rmoff's random ramblings
about talks

Reviving a bricked EdgeRouter Lite (ERL) from a Mac

Published Jun 8, 2016 by in Edgemax, Erl, Edgerouter Lite, Tftp, Rj45, Screen, Squashfs, Router, Networking at https://rmoff.net/2016/06/08/reviving-a-bricked-edgerouter-lite-erl-from-a-mac/

I’ve got an EdgeRouter LITE (ERL) which I used as my home router until a powercut fried it a while ago (looks like I’m not the only one to have this issue). The symptoms were it powering on but not giving any DHCP addresses, or after a factory reset responding on the default IP of 192.168.1.1. It was a real shame, because it had been a great bit of kit up until then. I am a complete hack when it comes to networking, and it struck the balance right between letting me do what I needed to do, without overwhelming me with complexity. I’d replaced it with a SonicWall TZ105 but having utterly failed to get the latter to permit OpenVPN traffic (so I can access my home server when on the road), which I had done with no problem on the ERL I thought I’d try and resurrect the ERL using the instructions here.

I bought a RJ45-USB cable from Amazon, and connected it to Console on the ERL and the USB to my Macbook Pro.

On my Mac, I determined USB device:

rmoff@asgard:~> ls -l /dev/tty.usbserial*
crw-rw-rw-  1 root  wheel   18,   4  8 Jun 17:01 /dev/tty.usbserial-AI038A4A

Using the eternally brilliant GNU screen as serial terminal client from standard Terminal/iTerm on the Mac: (the 115200 is the baud rate)

screen /dev/tty.usbserial-AI038A4A 115200

Powering up the router showed:

[...]
SQUASHFS error: zlib_inflate error, data probably corrupt
SQUASHFS error: squashfs_read_data failed to read block 0x29767f3
SQUASHFS error: Unable to read fragment cache entry [29767f3]
SQUASHFS error: Unable to read page, block 29767f3, size b168
SQUASHFS error: Unable to read fragment cache entry [29767f3]
SQUASHFS error: Unable to read page, block 29767f3, size b168
SQUASHFS error: Unable to read fragment cache entry [29767f3]
SQUASHFS error: Unable to read page, block 29767f3, size b168
SQUASHFS error: Unable to read fragment cache entry [29767f3]
SQUASHFS error: Unable to read page, block 29767f3, size b168
SQUASHFS error: Unable to read fragment cache entry [29767f3]
SQUASHFS error: Unable to read page, block 29767f3, size b168
start-stop-daemon: unable to start /usr/sbin/atd (Input/output error)
Starting routing daemon: rib.
Starting EdgeOS router: migrate rl-system configure.

Welcome to EdgeOS ubnt ttyS0

By logging in, accessing, or using the Ubiquiti product, you
acknowledge that you have read and understood the Ubiquiti
License Agreement (available in the Web UI at, by default,
http://192.168.1.1) and agree to be bound by its terms.

ubnt login:

[...]

And on a second occasion showed:

 0:0:0:0: [sda] No Caching mode page found
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Attached SCSI removable disk
VFS: Cannot open root device "sda2" or unknown-block(8,2): error -17
Please append a correct "root=" boot option; here are the available partitions:
1f00             512 mtdblock0  (driver?)
1f01             512 mtdblock1  (driver?)
1f02              64 mtdblock2  (driver?)
0800         3789504 sda  driver: sd
  0801          145408 sda1 35e60000-01
  0802         1709056 sda2 35e60000-02
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(8,2)

*** NMI Watchdog interrupt on Core 0x00 ***
        $0      0x0000000000000000      at      0x0000000010000ce0
        v0      0xffffffffc0620000      v1      0x0000000000000000
        a0      0xffffffffc07b0478      a1      0x0000000000000001
        a2      0x0000000000000000      a3      0xffffffffc05f8028
        a4      0x0000000000000000      a5      0x0000000000000002
        a6      0x0000000000000002      a7      0x0000000000000000
        t0      0xffffffffc07c0000      t1      0xffffffffc05f8028
        t2      0xffffffffc07b0000      t3      0x0000000000000006
        s0      0xffffffffc0590000      s1      0xffffffffc058bdd0
        s2      0xffffffffc0590000      s3      0x0000000000000014
        s4      0xffffffffc05df940      s5      0xffffffffc0688a60
        s6      0x0000000000000004      s7      0x0000000000000001
        t8      0x0000000000000000      t9      0x000000000000032b
        k0      0xdab0f2c75931f243      k1      0xd0f77c4765a7af0b
        gp      0xffffffffc05dc000      sp      0xffffffffc05df6f0
        s8      0x0000000862f59974      ra      0xffffffffc04ea078
        err_epc 0xffffffffc00a1070      epc     0xffffffffc007a140
        status  0x0000000010480ce4      cause   0x0000000040808800
        sum0    0x000000f000000000      en0     0x0100000400000000
*** Chip soft reset soon ***

