Linksys E7350 Serial Port Problem or downgrade method

are there detailed instructions anywhere I can add to the wiki?

printenv
autostart=yes
baudrate=115200
boot_ver=V1.0
bootcmd=mtkautoboot
bootcount=10
bootdelay=0
bootfile=openwrt-ramips-mt7621-belkin_rt1800-squashfs-sysupgrade.bin
bootfile.firmware=openwrt-ramips-mt7621-belkin_rt1800-squashfs-factory.bin
bootimage=2
bootmenu_0=Startup system (Default)=mtkboardboot
bootmenu_1=Upgrade firmware=mtkupgrade fw
bootmenu_2=Upgrade bootloader=mtkupgrade bl
bootmenu_3=Upgrade bootloader (advanced mode)=mtkupgrade bladv
bootmenu_4=Load image=mtkload
bootmenu_5=Upgrade firmware with code pattern=mtkupgrade pfw
ethact=eth@1e100000
fdtcontroladdr=8ffece60
fileaddr=80010000
filesize=69cc35
ipaddr=192.168.1.1
loadaddr=0x80010000
mtddevname=u-boot
mtddevnum=0
mtdids=nand0=ranand
mtdparts=mtdparts=ranand:512k(u-boot),512k(u-boot-env),512k(factory),48m(firmware),-(firmware_2)
netmask=255.255.255.0
partition=nand0,0
serverip=192.168.1.2
stderr=uartlite0@1e000c00
stdin=uartlite0@1e000c00
stdout=uartlite0@1e000c00

so installing factory.bin via web interface does not work, tried both available rt1800 firmware.
Trying to tftpboot the current snapshot, error cant find kernel.

Saving Environment to NAND... Erasing NAND...
Erasing at 0x80000 -- 100% complete.
Writing to NAND... OK
OK
#####CBT_BOOT_VERSION=[V1.0]######
#####boot_count=[11] boot_part=[1] boot_change=[1]######

Loading from nand0, offset 0x180000
** Unknown image type
no partition number specified

Loading from nand0, offset 0x180000
** Unknown image type
=> 

so could someone advise how to get out of uboot please

dont connect GND until after initial boot up

So the error message when tftpbooting is can't find kernel.
Doesn't matter what I try.

Can someone tell me if my uboot printenv is correct?
This was from today's snapshot, tried both sysupgrade and factory images.

Anyone have a working version as snapshot could be broken.

tftpboot
Using eth@1e100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-ramips-mt7621-belkin_rt1800-squashfs-sysupgrade.bin'.
Load address: 0x80010000
Loading: T #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ##################
	 433.6 KiB/s
done
Bytes transferred = 6933557 (69cc35 hex)
Automatic boot of image at addr 0x80010000 ...
Wrong Image Format for tftpboot command
ERROR: can't get kernel image!

git commit from @neheb matches what is trying to load

*** Loading image ***

Input load address: 0x80010000

Available load methods:
    0 - TFTP client (Default)
    1 - Xmodem
    2 - Ymodem
    3 - Kermit
    4 - S-Record

Select (enter for default): 0

Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.2
Input IP netmask: 255.255.255.0
Input file name: sysupgrade.img                                             

Using eth@1e100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'sysupgrade.img'.
Load address: 0x80010000
Loading: T #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ##################
	 1.2 MiB/s
done
Bytes transferred = 6933557 (69cc35 hex)

*** Loaded 6933557 (0x69cc35) bytes at 0x80010000 ***

Run loaded data now? (Y/n): y
Wrong Image Format for <NULL> command
ERROR: can't get kernel image!

Very strange. My RT1800 is in production right now so I can’t really do any testing.

My advice currently is to try flashing stock firmware, as old as possible and try flashing the factory. After two reboots of course.

Well that was a painful learning experience,

tl;dr tftpboot the belkin_rt1800-initramfs-kernel.bin

after that flash sysupgrade after scp it to the device.

@neheb my firmware version is FW_RT1800_V1.1.00.005, it's probably something ancient in the firmware causing the issue.

My RT1800 arrived with "Current firmware version: 1.0.00.005"
Updated it with FW_RT1800_V1.1.00.016_Prod_20210723_code.bin
Web interface showed "Firmware Version 1.1.00 build 16 Jul 23, 2021"
Then upgraded it with -factory.bin first, then finally with -sysupgrade.bin (built with Luci) using scp/ssh.

Nice to know you have a -factory.bin that works, can you share it?

Both -factory.bin and -sysupgrade.bin were downloaded from the firmware-selector
https://downloads.openwrt.org/snapshots/targets/ramips/mt7621/openwrt-ramips-mt7621-belkin_rt1800-squashfs-factory.bin

That's not that helpful, if you go to https://firmware-selector.openwrt.org/ and choose Snapshot;

Firmware selector currently shows:

Model:
Belkin RT1800
Platform:
ramips/mt7621
Version:
SNAPSHOT (r22071-3c66ac7e22)
Date:
2023-02-15 20:22:37

The current snapshot -factory.bin does not work on either RT1800 I have here, one has had to be converted via serial, the other is still on FW_RT1800_V1.1.00.005, so which version did you use as the install process is currently broken and I would like to help other users from not having to crack open the case, if the web interface method is meant to work.

It did work for me, all the versions are in my first post.

that version is not even mentioned in the release notes

so the snapshot from the 15th February 2023 worked for you?

that's correct

So I'm currently following your process, -factory.bin was accepted but I'm back in the belkin 17.01 reboot stock firmware.

I'll try a factory reset and report back.
Took three attempts, but the web upgrade method finally worked.

Hi there,

I try this pin layout and I think I always using wrong pin to connect console.
And I installed OpenWRT on my E7350 successful.

I choose 6. Upgrade firmware with code pattern and upload bin file(sorry I forgot which file I upload,kernel or factory).

Available load methods:
    0 - TFTP client (Default)
    1 - Xmodem
    2 - Ymodem
    3 - Kermit
    4 - S-Record

Select (enter for default): 

Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.2
Input IP netmask: 255.255.255.0
Input file name: e7350.bin

Using eth@1e100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'e7350.bin'.
Load address: 0x80010000
Loading: *T #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ################################
	 1.5 MiB/s
done
Bytes transferred = 9044000 (8a0020 hex)

*** Loaded 9044000 (0x8a0020) bytes at 0x80010000 ***


 Image Code pattern is ok !  


Erasing from 0x3180000 to 0x3a1ffff, size 0x8a0000 ... OK
Writting from 0x80010020 to 0x3180000, size 0x8a0000 ... OK

*** Firmware_2 upgrade completed! ***

Erasing from 0x180000 to 0xa1ffff, size 0x8a0000 ... OK
Writting from 0x80010020 to 0x180000, size 0x8a0000 ... OK

*** Firmware upgrade completed! ***

Hit any key to stop firmware bootup:  3  2  1  0 
Saving Environment to NAND... Erasing NAND...
Erasing at 0x80000 -- 100% complete.
Writing to NAND... OK
OK
#####CBT_BOOT_VERSION=[V0.2]######
#####boot_count=[4] boot_part=[2] boot_change=[1]######

Loading from nand0, offset 0x3180000
Fit image detected...
   FIT description: MIPS OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel-1)
     Description:  MIPS OpenWrt Linux-5.10.166
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x800100e4
     Data Size:    2859345 Bytes = 2.7 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x82000000
     Entry Point:  0x82000000
     Hash algo:    crc32
     Hash value:   8b672671
     Hash algo:    sha1
     Hash value:   7153fb1177a0b087c4742d419cdf9212bc39aa09
    Image 1 (fdt-1)
     Description:  MIPS OpenWrt linksys_e7350 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x802ca374
     Data Size:    10468 Bytes = 10.2 KiB
     Architecture: MIPS
     Hash algo:    crc32
     Hash value:   b793cf8c
     Hash algo:    sha1
     Hash value:   c8c0cba37bde8383bf157394343ff29dce87e246
    Default Configuration: 'config-1'
    Configuration 0 (config-1)
     Description:  OpenWrt linksys_e7350
     Kernel:       kernel-1
     FDT:          fdt-1
Automatic boot of image at addr 0x80010000 ...
## Loading kernel from FIT Image at 80010000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  MIPS OpenWrt Linux-5.10.166
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x800100e4
     Data Size:    2859345 Bytes = 2.7 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x82000000
     Entry Point:  0x82000000
     Hash algo:    crc32
     Hash value:   8b672671
     Hash algo:    sha1
     Hash value:   7153fb1177a0b087c4742d419cdf9212bc39aa09
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 80010000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  MIPS OpenWrt linksys_e7350 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x802ca374
     Data Size:    10468 Bytes = 10.2 KiB
     Architecture: MIPS
     Hash algo:    crc32
     Hash value:   b793cf8c
     Hash algo:    sha1
     Hash value:   c8c0cba37bde8383bf157394343ff29dce87e246
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x802ca374
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 8fe77000, end 8fe7c8e3 ... OK
[    0.000000] Linux version 5.10.166 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22000-6bc675c0be) 12.2.0, GNU ld (GNU Binutils) 2.39) #0 SMP Sun Feb 5 21:39:17 2023

That is! Thanks everyone for help.

But after I installed OpenWRT,the new problem is wifi can't use.
There has no wireless config, seem the kernel not found wifi chip.(using snapshot image).

1 Like

OK Finally.
I using openwrt master branch, compile my own image.
Using kernel 5.15.95 instand of 5.10.166.
Radio works well now.


Saving Environment to NAND... Erasing NAND...
Erasing at 0x80000 -- 100% complete.
Writing to NAND... OK
OK
#####CBT_BOOT_VERSION=[V0.2]######
#####boot_count=[1] boot_part=[2] boot_change=[0]######

Loading from nand0, offset 0x3180000
Fit image detected...
   FIT description: MIPS OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel-1)
     Description:  MIPS OpenWrt Linux-5.15.93
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x800100e4
     Data Size:    2917995 Bytes = 2.8 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x82000000
     Entry Point:  0x82000000
     Hash algo:    crc32
     Hash value:   b528352d
     Hash algo:    sha1
     Hash value:   98a2587eb3a7aedeec82ff9066141dacee894f87
    Image 1 (fdt-1)
     Description:  MIPS OpenWrt linksys_e7350 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x802d888c
     Data Size:    10967 Bytes = 10.7 KiB
     Architecture: MIPS
     Hash algo:    crc32
     Hash value:   de228174
     Hash algo:    sha1
     Hash value:   97fed96297482a7847f4b1e61d945c052ca3f0d1
    Default Configuration: 'config-1'
    Configuration 0 (config-1)
     Description:  OpenWrt linksys_e7350
     Kernel:       kernel-1
     FDT:          fdt-1
Automatic boot of image at addr 0x80010000 ...
## Loading kernel from FIT Image at 80010000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  MIPS OpenWrt Linux-5.15.93
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x800100e4
     Data Size:    2917995 Bytes = 2.8 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x82000000
     Entry Point:  0x82000000
     Hash algo:    crc32
     Hash value:   b528352d
     Hash algo:    sha1
     Hash value:   98a2587eb3a7aedeec82ff9066141dacee894f87
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 80010000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  MIPS OpenWrt linksys_e7350 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x802d888c
     Data Size:    10967 Bytes = 10.7 KiB
     Architecture: MIPS
     Hash algo:    crc32
     Hash value:   de228174
     Hash algo:    sha1
     Hash value:   97fed96297482a7847f4b1e61d945c052ca3f0d1
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x802d888c
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 8fe76000, end 8fe7bad6 ... OK
[    0.000000] Linux version 5.15.93 (glucose@B550M-DS3H-Gentoo) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 3
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3

and

[   10.998786] kmodloader: loading kernel modules from /etc/modules.d/*
[   11.036934] urngd: v1.0.2 started.
[   11.214771] random: crng init done
[   11.218201] random: 30 urandom warning(s) missed due to ratelimiting
[   11.240686] tun: Universal TUN/TAP device driver, 1.6
[   11.254900] GACT probability on
[   11.259717] Mirror/redirect action on
[   11.276466] u32 classifier
[   11.279204]     input device check on
[   11.282871]     Actions configured
[   11.316512] Loading modules backported from Linux version v6.1-rc8-0-g76dcd734eca2
[   11.324129] Backport generated by backports.git v5.15.81-1-41-g02e352527db5
[   11.390124] xt_time: kernel timezone is -0000
[   11.562724] pci 0000:00:00.0: enabling device (0004 -> 0007)
[   11.568417] mt7915e_hif 0000:01:00.0: enabling device (0000 -> 0002)
[   11.575460] pci 0000:00:01.0: enabling device (0004 -> 0007)
[   11.581220] mt7915e 0000:02:00.0: enabling device (0000 -> 0002)
[   11.849826] mt7915e 0000:02:00.0: HW/SW Version: 0x8a108a10, Build Time: 20220929104113a
[   11.849826] 
[   12.181975] mt7915e 0000:02:00.0: WM Firmware Version: ____000000, Build Time: 20220929104145
[   12.219994] mt7915e 0000:02:00.0: WA Firmware Version: DEV_000000, Build Time: 20220929104205

This I'm sure is factory image because I only can update kernel using U-boot (sysupgrade can update system but can not update kernel).

1 Like

New attempt with virgin E7350: (No longer have prior unit)

This time working with a virgin E7350 that came with 1.0.00 build 24 (Sep 23, 2020). The -factory.bin from firmware selector says "upgrade successful" but keeps rebooting to stock, Tried this multiple times.

This one I am willing to crack open if necessary but for now I am trying this as if someone just bought this and have not updated the unit to the most current which is build 1.0.00 build 33(signed -10/04/2022).

1 Like

The e7350 is a dual boot unit.

So you're getting boot partition 2 load each time instead of partition 1 where you flashed openwrt successfully but it's refusing to boot into it.

Try installing the unsigned latest firmware. And then trying to flash openwrt factory again.

No luck. Installed latest available unsigned firmware (1.1.00.032 - Oct 04, 2022). Then from there in gets to about 33% on -factory.bin on each attempt, says flash unsuccessful and then reboots. Any ideas?

I could open up and serial cable at this point but I'm trying to go about all of this as an "average joe" as much as I can because most users who get this model are NOT going have this skill or desire to open up the unit.

Hoping the Dev's can figure this out. It may not be possible to install it at this time.

I would try the initramfs kernel bin, but that's unlikely to work from the web interface.

What's happening is clear, there's rt1800 and e7350 out there with corrupted boot partition 1 that only boot from partition 2.

Connecting UART allows the uboot to finally format the partition 1 allowing openwrt to install.

Sounds like I'm going to have to open up it up after all then.