[OpenWrt-Devel] Cannot flash UBNT Loco M2

[Joseph Marlin]

We certainly haven't. I've tried applying these patches - http://thread.gmane.org/gmane.comp.embedded.openwrt.devel/39001

to no avail. I still get hit by a "Error code 2 - Firmware Check Failed". 

I'm really suspecting this comes down to an intentional check by Ubiquiti to prevent us from flashing, as described on this list and in this comment on the ticket - https://dev.openwrt.org/ticket/20982#comment:16

I have not yet had a chance to change the image header and CRC to look like a Ubiquiti image, nor do I know how to offhand, but I hope to give it a shot soon.

----- Original Message -----
From: "Outback Dingo" <outbackdingo at gmail.com>
To: "Joseph Marlin" <jmarlin at saucontech.com>
Cc: "Bill Moffitt" <bmoffitt at ayrstone.com>, openwrt-devel at lists.openwrt.org
Sent: Friday, March 11, 2016 6:22:39 AM
Subject: Re: [OpenWrt-Devel] Cannot flash UBNT Loco M2

so, have we gotten past the ubiquiti bootloader downgrade issues yet ?

On Fri, Feb 12, 2016 at 11:09 PM, Joseph Marlin <jmarlin at saucontech.com>
wrote:

> Yes, we've been fighting this bug unsuccessfully for quite a while. It's
> the result of a new version of uboot changing the partition sizes.
>
> Here's the ticket: https://dev.openwrt.org/ticket/20982
>
>
>
> ----- Original Message -----
> From: "Outback Dingo" <outbackdingo at gmail.com>
> To: "Bill Moffitt" <bmoffitt at ayrstone.com>
> Cc: openwrt-devel at lists.openwrt.org
> Sent: Friday, February 12, 2016 5:00:38 PM
> Subject: Re: [OpenWrt-Devel] Cannot flash UBNT Loco M2
>
>
>
> On Fri, Feb 12, 2016 at 10:54 PM, Bill Moffitt < bmoffitt at ayrstone.com >
> wrote:
>
>
> I got a new batch of LocoM2 units, and they won't flash using the
> "recovery" (tftp) method - it says,
>
> received ERROR <code=2, msg=Firmware check failed>
> Error code 2: Firmware check failed
>
> I tried flashing it through the AirOS web interface, and it accepted the
> firmware, but the unit didn't boot. I took it apart and connected the
> serial cable, and this is what I saw:
>
> 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #25 Mon May 12 16:14:26
> PDT 2014
> [ 0.000000] bootconsole [early0] enabled
> [ 0.000000] CPU revision is: 00019374 (MIPS 24Kc)
> [ 0.000000] SoC: Atheros AR7241 rev 1
> [ 0.000000] Clocks: CPU:390.000MHz, DDR:390.000MHz, AHB:195.000MHz,
> Ref:5.000MHz
> [ 0.000000] Determined physical RAM map:
> [ 0.000000] memory: 02000000 @ 00000000 (usable)
> [ 0.000000] Initrd not found or empty - disabling initrd
> [ 0.000000] Zone PFN ranges:
> [ 0.000000] Normal 0x00000000 -> 0x00002000
> [ 0.000000] Movable zone start PFN for each node
> [ 0.000000] Early memory PFN ranges
> [ 0.000000] 0: 0x00000000 -> 0x00002000
> [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total
> pages: 8128
> [ 0.000000] Kernel command line: board=UBNT-NM console=ttyS0,115200
> mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,1024k(kernel),6528k(rootfs),256k(cfg)ro,64k(EEPROM)ro,7552k at 0x50000(firmware)
> rootfstype=squashfs,jffs2 noinitrd
> [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
> [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
> [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
> [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
> [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize
> 32 bytes
> [ 0.000000] Writing ErrCtl register=00000000
> [ 0.000000] Readback ErrCtl register=00000000
> [ 0.000000] Memory: 29116k/32768k available (2115k kernel code, 3652k
> reserved, 407k data, 208k init, 0k highmem)
> [ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1,
> Nodes=1
> [ 0.000000] NR_IRQS:51
> [ 0.000000] Calibrating delay loop... 259.27 BogoMIPS (lpj=1296384)
> [ 0.070000] pid_max: default: 32768 minimum: 301
> [ 0.070000] Mount-cache hash table entries: 512
> [ 0.080000] NET: Registered protocol family 16
> [ 0.080000] gpiochip_add: registered GPIOs 0 to 17 on device: ath79
> [ 0.090000] MIPS: machine is Ubiquiti Nanostation M
> [ 0.090000] registering PCI controller with io_map_base unset
> [ 0.500000] bio: create slab <bio-0> at 0
> [ 0.510000] PCI host bridge to bus 0000:00
