flashing OpenWRT

Download both the initramfs and sysupgrade from OpenWRT’s mt7621 releases. That link is for 18.06.01 and you’ll want to grab either the ubnt-erx or the ubnt-erx-sfp depending on hardware.

Open the case of your unit and plug in your serial breakout board. The pins are from J33 down towards J9: +3.3V, RX, TX, GND.

Serial port settings are 57600 8N1.

flashing OpenWRT: choosed tftp

I love this typo. When you get to UBoot, hit 1 for TFTP.

Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. default: 3 3 You choosed 1

Put in the required IP addresses for your tftp server. If you’re looking for a simple GUI front end for macOS, try the aptly named TFTP Server

1: System Load Linux to SDRAM via TFTP. Please Input new ones /or Ctrl-C to discard Input device IP (192.168.0.1) ==: Input server IP (192.168.0.200) ==: Input Linux Kernel filename (initramfs.bin) ==:openwrt-initramfs.bin netboot_common, argc= 3

You should see the ramfs and kernel load, and dump you to the shell. Hit Enter to activate the console.

BusyBox v1.28.3 () built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt 18.06.1, r7258-5eb055306f ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:/#

flashing OpenWRT: scp the sysupgrade

Now use scp to get the sysupgrade.tar file onto the live system. I guess you don’t really have to worry about changing directory to /tmp because it’s a ramfs. Force of habit I guess.

root@OpenWrt:/# cd /tmp root@OpenWrt:/tmp# scp wintr@10.80.0.52:openwrt-sysupgrade.tar . wintr@10.80.0.52's password: openwrt-sysupgrade.tar 100% 3430KB 3.4MB/s 00:01 root@OpenWrt:/tmp#

Then run sysupgrade -n on the sysupgrade.tar to get everthing copied over.

root@OpenWrt:/tmp# sysupgrade -n openwrt-sysupgrade.tar Commencing upgrade. Closing all shell sessions. Watchdog handover: fd=3 - watchdog - killall: telnetd: no process killed Sending TERM to remaining processes ... odhcp6c udhcpc ntpd dnsmasq ubusd logd rpcd netifd odhcpd uhttpd Sending KILL to remaining processes ... Performing system upgrade... 1+0 records in 1+0 records out Unlocking kernel1 ... Writing from <stdin> to kernel1 ... Volume ID 0, size 14 LEBs (1777664 bytes, 1.6 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1 Set volume size to 244301824 Volume ID 1, size 1924 LEBs (244301824 bytes, 232.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1 sysupgrade successful umount: can't unmount /dev: Resource busy umount: can't unmount /tmp: Resource busy umount: can't unmount /: Invalid argument [ 505.299073] reboot: Restarting system

They system will reboot into OpenWRT. The eth0 port will take a DHCP address at that point. Start with a passwd and then an opkg update maybe.

restoring EdgeOS

This is a little bit more complicated. Basically you need to be booted into a live environment and have the contents of the EdgeOS release available to be written to disk. With the limited RAM on the ER-X, this can sometimes mean juggling files around when booted into a ramfs. This is my method, but maybe it’ll point you in the right direction.

Start by downloading the latest EdgeRouter X EdgeOS release from Ubiquiti’s EdgeRouter X Page directly. We will be using 1.10.8 here.

Create a directory for it and extract everything from the tarball into that directory.

[wintr@hokkaido]~/repos$wget https://dl.ubnt.com/firmwares/edgemax/v1.10.x/ER-e50.v1.10.8.5142457.tar ER-e50.v1.10.8.5142457.tar 100%[=============================================================================>] 78.32M 17.7MB/s in 5.2s 2018-12-28 17:11:29 (15.1 MB/s) - ‘ER-e50.v1.10.8.5142457.tar’ saved [82124800/82124800] [wintr@hokkaido]~/repos$mkdir restore-e50 [wintr@hokkaido]~/repos$tar xvf ER-e50.v1.10.8.5142457.tar -C restore-e50/ x vmlinux.tmp x vmlinux.tmp.md5 x squashfs.tmp x squashfs.tmp.md5 x version.tmp x compat

restoring EdgeOS: Boot to OpenWRT initramfs

Just as above. We can’t flash the mdt partition if we’re living in it, so we boot to a live environment. Once you are live in OpenWRTs ramfs, scp over the important files from the EdgeOS tarball.

You can try this by wget -ing the tarball, but the OpenWRT shipped wget doesn’t support https. So you won’t be able to download directly from Ubiquiti. You could try scp -ing over the whole archive once you’ve downloaded it elsewhere, but then you wont have space left to untar it. This is the easiest way I’ve found so far.

root@OpenWrt:~# cd /tmp root@OpenWrt:/tmp# root@OpenWrt:/tmp# scp wintr@10.80.0.52:repos/restore-e50/* . wintr@10.80.0.52's password: compat 100% 8 0.0KB/s 00:00 squashfs.tmp 100% 77MB 3.5MB/s 00:22 squashfs.tmp.md5 100% 33 0.0KB/s 00:00 version.tmp 100% 42 0.0KB/s 00:00 vmlinux.tmp 100% 1679KB 1.6MB/s 00:00 vmlinux.tmp.md5 100% 33 0.0KB/s 00:00

restoring EdgeOS: Unsorted Block Images

Oddly enough, when you google “UBI” the Latin translation is “where?”. Fitting for file systems. Here were going to clean up the drive partitions to get prepped for the EdgeOS. Run the following commands:

ubidetach -d 0 ubiformat /dev/mtd5 ubiattach -p /dev/mtd5 ubimkvol /dev/ubi0 --vol_id=0 --lebs=1925 --name=troot mount -o sync -t ubifs ubi0:troot /mnt/

