CFE bootloader update

[ryzhov_al]

Preamble
This archive is for a CFE bootloader upgrade on Asus RT-N66U router from factory version 1.0.1.2, 1.0.1.3 or 1.0.1.4 to version 1.0.1.9. The goal of updates:

• from 1.0.1.2 to newer: to return CFE possibility to read variables from NVRAM which is lost while NVRAM been upgraded 64Кб in recent stock firmware releases,
• from 1.0.1.3 to newer: to get overclocking ability.

You may check current CFE by:

strings /dev/mtd0ro | grep bl_ver

Disclaimer
If you don't need this new options or you just don't know what it is, then better do not to touch the bootloader. Damaged CFE will bricks the router! You should represent consequences of the actions and you should understand what you are doing in the update process because only you take responsibility for update success. Or fail.


Problem diagnostics
It's enough to set any the NVRAM variable used by CFE and make sure that CFE 1.0.1.2 ignores it. For example, remember the current BogoMIPS value:

# cat /proc/cpuinfo | grep BogoMIPS

then try to change CPU frequency and reboot router:

# nvram set clkfreq=300 && nvram commit && reboot

If CFE ignores your settings, BogoMIPS value will remain the same because CFE didn't set new CPU frequency.


Updating CFE
Update works only on Merlin's mod, please follow this steps:

1. Download and unpack update script
Get access to the RT-N66U console via Telnet/SSH/Serial and type:

cd /tmp
wget http://files.ryzhov-al.ru/Routers/RT-N66U_CFE_update/cfe_n66u-1.0.1.9.tgz
tar -xzvf cfe_n66u-1.0.1.9.tgz

2a. Update current CFE
If you did not update before, then type:

./cfe_update.sh /dev/mtd0ro

and watch the progress of the update. The script will ask your final decision before update. Please, proceed if only if you sure what you are doing.

2b. Update CFE, using previously saved CFE backup image
If you already done update before, you may fix it with saved CFE image this way:

./cfe_update.sh ./cfe.old

3. Saving old CFE image
Please consider saving your old CFE. A ./cfe.old file will be placed in the same dir with update script, save it to some safe place.

Here is an example of whole script's output when all went well. Script checks current CFE version before update to prevent CFE re-update.
And here is original stock CFE versions for those who never make a backups

 

[Gingernut]

Hi and thanks for posting this.

I ask where did you get this updated cfe bootloader?

 

[ryzhov_al]

Hi.

I ask where did you get this updated cfe bootloader?

It's taken from new RT-N66U device. You may check current CFE version this way:

# strings /dev/mtd0ro | grep bl_version

 

[Gingernut]

With the cat/dev/mtd0 > ./ cfe.original command I couldn't get a cfe backup it kept erroring out.

[email protected]:/tmp/home/root# cat/dev/mtd0 > ./ cfe.original
-sh: can't create ./: Is a directory

But this command works fine:

dd if=/dev/mtd0 of=/tmp/cfe.original

Another problem:

# sh cfe_update.sh cfe.original cfe.new
[1/4] Dumping default NVRAM settings from your CFE...
cfe_update.sh: 9: cfe_update.sh: ./nvsimple: Permission denied
[2/4] Modifying NVRAM settings (silent step)...
[3/4] Creating new CFE...
4092+0 records in
4092+0 records out
4092 bytes (4.1 kB) copied, 0.017737 s, 231 kB/s
[4/4] Checking differences between NVRAM from old and new CFE's
If you see only two differences: one is for 'bl_version' and second is a new 'odmpid=ASUS' variable then all step are done! New CFE image 'cfe.new' is prepared for flash.

Got a bit further after a changing permissions with chmod +x but I'm to scared to flash tthe ne cfe as the size is so different:

[email protected]:~/cfe_n66u-1.0.1.3$ sh cfe_update.sh cfe.original cfe.new
[1/4] Dumping default NVRAM settings from your CFE...
./nvsimple: 1: ./nvsimple: Syntax error: "(" unexpected
[2/4] Modifying NVRAM settings (silent step)...
[3/4] Creating new CFE...
4092+0 records in
4092+0 records out
4092 bytes (4.1 kB) copied, 0.00961613 s, 426 kB/s
[4/4] Checking differences between NVRAM from old and new CFE's
If you see only two differences: one is for 'bl_version' and second is a new 'odmpid=ASUS' variable then all step are done! New CFE image 'cfe.new' is prepared for flash.

