Openwrt support for the Unifi Express UX/ UXG Lite

hecatae · November 10, 2024, 8:01pm

The Express has a Qualcomm IPQ5018 chipset, with a dual-core ARM A53 CPU running at 1 GHz. It has 1 GB DDR3L RAM and 16 GB of storage.

fdisk -l
Disk /dev/mtdblock0: 192 KiB, 196608 bytes, 384 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mtdblock1: 64 KiB, 65536 bytes, 128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mtdblock2: 64 KiB, 65536 bytes, 128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mtdblock3: 640 KiB, 655360 bytes, 1280 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mtdblock4: 64 KiB, 65536 bytes, 128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mtdblock5: 64 KiB, 65536 bytes, 128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mtdblock6: 64 KiB, 65536 bytes, 128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mtdblock7: 640 KiB, 655360 bytes, 1280 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mtdblock8: 448 KiB, 458752 bytes, 896 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mtdblock9: 64 KiB, 65536 bytes, 128 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mtdblock10: 5.75 MiB, 6029312 bytes, 11776 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes


Disk /dev/mmcblk0: 14.56 GiB, 15634268160 bytes, 30535680 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 26E18D23-2274-43BA-8834-F1764ABCD615

Device            Start      End  Sectors  Size Type
/dev/mmcblk0p1     2048   133119   131072   64M Linux filesystem
/dev/mmcblk0p2   133120   198655    65536   32M Linux filesystem
/dev/mmcblk0p3   198656  4392959  4194304    2G Linux filesystem
/dev/mmcblk0p4  4392960  6490111  2097152    1G Linux filesystem
/dev/mmcblk0p5  6490112 10684415  4194304    2G Linux filesystem
/dev/mmcblk0p6 10684416 30533631 19849216  9.5G Linux filesystem


Disk /dev/loop0: 887.77 MiB, 930893824 bytes, 1818152 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes

Further hardware specifications are available here:

This would be a great travel router, but Ubiquiti cripple it to be a access point or a gateway and controller and access point, which can only manage a further four unifi devices.

While I await for mine to arrive, has anyone started work on the UX or the very similar UXG Lite.

brada4 · November 10, 2024, 8:06pm

No ipq5018 supported yet. For the price you can fill the travel bag with simpler usb-c power routers.

hecatae · February 4, 2025, 12:37pm

teardown found here:
https://linustechtips.com/topic/1547871-unifi-express-teardown/

That looks promising for a serial connection, unifi os is a debian variant.

frollic · February 4, 2025, 12:52pm

I would agree.
Unless it delivers something really spectacular (which I doubt), why pay them $150.

hecatae · February 5, 2025, 2:30pm

Looks like it has 10GB storage.

df -h
Filesystem                         Size  Used Avail Use% Mounted on
udev                               455M     0  455M   0% /dev
tmpfs                               92M   19M   74M  20% /run
/dev/disk/by-partlabel/root        2.0G  1.7G  101M  95% /boot/firmware
/dev/loop0                         888M  888M     0 100% /mnt/.rofs
/dev/disk/by-partlabel/overlay     9.3G  2.4G  6.4G  28% /mnt/.rwfs
overlayfs-root                     9.3G  2.4G  6.4G  28% /
/dev/disk/by-partlabel/log         974M   47M  861M   6% /var/log
/dev/disk/by-partlabel/persistent  2.0G  100M  1.7G   6% /persistent
tmpfs                              459M   28K  459M   1% /dev/shm
tmpfs                              5.0M     0  5.0M   0% /run/lock
tmpfs                              4.0M     0  4.0M   0% /sys/fs/cgroup
tmpfs                              230M  252K  230M   1% /tmp
tmpfs                               16M     0   16M   0% /var/log/ulog
tmpfs                               64M     0   64M   0% /var/opt/unifi/tmp

Base operating system is Debian 11 Bullseye with a 4.4.60-ui-qcom kernel.

cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00001000 "SBL1"
mtd1: 00010000 00001000 "MIBIB"
mtd2: 00010000 00001000 "BOOTCONFIG"
mtd3: 000a0000 00001000 "QSEE"
mtd4: 00010000 00001000 "DEVCFG"
mtd5: 00010000 00001000 "CDT"
mtd6: 00010000 00001000 "APPSBLENV"
mtd7: 000a0000 00001000 "APPSBL"
mtd8: 00070000 00001000 "ART"
mtd9: 00010000 00001000 "EEPROM"
mtd10: 005c0000 00001000 "config"

Firmware is provided as a bin file:

