FortiAP U433F boot loop

[Spidler]

Hey folks,

Any idea about this one? u433F is stuck in a boot loop. I might be able to fix it if I could get into the uboot - hard to do without the password. Here's the console dump of the boot:

BTRM V1.6 CPU0 L1CD MMUI MMU7 DATA ZBBS MAIN OTP? OTPP USBT NAND IMG? IMGL UHD? UHDP RLO? RLOP UBI? UBIF IMG? IMGL UHD? UHDP RLO? RLOP UBI? UBIP PASS ---- HELO 5.0205HNDrc05-1.0.38-163.157 CPU0 L1CD MMUI MMUA CODE ZBBS MAIN Boot Strap Register: 0x6fc4b NVRAM memcfg 0x41527 MCB chksum 0xa2becbd7, config 0x41527

MemsysInit lpf0_generic_aarch64 1.3.0.1 20150910 DDR3 900015A0 80018000 8001A000 00000000 00000000 0070371A MCB rev=0x00040301 Ref ID=0x0371A Sub Bld=0x007 Dram Timing 11-11-11

DDR3-1600 CL11 total 1024MB 2 16bits part %1 SSC

Add/Ctl Alignment no adjustment

ZQ Cal LP PHY R in Ohm P: Finger=0x2D0 Term=0x78 Drv=0x2A N: Finger=0x2D0 Term=0x78 Drv=0x2D

PLL Ref(Hz)=0x02FAF080 UI STEPS=0x03A DDR CLK(MHz)=0x31B WL CLK dly(ps)=0x0C8 bitT(ps)=0x274 VDLsize(fs)=0x2A4B CLK_VDL=0x01A

SHMOO 28nm 8001A000 80018800 00000000 00020000 00000001

Shmoo WL

One UI Steps : 0x45

auto-clk result = 00B (filter=0C steps) initial CLK shift = 01A final CLK shift = 00B

000000000011111111112222222222333333333344444444445555555555666666666 012345678901234567890123456789012345678901234567890123456789012345678 00 S------------------------X+++++++++++++++++++++++++++++++++++++++++++ 01 S----------------------------X+++++++++++++++++++++++++++++++++++++++ 02 S-------------------------------------------X++++++++++++++++++++++++ 03 S-------------------------------------------X++++++++++++++++++++++++

Shmoo RD En FORCED WR ODT = 0x18001800 DQSN DRIVE PAD CONTROL (from) (to) B0 00031A30 00079A30 B1 00031A30 00079A30 B2 00031A30 00079A30 B3 00031A30 00079A30 B0 RISE UI=1 VDL=21 PICK UI=2 VDL=21 B1 RISE UI=1 VDL=13 PICK UI=2 VDL=13 B2 RISE UI=1 VDL=17 PICK UI=2 VDL=17 B3 RISE UI=1 VDL=11 PICK UI=2 VDL=11 000000000011111111112222222222333333333344444444445555555555666666666 012345678901234567890123456789012345678901234567890123456789012345678 00 --S--------------------------++++X+++++++++++++++++++++++++++++++++++ 01 --S----------------X+++++++++++++++++++++++++++++++++++++++++++++++++ 02 --S--------------------X+++++++++++++++++++++++++++++++++++++++++++++ 03 --S--------------X+++++++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD DQ NP DQS : B0 VDL=3A ok B1 VDL=3B ok B2 VDL=3A ok B3 VDL=3A ok 000000000011111111112222222222333333333344444444445555555555666666666 012345678901234567890123456789012345678901234567890123456789012345678 00 ------++++++++++++++++++++++X+++++++++++++++++++++++----------------- 01 -----++++++++++++++++++++++X+++++++++++++++++++++++------------------ 02 ---------++++++++++++++++++++++X++++++++++++++++++++++--------------- 03 --------++++++++++++++++++++++X+++++++++++++++++++++++--------------- 04 ----------+++++++++++++++++++++++X++++++++++++++++++++++++----------- 05 -------+++++++++++++++++++++++X+++++++++++++++++++++++--------------- 06 ----------++++++++++++++++++++++X+++++++++++++++++++++++------------- 07 ---------+++++++++++++++++++++++X+++++++++++++++++++++++------------- 08 ------+++++++++++++++++++++++X+++++++++++++++++++++++---------------- 09 ---------++++++++++++++++++++++X+++++++++++++++++++++++-------------- 10 -----++++++++++++++++++++++X++++++++++++++++++++++------------------- 11 --------+++++++++++++++++++++++X+++++++++++++++++++++++-------------- 12 ------++++++++++++++++++++X++++++++++++++++++++---------------------- 13 ---------++++++++++++++++++++++X+++++++++++++++++++++++-------------- 14 -++++++++++++++++++++++X+++++++++++++++++++++++---------------------- 15 -----++++++++++++++++++++++X++++++++++++++++++++++------------------- 16 -------+++++++++++++++++++++X++++++++++++++++++++++------------------ 17 ------+++++++++++++++++++++X++++++++++++++++++++++------------------- 18 ----------++++++++++++++++++++++X++++++++++++++++++++++-------------- 19 ----------+++++++++++++++++++++X++++++++++++++++++++++--------------- 20 ---++++++++++++++++++++++X++++++++++++++++++++++--------------------- 21 ------+++++++++++++++++++++X++++++++++++++++++++++------------------- 22 ---++++++++++++++++++++++X++++++++++++++++++++++--------------------- 23 --------++++++++++++++++++++++X+++++++++++++++++++++++------------- pmc_init:PMC using DQM mode pmc_patch_4908:7 0 ffaa0437 34a0344 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host/tftp (f/h/c) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Boot image (0=latest, 1=previous) : 0 Default host ramdisk file name : Default ramdisk store address : Board Id (0-17) : 949408EAP_54991 Number of MAC Addresses (1-32) : 10 Base MAC Address : 00:0c:e6:86:3b:e0 PSI Size (1-128) KBytes : 128 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 flow memory allocation (MB) : 43 buffer memory allocation (MB) : 16 DHD 0 memory allocation (MB) : 0 DHD 1 memory allocation (MB) : 0 DHD 2 memory allocation (MB) : 0 Partition 1 Size (MB) : 0 Partition 2 Size (MB) : 0 Partition 3 Size (MB) : 0 Partition 4 Size (MB) (Data) : 4MB