> [ 0.510000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
> [ 0.520000] pci_bus 0000:00: root bus resource [io 0x0000]
> [ 0.520000] pci 0000:00:00.0: fixup device configuration
> [ 0.530000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1000ffff
> 64bit]
> [ 0.530000] pci 0000:00:00.0: using irq 40 for pin 1
> [ 0.540000] Switching to clocksource MIPS
> [ 0.540000] NET: Registered protocol family 2
> [ 0.550000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
> [ 0.550000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
> [ 0.560000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
> [ 0.560000] TCP: Hash tables configured (established 1024 bind 1024)
> [ 0.570000] TCP reno registered
> [ 0.570000] UDP hash table entries: 256 (order: 0, 4096 bytes)
> [ 0.580000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
> [ 0.590000] NET: Registered protocol family 1
> [ 0.610000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
> [ 0.620000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME)
> (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
> [ 0.630000] msgmni has been set to 56
> [ 0.630000] io scheduler noop registered
> [ 0.630000] io scheduler deadline registered (default)
> [ 0.640000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
> [ 0.670000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
> [ 0.670000] console [ttyS0] enabled, bootconsole disabled
> [ 0.670000] console [ttyS0] enabled, bootconsole disabled
> [ 0.690000] m25p80 spi0.0: found mx25l6405d, expected m25p80
> [ 0.690000] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
> [ 0.700000] 7 cmdlinepart partitions found on MTD device spi0.0
> [ 0.710000] Creating 7 MTD partitions on "spi0.0":
> [ 0.710000] 0x000000000000-0x000000040000 : "u-boot"
> [ 0.720000] 0x000000040000-0x000000050000 : "u-boot-env"
> [ 0.720000] 0x000000050000-0x000000150000 : "kernel"
> [ 0.730000] 0x000000150000-0x0000007b0000 : "rootfs"
> [ 0.740000] mtd: partition "rootfs" set to be root filesystem
> [ 0.740000] mtd: partition "rootfs_data" created automatically,
> ofs=360000, len=450000
> [ 0.750000] 0x000000360000-0x0000007b0000 : "rootfs_data"
> [ 0.760000] 0x0000007b0000-0x0000007f0000 : "cfg"
> [ 0.770000] 0x0000007f0000-0x000000800000 : "EEPROM"
> [ 0.770000] 0x000000050000-0x0000007b0000 : "firmware"
> [ 0.790000] ag71xx_mdio: probed
> [ 0.790000] eth0: Atheros AG71xx at 0xb9000000, irq 4
> [ 1.350000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.1:04
> [uid=004dd041, driver=Generic PHY]
> [ 1.360000] eth1: Atheros AG71xx at 0xba000000, irq 5
> [ 1.920000] eth1: Found an AR7240/AR9330 built-in switch
> [ 2.950000] TCP cubic registered
> [ 2.950000] NET: Registered protocol family 17
> [ 2.950000] 8021q: 802.1Q VLAN Support v1.8
> [ 2.970000] VFS: Mounted root (squashfs filesystem) readonly on device
> 31:3.
> [ 2.970000] Freeing unused kernel memory: 208k freed
> - preinit -
> Press the [f] key and hit [enter] to enter failsafe mode
> - regular preinit -
> jffs2 not ready yet; using ramdisk
> - init -
> [ 9.230000] Compat-drivers backport release: compat-drivers-2013-01-21-1
> [ 9.230000] Backport based on wireless-testing.git master-2013-02-22
> [ 9.240000] compat.git: wireless-testing.git
> [ 9.270000] cfg80211: Calling CRDA to update world regulatory domain
> [ 9.280000] cfg80211: World regulatory domain updated:
> [ 9.280000] cfg80211: (start_freq - end_freq @ bandwidth),
> (max_antenna_gain, max_eirp)
> [ 9.290000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi,
> 2000 mBm)
> [ 9.300000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi,
> 2000 mBm)
> [ 9.310000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi,
> 2000 mBm)
> [ 9.320000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi,
> 2000 mBm)
> [ 9.320000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi,
> 2000 mBm)
> [ 9.670000] usbcore: registered new interface driver usbfs
> [ 9.680000] usbcore: registered new interface driver hub
> [ 9.680000] usbcore: registered new device driver usb
> [ 10.200000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
> [ 10.230000] ieee80211 phy0: Atheros AR9287 Rev:2 mem=0xb0000000, irq=40
