Installing OpenWrt on UniFi nanoHD

I'm struggling with installation of OpenWrt on my new UniFi nanoHD access point.

I was following the steps described in David Bauer commit message https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=4c8446bf39de99990847eb4bc7744e25835a34f5
but without any success.

Reason might be the steps re described for version 3.9.27 with U-Boot 1.1.3-00002-g9d3c98f [UniFi,1.0.8.55]. I'm stuck on 4.3.20 with U-Boot 2018.03 [UniFi,v1.1.25.57], because mca-dump reports minimal required versions as 4.3.16.

After such installation device reboots into TFTP mode.

Where might be the problem?
Is snapshot broken? Is it due to the newer botloader?

How can I set it up?

dts dump from latest version (4.3.21)

/ {
	model = "Ubiquiti Networks, Inc. UAP-NANO-HD";
	compatible = "mediatek,mt7621-soc";
	#address-cells = <0x01>;
	#size-cells = <0x01>;

	pcie@1e140000 {
		reg = <0x1e140000 0x100 0x1e142000 0x100>;
		interrupts = <0x00 0x04 0x04 0x00 0x18 0x04 0x00 0x19 0x04>;
		pinctrl-0 = <0x0c>;
		compatible = "mediatek,mt7621-pci";
		clock-names = "pcie0\0pcie1\0pcie2";
		reset-names = "pcie0\0pcie1\0pcie2";
		bus-range = <0x00 0xff>;
		device_type = "pci";
		clocks = <0x0d 0x18 0x0d 0x19 0x0d 0x1a>;
		ranges = <0x2000000 0x00 0x00 0x60000000 0x00 0x10000000 0x1000000 0x00 0x00 0x1e160000 0x00 0x10000>;
		resets = <0x02 0x18 0x02 0x19 0x02 0x1a>;
		status = "okay";
		#address-cells = <0x03>;
		#size-cells = <0x02>;
		pinctrl-names = "default";
		interrupt-parent = <0x04>;

		pcie0 {
			reg = <0x00 0x00 0x00 0x00 0x00>;
			device_type = "pci";
			#address-cells = <0x03>;
			#size-cells = <0x02>;

			mt76@0,0 {
				reg = <0x00 0x00 0x00 0x00 0x00>;
				mediatek,2ghz = <0x00>;
				device_type = "pci";
				mediatek,mtd-eeprom = <0x0e 0x00>;
			};
		};

		pcie1 {
			reg = <0x800 0x00 0x00 0x00 0x00>;
			device_type = "pci";
			#address-cells = <0x03>;
			#size-cells = <0x02>;
		};

		pcie2 {
			reg = <0x1000 0x00 0x00 0x00 0x00>;
			device_type = "pci";
			#address-cells = <0x03>;
			#size-cells = <0x02>;
		};
	};

	cpus {

		cpu@0 {
			compatible = "mips,mips1004Kc";
		};

		cpu@1 {
			compatible = "mips,mips1004Kc";
		};
	};

	gsw@1e110000 {
		reg = <0x1e110000 0x8000>;
		interrupts = <0x00 0x17 0x04>;
		compatible = "mediatek,mt7621-gsw";
		phandle = <0x09>;
		linux,phandle = <0x09>;
		interrupt-parent = <0x04>;
	};

	rstctrl {
		#reset-cells = <0x01>;
		compatible = "ralink,rt2880-reset";
		phandle = <0x02>;
		linux,phandle = <0x02>;
	};

	chosen {
		bootargs = "ubootver=v1.1.25.57 ramoops.mem_address=0x7ff8000 ramoops.mem_size=32768 ramoops.ecc=1 mem=131039K ubntbootid=0";
	};

	sdhci@1E130000 {
		reg = <0x1e130000 0x4000>;
		interrupts = <0x00 0x14 0x04>;
		compatible = "ralink,mt7620-sdhci";
		status = "disabled";
		interrupt-parent = <0x04>;
	};

	gpio-keys-polled {
		compatible = "gpio-keys-polled";
		poll-interval = <0x14>;
		#address-cells = <0x01>;
		#size-cells = <0x00>;

