Ubiquiti NanoStation 5AC Loco - Revision history

Hurricos: Add the btih for a stock + OpenWrt dump from NS 5AC Loco

2021-02-06T19:31:48Z

Add the btih for a stock + OpenWrt dump from NS 5AC Loco

Hurricos: Add link proving spispeed= specification is required; reduce suggested spispeed for reliability.

2020-09-23T16:39:45Z

Add link proving spispeed= specification is required; reduce suggested spispeed for reliability.

Stephen304 at 20:26, 14 September 2020

2020-09-14T20:26:13Z

Hurricos: Mention inability to use TFTP to rollback beyond a certain version, and the possibility of using U-boot directly to correct this.

2020-09-14T19:58:26Z

Mention inability to use TFTP to rollback beyond a certain version, and the possibility of using U-boot directly to correct this.

Lurker42o: Move advanced techniques into their own section

2020-08-05T23:07:13Z

Move advanced techniques into their own section

Lurker42o: /* Flash The Stock Ubiquiti Firmware via TFTP */ Note about rebooting.

2020-08-05T23:04:12Z

Flash The Stock Ubiquiti Firmware via TFTP: Note about rebooting.

Lurker42o: /* Install The Mass Mesh OpenWrt Image */ Add note pointing out that you need factory image.

2020-08-05T23:03:20Z

Install The Mass Mesh OpenWrt Image: Add note pointing out that you need factory image.

Lurker42o: Link to serial instructions.

2020-02-01T23:52:46Z

Link to serial instructions.

Stephen304: /* Downgrade Ubiquiti AirOS With An External Programmer */

2020-01-29T02:00:57Z

Downgrade Ubiquiti AirOS With An External Programmer

Cure: /* Reading the chip with flashrom */

2020-01-29T01:46:21Z

Reading the chip with flashrom

← Older revision		Revision as of 19:31, 6 February 2021
Line 17:		Line 17:

	[https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-sysupgrade.bin MassMesh Firmware (Sysupgrade) (Latest)]		[https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-sysupgrade.bin MassMesh Firmware (Sysupgrade) (Latest)]
		+
		+	[magnet:?xt=urn:btih:3ec9b5e9cbc7561507eb933df855f15c7b7eb9bc BitTorrent magnet link containing two 16MiB flash .bin files, one for a pre-OpenWrt stock 5AC Loco and another for an OpenWrt-flashed Loco]. You may use the latter to overwrite the content of flash on a 5AC Loco to restore it to an older version of U-boot capable of booting OpenWrt, but note that the MAC address is also stored in flash.

	== Flashing ==		== Flashing ==

@@ Line 157: / Line 157: @@
 ==== Reading the chip with flashrom ====
-Once the pomona is connected to the raspberry pi, make sure the nanostation is disconnected from power/ethernet. Then clip on the pomona.
+Once the Pomona is connected to the raspberry pi, make sure the NanoStation is disconnected from power/ethernet. Then clip on the Pomona.
-Flashrom on the raspberry pi requires us to specify the spi speed for the operation. We also need to specify the exact rom chip model, because there are two models that match:
+Flashrom on the Pi [https://github.com/flashrom/flashrom/issues/29 requires] us to specify the speed of operation. We also need to specify the exact ROM chip model, because there are two models that match:
-   $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=30000 -r proprietary.rom
+   $ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=4096 -r proprietary.rom
    flashrom  on Linux 4.19.75+ (armv6l)
    flashrom is free software, get the source code at https://flashrom.org
@@ Line 173: / Line 173: @@
 So here's the final command to read out the chip:
-   $ flashrom -c "MX25L12835F/MX25L12845E/MX25L12865E" -p linux_spi:dev=/dev/spidev0.0,spispeed=30000 -r proprietary.rom
+   $ flashrom -c "MX25L12835F/MX25L12845E/MX25L12865E" -p linux_spi:dev=/dev/spidev0.0,spispeed=4096 -r proprietary.rom
    flashrom  on Linux 4.19.75+ (armv6l)
    flashrom is free software, get the source code at https://flashrom.org
@@ Line 205: / Line 205: @@
 ==== Writing to the chip with flashrom ====
-   pi@raspberrypi:~ $ flashrom -c "MX25L12835F/MX25L12845E/MX25L12865E" -p linux_spi:dev=/dev/spidev0.0,spispeed=30000 -w read1-10000-openwrt.bin
+   pi@raspberrypi:~ $ flashrom -c "MX25L12835F/MX25L12845E/MX25L12865E" -p linux_spi:dev=/dev/spidev0.0,spispeed=4096 -w read1-10000-openwrt.bin
    flashrom  on Linux 4.19.75-v7l+ (armv7l)
    flashrom is free software, get the source code at https://flashrom.org

@@ Line 31: / Line 31: @@
 === From Stock Firmware (Ubiquiti AirOS)===
-==== Downgrade Ubiquiti AirOS ====
+==== Downgrade Ubiquiti AirOS via Web UI ====
 # Download the [https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin Stock Firmware Image v8.5.0.36727].
@@ Line 41: / Line 41: @@
 # Login using the set password or default credentials <code>ubnt / ubnt</code>
 # Navigate to settings and downgrade the stock firmware to v8.5.0.36727 using the downloaded image file
 ==== Install The Mass Mesh OpenWrt Image ====
@@ Line 213: / Line 233: @@
 # Ensure you have an IP address in the 192.168.1.x subnet and use scp to transfer the sysupgrade firmware you wish to flash
 # Flash the full firmware to the radio's storage using <code>mtd -r write /tmp/sysupgrade.bin firmware</code>, replacing <code>sysupgrade.bin</code> with the full filename of the firmware you are flashing
 == Condensed Command-list ==

@@ Line 196: / Line 196: @@
 === Flash using serial header access ===
-Using small modifications to the radio, direct serial access allows temporarily running OpenWRT in memory and using the temporary environment to flash a full image to the radio's memory.
+Direct serial access allows temporarily running OpenWRT in memory and using the temporary environment to flash a full image to the radio's memory.
 [[File:Ubnt_ns5acl_serial.jpg|thumb|Click to enlarge pinout]]
@@ Line 213: / Line 213: @@
 # Ensure you have an IP address in the 192.168.1.x subnet and use scp to transfer the sysupgrade firmware you wish to flash
 # Flash the full firmware to the radio's storage using <code>mtd -r write /tmp/sysupgrade.bin firmware</code>, replacing <code>sysupgrade.bin</code> with the full filename of the firmware you are flashing
 == Condensed Command-list ==

@@ Line 50: / Line 50: @@
 # Patch the fwupdate.real binary a la the instructions [https://openwrt.org/toh/ubiquiti/ubiquiti_nanostation_ac_loco here.]
 # <code>/tmp/fwupdate.real -m /tmp/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin</code>
 === Downgrade Ubiquiti AirOS With An External Programmer===

@@ Line 225: / Line 225: @@
 tftp> put firmware.bin
 </pre>
 === Flash The Mass Mesh Firmware ===
 <pre>

@@ Line 44: / Line 44: @@
 ==== Install The Mass Mesh OpenWrt Image ====
-{{ Note| Additional instructions are available [https://openwrt.org/toh/ubiquiti/ubiquiti_nanostation_ac_loco on OpenWrt's website].}}
+{{ Note| Additional instructions are available [https://openwrt.org/toh/ubiquiti/ubiquiti_nanostation_ac_loco on OpenWrt's website]. The "factory" image should be chosen for this step.}}
 # Download the latest Mass Mesh firmware [https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin here].
 # Copy the firmware onto the nanostation. (We like to put it in the <code>/tmp/</code> directory.)

@@ Line 9: / Line 9: @@
 {{Note| The Nanostation's architecture is '''MIPS 24KC.'''}}
-{{ Warning| As of January 1, 2020, brand new Nanostations do not support downgrading the Ubiquiti AirOS firmware. (Even with the patch.)}}
+{{ Warning| As of January 1, 2020, brand new Nanostations do not support downgrading the Ubiquiti AirOS firmware. (Even with the patch.) Instead, you must [[#Flash using serial header access|Flash using serial header access]]}}
 == Files ==

@@ Line 180: / Line 180: @@
 Useful resources:
 * [https://www.flashrom.org/RaspberryPi Flashrom page on using the Raspberry Pi as a flashing tool]
 === Flash using serial header access ===

@@ Line 173: / Line 173: @@
         0x389F0         uImage header, header size: 64 bytes, header CRC: 0xE75790E0, created: 2018-11-13 14:36:59, image size: 998847 bytes, Data
    Address: 0x80002000, Entry Point: 0x80002000, data CRC: 0xAAECA664, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS Ubiquiti Linux-2.6.32.68"
-        0x50000         uImage header, header size: 64 bytes, header CRC: 0x22425505, created: 2019-02-13 09:09:52, image size: 990770 bytes, Data
+        0x50000         uImage header, header size: 64 bytes, header CRC: 0x22425505, created: 2019-02-13 09:09:52, image size: 990770 bytes, Data Address: 0x80002000, Entry Point: 0x80002000, data CRC: 0x8F3B71D3, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS Ubiquiti Linux-2.6.32.68"
         0x50040         LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 2836596 bytes
    1318514       0x141E72        Ubiquiti partition header, header size: 56 bytes, name: "PARTrootfs", base address: 0x00000002, data size: 0 bytes