Net: Registering Ethernet Driver..... Broadcom BCM 4908 Ethernet driver 0.1 pmc_switch_power_up: Rgmii Tx clock zone1 enable 0 zone2 enable 0. Setting SGMII Calibration value to 0x8

Detecting PHYs...

Loading firmware into detected phys... Firmware version: Blackfin B0 v01-00-02-2018-07-20 Loading firmware into phys: map=0x80000000 Turn on broadcast mode to accept write operations Halt the phys processors operation Upload the firmware into the on-chip memory 100% Reset the processors to start execution of the code in the on-chip memory Verify that the processors are running: OK Verify that the firmware has been loaded with good CRC: OK Firmware loading completed successfully

Unsupported MII type: 0 bcm4908_eth-0 MAC: 00:0c:e6:86:3b:e0

------------------------------- FortiAP-PU433F (Oct 22 2020 - 00:53:46) Ver:00000003

Serial Number:PU433F5E19001649 Region Code:A ------------------------------- Hit CTRL+c to abort u-boot in 3 seco 0 Uncompressing IMAGE ... DONE Decompression LZMA Image OK! /memory = 0x40000000 bytes @ 0x0 WARNING: Node's property /reserved-memory/dt_reserved_buffer is not defined WARNING: Node's property /reserved-memory/dt_reserved_flow is not defined

Starting kernel ...

