I was able to work around the problem with the following:

http://download1.dd-wrt.de/phpBB2/viewt … ;start=315

setup serial connection
interrupt boot-up
setenv image EA8500-factory-to-ddwrt.img
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
run flashimg
run flashimg2
reset

then repeat using lede img

I was not able to go back to stock fw, but that's ok for now!

Hello!

It would be nice to get the wiki updated with more information for this router:

https://wiki.openwrt.org/toh/linksys/linksys_ea8500

I was specifically looking for board pictures, the uboot smeminfo output and a few other things.

I was looking at the smem/mtdparts layout. Why do they have the kernel partition overlap the root/ubi partitions?

Hello, i have a problem with my ea8500. Now i have installed openwrt-ipq806x-EA8500-squashfs-factory.bin (from there) but wifi module not working

I try change firmware to lede (from second post in this topic) but i have a problem. In luci when I upload image device has been restarted but firmware is still the same.

From sysupgrade in ssh:

root@OpenWrt:/# sysupgrade -v /tmp/lede-ipq806x-EA8500-squashfs-sysupgrade.tar 
Saving config files...
etc/config/dhcp
etc/config/dropbear
etc/config/firewall
etc/config/luci
etc/config/network
etc/config/rpcd
etc/config/system
etc/config/ubootenv
etc/config/ucitrack
etc/config/uhttpd
etc/dropbear/dropbear_rsa_host_key
etc/fw_env.config
etc/group
etc/hosts
etc/inittab
etc/luci-uploads/.placeholder
etc/opkg/keys/af22f7a88858c8e9
etc/passwd
etc/profile
etc/rc.local
etc/shadow
etc/shells
etc/sysctl.conf
etc/sysctl.d/local.conf
cp: can't create '/tmp/syscfg/sysupgrade.tgz': No such file or directory
cp: can't create '/tmp/syscfg/sysupgrade.tgz': No such file or directory
Sending TERM to remaining processes ... sh ubusd askfirst logd rpcd netifd odhcpd uhttpd ntpd dnsmasq 
Sending KILL to remaining processes ... askfirst 
Switching to ramdisk...
Performing system upgrade...
Unlocking kernel2 ...

Writing from <stdin> to kernel2 ...     
UBI device number 1, total 296 LEBs (37584896 bytes, 35.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
ubimkvol: error!: UBI device does not have free logical eraseblocks
cannot create rootfs volume
libubi: error!: "/dev/" is not a character device
ubiupdatevol: error!: error while probing "/dev/"
              error 22 (Invalid argument)
mount: mounting /dev/ on /tmp/new_root failed: Invalid argument
mounting ubifs  failed
sysupgrade successful

With mtd I can't upgrade because I don't have firmware or linux partition:

root@OpenWrt:/# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00020000 "SBL1"
mtd1: 00140000 00020000 "MIBIB"
mtd2: 00140000 00020000 "SBL2"
mtd3: 00280000 00020000 "SBL3"
mtd4: 00120000 00020000 "DDRCONFIG"
mtd5: 00120000 00020000 "SSD"
mtd6: 00280000 00020000 "TZ"
mtd7: 00280000 00020000 "RPM"
mtd8: 00140000 00020000 "art"
mtd9: 00100000 00020000 "APPSBL"
mtd10: 00040000 00020000 "u_env"
mtd11: 00040000 00020000 "s_env"
mtd12: 00040000 00020000 "devinfo"
mtd13: 02800000 00020000 "kernel1"
mtd14: 02500000 00020000 "rootfs1"
mtd15: 02800000 00020000 "kernel2"
mtd16: 02500000 00020000 "rootfs2"
mtd17: 02080000 00020000 "syscfg"

Please help me how I can change firmware or reverse to original

EDIT:
I tried write factory image to kernel2, after reboot I had still the same image (from openwrt) but now I could use sysupgrade with ledo image Now I have ledo system and working wifi!

(Last edited by it23589236847236 on 11 Aug 2016, 11:47)

Hello all,

It seems that the sysupgrade function is failing on the latest snapshots. I have downloaded the snaphots 'openwrt-ipq806x-EA8500-squashfs-sysupgrade.tar' (from https://downloads.openwrt.org/snapshots … x/generic/) on august 21th (md5: c8ab5bdbd9b0cb63932d73c3bcdaa728) and august 22th (md5: 03f4c350be9919a58d011088434a88ef).

I've tried to flash a sysupgrade in LuCI (System ->Backup/Flash Firmware -> upload flash image.

After submitting the upload the device tries to reboot, but the boot fails. The power led turns off and doesn't turn on. De leds on the lan ports are blinking and after some time the lan connection between device and pc is not working anymore.  Most likely the device is bricked.

I can debrick the device by using the fail safe function of this device: try to boot 3 times, after a third failed boot the device boots the last working firmware.

The sysupgrade fails with or without the option 'keep settings'.

The sysupgrade for the snapshot uploaded on august 8th does work (firmwareversion is 'Lede Ianchi-full 160624.0934 r935 / LuCI Master (git-16.171.60975-65c7610' and the kernel version is 4.4.13).

Please help?

(Last edited by dino3000 on 23 Aug 2016, 01:17)

Report:
- hardware and firmware: Linksys EA8500-AH + stock firmware version: 168206
- openwrt firmware: downloads.lede-project.org/snapshots/targets/ipq806x/generic/

I flashed bin file and did sysupgrade, it works. Thanks a lot.
I've tried several days on DD-wrt, this one is more favourable, not way to use DD-wrt again.

First of all thank you very much for the Linksys EA8500 patch. It works very well on the latest LEDE trunk.

Question - any idea how to get the real ethernet interface MACs? For example, the phy0/1 wifi macs are correct, but all the ethernet ports have a random/fake MAC. ifconfig shows:

`wlan0 ESSID: "LEDE"
Access Point: C0:56:27:25:7B:DA
Mode: Master Channel: 11 (2.462 GHz)
Tx-Power: 30 dBm Link Quality: unknown/70
Signal: unknown Noise: unknown
Bit Rate: unknown
Encryption: none
Type: nl80211 HW Mode(s): 802.11bgn
Hardware: 168C:0040 168C:0002 [Generic MAC80211]
TX power offset: unknown
Frequency offset: unknown
Supports VAPs: yes PHY name: phy0

wlan1 ESSID: "LEDE"
Access Point: C0:56:27:25:7B:DB
Mode: Master Channel: 36 (5.180 GHz)
Tx-Power: 23 dBm Link Quality: unknown/70
Signal: unknown Noise: -104 dBm
Bit Rate: unknown
Encryption: none
Type: nl80211 HW Mode(s): 802.11nac
Hardware: 168C:0040 168C:0002 [Generic MAC80211]
TX power offset: unknown
Frequency offset: unknown
Supports VAPs: yes PHY name: phy1

br-lan Link encap:Ethernet HWaddr 00:06:3B:01:41:00
inet addr:172.16.25.25 Bcast:172.16.25.255 Mask:255.255.255.0
inet6 addr: fe80::206:3bff:fe01:4100/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6738 errors:0 dropped:0 overruns:0 frame:0
TX packets:19113 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1061754 (1.0 MiB) TX bytes:26872381 (25.6 MiB)

eth0 Link encap:Ethernet HWaddr 00:06:3B:01:41:00
inet6 addr: fe80::206:3bff:fe01:4100/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:32729 errors:0 dropped:0 overruns:0 frame:0
TX packets:25537 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:28999723 (27.6 MiB) TX bytes:28072864 (26.7 MiB)
Interrupt:31

eth0.1 Link encap:Ethernet HWaddr 00:06:3B:01:41:00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6852 errors:0 dropped:4 overruns:0 frame:0
TX packets:19100 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1115550 (1.0 MiB) TX bytes:26870903 (25.6 MiB)

eth0.2 Link encap:Ethernet HWaddr 00:06:3B:01:41:00
inet addr:172.16.40.51 Bcast:172.16.41.255 Mask:255.255.254.0
inet6 addr: fe80::206:3bff:fe01:4100/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:11970 errors:0 dropped:706 overruns:0 frame:0
TX packets:6425 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:26738771 (25.5 MiB) TX bytes:1098535 (1.0 MiB)

eth1 Link encap:Ethernet HWaddr 00:03:7F:BA:DB:02
inet6 addr: fe80::203:7fff:feba:db02/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:27 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:2474 (2.4 KiB)
Interrupt:32

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:632 (632.0 B) TX bytes:632 (632.0 B)

wlan0 Link encap:Ethernet HWaddr C0:56:27:25:7B:DA
inet6 addr: fe80::c256:27ff:fe25:7bda/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:1288 (1.2 KiB)

wlan1 Link encap:Ethernet HWaddr C0:56:27:25:7B:DB
inet6 addr: fe80::c256:27ff:fe25:7bdb/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:1120 (1.0 KiB)
`

The real MAC on the router label/sticker is C0:56:27:25:7B:D9

See link :https://goo.gl/photos/3EvMHrLa4Fd38ABv6

Any thoughts?

Thank you

All of the ipq806x systems have this problem, including the EA8500. The system uses a default MAC address for the ethernet ports. So, if you buy any two ipq806x systems and put them on the same network, their ethernet MAC addresses will conflict! The same would be true of the 802.11 MAC addresses, but they have been fixed already (with a half-assed patch).

The way I fixed this in the router I ported to LEDE was to add a preinit script, as you can see here:

http://jmomo.net/files/lede/v3-0002-ipq … 7dru.patch

Look at the target/linux/ipq806x/base-files/lib/preinit/06_set_iface_mac file

Note that this file must exist in the squashfs image. Putting it onto the overlay image won't work, because that's too late for preinit. You would need to build your own image.

I would suggest submitting a patch to this device, but the LEDE devs have given me a real hard time about this fix for ideological/emotional reasons. Still, this is the best way I know of how to fix it.

(Last edited by jmomo on 3 Nov 2016, 12:21)

Thanks for the info!

I have attempted what you said (we already build our images from source anyway so that's no problem)

I added the following file to preinit/06_set_iface_mac and it is being called at boot but still not setting the MAC

When I cat /tmp/lan after boot, the MAC is not in there either.

Any way I can perform checks whilst the device is running? Does the 06_set_iface_mac get run on every boot so  can mod that file directly without having to do a new firmware build every time?

Thanks

That "APPSBLENV" is a partition name on my device (tew827dru), but doesn't exist on the EA8500. You need to localize it for your platform.

I don't have an ea8500 to test with, but you will need to figure out how to discover the WAN and LAN MAC addresses.

The 802.11 MAC addresses are fixed here in this file:
target/linux/ipq806x/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac

This is the command substitution used the determine the MAC address on the ea8500:

$(mtd_get_mac_ascii devinfo hw_mac_addr)

So the ea8500 has a NAND partition named "devinfo", and it looks like there is a field/element named "hw_mac_addr" in it.

The way the 802.11 MAC addresses are defined is "$(macaddr_add $(mtd_get_mac_ascii APPSBLENV wan_mac) $(($PHYNBR + 1)) )". The problem here is that if you get hardware with adjacent addresses, you might still get conflicts, but it's better than doing nothing.

Try using this:

This should set your eth0 to the MAC address on the label, and eth1 will the be MAC address -1.

The result should be something like:
  eth0 = hw_mac_addr
  eth1 = hw_mac_addr -1
  wlan0 = hw_mac_addr +1
  wlan1 = hw_mac_addr +2

(Last edited by jmomo on 4 Nov 2016, 00:30)

That works, brilliant. And it can be done in a script on overlay, no need to compile in at boot (though I will be doing).

Some other nice info in the "devinfo" partition also, like the original wireless key, serial number, wps pin and manufactured date.

Thanks again.

To the best of my knowledge, not correct. The problem is VLAN sub interfaces. If you have any, they will all use the garbage MAC addresses because they inherit the MAC address of the parent interface at creation time, which is after preinit, but before most of the stuff in your overlay gets run. It probably looks right for your simple/default setup, but there are consequences for not doing it in preinit. That's what the "preinit" part of boot stage was designed for -- kind of like a replacement for an initrd since most of these devices don't have an initrd.

Absolutely correct. Sorry, I meant you can get the MAC from the partition whilst the router is up and running, not that you should run the script at that point and set the iface MAC. That should definitely be done preinit.

Thanks

Also, is there a tested method of getting back to original Linksys EA8500 firmware yet, via mtd flash, TFTP or serial console?

Hello all, I am testing too the lede firmware with the UK version of this router (that I think it is just a world one maybe? how can I recognize it). Seems to work everything apart setting the router static ip of the LAN interface to 192.168.0.1.

Do you know if it is a known bug?! Seems so strange that all other ip ranges works.

When I flash the firmware, I just install luci, and change the ip to 192.168.0.1. After this, ssh and luci stop to work. Rebooting the router or forcing my pc to find a new address with the dhcp configured in the 192.168.0.1/24 network, I can ping the router, but ssh and luci still doesn't work. Even telnet doesn't work.

EDIT: just to clarify, 192.168.1.1 works fine, another ip in the 192.168.1.1/24 range is ok, in the 192.168.2.1/24 is again ok (and I think for whichever network until the very last one).

In the 192.168.0.1/24 network, I can give to the router all the ip addresses that I want, apart the 192.168.0.1 that will automatically disable ssh and luci... ping will still work.

