{{Tip | Before continuing, connect to your mesh node using the '''MassMesh.org''' wireless network or by connecting directly to the mesh node, like in [[Mesh Node Troubleshooting]].}}

{{Tip | Access your mesh node by navigating to http://192.168.42.1 in your web browser.}}

== Setting Your Password ==

[[File:No_password.png|thumb|When you first boot your mesh node, there is no admin password set.]]

When you first boot your mesh node, there is no password set. This is quite dangerous, so OpenWrt will disable many useful features until you set one. Therefore, it is important that you set one up right away.

{{Warning|This is not the same thing as a wi-fi password. Your admin password should be a secret.}}

To set a password, complete the following steps:
* Navigate to "System > Administration" in the left-hand menu of OpenWrt
** [[File:Set_password_screen.png|frameless|Enter your desired password twice, and click "Save."]]
* Enter your desired password twice, and hit Enter or click "Save."

== Enabling Remote Support ==

Following these steps, you will allow a maintainer to log into and use your mesh node remotely -- as long as it's connected to the global Yggdrasil network. See [[#The Yggdrasil Page]] if you think you may not be connected to the rest of the Yggdrasil network.

In order to enable remote support, you will need to:
# Authorize the maintenance team to access your mesh node
# Allow SSH over Yggdrasil

=== Authorize the Maintenance Team to Access Your Mesh Node ===

{{Note|You must first [[#Setting Your Password|Set Up a Password]] before adding authorized remote users.}}

# Navigate to System > Administration
# Select the "SSH-Keys" tab
## [[File:SSH_Keys_Screen_owrt.png|frameless|The ssh-keys tab.]]
# Enter the following keys, clicking "Add Key" in between each
<pre>
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCndT67lJYJl1Re974keiGRzzD0m4qY9KM4m/XttWWinSggoFD+VKQDZchxnsyGbtDFH/NOSfI37MS+djccDj5fue1s/KnzL/j44JFyzt0M1pVgwopetMKTCaduCVeCQP2JN20Ss4fBI4FjvBM1tgAx3d1FUJEz7axwxJUBAgUDtvA1PUSKdhPxZTlWrKgHr4OXzdEoYJcLiktQc79QR2lJHKIBZgVq0C76Y/q+Q3mbl7ppLMmNgFRprXRkzDtRHndin5S7+f2zOlNryIGdnX3HCItr0XBkG/uNkrWnx0NFArP6Xq/BsJMhdNvl+KfCZiLYN2m3qxhEjZeTQIfBXh5wDfUzW0tPoDSCQ2WIBRjkSPjgnohskbakF6bnzLPJlsQofHfdDYUJJkywTYfo7FspPR4h2//FrBUDaRUXFUQBaguBTKX5P6U6quXSAfupkPIjZ7TkbxL0Q4OkWa/MX/QdBi/wZMYTcm4osJBmFxEZEumFHTb2gZ3SyTKD9sCKQHE= lurker@lurker-T450

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAgEA3nzI6T6Lpd5xFoRewcx91Dv9sUzNNmdYfwOleemBFz0y3RaQElehUWasyjuIURZw7RL5EjvrqeQq9pe/lO99dO0F9yMuMsMH2t88YrVJQ/z/5Aa4I2zYQotKb/9CCfynsy41y5xywxtOwXiDk2kpo+c9VZCyCeW8Hnc9HaIpkKSLnkqDVhESzlrkYyNKZvUAL1hiFIzmmw/veFgRb7/ol76Ze3xsWugbHUECEIAKoz/8uaevOAAoJrMFhffFIQ8IfClqDZv2lnBBhvh1O9TO0Mg4klcieyQ1RZhMjeP4WnAa9PXP7xZlQHLgO9qO1jDd2sOdkX6EedCfX5jO4Y51HPJpV35uYumw3veftMlpIJFmA2eIQxU19SCYpojWRGXZ5v9WtFIHX2nGy+Gi1bk7TR+HBsCDXOPhhQk4ceIM4OonqEb1NJ57elxh6mFbDAQCZtYhRLqYvcyGpuBdVdLNOJbOZ7vBJY3Kfjxa87rvFIJheT6DXhpdRayeOovLm0vuJ53bZoWxWOqjpuigQqHtSB3OmintrKB916BhNFsHwPeZpK0ahZGFygV63REM/X8m0nOlHqyAY69uzLHyYXM83zAI1L5Y4wuzsVqO+1tnK6PMcfg5/DArjBrn7YqA5tzJY9EgdVVPjpgjD2yYYTOP6b3UUw4uFj3asnOX24dfVzk= ward@countzero

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDVi8ExDYdV7EfkjQiMZA3o0QtjVNtd0wVzp9n1xFqY1dse/zHBqrEZQKBtbrk7D/NAI4qzoogC6SbHWa8fHPyc3LJuKbxHrSC8xylByGL7nAzI7AfmsHCQ8Z+OrgI625PzVpMCY/30D/rBgR2JTlzxlA35cuOPjN5r1HHE53+mVRu62jn/wTa16ubFXaYmibpZ3C830+qsAB8RPEHJH7zknFNPponAqH7kt1I8WQL6fa2TCuxIBijzDLbtX1xH4klTeMRJTK+tmLRUUjUefD/f7lNlgce7o9zkHktO5u1hmpC95/NC2cylzU9RWglHqJ21fSg66y441lm0Y9ZUc2p7DQFQP0f6kovuPWgVPWuMCQHVPgCWqqlKfTK3Dyscn9MfsCUnN2fZY+T0fx3lutLcIOwvQc/N2EDJIb0/R+7XMrzfUDVrkGeBoG11tBkKjltdC19JrAmGAkfIcN0LMOeZT7yTlZ/f/6d5C19DegXX74owM4V4pkqs/hbpmDkvQYkSXPfVpZ9ZTVUVSBrwKVaVX9A1hTXjIzfsuoZheMIdlakt0qSIuukyaIxzi1aAH67nR0kp+XCLldBDXGKQXah+mIGQPDBwWFR34re40jzxKmvLT+Dq+5yASgoLDbul8IYDJa2r7yYZQu+EgsW24p62q+y041wW4YIGBJs/cQqpCw== stephen304@gmail.com

</pre>

=== Allow SSH over Yggdrasil ===
# Navigate to Network > Firewall
# Select the "Traffic Rules tab
## [[File:Firewall_traffic_rules_tab_owrt.png|frameless|The network firewall traffic rules tab.]]
# Scroll down to "Allow-SSH-Yggdrasil"
# Enable the Accept input checkbox
## [[File:Enable_ssh_over_yggdrasil_firewall_rule_checked.png|frameless|Enable the ssh-over-yggdrasil firewall rule.]]
# Click "Save and Apply"
## [[File:firewall_save_and_apply.png|frameless|Click save and apply]]

== The Diagnostic Page ==
== The Yggdrasil Page ==

[[File:Peers.png|thumb|A working mesh node should have several peers.]]

One of the most helpful screens for troubleshooting is the Yggdrasil page. This page is entirely focused on your mesh node's status ''within the global Yggdrasil mesh network.'' You can access the Yggdrasil page by selecting "Network > Yggdrasil" on the right-hand menu in OpenWrt.

=== Important Yggdrasil Information ===

You can view important information about your mesh node in the Yggdrasil screen. Among other things, you can view your node's static [https://en.wikipedia.org/wiki/IPv6 IPv6] address and [https://en.wikipedia.org/wiki/Public-key_cryptography public key.]

Your static IPv6 address is unique to the Yggdrasil, and never changes. It comes in handy very frequently, and is used for remote support (among other things.) Your public key is sometimes used to gain access to private resources on the Yggdrasil network. It's good to know where it is just in case you ever need it.

[[File:IPv6.png|frameless|Your static IPv6 address is unique to the Yggdrasil, and never changes.]]
[[File:Pubkey.png|frameless|Your public key is sometimes used to gain access to private resources on the Yggdrasil network.]]

=== Checking for Peers ===

As long as your mesh node has public Yggdrasil peers, it is connected to the global Yggdrasil mesh network. This means that things like remote support will work properly. If you're interested in learning more about Yggdrasil vs. the Internet vs. the LAN, see our [[Network Architecture]] page.

A working mesh node should have several peers. You can see these in the following screen:
* [[File:Peers.png|frameless|A working mesh node should have several peers.]]

If you don't have any peers, your Yggdrasil screen will look something like this:
* [[File:No_Peers.png|frameless|If you don't have any peers, your Yggdrasil screen will look something like this.]]
* Note the "Proto" column.... it says "self," because the only peer your mesh node has is ... itself!

== The Internet Gateway Page ==

Once you are connected to the ''Yggdrasil mesh network'' (see previous section), it is time to configure the node for internet access. To do so, the node needs to be connected to an internet gateway. We use a program called [https://github.com/massmesh/autoygg Autoygg] for this purpose. You can access the Internet Gateway page by selecting "Network > Internet Gateway" in the left-hand menu in OpenWrt.

=== The Autoygg client status page ===

The '''Status''' page shows the current connection state with the configured Autoygg Gateway. On first boot, the page will show that you are '''disconnected''':

[[File:AutoyggStatusFirstTimeSetup.png|frameless|The Autoygg status screen for a new installation.]]

=== The Autoygg client settings page ===

On the '''Settings''' page, an Internet Gateway server can be configured. It is also possible (but not required) to populate your name, e-mail address and/or phone number, to identify yourself to the gateway owner.

==== Connecting to a Mass Mesh public Internet Gateway ====

Mass Mesh runs a public Internet Gateway at the address '''201:506e:60d6:bd66:e35c:606:4883:ea9a'''. If you would like to use it to connect to the internet, put that address in the '''autoygg gateway''' field and click '''SAVE & APPLY''':

[[File:AutoyggSettingsMassMeshGateway.png|frameless|The Autoygg settings screen with the Mass Mesh gateway configured.]]

At this point, the '''Status''' page will show you are not connected:

[[File:AutoyggStatusPageClientNotConnected.png|frameless|The Autoygg status screen with the Mass Mesh gateway configured, but not connected.]]

Before you can connect to the internet via the Mass Mesh gateway, one of our volunteers will need to add your node to the accesslist on the gateway server. You can request this in the '''[https://app.element.io/#/room/#mm-ap-hosts:matrix.org Mass Mesh AP Hosts chat room].''' Please provide your Yggdrasil IPv6 address when you do so, which is available on the '''Yggdrasil node status''' page, as described above.

Once your node is added to our accesslist, you can hit the '''Connect''' button and if that goes well, the status page will look similar to this:

[[File:AutoyggStatusPageClientConnected.png|frameless|The Autoygg status screen with the Mass Mesh gateway configured and connected.]]

==== Connecting to your own Internet Gateway ====

It is also possible to run your own Internet Gateway server. This can be done on a cheap cloud VPS, for instance. It requires installing and running the [https://github.com/MassMesh/autoygg/blob/main/README.md Autoygg server]. If you want assistance with this, please ask in the '''[https://app.element.io/#/room/#massmeshtech:matrix.org MassMesh Tech chat room].'''

File:AutoyggStatusPageClientConnected.png

2020-09-02T00:36:42Z

Cure:

File:AutoyggStatusPageClientNotConnected.png

2020-09-02T00:26:10Z

Cure:

File:AutoyggSettingsMassMeshGateway.png

2020-09-02T00:22:59Z

Cure:

2020-01-28T03:24:12Z

Cure:

Ubiquiti NanoStation 5AC Loco

2020-01-28T02:38:15Z

Cure: /* Pinouts (please proceed with caution!) */ add binwalk output

[[Category:Devices]]
[[Category:Ubiquiti]]
[[File:Ubnt-ns-5ac-loco.png|thumb|NanoStation 5AC Loco]]

The NanoStation 5AC Loco is a directional, weather resistant, PoE powered radio with a beam width of 90 degrees and a secondary omnidirectional radio. This makes it useful for simultaneously meshing on one radio while providing an access point for client devices on the other.

{{ Warning| This is a PoE device. Never connect your computer directly to the PoE injector's red port!!!}}

{{Note| The Nanostation's architecture is '''MIPS 24KC.'''}}

{{ Warning| As of January 1, 2020, brand new Nanostations do not support downgrading the Ubiquiti AirOS firmware. (Even with the patch.)}}

== Files ==
[https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin Stock Firmware v8.5.0.36727]

[https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin MassMesh Firmware (Factory) (Latest)]

[https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-sysupgrade.bin MassMesh Firmware (Sysupgrade) (Latest)]

== Flashing ==

=== From OpenWrt ===
{{Note|Mass Mesh mesh radios have a static IP of 192.168.2.1. To access the admin UI, set your computer's ip/netmask to 192.168.2.10/24, then browse to http://192.168.2.1/ in your favorite web browser.}}
# Download the latest [https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-sysupgrade.bin MassMesh sysupgrade firmware.]
# Connect to the Nanostation and enter its IP address into your favorite web browser.
## If you are using another version of OpenWrt, please refer to its documentation for details about its IP address.
# Navigate to System → Backup / Flash Firmware → Actions: '''Flash new firmware image.'''
# Choose the sysupgrade file previously downloaded and click '''Flash'''
# Wait for the device to complete and reboot (This can take up to 5 minutes.)

