Adventures installing OpenWRT

I recently got my MikroTik RB2011U, and I wanted to install OpenWRT on it.

The MikroTik RouterBOARD has a “Netinstall” mode, in which it connects to eth1 and receives a kernel to boot from using TFTP1. I ended up with this small script, based on something from the OpenWRT documentation:

#!/bin/sh

# Replace `enp2s0f1` with your ethernet interface

# Serve TFTP from $TFTP_DIR/$TFTP_FILE

TFTP_DIR=~/tmp/openwrt
TFTP_FILE=stable.elf

sudo ifconfig enp2s0f1 192.168.1.10 up

sudo dnsmasq -i enp2s0f1 --dhcp-range=192.168.1.100,192.168.1.200 \
  --dhcp-boot=$TFTP_FILE --enable-tftp --tftp-root=$TFTP_DIR \
  --enable-tftp -d -u $USER -p0 -K --log-dhcp --bootp-dynamic

Once the router attempted to connect to the DHCP server with the hostname OpenWrt, I killed the TFTP server.

This worked - the router was now running OpenWRT from RAM.

Then, I disconnected my laptop from eth1 and plugged it into eth2. The OpenWRT initramfs is configured to act as a DHCP server on eth2 through eth10.

At this point, I sshed into the router:

$ ssh root@OpenWrt

(In the future, commands starting with $ are on the host computer, and commands starting with # are on the router.)

I now had a root shell on the router! So far so good.

I then scped the OpenWRT sysupgrade2 onto the router:

$ scp ~/tmp/openwrt/stable.bin root@OpenWrt:/tmp/sysupgrade.bin

and proceeded to sysupgrade the router:

# sysupgrade /tmp/sysupgrade.bin
Image metadata not found
Cannot save config while running from ramdisk.
Commencing upgrade. Closing all shell sessions.

At this point, the router closed the SSH connection and entered a boot loop.

Huh.

That’s interesting.

I tried repeating the previous steps, replacing stable (18.06.4) OpenWRT with the snapshot. (The RB2011U v2 is listed as only supported by OpenWRT snapshot.)

No luck.

In vain, I tried pinging the router as it boot looped. It never responded.

This meant that it was crashing and burning before networking was initialized. (This also meant that OpenWRT failsafe mode wouldn’t help.)

So, I tried to read the kernel logs from flash memory:

# mount /dev/mtdblock6 /mnt
mount: mounting /dev/mtdblock6 on /mnt/ failed: Invalid argument

Maybe I need to specify the filesystem type? JFFS2 seems likely:

# mount -t jffs2 /dev/mtdblock6 /mnt
## (hangs for a *really* long time)
mount: mounting /dev/mtdblock6 on /mnt/ failed: Invalid argument

That last case was interesting, so I pulled up another SSH connection and:

# dmesg | tail -1
[  703.468505] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not
found at 0x0244003c: 0xa94c instead
[  855.211369] jffs2: Cowardly refusing to erase blocks on filesystem
with no valid JFFS2 nodes
[  855.220100] jffs2: empty_blocks 0, bad_blocks 3, c->nr_blocks 992

It appears that there’s no JFFS2 filesystem on /dev/mtdblock6. That makes sense, given:

# cat /proc/mtd | grep mtd6
mtd0: 0000c000 00001000 "routerboot"
mtd1: 00001000 00001000 "hard_config"
mtd2: 00001000 00001000 "bios"
mtd3: 00001000 00001000 "soft_config"
mtd4: 00040000 00020000 "booter"
mtd5: 003c0000 00020000 "kernel"
mtd6: 07c00000 00020000 "ubi"

It would appear that mtd6 has UBIFS on it, but:

# mount -t ubifs /dev/mtdblock6 /mnt
mount: mounting /dev/mtdblock6 on /mnt/ failed: Invalid argument

At this point, I decided to dump /dev/mtd6 to my laptop, and do some forensics:

# dd if=/dev/mtd6 | ssh ecs@192.168.1.10 dd of=/tmp/mtd6
## blah blah blah fingerprints blah blah blah
ecs@192.168.1.10's password:
253952+0 records in
253952+0 records out
253944+10 records in
253952+0 records out
130023424 bytes (130 MB, 124 MiB) copied, 313.463 s, 415 kB/s

Wait! UBI is ubi, not ubifs:

# mount -t ubi /dev/mtdblock6 /mnt
mount: mounting /dev/mtdblock6 on /mnt/ failed: No such device

What?!?!

# ls -l /dev/mtdblock6
brw-------    1 root     root       31,   6 Jan  1  1970 /dev/mtdblock6

By this point, I’ve installed ubi_reader on my laptop and I go back there to do some diagnostics:

$ ubireader_list_files mtd6
UBI Fatal: Less than 2 layout blocks found.
$ less mtd6
## UBI#^A^@^@^@...^E^@^@^B...
## ...
## <FF><FF><FF><FF><FF>...

Interesting. It appeared that OpenWRT did not successfully flash, but it failed consistently. (By this time, I had re-flashed OpenWRT quite a few times.)

At this point, it was 5:00 in the morning, so I decided to go to sleep.

Update: I returned that router and bought another one. Same problem. I decided to give up.


  1. The Trivial File Transfer Protocol.
  2. OpenWRT has a sysupgrade command which takes a firmware image and installs it. The install procedure for MikroTik RouterBOARDs is to run OpenWRT from RAM using TFTS, then use sysupgrade to flash a firmware upgrade.

Posts from RSS feeds I follow around the net

How to enter the GMTK Game Jam

via Game Maker's Toolkit June 26, 2020
Endorheic Basin

via xkcd.com June 26, 2020
General-purpose OS, special-purpose OS, and now: vendor-purpose OS

There have, historically, been two kinds of operating systems: general-purpose, and special-purpose. These roles are defined by the function they serve for the user. Examples of general-purpose operating systems include Unix (Linux, BSD, etc), Solaris, Haiku…

via Drew DeVault's Blog June 26, 2020

Generated by openring