[Solved] UniFi AC HD support?

I've tried to follow wiki's instruction and I'm afraid I was not able to succeed because it seems kernel0 seems to be now protected from dtb against write changes, or something like that

UAP-HD-BZ.6.5.28# mtd write /tmp/sysupgrade.bin /dev/mtd12
Could not open mtd device: /dev/mtd12
Can't open device for writing!

On the other hand, I tried to use the tftpsrv approach from u-boot, without any success either:

Board: Ubiquiti Networks AR7240 board (e530-28.0000)
WARNING:Boot selection logic magic mismatch!
UBNT application initialized 
Erasing cfg partition ...... done.
Erasing APPSBLENV partition ...... done.
Link 2 status changed
Half duplex link
Link 2 up, Phy_status = a070a0a
Port:2 speed 100Mbps
Using eth0 device
Listening for TFTP transfer on 192.168.1.20
Load address: 0x44000000
Loading: T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T T #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############################
done
Bytes transferred = 7463290 (71e17a hex)
ERROR: Firmware Type Error! 

When trying to use tftpboot, it complains about missing root params:

(IPQ) # tftpboot 0x44000000 firmware
Using eth0 device
TFTP from server 192.168.1.3; our IP address is 192.168.1.20
Filename 'firmware'.
Load address: 0x44000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##################################################
done
Bytes transferred = 7405877 (710135 hex)
(IPQ) # bootm
## Booting kernel from FIT Image at 44000000 ...
   Using 'config@1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM OpenWrt Linux-5.10.176
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x440000e4
     Data Size:    3070466 Bytes = 2.9 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x42208000
     Entry Point:  0x42208000
     Hash algo:    crc32
     Hash value:   442fbb0b
     Hash algo:    sha1
     Hash value:   8f1ccaffb7550437bafc1f558492d1f968425e9f
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 44000000
   Using 'config@1' configuration
   Trying 'fdt-1' FDT blob subimage
     Description:  ARM OpenWrt ubnt_unifi-ac-hd device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x442edc24
     Data Size:    29305 Bytes = 28.6 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   166e6ef9
     Hash algo:    sha1
     Hash value:   84da2ae9bb8938b1cc5b472286f0db45b8cccd47
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x442edc24
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 5eaf5000, end 5eaff278 ... OK
mtdparts = mtdparts=nand0:128K@0x0(0:SBL1),64K@0x20000(0:MIBIB),128K@0x30000(0:SBL2),192K@0x50000(0:SBL3),64K@0x80000(0:DDRCONFIG),64K@0x90000(0:SSD),192K@0xa0000(0:TZ),128K@0xd0000(0:RPM),768K@0xf0000(0:APPSBL,
Using machid 0x13ec from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.10.176 (builder@buildhost) (arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 11.2.0 r20134-5f15225c1e) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Thu Apr 27 20:28:15 2023
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5787d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] OF: fdt: Machine model: Ubiquiti UniFi AC HD
[    0.000000] OF: fdt: Ignoring memory range 0x40000000 - 0x42000000
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000042000000-0x000000005fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000042000000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000042000000-0x000000005fffffff]
[    0.000000] percpu: Embedded 15 pages/cpu s31180 r8192 d22068 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 121800
[    0.000000] Kernel command line: 
[    0.000000] Bootloader command line not present
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 475424K/491520K available (7022K kernel code, 618K rwdata, 1028K rodata, 1024K init, 242K bss, 16096K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] clocksource: dg_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 305801671480 ns
[    0.000008] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 343597383600ns
[    0.000024] Switching to timer-based delay loop, resolution 160ns
[    0.000316] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=62500)
[    0.000343] pid_max: default: 32768 minimum: 301
[    0.000504] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000526] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.001498] CPU: Testing write buffer coherency: ok
[    0.001814] qcom_scm: convention: smc legacy
[    0.002880] Setting up static identity map for 0x42300000 - 0x42300060
