UAP-AC-PRO Gen2 - help to unbrick

hi guys,

recently I bought a pair of UAP-AC-PRO Gen2 Ubiquiti APs which can power on & boot, but they are not visible in Ubiquiti controller, not sure if OpenWRT was not installed on them (not successfuly) as the AP cannot boot up completely, I cannot access SSH with default credentials even if the AP was reset many times (it will just close the connection, I can provide ssh verbose output). I am able to put in any firmware via TFTP, but still the same result - AP will boot into solid blue LED and I see 169.254.x.x IP in controller even if it has proper IP assigned by DHCP (can ping it) for few minutes, then it will disappear from controller. I can provide serial console output, maybe somebody here would give me a hint how to fix ... first part is boot without interruption, second part is interrupted boot with DHCP command as it shows bad checksum of img file, not sure how to fix ...

U-Boot unifi-v2.0.6.306-ge8871a78 (Nov 12 2019 - 10:30:55)

DRAM:  
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0x10, 0x10, 0x10, 0x10)
128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ff3800, log_magic:0x55555555 kseg: 0xa0000000
Top of RAM usable for U-Boot at: 87ff3000
Reserving 252k for U-Boot at: 87fb0000
Reserving 192k for malloc() at: 87f80000
Reserving 44 Bytes for Board Info at: 87f7ffd4
Reserving 36 Bytes for Global Data at: 87f7ffb0
Reserving 128k for boot params() at: 87f5ffb0
Stack Pointer at: 87f5ff98
Now running in RAM - U-Boot at: 87fb0000
Flash: 16 MB
PCIe WLAN Module found (tries: 1). 
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x9fff0000
ath_gmac_enet_initialize: reset mask:c02200 
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
 ath_gmac_enet_initialize: is_s17()=1, is_ar8033()=0, phy id1=4d phy_id2=d036 
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 18:e8:29:69:xx:xx
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0 
## Starting application at 0x80200020 ...
Board: Ubiquiti Networks AR956X board (e537-26.1150.0030.0040)
 0. Name = u-boot, offset = 0, start_addr=9f000000, size=393216,start_sector=0, end_sector=5 
 1. Name = u-boot-env, offset = 60000, start_addr=9f060000, size=65536,start_sector=6, end_sector=6 
 2. Name = kernel0, offset = 70000, start_addr=9f070000, size=7929856,start_sector=7, end_sector=127 
 3. Name = kernel1, offset = 800000, start_addr=9f800000, size=7929856,start_sector=128, end_sector=248 
 4. Name = bs, offset = f90000, start_addr=9ff90000, size=131072,start_sector=249, end_sector=250 
 5. Name = cfg, offset = fb0000, start_addr=9ffb0000, size=262144,start_sector=251, end_sector=254 
 6. Name = EEPROM, offset = ff0000, start_addr=9fff0000, size=65536,start_sector=255, end_sector=255 
get_mtd_params: name=bs
ubnt_flash_read: addr=8023bf20, sa=9ff90000, sz=131072 
ubnt_bootsel_init: bootsel magic=a34de82b, bootsel = 1 
UBNT application initialized 
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
keep cfg partition. 
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
ubnt_uwrite: Nothing to flash, exiting 
## Application terminated, rc = 0x0
## Starting application at 0x80200020 ...
cfg_default_state : TRUE
## Application terminated, rc = 0x1
Trying eth0
dup 1 speed 1000
NetOurIP:a9fe8731
Using eth0 device
## Starting application at 0x80200020 ...
Number of boot partitions = 2 
get_mtd_params: name=bs
ubnt_flash_read: addr=8023bf20, sa=9ff90000, sz=131072 
ubnt_get_bootsel: Boot partition selected = 1 
Loading Kernel Image @ 81000000, size = 7929856 
Verifying 'kernel1' parition:OK
## Application terminated, rc = 0x0
## Booting image at 9f800000 ...
   Image Name:   Ubiquiti Linux-4.4.153
   Created:      2018-08-30  12:10:54 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    7721310 Bytes =  7.4 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f800040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 4.4.153 (builder@owrt1505-builder) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3979-2252731af4) ) #0 Thu Aug 30 12:10:54 2018
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 07ff3800 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] No valid device tree found, continuing without
