This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionLast revisionBoth sides next revision | ||
playground:mission-log-template [2016/03/18 11:09] – [Step 8: Verify the jffs2 was flashed correctly] chrono | playground:mission-log-template [2016/04/19 19:52] – [Science > Superstition] chrono | ||
---|---|---|---|
Line 1: | Line 1: | ||
~~DRAFT~~ | ~~DRAFT~~ | ||
- | ====== Harder Soft-Unbricking a Ubiquiti Unifi UAP-Pro AP====== | ||
- | Image sideview | + | ====== Science > Superstition ====== |
- | After re-deploying | + | The Apollo-NG project has gained a lot of street/net credit and credibility over the years, so that ever more often people come out of nowhere, asking questions and looking for advice because they know that they won' |
- | ===== The Symptom ===== | + | Since we have nothing to sell in order to gain profit, we have no dog in anyone' |
- | < | + | In times where practically the whole body of society is trained from early days to lie, deceit and pretend to be accepted by social peers, to "make a career" |
- | U-Boot unifi-v1.2.3.74-ge597862a (Mar 14 2013 - 18:30:11) | + | |
- | Board: Ubiquiti Networks AR9344 board (e507-27.2122.0030.0030) | + | You don't longer believe in the devil (good), you don't longer believe (in) press/ |
- | DRAM: 128 MB | + | |
- | Flash: 16 MB | + | |
- | Net: | + | |
- | Hit any key to stop autoboot: | + | |
- | Scanning JFFS2 FS: .| | + | |
- | Unknown node type: e008 len 52 offset 0xf41eec | + | |
- | [...] | + | |
- | cant find .firewall.uci-mWgTyx�� | + | |
- | [...] | + | |
- | cant find .wireless.uci-HxpWh9 | + | |
- | cant find .network.uci-anmaB1 | + | |
- | ����������������������������������������������������������������������� | + | |
- | ����������������������������������������������������������������������� | + | |
- | ����������������������������������������������������������������������� | + | |
- | ������������������������������������������������������� | + | |
- | </ | + | |
- | It is still unclear what exactly causes this jffs2 corruption, but there have been at least three other reported cases and one directly confirmed by djs500, who found the draft-wip-template for this mission log on the net, had exactly | + | We're facing real problems |
- | ===== Solution 1 ===== | + | Luckily for us, ever more often, people like Edward Snowden come forward and help by establishing that what others declared " |
- | https:// | ||
- | |||
- | |||
- | Set a static IP on your PC's NIC from 192.168.1.0/ | ||
- | |||
- | Follow the steps to unbrick your UAP: | ||
- | - Set the IP on your PC to be able to access the bricked unit and prepare the firmware file. | ||
- | - On your PC, open your TFTP client and locate the firmware.bin file so you can start it later. Do not initiate the transfer. | ||
- | Using the Windows integrated TFTP client the command to prepare is: "tftp -i 192.168.1.20 PUT [path to file]\firmware.bin" | ||
- | Unplug the bricked unit. | ||
- | Plug the LAN connection of the PoE injector directly to your PC's NIC. | ||
- | Keep the UniFi AP's reset button depressed and plug in network/PoE in the unit. | ||
- | Keep the reset button depressed until you see the light cycling relatively fast through amber/ | ||
- | Engage the TFTP push command and wait. The device will write the firmware and it will reboot. | ||
- | If you wait too long to start the TFTP transfer, the push will not work as the device will stall. Please redo from step 3. | ||
- | To ensure all goes clean, after the device gets stable (blinking or steady amber LED), give it a reset: | ||
- | Remove power. Reconnect holding the reset button for ~7 seconds (green led will flash once) -> release reset button and wait for the device to stabilize again. | ||