[    0.003066] rcu: Hierarchical SRCU implementation.
[    0.003389] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.003651] smp: Bringing up secondary CPUs ...
[    0.005659] smp: Brought up 1 node, 2 CPUs
[    0.005678] SMP: Total of 2 processors activated (25.00 BogoMIPS).
[    0.005691] CPU: All CPU(s) started in SVC mode.
[    0.015009] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    0.015167] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.015199] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.015350] pinctrl core: initialized pinctrl subsystem
[    0.017001] NET: Registered protocol family 16
[    0.017332] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.018617] thermal_sys: Registered thermal governor 'step_wise'
[    0.020544] cpuidle: using governor ladder
[    0.020618] cpuidle: using governor menu
[    0.065119] usbcore: registered new interface driver usbfs
[    0.065202] usbcore: registered new interface driver hub
[    0.065268] usbcore: registered new device driver usb
[    0.065330] pps_core: LinuxPPS API ver. 1 registered
[    0.065347] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.065390] PTP clock support registered
[    0.067558] clocksource: Switched to clocksource dg_timer
[    0.068640] NET: Registered protocol family 2
[    0.068856] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.069777] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.069838] TCP established hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.069883] TCP bind hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.069940] TCP: Hash tables configured (established 4096 bind 4096)
[    0.070039] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.070073] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.070317] NET: Registered protocol family 1
[    0.070372] PCI: CLS 0 bytes, default 64
[    0.071514] workingset: timestamp_bits=14 max_order=17 bucket_order=3
[    0.077303] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.077324] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.179872] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 249)
[    0.181868] qcom-pcie 1b500000.pci: supply vdda not found, using dummy regulator
[    0.182087] qcom-pcie 1b500000.pci: supply vdda_phy not found, using dummy regulator
[    0.182190] qcom-pcie 1b500000.pci: supply vdda_refclk not found, using dummy regulator
[    0.182455] qcom-pcie 1b500000.pci: host bridge /soc/pci@1b500000 ranges:
[    0.182532] qcom-pcie 1b500000.pci:       IO 0x000fe00000..0x000fe0ffff -> 0x000fe00000
[    0.182574] qcom-pcie 1b500000.pci:      MEM 0x0008000000..0x000fdfffff -> 0x0008000000
[    0.402981] qcom-pcie 1b500000.pci: Link up
[    0.403137] qcom-pcie 1b500000.pci: PCI host bridge to bus 0000:00
[    0.403163] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.403186] pci_bus 0000:00: root bus resource [io  0x0000-0xffff] (bus address [0xfe00000-0xfe0ffff])
[    0.403206] pci_bus 0000:00: root bus resource [mem 0x08000000-0x0fdfffff]
[    0.403281] pci 0000:00:00.0: [17cb:0101] type 01 class 0x060400
[    0.403421] pci 0000:00:00.0: supports D1
[    0.403439] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.406919] PCI: bus0: Fast back to back transfers disabled
[    0.407392] pci 0000:01:00.0: [168c:0046] type 00 class 0x028000
[    0.407686] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.409166] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.413075] PCI: bus1: Fast back to back transfers disabled
[    0.413167] pci 0000:00:00.0: BAR 8: assigned [mem 0x08000000-0x081fffff]
[    0.413194] pci 0000:01:00.0: BAR 0: assigned [mem 0x08000000-0x081fffff 64bit]
[    0.413343] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.413368] pci 0000:00:00.0:   bridge window [mem 0x08000000-0x081fffff]
[    0.414325] pcieport 0000:00:00.0: AER: enabled with IRQ 43
[    0.415249] qcom-pcie 1b700000.pci: supply vdda not found, using dummy regulator
[    0.415469] qcom-pcie 1b700000.pci: supply vdda_phy not found, using dummy regulator
[    0.415576] qcom-pcie 1b700000.pci: supply vdda_refclk not found, using dummy regulator
[    0.415822] qcom-pcie 1b700000.pci: host bridge /soc/pci@1b700000 ranges:
[    0.415894] qcom-pcie 1b700000.pci:       IO 0x0031e00000..0x0031e0ffff -> 0x0031e00000
[    0.415933] qcom-pcie 1b700000.pci:      MEM 0x002e000000..0x0031dfffff -> 0x002e000000
[    0.644934] qcom-pcie 1b700000.pci: Link up
[    0.645078] qcom-pcie 1b700000.pci: PCI host bridge to bus 0001:00
[    0.645103] pci_bus 0001:00: root bus resource [bus 00-ff]
[    0.645125] pci_bus 0001:00: root bus resource [io  0x10000-0x1ffff] (bus address [0x31e00000-0x31e0ffff])
[    0.645144] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff]
[    0.645213] pci 0001:00:00.0: [17cb:0101] type 01 class 0x060400
[    0.645344] pci 0001:00:00.0: supports D1
[    0.645362] pci 0001:00:00.0: PME# supported from D0 D1 D3hot
[    0.648889] PCI: bus0: Fast back to back transfers disabled
[    0.649360] pci 0001:01:00.0: [168c:0046] type 00 class 0x028000
[    0.649652] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.651021] pci 0001:01:00.0: PME# supported from D0 D3hot D3cold
[    0.654908] PCI: bus1: Fast back to back transfers disabled
[    0.654991] pci 0001:00:00.0: BAR 8: assigned [mem 0x2e000000-0x2e1fffff]
[    0.655018] pci 0001:01:00.0: BAR 0: assigned [mem 0x2e000000-0x2e1fffff 64bit]
[    0.655166] pci 0001:00:00.0: PCI bridge to [bus 01-ff]
[    0.655189] pci 0001:00:00.0:   bridge window [mem 0x2e000000-0x2e1fffff]
[    0.656072] pcieport 0001:00:00.0: AER: enabled with IRQ 45
[    0.659111] L2 @ QSB rate. Forcing new rate.
[    0.659329] L2 @ 384000 KHz
[    0.659519] CPU0 @ 800000 KHz
[    0.659537] CPU1 @ QSB rate. Forcing new rate.
[    0.659669] CPU1 @ 384000 KHz
[    0.663724] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0
[    0.665709] gsbi 1a200000.gsbi: GSBI port protocol: 3 crci: 0
[    0.667830] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.670299] msm_serial 16340000.serial: msm_serial: detected port #0
[    0.670351] msm_serial 16340000.serial: uartclk = 7372800
[    0.670421] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 46, base_baud = 460800) is a MSM
[    0.670461] msm_serial: console setup on port #0
[    1.498517] printk: console [ttyMSM0] enabled
[    1.503611] msm_serial: driver initialized
[    1.512770] loop: module loaded
[    1.514442] spi_qup 1a280000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    1.516459] spi-nor spi0.0: mx25u25635f (32768 Kbytes)
[    1.522242] 16 fixed-partitions partitions found on MTD device spi0.0
[    1.528349] Creating 16 MTD partitions on "spi0.0":
[    1.533566] 0x000000000000-0x000000020000 : "SBL1"
[    1.538938] 0x000000020000-0x000000030000 : "MIBIB"
[    1.543673] 0x000000030000-0x000000050000 : "SBL2"
[    1.548462] 0x000000050000-0x000000080000 : "SBL3"
[    1.553264] 0x000000080000-0x000000090000 : "DDRCONFIG"
[    1.558099] 0x000000090000-0x0000000a0000 : "SSD"
[    1.563143] 0x0000000a0000-0x0000000d0000 : "TZ"
[    1.568110] 0x0000000d0000-0x0000000f0000 : "RPM"
[    1.572695] 0x0000000f0000-0x0000001b0000 : "APPSBL"
[    1.577318] 0x0000001b0000-0x0000001c0000 : "APPSBLENV"
[    1.582471] 0x0000001c0000-0x0000001d0000 : "EEPROM"
[    1.587340] 0x0000001d0000-0x0000001e0000 : "bootselect"
[    1.592569] 0x0000001e0000-0x000001050000 : "firmware"
[    1.603152] no rootfs found after FIT image in "firmware"
[    1.603198] 0x000001050000-0x000001ec0000 : "kernel1"
[    1.608305] 0x000001ec0000-0x000001fc0000 : "debug"
[    1.613251] 0x000001fc0000-0x000002000000 : "cfg"
[    1.639050] ipq806x-gmac-dwmac 37200000.ethernet: IRQ eth_wake_irq not found
[    1.639096] ipq806x-gmac-dwmac 37200000.ethernet: IRQ eth_lpi not found
[    1.645367] ipq806x-gmac-dwmac 37200000.ethernet: PTP uses main clock
[    1.652299] ipq806x-gmac-dwmac 37200000.ethernet: User ID: 0x10, Synopsys ID: 0x37
[    1.658232] ipq806x-gmac-dwmac 37200000.ethernet:    DWMAC1000
[    1.665575] ipq806x-gmac-dwmac 37200000.ethernet: DMA HW capability register supported
[    1.671491] ipq806x-gmac-dwmac 37200000.ethernet: RX Checksum Offload Engine supported
[    1.679196] ipq806x-gmac-dwmac 37200000.ethernet: COE Type 2
[    1.687015] ipq806x-gmac-dwmac 37200000.ethernet: TX Checksum insertion supported
[    1.692906] ipq806x-gmac-dwmac 37200000.ethernet: Wake-Up On Lan supported
[    1.700280] ipq806x-gmac-dwmac 37200000.ethernet: Enhanced/Alternate descriptors
[    1.706981] ipq806x-gmac-dwmac 37200000.ethernet: Enabled extended descriptors
[    1.714618] ipq806x-gmac-dwmac 37200000.ethernet: Ring mode enabled
[    1.721648] ipq806x-gmac-dwmac 37200000.ethernet: Enable RX Mitigation via HW Watchdog Timer
[    1.766962] ipq806x-gmac-dwmac 37400000.ethernet: IRQ eth_wake_irq not found
[    1.767008] ipq806x-gmac-dwmac 37400000.ethernet: IRQ eth_lpi not found
[    1.773395] ipq806x-gmac-dwmac 37400000.ethernet: PTP uses main clock
[    1.780052] ipq806x-gmac-dwmac 37400000.ethernet: User ID: 0x10, Synopsys ID: 0x37
[    1.786028] ipq806x-gmac-dwmac 37400000.ethernet:    DWMAC1000
