Another Ubiquity ER-X bricked

[AStroh]

I have had issues with my Ubiquiti ER-X (Edge Router X) and changing the firmware. I want to post where I am at so others can learn from my mistake and if anyone has any input I’ll take it. I tried to update the firmware via TFTP but the uboot kernel is not communicating over TCPIP. I have the ip in the environment variable and plugged into another switch but no dice.

I bricked the router bad. I have a bad boot kernel (Kernel Panic) memory sector bfd4000 and c0040000. I am not aware of any others I can boot into. I tried a Kermit usb-serial-3pins on router update via option 7, which appears to copy just fine but into memory sector 80100000 but that has consistently failed with even the signed firmware which takes 8 hours over serial. 20 minutes for each smaller .bin file but those fail also.

I started by forcing an update. That bricked bfd4000. I was able to boot into c004000 and get into busybox. Busybox allowed TCP/IP and I was able to SCP (secure copy) over a new firmware and I had an old version of OpenWRT working. I do not know why but I managed to brick that c004000 sector as well.

Now I can only communicate via the uboot and the router will bootloop if I let it continue via option 3.

I have TFTP server setup correctly but without TCP/IP connectivity with uboot, it is useless. I don’t know if I am missing some environment variable or something. Uboot options below.

Using loadb bfd4000 vme50, fails no matter what for some reason to transfer using Kermit serial.

Now, the latest I am trying is a cp.linux to bfd4000 to transfer a linux kernel over to a bootable memory space. I have yet to try the ‘go’, ‘i2ccmd’, ‘mdio’, ‘nand’, ‘mm’, ‘spi’, and ‘ubnt’ commands.

I don’t know if the following translates to bfd4000 or c004000.

On bootup, I see:

0x000000000000-0x000000008000 : “u-boot”

0x000000008000-0x00000000e000 : “u-boot-env”

0x00000000e000-0x000000140000 : “factory”

0x000000140000-0x000000440000 “kernel 1”

0x000000440000-0x000000740000 “kernel 2”

0x000000740000-0x00000ff00000 “ ubi”

Thanks for reading.

Here are my uboot options:

4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Nov 2 2015–16:39:31)

MT7621 # ?

? — alias for ‘help’

bootm — boot application image from memory

cp — memory copy

erase — erase SPI FLASH memory

go — start application at address ‘addr’

help — print online help

i2ccmd — read/write data to eeprom via I2C Interface

loadb — load binary file over serial line (kermit mode)

md — memory display

mdio — Ralink PHY register R/W command !!

mm — memory modify (auto-incrementing)

nand — nand command

nm — memory modify (constant address)

printenv- print environment variables

reset — Perform RESET of the CPU

saveenv — save environment variables to persistent storage

setenv — set environment variables

spi — spi command

tftpboot- boot image via network using TFTP protocol

ubntw — ubntw command

version — print monitor version

[mk24]

Run a TFTP server on your PC. I think that uboot only works on Ethernet port 0. Use the bootloader tftpboot command to download the initramfs-kernel image of OpenWrt. Launch it with bootm. This runs OpenWrt in RAM. scp the sysupgrade OpenWrt to this running OpenWrt (you will need to move the Ethernet cable to port 1) and install it with sysupgrade.

The sysupgrade script knows is the best way to format and install OpenWrt to flash. Writing directly to flash from the bootloader CLI is not recommended, especially with NAND flash.

[AStroh]

I would but the router is not accessible by tcp/ip. Idk if I am missing something in the setup/env variables but everything seems fine. I cannot ping it and it cannot connect over tftp.

Only the uboot commands at the bottom of my post are accessible and Kermit transmit over serial to the odd boot space mentioned.

[mk24]

I don't think it ever answers pings. You need a server on the PC not a client (for Ubiquiti TFTP push recovery, you use a client). The most common problem with setting up a TFTP server is its operation being blocked by firewall(s) on the PC. If you run Wireshark on the PC you should see TFTP requests from the router during execution of the tftpboot command even if a firewall is active.

[AStroh]

Thanks @mk24.

It turns out I had a second firewall so to speak running. Running wireshark identified that pretty quickly. I had a TFTP being sent out with no error but my TFTP receiver on the router was timing out. I could not use bootm but I was able to use option 1 to tftp boot into ram then upgrade from the luci webpage. Using the default luci webpage instead of changing the ip address was much easier also.

I tried going all the way to the latest version 21.02 but I had issues with the wan port not coming up when trying to change my settings to reflect the new DSA config and rolled back to the latest 19.07.7 The default config doesn't allow me access to the internet.
If someone posts a DSA config for an ER-X, I may try it. The guide didn't work out for some reason.