MT6000 uboot update instructions

For Developers
21

i realized that right after i posted.

As for the b3000, the primary uboot bl is corrupted ... hangs before primary bl is done. Without a jtag or a way to serial boot, its toast.

However, I got 10 of them for less the 100$ so it doesn't sting at all... plus it still works as the picture the frame :stuck_out_tongue:

22

I just had the same question and decided to try on my own since apparently nobody knows or is willing to give instructions as this has come up multiple times in other threads.

There are valid reasons to do this. For me it's just one more piece of software where I know now what's running on my device. Even if I trust the vendor and bootloader source is available, without reproducible builds and verifying it, it doesn't mean much in terms of security.

If successful, this still has the downside of no longer having the U-Boot web UI for recovery and hence recovery from bootloader is only possible using a serial connection (involves soldering on the board). AFAIK it's not possible to load an image from TFTP without serial. Also see the original commit:

Obvious disclaimer is obvious: I’m not responsible if you convert your device into a brick :slightly_smiling_face:

Everything below should only be followed if you accept high likelihood of hard :brick:.
If anything is unclear in the following instructions you most definitely should not try.

Here’s how I did it (there are probably other ways to do it as well)

  1. Download (stable) image files from
    https://firmware-selector.openwrt.org/?version=24.10.5&target=mediatek%2Ffilogic&id=glinet_gl-mt6000
    or build image yourself

  2. Check files after download (optional, but recommended)

    sha256sum openwrt-24.10.5-mediatek-filogic-glinet_gl-mt6000-*

  3. Copy files to device

    scp -O openwrt-24.10.5-mediatek-filogic-glinet_gl-mt6000-preloader.bin root@192.168.1.1:/tmp/
scp -O openwrt-24.10.5-mediatek-filogic-glinet_gl-mt6000-bl31-uboot.fip root@192.168.1.1:/tmp/

  4. Check files again after transfer (optional, but recommended)

    sha256sum /tmp/openwrt-24.10.5-mediatek-filogic-glinet_gl-mt6000-*

  5. Check partitions (lsblk must be installed, optional, but recommended)

    root@OpenWrt:~# lsblk -o +START,PARTLABEL

    NAME         MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS START PARTLABEL
loop0          7:0    0  6.7G  0 loop /overlay          
mmcblk0      179:0    0  7.3G  0 disk                   
├─mmcblk0p1  179:1    0  512K  0 part              8192 u-boot-env
├─mmcblk0p2  179:2    0    2M  0 part              9216 factory
├─mmcblk0p3  179:3    0    2M  0 part             13312 fip
├─mmcblk0p4  179:4    0    2M  0 part             17408 cfg
├─mmcblk0p5  179:5    0    2M  0 part             21504 log
├─mmcblk0p6  179:6    0   32M  0 part             25600 kernel
└─mmcblk0p7  179:7    0  6.8G  0 part /rom        91136 rootfs
mmcblk0boot0 179:8    0    4M  1 disk                   
mmcblk0boot1 179:16   0    4M  1 disk

  6. Make backups of critical partitions (optional, recommend but doesn't prevent potential brick)

    ssh root@192.168.1.1 "cat /dev/mmcblk0boot0" > mmcblk0boot0.bin
ssh root@192.168.1.1 "cat /dev/mmcblk0boot1" > mmcblk0boot1.bin
ssh root@192.168.1.1 "cat /dev/mmcblk0p3" > mmcblk0p3.bin
# can't hurt to backup the other partitions as well

  7. Make preloader disk temporarily writable

    echo 0 > /sys/block/mmcblk0boot0/force_ro

  8. Erase (zero) partition content and flash preloader image

    dd if=/dev/zero of=/dev/mmcblk0boot0 oflag=direct

    dd if=/tmp/openwrt-24.10.5-mediatek-filogic-glinet_gl-mt6000-preloader.bin \
   of=/dev/mmcblk0boot0 \
   oflag=direct

    Verify written data (optional, but recommended)

    SIZE="$(wc -c </tmp/openwrt-24.10.5-mediatek-filogic-glinet_gl-mt6000-preloader.bin)"
dd if=/dev/mmcblk0boot0 bs=1 count="$SIZE" | sha256sum

  9. Erase (zero) partition content and flash u-boot image

    dd if=/dev/zero of=/dev/mmcblk0p3 oflag=direct

    dd if=/tmp/openwrt-24.10.5-mediatek-filogic-glinet_gl-mt6000-bl31-uboot.fip \
   of=/dev/mmcblk0p3 \
   oflag=direct

    Verify written data (optional, but recommended)

    SIZE="$(wc -c </tmp/openwrt-24.10.5-mediatek-filogic-glinet_gl-mt6000-bl31-uboot.fip)"
dd if=/dev/mmcblk0p3 bs=1 count="$SIZE" | sha256sum

  10. If checksums do not match or there are any other errors, check everything twice.
    Do not reboot before you are sure the data was written correctly. Otherwise :brick:

  11. sync && reboot. If your router still boots, it probably worked. If not :man_shrugging:

1 Like
23

... there's mtk_uartboot, as mentioned 3+ weeks ago.

24

I've seen that but I haven't had to use it, so I can't confirm if it works.

25

You can always test, if you've got serial port access, it's non destructive.

It'll (probably, I've only done this with ubootmods) get to up to the point where the in-mem U-Boot is looping and requesting an initramfs over TFTP.

1 Like
26

I don't have serial connected yet either. Worked first try :sweat_smile: