Ubiquiti NanoStation 5AC Loco

NanoStation 5AC Loco

The NanoStation 5AC Loco is a directional, weather resistant, PoE powered radio with a beam width of 90 degrees and a secondary omnidirectional radio. This makes it useful for simultaneously meshing on one radio while providing an access point for client devices on the other.

Warning: This is a PoE device. Never connect your computer directly to the PoE injector's red port!!!

Note: The Nanostation's architecture is MIPS 24KC.

Warning: As of January 1, 2020, brand new Nanostations do not support downgrading the Ubiquiti AirOS firmware. (Even with the patch.)

Files

Stock Firmware v8.5.0.36727

MassMesh Firmware (Factory) (Latest)

MassMesh Firmware (Sysupgrade) (Latest)

Flashing

From OpenWrt

Note: Mass Mesh mesh radios have a static IP of 192.168.2.1. To access the admin UI, set your computer's ip/netmask to 192.168.2.10/24, then browse to http://192.168.2.1/ in your favorite web browser.

1. Download the latest MassMesh sysupgrade firmware.
2. Connect to the Nanostation and enter its IP address into your favorite web browser.
   1. If you are using another version of OpenWrt, please refer to its documentation for details about its IP address.
3. Navigate to System → Backup / Flash Firmware → Actions: Flash new firmware image.
4. Choose the sysupgrade file previously downloaded and click Flash
5. Wait for the device to complete and reboot (This can take up to 5 minutes.)

From Stock Firmware (Ubiquiti AirOS)

Downgrade Ubiquiti AirOS

1. Download the Stock Firmware Image v8.5.0.36727.
2. Power on the Nanostation via a PoE injector. (This is the **red** ethernet port on your injector.)
3. Connect the LAN side of the PoE injector to a computer.
4. Assign a static IP/netmask of 192.168.1.25/24 to the computer
   1. sudo ip addr add 192.168.1.25/24 dev eth0
5. Use a browser to visit http://192.168.1.20/
6. Login using the set password or default credentials ubnt / ubnt
7. Navigate to settings and downgrade the stock firmware to v8.5.0.36727 using the downloaded image file

Install The Mass Mesh OpenWrt Image

Note: Additional instructions are available on OpenWrt's website.

1. Download the latest Mass Mesh firmware here.
2. Copy the firmware onto the nanostation. (We like to put it in the /tmp/ directory.)
3. Open a secure shell on the Nanostation. ssh ubnt@192.168.1.20
4. Patch the fwupdate.real binary a la the instructions here.
5. /tmp/fwupdate.real -m /tmp/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin

Downgrade Ubiquiti AirOS With An External Programmer

When your nanostation is bricked, or if the stock firmware won't let you flash our custom firmware, you can use the In-System Programming (ISP) technique to reflash the device (see also the Flashrom wiki. You're going to need:

1. a Pomona 5252 test clip (https://www.digikey.com/product-detail/en/pomona-electronics/5252/501-2059-ND/745103), ~$16
2. a raspberry pi (e.g. a zero w) ~$10
3. some header pins and prototyping wires to connect everything

The Nanostation has a Macronix MX25L12835F rom chip (datasheet), which is an SPI chip with 16 connectors good for 128 Mbit of storage.

We can use Flashrom running on a raspberry pi to read and write that chip, if we hook up the Pomona 5252 test clip to the MX25L12835F and connect it to the correct SPI pins on the pi:

A Raspberry Pi Zero W with SPI headers populated:

Pinouts (untested, please proceed with caution!)

The Raspberry Pi has 2 SPI interfaces, SPI0 and SPI1.

On the Raspberry Pi boot partition, make sure to update config.txt and uncomment the line that reads

dtparam=spi=on

After a reboot, you should see the spi device files:

 root@raspberrypi:/home/pi# ls -laF /dev/spidev0.*
 crw-rw---- 1 root spi 153, 0 Jan  7 01:44 /dev/spidev0.0
 crw-rw---- 1 root spi 153, 1 Jan  7 01:44 /dev/spidev0.1

Now connect the Raspberry Pi to the Pomona clip. Choose either SPI0 or SPI1.

RPi SPI0		RPi SPI1		Pomona Clip		Notes	Color in picture below
17	3.3V	17	3.3V	2	VCC	DO NOT connect the 3.3V/VCC pin if you choose to power the nanostation directly instead!	red
19	SPI0 MOSI	38	SPI1 MOSI	15	SI		blue
21	SPI0 MISO	35	SPI1 MISO	8	SO		green
23	SPI0 SCLK	40	SPI1 SCLK	16	SCLK		orange
25	GND	25	GND	10	GND		brown
24	SPI0 CE0	12	SPI1 CE0	7	CS		yellow

Useful resources:

• Flashrom page on using the Raspberry Pi as a flashing tool

Condensed Command-list

Flash The Stock Ubiquiti Firmware via TFTP

wget https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin
cp https://dl.ubnt.com/firmwares/XC-fw/v8.5.0/WA.v8.5.0.36727.180118.1314.bin firmware.bin
sudo apt install tftp
tftp
tftp> connect 192.168.1.20
tftp> rexmt 1
tftp> timeout 60
tftp> binary
tftp> put firmware.bin

Flash The Mass Mesh Firmware

wget https://github.com/MassMesh/meta-imagebuilder-artifacts/raw/master/massmesh/meshradio/ubnt_nanostation-ac-loco/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin
scp openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin ubnt@192.168.1.20:/tmp
ssh ubnt@192.168.1.20
hexdump -Cv /bin/ubntbox | sed 's/14 40 fe fe/00 00 00 00/g' | hexdump -R > /tmp/fwupdate.real
chmod +x /tmp/fwupdate.real
/tmp/fwupdate.real -m /tmp/openwrt-massmesh-meshradio-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin