Flash Meraki MR32 NEW Method

I discovered another method to flash the Meraki MR32. Following this guide https://openwrt.org/toh/meraki/mr32 it was confusing where to find mr32-initramfs.bin to flash initially.

Instead of using the upgrade meraki_mr32-squashfs.sysupgrade.bin I went with meraki_mr32-squashfs.trx and now can't boot past U-Boot.

What would have been the correct file to flash?

I'll put a guide together for this other method for others to try soon.

Here is the current U-Boot output;

U-Boot 2012.10-00075-g79231c6 (Jul 09 2014 - 13:28:22) Meraki bootkernel loader

Wait.
Done.
DEV ID= 0000cf12
SKU ID = 0
OTP status: eca00018
MEMC 0 DDR speed = 800MHz
Log: ddr40_phy_init.c: Configuring DDR Controller PLLs
Log: offset = 0x18010800
Log: VCO_FREQ is 1600 which is greater than 1Ghz.
Log: DDR Phy PLL polling for lock 
Log: DDR Phy PLL locked.
Log: ddr40_phy_init::DDR PHY step size calibration complete.
Log: ddr40_phy_init:: Virtual VttSetup onm CONNECT=0x01CF7FFF, OVERRIDE=0x00077FFF
Log: ddr40_phy_init:: Virtual Vtt Enabled
Log: DDR Controller PLL Configuration Complete
PHY register dump after DDR PHY init
PHY register dump after mode register write

SHMOO VER 1.13

PKID07DC06011801080000000000001A103F01000000

S3000019F
00001030


RDLYW0 00000005

RDENW0 00000030

RDQSW0 

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ---------+++++++++++++++++++++++X++++++++++++++++++++++---------
 01 ------------++++++++++++++++++++++X+++++++++++++++++++++--------
 02 -----------+++++++++++++++++++++++X++++++++++++++++++++++-------
 03 --------+++++++++++++++++++++++X+++++++++++++++++++++++---------
 04 --------+++++++++++++++++++++X+++++++++++++++++++++-------------
 05 -----------+++++++++++++++++++++X+++++++++++++++++++++----------
 06 ---------+++++++++++++++++++++X+++++++++++++++++++++------------
 07 ----------++++++++++++++++++++++X++++++++++++++++++++++---------
 08 --++++++++++++++++++++++X++++++++++++++++++++++-----------------
 09 -----+++++++++++++++++++++X+++++++++++++++++++++----------------
 10 --++++++++++++++++++++++X++++++++++++++++++++++-----------------
 11 -------++++++++++++++++++++++X+++++++++++++++++++++-------------
 12 ------+++++++++++++++++++++X++++++++++++++++++++----------------
 13 --------++++++++++++++++++++++X++++++++++++++++++++++-----------
 14 -----+++++++++++++++++++++X++++++++++++++++++++-----------------
 15 ------+++++++++++++++++++++X++++++++++++++++++++----------------


PW0 

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ---------+++++++++++++++++++++++X+++++++++++++++++++++++--------
 01 ----------++++++++++++++++++++++++X+++++++++++++++++++++++------
 02 -----------+++++++++++++++++++++++X++++++++++++++++++++++-------
 03 ---------+++++++++++++++++++++++X+++++++++++++++++++++++--------
 04 -------+++++++++++++++++++++++X++++++++++++++++++++++-----------
 05 -----------++++++++++++++++++++++X++++++++++++++++++++++--------
 06 ------+++++++++++++++++++++++X+++++++++++++++++++++++-----------
 07 --------++++++++++++++++++++++++X++++++++++++++++++++++++-------
 08 +++++++++++++++++++++++X+++++++++++++++++++++++-----------------
 09 --+++++++++++++++++++++++X++++++++++++++++++++++----------------
 10 -+++++++++++++++++++++++X++++++++++++++++++++++-----------------
 11 -----+++++++++++++++++++++++X+++++++++++++++++++++++------------
 12 ---++++++++++++++++++++++X++++++++++++++++++++++----------------
 13 ------++++++++++++++++++++++++X++++++++++++++++++++++++---------
 14 ---++++++++++++++++++++++X++++++++++++++++++++++----------------
 15 --+++++++++++++++++++++++X++++++++++++++++++++++----------------


NW0 

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ---------+++++++++++++++++++++++X++++++++++++++++++++++---------
 01 -----------++++++++++++++++++++++X+++++++++++++++++++++---------
 02 -----------+++++++++++++++++++++++X+++++++++++++++++++++++------
 03 ---------+++++++++++++++++++++++X++++++++++++++++++++++---------
 04 -------++++++++++++++++++++++X+++++++++++++++++++++-------------
 05 ---------++++++++++++++++++++++X++++++++++++++++++++++----------
 06 ---------+++++++++++++++++++++X+++++++++++++++++++++------------
 07 ---------+++++++++++++++++++++++X++++++++++++++++++++++---------
 08 --+++++++++++++++++++++++X++++++++++++++++++++++----------------
 09 ----++++++++++++++++++++++X++++++++++++++++++++++---------------
 10 --++++++++++++++++++++++X++++++++++++++++++++++-----------------
 11 -------+++++++++++++++++++++++X++++++++++++++++++++++-----------
 12 -----++++++++++++++++++++++X++++++++++++++++++++++--------------
 13 ---------++++++++++++++++++++++X+++++++++++++++++++++-----------
 14 -----+++++++++++++++++++++X++++++++++++++++++++-----------------
 15 ------++++++++++++++++++++++X+++++++++++++++++++++--------------


WRDQW0 

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ++++++++++++++++++++X+++++++++++++++++++-------++++++++++++++++-
 01 +++++++++++++++++++++X++++++++++++++++++++-----++++++++++++++++-
 02 +++++++++++++++++++++X+++++++++++++++++++++-----+++++++++++++++-
 03 +++++++++++++++++++X+++++++++++++++++++--------++++++++++++++++-
 04 +++++++++++++++++++X+++++++++++++++++++--------++++++++++++++++-
 05 +++++++++++++++++++++X++++++++++++++++++++------+++++++++++++++-
 06 ++++++++++++++++++++X+++++++++++++++++++-------++++++++++++++++-
 07 ++++++++++++++++++++X++++++++++++++++++++-----+++++++++++++++++-
 08 +++++++++++++++++++X++++++++++++++++++----------+++++++++++++++-
 09 ++++++++++++++++++++X+++++++++++++++++++-------++++++++++++++++-
 10 ++++++++++++++++++++X+++++++++++++++++++-------++++++++++++++++-
 11 ++++++++++++++++++++X++++++++++++++++++++------++++++++++++++++-
 12 +++++++++++++++++++X+++++++++++++++++++-------+++++++++++++++++-
 13 +++++++++++++++++++++X++++++++++++++++++++-----++++++++++++++++-
 14 ++++++++++++++++++++X++++++++++++++++++++------++++++++++++++++-
 15 ++++++++++++++++++++X+++++++++++++++++++-------++++++++++++++++-


WRDMW0 00000020
WRDMW0 00000019


ADDR

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ++++++++++++++++S++++++++++++++X++++++++++++++++++++++++++++++++

DRAM:  15.9 MiB
WARNING: Caches not enabled
NAND:   (ONFI), iProc NAND chip could not be initialized
0 MiB
In:    serial
Out:   serial
Err:   serial
Unlocking L2 Cache ...Done
About to set TTBR0 to 00fe0000
Set TTBR0 to 00fe0000
arm_clk=1000MHz, axi_clk=500MHz, apb_clk=250MHz, arm_periph_clk=500MHz
Registering eth
Broadcom BCM IPROC Ethernet driver 0.1
Using GMAC1 (0x18025000)
ERROR: could not get env ethaddr
et0: ethHw_chipAttach: Chip ID: 0xcf12; phyaddr: 0x1e
bcm_robo_attach: devid: 0x53012

NAND read: device 0 offset 0x500000, size 0x300000
 3145728 bytes read: OK
Bad Bootkernel magic!
NAND read: device 0 offset 0x100000, size 0x300000
 3145728 bytes read: OK
Bad CRC!u-boot>

Here are some screen grabs for this method of changing fw;


how did you intalled the .trx? and how did you connected your pc to the mr32

Hi @PiXEL8 ,

Did you still manage to write your new tutorial? I'm willing to flash these AP's but the current tutorial doesn't work with my u-boot.

Hi, sorry I bricked my one device with the .trx image listed above and didn't try flashing another MR32.

The method involves shorting a missing jumper on the PCB next to the reset button (highlighted in red below). Holding that missing jumper to gnd for ~30sec while applying power will cause the main led to go bright white. Releasing the jumper will then cause the MR32 to boot from the broadcom maintenance image as shown above.

Please post here if you are able to successfully flash to OpenWRT using the web interface or cmd line dd/mtd/nc/ect...

-PiXEL8

Hi PiiXEL8,

Sadly this has bricked my MR32 aswell. After i shorted that jumper it only wanted to boot into a orange-yellow flashing light and no webui is available. Sad part about it, is that it also no longer boots normally.

I saw this too and it's not bricked, just in another mode. You can exit back to normal by trying different combinations of the missing jumper and the reset switch.

Monitor the console output for changes while trying different combinations. I don't remember what I did but it went in this mode several times for me.

I'll take some detailed notes when I try flashing another MR32 I have here soon.

Any luck on getting back to this path form a high level documentation / effort standpoint. I have a pile of MR32 units that are all updated past a rootable firmware version and I don't seem to be able to recreate any of the boot scenarios you describe. Shorting J2/p1 to ground seems to pause boot until released but never changes the boot result (I've tried multiple timeframes 15sec-2min). I honestly seems to me that J2 is just a secondary trace to the reset button as once the board is fully booted reset and J2 have the same effect.

@bfvogel I just looked at the MR32 that was bricked and it may have been J25 (above J2) instead of J2. Sorry for the uncertainty. I was hoping to write this up shortly after my initial post but there wasn't any interest for quite a while. I'll take another look soon with a 2nd MR32 I have here and post a detailed guide.

Thanks for the quick reply I look forward to you taking another look into this path. Shorting J25 far side (the pin closest to the edge of the board) to ground fried my testing unit. I'll wait for an update to teardown another one.

I can confirm the J2 is connected to the reset button, so pressing reset button does the same thing.

I managed to boot into Broadcom design reference firmware and the MR32 is quite usable as an AP in this mode, it broadcast SSID, support WPA2, etc ... the problem now is how to make the MR32 always boot into this diagnostics mode, it really tried everything and cannot make it persistent.

I know it's not running OpenWRT but at least it's usable at some extend.

To get into this mode you have to power on the device with the reset button pressed, when you see the white led flashing release the button and press it again, you will see the blue led activated, this means it's in recovery mode. There are two options, RED led means Meraki fw, BLUE led means Broadcom diagnostics firmware.

Now, the question is how to make it always boot into this Broadcom mode ? If I really don't find a "software" way to do it I will simply put a small Atmel Attiny85 controller inside to press the reset button sequence every time it boots...

darkm4n, glad you got it working and posted a corrected guide. Thank you.