Hello,
I'm getting a hard time when flashing my dated Unifi AP Pro with OpenWrt v 23.
I've downloaded the factory image referenced here
and successfully flashed it via tftp.
Only after erasing the u-bbot-env partition I get the kernel to boot, but it then goes into a loop complaining that it can't use older JFFS2 with newer kernels?
U-Boot unifi-v1.6.15.278-g4ebbbcff (Mar 5 2018 - 23:40:54)
DRAM: 128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ffb000, log_magic:0xf0b2711b kseg: 0xa0000000
Flash: 16 MB
PCIe WLAN Module found (tries: 1).
Net: eth0: 04:18:d6:80:c8:a7
eth0
Setting 0xb8116290 to 0x20402d0f
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot: 0
Board: Ubiquiti Networks AR9344 board (e507-33.2123.0030.0030)
0. Name = u-boot, offset = 0, start_addr=9f000000, size=262144,start_sector=0, end_sector=3
1. Name = u-boot-env, offset = 40000, start_addr=9f040000, size=65536,start_sector=4, end_sector=4
2. Name = jffs2, offset = 50000, start_addr=9f050000, size=16121856,start_sector=5, end_sector=250
3. Name = cfg, offset = fb0000, start_addr=9ffb0000, size=262144,start_sector=251, end_sector=254
4. Name = EEPROM, offset = ff0000, start_addr=9fff0000, size=65536,start_sector=255, end_sector=255
UBNT application initialized
Scanning JFFS2 FS: . done.
find_inode failed for name=kernel1
ls: Failed to scan jffs2 file structure
## Booting image at 81000000 ...
Image Name: MIPS OpenWrt Linux-5.15.167
Created: 2024-09-23 12:34:46 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2337979 Bytes = 2.2 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum at 0x81000040 ...OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 5.15.167 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24106-10cc5fcd00) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Mon Sep 23 12:34:46 2024
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[ 0.000000] MIPS: machine is Ubiquiti UniFi AP Pro
[ 0.000000] SoC: Atheros AR9344 rev 3
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 120820K/131072K available (6100K kernel code, 599K rwdata, 784K rodata, 1212K init, 216K bss, 10252K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] CPU clock: 560.000 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6825930166 ns
[ 0.000001] sched_clock: 32 bits at 280MHz, resolution 3ns, wraps every 7669584382ns
[ 0.008391] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
[ 0.084998] pid_max: default: 32768 minimum: 301
[ 0.091035] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.098856] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.114490] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.125017] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.132494] pinctrl core: initialized pinctrl subsystem
[ 0.140140] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.147108] thermal_sys: Registered thermal governor 'step_wise'
[ 0.161176] clocksource: Switched to clocksource MIPS
[ 0.174710] NET: Registered PF_INET protocol family
[ 0.180169] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.189003] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.198074] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.206349] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.214531] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.222066] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.228980] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.236007] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.243901] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.250012] PCI: CLS 0 bytes, default 32
[ 0.257939] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 0.271056] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.277350] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.289571] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[ 0.302127] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[ 0.309431] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.319195] printk: console [ttyS0] disabled
[ 0.323885] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[ 0.333102] printk: console [ttyS0] enabled
[ 0.333102] printk: console [ttyS0] enabled
[ 0.342016] printk: bootconsole [early0] disabled
[ 0.342016] printk: bootconsole [early0] disabled
[ 0.371651] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[ 0.376956] 5 fixed-partitions partitions found on MTD device spi0.0
[ 0.383486] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[ 0.390249] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[ 0.397430] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[ 0.404240] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[ 0.411673] Creating 5 MTD partitions on "spi0.0":
[ 0.416564] 0x000000000000-0x000000040000 : "u-boot"
[ 0.427546] 0x000000040000-0x000000050000 : "u-boot-env"
[ 0.434166] 0x000000050000-0x000000fb0000 : "firmware"
[ 0.442357] 2 fixed-partitions partitions found on MTD device firmware
[ 0.449007] Creating 2 MTD partitions on "firmware":
[ 0.454099] 0x000000000000-0x000000300000 : "kernel"
[ 0.460300] 0x000000300000-0x000000f60000 : "rootfs"
[ 0.468259] mtd: setting mtd4 (rootfs) as root device
[ 0.473534] mtdsplit: no squashfs found in "rootfs"
[ 0.478528] 0x000000fb0000-0x000000ff0000 : "cfg"
[ 0.484562] 0x000000ff0000-0x000001000000 : "art"
[ 0.887072] switch0: Atheros AR8327 rev. 4 switch registered on mdio.0
[ 1.541340] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd034, driver=Atheros AR8216/AR8236/AR8316]
[ 1.552654] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii
[ 1.559522] i2c_dev: i2c /dev entries driver
[ 1.566472] NET: Registered PF_INET6 protocol family
[ 1.582595] Segment Routing with IPv6
[ 1.586417] In-situ OAM (IOAM) with IPv6
[ 1.590538] NET: Registered PF_PACKET protocol family
[ 1.595846] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 1.609346] 8021q: 802.1Q VLAN Support v1.8
[ 1.615354] PCI host bridge to bus 0000:00
[ 1.619531] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[ 1.626573] pci_bus 0000:00: root bus resource [io 0x0000]
[ 1.632249] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 1.640341] pci 0000:00:00.0: [168c:0033] type 00 class 0x028000
[ 1.646496] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x0001ffff 64bit]
[ 1.653457] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[ 1.660349] pci 0000:00:00.0: supports D1
[ 1.664440] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[ 1.671681] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[ 1.678442] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1001ffff 64bit]
[ 1.685914] pci 0000:00:00.0: BAR 6: assigned [mem 0x10020000-0x1002ffff pref]
[ 1.696326] clk: Disabling unused clocks
[ 1.704515] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000144: 0x6873 instead
[ 1.714264] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000148: 0x4505 instead
[ 1.723912] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000014c: 0x6660 instead
[ 1.733548] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000154: 0x2d00 instead
[ 1.743183] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000158: 0x0400 instead
[ 1.752819] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000015c: 0xc002 instead
[ 1.762446] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000160: 0x0400 instead
[ 1.772073] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000164: 0x040e instead
[ 1.781701] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000016c: 0x285a instead
[ 1.791337] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000174: 0x205a instead
[ 1.800953] jffs2: Further such events for this erase block will not be printed
[ 1.810267] jffs2: Empty flash at 0x0000017c ends at 0x00000184
[ 1.847670] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x87a4 instead
[ 1.857321] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x7dfd instead
[ 1.866955] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010008: 0x3e6f instead
[ 1.876581] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001000c: 0xafd9 instead
[ 1.886209] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010010: 0xd969 instead
[ 1.895835] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010014: 0x6769 instead
[ 1.905463] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0xdf5b instead
[ 1.915096] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001001c: 0x187e instead
[ 1.924727] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010020: 0xce7e instead
[ 1.934353] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010024: 0x596a instead
[ 1.943980] jffs2: Further such events for this erase block will not be printed
[ 1.984703] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020000: 0x239e instead
[ 1.994354] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020004: 0xc3f2 instead
[ 2.003989] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020008: 0x8b30 instead
[ 2.013623] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0002000c: 0x540d instead
[ 2.023259] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020010: 0xc249 instead
[ 2.032888] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020014: 0x6402 instead
[ 2.042523] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020018: 0x6cae instead
[ 2.052150] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0002001c: 0x1748 instead
[ 2.061778] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020020: 0xadd8 instead
[ 2.071405] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00020024: 0xf38e instead
[ 2.081022] jffs2: Further such events for this erase block will not be printed
[ 2.113276] jffs2: Old JFFS2 bitmask found at 0x0002b8fc
[ 2.118668] jffs2: You cannot use older JFFS2 filesystems with newer kernels
I'm a bit confused with squashfs and jffs2? So the image should use squashfs but repartitioning and changing from jffs2 to squashfs cannot be done unless replacing u-boot itself?
This is how I flashed the firmware:
ar7240> tftpboot 0x81000000 openwrt-factory.bin
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename 'openwrt-factory.bin'.
Load address: 0x81000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#############################################
done
Bytes transferred = 6881943 (690297 hex)
ar7240> erase 0x9f050000 +0x690297
.......................................................................................................... done
Erased 106 sectors
ar7240> cp.b 0x81000000 0x9f050000 0x690297
Copy to Flash... write addr: 9f050000
done
After that booting the image fails "Bad Magic Number":
ar7240> bootm 0x9f050000
## Booting image at 9f050000 ...
Bad Magic Number
However if I erase the u-boot-env partition it is at least booting a kernel (from a different address - but fails with above error?):
ar7240> mtdpart
device nor0 <ath-nor0>, # parts = 5
#: name size offset mask_flags
0: u-boot 0x00040000 0x00000000 0
1: u-boot-env 0x00010000 0x00040000 0
2: jffs2 0x00f60000 0x00050000 0
3: cfg 0x00040000 0x00fb0000 0
4: EEPROM 0x00010000 0x00ff0000 0
active partition: nor0,0 - (u-boot) 0x00040000 @ 0x00000000
defaults:
mtdids : nor0=ath-nor0
mtdparts: mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),15744k(jffs2),256k(cfg),64k(EEPROM)
ar7240> erase 0x9f040000 +0x10000
. done
Erased 1 sectors
ar7240> reset
Resetting...
U-Boot unifi-v1.6.15.278-g4ebbbcff (Mar 5 2018 - 23:40:54)
DRAM: 128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ffb000, log_magic:0xf0b2711b kseg: 0xa0000000
Flash: 16 MB
*** Warning - bad CRC, using default environment
PCIe WLAN Module found (tries: 1).
Net: eth0: 04:18:d6:80:c8:a7
eth0
Setting 0xb8116290 to 0x20402d0f
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot: 0
Board: Ubiquiti Networks AR9344 board (e507-33.2123.0030.0030)
0. Name = u-boot, offset = 0, start_addr=9f000000, size=262144,start_sector=0, end_sector=3
1. Name = u-boot-env, offset = 40000, start_addr=9f040000, size=65536,start_sector=4, end_sector=4
2. Name = jffs2, offset = 50000, start_addr=9f050000, size=16121856,start_sector=5, end_sector=250
3. Name = cfg, offset = fb0000, start_addr=9ffb0000, size=262144,start_sector=251, end_sector=254
4. Name = EEPROM, offset = ff0000, start_addr=9fff0000, size=65536,start_sector=255, end_sector=255
u-boot-env is invalid, overiding with default.
First 0x4 last 0x4 sector size 0x10000
. done
write addr: 9f040000
UBNT application initialized
Scanning JFFS2 FS: . done.
find_inode failed for name=kernel1
ls: Failed to scan jffs2 file structure
## Booting image at 81000000 ...
Image Name: MIPS OpenWrt Linux-5.15.167
Created: 2024-09-23 12:34:46 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2337979 Bytes = 2.2 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum at 0x81000040 ...OK
Uncompressing Kernel Image ... OK
It seems that some leftovers from ubnt are fiddling with boot params? What am I doing wrong?
Any help is appreciated!
