Ubiquiti Networks PicoStation M2HP

• Ubiquiti page on PicoStation M2HP

• CPU: Atheros AR7241 V1 SoC 390 MHz (MIPS 32-bit big-endian)
• Memory: 32MB
• Storage: 8MB SPI FLASH
• Network: 1 WAN and 2 LAN ports attached via Infineon ADM6996FC Ethernet switch PHY
• Peripherals:
  • 3 MiniPCI Type IIIA slots (larger expands past edge of board)
  • 1 Hi-Speed USB (no USB port)
  • 1 UART
• Power: 12-24V DC, 3-7W draw; supply over unused Ethernet pins on WAN port

There is an 8 pin user header which exports 8 GPIO pins:

The GPIO pins share functionality with other devices. The AR71XX_GPIO_FUNCTION register defines whether the pins are GPIO or a separate function.

• GPIO_0 also shares with the SPI CS1 pin (enabled by setting GPIO_SPI_CS1_EN), which isn't currently used
• GPIO_1 also shares with the SPI CS2 pin (enabled by setting GPIO_SPI_CS2_EN), which isn't currently used

The RSPro has an Atheros 8316 gigabit switch included.

openwrt discussion about initial support: https://forum.openwrt.org/viewtopic.php?pid=104435#p104435

-HEAD supports this - see the arswitch device.

The PicoStation M2HP receives power over the WAN port.

The UART pins provide TTL level signals. You will need a TTL-RS232 adapter such as http://www.adafruit.com/products/954

(TBD)

The PicoStation M2HP uses !uboot as its boot loader.

Initial bootup log looks like this:

U-Boot 1.1.4.2-s564 (Jul 19 2012 - 10:41:56)

Board: Ubiquiti Networks XM board (rev 1.0 e302)
DRAM:  32 MB
Flash:  8 MB
PCIe WLAN Module found (#1).
Net:   eth0, eth1
Hit any key to stop autoboot:  0
ar7240> printenv
bootdelay=1
baudrate=115200
ethaddr=00:15:6d:0d:00:00
mtdids=nor0=ar7240-nor0
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
filesize=10000
fileaddr=81000000
serverip=192.168.1.254
ethact=eth0
mtdparts=mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),5760k(rootfs),256k(cfg),64k(EEPROM)
bootcmd=bootm 0x9f050000
bootargs=console=tty0 root=31:03 rootfstype=squashfs init=/init
ipaddr=192.168.1.20
stdin=serial
stdout=serial
stderr=serial

Environment size: 452/65532 bytes

Once the system is booted, login with username/password ubnt to access the shell.

Press Ctrl-C on startup and run following command sequence:

ip -h ServerIP -l RStationIP
load kernel
exec

or configure these settings permanently using RedBoot fconfig command. You can also use BOOTP. Type 'fconfig' at the RedBoot prompt to configure this functionality.

After the exec, you'll see something like this:

RedBoot> exec
Now booting linux kernel:
 Base address 0x80050000 Entry 0x800879d0
 Cmdline : -s
 memsize=0x08000000
 modetty0=0,n,8,1,hw
 board=RouterStation PRO
 ethaddr=00.15.6d.c1.c8.4e
platform frequency: 720000000
arguments: 
  a0 = 00000002
  a1 = 80050028
  a2 = 80050000
  a3 = 0000000a
Cmd line: 

Environment:
  memsize = 0x08000000
  modetty0 = 0,n,8,1,hw
  ethaddr = 00.15.6d.c1.c8.4e
  board = RouterStation PRO
Cache info:
  picache_stride    = 4096
  picache_loopcount = 16
  pdcache_stride    = 4096
  pdcache_loopcount = 8
cpu0: MIPS Technologies processor v116.147
  MMU: Standard TLB, 16 entries
  L1 i-cache: 4 ways of 512 sets, 32 bytes per line
  L1 d-cache: 4 ways of 256 sets, 32 bytes per line
  Config1=0x9ee3519e<PerfCount,WatchRegs,MIPS16,EJTAG>
  Config3=0x20
KDB: debugger backends: ddb
KDB: current backend: ddb
Copyright (c) 1992-2010 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 9.0-CURRENT #2 r202166:202178M: Tue Jan 12 23:07:19 WET 2010
    rpaulo@freebsd-vmware:/usr/home/rpaulo/freebsd/obj/mips/usr/home/rpaulo/freebsd/src/sys/AR71XX mips
real memory  = 134217728 (131072K bytes)
avail memory = 125689856 (119MB)
nexus0: <MIPS32 root nexus>
clock0: <Generic MIPS32 ticker> on nexus0
clock0: [FILTER]
apb0 at irq 4 on nexus0
apb0: [FILTER]
uart0: <16550 or compatible> on apb0
uart0: [FILTER]
uart0: console (115200,n,8,1)
pcib0 at irq 0 on nexus0
pcib0: [FILTER]
pci0: <PCI bus> on pcib0
pci0: <old, non-VGA display device> at device 0.0 (no driver attached)
arge0: <Atheros AR71xx built-in ethernet interface> at mem 0x19000000-0x19000fff irq 2 on nexus0
miibus0: <MII bus> on arge0
ukphy0: <Generic IEEE 802.3u media interface> PHY 4 on miibus0
ukphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, auto
arge0: Ethernet address: 00:15:6d:c1:c8:4e
arge0: [FILTER+ITHREAD]
arge1: <Atheros AR71xx built-in ethernet interface> at mem 0x1a000000-0x1a000fff irq 3 on nexus0
arge1: Ethernet address: 00:15:6d:c1:c8:4f
arge1: [FILTER+ITHREAD]
spi0: <AR71XX SPI> at mem 0x1f000000-0x1f00000f on nexus0
spibus0: <spibus bus> on spi0
mx25l0: <M25Pxx Flash Family> at cs 0 on spibus0
mx25l0: mx25ll128, sector 65536 bytes, 256 sectors
ar71xx_wdog0: <Atheros AR71XX watchdog timer> on nexus0
Timecounter "MIPS32" frequency 360000000 Hz quality 800
Timecounters tick every 1.000 msec
bootpc_init: wired to interface 'arge0'
Sending DHCP Discover packet from interface arge0 (00:15:6d:c1:c8:4e)
arge0: link state changed to DOWN

Looking for PHY for MAC unit 0
Eth ADM6996FC found.
Looking for PHY for MAC unit 1
Eth ADM6996FC found.
Ethernet eth0: MAC address 00:15:6d:c1:28:2f
IP: 192.168.1.20/255.255.255.0, Gateway: 0.0.0.0
Default server: 192.168.1.42

RedBoot(tm) bootstrap and debug environment [ROMRAM]
Ubiquiti Networks certified release, version 0.9.7.00 - built 18:07:09, Nov 18 2
008

Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.

Board: Ubiquiti AR71xx-based board
RAM: 0x80000000-0x84000000, [0x8003ae00-0x80fe1000] available
FLASH: 0xbf000000 - 0xc0000000, 256 blocks of 0x00010000 bytes each.
== Executing boot script in 1.000 seconds - enter ^C to abort
RedBoot> cache off
RedBoot> fis load -d -e kernel
Trying LZMA decompression...
Image loaded from 0x80060000-0x8027f086
Image is not ELF, skipping ELF parsing...
RedBoot> go

No wireless card found in slot 0

SIOCSIFADDR: No such device
SIOCGIFFLAGS: No such device
interface ath0 does not exist!
SIOCSIFADDR: No such device
SIOCGIFFLAGS: No such device
SIOCGIFFLAGS: No such device

Please press Enter to activate this console.

00000000-03ffffff : System RAM
  00060000-002060d7 : Kernel code
  002060d8-0025e0bf : Kernel data
10000000-17ffffff : PCI memory space
18020000-18020fff : serial8250.0
1b000000-1bffffff : ar7100-ehci.0
1c000000-1cffffff : ar7100-ohci.0
b9000000-b9002000 : eth0_membase
ba000000-ba002000 : eth1_membase

Linux version 2.6.15 (keba@keba-laptop) (gcc version 3.4.4) #5 Tue Nov 18 18:11:
52 EET 2008
CPU revision is: 00019374
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
On node 0 totalpages: 16384
  DMA zone: 16384 pages, LIFO batch:3
  DMA32 zone: 0 pages, LIFO batch:0
  Normal zone: 0 pages, LIFO batch:0
  HighMem zone: 0 pages, LIFO batch:0
Built 1 zonelists
Kernel command line: console=ttyS0,115200 init=/linuxrc quiet
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 512 (order: 9, 8192 bytes)
Using 340.000 MHz high precision timer.
Console: colour dummy device 80x25
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 62208k/65536k available (1688k kernel code, 3288k reserved, 351k data, 1
32k init, 0k highmem)
Calibrating delay loop... 451.58 BogoMIPS (lpj=225792)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
calling simple_config callback..
SCSI subsystem initialized
PCI: Scanning bus 0000:00
PCI: Fixups for bus 0000:00
PCI: Bus scan for 0000:00 returning with max=00
AR7100 GPIOC major 0
squashfs: version 3.3 (2007/10/31) Phillip Lougher
Initializing Cryptographic API
io scheduler noop registered
io scheduler deadline registered
Serial: 8250/16550 driver $Revision: #1 $ 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
SPI Flash Manufacturer: 0xC2, Device: 0x2018
cmdlinepart partition parsing not available
Searching for RedBoot partition table in ar7100-nor0 at offset 0xff0000
9 RedBoot partitions found on MTD device ar7100-nor0
Creating 9 MTD partitions on "ar7100-nor0":
0x00000000-0x00030000 : "RedBoot"
0x00030000-0x00040000 : "unallocated"
0x00040000-0x00140000 : "kernel"
0x00140000-0x00800000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
0x00800000-0x00bd0000 : "unallocated"
0x00bd0000-0x00fd0000 : "data"
0x00fd0000-0x00ff0000 : "cfg"
0x00ff0000-0x01000000 : "FIS directory"
0x00fff000-0x01000000 : "RedBoot config"
mtd: partition "RedBoot config" doesn't start on an erase block boundary -- forc
e read-only
Netfilter messages via NETLINK v0.30.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
GRE over IPv4 tunneling driver
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 132k freed
Warning: unable to open an initial console.
Algorithmics/MIPS FPU Emulator v1.5
ag7100_mod: module license 'unspecified' taints kernel.
ar7100-gpio 1.0 initialised
ath_hal: 0.9.17.1 (AR5212, AR5416, RF5413, REGOPS_FUNC, 11D)
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
wlan: 0.8.4.2 (Atheros/multi-bss)
wlan: mac acl policy registered
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Right
s Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserve
d
ath_pci: 0.9.4.5 (Atheros/multi-bss)
rssi-leds 1.0 loaded
ag7100: unit 0: phy not up carrier 1
device eth0 entered promiscuous mode

Based on a number of sources of source code for Atheros MIPS parts, I've started the AtherosMIPS page to put it into an organized form.

The DIR-615 revC1 has an Atheros AR9130 under the hood. This is very similar to the AR7160 that the RouterStation has in it. There's a GPL compliance tarball that's available from DLINK

There's also an openwrt port underway that is useful at their SVN Server