- | After device is stabilized, power cycle it again, and you are good to go on adopting the device in the controller again. | ||
- | |||
- | <WRAP round alert> | ||
- | < | ||
- | Official UBNT solution didn't work at all | ||
- | </p> | ||
- | </ | ||
- | </ | ||
- | |||
- | This may be due to the fact that it expects a bricked UBNT firmware and NOT an OpenWRT installation. | ||
- | ===== Solution 2 ===== | ||
- | |||
- | Soft Unbrick via Serial using urescue and a tftp server was another method mentioned somewhere, but sadly it never really flashed anything and went staight to the reset in less than a second instead. It could never have written the complete firmware in this short time period and after testing: it didn' | ||
- | |||
- | < | ||
- | ar7240> urescue | ||
- | Setting default IP 192.168.1.20 | ||
- | Starting TFTP server... | ||
- | Using eth0 (192.168.1.20), | ||
- | Waiting for connection: - | ||
- | Receiving file from 192.168.1.254: | ||
- | Received 4683453 bytes | ||
- | Firmware Version: BZ.ar934x.v3.2.1.2601.140606.1622 | ||
- | Setting U-Boot environment variables | ||
- | Will not overwrite u-boot partition! Skipped. | ||
- | |||
- | Firmware update complete. | ||
- | |||
- | Resetting.. | ||
- | </ | ||
- | |||
- | <WRAP round alert> | ||
- | < | ||
- | Serial urescue didn't work at all | ||
- | </p> | ||
- | </ | ||
- | </ | ||
- | |||
- | ===== Solution 3 ===== | ||
- | |||
- | None of the above solutions worked with our OpenWRT UAP-Pro, so we had to grab one of the original jffs2 images from a live one with original UBNT firmware and use a tftp server to transfer that jffs2 image file to the AP and write the image by hand, which finally worked. | ||
- | |||
- | The following unbrick trace documents the 9 easy to follow steps codec, fpletz and I took to restore the UAP to its orginal UBNT firmware with default configuration (and default ubnt login) to be able to finally reinstall OpenWRT. | ||
- | |||
- | |||
- | ==== Step 1: Preparation ==== | ||
- | |||
- | <WRAP round download> | ||
- | **If you've lost your original firmware backup too, you can download the jffs2 image here: **\\ | ||
- | {{https:// | ||
- | </ | ||
- | |||
- | Just bunzip2 the downloaded jffs2.img.bz2 and put jffs2.img into your tftproot so that the AP can access it via LAN. If you don't know which tftp-server to pick, dnsmasq and atftp have been reliable alternatives and have a solid base of documentation and HOWTOs to get started out there. | ||
- | |||
- | In this setup dnsmasq was hosted on a laptop, eth0 IP 192.168.1.254 connected via LAN to the main port of the UAP-Pro. | ||
- | |||
- | ==== Step 2: Connect Serial Console ==== | ||
- | |||
- | image: ttl-serial-connection-info | ||
- | |||
- | ==== Step 3: Transfer jffs2 image to AP ==== | ||
- | |||
- | Power up the AP and press a key to enter u-boot menu, then transfer and load the original | ||
- | jffs2 image over tftp to the AP and store it in RAM, starting at memory address **0x83000000**: | ||
- | |||
- | < | ||
- | ar7240> tftp 83000000 jffs2.img | ||
- | </ | ||
- | |||
- | If the tftp server is reachable, the output should look like this: | ||
- | |||
- | < | ||
- | Using eth0 device | ||
- | TFTP from server 192.168.1.254; | ||
- | Filename ' | ||
- | Load address: 0x83000000 | ||
- | Loading: ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ################################################################# | ||
- | ############################# | ||
- | done | ||
- | Bytes transferred = 16121856 (f60000 hex) | ||
- | </ | ||
- | |||
