Ubiquiti NanoStation M2, 64MB RAM and 16MB Flash upgrade, help with image build

Hi Guys.

I have a few of the Ubiquiti NanoStation M2's Running the latest 19.07.3
which is now about to be the last version available due to stability, low ram and flash.
which in all fairness, in the current configuration is not a bad decision.
I am experiencing issues especially with storage..

However. I really like these powerful devices. and I believe fairly strongly that they should get a new lease on life. so I have ordered some 64MB RAM chips (HY5DU121622) as well as 16MB Spi flash chips (W25Q128BVFG) for them.
I'm pretty sure I got a compatible RAM chip here, and that it will be auto-detected out of the box?.
I'm also sure that the larger SPI flash will "work", however not fully utilized by the firmware due to memory mapping.

I'm fairly new to whole compiling my own OpenWrt thing, but following the guide i got it running successfully.
however. with no modifications to the memory layout, that will just result in the standard image file

so I'm hoping you guys could throw me a bone and a few tips on the changes to make and where?. to get a functional memory map, what if anything is needed for U-Boot?, etc.
and get building this new and improved.

NanoStation M2 Atheros AR7240 / Atheros AR9283 64MB RAM, 16MB Flash

I'm pretty sure I'm supposed to be looking in the extracted imagebuilder file (currently)

not sure which target is the m2 ? I'm assuming its the "m"

root@someserver:~/openwrt/nanostation/openwrt-imagebuilder-19.07.3-ath79-generic.Linux-x86_64# make info | grep nanostation
    SupportedDevices: ubnt,nanostation-ac
    SupportedDevices: ubnt,nanostation-ac-loco
    SupportedDevices: ubnt,nanostation-loco-m bullet-m
    SupportedDevices: ubnt,nanostation-loco-m-xw loco-m-xw
    SupportedDevices: ubnt,nanostation-m nanostation-m
    SupportedDevices: ubnt,nanostation-m-xw nanostation-m-xw
        which #include    ar7241_ubnt_xm_outdoor.dtsi
              which #include    ar7241_ubnt_xm.dtsi

which is where find this memory map configuration.

&spi {
        status = "okay";
        num-cs = <1>;

        flash@0 {
                compatible = "jedec,spi-nor";
                reg = <0>;
                spi-max-frequency = <25000000>;

                partitions {
                        compatible = "fixed-partitions";
                        #address-cells = <1>;
                        #size-cells = <1>;

                        partition@0 {
                                label = "u-boot";
                                reg = <0x000000 0x040000>;

                        partition@1 {
                                label = "u-boot-env";
                                reg = <0x040000 0x010000>;

                        partition@2 {
                                compatible = "denx,uimage";
                                label = "firmware";
                                reg = <0x050000 0x750000>;

                        partition@3 {
                                label = "board_config";
                                reg = <0x7a0000 0x010000>;

                        partition@4 {
                                label = "cfg";
                                reg = <0x7b0000 0x040000>;

                        art: partition@5 {
                                label = "art";
                                reg = <0x7f0000 0x010000>;

but to be honest. this is where i get a bit lost on what changes to make, to utilize the extra flash,
and if I'm in the right spot to start with?

I am equipped to read/write the SPI Flash chips in an external programmer
(so i'm planning to start with a 8MB raw dump from the original chip. onto the new 16MB chips,
starting 0x00 then solder, and u-boot from there... hopefully)

any help / pointers would be greatly appreciated.
lets keep these devices going for a mere 4-5$ worth of parts


1 Like

First, to be safe, you need to back up the partitions marked as read-only: u-boot, board_config, cfg, art.

Looking at the dtsi file, you see that there are 3 read-only partitions located at the end of the original flash memory. Once you replace the new 16MB flash memory, you need to move it to the correct place at the bottom of the flash memory.
Because the memory capacity will increase by 8388608 Bytes (800000 hex) from the original, you need to add it to the following offset address (in hexadecimal numbers):

partition@2 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x050000 0xf50000>;   # 0x750000+800000=f50000
partition@3 {
				label = "board_config";
				reg = <0xfa0000 0x010000>;   # 0x050000+f50000=fa0000
partition@4 {
				label = "cfg";
				reg = <0xfb0000 0x040000>;   # 0xfa0000+10000=fb0000
art: partition@5 {
				label = "art";
				reg = <0xff0000 0x010000>;   # 0xfb0000+40000=ff0000

And you need to edit the generic-ubnt.mk file as follows:

define Device/ubnt
  DEVICE_PACKAGES := kmod-usb-core kmod-usb2
  IMAGE_SIZE := 15744k   # 7552k + 8192 = 15744k
  UBNT_VERSION := 6.0.0
  IMAGES += factory.bin
  IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
	append-rootfs | pad-rootfs | check-size $$$$(IMAGE_SIZE) | mkubntimage-split

Finally, when the new firmware has been installed, you need to restore the last 3 partitions: board_config, cfg & art.

1 Like

Thanks a lot for that. @leeandy i will give that a go, I'm still waiting for the parts.

@leeandy, do you happen to know if the U-Boot that I have in the nanostation now,
will support the 16mb chip? or if a different / modified one need to replace it ?


Maybe it will recognize. I have modified buffalo g450 to use the same ar724x chipset, it even recognized up to 32MB of flash. give it a try ^-^.

thanks @leeandy

so my plan is as follows.

externally burn my current uboot to the 16mb chip @0x00
and hope it boots on the new 16mb chip.

then flash my newly build 16mb firmware via serial/tftp?

and then also restore the other 3 partitions from within uboot to their respective locations as described above?

that sound about right for workflow?

i may just do the 3 partitions, as i do the uboot, externally prior to soldering


The simpler way:

  • Full dump orignal chip and then write to new chip by external programmer.
  • Flash newly firmware by sysupgrade.
    To restore the other 3 partitions, you can install kmod-mtd-rw package and use the following commands example:
insmod mtd-rw.ko i_want_a_brick=1
mtd write board_config_backup.bin "board_config"
mtd write cfg_backup.bin "cfg"
mtd write art_backup.bin "art"
1 Like

awesome thanks for that @leeandy


I'm not sure if it's still relevant, but regarding RAM mod - I successfully performed one on my Nanobridge M5 XM board, using Samsung K4H511638G-LCCC chip. In practice, any DDR400-capable chip should work, but please avoid 60ns (DDR-333/PC2700) parts - I tried one and despite size being detected correctly, unit would hang just after DRAM detection.

its been a while, but I finally had the parts on hand, and time to continue this project.

i replaced the ram chip with a 64mb one
Hynix HY5DU121622 512M DDR SDRAM
u-boot autodetected the 64mb ram,

i replaced the flash with a 16Mb one. (winbond 25Q128FV)

u-boot does not automatically detect the 16Mb flash.

and I have tried several things.
compiling from Image builder with the above mods, but it does not result in 16mb flash being available.

it looks like I need a 16mb u-boot. any suggestions on how to go about that?

apparently the " Ubiquiti UniFi Outdoor Plus" has the same CPU and 16mb flash.
hoping to find a firmware dump or u-boot image

Don't worry about flash size detected by U-boot. What Linux kernel sees is what you care about. You need to remap config and ART partitions to the end, to make up space for extended roots, and write a new device tree, to reflect that.

An example for another device is here: https://github.com/Leo-PL/openwrt/commit/d5712c44c35f089e18098e940549620659e22ea2
Here I only expanded rootfs, and remapped ART, you'd need to remap "config" partition as well.

Also, this makes me wonder. Images are still available both for master and 21.02 branch: https://firmware-selector.openwrt.org/?version=21.02-SNAPSHOT&target=ath79%2Fgeneric&id=ubnt_nanostation-m
This is an 8/32 device, which is still pretty usable, albeit not very fast with LuCI, so it's going to be supported at least in this release.

Okay.. I will ignore U-Boot's flash size.
I have already "manually" programmed the ART to the back of my flash to make it happy with the WIFI calibration. but its more of a hack..

I will take a look at your link, and see if I can figure out how configure it properly.
for a neat 16mb image build, I also have 32mb flash chips on hand.

my "dev box" is converted to DIP so I can pretty painlessly throw my failed attempts at it. :laughing:
and yes.. I totally agree, these devices are still very worthwhile.
especially since they are outdoor and have an awesome antenna..
even the 64mb ram upgrade is a great win in my book

note: (unfortunately only 50% of my devices have SOIC Ram chip. . the rest have BGA)
I'm not feelin that sporty yet.

Great that it worked for you. I had to do pretty similar tinkering with images during flash upgrades.

I think you can fit SOIC flash chip in place of WSON chip, pad spacing is more-or-less the same. Minus the bottom thermal pad in WSON, for which do watch out during desoldering. It tends to hold the chip firmly in place, so please be careful with the hot-air station, and check the fit of SOIC beforehand.

A friend of mine fried his Thinkpad while desoldering and resoldering a WSON flash repeatedly, but with SOIC in place it's so much easier. Also, if you managed to do RAM mod, WSON flash should be easy-peasy.

although it was SOIC on this board, the fairly high pin count made the RAM swap a bit tricky,
and while I was super careful, I did manage to damage 3 pads,
so I had to solder in some hair strains, (blob of epoxy lower left on the RAM chip) .

as for the flash, I glued on a DIP socket, and soldered it to the pads.
I'm using an adapter with an SOIC8 package instead of the 16pin one

I have not had time to work much more on building the 16MB Flash image yet,
but it certainly makes for faster prototyping this way.


1 Like

Wow, that's quite a hefty repair job. Kudos!
Also, this is why I always use preheater with such jobs - I learned this the hard way, by killing two WR1043NDs.

I didn't know that Nanostations were using SOIC16 flashes as well. Now, with the adapter you should be pretty safe, unless high frequency clock is used on SPI, for example, 108MHz for fast reads.
Besides, I found a source of cheap (and legitimate) SOP8W and SOP16W sockets for prototypes on Aliexpress:

They are hard to solder in initially - preheater is usually needed, as well as proper tinning of the leads, but once soldered in, they can be really helpful in development devices. I managed to almost kill a friend's Dell thin client with this, but was my first attempt soldering one into actual device.

Hi @RuneKyndal

Just so you know, I just did the same, upgraded NanoStation M2 to 64MB, but I left the 8MB flash alone
8MB seems to be (just) enough.

U-Boot (Dec  5 2012 - 15:23:07)
Board: Ubiquiti Networks XM board (rev 1.0 e012)
DRAM:  64 MB
Flash:  8 MB

But I did not need to do any building. I just installed the images from 21.02(rc4) and they just worked.
It was a happy suprise those images even existed.

Sidenote: I got my RAM from an old SODIMM module 8x SAMSUNG K4H511638C-UCB3
The old module were ZENTEL A3S56D40FTP-G5 in some and ETRONTECH EM6AA160TSB-5G in others

Edit1: after field test, running quite well with 21.02 rc4 and DAWN installed for 802.11k/r/v, still 24MB free memory.

So far I upgraded 8x NSM2, 3xBulletM2, 6xLocoM2, Ten which had the newer style BGA84 ball grid array memory. It took me some time to train myself to do those, but it worked. All devices good, I wasted one BGA chip (could reuse it if I would reball it). 2 more Loco's to go.

1 Like

so this project have been on ice for a bit. but I'm now in 8 day covid quarantine,
stuck in a hotel in Indonesia (for travel.) so I brought this to play with it :neutral_face:

I have tried several times, a few things. first of all.the changes you helped me with

new 16mb memory map, expanding by 0x800000, and moving board config,cfg and art to the end in


and the increased flash size to 15744k in

building with this command, (removing stuff to fit in 8mb still, for testing as it complains otherwise... indicating 8mb file is being made..)
it builds no issues. and it boots fine.

make image PROFILE=ubnt_nanostation-m PACKAGES="-dnsmasq -firewall -ip6tables -iptables -odhcpd-ipv6only -ppp -ppp-mod-pppoe -opkg -uclient-fetch -odhcp6c -luci -kmod-ipt-offload uhttpd luci-mod-admin-full luci-base libiwinfo-lua luci-theme-bootstrap
openvpn-openssl luci-app-openvpn luci-compat travelmate luci-app-travelmate mc"
Exportable Squashfs 4.0 filesystem, xz compressed, data block size 262144
compressed data, compressed metadata, compressed fragments,
no xattrs, compressed ids
duplicates are removed
Filesystem size 5197.21 Kbytes (5.08 Mbytes) 34.74% of uncompressed filesystem size (14961.18 Kbytes)
Inode table size 9284 bytes (9.07 Kbytes) 21.60% of uncompressed inode table size (42986 bytes)
Directory table size 12572 bytes (12.28 Kbytes)46.04% of uncompressed directory table size (27307 bytes)

output files are ~7.5mb and no extra flash space after upgrade

upgrade sysupgrade.bin via Luci
upgrade vis U-Boot TFTP factory.bin

root@Openwrt:/# df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/root                 5376      5376         0 100% /rom
tmpfs                    29772        60     29712   0% /tmp
/dev/mtdblock5             640       240       400  38% /overlay
overlayfs:/overlay         640       240       400  38% /
tmpfs                      512         0       512   0% /dev

 0.379097] spi-nor spi0.0: w25q128 (16384 Kbytes)
[    0.384021] 6 fixed-partitions partitions found on MTD device spi0.0
[    0.390413] Creating 6 MTD partitions on "spi0.0":
[    0.395254] 0x000000000000-0x000000040000 : "u-boot"
[    0.401746] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.408581] 0x000000050000-0x0000007a0000 : "firmware"
[    0.419368] 2 uimage-fw partitions found on MTD device firmware
[    0.425395] Creating 2 MTD partitions on "firmware":
[    0.430411] 0x000000000000-0x000000200000 : "kernel"
[    0.436766] 0x000000200000-0x000000750000 : "rootfs"
[    0.443263] mtd: device 4 (rootfs) set to be root filesystem
[    0.451823] 1 squashfs-split partitions found on MTD device rootfs
[    0.458134] 0x000000730000-0x000000750000 : "rootfs_data"
[    0.465015] 0x0000007a0000-0x0000007b0000 : "board_config"
[    0.472027] 0x0000007b0000-0x0000007f0000 : "cfg"
[    0.478247] 0x0000007f0000-0x000000800000 : "art"
[    0.487573] libphy: Fixed MDIO Bus: probed

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00750000 00010000 "firmware"
mtd3: 00200000 00010000 "kernel"
mtd4: 00550000 00010000 "rootfs"
mtd5: 00020000 00010000 "rootfs_data"
mtd6: 00010000 00010000 "board_config"
mtd7: 00040000 00010000 "cfg"
mtd8: 00010000 00010000 "art"

that looks to be the original configuration, Imagebuilder ignoring my changes?,
(or am i making them in the wrong place?)

might be a dead end this one LOL

I am a bit stuck anyway, am also trying 21.02, same results

suggestions ?