 

[Koenig]

With the cat/dev/mtd0 > ./ cfe.original command I couldn't get a cfe backup it kept erroring out.



But this command works fine:



Another problem:

I think the "cat/dev/mtd0 > ./ cfe.original" should be without space between "/" and "cfe.original"

More like this: cat/dev/mtd0 > ./cfe.original

 

[Gingernut]

Don't know.

ASUSWRT RT-N66U_3.0.0.4 Sun Sep 23 02:39:35 UTC 2012
[email protected]:/tmp/home/root# cat/dev/mtd0 > ./cfe.original
-sh: cat/dev/mtd0: not found
[email protected]:/tmp/home/root#

With the other command it gives me a cfe backup.

 

[Koenig]

Don't know.

My bad, tried it my self.

This does the trick: "cat /dev/mtd0 > ./cfe.original"
Space between "cat" and "/dev...." and no space between "./" and "cfe.original"


This is probably basic Linux knowledge, and I'm just not god at it, so I'm just gonna stop messing with this now.

Question to the author of this thread:
Through scp I got the cfe.original to my computer and it was exactly 256kB big, does this sound about right?

 

[ryzhov_al]

I think the "cat/dev/mtd0 > ./ cfe.original" should be without space between "/" and "cfe.original"

More like this: cat/dev/mtd0 > ./cfe.original

Fixed. It's spell checker's fault

Question to the author of this thread:
Through scp I got the cfe.original to my computer and it was exactly 256kB big, does this sound about right?

It's Ok. You are dumping a some region on flash, but not whole 256kB is used by CFE. You may look into cfe.original with any HEX viewer, there is only "FF FF FF .." in the second half of dump which means it's part is unused.

 

[Koenig]

Installed Ubuntu via virtualbox just to see if I could get this working, however when running the script I got a "Syntax Error"....

[email protected]:~/N66U$ ./cfe_update.sh cfe.original cfe.new
[1/4] Dumping default NVRAM settings from your CFE...
./nvsimple: 1: ./nvsimple: Syntax error: "(" unexpected
[2/4] Modifying NVRAM settings (silent step)...
[3/4] Creating new CFE...
4092+0 records in
4092+0 records out
4092 bytes (4.1 kB) copied, 0.0185861 s, 220 kB/s
[4/4] Checking differences between NVRAM from old and new CFE's
If you see only two differences: one is for 'bl_version' and second is a new 'odmpid=ASUS' variable then all step are done! New CFE image 'cfe.new' is prepared for flash.
[email protected]:~/N66U$


Then I also noticed the significant difference in filesize between cfe.original and cfe.new, the original beeing 256kB and the new beeing 132 and something kB's

 

[ryzhov_al]

./nvsimple: 1: ./nvsimple: Syntax error: "(" unexpected

Looks like a try to run i386 binary on x64 system without libc-compat libraries. Recompiled nvsimple as a static binary. Please, give a feedback.

Then I also noticed the significant difference in filesize between cfe.original and cfe.new, the original beeing 256kB and the new beeing 132 and something kB's

It's Ok. Look into ./cfe.original: dumped whole /dev/mtd0 partition, but only first half is really used.

 

[Koenig]

Looks like a try to run i386 binary on x64 system without libc-compat libraries. Recompiled nvsimple as a static binary. Please, give a feedback.

I'm not sure what you mean here (sorry my Linux is bad... )

I'm running this: ubuntu-12.04.1-desktop-i386 through virtualbox on a win7-x64-system.

Do you mean I should recompile nvsimple or have you done it?

 

[ryzhov_al]

Do you mean I should recompile nvsimple or have you done it?

I'm already done it for you last night.
Please, download an archive and try again.

 

[Koenig]

I'm already done it for you last night.
Please, download an archive and try again.

