After tplink, it was time to play with picostation m2hp.
I’ve learned a bunch of things from this experience and this entire bring up would have been impossible without the help from loos@ and adrian@
First of all, a usb-ttl serial adapter is needed to connect to the board:
Here,
black – GND
white – TX
green – RX
When you power it on, the boot up sequence looks like this:
U-Boot 1.1.4.2-s564 (Jul 19 2012 - 10:41:56)
Board: Ubiquiti Networks XM board (rev 1.0 e302)
DRAM: 32 MB
Flash: 8 MB
PCIe WLAN Module found (#1).
Net: eth0, eth1
Hit any key to stop autoboot: 0
Here is where you should top the autoboot and it will drop into uboot>.
ar7240> printenv
bootdelay=1
baudrate=115200
ethaddr=00:15:6d:0d:00:00
mtdids=nor0=ar7240-nor0
partition=nor0,0
mtddevnum=0
mtddevname=u-boot
filesize=10000
fileaddr=81000000
serverip=192.168.1.254
ethact=eth0
mtdparts=mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),5760k(rootfs),256k(cfg),64k(EEPROM)
bootcmd=bootm 0x9f050000
bootargs=console=tty0 root=31:03 rootfstype=squashfs init=/init
ipaddr=192.168.1.20
stdin=serial
stdout=serial
stderr=serial
Environment size: 452/65532 bytes
ar7240>
Again, mtdparts an important piece here to see how uboot expects the image layout:
mtdparts=ar7240-nor0:256k(u-boot),64k(u-boot-env),1024k(kernel),5760k(rootfs),256k(cfg),64k(EEPROM)
I picked up a working openwrt image and tried to load it.
My setup looks like this:
Black power adapter has 2 cables going to it: o POE (yellow)- power over ethernet – which connects to the board o LAN (green)- which connects to my working router
Laptop act as a tftp server here which is also connected to the router (via gray cable). This way laptop and board are both in the same network. laptop has a tftp server running and I’ve assigned 192.168.1.254 to that network interface (em0 in my case) with “ifconfig alias”. This is because as you can see in uboot’s printenv, uboot expects the tftp server to be running at that address. The board will obviously act as a tftp client.
Now, to transfer the image, after generating the image (which we will look into in a bit), copy that into /tftpboot on the server.
This is how you put board into “urescue” mode:
Board: Ubiquiti Networks XM board (rev 1.0 e302)
DRAM: 32 MB
Flash: 8 MB
PCIe WLAN Module found (#1).
Net: eth0, eth1
Hit any key to stop autoboot: 0
ar7240> ping 192.168.1.254
Using eth0 device
host 192.168.1.254 is alive
ar7240> urescue
Setting default IP 192.168.1.20
Starting TFTP server...
Using eth0 (192.168.1.20), address: 0x81000000
Waiting for connection: /
Now, board is waiting for image. Send it from the tftp server:
% tftp 192.168.1.20
tftp> bin
tftp> put PICOSTATION_M2HP.initial.img
Sent 5994346 bytes during 15.2 seconds in 11709 blocks
tftp>
board receiving the image:
Receiving file from 192.168.1.18:18401
Received 6040751 bytes
Firmware Version: XM.ar7240.FreeBSD
Alright this was the basics of how to upload a valid image onto the board. Fun part is to generate a valid image that board will accept. I tried a bunch of different kenrconf’s available in the freebsd-wifi-build project but board was not accepting the generated images. After accepting the image, it used to fail like this:
Firmware check failed! (-2)
This error was coming from uboot which was proprietary and I could not find this error in any opensourced version of uboot.
General consensus about the reasons for this error was: – bad layout of the firmware image – wrong header (something that this uboot is not liking)
loos@ showed me a trick to look at images with hexdum. After looking at openwrt’s working image by hexdump -c image, I found out that uboot was expecting something along the lines of XS2.ar7240.FreeBSD as version string in its header. If it does not see ar7240 in the header, it would fail the check.
So, after all that and with ray@ suggestion of using lzma’ed kernel, I could boot up the board which later failed at mounting the rootfs:
U-Boot 1.1.4.2-s594 (Dec 5 2012 - 15:23:07)
Board: Ubiquiti Networks XM board (rev 1.0 e302)
DRAM: 32 MB
Flash: 8 MB
PCIe WLAN Module found (#1).
Net: eth0, eth1
Hit any key to stop autoboot: 0
ar7240> rescu
Unknown command 'rescu' - try 'help'
ar7240> uresc
Setting default IP 192.168.1.20
Starting TFTP server...
Using eth0 (192.168.1.20), address: 0x81000000
Waiting for connection: \
Receiving file from 192.168.1.254:57971
Received 5917237 bytes
Firmware Version: XS2.ar7240.FreeBSD
Setting U-Boot environment variables
Un-Protected 1 sectors
Erasing Flash.... done
Erased 1 sectors
Writing to Flash... done
Protected 1 sectors
Copying partition 'kernel' to flash memory:
erasing range 0x9F050000..0x9F12FFFF: .............. done
Erased 14 sectors
writing to address 0x9f050000, length 0x000e0000 ...
Copying partition 'rootfs' to flash memory:
erasing range 0x9F130000..0x9F5FFFFF: ............................................................................. done
Erased 77 sectors
writing to address 0x9f130000, length 0x004d0000 ...
Firmware update complete.
Resetting...
U-Boot 1.1.4.2-s594 (Dec 5 2012 - 15:23:07)
Board: Ubiquiti Networks XM board (rev 1.0 e302)
DRAM: 32 MB
Flash: 8 MB
PCIe WLAN Module found (#1).
Net: eth0, eth1
Hit any key to stop autoboot: 0
## Booting image at 9f050000 ...
Image Name: FreeBSD
Created: 2013-08-26 14:51:52 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 893021 Bytes = 872.1 kB
Load Address: 80050000
Entry Point: 80050100
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
CPU platform: Atheros AR7241 rev 1
CPU Frequency=390 MHz
CPU DDR Frequency=390 MHz
CPU AHB Frequency=195 MHz
platform frequency: 390000000
CPU reference clock: 5 MHz
arguments:
a0 = 00000006
a1 = a1f4bfb0
a2 = a1f4c450
a3 = 00000000
Cmd line:argv is invalid
Environment:
envp is invalid
Cache info:
picache_stride = 4096
picache_loopcount = 16
pdcache_stride = 4096
pdcache_loopcount = 8
cpu0: MIPS Technologies processor v116.147
MMU: Standard TLB, 16 entries
L1 i-cache: 4 ways of 512 sets, 32 bytes per line
L1 d-cache: 4 ways of 256 sets, 32 bytes per line
Config1=0x9ee3519e
Config3=0x20
KDB: debugger backends: ddb
KDB: current backend: ddb
Copyright (c) 1992-2013 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 10.0-CURRENT #0 r254676: Thu Aug 22 18:05:52 UTC 2013
[email protected]:/usr/home/hirenp/work/freebsd/head/obj/mipseb/mips.mips/usr/home/hirenp/work/freebsd/head/src/sys/AP91 mips
gcc version 4.2.1 20070831 patched [FreeBSD]
real memory = 16777216 (16384K bytes)
avail memory = 12087296 (11MB)
random device not loaded; using insecure entropy
nexus0:
nexus0: failed to add child: arge0
clock0: on nexus0
Timecounter "MIPS32" frequency 195000000 Hz quality 800
Event timer "MIPS32" frequency 195000000 Hz quality 800
argemdio0: at mem 0x19000000-0x19000fff on nexus0
mdio0: on argemdio0
mdioproxy0: on mdio0
arswitch0: on mdio0
arswitch0: attaching PHY 0 failed
arswitch0: attaching PHY 1 failed
arswitch0: attaching PHY 2 failed
arswitch0: attaching PHY 3 failed
device_attach: arswitch0 attach returned 6
apb0 at irq 4 on nexus0
uart0: <16550 or compatible> on apb0
uart0: console (115200,n,8,1)
pcib0 at irq 0 on nexus0
pcib0: found EEPROM at 0x1fff1000 on 0.0.0
pcib0: EEPROM firmware: 0x1fff1000 @ 4096 bytes
pcib0: device EEPROM 'pcib.0.bus.0.0.0.eeprom_firmware' registered
pci0: on pcib0
pci0: at device 0.0 (no driver attached)
arge0: at mem 0x19000000-0x19000fff irq 2 on nexus0
miiproxy0: on arge0
arge0: can't attach proxy
arge0: finishing attachment, phymask 0010, proxy null
arge0: unable to attach PHY 4: 6
device_attach: arge0 attach returned 6
arge1: at mem 0x1a000000-0x1a000fff irq 3 on nexus0
arge1: finishing attachment, phymask 0000, proxy null
arge1: Ethernet address: 62:73:64:dd:03:41
spi0: at mem 0x1f000000-0x1f00000f on nexus0
spibus0: on spi0
mx25l0: at cs 0 on spibus0
mx25l0: w25q64, sector 65536 bytes, 128 sectors
ar71xx_wdog0: on nexus0
ar71xx_wdog0: Previous reset was due to watchdog timeout
Timecounters tick every 1.000 msec
Trying to mount root from ufs:/dev/map/rootfs.uncompress []...
mountroot: waiting for device /dev/map/rootfs.uncompress ...
Mounting from ufs:/dev/map/rootfs.uncompress failed with error 19.
Loader variables:
Manual root filesystem specification:
: [options]
Mount using filesystem
and with the specified (optional) option list.
eg. ufs:/dev/da0s1a
zfs:tank
cd9660:/dev/acd0 ro
(which is equivalent to: mount -t cd9660 -o ro /dev/acd0 /)
? List valid disk boot devices
. Yield 1 second (for background tasks)
Abort manual input
mountroot>
jmg@ suspected that /dev/map/rootfs.uncompress doesn’t exist for some reason as error: 19 is ENODEV and asked me to enable debugging in g_uncompress.c
I did not find anything useful after enabling debugs:
flash/spi0.uncompress: media sectorsize 512, mediasize 8388608
flash/spi0.uncompress: no CLOOP magic
map/u-boot.uncompress: media sectorsize 512, mediasize 262144
map/u-boot.uncompress: no CLOOP magic
map/u-boot-env.uncompress: media sectorsize 512, mediasize 65536
map/u-boot-env.uncompress: no CLOOP magic
map/kernel.uncompress: media sectorsize 512, mediasize 1048576
map/kernel.uncompress: no CLOOP magic
map/rootfs.uncompress: media sectorsize 512, mediasize 6684672
map/rootfs.uncompress: no CLOOP magic
map/cfg.uncompress: media sectorsize 512, mediasize 262144
map/cfg.uncompress: no CLOOP magic
map/eeprom.uncompress: media sectorsize 512, mediasize 65536
map/eeprom.uncompress: no CLOOP magic
Trying to mount root from ufs:/dev/map/rootfs.uncompress []...
mountroot: waiting for device /dev/map/rootfs.uncompress ...
Mounting from ufs:/dev/map/rootfs.uncompress failed with error 19.
Loader variables:
Manual root filesystem specification:
: [options]
Mount using filesystem
and with the specified (optional) option list.
eg. ufs:/dev/da0s1a
zfs:tank
cd9660:/dev/acd0 ro
(which is equivalent to: mount -t cd9660 -o ro /dev/acd0 /)
? List valid disk boot devices
. Yield 1 second (for background tasks)
Abort manual input
mountroot> ?
List of GEOM managed disk devices:
map/eeprom map/cfg map/rootfs map/kernel map/u-boot-env map/u-boot flash/spi0
mountroot>
Later loos@ caught that the problem was the rootfs start point in the hints file.
Specially we had to specify: hint.map.3.start=0x130000
Because mtdparts specify 0x130000 as rootfs offset.
After this bring up part was done:
U-Boot 1.1.4.2-s594 (Dec 5 2012 - 15:23:07)
Board: Ubiquiti Networks XM board (rev 1.0 e302)
DRAM: 32 MB
Flash: 8 MB
PCIe WLAN Module found (#1).
Net: eth0, eth1
Hit any key to stop autoboot: 0
ar7240> ures
Setting default IP 192.168.1.20
Starting TFTP server...
