[Solved] How to debrick E8450?

[dalutou]

I brick my E8450 when updating the u-boot.

I put these files on a tftp server

openwrt-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip
openwrt-mediatek-mt7622-linksys_e8450-ubi-preloader.bin (I didn't notice that this file is damaged, it's likely empty)
openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb
openwrt-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb

and run on E8450 with follow commands

fw_setenv bootcmd "run boot_tftp_write_bl2 && run boot_tftp_write_fip ; run reset_factory ; reset"
reboot

So, it bricked. When power on, no led is on.

I connect with tty serial, and get

F0: 102B 0000
F6: 3800 00A0
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
00: 1005 0000
F6: 3800 00A0
F3: 1006 0037
F3: 4000 00E0
F5: 480A 0031
F5: 480A 0031
01: 102A 0001
02: 1005 0000
BP: 0000 00C0 [0001]
T0: 0000 05B1 [000F]
System halt!

How to debrick E8450 with serial?
Can I write the u-boot to flash with tty serial?

@dangowrt

[dalutou]

The u-boot seems to have been damaged.

I have the oem mtd backups and openwrt mtds.

mtd0
mtd1
mtd2
mtd3

OpenWrt.mtd0-bl2.bin
OpenWrt.mtd1-fip.bin                           
OpenWrt.mtd2-factory.bin

[dangowrt]

You will need to connect JTAG, serial is not enough unfortunately at this stage. See https://github.com/mtk-openwrt/openocd-scripts for details.

[dalutou]

Thank you. I bought a USB DAPLink and JTag connector, hoping that after some learning, I can restore this router

[dalutou]

I tried to connect the JTAG using 4 wires (TMS/TCK/TDO/TDI), also tried TMS (5.1k pull-up), TCK (1k pull-down), but it doesn't work.

Run ./openocd -f e8450.cfg, got errors:

xPack Open On-Chip Debugger 0.12.0+dev-01312-g18281b0c4-dirty (2023-09-05-01:33)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : CMSIS-DAP: SWD supported
Info : CMSIS-DAP: JTAG supported
Info : CMSIS-DAP: Atomic commands supported
Info : CMSIS-DAP: FW Version = 0254
Info : CMSIS-DAP: Serial# = 070000814646dd270231323936373657a5a5a5a597969908
Info : CMSIS-DAP: Interface Initialised (JTAG)
Info : SWCLK/TCK = 1 SWDIO/TMS = 0 TDI = 0 TDO = 1 nTRST = 0 nRESET = 1
Info : CMSIS-DAP: Interface ready
Info : clock speed 500 kHz
Info : cmsis-dap JTAG TLR_RESET
Info : cmsis-dap JTAG TLR_RESET
Info : TAP mt7622.cpu does not have valid IDCODE (idcode=0x0)
Info : TAP auto0.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto1.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto2.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto3.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto4.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto5.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto6.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto7.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto8.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto9.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto10.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto11.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto12.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto13.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto14.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto15.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto16.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto17.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto18.tap does not have valid IDCODE (idcode=0x0)
Info : TAP auto19.tap does not have valid IDCODE (idcode=0x0)
Warn : Unexpected idcode after end of chain: 21 0x00000000
Warn : Unexpected idcode after end of chain: 53 0x00000000
Warn : Unexpected idcode after end of chain: 85 0x00000000
Warn : Unexpected idcode after end of chain: 117 0x00000000
Warn : Unexpected idcode after end of chain: 149 0x00000000
Warn : Unexpected idcode after end of chain: 181 0x00000000
Warn : Unexpected idcode after end of chain: 213 0x00000000
Warn : Unexpected idcode after end of chain: 245 0x00000000
Warn : Unexpected idcode after end of chain: 277 0x00000000
Warn : Unexpected idcode after end of chain: 309 0xfffff800
Error: double-check your JTAG setup (interface, speed, ...)
Error: Trying to use configured scan chain anyway...
Error: mt7622.cpu: IR capture error; saw 0x0f not 0x01
Info : cmsis-dap JTAG TLR_RESET
Warn : Bypassing JTAG setup events due to errors
Error: Invalid ACK (7) in DAP response

My config file, e8450.cfg

adapter driver cmsis-dap
transport select jtag
adapter speed 500
source [find target/mt7622.cfg]

Then I saw a photo by daniel here Belkin RT3200/Linksys E8450 WiFi AX discussion.
Maybe I can try it later. For now it's a homemade 4 wires from the network cable and pressed them onto the E8450's PINs with clips, the connection isn't very stable.
The 7 wires (TDI/TMS/TCK/RTCK/TDO/nSRST/GND) are probably more difficult with this method, so I'd better buy some rows of pins and solder them on. I'll keep updating my progress.

