I had one UAP Pro in strange state. UAP shines after powering up only white, can do firmware recovery via TFTP, but after update light goes off. It does not automatically reboot after update and it still has a problem when it is turned on. I used PL2303 USB to TTL RS232 converter connected to 4 pin header inside Unifi unit and terminal program Tera Term to see what is wrong. This is what i seen:

U-Boot unifi-v1.6.15.278-g4ebbbcff (Mar 5 2018 - 23:40:54)

DRAM: 128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ffb000, log_magic:0xedddf96a kseg: 0xa0000000
Flash: 16 MB
PCIe WLAN Module found (tries: 1).
Net: eth0: dc:9f:db:1a:89:5a
eth0
Setting 0xb8116290 to 0x20402d0f
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot: 0
Board: Ubiquiti Networks AR9344 board (e507-21.2122.0030.0030)
0. Name = u-boot, offset = 0, start_addr=9f000000, size=262144,start_sector=0, end_sector=3
1. Name = u-boot-env, offset = 40000, start_addr=9f040000, size=65536,start_sector=4, end_sector=4
2. Name = jffs2, offset = 50000, start_addr=9f050000, size=16121856,start_sector=5, end_sector=250
3. Name = cfg, offset = fb0000, start_addr=9ffb0000, size=262144,start_sector=251, end_sector=254
4. Name = EEPROM, offset = ff0000, start_addr=9fff0000, size=65536,start_sector=255, end_sector=255
UBNT application initialized
Scanning JFFS2 FS: .| Unknown node type: e002 len 4164 offset 0xf530d8
Unknown node type: e002 len 2736 offset 0xf5f408
done.
Error: none of the image file is good!
ar7240><INTERRUPT>

This is bad situation. UAP Pro is bricked and need fix. I will share with you my experience:

You will need  Tera Term or similar windows terminal program. TFTP server, PL2303 USB to TTL RS232 converter (ebay), Putty. Functional mtdblocks from working AP (this is from UAP Pro with FW version 4.0.15.9872 without EEprom mtdblock4). You can extract mtdblocks from same functional AP with Putty. Putty have commandline utility named plink. You can use commandline (run as administrator) plink -l yourAPusername -pw yourAPpassword yourAPIPAddress cat /dev/mtdblock0 > mtdblock0. Acquired files are stored in "windows\system32".

Example:

plink -l admin -pw topsecret1 192.168.0.137 cat /dev/mtdblock0 > mtdblock0

plink -l admin -pw topsecret1 192.168.0.137 cat /dev/mtdblock1 > mtdblock1

plink -l admin -pw topsecret1 192.168.0.137 cat /dev/mtdblock2 > mtdblock2

plink -l admin -pw topsecret1 192.168.0.137 cat /dev/mtdblock3 > mtdblock3

plink -l admin -pw topsecret1 192.168.0.137 cat /dev/mtdblock4 > mtdblock4

When you have mtdblocks, then you can do recovery UAP Pro. Connect PL2303 to PC, Connect GND pin to GND (you can determine GND pin with multimeter, it's connected to the backplane of UAP) and RX, TX like is in middle (or you can try swap if you have different colors). Do not connect power pin (red) from converter to anything! Wiring is shown on picture - left pin is GND, next pin is RX, TX and right pin is +3,3V.

Run Tera Term, choose "Serial" and select proper COM port. Now in menu  "Setup->Serial port..". Select speed  115 200, data 8, parity none, stop bits 1, flow control none. When you turn on now AP (plug in POE), you must see text in terminal (when not, swap Rx,Tx wires on header). When it is o.k., you must setup computer with TFTP server. LAN settings is IP:192.168.1.254, MASK: 255.255.255.0, GW: 192.168.1.20. Now run TFTP in "options" set up "network" IP 192.168.1.254 and in "server" tab select "path", where you have stored mtdblocks from working AP. Now you can connect PC to UAP injector and connect UAP to PC.

Now you can send some commands:

ar7240> mtdparts

device nor0 , # parts = 5
#: name                 size                     offset        mask_flags
0: u-boot          0x00040000           0x00000000           0
1: u-boot-env   0x00010000           0x00040000           0
2: jffs2             0x00f60000            0x00050000           0
3: cfg              0x00040000            0x00fb0000           0
4: EEPROM     0x00010000            0x00ff0000            0

active partition: nor0,0 - (u-boot) 0x00040000 @ 0x00000000

defaults:
mtdids : nor0=ath-nor0
mtdparts: mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),15744k(jffs2),256k(cfg),64k(EEPROM)

When you send command mtdparts, you can see size and start addres. We are interested with 15744k(jffs2)  and 256k(cfg).

Now we need to download functional mdparts to RAM and erase & flash it to the flash memory at right position.

ar7240> tftp 83000000 mtdblock2
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename 'mtdblock2'.
Load address: 0x83000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#############################
done
Bytes transferred = 16121856 (f60000 hex)
ar7240> protect off all
Un-Protect Flash Bank # 1
ar7240> erase 0x9f050000 +0xf60000
...................................................................................................................................................................................................................................................... done
Erased 246 sectors
ar7240> cp.b 0x83000000 0x9f050000 0xf60000
Copy to Flash... write addr: 9f050000
done
ar7240> cmp.b 0x83000000 0x9f050000 0xf60000
Total of 16121856 bytes were the same
ar7240> tftp 83000000 mtdblock3
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename 'mtdblock3'.
Load address: 0x83000000
Loading: ####################################################
done
Bytes transferred = 262144 (40000 hex)
ar7240> erase 0x9ffb0000 +0x40000
.... done
Erased 4 sectors
ar7240> cp.b 0x83000000 0x9ffb0000 0x40000
Copy to Flash... write addr: 9ffb0000
done
ar7240> cmp.b 0x83000000 0x9ffb0000 0x40000
Total of 262144 bytes were the same

Now you can off UAP and On Again and press reset button for TFTP recovery mode:

U-Boot unifi-v1.6.15.278-g4ebbbcff (Mar 5 2018 - 23:40:54)

DRAM: 128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ffb000, log_magic:0xedddf96a kseg: 0xa0000000
Flash: 16 MB
PCIe WLAN Module found (tries: 1).
Net: eth0: dc:9f:db:1a:89:5a
eth0
Setting 0xb8116290 to 0x20402d0f
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot: 0
Board: Ubiquiti Networks AR9344 board (e507-21.2122.0030.0030)
0. Name = u-boot, offset = 0, start_addr=9f000000, size=262144,start_sector=0, end_sector=3
1. Name = u-boot-env, offset = 40000, start_addr=9f040000, size=65536,start_sector=4, end_sector=4
2. Name = jffs2, offset = 50000, start_addr=9f050000, size=16121856,start_sector=5, end_sector=250
3. Name = cfg, offset = fb0000, start_addr=9ffb0000, size=262144,start_sector=251, end_sector=254
4. Name = EEPROM, offset = ff0000, start_addr=9fff0000, size=65536,start_sector=255, end_sector=255
UBNT application initialized
reset button pressed: clearing cfg partition!

First 0xfb last 0xfe sector size 0x10000
.... done
reset button pressed: clearing u-boot-env partition!

First 0x4 last 0x4 sector size 0x10000
. done
u-boot-env is invalid, overiding with default.

First 0x4 last 0x4 sector size 0x10000
. done
write addr: 9f040000
eth0 link down
Setting default IP 192.168.1.20
Starting TFTP server...
Using eth0 (192.168.1.20), address: 0x81000000
Waiting for connection: Tx Timed out
Tx Timed out
Tx Timed out

Finally after next restart UAP Pro boots correctly and waiting for adopt:

U-Boot unifi-v1.6.15.278-g4ebbbcff (Mar  5 2018 - 23:40:54)

DRAM:  128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ffb000, log_magic:0xa5d4c96a kseg: 0xa0000000
Flash: 16 MB
PCIe WLAN Module found (tries: 1).
Net:   eth0: dc:9f:db:1a:89:7a
eth0
Setting 0xb8116290 to 0x20402d0f
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
Board: Ubiquiti Networks AR9344 board (e507-21.2122.0030.0030)
 0. Name = u-boot, offset = 0, start_addr=9f000000, size=262144,start_sector=0, end_sector=3
 1. Name = u-boot-env, offset = 40000, start_addr=9f040000, size=65536,start_sector=4, end_sector=4
 2. Name = jffs2, offset = 50000, start_addr=9f050000, size=16121856,start_sector=5, end_sector=250
 3. Name = cfg, offset = fb0000, start_addr=9ffb0000, size=262144,start_sector=251, end_sector=254
 4. Name = EEPROM, offset = ff0000, start_addr=9fff0000, size=65536,start_sector=255, end_sector=255
UBNT application initialized
Scanning JFFS2 FS: .| Unknown node type: e002 len 4164 offset 0xf58ee4
 done.
## Booting image at 81000000 ...
   Image Name:   MIPS Ubiquiti Linux-2.6.32.33
   Created:      2018-12-29  10:12:49 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    6435724 Bytes =  6.1 MB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum at 0x81000040 ...OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Booting Atheros AR934x

 Done! I hope this helps to somebody.

Přidat komentář