Fri 1 Feb

Teardown of an Ubiquiti Nanostation Loco M5

I was doing some work on a Ubiquiti Nanostation Loco M5 yesterday and wound up bricking it (protip: the 'erase all' command in uBoot also erases the bootloader itself... whoops!). Rather than getting out the JTAG I decided I'd do a full teardown of it since I hadn't seen one of this device before.

I'd long since removed the board from the case, so here's the board itself. The silver thing on top is shielding for the RF components. It's pretty easy to pop it off with a flathead screwdriver -- just jam it into the sides until it bends up.

There are a few chips on this board. The big one in the center is the 400MHz MIPS SoC, the Atheros AR7240-AH1A. The chip below that is the Winbond 25X64VFIG, a flash memory module. On the left side of the board, we have an M-Tek H16125MCG, an Ethernet transformer (I'm not sure if this is found on all ethernet devices, or if it has something to do with PoE). Directly above the transformer is a chip that's covered in stickers, the one "mystery chip" on this board (at least to me). Removing the stickers, I found three markings. On the top, it has a logo followed by "MIRA", which appears to be a custom IC manufacturer from Taiwan. There are two other markings: one next to the logo reading P3S56040ETP, and one on the bottom reading 944ANF74-G5. I found one reference to the latter, on this site, suggesting both that this is a 32MB SDRAM chip and that the Buffalo WHR-HP-G300N has a very similar bill of materials to the NSLM5!

Inside the shielded area, directly above the AR7240, is the radio chip, the Atheros AR9280-AL1A. The two chips to the left are both Skyworks SE2593A20, a dual-band WiFi frontend which does all the switching, filtering, and so forth. If you look closely towards the bottom left of the shielded area, you can see two leads running to a pair of connectors for RF pigtails (they're the golden squares with a dark circle). These are the antenna lines -- you can follow them back to the antenna port of each of the frontend chips. I guess they left those leads for testing purposes; I don't know if they're functional.

A couple other points of interest are the serial port on the lower right side of the board, just next to the Ethernet port. The reset button is on the bottom left, under the Ethernet transformer.

Flipping the board over, we see the antennas. These are two panel antennas layered on top of each other. They're attached with some plastic screws and solder to connect them to the antenna leads, along with one metal bolt which looks like it goes to ground. The lower layer of the antenna is the only one that's soldered to the board. The upper layer actually doesn't make any electrical contact with the lower one.

Up to this point, you could probably re-assemble the board. But this is a teardown, so I broke off the solder between the lower antenna and the board. It snaps in two pretty easily.

(Note my current favorite tool in the top right corner, vicegrips!)

There's nothing too exciting underneath, just the bottom of the Atheros chips.

I still have all the parts, so if you'd like better pictures or have questions about any parts I didn't discuss, let me know!