Tried with both links to the archive in your first post but still get the same result:

[email protected]:~/N66U$ ./cfe_update.sh cfe.original cfe.new
[1/4] Dumping default NVRAM settings from your CFE...
./nvsimple: 1: ./nvsimple: Syntax error: "(" unexpected
[2/4] Modifying NVRAM settings (silent step)...
[3/4] Creating new CFE...
4092+0 records in
4092+0 records out
4092 bytes (4.1 kB) copied, 0.0221387 s, 185 kB/s
[4/4] Checking differences between NVRAM from old and new CFE's
If you see only two differences: one is for 'bl_version' and second is a new 'odmpid=ASUS' variable then all step are done! New CFE image 'cfe.new' is prepared for flash.
[email protected]:~/N66U$

And just to make sure it is nothing with rights or such, with sudo:

[email protected]:~/N66U$ sudo ./cfe_update.sh cfe.original cfe.new
[sudo] password for koenig:
[1/4] Dumping default NVRAM settings from your CFE...
./nvsimple: 1: ./nvsimple: Syntax error: "(" unexpected
[2/4] Modifying NVRAM settings (silent step)...
[3/4] Creating new CFE...
4092+0 records in
4092+0 records out
4092 bytes (4.1 kB) copied, 0.0118174 s, 346 kB/s
[4/4] Checking differences between NVRAM from old and new CFE's
If you see only two differences: one is for 'bl_version' and second is a new 'odmpid=ASUS' variable then all step are done! New CFE image 'cfe.new' is prepared for flash.
[email protected]:~/N66U$

 

[Gingernut]

I finally got it to build the new CFE without errors. The problem now is that it doesn't seem to want to update, after flashing the new one it does it in about 20 seconds and doesn't give any success/error feedback.
When I check the CFE version after it's still on 1.0.1.2 even after a reboot.

Do we need to do a full reset or is just a reboot fine.

Thanks

 

[Koenig]

I finally got it to build the new CFE without errors. The problem now is that it doesn't seem to want to update, after flashing the new one it does it in about 20 seconds and doesn't give any success/error feedback.
When I check the CFE version after it's still on 1.0.1.2 even after a reboot.

Do we need to do a full reset or is just a reboot fine.

Thanks

Do know what it was that gave the Syntax Error?

 

[Gingernut]

Over at the wl500g forums Ryzhov posted the same topic on updating the CFE, unfortunately it's all in Russian but you can get the drift of some of it. Saw a command there that changes a flag or something in nvsimple and applying it makes it build fine.

Thing is the wl500g forum seems to be down right now so I can't get you it.

 

[RMerlin]

Incoming requests for a US <-> EU CFE converter in 3...2...

ryzhov, did you pull the updated CFE from an RT-N66R?

 

[ryzhov_al]

When I check the CFE version after it's still on 1.0.1.2 even after a reboot.

It's may be your old current NVRAM value from /dev/mtd3, not a default value from CFE. A CFE checks vital NVRAM values at every boot and corrects them if necessery. To reveal your true bootloader version please do:

$ nvram unset bl_version && nvram commit && reboot

after reboot check new value with:

$ nvram get bl_version

or do a test case from the first post.

Over at the wl500g forums Ryzhov posted the same topic on updating the CFE, unfortunately it's all in Russian but you can get the drift of some of it. Saw a command there that changes a flag or something in nvsimple and applying it makes it build fine.

Thing is the wl500g forum seems to be down right now so I can't get you it.

Yes, wl500g.info is down right now, but those my posts is almost the same as here.

Incoming requests for a US <-> EU CFE converter in 3...2...

Roger that
Take a look at ./nvsimple in my archive. It extracts default NVRAM settings from CFE partition into a text file. So you may extract NVRAM from EU and US devices and compare it with a diff. Look into email for my dump.

Also, there is a plain-old (8 years old!) ./nvserial Broadcom's utility, which can "implant" NVRAM settings back from text file into CFE binary.

The tools is yours.

ryzhov, did you pull the updated CFE from an RT-N66R?

No.

 

[ryzhov_al]

./nvsimple: 1: ./nvsimple: Syntax error: "(" unexpected

Gotcha! Two guys already faced this problem. It's because my build system is a x64, but you've got a i386 environment. The fastest way to solve it is to compile ./nvsimple on your system:

$ rm ./nvsimple
$ gcc ./nvsimple.c -o ./nvsimple

I will think how to build universal (x64/i386) ./nvsimple and will upload it in a next version of archive.


BTW Is someone interesting in thermal protection mechanism in our routers? While digging CFE i have figured out how it works, can share my knowledge to some, who afraid overheating.

 

[Gingernut]

It's may be your old current NVRAM value from /dev/mtd3, not a default value from CFE. A CFE checks vital NVRAM values at every boot and corrects them if necessery. To reveal your true bootloader version please do:

$ nvram unset bl_version && nvram commit && reboot

after reboot check new value with:

$ nvram get bl_version

or do a test case from the first post.

After the nvram unset command and a reboot it dosen't give a version output at all now.