I have a Ubiquity Nano Station M5 with FW version XW.v6.1.7. (HW rev. 1901K)
I tried several methods to downgrade the stock FW so that I'm able to install openWRT, but I failed.
Any FW older then v6.1.4 are giving me the error code A12. Root cause seems to be the fact that Ubiquiti has changed the HW for newer Nano Stations M5. It seems this has changes since HW revision 1847G [1].
Together with @guifipedro I was able to start to compare the dmesg of an 'old' device with openWRT and a 'new' device with v6.1.4 FW. Up to now our findings are, that the flash chip has changed, which seems to be ath-nor0 now.
I'm writing this to raise awareness that:
you are not able to downgrade the AirOS FW to a point where you can install openWRT via the web console or tftp
It's highly possible that the actual openWRT image for the NanoStation M5 is not bootable with the newer HW revisions.
Next steps will be to open the box to access the serial console (who needs warranty of a useless device, if you can't install openWRT anyway...) and try to see if I can overwrite the kernel with an openWRT one via the serial console and u-boot. If anyone is working on something similar or wants the help, please let me know.
That's for the new AC models and AirOS 8. Would not apply to non-AC hardware.
I think there was a process to manually initiate TFTP with some options from the bootloader command prompt (requires opening the case to attach serial). This will allow flashing an old AirOS, but it will only install the kernel / rootfs. Then boot that AirOs and use the web interface to again flash the old AirOS. That replaces the bootloader with the old one. Finally you can install the "factory" OpenWrt.
For a one time run you don't have to solder pins on the serial port, just put a row of square pins in the holes and tilt them to the side so they make contact.
Did you try it already? If the upgrade procedure is identical across all airOS versions then it should work, of course you flash image for your device instead of the one in wiki.
Well the problem is, that older AirOS version does not support the HW, as, at least, the flash chip has changed. That's the problem. You don't get a running AirOS because, I suppose, the kernel is not able to read the rootfs. So no way to update through the web interface neither.
That indicates you have been able to write to flash and the same procedure is valid on airos 6.
Boot failure is likely caused by wrong/incomplete firmware, or flashing error. Maybe even u-boot that checks for fw signature, but even u-boot can be replaced if found problematic.
Important thing is that it's possible to do it without device opening.
For the recovery, use tftp client and reset button. Google for howtos.
Up to know having had a look on the u-boot source code ubiquiti provides me, I don't think that u-boot checks a special signature. I started to have a look on the kernel header with hexdump, and what I found out:
/dev/mtd3 is only 1MB big but openWRT kernel is 1.313 MB. That's why crc32 checksum in u-boot fails.
So I have to find out, how to reduce the size of the kernel. If you have any hints, that would be appreciated as my knowledge of the openWRT build system is pretty much rudimentary...
There is no need for fullquotes. Just use the Reply button below the posting you want to reply to, and the forum software will automatically link your posting to the one you reply to.
Therefore, no need to completely quote the posting you are replying to.
Thanks for your understanding.
mtd2 or mtd3? run cat /proc/mtd to display partitions
on litebeam kernel size is also 1.4MB but it loaded fine.while experimenting with flashing of first unit, i did flash only kernel partition, then dumped it back into ram and ran md5sum to verify that it was properly written - you can try that to see if there are any problems.
flashing second unit suceeded right on first attempt but openwrt displayed many jffs2 eraseblock messages in kernel - only conclusion i could made is that these messages appeared because flash was not erased prior to writing image, which i did on first unit by writing empty file first
The flash block was not erased first. NOR flash lets you change a 1 bit to a 0 with a single write, but to change any 0 to a 1 the whole block needs to be erased. This is usually done by running mtd write which includes an erase routine.
Good news, I was able to boot a totally striped down openWRT 4.14 kernel, which of course wasn't able to reach userspace. But that confirms, that:
a) we can write the mtd partition via ssh
b) u-boot does not check any special kernel signature
Now I'll need to find out how to build a kernel small enough to fit the device.
I don't know how you proceed in these cases, but while this is not solved we should warn future users in the openwrt wiki site for this device [1] that at the moment new versions are not working. That there is a "work in progress" and link to this topic (I don't know if there are other opened)