Booting Linux on physical CPU 0x0 Linux version 4.1.52 (root@jenkins-3700D-2) (gcc version 5.5.0 (Buildroot 2017.11.1) ) #1 SMP PREEMPT Tue Apr 20 18:27:24 UTC 2021 CPU: AArch64 Processor [420f1000] revision 0 Detected VIPT I-cache on CPU0 alternatives: enabling workaround for ARM erratum 845719 PERCPU: Embedded 16 pages/cpu @ffffffc03ffae000 s25240 r8192 d32104 u65536 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 255488 Kernel command line: coherent_pool=4M cpuidle_sysfs_switch pci=pcie_bus_safe rootwait log_buf_len individual max cpu contribution: 4096 bytes log_buf_len total cpu_extra contributions: 12288 bytes log_buf_len min size: 16384 bytes log_buf_len: 32768 bytes early log buf free: 15200(92%) PID hash table entries: 4096 (order: 3, 32768 bytes) Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes) Inode-cache hash table entries: 65536 (order: 7, 524288 bytes) Memory: 976308K/1036288K available (5259K kernel code, 1852K rwdata, 1916K rodata, 240K init, 1508K bss, 59980K reserved, 0K cma-reserved) Virtual kernel memory layout: vmalloc : 0xffffff8000000000 - 0xffffffbdffff0000 ( 247 GB) vmemmap : 0xffffffbe00000000 - 0xffffffbfc0000000 ( 7 GB maximum) 0xffffffbe00000000 - 0xffffffbe00e00000 ( 14 MB actual) fixed : 0xffffffbffabfd000 - 0xffffffbffac00000 ( 12 KB) PCI I/O : 0xffffffbffae00000 - 0xffffffbffbe00000 ( 16 MB) modules : 0xffffffbffc000000 - 0xffffffc000000000 ( 64 MB) memory : 0xffffffc000000000 - 0xffffffc040000000 ( 1024 MB) .init : 0xffffffc000783000 - 0xffffffc0007bf000 ( 240 KB) .text : 0xffffffc000080000 - 0xffffffc0007825a4 ( 7178 KB) .data : 0xffffffc0007c0000 - 0xffffffc00098f040 ( 1853 KB) Preemptible hierarchical RCU implementation. NR_IRQS:64 nr_irqs:64 0 Architected cp15 timer(s) running at 50.00MHz (phys). clocksource arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb8812736b, max_idle_ns: 440795202655 ns sched_clock: 56 bits at 50MHz, resolution 20ns, wraps every 4398046511100ns BRCM Legacy Drivers' Helper, all legacy drivers' IO memories/interrupts should be remapped here Remapping interrupts... hwirq virq 61 5 64 6 66 7 77 8 78 9 79 10 80 11 81 12 82 13 83 14 84 15 85 16 86 17 88 18 96 19 97 20 98 21 99 22 118 23 119 24 106 25 104 26 105 27 76 28 120 29 110 30 148 31 154 32 155 33 156 34 157 35 158 36 159 37 69 38 Remapping IO memories... phys virt size 00000000ff800000 ffffff8000008000 00003000 00000000ff858000 ffffff800000c000 00003000 00000000ffe00000 ffffff8000080000 00100000 0000000080002000 ffffff8000002000 00001000 0000000080018000 ffffff8000010000 00004000 0000000080200000 ffffff8000018000 00005000 0000000080280000 ffffff8000016000 00001000 0000000082200000 ffffff8000200000 00100000 0000000080080000 ffffff8000380000 00050000 0000000080008000 ffffff8000020000 00003fff 000000008000c000 ffffff8000028000 00003fff 0000000081060000 ffffff8000030000 00004000 0000000080100000 ffffff8000038000 00002000 0000000080010000 ffffff800001e000 00001000 console [ttyS0] enabled Calibrating delay loop (skipped), value calculated using timer frequency.. 100.00 BogoMIPS (lpj=50000) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 2048 (order: 2, 16384 bytes) Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes) --Kernel Config-- SMP=1 PREEMPT=1 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 Do not need to create mapping for reserved memory phys 0x0000000006000000 virt 0xffffffc006000000 size 0x02000000 for rdp1 creating mapping for reserved memory phys 0x0000000005400000 virt 0xffffffc005400000 size 0x00c00000 for rdp2 pmc_init:PMC using DQM mode Successfully retrieved NVRAM data from dtb Failed to retrieve boot CFE version from dtb! CPU1: Booted secondary processor Detected VIPT I-cache on CPU1 CPU2: Booted secondary processor Detected VIPT I-cache on CPU2 CPU3: Booted secondary processor Detected VIPT I-cache on CPU3 Brought up 4 CPUs SMP: Total of 4 processors activated. CPU: All CPU(s) started at EL2 alternatives: patching kernel code devtmpfs: initialized clocksource jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns futex hash table entries: 1024 (order: 4, 65536 bytes) NET: Registered protocol family 16 cpuidle: using governor ladder cpuidle: using governor menu vdso: 2 pages (1 code @ ffffffc0007c5000, 1 data @ ffffffc0007c4000) DMA: preallocated 4096 KiB pool for atomic allocations Broadcom Logger v0.1 ACPI: Interpreter disabled. SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb skb_free_task created successfully with start budget 256 BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v1.0 initialized Broadcom GBPM v0.1 initialized Switched to clocksource arch_sys_counter pnp: PnP ACPI: disabled NET: Registered protocol family 2 TCP established hash table entries: 8192 (order: 4, 65536 bytes) TCP bind hash table entries: 8192 (order: 5, 131072 bytes) TCP: Hash tables configured (established 8192 bind 8192) UDP hash table entries: 512 (order: 2, 16384 bytes) UDP-Lite hash table entries: 512 (order: 2, 16384 bytes) NET: Registered protocol family 1 Starting AP Rttrace Driver squashfs: version 4.0 (2009/01/31) Phillip Lougher jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. fuse init (API version 7.23) io scheduler noop registered (default) brd: module loaded loop: module loaded nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xdc nand: Micron MT29F4G08ABAEAWP nand: 512 MiB, SLC, erase size: 256 KiB, page size: 4096, OOB size: 224 bcm63xx_nand ff801800.nand: Adjust timing_1 to 0x65324458 timing_2 to 0x80040e54 bcm63xx_nand ff801800.nand: detected 512MiB total, 256KiB blocks, 4KiB pages, 27B OOB, 8-bit, BCH-8 Bad block table found at page 131008, version 0x01 Bad block table found at page 130944, version 0x01 rootfs_ofs=0x00021000, part1ofs=0x00001000, part2ofs=0x00021000 >>>>> For primary mtd partition rootfs, cferam/vmlinux.lz mounted as JFFS2, vmlinux fs mounted as UBIFS <<<<< Secondary mtd partition rootfs_update detected as JFFS2 for cferam/vmlinux source and UBIFS for vmlinux filesystem Part[0] name=rootfs, size=3840000, ofs=8bc0000 Part[1] name=rootfs_update, size=3880000, ofs=b80000 Part[2] name=data, size=ffc0000, ofs=c400000 Part[3] name=nvram, size=100000, ofs=0 Part[6] name=bootflags, size=140000, ofs=c0000 Part[7] name=crashlog, size=40000, ofs=1c3c0000 Part[8] name=biosinfo, size=80000, ofs=80000 Creating 11 MTD partitions on "brcmnand.0": 0x000008bc0000-0x00000c400000 : "rootfs" 0x000000b80000-0x000004400000 : "rootfs_update" 0x00000c400000-0x00001c3c0000 : "data" 0x000000000000-0x000000100000 : "nvram" 0x000000400000-0x000004400000 : "image_update" 0x000008400000-0x00000c400000 : "image" 0x0000000c0000-0x000000200000 : "bootflags" 0x00001c3c0000-0x00001c400000 : "crashlog" 0x000000080000-0x000000100000 : "biosinfo" 0x000008400000-0x000008b80000 : "bootfs" 0x000000400000-0x000000b40000 : "bootfs_update" bcm63xx-hsspi ff801000.spi: transfer timed out! m25p80 spi1.0: error -110 reading 9f m25p80: probe of spi1.0 failed with error -2 tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> PPP generic driver version 2.4.2 PPP BSD Compression module registered PPP Deflate Compression module registered NET: Registered protocol family 24 i2c /dev entries driver bcm96xxx-wdt ff800428.watchdog: Broadcom BCM96xxx watchdog timer brcmboard registered brcmboard: brcm_board_init entry print_rst_status: Last RESET due to HW reset print_rst_status: RESET reason: 0x00000000 DYING GASP IRQ Initialized and Enabled SES: LED GPIO 0x400c is enabled map_hw_timer_interrupt,130: interrupt_id 19 map_hw_timer_interrupt,130: interrupt_id 20 map_hw_timer_interrupt,130: interrupt_id 21 map_hw_timer_interrupt,130: interrupt_id 22 Serial: BCM63XX driver $Revision: 3.00 $ ttyS0 at MMIO 0xff800640 (irq = 6, base_baud = 921600) is a BCM63XX i2c-bcm63000 ff802100.i2c: Broadcom BCM96xxx I2C driver

Optical detection module loaded. BPM: tot_mem_size=1073741824B (1024MB), buf_mem_size <15%> =161061270B (153MB), num of buffers=57195, buf size=2816 Broadcom BPM Module Char Driver v0.1 Registered<304> [NTC bpm] bpm_module_init: tot_mem_pool=2487 mem_idx:2487 GACT probability NOT on Mirror/redirect action on u32 classifier input device check on Actions configured Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (7627 buckets, 30508 max) /proc/net/netfilter/nf_dyndscp_w2ldscp_transtbl created xt_time: kernel timezone is -0000 ip_tables: (C) 2000-2006 Netfilter Core Team Initializing XFRM netlink socket NET: Registered protocol family 10 ip6_tables: (C) 2000-2006 Netfilter Core Team sit: IPv6 over IPv4 tunneling driver ip6_gre: GRE over IPv6 tunneling driver NET: Registered protocol family 17 NET: Registered protocol family 15 bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this. Bridge firewalling registered L2TP core: blog_l2tp_rcv_check l2tp_core: L2TP core driver, V2.0 l2tp_ppp: PPPoL2TP kernel driver, V2.0 8021q: 802.1Q VLAN Support v1.8 ubi0: attaching mtd0 ubi0: scanning is finished ubi0: attached mtd0 (name "rootfs", size 56 MiB) ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096 ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192 ubi0: good PEBs: 225, bad PEBs: 0, corrupted PEBs: 0 ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128 ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1899548714 ubi0: available PEBs: 0, total reserved PEBs: 225, PEBs reserved for bad PEB handling: 5 ubi0: background thread "ubi_bgt0d" started, PID 410 UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "rootfs_ubifs", R/O mode UBIFS (ubi0:0): LEB size: 253952 bytes (248 KiB), min./max. I/O unit sizes: 4096 bytes/4096 bytes UBIFS (ubi0:0): FS size: 52314112 bytes (49 MiB, 206 LEBs), journal size 9404416 bytes (8 MiB, 38 LEBs) UBIFS (ubi0:0): reserved for root: 0 bytes (0 KiB) UBIFS (ubi0:0): media format: w4/r0 (latest is w4/r0), UUID 0F805064-BF6D-44E4-9851-E44F38AD1298, small LPT model VFS: Mounted root (ubifs filesystem) readonly on device 0:12. devtmpfs: mounted Freeing unused kernel memory: 240K jffs2: notice: (430) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. jffs2: notice: (485) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. wlcsm: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint Initializing WLCSM Module WLCSM Module loaded successfully BCMLIBS loaded... FPM will initialize 2 pool with token size set to 256B. This requires 32MB bcm-fpm: FPM with 2 pool(s) Broadcom 802.1Q VLAN Interface, v0.1 bm_base_addr 0xffffffc006000000, size 33554432, bm_base_addr_phys 0x0000000006000000 fm_base_addr 0xffffffc005400000, size 12582912, fm_base_addr_phys 0x0000000005400000 RDP Physical address=0x82200000 Virtual address = 0xffffff8000c00000 configure_runner: NATC keysize 0x100070 key element size 16 contextsize 0x400000 context element size 64 rdd_init_params.runner_nat_cache_key_ptr=0xffffffc005d00000 rdd_init_params.runner_nat_cache_context_ptr=0xffffffc005400000 rdd_init_params.runner_context_cont_ptr=0xffffffc005800000 FPM_BPM phy_addr 0x82c30000,virt_addr 0xffffff800087e000

