Stuck in recovery (initramfs) mode - Can't upgrade

Please help! I have many OpenWrt devices, but this is the first time one of the devices is stuck in initramfs mode. Here is the device info (Note: we have 2 additional devices of the same model, and those devices are running OpenWrt 23.05.3 non-initramfs with no problem):
|Hostname| OpenWrt
|Model| Ubiquiti UniFi AC Pro
|Architecture| Qualcomm Atheros QCA956X ver 1 rev 0
|Target Platform| ath79/generic
|Firmware Version| OpenWrt 23.05.3 r23809-234f1a2efa / LuCI openwrt-23.05 branch git-24.073.29889-cd7e519
|Kernel Version| 5.15.150

I try to upgrade in LuCI and CLI to the sysupgrade package, and the devices keeps reverting back to the 23.05.3 initramfs mode. I can successfully scp the sysupgrade package to the device, and run the sysupgrade command (even tried options -F -n -p), but the system also comes back from reboot in the same initramfs mode. I even tried to downgrade to an older OpenWrt package, and the device won't downgrade either.

root@OpenWrt:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00060000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00f20000 00010000 "firmware"
mtd3: 00240000 00010000 "kernel"
mtd4: 00ce0000 00010000 "rootfs"
mtd5: 00900000 00010000 "rootfs_data"
mtd6: 00020000 00010000 "bs"
mtd7: 00040000 00010000 "cfg"
mtd8: 00010000 00010000 "art"

root@OpenWrt:~# dmesg
[    0.000000] Linux version 5.15.150 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23809-234f1a2efa) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Fri Mar 22 22:09:42 2024
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is Ubiquiti UniFi AC Pro
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 106740K/131072K available (6082K kernel code, 597K rwdata, 780K rodata, 15316K init, 216K bss, 24332K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000001] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008288] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074814] pid_max: default: 32768 minimum: 301
[    0.080511] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.088251] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.102153] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.112569] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.119918] pinctrl core: initialized pinctrl subsystem
[    0.127129] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.133921] thermal_sys: Registered thermal governor 'step_wise'
[    0.145756] clocksource: Switched to clocksource MIPS
[    0.158711] NET: Registered PF_INET protocol family
[    0.164067] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.172632] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.181603] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.189819] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.197924] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.205366] TCP: Hash tables configured (established 1024 bind 1024)
[    0.212215] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.219173] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.226910] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.232920] PCI: CLS 0 bytes, default 32
[    0.316184] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.327661] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.333817] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.367023] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.388969] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.396244] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.405291] printk: console [ttyS0] disabled
[    0.409913] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.419038] printk: console [ttyS0] enabled
[    0.428104] printk: bootconsole [early0] disabled
[    0.497751] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[    0.503135] 6 fixed-partitions partitions found on MTD device spi0.0
[    0.509781] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.516665] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.523767] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.530666] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.537864] Creating 6 MTD partitions on "spi0.0":
[    0.542834] 0x000000000000-0x000000060000 : "u-boot"
[    0.617985] 0x000000060000-0x000000070000 : "u-boot-env"
[    0.624368] 0x000000070000-0x000000f90000 : "firmware"
[    0.632595] 2 uimage-fw partitions found on MTD device firmware
[    0.638770] Creating 2 MTD partitions on "firmware":
[    0.643901] 0x000000000000-0x000000240000 : "kernel"
[    0.650054] 0x000000240000-0x000000f20000 : "rootfs"
[    0.657566] mtd: setting mtd4 (rootfs) as root device
[    0.662893] 1 squashfs-split partitions found on MTD device rootfs
[    0.669329] 0x000000620000-0x000000f20000 : "rootfs_data"
[    0.675981] 0x000000f90000-0x000000fb0000 : "bs"
[    0.683260] 0x000000fb0000-0x000000ff0000 : "cfg"
[    0.689143] 0x000000ff0000-0x000001000000 : "art"
[    1.450569] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[    2.107390] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    2.118720] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    2.125446] i2c_dev: i2c /dev entries driver
[    2.132022] NET: Registered PF_INET6 protocol family
[    2.147001] Segment Routing with IPv6
[    2.150864] In-situ OAM (IOAM) with IPv6
[    2.155023] NET: Registered PF_PACKET protocol family
[    2.160409] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    2.174102] 8021q: 802.1Q VLAN Support v1.8
[    2.179691] PCI host bridge to bus 0000:00
[    2.183938] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    2.191096] pci_bus 0000:00: root bus resource [io  0x0000]
[    2.196866] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.205088] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[    2.211341] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    2.218413] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    2.225407] pci 0000:00:00.0: supports D1
[    2.229563] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    2.236382] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    2.243243] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    2.250828] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    2.344923] Freeing unused kernel image (initmem) memory: 15316K
[    2.351170] This architecture does not have kernel memory protection.
[    2.357839] Run /init as init process
[    2.361617]   with arguments:
[    2.361622]     /init
[    2.361626]   with environment:
[    2.361630]     HOME=/
[    2.361634]     TERM=linux
[    2.956681] init: Console is alive
[    2.960695] init: - watchdog -
[    2.985459] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.998698] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.016701] init: - preinit -
[    3.344792] random: jshn: uninitialized urandom read (4 bytes read)
[    3.491408] random: jshn: uninitialized urandom read (4 bytes read)
[    3.579953] random: jshn: uninitialized urandom read (4 bytes read)
[    4.571142] random: procd: uninitialized urandom read (4 bytes read)
[    4.585283] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 2 is up
[    4.600048] eth0: link up (1000Mbps/Full duplex)
[    4.604867] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    4.626600] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[    6.780414] eth0: link down
[    6.802143] procd: - early -
[    6.805425] procd: - watchdog -
[    7.434701] procd: - watchdog -
[    7.438351] procd: - ubus -
[    7.450006] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.492259] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.499360] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.509237] procd: - init -
[    8.180421] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.632763] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b
[    8.640554] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36
[    8.878268] PPP generic driver version 2.4.2
[    8.896622] NET: Registered PF_PPPOX protocol family
[    8.985664] ath: EEPROM regdomain: 0x2a
[    8.985684] ath: EEPROM indicates we should expect a direct regpair map
[    8.985700] ath: Country alpha2 being used: US
[    8.985706] ath: Regpair used: 0x2a
[    8.998068] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[    9.000044] ieee80211 phy0: Atheros AR9561 Rev:0 mem=0xb8100000, irq=2
[    9.066212] kmodloader: done loading kernel modules from /etc/modules.d/*
[   10.218710] urngd: v1.0.2 started.
[   10.461463] random: jshn: uninitialized urandom read (4 bytes read)
[   10.916799] random: jshn: uninitialized urandom read (4 bytes read)
[   11.174090] random: jshn: uninitialized urandom read (4 bytes read)
[   12.062178] random: crng init done
[   12.065711] random: 31 urandom warning(s) missed due to ratelimiting
[   44.040829] eth0: link up (1000Mbps/Full duplex)
[   44.045638] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   44.069057] br-lan: port 1(eth0.1) entered blocking state
[   44.074658] br-lan: port 1(eth0.1) entered disabled state
[   44.080561] device eth0.1 entered promiscuous mode
[   44.085525] device eth0 entered promiscuous mode
[   44.112893] br-lan: port 1(eth0.1) entered blocking state
[   44.118533] br-lan: port 1(eth0.1) entered forwarding state
[   45.056075] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

What firmware image are you using (please provide the exact file name), and what commands are you issuing to attempt the upgrade?

Thanks for the response!
I initially installed OpenWrt using the file:
openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-initramfs-kernel.bin
After successfully switching from the OEM firmware to OpenWrt, I then tried to upgrade to squashfs using the file: openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin

Attempt 1:
Usually after I install the kernel version of OpenWrt, I'm able to do the sysupgrade in the LuCi UI to the squashfs package. See the following screenshot, where I click on the button "Go to firmware upgrade...", which takes me to the "Flash operations" page, and I click on
"Flash new firmware image'. I upload the file "openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin". The device rebooted, but came back in initramfs mode.

Attempt 2:

  • I successfully scp the file "openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin" to the device's /tmp directory. I'll cd /tmp and then run the following command:
    sysupgrade -F openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin

I even tried: sysupgrade -F -n -p openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin
but the device still comes back to initramfs mode.

Hopefully this answers your question/request?

Does it throw any errors?

Have you tried tftp?

I'm curious why it comes back to the initramfs all the time....
In most (all?) cases, you're not supposed to flash it.

I didn't try TFTP since I can successfully scp the package to the device [sorry, the forum won't let me put more screenshot pictures]:
'openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin 100% 6272KB 6.3MB/s 00:00"

Now the sysupgrade command seems to throw an error now (even though I didn't think it did before) - again, sorry, the forum won't let me paste screenshots anymore on this thread, so here is the text cut-and-paste:

-rw-r--r--    1 root     root       6422849 Mar 23 13:44 openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin
root@OpenWrt:/tmp# sysupgrade -F -n -p openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin 
Sat Mar 23 13:45:03 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failed
root@OpenWrt:/tmp# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

Any help on how to determine the error? Any logs or command output that I can provide? Thanks for your help!

Those are not errors -- that's the expected sequence of events.

What do you get when you login via ssh again and issue this command:

ubus call system board

And finally:

Please use the "Preformatted text </>" button for logs, scripts, configs and general console output.
grafik
Please edit your post accordingly. Thank you! :slight_smile:

1 Like

Thanks again for your continued help. Here is the output of the ubus call system board:

root@OpenWrt:~# ubus call system board
{
	"kernel": "5.15.150",
	"hostname": "OpenWrt",
	"system": "Qualcomm Atheros QCA956X ver 1 rev 0",
	"model": "Ubiquiti UniFi AC Pro",
	"board_name": "ubnt,unifiac-pro",
	"rootfs_type": "initramfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.3",
		"revision": "r23809-234f1a2efa",
		"target": "ath79/generic",
		"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
	}
}

Other than the message on Luci, are you sure that it is not now running the persistent storage version? What does mount show? Can you write files and have them remain through reboots?

Though generally not recommended, you can use mtd to write the sysupgrade file directly to flash (be sure to use the firmware partition).
mtd -e -r write <filename> firmware
This should take time (on the order of tens of seconds) to complete. If it completes within 1 or 2 seconds, the flash chip was not actually written probably due to the write protection bug, which should have been fixed in 23.05.3.

  1. Here is the mount output:
root@OpenWrt:~# mount
tmpfs on / type tmpfs (rw,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
tmpfs on /dev type tmpfs (rw,nosuid,noexec,noatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,noatime,mode=600,ptmxmode=000)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)
bpffs on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,noatime,mode=700)

  1. Here is the output of the mtd command:
root@OpenWrt:/tmp# mtd -e -r write openwrt-23.05.3-ath79-generic-ubnt_unifiac-pr
o-squashfs-sysupgrade.bin firmware
Could not open mtd device: -r
Could not open mtd device: -r
root@OpenWrt:/tmp# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

  1. Files do NOT remain through reboots:
    Here I copied the software package to the /root home directory:
root@OpenWrt:~# ls -l
-rw-r--r--    1 root     root       6422849 Mar 22 22:11 openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin
root@OpenWrt:~# pwd
/root
root@OpenWrt:~# reboot
root@OpenWrt:~# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

And then after the reboot, here is the output (i.e. file is gone after the reboot):

root@OpenWrt:~# cd
root@OpenWrt:~# ls -l
root@OpenWrt:~# pwd
/root

I even tried downgrading to older software releases (kernel and squashfs), and nothing changes. I'm stuck on this initramfs version :frowning:

I think that's a syntax error on my part. Try leaving the -r out and use only -e, or no dash options at all.

You should see a progress indication ([e] and [w]) for some time. After the command finishes, reboot manually.

Thanks, but it still seems to be stuck in initramfs.
[FYI: I have 2 other identical hardware/devices successfully running OpenWrt squashfs. I'm not sure why this one is stuck. If you need commands run on the other good units, just let me know?]

  1. Here is the output of the mtd command:
root@OpenWrt:/tmp# mtd write openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin firmware
Unlocking firmware ...

Writing from openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin to firmware ...     
root@OpenWrt:/tmp# mount
tmpfs on / type tmpfs (rw,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
tmpfs on /dev type tmpfs (rw,nosuid,noexec,noatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,noatime,mode=600,ptmxmode=000)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)
bpffs on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,noatime,mode=700)
root@OpenWrt:/tmp# reboot
root@OpenWrt:/tmp# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.
  1. Coming back from the reboot:
root@OpenWrt:~# ubus call system board
{
	"kernel": "5.15.150",
	"hostname": "OpenWrt",
	"system": "Qualcomm Atheros QCA956X ver 1 rev 0",
	"model": "Ubiquiti UniFi AC Pro",
	"board_name": "ubnt,unifiac-pro",
	"rootfs_type": "initramfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.3",
		"revision": "r23809-234f1a2efa",
		"target": "ath79/generic",
		"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
	}
}

  1. And the UI even says that the device is in initramfs mode.

I don't know enough about how OpenWrt decides which partition to pick up the new software package, but is there a way to force OpenWrt to use the squashfs package and not revert back to the initramfs?

I'd suggest to flash the 23.05.2 sysupgrade image next, not because it would be better, just to get a clearly different version number here, to ensure that the flashing actually worked.

How long did the write take? If it finishes abnormally quickly (1-2 seconds), it didn't actually write.

I think there is only one partition. Although maybe a flag in the bs partition needs to be set differently than you have it.

23.05.2 definitely has the bug and should not be used. If there is a 22 build for this model you could try it.

Thanks again everyone for the continued help.

  1. I didn't see mk24's suggestion not to use the 23.05.2 build before I tried the upgrade. It didn't work anyways, and here is the output:
-rw-r--r--    1 root     root       6422849 Mar 23 02:57 openwrt-23.05.2-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin
root@OpenWrt:/tmp# sysupgrade -F openwrt-23.05.2-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin 
Cannot save config while running from ramdisk.
Sat Mar 23 02:57:22 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failed
root@OpenWrt:/tmp# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

And then after the reboot, the device is still on 23.05.3:

root@OpenWrt:~# ubus call system board
{
	"kernel": "5.15.150",
	"hostname": "OpenWrt",
	"system": "Qualcomm Atheros QCA956X ver 1 rev 0",
	"model": "Ubiquiti UniFi AC Pro",
	"board_name": "ubnt,unifiac-pro",
	"rootfs_type": "initramfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.3",
		"revision": "r23809-234f1a2efa",
		"target": "ath79/generic",
		"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
	}
}
  1. I tried to sysupgrade 22.03.6, and it didn't work either.
root@OpenWrt:/tmp# sysupgrade -F openwrt-22.03.6-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin 
Cannot save config while running from ramdisk.
Fri Mar 22 22:11:25 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failed
root@OpenWrt:/tmp# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

And then after the reboot, the device is still on 23.05.3:

root@OpenWrt:~# ubus call system board
{
	"kernel": "5.15.150",
	"hostname": "OpenWrt",
	"system": "Qualcomm Atheros QCA956X ver 1 rev 0",
	"model": "Ubiquiti UniFi AC Pro",
	"board_name": "ubnt,unifiac-pro",
	"rootfs_type": "initramfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.3",
		"revision": "r23809-234f1a2efa",
		"target": "ath79/generic",
		"description": "OpenWrt 23.05.3 r23809-234f1a2efa"
	}
}
  1. Here is how long the mtd command took [approximately 51 seconds]:
root@OpenWrt:/tmp# date
Fri Mar 22 22:11:08 UTC 2024
root@OpenWrt:/tmp# mtd write openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin firmware
Unlocking firmware ...