INFO[0068] Firmware upgrade start
INFO[0068] Invoke hooks under /usr/lib/ubnt/hooks/system/upgrade-top
INFO[0076] Failed to extract updater from firmware [/var/tmp/fwupdate.lW3uEj8dry]: Failed to fwextract updater from /var/tmp/fwupdate.lW3uEj8dry to /tmp/fw-updater err=[exit status 255]
INFO[0076] Upgrade Preloader
INFO[0076] Preloader not found in the device, skip
INFO[0076] Upgrade ATF
INFO[0076] ATF not found in the device, skip
INFO[0077] Upgrade QCA Preloaders
INFO[0078] QCA Preloaders partition qsee matched, skip
INFO[0078] QCA Preloaders partition devcfg matched, skip
INFO[0079] QCA Preloaders partition sbl1 matched, skip
INFO[0079] Upgrade uboot
INFO[0080] uboot matched, skip
INFO[0080] Upgrade kernel
INFO[0082] Upgrade rootfs
INFO[0155] Invoke hooks under /usr/lib/ubnt/hooks/system/upgrade-bottom
INFO[0157] Firmware upgrade end
Firmware ready - rebooting to update...

hecatae · February 15, 2025, 7:50pm

UXG Lite is the same chipset but missing the wireless.
Updated topic as UXG Lite is unnecessarily crippled as far as I can see, got one on it's way to compare.

Arrived, it's got 1gb RAM, will crack into the device tomorrow.

@Hostle @georgem83 have either of you got a simple initramfs-kernel.bin suitable for a ipq5018 device with just single WAN and LAN, I was considering trying the X2000 ones.

hecatae · February 25, 2025, 11:41pm

Today Ubiquiti launched the Unifi Express 7

I'm still laughing at the 10g wan and the 2.5g lan...

Anyway I expect to see a few more of the UX and UXG Lite available with people upgrading so I'm continuing.

Hostle · February 26, 2025, 11:08pm

I am sure one can be provided .. I'm not home this week, but I can provide one when I return next week, if you are still in need.

georgem83 · February 27, 2025, 1:04am

Happy to help, do you have ssh or serial access to stock?

hecatae · February 27, 2025, 1:48am

I have SSH access, still working out how to open the housing.

georgem83 · February 27, 2025, 4:31am

ok, ssh would be good enough for now.

Can you run the following and send the output?

ifconfig
cat /proc/mtd
ls /sys/class/mdio_bus/90000.mdio-1/

hecatae · February 27, 2025, 7:59am

ifconfig

br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.1  netmask 255.255.255.0  broadcast 0.0.0.0
        inet6 fe80::962a:6fff:fe12:5311  prefixlen 64  scopeid 0x20<link>
        ether 94:2a:6f:12:53:11  txqueuelen 1000  (Ethernet)
        RX packets 4805859  bytes 1873926419 (1.7 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 11747578  bytes 12831975843 (11.9 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::962a:6fff:fe12:5311  prefixlen 64  scopeid 0x20<link>
        ether 94:2a:6f:12:53:11  txqueuelen 1000  (Ethernet)
        RX packets 271784  bytes 41881194 (39.9 MiB)
        RX errors 0  dropped 8  overruns 0  frame 0
        TX packets 1217338  bytes 1410012871 (1.3 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::962a:6fff:fe12:5312  prefixlen 64  scopeid 0x20<link>
        ether 94:2a:6f:12:53:12  txqueuelen 1000  (Ethernet)
        RX packets 12041610  bytes 12947732411 (12.0 GiB)
        RX errors 0  dropped 102  overruns 22  frame 22
        TX packets 4860154  bytes 1974827182 (1.8 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 2011699  bytes 1650275173 (1.5 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2011699  bytes 1650275173 (1.5 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1492
        inet x.x.x.x  netmask 255.255.255.255  destination x.x.x.x
        ppp  txqueuelen 1000  (Point-to-Point Protocol)
        RX packets 12026051  bytes 12678968073 (11.8 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4846743  bytes 1948341064 (1.8 GiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vwireap5: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether 9e:2a:6f:12:53:14  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wifi0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        unspec 94-2A-6F-12-53-13-00-00-00-00-00-00-00-00-00-00  txqueuelen 8191                                                                               (UNSPEC)
        RX packets 3511696  bytes 1673968152 (1.5 GiB)
        RX errors 3  dropped 0  overruns 0  frame 0
        TX packets 7603603  bytes 3160576827 (2.9 GiB)
        TX errors 5509  dropped 5509 overruns 0  carrier 0  collisions 0