RDP PKT memory = 32MB : Max Possible Bufs <16384> of size <2048>; Allocating <15360> bufs; RDP enum <5> brcmchipinfo: brcm_chipinfo_init entry Broadcom Ingress QoS Module Char Driver v1.0 Registered<303>

Broadcom Ingress QoS v1.0 initialized Broadcom Packet Flow Cache FCACHE_CONFIG_MAX_FLOW_ENTRIES<16384> FCACHE_CONFIG_MAX_FDB_ENTRIES<1024> FCACHE_CONFIG_MAX_HOST_DEV_ENTRIES<64> FCACHE_CONFIG_MAX_HOST_MAC_ENTRIES<32> npe_max_entries<32768> Bind blog_notify_evt_enqueue_fn[<ffffffbffc485870>] fc_evt task created successfully max_ent = 16384 intvl_msec = 10000 num_slices = 2000 num_ent = 9 period_msec = 5 NBUFF v1.0 Initialized Total # of labels = 68 Initialized fcache state Pkt HW acceleration is disabled/unavailable. Broadcom Packet Flow Cache Char Driver v4.0 Registered<302> fc_timer_task created successfully Pkt HW acceleration is disabled/unavailable. Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain WARNING: Flow Cache not bound to Blog [FHW] pktDbgLvl[0xffffffbffc49dbc8]=0 [FHW] fhw_construct: Initialized Fcache HW accelerator layer state flwStatsThread created. numFlwsPerPoll 546 maxFlwIdx 16383 Fcache Pathstats created Constructed Broadcom Packet Flow Cache v4.0 Broadcom Command List Driver v1.0 crossbar[0]: Allocated cb_idx=0 int_ep=0 crossbar[0]: Add cb_idx=0 ext_ep=0 SERDES:6 crossbar Mux: connect cb_idx:0 int_ep 0 to ext_ep 0 crossbar Mux: connect cb_idx:0 int_ep 1 to ext_ep 2

Detecting PHYs... Lift PHY at address 31 out of Reset by GPIO:31 Active Low 54991E B0 3590:5099 --> 0x1f

Loading firmware into detected PHYs...

Firmware version: Blackfin B0 v01-00-14-2019-08-08 Loading firmware into PHYs: map=0x80000000 count=1 Halt the PHYs processors operation Upload the firmware into the on-chip memory 100% Reset the processors to start execution of the code in the on-chip memory Verify that the processors are running: OK Verify that the firmware has been loaded with good CRC: OK Firmware loading completed successfully

Adjusted SF2 QGPHY: qphy_ctrl=0x0010800e ext_pwr_down=0x7 Adjusted SF2 SGPHY: sphy_ctrl=0x00010c1b NOTE: Using Port Grouping for IMP ports : [ 3, 7 --> 8 ] LAG/Trunking enabled <0x08> BCMENET: Enabling Software GSO for eth2 getrcal for res select 5, int 667, ext 655, ratio 125 ratio1 140, rcal 8 Setting SGMII Calibration value to 0x8 PLL_PON(8051): 0x0210; TX_PON(8067): 0x0040; RX_PON(80b2): 0x0880 BCMENET: Enabling Software GSO for eth1 eth2: Down <00:0C:E6:86:3B:E0> <ExtSw P3, Logical 11> PHY_ID <0x0007f00b:0x0b: On-chip 1G GPHY> Cfg: ANG.1G; Down eth1: Down <00:0C:E6:86:3B:E0> <ExtSw P7, Logical 15> Chip Port 9, CrossBar Port 0, PHY_ID <0x06100006:0x06: On-chip 2.5G SERDES> Cfg: ANG.2.5G; Down PHY_ID <0x0388001f:0x1f:External Cascaded 10G EXT3> Cfg: ANG.2.5G; Down ===> Activate Deep Green Mode bcmswlpbk0 (Ext switch port: 8) (Logical Port: 8) Virtual link DOWN dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered bcm_enet_init:L2385 ENET system contructed and configured enet-kthrd thread enet_kthread_handler:L298 Instantiating ENET thread [NTC bitpool] idx_pool_init: 551:PktRnr[0]:Create Index Pool_Size = 16512 [NTC bitpool] idx_pool_init: 551:L2L3-ucast:Create Index Pool_Size = 16384 Initialized Runner Host Layer Initialized Runner Unicast Layer Initialized Runner L2 Unicast Layer [NTC bitpool] idx_pool_init: 551:FHW[0]:Create Index Pool_Size = 16512 Retrieve num_fhw_path=64 Pathstats allocated 2048 bytes Broadcom Packet Flow Cache HW acceleration enabled. Enabled Runner binding to Flow Cache Initialized Runner Protocol Layer (800) Broadcom Runner Blog Driver Char Driver v0.1 Registered <309> Broadcom EAP Forwarder v0.1 is loaded ++++ Powering up SATA block writing PORT0_SATA3_PCB_BLOCK_ADDR INFO: PLL lock for port0 detected 9100... ahci ahci.0: SSS flag set, parallel bus scan disabled ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 6 Gbps 0x1 impl platform mode ahci ahci.0: flags: 64bit ncq sntf stag clo pmp slum part scsi host0: ahci ata1: SATA max UDMA/133 mmio [mem 0x8000a000-0x8000bfff] port 0x100 irq 28 ata1: SATA link down (SStatus 0 SControl 300) PCIe HCD (impl1) bcm963xx-pcie: [0] DT node available: /pcie@80040000 bcm963xx-pcie: found port [0] GEN2 Core Rev [3.04] with 2 Lanes getrcal for res select 5, int 667, ext 655, ratio 125 ratio1 140, rcal 8 bcm963xx-pcie: Core [0] setting resistor calibration value to 0x8 bcm963xx-pcie: core [0] Link UP - [2] lanes, [GEN2] speed bcm963xx-pcie 80040000.pcie: PCI host bridge to bus 0000:00 pci_bus 0000:00: root bus resource [mem 0xc0000000-0xcfffffff] pci_bus 0000:00: root bus resource [bus 00-ff] bcm963xx-pcie: Core [0] Enabled PCIE/UBUS Error Interrupts bcm963xx-pcie: Core [0] UBUS Intr [UBUS_LINKUP] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring pci 0000:00:00.0: BAR 8: assigned [mem 0xc0000000-0xc0bfffff] pci 0000:00:00.0: BAR 9: assigned [mem 0xc0c00000-0xc0cfffff 64bit pref] pci 0000:01:00.0: BAR 2: assigned [mem 0xc0000000-0xc07fffff 64bit] pci 0000:01:00.0: BAR 4: assigned [mem 0xc0c00000-0xc0cfffff 64bit pref] pci 0000:01:00.0: BAR 0: assigned [mem 0xc0800000-0xc080ffff 64bit] pci 0000:00:00.0: PCI bridge to [bus 01] pci 0000:00:00.0: bridge window [mem 0xc0000000-0xc0bfffff] pci 0000:00:00.0: bridge window [mem 0xc0c00000-0xc0cfffff 64bit pref] pcieport 0000:00:00.0: enabling device (0000 -> 0002) pcieport 0000:00:00.0: Max Payload Size set to 512/ 512 (was 128), Max Read Rq 512 pci 0000:01:00.0: Max Payload Size set to 512/ 512 (was 128), Max Read Rq 512 bcm963xx-pcie: [1] DT node available: /pcie@80050000 bcm963xx-pcie: found port [1] GEN2 Core Rev [3.04] with 1 Lanes getrcal for res select 5, int 667, ext 655, ratio 125 ratio1 140, rcal 8 bcm963xx-pcie: Core [1] setting resistor calibration value to 0x8 bcm963xx-pcie: core [1] Link UP - [1] lanes, [GEN2] speed bcm963xx-pcie 80050000.pcie: PCI host bridge to bus 0001:00 pci_bus 0001:00: root bus resource [mem 0xd0000000-0xdfffffff] pci_bus 0001:00: root bus resource [bus 00-ff] bcm963xx-pcie: Core [1] Enabled PCIE/UBUS Error Interrupts bcm963xx-pcie: Core [1] UBUS Intr [UBUS_LINKUP] pci 0001:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring pci 0001:00:00.0: BAR 8: assigned [mem 0xd0000000-0xd0bfffff] pci 0001:00:00.0: BAR 9: assigned [mem 0xd0c00000-0xd0cfffff 64bit pref] pci 0001:01:00.0: BAR 2: assigned [mem 0xd0000000-0xd07fffff 64bit] pci 0001:01:00.0: BAR 4: assigned [mem 0xd0c00000-0xd0cfffff 64bit pref] pci 0001:01:00.0: BAR 0: assigned [mem 0xd0800000-0xd080ffff 64bit] pci 0001:00:00.0: PCI bridge to [bus 01] pci 0001:00:00.0: bridge window [mem 0xd0000000-0xd0bfffff] pci 0001:00:00.0: bridge window [mem 0xd0c00000-0xd0cfffff 64bit pref] pcieport 0001:00:00.0: enabling device (0000 -> 0002) pcieport 0001:00:00.0: Max Payload Size set to 512/ 512 (was 128), Max Read Rq 512 pci 0001:01:00.0: Max Payload Size set to 512/ 512 (was 128), Max Read Rq 512 bcm963xx-pcie: [2] DT node available: /pcie@80060000 bcm963xx-pcie: found port [2] GEN2 Core Rev [3.04] with 1 Lanes getrcal for res select 5, int 667, ext 655, ratio 125 ratio1 140, rcal 8 bcm963xx-pcie: Core [2] setting resistor calibration value to 0x8 bcm963xx-pcie: core [2] Link UP - [1] lanes, [GEN1] speed bcm963xx-pcie 80060000.pcie: PCI host bridge to bus 0002:00 pci_bus 0002:00: root bus resource [mem 0xe0000000-0xefffffff] pci_bus 0002:00: root bus resource [bus 00-ff] bcm963xx-pcie: Core [2] Enabled PCIE/UBUS Error Interrupts bcm963xx-pcie: Core [2] UBUS Intr [UBUS_LINKUP] pci 0002:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring pci 0002:00:00.0: BAR 8: assigned [mem 0xe0000000-0xe05fffff] pci 0002:01:00.0: BAR 2: assigned [mem 0xe0000000-0xe03fffff 64bit] pci 0002:01:00.0: BAR 0: assigned [mem 0xe0400000-0xe0407fff 64bit] pci 0002:00:00.0: PCI bridge to [bus 01] pci 0002:00:00.0: bridge window [mem 0xe0000000-0xe05fffff] pcieport 0002:00:00.0: enabling device (0000 -> 0002) pcieport 0002:00:00.0: Max Payload Size set to 512/ 512 (was 128), Max Read Rq 512 pci 0002:01:00.0: Max Payload Size set to 512/ 512 (was 128), Max Read Rq 512 Wifi Forwarding Driver is initialized! ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver ehci-platform: EHCI generic platform driver ehci-pci: EHCI PCI platform driver ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver ohci-platform: OHCI generic platform driver ohci-pci: OHCI PCI platform driver ++++ Powering up USB blocks xhci-hcd xhci-hcd.0: xHCI Host Controller xhci-hcd xhci-hcd.0: new USB bus registered, assigned bus number 1 xhci-hcd xhci-hcd.0: hcc params 0x0250f17c hci version 0x100 quirks 0x00014010 xhci-hcd xhci-hcd.0: irq 25, io mem 0x8000d000 hub 1-0:1.0: USB hub found hub 1-0:1.0: config failed, hub doesn't have any ports! (err -19) xhci-hcd xhci-hcd.0: xHCI Host Controller xhci-hcd xhci-hcd.0: new USB bus registered, assigned bus number 2 hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected ehci-platform ehci-platform.0: EHCI Host Controller ehci-platform ehci-platform.0: new USB bus registered, assigned bus number 3 ehci-platform ehci-platform.0: irq 27, io mem 0x8000c300 ehci-platform ehci-platform.0: USB 2.0 started, EHCI 1.00 hub 3-0:1.0: USB hub found hub 3-0:1.0: 2 ports detected ohci-platform ohci-platform.0: Generic Platform OHCI controller ohci-platform ohci-platform.0: new USB bus registered, assigned bus number 4 ohci-platform ohci-platform.0: irq 26, io mem 0x8000c400 hub 4-0:1.0: USB hub found hub 4-0:1.0: 2 ports detected usbcore: registered new interface driver usblp usbcore: registered new interface driver usb-storage usbcore: registered new interface driver uas bcmspu: loading driver cryptodev: driver 1.8 loaded. broadcomThermalDrv brcm-therm: init (CPU count 4 4 4 4) brcm_otp_init entry paexport : PA Header Magic : EXIT_FAILURE gre: GRE over IPv4 demultiplexor driver ip_gre: GRE over IPv4 tunneling driver random: openssl urandom read with 5 bits of entropy available usb 4-2: new full-speed USB device number 2 using ohci-platform We just switched from Meru image (1/1); clean-up data partition and reboot in 15s