> [ 10.240000] cfg80211: Calling CRDA for country: US
> [ 10.250000] cfg80211: Regulatory domain changed to country: US
> [ 10.250000] cfg80211: (start_freq - end_freq @ bandwidth),
> (max_antenna_gain, max_eirp)
> [ 10.260000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi,
> 2700 mBm)
> [ 10.270000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi,
> 1700 mBm)
> [ 10.270000] cfg80211: (5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi,
> 2000 mBm)
> [ 10.280000] cfg80211: (5490000 KHz - 5600000 KHz @ 40000 KHz), (300 mBi,
> 2000 mBm)
> [ 10.290000] cfg80211: (5650000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi,
> 2000 mBm)
> [ 10.300000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi,
> 3000 mBm)
> [ 10.340000] PPP generic driver version 2.4.2
> [ 10.510000] ip_tables: (C) 2000-2006 Netfilter Core Team
> [ 10.630000] NET: Registered protocol family 24
> [ 10.650000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
> [ 10.680000] nf_conntrack version 0.5.0 (458 buckets, 1832 max)
> [ 10.910000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
>
> Please press Enter to activate this console. [ 14.030000] device eth0
> entered promiscuous mode
> [ 31.230000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
> [ 31.250000] jffs2_build_filesystem(): unlocking the mtd device... done.
> [ 31.250000] jffs2_build_filesystem(): erasing all blocks after the end
> marker...
> [ 31.270000] Newly-erased block contained word 0x19852003 at offset
> 0x00440000
> [ 31.280000] Newly-erased block contained word 0x19852003 at offset
> 0x00430000
> [ 31.290000] Newly-erased block contained word 0x19852003 at offset
> 0x00420000
> [ 31.300000] Newly-erased block contained word 0x19852003 at offset
> 0x00410000
> [ 31.310000] Newly-erased block contained word 0x19852003 at offset
> 0x00400000
> [ 31.330000] Newly-erased block contained word 0x19852003 at offset
> 0x003f0000
> [ 31.340000] Newly-erased block contained word 0x19852003 at offset
> 0x003e0000
> [ 31.350000] Newly-erased block contained word 0x19852003 at offset
> 0x003d0000
> [ 31.360000] Newly-erased block contained word 0x0 at offset 0x003c0000
> [ 31.370000] Newly-erased block contained word 0xdeadc0de at offset
> 0x003b0000
> [ 31.380000] Newly-erased block contained word 0xdeadc0de at offset
> 0x003a0000
> [ 31.390000] Newly-erased block contained word 0x4a75fa8e at offset
> 0x00390000
> [ 31.400000] Newly-erased block contained word 0x529688b3 at offset
> 0x00380000
> [ 31.410000] Newly-erased block contained word 0x72c5c469 at offset
> 0x00370000
> [ 31.420000] Newly-erased block contained word 0x37d3b7b1 at offset
> 0x00360000
> [ 31.430000] Newly-erased block contained word 0x3701cf35 at offset
> 0x00350000
> [ 31.450000] Newly-erased block contained word 0xe92b7c18 at offset
> 0x00340000
> [ 31.460000] Newly-erased block contained word 0x9509712e at offset
> 0x00330000
> [ 31.470000] Newly-erased block contained word 0x60acb07d at offset
> 0x00320000
> [ 31.480000] Newly-erased block contained word 0x47a1a3d9 at offset
> 0x00310000
> [ 31.490000] Newly-erased block contained word 0xe212a57b at offset
> 0x00300000
> [ 31.500000] Newly-erased block contained word 0x503dddd7 at offset
> 0x002f0000
> [ 31.510000] Newly-erased block contained word 0xdab1df97 at offset
> 0x002e0000
> [ 31.520000] Newly-erased block contained word 0xcfb10ba9 at offset
> 0x002d0000
> [ 31.530000] Newly-erased block contained word 0x3ce9160b at offset
> 0x002c0000
> [ 31.540000] Newly-erased block contained word 0xe9f4632c at offset
> 0x002b0000
> [ 31.550000] Newly-erased block contained word 0x62ff3bc1 at offset
> 0x002a0000
> [ 31.560000] Newly-erased block contained word 0x2e6fe819 at offset
> 0x00290000
> [ 31.580000] Newly-erased block contained word 0x57385080 at offset
> 0x00280000
> [ 31.590000] Newly-erased block contained word 0x247953e9 at offset
> 0x00270000
> [ 31.600000] Newly-erased block contained word 0x3b06bbb0 at offset
> 0x00260000
> [ 31.610000] Newly-erased block contained word 0x2da7a328 at offset
> 0x00250000
> [ 31.620000] Newly-erased block contained word 0xffff3ead at offset
