Upcoming Maintenance Alert:

The UBNT Community will be upgraded at 5pm MDT on April 25th. During this time the community forums will be set to read-only status.

Learn more

×
Reply
Highlighted
Emerging Member
Posts: 90
Registered: ‎05-14-2008
Kudos: 13
Solutions: 1

Again on Unifi BAD DATA CRC

Hi all, I have on the bench 4 Unifi standard, all with the same issue, all come from the same environment but have failed not at the same time (one a time with a cadence of about a week or so).

On location there are a very simple net environment:

1 ADSL Router

1 switch TP-Link 16 port

6 Unifi (4 on cable and 2 on wireless uplink)

3 PC on net connect by cable + a variable number of PC and other device connect via wireless by the Unifi system (max 25 - 30 device at same time)

The plant was start  this summer and just in september have presented a similar problem, the symptom are simple, Unifi is connected, the POE is functionally but no light on unit and AP is not present, not all device off in the same moment, but one each from time in time during 15 days.

The Unifi was changed with new device, the "damaged" unit where restored with firmware recover (some at first try, some other need 2 -3 attempts and the erase of config sector (nor0,4), but all was recovered and in part re-used.

On the system is active the automatic update, the Unifi server originally installed was 2.4.4 and now is 2.4.6, no beta was running here.

Initially the Unifi was fed by standard 220 V AC mains, but since that on location there was an UPS for the computer and thinking of something relate to AC Voltage, some modify in the plant was made, and all the net structure was taken under UPS (not only Router-Switch-PC and 1 Unifi as before)

After the change there are 1 or 2 month with no problem, but in mid november the issue re-start, same as before, the Unifi went off one at a time and 4 (on 6) are just on work bench, and restore this time is not the solution; the problem is the same on all 4:

 
U-Boot 1.1.4-gb387d959 (Dec  8 2011 - 10:16:49)

Board: Ubiquiti Networks AR7241 board (e502-6.0101.002e)
DRAM:  64 MB
Flash:  8 MB
*** Warning - bad CRC, using default environment

Net:   eth0, eth1
Hit any key to stop autoboot:  0
## Booting image at 9f050000 ...
   Image Name:   MIPS Ubiquiti Linux-2.6.15-5.2
   Created:      2013-10-08  18:37:43 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    729748 Bytes = 712.6 kB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum at 0x9f050040 ...Bad Data CRC
ar7240>

this on 3 unit before and after restoring, the fourth units was the same before restoring firmware, but after the restore the situation is changed and this is the actual error on boot:



U-Boot unifi-v1.3.2.122-g6a7fa502 (May 13 2013 - 23:18:59)

Board: Ubiquiti Networks AR7241 board (e502-6.0101.002e)
DRAM:  64 MB
Flash:  8 MB
Net:   eth0, eth1
Hit any key to stop autoboot:  0
*** ERROR: `serverip' not set
## Booting image at 8022c090 ...
Bad Magic Number
ar7240>

It seems that the revision of U-boot is different, probably becouse I have restored a beta 3 also to see if something change, but it's also possible that the unifi with different revision come from a different stock I buy, (the actual I have on shelve have a test date on August 8 2013 and was part of a 5 cartons stock I buy in september) test date is compatible with U-Boot date and buy date with precedent issue in september.

I have search and read this two post with similar issue

http://community.ubnt.com/t5/UniFi/Unifi-and-Bad-CRC/m-p/622563/highlight/true#M50104

http://community.ubnt.com/t5/UniFi/Problem-with-U-Boot-BAD-DATA-CRC/m-p/520959/highlight/true#M41938

After that I have searched again, having many other information on similar (but not identical issue), but nothing has help me to solve the situation, this problem of bad data crc is common in many other Ubiquiti device, but frankly the Unifi platform and Nanobridge M5 seem to be the more affected (considering the number I see) On Nanobridge it seem to be concentrated on summertime and probably is a temperature issue that overcome specification for some components on the board, but on Unifi situation is more complex, from every issue I have, only one regarding an outdoor Unifi on summertime, the other is coming from UAP and UAP-LR installed in the most varied contexts (home, school, office in industrial environments) never the same and never repeated.

All 2 messange on board is closed from september or october, there are some new from this time? something are changed?

Have seen that UBNT-MikeD and other from Ubiquiti crew have some solution that in some case work, there are any news on that, can I have some more information on that by UBNT Staff?

