Flashing the Ubiquiti Unifi UAP v2

mk24 · July 29, 2021, 3:09pm

It's not the same hardware, the Nanostation has two Ethernet ports and the UAP only has one. In both cases though I think the AR7241 internal switch is involved. (this is because the bootloader recovery expects to TFTP from what would be a "LAN" port on a 5 port router, not the separate un-switched WAN port). So even though only one of the five PHYs on the AR7241 is actually wired out to a physical port, it is one of the switched ones.

For snapshot builds consider the "LAN enumeration" note from the Nanostation page:

These should still be swconfig based. Is the swconfig command present? Does it show the switch port going up and down as the network cable is plugged and unplugged (on the other side of the POE injector of course).

rdmitry0911 · July 29, 2021, 4:18pm

In 19.07.6 ubnt_unifi build eth0 works fine and there is no switch in config: swconfig list shows nothing.

in snapshot ubnt_unifi build eth0 doesn't work, link state of eth0 is always down and can't be brought up. There is a switch in configuration:

root@OpenWrt:/# swconfig dev switch0 show
Global attributes:
        enable_vlan: 0
        ar8xxx_mib_poll_interval: 500
        ar8xxx_mib_type: 0
        enable_mirror_rx: 0
        enable_mirror_tx: 0
        mirror_monitor_port: 0
        mirror_source_port: 0
        arl_table: address resolution table

Port 0:
        mib: No MIB data
        pvid: 0
        link: port:0 link:up speed:10baseT half-duplex 
Port 1:
        mib: No MIB data
        pvid: 0
        link: port:1 link:up speed:10baseT half-duplex 
Port 2:
        mib: No MIB data
        pvid: 0
        link: port:2 link:up speed:10baseT half-duplex 
Port 3:
        mib: No MIB data
        pvid: 0
        link: port:3 link:up speed:10baseT half-duplex 
Port 4:
        mib: No MIB data
        pvid: 0
        link: port:4 link:up speed:10baseT half-duplex 
root@OpenWrt:/#

in snapshot ubnt_nanostation-m build eth0 doesn't work, link state of eth0 can be brought up, thou cable plug/unplug is not recognized. There is a switch in configuration:

root@OpenWrt:/# swconfig dev switch0 show
Global attributes:
        enable_vlan: 0
        ar8xxx_mib_poll_interval: 500
        ar8xxx_mib_type: 0
        enable_mirror_rx: 0
        enable_mirror_tx: 0
        mirror_monitor_port: 0
        mirror_source_port: 0
        arl_table: address resolution table

Port 0:
        mib: No MIB data
        pvid: 0
        link: port:0 link:up speed:10baseT half-duplex 
Port 1:
        mib: No MIB data
        pvid: 0
        link: port:1 link:up speed:10baseT half-duplex 
Port 2:
        mib: No MIB data
        pvid: 0
        link: port:2 link:up speed:10baseT half-duplex 
Port 3:
        mib: No MIB data
        pvid: 0
        link: port:3 link:up speed:10baseT half-duplex 
Port 4:
        mib: No MIB data
        pvid: 0
        link: port:4 link:up speed:10baseT half-duplex

 root@OpenWrt:/# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
    link/ether 02:27:22:0a:22:85 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::27:22ff:fe0a:2285/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc fq_codel state DOWN qlen 1000
    link/ether 00:27:22:0a:22:85 brd ff:ff:ff:ff:ff:ff
    inet 172.16.66.180/24 brd 172.16.66.255 scope global eth1
       valid_lft forever preferred_lft forever
4: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 00:27:22:0b:22:85 brd ff:ff:ff:ff:ff:ff

rdmitry0911 · July 30, 2021, 12:56pm

Still struggling. my /etc/board.json looks like this:

root@OpenWrt:~# cat /etc/board.json
{
	"model": {
		"id": "ubnt,unifi",
		"name": "Ubiquiti UniFi"
	},
	"network": {
		"lan": {
			"device": "eth0",
			"protocol": "static"
		}
	},
	"system": {
		"label_macaddr": "00:27:22:0b:22:85"
	}
}
root@OpenWrt:~#

and this is strange for me, that there is no switch section in there and there is a switch in the system.
BTW, how do your /etc/config/network, /etc/board.json and swconfig dev switch0 show look like?