[Riverguide99]

I had the same issue with a U433F recently, I performed the following steps:

1.  Connect a console cable, make sure you see the boot loop like you pasted here. 

2.  Power up (I used POE) and press and hold the "reset" button for about 15 seconds until you see it boot again.

3.  Even though you see text flying across your screen, it accepts commands and you can break out to the boot menu in the first few seconds of powering up.  There were four boot images in the boot order to choose from.  Meru images were the first two options, I chose one of the fortinet images (image 4).  It rebooted again and I was finally able to connect a browser to its default 192.168 address.  I then manually pushed updates (sequentially, cannot skip) until It was up to date.  No issues since.

[FortiWill]

I had the same Issue, what made it for me is this;

1-Boot the AP with the console cable connected with 115200 baud with Putty.

2- At some point the ap will offer you to press CTRL+C and then will ask you to enter a password. The password is the serial number of the AP.

3- Then run this command to change the boot image, bootimg imageid 2

[horstL]

and the password is really the full Serial number with PU431F... etc ?

it's not working to login, the password is marked as wrong with the digits only info (= substring of the full PU431F1C2345679) = >  2345679

[FortiWill]

In my case the serial number as the password worked. If it does not work in your case, I suggest to open a ticket at Fortinet and call the technical support.

[Johncrazzii83]

Hey there,

I'm not sure about the exact cause of the boot loop, but it seems like the FortiAP U433F device is stuck in a Lane boot loop. Accessing the uboot without the password might be challenging. It would be helpful to provide more details or consult the device's documentation or support for further assistance.