Hi all,
I'm looking at putting custom firmware on a Bullet M2 HP XW but I'm having some trouble.
I have tried a few different firmwares going through either the web interface (the images are always rejected), through SSH (again rejected by the fwupdate utility), through TFTP (nothing happens) and through serial (doesn't work, with more info below).
I've troubleshooted down the rabbit hole as far as I can go but now I'm stuck. Using the flash commands through Uboot over serial isn't yielding the results I would expect. I've tried writing images, writing garbage, nuking the entire flash, erasing etc, but the flash never seems to change. The flash doesn't seem to be protected and there is no change in behaviour if I use protect off all
. I would expect if I try hard enough I should be at least able to brick the device...
Here's an example where I try to erase a section of flash and overwrite it with 0's. I would expect that after the erase the flash should be different (maybe all 0xff's?) and then after the flash copy it should be all 0's, but it never seems to change.
U-Boot 1.1.4-s1039 (May 24 2017 - 15:58:18)
DRAM: 64 MB
Flash: 8 MB (0xc2, 0x20, 0x17)
Net: AR8035
eth0, eth1
Board: Ubiquiti Networks AR9342 board (e2c4-141067.1122.0030)
Radio: 0777:e2c4
Reset: Normal
Hit any key to stop autoboot: 0
ar7240> md 0x9f070000
9f070000: e771b8da 1c63b547 baf4c032 a8bbce23 .q...c.G...2...#
9f070010: 69861c9b 9c18bd0c 8cb34e6a daf7f1e0 i.........Nj....
9f070020: 90e982b5 92712537 bc07e875 baf25efe .....q%7...u..^.
9f070030: c51ae4ff 16afd0d2 5944932b 73541e40 ........YD.+sT.@
9f070040: ef0063f6 134b0c3c 9bfa48d6 a65ecd6b ..c..K.<..H..^.k
9f070050: 0c874eb6 b7d724d9 7eee3ab8 5c436b58 ..N...$.~.:.\CkX
9f070060: 8a4739c7 5a15711b 58bba5aa 029178a7 .G9.Z.q.X.....x.
9f070070: 8af515a0 de72bd14 86769653 a4ef6a46 .....r...v.S..jF
9f070080: 3914ace8 df4fecab 272c1032 04b43e7d 9....O..',.2..>}
9f070090: d21f5e4a 43b3dad0 f4ec43cd 3c6bf121 ..^JC.....C.<k.!
9f0700a0: 16a17dd4 26d629aa b85419c5 36c86c18 ..}.&.)..T..6.l.
9f0700b0: 5acb19d4 7a172373 66d1ada5 43d7683b Z...z.#sf...C.h;
9f0700c0: f92ee838 57e29bd4 aa675e5b 7eb98879 ...8W....g^[~..y
9f0700d0: e31094fc 3e377277 6a047e16 017bcea7 ....>7rwj.~..{..
9f0700e0: 296962f0 5b7c0412 94dab4e5 d60f178e )ib.[|..........
9f0700f0: 91f89f5a 15b22e56 3c60a55b 80c12dee ...Z...V<`.[..-.
ar7240> mw.b 0x80000000 0 0x10000
ar7240> md 0x80000000
80000000: 00000000 00000000 00000000 00000000 ................
80000010: 00000000 00000000 00000000 00000000 ................
80000020: 00000000 00000000 00000000 00000000 ................
80000030: 00000000 00000000 00000000 00000000 ................
80000040: 00000000 00000000 00000000 00000000 ................
80000050: 00000000 00000000 00000000 00000000 ................
80000060: 00000000 00000000 00000000 00000000 ................
80000070: 00000000 00000000 00000000 00000000 ................
80000080: 00000000 00000000 00000000 00000000 ................
80000090: 00000000 00000000 00000000 00000000 ................
800000a0: 00000000 00000000 00000000 00000000 ................
800000b0: 00000000 00000000 00000000 00000000 ................
800000c0: 00000000 00000000 00000000 00000000 ................
800000d0: 00000000 00000000 00000000 00000000 ................
800000e0: 00000000 00000000 00000000 00000000 ................
800000f0: 00000000 00000000 00000000 00000000 ................
ar7240> erase 0x9f070000 +0x10000
. done
Erased 1 sectors
ar7240> md 0x9f070000
9f070000: e771b8da 1c63b547 baf4c032 a8bbce23 .q...c.G...2...#
9f070010: 69861c9b 9c18bd0c 8cb34e6a daf7f1e0 i.........Nj....
9f070020: 90e982b5 92712537 bc07e875 baf25efe .....q%7...u..^.
9f070030: c51ae4ff 16afd0d2 5944932b 73541e40 ........YD.+sT.@
9f070040: ef0063f6 134b0c3c 9bfa48d6 a65ecd6b ..c..K.<..H..^.k
9f070050: 0c874eb6 b7d724d9 7eee3ab8 5c436b58 ..N...$.~.:.\CkX
9f070060: 8a4739c7 5a15711b 58bba5aa 029178a7 .G9.Z.q.X.....x.