		reset {
			gpios = <0x0f 0x0c 0x01>;
			label = "reset";
			linux,code = <0x198>;
		};
	};

	xhci@1E1C0000 {
		reg = <0x1e1c0000 0x1000 0x1e1d0700 0x100>;
		interrupts = <0x00 0x16 0x04>;
		compatible = "mediatek,mt8173-xhci";
		clock-names = "sys_ck";
		clocks = <0x01>;
		status = "okay";
		interrupt-parent = <0x04>;
	};

	gpio-leds {
		compatible = "gpio-leds";

		wifi {
			gpios = <0x0f 0x03 0x00>;
			label = "ubnt:blue:personality";
			linux,default-trigger = "external1";
		};

		power {
			gpios = <0x0f 0x04 0x00>;
			label = "ubnt:white:personality";
			linux,default-trigger = "external0";
		};
	};

	ethernet@1e100000 {
		reg = <0x1e100000 0x10000>;
		interrupts = <0x00 0x03 0x04>;
		mediatek,switch = <0x09>;
		compatible = "mediatek,mt7621-eth";
		reset-names = "fe\0eth";
		mtd-mac-address = <0x0b 0x00>;
		resets = <0x02 0x06 0x02 0x17>;
		mac-address = [74 ac b9 d3 6a 2a];
		#address-cells = <0x01>;
		#size-cells = <0x00>;
		mediatek,ethsys = <0x0a>;
		interrupt-parent = <0x04>;

		mdio-bus {
			#address-cells = <0x01>;
			#size-cells = <0x00>;

			ethernet-phy@1f {
				reg = <0x1f>;
				phy-mode = "rgmii";
			};
		};
	};

	aliases {
		serial0 = "/palmbus@1E000000/uartlite@c00";
	};

	interrupt-controller@1fbc0000 {
		reg = <0x1fbc0000 0x2000>;
		compatible = "mti,gic";
		mti,reserved-cpu-vectors = <0x07>;
		#interrupt-cells = <0x03>;
		phandle = <0x04>;
		interrupt-controller;
		linux,phandle = <0x04>;

		timer {
			interrupts = <0x01 0x01 0x00>;
			compatible = "mti,gic-timer";
			clocks = <0x08>;
		};
	};

	nand@1e003000 {
		reg = <0x1e003000 0x800 0x1e003800 0x800>;
		bank-width = <0x02>;
		compatible = "mtk,mt7621-nand";
		status = "disabled";
		#address-cells = <0x01>;
		#size-cells = <0x01>;
	};

	pinctrl {
		pinctrl-0 = <0x07>;
		compatible = "ralink,rt2880-pinmux";
		pinctrl-names = "default";

		i2c {
			phandle = <0x03>;
			linux,phandle = <0x03>;

			i2c {
				ralink,function = "i2c";
				ralink,group = "i2c";
			};
		};

		spi {
			phandle = <0x06>;
			linux,phandle = <0x06>;

			spi {
				ralink,function = "spi";
				ralink,group = "spi";
			};
		};

		mdio {

			mdio {
				ralink,function = "mdio";
				ralink,group = "mdio";
			};
		};

		nand {

			sdhci-nand {
				ralink,function = "nand2";
				ralink,group = "sdhci";
			};

			spi-nand {
				ralink,function = "nand1";
				ralink,group = "spi";
			};
		};

		pcie {
			phandle = <0x0c>;
			linux,phandle = <0x0c>;

			pcie {
				ralink,function = "pcie rst";
				ralink,group = "pcie";
			};
		};

		sdhci {

			sdhci {
				ralink,function = "sdhci";
				ralink,group = "sdhci";
			};
		};

		uart1 {

			uart1 {
				ralink,function = "uart1";
				ralink,group = "uart1";
			};
		};

		uart2 {

			uart2 {
				ralink,function = "uart2";
				ralink,group = "uart2";
			};
		};

		uart3 {

			uart3 {
				ralink,function = "uart3";
				ralink,group = "uart3";
			};
		};

		pinctrl0 {
			phandle = <0x07>;
			linux,phandle = <0x07>;

			gpio {
				ralink,function = "gpio";
				ralink,group = "i2c\0uart2\0uart3\0rgmii2\0jtag";
			};
		};

		rgmii1 {

			rgmii1 {
				ralink,function = "rgmii1";
				ralink,group = "rgmii1";
			};
		};

		rgmii2 {

			rgmii2 {
				ralink,function = "rgmii2";
				ralink,group = "rgmii2";
			};
		};
	};

	ethsys@1e000000 {
		reg = <0x1e000000 0x8000>;
		compatible = "mediatek,mt7621-ethsys";
		phandle = <0x0a>;
		linux,phandle = <0x0a>;
	};

	palmbus@1E000000 {
		reg = <0x1e000000 0x100000>;
		compatible = "palmbus";
		ranges = <0x00 0x1e000000 0xfffff>;
		#address-cells = <0x01>;
		#size-cells = <0x01>;

		i2c@900 {
			reg = <0x900 0x100>;
			pinctrl-0 = <0x03>;
			compatible = "mediatek,mt7621-i2c";
			reset-names = "i2c";
			clocks = <0x01>;
			resets = <0x02 0x10>;
			status = "disabled";
			#address-cells = <0x01>;
			#size-cells = <0x00>;
			pinctrl-names = "default";
		};

		i2s@a00 {
			reg = <0xa00 0x100>;
			dmas = <0x05 0x04 0x05 0x06>;
			interrupts = <0x00 0x10 0x04>;
			txdma-req = <0x02>;
			compatible = "mediatek,mt7621-i2s";
			reset-names = "i2s";
			clocks = <0x01>;
			resets = <0x02 0x11>;
			status = "disabled";
			rxdma-req = <0x03>;
			dma-names = "tx\0rx";
			interrupt-parent = <0x04>;
		};

		systick@d00 {
			reg = <0xd00 0x10>;
			interrupts = <0x00 0x05 0x04>;
			compatible = "ralink,mt7621-systick\0ralink,cevt-systick";
			reset-names = "intc";
			resets = <0x02 0x1c>;
			interrupt-parent = <0x04>;
		};

		cpc@1fbf0000 {
			reg = <0x1fbf0000 0x8000>;
			compatible = "mtk,mt7621-cpc";
		};

		mc@1fbf8000 {
			reg = <0x1fbf8000 0x8000>;
			compatible = "mtk,mt7621-mc";
		};

		spi@b00 {
			reg = <0xb00 0x100>;
			pinctrl-0 = <0x06>;
			compatible = "ralink,mt7621-spi";
			reset-names = "spi";
			clocks = <0x01>;
			resets = <0x02 0x12>;
			status = "okay";
			#address-cells = <0x01>;
			#size-cells = <0x00>;
			pinctrl-names = "default";

			mx25l12805d@0 {
				reg = <0x00>;
				compatible = "jedec,spi-nor";
				m25p,chunked-io = <0x20>;
				spi-max-frequency = <0x17d7840>;
				#address-cells = <0x01>;
				#size-cells = <0x01>;

				partition@10d0000 {
					reg = <0x10d0000 0xf30000>;
					label = "kernel1";
				};

				partition@1a0000 {
					reg = <0x1a0000 0xf30000>;
					label = "kernel0";
				};

				partition@0 {
					reg = <0x00 0x60000>;
					label = "u-boot";
				};

				partition@60000 {
					reg = <0x60000 0x10000>;
					label = "u-boot-env";
				};

				partition@70000 {
					reg = <0x70000 0x10000>;
					label = "Factory";
					phandle = <0x0e>;
					read-only;
					linux,phandle = <0x0e>;
				};

				partition@80000 {
					reg = <0x80000 0x10000>;
					label = "EEPROM";
					phandle = <0x0b>;
					read-only;
					linux,phandle = <0x0b>;
				};

				partition@90000 {
					reg = <0x90000 0x10000>;
					label = "bs";
				};

				partition@a0000 {
					reg = <0xa0000 0x100000>;
					label = "cfg";
				};
			};
		};

