Unifi AP AC LR flashed broken?

ThomasHH · February 14, 2024, 6:05am

Good Morning,

Now I have to ask here. I have a latest generation Unifi AP AC LR. I can't even remember what I did in sequence, but the part just stays at this point:

U-Boot unifi-v2.0.9.307-gd60f380a (Mar 25 2021 - 15:00:50)

DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ff3800, log_magic:0x55555555 kseg: 0xa0000000
Top of RAM usable for U-Boot at: 87ff3000
Reserving 252k for U-Boot at: 87fb0000
Reserving 192k for malloc() at: 87f80000
Reserving 44 Bytes for Board Info at: 87f7ffd4
Reserving 36 Bytes for Global Data at: 87f7ffb0
Reserving 128k for boot params() at: 87f5ffb0
Stack Pointer at: 87f5ff98
Now running in RAM - U-Boot at: 87fb0000
Flash: 16 MB
PCIe WLAN Module found (tries: 1).
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x9fff0000
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
 ath_gmac_enet_initialize: is_s17()=0, is_ar8033()=1, phy id1=4d phy_id2=d074
WAN AR8033 PHY init
athrs_ar8033_reg_init: Done 111
Max resets limit reached exiting...
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: d8:b3:70:b3:8a:ac
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
## Starting application at 0x80200020

and just won't boot any further. I use the following commands:

tftpboot 0x80000000 openwrt-23.05.0-ath79-generic-ubnt_unifiac-lr-squashfs-sysupgrade.bin
erase 0x9f070000 +$filesize
cp.b 0x80000000 0x9f070000 $filesize
bootm 0x9f070000

Then the device boots and I can log in etc. After a restart everything is back to the old one - the part stops when I try to boot.

I have to say that I have very little idea of what I'm doing here ... But the goal should be a functioning Freifunk node. Can someone help me there?

Thanks

bmork · February 14, 2024, 7:40am

That method doesn't seem to account for the possibility that uboot is configured for booting from the second firmware partition. Maybe that's the problem? Current OpenWrt images are probably huge enough to overwrite the start of the second firmware, so it will fail to boot. I'd expect it to write some error messages in this case though, but maybe it doesn't?

What's the content of the "bs" partition (only first 4 bytes are significant)? Should be at 0x9ff90000 I believe, but don't take my word for it.

A very safe method for resetting "bs" would be using tftp recovery and then immediately repeat the OpenWrt installation.

ThomasHH · February 14, 2024, 8:36am

What would be the correct course of action? I have little idea about it and unfortunately I'm just working through instructions without really understanding what's behind it. There were no error messages during the entire process.

How do I get this out? Here is the output from mtdparts:

ath> mtdparts

device nor0 <ath-nor0>, # parts = 7
 #: name                        size            offset          mask_flags
 0: u-boot                      0x00060000      0x00000000      0
 1: u-boot-env                  0x00010000      0x00060000      0
 2: kernel0                     0x00790000      0x00070000      0
 3: kernel1                     0x00790000      0x00800000      0
 4: bs                          0x00020000      0x00f90000      0
 5: cfg                         0x00040000      0x00fb0000      0
 6: EEPROM                      0x00010000      0x00ff0000      0

active partition: nor0,0 - (u-boot) 0x00060000 @ 0x00000000

defaults:
mtdids  : nor0=ath-nor0
mtdparts: mtdparts=ath-nor0:384k(u-boot),64k(u-boot-env),7424k(kernel0),256k(cfg),64k(EEPROM)

How do I play this? The AP doesn't seem to do much anymore (at least not permanently). After a reboot it always stays in the same place. I'm already trying more or less random instructions from the internet to get a different reaction from the AP

bmork · February 14, 2024, 10:38am

Not sure there. Depends on what tools that U-Boot has for reading from flash. Copy a few bytes to memory and dump from there should work in any case.

tftp recovery is described here: https://openwrt.org/toh/ubiquiti/unifiac#flashing_via_tftp_tftp_recovery
or: https://help.ui.com/hc/en-us/articles/360043360253-UniFi-Recovery-Mode

But there is no point in doing this unless you know it will help, so try and see if you can read "bs" first. The first 4 bytes should be all zeroes when booting from "kernel0". See the different "non-invasive" instructions on the device page. This problem is exactly the same when installing from u-Boot, but has been ignored in those instructions for some reason.

Why are you using the U-Boot method anyway? Console access is generally not required for these devices, I believe. Unless something has happened to recent firmwares making all the "non-invasive" methods fail?

ThomasHH · February 14, 2024, 12:59pm

Ah, OK, that doesn't work anymore. The reset button no longer has any function. The LED only lights up again when I flash the device's firmware using the method described above.

For firmware higher than 3.7.58, signed firmware is expected. These are new UniFi AP AC LR devices.

bmork · February 14, 2024, 1:14pm

Somehow I have a hard time believing that. AFAIK, this is still their official and documented emergency reset procedure. And they have (re-)implemented the functionality oon brand new devices like the U6+. So it seems unlikely that they've dropped it from an old platform where it has been working for ages.

Did you press and hold the reset button while powering on? And it still didn't enter the white-blue-off led pattern as documented on?:

Then I gues you should consider that a bug. The might not want to support OpenWrt, but they do support tftp recovery.

mk24 · February 14, 2024, 4:11pm

With serial I would do this:
Interrupt the boot.
At the boot prompt, TFTP the initramfs OpenWrt to 0x82000000 and bootm 0x82000000 to boot OpenWrt in RAM.
At the OpenWrt CLI, confirm that the bs bit is set to 0.
Transfer the sysupgrade OpenWrt file to /tmp and use sysupgrade to flash it.
Reboot. OpenWrt should now be permanently installed.

This sort of writing directly to flash is not recommended as it is easy to make a mistake and clobber vital data such as the bootloader or ART.

ThomasHH · February 15, 2024, 5:55am

Please excuse me, but I have never spoken English and therefore have to work with the translator. I hope that this did not cause any transmission errors. The device already has such a reset button. I originally wanted to downgrade from the factory installed firmware 6.x to 5.x, then to 4.x and finally to 3.7.58. From 6.x to 5.x it still worked. But it couldn't go any further down, which is why I opened the device and tried my luck again via the serial interface.

After a few attempts to flash the firmware via the serial interface, the reset button no longer works. Up until then it had basically worked as it should. Video

bmork · February 15, 2024, 6:36am

Aha, now I understand. That makes sense. So the reset button of your device is broken. I see the problem there...

Maybe you can short short the button contacts since you've opened the device anyway?

ThomasHH · February 15, 2024, 7:38am

So, I've recorded the whole thing now. The reset button is not physically broken. If I start the firmware in RAM, the reset button also works. As you can also see in the video, the LED only lights up when the firmware is running in the RAM: Video (PS: the video will only be on YouTube in about 45 minutes. available in 4k)

What do I have to do for this? How does this work? As I said, my strengths lie somewhere else

bmork · February 15, 2024, 7:42am

This is how it looks like on my AP AC Pro:

root@unifiac2:~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00060000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00f20000 00010000 "firmware"
mtd3: 00260000 00010000 "kernel"
mtd4: 00cc0000 00010000 "rootfs"
mtd5: 006a0000 00010000 "rootfs_data"
mtd6: 00020000 00010000 "bs"
mtd7: 00040000 00010000 "cfg"
mtd8: 00010000 00010000 "art"
root@unifiac2:~# hexdump -n 8 -C /dev/mtd6ro
00000000  00 00 00 00 a3 4d e8 2b                           |.....M.+|
00000008

When configured for "kernel1" it would show "80 00 00 00 a3 4d e8 2b" instead AFAIR.

ThomasHH · February 15, 2024, 8:01am

That's exactly how it looks to me

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00060000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00f20000 00010000 "firmware"
mtd3: 00240000 00010000 "kernel"
mtd4: 00ce0000 00010000 "rootfs"
mtd5: 00920000 00010000 "rootfs_data"
mtd6: 00020000 00010000 "bs"
mtd7: 00040000 00010000 "cfg"
mtd8: 00010000 00010000 "art"
root@OpenWrt:/# hexdump -n 8 -C /dev/mtd6ro
00000000  00 00 00 00 a3 4d e8 2b                           |.....M.+|
00000008
root@OpenWrt:/#

bmork · February 15, 2024, 9:02am

Well, then that was not the problem.

Try sysupgrade from OpenWrt as @mk24 suggested

ThomasHH · February 15, 2024, 9:10am

(post deleted by author)

ThomasHH · February 15, 2024, 9:13am

But I have that and nothing changes in behavior. After the sysupgrade it boots to the point "## Starting application at 0x80200020" and stops there. You can see that here in the video: https://youtu.be/Xkzhq6j91JQ

bmork · February 15, 2024, 10:21am

Then I wonder if there is something else/more broken than just the reset button

mk24 · February 15, 2024, 6:43pm

Video very hard to see but it looks like you forced sysupgrade with unifi-ap-lr build instead of unifiac-lr. The ap-lr is an old b/g/n device; completely different hardware.

Use the 22.03.6 unifiac-lr firmware from the ath79 target. First boot the initramfs in RAM then sysupgrade with the sysupgrade. This will not require a force sysupgrade.

ThomasHH · February 16, 2024, 6:31am

First of all, thank you for your patience

I have now followed this. I started the system and interrupted the boot process:


U-Boot unifi-v2.0.9.307-gd60f380a (Mar 25 2021 - 15:00:50)

DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ff3800, log_magic:0x75755575 kseg: 0xa0000000
Top of RAM usable for U-Boot at: 87ff3000
Reserving 252k for U-Boot at: 87fb0000
Reserving 192k for malloc() at: 87f80000
Reserving 44 Bytes for Board Info at: 87f7ffd4
Reserving 36 Bytes for Global Data at: 87f7ffb0
Reserving 128k for boot params() at: 87f5ffb0
Stack Pointer at: 87f5ff98
Now running in RAM - U-Boot at: 87fb0000
Flash: 16 MB
PCIe WLAN Module found (tries: 1).
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x9fff0000
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
 ath_gmac_enet_initialize: is_s17()=0, is_ar8033()=1, phy id1=4d phy_id2=d074
WAN AR8033 PHY init
athrs_ar8033_reg_init: Done 111
Max resets limit reached exiting...
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: d8:b3:70:b3:8a:ac
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
ath>

Then I booted the firmware 22.03.6 (openwrt-22.03.6-ath79-generic-ubnt_unifiac-lr-initramfs-kernel.bin) into the ram:

ath> **tftpboot 0x80000000 openwrt-22.03.6-ath79-generic-ubnt_unifiac-lr-initramfs-kernel.bin**
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename 'openwrt-22.03.6-ath79-generic-ubnt_unifiac-lr-initramfs-kernel.bin'.
Load address: 0x80000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #
done
Bytes transferred = 5657764 (5654a4 hex)
ath> **erase 0x9f070000 +$filesize**
Erase Flash from 0x9f070000 to 0x9f5dffff in Bank # 1
First 0x7 last 0x5d sector size 0x10000
....................................................................................... done
Erased 87 sectors
ath> **cp.b 0x80000000 0x9f070000 $filesize**
Copy to Flash... write addr: 9f070000
done
ath> **bootm 0x9f070000**
## Booting image at 9f070000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.201
   Created:      2023-11-25  18:18:57 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5657700 Bytes =  5.4 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f070040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 5.10.201 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r20265-f85a79bcb4) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Sat Nov 25 18:18:57 2023
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is Ubiquiti UniFi AC LR
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 110404K/131072K available (5895K kernel code, 610K rwdata, 748K rodata, 11872K init, 210K bss, 20668K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008282] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074811] pid_max: default: 32768 minimum: 301
[    0.079804] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087520] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.097625] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.107979] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.118385] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.125656] pinctrl core: initialized pinctrl subsystem
[    0.135125] NET: Registered protocol family 16
[    0.140554] thermal_sys: Registered thermal governor 'step_wise'
[    0.187447] clocksource: Switched to clocksource MIPS
[    0.200269] NET: Registered protocol family 2
[    0.205069] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.213437] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.222360] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.230461] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.237905] TCP: Hash tables configured (established 1024 bind 1024)
[    0.244720] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.251658] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.259319] NET: Registered protocol family 1
[    0.263941] PCI: CLS 0 bytes, default 32
[    0.460933] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.471256] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.477404] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.489498] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.499793] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.506794] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.515576] printk: console [ttyS0] disabled
[    0.520193] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.529308] printk: console [ttyS0] enabled
[    0.529308] printk: console [ttyS0] enabled
[    0.538377] printk: bootconsole [early0] disabled
[    0.538377] printk: bootconsole [early0] disabled
[    0.564340] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[    0.569767] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.576368] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.583235] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.590459] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.597312] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.604639] Creating 7 MTD partitions on "spi0.0":
[    0.609640] 0x000000000000-0x000000060000 : "u-boot"
[    0.619283] 0x000000060000-0x000000070000 : "u-boot-env"
[    0.625704] 0x000000070000-0x000000800000 : "firmware"
[    0.634141] 0x000000800000-0x000000f90000 : "kernel1"
[    0.640304] 0x000000f90000-0x000000fb0000 : "bs"
[    0.647329] 0x000000fb0000-0x000000ff0000 : "cfg"
[    0.653237] 0x000000ff0000-0x000001000000 : "art"
[    1.478223] ag71xx 19000000.eth: connected to PHY at mdio.0:04 [uid=004dd074, driver=Qualcomm Atheros AR8031/AR8033]
[    1.489681] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    1.496483] i2c /dev entries driver
[    1.501789] NET: Registered protocol family 10
[    1.513339] Segment Routing with IPv6
[    1.517242] NET: Registered protocol family 17
[    1.521971] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.535380] 8021q: 802.1Q VLAN Support v1.8
[    1.540536] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[    1.546863]  MEM 0x0000000012000000..0x0000000013ffffff
[    1.552314]   IO 0x0000000000000000..0x0000000000000000
[    1.557899] PCI host bridge to bus 0000:00
[    1.562145] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    1.569277] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.575030] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    1.582048] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.590275] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[    1.596512] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    1.603581] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    1.610583] pci 0000:00:00.0: supports D1
[    1.614722] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.621486] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    1.628378] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    1.635940] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    1.710188] Freeing unused kernel memory: 11872K
[    1.714966] This architecture does not have kernel memory protection.
[    1.721650] Run /init as init process
[    2.273214] init: Console is alive
[    2.277158] init: - watchdog -
[    2.301216] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.314158] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.332108] init: - preinit -
[    2.610373] random: jshn: uninitialized urandom read (4 bytes read)
[    2.754207] random: jshn: uninitialized urandom read (4 bytes read)
[    2.787638] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.098979] eth0: link up (1000Mbps/Full duplex)
[    6.103793] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    7.121223] eth0: link down
[    7.135505] procd: - early -
[    7.138900] procd: - watchdog -
[    7.751438] procd: - watchdog -
[    7.755061] procd: - ubus -
[    7.766325] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.808062] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.815140] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.825062] procd: - init -
Please press Enter to activate this console.
[    8.489801] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.940829] Loading modules backported from Linux version v5.15.92-0-ge515b9902f5f
[    8.948722] Backport generated by backports.git v5.15.92-1-0-gdfe0f60c
[    9.180309] PPP generic driver version 2.4.2
[    9.188021] NET: Registered protocol family 24
[    9.297946] ieee80211 phy0: Atheros AR9561 Rev:0 mem=0xb8100000, irq=2
[    9.347901] kmodloader: done loading kernel modules from /etc/modules.d/*
[   10.589214] urngd: v1.0.2 started.
[   10.722899] random: jshn: uninitialized urandom read (4 bytes read)
[   11.153048] random: jshn: uninitialized urandom read (4 bytes read)
[   11.243013] random: jshn: uninitialized urandom read (4 bytes read)
[   11.727997] random: jshn: uninitialized urandom read (4 bytes read)
[   12.302981] random: crng init done
[   12.306510] random: 31 urandom warning(s) missed due to ratelimiting
[   31.177973] br-lan: port 1(eth0) entered blocking state
[   31.183378] br-lan: port 1(eth0) entered disabled state
[   31.189107] device eth0 entered promiscuous mode
[   34.259041] eth0: link up (1000Mbps/Full duplex)
[   34.263857] br-lan: port 1(eth0) entered blocking state
[   34.269308] br-lan: port 1(eth0) entered forwarding state
[   34.291981] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready



BusyBox v1.35.0 (2023-11-25 18:18:57 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 22.03.6, r20265-f85a79bcb4
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

The last thing I did was the sysupdate and it got stuck in the same place the next time I booted:

root@OpenWrt:/# **sysupgrade -v /tmp/openwrt-22.03.6-ath79-generic-ubnt_unifiac-lr
-squashfs-sysupgrade.bin**
Cannot save config while running from ramdisk.
Sat Nov 25 18:19:59 UTC 2023 upgrade: Commencing upgrade. Closing all shell sessions.
Watchdog handover: fd=3
- watchdog -
Watchdog did not previously reset the system
Sat Nov 25 18:20:00 UTC 2023 upgrade: Sending TERM to remaining processes ...
Sat Nov 25 18:20:00 UTC 2023 upgrade: Sending signal TERM to ntpd (2092)
Sat Nov 25 18:20:00 UTC 2023 upgrade: Sending signal TERM to ntpd (2095)
Sat Nov 25 18:20:04 UTC 2023 upgrade: Sending KILL to remaining processes ...
[   81.541239] stage2 (2704): drop_caches: 3
Sat Nov 25 18:20:10 UTC 2023 upgrade: Switching to ramdisk...
Sat Nov 25 18:20:12 UTC 2023 upgrade: Performing system upgrade...
[   83.887420] do_stage2 (2704): drop_caches: 3
Unlocking firmware ...

Writing from <stdin> to firmware ...
Appending jffs2 data from /tmp/sysupgrade.tgz to firmware..
.File /tmp/sysupgrade.tgz does not exist
Sat Nov 25 18:20:56 UTC 2023 upgrade: Upgrade completed
Sat Nov 25 18:20:57 UTC 2023 upgrade: Rebooting system...
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
[  128.310551] reboot: Restarting system
▒

U-Boot unifi-v2.0.9.307-gd60f380a (Mar 25 2021 - 15:00:50)

DRAM:
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ff3800, log_magic:0x75755575 kseg: 0xa0000000
Top of RAM usable for U-Boot at: 87ff3000
Reserving 252k for U-Boot at: 87fb0000
Reserving 192k for malloc() at: 87f80000
Reserving 44 Bytes for Board Info at: 87f7ffd4
Reserving 36 Bytes for Global Data at: 87f7ffb0
Reserving 128k for boot params() at: 87f5ffb0
Stack Pointer at: 87f5ff98
Now running in RAM - U-Boot at: 87fb0000
Flash: 16 MB
PCIe WLAN Module found (tries: 1).
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x9fff0000
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
 ath_gmac_enet_initialize: is_s17()=0, is_ar8033()=1, phy id1=4d phy_id2=d074
WAN AR8033 PHY init
athrs_ar8033_reg_init: Done 111
Max resets limit reached exiting...
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: d8:b3:70:b3:8a:ac
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
## Starting application at 0x80200020 ...

mk24 · February 16, 2024, 3:24pm

This looks like the reset circuit is stuck on so it goes to TFTP recovery every time. Is the LED flashing blue-white-off? Or otherwise the uboot environment parameters are wrong.

In other words it never even tries to boot from flash, so it doesn't matter what is stored there.

ThomasHH · February 16, 2024, 7:09pm

Hello,
no, the LED does not light up or flash, it is permanently off. The LED only works when he boots the system from RAM. Then the reset button also works