(this also looks worth trying, but means opening up the ERL)

Started TFTP server on my Mac (h/t):

sudo launchctl load -F /System/Library/LaunchDaemons/tftp.plist
sudo launchctl start com.apple.tftpd

Downloaded emrk-0.9c.bin from http://packages.vyos.net/tools/emrk/ and copied it to the TFTP folder, to be used as a boot image for the ERL to run from across the network.

wget http://packages.vyos.net/tools/emrk/0.9c/emrk-0.9c.bin
sudo cp emrk-0.9c.bin /private/tftpboot/

Power up the ERL (or restart it if it’s already on) and keep pressing a key in the Console window, which will interupt the boot sequence and land you at the bootloader console:

Looking for valid bootloader image....
Jumping to start of image at address 0xbfc80000


U-Boot 1.1.1 (UBNT Build ID: 4493936-g009d77b) (Build time: Sep 20 2012 - 15:48:51)

BIST check passed.
UBNT_E100 r1:2, r2:14, serial #: DC9FDB282DDB
Core clock: 500 MHz, DDR clock: 266 MHz (532 Mhz data rate)
DRAM:  512 MB
Clearing DRAM....... done
Flash:  4 MB
Net:   octeth0, octeth1, octeth2

USB:   (port 0) scanning bus for devices... 1 USB Devices found
       scanning bus for storage devices...
  Device 0: Vendor:          Prod.: USB DISK 2.0     Rev: PMAP
            Type: Removable Hard Disk
            Capacity: 3700.6 MB = 3.6 GB (7579008 x 512)                                                                                                                           0
Octeon ubnt_e100#

Connect the ERL to your network (I used port 0), and then configure its network details:

Octeon ubnt_e100# set ipaddr 192.168.10.2
Octeon ubnt_e100# set netmask 255.255.255.0
Octeon ubnt_e100# set serverip 192.168.10.79
Octeon ubnt_e100# set gatewayip 192.168.10.1

where:

  • ipaddr - the IP address to assign to the ERL
  • netmask - 255.255.255.0 (I don’t profess to be a networking expert; maybe this would vary in some cases?)
  • serverip - the IP address of the TFTP server (my Mac, in this case)
  • gatewayip - the IP address of the router currently in use (not the ERL, but the one acting as your current gateway). According to the doc this is optional.

Then define the boot image to use, and transfer it to the ERL:

Octeon ubnt_e100# set bootfile emrk-0.9c.bin
Octeon ubnt_e100# tftpboot
Using octeth0 device
TFTP from server 192.168.10.79; our IP address is 192.168.10.2
Filename 'emrk-0.9c.bin'.
Load address: 0x9f00000
Loading: #################################################################
         #############################################
done
Bytes transferred = 15665511 (ef0967 hex), 9502 Kbytes/sec
Octeon ubnt_e100#

Finally, initiate the boot sequence from the newly-transferred image:

Octeon ubnt_e100# bootoctlinux $loadaddr
ELF file is 64 bit
Allocating memory for ELF segment: addr: 0xffffffff81100000 (adjusted to: 0x1100000), size 0xe83940
Allocated memory for ELF segment: addr: 0xffffffff81100000, size 0xe83940
Processing PHDR 0
  Loading e23d80 bytes at ffffffff81100000
  Clearing 5fbc0 bytes at ffffffff81f23d80
[...]