[    1.793626] ipq806x-gmac-dwmac 37400000.ethernet: DMA HW capability register supported
[    1.799373] ipq806x-gmac-dwmac 37400000.ethernet: RX Checksum Offload Engine supported
[    1.807031] ipq806x-gmac-dwmac 37400000.ethernet: COE Type 2
[    1.814993] ipq806x-gmac-dwmac 37400000.ethernet: TX Checksum insertion supported
[    1.820845] ipq806x-gmac-dwmac 37400000.ethernet: Wake-Up On Lan supported
[    1.828208] ipq806x-gmac-dwmac 37400000.ethernet: Enhanced/Alternate descriptors
[    1.834895] ipq806x-gmac-dwmac 37400000.ethernet: Enabled extended descriptors
[    1.842515] ipq806x-gmac-dwmac 37400000.ethernet: Ring mode enabled
[    1.849544] ipq806x-gmac-dwmac 37400000.ethernet: Enable RX Mitigation via HW Watchdog Timer
[    1.894633] i2c /dev entries driver
[    1.898926] sdhci: Secure Digital Host Controller Interface driver
[    1.898960] sdhci: Copyright(c) Pierre Ossman
[    1.903999] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.910929] NET: Registered protocol family 10
[    1.915608] Segment Routing with IPv6
[    1.918650] NET: Registered protocol family 17
[    1.922223] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.927081] 8021q: 802.1Q VLAN Support v1.8
[    1.939732] Registering SWP/SWPB emulation handler
[    1.968028] qcom_rpm 108000.rpm: RPM firmware 3.0.16777381
[    1.981989] s1a: Bringing 0uV into 1050000-1050000uV
[    1.982272] s1a: supplied by regulator-dummy
[    1.986157] s1b: Bringing 0uV into 1050000-1050000uV
[    1.990586] s1b: supplied by regulator-dummy
[    1.995351] s2a: Bringing 0uV into 800000-800000uV
[    1.999776] s2a: supplied by regulator-dummy
[    2.004225] s2b: Bringing 0uV into 800000-800000uV
[    2.008814] s2b: supplied by regulator-dummy
[    2.017928] thermal thermal_zone0: failed to read out thermal zone (-110)
[    2.031705] /dev/root: Can't open blockdev
[    2.031729] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    2.034687] Please append a correct "root=" boot option; here are the available partitions:
[    2.042335] 1f00             128 mtdblock0 
[    2.042340]  (driver?)
[    2.054564] 1f01              64 mtdblock1 
[    2.054568]  (driver?)
[    2.061126] 1f02             128 mtdblock2 
[    2.061130]  (driver?)
[    2.067583] 1f03             192 mtdblock3 
[    2.067588]  (driver?)
[    2.074095] 1f04              64 mtdblock4 
[    2.074100]  (driver?)
[    2.080655] 1f05              64 mtdblock5 
[    2.080660]  (driver?)
[    2.087114] 1f06             192 mtdblock6 
[    2.087119]  (driver?)
[    2.093625] 1f07             128 mtdblock7 
[    2.093630]  (driver?)
[    2.100208] 1f08             768 mtdblock8 
[    2.100213]  (driver?)
[    2.106645] 1f09              64 mtdblock9 
[    2.106649]  (driver?)
[    2.113156] 1f0a              64 mtdblock10 
[    2.113161]  (driver?)
[    2.120077] 1f0b              64 mtdblock11 
[    2.120081]  (driver?)
[    2.126611] 1f0c           14784 mtdblock12 
[    2.126615]  (driver?)
[    2.133210] 1f0d           14784 mtdblock13 
[    2.133215]  (driver?)
[    2.139852] 1f0e            1024 mtdblock14 
[    2.139857]  (driver?)
[    2.146402] 1f0f             256 mtdblock15 
[    2.146407]  (driver?)
[    2.153000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.155190] CPU1: stopping
[    2.163431] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.10.176 #0
[    2.166117] Hardware name: Generic DT based system
[    2.172290] Function entered at [<c030e3cc>] from [<c030a15c>]
[    2.176974] Function entered at [<c030a15c>] from [<c0635ba8>]
[    2.182788] Function entered at [<c0635ba8>] from [<c030d0f0>]
[    2.188604] Function entered at [<c030d0f0>] from [<c030d150>]
[    2.194419] Function entered at [<c030d150>] from [<c03719a0>]
[    2.200236] Function entered at [<c03719a0>] from [<c064ef08>]
[    2.206051] Function entered at [<c064ef08>] from [<c0300b8c>]
[    2.211866] Exception stack(0xc106df58 to 0xc106dfa0)
[    2.217689] df40:                                                       00000a42 00000000
[    2.222836] df60: 00000a44 c0314bc0 c106c000 00000001 c0d04f18 c0d04f58 00000000 00000000
[    2.230995] df80: 00000000 c0c48028 c0d04fd0 c106dfa8 c0307510 c0307514 60000013 ffffffff
[    2.239130] Function entered at [<c0300b8c>] from [<c0307514>]
[    2.247284] Function entered at [<c0307514>] from [<c034e8c8>]
[    2.253013] Function entered at [<c034e8c8>] from [<c034ebe4>]
[    2.258829] Function entered at [<c034ebe4>] from [<423015ac>]
[    2.264649] Rebooting in 1 seconds..