=== From Stock Firmware (Ubiquiti AirOS)===

==== Downgrade Ubiquiti AirOS ====

# Download the [https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin Stock Firmware Image v8.5.0.36727].
# Power on the Nanostation via a PoE injector. (This is the **red** ethernet port on your injector.)
# Connect the LAN side of the PoE injector to a computer.
# Assign a static IP/netmask of <code>192.168.1.25/24</code> to the computer
## <code>sudo ip addr add 192.168.1.25/24 dev eth0</code>
# Use a browser to visit http://192.168.1.20/
# Login using the set password or default credentials <code>ubnt / ubnt</code>
# Navigate to settings and downgrade the stock firmware to v8.5.0.36727 using the downloaded image file

==== Install The Mass Mesh OpenWrt Image ====

{{ Note| Additional instructions are available [https://openwrt.org/toh/ubiquiti/ubiquiti_nanostation_ac_loco on OpenWrt's website].}}
# Download the latest Mass Mesh firmware [https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin here].
# Copy the firmware onto the nanostation. (We like to put it in the <code>/tmp/</code> directory.)
# Open a secure shell on the Nanostation. <code>ssh ubnt@192.168.1.20</code>
# Patch the fwupdate.real binary a la the instructions [https://openwrt.org/toh/ubiquiti/ubiquiti_nanostation_ac_loco here.]
# <code>/tmp/fwupdate.real -m /tmp/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin</code>

=== Downgrade Ubiquiti AirOS With An External Programmer===

When your nanostation is bricked, or if the stock firmware won't let you flash our custom firmware, you can use the '''In-System Programming''' (ISP) technique to reflash the device (see also the [https://www.flashrom.org/ISP Flashrom wiki]. You're going to need:

# a Pomona 5252 test clip (https://www.digikey.com/product-detail/en/pomona-electronics/5252/501-2059-ND/745103), ~$16
# a raspberry pi (e.g. a zero w) ~$10
# some header pins and prototyping wires to connect everything

The Nanostation has a Macronix MX25L12835F rom chip ([https://www.macronix.com/Lists/Datasheet/Attachments/7397/MX25L12835F,%203V,%20128Mb,%20v1.6.pdf datasheet]), which is an SPI chip with 16 connectors good for 128 Mbit of storage.

We can use [https://flashrom.org Flashrom] running on a raspberry pi to read and write that chip, if we hook up the Pomona 5252 test clip to the MX25L12835F and connect it to the correct [https://pinout.xyz/pinout/spi SPI pins] on the pi:

[[File:raspberry-pi-pinout.png|inline|raspberry pi GPIO pinout]]

(note: the SPI1 CE0/CE1 pins are not labeled on this image)

==== Pinouts (please proceed with caution!) ====

The Raspberry Pi has 2 SPI interfaces, SPI0 and SPI1.

On the Raspberry Pi boot partition, make sure to update config.txt and uncomment the line that reads

dtparam=spi=on

After a reboot, you should see the spi device files:

root@raspberrypi:/home/pi# ls -laF /dev/spidev0.*
crw-rw---- 1 root spi 153, 0 Jan 7 01:44 /dev/spidev0.0
crw-rw---- 1 root spi 153, 1 Jan 7 01:44 /dev/spidev0.1

Now connect the Raspberry Pi to the Pomona clip. Choose either SPI0 or SPI1. We're going to '''power up the NanoStation with its own power supply''', so we need to leave the VCC pin on the flash chip disconnected. We are however going to connect a few other pins to our 3.3V source from the raspberry pi, to pull them up.

{| class="wikitable"
|-
!colspan="2"|RPi SPI0!!colspan="2"|RPi SPI1!!colspan="2"|Pomona Clip!!Notes!!Color in picture below
|-
|17||3.3V
|17||3.3V
|1||SIO3
|''we do not use this pin, so we pull it up''
|red
|-
|17||3.3V
|17||3.3V
|9||WP#SIO2
|''put the chip in read/write mode''
|red
|-
|19||SPI0 MOSI
|38||SPI1 MOSI
|15||SI
|
|blue
|-
|21||SPI0 MISO
|35||SPI1 MISO
|8||SO
|
|orange
|-
|23||SPI0 SCLK
|40||SPI1 SCLK
|16||SCLK
|
|green
|-
|25||GND
|25||GND
|10||GND
|
|brown
|-
|24||SPI0 CE0
|12||SPI1 CE0
|7||CS
|
|yellow
|}

[[File:raspberry-pi-zero-w-spi0-connected.jpg|inline|1024px|A Raspberry Pi Zero W with wires connected to the SPI0 pins]]

Once the pomona is connected to the raspberry pi, power up the nanostation with its own power supply. Then clip on the pomona.

Flashrom on the raspberry pi requires us to specify the spi speed for the operation. We also need to specify the exact rom chip model, because there are two models that match:

flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=30000 -r proprietary.rom
flashrom on Linux 4.19.75+ (armv6l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L12805D" (16384 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L12835F/MX25L12845E/MX25L12865E" (16384 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): "MX25L12805D", "MX25L12835F/MX25L12845E/MX25L12865E"
Please specify which chip definition to use with the -c <chipname> option.

So here's the final command to read out the chip:

flashrom -c "MX25L12835F/MX25L12845E/MX25L12865E" -p linux_spi:dev=/dev/spidev0.0,spispeed=30000 -r proprietary.rom
flashrom on Linux 4.19.75+ (armv6l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L12835F/MX25L12845E/MX25L12865E" (16384 kB, SPI) on linux_spi.
Reading flash... done.

It's easy to verify that if the reading worked. If you were reading out the original firmware, binwalk would print something like this:

$ binwalk proprietary.rom

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
115152 0x1C1D0 Certificate in DER format (x509 v3), header length: 4, sequence length: 64
142896 0x22E30 U-Boot version string, "U-Boot 1.1.4-s1100 (Sep 5 2018 - 17:53:00)"
143184 0x22F50 CRC32 polynomial table, big endian
224396 0x36C8C CRC32 polynomial table, big endian
226924 0x3766C Ubiquiti end header, header size: 12 bytes, cumulative ~CRC32: 0x454E442E
231856 0x389B0 Ubiquiti partition header, header size: 56 bytes, name: "PARTkernel", base address: 0x00000001, data size: -2147475456 bytes
231920 0x389F0 uImage header, header size: 64 bytes, header CRC: 0xE75790E0, created: 2018-11-13 14:36:59, image size: 998847 bytes, Data Address: 0x80002000, Entry Point: 0x80002000, data CRC: 0xAAECA664, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS Ubiquiti Linux-2.6.32.68"
327680 0x50000 uImage header, header size: 64 bytes, header CRC: 0x22425505, created: 2019-02-13 09:09:52, image size: 990770 bytes, Data Address: 0x80002000, Entry Point: 0x80002000, data CRC: 0x8F3B71D3, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS Ubiquiti Linux-2.6.32.68"
327744 0x50040 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2836596 bytes
1318514 0x141E72 Ubiquiti partition header, header size: 56 bytes, name: "PARTrootfs", base address: 0x00000002, data size: 0 bytes
1318578 0x141EB2 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 7203018 bytes, 956 inodes, blocksize: 262144 bytes, created: 2019-02-13 09:09:54

Useful resources:
* [https://www.flashrom.org/RaspberryPi Flashrom page on using the Raspberry Pi as a flashing tool]

=== Flash using serial header access ===
Using small modifications to the radio, direct serial access allows temporarily running OpenWRT in memory and using the temporary environment to flash a full image to the radio's memory.

[[File:Ubnt_ns5acl_serial.jpg|thumb|Click to enlarge pinout]]
# Using your thumb or a small tool, push the tab in the slot located on the lower rear of the radio and slide the bottom half out of the enclosure
# Looking at the rear of the board (where all the components are on the opposite side as the antenna), locate the serial headers on the middle left side of the board
# Solder at least the top 3 pins shown in the picture. The pins from left to right (starting with the square shaped pad that is unpopulated in the image) are 3.3V, RX, TX, and GND. 3.3V is not needed here
# Connect GND on the board to GND on your FTDI adapter, TX on the board to RX on the FTDI adapter, and RX on the board to TX on the FTDI adapter
# Make sure your FTDI adapter is in 3.3V mode and attached to your computer, then open the serial port on your computer (ex. <code>minicom -D /dev/ttyUSB0</code>). Use 115200 8N1 in your terminal settings.
# Connect the NanoStation and press enter in the console when it says <code>Hit any key to stop autoboot:</code>. You should be left at a <code>ar7240> </code> prompt.
# Connect your laptop to the LAN port of the PoE injector powering the NanoStation and assign a static IP of <code>192.168.1.254</code>
# Install a TFTP server and place [https://downloads.openwrt.org/releases/19.07.0/targets/ath79/generic/openwrt-19.07.0-ath79-generic-ubnt_nanostation-ac-loco-initramfs-kernel.bin openwrt-19.07.0-ath79-generic-ubnt_nanostation-ac-loco-initramfs-kernel.bin] in the root folder of the TFTP server (<code>/srv/tftp</code> for tftp-hpa on Arch).
# Rename the initramfs-kernel.bin file to <code>1401A8C0.img</code> and ensure the tftp server / service is started
# Run <code>tftpboot</code> in the serial console and wait for it to complete
# Run <code>bootm</code> in the serial console to boot the initramfs
# Once OpenWRT has booted, you can press Enter to enable shell access
# Ensure you have an IP address in the 192.168.1.x subnet and use scp to transfer the sysupgrade firmware you wish to flash
# Flash the full firmware to the radio's storage using <code>mtd -r write /tmp/sysupgrade.bin firmware</code>, replacing <code>sysupgrade.bin</code> with the full filename of the firmware you are flashing

