Need help to unbrick unifi uap ac lr

Hi all,

Can somebody share the partition dump of a uap ac lr?
I have a bricked uap ac lr.
following this tutorial the dump is needed?
I alredy try to solve the problem with the official ubiquiti tftp recovery.

To do the the dump it's easy (i can help if needed)
you can use the following script (addapt your username in the script)
or manualy using the following command (replace username and ip):

ssh usernam@apipacddress cat /dev/mtdblock0 >mtdblock0
ssh usernam@apipacddress cat /dev/mtdblock1 >mtdblock1
ssh usernam@apipacddress cat /dev/mtdblock2 >mtdblock2
ssh usernam@apipacddress cat /dev/mtdblock3 >mtdblock3
ssh usernam@apipacddress cat /dev/mtdblock4 >mtdblock4
ssh usernam@apipacddress cat /dev/mtdblock5 >mtdblock5

i think i only need the mtdblock2 & mtdblock3

here the bootlog:



U-Boot unifi-v2.0.6.306-ge8871a78 (Nov 12 2019 - 10:30:55)

DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ff3800, log_magic:0x77757575 kseg: 0xa0000000
Top of RAM usable for U-Boot at: 87ff3000
Reserving 252k for U-Boot at: 87fb0000
Reserving 192k for malloc() at: 87f80000
Reserving 44 Bytes for Board Info at: 87f7ffd4
Reserving 36 Bytes for Global Data at: 87f7ffb0
Reserving 128k for boot params() at: 87f5ffb0
Stack Pointer at: 87f5ff98
Now running in RAM - U-Boot at: 87fb0000
Flash: 16 MB
PCIe WLAN Module found (tries: 1).
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x9fff0000
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
 ath_gmac_enet_initialize: is_s17()=0, is_ar8033()=1, phy id1=4d phy_id2=d074
WAN AR8033 PHY init
athrs_ar8033_reg_init: Done 111
Max resets limit reached exiting...
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: e0:63:da:39:65:65
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
## Starting application at 0x80200020 ...
Board: Ubiquiti Networks AR956X board (e527-22.1150.0030.0040)
 0. Name = u-boot, offset = 0, start_addr=9f000000, size=393216,start_sector=0, end_sector=5
 1. Name = u-boot-env, offset = 60000, start_addr=9f060000, size=65536,start_sector=6, end_sector=6
 2. Name = kernel0, offset = 70000, start_addr=9f070000, size=7929856,start_sector=7, end_sector=127
 3. Name = kernel1, offset = 800000, start_addr=9f800000, size=7929856,start_sector=128, end_sector=248
 4. Name = bs, offset = f90000, start_addr=9ff90000, size=131072,start_sector=249, end_sector=250
 5. Name = cfg, offset = fb0000, start_addr=9ffb0000, size=262144,start_sector=251, end_sector=254
 6. Name = EEPROM, offset = ff0000, start_addr=9fff0000, size=65536,start_sector=255, end_sector=255
get_mtd_params: name=bs
ubnt_flash_read: addr=8023bf20, sa=9ff90000, sz=131072
ubnt_bootsel_init: bootsel magic=a34de82b, bootsel = 1
UBNT application initialized
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
keep cfg partition.
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
ubnt_uwrite: Nothing to flash, exiting
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
cfg_default_state : TRUE
## Application terminated, rc = 0x1
Trying eth0
dup 1 speed 1000
NetOurIP:a9fe6565
Using eth0 device
checksum bad
checksum bad
checksum bad
checksum bad
## Starting application at 0x80200020 ...
Number of boot partitions = 2
get_mtd_params: name=bs
ubnt_flash_read: addr=8023bf20, sa=9ff90000, sz=131072
ubnt_get_bootsel: Boot partition selected = 1
Loading Kernel Image @ 81000000, size = 7929856
Verifying 'kernel1' parition:Bad Magic Number
Loading Kernel Image @ 81000000, size = 7929856
Verifying 'kernel0' parition:Bad Data CRC
 FATAL: No parition is good.
## Application terminated, rc = 0x0
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-3.3.8
   Created:      2017-05-08  17:06:53 UTC
   Image Type:   MIPS Linux Multi-File Image (lzma compressed)
   Data Size:    7438961 Bytes =  7.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Contents:
   Image 0:  7438953 Bytes =  7.1 MB
   Verifying Checksum at 0x81000040 ...Bad Data CRC
ath>

here the environment:

