Flashing OpenWRT and Recovering EdgeOS on Ubiquiti EdgeRouter X
Wil Knoll · 2018 Dec 28, 17:47 · 1479 words · 7 minutes read
flashing OpenWRT
Download both the initramfs and sysupgrade from OpenWRT’s mt7621 releases. That link is for 18.06.01 and you’ll want to grab either the ubnt-erx or the ubnt-erx-sfp depending on hardware.
Open the case of your unit and plug in your serial breakout board. The pins are from J33 down towards J9: +3.3V, RX, TX, GND.
Serial port settings are 57600 8N1.
flashing OpenWRT: choosed tftp
I love this typo. When you get to UBoot, hit 1 for TFTP.
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
default: 3
3
You choosed 1
Put in the required IP addresses for your tftp server. If you’re looking for a simple GUI front end for macOS, try the aptly named TFTP Server
1: System Load Linux to SDRAM via TFTP.
Please Input new ones /or Ctrl-C to discard
Input device IP (192.168.0.1) ==:
Input server IP (192.168.0.200) ==:
Input Linux Kernel filename (initramfs.bin) ==:openwrt-initramfs.bin
netboot_common, argc= 3
You should see the ramfs and kernel load, and dump you to the shell. Hit Enter to activate the console.
BusyBox v1.28.3 () built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 18.06.1, r7258-5eb055306f
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
flashing OpenWRT: scp the sysupgrade
Now use scp to get the sysupgrade.tar file onto the live system. I guess you don’t really have to worry about changing directory to /tmp because it’s a ramfs. Force of habit I guess.
root@OpenWrt:/# cd /tmp
root@OpenWrt:/tmp# scp wintr@10.80.0.52:openwrt-sysupgrade.tar .
wintr@10.80.0.52's password:
openwrt-sysupgrade.tar 100% 3430KB 3.4MB/s 00:01
root@OpenWrt:/tmp#
Then run sysupgrade -n on the sysupgrade.tar to get everthing copied over.
root@OpenWrt:/tmp# sysupgrade -n openwrt-sysupgrade.tar
Commencing upgrade. Closing all shell sessions.
Watchdog handover: fd=3
- watchdog -
killall: telnetd: no process killed
Sending TERM to remaining processes ... odhcp6c udhcpc ntpd dnsmasq ubusd logd rpcd netifd odhcpd uhttpd
Sending KILL to remaining processes ...
Performing system upgrade...
1+0 records in
1+0 records out
Unlocking kernel1 ...
Writing from <stdin> to kernel1 ...
Volume ID 0, size 14 LEBs (1777664 bytes, 1.6 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 244301824
Volume ID 1, size 1924 LEBs (244301824 bytes, 232.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
umount: can't unmount /: Invalid argument
[ 505.299073] reboot: Restarting system
They system will reboot into OpenWRT. The eth0 port will take a DHCP address at that point. Start with a passwd and then an opkg update maybe.
restoring EdgeOS
This is a little bit more complicated. Basically you need to be booted into a live environment and have the contents of the EdgeOS release available to be written to disk. With the limited RAM on the ER-X, this can sometimes mean juggling files around when booted into a ramfs. This is my method, but maybe it’ll point you in the right direction.
Start by downloading the latest EdgeRouter X EdgeOS release from Ubiquiti’s EdgeRouter X Page directly. We will be using 1.10.8 here.
Create a directory for it and extract everything from the tarball into that directory.
[wintr@hokkaido]~/repos$wget https://dl.ubnt.com/firmwares/edgemax/v1.10.x/ER-e50.v1.10.8.5142457.tar
ER-e50.v1.10.8.5142457.tar 100%[=============================================================================>] 78.32M 17.7MB/s in 5.2s
2018-12-28 17:11:29 (15.1 MB/s) - ‘ER-e50.v1.10.8.5142457.tar’ saved [82124800/82124800]
[wintr@hokkaido]~/repos$mkdir restore-e50
[wintr@hokkaido]~/repos$tar xvf ER-e50.v1.10.8.5142457.tar -C restore-e50/
x vmlinux.tmp
x vmlinux.tmp.md5
x squashfs.tmp
x squashfs.tmp.md5
x version.tmp
x compat
restoring EdgeOS: Boot to OpenWRT initramfs
Just as above. We can’t flash the mdt partition if we’re living in it, so we boot to a live environment. Once you are live in OpenWRTs ramfs, scp over the important files from the EdgeOS tarball.
You can try this by wget-ing the tarball, but the OpenWRT shipped wget doesn’t support https. So you won’t be able to download directly from Ubiquiti. You could try scp-ing over the whole archive once you’ve downloaded it elsewhere, but then you wont have space left to untar it. This is the easiest way I’ve found so far.
root@OpenWrt:~# cd /tmp
root@OpenWrt:/tmp#
root@OpenWrt:/tmp# scp wintr@10.80.0.52:repos/restore-e50/* .
