Reply
New Member
Posts: 10
Registered: ‎11-03-2010
Kudos: 1

NS Loco M5 inaccessible after hard-reset

I have my NS Loco M5 (firmware XM-v5.2.1.build6359) in Wireless Mode/Network Mode = Station/Router, locked to AP MAC -- working Internet connection.
A week ago I have tried to create a simple (2-line) rc.poststart script:

#!/bin/sh
tcpdump -i eth0 -w /tmp/login.pcap -s 1500 {expression}

I followed skyhook's steps 1) - 5) from http://dottv2.tv/forum/showthread.php?t=9755&page=2 -- but I didn't realize that this tcpdump command doesn't run in background (I forgot '&' at the end of line), so after reboot it probably blocked my NS -- it didn't respond to ping, no Internet connection.

So I powered the NS off, pressed the reset button, powered it on and held the button pressed for about 2 sec. Signal LEDs were alternatively blinking (1&&3 || 2&&4), after 5 minutes I powered it off and then on again.
Then a strange situation occured: the Internet connection was working, but my NS was inaccessible from LAN -- I have tried via browser (Opera 10.63) and SSH (PuTTY 0.60).
Furthermore, I tried to access my NS through WLAN (my friend has also NS Loco M5 with the same configuration except WLAN IP address) -- I have tried port 80 (telnet 10.8.13.132 80) and SSH (ssh admin@10.8.13.132). However, the NS does respond to ping requests -- from LAN as well as from WLAN.

This state remains until now (working Internet connection & inaccessible NS), and I have tried all these things (after each try I have waited at least 5 minutes, but the NS remained inaccessible):
  • I have reset the NS again, but held the reset button for 30 sec.
    while powering it on
  • I have flashed firmware (the same version) via WinAgents tftp 1.4
    -- because WisTech suggested it here:
    http://www.ubnt.com/forum/showthread.php?t=19613
  • I have made a short 10-15-10sec reset -- see Dave.D's post:
    https://ubnt.com/forum/showthread.php?t=15802


    I was thinking about trying alternative firmware, but it seems to me kind of risky, and I don't know if there are any stable alternative firmwares for Nanostation Loco M5...

    You can find more detailed report (with config and logs attached) in my ticket WBFB-83186 on ubnt.supportcenterpro.com.

    Thanks in advance,
    M. Rehak
  • Previous Employee
    Posts: 9,171
    Registered: ‎08-17-2007
    Kudos: 24

    Re: NS Loco M5 inaccessible after hard-reset

    I have my NS Loco M5 (firmware XM-v5.2.1.build6359) in Wireless Mode/Network Mode = Station/Router, locked to AP MAC -- working Internet connection.
    A week ago I have tried to create a simple (2-line) rc.poststart script:

    #!/bin/sh
    tcpdump -i eth0 -w /tmp/login.pcap -s 1500 {expression}

    I followed skyhook's steps 1) - 5) from http://dottv2.tv/forum/showthread.php?t=9755&page=2 -- but I didn't realize that this tcpdump command doesn't run in background (I forgot '&' at the end of line), so after reboot it probably blocked my NS -- it didn't respond to ping, no Internet connection.

    So I powered the NS off, pressed the reset button, powered it on and held the button pressed for about 2 sec. Signal LEDs were alternatively blinking (1&&3 || 2&&4), after 5 minutes I powered it off and then on again.
    Then a strange situation occured: the Internet connection was working, but my NS was inaccessible from LAN -- I have tried via browser (Opera 10.63) and SSH (PuTTY 0.60).
    Furthermore, I tried to access my NS through WLAN (my friend has also NS Loco M5 with the same configuration except WLAN IP address) -- I have tried port 80 (telnet 10.8.13.132 80) and SSH (ssh admin@10.8.13.132). However, the NS does respond to ping requests -- from LAN as well as from WLAN.

    This state remains until now (working Internet connection & inaccessible NS), and I have tried all these things (after each try I have waited at least 5 minutes, but the NS remained inaccessible):
  • I have reset the NS again, but held the reset button for 30 sec.
    while powering it on
  • I have flashed firmware (the same version) via WinAgents tftp 1.4
    -- because WisTech suggested it here:
    http://www.ubnt.com/forum/showthread.php?t=19613
  • I have made a short 10-15-10sec reset -- see Dave.D's post:
    https://ubnt.com/forum/showthread.php?t=15802


    I was thinking about trying alternative firmware, but it seems to me kind of risky, and I don't know if there are any stable alternative firmwares for Nanostation Loco M5...

    You can find more detailed report (with config and logs attached) in my ticket WBFB-83186 on ubnt.supportcenterpro.com.

    Thanks in advance,
    M. Rehak


  • Hello,

    You have tried to TFTP firmware to the device while its alternating blinking on the LED's correct? Did the script corrupt the bootloader? Can you access the unit via the serial port?

    Thanks,
    New Member
    Posts: 10
    Registered: ‎11-03-2010
    Kudos: 1

    Re: NS Loco M5 inaccessible after hard-reset

    Hello,

    You have tried to TFTP firmware to the device while its alternating blinking on the LED's correct? Did the script corrupt the bootloader? Can you access the unit via the serial port?

    Thanks,



    Yes, I have tried (successfully, see WinAgents TFTP log below) to TFTP latest stable firmware to the NS M5 Loco while its alternating blinking on LEDs.
    The rc.poststart script just didn't finish (nor did it run in background), so the AP became stuck after reboot (that's my guess, because that was the only thing I have changed), therefore I have done all this resetting and firmware-flashing stuff.
    I have not opened the unit yet, I did not know there is a serial port inside -- I have just found an info about it -- nanostation serial. Is there a how-to on serial connection for NS M5 Loco ? I already have a serial-to-USB cable which I successfully used to access ASUS WL-500gP (its serial port also uses 3.3V, see WL-500gP serial). So can I use this cable to my NS Loco M5 ?

    Thanks.
    ________________________________________________________________
    WinAgents TFTP log:

    D:\!Shared\!Archiv\DRIVERs\Ubiquiti NS Loco M5\firmware>tftp -i 192.168.1.20 PUT XM-v5.2.1.build6359.bin

    WinAgents TFTP Client version 1.4 Copyright (c)2004-2007 by Tandem Systems,Ltd.
    http://www.winagents.com - Software for network administrators

    Transfering file XM-v5.2.1.build6359.bin to server in octet mode...
    File XM-v5.2.1.build6359.bin was transferred successfully.
    6424566 bytes transfered for 28 seconds, 229448 bytes/second
    New Member
    Posts: 10
    Registered: ‎11-03-2010
    Kudos: 1

    serial connection successful

    I have just managed to connect to my Nanostation Loco M5, using my FTDI-based USB-to-serial cable and pinout found at openwrt wiki - nanostation -- it is very similar to NS5 picture (from left to right: +3.3V | RX | -- | TX | GND), but the COM speed is 115200 and params are 8/N/1.

    It gave me this nice output, I pressed a key to interrupt, then typed "?" for help, and finally "boot" to boot default :

    U-Boot 1.1.4.2 (Jul 13 2010 - 20:06:30)