I tested 192.168.0.2, 192.168.0.20 and 192.168.0.254... they all works, just the .1 seems to don't work

(Last edited by etomm on 5 Nov 2016, 22:58)

For the last two questions, you guys should hit up Ianchi -- he's the lead dev for the ea8500. Look up his Github page and post something there. I have not seen him here on this thread for a long time, so I'm not sure he bothers to check it anymore.

Unfortunately the router resets... much for my tastes.

As particular packages I have installed OpenVPN, dnsmasq-full, wpad, strongswan, mwan3. I am having 4 2.4GHZ and 2 5GHZ networks, 8 interfaces defined, 5 zones in the firewall and 4 openvpn connections.

Too much unstable still.

BTW passing to the latest trunk solved the problem with 192.168.0.1 ip address.

(Last edited by etomm on 7 Nov 2016, 20:22)

Is it possible to fix the mac addresses on VLAN sub interfaces after device has booted? Can I not have some sort of uci-defaults script for that?

Not sure what you are trying to ask. You literally answered your own question. The changes I posted fix the problem you asked about. The text above confirms that. Drunk at keyboard?

(Last edited by jmomo on 21 Nov 2016, 08:44)

I'm sorry if my question didn't pass your sobriety test. Feel free not to answer the questions you don't understand or seek clarification in a more civilized way.

Hopefully @tedster22 can answer then -- do uci-scripts run early enough for the code above to work?

hi guys!
i flashed lede-ipq806x-EA8500-squashfs-factory.bin, and tray to flash lede-ipq806x-EA8500-squashfs-sysupgrade.tar   

have error, end dont have admin panel on 192.168.1.1 only ssh

my error is ...

root@lede:/tmp# sysupgrade -v lede-ipq806x-EA8500-squashfs-sysupgrade.tar
Saving config files...
etc/config/dhcp
etc/config/dropbear
etc/config/firewall
etc/config/network
etc/config/system
etc/config/ubootenv
etc/config/wireless
etc/dropbear/dropbear_rsa_host_key
etc/fw_env.config
etc/group
etc/hosts
etc/inittab
etc/opkg/keys/72a57f2191b211e0
etc/opkg/keys/9ef4694208102c43
etc/opkg/keys/b5043e70f9a75cde
etc/opkg/keys/dace9d4df16896bf
etc/opkg/keys/dd6de0d06bbd3d85
etc/passwd
etc/profile
etc/rc.local
etc/shadow
etc/shells
etc/sysctl.conf
etc/sysctl.d/local.conf
cp: can't create '/tmp/syscfg/sysupgrade.tgz': No such file or directory
cp: can't create '/tmp/syscfg/sysupgrade.tgz': No such file or directory
Sending TERM to remaining processes ... ubusd askfirst logd netifd odhcpd ntpd dnsmasq
Sending KILL to remaining processes ... askfirst
Switching to ramdisk...
Performing system upgrade...
Unlocking kernel1 ...

Writing from <stdin> to kernel1 ...
UBI device number 1, total 296 LEBs (37584896 bytes, 35.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
Volume ID 0, size 22 LEBs (2793472 bytes, 2.7 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 31744000
Volume ID 1, size 250 LEBs (31744000 bytes, 30.3 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev/pts: Resource busy
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy

root@lede:~#
root@lede:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00020000 "SBL1"
mtd1: 00140000 00020000 "MIBIB"
mtd2: 00140000 00020000 "SBL2"
mtd3: 00280000 00020000 "SBL3"
mtd4: 00120000 00020000 "DDRCONFIG"
mtd5: 00120000 00020000 "SSD"
mtd6: 00280000 00020000 "TZ"
mtd7: 00280000 00020000 "RPM"
mtd8: 00140000 00020000 "art"
mtd9: 00100000 00020000 "APPSBL"
mtd10: 00040000 00020000 "u_env"
mtd11: 00040000 00020000 "s_env"
mtd12: 00040000 00020000 "devinfo"
mtd13: 02800000 00020000 "kernel1"
mtd14: 02500000 00020000 "rootfs1"
mtd15: 02800000 00020000 "kernel2"
mtd16: 02500000 00020000 "rootfs2"
mtd17: 02080000 00020000 "syscfg"

help me plz

(Last edited by ukr-ix on 21 Nov 2016, 13:56)

Hi Ianchi,
I just used your openwrt for my EA8500. I found it is too complicated for me. I want to roll back.
I have put the factory 8500 bin file in /mtp direction, and i used mac terminal to type what you mentioned here.
However, I got this messge: revert.sh: not found