		uartlite@c00 {
			reg = <0xc00 0x100>;
			interrupts = <0x00 0x1a 0x04>;
			reg-shift = <0x02>;
			no-loopback-test;
			compatible = "ns16550a";
			clock-frequency = <0x2faf080>;
			clocks = <0x01>;
			reg-io-width = <0x04>;
			interrupt-parent = <0x04>;
		};

		gdma@2800 {
			reg = <0x2800 0x800>;
			interrupts = <0x00 0x0d 0x04>;
			compatible = "ralink,rt3883-gdma";
			reset-names = "dma";
			#dma-requests = <0x10>;
			resets = <0x02 0x0e>;
			status = "disabled";
			#dma-channels = <0x10>;
			#dma-cells = <0x01>;
			phandle = <0x05>;
			linux,phandle = <0x05>;
			interrupt-parent = <0x04>;
		};

		sysc@0 {
			reg = <0x00 0x100>;
			compatible = "mtk,mt7621-sysc";
		};

		memc@5000 {
			reg = <0x300 0x100>;
			compatible = "mtk,mt7621-memc";
		};

		wdt@100 {
			reg = <0x100 0x100>;
			compatible = "mtk,mt7621-wdt";
		};

		hsdma@7000 {
			reg = <0x7000 0x1000>;
			interrupts = <0x00 0x0b 0x04>;
			compatible = "mediatek,mt7621-hsdma";
			reset-names = "hsdma";
			#dma-requests = <0x01>;
			resets = <0x02 0x05>;
			status = "disabled";
			#dma-channels = <0x01>;
			#dma-cells = <0x01>;
			interrupt-parent = <0x04>;
		};

		gpio@600 {
			reg = <0x600 0x100>;
			compatible = "mtk,mt7621-gpio";
			#address-cells = <0x01>;
			#size-cells = <0x00>;

			bank@0 {
				reg = <0x00>;
				#gpio-cells = <0x02>;
				compatible = "mtk,mt7621-gpio-bank";
				phandle = <0x0f>;
				gpio-controller;
				linux,phandle = <0x0f>;
			};

			bank@1 {
				reg = <0x01>;
				#gpio-cells = <0x02>;
				compatible = "mtk,mt7621-gpio-bank";
				gpio-controller;
			};

			bank@2 {
				reg = <0x02>;
				#gpio-cells = <0x02>;
				compatible = "mtk,mt7621-gpio-bank";
				gpio-controller;
			};
		};
	};

	sysclock@0 {
		#clock-cells = <0x00>;
		compatible = "fixed-clock";
		clock-frequency = <0xd693a40>;
		phandle = <0x01>;
		linux,phandle = <0x01>;
	};

	cpuclock@0 {
		#clock-cells = <0x00>;
		compatible = "fixed-clock";
		clock-frequency = <0x3473bc00>;
		phandle = <0x08>;
		linux,phandle = <0x08>;
	};

	cpuintc@0 {
		compatible = "mti,cpu-interrupt-controller";
		#interrupt-cells = <0x01>;
		#address-cells = <0x00>;
		interrupt-controller;
	};

	memory@0 {
		reg = <0x00 0x8000000>;
		device_type = "memory";
	};

	clkctrl {
		#clock-cells = <0x01>;
		compatible = "ralink,rt2880-clock";
		phandle = <0x0d>;
		linux,phandle = <0x0d>;
	};
};

Does anyone can dump it from older devices?

I'm really interested in finding out how to get the nanoHD running openwrt too - the stock firmware has been a debacle with recent releases.

I hope David can chime in and help us out.

According to articles about other Unif devices I assume lower version is needed due to the attached bootloader. I wonder what is the difference that causes openwrt not too boot. IMO will be the best to find it out and apply changes so it will be possible to use OpenWrt on recent bootloader.

I'm also wondering why there is only sysupgrade image for nanoHD.

Looks like, it might be related to some flash issue in latest snapshot :frowning: Nanobeam AC Gen 2?

Is it somehow possible to obtain older snapshot, or I have to build it by myself?