    Board: Ubiquiti Networks XM board (rev 0.0 e0a5)
    DRAM: 32 MB
    Flash: 8 MB
    Net: eth0, eth1
    Hit any key to stop autoboot: 0
    ar7240> ?
    autoscr - run script from memory
    ? - alias for 'help'
    base - print or set address offset
    boot - boot default, i.e., run 'bootcmd'
    bootd - boot default, i.e., run 'bootcmd'
    bootelf - Boot from an ELF image in memory
    bootm - boot application image from memory
    cmp - memory compare
    cp - memory copy
    crc32 - checksum calculation
    echo - echo args to console
    erase - erase FLASH memory
    flinfo - print FLASH memory information
    go - start application at address 'addr'
    help - print online help
    iminfo - print header information for application image
    imls - list all images found in flash
    loop - infinite loop on address range
    md - memory display
    mii - MII utility commands
    mm - memory modify (auto-incrementing)
    mtdparts- define flash/nand partitions
    mtest - simple RAM test
    mw - memory write (fill)
    nm - memory modify (constant address)
    ping - send ICMP ECHO_REQUEST to network host
    printenv- print environment variables
    protect - enable or disable FLASH write protection
    reset - Perform RESET of the CPU
    run - run commands in an environment variable
    saveenv - save environment variables to persistent storage
    setenv - set environment variables
    sleep - delay execution for some time
    tftpboot- boot image via network using TFTP protocol
    urescue - start TFTP server and wait for firmware
    version - print monitor version
    ar7240> boot
    ## Booting image at 9f050000 ...
    Image Name: MIPS Ubiquiti Linux-2.6.15-5.2
    Created: 2010-09-13 15:04:16 UTC
    Image Type: MIPS Linux Kernel Image (lzma compressed)
    Data Size: 754806 Bytes = 737.1 kB
    Load Address: 80002000
    Entry Point: 80002000
    Verifying Checksum ... OK
    Uncompressing Kernel Image ... OK

    Starting kernel ...

    Booting...
    ...mounts done
    ...filesystem init done
    ...base ok
    ...update ok
    ...symlinks ok
    ...httpd ok
    ...detect ok
    ...running /sbin/init


    The question is, what now ? How can I reset this unit to factory defaults, or just erase the rc.poststart script (if it's still there) ?

    Thanks
    Previous Employee
    Posts: 9,171
    Registered: ‎08-17-2007
    Kudos: 24

    Re: NS Loco M5 inaccessible after hard-reset

    I have just managed to connect to my Nanostation Loco M5, using my FTDI-based USB-to-serial cable and pinout found at openwrt wiki - nanostation -- it is very similar to NS5 picture (from left to right: +3.3V | RX | -- | TX | GND), but the COM speed is 115200 and params are 8/N/1.

    It gave me this nice output, I pressed a key to interrupt, then typed "?" for help, and finally "boot" to boot default :

    U-Boot 1.1.4.2 (Jul 13 2010 - 20:06:30)

    Board: Ubiquiti Networks XM board (rev 0.0 e0a5)
    DRAM: 32 MB
    Flash: 8 MB
    Net: eth0, eth1
    Hit any key to stop autoboot: 0
    ar7240> ?
    autoscr - run script from memory
    ? - alias for 'help'
    base - print or set address offset
    boot - boot default, i.e., run 'bootcmd'
    bootd - boot default, i.e., run 'bootcmd'
    bootelf - Boot from an ELF image in memory
    bootm - boot application image from memory
    cmp - memory compare
    cp - memory copy
    crc32 - checksum calculation
    echo - echo args to console
    erase - erase FLASH memory
    flinfo - print FLASH memory information
    go - start application at address 'addr'
    help - print online help
    iminfo - print header information for application image
    imls - list all images found in flash
    loop - infinite loop on address range
    md - memory display
    mii - MII utility commands
    mm - memory modify (auto-incrementing)
    mtdparts- define flash/nand partitions
    mtest - simple RAM test
    mw - memory write (fill)
    nm - memory modify (constant address)
    ping - send ICMP ECHO_REQUEST to network host
    printenv- print environment variables
    protect - enable or disable FLASH write protection
    reset - Perform RESET of the CPU
    run - run commands in an environment variable
    saveenv - save environment variables to persistent storage
    setenv - set environment variables
    sleep - delay execution for some time
    tftpboot- boot image via network using TFTP protocol
    urescue - start TFTP server and wait for firmware
    version - print monitor version
    ar7240> boot
    ## Booting image at 9f050000 ...
    Image Name: MIPS Ubiquiti Linux-2.6.15-5.2
    Created: 2010-09-13 15:04:16 UTC
    Image Type: MIPS Linux Kernel Image (lzma compressed)
    Data Size: 754806 Bytes = 737.1 kB
    Load Address: 80002000
    Entry Point: 80002000
    Verifying Checksum ... OK
    Uncompressing Kernel Image ... OK

    Starting kernel ...

