Flashing OpenWRT onto Ubiquiti UniFi AP AC

Recently OpenWRT released version 20.02 and it’s great!

The Wiki instructions for flashing Ubiquiti AP AC devices (including Pro, Lite and LR versions) has a number of options. One uses tftp but requires a specific version of the stock firmware, others use mtd flashing tools (either from OpenWRT or stock) flashing tools, and another via serial.

I chose option 2, using mtd-tools from OpenWRT, as I think it’s the most simple. However, it did require a few extra tweaks for 20.02 due to library errors.

As per the title we are using OpenWRT tools to flash the firmware. As the device is running stock firmware, we will need to download the packages from OpenWRT and extract them onto the device so that we can use them to flash the firmware.

Flashing error

However, when following the instructions to flash, we get this library error.

UBNT-BZ.v4.3.20# lib/ld-musl-mips-sf.so.1 sbin/mtd write openwrt-21.02.0-ath79-generic-ubnt_unifiac-lite-squashfs-sysupgrade.bin kernel0
Error loading shared library libubox.so.20210516: No such file or directory (needed by sbin/mtd)
Error relocating sbin/mtd: md5_end: symbol not found
Error relocating sbin/mtd: md5sum: symbol not found
Error relocating sbin/mtd: md5_hash: symbol not found
Error relocating sbin/mtd: md5_begin: symbol not found

So, we need one more library, libubox.

Getting the firmware, tools and libraries

Let’s grab all of the required packages now.

wget https://downloads.openwrt.org/releases/21.02.0/targets/ath79/generic/packages/mtd_26_mips_24kc.ipk
wget https://downloads.openwrt.org/releases/21.02.0/targets/ath79/generic/packages/libc_1.1.24-3_mips_24kc.ipk
wget https://downloads.openwrt.org/releases/21.02.0/packages/mips_24kc/base/libubox20210516_2021-05-16-b14c4688-2_mips_24kc.ipk

Make sure that you also download the firmware for your device. I am doing this on some AC Lite devices (hence the firmware file for me is openwrt-21.02.0-ath79-generic-ubnt_unifiac-lite-squashfs-sysupgrade.bin) but your device might be different.

Now follow on with the rest of the instructions to get your device on the network and copy the files over.

Copy the files over and install them

Either connect your AP directly to your Linux machine and boot it up the device with stock firmware so that it doesn’t get an IP from DHCP. Or, boot it up and then after a few minutes, plug it into your network. Or, plug it into your network and check what IP the device got. Either way, find the IP.

If no DHCP is found, the AP should fall back to 192.168.1.20. If so, add an IP address from that range (e.g. 192.168.1.123/24) to an interface on your machine.

Copy the firmware as well as the ipk packages to your device over scp, the user is ubnt and the password is ubnt.

scp openwrt*squashfs-sysupgrade.bin ubnt@192.168.1.20:/tmp/
scp *ipk ubnt@192.168.1.20:/tmp/

Now SSH onto the device and extract the packages into /tmp/flash directory.

mkdir /tmp/flash
cd /tmp/flash
tar -xzOf /tmp/libc_1.1.24-3_mips_24kc.ipk  ./data.tar.gz | tar -xvz
tar -xzOf /tmp/mtd_26_mips_24kc.ipk ./data.tar.gz | tar -xvz
tar -xzOf /tmp/libubox20210516_2021-05-16-b14c4688-2_mips_24kc.ipk ./data.tar.gz | tar -xvz

Updated flashing command

Now we flash the OpenWRT image to kernel0, however because of the extra library flashing is slightly different. Fortunately, musl supports LD_LIBRARY_PATH which makes it super easy.

LD_LIBRARY_PATH=${PWD}/lib lib/ld-musl-mips-sf.so.1 sbin/mtd write /tmp/openwrt-21.02.0-ath79-generic-ubnt_unifiac-lite-squashfs-sysupgrade.bin kernel0

Erasing kernel1 is also slightly different.

LD_LIBRARY_PATH=${PWD}/lib lib/ld-musl-mips-sf.so.1 sbin/mtd erase kernel1

Continue on with the rest of the instructions, e.g. ensure bootloader is set to kernel0 (OpenWRT doesn’t support multi-boot).

dd if=/dev/zero bs=1 count=1 of=/dev/mtd4

Then you can reboot and hopefully when it comes back it’s running OpenWRT at the default 192.168.1.1 IP address.