Flashing OpenWrt to Ubiquiti UniFi AP (stock flash ver >= 4.0.15)

[alexdev]

WARNING! Use this only with Ubiquiti UniFi AP! You may break your device!

If you are trying to flash OpenWRT to Ubiquiti UniFi AP updated to 4.0.15 or greater, process will finish with an error. Device goes into infinite blinking and will not boot after power reset. Standard recovery to stock flash makes device work again, but... We want OpenWRT. We have an issue with stock firmware: Apple mobile devices don't connect to AP at all. Sometimes We were able to connect, but this APs are aimed for public usage, you don't want to tell your customers something like this: "to connect to our shared WiFi network, please, touch you nouse with your right hand middle finger, keeping your left hand fingers crossed". Customers just want to select your free office network, thats all they are ready to do. In one of our offices we were able to flash OpenWRT on UniFi AP (without any troubles) and problems were gone. "Yeah! Let's flash OpenWRT to all APs we have!". But... Only one of our APs was not updated to recent stock firmware... What's going on? Why can't we flash the same firmware to same APs with the same HW as the first one? Let's try to figure out.
We've opened AP case and attach serial console to its serial port:

Warning! Please keep +3.3 pin unconnected!

Connect UBL-to-TTL (i'm using cheap CP2102 converter ) to your PC (i'm using linux, so... sorry ) and run serial console:

$ ls -lh /dev/ttyUSB*
/dev/ttyUSB0
$ screen /dev/ttyUSB0 115200

Then, start flashing AP as we always do: Switch power off, hold button and power on device. At this point you should see messages in your console. If you don't, then... You made connection in wrong way, try to redo connection. Or... Your AP is dead.

As a results, flash procedure finished with error: no partition named rootfs (sorry, i did not save original message).

What?.. Okay, let's break boot procedure by pressing any button in screen during early boot stages. You have olny 1 second to do this. print out available partitons:

ar7240> mtdparts

device nor0 , # parts = 5
#: name size offset mask_flags
0: u-boot 0x00040000 0x00000000 0
1: u-boot-env 0x00010000 0x00040000 0
2: kernel 0x00760000 0x00050000 0
3: cfg 0x00040000 0x007b0000 0
4: EEPROM 0x00010000 0x007f0000 0
.....
mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),7552k(kernel),256k(cfg),64k(EEPROM)
...

Eah, no rootfs partiton there...

Let's try this procedure with our first AP:

device nor0 , # parts = 6
#: name size offset mask_flags
0: u-boot 0x00040000 0x00000000 0
1: u-boot-env 0x00010000 0x00040000 0
2: kernel 0x00100000 0x00050000 0
3: rootfs 0x00660000 0x00150000 0
4: cfg 0x00040000 0x007b0000 0
5: EEPROM 0x00010000 0x007f0000 0

active partition: nor0,0 - (u-boot) 0x00040000 @ 0x00000000

defaults:
mtdids : nor0=ar7240-nor0
mtdparts: mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)

Reconnect the second AP and recreate same partitons as on the first device:

ar7240> mtdparts del nor0,4
ar7240> mtdparts del nor0,3
ar7240> mtdparts del nor0,2

ar7240> mtdparts add nor0 0x00100000@0x00050000 kernel
ar7240> mtdparts add nor0 0x00660000@0x00150000 rootfs
ar7240> mtdparts add nor0 0x00040000@0x007b0000 cfg
ar7240> mtdparts add nor0 0x00010000@0x007f0000 EEPROM

ar7240> setenv mtdparts mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)
ar7240> saveenv
ar7240> reset

After that connect AP to you PC with internet cable (do not detach console if you want to see flash process progress) and flash device with TFTP client:

1. Download OpenWRT firmware (https://openwrt.org/toh/ubiquiti/unifi, ...-factory.bin)
2. save firmware to file, lets say fw.bin
3. Prepare tftp client:
   $ cd
   $ tftp 192.168.1.20
   tftp> binary
   tftp> trace
   tftp> put fw.bin

do not hit enter on the last command, just type it and go to the next point
3) Poweroff device
4) hold reset button
5) poweron device. do not release reset button
6) at the same time hit enter in tfpt client console
7) You can release reset buttononce you see the progress in tftp console

Check device serial console in screen. AP will flash and reboot. That's all.

[da8en2]

Thanks for the writeup, I was able to flash OpenWRT to my UniFi AP using this guide.

However the device clears the config partition and boots to TFTP mode every time after reboot. I can only boot into OpenWRT if I keep the serial console connected and CTRL+C out of the TFTP server.

Any idea how to fix this?

U-Boot unifi-v1.6.17.296-g1af7670c (Apr 22 2019 - 11:05:55)

DRAM:  64 MB
Base:0x80000000, Top:0x84000000, Res logbuf:0xa3ff3800, log_magic:0xe8c4e0e4 kseg: 0xa0000000
Flash:  8 MB
PCIe WLAN Module found (tries: 1).
Net:   eth0, eth1
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0
Board: Ubiquiti Networks AR7241 board (e502-18.0101.002e)
 0. Name = u-boot, offset = 0, start_addr=9f000000, size=262144,start_sector=0, end_sector=3
 1. Name = u-boot-env, offset = 40000, start_addr=9f040000, size=65536,start_sector=4, end_sector=4
 2. Name = kernel, offset = 50000, start_addr=9f050000, size=1048576,start_sector=5, end_sector=20
 3. Name = rootfs, offset = 150000, start_addr=9f150000, size=6684672,start_sector=21, end_sector=122
 4. Name = cfg, offset = 7b0000, start_addr=9f7b0000, size=262144,start_sector=123, end_sector=126
 5. Name = EEPROM, offset = 7f0000, start_addr=9f7f0000, size=65536,start_sector=127, end_sector=127
UBNT application initialized
reset button pressed: clearing cfg partition!

First 0x7b last 0x7e sector size 0x10000
.... done
reset button pressed: clearing u-boot-env partition!
Setting default IP 192.168.1.20
Starting TFTP server...

[mk24]

it appears the reset button is pressed, or there is something wrong with the power supply which is triggering the remote reset feature.

The OpenWrt kernel has an internal partition table-- it is not necessary to re-define any partitions in the bootloader. Once properly installed in flash, a bootm 0xbf050000 should launch OpenWrt. This is the default bootcmd in the u-boot environment, so it will boot when the power is turned on, unless the reset button is active.

These are the official instructions, such as they are.
https://openwrt.org/toh/ubiquiti/unifi
Most of what @alexdev did is not necessary.

[da8en2]

Thank you for your reply @mk24

I just tried 2 other poe adapters since I have enough lying around, same result. The reset button is definitely not pressed either.

I was not able to install OpenWRT prior to redoing the partition table as described above because I would get the same error that alexdev described "no rootfs partition found - aborting"

Thanks to alex's writeup I was able to flash OpenWRT but I can't get the device to booth past the TFTP prompt without manual interaction, also the settings are deleted every boot.

Any other ideas?

[da8en2]

In case anyone else encounters this:

setenv bootcmd 'bootm 0xbf050000'
saveenv

fixed it!

[culag]

Thank you so much for the guidance!
I was able to flash OpenWRT on 4 UAP and they work great.

[knacky]

Is the published method of downgrading the u-boot version so OpenWRT can be flashed on UniFi not sufficient anymore?

[OpenWrt Wiki] Ubiquiti UniFi AP AC

The documented method requires no hardware surgery or console wizardry, and it's worked for me on newly purchased UniFi AC-LR and UniFi nanoHD, both with 2020 manufacturing date and coming with 4.0.x original firmware.

[mk24]

This thread is about the non-AC older model.