fever365/owrt-ubi-installer

OpenWrt firmware installer for the Linksys E8450 aka. Belkin RT3200

An OpenWrt UBI Installer Image Generator for Linksys E8450 and Belkin RT3200

Showing.web.UI.and.serial.during.installation.mp4

Showing the installation process. The window on the right displays the serial RX interface for documentation purpose only. The interaction required is shown on the left, which is done entirely within the web browser.

WARNING #1 This will replace the bootloader (TF-A 2.4, U-Boot 2021.10) and convert the flash layout of the device to UBI. The installer stores a copy of the previous bootchain in a dedicated UBI volume boot_backup.

WARNING #2 Re-flashing the installer when the device is already using UBI flash layout will erase the previously backed up bootchain, which in most cases would be the vendor/official one.

If you plan to ever go back to the stock firmware, it's recommended that you make a complete backup of the device flash before running the installer. (see below "Device flash complete backup procedure")

Table of Contents

• Script information
• Installing OpenWrt
• Upgrading to the latest OpenWrt snapshot
• Enter recovery mode under OpenWrt
• Device flash complete backup procedure
• Restoring the vendor/official firmware

Script information

This script downloads the OpenWrt ImageBuilder to generate a release-like (i.e. LuCI included) sysupgrade image. The process involves re-packaging the initramfs image to contain everything necessary for a permanent recovery image within the NAND flash, including the installer script and the prerequisite installation images.

You'll need the below to use the script to generate the installer image:

• All prerequisites of the OpenWrt ImageBuilder
• libfdt-dev
• cmake

If you are not interested in building yourself, the pre-built files are available here.

Installing OpenWrt

Downgrade firmware

Upstream firmware version 1.1.x rejects the installer image. The recommended work-around is to downgrade to version 1.0 before running the installer.

• For Linksys E8450 FW_E8450_1.0.01.101415_prod.img
• For Belkin RT3200 FW_RT3200_1.0.01.101415_prod.img

Upstream firmware version 1.1.01.272918 or higher, including 1.2.x require using the _signed.itb image instead.

Assuming the device is running stock firmware version 1.0, and is brand new or just after factory reset.

To be 100% on the safe side consider doing the complete backup procedure before proceeding with the installation.

1. Connect any of the LAN ports of the device directly to the Ethernet port of your computer.
2. Set the IP address of your computer as 192.168.1.254 with netmask 255.255.255.0, no gateway, no DNS.
3. Power on the device, wait about a minute for it to be ready.
4. Open a web browser, navigate to http://192.168.1.1 and wait for the wizard to come up.
5. Click exactly inside the radio button to confirm the terms and conditions, then abort the wizard.
6. You should then be greeted by the login screen, the stock password is "admin".
7. Navigate to Administration -> Firmware Upgrade.
8. Upload openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb.
9. Wait for a minute, the OpenWrt recovery image should come up.
10. Navigate to System -> Backup / Flash Firmware.
11. Upload openwrt-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb.
12. The device will reboot, you may proceed to setup OpenWrt.
13. Follow the post install tips in the OpenWrt Wiki. You may proceed to setup OpenWrt.

Upgrading to the latest OpenWrt snapshot

WARNING SNAPSHOTS ARE LARGELY UNTESTED! PROCEED AT YOUR OWN RISK!

1. Backup the original/vendor bootchain (does not include original/vendor firmware).

   Connect to the device via SSH and enter the following commands:

   mkdir /tmp/boot_backup
   mount -t ubifs ubi0:boot_backup /tmp/boot_backup
   

   Then, copy the files under /tmp/boot_backup using scp to your computer. These files are needed in case you want to restore the original/vendor firmware. They can also be used in emergency case for reflashing via JTAG.

2. Both auc (attended sysupgrade command-line client) and luci-app-attendedsysupgrade (LuCI web-interface counterpart) are included since version 0.6. Simply run auc from the command-line, or navigate to System -> Attended Sysupgrade and proceed accordingly.

Enter recovery mode under OpenWrt

Using the RESET button:

1. Hold down the "reset" button (below the "WPS" button) whilst powering on the device.

2. Release the button once the power LED turns into orange/yellow.

This will remove any user configuration and allow restoring or upgrading from ssh/http/tftp.

