[LEDE-DEV] Ubnt Bullet M2 flashing ?

[Joe Ayers]

We've found that some of the newer AirMax hardware releasing with XW revs,
do not have a downgrade process.   For example the NanoStation M2 XW.  The
AirOX 5.5.x firmware did not offer support and the nanostation-m-xw image
has no path to load.

Downgrading the AirMax devices to AirOS 5.5.x  is a lot of extra steps.
Just in case this is not already known, It is possible to directly load, in
one step, an image using 'tftp'.   The AirOS UI requires signed firmware in
newer versions, but tftp does not.    A patch like the following is
required for uboot to accept the firmware and load via tftp.   Newer
versions of ubnt's uboot have a restriction on naming convention (seems to
reject firmware if alpha chars in some places).  This works for all AirOS
versions (the respective uboot version), available today,  on AirMax
hardware.    Example, "v6.0.6.31296.170704.204" is from an AirOS image
applied in chaos calmer.

--- a/target/linux/ar71xx/image/Makefile
+++ b/target/linux/ar71xx/image/Makefile
@@ -1406,7 +1406,7 @@ define Image/Build/UBNT2
   dd if=$(call sysupname,$(1),$(2)) of=$(KDIR_TMP)/$(2)-mtdpart-kernel.bin
bs=1024k count=1; \
   dd if=$(call sysupname,$(1),$(2)) of=$(KDIR_TMP)/$(2)-mtdpart-rootfs.bin
bs=1024k skip=1; \
   $(STAGING_DIR_HOST)/bin/mkfwimage \
- -B $(4) -v $(5).$(6).v6.0.0-OpenWrt-$(REVISION) \
+ -B $(4) -v $(5).$(6).v6.0.6.31296.170704.204 \
   -k $(KDIR_TMP)/$(2)-mtdpart-kernel.bin \
   -r $(KDIR_TMP)/$(2)-mtdpart-rootfs.bin \
   -o $(call factoryname,$(1),$(2)); \

Joe AE6XE


> Date: Mon, 30 Apr 2018 12:24:15 -0700
> From: Etienne Champetier <champetier.etienne at gmail.com>
> To: LEDE Development List <lede-dev at lists.infradead.org>
> Cc: Bill Moffitt <bmoffitt at ayrstone.com>, Joseph Marlin
>          <jmarlin at saucontech.com>
> Subject: Re: [LEDE-DEV] Ubnt Bullet M2 flashing ?
> Message-ID:
>   <CAOdf3gqT_TQBqPWkj3pcqW+gOMPtnQgDi6ysraG3Qs3MSEzA3A at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"

> Hi All,

> 2018-04-19 6:19 GMT-07:00 Joseph Marlin <jmarlin at saucontech.com>:
>> We still flash Ubiquiti Airrouters regularly, and we still have to
downgrade to 5.5.10 as a
>> first step. I imagine Bullet M2 would be similar.

> I received last week my new Bullet M, and I confirm it is still
> possible to downgrade to 5.5.10
> It was shipped with 5.6.11, but I wanted to confirm that I can
> downgrade from latest AirOS version, so what I did:

> 1) Upgrade to 6.1.6
> XM.v6.1.6.32290.180307.1650.bin (md5sum 96a876222ede2cac4b2e895c14160c31)
> This version only accept signed image via the WebUI

> 2) Downgrade to 6.0.6-beta
> XM.v6.0.6-beta.30875.170526.0038.bin (md5sum
6baf82898fd70e9d394fb3b5a17d6fc3)
> This version is signed but accept non signed image via the WebUI

> 3) Downgrade to 5.6.15
> XM.v5.6.15.30572.170328.1107.bin (md5sum dbe0fe1c5404c19f0adf328ca8d01a7a)
>   .0.6-beta refuses to go back to 5.5.10 directly, so I went to 5.6.15
> (unsigned version)

>   4) Downgrade to 5.5.10
> XM.v5.5.10.24241.141001.1649.bin (md5sum 288b6dd2cbf35a85582f942ae5489873)

> 5) Upgrade to LEDE 17.01 \o/
using the WebUI and the factory image


> Adrian Schmutzler sent me another downgrade path that they use with
> OpenWRT-based Freifunk Franken Firmware
> XM.v6.0.6-beta.30875.170526.0038.bin
> XM.v6.0.4.30805.170505.1525.bin
> XM.v5.5.11.28002.150723.1344.bin


> Also I want to point to another email thread "ar71xx: Ubiquiti Airmax
> M: add relocate-kernel to invalidate cache"
> http://lists.infradead.org/pipermail/lede-dev/2018-April/011980.html
> According to this thread OpenWRT master should be compatible with all
AirOS 5.X

> Cheers
> Etienne