    Booting...
    ...mounts done
    ...filesystem init done
    ...base ok
    ...update ok
    ...symlinks ok
    ...httpd ok
    ...detect ok
    ...running /sbin/init


    The question is, what now ? How can I reset this unit to factory defaults, or just erase the rc.poststart script (if it's still there) ?

    Thanks


    Hello,

    Its just hanging on the /sbin/init ? If so the flash may be corrupted.

    Thanks,
    New Member
    Posts: 10
    Registered: ‎11-03-2010
    Kudos: 1

    no corrupt firmware

    Hello,

    Its just hanging on the /sbin/init ? If so the flash may be corrupted.

    Thanks,


    I have just checked MD5 sum of my firmware:
    fa130fab6d9281c1837b34fd98692a19
    and it is the same as on your download page.

    Now I have restarted my NS Loco M5 with serial cable attached and sufficient signal strength. The connection to Internet is working, but the serial console is frozen at line
    ...running /sbin/init
    for 12 minutes now. Shall I press some key combination or just wait for something ?
    Is the serial console more powerful if the NS Loco is after hard-reset (in TFTP server mode) ? Or what should I do (and when) in serial console in order to reset the unit to factory settings ?

    Thanks.
    New Member
    Posts: 10
    Registered: ‎11-03-2010
    Kudos: 1

    Broken NVRAM found, recovering it -- is this the cause ?

    I have just tried alternative firmware -- DD-WRT (I have found image for NS Loco M5), and this is the serial console output during firmware upgrade (I followed the steps in Firmware_Recovery):

    see attachment ns_locoM5_serial.101106-01.txt


    Note this line in log:
     Broken NVRAM found, recovering it (Magic FFFFFFFF)

    I guess this might be the cause of Ubiquiti's firmware updater malfunctioning -- the firmware updater tries to erase NVRAM, but it finds out it is broken, so updater leaves it unchanged (that would explain why my configuration is always preserved after firmware update, causing my Internet connection to work as if no reset has occurred).

    I could not connect to the unit neither via telnet nor via ssh (the ports are not open), but I was able to get into web interface and set admin's username/password. Then I tried to flash the original firmware, and this is the serial console output during firmware upgrade (again, I followed the steps in Firmware_Recovery):

    see attachment ns_locoM5_serial.101106-02.txt


    Thanks.
    Highlighted
    New Member
    Posts: 10
    Registered: ‎11-03-2010
    Kudos: 1

    Problem SOLVED :-)

    Hello guys,
    a while ago I was able to solve this problem, and it might be useful to other users.

    Problem symptoms

  • Inaccessible NS Loco M5 after reboot
  • Inaccessible NS Loco M5 after hard-reset (firmware upgrade won't change anything) -- except pings, but previous configuration might work (e.g. in station/router mode, it will associate with configured AP and route Internet traffic to your LAN). If you could connect to the unit via serial port, you would see the booting freezes at line: ...running /sbin/init


    Problem cause

  • caused by misconfiguration, in my case never-ending rc.poststart script
  • caused by misconfiguration (firmware upgrade won't repair MTD partition "cfg")


    Solution

    You will need to connect unit's serial port via RS3232 cable (not RS232, this port works with 3.3V). Also you will need some soft like HyperTerminal (in windows) or PuTTY capable of serial communication.

  • set (on your PC) your IP address/mask to 192.168.1.254/255.255.255.0
  • connect to your unit using RS3232 cable -- see pinout at openwrt wiki - nanostation, it's very similar to picture Nano 5 Loco, but the header is located next to LAN connector
  • use some terminal client (PuTTY is good) to connect to the unit, using speed 115200, other params are 8/N/1, XON/XOFF
  • power-off & power-on the unit with terminal client connected
  • press any key when you see the line
    Hit any key to stop autoboot:  1

