Flash Meraki MR32 NEW Method

PiXEL8 · October 6, 2021, 1:35pm

I discovered another method to flash the Meraki MR32. Following this guide https://openwrt.org/toh/meraki/mr32 it was confusing where to find mr32-initramfs.bin to flash initially.

Instead of using the upgrade meraki_mr32-squashfs.sysupgrade.bin I went with meraki_mr32-squashfs.trx and now can't boot past U-Boot.

What would have been the correct file to flash?

I'll put a guide together for this other method for others to try soon.

Here is the current U-Boot output;

U-Boot 2012.10-00075-g79231c6 (Jul 09 2014 - 13:28:22) Meraki bootkernel loader

Wait.
Done.
DEV ID= 0000cf12
SKU ID = 0
OTP status: eca00018
MEMC 0 DDR speed = 800MHz
Log: ddr40_phy_init.c: Configuring DDR Controller PLLs
Log: offset = 0x18010800
Log: VCO_FREQ is 1600 which is greater than 1Ghz.
Log: DDR Phy PLL polling for lock 
Log: DDR Phy PLL locked.
Log: ddr40_phy_init::DDR PHY step size calibration complete.
Log: ddr40_phy_init:: Virtual VttSetup onm CONNECT=0x01CF7FFF, OVERRIDE=0x00077FFF
Log: ddr40_phy_init:: Virtual Vtt Enabled
Log: DDR Controller PLL Configuration Complete
PHY register dump after DDR PHY init
PHY register dump after mode register write

SHMOO VER 1.13

PKID07DC06011801080000000000001A103F01000000

S3000019F
00001030


RDLYW0 00000005

RDENW0 00000030

RDQSW0 

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ---------+++++++++++++++++++++++X++++++++++++++++++++++---------
 01 ------------++++++++++++++++++++++X+++++++++++++++++++++--------
 02 -----------+++++++++++++++++++++++X++++++++++++++++++++++-------
 03 --------+++++++++++++++++++++++X+++++++++++++++++++++++---------
 04 --------+++++++++++++++++++++X+++++++++++++++++++++-------------
 05 -----------+++++++++++++++++++++X+++++++++++++++++++++----------
 06 ---------+++++++++++++++++++++X+++++++++++++++++++++------------
 07 ----------++++++++++++++++++++++X++++++++++++++++++++++---------
 08 --++++++++++++++++++++++X++++++++++++++++++++++-----------------
 09 -----+++++++++++++++++++++X+++++++++++++++++++++----------------
 10 --++++++++++++++++++++++X++++++++++++++++++++++-----------------
 11 -------++++++++++++++++++++++X+++++++++++++++++++++-------------
 12 ------+++++++++++++++++++++X++++++++++++++++++++----------------
 13 --------++++++++++++++++++++++X++++++++++++++++++++++-----------
 14 -----+++++++++++++++++++++X++++++++++++++++++++-----------------
 15 ------+++++++++++++++++++++X++++++++++++++++++++----------------


PW0 

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ---------+++++++++++++++++++++++X+++++++++++++++++++++++--------
 01 ----------++++++++++++++++++++++++X+++++++++++++++++++++++------
 02 -----------+++++++++++++++++++++++X++++++++++++++++++++++-------
 03 ---------+++++++++++++++++++++++X+++++++++++++++++++++++--------
 04 -------+++++++++++++++++++++++X++++++++++++++++++++++-----------
 05 -----------++++++++++++++++++++++X++++++++++++++++++++++--------
 06 ------+++++++++++++++++++++++X+++++++++++++++++++++++-----------
 07 --------++++++++++++++++++++++++X++++++++++++++++++++++++-------
 08 +++++++++++++++++++++++X+++++++++++++++++++++++-----------------
 09 --+++++++++++++++++++++++X++++++++++++++++++++++----------------
 10 -+++++++++++++++++++++++X++++++++++++++++++++++-----------------
 11 -----+++++++++++++++++++++++X+++++++++++++++++++++++------------
 12 ---++++++++++++++++++++++X++++++++++++++++++++++----------------
 13 ------++++++++++++++++++++++++X++++++++++++++++++++++++---------
 14 ---++++++++++++++++++++++X++++++++++++++++++++++----------------
 15 --+++++++++++++++++++++++X++++++++++++++++++++++----------------


NW0 

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ---------+++++++++++++++++++++++X++++++++++++++++++++++---------
 01 -----------++++++++++++++++++++++X+++++++++++++++++++++---------
 02 -----------+++++++++++++++++++++++X+++++++++++++++++++++++------
 03 ---------+++++++++++++++++++++++X++++++++++++++++++++++---------
 04 -------++++++++++++++++++++++X+++++++++++++++++++++-------------
 05 ---------++++++++++++++++++++++X++++++++++++++++++++++----------
 06 ---------+++++++++++++++++++++X+++++++++++++++++++++------------
 07 ---------+++++++++++++++++++++++X++++++++++++++++++++++---------
 08 --+++++++++++++++++++++++X++++++++++++++++++++++----------------
 09 ----++++++++++++++++++++++X++++++++++++++++++++++---------------
 10 --++++++++++++++++++++++X++++++++++++++++++++++-----------------
 11 -------+++++++++++++++++++++++X++++++++++++++++++++++-----------
 12 -----++++++++++++++++++++++X++++++++++++++++++++++--------------
 13 ---------++++++++++++++++++++++X+++++++++++++++++++++-----------
 14 -----+++++++++++++++++++++X++++++++++++++++++++-----------------
 15 ------++++++++++++++++++++++X+++++++++++++++++++++--------------


WRDQW0 

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ++++++++++++++++++++X+++++++++++++++++++-------++++++++++++++++-
 01 +++++++++++++++++++++X++++++++++++++++++++-----++++++++++++++++-
 02 +++++++++++++++++++++X+++++++++++++++++++++-----+++++++++++++++-
 03 +++++++++++++++++++X+++++++++++++++++++--------++++++++++++++++-
 04 +++++++++++++++++++X+++++++++++++++++++--------++++++++++++++++-
 05 +++++++++++++++++++++X++++++++++++++++++++------+++++++++++++++-
 06 ++++++++++++++++++++X+++++++++++++++++++-------++++++++++++++++-
 07 ++++++++++++++++++++X++++++++++++++++++++-----+++++++++++++++++-
 08 +++++++++++++++++++X++++++++++++++++++----------+++++++++++++++-
 09 ++++++++++++++++++++X+++++++++++++++++++-------++++++++++++++++-
 10 ++++++++++++++++++++X+++++++++++++++++++-------++++++++++++++++-
 11 ++++++++++++++++++++X++++++++++++++++++++------++++++++++++++++-
 12 +++++++++++++++++++X+++++++++++++++++++-------+++++++++++++++++-
 13 +++++++++++++++++++++X++++++++++++++++++++-----++++++++++++++++-
 14 ++++++++++++++++++++X++++++++++++++++++++------++++++++++++++++-
 15 ++++++++++++++++++++X+++++++++++++++++++-------++++++++++++++++-


WRDMW0 00000020
WRDMW0 00000019


ADDR

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ++++++++++++++++S++++++++++++++X++++++++++++++++++++++++++++++++

DRAM:  15.9 MiB
WARNING: Caches not enabled
NAND:   (ONFI), iProc NAND chip could not be initialized
0 MiB
In:    serial
Out:   serial
Err:   serial
Unlocking L2 Cache ...Done
About to set TTBR0 to 00fe0000
Set TTBR0 to 00fe0000
arm_clk=1000MHz, axi_clk=500MHz, apb_clk=250MHz, arm_periph_clk=500MHz
Registering eth
Broadcom BCM IPROC Ethernet driver 0.1
Using GMAC1 (0x18025000)
ERROR: could not get env ethaddr
et0: ethHw_chipAttach: Chip ID: 0xcf12; phyaddr: 0x1e
bcm_robo_attach: devid: 0x53012

NAND read: device 0 offset 0x500000, size 0x300000
 3145728 bytes read: OK
Bad Bootkernel magic!
NAND read: device 0 offset 0x100000, size 0x300000
 3145728 bytes read: OK
Bad CRC!u-boot>

PiXEL8 · October 6, 2021, 4:43pm

Here are some screen grabs for this method of changing fw;

Error2k · November 26, 2021, 3:45pm

how did you intalled the .trx? and how did you connected your pc to the mr32

GravityS · March 30, 2022, 5:50pm

Hi @PiXEL8 ,

Did you still manage to write your new tutorial? I'm willing to flash these AP's but the current tutorial doesn't work with my u-boot.

PiXEL8 · April 1, 2022, 4:16pm

Hi, sorry I bricked my one device with the .trx image listed above and didn't try flashing another MR32.

The method involves shorting a missing jumper on the PCB next to the reset button (highlighted in red below). Holding that missing jumper to gnd for ~30sec while applying power will cause the main led to go bright white. Releasing the jumper will then cause the MR32 to boot from the broadcom maintenance image as shown above.

Please post here if you are able to successfully flash to OpenWRT using the web interface or cmd line dd/mtd/nc/ect...

-PiXEL8

GravityS · April 7, 2022, 12:44pm

Hi PiiXEL8,

Sadly this has bricked my MR32 aswell. After i shorted that jumper it only wanted to boot into a orange-yellow flashing light and no webui is available. Sad part about it, is that it also no longer boots normally.

PiXEL8 · April 7, 2022, 9:27pm

I saw this too and it's not bricked, just in another mode. You can exit back to normal by trying different combinations of the missing jumper and the reset switch.

Monitor the console output for changes while trying different combinations. I don't remember what I did but it went in this mode several times for me.

I'll take some detailed notes when I try flashing another MR32 I have here soon.

bfvogel · April 18, 2022, 6:12pm

Any luck on getting back to this path form a high level documentation / effort standpoint. I have a pile of MR32 units that are all updated past a rootable firmware version and I don't seem to be able to recreate any of the boot scenarios you describe. Shorting J2/p1 to ground seems to pause boot until released but never changes the boot result (I've tried multiple timeframes 15sec-2min). I honestly seems to me that J2 is just a secondary trace to the reset button as once the board is fully booted reset and J2 have the same effect.

PiXEL8 · April 18, 2022, 8:26pm

@bfvogel I just looked at the MR32 that was bricked and it may have been J25 (above J2) instead of J2. Sorry for the uncertainty. I was hoping to write this up shortly after my initial post but there wasn't any interest for quite a while. I'll take another look soon with a 2nd MR32 I have here and post a detailed guide.

bfvogel · April 18, 2022, 9:45pm

Thanks for the quick reply I look forward to you taking another look into this path. Shorting J25 far side (the pin closest to the edge of the board) to ground fried my testing unit. I'll wait for an update to teardown another one.

darkm4n · May 18, 2022, 2:11pm

I can confirm the J2 is connected to the reset button, so pressing reset button does the same thing.

I managed to boot into Broadcom design reference firmware and the MR32 is quite usable as an AP in this mode, it broadcast SSID, support WPA2, etc ... the problem now is how to make the MR32 always boot into this diagnostics mode, it really tried everything and cannot make it persistent.

I know it's not running OpenWRT but at least it's usable at some extend.

To get into this mode you have to power on the device with the reset button pressed, when you see the white led flashing release the button and press it again, you will see the blue led activated, this means it's in recovery mode. There are two options, RED led means Meraki fw, BLUE led means Broadcom diagnostics firmware.

Now, the question is how to make it always boot into this Broadcom mode ? If I really don't find a "software" way to do it I will simply put a small Atmel Attiny85 controller inside to press the reset button sequence every time it boots...

PiXEL8 · May 18, 2022, 3:55pm

darkm4n, glad you got it working and posted a corrected guide. Thank you.

cmbow · September 25, 2023, 9:30am

Want to confirm some things and update a bit.
Trying to get it into the Broadcom reference firmware, or into some custom firmware loading mode.

When you try the tricks above, does it matter if the wan/lan cable is plugged into the AP?

I tried to do this in 2023 with a meraki MR32. So far I only used the Reset button (not the jumper, since you said it's the same)

The pattern of the LED seems to be different unless I'm doing smth wrong:

holding reset down while plugging it in: only counts as pressing the reset because then the router waits forever if you don't let go and eventually the led powers off if you never let go.
The LED patterns I get are like this:

orange = you just pressed reset or you're holding down reset
rainbow rgb cycle animation = router is loading/powering up
green = loaded and ready with cisco + wan/lan plugged in
blinking orange = loaded but no wan/lan plugged in
blinking green = it blinks green just a few times if I press and hold Reset while it's in the rainbow cycle. After which it goes back to orange.

Anyone else know of any other/updated reset/jumper combos?
Otherwise there's the internal pins, but that I don't have time to mess with rn.

simonjburrows · January 20, 2024, 1:08am

Hi @PiXEL8
Whats the account details to login to this page?

romawkafor · September 9, 2024, 7:14pm

Greetings. I will revive the topic

I was able to stop U-Boot from loading by pressing the "s" key by editing the serial number (Q2XXXXXXXXXV) on the AT24C64 next to the SoC.

Unfortunately, the following commands do not work in the U-Boot interface.

cd /storage/
rm ./config*
rm ./odm_test.log
echo "serial_allow_odm true" > ./config
echo "serial_access_enabled true" >> ./config
echo "serial_access_check false" >> ./config
echo "valid_config true" >> ./config
cp ./config ./config.local
exit

help in the U-Boot interface also does not work.

Is there any way to install initramfs and where to find this file: mr32-initramfs.bin.

Or maybe there's some way to put OpenWRT on MR32.

If you press "v" and enter in U-Boot, it prints the following output:

U-Boot 2012.10-00075-g79231c6 (Jul 09 2014 - 13:28:22) Meraki bootkernel loader
arm-linux-gcc (GCC) 4.7.1
GNU ld (GNU Binutils) 2.24

in the UART console you can see the following software version:
Bootkernel Meraki Build is 25-201807091103-G1dfc8e26-aacharya

mandzo · October 5, 2024, 7:06pm

Hello everyone,

I recently acquired a Meraki MR32 unit and am interested in installing OpenWrt on it. If anyone has an OpenWrt NAND dump for the MR32, I would greatly appreciate your assistance. I have the RT809H programmer ready for use.

I'm encountering an issue with the message:

'UNRECOGNIZED COMMAND LOGGED TO CLOUD SERVERS.'

It seems this problem is related to the newest Cisco firmware, Bootkernel Meraki Build 25-201807091103-G1dfc8e26-aacharya.

Could someone provide or insert a NAND dump of an older firmware version where this procedure was still supported? or or a NAND dump with OpenWRT?

Thank you in advance for your help!

mandzo · October 10, 2024, 10:36pm

I’m looking to install OpenWRT on my Meraki MR32 device. If anyone has a functional NAND dump with OpenWRT for the MR32, I am willing to pay for it.

Thanks