ath> printenv
bootargs=console=tty0 panic=3
bootcmd=run ubntappinit; go $ubntaddr ubntboot;bootm $flash_boot_addr
bootdelay=1
ipaddr=192.168.1.20
serverip=192.168.1.254
ubntappinit=go ${ubntaddr} uappinit;go ${ubntaddr} ureset_button;urescue;go ${ubntaddr} uwrite; go ${ubntaddr} udisc_prep; udiscsend
usetbrev=go ${ubntaddr} usetbrev
usetprotect=go ${ubntaddr} usetprotect
usetbid=go ${ubntaddr} usetbid
usetmac=go ${ubntaddr} usetmac
usetrd=go ${ubntaddr} usetrd
mtdparts=mtdparts=ath-nor0:384k(u-boot),64k(u-boot-env),7744k(kernel0),7744k(kernel1),128k(bs),256k(cfg),64k(EEPROM)
stdin=serial
stdout=serial
stderr=serial
ubntaddr=80200020
led1=7
led2=8
appinitdone=true
do_disc_sip=169.254.101.101
do_discsend=TRUE
do_discsendpayload=87f90c18
ethact=eth0
mtdids=nor0=ath-nor0
partition=nor0,0
mtddevnum=0
mtddevname=u-boot

Environment size: 811/65532 bytes
ath>

here the partition table:

ath> mtdparts

device nor0 <ath-nor0>, # parts = 7
 #: name                        size            offset          mask_flags
 0: u-boot                      0x00060000      0x00000000      0
 1: u-boot-env                  0x00010000      0x00060000      0
 2: kernel0                     0x00790000      0x00070000      0
 3: kernel1                     0x00790000      0x00800000      0
 4: bs                          0x00020000      0x00f90000      0
 5: cfg                         0x00040000      0x00fb0000      0
 6: EEPROM                      0x00010000      0x00ff0000      0

active partition: nor0,0 - (u-boot) 0x00060000 @ 0x00000000

defaults:
mtdids  : nor0=ath-nor0
mtdparts: mtdparts=ath-nor0:384k(u-boot),64k(u-boot-env),7424k(kernel0),256k(cfg),64k(EEPROM)

I am open to any other suggestion.

Bootloader is intact you should be able to TFTP recover it.

Note that in TFTP recovery the LED will flash indefinitely, but you only have a short time to upload the file before the bootloader server silently shuts down. So have your PC static IP set and use a switch between the PC and the PoE injector so the PC is ready to send as soon as the LED starts flashing.

Thanks for your reply.
I already try to do that.
When i abort the boot ans issue the command urescue, the tft application don't start.

When i use the official tftp recovery process.
1.Push the reset button
2.plug the poe
3. Wait +- 8second the led sequence blue, white, none evry 5 sec

I am able to put the official firmware using tftp server on my laptop.
I can see on the serial the firmware is flashed.
Then after the reboot i still get:
Verifying 'kernel1' parition:Bad Magic Number
Verifying Checksum at 0x81000040 ...Bad Data CRC

That's strange; it should boot kernel 0 after a TFTP flash.

Since you have serial working, you could try booting the initramfs OpenWrt and use it to sysupgrade, or write the sysupgrade OpenWrt direct to flash (in both "kernel" partitions). Either way I suggest 19.07.3 as I've had problems with snapshot builds on Ubiquiti AC devices.

not sure how to do that.
I am able to get openwrt in memory using tftp
But if i boot from memory, i get unable to mount root fs followed by a kernel panic
Here the log:

ath> tftp 0x83000000 openwrt-19.07.3-ath79-generic-ubnt_unifiac-lr-squashfs-sysupgrade.bin
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename 'openwrt-19.07.3-ath79-generic-ubnt_unifiac-lr-squashfs-sysupgrade.bin'.
Load address: 0x83000000
Loading: T #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #############
done
Bytes transferred = 4391225 (430139 hex)
ath> bootm 0x83000000
## Booting image at 83000000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.180
   Created:      2020-05-16  18:32:20 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1596064 Bytes =  1.5 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x83000040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 4.14.180 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11063-85e04e9f46)) #0 Sat May 16 18:32:20 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is Ubiquiti UniFi-AC-LR
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] random: get_random_bytes called from 0x804ff740 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 123304K/131072K available (4030K kernel code, 162K rwdata, 532K rodata, 1220K init, 212K bss, 7768K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008217] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074761] pid_max: default: 32768 minimum: 301
[    0.079777] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.086759] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.097627] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.108026] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.114523] pinctrl core: initialized pinctrl subsystem
[    0.122064] NET: Registered protocol family 16
[    0.129492] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[    0.135970]  MEM 0x0000000012000000..0x0000000013ffffff
[    0.141468]   IO 0x0000000000000000..0x0000000000000000
[    0.161045] PCI host bridge to bus 0000:00
[    0.165371] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    0.172654] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.178518] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.185676] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.194444] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    0.202197] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    0.212397] clocksource: Switched to clocksource MIPS
[    0.218605] NET: Registered protocol family 2
[    0.223977] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.231333] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.238080] TCP: Hash tables configured (established 1024 bind 1024)
[    0.244912] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.251084] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.257940] NET: Registered protocol family 1
[    0.265150] Crashlog allocated RAM at address 0x3f00000
[    0.271790] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    0.282854] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.288996] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.307683] io scheduler noop registered
[    0.311817] io scheduler deadline registered (default)
[    0.318970] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[    0.327256] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.335993] console [ttyS0] disabled
[    0.339790] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.348922] console [ttyS0] enabled
[    0.348922] console [ttyS0] enabled
[    0.356490] bootconsole [early0] disabled
[    0.356490] bootconsole [early0] disabled
[    0.372862] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[    0.378129] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.384722] Creating 7 MTD partitions on "spi0.0":
[    0.389677] 0x000000000000-0x000000060000 : "u-boot"
[    0.395514] 0x000000060000-0x000000070000 : "u-boot-env"
[    0.401600] 0x000000070000-0x000000800000 : "firmware"
[    0.410024] 0x000000800000-0x000000f90000 : "ubnt-airos"
[    0.416232] 0x000000f90000-0x000000fb0000 : "bs"
[    0.421607] 0x000000fb0000-0x000000ff0000 : "cfg"
[    0.427164] 0x000000ff0000-0x000001000000 : "EEPROM"
[    0.433914] libphy: Fixed MDIO Bus: probed
[    1.112750] libphy: ag71xx_mdio: probed
[    1.212633] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:04 [uid=004dd074, driver=Atheros 8031 ethernet]
[    1.223603] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    1.231607] NET: Registered protocol family 10
[    1.240174] Segment Routing with IPv6
[    1.244095] NET: Registered protocol family 17
[    1.248725] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.262126] 8021q: 802.1Q VLAN Support v1.8
[    1.267858] hctosys: unable to open rtc device (rtc0)
[    1.273960] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    1.281689] Please append a correct "root=" boot option; here are the available partitions:
[    1.290361] 1f00             384 mtdblock0
[    1.290365]  (driver?)
[    1.297132] 1f01              64 mtdblock1
[    1.297135]  (driver?)
[    1.303901] 1f02            7744 mtdblock2
[    1.303904]  (driver?)
[    1.310651] 1f03            7744 mtdblock3
[    1.310654]  (driver?)
[    1.317417] 1f04             128 mtdblock4
[    1.317421]  (driver?)
[    1.324177] 1f05             256 mtdblock5
[    1.324180]  (driver?)
[    1.330927] 1f06              64 mtdblock6
[    1.330930]  (driver?)
[    1.337693] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    1.346842] Rebooting in 1 seconds..


U-Boot unifi-v2.0.6.306-ge8871a78 (Nov 12 2019 - 10:30:55)

DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ff3800, log_magic:0x75555555 kseg: 0xa0000000
Top of RAM usable for U-Boot at: 87ff3000
Reserving 252k for U-Boot at: 87fb0000
Reserving 192k for malloc() at: 87f80000
Reserving 44 Bytes for Board Info at: 87f7ffd4
Reserving 36 Bytes for Global Data at: 87f7ffb0
Reserving 128k for boot params() at: 87f5ffb0
Stack Pointer at: 87f5ff98
Now running in RAM - U-Boot at: 87fb0000
Flash: 16 MB
PCIe WLAN Module found (tries: 1).
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x9fff0000
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
 ath_gmac_enet_initialize: is_s17()=0, is_ar8033()=1, phy id1=4d phy_id2=d074
WAN AR8033 PHY init
athrs_ar8033_reg_init: Done 111
Max resets limit reached exiting...
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: e0:63:da:39:65:65
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
## Starting application at 0x80200020 ...
Board: Ubiquiti Networks AR956X board (e527-22.1150.0030.0040)
 0. Name = u-boot, offset = 0, start_addr=9f000000, size=393216,start_sector=0, end_sector=5
 1. Name = u-boot-env, offset = 60000, start_addr=9f060000, size=65536,start_sector=6, end_sector=6
 2. Name = kernel0, offset = 70000, start_addr=9f070000, size=7929856,start_sector=7, end_sector=127
 3. Name = kernel1, offset = 800000, start_addr=9f800000, size=7929856,start_sector=128, end_sector=248
 4. Name = bs, offset = f90000, start_addr=9ff90000, size=131072,start_sector=249, end_sector=250
 5. Name = cfg, offset = fb0000, start_addr=9ffb0000, size=262144,start_sector=251, end_sector=254
 6. Name = EEPROM, offset = ff0000, start_addr=9fff0000, size=65536,start_sector=255, end_sector=255
get_mtd_params: name=bs
ubnt_flash_read: addr=8023bf20, sa=9ff90000, sz=131072
ubnt_bootsel_init: bootsel magic=a34de82b, bootsel = 1
UBNT application initialized
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
keep cfg partition.
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
ubnt_uwrite: Nothing to flash, exiting
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
cfg_default_state : TRUE
## Application terminated, rc = 0x1
Trying eth0
dup 1 speed 1000
NetOurIP:a9fe6565
Using eth0 device
checksum bad
checksum bad
checksum bad
## Starting application at 0x80200020 ...
Number of boot partitions = 2
get_mtd_params: name=bs
ubnt_flash_read: addr=8023bf20, sa=9ff90000, sz=131072
ubnt_get_bootsel: Boot partition selected = 1
Loading Kernel Image @ 81000000, size = 7929856
Verifying 'kernel1' parition:Bad Magic Number
Loading Kernel Image @ 81000000, size = 7929856
Verifying 'kernel0' parition:Bad Data CRC
 FATAL: No parition is good.
## Application terminated, rc = 0x0
## Booting image at 81000000 ...
   Image Name:   Ubiquiti Linux-4.4.153
   Created:      2018-08-30  12:10:54 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    7721310 Bytes =  7.4 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x81000040 ...Bad Data CRC
ath> Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
Unknown command 'Kernel' - try 'help'
ath>

How to save openwrt on both partition?
maybe i have to do:

tftpboot 0x80000000 openwrt-ar71xx-generic-ubnt-unifiac-squashfs-sysupgrade.bin
erase 0x9f070000 +$filesize
cp.b 0x80000000 0x9f070000 $filesize
bootm 0x9f070000

But i am not sure if the address 0x9f070000 is correct.
And i don't know the address of the kernel2 partition.

edit: i have found on the bootlog both address
2. Name = kernel0, offset = 70000, start_addr=9f070000, size=7929856,start_sector=7, end_sector=127
3. Name = kernel1, offset = 800000, start_addr=9f800000, size=7929856,start_sector=128, end_sector=248

Could you confirm if i'ts the correct way to flash openwrt ?

To boot from RAM you need the initramfs build:
https://downloads.openwrt.org/releases/19.07.3/targets/ath79/generic/openwrt-19.07.3-ath79-generic-ubnt_unifiac-lr-initramfs-kernel.bin
This runs entirely from RAM it doesn't have a filesystem in flash. But it offers mtd or sysupgrade to write to flash.
This is safer than using the bootloader to erase and write flash. Though you can do that the addresses look correct. If you write direct to flash use the sysupgrade version.

1 Like

still same problem.
what i have done:

  1. tftp the initramfs on the memory
  2. boot initramfs from memory
  3. sysupgrade the squashfs to "firmware"partition (old ubiquiti "kernel0" partition)
    here the log:
ath> tftp 0x83000000 openwrt-19.07.3-ath79-generic-ubnt_unifiac-lr-initramfs-kernel.bin
Trying eth0
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename 'openwrt-19.07.3-ath79-generic-ubnt_unifiac-lr-initramfs-kernel.bin'.
Load address: 0x83000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###############################
done
Bytes transferred = 3817084 (3a3e7c hex)
ath> bootm 0x83000000
## Booting image at 83000000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.180
   Created:      2020-05-16  18:32:20 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3817020 Bytes =  3.6 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x83000040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 4.14.180 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11063-85e04e9f46)) #0 Sat May 16 18:32:20 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is Ubiquiti UniFi-AC-LR
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] random: get_random_bytes called from 0x804ff740 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 116392K/131072K available (4030K kernel code, 162K rwdata, 532K rodata, 8132K init, 212K bss, 14680K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008218] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074761] pid_max: default: 32768 minimum: 301
[    0.079777] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.086759] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.097626] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.108018] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.114516] pinctrl core: initialized pinctrl subsystem
[    0.122052] NET: Registered protocol family 16
[    0.129480] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[    0.135954]  MEM 0x0000000012000000..0x0000000013ffffff
[    0.141451]   IO 0x0000000000000000..0x0000000000000000
[    0.161002] PCI host bridge to bus 0000:00
[    0.165330] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    0.172612] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.178477] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.185635] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.194402] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    0.202155] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    0.212343] clocksource: Switched to clocksource MIPS
[    0.218555] NET: Registered protocol family 2
[    0.223927] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.231283] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.238030] TCP: Hash tables configured (established 1024 bind 1024)
[    0.244863] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.251034] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.257889] NET: Registered protocol family 1
[    0.413010] Crashlog allocated RAM at address 0x3f00000
[    0.419698] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    0.430718] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.436903] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.506740] io scheduler noop registered
[    0.510873] io scheduler deadline registered (default)
[    0.518027] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[    0.526319] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.535031] console [ttyS0] disabled
[    0.538829] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.547962] console [ttyS0] enabled
[    0.547962] console [ttyS0] enabled
[    0.555530] bootconsole [early0] disabled
[    0.555530] bootconsole [early0] disabled
[    0.571923] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[    0.577242] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.583816] Creating 7 MTD partitions on "spi0.0":
[    0.588771] 0x000000000000-0x000000060000 : "u-boot"
[    0.594604] 0x000000060000-0x000000070000 : "u-boot-env"
[    0.600723] 0x000000070000-0x000000800000 : "firmware"
[    0.609146] 0x000000800000-0x000000f90000 : "ubnt-airos"
[    0.615326] 0x000000f90000-0x000000fb0000 : "bs"
[    0.620692] 0x000000fb0000-0x000000ff0000 : "cfg"
[    0.626243] 0x000000ff0000-0x000001000000 : "EEPROM"
[    0.633014] libphy: Fixed MDIO Bus: probed
[    1.312699] libphy: ag71xx_mdio: probed
[    1.432581] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:04 [uid=004dd074, driver=Atheros 8031 ethernet]
[    1.443559] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    1.451557] NET: Registered protocol family 10
[    1.460137] Segment Routing with IPv6
[    1.464066] NET: Registered protocol family 17
[    1.468694] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.482097] 8021q: 802.1Q VLAN Support v1.8
[    1.487875] hctosys: unable to open rtc device (rtc0)
[    1.537507] Freeing unused kernel memory: 8132K
[    1.542186] This architecture does not have kernel memory protection.
[    1.561623] init: Console is alive
[    1.565460] init: - watchdog -
[    1.586080] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.595589] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.613638] init: - preinit -
[    1.791943] random: jshn: uninitialized urandom read (4 bytes read)
[    1.865214] random: jshn: uninitialized urandom read (4 bytes read)
[    1.898168] random: jshn: uninitialized urandom read (4 bytes read)
[    2.055578] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    4.202342] random: fast init done
[    5.185583] procd: - early -
[    5.188650] procd: - watchdog -
[    5.755219] procd: - watchdog -
[    5.758737] procd: - ubus -
[    5.767443] urandom_read: 5 callbacks suppressed
[    5.767450] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.812012] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.819876] procd: - init -
Please press Enter to activate this console.
[    6.209172] kmodloader: loading kernel modules from /etc/modules.d/*
[    6.234565] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    6.258543] Loading modules backported from Linux version v4.19.120-0-gfdc072324f3c
[    6.266497] Backport generated by backports.git v4.19.120-1-0-g60c3a249
[    6.293627] ip_tables: (C) 2000-2006 Netfilter Core Team
[    6.306341] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[    6.404887] xt_time: kernel timezone is -0000
[    6.506827] PPP generic driver version 2.4.2
[    6.519107] urngd: v1.0.2 started.
[    6.523424] NET: Registered protocol family 24
[    6.595974] ieee80211 phy0: Atheros AR9561 Rev:0 mem=0xb8100000, irq=2
[    6.675675] kmodloader: done loading kernel modules from /etc/modules.d/*
[    6.836604] random: crng init done
[   33.855713] eth0: link up (1000Mbps/Full duplex)
[   33.861005] br-lan: port 1(eth0) entered blocking state
[   33.866467] br-lan: port 1(eth0) entered disabled state
[   33.872127] device eth0 entered promiscuous mode
[   33.900501] br-lan: port 1(eth0) entered blocking state
[   33.905948] br-lan: port 1(eth0) entered forwarding state
[   33.911665] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   34.912383] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready



BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07.3, r11063-85e04e9f46
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# [  182.592674] eth0: link down
[  182.596192] br-lan: port 1(eth0) entered disabled state
[  448.834070] eth0: link up (1000Mbps/Full duplex)
[  448.838880] br-lan: port 1(eth0) entered blocking state
[  448.844316] br-lan: port 1(eth0) entered forwarding state

root@OpenWrt:/# [  508.112665] eth0: link down
[  508.116187] br-lan: port 1(eth0) entered disabled state
[  796.194058] eth0: link up (1000Mbps/Full duplex)
[  796.198867] br-lan: port 1(eth0) entered blocking state
[  796.204304] br-lan: port 1(eth0) entered forwarding state
[  844.032653] eth0: link down
[  844.036174] br-lan: port 1(eth0) entered disabled state

root@OpenWrt:/# sha256sum /tmp/
.uci/
TZ
board.json
dhcp.leases
dnsmasq.d/
etc/
hosts/
lib/
lock/
log/
openwrt-19.07.3-ath79-generic-ubnt_unifiac-lr-squashfs-sysupgrade.bin
resolv.conf
resolv.conf.auto
run/
shm/
state/
sysinfo/
tmp/
root@OpenWrt:/# sha256sum /tmp/openwrt-19.07.3-ath79-generic-ubnt_unifiac-lr-squ
ashfs-sysupgrade.bin
506572b937d48b5b6a4322805483fef082e11bc28f95d1182d7a60e82ef1d19a  /tmp/openwrt-19.07.3-ath79-generic-ubnt_unifiac-lr-squashfs-sysupgrade.bin
root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00060000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00790000 00010000 "firmware"
mtd3: 00790000 00010000 "ubnt-airos"
mtd4: 00020000 00010000 "bs"
mtd5: 00040000 00010000 "cfg"
mtd6: 00010000 00010000 "EEPROM"
root@OpenWrt:/# sysupgrade -v /tmp/*.bin
Cannot save config while running from ramdisk.
Commencing upgrade. Closing all shell sessions.
Watchdog handover: fd=3
- watchdog -
killall: telnetd: no process killed
Sending TERM to remaining processes ... netifd odhcpd uhttpd ntpd dnsmasq ubusd urngd logd rpcd
Sending KILL to remaining processes ...
Performing system upgrade...
Unlocking firmware ...

Writing from <stdin> to firmware ...
Appending jffs2 data from /tmp/sysupgrade.tgz to firmware..
.File /tmp/sysupgrade.tgz does not exist
Upgrade completed
Rebooting system...
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
[ 1322.194190] reboot: Restarting systemt


U-Boot unifi-v2.0.6.306-ge8871a78 (Nov 12 2019 - 10:30:55)

DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xe, 0xe, 0xe, 0xe)
128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ff3800, log_magic:0x00000000 kseg: 0xa0000000
Top of RAM usable for U-Boot at: 87ff3000
Reserving 252k for U-Boot at: 87fb0000
Reserving 192k for malloc() at: 87f80000
Reserving 44 Bytes for Board Info at: 87f7ffd4
Reserving 36 Bytes for Global Data at: 87f7ffb0
Reserving 128k for boot params() at: 87f5ffb0
Stack Pointer at: 87f5ff98
Now running in RAM - U-Boot at: 87fb0000
Flash: 16 MB
PCIe WLAN Module found (tries: 1).
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x9fff0000
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
 ath_gmac_enet_initialize: is_s17()=0, is_ar8033()=1, phy id1=4d phy_id2=d074
WAN AR8033 PHY init
athrs_ar8033_reg_init: Done 111
Max resets limit reached exiting...
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: e0:63:da:39:65:65
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
## Starting application at 0x80200020 ...
Board: Ubiquiti Networks AR956X board (e527-22.1150.0030.0040)
 0. Name = u-boot, offset = 0, start_addr=9f000000, size=393216,start_sector=0, end_sector=5
 1. Name = u-boot-env, offset = 60000, start_addr=9f060000, size=65536,start_sector=6, end_sector=6
 2. Name = kernel0, offset = 70000, start_addr=9f070000, size=7929856,start_sector=7, end_sector=127
 3. Name = kernel1, offset = 800000, start_addr=9f800000, size=7929856,start_sector=128, end_sector=248
 4. Name = bs, offset = f90000, start_addr=9ff90000, size=131072,start_sector=249, end_sector=250
 5. Name = cfg, offset = fb0000, start_addr=9ffb0000, size=262144,start_sector=251, end_sector=254
 6. Name = EEPROM, offset = ff0000, start_addr=9fff0000, size=65536,start_sector=255, end_sector=255
get_mtd_params: name=bs
ubnt_flash_read: addr=8023bf20, sa=9ff90000, sz=131072
ubnt_bootsel_init: bootsel magic=a34de82b, bootsel = 1
UBNT application initialized
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
keep cfg partition.
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
ubnt_uwrite: Nothing to flash, exiting
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
cfg_default_state : TRUE
## Application terminated, rc = 0x1
Trying eth0
dup 1 speed 1000
NetOurIP:a9fe6565
Using eth0 device
checksum bad
checksum bad
checksum bad
checksum bad
## Starting application at 0x80200020 ...
Number of boot partitions = 2
get_mtd_params: name=bs
ubnt_flash_read: addr=8023bf20, sa=9ff90000, sz=131072
ubnt_get_bootsel: Boot partition selected = 1
Loading Kernel Image @ 81000000, size = 7929856
Verifying 'kernel1' parition:Bad Magic Number
Loading Kernel Image @ 81000000, size = 7929856
Verifying 'kernel0' parition:Bad Data CRC
 FATAL: No parition is good.
## Application terminated, rc = 0x0
## Booting image at 81000000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.180
   Created:      2020-05-16  18:32:20 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1596064 Bytes =  1.5 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x81000040 ...Bad Data CRC
ath>

It booted kernel 1, which is still corrupt. You have to write a zero to bs (mtd4) and erase mtd3 as the device wiki page explains.
https://openwrt.org/toh/ubiquiti/unifiac

It should work to one-time boot kernel 0 directly bootm 0x9f070000. OpenWrt will be running from flash. That will not fix the boot from kernel 1 at power on though.