Using eth0 (192.168.1.20), address: 0x81000000
Waiting for connection: |
Receiving file from 192.168.1.254:57971
Received 5966201 bytes
Firmware Version: XM.ar7240.FreeBSD
Setting U-Boot environment variables
Un-Protected 1 sectors
Erasing Flash.... done
Erased 1 sectors
Writing to Flash... done
Protected 1 sectors
Copying partition 'kernel' to flash memory:
erasing range 0x9F050000..0x9F12FFFF: .............. done
Erased 14 sectors
writing to address 0x9f050000, length 0x000e0000 ...
Copying partition 'rootfs' to flash memory:
erasing range 0x9F130000..0x9F5FFFFF: ............................................................................. done
Erased 77 sectors
writing to address 0x9f130000, length 0x004d0000 ...
Copying partition 'cfg' to flash memory:
erasing range 0x9F6F0000..0x9F6FFFFF: . done
Erased 1 sectors
writing to address 0x9f6f0000, length 0x00010000 ...
Firmware update complete.
Resetting...
U-Boot 1.1.4.2-s594 (Dec 5 2012 - 15:23:07)
Board: Ubiquiti Networks XM board (rev 1.0 e302)
DRAM: 32 MB
Flash: 8 MB
PCIe WLAN Module found (#1).
Net: eth0, eth1
Hit any key to stop autoboot: 0
## Booting image at 9f050000 ...
Image Name: FreeBSD
Created: 2013-08-27 11:12:34 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 892769 Bytes = 871.8 kB
FreeBSD 10.0-CURRENT #6 r254676M: Tue Aug 27 11:11:27 UTC 2013
[email protected]:/usr/home/hirenp/work/freebsd/head/obj/mipseb/mips.mips/usr/home/hirenp/work/freebsd/head/src/sys/AP91 mips
gcc version 4.2.1 20070831 patched [FreeBSD]
real memory = 16777216 (16384K bytes)
avail memory = 12087296 (11MB)
random device not loaded; using insecure entropy
nexus0:
clock0: on nexus0
Timecounter "MIPS32" frequency 195000000 Hz quality 800
Event timer "MIPS32" frequency 195000000 Hz quality 800
argemdio0: at mem 0x1a000000-0x1a000fff on nexus0
mdio0: on argemdio0
mdioproxy0: on mdio0
arswitch0: on mdio0
miibus0: on arswitch0
ukphy0: PHY 0 on miibus0
ukphy0: none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, 1000baseT-FDX-master, auto
miibus1: on arswitch0
ukphy1: PHY 1 on miibus1
ukphy1: none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, 1000baseT-FDX-master, auto
miibus2: on arswitch0
ukphy2: PHY 2 on miibus2
ukphy2: none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, 1000baseT-FDX-master, auto
miibus3: on arswitch0
ukphy3: PHY 3 on miibus3
ukphy3: none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, 1000baseT-FDX-master, auto
etherswitch0: on arswitch0
mdio1: on arswitch0
mdioproxy1: on mdio1
apb0 at irq 4 on nexus0
uart0: <16550 or compatible> on apb0
uart0: console (115200,n,8,1)
pcib0 at irq 0 on nexus0
pcib0: found EEPROM at 0x1fff1000 on 0.0.0
pcib0: EEPROM firmware: 0x1fff1000 @ 4096 bytes
pcib0: device EEPROM 'pcib.0.bus.0.0.0.eeprom_firmware' registered
pci0: on pcib0
pci0: at device 0.0 (no driver attached)
arge0: at mem 0x19000000-0x19000fff irq 2 on nexus0
arge0: Overriding MAC from EEPROM
miiproxy0: on arge0
miiproxy0: attached to target mdio1
arge0: finishing attachment, phymask 0010, proxy set
miibus4: on miiproxy0
ukphy4: PHY 4 on miibus4
ukphy4: none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, 1000baseT-FDX-master, auto
arge0: Ethernet address: 12:00:00:18:3c:02
arge1: at mem 0x1a000000-0x1a000fff irq 3 on nexus0
arge1: finishing attachment, phymask 0000, proxy null
arge1: Ethernet address: 12:00:00:18:3c:03
spi0: at mem 0x1f000000-0x1f00000f on nexus0
spibus0: on spi0
mx25l0: at cs 0 on spibus0
mx25l0: w25q64, sector 65536 bytes, 128 sectors
ar71xx_wdog0: on nexus0
ar71xx_wdog0: Previous reset was due to watchdog timeout
Timecounters tick every 1.000 msec
arswitch0port1: link state changed to DOWN
arswitch0port2: link state changed to DOWN
arswitch0port3: link state changed to DOWN
arswitch0port4: link state changed to DOWN
map/rootfs.uncompress: GEOM_ULZMA image found
map/rootfs.uncompress: 173 x 131072 blocks
Trying to mount root from ufs:/dev/map/rootfs.uncompress []...