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ff2fff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ff2fff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ff2fff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32499
[    0.000000] Kernel command line: console=tty0 panic=3 ubntbootid=1 mtdparts=ath-nor0:384k(u-boot),64k(u-boot-env),7744k(kernel0),7744k(kernel1),128k(bs)d
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 119072K/131020K available (2890K kernel code, 145K rwdata, 532K rodata, 6536K init, 266K bss, 11948K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:775.000MHz, DDR:650.000MHz, AHB:258.333MHz, Ref:25.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008198] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.071009] pid_max: default: 32768 minimum: 301
[    0.075969] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.082945] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.093050] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.103440] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.110454] NET: Registered protocol family 16
[    0.115456] ramoops: using module parameters
[    0.120080] pstore: Registered ramoops as persistent store backend
[    0.126618] ramoops: attached 0xc800@0x7ff3800, ecc: 0/0
[    0.133267] MIPS: machine is Generic AR71XX/AR724X/AR913X based board
[    0.140104] calling mips_machine_setup on mips_machtype:f1
[    0.145893] MIPS: machine is Ubiquiti Networks Inc. (c) gen2
[    0.151857] Board: Ubiquiti UAP-AC-Pro-Gen2
[    0.376494] registering PCI controller with io_map_base unset
[    0.393733] PCI host bridge to bus 0000:00
[    0.398058] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    0.405338] pci_bus 0000:00: root bus resource [io  0x0001]
[    0.411205] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.418361] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.426765] pci 0000:00:00.0: invalid calibration data
[    0.432547] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    0.440258] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    0.447898] pci 0000:00:00.0: using irq 40 for pin 1
[    0.453258] lo: assigned ifindex: 1
[    0.457489] clocksource: Switched to clocksource MIPS
[    0.464031] NET: Registered protocol family 2
[    0.469301] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.476657] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.483408] TCP: Hash tables configured (established 1024 bind 1024)
[    0.490190] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.496357] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.503262] NET: Registered protocol family 1
[    6.671909] Crashlog allocated RAM at address 0x3f00000
[    6.690198] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    6.696355] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    6.709072] io scheduler noop registered
[    6.713210] io scheduler deadline registered (default)
[    6.718852] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    6.745965] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[    6.757616] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[    6.762958] 7 cmdlinepart partitions found on MTD device ath-nor0
[    6.769391] Creating 7 MTD partitions on "ath-nor0":
[    6.774624] 0x000000000000-0x000000060000 : "u-boot"
[    6.781837] 0x000000060000-0x000000070000 : "u-boot-env"
[    6.788893] 0x000000070000-0x000000800000 : "kernel0"
[    6.795592] 0x000000800000-0x000000f90000 : "kernel1"
[    6.802366] 0x000000f90000-0x000000fb0000 : "bs"
[    6.808670] 0x000000fb0000-0x000000ff0000 : "cfg"
[    6.815009] 0x000000ff0000-0x000001000000 : "EEPROM"
[    6.852933] switch0: Atheros AR8337 rev. 2 switch registered on ag71xx-mdio.0
[    7.594121] random: nonblocking pool is initialized
[    7.864626] libphy: ag71xx_mdio: probed
[    8.458940] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    8.470155] eth0: assigned ifindex: 2
[    8.474511] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:SGMII
[    8.482680] NET: Registered protocol family 10
[    8.490638] NET: Registered protocol family 17
[    8.495378] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    8.508812] 8021q: 802.1Q VLAN Support v1.8
[    8.513733] bootconsole [early0] disabled   


U-Boot unifi-v2.0.6.306-ge8871a78 (Nov 12 2019 - 10:30:55)