== Condensed Command-list ==
=== Flash The Stock Ubiquiti Firmware via TFTP ===
<pre>
wget https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin
cp https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin firmware.bin
sudo apt install tftp
tftp
tftp> connect 192.168.1.20
tftp> rexmt 1
tftp> timeout 60
tftp> binary
tftp> put firmware.bin
</pre>
=== Flash The Mass Mesh Firmware ===
<pre>
wget https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin
scp openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin ubnt@192.168.1.20:/tmp
ssh ubnt@192.168.1.20
hexdump -Cv /bin/ubntbox | sed 's/14 40 fe fe/00 00 00 00/g' | hexdump -R > /tmp/fwupdate.real
chmod +x /tmp/fwupdate.real
/tmp/fwupdate.real -m /tmp/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin
</pre>

Ubiquiti NanoStation 5AC Loco

2020-01-28T02:32:56Z

Cure: /* Downgrade Ubiquiti AirOS With An External Programmer */

[[Category:Devices]]
[[Category:Ubiquiti]]
[[File:Ubnt-ns-5ac-loco.png|thumb|NanoStation 5AC Loco]]

The NanoStation 5AC Loco is a directional, weather resistant, PoE powered radio with a beam width of 90 degrees and a secondary omnidirectional radio. This makes it useful for simultaneously meshing on one radio while providing an access point for client devices on the other.

{{ Warning| This is a PoE device. Never connect your computer directly to the PoE injector's red port!!!}}

{{Note| The Nanostation's architecture is '''MIPS 24KC.'''}}

{{ Warning| As of January 1, 2020, brand new Nanostations do not support downgrading the Ubiquiti AirOS firmware. (Even with the patch.)}}

== Files ==
[https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin Stock Firmware v8.5.0.36727]

[https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin MassMesh Firmware (Factory) (Latest)]

[https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-sysupgrade.bin MassMesh Firmware (Sysupgrade) (Latest)]

== Flashing ==

=== From OpenWrt ===
{{Note|Mass Mesh mesh radios have a static IP of 192.168.2.1. To access the admin UI, set your computer's ip/netmask to 192.168.2.10/24, then browse to http://192.168.2.1/ in your favorite web browser.}}
# Download the latest [https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-sysupgrade.bin MassMesh sysupgrade firmware.]
# Connect to the Nanostation and enter its IP address into your favorite web browser.
## If you are using another version of OpenWrt, please refer to its documentation for details about its IP address.
# Navigate to System → Backup / Flash Firmware → Actions: '''Flash new firmware image.'''
# Choose the sysupgrade file previously downloaded and click '''Flash'''
# Wait for the device to complete and reboot (This can take up to 5 minutes.)

=== From Stock Firmware (Ubiquiti AirOS)===

==== Downgrade Ubiquiti AirOS ====

# Download the [https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin Stock Firmware Image v8.5.0.36727].
# Power on the Nanostation via a PoE injector. (This is the **red** ethernet port on your injector.)
# Connect the LAN side of the PoE injector to a computer.
# Assign a static IP/netmask of <code>192.168.1.25/24</code> to the computer
## <code>sudo ip addr add 192.168.1.25/24 dev eth0</code>
# Use a browser to visit http://192.168.1.20/
# Login using the set password or default credentials <code>ubnt / ubnt</code>
# Navigate to settings and downgrade the stock firmware to v8.5.0.36727 using the downloaded image file

==== Install The Mass Mesh OpenWrt Image ====

{{ Note| Additional instructions are available [https://openwrt.org/toh/ubiquiti/ubiquiti_nanostation_ac_loco on OpenWrt's website].}}
# Download the latest Mass Mesh firmware [https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin here].
# Copy the firmware onto the nanostation. (We like to put it in the <code>/tmp/</code> directory.)
# Open a secure shell on the Nanostation. <code>ssh ubnt@192.168.1.20</code>
# Patch the fwupdate.real binary a la the instructions [https://openwrt.org/toh/ubiquiti/ubiquiti_nanostation_ac_loco here.]
# <code>/tmp/fwupdate.real -m /tmp/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin</code>

=== Downgrade Ubiquiti AirOS With An External Programmer===

When your nanostation is bricked, or if the stock firmware won't let you flash our custom firmware, you can use the '''In-System Programming''' (ISP) technique to reflash the device (see also the [https://www.flashrom.org/ISP Flashrom wiki]. You're going to need:

# a Pomona 5252 test clip (https://www.digikey.com/product-detail/en/pomona-electronics/5252/501-2059-ND/745103), ~$16
# a raspberry pi (e.g. a zero w) ~$10
# some header pins and prototyping wires to connect everything

The Nanostation has a Macronix MX25L12835F rom chip ([https://www.macronix.com/Lists/Datasheet/Attachments/7397/MX25L12835F,%203V,%20128Mb,%20v1.6.pdf datasheet]), which is an SPI chip with 16 connectors good for 128 Mbit of storage.

We can use [https://flashrom.org Flashrom] running on a raspberry pi to read and write that chip, if we hook up the Pomona 5252 test clip to the MX25L12835F and connect it to the correct [https://pinout.xyz/pinout/spi SPI pins] on the pi:

[[File:raspberry-pi-pinout.png|inline|raspberry pi GPIO pinout]]

(note: the SPI1 CE0/CE1 pins are not labeled on this image)

==== Pinouts (please proceed with caution!) ====

The Raspberry Pi has 2 SPI interfaces, SPI0 and SPI1.

On the Raspberry Pi boot partition, make sure to update config.txt and uncomment the line that reads

dtparam=spi=on

After a reboot, you should see the spi device files:

root@raspberrypi:/home/pi# ls -laF /dev/spidev0.*
crw-rw---- 1 root spi 153, 0 Jan 7 01:44 /dev/spidev0.0
crw-rw---- 1 root spi 153, 1 Jan 7 01:44 /dev/spidev0.1

Now connect the Raspberry Pi to the Pomona clip. Choose either SPI0 or SPI1. We're going to '''power up the NanoStation with its own power supply''', so we need to leave the VCC pin on the flash chip disconnected. We are however going to connect a few other pins to our 3.3V source from the raspberry pi, to pull them up.

{| class="wikitable"
|-
!colspan="2"|RPi SPI0!!colspan="2"|RPi SPI1!!colspan="2"|Pomona Clip!!Notes!!Color in picture below
|-
|17||3.3V
|17||3.3V
|1||SIO3
|''we do not use this pin, so we pull it up''
|red
|-
|17||3.3V
|17||3.3V
|9||WP#SIO2
|''put the chip in read/write mode''
|red
|-
|19||SPI0 MOSI
|38||SPI1 MOSI
|15||SI
|
|blue
|-
|21||SPI0 MISO
|35||SPI1 MISO
|8||SO
|
|orange
|-
|23||SPI0 SCLK
|40||SPI1 SCLK
|16||SCLK
|
|green
|-
|25||GND
|25||GND
|10||GND
|
|brown
|-
|24||SPI0 CE0
|12||SPI1 CE0
|7||CS
|
|yellow
|}

[[File:raspberry-pi-zero-w-spi0-connected.jpg|inline|1024px|A Raspberry Pi Zero W with wires connected to the SPI0 pins]]

Once the pomona is connected to the raspberry pi, power up the nanostation with its own power supply. Then clip on the pomona.

Flashrom on the raspberry pi requires us to specify the spi speed for the operation. We also need to specify the exact rom chip model, because there are two models that match:

flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=30000 -r proprietary.rom
flashrom on Linux 4.19.75+ (armv6l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L12805D" (16384 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L12835F/MX25L12845E/MX25L12865E" (16384 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): "MX25L12805D", "MX25L12835F/MX25L12845E/MX25L12865E"
Please specify which chip definition to use with the -c <chipname> option.

So here's the final command to read out the chip:

flashrom -c "MX25L12835F/MX25L12845E/MX25L12865E" -p linux_spi:dev=/dev/spidev0.0,spispeed=30000 -r proprietary.rom
flashrom on Linux 4.19.75+ (armv6l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L12835F/MX25L12845E/MX25L12865E" (16384 kB, SPI) on linux_spi.
Reading flash... done.

