ar71xx: Add support for Ubiquiti NanoStation AC loco and Ubiquiti LiteBeam AC AP

[TobleMiner]

This PR adds support for the new Ubiquiti NanoStation AC loco and the very similar Ubiquiti LiteBeam AC AP. Below instructions (except for alternate installation, the serial header of the LiteBeam AC AP is probably in a different place) and specs apply to both devices.

Overview

The Ubiquiti NanoStation AC loco is the sucessor to the NanoStation M5 loco.
It features both a 5 GHz AC and a 2.4 GHz radio.

Specs

CPU: Atheros AR9342 @ 535 MHz
Flash: 128 Mbit nor flash, Macronix MX25L12805D
RAM: 64 MB
Ethernet: 1x 1000 Mbit/s (AR8035 PHY)
WLAN: AR9342 & QCA988X

It's worthy of note though that the 5 GHz radio is a custom Ubiquiti branded part with the pci id 0777:11ac and a Ubiquiti part number. Apart from the pci id it seems to be an absolutely normal QCA988X rev 2.

Obtaining firmware

Either build it yourself or get it from https://github.com/TobleMiner/openwrt-prereleases-bin

Installation

The firmware for this ubiquiti device is signed. But since there are no mtd utilities available on the device the original fwupdate.real binary must be used.
Please make sure you have got firmware version v8.5.0.36727 installed. The instructions probably won't work for other versions.
To install unsigned firmware the fwupdate.real binary (which is in fact just a symlink to ubntbox) must be patched:

hexdump -Cv /bin/ubntbox | sed 's/14 40 fe fe/00 00 00 00/g' | hexdump -R > /tmp/fwupdate.real
chmod +x /tmp/fwupdate.real

After that the factory image can be installed using the patched binary:

/tmp/fwupdate.real -m /tmp/openwrt-ar71xx-generic-ubnt-nanostationacl-squashfs-factory.bin

Problems installing?

The above instructions were only verified using firmware version v8.5.0.36727.

It will most likely work for any firmware version where

md5sum /bin/fwupdate.real

outputs

3584df67dd90aeedf4bee71c08292233

I've not had a look at any other firmware versions yet but up/downgrading to version v8.5.0.36727 should always work.

If you do not have any luck with the non-invasive installation and are not afraid of opening your device and have a USB to serial adapter at hand you can always follow the instructions below.

Alternate Installation Instructions

There seem to be some additional checks in the tftp rescue and I was unable to install any of my firmware binaries that way.

It may be possible to dd the firmware onto the flash directly from AirOS but I used the tftpboot functionality of u-boot to first load an initramfs image and then persistently flash a squashfs image from inside openWrt:

1. Connect to serial header on device (8N1 115200, see photo of serial header)
2. Power on device and enter u-boot console
3. Set up tftp server serving an openwrt initramfs build
4. Load initramfs build using the command tftpboot in the uboot cli
5. Boot the loaded image using the command bootm
6. Copy squashfs openwrt sysupgrade build to the booted device
7. Use mtd to write sysupgrade to partition "firmware"
8. Reboot and enjoy

Performance

Performance is great. I'm seeing upwards of 350 Mbit/s throughput on 5 GHz and around 40 Mbit/s on 2.4 GHz. The latter is to be expected since the 2.4 GHz radio is only used as a management and servicing radio by the Ubiquiti firmware.

Issues

I've not come across any compatibility issues yet, everything seems to work perfectly.

Signed-off-by: Tobias Schramm tobleminer@gmail.com

[robimarko]

I am adding support for Litebeam 5AC 23
It uses the same PCI AC card with UBNT custom ID.
So since multiple devices would be relying on your patch,can you rename ti to something like "Add PCI ID for UBNT rebranded QCA988X"

Also,it would make sense to push this upstream

[TobleMiner]

@robimarko Nice to see more people working on the Ubiquiti AirMAX AC devices.

I've renamed the patch to be more generic and will try upstraming on linux-wireless. (although i'll probably have to do something about the ugly pci vendor id hack for that)

[robimarko]

@TobleMiner Great job,it looks like it will be merged.
https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?h=pending&id=4037b395c946f94ee05ddc652421cdbd35567a3e

[TobleMiner]

I've used the Nanostation AC as my primary AP for the last few days and discovered some issues with 1000 Mbit/s and 10 Mbit/s Ethernet. I've updated the PLL settings and introduced some RX delay to fix it.

[rotanid]

@TobleMiner

1. ubiquiti promotes the 2.4ghz wifi as "management" - but i guess it can be used like a normal dual-band device with OpenWrt and your patch?
2. there are two devices NS-5AC and NS-5ACL - please make sure your naming of the device allows to add the other one without problems, currently you use "nanostationac" , maybe "nanostationacl" would be better to allow to add the NS-5AC later?

[robimarko]

This PCB is pretty much the same as first gen LiteBeam and other WA boards.
On second gen boards, internal AR9342 radio is used as 2.4GHz AP for management, so it most likely only has small PCB antenna for it.
Previously it had no antenna for it and it was disabled with bootstrap configuration if I am not mistaken.

Since pretty much all WA devices are 99% the same it would be better to add ubnt-wa.c machfile like XC and XM have.

You can do it, or I can do it when opening PR for LiteBeam.

I am only pretty damn pissed that they locked the devices completely, both bootloader for TFTP and Stock firmware check for firmware signature.
Since they refuse to release U-boot source we cant figure out the signature.

From what I looked at it is looks like SHA1 hash in the firmware header after version.
But I cant figure out from what it is generated, I tried manually generating SHA1 hash-es for firmware name and versions from the header but they don't match.

This way in order to flash OpenWRT on LiteBeam I need to first open it and that is endeavor on its own, then I need to remove glued on heatsink with a thermal pad which is stuck hard to expose UART header which is usable.

[TobleMiner]

@rotanid

Yep, the 2.4GHz wireless is totally useable. It only has one tiny antenna and is not particularly fast though.

I thought I had replaced all occurrences of nanostationac but I did indeed miss some. I will fix that ASAP

@robimarko

Sure, I can add a WA machine file for the nanostation AC. Did you confirm that the litebeam AC is compatible with my settings though?

Regarding the signature I did notice what seems to be a sha1 hash after the firmware version, too.

But I think the actual RSA signature is at the very end of the file. Ubiquiti has changed the end header magic to ENDS and there are what seems to be about 256 bytes of seemingly random data after the magic. My current guess is that ENDS means ENDSigned and the 256 bytes after that could very well be a 2048 bit RSA signature (There are some strings talking about a RSA signature in the binary).

Luckily opening the NanoStation AC loco is pretty easy. I've started a device page on the OpenWRT wiki

[robimarko]

@TobleMiner I did not confirm it since LiteBeam for developing is borrowed to a friend who was curious how POE works on it and since it was already disassembled I gave it to him to take a look.
But from everything I saw in your PR, it is the same minus 2.4GHz radio.
You can simply instead of using mach-ubnt-nanostationac.c call ti mach-ubnt-wa.c
And of course, change Makefile reference and all other appropriate ones as well.
The rest would be the same, and then when I get the device back and confirm it reuses 90% of your code I can merge device setup functions into generic one.

Hmm,I just took a look at the end of stock binary upgrade image.
And indeed there is ENDS and some random data, that could indeed be RSA.

I tried decompiling fwupdate binary and it gets decompiled in IDA Pro, but I ain't really expert in that field and wasn't able to find out anything.
But this requires a lot of digging

[TobleMiner]

@robimarko I've updated the PR to be more generic.

I've taken a look at the fwupdate.real binary, too and reverse engineering it won't be an easy task. The task is made even harder by the fact that Ubiquiti jammed the update functionality into a big binary that contains a lot of different tools, stripped all symbols and even the elf section headers.

Also there are some DSP instructions and conditional branches in the code that IDA can't decode. This breaks flow analysis in quite a few places. Analysing the binary will take quite some time.

The u-boot tftp rescue mode might be worth taking a look at as well.

EDIT:
I had success in binary-patching the ubntbox binary to allow me to install firmware with any signature.

[robimarko]

@TobleMiner Great, thanks for that.
Yeah,fwupdate binary would be too much of a task.

U-boot TFTP should be a much easier, I gotta try decompiling it, but finding relevant sections of code would not be easy.

Took a look at stock binary using binwalk,a lot of stuff found.
https://gist.github.com/robimarko/c2b0fb5ed1156b4e3f47af5a15ec4283

Also,took a look at fwupdate.real with strings.
There is bunch of custom UBNT apps inside.

[TobleMiner]

I've updated the PR to add proper WA image support to mkfwimage.

@robimarko
Also I managed to bypass the signature check by patching the ubntbox binary beforehand:

hexdump -Cv /bin/ubntbox | sed 's/14 40 fe fe/00 00 00 00/g' | hexdump -R > /tmp/fwupdate.real
chmod +x /tmp/fwupdate.real
/tmp/fwupdate.real -m openwrt-ar71xx-generic-ubnt-nanostationac-squashfs-factory.bin

This allows for easy testing (and later flashing) of OpenWRT builds on the NanoStation AC

[robimarko]

@TobleMiner Awesome progress.
Good to see you integrating WA image in mktimage since all AC devices from UBNT use WA board and are pretty much identical hardware wise
I doubt we will ever be able to guess a proper way to generate RSA without UBNT sources.