rdmitry0911 · July 30, 2021, 2:37pm

And one more strange thing I've found

kernel log of 19.07.7 unifi build with working eth0 contains this:

[    1.418811] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:04 [uid=004dd041, driver=Generic PHY]
[    1.428871] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii

kernel log of snapshot unifi build with broken eth0 contains this:

[    1.222054] switch0: Atheros AR724X/AR933X built-in rev. 0 switch registered on mdio.0
[    1.606583] ag71xx 19000000.eth: connected to PHY at mdio.0:1f:04 [uid=00000000, driver=Generic PHY]
[    1.616800] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii

kernel log of snapshot nanostation build with semi-working eth0 contains this:

[    1.842266] switch0: Atheros AR724X/AR933X built-in rev. 0 switch registered on mdio.0
[    1.926945] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[    1.936995] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: gmii

As you may note, ag71xx connects to PHY different way in all 3 cases. I think this is the reason of broken eth0. Is there any way to control this?

rdmitry0911 · July 31, 2021, 2:56pm

I managed to build an image that works fine on my unifi ap. I've just changed in target/linux/ath79/dts/ar7241_ubnt_unifi.dtsi

#include "ar7241.dtsi" -> #include "ar7240.dtsi"

and rebuild the system. That's it.

alefello · October 1, 2021, 7:29am

Hi
Were you able to flash it permantly at last?
Thank you

alefello · October 1, 2021, 6:21pm

It's a v1 or a v2?
Thank you

BennoHouse · October 13, 2021, 9:11pm

Hi, no. The devices are currently just running the initramfs-build and are connected to a UPS. So far, they are working well enough, but will be replaced with a different system in time.

BennoHouse · February 22, 2023, 1:36pm

Hi everyone,

just a quick update.

We have swapped out the old access points in the mean time, but I took them out of storage once again to try and flash them permanently.

I saw that the Nanostation Loco build has the same flash size as the UAP v2 apparently (8 MB), so I just booted the initramfs build again and did a sysupgrade from SSH.

Unfortunately, that just destroyed the stock system and the AP is now unable to boot normally.

The serial messages from the update looked like this:

Tue Jan  3 00:26:11 UTC 2023 upgrade: Sending TERM to remaining processes ...
Tue Jan  3 00:26:11 UTC 2023 upgrade: Sending signal TERM to ntpd (2127)
Tue Jan  3 00:26:11 UTC 2023 upgrade: Sending signal TERM to ntpd (2130)
Tue Jan  3 00:26:15 UTC 2023 upgrade: Sending KILL to remaining processes ...
Tue Jan  3 00:26:15 UTC 2023 upgrade: Sending signal KILL to ntpd (2127)
Tue Jan  3 00:26:15 UTC 2023 upgrade: Sending signal KILL to ntpd (2130)
[  129.131078] stage2 (2796): drop_caches: 3
Tue Jan  3 00:26:21 UTC 2023 upgrade: Switching to ramdisk...
Tue Jan  3 00:26:24 UTC 2023 upgrade: Performing system upgrade...
[  132.281791] do_stage2 (2796): drop_caches: 3
Unlocking firmware ...

