Fix readonly ubiquiti airmax

[herbetom]

closes #2939

I've installed a firmware build from the branch on a Ubiquiti NanoBeam AC Gen1 (XC).

I'm able to store the /etc/dropbear/authorized_keys file accross reboots.

I haven't validated that the device was actually affected and haven't checked anything else.

dmesg

[    0.000000] Linux version 5.15.139 (tom@buildsrv01.darmstadt.freifunk.net) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23673+8-59fd8f08cf) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Sun Dec 17 17:25:55 2023
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is Ubiquiti NanoBeam AC Gen1 (XC)
[    0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 120956K/131072K available (5658K kernel code, 573K rwdata, 1264K rodata, 1200K init, 211K bss, 10116K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 720.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns
[    0.000001] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns
[    0.008378] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[    0.075041] pid_max: default: 32768 minimum: 301
[    0.080753] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.088547] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.102371] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.112894] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.120182] pinctrl core: initialized pinctrl subsystem
[    0.127540] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.134427] thermal_sys: Registered thermal governor 'step_wise'
[    0.150016] clocksource: Switched to clocksource MIPS
[    0.163154] NET: Registered PF_INET protocol family
[    0.168595] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.177203] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.186185] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.194444] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.202612] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.210140] TCP: Hash tables configured (established 1024 bind 1024)
[    0.217054] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.224080] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.231823] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.237890] PCI: CLS 0 bytes, default 32
[    0.245164] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    0.255829] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.262107] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.273957] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    0.285059] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.292413] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.301726] printk: console [ttyS0] disabled
[    0.306344] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[    0.315589] printk: console [ttyS0] enabled
[    0.324494] printk: bootconsole [early0] disabled
[    0.350136] led_gpio@0 enforce active low on chipselect handle
[    0.368275] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[    0.373613] 5 fixed-partitions partitions found on MTD device spi0.0
[    0.380116] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.386865] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.393875] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.400650] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.407683] Creating 5 MTD partitions on "spi0.0":
[    0.412597] 0x000000000000-0x000000040000 : "u-boot"
[    0.420312] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.426705] 0x000000050000-0x000000fb0000 : "firmware"
[    0.434541] 2 uimage-fw partitions found on MTD device firmware
[    0.440616] Creating 2 MTD partitions on "firmware":
[    0.445653] 0x000000000000-0x000000240000 : "kernel"
[    0.451690] 0x000000240000-0x000000f60000 : "rootfs"
[    0.458935] mtd: setting mtd4 (rootfs) as root device
[    0.464210] 1 squashfs-split partitions found on MTD device rootfs
[    0.470517] 0x0000006b0000-0x000000f60000 : "rootfs_data"
[    0.477716] 0x000000fb0000-0x000000ff0000 : "cfg"
[    0.483609] 0x000000ff0000-0x000001000000 : "art"
[    0.950811] ag71xx 19000000.eth: connected to PHY at mdio.0:04 [uid=004dd074, driver=Qualcomm Atheros AR8031/AR8033]
[    0.962182] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    0.968866] i2c_dev: i2c /dev entries driver
[    0.979871] NET: Registered PF_INET6 protocol family
[    0.989632] Segment Routing with IPv6
[    0.993510] In-situ OAM (IOAM) with IPv6
[    0.997610] NET: Registered PF_PACKET protocol family
[    1.002821] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.016256] 8021q: 802.1Q VLAN Support v1.8
[    1.021839] PCI host bridge to bus 0000:00
[    1.026015] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    1.033046] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.038699] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.046788] pci 0000:00:00.0: [0777:11ac] type 00 class 0x028000
[    1.052932] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    1.059874] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    1.066759] pci 0000:00:00.0: supports D1 D2
[    1.072150] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    1.078899] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    1.086378] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
[    1.104577] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    1.118385] Freeing unused kernel image (initmem) memory: 1200K
[    1.124435] This architecture does not have kernel memory protection.
[    1.130984] Run /sbin/init as init process
[    1.135136]   with arguments:
[    1.135141]     /sbin/init
[    1.135146]   with environment:
[    1.135150]     HOME=/
[    1.135155]     TERM=linux
[    1.881448] init: Console is alive
[    1.885389] init: - watchdog -
[    3.663435] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.766527] usbcore: registered new interface driver usbfs
[    3.772278] usbcore: registered new interface driver hub
[    3.777756] usbcore: registered new device driver usb
[    3.798195] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    3.807094] fsl-ehci: Freescale EHCI Host controller driver
[    3.814547] ehci-platform: EHCI generic platform driver
[    3.823446] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.841319] init: - preinit -
[    5.411477] random: jshn: uninitialized urandom read (4 bytes read)
[    5.900223] random: jshn: uninitialized urandom read (4 bytes read)
[    6.007088] random: jshn: uninitialized urandom read (4 bytes read)
[    8.654757] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    8.672689] urandom-seed: Seed file not found (/etc/urandom.seed)
[    8.886127] procd: - early -
[    8.889374] procd: - watchdog -
[    9.528985] procd: - watchdog -
[    9.537374] procd: - ubus -
[    9.622458] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.631284] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.638303] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.661649] procd: - init -
[   10.404123] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.660999] tun: Universal TUN/TAP device driver, 1.6
[   10.677293] l2tp_core: L2TP core driver, V2.0
[   10.684361] l2tp_netlink: L2TP netlink interface
[   10.692154] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[   10.787383] GACT probability on
[   10.792830] Mirror/redirect action on
[   10.810774] u32 classifier
[   10.813547]     input device check on
[   10.817257]     Actions configured
[   10.858157] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b
[   10.865811] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36
[   11.131430] usbcore: registered new interface driver usbserial_generic
[   11.138134] usbserial: USB Serial support registered for generic
[   11.188809] xt_time: kernel timezone is -0000
[   11.544403] usbcore: registered new interface driver ch341
[   11.550142] usbserial: USB Serial support registered for ch341-uart
[   11.596175] usbcore: registered new interface driver cp210x
[   11.601966] usbserial: USB Serial support registered for cp210x
[   11.655971] usbcore: registered new interface driver ftdi_sio
[   11.661932] usbserial: USB Serial support registered for FTDI USB Serial Device
[   11.884010] usbcore: registered new interface driver pl2303
[   11.889744] usbserial: USB Serial support registered for pl2303
[   11.944555] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[   11.951139] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   13.169197] ath10k_pci 0000:00:00.0: qca988x hw2.0 ubiquiti target 0x4100016c chip_id 0x043222ff sub 0777:e4f5
[   13.179424] ath10k_pci 0000:00:00.0: kconfig debug 1 debugfs 1 tracing 0 dfs 1 testmode 0
[   13.192295] ath10k_pci 0000:00:00.0: firmware ver 10.2.4-1.0-00047 api 5 features no-p2p,raw-mode,mfp,allows-mesh-bcast crc32 35bd9258
[   14.094868] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[   15.320255] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 5 htt-op 2 cal file max-sta 128 raw 0 hwcrypto 1
[   15.464186] ath: EEPROM regdomain: 0x0
[   15.464210] ath: EEPROM indicates default country code should be used
[   15.464215] ath: doing EEPROM country->regdmn map search
[   15.464230] ath: country maps to regdmn code: 0x3a
[   15.464237] ath: Country alpha2 being used: US
[   15.464244] ath: Regpair used: 0x3a
[   15.540237] batman_adv: B.A.T.M.A.N. advanced 2023.1-openwrt-4 (compatibility version 15) loaded
[   15.580601] kmodloader: done loading kernel modules from /etc/modules.d/*
[   16.846603] random: jshn: uninitialized urandom read (4 bytes read)
[   17.004463] random: jshn: uninitialized urandom read (4 bytes read)
[   17.112203] random: jshn: uninitialized urandom read (4 bytes read)
[   18.336193] random: dd: uninitialized urandom read (1 bytes read)
[   30.530170] ath: EEPROM regdomain: 0x8114
[   30.530198] ath: EEPROM indicates we should expect a country code
[   30.530205] ath: doing EEPROM country->regdmn map search
[   30.530211] ath: country maps to regdmn code: 0x37
[   30.530218] ath: Country alpha2 being used: DE
[   30.530225] ath: Regpair used: 0x37
[   30.530231] ath: regdomain 0x8114 dynamically updated by user
[   32.447184] urngd: v1.0.2 started.
[   34.954763] random: crng init done
[   34.958238] random: 115 urandom warning(s) missed due to ratelimiting
[   40.840656] br-setup: port 1(eth0) entered blocking state
[   40.846159] br-setup: port 1(eth0) entered disabled state
[   40.851957] device eth0 entered promiscuous mode
[   44.981483] eth0: link up (1000Mbps/Full duplex)
[   44.986225] br-setup: port 1(eth0) entered blocking state
[   44.991741] br-setup: port 1(eth0) entered forwarding state
[   45.040094] IPv6: ADDRCONF(NETDEV_CHANGE): br-setup: link becomes ready
[   76.462824] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   76.469852] jffs2_build_filesystem(): unlocking the mtd device... 
[   76.469877] done.
[   76.478139] jffs2_build_filesystem(): erasing all blocks after the end marker... 
[  117.833919] done.
[  117.843514] jffs2: notice: (1913) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  118.198817] overlayfs: upper fs does not support tmpfile.

