Upcoming Maintenance Alert:

The UBNT Community will be upgraded at 5pm MDT on April 25th. During this time the community forums will be set to read-only status.

Learn more

×
Reply
New Member
Posts: 1
Registered: ‎06-12-2016

Re: HOWTO: Unbrick your UniFi AP

I have an Outdoor5 and I switched to TWC from At&t new modem router etc, the AP was set to the previous router and I want to input the info of the new hardware. I cannot get in the Outdoor5 it's asking for the user and password that I no longer know. I tried to reset from the button on the unit and it doeasn't bring it back to factory. It's seen by the Discover sometimes Pending other times Managed/Adopted. How can I reset it, would it be easier to get the Usb to TTL setup or can I write firmware and do it that way. Thanks in advance for any help.

New Member
Posts: 19
Registered: ‎08-27-2013

Re: HOWTO: Unbrick your UniFi AP

I also can't get mtdblock's. I tried putty and winscp.

 

Winscp says: Received error message from remote side: 'scp: mtdblock2: not a regular file'

 

Please, share this mtdblock's here.

New Member
Posts: 19
Registered: ‎08-27-2013

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

I got these blocks via putty.

 

cat /dev/mtdblock0 > /tmp/boot0.bin

cat /dev/mtdblock1 > /tmp/boot1.bin

cat /dev/mtdblock2 > /tmp/boot2.bin

cat /dev/mtdblock3 > /tmp/boot3.bin

cat /dev/mtdblock4 > /tmp/boot4.bin

cat /dev/mtdblock5 > /tmp/boot5.bin

 

When I tried to get them via WinSCP by copy from DEV to TMP it was not working. The result was an empty files.

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: HOWTO: Unbrick your UniFi AP

Hello.

 

Here is the firmware extracted from one of my AP's

 

Its 3.3.20.4019.

 

We carefull when writing these back, only repalce the blocks you need to. You dont want to end up with a clone of my AP...

 

 

Attachment
New Member
Posts: 19
Registered: ‎08-27-2013

Re: HOWTO: Unbrick your UniFi AP

I actually have UniFi AP with used on board AirOS 5.5 or 5.5.2. It was working long time normally. Further it got some problem kind of non stable loading. I made fullflash and replace flashchip and got BAD DATA CRC.

I have gotten mtdblocks from other UniFi with 5.5 and 5.5.2 AirOS. Next I followed your instruction to rewrite mtdblocks.

Here is my result:

