I have a Ubiquity AirCube ISP. I think that this could be a nice device for OpenWrt. It has a good balance between price (about 30 Euro in Germany) and offered hardware (MIPS with 650MHz, 16MiB Flash, 64MiB RAM).
There is already at least one thread here that started discussing a port: Support for UBNT AirCube ACB-ISP But it seems that it hasn't been continued. So I would like to give it a (new) try.
There are some odd things in the hardware that might could get interesting later. I'll have to have a look at them as soon as the basic image is running:
The LED is not a simple GPIO pin but it has it's own controller connected via SPI (protocol analyzed in the notes)
There is a switchable POE Pass Through. I've no idea where such a thing could be integrated into the frontend.
What I'm currently struggling with are the following points:
I would like to find out where the RESET button is connected to. Any good idea how to do that while I still have the original firmware? Or is that simpler as soon as I have an OpenWRT running?
For the ath79 family of targets I need a device tree. I started a (still incomplete) one in the notes repository (devicetree/qca9533_ubnt_acb-isp.dts - can't post the full link because new users are only allowed to post two links ...). Now I'm struggling with the MAC-Addresses. Some hints how I can find out where the original system get's it's addresses from?
I have put a dump of the original flash into the notes repository mentioned earlier and have tried to collect some basic information like the boot log and the content of some interesting files. Do I have to save any more information before I put a OpenWRT image to the AP?
I don't know how to do it, but since you have a shell access... Had u tried using dd of mtd? If you are overwriting only system and kernel, then if something go wrong, you will still have an option to restore original firmware via tftp, right?
/update: The flash chip is in SOP package, it's easy to find tools for dumping these chips (google: pomona sop clip) and it's better to dump them first.
I don't know if this is helpful, but I hope it is.
Hello kazigk, thanks for the hint. I already did this as one of the first steps after adding the serial port. My method was a little hacky (dumping the flash via U-Boot, post processing the output and converting it from ASCII to binary) but I have a complete image that looks good.
Currently my big problem is to create an image that is accepted by the web interface or (more likely) by U-Boot. I think it is quite possible that it is mandatory to have a signed image for the web interface. But I still hope that U-Boot accepts something with the right checksums. I already did some analysis of the original images (detailed description in my github notes) but U-Boot still refuses the image.
Ubiquiti didn't provide the sources when I asked in January. The answer was a "GPL Source code for airCube is not available for now and we do not have any ETA when it will be available.". I wrote back a friendly reminder that U-Boot is GPL and the support person promised to forward it to the "team" and that they would "check into this".
Nothing happened since than so I'll have to find some other way to create a flash able image. U-Boot is GPL so I don't have a bad consciousness to analyze the binary. But without any symbols or hints regarding the structure, reverse engineering isn't something simple. Maybe I should try to connect a debugger but I haven't found any pins or pads for that and with some bad luck the JTAG could be locked down ...
Bad news: It seems that U-Boot doesn't allow any unsigned binaries. After I have found a bug in my image generation I now receive the following message when trying to upgrade via the urescue command:
Receiving file from 192.168.1.5:41751
Received 3671068 bytes
Firmware Version: ACB.ar934x
Firmware check failed! (1)
So most likely there is no possibility to get any new content onto the router via the official channels (web interface or rescue mode).
I'll try to ssh into the original firmware next. If that doesn't work either, the only method is most likely via a serial console via U-Boot which makes it quite hard for a end-user.
Just noted: No I can't. At least not until my patch got merged. The "Create New Dataentry Page" has a required field in "OpenWrt support" which wants to know in which current release the support has been added.
I'll create the page as soon as the patch is merged. Basically I already noted down the information in my notes repository. I'll just have to remove information that isn't relevant.
Hi! I recently bought AirCube ISP. However I cant access the insides. I even broke my credit card (no worry, it was expired) while I was trying to open the case. Would you record a video showing how to open the case or at least take a photo of the clips, please? Thank you in the advance. I appreciate your work
(Sorry for my english, if it's bad)
/edit: I know that there are photos of clips location on your GitHub repo, but I still don;t know how I can pry the clamps
The case is quite hard to open due to the thick plastic. Some pieces of cardboard can help you a lot. Start on the connector side. See
Sorry for the bad sound quality. I used only a simple compact (photo) camera. Normally I don't do this kind of stuff.
edit: The sound isn't relevant anyway. But please enable subtitles. I added some comments there.
That should be possible as soon as the patches from the pull request are applied. But currently still every now and then a write goes wrong because the SPI is too fast. So blinking won't work yet.
Nice to hear that it is useful.
Thanks for the offer. But I wouldn't know why I personally would need one. The base support is already accepted in OpenWRT and therefore the images are built using the official build structure. If you want to donate something to the project please contact the official team. I'm not really connected to OpenWRT. Just wanted to run it on my access point
For me, setting the LED to always on (it was like it by default) works fine even now, because I built OpenWRT from "20190525_aircube_led" branch in your repository.
One question is bothering me. I'm planning to buy AirCube ISP AC. Since this router is using exactly the same firmware file as AirCube ISP, then also the same OpenWRT image should work on AC version. (Maybe except for 5GHz radio, but I can add support for this by simply installing packages that are providing drivers for it). Am I right?
OK yes. On that branch switching the LED on works (most likely almost every time). Only if you want to do something more like blinking with network traffic, you will get some odd effects.
I had a look at the photos in the FCC documents some time back and there is an extra radio chip for 5GHz in there. So most likely it is necessary to adapt the device tree files for 5GHz to work. Maybe it's necessary too to find out where the calibration data or similar information for the extra radio are. So I'm not sure whether it is enough to just install a driver package.
I haven't really done a lot on the device since the initial port (have been quite busy in the last weeks with work stuff - I hope that I'll soon find some more time for such hobby projects again). Currently I have two open points:
In that case: If I remember correctly, the original firmware doesn't have a "root" but they renamed it to ubnt. Try to have a look at the user id.
Currently I have the following impression: All commands that want to do anything with the mtd work when executed from a shell on the serial port. But the same commands seem to give a "not permitted" error as soon as they are executed from a ssh, via webserver or in a startup script. I have never found out why.
Please tell me if you find out something more or if I can help with anything. It's still nagging on me that I never got that working.