wintr@10.80.0.52's password:
compat 100% 8 0.0KB/s 00:00
squashfs.tmp 100% 77MB 3.5MB/s 00:22
squashfs.tmp.md5 100% 33 0.0KB/s 00:00
version.tmp 100% 42 0.0KB/s 00:00
vmlinux.tmp 100% 1679KB 1.6MB/s 00:00
vmlinux.tmp.md5 100% 33 0.0KB/s 00:00
restoring EdgeOS: Unsorted Block Images
Oddly enough, when you google “UBI” the Latin translation is “where?”. Fitting for file systems. Here were going to clean up the drive partitions to get prepped for the EdgeOS. Run the following commands:
ubidetach -d 0
ubiformat /dev/mtd5
ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 --vol_id=0 --lebs=1925 --name=troot
mount -o sync -t ubifs ubi0:troot /mnt/
Which should look like this:
root@OpenWrt:/# ubidetach -d 0
[ 89.776541] block ubiblock0_0: released
[ 89.784211] ubi0: detaching mtd5
[ 89.792747] ubi0: mtd5 is detached
root@OpenWrt:/# ubiformat /dev/mtd5
ubiformat: mtd5 (nand), size 259784704 bytes (247.7 MiB), 1982 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 1981 -- 100 % complete
ubiformat: 1982 eraseblocks have valid erase counter, mean value is 5
ubiformat: formatting eraseblock 1981 -- 100 % complete
root@OpenWrt:/# ubiattach -p /dev/mtd5
[ 167.131104] ubi0: attaching mtd5
[ 169.575563] ubi0: scanning is finished
[ 169.600661] ubi0: attached mtd5 (name "ubi", size 247 MiB)
[ 169.611615] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 169.625325] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 169.638862] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 169.652734] ubi0: good PEBs: 1982, bad PEBs: 0, corrupted PEBs: 0
[ 169.664882] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 169.679294] ubi0: max/mean erase counter: 9/6, WL threshold: 4096, image sequence number: 1327463006
[ 169.697496] ubi0: available PEBs: 1938, total reserved PEBs: 44, PEBs reserved for bad PEB handling: 40
[ 169.716235] ubi0: background thread "ubi_bgt0d" started, PID 1533
UBI device number 0, total 1982 LEBs (251666432 bytes, 240.0 MiB), available 1938 LEBs (246079488 bytes, 234.6 MiB), LEB size 126976 bytes (124.0 KiB)
root@OpenWrt:/# ubimkvol /dev/ubi0 --vol_id=0 --lebs=1925 --name=troot
Volume ID 0, size 1925 LEBs (244428800 bytes, 233.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "troot", alignment 1
root@OpenWrt:/# mount -o sync -t ubifs ubi0:troot /mnt/
[ 183.510552] UBIFS (ubi0:0): default file-system created
[ 183.522468] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 1538
[ 183.640343] UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "troot"
[ 183.654909] UBIFS (ubi0:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 183.674684] UBIFS (ubi0:0): FS size: 242778112 bytes (231 MiB, 1912 LEBs), journal size 12189696 bytes (11 MiB, 96 LEBs)
[ 183.696351] UBIFS (ubi0:0): reserved for root: 4952683 bytes (4836 KiB)
[ 183.709611] UBIFS (ubi0:0): media format: w4/r0 (latest is w5/r0), UUID 552896D7-2284-47CC-9B56-87FD73826034, small LPT model
root@OpenWrt:/#
restoring EdgeOS: flashing
And now move everything into place. We end up putting the kernel into two partitions. I don’t know if this is required but I’m not messing with the incantations that have worked so far. Maybe I’ll experiment after this write up.
You’ll run the following commands:
cp /tmp/version.tmp /mnt/version
cp /tmp/squashfs.tmp /mnt/squashfs.img
cp /tmp/squashfs.tmp.md5 /mnt/squashfs.img.md5
dd if=/tmp/vmlinux.tmp of=/dev/mtdblock3
dd if=/tmp/vmlinux.tmp of=/dev/mtdblock4
Which should look like:
root@OpenWrt:/tmp# cp /tmp/version.tmp /mnt/version
root@OpenWrt:/tmp# cp /tmp/squashfs.tmp /mnt/squashfs.img
root@OpenWrt:/tmp# cp /tmp/squashfs.tmp.md5 /mnt/squashfs.img.md5
root@OpenWrt:/tmp# dd if=/tmp/vmlinux.tmp of=/dev/mtdblock3
3358+1 records in
3358+1 records out
root@OpenWrt:/tmp# dd if=/tmp/vmlinux.tmp of=/dev/mtdblock4
3358+1 records in
3358+1 records out
root@OpenWrt:/tmp#
Now, just give it a reboot and see what happens. It should be somewhat obvious if it worked or not.
Welcome to EdgeOS ubnt ttyS1
By logging in, accessing, or using the Ubiquiti product, you
acknowledge that you have read and understood the Ubiquiti
License Agreement (available in the Web UI at, by default,
http://192.168.1.1) and agree to be bound by its terms.
ubnt login: ubnt
Password:
Linux ubnt 3.10.107-UBNT #1 SMP Tue Nov 20 18:17:44 UTC 2018 mips
Welcome to EdgeOS
ubnt@ubnt:~$ show version
Version: v1.10.8
Build ID: 5142457
Build on: 11/20/18 18:09
Copyright: 2012-2018 Ubiquiti Networks, Inc.
HW model: EdgeRouter X 5-Port
HW S/N: 802AA81E12AE
Uptime: 00:01:05 up 1 min, 1 user, load average: 1.67, 0.54, 0.19
ubnt@ubnt:~$
So, now that you have a path back, there’s no reason not to experiment with OpenWRT on an EdgeRouter X. It’s even easier on an EdgeRouter Lite, but that writeup can wait till the new year.
Cheers.