Using PSTORE/ramoops

1. While running the production firmware enter this command in the shell

   echo c > /proc/sysrq-trigger
   

2. Once the router has rebooted into recovery mode, clear PSTORE to make it reboot into production mode again:

   rm /sys/fs/pstore/*
   

This keep user configuration but still allow restoring or upgrading from ssh/http/tftp.

Device flash complete backup procedure

Assuming the device is running stock firmware version 1.0

1. Flash openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb (note that this file doesn't have the word installer in its filename)

2. Backup

   • Via LuCi web-interface

     • Login http://192.168.1.1, then navigate to System -> Backup / Flash Firmware and save a copy of each of the mtdblock. Resist the temptation to flash anything from this page! You will likely need serial console access to repair the device. Make sure the mtdblock file size make sense as users have reported that they found their files have 0 bytes. In that case backup via SSH (see below) as an alternate method to backup the mtdblock files.

   • Via SSH (alternate backup method)

     • We are going to make a complete backup of the device (includes original/vendor firmware), connect to the device via SSH and enter the following commands:

       cd /dev
       for part in mtd[0123] ; do
       dd if=$part of=/tmp/$part
       done
       

     • Then, copy the resulting mtdx files found in the /tmp folder on the router to the computer using scp or WinSCP (the size of the mtd3 file has to be 125MB and make sure the size of the other files is the same, when you copy them to the computer).

3. Perform a powercycle to reboot into the original/vendor firmware (to perform a powercycle, unplug the device from the power source for about 30 seconds before plugging it back). In case the router does not reboot into the original/vendor firmware, but back into the OpenWrt initramfs system, don't worry (this may happen). Try another powercycle, or the reboot command via SSH. But don't try to go back to original/vendor firmware by flashing a firmware image!

4. When the device is running original/vendor firmware, perform a factory reset.

Do not attempt to flash anything (that includes the stock firmware, openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery-installer.itb etc.) from the running initramfs system -- it will fail to reboot, possibly requiring serial console access. Instead, powercycle the device to reboot into the original non-ubi firmware, and then flash the installer version.

Restoring the vendor/official firmware

⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️

Bad blocks are not handled in the way the stock firmware and loader expects it. Ie. if you are lucky enough to own a device which got a bad block in the first ~22MiB of the SPI-NAND flash, then you will need to flash using TFTP which can only be triggered using the boot menu accessible via the serial console.

Be prepared to open the device and wire up the serial console!

1. Boot into recovery mode, either by flashing openwrt-mediatek-mt7622-linksys_e8450-ubi-initramfs-recovery.itb (note that this file doesn't have the word installer in its filename) or by holding the RESET button while connecting the device to power or by issuing echo c > /proc/sysrq-trigger while running the production firmware.
2. Use scp or WinSCP to copy the mtdx files to the /tmp folder on the router (the complete backup that you have on your computer), which is the original/vendor bootchain and firmware (the size of the mtd3 file has to be 125MB and make sure the size of the other files is the same, when you copy them to the router). In case you only got the minimal backup (mtd3 file size is 2MB), also upload the original/vendor firmware.
3. Connect to the device via SSH and enter the following commands:

ubidetach -d 0
insmod mtd-rw i_want_a_brick=1
mtd write /tmp/mtd0 /dev/mtd0
mtd write /tmp/mtd1 /dev/mtd1
mtd write /tmp/mtd2 /dev/mtd2
mtd write /tmp/mtd3 /dev/mtd3

In case you were using the minimal backup files, now write the original/vendor firmware:

# On Linksys E8450
mtd -p 0x200000 write /tmp/FW_E8450_1.0.01.101415_prod.img /dev/mtd3

# On Belkin RT3200
mtd -p 0x200000 write /tmp/FW_RT3200_1.0.01.101415_prod.img /dev/mtd3

4. Reboot the device and wait about a minute for it to be ready.
5. If you use the complete backup, after rebooting, the router will boot into the initramfs system, you will need perform a powercycle to reboot into the original/vendor firmware (to perform a powercycle, unplug the device from the power source for about 30 seconds before plugging it back).