Which should look like this:

root@OpenWrt:/# ubidetach -d 0 [ 89.776541] block ubiblock0_0: released [ 89.784211] ubi0: detaching mtd5 [ 89.792747] ubi0: mtd5 is detached root@OpenWrt:/# ubiformat /dev/mtd5 ubiformat: mtd5 (nand), size 259784704 bytes (247.7 MiB), 1982 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes libscan: scanning eraseblock 1981 -- 100 % complete ubiformat: 1982 eraseblocks have valid erase counter, mean value is 5 ubiformat: formatting eraseblock 1981 -- 100 % complete root@OpenWrt:/# ubiattach -p /dev/mtd5 [ 167.131104] ubi0: attaching mtd5 [ 169.575563] ubi0: scanning is finished [ 169.600661] ubi0: attached mtd5 (name "ubi", size 247 MiB) [ 169.611615] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes [ 169.625325] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 [ 169.638862] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096 [ 169.652734] ubi0: good PEBs: 1982, bad PEBs: 0, corrupted PEBs: 0 [ 169.664882] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128 [ 169.679294] ubi0: max/mean erase counter: 9/6, WL threshold: 4096, image sequence number: 1327463006 [ 169.697496] ubi0: available PEBs: 1938, total reserved PEBs: 44, PEBs reserved for bad PEB handling: 40 [ 169.716235] ubi0: background thread "ubi_bgt0d" started, PID 1533 UBI device number 0, total 1982 LEBs (251666432 bytes, 240.0 MiB), available 1938 LEBs (246079488 bytes, 234.6 MiB), LEB size 126976 bytes (124.0 KiB) root@OpenWrt:/# ubimkvol /dev/ubi0 --vol_id=0 --lebs=1925 --name=troot Volume ID 0, size 1925 LEBs (244428800 bytes, 233.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "troot", alignment 1 root@OpenWrt:/# mount -o sync -t ubifs ubi0:troot /mnt/ [ 183.510552] UBIFS (ubi0:0): default file-system created [ 183.522468] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 1538 [ 183.640343] UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "troot" [ 183.654909] UBIFS (ubi0:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes [ 183.674684] UBIFS (ubi0:0): FS size: 242778112 bytes (231 MiB, 1912 LEBs), journal size 12189696 bytes (11 MiB, 96 LEBs) [ 183.696351] UBIFS (ubi0:0): reserved for root: 4952683 bytes (4836 KiB) [ 183.709611] UBIFS (ubi0:0): media format: w4/r0 (latest is w5/r0), UUID 552896D7-2284-47CC-9B56-87FD73826034, small LPT model root@OpenWrt:/#

restoring EdgeOS: flashing

And now move everything into place. We end up putting the kernel into two partitions. I don’t know if this is required but I’m not messing with the incantations that have worked so far. Maybe I’ll experiment after this write up.

You’ll run the following commands:

cp /tmp/version.tmp /mnt/version cp /tmp/squashfs.tmp /mnt/squashfs.img cp /tmp/squashfs.tmp.md5 /mnt/squashfs.img.md5 dd if=/tmp/vmlinux.tmp of=/dev/mtdblock3 dd if=/tmp/vmlinux.tmp of=/dev/mtdblock4

Which should look like:

root@OpenWrt:/tmp# cp /tmp/version.tmp /mnt/version root@OpenWrt:/tmp# cp /tmp/squashfs.tmp /mnt/squashfs.img root@OpenWrt:/tmp# cp /tmp/squashfs.tmp.md5 /mnt/squashfs.img.md5 root@OpenWrt:/tmp# dd if=/tmp/vmlinux.tmp of=/dev/mtdblock3 3358+1 records in 3358+1 records out root@OpenWrt:/tmp# dd if=/tmp/vmlinux.tmp of=/dev/mtdblock4 3358+1 records in 3358+1 records out root@OpenWrt:/tmp#

Now, just give it a reboot and see what happens. It should be somewhat obvious if it worked or not.

Welcome to EdgeOS ubnt ttyS1 By logging in, accessing, or using the Ubiquiti product, you acknowledge that you have read and understood the Ubiquiti License Agreement (available in the Web UI at, by default, http://192.168.1.1) and agree to be bound by its terms. ubnt login: ubnt Password: Linux ubnt 3.10.107-UBNT #1 SMP Tue Nov 20 18:17:44 UTC 2018 mips Welcome to EdgeOS ubnt@ubnt:~$ show version Version: v1.10.8 Build ID: 5142457 Build on: 11/20/18 18:09 Copyright: 2012-2018 Ubiquiti Networks, Inc. HW model: EdgeRouter X 5-Port HW S/N: 802AA81E12AE Uptime: 00:01:05 up 1 min, 1 user, load average: 1.67, 0.54, 0.19 ubnt@ubnt:~$

So, now that you have a path back, there’s no reason not to experiment with OpenWRT on an EdgeRouter X. It’s even easier on an EdgeRouter Lite, but that writeup can wait till the new year.

Cheers.