On boot I got some errors:

Checking system image MD5 sum
sd 0:0:0:0: [sda] Unhandled sense code
sd 0:0:0:0: [sda] Result: hostbyte=0x00 driverbyte=0x08
sd 0:0:0:0: [sda] Sense Key : 0x3 [current]
sd 0:0:0:0: [sda] ASC=0x11 ASCQ=0x0
sd 0:0:0:0: [sda] CDB: cdb[0]=0x28: 28 00 00 12 a4 18 00 00 f0 00
end_request: I/O error, dev sda, sector 1221656
sd 0:0:0:0: [sda] Unhandled sense code
sd 0:0:0:0: [sda] Result: hostbyte=0x00 driverbyte=0x08
sd 0:0:0:0: [sda] Sense Key : 0x3 [current]
sd 0:0:0:0: [sda] ASC=0x11 ASCQ=0x0
sd 0:0:0:0: [sda] CDB: cdb[0]=0x28: 28 00 00 13 d6 60 00 00 f0 00
end_request: I/O error, dev sda, sector 1300064
System image MD5 sum is not correct! Your image may be corrupted.

And then a prompt for accepting the licence and whether I wanted to use DHCP, to both of which I answered yes:

**********************************************
Welcome to EdgeMax Rescue Kit!

This tool is distributed under the terms of
GNU General Public License and other licenses

Brought to you by SO3 Group

[...]

At the EMRK> prompt, I opted for the complete reinstall:

EMRK>emrk-reinstall
WARNING: This script will reinstall EdgeOS from scratch
If you have any usable data on your router storage,
it will be irrecoverably destroyed!
Do you want to continue?
yes or no: yes
Unmounting boot partition
Unmounting root partition
Re-creating partition table
Creating boot partition
Formatting boot partition
mkfs.vfat 3.0.9 (31 Jan 2010)
Creating root partition
Formatting root partition
Mounting boot parition
Mounting root partition
kjournald starting.  Commit interval 5 seconds
EXT3 FS on sda2, internal journal
EXT3-fs: mounted filesystem with writeback data mode.
Enter EdgeOS image url:http://dl.ubnt.com/firmwares/edgemax/v1.8.0/ER-e100.v1.8.0.4853089.tar

You’re then prompted for the EdgeOS image, which you can find on the Ubiquiti website. I went for the one matching my router, ERLite (EdgeRouter ERLite-3/ERPoe-5 Firmware v1.8.0)

Unpacking EdgeOS release image
Verifying EdgeOS kernel
Copying EdgeOS kernel to boot partition
Verifying EdgeOS system image
Copying EdgeOS system image to root partition
Copying version file to the root partition
Creating EdgeOS writable data directory
Cleaning up
Installation finished
Please reboot your router

Now enter reboot to restart your hopefully-healthy ERL!

EMRK>reboot

After the reboot things looked much healthier!

scsi 0:0:0:0: Direct-Access              USB DISK 2.0     PMAP PQ: 0 ANSI: 4
sd 0:0:0:0: [sda] 7579008 512-byte logical blocks: (3.88 GB/3.61 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] No Caching mode page found
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] No Caching mode page found
sd 0:0:0:0: [sda] Assuming drive cache: write through
 sda: sda1 sda2
sd 0:0:0:0: [sda] No Caching mode page found
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Attached SCSI removable disk
kjournald starting.  Commit interval 3 seconds
EXT3-fs (sda2): using internal journal
EXT3-fs (sda2): mounted filesystem with journal data mode
VFS: Mounted root (unionfs filesystem) on device 0:11.
Freeing unused kernel memory: 288K (ffffffffc0648000 - ffffffffc0690000)
Algorithmics/MIPS FPU Emulator v1.5
INIT: version 2.88 booting
INIT: Entering runlevel: 2
[ ok ] Starting routing daemon: rib nsm ribd.
[ ok ] Starting EdgeOS router: migrate rl-system configure.

Welcome to EdgeOS ubnt ttyS0

By logging in, accessing, or using the Ubiquiti product, you
acknowledge that you have read and understood the Ubiquiti
License Agreement (available in the Web UI at, by default,
http://192.168.1.1) and agree to be bound by its terms.

ubnt login:

If you accidently close your screen you’ll find you get a “Resource Busy” and “Sorry, could not find a PTY.” error. Simply unplug the USB cable from your Mac and then plug it back in, and you’ll be good to go again from where you left off


Robin Moffatt

Robin Moffatt works on the DevRel team at Confluent. He likes writing about himself in the third person, eating good breakfasts, and drinking good beer.

Story logo

© 2025