> 0x00240000
> [ 31.630000] Newly-erased block contained word 0x335623ff at offset
> 0x00230000
> [ 31.640000] Newly-erased block contained word 0x3726f738 at offset
> 0x00220000
> [ 31.650000] Newly-erased block contained word 0xc0f98fd4 at offset
> 0x00210000
> [ 31.660000] Newly-erased block contained word 0xca7dc293 at offset
> 0x00200000
> [ 31.670000] Newly-erased block contained word 0x857378b2 at offset
> 0x001f0000
> [ 31.680000] Newly-erased block contained word 0x9861d4fe at offset
> 0x001e0000
> [ 31.690000] Newly-erased block contained word 0x22a76231 at offset
> 0x001d0000
> [ 31.700000] Newly-erased block contained word 0xf0b375b8 at offset
> 0x001c0000
> [ 31.710000] Newly-erased block contained word 0xd33a9001 at offset
> 0x001b0000
> [ 31.720000] Newly-erased block contained word 0x89397348 at offset
> 0x001a0000
> [ 31.730000] Newly-erased block contained word 0x83d192f2 at offset
> 0x00190000
> [ 31.740000] Newly-erased block contained word 0xca2178ad at offset
> 0x00180000
> [ 31.750000] Newly-erased block contained word 0x6cabc8b3 at offset
> 0x00170000
> [ 31.760000] Newly-erased block contained word 0x38ee4330 at offset
> 0x00160000
> [ 31.770000] Newly-erased block contained word 0x64b6aa0c at offset
> 0x00150000
> [ 31.780000] Newly-erased block contained word 0x7a5b7560 at offset
> 0x00140000
> [ 31.800000] Newly-erased block contained word 0xe177e91 at offset
> 0x00130000
> [ 31.810000] Newly-erased block contained word 0xd37014b5 at offset
> 0x00120000
> [ 31.820000] Newly-erased block contained word 0xd837cbc0 at offset
> 0x00110000
> [ 31.830000] Newly-erased block contained word 0x6bd36a94 at offset
> 0x00100000
> [ 31.850000] Newly-erased block contained word 0xfa3e9f50 at offset
> 0x000f0000
> [ 31.850000] Newly-erased block contained word 0x467bb66e at offset
> 0x000e0000
> [ 31.870000] Newly-erased block contained word 0x540ba61b at offset
> 0x000d0000
> [ 31.880000] Newly-erased block contained word 0x2ff93485 at offset
> 0x000c0000
> [ 31.890000] Newly-erased block contained word 0x858a231 at offset
> 0x000b0000
> [ 31.900000] Newly-erased block contained word 0xc7651bcd at offset
> 0x000a0000
> [ 31.910000] Newly-erased block contained word 0x82440040 at offset
> 0x00090000
> [ 31.920000] Newly-erased block contained word 0xac9d2906 at offset
> 0x00080000
> [ 31.940000] Newly-erased block contained word 0xe21295c2 at offset
> 0x00070000
> [ 31.950000] Newly-erased block contained word 0x8cba2c3e at offset
> 0x00060000
> [ 31.960000] Newly-erased block contained word 0xcd35e173 at offset
> 0x00050000
> [ 31.970000] Newly-erased block contained word 0xa9d4a3b7 at offset
> 0x00040000
> [ 31.980000] Newly-erased block contained word 0xcd4325 at offset
> 0x00030000
> [ 31.990000] Newly-erased block contained word 0xd3604763 at offset
> 0x00020000
> [ 32.010000] Newly-erased block contained word 0x8a38aa45 at offset
> 0x00010000
> [ 32.020000] Newly-erased block contained word 0xdeadc0de at offset
> 0x00000000
> [ 32.020000] done.
> [ 32.030000] JFFS2 notice: (1164) jffs2_build_xattr_subsystem: complete
> building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref
> (0 dead, 0 orphan) found.
>
> I'm flashing Chaos Calmer. The radio has a MAC address starting with
> 68:72, which is not new (in the past, UBNT has "signaled" a change by
> changing the MAC address prefix). It is still an "XM" device (only the M5
> seems to have moved to "XW").
>
> Has anyone else seen this? Is there a fix at hand?
>
> last i knew at least on the new bullets/picos you needed to downgrade
> AirOS before you could flash them with WRT, due to ubott changes, wonder if
> its true for this unit also.....
>
>
>
>
> --
> Bill Moffitt
> Ayrstone Productivity
> http://ayrstone.com
> _______________________________________________
> openwrt-devel mailing list
> openwrt-devel at lists.openwrt.org
> https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
>
>
> _______________________________________________
> openwrt-devel mailing list
> openwrt-devel at lists.openwrt.org
> https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
>
_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel