EAP600 Bricked

I have an Engenius EAP600 that was running an OpenWRT snapshot from August 2021. Not knowing about the Senao Failsafe issue, I pushed an update to the latest version through LUCI (not keeping settings). After waiting a while, it was still not accessible at 192.168.1.1 (or its old IP address).
There is a chance that we switched from POE to powered during the update.

Connecting with serial and watching it start up, I very quickly get the output below, but then it hangs indefinitely.

U-Boot 1.1.4 (Jan 10 2013 - 11:04:51)

EAP600 (ar934x) U-boot
DRAM:
sri
Wasp 1.2
wasp_ddr_initial_config(276): Wasp (16bit) ddr1 init
wasp_ddr_initial_config(426): Wasp ddr init done
Tap value selected = 0x8 [0xaa55aa55 - 0x0]
Setting 0xb8116290 to 0x10202d0f
 4 MB
Top of RAM usable for U-Boot at: 80400000
Reserving 230k for U-Boot at: 803c4000
Reserving 192k for malloc() at: 80394000
Reserving 44 Bytes for Board Info at: 80393fd4
Reserving 36 Bytes for Global Data at: 80393fb0
Reserving 128k for boot params() at: 80373fb0
Stack Pointer at: 80373f98

I saw from this forum post that the AP may hang at this point if you boot it with the UART connected. However, booting with RX disconnected hangs at the same spot. Booting with USB disconnected, then connecting ~10 seconds later yields only a blank and non-responsive screen.

The ethernet activity light shows blue and blinks with activity when connected to my computer or router. But pings to 192.168.1.1 time out, and no new devices show up in my router's list.

What else can I try to recover this AP? Is it totally gone?

Try to force failsafe mode by interrupt boot process with "F" key on serial console.
Then you can flash new OpenWRT firmware with webui at 192.168.1.1.
This is as far as I can recall.

If you can still be able to ping 192.168.1.1 try the following:
use Putty
root@192.168.1.1
fw_setenv rootfs_checksum 0
reboot

  • web 192.168.1.1 (If Chrome is failed, try Firefox)
  • Failsafe mode: Choose File & Upgrade

If you cannot ping to 192.168.1.1 you need USB to serial console cable

  • Remove 4 screws holding the EAP600 lid

  • Remove 2 screws holding the board and flip it, you will see 4 pin serial port.

  • You will see white arrow which is on the left in the picture that is power, attach it with RED cable.

  • The next one will be ground, attach it with BLACK cable.

  • Then WHITE and GREEN cable, in some manual it says green then white but it was not usable, for me, white and green worked.

  • in TTY, set serial to baudrate 115200, 8 data bits, no parity, stop bits 1, flow control: off.

  • Power on EAP600 to boot

  • In boot sequence it will ask to press f to get in to failsafe mode, you have to quickly press f (or repeatedly press it since power on) to get into failsafe mode.

  • exit TTY

  • pray for it to work and get into web 192.168.1.1

1 Like

I am still not able to ping or SSH at 192.168.1.1.
Previously, I was not connecting the red wire, and I had Flow Control set to Xon/Xoff.
However, changing both of those to your recommended settings, it still hangs at Stack Pointer at: 80373f98 and does not proceed from there. I tried pressing F at different times, continuously on boot up, etc, and have not made any more headway.

You can try this;

  1. Connect usb to serial as advice above.
  2. Connect RJ45 to your PC.
  3. Power off your device and use putty or kitty and set it as advice.
  4. While power on your device, keep tapping "F", your device will boot again in failsafe mode.
  5. Use webui to inject new firmware.

Maybe this will work;
While power off, keep pressing reset button then power on device. It may take you 10-15 seconds.
You can try this method without serial cable.
You may get in to OpenWRT failsafe mode, not Engenius failsafe mode. Do not sysupgrade current 21.02 or 22.03RC version. Use your prior 21.02-SNAPSHOT, not the current one.
If you successfully unbrick your device, do not upgrade with normal method.
Put your device in failsafe mode by issue command [fw_setenv rootfs_checksum 0] with ssh, then you can directly upgrade to 21.02+ via webui.

Make sure that your PC's subnet must be 192.168.1.0/24.

Can you copy all the text during boot sequence? We are not sure that you boot passed the failsafe notification or not.

No change in results following the two methods above. The reset button didn't seem to have any effect.

Here is the complete serial output (it has been the same for every test):

U-Boot 1.1.4 (Jan 10 2013 - 11:04:51)

EAP600 (ar934x) U-boot
DRAM:
sri
Wasp 1.2
wasp_ddr_initial_config(276): Wasp (16bit) ddr1 init
wasp_ddr_initial_config(426): Wasp ddr init done
Tap value selected = 0x8 [0xaa55aa55 - 0x0]
Setting 0xb8116290 to 0x10202d0f
 4 MB
Top of RAM usable for U-Boot at: 80400000
Reserving 230k for U-Boot at: 803c4000
Reserving 192k for malloc() at: 80394000
Reserving 44 Bytes for Board Info at: 80393fd4
Reserving 36 Bytes for Global Data at: 80393fb0
Reserving 128k for boot params() at: 80373fb0
Stack Pointer at: 80373f98

Method 2 of this guide;
git.openwrt.org Git - openwrt/openwrt.git/commitdiff
And you may already known about this;
Upgrade to OpenWrt 21.02-RC3 Bricked EAP600 - need help unbricking - #4 by mpratt14 - Installing and Using OpenWrt - OpenWrt Forum

I had unbrick this device once, but I can't actually recall how to do it;

I have tried the information from both of those posts. The problem seems to be that it hangs on boot up prior to accepting the failsafe signal.

@mpratt14, any thoughts?

This looks quite bad. The bootloader is crashing before the bootloader even fully starts. This could be due to corruption of the bootloader partition(s) of flash, which would take a flash programmer to restore. I don't know if that model had TP-Link's two stage bootloader or not.

This has nothing to do with failsafe in OpenWrt, since the OpenWrt kernel never even tries to boot.

Can I flash the chip through USB-to-TTL on the UART pins, or will I need a SIOC16 test clip and programmer (probably a Raspberry Pi)?

Can't flash it using the serial port.