wifi1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        unspec 94-2A-6F-12-53-14-00-00-00-00-00-00-00-00-00-00  txqueuelen 8191                                                                               (UNSPEC)
        RX packets 1142813  bytes 237889126 (226.8 MiB)
        RX errors 3  dropped 0  overruns 0  frame 0
        TX packets 3671271  bytes 4054738707 (3.7 GiB)
        TX errors 462  dropped 462 overruns 0  carrier 0  collisions 0

wifi0ap0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::962a:6fff:fe12:5313  prefixlen 64  scopeid 0x20<link>
        ether 94:2a:6f:12:53:13  txqueuelen 0  (Ethernet)
        RX packets 411505  bytes 61298653 (58.4 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2382378  bytes 3126092421 (2.9 GiB)
        TX errors 296  dropped 0 overruns 0  carrier 0  collisions 0

wifi0ap1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::982a:6fff:fe12:5313  prefixlen 64  scopeid 0x20<link>
        ether 9a:2a:6f:12:53:13  txqueuelen 0  (Ethernet)
        RX packets 3052520  bytes 1604342440 (1.4 GiB)
        RX errors 3  dropped 3  overruns 0  frame 0
        TX packets 5217850  bytes 4599768677 (4.2 GiB)
        TX errors 5213  dropped 0 overruns 0  carrier 0  collisions 0

wifi0ap2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::9c2a:6fff:fe12:5313  prefixlen 64  scopeid 0x20<link>
        ether 9e:2a:6f:12:53:13  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wifi1ap3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::962a:6fff:fe12:5314  prefixlen 64  scopeid 0x20<link>
        ether 94:2a:6f:12:53:14  txqueuelen 0  (Ethernet)
        RX packets 1142618  bytes 237860880 (226.8 MiB)
        RX errors 3  dropped 3  overruns 0  frame 0
        TX packets 3479536  bytes 4150381836 (3.8 GiB)
        TX errors 462  dropped 0 overruns 0  carrier 0  collisions 0

wifi1ap4: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::982a:6fff:fe12:5314  prefixlen 64  scopeid 0x20<link>
        ether 9a:2a:6f:12:53:14  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

cat /proc/mtd

dev:    size   erasesize  name
mtd0: 00030000 00001000 "SBL1"
mtd1: 00010000 00001000 "MIBIB"
mtd2: 00010000 00001000 "BOOTCONFIG"
mtd3: 000a0000 00001000 "QSEE"
mtd4: 00010000 00001000 "DEVCFG"
mtd5: 00010000 00001000 "CDT"
mtd6: 00010000 00001000 "APPSBLENV"
mtd7: 000a0000 00001000 "APPSBL"
mtd8: 00070000 00001000 "ART"
mtd9: 00010000 00001000 "EEPROM"
mtd10: 005c0000 00001000 "config"

ls /sys/class/mdio_bus/90000.mdio-1/

ls: cannot access '/sys/class/mdio_bus/90000.mdio-1/': No such file or directory

ls /sys/class/mdio_bus/90000.mdio/
90000.mdio:1c/ device@ of_node@ power/ subsystem@ uevent

georgem83 · February 27, 2025, 8:21am

ok, so you have the two internal MACs connected to two ethernet phys, one is ge_phy (1 gbps) and the other likely qca8081 (2.5gbps) based on the phy address (0x1c).

Can you also send the output of dmesg | grep cnss to identify what BDFs are used. They'll be called bdwlan.b*. Can you grab those files from stock and send them over? They'll need some editing..

I'll prepare a dts and post a link shortly..

hecatae · February 27, 2025, 8:49am

interesting, dmesg | grep cnss comes back with nothing.

georgem83 · February 27, 2025, 9:20am

can you post the output of dmesg?

georgem83 · February 27, 2025, 9:30am

and hexdump -C -n 128 /dev/mtd8 or you may have to use a similar tool if not found

georgem83 · February 27, 2025, 9:37am

here's a dts you can start off from:

hecatae · February 27, 2025, 8:25pm

unifi express UX dmesg:

hecatae · February 27, 2025, 8:27pm

only hexdump tools found:

apt search hexdump
Sorting... Done
Full Text Search... Done
libdata-hexdump-perl/oldstable 0.02-1.1 all
  hexadecimal dumper

libdata-hexdumper-perl/oldstable 3.0001-1.1 all
  module for formatting binary data in a human-readable way

This basically runs Debian 11 Bullseye, so is there anything linux that you would prefer me to use?