Useful resources:
* [https://www.flashrom.org/RaspberryPi Flashrom page on using the Raspberry Pi as a flashing tool]

=== Flash using serial header access ===
Using small modifications to the radio, direct serial access allows temporarily running OpenWRT in memory and using the temporary environment to flash a full image to the radio's memory.

[[File:Ubnt_ns5acl_serial.jpg|thumb|Click to enlarge pinout]]
# Using your thumb or a small tool, push the tab in the slot located on the lower rear of the radio and slide the bottom half out of the enclosure
# Looking at the rear of the board (where all the components are on the opposite side as the antenna), locate the serial headers on the middle left side of the board
# Solder at least the top 3 pins shown in the picture. The pins from left to right (starting with the square shaped pad that is unpopulated in the image) are 3.3V, RX, TX, and GND. 3.3V is not needed here
# Connect GND on the board to GND on your FTDI adapter, TX on the board to RX on the FTDI adapter, and RX on the board to TX on the FTDI adapter
# Make sure your FTDI adapter is in 3.3V mode and attached to your computer, then open the serial port on your computer (ex. <code>minicom -D /dev/ttyUSB0</code>). Use 115200 8N1 in your terminal settings.
# Connect the NanoStation and press enter in the console when it says <code>Hit any key to stop autoboot:</code>. You should be left at a <code>ar7240> </code> prompt.
# Connect your laptop to the LAN port of the PoE injector powering the NanoStation and assign a static IP of <code>192.168.1.254</code>
# Install a TFTP server and place [https://downloads.openwrt.org/releases/19.07.0/targets/ath79/generic/openwrt-19.07.0-ath79-generic-ubnt_nanostation-ac-loco-initramfs-kernel.bin openwrt-19.07.0-ath79-generic-ubnt_nanostation-ac-loco-initramfs-kernel.bin] in the root folder of the TFTP server (<code>/srv/tftp</code> for tftp-hpa on Arch).
# Rename the initramfs-kernel.bin file to <code>1401A8C0.img</code> and ensure the tftp server / service is started
# Run <code>tftpboot</code> in the serial console and wait for it to complete
# Run <code>bootm</code> in the serial console to boot the initramfs
# Once OpenWRT has booted, you can press Enter to enable shell access
# Ensure you have an IP address in the 192.168.1.x subnet and use scp to transfer the sysupgrade firmware you wish to flash
# Flash the full firmware to the radio's storage using <code>mtd -r write /tmp/sysupgrade.bin firmware</code>, replacing <code>sysupgrade.bin</code> with the full filename of the firmware you are flashing

== Condensed Command-list ==
=== Flash The Stock Ubiquiti Firmware via TFTP ===
<pre>
wget https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin
cp https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin firmware.bin
sudo apt install tftp
tftp
tftp> connect 192.168.1.20
tftp> rexmt 1
tftp> timeout 60
tftp> binary
tftp> put firmware.bin
</pre>
=== Flash The Mass Mesh Firmware ===
<pre>
wget https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin
scp openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin ubnt@192.168.1.20:/tmp
ssh ubnt@192.168.1.20
hexdump -Cv /bin/ubntbox | sed 's/14 40 fe fe/00 00 00 00/g' | hexdump -R > /tmp/fwupdate.real
chmod +x /tmp/fwupdate.real
/tmp/fwupdate.real -m /tmp/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin
</pre>

Ubiquiti NanoStation 5AC Loco

2020-01-28T02:30:27Z

2020-01-06T21:34:46Z

Cure: Cure uploaded a new version of File:Raspberry-pi-zero-w-with-spi-headers-populated.jpg

== Summary ==
Raspberry Pi zero w with SPI headers populated

Ubiquiti NanoStation 5AC Loco

2020-01-05T14:31:47Z

Cure: /* With an external programmer */

Ubiquiti NanoStation 5AC Loco

2020-01-05T03:09:07Z

Cure: /* With an external programmer */

Ubiquiti NanoStation 5AC Loco

2020-01-05T03:08:31Z

Cure:

File:Raspberry-pi-zero-w-with-spi-headers-populated.jpg

2020-01-05T03:05:45Z

Cure: Raspberry Pi zero w with SPI headers populated

== Summary ==
Raspberry Pi zero w with SPI headers populated

File:Raspberry-pi-pinout.png

2020-01-05T02:44:53Z

Cure: Raspberry pi GPIO pinout, from https://pinout.xyz/resources/raspberry-pi-pinout.png CC-BY-NC

== Summary ==
Raspberry pi GPIO pinout, from https://pinout.xyz/resources/raspberry-pi-pinout.png

CC-BY-NC