Rescue from failed firmware upgrade

Some device vendors provide built-in rescue functions in their device's flash ROM boot partition that remain there, even after a LEDE firmware upgrade, so a LEDE upgrade will not overwrite this rescue function.

This rescue functions can be used to recover a failed flash update (no matter if the failed flash was vendor firmware or LEDE) or recover from an otherwise dead device, as long as the device hardware and the rescue function is still intact. These rescue partitions do consume a tiny piece of the flash, but renders a device mostly unbrickable.

Unfortunately such rescue functions are not available from all vendors, sometimes not for all models from a vendor and the actual rescue process is mostly vendor specific. This page is meant to collect the known rescue methods of different router vendors or router models.

Check the “device page” of both LEDE and OpenWrt for your device (look for a link in the last columns of each project's table of hardware). The device page may describe a rescue method for your specific device.

Some of the methods may require creating a custom RS232-serial-cable or soldering-skills, while most newer devices require just a certain software trick to remote flash the device from a PC client.

Many devices of the following manufacturers support a recovery procedures as listed here:

Manufacturer Procedure Links
ASUS TFTP-like rescue procedure with a manufacturer utility to be installed on a client PC. Official ASUS recovery documentation
D-Link Several devices have a dedicated rescue firmware partition in their flash ROM.
Linksys Several older devices support a remote TFTP recovery procedure.
Several newer devices have 2 independent firmware partitions.
- Official Linksys TFTP recovery documentation
- For Linksys dual firmware, see below
Mikrotik TFTP-like rescure procedure with a manufacturer utility called 'netinstall' installed on a client PC. Official Microtik recovery documentation
Netgear TFTP on a PC client can be used to rescue the firmware. Official Netgear TFTP recovery documentation
TP-Link TFTP on a PC client can be used to rescue the firmware.
Several newer devices provide a rescue partition.
TP-Link forum TFTP recovery documentation
Ubiquiti (UBNT) TFTP on a PC client can be used to rescue the firmware. Official UBNT site: site search for 'firmware recovery'
Xiaomi Several devices with USB port support a rescue USB stick method.
ZBT (ZBTLink) Several devices support a rescue partition.
On some devices, TFTP on a PC client can be used to rescue the firmware.

Examples: the different Raspberry PI's, devices of PC Engines).

LEDE devices that use a drive-installed image.gz or sdcard.img.gz are not an issue to recover. The LEDE OS is not applied to flash ROM, but installed on a removable drive, e.g. an SD-card. For recovery, mount the removable drive in a working PC and reapply the LEDE image to the removable drive according to the device-specific instructions.

In several of these recovery procedures you will need a working TFTP server on your PC, see how to install and configure it in Set up a TFTP Server article.

Supported by some Xiaomi devices

process for Xiaomi Mi:

  1. Download firmware and store as miwifi.bin on an USB flash drive (must be FAT or FAT32)
  2. Plug USB flash drive into device USB port
  3. Unplug device cord
  4. Press and hold the reset button and then re-plug the power cord
  5. Release reset button, when the orange status LED starts blinking
  6. Flashing is finished, when LED turns blue

Supported by several devices at least of the following vendors: D-Link, TP-Link, ZBTLink

This function is based on extra code in the boot partition in the flash ROM and it is still available on the device, even after the device has been flashed to LEDE. No further tools are needed, to trigger this rescue function.

Procedure, to boot into rescue partition:

  1. Switch device power off (or pull the power cord).
  2. Connect a client to the device via Ethernet to LAN1
  3. Trigger the rescue function by pressing and holding the reset button of the device and then turning the device on (or plug in the power cord).
  4. You can release the reset button after a few seconds.
  5. The device will take ~15-20 seconds to boot a mini-web server, that provides only a single function: it can upload a firmware file and has a button to trigger the flash process. The web-server will usually be available under either (if in doubt, try both)
    1. http://192.168.0.1 (TP-Link and newer D-Link devices)
    2. http://192.168.1.1 (ZBT-Link and older D-Link devices)
  6. Note: You need to set your PC client to a fixed IP address beforehand, as DHCP is not supported in this rescue mode. So depending on your device, so you need to set the PC client's to a matching IP address, either:
    1. an IP of the 192.168.0.x range, e.g. 192.168.0.2 / 255.255.255.0
    2. an IP of the 192.168.1.x range, e.g. 192.168.1.2 / 255.255.255.0

Notes:

Supported by newer Linksys devices

Most newer devices (mostly those with decent amount of flash ROM) have 2 independent firmware partitions. A usage strategy could be, to install LEDE only into one of the 2 partitions and leave the vendor firmware in the other partition. No further tools are required to toggle between the two partitions.

Procedure, to manually toggle between the two firmware partitions:

  1. Switch device power off.
  2. 3x Switch device power on for 2 seconds, then off again.
  3. Switch device power on, the device should now boot to the alternative partition.

When successfully booted into any of the two partitions, a triggered firmware update will flash the other, secondary partition. The partition that is currently booted, stays untouched.