken:

Enter U-Boot Menu:

Press 4 at the U-Boot prompt to enter command mode.

Set Environment Variables:

setenv serverip 192.168.1.100
setenv bootargs 'console=ttyS0,115200 earlyprintk loglevel=8 root=/dev/ram0 rootfstype=squashfs,jffs2'

TFTP Boot:

tftpboot 0x8000000 openwrt-23.05.4-ramips-mt7621-linksys_ea7300-v2-initramfs-kernel.bin
Firmware transfers successfully.

Boot Image:

bootm 0x8000000
Kernel starts with the message "Starting kernel ...", but then there's no further output or activity from the router.

Issues:

After "Starting kernel ...", the router does not proceed; no LED activity, no further console output.
I've tried different bootargs configurations but haven't found one that results in a complete boot.

Logs:

Here are the relevant logs:

MT7621 # setenv serverip 192.168.1.100
MT7621 # setenv bootargs 'console=ttyS0,115200 earlyprintk loglevel=8 root=/dev/ram0 rootfstype=squashfs,jffs2'
MT7621 # tftpboot 0x8000000 openwrt-23.05.4-ramips-mt7621-linksys_ea7300-v2-initramfs-kernel.bin
[TFTP transfer logs omitted for brevity - successful transfer]
Bytes transferred = 5759521 (57e221 hex)
MT7621 # bootm 0x8000000
## Booting image at 08000000 ...
   Image Name:   MIPS OpenWrt Linux-5.15.162
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    5759457 Bytes =  5.5 MB
   Load Address: 80001000
   Entry Point:  80001000
   Verifying Checksum ... OK
OK
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 256

Starting kernel ...

Questions:

Is there something I'm missing in my bootargs configuration?
Could this be a hardware issue, or is it more likely a software/firmware problem?
Any suggestions for additional debugging steps or different boot parameters?

Thanks in advance for any help or insights!

Uruz

frollic · December 20, 2024, 1:54pm

try using an older (and smaller) initramfs - https://firmware-selector.openwrt.org/?version=21.02.0&target=ramips%2Fmt7621&id=linksys_ea7300-v2

if that doesn't work, try removing the mem address from tftpboot and bootm.
if that doesn't work, try increasing the mem address.

uruzFR · December 20, 2024, 2:20pm

I attempted:

Removing Memory Address:
- tftpboot older.bin instead of specifying an address.
- bootm without specifying an address.
Increasing Memory Address:
- I tried tftpboot 0x8010000 older.bin and then bootm 0x8010000.

Outcome: Again, the kernel starts but no further progress is made.

uruzFR · December 20, 2024, 2:29pm

Without Memory Address:

4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Jan  3 2019 - 10:52:13)
MT7621 #
MT7621 #
MT7621 #
MT7621 # set serverip 192.168.1.100
MT7621 # tftpboot older.bin

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done

 ETH_STATE_ACTIVE!!
*** Warning: no boot file name; using 'test.bin'
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x0
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (e8:80:88:27:cd:18)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####################Got ARP REQUEST, return our IP
############################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##########
done
Bytes transferred = 9699584 (940100 hex)
LoadAddr=0 NetBootFileXferSize= 00940100
MT7621 # bootm
## Booting image at 00000000 ...
Bad Magic Number,E8808827
Bad Header Checksum

With Memory Address:

MT7621 #
MT7621 #
MT7621 #
MT7621 # ls
Unknown command 'ls' - try 'help'
MT7621 # set server ip 192.168.1.100
MT7621 # tftpboot 0x8010000 older.bin

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done

 ETH_STATE_ACTIVE!!
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'older.bin'.

 TIMEOUT_COUNT=10,Load address: 0x8010000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (e8:80:88:27:cd:18)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ####################################################
done
Bytes transferred = 4924454 (4b2426 hex)
LoadAddr=8010000 NetBootFileXferSize= 004b2426
MT7621 # bootm 0x8010000
## Booting image at 08010000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.143
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    4924390 Bytes =  4.7 MB
   Load Address: 80001000
   Entry Point:  80001000
   Verifying Checksum ... OK
OK
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 256

Starting kernel ...

And with the older version of firmware

badulesia · December 20, 2024, 2:36pm

Where did you find the memory adress info?

Maybe in this
https://openwrt.org/toh/linksys/ea7300_v2#flash_layout

frollic · December 20, 2024, 2:39pm

and did you try flashing it via stock webui ?

uruzFR · December 20, 2024, 2:43pm

In fact, I want to reflash my router because I can only boot from partition 1, and according to the OpenWrt documentation, if I want to reflash the router, it needs to boot from partition 2.

After many attempts, I've come to the conclusion that the partition is corrupted because I have no way to switch partitions despite following the change procedures, and I noticed through the serial connection that it automatically returns to partition 1.

uruzFR · December 20, 2024, 2:44pm

it's impossible to find the original firmware; it seems to have disappeared from the internet

frollic · December 20, 2024, 2:45pm

since you got serial access, you should be able to force it to try to boot from the 2nd partition ?

uruzFR · December 20, 2024, 2:55pm

Attempt to Set Boot to Partition 2:

4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Jan  3 2019 - 10:52:13)
MT7621 # setenv boot_part 2
MT7621 # savenv
Unknown command 'savenv' - try 'help'
MT7621 # saveenv
Saving Environment to NAND Flash...
..Erasing NAND Flash...
ranand_erase: start:80000, len:20000
.Writing to NAND Flash...
done

Logs Showing Boot Back to Partition 1:

4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Jan  3 2019 - 10:52:13)
MT7621 # printenv
bootcmd=tftp
bootdelay=5
baudrate=115200
ethaddr="00:AA:BB:CC:DD:10"
auto_recovery=yes
boot_ver=0.1.8
BootType=3
boot_part_ready=3
filesize=940100
fileaddr=8000000
ipaddr=192.168.1.1
serverip=192.168.1.100
boot_part=1
bootargs=console=ttyS1,115200n8 root=/dev/mtdblock6 ro rootfstype=jffs2 init=/sbin/init
stdin=serial
stdout=serial
stderr=serial

Environment size: 347/4092 bytes

badulesia · December 20, 2024, 3:55pm

There is a much easier method than this : the power button trick.
Power off, wait 5s
Power on, wait 10s
Repeat three (four ?) times. This will force the bootloader to change the booting partition.

change to boot_part=2, but the button method is much faster.

badulesia · December 20, 2024, 3:57pm

I have it if you want. Apparently Linksys support has gone rogue.

mk24 · December 20, 2024, 4:11pm

The problem is the memory address when booting initramfs. The initramfs is a compressed kernel that gets uncompressed and relocated to its proper location near the start of RAM 80000000. The problem is that you have loaded the compressed image into the same memory space that the uncompressed image needs, so when it starts to uncompress the data waiting to be uncompressed gets clobbered.

Load the image into RAM well away from where it will execute from. 0x82000000 is 32 MB above the start of RAM and will allow space.

uruzFR · December 20, 2024, 4:45pm

If you have it, I'm interested !

badulesia · December 20, 2024, 4:50pm

Enjoy

uruzFR · December 20, 2024, 4:52pm

Merci beaucoup

uruzFR · December 20, 2024, 4:55pm

Thank you so much for your advice! Loading the initramfs at 0x82000000 worked perfectly, and my router is now booting successfully.

frollic · December 20, 2024, 7:59pm

Told you to increase the mem address

system · December 30, 2024, 7:59pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.