DRAM:  
sri
ath_ddr_initial_config(278): (ddr2 init)
ath_sys_frequency: cpu 775 ddr 650 ahb 258
Tap values = (0x10, 0x10, 0x10, 0x10)
128 MB
Base:0x80000000, Top:0x88000000, Res logbuf:0xa7ff3800, log_magic:0x55555555 kseg: 0xa0000000
Top of RAM usable for U-Boot at: 87ff3000
Reserving 252k for U-Boot at: 87fb0000
Reserving 192k for malloc() at: 87f80000
Reserving 44 Bytes for Board Info at: 87f7ffd4
Reserving 36 Bytes for Global Data at: 87f7ffb0
Reserving 128k for boot params() at: 87f5ffb0
Stack Pointer at: 87f5ff98
Now running in RAM - U-Boot at: 87fb0000
Flash: 16 MB
PCIe WLAN Module found (tries: 1). 
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
Fetching MAC Address from 0x9fff0000
ath_gmac_enet_initialize: reset mask:c02200 
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
 ath_gmac_enet_initialize: is_s17()=1, is_ar8033()=0, phy id1=4d phy_id2=d036 
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 18:e8:29:69:xx:xx
eth0 up
eth0
Setting 0x181162c0 to 0x20402100
Board: Copyright Ubiquiti Networks Inc. 2014
Hit any key to stop autoboot:  0 
ath> dhcp
Trying eth0
dup 1 speed 1000
BOOTP broadcast 1
DHCPHandler: got packet: (src=67, dst=68, len=300) state: 3
Filtering pkt = 0
DHCPHandler: got DHCP packet: (src=67, dst=68, len=300) state: 3
DHCP: state=SELECTING bp_file: ""
TRANSITIONING TO REQUESTING STATE
Bootfile: 
DhcpSendRequestPkt: Sending DHCPREQUEST
Transmitting DHCPREQUEST packet: len = 343
DHCPHandler: got packet: (src=67, dst=68, len=300) state: 4
Filtering pkt = 0
DHCPHandler: got DHCP packet: (src=67, dst=68, len=300) state: 4
DHCP State: REQUESTING
Bootfile: 
DHCP client bound to address 192.168.1.121
*** Warning: no boot file name; using '7901A8C0.img'
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.121
Filename '7901A8C0.img'.
Load address: 0x81000000
Loading: T T T checksum bad
checksum bad
checksum bad
checksum bad
T 
Abort
ath> <INTERRUPT>

Does it keep rebooting over and over? How often? I don't think the stock firmware is supposed to ever reboot itself except on command from the controller. If you don't connect to any network, upon failing to DHCP, the unit should set itself to 192.168.1.20/24 and you can static IP your PC to 192.168.1.X and ssh in.

no, it's steady ... after "boot" I can see it in controller with 169.254.x.x IP, even if I see properly assigned 192.168.x.x IP on it, then it disappears after few mins ... ssh is possible, ubnt/ubnt will result in closed connection.

I could SSH in - but there appears Error A12 - not sure how to fix ....

I don't know what that error is. Is there any explanation of it in the message?

Your client will throw a "Danger: Host key has changed" error normally if you've reset the device to defaults causing it to generate a new host key. Follow the instructions for the client to accept the new key. This is strictly a client-side issue.

Do not connect to any other network. This means a direct connection between the AP, POE source, to your PC Ethernet port. No other network devices involved. Disconnect the PC from any other wired or wireless networks.

Set PC to a static IP of 192.168.1.10 with a netmask of 255.255.255.0 then ssh to the AP at 192.168.1.20.

If your final intention here is not to install and use OpenWrt, but to use the stock firmware and controller, you should seek help from a Ubiquiti forum.

hi mate,

it is not a client-server issue, but something is preventing to SSH in, as connection is closed after typing the pass. But after some time I was able to get in, I can invoke some commands there as well but having there Error A12 (flash corrupted/failing) leaves me with nothing else to try to revive it ... only if I would have backup of mtdparts of same but working device, I can try to rewrite flash, if that does not help, I'll have 2 frisbees ...