[    0.501000] ehci_reset Intialize USB CONTROLLER in host mode: 3
[    0.508000] ehci_reset Port Status c000000
[    0.512000] ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000
[    0.519000] ehci_reset Intialize USB CONTROLLER in host mode: 3
[    0.526000] ehci_reset Port Status c000000
[    0.536000] ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00
[    0.542000] usb usb1: configuration #1 chosen from 1 choice
[    0.548000] hub 1-0:1.0: USB hub found
[    0.552000] hub 1-0:1.0: 1 port detected
[    0.557000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    0.564000] u32 classifier
[    0.567000]     Performance counters on
[    0.570000]     input device check on
[    0.574000]     Actions configured
[    0.580000] TCP westwood registered
[    0.584000] NET: Registered protocol family 10
[    0.592000] NET: Registered protocol family 17
[    0.597000] Bridge firewalling registered
[    0.601000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    0.608000] All bugs added by David S. Miller <davem@redhat.com>
[    0.614000] ar7240wdt_init: Registering WDT success
[    0.629000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[    0.637000] Freeing unused kernel memory: 136k freed
[    0.654000] Please be patient, while AirOS loads ...
[    0.705000] CPU 0 Unable to handle kernel paging request at virtual address c
00695cf, epc == 800f80c0, ra == 800f8048
[    0.715000] Oops[#1]:
[    0.715000] Cpu 0
[    0.715000] $ 0   : 00000000 802f0000 c00695cf fffc0db8
[    0.715000] $ 4   : 00020001 00000dba fffdffff 068a79e0
[    0.715000] $ 8   : 00002000 ffffffbf 00000041 00000000
[    0.715000] $12   : 802b43a8 ea2f375e 838dd3a0 00000001
[    0.715000] $16   : 00000000 00000045 00000010 c00a0644
[    0.715000] $20   : ffffffff 00000000 00000389 c00a0000
[    0.715000] $24   : 00000001 80010804
[    0.715000] $28   : 83818000 83819998 c006a000 800f8048
[    0.715000] Hi    : 00000000
[    0.715000] Lo    : 284af100
[    0.715000] epc   : 800f80c0 unlzma+0xc48/0xdd8
[    0.715000]     Not tainted
[    0.715000] ra    : 800f8048 unlzma+0xbd0/0xdd8
[    0.715000] Status: 1000ff03    KERNEL EXL IE
[    0.715000] Cause : 00800008
[    0.715000] BadVA : c00695cf
[    0.715000] PrId  : 00019374 (MIPS 24Kc)
[    0.715000] Modules linked in:
[    0.715000] Process swapper (pid: 1, threadinfo=83818000, task=83817b68, tls=
00000000)
[    0.715000] Stack : 83407688 000006df 800a13a0 83402d64 00000046 00000017 000
00019 6c000200
[    0.715000]         01000000 010001f1 630001bd 800f72cc c0048099 c0048000 c00
500fd 000080fd
[    0.715000]         01d888a8 032b1400 035f65e0 00000001 00000dba 0000000a 005
18dd9 144b288d
[    0.715000]         063fbc48 00000000 00000010 c0048000 00000003 00000003 000
00008 83817b68
[    0.715000]         80300000 838e7484 00000000 00000000 00000021 c00500fd 000
00021 838f4d40
[    0.715000]         ...
[    0.715000] Call Trace:
[    0.715000] [<800f80c0>] unlzma+0xc48/0xdd8
[    0.715000] [<800cb2b8>] lzma_uncompress+0x128/0x270
[    0.715000] [<800c7304>] squashfs_read_data+0x484/0x690
[    0.715000] [<800c79e8>] squashfs_cache_get+0x1cc/0x310
[    0.715000] [<800c8cec>] squashfs_readpage+0x5e0/0x8b4
[    0.715000] [<8005fbec>] __do_page_cache_readahead+0x1c0/0x218
[    0.715000] [<8005fc6c>] ra_submit+0x28/0x34
[    0.715000] [<800601b8>] page_cache_sync_readahead+0x5c/0x68
[    0.715000] [<80058b64>] generic_file_aio_read+0x2ac/0x760
[    0.715000] [<8007dc34>] do_sync_read+0xd4/0x13c
[    0.715000] [<800826ec>] kernel_read+0x2c/0x40
[    0.715000] [<80082808>] prepare_binprm+0x108/0x120
[    0.715000] [<80083b14>] do_execve+0x104/0x29c
[    0.715000] [<80008534>] sys_execve+0x4c/0x78
[    0.715000] [<8000d1c4>] stack_done+0x20/0x3c
[    0.715000]
[    0.715000]
[    0.715000] Code: 00661821  02c51023  03c21021 <90520000> 03d61821  26d60001
 0803e04c  a0720000  8fa50050
[    0.715000] Disabling lock debugging due to kernel taint
[    0.944000] Kernel panic - not syncing: Attempted to kill init!

Now I don't understand where is the problem, firmware or hardware?
When I tried firmware UniFi 3.2.10.2886 it had a success ping but I could not enter via ssh or winscp. Window simply closed without cause after entering of password.
Thank for your mtdblocks. I'll try its.

New Member
Posts: 19
Registered: ‎08-27-2013

Re: HOWTO: Unbrick your UniFi AP

I have tried your mtdparts. I rewrote all of them.

 

tftp 83000000 mtdblock0
erase 0x9f000000 +0x40000
cp.b 0x83000000 0x9f000000 0x40000

tftp 83000000 mtdblock1
erase 0x9f040000 +0x10000
cp.b 0x83000000 0x9f040000 0x10000

tftp 83000000 mtdblock2
erase 0x9f050000 +0x100000
cp.b 0x83000000 0x9f050000 0x100000

tftp 83000000 mtdblock3
erase 0x9f150000 +0x660000
cp.b 0x83000000 0x9f150000 0x660000

tftp 83000000 mtdblock4
erase 0x9f7b0000 +0x40000
cp.b 0x83000000 0x9f7b0000 0x40000

tftp 83000000 mtdblock5
erase 0x9f7f0000 +0x10000
cp.b 0x83000000 0x9f7f0000 0x10000

I getting permanent reloading.