warning: no time-of-day clock registered, system time will not be set accurately
Aug 27 11:11:45 init: login_getclass: unknown class 'daemon'
*** Populating /var ..
*** Loading configuration files ..
*** Restoring from /dev/map/cfg ..
gunzip: unknown compression format
0 blocks
*** Completed.
*** setting up hostname
*** Load kernel modules
random: initialized
*** bringing up loopback ..
*** Starting networking via /etc/rc.d/base/net
sysctl: unknown oid 'dev.ath.0.txq_mcastq_maxdepth': No such file or directory
sysctl: unknown oid 'dev.ath.1.txq_mcastq_maxdepth': No such file or directory
*** Interface: arge0: start
arge0: link state changed to UP
*** Interface: arge0: done
*** Interface: bridge0: start
bridge0: Ethernet address: d2:c4:a8:63:0e:57
arge0: promiscuous mode enabled
bridge0: link state changed to UP
*** Interface: bridge0: done
*** Default password/login databases ..
*** inetd
*** Done!
FreeBSD/mips (freebsd-wifi-build) (ttyu0)
login: root
No home directory.
Logging in with home = "/".
# uname -a
FreeBSD freebsd-wifi-build 10.0-CURRENT FreeBSD 10.0-CURRENT #6 r254676M: Tue Aug 27 11:11:27 UTC 2013 [email protected]:/usr/home/hirenp/work/freebsd/head/obj/mipseb/mips.mips/usr/home/hirenp/work/freebsd/head/src/sys/AP91 mips
# df -k
Filesystem 1024-blocks Used Avail Capacity Mounted on
/dev/map/rootfs.uncompress 21851 20633 -529 103% /
devfs 1 1 0 100% /dev
/dev/md0 828 8 756 1% /tmp
/dev/md1 828 56 708 7% /var
/dev/md2 828 436 328 57% /etc
# pciconf -lv
none0@pci0:0:0:0: class=0x028000 card=0xe3020777 chip=0x002a168c rev=0x01 hdr=0x00
vendor = 'Atheros Communications Inc.'
device = 'AR928X Wireless Network Adapter (PCI-Express)'
class = network
# ifconfig
arge0: flags=8943 metric 0 mtu 1500
options=80000
ether 12:00:00:18:3c:02
media: Ethernet autoselect (100baseTX )
status: active
arge1: flags=8802 metric 0 mtu 1500
ether 12:00:00:18:3c:03
media: Ethernet 1000baseT
status: active
lo0: flags=8049 metric 0 mtu 16384
options=600003
inet 127.0.0.1 netmask 0xff000000
bridge0: flags=8843 metric 0 mtu 1500
ether d2:c4:a8:63:0e:57
inet 192.168.1.20 netmask 0xffffff00 broadcast 192.168.1.255
id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
member: arge0 flags=143
ifmaxaddr 0 port 5 priority 128 path cost 200000
#
Next up was figuring out networking.
I loaded all needed modules:
# kldstat
Id Refs Address Size Name
1 22 0x80050000 2d8f10 kernel
2 1 0xc0081000 1078 if_ath_pci.ko
3 1 0xc0083000 11e4bc if_ath.ko
4 4 0xc01a2000 606fc wlan.ko
5 2 0xc0203000 4924 bridgestp.ko
6 1 0xc0208000 6d90 if_bridge.ko
7 1 0xc020f000 a5e0 random.ko
8 1 0xc021a000 3ac wlan_xauth.ko
9 1 0xc021b000 27e4 wlan_tkip.ko
#
But if loading if_ath_pci failed in:
ath0: at device 0.0 on pci0
ath0: ath_pci_attach: EEPROM firmware @ 0x8046c000
[ath]: default pwr offset: -5 dBm != EEPROM pwr offset: 0 dBm; curves will be adjusted.
ath0: ath_getchannels: unable to collect channel list from hal, status 12
device_attach: ath0 attach returned 22
Turning up debugging level:
# sysctl hw.ath.hal.debug=25600000000
hw.ath.hal.debug: 0 -> 2147483647
# kldload if_ath_pci
ath0: mem 0x10000000-0x1000ffff irq 0 at device 0.0 on pci0
ath0: ath_pci_attach: EEPROM firmware @ 0x8046c000
ar9280Attach: sc 0xc090d000 st 0x803006b4 sh 0xb0000000
ar5416SetReset Applying descriptor swap
ar5416SetPowerMode: AWAKE -> AWAKE (set chip )
ar9280Attach: ID 0x802ff VERSION 0x2 TYPE 0x0 REVISION 0x2
ath_hal_v14EepromAttach Eeprom Version 14.22
v14EepromReadCTLInfo Numctls = 11
ar5416SetPowerMode: AWAKE -> AWAKE (set chip )
ar9280RfAttach: attach AR9280 radio
[ath]: default pwr offset: -5 dBm != EEPROM pwr offset: 0 dBm; curves will be adjusted.
enableAniMIBCounters: Enable mib counters: OfdmPhyErrBase 0xbffe0c cckPhyErrBase 0xbfff38
ar9280Attach: return
getchannels: cc 0 regDmn 0xf0 mode 0xffffff ecm
isEepromValid: invalid regulatory domain/country code 0x2a
getregstate: invalid EEPROM contents
ath0: ath_getchannels: unable to collect channel list from hal, status 12
ar5416Detach:
ar5416SetPowerMode: AWAKE -> AWAKE (set chip )
Detaching Ani
Disable MIB counters
ar5416SetPowerMode: AWAKE -> AWAKE (set chip )
ar5416SetReset Applying descriptor swap
ar5416SetPowerMode: AWAKE -> FULL-SLEEP (set chip )
device_attach: ath0 attach returned 22
Error here was: isEepromValid: invalid regulatory domain/country code 0x2a
What it meant was that hal regdomain needed to be updated with country code 0x2a
Just to hack that up for time being, adrian@ suggested to set it to 0x0 which worked.
Index: dev/ath/ath_hal/ah_regdomain.c
===================================================================
--- dev/ath/ath_hal/ah_regdomain.c (revision 255320)
+++ dev/ath/ath_hal/ah_regdomain.c (working copy)
@@ -169,6 +169,10 @@
if (regDomainPairs[i].regDmnEnum == rd)
return AH_TRUE;
}
+ if (rd == 42) {
+ rd = 0;
+ return AH_TRUE;
+ }
HALDEBUG(ah, HAL_DEBUG_REGDOMAIN,
"%s: invalid regulatory domain/country code 0x%x\n", __func__, rd);
return AH_FALSE;
The kernconf and hints file are committed as r255086.
This is how you can generate the image:
$ cd ~
$ mkdir -p work/freebsd/head
$ cd work/freebsd/head
$ svn checkout svn://svn.freebsd.org/base/head src
$ svn checkout http://freebsd-wifi-build.googlecode.com/svn/trunk/ build
$ cd build/programs/ubnt-mkfwimage
$ make
$ su
# make install
# exit
$ cd ~/work/freebsd/head/src
$ ../build/build/bin/build picostation_m2hp buildworld buildkernel
$ su
# mkdir /tftpboot
# ../build/build/bin/build picostation_m2hp installworld installkernel distribution mfsroot fsimage uboot ubnt
# exit
On successful completion, resulting image PICOSTATION_M2HP.initial.img will be in /tftpboot.
My entire effort/rant has been also recorded at freebsd-embedded@