For the record I tried to flash with snapshot from 2nd of June https://web.archive.org/web/20200602192851/https://downloads.openwrt.org/snapshots/targets/ramips/mt7621/openwrt-ramips-mt7621-ubnt_unifi-nanohd-squashfs-sysupgrade.bin but it seems that problem is still present there.

@PolynomialDivision do you know since when the issue with 16pin flash started?

With 5.4 kernel. :wink: You can just build a snapshot with 4.19 kernel if the target is ath79. That is what I do.

I've managed to build an image from the revision of David's commit, it is based on kernel 4.14, but unfortunately my nano don't like it...

latest:
u-boot legacy uImage, MIPS OpenWrt Linux-5.4.71, Linux/MIPS, OS Kernel Image (lzma), 2480450 bytes, Fri Oct 16 13:29:48 2020, Load Address: 0x80001000, Entry Point: 0x80001000, Header CRC: 0x30FA975F, Data CRC: 0x69149EA8
my:
u-boot legacy uImage, MIPS OpenWrt Linux-4.14.172, Linux/MIPS, OS Kernel Image (lzma), 2016612 bytes, Tue Mar 10 20:54:46 2020, Load Address: 0x80001000, Entry Point: 0x80001000, Header CRC: 0x807D09BF, Data CRC: 0xE9DFECFA

EDIT
I made a dump from the originally installed firmware and file utility is not able to recognize it (described as data). I was wondering if it may be the new uImage instead of legacy one :thinking:

The new bootloader may be requiring signed or encrypted firmware, in which case you'll have to downgrade the bootloader.

Is it possible to open the case of these and make a serial connection?

Looks like opening the case is not possible. According to the video I found it is glued, so opening may void my warranty.

I have topic opened on Ubiquity support about downgrading under minimal version. One way I see is to extract boot loader from official image (for example with this tool: https://github.com/aliosa27/ubnt-mkfwimage author may add nano support soon) and dd it manually. Or even made a custom build?

Yesterday I took the risk and dd–ed the bootloader with 3.29 version together with snapshoot image from commit 4c8446bf39de99990847eb4bc7744e25835a34f5, which was supposed to more or less work.

Unfortunately the result was boot error (fast blinking white led). It is "slightly better" then before where loading this image was resulting the device to switch onto the TFTP mode. Exactly same happens (boot error) when launching the official 3.x image.

I assume that there is some slightly difference in the hardware, that is not correctly reflected in the DTS.

Same issue here, it only boots into TFTP mode (I think, blue/white blinking) with an OpenWRT image dd'ed to mtd as per the initial commit. Downgrading to v3.9.27 yields a fast white blinking LED.

Did you figure out why that happens? Any solution?

@knacky
In the now closed thread Flashing OpenWrt to Ubiquiti UniFi AP (stock flash ver >= 4.0.15) - #7 by knacky it sounds like you found a way? Can you be more specific please?

Does it boil down to:

  1. Use fwupdate.real to downgrade the bootloader
  2. Write an OpenWrt image without reboot using mtd write

?

fwiw downgrading using fwupdate.real doesn't work for me:

UAP-nanoHD-BZ.5.43.23# fwupdate.real -d -c /tmp/BZ.mt7621.v3.9.27.8537.180317.1220.bin 
check = 1
verbose = 1
keep_running = 0
write_flash = 0
imagefile = /tmp/BZ.mt7621.v3.9.27.8537.180317.1220.bin
Found mtd block: /dev/mtd0(u-boot)
Found mtd block: /dev/mtd1(u-boot-env)
Found mtd block: /dev/mtd2(Factory)
Found mtd block: /dev/mtd3(EEPROM)
Found mtd block: /dev/mtd4(bs)
Found mtd block: /dev/mtd5(cfg)
Found mtd block: /dev/mtd6(kernel0)
Found mtd block: /dev/mtd7(kernel1)
Got U-Boot variable: mtdparts = mtdparts=mt7621-nor0:384k(u-boot),64k(u-boot-env),64k(Factory),64k(EEPROM),64k(bs),1024k(cfg),15552k(kernel0),15552k(kernel1)
Adding U-Boot partition: u-boot BFC00000 00060000
Adding U-Boot partition: u-boot-env BFC60000 00010000
Adding U-Boot partition: Factory BFC70000 00010000
Adding U-Boot partition: EEPROM BFC80000 00010000
Adding U-Boot partition: bs BFC90000 00010000
Adding U-Boot partition: cfg BFCA0000 00100000
Adding U-Boot partition: kernel0 BFDA0000 00F30000
Adding U-Boot partition: kernel1 C0CD0000 00F30000
Calculating flash size:
Adding block: /dev/mtd0("u-boot") - size: 00060000
Adding block: /dev/mtd1("u-boot-env") - size: 00010000
Skipping block /dev/mtd2("Factory") - size: 00010000, artificial: 0, unallocated: 0, writeable: 0(WRITEABLE: 400, flags: 800)
Skipping block /dev/mtd3("EEPROM") - size: 00010000, artificial: 0, unallocated: 0, writeable: 0(WRITEABLE: 400, flags: 800)
Adding block: /dev/mtd4("bs") - size: 00010000
Adding block: /dev/mtd5("cfg") - size: 00100000
Adding block: /dev/mtd6("kernel0") - size: 00F30000
Adding block: /dev/mtd7("kernel1") - size: 00F30000
Total flash size: 02000000
Flash start: BFC00000
Flash end: C1C00000
Header MAGIC 'UBNT'
Current: BZ.mt7621_5.43.23+12533.201222.2019
New ver: BZ.mt7621.v3.9.27.8537.180317.1220
Invalid version 'BZ.mt7621.v3.9.27.8537.180317.1220'

As stated before, most likely there is hardware changes between versions. Support stated that it is not true, and "version lock" is just because. But after force downloading the boot loader device is not booting.

Sorry for the late reply @dhewg. I downgraded the bootloader as follows:

  1. Download v3.9.27 firmware from Ubiquiti site
    Ubiquiti - Downloads

  2. SCP the firmware file to /tmp on the nanoHD

  3. Run the following command to downgrade the bootloader to the one included in the v3.9.27 firmware file:
    fwupdate.real -m /tmp/BZ.mt7621.v3.9.27.8537.180317.1220.bin

  4. When it reboots and comes back up, follow the installation instructions in the git commit link in post #1 of this thread to install OpenWrt.

I just tried the above methods to install OpenWRT on the NanoHD. It did not work.

I experienced the same roadblocks as the users above. It turns out you cannot simply downgrade the bootloader as described by @knacky, the result is "Invalid version". The lowest firmware I could go was 4.3.21.xxx. All others failed when using the SCP method for transfer and SSH for fwupdate.real.

I also tried older firmware with TFTP, the result failed with rapid flashing white. Nothing that I tried worked to install an earlier firmware (and specifically the firmware v3.9.27.xx suggested in the commit).

I also YOLO tried with the snapshot, but the same happened as @dhewg mentioned, it would boot to TFTP.

I just posted this to confirm that downgrading doesn't work on these recently purchased nanoHD. I ended up using UniFi for now (send help lol :wink: ).

What's the next step?

Then, sadly, it sounds as though newer firmware versions shipping on current stock are prohibiting u-boot downgrades.

Hey guys,

i opened one of my Nano HD's. They are just clamped together not glued.

There is a 4 Pin Header on the PCB which will give you a serial terminal.

Flashing the 3.9.27 Firmware does start the nano and will after some time even start the ssh server (Even though the LED is fast flashing white). But you cannot login to the ssh server.
However with the Serial console you can copy the openwrt firmware image to the nano with netcat or something like that. Then you can flash like it is said in the git commit and openwrt will start fine.

But... i had this idea of extracting the u-boot bootlader from Version 3.9.27, copy it to my pc, then upgrade to a recent firmware (5.43.36), login with ssh, flash like said in the git commit, AND dd the old u-boot bootlader into /dev/mtd0. Guess what... Bricked my nano. So don't be like me and dd your u-boot manually :smiley:

2 Likes

I forgot something:

When flashing the openwrt Image like PsyLive said (4.321.xxx) it will say "Bad CRC" when booting up and will fall back to tftp mode.

1 Like