Please press Enter to activate this console. [   37.964000] CPU 0 Unable to hand
le kernel paging request at virtual address c00696ac, epc == 800fe7c0, ra == 800
fe748
[   37.974000] Oops[#1]:
[   37.974000] Cpu 0
[   37.974000] $ 0   : 00000000 80290000 c00696ac fffdac5c
[   37.974000] $ 4   : 00020000 0001ac5c fffe0000 0580f41f
[   37.974000] $ 8   : 00002000 ffffffbf 00000041 55bf39d6
[   37.974000] $12   : 802572a8 118df4a4 838db8e0 00000001
[   37.974000] $16   : 00000000 00000003 00000010 c0b21644
[   37.974000] $20   : ffffffff 00000000 0001a308 c0b21000
[   37.974000] $24   : 00000002 800167b8
[   37.974000] $28   : 82e1a000 82e1ba98 c006a000 800fe748
[   37.974000] Hi    : 00000008
[   37.974000] Lo    : d22e7b80
[   37.974000] epc   : 800fe7c0 unlzma+0xc48/0xdd8
[   37.974000]     Tainted: P
[   37.974000] ra    : 800fe748 unlzma+0xbd0/0xdd8
[   37.974000] Status: 1000ff03    KERNEL EXL IE
[   37.974000] Cause : 00800008
[   37.974000] BadVA : c00696ac
[   37.974000] PrId  : 00019374 (MIPS 24Kc)
[   37.974000] Modules linked in: ebt_vlan ebt_stp ebt_snat ebt_redirect ebt_pkt
type ebt_mark_m ebt_mark ebt_log ebt_limit ebt_ip ebt_dnat ebt_arp ebt_among ebt
able_nat ebtable_filter ebtable_broute ebtables x_tables ath_pktlog(P) umac ath_
dev(P) ath_rate_atheros(P) ath_dfs(P) ath_hal(P) asf(P) adf athrs_gmac pktgen fu
se sd_mod scsi_mod sha1_generic michael_mic md5 hmac des_generic arc4 aes_generi
c ubnt_common(P) ecb cbc gpiodev(P) ubnthal(P)
[   37.974000] Process init (pid: 1054, threadinfo=82e1a000, task=83816038, tls=
00000000)
[   37.974000] Stack : 8344ab88 00000648 800a6fb0 83402d64 00000004 00000021 000
0001d 6c000200
[   37.974000]         00000000 000001e7 c0000000 800fd9cc c0050cf6 c0048000 c00
522f2 0000a2f2
[   37.974000]         017bf237 02e02183 02a0d29c 00000001 0001ac5c 0000000a 000
00010 000000c6
[   37.974000]         000000ac 00000000 00000000 c0048000 00000003 00000003 000
00003 83816038
[   37.974000]         802a0000 82d7d8a8 00000000 00000000 0000002a c00522f2 000
0002a 838e3dc0
[   37.974000]         ...
[   37.974000] Call Trace:
[   37.974000] [<800fe7c0>] unlzma+0xc48/0xdd8
[   37.974000] [<800d0888>] lzma_uncompress+0x128/0x26c
[   37.974000] [<800cc93c>] squashfs_read_data+0x484/0x690
[   37.974000] [<800cd020>] squashfs_cache_get+0x1cc/0x310
[   37.974000] [<800ce300>] squashfs_readpage+0x5e0/0x8b0
[   37.974000] [<80065670>] __do_page_cache_readahead+0x1c0/0x220
[   37.974000] [<800656f8>] ra_submit+0x28/0x34
[   37.974000] [<80065c4c>] page_cache_sync_readahead+0x5c/0x68
[   37.974000] [<8005e674>] generic_file_aio_read+0x2ac/0x780
[   37.974000] [<800836e0>] do_sync_read+0xd4/0x13c
[   37.974000] [<80088564>] kernel_read+0x2c/0x40
[   37.974000] [<80088680>] prepare_binprm+0x108/0x120
[   37.974000] [<80089564>] do_execve+0x104/0x298
[   37.974000] [<8000f7b8>] sys_execve+0x4c/0x78
[   37.974000] [<80004144>] stack_done+0x20/0x3c
[   37.974000]
[   37.974000]
[   37.974000] Code: 00661821  02c51023  03c21021 <90520000> 03d61821  26d60001
 0803fa0c  a0720000  8fa50050
[   38.235000] Fatal exception: panic in 5 seconds
[   43.240000] Kernel panic - not syncing: Fatal exception
[   43.245000] Rebooting in 3 seconds..

What can be the reason it?

 

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: HOWTO: Unbrick your UniFi AP

model UAP are you trying to reflash ?

New Member
Posts: 19
Registered: ‎08-27-2013

Re: HOWTO: Unbrick your UniFi AP

Model is UniFi AP.

1235K-DC9FDB24EBEB

 

Its Fullflash is included here.

Attachment
New Member
Posts: 12
Registered: ‎12-11-2013

Re: HOWTO: Unbrick your UniFi AP

hi mike i am stuck with 5 UAP-LR not booting i have tried TFTP but the AP is not getting IP from DHCP or to its default ...... can you help me with TTL command to restore my AP

New Member
Posts: 12
Registered: ‎12-11-2013

Re: HOWTO: Unbrick your UniFi AP

can you please send me the TTL command to restore UAP-LR 

New Member
Posts: 19
Registered: ‎08-27-2013

Re: HOWTO: Unbrick your UniFi AP

Flash chip on the UniFi AP is damaged. One sector is not good or maybe more. It's new chip from aliexpress. Bad quality and I lost a lot of time for understanding this.

New Member
Posts: 4
Registered: ‎08-18-2016

Re: HOWTO: Unbrick your UniFi AP

I am sorry for my English. Self Airgrid M5 HP, but the reset button can not get to the TFTP. I am trying to instructions from the first page, but I get only here

terminal.jpg

New Member
Posts: 19
Registered: ‎08-27-2013

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

Was you trying to push any key since "Hit any key to stop autoboot" ?

New Member
Posts: 4
Registered: ‎08-18-2016

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

When I press any key

terminal1.jpg

Previously, when you try to log displayed this

error.jpg

Today, my friend brought the antenna, I don't know what he did, but now see this

error1.jpg

New Member
Posts: 19
Registered: ‎08-27-2013

Re: HOWTO: Unbrick your UniFi AP

snoop69

I think you have the damaged flash or data mtdblock5 was deleted somehow. If it is the second reason you can use command urescue -f and via TFTP2.exe load the firmware XM-v5.5.build12536.bin .

But this firmware can't be updated because you will get counterfeit again.

New Member
Posts: 4
Registered: ‎08-18-2016

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

Firmware is loaded, but again it stopped at Booting. Disconnected the cable, again connect and have the opportunity to set the antenna :-) When she was still in operation, remember that she firmware v5.6.2 (XM)

 

terminal2.jpg

New Member
Posts: 19
Registered: ‎08-27-2013

Re: HOWTO: Unbrick your UniFi AP

snoop69

 

There is "Board not calibrated".

You can overwrite all fullflash (mtdblocks). And when you will be do this see onto comparing data with cmp.b . May be flash-chip is crashed. I don't know how to save original image from flash-chip via U-Boot. After rewriting fullflash there will be working only firmware v.5.5. But if you have such decision then take fullflash from similar AirGrig and rewrite it. If you share photo your AirGrid I can share mtdblocks from my AirGrid.

New Member
Posts: 4
Registered: ‎08-18-2016

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

Frankly I do not understand what is mtdblocks cmp.b Mad2 and I am glad that at least it works Yesnod Without your advice I would antenna failed to operational status.Hurray Internet provider wanted to blow up the antenna, so I let her.

Under the tab Wireless - line SSID not find any network

Site Survey.jpg

 

How is it possible that two visually identical antennas have different web interface and firmware? My antenna has a bigger screen.

My antenna on the roof AirGrid M5 27dBi

My.jpg

 

Here solved AirGrid M5 23dBi

Jirka.jpg

New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

Hi all..Im new here

 

My ubnt is unify ap (not LR).. My initial problem is that I suddenly cant adopt my unify AP.

Cant ping and cant tftp it also. I open the case and connect usb ttl to it.

I also experienced console stop at "booting"..light is solid orange and nothing happened as 

I cant enter tftp mode using urescue -f, It just stay on ar7240> ....

I have to use physical button to enter tftp mode, the light show tftp mode (green, orange, off in 14 seconds or so) >> this result in tftp mode in console but I cant still ping it or transfer bin file to it using tftp.

 

I assume that my LAN is burnt (at least) ? ....but I am open to any suggestion...

 

mtest result shows nothing..no error I assume

 

stop at bootingstop at bootingcom42.jpg

 

 

 

 

 

New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

Hi all... Im new here.. Im sorry if I double post.. I think I have posted before but its gone....

 

I also experienced stop at booting ...Starting kernel ...Booting .... than stop as @snoop69

My initial problem is that I cant adopt Unify AP (non LR). cant ping it, ip shows 1.20 but cant do anything to it.

Tftp using button provide tftp mode (urescue -f from usb ttl not working) but it still cant do anything.

Cant ping it and cant transfer bin to it.

I think my LAN is busted....BUT I am open to suggestion...

 

 

 

com42.jpg
com42_2.jpg
Reply