Frankly I'm finished ideas, so any possible help is welcome, and is urgent to find a solution, becouse it's clear that I can't change 6 Unifi every 2 - 3 month till the end of the warranty period (2 years here...)

Thanks in advance for any help coming

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: Again on Unifi BAD DATA CRC

I appreciate this is an old thread, but I couldnt find any help to the problem either so I decided to spend the time working out a solution when the urescue command doesnt flash properly and recover the unify.

Below is the output of my TTL Serial console connected to the Unify (SWX-UAP)

** BE CAREFUL You can make the situation worse than it already is by miss typing the commands, getting a memory address wrong etc.. ** BE CAREFUL ** (Worth saying twice) And remember your results may vary to mine. I have sucuessfully recovered eleven unify's that would not recover via the urescue process using the below. Each and every one is now updated to 2.4.6.2178 and is working perfectly.

U-Boot unifi-v1.2.1.71-g529c499d (Dec 21 2012 - 12:50:21)

Board: Ubiquiti Networks AR7241 board (e502-6.0101.002e)
DRAM:  64 MB
Flash:  8 MB
*** Warning - bad CRC, using default environment

***           saving default environment ...
Un-Protected 1 sectors
Erasing Flash.... done
Erased 1 sectors
Writing to Flash... write addr: 9f040000
done
Protected 1 sectors
Net:   eth0, eth1
Hit any key to stop autoboot:  0
## Booting image at 9f050000 ...
   Image Name:   MIPS Ubiquiti Linux-2.6.15-5.2
   Created:      2012-02-24  16:55:55 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    730087 Bytes = 713 kB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum at 0x9f050040 ...Bad Data CRC

ar7240> mtdparts default
ar7240> saveenv
Saving Environment to Flash...
Un-Protected 1 sectors
Erasing Flash.... done
Erased 1 sectors
Writing to Flash... write addr: 9f040000
done
Protected 1 sectors
ar7240> tftp 83000000 2.4.6.2178/mtdblock2
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename '2.4.6.2178/mtdblock2'.
Load address: 0x83000000
Loading: #################################################################
         #################################################################
         #################################################################
         ##########
done
Bytes transferred = 1048576 (100000 hex)
ar7240> protect off all
Un-Protect Flash Bank # 1
ar7240> erase 0x9f050000 +0x100000
................ done
Erased 16 sectors
ar7240> cp.b 0x83000000 0x9f050000 0x100000
Copy to Flash... write addr: 9f050000
done
ar7240> cmp.b 0x83000000 0x9f050000 0x100000
Total of 1048576 bytes were the same
ar7240> tftp 83000000 2.4.6.2178/mtdblock3
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename '2.4.6.2178/mtdblock3'.
Load address: 0x83000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######
done
Bytes transferred = 6684672 (660000 hex)
ar7240> erase 0x9f150000 +0x660000
...................................................................................................... done
Erased 102 sectors
ar7240> cp.b 0x83000000 0x9f150000 0x660000
Copy to Flash... write addr: 9f150000
done
ar7240> cmp.b 0x83000000 0x9f150000 0x660000
Total of 6684672 bytes were the same
ar7240>
ar7240> reset

Resetting...

U-Boot unifi-v1.2.1.71-g529c499d (Dec 21 2012 - 12:50:21)

Board: Ubiquiti Networks AR7241 board (e502-6.0101.002e)
DRAM:  64 MB
Flash:  8 MB
*** Warning - bad CRC, using default environment

***           saving default environment ...
Un-Protected 1 sectors
Erasing Flash.... done
Erased 1 sectors
Writing to Flash... write addr: 9f040000
done
Protected 1 sectors
Net:   eth0, eth1
Hit any key to stop autoboot:  0
## Booting image at 9f050000 ...
   Image Name:   MIPS Ubiquiti Linux-2.6.15-5.2
   Created:      2013-10-08  18:37:43 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    729748 Bytes = 712.6 kB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum at 0x9f050040 ...OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Booting...

And from then on its accessable again from the regular Unify web interface.


I've invested time in reading about U-Boot and what commands were available and knowing linux and networking already, together with programming knowledge this is how I have bought it all together to transfer the parts of the image nessasary and write then directly,

What you will also need is the seperate parts of the NAND flash that make up the whole filing system, I only used the kernel and rootfs parts though. You will also need a working tftp server for the unify to pull the partitions from, but you'll probably have this already since you've tried the urescrue and found it not wor work.

To get the working partitions you'll need another working unify that you can ssh into and then extract from and copy to your tftp server ready to be transfered. I did try and work out a way to extract them from the firmware.bin file but gave up and went for the shorter route.

 

 

New Member
Posts: 4
Registered: ‎06-05-2014

Re: Again on Unifi BAD DATA CRC

Hello Stevebird,

I am in need of some of your experience in saving the partitions from a good UAP to be able to rescue one of mine.

It "bricked" after a power failure, stayed green but reported as disconnected. Restarting left it with no lights burning. Can only access from serial ttl3.3v  - tried urescue with a few firmware version updates but the crc error in the kernel partition causes it to malfunction. I'm not a Linux boffin, but have been in the industry for a few decades. Im at the point of ssh into a new unit to save the flash info, but am short of the experience.

 Can you help please?  Ubnt first response was for me to try the tftp recovery procedure, which I've tried a few times on the unit already. Your post above is the best I've seen on the topic so far.

Appreciated.

Rudyj

 

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: Again on Unifi BAD DATA CRC

There are various ways to extract the partitions from a linux box, the quick and dirty way I did it was using simple ssh redirect;

using another linux box, from the cli I typed -

ssh admin@192.168.0.114 cat /dev/mtdblock0 >mtdblock0

where 192.168.0.114 is the IP of my working unify and admin is the username used to ssh into the working unify.

You'll be presented with a request for a password which is the password you'd use to ssh into the working unify.

Just repeat for all of the mtdblocks you want

I've just done it again and ended up with six files ;

-rw-r--r-- 1 root root  262144 Jun  5 16:04 mtdblock0
-rw-r--r-- 1 root root   65536 Jun  5 16:04 mtdblock1
-rw-r--r-- 1 root root 1048576 Jun  5 16:04 mtdblock2
-rw-r--r-- 1 root root 6684672 Jun  5 16:04 mtdblock3
-rw-r--r-- 1 root root  262144 Jun  5 16:05 mtdblock4
-rw-r--r-- 1 root root   65536 Jun  5 16:05 mtdblock5

from there you tftp the various parts into the various locations, I'd advise NOT messing about with the Uboot partition as if you mess that up then you'll be in the same position I'm in with a handful of the ones I have and need to Jtag them with the Uboot again. At this point I'm still researching a solution and keep hitting a brick wall.


UBNT must have a util that connects to the J2 connector and flashes the UBoot into the nand and from there the reset of the setup is probably automatic. Getting that Util or the info on how to do it has so far been impossible.

 

Good luch with your restore.

 

New Member
Posts: 4
Registered: ‎06-05-2014

Re: Again on Unifi BAD DATA CRC

Hello stevebird,

Many many thanks. You don't know how much I appreciate the help.

Sincerely

Rudy

 

 

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: Again on Unifi BAD DATA CRC

Hi,
Another thought........ if you dont have to, dont re-write mtdblock5 (eprom data) as amongst other things this has the MAC addresses in it for the interfaces and if you 'copy' from a working unit, you will effectively end up with a 'clone' of that unit which then leads to all sorts of funnies in the management software.


I've found though you can edit the binary file with a hex editor and you'll see the MAC addresses in the file which can then be manually altered. Its a bit of a task though so best avoided if possible.

New Member
Posts: 4
Registered: ‎06-05-2014

Re: Again on Unifi BAD DATA CRC

Hello Stevebird,

Just some feedback.

My UAP is back up and running. I followed all your instructions, but only replaced the mtdblock2 and mtdblock 3.

I kept on getting cmp.b failures at different addresses in both of those blocks. I decided to do a bunch of erases to the same location and then a bunch of cp.b 's to each destination.  My cmp.b passed with all the correct answers and reset brought the unit back to life without failure.

You've got my interest now in how to write the uboot block from J2.  It must be possible.  The pins all go to the processor on the board, just like the ttl3v3 connections,  so there must be a way to do it.  I'm hooked.

thanks again - UAP saved.

 

 

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: Again on Unifi BAD DATA CRC

[ Edited ]

I'm really pleased I was able to help and that your device is up and running again.


If you manage to get to point of getting the jtag working then I'd be really interested in how you did it.

I've been looking at the same, I've got a wiggler and a USB Blaster and both talk to the CPU, but within the command set and more info the utils I have refuse to go much further.

I just wish I had the time......

Is there a way to PM on this ?

New Member
Posts: 2
Registered: ‎06-15-2014

Re: Again on Unifi BAD DATA CRC

Hi!

I followed the instructions from the stevebird post and have the following log:

 

U-Boot unifi-v1.3.3.124-ge1a2c421 (Sep 27 2013 - 13:13:30)

 

Board: Ubiquiti Networks AR7241 board (e512-6.0101.002e)

DRAM:  64 MB

Flash:  8 MB

Net:   eth0, eth1

Hit any key to stop autoboot:  0

## Booting image at 9f050000 ...

   Image Name:   MIPS Ubiquiti Linux-2.6.15-5.2

   Created:      2013-10-08  18:37:43 UTC

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    729748 Bytes = 712.6 kB

   Load Address: 80002000

   Entry Point:  80002000

   Verifying Checksum at 0x9f050040 ...Bad Data CRC

ar7240> mtdparts default


ar7240> saveenv


Saving Environment to Flash...

Un-Protected 1 sectors

Erasing Flash.... done

Erased 1 sectors

Writing to Flash... write addr: 9f040000

done

Protected 1 sectors

ar7240>  tftp 83000000 mtdblock2


Using eth0 device

TFTP from server 192.168.1.254; our IP address is 192.168.1.20

Filename 'mtdblock2'.

Load address: 0x83000000

Loading: checksum bad

checksum bad

#################################################################

         #################################################################

         #################################################################

         ##########

done

Bytes transferred = 1048576 (100000 hex)

ar7240> protect off all


Un-Protect Flash Bank # 1

ar7240> erase 0x9f050000 +0x100000


................ done

Erased 16 sectors

ar7240> cp.b 0x83000000 0x9f050000 0x100000


Copy to Flash... write addr: 9f050000

done

ar7240> cmp.b 0x83000000 0x9f050000 0x100000


byte at 0x8303e210 (0xa0) != byte at 0x9f08e210 (0xa1)

Total of 254480 bytes were the same

ar7240> tftp 83000000 mtdblock3


Using eth0 device

TFTP from server 192.168.1.254; our IP address is 192.168.1.20

Filename 'mtdblock3'.

Load address: 0x83000000

Loading: #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         #################################################################

         ######

done

Bytes transferred = 6684672 (660000 hex)

ar7240> erase 0x9f150000 +0x660000


...................................................................................................... done

Erased 102 sectors

ar7240> cp.b 0x83000000 0x9f150000 0x660000


Copy to Flash... write addr: 9f150000

done

ar7240> cmp.b 0x83000000 0x9f150000 0x660000


byte at 0x8318ebb3 (0x10) != byte at 0x9f2debb3 (0x18)

Total of 1633203 bytes were the same

ar7240> reset

 


Resetting...

 

U-Boot unifi-v1.3.3.124-ge1a2c421 (Sep 27 2013 - 13:13:30)

 

Board: Ubiquiti Networks AR7241 board (e512-6.0101.002e)

DRAM:  64 MB

Flash:  8 MB

Net:   eth0, eth1

Hit any key to stop autoboot:  0

## Booting image at 9f050000 ...

   Image Name:   MIPS Ubiquiti Linux-2.6.15-5.2

   Created:      2013-10-08  18:37:43 UTC

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    729748 Bytes = 712.6 kB

   Load Address: 80002000

   Entry Point:  80002000

   Verifying Checksum at 0x9f050040 ...Bad Data CRC

ar7240>

 

Where is my mistake??

How can I fix it?

______

Many thanks!

 

 

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: Again on Unifi BAD DATA CRC

[ Edited ]


ar7240> cp.b 0x83000000 0x9f050000 0x100000


Copy to Flash... write addr: 9f050000

done

ar7240> cmp.b 0x83000000 0x9f050000 0x100000


byte at 0x8303e210 (0xa0) != byte at 0x9f08e210 (0xa1)

Total of 254480 bytes were the same


Where is my mistake??

How can I fix it?

______

Many thanks!

 

 


That is where it first went wrong.. The memory and the nand dont equal or != as it says...


You could try re-writing it and then re-comparing it.. Unless you can get it to write to the nand properly then unfortunatly you won't be able to continue. Looks like you have more than one bad block on the Nand.

Nand chips do fail sometimes, I've got five units that have and do have brand new Nands for them but unless I can solve writing the U-Boot partition then theres little point in me chaning all five.?

Good luck.

New Member
Posts: 2
Registered: ‎06-15-2014

Re: Again on Unifi BAD DATA CRC

Hi stevebird!

I did it three times, but each time I got "Bad Data CRC".

Probably NAND is damaged Man Sad(

Thanks!

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: Again on Unifi BAD DATA CRC

Sadly it does sound like that maybe the case.


I've got five like it Cryin


I did have one like yours that seemed not to want to write properly, but I kept writing to it and eventually it took it and is working now. May just keep trying. If not you'll need a new NAND, they are pennies to buy, but we still need a method to write the U-Boot to them before we can go further and write the rest of the operating system.

If you come up with a process, I'd be interested, i've not got any spare time to invest in finding out how to JTAG the U-Boot. There doesnt seem to be much info around about the CPU and the JTAG commands it supports.

New Member
Posts: 4
Registered: ‎06-05-2014

Re: Again on Unifi BAD DATA CRC

hi stevebird,

I've setup a tmp gmail account to initiate PM.  Please use rudyjohl6@gmail.com and I wll reply with my normal email address. Then at least we wont be bombed with all sorts of junkmail.

Regards.

 

Ubiquiti Employee
Posts: 7,053
Registered: ‎01-28-2013
Kudos: 8351
Solutions: 574
Contributions: 20

Re: Again on Unifi BAD DATA CRC


Rudyj wrote:

hi stevebird,

I've setup a tmp gmail account to initiate PM.  Please use rudyjohl6@gmail.com and I wll reply with my normal email address. Then at least we wont be bombed with all sorts of junkmail.

Regards.

I just fixed your PM issue.

Thanks,
Mike

Regular Member
Posts: 345
Registered: ‎12-17-2009
Kudos: 31

Re: Again on Unifi BAD DATA CRC

[ Edited ]

I think this will help you out to full backup a working mx flashchip and paste it back after a full erase.. or paste it into a new mx chip witch costs like cents.

 

to make an ideea : http://www.aliexpress.com/item/Disassemble-good-measure-MX25L6445EMI-10G-can-8M-Flash-Pen-FLASH-SOP-...   found in ns loco m2 and others

 

 

 

http://www.aliexpress.com/item/Free-shipping-Bios-Board-MX25L6405-W25Q64-USB-Programmer-LCD-Burner-C...

 

-I have the software if you wanna see what options you have there...regarding flashing

 

 

and for quick connect you may wanna use this http://www.aliexpress.com/item/Free-shipping-Programmer-Testing-Clip-SOP16-SOP-SOIC-16-SOIC16-DIP16-...

 

---there are only 8 wires I think that you need to connect from that sop 16 clip to the usb programer.

 

 

---or:  http://www.aliexpress.com/item/Freeshipping-SOP16-to-DIP16-SOP16-turn-DIP16-SOIC16-to-DIP16-narrow-1...

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: Again on Unifi BAD DATA CRC


acidu wrote:

I think this will help you out to full backup a working mx flashchip and paste it back after a full erase.. or paste it into a new mx chip witch costs like cents.


 

http://www.aliexpress.com/item/Free-shipping-Bios-Board-MX25L6405-W25Q64-USB-Programmer-LCD-Burner-C...

 

-I have the software if you wanna see what options you have there...regarding flashing

 

 

and for quick connect you may wanna use this http://www.aliexpress.com/item/Free-shipping-Programmer-Testing-Clip-SOP16-SOP-SOIC-16-SOIC16-DIP16-...

 

---there are only 8 wires I think that you need to connect from that sop 16 clip to the usb programer.

 

 

---or:  http://www.aliexpress.com/item/Freeshipping-SOP16-to-DIP16-SOP16-turn-DIP16-SOIC16-to-DIP16-narrow-1...


I realise this is an old post, but I wondered if you (or anyone) got anywhere in trying to use this or any other programmer to reflash the uboot ?

Regular Member
Posts: 345
Registered: ‎12-17-2009
Kudos: 31

Re: Again on Unifi BAD DATA CRC

Forum is old info is NEW to you. It works by the way...regarding thread time and date Man Happy)
New Member
Posts: 14
Registered: ‎02-05-2014
Kudos: 11

Re: Again on Unifi BAD DATA CRC

Hey Steve...

 

Kindly provide me more information about mtdblock?

how to download this files & how to put it.

 

I am working this stage..... please check screenshot

 

thanks

screen1.png
Reply