[blocktrron]

At the OpenWrt developer meetup, we've talked about this patch and while it doesn't matter for this backport, the patch should be replaced by a more selective patch based on DT-properties, as this approach might break future devices if upstream deprecates the unlock-all Kconfig symbol.

[herbetom]

A quick test seems promising (see updated initial post). I'm not too keen to brick (and attempt to restore the device). What tests do we want to do before readding them? I'll take the device home and can to those then.

[herbetom]

it appears as if those devices haven't been marked as outdoor devices. I will have to look into that.

ah, okay #3070 / d6dd629

[blocktrron]

@herbetom Please try with this patch and add the property to the node of the nor flash:

From 5c8bbd7b7f8881a6f22ebcef7ce57655ab8ec603 Mon Sep 17 00:00:00 2001
From: David Bauer <mail@david-bauer.net>
Date: Thu, 4 Jan 2024 12:56:10 +0100
Subject: [PATCH] mtd: spi-nor: add property to unlock entire chip

Add a new device-tree porperty "swp-disable" which can be added to
spi-nor OF-nodes to indicate the whole flash-chip should be unlocked.

This avoids changing the default behavior of all SPI-NOR chips and helps
to indicate devices which require the old kernel behavior explicitly.

Signed-off-by: David Bauer <mail@david-bauer.net>
---
 ...r-add-property-to-unlock-entire-chip.patch |  9 ++---
 ...r-add-property-to-unlock-entire-chip.patch | 35 +++++++++++++++++++
 2 files changed, 37 insertions(+), 7 deletions(-)
 create mode 100644 target/linux/generic/hack-6.1/400-mtd-spi-nor-add-property-to-unlock-entire-chip.patch

diff --git a/target/linux/generic/hack-5.15/400-mtd-spi-nor-add-property-to-unlock-entire-chip.patch b/target/linux/generic/hack-5.15/400-mtd-spi-nor-add-property-to-unlock-entire-chip.patch
index 9ea757ad8a..c8eb9122e6 100644
--- a/target/linux/generic/hack-5.15/400-mtd-spi-nor-add-property-to-unlock-entire-chip.patch
+++ b/target/linux/generic/hack-5.15/400-mtd-spi-nor-add-property-to-unlock-entire-chip.patch
@@ -14,11 +14,9 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  drivers/mtd/spi-nor/core.c | 3 +++
  1 file changed, 3 insertions(+)
 
-diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
-index eb5d7b3d1860..9ec21461b058 100644
 --- a/drivers/mtd/spi-nor/core.c
 +++ b/drivers/mtd/spi-nor/core.c
-@@ -2799,6 +2799,7 @@ static int spi_nor_quad_enable(struct spi_nor *nor)
+@@ -2820,6 +2820,7 @@ static int spi_nor_quad_enable(struct sp
  
  static int spi_nor_init(struct spi_nor *nor)
  {
@@ -26,7 +24,7 @@ index eb5d7b3d1860..9ec21461b058 100644
  	int err;
  
  	err = spi_nor_octal_dtr_enable(nor, true);
-@@ -2824,6 +2825,8 @@ static int spi_nor_init(struct spi_nor *nor)
+@@ -2845,6 +2846,8 @@ static int spi_nor_init(struct spi_nor *
  	 * SNOR_F_SWP_IS_VOLATILE.
  	 */
  	if (IS_ENABLED(CONFIG_MTD_SPI_NOR_SWP_DISABLE) ||
@@ -35,6 +33,3 @@ index eb5d7b3d1860..9ec21461b058 100644
  	    (IS_ENABLED(CONFIG_MTD_SPI_NOR_SWP_DISABLE_ON_VOLATILE) &&
  	     nor->flags & SNOR_F_SWP_IS_VOLATILE))
  		spi_nor_try_unlock_all(nor);
--- 
-2.39.2
-
diff --git a/target/linux/generic/hack-6.1/400-mtd-spi-nor-add-property-to-unlock-entire-chip.patch b/target/linux/generic/hack-6.1/400-mtd-spi-nor-add-property-to-unlock-entire-chip.patch
new file mode 100644
index 0000000000..c8eb9122e6
--- /dev/null
+++ b/target/linux/generic/hack-6.1/400-mtd-spi-nor-add-property-to-unlock-entire-chip.patch
@@ -0,0 +1,35 @@
+From 228fcb0738a9e582a15666e717bb2fc5078c694c Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Thu, 4 Jan 2024 12:44:06 +0100
+Subject: [PATCH] mtd: spi-nor: add property to unlock entire chip
+
+Add a new device-tree porperty "swp-disable" which can be added to
+spi-nor OF-nodes to indicate the whole flash-chip should be unlocked.
+
+This avoids changing the default behavior of all SPI-NOR chips and helps
+to indicate devices which require the old kernel behavior explicitly.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/mtd/spi-nor/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/mtd/spi-nor/core.c
++++ b/drivers/mtd/spi-nor/core.c
+@@ -2820,6 +2820,7 @@ static int spi_nor_quad_enable(struct sp
+ 
+ static int spi_nor_init(struct spi_nor *nor)
+ {
++	struct of_node *np = spi_nor_get_flash_node(nor);
+ 	int err;
+ 
+ 	err = spi_nor_octal_dtr_enable(nor, true);
+@@ -2845,6 +2846,8 @@ static int spi_nor_init(struct spi_nor *
+ 	 * SNOR_F_SWP_IS_VOLATILE.
+ 	 */
+ 	if (IS_ENABLED(CONFIG_MTD_SPI_NOR_SWP_DISABLE) ||
++		of_property_read_bool(nor->dev->of_node,
++				      "swp-disable") ||
+ 	    (IS_ENABLED(CONFIG_MTD_SPI_NOR_SWP_DISABLE_ON_VOLATILE) &&
+ 	     nor->flags & SNOR_F_SWP_IS_VOLATILE))
+ 		spi_nor_try_unlock_all(nor);
-- 
2.39.2

[blocktrron]

Okay, My patch was not the best. Please apply the patches from my staging tree and see if this fixes the WP. Also remember to revert the kernel configuration update which enabled this behavior target-wide.

[herbetom]

I've tried it and the device didn't came back up. Don't know what's gone wrong. A Power Cycle didn't change anything.
Will have to look into how recovery could work.

[blocktrron]

Tried on a TL-WR842N v3 with and without the DT property. So the patch itself seems fine.

[herbetom]

The current state seems to work regarding resolvig the read only problem.

Hoewer, in my tests with an Ubiquiti NanoBeam AC Gen1 (XC) i've had the problem that the device became unresponsive after some upgrades (Ethernet up, but no response).

The "solution" was to power it down for an extended period of time. (A few days, haven't attempted to narrow it down. Just unpluging it for a few seconds didn't seem to help.)

I'm not eaxtly sure what triggers it, but larger upgrades (upgrading from OpenWrt v2023.1.x) seems like something that should be tested a bit more.

[herbetom]

I've rebased this onto #3184

[rotanid]

@herbetom needs an update or rebase, doesn't it?