[robimarko]

And your patch was merged
https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?id=d5cc61119343b6f1b8716cfe591d4989ea0c5c28

https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?id=34f1cb339cae5c0b6b75094e2d5c79d19be424ed

[kuehro]

I got the correct md5sum for /bin/ubntbox after uploading WA.v8.5.0.36727.180118.1314.bin to the firmware, downloaded from https://www.ubnt.com/download/airmax-ac/nanostation-ac/ns-5acl
Installation went smoothly after that.

[robimarko]

@kuehro I dont understand what you did.
Can you explain?

[TobleMiner]

@kuehro Nice! Good to see someone else having success with this device.

Thanks for pointing out the firmware version required for flashing. I've added it to the installation instructions.

Does everything work as expected? Please report any issues you find.

@robimarko I think he upgraded his device to stock firmware v8.5.0.36727 and followed my instructions from there. And it seems to have worked out 😄

[kuehro]

@robimarko: My device came with Version WA.v8.4.2 and after ssh to 192.1681.20 I got the wrong md5sum for /bin/ubntbox. So I downloaded different firmware versions from Ubiquiti and after uploading the 8.5.0 firmware under System -> Upload in the Ubiquiti interface, I got the correct md5sum for /bin/ubntbox. After that I patched the ubntbox binary with hexdump as shown above in the documentation and installed a *-factory.bin with the resulting /tmp/fwupdate.real. The firmware was built from sources checked out with
git clone -b ubnt-nanostation-ac-loco https://github.com/openwrt/openwrt.git openwrt_Tobler
and then building in openwrt_Tobler as usual.

Here is the log from the first boot (address is 192.168.1.1):

BusyBox v1.27.2 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r5936-fea02b1d51
 -----------------------------------------------------
root@OpenWrt:~# cat /etc/openwrt_release 
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='SNAPSHOT'
DISTRIB_REVISION='r5936-fea02b1d51'
DISTRIB_TARGET='ar71xx/generic'
DISTRIB_ARCH='mips_24kc'
DISTRIB_DESCRIPTION='OpenWrt SNAPSHOT r5936-fea02b1d51'
DISTRIB_TAINTS='no-all'
root@OpenWrt:~# uname -a
Linux OpenWrt 4.9.77 #0 Fri Feb 2 21:41:25 2018 mips GNU/Linux

@TobleMiner: Thanks for your hard work and +1 for merging with master.

[kuehro]

I have added the output of dmesg and iw phy info to
https://openwrt.org/toh/ubiquiti/ubiquiti_nanostation_ac_loco

[tohojo]

I can also confirm that this works. Thanks!
+1 for merging!

[rogerpueyo]

Hi,

I tested it yesterday on a brand new device, after upgrading to stock firmware v8.5.0:

• flashing worked
• device works (identification, network, both radios...)

So far everything seems to be fine with the support.

Thanks!

[rogerpueyo]

@pepe2k , since you added the ar71xx tag, do you think you could merge the PR? Thanks!

[rogerpueyo]

@TobleMiner Your commit can be very easily used to support the LBE-5AC-16-120. I'll send my PR on top of yours once it gets merged upstream.

[Manawyrm]

+1 for merging this PR.
Would make it possible to use these devices with Gluon/Freifunk sooner.
Seems to work fine so far!

[rogerpueyo]

@TobleMiner surprise! :) #1154

[blogic]

@rogerpueyo @TobleMiner which of the 2 patches should i merge ? and can you send the ath10k patch upstream please ?

[blogic]

and can you not just port this over to ath79 ?

[robimarko]

It works on ath79 but the radio performance is terrible due to PCI issues

[blogic]

@robimarko what pci issues ?

[robimarko]

Perfomance over it is really bad.
Only couple of Mbits

[blogic]

ok, so which PR should i merge into ar71xx ?

[TobleMiner]

@blogic To the best of my knowledge this PR is the only one for the NanoStation AC loco. All the other PRs for Ubiqutiti AC AirMAX devices are based on this one.

EDIT:
Ah, I think I see why this is a little confusing. The title of this PR was a little missleading. It says "LiteBeam AC" but I really meant "LiteBeam AC AP". I've updated the title and description accordingly

[rogerpueyo]

Hi,

This pull request adds support for two devices:

• NanoStation AC loco (your commit, also WA board supoort, etc.)
• Ubiquiti LiteBeam ac AP (my commit)

Furthermore, there is this commit (7da7c1f) and a pull request (#1154) to add support for a third device, the Ubiquiti LiteBeam ac. @TobleMiner, can you please include this last commit to this pull request, so that we have everything in one single place and I can close mine?

After that, @blogic, you may want to merge the whole thing.

Regarding the ath79 port, I've got a few commits here but they depend on @robimarko's code which has not been merged upstream yet. I think it'd be nice to have the devices supported in ar71xx and not wait for ath79 to replace it, since it's not even being compiled in the snapshots and, well, the code for the ar71xx port is already here.

Thanks

[robimarko]

@rogerpueyo I will push Nanobeam ath79 PR once IRQ driver changes from mailing list are merged since they should fix the PCI low throughput issues.

[TobleMiner]

Closed in favor of #1346

[cybermaus]

Hi. I checked this firmware and installed it without appearant problems on a NanoBeam 5AC-16 (not Gen2) device (which is a different device then the LiteBeam mentioned above)

I created a proper page in the Wiki to describe and store my findings.

Possibly the only fix that need to be made is the model name in the firmware, which now read "Ubiquiti Nanostation AC loco (WA)" but should be "Ubiquiti NanoBeam AC (WA)"
NanoStation AC

[rogerpueyo]

@cybermaus,

Thanks for testing it. However, this patch is based on the now deprecated ar71xx architecture, and was superseded by patch #1346 based on the ath79 architecture.

I can try to add support for your device, but since I don't have it myself, somebody should test it thoroughly before sending it upstream. Would you like to test it?

[cybermaus]

I was merely trying to contact a developer who was working on this area, sorry if this is an old thread. So maybe I respond to the wrong closed case, but the one I downloaded is already the newer ath79 one, and the info I am providing is that that one works, so NanoBeam AC (WA) can be added to the builds.

openwrt-ath79-generic-ubnt_nanostation-ac-loco-squashfs-factory.bin

Mind you, in the mean time this guy also responded:
https://forum.openwrt.org/t/ubiquity-nanobeam-5ac-available-for-testing/28296/5

See also this new page: https://openwrt.org/toh/ubiquiti/ubiquiti_nanobeam_ac
Thanks

[TobleMiner]

@cybermaus I've just built a support patch based on ath79 at https://github.com/TobleMiner/openwrt/tree/ubnt-nanobeam

[cybermaus]

Ok, thanks. Two questions: Does this now show up automatically on the nightly builds tomorrow of the main OpenWRT snapshots?

And also: It seems a reference to the nanostation ac (non-loco) is missing here:

[TobleMiner]

@cybermaus No, the patch is on my fork of the main openwrt repo only thus it won't be built automatically. I do however provide prebuilt binaries at https://github.com/TobleMiner/openwrt-prereleases-bin/tree/master/nanobeam-ac

Please note that I have not verified that those binaries will work with your NanoBeam. I do not have a NanoBeam AC and can't test them. They will be missing configuration for the signal strength indicator LEDs since I do not know the correct GPIO -> LED mapping.

Regarding your second question: The network configuration for the Nanostation AC is further down in the file. It has two ethernet ports and an integrated switch thus it requires different configuration parameters.

[psyborg55]

few days ago i got Litebeam 5AC 23 Gen2 with WA.v8.5.7.38314.180628.1036, patching ubntbox did not work, downgrading to WA.v8.5.0.36727.180118.1314 was useless as device remained inaccessible.

luckily there is a crack in airos8 upgrade procedure that allows for flash manipulation without opening device:

log in to ssh and start to update same firmware that is already on device (in my case 8.5.7):

fwupdate.real -m /tmp/WA.v8.5.7.38314.180628.1036.bin -d

during the process abort the upgrade (sometime when it reaches checking of mtd3) by pressing Ctrl+C

this way we let the airos upgrade do the hard work for us by unlocking mtd partitions :)

after that flash your sysupgrade image to /dev/mtdblock2 and /dev/mtdblock3. it is needed to split sysupgrade image prior to that into chunks that will fit these partitions, see this great article by bugblue on how to do that: https://pastebin.com/0wzMthfr

unplug and replug power to device and it boots openwrt

i did waste several hours with this since i was trying factory image at first, then remembered sysupgrade must be used

[baalwy]

How to add super channels to ac loco

[0x7c9]

How to add super channels to ac loco

solved?