Flashing OpenWrt on Linksys MR8300 - partially bricked

dck · May 4, 2020, 9:02am

What speed of transfer you got over the tftp?

GillyMoMo · May 4, 2020, 2:59pm

It was a couple megs or so. So in order to flash Openwrt on the MR8300 it must be on partition 2 and not partition 1.

So do the following:

Boot into U-boot
tftp 84000000 [filename].itb (initramfs)
bootipq
bootm (this loads your tftp flash from memory)
Login to OpenWRT
Go to update firmware and flash the sysupgrade.bin
After reboot you'll have a good running openwrt router.

So there isn't any needed drivers or builds required other than the one built for the EA8300. It has more RAM than the EA8300 and I am not sure about space. Also the bluetooth doesn't work either. I am running this as we speak and I haven't seen any issues. So this can be listed as usable just the means of flashing is via tftp only.

Breakshadow · May 26, 2020, 3:10pm

Will be very happy if any official OpenWRT support is able for Linksys MR8300.
Have a MR8300 myself but doesn't have any serial access device.
Also I have some kind of log generated by sysinfo.cgi

-----Boot Data-----
cat /proc/cmdline: init=/sbin/init rootfstype=ubifs ubi.mtd=13,2048 root=ubi0:ubifs rootwait rw clk_ignore_unused
cat /proc/mtd: dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00100000 00020000 "0:QSEE"
mtd3: 00080000 00020000 "0:CDT"
mtd4: 00080000 00020000 "0:APPSBLENV"
mtd5: 00080000 00020000 "0:ART"
mtd6: 00200000 00020000 "0:APPSBL"
mtd7: 00080000 00020000 "u_env"
mtd8: 00040000 00020000 "s_env"
mtd9: 00040000 00020000 "devinfo"
mtd10: 05800000 00020000 "kernel"
mtd11: 05500000 00020000 "rootfs"
mtd12: 05800000 00020000 "alt_kernel"
mtd13: 05500000 00020000 "alt_rootfs"
mtd14: 00100000 00020000 "sysdiag"
mtd15: 04680000 00020000 "syscfg"

Memory Use:
free
             total         used         free       shared      buffers
Mem:        500872       158140       342732            0            0
-/+ buffers:             158140       342732
Swap:            0            0            0

If there is something that I can provide, please ask and I'll provide.
(Also the GPL code of this router is released on Linksys' GPL page.)

GillyMoMo · June 2, 2020, 6:52pm

There actually is. So I kind of did some tomfoolery and flashed the EA8300 firmware on this device and it actually works. Again the only way to get it flash is via serial since the oem firmware doesn't allow for it to be flashed otherwise. When you look at the SOC's MR8300, MR9000 and EA8300 they are exactly the same. The MR8300 and MR9000 have 512MB of RAM instead of 256 like the EA8300. I suspect I need to create a fork or builds of this for us MR8300 folks?

Bobcat · June 28, 2020, 4:08am

Is the MR8300 conversion to OpenWRT still only via serial ?

I have several issues with the OEM firmware :

Wi-Fi drops every once in a while
Impossible to have stable Wi-Fi on iPhones 7 and 8 using Zoiper voip soft phone, which keeps de-registering showing "not ready"
OEM firmware completely dummed out compared to EA8300

So I just bought a refurbished EA8300, namely because of OPENWRT support, price, very decent flash + ram size, double firmware backup.

Flashed this baby twice to latest OEM firmware, in order to fall back if required. I then proceeded to flash to 19.07.3 and WOW :

In the farther rooms, now getting full 3 bar signal on my iPads and iPhones, where I only got 2 bars with my previous routers Archer C60 and the MR8300
No more intermittent Wi-Fi drops
Most importantly Zoiper works perfectly now with my iPhones

I must say I had previously bought an EA8300 prior to the MR8300 back in 2019, but it didn't fix the C60 signal strength issue and as such I returned it.
I later got my hands on the MR8300 for $100 CAD new, primarily lured by killer price, mesh and the fact the EA's firmware was quite a step up from my C60's. What a deception the dummed MR was compared to the EA, but I decided to keep it considering the killer price and decent upgrade to the C60.

However, as impressed I am with the EA's brain surgery, I am now itching to upgrade my MR8300 to same. However, I would very much prefer to avoid using a scalpel with a serial intervention.

My questions here are as follows :

Has the MR8300 been locked out from GUI upgrade by Linksys the way TP-LINK did to my C60, or this is an issue that will be resolved in a future release of OpenWRT ?

Also, do I just need to be patient and official support is in the works ?

This is my first post here, hopefully I didn't rant too much...

I really like OpenWRT, never felt so much in control before !

GillyMoMo · June 30, 2020, 6:39pm

Has the MR8300 been locked out from GUI upgrade by Linksys the way TP-LINK did to my C60, or this is an issue that will be resolved in a future release of OpenWRT ?

That was the first thing I figured out when I picked up this router. No way to flash the "easy way". That wasn't too bad to do and these happen to come apart pretty easy. I do suggest making the serial port exposed outside if you can swing it (Did this to my EA9500 and both of my MR8300's).

Also, do I just need to be patient and official support is in the works ?

If you look at the hardware of the MR8300/9000 vs EA8300 they are exactly the same. What separates the two is the fact that the MR has 512MB of RAM vs the EA's 256MB of RAM. Both are ipq40xx, in a way you could say it's like the WRTxxxxAC router family just with a different chipset. As of yesterday I confirmed that 802.11s is working well (of course standard wifi and all other normal features work as well). Or the TLDR, it is supported there just isn't a guide to do what I did yet. From what I gather though looks like I may be having to continue supporting this and get another thread together.

Bobcat · June 30, 2020, 9:21pm

Should I understand the exposed serial port is because the only way to update OpenWRT once installed is via serial or it's just in case you want to revert to stock OEM fw and re-flash back to OpenWRT because you put yourself in trouble and need back to stock in order to start from scratch ?

Since the HW seems to be same as EA8300, except for ram, I was thinking of flashing stock EA8300 fw to MR, essentially turning MR to EA and then flashing to OpenWRT like I did successfully with my EA. Did you ever go there ? Or might this be a venue to GUI upgrade ?

Bobcat · July 1, 2020, 12:26am

OK, I just rebooted the MR, just to find out the stock fw doesn't have a specific file upload choice, just an upgrade from detected new available version from Linksys. Boy, this stock fw has been very seriously dumb-ed out compared to the EA. So that kills the thought of an EA fw flash.

Bobcat · July 3, 2020, 2:07am

Would appreciate if it were possible to obtain a step by step guide on upgrading MR8300 to OpenWRT.

I was reading thread and I don't quite seem to follow from A to Z, there seems to be some assumptions along the way...

Would anyone be so kind ? I am new to this, the EA8300 upgrade went super fine from the first try, but I am itching to upgrade the MR. Please...

GillyMoMo · July 4, 2020, 7:49pm

I'll be more than happy to write one up for you. I'll have to take some pictures and get screen shots. Give me a few and I'll start a new thread with said guide.

Bobcat · July 4, 2020, 7:54pm

Many thanks, looking forward to my upgrade !

aannecchiarico · July 7, 2020, 12:29pm

+1 For a step by step guide on installing OpenWRT on the MR8300 as well.

xenotaph · July 14, 2020, 7:56am

Anyone do a tcpdump to see how the router checks for OEM updates? Is it possible to fool it to get an image from somewhere else than the official server?

arwelr · July 14, 2020, 5:30pm

Hi @GillyMoMo, I wrote some detailed instructions on flashing the MR8300 based on the comments on this thread. I'd like to share them with you in case they can be helpful for the guide you're writing.

aannecchiarico · July 29, 2020, 6:39pm

Could you post the instructions?

mdwrt · August 3, 2020, 12:53am

Hello all, i own an MR8300 and was able to install OpenWRT via the web. You need to go to http://routerip/fwupdate.html

It works!

arwelr · August 4, 2020, 7:41pm

Installing OpenWrt using the Serial Console on the MR8300

Instructions based on some of the comments of this thread.

Preparations / Requirements

You will need a computer with a fixed IP address in the 192.168.1.0/24 network.
Any IP address will do, except 192.168.1.1, which is the one the router assigns to itself. Connect this computer to any of the ports on the router, except WAN, of course.
You will need a TFTP server connected to the router (you probably want it to be running on the same computer as in the previous point).
The address of the TFTP server should preferably be 192.168.1.254.
You should have managed to open the case of the MR8300. The instructions for opening the case of the EA8300 page are very good.
You will need a USB to TTL serial cable to get to the serial console.
You need to connect the RX, TX and GND cables to the correct pins in the router.
You will need software to connect to the serial port (like minicom on linux, or PuTTY on Windows).
Download the ITB image and put it in the TFTP server's storage directory. For the 19.07.3 release, this should do:
$ wget https://downloads.openwrt.org/releases/19.07.3/targets/ipq40xx/generic/openwrt-19.07.3-ipq40xx-generic-linksys_ea8300-initramfs-fit-zImage.itb /var/lib/tftpboot/image.itb

NOTE: Change /var/lib/tftpboot for the actual directory where the TFTP server will look for files to serve.

NOTE: I called it image.itb so it is easier to type later (maybe mr8300.itb would have been a better name)

IMPORTANT: Check the sha256sum of the file downloaded against the one you will find in the downloads page.
Download the OpenWrt upgrade binary to the computer you will use to connect to the router (same computer as in the first point):
$ wget https://downloads.openwrt.org/releases/19.07.3/targets/ipq40xx/generic/openwrt-19.07.3-ipq40xx-generic-linksys_ea8300-squashfs-sysupgrade.bin

IMPORTANT: make sure the sha256sum matches with the one in the downloads page.