[dalutou]

Regarding the JTAG connection, I've been trying all day to get OpenOCD to work.

• OpenOCD 0.12 macOS
• Adapter: DapLink （adapter driver cmsis-dap）

The PIN connection is as follows.

E8450 PIN No.	PIN Name(I Think)	Adapter PIN
5	TDI	TDI
7	TMS	TMS (with 10k pull-up)
9	TCK	TCK (with 1k pull-down)
11	RTCK	RTCK
13	TDO	TDO
15	nSRST	nSRST （and try SRST）
2	GND	GND

My Adapter is a nanoDapLink, it DO NOT have TRST.

My config file

adapter driver cmsis-dap
transport select jtag
adapter speed 500

adapter srst delay 500
adapter srst pulse_width 200
reset_config srst_only

source [find target/mt7622.cfg]

I have tried several times to change the configuration file, but when I run it, it never connects successfully.

Power on the router, and run openocd, comes the errors below.

./openocd -f e8450.cfg
xPack Open On-Chip Debugger 0.12.0+dev-01312-g18281b0c4-dirty (2023-09-05-01:33)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : CMSIS-DAP: SWD supported
Info : CMSIS-DAP: JTAG supported
Info : CMSIS-DAP: Atomic commands supported
Info : CMSIS-DAP: FW Version = 0254
Info : CMSIS-DAP: Serial# = 070000814646dd270231323936373657a5a5a5a597969908
Info : CMSIS-DAP: Interface Initialised (JTAG)
Info : SWCLK/TCK = 1 SWDIO/TMS = 0 TDI = 0 TDO = 0 nTRST = 0 nRESET = 1
Info : CMSIS-DAP: Interface ready
Info : clock speed 500 kHz
Info : cmsis-dap JTAG TLR_RESET
Info : cmsis-dap JTAG TLR_RESET
Error: JTAG scan chain interrogation failed: all zeroes
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway...
Error: mt7622.cpu: IR capture error; saw 0x00 not 0x01
Info : cmsis-dap JTAG TLR_RESET
Warn : Bypassing JTAG setup events due to errors
Error: Invalid ACK (0) in DAP response

This problem has been bothering me for a few days now, and I've gone through a lot of information and forum posts, but none of them really solved the problem, so maybe I didn't understand the key points.

So I decided to buy a CH341A and write data directly to SPI NAND flash.

[dangowrt]

I've only tried this using FT2232H breakout board with some pull-up and pull-down resistors, and that worked fine with OpenOCD. Quite certainly you do need TRST signal.

[dalutou]

I replaced the router's flash(Fidelix FM35Q1GA) with a new SPI NAND FLASH (Winbond W25N01GV), but it didn't work.

Here is my steps:

1. Prepare a backup mtd

• Merge previously backed up openwrt mtds.
• cat bl2.bin fip.bin factory.bin > full-mtd.bin
• File size: bl2.bin(512KB), fip.bin(1280KB), factory.bin(128KB).

2. Write mtd backups to W25N01GV.

• Use a CH341A to write the mtd to new nand flash, https://github.com/McMCCRU/SNANDer
• ./SNANDer -v -w full-mtd.bin (not disable Flash ECC)

3. Replace the flash

• Using a soldering iron, carefully remove the old flash and solder on the new one.

4. Connect serial and power on

Not working, it shows somethings like this:

F0: 102B 0000
F6: 3800 00A0
F3: 4000 0036
F5: 480A 0031
F5: 480A 0031
00: 1005 0000
F6: 3800 00A0
F3: 1006 0037
F3: 4000 00E0
F5: 480A 0031
F5: 480A 0031
01: 102A 0001
02: 1005 0000
BP: 0000 00C0 [0001]
T0: 0000 05B1 [000F]
System halt!

I double-checked each step to make sure I didn't make mistake, or should I use vendor's backup mtds?
Worst case scenario, I've completely corrupted this router when trying to connect the jtag because of a short circuit or something.

I hope someone can give me some help.

[dangowrt]

You will need to write with OOB data matching MediaTek's BCH ECC engine which is used instead of the ECC of the NAND chip. I'm not sure there are publicly available tools for that, which is why I've always used JTAG and the device itself to rewrite the flash if needed.

[dalutou]

Thank you for the reply.
Looks like I've been going down the wrong path.
I will try a different jtag adapter next time, my DAPLINK (openocd cmsis-dap) doesn't have TRST, never had a successful connection.

[dalutou]

Today, I got the ram-boot u-boot running, and recovery my Linksys E8450.

Use jtag to load the u-boot on RAM.

U-Boot 2021.04-rc3-gdc001ffc7d-dirty (Mar 05 2021 - 17:10:16 +0800)

CPU:   MediaTek MT7622
Model: mt7622-rfb
DRAM:  256 MiB
WDT:   Started with servicing (60s timeout)
MMC:   mmc@11230000: 0, mmc@11240000: 1
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:
Warning: ethernet@1b100000 (eth0) using random MAC address - 76:cc:ef:68:5b:31
eth0: ethernet@1b100000
MT7622>

Then

setenv loadaddr 0x48000000
tftpboot openwrt-23.05.0-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb
bootm

Now, OpenWRT is running, the rest is easy.

1. copy the backup MTDs to /tmp. (I use vendor backup MTDs, scp to copy from computer, because scp computer to router not work.)
2. write the the MTD files to router. Like mtd write /tmp/backup_mtd0 bl2 etc.
3. reboot, enter the vendor u-boot from serial.
4. flash FW_E8450_1.1.00.180912_prod.img, then I have restoring the vendor firmware
5. reboot

The key step in the problem is the jtag connection, I use a FT4232HL USB to JTAG board.
OpenOCD with a patch is also essential, I use openocd 0.12.0 with the patch .

An inexplicable matter:
When jtag usb is connected to the router and the jtag usb is not plugged into the computer, the router will not boot when powered on and the led does not light up.
When the jtag usb is plugged into the computer, the led lights up and the router boots up normally.
If remove jtag wires, everythings is OK.

Thanks to Daniel, without you I would not have been able to find a way to solve the problem at all!

[satmandu]

@dalutou Do you have a link to a recommended FT4232HL jtag board?

[dalutou]

I got it from Taobao.com .
It may not be suitable for buyers outside of China. Perhaps you can search for FT4232HL on aliexpress.com

[ZimaBlue1996]

could you share the backup MTDs ? I have the same problem,ths.

[ZimaBlue1996]

Thank you for your help! I'll try it in the evening.

[ZimaBlue1996]

Thank you very much! It is work. I can into uboot

[dangowrt]

There is a new tool which allows to debrick via UART (no JTAG needed!)
https://github.com/981213/mtk_uartboot

To use it you need to build https://github.com/mtk-openwrt/arm-trusted-firmware/ with the RAM_BOOT_UART_DL and otherwise identical build options like the OpenWrt arm-trusted-firmware-mediatek package.

The you connect UART while the device is powered off and run the tool.

./mtk_uartboot --bl2-load-baudrate 921600 --brom-load-baudrate 115200 -s /dev/ttyUSB0 -p bl2.bin --aarch64 -f openwrt-23.05.2-mediatek-mt7622-linksys_e8450-ubi-bl31-uboot.fip ; screen /dev/ttyUSB0 115200

(careful: using snapshot builds of the uboot.fip file only works if you have previously run the updated installer. Use 23.05.2 release for debricking otherwise!)

Now power on the device, and interrupt boot in U-Boot where you can then carry out fixes

[dalutou]

• linksys_e8450-ubi-preloader.bin
• linksys_e8450-ubi-bl31-uboot.fip

Can I directly use the files in 23.0.5.2, or do I have to customize and compile ATF?

[dangowrt]

You should use fip image from 23.05.2 release.
You have to build https://github.com/mtk-openwrt/arm-trusted-firmware/ with the RAM_BOOT_UART_DL and otherwise identical build options like the OpenWrt arm-trusted-firmware-mediatek package.