Once running OpenWrt again, execute the following:
mtd erase mtd3
dd if=/dev/zero bs=1 count=1 of=/dev/mtd4

1 Like

I just try again .
this time uside mtd to flash on partition 0
And i have also switch the partition using dd.
I try to erase the kernel2 partition but using mtd and it fail.

root@OpenWrt:/# dd if=/dev/zero bs=1 count=1 of=/dev/mtd4
1+0 records in
1+0 records out
root@OpenWrt:/#
root@OpenWrt:/# mtd write /tmp/openwrt-19.07.3-ath79-generic-ubnt_unifiac-lr-squ
ashfs-sysupgrade.bin firmware
Unlocking firmware ...

Writing from /tmp/openwrt-19.07.3-ath79-generic-ubnt_unifiac-lr-squashfs-sysupgrade.bin to firmware ...
root@OpenWrt:/# mtd erase kernel1
Could not open mtd device: kernel1
Could not open mtd device: kernel1
root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00060000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00790000 00010000 "firmware"
mtd3: 00790000 00010000 "ubnt-airos"
mtd4: 00020000 00010000 "bs"
mtd5: 00040000 00010000 "cfg"
mtd6: 00010000 00010000 "EEPROM"
root@OpenWrt:/# ubnt-airos^C
root@OpenWrt:/# mtd erase ubnt-airos
Could not open mtd device: ubnt-airos
Could not open mtd device: ubnt-airos
root@OpenWrt:/# mtd erase ubnt-airos
Could not open mtd device: ubnt-airos
Could not open mtd device: ubnt-airos
...
Using eth0 device
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
## Starting application at 0x80200020 ...
Number of boot partitions = 2
get_mtd_params: name=bs
ubnt_flash_read: addr=8023bf20, sa=9ff90000, sz=131072
ubnt_get_bootsel: Boot partition selected = 0
Loading Kernel Image @ 81000000, size = 7929856
Verifying 'kernel0' parition:Bad Data CRC
Loading Kernel Image @ 81000000, size = 7929856
Verifying 'kernel1' parition:Bad Magic Number
 FATAL: No parition is good.
## Application terminated, rc = 0x0
## Booting image at 81000000 ...
Bad Magic Number
ath>

i will try again using dd

root@OpenWrt:/# mtd erase mtd3
Could not open mtd device: mtd3
Could not open mtd device: mtd3

I have found a tone of post (most of them on ubiquiti forum) with the same problem i'ts like the partition is corrupted,
The only documented solution is to flash a full dump of the partition.

Why i am unable to erase te partition 3 ?
Do you tink the file partition is locked by the boot loader ?
Maybe i have to erase the partition using uboot ?

Do you have a working unifi ap ac with ubiquiti firmware so i can try to flash the dump of both kernel partition ?
and the only

edit:
here more try:

root@OpenWrt:/# dd if=/dev/zero bs=1 count=1 of=/dev/mtd4
1+0 records in
1+0 records out
root@OpenWrt:/# dd if=/dev/zero bs=1 count=1 of=/dev/mtd3
dd: can't open '/dev/mtd3': Permission denied
root@OpenWrt:/# mtd unlock mtd3
Could not open mtd device: mtd3
Could not open mtd device: mtd3

edit 2:
two more attempt:
1.erased partition mtd3 from uboot and flashed openwrt on mtd2 (still fail)
2.flashed ubiquiti firmware from uboot and compared the memory with the flash (i tink the flash memory is not corrupted)

Bytes transferred = 4391225 (430139 hex)
ath> erase 0x9f070000 +$filesize
Erase Flash from 0x9f070000 to 0x9f4affff in Bank # 1
First 0x7 last 0x4a sector size 0x10000
.................................................................... done
Erased 68 sectors
ath> cp.b 0x80000000 0x9f070000 $filesize
Copy to Flash... write addr: 9f070000
done

ath> cmp 0x80000000 0x9f070000 $filesize
word at 0x80010000 (0x4d41ef10) != word at 0x9f080000 (0x40000800)
Total of 16384 words were the same

That looks like the flash chip is bad. The word did not erase or write properly.

Try erasing the 9f08 block then read it with md.b it should be all FF.

The OpenWrt sysupgrade image is a byte for byte image of what needs to be in the partition to run OpenWrt. So like I said before, if you have OpenWrt flashed to kernel0 (mtd2, 9f070000), you should be able to boot it manually with bootm 0x9f070000

Thanks,

I think i have made a postale Yesterday.
After mtdparts default i see no more the kernel1 partition.

I will try this evening to erase the partition and read again.

I will also try to write open wrt ans boot from flash.
I need to use the squashfs image?

Yes squashfs-sysupgrade. There are only two images for the Unifi AC-LR in the 19.07.3/ath79 directory, that and the initramfs.

If you haven't already, RAM boot OpenWrt again and make backups of the bootloader and art partitions. You'll need those if you accidentally erase them or have to replace the flash chip.

from uboot i am able to erase 0x9f070000 but not 0x9f800000.
do you think it's write protected, maybe i can do that from openwrt ?
here the log:

Bytes transferred = 4391225 (430139 hex)
ath> md.b 0x9f070000
9f070000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
9f070010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
9f070020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
9f070030: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff    ................
ath> md.b 0x9f800000
9f800000: 04 00 00 00 00 00 00 40 00 00 20 00 00 00 00 00    .......@.. .....
9f800010: 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
9f800020: 01 00 00 00 00 01 00 13 00 00 00 00 00 00 00 00    ................
9f800030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
ath> erase 0x9f800000 +$filesize
Erase Flash from 0x9f800000 to 0x9fc3ffff in Bank # 1
First 0x80 last 0xc3 sector size 0x10000
.................................................................... done
Erased 68 sectors
ath> md.b 0x9f800000
9f800000: 04 00 00 00 00 00 00 40 00 00 20 00 00 00 00 00    .......@.. .....
9f800010: 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
9f800020: 01 00 00 00 00 01 00 13 00 00 00 00 00 00 00 00    ................
9f800030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
ath> cp.b 0x80000000 0x9f070000 $filesize
Copy to Flash... write addr: 9f070000
done
ath> cmp.b 0x80000000 0x9f070000 $filesize
byte at 0x80010000 (0x4d) != byte at 0x9f080000 (0x40)
Total of 65536 bytes were the same
ath> md.b 0x9f070000
9f070000: 27 05 19 56 3b 97 7d 7c 5e c0 31 b4 00 18 5a a0    '..V;.}|^.1...Z.
9f070010: 80 06 00 00 80 06 00 00 0f cc 8d 12 05 05 02 03    ................
9f070020: 4d 49 50 53 20 4f 70 65 6e 57 72 74 20 4c 69 6e    MIPS OpenWrt Lin
9f070030: 75 78 2d 34 2e 31 34 2e 31 38 30 00 00 00 00 00    ux-4.14.180.....
ath> cp.b 0x80000000 0x9f800000 $filesize
Copy to Flash... write addr: 9f800000
done
ath> cmp.b 0x80000000 0x9f800000 $filesize
byte at 0x80000000 (0x27) != byte at 0x9f800000 (0x24)
Total of 0 bytes were the same
ath> md.b 0x9f800000
9f800000: 24 00 00 00 0a 00 09 44 00 00 20 04 00 00 00 00    $......D.. .....
9f800010: 00 00 00 00 00 00 00 00 06 0c 00 00 00 00 00 00    ................
9f800020: 01 40 00 00 00 01 00 21 40 00 50 00 00 00 20 00    .@.....!@.P... .
9f800030: 40 40 04 00 00 00 00 20 20 00 00 00 00 00 00 00    @@.....  .......
ath>  protect off all
Un-Protect Flash Bank # 1
ath> erase 0x9f800000 +$filesize
Erase Flash from 0x9f800000 to 0x9fc3ffff in Bank # 1
First 0x80 last 0xc3 sector size 0x10000
.................................................................... done
Erased 68 sectors
ath> md.b 0x9f800000
9f800000: 24 00 00 00 0a 00 09 44 00 00 20 04 00 00 00 00    $......D.. .....
9f800010: 00 00 00 00 00 00 00 00 06 0c 00 00 00 00 00 00    ................
9f800020: 01 40 00 00 00 01 00 21 40 00 50 00 00 00 20 00    .@.....!@.P... .
9f800030: 40 40 04 00 00 00 00 20 20 00 00 00 00 00 00 00    @@.....  .......
ath> bootm 0x9f070000
## Booting image at 9f070000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.180
   Created:      2020-05-16  18:32:20 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1596064 Bytes =  1.5 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f070040 ...Bad Data CRC
ath>

And here the partition table:

ath> mtdparts

device nor0 <ath-nor0>, # parts = 7
 #: name                        size            offset          mask_flags
 0: u-boot                      0x00060000      0x00000000      0
 1: u-boot-env                  0x00010000      0x00060000      0
 2: kernel0                     0x00790000      0x00070000      0
 3: kernel1                     0x00790000      0x00800000      0
 4: bs                          0x00020000      0x00f90000      0
 5: cfg                         0x00040000      0x00fb0000      0
 6: EEPROM                      0x00010000      0x00ff0000      0

active partition: nor0,0 - (u-boot) 0x00060000 @ 0x00000000

defaults:
mtdids  : nor0=ath-nor0
mtdparts: mtdparts=ath-nor0:384k(u-boot),64k(u-boot-env),7424k(kernel0),256k(cfg),64k(EEPROM)
ath>

I juste read this https://openwrt.org/docs/techref/flash.
Si i think i did a mistake Yesterday.
I have backup each individuel partition using dd.
Ans i also erase the kernel1 partition using dd.

So my backup is not usable?
Can i recover thé partition kernel1 or it's no definitivly damages?