Problems installing Ubiquiti UAP_LR

Hey,
We have some older UAP and UAP_LR that we took out of service. I already manged to reuse the UAP devices as Freifunk Routers via Serial Interface (unifi firmware 4.3.28).

However the UAP_LR are different! First shitmove from ui, they did not solder pins on serial or jtag interface, ok fine i fixed that.
But whatever i've tried i can't write the tftpboot -> mem image to the bootaddress.

Here is what i did so far. (hope i can reassemble the right order.)

  1. tried it like i did with the UAP after soldering 4 pins to serial and used the openwrt page here: https://openwrt.org/toh/ubiquiti/unifi_ap accidentally used the factory.bin once but the sysupgrade firmware either did the trick.
  2. i noticed that the start address for the image is 0x9f070000 rather than 0x9f050000
  3. First thing i noticed is that when erasing 0x9f070000 +0x0076000 that goes fast and when md 0x9f070000 still everything is in place and not erased.
  4. i also tried protect off all and protect off 0x9f070000 which seems unaffected.
  5. i also tried both images with the UAP_LR in tftp mode and pushing from my linuxbox.

We have nine or ten UAP_LR and i hate to trash them if i could give them a second lifespan, so i think i need some more embedded professional help.
It looks like the nor0 is somehow write protected or just boots an image from somewhere in the flash suspicious ubntaddress at 0x8020020

ar7240> printenv
bootargs=console=tty0 panic=3
bootcmd=run ubntappinit ubntboot
bootdelay=1
ipaddr=192.168.1.20
serverip=192.168.1.254
ubntappinit=go ${ubntaddr} uappinit;go ${ubntaddr} ureset_button;urescue;go ${ubntaddr} uwrite
ubntboot=bootm 0x9f070000
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
ubntaddr=80200020
mtdids=nor0=ath-nor0
mtdparts=mtdparts=ath-nor0:384k(u-boot),64k(u-boot-env),7424k(kernel),256k(cfg),64k(EEPROM)
partition=nor0,0
mtddevnum=0
mtddevname=u-boot

So thanks in advanced. I hope someone just says "you dumbhead, just do x and it works!"
Otherwise please give me a point in the right direction or help me understand what F****** Ubiquiti is doing here.
Thank You
Jorval

Do not use the bootloader to erase or write flash. Hopefully you didn't clobber anything important.

Using the serial bootloader console:

  • TFTP the intramfs OpenWrt image for your model to RAM. Be sure it is the correct image for the model you have, as the flash partition scheme is hard-coded into the image.
  • bootm the OpenWrt in RAM
    Now your serial console is controlling a temporary instance of OpenWrt.
  • Transfer (scp or wget) the sysupgrade OpenWrt to the /tmp directory, which is a RAM disk (actually at this point it's all a RAM disk)
  • Run sysupgrade to install that image. It will reboot into a permanent install of OpenWrt.

Hey,
Thank You for your answer.

so i tried these both images:
openwrt-22.03.5-ath79-generic-ubnt_unifi-initramfs-kernel.bin
openwrt-22.03.5-ath79-generic-ubnt_unifiac-lr-initramfs-kernel.bin

both unfortunally didn't boot:

ar7240> tftpboot 0x80000000 owrtacinit.bin
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename 'owrtacinit.bin'.
Load address: 0x80000000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ############################################################
done
Bytes transferred = 5630585 (55ea79 hex)
ar7240> bootm 0x80000000
## Booting image at 80000000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.176
   Created:      2023-04-27  20:28:15 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5630521 Bytes =  5.4 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x80000040 ...OK
   Uncompressing Kernel Image ... ERROR: LzmaDecode.c, 543

Decoding error = 1
LZMA ERROR 1 - must RESET board to recover

Resetting...

U-Boot unifi-v2.0.4.295-g6dbfde2a (Dec 11 2018 - 15:20:42)

and once again Ubiquiti 4.3.78 is there.
Thanks for the try.
i also find out that they have wiped the mtd utility when ssh into the firmware.

The problem there is that the compressed kernel was loaded into the same RAM space that the kernel will be uncompressed to. As it starts to uncompress itself, the image overwrites itself and becomes corrupt.

Short answer: Use 0x81000000 as the load address instead of 0x80000000.

noob me!

ok, both images worked somehow but i belive none of them really fit the UAP_LR.
The openwrt-22.03.5-ath79-generic-ubnt_unifi-initramfs-kernel.bin boots but my serial stops working.
i have no ip 192.168.1.1 or .20 changing the baud rate to 140000000 which is the last entry in the bootprocess doesn't work either. (maybe i make another stupid thing here?)

[    1.745977] printk: console [ttyS0] disabled
[    1.760212] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 140000000) is a 16550A

and the ac-lr initram starts spreading bytecode and errors out rebooting into ubnt firmware.

so. i have to stop for today. Tomorrow is another one...
thanks again.