If you have everything, you can proceed.

Procedure

Read all the following steps at least once before attempting to start this, and make sure you feel comfortable with the procedure. Failure may result in your router being bricked.
If the MR8300 was on, turn it off.
Find the serial console pins at the right of the board in a connector marked as J3 (exactly as with the EA8300).
Now connect to the serial port at 115200 bps and 8N1 (8 data bits, no parity, and 1 stop bit).

Turn on the router and get to the u-boot prompt by pressing a key (you have 2 seconds to do that once the power button is turned on).

The u-boot output looks like this (some lines omitted):

U-Boot 2012.07 [Chaos Calmer 15.05.1,r35193] (Sep 27 2018 - 09:37:31)

CBT U-Boot ver: 1.3.3

smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010006
NAND:  ID = 9590dac2
Vendor = c2
Device = da
ONFI device found
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:   qca_mmc: 0
PCI0 Link Intialized
In:    serial
Out:   serial
Err:   serial
machid: 8010006
flash_type: 2
Net:   MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0

Updating boot_count ... done

Hit any key to stop autoboot:  0
(IPQ40xx) #

Next if the IP address of the TFTP server you have is not 192.168.1.254, change the variable serverip in the u-boot environment:
```
(IPQ40xx) # setenv serverip 192.168.1.x
```
This change is not permanent, don't worry.

Now download the ITB image to memory as described by @GillyMoMo earlier:

(IPQ40xx) # tftp 84000000 image.itb
eth0 PHY0 up Speed :1000 Full duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'image.itb'.
Load address: 0x84000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #
done
Bytes transferred = 4783568 (48fdd0 hex)
(IPQ40xx) #

NOTE: use the correct file name.

If you see a T instead of a #, this means there was a timeout, most
likely u-boot could not find the TFTP server (use ping in the uboot console to see if you can reach it)

Once the image is loaded into memory, boot it with the commands that @GillyMoMo provided:
```
(IPQ40xx) # bootipq
... some info about the image is shown ...
(IPQ40xx) # bootm
```

OpenWrt will now boot, and after a few seconds if you press enter you will get to the command line prompt:

BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07.3, r11063-85e04e9f46
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

Now head to your web browser on the computer connected to the router, and go to the address http://192.168.1.1. No password is required to log in.
ATTENTION: If you didn't get to the OpenWrt page, something is not right, do not proceed, maybe you want to try again, though.
Optional: you might want to save the contents of all different mtdbocks. If so, in the web interface, go to "System", "Backup / Flash Firmware", and "Save mtdblock contents", and save those partition you want to backup them.
Upgrade the system by going to the "System", "Backup / Flash Firmware" page, and select "Flash new firmware image". Choose the sysupgrade.bin file you downloaded earlier.

If successful, reboot the system.

Up to this point, OpenWrt was flashed in one of the flash partitions of the router, but when you reboot the router, you will most likely boot back to the original Linksys firmware. If so, reboot the system again, and get to the u-boot console by pressing a key within 2 seconds of the reboot, and follow these steps:

Check what partition is being booted:

(IPQ40xx) # printenv boot_part
boot_part=1

If boot_part=1 then OpenWrt was installed in partition 2, otherwise it was installed on partition 1. This u-boot command will automatically boot from the right partition in this situation:
```
(IPQ40xx) # if test $boot_part = 1; then run bootpart2; else run bootpart1; fi
```
Make sure you booted to OpenWrt, if not, something went wrong and you should probably redo all the steps, or stick with the Linksys firmware.
If after reboot you are greeted with the OpenWrt control panel, then Congratulations, but you are not finished! Now that we know that this works, we need to make the changes permanent, so you boot from the correct partition every time.
Reboot the system once more, and get to the u-boot console one last time.
Change the boot_part variable. Remember, if it was set to 1, now you will set it to 2, and if it was set to 2, now you will set it to 1.
This command will do it automatically for us:
```
(IPQ40xx) # if test $boot_part = 1; then setenv boot_part 2; elif test $boot_part = 2; then setenv boot_part 1; else echo Something is wrong; fi
```
Make sure the boot_part variable changed.
If the variable boot_part was successfully updated, you can now save the environment permanently with saveenv, and reboot the router, which should now boot OpenWrt by default:
```
(IPQ40xx) # saveenv
(IPQ40xx) # reset
```

Good luck!

mdwrt · August 5, 2020, 12:34am

Hi arwelr, i was able to navigate to https://routerip/fwupdate.html to install the EA8300 OpenWRT firmware on my MR8300. That page allowed me to browse for a file, it was painless and took like 5 minutes. Let me know if you have any questions

arwelr · August 5, 2020, 6:23am

I have not tried this page on my router because don't have the original firmware anymore, but if it works, it is way easier than reflashing it using the serial port, thanks for the heads up!

Bobcat · August 6, 2020, 12:29am

Hi mdwrt, Link does not work: Server not found...