  • now enter: mtd
    You should get something like this:

    device nor0 , # parts = 6
    #: name size offset mask_flags
    0: u-boot 0x00040000 0x00000000 0
    1: u-boot-env 0x00010000 0x00040000 0
    2: kernel 0x00100000 0x00050000 0
    3: rootfs 0x00660000 0x00150000 0
    4: cfg 0x00040000 0x007b0000 0
    5: EEPROM 0x00010000 0x007f0000 0

    active partition: nor0,0 - (u-boot) 0x00040000 @ 0x00000000

    defaults:
    mtdids : nor0=ar7240-nor0
    mtdparts: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)

  • write down the cfg partition offset and size (let's call them cfg_offset and cfg_size), and also kernel partition offset (let's call it kernel_offset)
  • now enter: pri
    You should get something like this:

    bootdelay=1
    baudrate=115200
    ethaddr=00:15:6d:0d:00:00
    serverip=192.168.1.254
    mtdids=nor0=ar7240-nor0
    ethact=eth0
    mtdparts=mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)
    bootcmd=bootm 0x9f050000
    bootargs=console=ttyS0,115200 root=31:03 rootfstype=squashfs init=/init
    ipaddr=192.168.1.20
    stdin=serial
    stdout=serial
    stderr=serial
    partition=nor0,0
    mtddevnum=0
    mtddevname=u-boot

  • write down the address from line: bootcmd=bootm bootcmd_address,
    and compute following: bootcmd_address - kernel_offset + cfg_offset
    You will probably get 0x9f7b0000 -- let's call it cfg_absolute_address
  • now comes the critical part -- erasing the cfg partition, enter: era cfg_absolute_address +cfg_size
    You should get:

    .... done
    Erased 4 sectors

    But if you get some write-protection error, don't worry, enter: pro off cfg_absolute_address +cfg_size
    Then try to erase, finally enter: pro on cfg_absolute_address +cfg_size
    You should get something like this:

    ar7240> pro off 0x9f7b0000 +0x00040000
    Un-Protected 4 sectors
    ar7240> era 0x9f7b0000 +0x00040000
    .... done
    Erased 4 sectors
    ar7240> pro on 0x9f7b0000 +0x00040000
    Protected 4 sectors

  • it's time to reset the unit, enter: res
  • stop autoboot (see step (5))
  • see for yourself that the cfg partition was erased, enter: md cfg_absolute_address 0x400
    You should get memory dump with nothing but ffffffff's.
    Do the same for address (cfg_absolute_address + 0x20000), you should get the same result.
  • now is the time for firmware upgrade, enter: ur
    You should get something like this:

    Setting default IP 192.168.1.20
    Starting TFTP server...
    Using eth0 (192.168.1.20), address: 0x81000000
    Waiting for connection: |

  • after you see the line
    Waiting for connection |

    tftp desired firmware (you may use the current one) to the unit -- I recommend default firmware which you can download at http://ubnt.com/support/downloads, in command line it goes like this:
    tftp -i 192.168.1.20 PUT desired_firmware.bin

  • watch the serial console, you should see something like this:

    Receiving file from 192.168.1.254:1774
    Received 6424566 bytes
    Firmware Version: XM.ar7240.v5.2.1.6359.100913.1803
    Setting U-Boot environment variables
    Un-Protected 1 sectors
    Erasing Flash.... done
    Erased 1 sectors
    Writing to Flash... done
    Protected 1 sectors
    Will not overwrite u-boot partition! Skipped.
    Copying partition 'kernel' to flash memory:
    erasing range 0x9F050000..0x9F10FFFF: ............ done
    Erased 12 sectors
    writing to address 0x9f050000, length 0x000c0000 ...
    Copying partition 'rootfs' to flash memory:
    erasing range 0x9F150000..0x9F68FFFF: .................................................................................... done
    Erased 84 sectors
    writing to address 0x9f150000, length 0x00540000 ...

    Firmware update complete.

    Resetting...

    U-Boot 1.1.4.2 (Jul 13 2010 - 20:06:30)

    Board: Ubiquiti Networks XM board (rev 0.0 e0a5)
    DRAM: 32 MB
    Flash: 8 MB
    Net: eth0, eth1
    Hit any key to stop autoboot: 0
    ## Booting image at 9f050000 ...
    Image Name: MIPS Ubiquiti Linux-2.6.15-5.2
    Created: 2010-09-13 15:04:16 UTC
    Image Type: MIPS Linux Kernel Image (lzma compressed)
    Data Size: 754806 Bytes = 737.1 kB
    Load Address: 80002000
    Entry Point: 80002000
    Verifying Checksum ... OK
    Uncompressing Kernel Image ... OK

    Starting kernel ...

    Booting...
    ...mounts done
    ...filesystem init done
    ...base ok
    ...update ok
    ...symlinks ok
    ...httpd ok
    ...detect ok
    ...running /sbin/init
    Public key portion is:
    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgwCrbkQ/w+CYCu1lmHW1F5VaTrPBUuSM7mrDImG2EmHFSsSd3vFlb0ECOc7HgIKn3cXDENO7A4Mn+8lUgWWAeVuarFdNMVxyMJCzHuv35PNcTze7vSHvAlKmXSq9DAmkeCUaetJG6xzNxNEW8r8VnguZGtkvHHZcaerF3wAamoB6HuUt ubnt@UBNT
    Fingerprint: md5 59:ba:d3:ce:b7:f6:02:90:5d:60:c9:7a:20:d3:59:d4
    Public key portion is:
    ssh-dss AAAAB3NzaC1kc3MAAACBAP38EHNrty/LkgNTslN5UWpfWSRiSbk9Yct0SDwWUwRUjR60PjGY8j7NBumDnHiuL07u/zB0ECbripwYYgAOE44P3WZUfAKBfLG/ylfjY8Uld6pb+UuwZX/V2vZW7kbuiZFJjyLbTtkaIpI+1Fb3kGMH+AMhuMHMFwscD69tm0HJAAAAFQCTgJHDIoiWdtW+RSIHv7LRWkuugQAAAIBJBgq2EPyRtlYfmPAj8L6T0nMGmv9lqfS5/zX6P8SUd7lR9Kxuj0jD/F8G5indz0/Eaqhyj23QVKKlnJqaNrdzamQLH8gayjk4jI747Q+CqjILZ76+5dJf2opZ/T7FvhhJ+hvsB7KB/Gutre1gbgU8biIxBLtDHZgWuSK9cyTxvwAAAIAabarDeET2sjnbDu/+H0wrNM91TLAARxo2Sgu5Qer0rPZqkTlTq16mYcKFMX/RuTY8AgtW8S+495ja+SmiEX5cv02QUgGtT47fE2bOPS5rroEA1Yy0tHVvq5bERpGCn/TvTSE0bhSBsqE/eZuVTZXncmoc2aJ8cHnn8R7TitG0sg== ubnt@UBNT
    Fingerprint: md5 a7:3f:1f:9a:aa:da:13:06:07:d3:f6:2d:c7:f3:66:b5

    Please press Enter to activate this console.

  • The firmware upgrade process should take max. 7 minutes. After this time (or sooner) you should be able to connect to your unit using either web-interface (192.168.1.20:80) or SSH (192.168.1.20:22).
    Username/password is ubnt/ubnt.

    If this is not enough, see the attached log from serial console (erase_cfg,upgrade_fw.txt), hope this helps.
  • New Member
    Posts: 10
    Registered: ‎11-03-2010
    Kudos: 1

    NS Loco M5 - serial port pinout

    Here is the pinout of NS Loco M5 serial port (lower left corner).
    New Member
    Posts: 10
    Registered: ‎11-03-2010
    Kudos: 1

    Automation suggested

    I strongly suggest that this process of erasing (or replacing with default content) MTD partition "cfg" will be automated as:

    • action fired by pressing the reset button on the unit in the exact moment during boot time by using e.g. recvudp -- see un-brick a WRT54GL, or
    • a form of binary image (like firmware updates are), which will be flashed to the MTD partition "cfg" and will not affect other partitions.


    I personally prefer the first option -- in this manner you could create a timeout-menu (with sub-menus) and include other useful boot options, like the failsafe mode (openwrt whiterussian has it). The only additional tool needed would be recvudp tool which will display the UDP output from the unit.

    Thanks.
    Established Member
    Posts: 1,727
    Registered: ‎05-20-2008
    Kudos: 483
    Solutions: 6

    Re: NS Loco M5 inaccessible after hard-reset

    @mrehak
    I am trying to access the Nano M series devices via serial but I couldnt make it.
    Could you please tell me the exact model of your FTDI cable ?
    Or does anyone know any other cable model that I can purchase or make ?
    New Member
    Posts: 9
    Registered: ‎12-23-2010

    Re: NS Loco M5 inaccessible after hard-reset

    Hello mrehak, I have the same problem but I'm trying to recover with your second suggestion (a firmware that 'cleans' the cfg partition). At last I could fix it.
    Thanks
    Ubiquiti Employee
    Posts: 484
    Registered: ‎08-28-2007
    Kudos: 82
    Solutions: 8

    Re: NS Loco M5 inaccessible after hard-reset

    Hi guys.

    I see that there is big thread so can help there how to reset 'cfg' in human form without much hacking.

    1. If device boots to normal state but you don't know IP or password to access it then
    press reset button (keep it pressed) for more than 8 seconds (some older fw requires > 16 seconds). You will see all LEDs off/on/off this will be a sing that device is rebooting after reset to defaults. So there is a time to release reset button.
    Note: boot will take more time (extra 20seconds) after reset to defaults as RSA/DSS Public keys take time to generate on first boot.

    2. If device hangs in init state (usually because of invalid users script (aka rc.*) in /etc/persistent/ directory) and does not boot to normal state then
    a) power off the device
    b) press reset button
    c) power on the device
    d) keep reset button pressed for more than 8 seconds (some older fw requires > 16 seconds)
    e) LEDs will switch on one by one till all LEDs will switched on (device is going to recovery mode)
    f) each second LED will switch on/off simultaneously (device ready to recovery procedure and 'cfg' reset)
    g) release reset button
    h) upload firmware via TFTP to the device (usually recovery IP is 192.168.1.20)
    After fw is uploaded successfully the 'cfg' partition will be reset as well.
    Note: if reset button will be hold for less than 8 seconds then no 'cfg' partition clearance be done.

    There are at least 3 other way how to clear 'cfg' partition but these 2 above are the simplest.

    Also note that all steps are for original UBNT firmwares and original UBNT boot loaders.
    Ubiquiti Networks, Inc.
    System programmer
    Emerging Member
    Posts: 63
    Registered: ‎04-20-2008
    Kudos: 1

    Re: NS Loco M5 inaccessible after hard-reset

    Hi keba,
    Is there a way not to allow any form of configuration reset ?
    Ubiquiti Employee
    Posts: 484
    Registered: ‎08-28-2007
    Kudos: 82
    Solutions: 8

    Re: NS Loco M5 inaccessible after hard-reset

    Use SDK and change default system configuration, build fw and use it. So anyform of reset will reset to that configuration in any case.
    There is no other possibility right now to protect cfg as it is on writable area of flash.
    Ubiquiti Networks, Inc.
    System programmer
    Emerging Member
    Posts: 63
    Registered: ‎04-20-2008
    Kudos: 1

    Re: NS Loco M5 inaccessible after hard-reset

    OK I supposed that way. Does this help in case of TFTP recovery mode reset.
    Ex. put in recovery mode, and put another firmware via TFTP and after that, the "clever user" has full access to use the device.
    Ubiquiti Employee
    Posts: 484
    Registered: ‎08-28-2007
    Kudos: 82
    Solutions: 8

    Re: NS Loco M5 inaccessible after hard-reset

    OK I supposed that way. Does this help in case of TFTP recovery mode reset.
    Ex. put in recovery mode, and put another firmware via TFTP and after that, the "clever user" has full access to use the device.


    No way to protect from that as 'cfg', 'root.fs' and 'kernel' are writable right now. It means any "clever user" can change them.

    If there is a lock then there is a key. Just matter of time and knowledge.
    Ubiquiti Networks, Inc.
    System programmer
    Reply