U-Boot 2012.07 [UniFi,v1.0.15.274] (Dec 05 2021 - 16:33:43)

I'm totally at a dead end. Any clues?

Did you follow the instructions in the device info page?

Note: I'm not sure, but you may need to downgrade the firmware -- it's possible that the process won't work for 6.x firmware... the process described has been tested to 4.3.21.

Yes, I'm afraid I've tried both ways recommended on the device info page.
The main one seems to be the lock of the devicetree region memory I've mentioned before:

UAP-HD-BZ.6.5.28# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00020000 00010000 "SBL1"
mtd1: 00010000 00010000 "MIBIB"
mtd2: 00020000 00010000 "SBL2"
mtd3: 00030000 00010000 "SBL3"
mtd4: 00010000 00010000 "DDRCONFIG"
mtd5: 00010000 00010000 "SSD"
mtd6: 00030000 00010000 "TZ"
mtd7: 00020000 00010000 "RPM"
mtd8: 000c0000 00010000 "APPSBL"
mtd9: 00010000 00010000 "APPSBLENV"
mtd10: 00010000 00010000 "EEPROM"
mtd11: 00010000 00010000 "bootselect"
mtd12: 00e70000 00010000 "kernel0"
mtd13: 00e70000 00010000 "kernel1"
mtd14: 00100000 00010000 "debug"
mtd15: 00040000 00010000 "cfg"
UAP-HD-BZ.6.5.28# dd if=/dev/zero bs=1 count=1 seek=7 conv=notrunc of=/dev/mtd11
1+0 records in
1+0 records out
UAP-HD-BZ.6.5.28# dd if=/tmp/sys of=/dev/mtdblock12
14464+1 records in
14464+1 records out
UAP-HD-BZ.6.5.28# 

After rebooting this is shown on u-boot booting time:

U-Boot 2012.07 [UniFi,v1.0.15.274] (Dec 05 2021 - 16:33:43)

smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  ipq_nand: unknown NAND device manufacturer: 0 device: 0
ipq_nand: failed to identify device
SF: Detected MX25U25635F with page size 4 KiB, total 32 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x2000000
32 MiB
PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
cdp: get part failed for 0:HLOS
cdp: get part failed for rootfs
SF: Detected MX25U25635F with page size 4 KiB, total 32 MiB
DDR: Power Down state is disabled
Net:   uap3xx_extra 0: resting gpio 67 ... 
MAC2 addr:fc:ec:da:43:76:a
Port:2 speed 10Mbps
MAC1 addr:fc:ec:da:43:76:b
Port:1 speed 10Mbps
eth0, eth1
Hit any key to stop autoboot:  0 
ubnt boot ...
SF: Detected MX25U25635F with page size 4 KiB, total 32 MiB
No such device

NAND read: device 0 offset 0x1c0000, size 0x10000
 65536 bytes read: OK

NAND read: device 0 offset 0x1d0000, size 0x10000
 65536 bytes read: OK
Board: Ubiquiti Networks AR7240 board (e530-28.0000)
WARNING:Boot selection logic magic mismatch!
UBNT application initialized 
reading kernel 0 from: 0x1e0000, size: 0x00c9e000
crc32+ sha1+ ## Booting kernel from FIT Image at 44000000 ...
   Using 'config@5100_2' configuration
   Trying 'kernel@1' kernel subimage
     Description:  Ubiquiti Linux v6.5.28+14491.230127.1613
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x44000120
     Data Size:    13145985 Bytes = 12.5 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x42208000
     Entry Point:  0x42208000
     Hash algo:    crc32
     Hash value:   202cd137
     Hash algo:    sha1
     Hash value:   cb9e4babebf25d2dd9ac08babab14511c77020da
   Verifying Hash Integrity ... crc32+ sha1+ OK

serial console shows it's trying to load kernel0 but the label says kernel1, so it's not even trying to boot from kernel0, which kind of makes sense if it was not properly written, this is what I got at dmesg when attempting to write the kernel into the mtd partition:

ri Jan 27 16:14:27 2023 kern.warn kernel: [  116.466126] mtdblock: erase of region [0x0, 0x10000] on "kernel0" failed
Fri Jan 27 16:14:27 2023 kern.warn kernel: [  116.466142] mtdblock: erase of region [0x0, 0x10000] on "kernel0" failed
Fri Jan 27 16:14:27 2023 kern.warn kernel: [  116.466157] mtdblock: erase of region [0x0, 0x10000] on "kernel0" failed
Fri Jan 27 16:14:27 2023 kern.warn kernel: [  116.466173] mtdblock: erase of region [0x0, 0x10000] on "kernel0" failed
Fri Jan 27 16:14:27 2023 kern.warn kernel: [  116.466189] mtdblock: erase of region [0x0, 0x10000] on "kernel0" failed
Fri Jan 27 16:14:27 2023 kern.warn kernel: [  116.466204] mtdblock: erase of region [0x0, 0x10000] on "kernel0" failed
Fri Jan 27 16:14:27 2023 kern.warn kernel: [  116.466218] mtdblock: erase of region [0x0, 0x10000] on "kernel0" failed
Fri Jan 27 16:14:27 2023 kern.warn kernel: [  116.466233] mtdblock: erase of region [0x0, 0x10000] on "kernel0" failed
Fri Jan 27 16:14:27 2023 kern.warn kernel: [  116.484444] VFS: Dirty inode writeback failed for block device mtdblock12 (err=-5).
Fri Jan 27 16:14:27 2023 kern.warn kernel: [  116.484458] mtdblock: erase of region [0x0, 0x10000] on "kernel0" failed

I even tried to write it into the kernel1 nand partition with the same error.

Okey okey, rollback!

I've just realized I was doing this under heavy sleep privation, I've found I was using the regular sysupgrade version to attempt the tftpboot, when in fact I should have used the smaller version to fit it into ram (as for today openwrt-22.03.5-ipq806x-generic-ubnt_unifi-ac-hd-initramfs-fit-uImage.itb).

I've successfully went with the tftpboot approach and burned the latest release!

I'll be updated the official device info page with this for any casual person like me.

Thanks!

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.
Thanks! :slight_smile:

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.