Making Picostation m2HP work

Tue Aug 20 23:56:36 UTC 2013

On Mon, Aug 19, 2013 at 10:09 AM, hiren panchasara <
hiren.panchasara at gmail.com> wrote:

>
>
>
> On Mon, Aug 19, 2013 at 5:59 AM, Luiz Otavio O Souza <lists.br at gmail.com>wrote:
>
>> Hi Hiren,
>>
>> I've looked at ubnt firmwares and there are a few identifiers that i can
>> gather:
>>
>> All the 'M' series (rockets, airgrids and many others) uses the same
>> firmware identifier: 'XM'.
>>
>> The b/g 2Ghz radios uses the 'XS2' identifier and the 5Ghz models uses
>> the 'XS5'.
>>
>> The original PicoStation2 HP firmware has the following identifier:
>>
>> $ hexdump -C PicoStation2HP-v4.0.3.build5058.bin
>> 00000000  55 42 4e 54 58 53 32 2e  61 72 32 33 31 36 2e 76
>>  |UBNTXS2.ar2316.v|
>> 00000010  34 2e 30 2e 33 2e 35 30  35 38 2e 31 33 30 33 32
>>  |4.0.3.5058.13032|
>> 00000020  38 2e 31 30 35 34 00 00  00 00 00 00 00 00 00 00
>>  |8.1054..........|
>> 00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
>>  |................|
>> [...]
>>
>> Can you try to build an image using 'XS2' as the board type and
>> 'XS2.ar2316.FreeBSD' as the version string ?
>>
>> If you create a correct image the update process will succeed even if the
>> compression is wrong (the loader will fail to boot, but that is ok, we can
>> hopefully fix the image later).
>>
>> The kernel load address and entry point set by mkfwimage for the XS2
>> board is different from what we expect:
>>
>>                 .name           =       "XS2",
>>                 .kern_start     =       0xbfc30000,
>>                 .kern_memstart  =       0x80041000,
>>
>                  .kern_entry     =       0x80041000,
>>                 .firmware_max_length=   0x00390000,
>>
>
> kern_memstart is not there in the mkfwimage I am using but I thing that
> should be fine.
>
> fwiw, I am using Adrian's
>
> http://freebsd-wifi-build.googlecode.com/svn/trunk/
>
>
> Trying rest of the things with XS2 and still getting the same result:
>
> ar7240> urescue
> Setting default IP 192.168.1.20
> Starting TFTP server...
> Using eth0 (192.168.1.20), address: 0x81000000
> Waiting for connection: /
> Receiving file from 192.168.1.254:42436
> Received 6408760 bytes
> Firmware check failed! (-2)
>

Alright so I think we've got a little further in the journey and got past
this error.

I think the "Firmware check failed!" error was coming because we were
setting UBNT_VERSION = "XS2.ar2316.FreeBSD" while it was expecting
something along the lines of "XS2.ar7240.FreeBSD"

ar7240 is the key thing here afaik. In retrospect it seems obvious(?)
because when I drop into uboot after powering on the device, the prompt for
uboot is:

ar7240>

That probably was the indication to not use ar2316 in version string. But
who knew :-)

Now after accepting the image it fails at a different point:

   Receiving file from 192.168.1.254:56679
   Received 6300568 bytes
   Firmware Version: XS2.ar7240.FreeBSD
   Setting U-Boot environment variables
   Un-Protected 1 sectors
   Erasing Flash.... done
   Erased 1 sectors
   Writing to Flash... done
   Protected 1 sectors
   Copying partition 'kernel' to flash memory:
           erasing range 0x9F050000..0x9F19FFFF: ..................... done
   Erased 21 sectors
           writing to address 0x9f050000, length 0x00150000 ...
   Copying partition 'rootfs' to flash memory:
           erasing range 0x9F1A0000..0x9F65FFFF:
   ............................................................................
   done
   Erased 76 sectors
           writing to address 0x9f1a0000, length 0x004c0000 ...

   Firmware update complete.

   Resetting...

   U-Boot 1.1.4.2-s594 (Dec  5 2012 - 15:23:07)

   Board: Ubiquiti Networks XM board (rev 1.0 e302)
   DRAM:  32 MB
   Flash:  8 MB
   PCIe WLAN Module found (#1).
   Net:   eth0, eth1
   Hit any key to stop autoboot:  0
   ## Booting image at 9f050000 ...
   Bad Magic Number
   Boot failed: resetting...

   U-Boot 1.1.4.2-s594 (Dec  5 2012 - 15:23:07)

   Board: Ubiquiti Networks XM board (rev 1.0 e302)
   DRAM:  32 MB
   Flash:  8 MB
   PCIe WLAN Module found (#1).
   Net:   eth0, eth1
   Hit any key to stop autoboot:  0
   ## Booting image at 9f050000 ...
   Bad Magic Number
   Boot failed: resetting...

So, its stuck in this loop now.

I also tried

ar7240> bootm 0x80041000
## Booting image at 80041000 ...
Bad Magic Number
ar7240> bootm 0xa8030000
## Booting image at a8030000 ...
Bad Magic Number

Just for catching something obvious,

ar7240> printenv
bootdelay=1
baudrate=115200
ethaddr=00:15:6d:0d:00:00
mtdids=nor0=ar7240-nor0
filesize=10000
fileaddr=81000000
serverip=192.168.1.254
ethact=eth0
mtdparts=mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1344k(kernel),5440k(rootfs),256k(cfg),64k(EEPROM)
bootcmd=bootm 0x9f050000
bootargs=console=tty0 root=31:03 rootfstype=squashfs init=/init
ipaddr=192.168.1.20
stdin=serial
stdout=serial
stderr=serial

cheers,
Hiren