Writing from openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin to firmware ...     
root@OpenWrt:/tmp# date
Fri Mar 22 22:11:59 UTC 2024

  1. I don't know how to set flags in the bs partition. Can anyone provide info on how to set the flags? Not knowing much about it, I assume that I probably have some issue like flags set incorrectly (even though I'm pretty sure that I never set any flags manually). It sounds like I'm writing to a particular partition, but the device flashes using the software in a different partition because of some flag or setting?

This appears to be similar to the UAP AC Mesh. These were dual partition from the factory but OpenWrt 23 converts to a single partition map which results in much more usable flash space.

If the bs flag is set to use partition 1, and the initramfs is in the former partition 1 space, it will boot that by default and not use the new OpenWrt flashed to partition 0 (the start of the firmware space).

Either of these methods should work (execute from running initramfs OpenWrt):

  1. Clear the bank select bit: dd if=/dev/zero bs=1 count=1 of=/dev/mtd6 (note mtd6 is the bs partition under the new OpenWrt scheme).
  2. Clobber both old partitions so that the initramfs no longer exists. Bootloader will still attempt partition 1, find no bootable code there, then revert to partition 0. This may result in increased boot time every time compared to having the bs bit set properly. Run mtd erase firmware then (without rebooting) sysupgrade or mtd write firmware.
1 Like

It worked, until it didn't. So very close, but now it might be bricked?

I only executed the " dd if=/dev/zero bs=1 count=1 of=/dev/mtd6" command, and then the unit came back as squashfs. I was so happy.

But then I simply did a fresh sysupgrade to 23.05.3, and now I can't ping or ssh 192.168.1.1 after the reboot. I don't understand it- the unit first came back as squashfs after running the "dd" command. All I did was a sysupgrade, and now it seems to be bricked?

root@OpenWrt:/tmp# sysupgrade -F openwrt-23.05.3-ath79-generic-ubnt_unifiac-pro-squashfs-sysupgrade.bin 
Fri Mar 22 22:11:40 UTC 2024 upgrade: Saving config files...
Fri Mar 22 22:11:40 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failed
root@OpenWrt:/tmp# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

Question #1: I know the unit could have any number of problems now, but any other ideas for help? Again, I didn't do anything but try a fresh sysupgrade after it seems to have come back successfully in squashfs mode from the "dd" command. Perhaps is the unit stuck trying to boot from a different partition?

Question #2: I also have Netgear routers running OpenWrt, and I've successfully used nmrpflash to connect to some of my Netgear routers that wouldn't initially ping or ssh. Does Ubiquiti routers have something like nmrpflash to help me unbrick the router without resorting to physically opening the unit and using the serial console? Or any ideas on how to connect to the unit?

Wow, what a roller coaster ride in the last 30 minutes- I went from being super happy to now being totally sad. Hopefully you all have some other ideas to help me other than resorting to throwing the unit away? Thanks again you all for your great help!

The only path to debrick without opening the case is to use TFTP to load stock firmware, and repeat the entire installation process again. The TFTP loader rejects firmware that is not signed by Ubiquiti.

OpenWrt should not alter the bs flag, so it should stay at zero through upgrades after it has been set that way once.

It may take a long time (on the order of 5 minutes) for the first boot of squashfs to format and mount the jffs filesystem. Until then the Ethernet will not respond.

THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU THANK YOU

I was able to reload the 23.05.3 package, and now it is working fine. Maybe my last upgrade, after setting the bs flag, got corrupted? I've rebooted several times and made several configuration changes, and everything seems to be ok now. Thank you all for taking the time to help me!

Last question: Is there some command to print the various important bit settings, like the partition and bs flag bits? Or do I have to print each one individually? I have 2 other fully working devices (exact same model, revision, etc), and I was hoping to compare important settings and flags just to make sure some other settings aren't messed up. Because somehow the bs flag got messed up on this last device, so I want to make sure other flags aren't messed up too. Figured I would ask, just in case there is a good command(s) to check.

hexdump -n1 -C /dev/mtd6

Expect result (bs flag = 0)

00000000  00                                                |.|
00000001

If the 00 on the first line is 80, the bs flag is set to 1.

mtd number may vary by device and OpenWrt version, check with cat /proc/mtd to confirm you are reading the bs partition.