9f070070: 8af515a0 de72bd14 86769653 a4ef6a46 .....r...v.S..jF
9f070080: 3914ace8 df4fecab 272c1032 04b43e7d 9....O..',.2..>}
9f070090: d21f5e4a 43b3dad0 f4ec43cd 3c6bf121 ..^JC.....C.<k.!
9f0700a0: 16a17dd4 26d629aa b85419c5 36c86c18 ..}.&.)..T..6.l.
9f0700b0: 5acb19d4 7a172373 66d1ada5 43d7683b Z...z.#sf...C.h;
9f0700c0: f92ee838 57e29bd4 aa675e5b 7eb98879 ...8W....g^[~..y
9f0700d0: e31094fc 3e377277 6a047e16 017bcea7 ....>7rwj.~..{..
9f0700e0: 296962f0 5b7c0412 94dab4e5 d60f178e )ib.[|..........
9f0700f0: 91f89f5a 15b22e56 3c60a55b 80c12dee ...Z...V<`.[..-.
ar7240> cp.b 0x80000000 0x9f070000 0x10000
Copy to Flash... write addr: 9f070000
done
ar7240> md 0x9f070000
9f070000: e771b8da 1c63b547 baf4c032 a8bbce23 .q...c.G...2...#
9f070010: 69861c9b 9c18bd0c 8cb34e6a daf7f1e0 i.........Nj....
9f070020: 90e982b5 92712537 bc07e875 baf25efe .....q%7...u..^.
9f070030: c51ae4ff 16afd0d2 5944932b 73541e40 ........YD.+sT.@
9f070040: ef0063f6 134b0c3c 9bfa48d6 a65ecd6b ..c..K.<..H..^.k
9f070050: 0c874eb6 b7d724d9 7eee3ab8 5c436b58 ..N...$.~.:.\CkX
9f070060: 8a4739c7 5a15711b 58bba5aa 029178a7 .G9.Z.q.X.....x.
9f070070: 8af515a0 de72bd14 86769653 a4ef6a46 .....r...v.S..jF
9f070080: 3914ace8 df4fecab 272c1032 04b43e7d 9....O..',.2..>}
9f070090: d21f5e4a 43b3dad0 f4ec43cd 3c6bf121 ..^JC.....C.<k.!
9f0700a0: 16a17dd4 26d629aa b85419c5 36c86c18 ..}.&.)..T..6.l.
9f0700b0: 5acb19d4 7a172373 66d1ada5 43d7683b Z...z.#sf...C.h;
9f0700c0: f92ee838 57e29bd4 aa675e5b 7eb98879 ...8W....g^[~..y
9f0700d0: e31094fc 3e377277 6a047e16 017bcea7 ....>7rwj.~..{..
9f0700e0: 296962f0 5b7c0412 94dab4e5 d60f178e )ib.[|..........
9f0700f0: 91f89f5a 15b22e56 3c60a55b 80c12dee ...Z...V<`.[..-.
ar7240>
Here is some more info on the board/system
ar7240> bdinfo
boot_params = 0x83F77FB0
memstart = 0x80000000
memsize = 0x04000000
flashstart = 0x9F000000
flashsize = 0x00800000
flashoffset = 0x0002D6C4
ethaddr = 00:AA:BB:CC:DD:EE
ip_addr = 192.168.1.20
baudrate = 115200 bps
ar7240> fli
Bank # 1: mx25l64 (Id: 0xc22017)
Size: 8 MB in 128 sectors
ar7240> mtdparts
device nor0 <ath-nor0>, # parts = 6
#: name size offset mask_flags
0: u-boot 0x00040000 0x00000000 0
1: u-boot-env 0x00010000 0x00040000 0
2: kernel 0x00100000 0x00050000 0
3: rootfs 0x00660000 0x00150000 0
4: cfg 0x00040000 0x007b0000 0
5: EEPROM 0x00010000 0x007f0000 0
active partition: nor0,0 - (u-boot) 0x00040000 @ 0x00000000
defaults:
mtdids : nor0=ath-nor0
mtdparts: mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)
ar7240> printenv
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
serverip=192.168.1.254
mtdids=nor0=ath-nor0
ethact=eth0
mtdparts=mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),6528k(rootfs),256k(cfg),64k(EEPROM)
bootcmd=bootm 0x9f050000
bootargs=console=tty0 root=31:03 rootfstype=squashfs init=/init
ipaddr=192.168.1.20
stdin=serial
stdout=serial
stderr=serial
ubntaddr=80200020
appinitdone=true
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
Environment size: 463/65532 bytes
ar7240>
I feel like I must be missing something obvious; I see other people have had success using the Bullet M2 but they look to be using slightly older hardware and software versions. I'm not sure what else to try; the simplest test I can think of is writing something to a random spot in flash and seeing if it can be read back and this seems to be failing. Any ideas?