Writing from <stdin> to firmware ...     
Tue Jan  3 00:26:29 UTC 2023 upgrade: Upgrade completed
Tue Jan  3 00:26:30 UTC 2023 upgrade: Rebooting system...
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource [  137.980156] reboot: Restarting system
�

U-Boot unifi-v2.0.4.295-g6dbfde2a (Dec 11 2018 - 15:20:42)

DRAM:  64 MB
Base:0x80000000, Top:0x84000000, Res logbuf:0xa3ff3800, log_magic:0x7575f955 kseg: 0xa0000000
Flash:  8 MB
Net:   athr8032_phy_probe: unit=0, AR8032 Detected
eth0: 18:e8:29:8c:9c:33
athr8032_phy_probe: unit=0, AR8032 Detected
eth0
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0 
Board: Ubiquiti Networks AR9342 board (e572-30.1123.0030)
 0. Name = u-boot, offset = 0, start_addr=9f000000, size=393216,start_sector=0, end_sector=5 
 1. Name = u-boot-env, offset = 60000, start_addr=9f060000, size=65536,start_sector=6, end_sector=6 
 2. Name = kernel, offset = 70000, start_addr=9f070000, size=7602176,start_sector=7, end_sector=122 
 3. Name = cfg, offset = 7b0000, start_addr=9f7b0000, size=262144,start_sector=123, end_sector=126 
 4. Name = EEPROM, offset = 7f0000, start_addr=9f7f0000, size=65536,start_sector=127, end_sector=127 
UBNT application initialized 
## Booting image at 9f070000 ...
Bad Magic Number
ar7240>

Not sure, what exactly went wrong, but I suppose the partition layout was somehow different and U-Boot doesn't find the boot partition anymore?

Is there any way to fix this? I still have the other AP to compare the partitioning, but not sure how to change it, if at all possible.

If nothing else, this just made it easier to boot the initramfs build from TFTP, because the Unifi system doesn't boot automatically anymore.

mk24 · February 22, 2023, 9:00pm

Boot stock firmware (on the other one you have that is still stock) and post the boot log, especially the part where the partition table is built.

mrtwiste · April 2, 2024, 5:39pm

With this trick,

# #Unlock mtd partitions with some magic:
# echo "5edfacbf" > /proc/ubnthal/.uf

I could flash a Linux Image, but I had no supported image so boot canceld:

ar7240> reset

Resetting...

U-Boot unifi-v2.0.4.295-g6dbfde2a (Dec 11 2018 - 15:20:42)

DRAM:  64 MB
Base:0x80000000, Top:0x84000000, Res logbuf:0xa3ff3800, log_magic:0x4a5a5a1a kseg: 0xa0000000
Flash:  8 MB
Net:   athr8032_phy_probe: unit=0, AR8032 Detected
eth0: 78:8a:20:e2:30:a1
athr8032_phy_probe: unit=0, AR8032 Detected
eth0
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
Board: Ubiquiti Networks AR9342 board (e582-31.1122.0030)
0. Name = u-boot, offset = 0, start_addr=9f000000, size=393216,start_sector=0, end_sector=5
1. Name = u-boot-env, offset = 60000, start_addr=9f060000, size=65536,start_sector=6, end_sector=6
2. Name = kernel, offset = 70000, start_addr=9f070000, size=7602176,start_sector=7, end_sector=122
3. Name = cfg, offset = 7b0000, start_addr=9f7b0000, size=262144,start_sector=123, end_sector=126
4. Name = EEPROM, offset = 7f0000, start_addr=9f7f0000, size=65536,start_sector=127, end_sector=127
UBNT application initialized
## Booting image at 9f070000 ...
Image Name:   MIPS OpenWrt Linux-5.10.146
Created:      2022-07-05  21:49:31 UTC
Image Type:   MIPS Linux Kernel Image (lzma compressed)
Data Size:    2196126 Bytes =  2.1 MB
Load Address: 80060000
Entry Point:  80060000
Verifying Checksum at 0x9f070040 ...OK
Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 5.10.146 (miki@gluonbuild) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19800+6-a7fb589e8a) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Tue Jul 5 21:49:31 2022
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[    0.000000] MIPS: machine is Ubiquiti UniFi AP
[    0.000000] SoC: Atheros AR9342 rev 2
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56384K/65536K available (5342K kernel code, 583K rwdata, 1208K rodata, 1180K init, 203K bss, 9152K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 185.032 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 20658623107 ns
[    0.000031] sched_clock: 32 bits at 92MHz, resolution 10ns, wraps every 23211935738ns
[    0.025695] Calibrating delay loop... 92.05 BogoMIPS (lpj=460288)
[    0.125185] pid_max: default: 32768 minimum: 301
[    0.140590] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.164177] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.194972] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.227473] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.259323] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.281407] pinctrl core: initialized pinctrl subsystem
[    0.312241] NET: Registered protocol family 16
[    0.505421] clocksource: Switched to clocksource MIPS
[    0.526038] NET: Registered protocol family 2
[    0.541051] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.567272] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.594516] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.619264] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.642021] TCP: Hash tables configured (established 1024 bind 1024)
[    0.662982] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.684275] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.707492] NET: Registered protocol family 1
[    0.721767] PCI: CLS 0 bytes, default 32
[    0.756922] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.789946] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.808875] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.844055] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    0.870938] pinctrl-single 18040028.pinmux: 64 pins, size 8
[    0.892229] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.920995] printk: console [ttyS0] disabled
[    0.935217] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 140000000)

mk24 · April 2, 2024, 7:01pm

The output stopped at the point where the Linux serial driver should have taken over from the bootloader serial driver. Often this means the image is not the correct one for the hardware. On the other hand, it may actually have booted but you can't see the log.

As you have serial, TFTP and boot the initramfs image. This is a much less risky way to test images. The initramfs can also be used to install a permanent image to flash using sysupgrade. This installation method bypasses any signature checks in the bootloader or stock firmware.

mrtwiste · April 3, 2024, 8:23am

There is no supported image for the v2 chipset. That's the reason, I tested with the V1 image if the trick with the echo command works. I have a lot of old Unifi AP V1 and V2 and wanted to recycle them for the german freifunk network...

mk24 · April 3, 2024, 11:43am

If the V2 has an AR9344 chipset as the logs suggest, it might be similar enough to some other old "XW" platform model to use its same firmware.

bmork · April 3, 2024, 2:58pm

Isn't this repeating what was learned years ago further up this thread?

@BennoHouse verified that the nanostation loco initramfs boots with serial and ethernet. But sysupgrade bricked the device. Which I believe is expected, as the partition layout is different.

The boot loader prints:

Board: Ubiquiti Networks AR9342 board (e582-31.1122.0030)
0. Name = u-boot, offset = 0, start_addr=9f000000, size=393216,start_sector=0, end_sector=5
1. Name = u-boot-env, offset = 60000, start_addr=9f060000, size=65536,start_sector=6, end_sector=6
2. Name = kernel, offset = 70000, start_addr=9f070000, size=7602176,start_sector=7, end_sector=122
3. Name = cfg, offset = 7b0000, start_addr=9f7b0000, size=262144,start_sector=123, end_sector=126
4. Name = EEPROM, offset = 7f0000, start_addr=9f7f0000, size=65536,start_sector=127, end_sector=127

While the nanostation loco layout is


			partition@0 {
				label = "u-boot";
				reg = <0x000000 0x040000>;
				read-only;
			};

			partition@40000 {
				label = "u-boot-env";
				reg = <0x040000 0x010000>;
				read-only;
			};

			partition@50000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x050000 0x760000>;
			};

			partition@7b0000 {
				label = "cfg";
				reg = <0x7b0000 0x040000>;
				read-only;
			};

			art: partition@7f0000 {
				label = "art";
				reg = <0x7f0000 0x010000>;

So using sysupgrade from a nanostation loco initramfs will partially overwrite u-boot.... Absolutely not recommended!

@mrtwiste avoided the immediate brick by flashing from OEM instead of sysupgrading. So the image is written to the correct parttion. But the layout will still not match what the image expects so it probably doesn't boot either. And if it booted, then the next sysupgrade would brick the device anyway.

Someone needs to create a UAPv2 dts with at least the proper chipset and partition definitions. There's not much point trying anything else. Gettting the partition layout correct is an absolute requirement before attempting to flash anything

psherman · April 20, 2024, 1:20am

4 posts were split to a new topic: Flashing 23.05 onto UAP-LR