- | The firmware image is stored in RAM now and occupies **0xf60000** bytes. Writing it from there to flash memory directly may fail when the target area has not been erased or if it is write-protected. Let's take care of that first. | ||
- | ==== Step 4: Reset partition table to defaults ==== | ||
- | |||
- | This gives you an overview of the partition table layout | ||
- | |||
- | < | ||
- | ar7240> mtdparts | ||
- | </ | ||
- | |||
- | < | ||
- | device nor0 < | ||
- | #: name size offset | ||
- | 0: u-boot | ||
- | 1: u-boot-env | ||
- | 2: jffs2 | ||
- | 3: cfg | ||
- | 4: EEPROM | ||
- | |||
- | active partition: nor0,0 - (u-boot) 0x00040000 @ 0x00000000 | ||
- | |||
- | defaults: | ||
- | mtdids | ||
- | mtdparts: mtdparts=ath-nor0: | ||
- | </ | ||
- | |||
- | Reset partition table to defaults with | ||
- | |||
- | < | ||
- | ar7240> mtdparts default | ||
- | </ | ||
- | |||
- | Save environment changes: | ||
- | |||
- | < | ||
- | ar7240> saveenv | ||
- | </ | ||
- | |||
- | < | ||
- | Saving Environment to Flash... | ||
- | Un-Protected 1 sectors | ||
- | Erasing Flash.... done | ||
- | Erased 1 sectors | ||
- | Writing to Flash... write addr: 9f040000 | ||
- | done | ||
- | Protected 1 sectors | ||
- | </ | ||
- | |||
- | ==== Step 5: Unlock Flash-Banks ==== | ||
- | |||
- | Now it is time to make sure that any write-protection is disabled: | ||
- | |||
- | < | ||
- | ar7240> protect off all | ||
- | </ | ||
- | < | ||
- | Un-Protect Flash Bank # 1 | ||
- | </ | ||
- | |||
- | ==== Step 6: Erase the corrupt jffs2 ==== | ||
- | |||
- | Figuring out the correct address and length was a bit difficult, uncertain, not well documented and took us quite a while, because we didn't want to brick it more by writing stuff somewhere other than we intended. Unfortunately, | ||
- | |||
- | < | ||
- | ar7240> erase 0x9f050000 +0xf60000 | ||
- | </ | ||
- | |||
- | < | ||
- | ...................................................................................................................................................................................................................................................... done | ||
- | Erased 246 sectors | ||
- | </ | ||
- | |||
- | ==== Step 7: Flash original jffs2 ==== | ||
- | |||
- | The cp command knows about flash memory areas and will automatically invoke the necessary flash programming algorithm when the target area is in flash memory. | ||
- | |||
- | < | ||
- | ar7240> cp.b 0x83000000 0x9f050000 0xf60000 | ||
- | </ | ||
- | |||
- | < | ||
- | Copy to Flash... write addr: 9f050000 | ||
- | done | ||
- | </ | ||
- | |||
- | ==== Step 8: Verify the jffs2 was flashed correctly ==== | ||
- | |||
- | Since we still have the jffs2 image stored in RAM, starting at address **0x83000000**, | ||
- | |||
- | < | ||
- | ar7240> cmp.b 0x83000000 0x9f050000 0xf60000 | ||
- | </ | ||
- | < | ||
- | Total of 16121856 bytes were the same | ||
- | </ | ||
- | |||
- | ==== Step 9: Reset, Reinstall OpenWRT and enjoy your revival work ==== | ||
- | < | ||
- | ar7240> reset | ||
- | </ | ||
- | |||
- | < | ||
- | Resetting... | ||
- | |||
- | U-Boot unifi-v1.2.3.74-ge597862a (Mar 14 2013 - 18:30:11) | ||
- | |||
- | Board: Ubiquiti Networks AR9344 board (e507-27.2122.0030.0030) | ||
- | DRAM: 128 MB | ||
- | Flash: 16 MB | ||
- | Net: eth0 | ||
- | Hit any key to stop autoboot: | ||
- | Scanning JFFS2 FS: . done. | ||
- | ## Booting image at 81000000 ... | ||
- | Image Name: MIPS Ubiquiti Linux-2.6.32.33 | ||
- | | ||
- | Image Type: MIPS Linux Kernel Image (lzma compressed) | ||
- | Data Size: 4450109 Bytes = 4.2 MB | ||
- | Load Address: 80002000 | ||
- | Entry Point: | ||
- | | ||
- | | ||
- | |||
- | Starting kernel ... | ||
- | </ | ||
{{tag> | {{tag> |