Hello,
I received for free 4 APs Meraki MR36H, is it possible to install OpenWrt on them? I connected console, checked bootloader but it's much newer than described on MR33 instruction.
Bootloader is 2018.01-Release-00246-gd14a13b331e1 date Dec 27 2021. I know how to solder, I didn't work with nand reprogramming yet but I can order flashing hardware and try 
since you got console access, post the boot log, use the </> button when you do.
check if boot loader can be interrupted.
based on https://fccid.io/UDX-60099010/, it uses an IPQ8070A, which is supported.
A lot of data...
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.0.3-00098-IPQ60xxLZB-1.465035.1
S - IMAGE_VARIANT_STRING=IPQ6018LA
S - OEM_IMAGE_VERSION_STRING=crm-ubuntu38
S - Boot Interface: NAND
S - Secure Boot: On
S - Boot Config @ 0x000a602c = 0x000002e4
S - JTAG ID @ 0x000a607c = 0x0013a0e1
S - OEM ID @ 0x000a6080 = 0x00010000
S - Serial Number @ 0x000a4128 = 0xe93b5922
S - Feature Config Row 0 @ 0x000a4130 = 0x0000000008000001
S - Feature Config Row 1 @ 0x000a4138 = 0x02c3e83383000009
S - PBL Patch Ver: 1
S - I-cache: On
S - D-cache: On
B - 3413 - PBL, Start
B - 592 - bootable_media_detect_entry, Start
B - 4339 - bootable_media_detect_success, Start
B - 5207 - elf_loader_entry, Start
B - 5380 - auth_hash_seg_entry, Start
B - 7846 - auth_hash_seg_exit, Start
B - 17244 - elf_segs_hash_verify_entry, Start
B - 112742 - elf_segs_hash_verify_exit, Start
B - 116934 - auth_xbl_sec_hash_seg_entry, Start
B - 117078 - auth_xbl_sec_hash_seg_exit, Start
B - 123425 - xbl_sec_segs_hash_verify_entry, Start
B - 123426 - xbl_sec_segs_hash_verify_exit, Start
B - 124356 - PBL, End
B - 104340 - SBL1, Start
B - 238479 - GCC [RstStat:0x0, RstDbg:0x600000] WDog Stat : 0x4
B - 240919 - clock_init, Start
D - 3721 - clock_init, Delta
B - 250405 - boot_flash_init, Start
D - 29768 - boot_flash_init, Delta
B - 282460 - sbl1_ddr_set_default_params, Start
D - 335 - sbl1_ddr_set_default_params, Delta
B - 289079 - boot_config_data_table_init, Start
D - 4910 - boot_config_data_table_init, Delta - (575 Bytes)
B - 299052 - CDT Version:2,Platform ID:8,Major ID:3,Minor ID:2,Subtype:0
B - 303749 - Image Load, Start
D - 6588 - OEM_MISC Image Loaded, Delta - (0 Bytes)
B - 313082 - Image Load, Start
D - 5063 - PMIC Image Loaded, Delta - (0 Bytes)
B - 320951 - sbl1_ddr_set_params, Start
B - 326014 - CPR configuration: 0x366
B - 329125 - Pre_DDR_clock_init, Start
D - 213 - Pre_DDR_clock_init, Delta
D - 0 - sbl1_ddr_set_params, Delta
B - 364536 - Image Load, Start
D - 427 - APDP Image Loaded, Delta - (0 Bytes)
B - 382958 - Image Load, Start
D - 396 - QTI_MISC Image Loaded, Delta - (0 Bytes)
B - 385367 - Image Load, Start
D - 7838 - Auth Metadata
D - 732 - Segments hash check
D - 30317 - QSEE Dev Config Image Loaded, Delta - (36458 Bytes)
B - 417575 - Image Load, Start
D - 13268 - Auth Metadata
D - 10400 - Segments hash check
D - 366519 - QSEE Image Loaded, Delta - (1435460 Bytes)
B - 784551 - Image Load, Start
D - 7503 - Auth Metadata
D - 976 - Segments hash check
D - 43279 - RPM Image Loaded, Delta - (102800 Bytes)
B - 829173 - Image Load, Start
D - 7503 - Auth Metadata
D - 2471 - Segments hash check
D - 114741 - APPSBL Image Loaded, Delta - (443608 Bytes)
B - 972431 - SBL1, End
D - 868396 - SBL1, Delta
S - Flash Throughput, 4000 KB/s (2019573 Bytes, 435379 us)
S - Core 0 Frequency, 800 MHz
S - DDR Frequency, 533 MHz
U-Boot 2018.01-RELEASE-00246-gd14a13b331e1 (Dec 27 2021 - 11:42:05 -0800)
DRAM: 1020 MiB
Setting bus to 0
Valid chip addresses: 56
Meraki Product (major num): 72
NAND: ONFI device found
qpic_nand: changing oobsize to 64 from 128 bytes
256 MiB
Using default environment
In: serial@78B1000
Out: serial@78B1000
Err: serial@78B1000
Device Tree: QCA, IPQ6018-A
machid: 8030200
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 237 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 1900, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 792484089
ubi0: available PEBs: 1073, total reserved PEBs: 827, PEBs reserved for bad PEB handling: 40
Secure boot enabled.
Read 0 bytes from volume part.safe to 4fffd000
No size specified -> Using max size (23359488)
Validating 0x1647000 bytes @ addr 0x4fffd000
Valid image
## Loading kernel from FIT Image at 50000000 ...
Using 'config_72' configuration
Trying 'kernel@1' kernel subimage
Description: Hatchet Kernel
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x50000108
Data Size: 3307787 Bytes = 3.2 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41080000
Entry Point: 0x41080000
## Loading ramdisk from FIT Image at 50000000 ...
Using 'config_72' configuration
Trying 'ramdisk@1' ramdisk subimage
Description: Hatchet Ramdisk
Type: RAMDisk Image
Compression: uncompressed
Data Start: 0x50327ac0
Data Size: 19568252 Bytes = 18.7 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x45000000
Entry Point: unavailable
Loading ramdisk from 0x50327ac0 to 0x45000000
## Loading fdt from FIT Image at 50000000 ...
Using 'config_72' configuration
Trying 'fdt@1' fdt subimage
Description: Amex Device Tree
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x515d11d8
Data Size: 78279 Bytes = 76.4 KiB
Architecture: AArch64
Load Address: 0x43000000
Loading fdt from 0x515d11d8 to 0x43000000
Booting using the fdt blob at 0x43000000
Uncompressing Kernel Image ... OK
Using Device Tree in place at 43000000, end 430161c6
Using machid 0x8030200 from environment
Starting kernel ...
Jumping to AARCH64 kernel via monitor
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 4.4.177-meraki (oe-user@oe-host) (gcc version 7.3.0 (GCC) ) #1 SMP PREEMPT Tue Dec 28 00:45:05 UTC 2021
[ 0.000000] Boot CPU: AArch64 Processor [51af8014]
[ 0.000000] Ignoring memory range 0x40000000 - 0x41000000
[ 0.000000] Machine: Meraki AMEX
[ 0.000000] bootconsole [uart0] enabled
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.0 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
[ 0.000000] PERCPU: Embedded 14 pages/cpu @ffffffc03ee57000 s20376 r8192 d28776 u57344
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 227808
[ 0.000000] Kernel command line: console=ttyMSM0,115200,n8 ubi.mtd=ubi clk_ignore_unused swiotlb=1 earlycon
[ 0.000000] log_buf_len individual max cpu contribution: 131072 bytes
[ 0.000000] log_buf_len total cpu_extra contributions: 393216 bytes
[ 0.000000] log_buf_len min size: 131072 bytes
[ 0.000000] log_buf_len: 524288 bytes
[ 0.000000] early log buf free: 129440(98%)
[ 0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes)
[ 0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes)
[ 0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes)
[ 0.000000] software IO TLB: mapped [mem 0x7fd0f000-0x7fd4f000] (0MB)
[ 0.000000] Memory: 879480K/925696K available (4545K kernel code, 476K rwdata, 1932K rodata, 208K init, 338K bss, 46216K reserved, 0K cma-reserved)
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vmalloc : 0xffffff8000000000 - 0xffffffbdbfff0000 ( 246 GB)
[ 0.000000] vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000 ( 8 GB maximum)
[ 0.000000] 0xffffffbdc0040000 - 0xffffffbdc0ffc000 ( 15 MB actual)
[ 0.000000] fixed : 0xffffffbffa7fd000 - 0xffffffbffac00000 ( 4108 KB)
[ 0.000000] PCI I/O : 0xffffffbffae00000 - 0xffffffbffbe00000 ( 16 MB)
[ 0.000000] modules : 0xffffffbffc000000 - 0xffffffc000000000 ( 64 MB)
[ 0.000000] memory : 0xffffffc000000000 - 0xffffffc03ef00000 ( 1007 MB)
[ 0.000000] .init : 0xffffffc0006d4000 - 0xffffffc000708000 ( 208 KB)
[ 0.000000] .text : 0xffffffc000080000 - 0xffffffc0006d3e44 ( 6480 KB)
[ 0.000000] .data : 0xffffffc000714000 - 0xffffffc00078b208 ( 477 KB)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.000000] Preemptible hierarchical RCU implementation.
[ 0.000000] Build-time adjustment of leaf fanout to 64.
[ 0.000000] NR_IRQS:64 nr_irqs:64 0
[ 0.000000] Architected cp15 timer(s) running at 24.00MHz (virt).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[ 0.000005] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[ 0.011055] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[ 0.026554] pid_max: default: 32768 minimum: 301
[ 0.029258] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.033762] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.041052] Initializing cgroup subsys io
[ 0.047478] Initializing cgroup subsys memory
[ 0.051496] Initializing cgroup subsys devices
[ 0.055808] Initializing cgroup subsys freezer
[ 0.060148] Initializing cgroup subsys pids
[ 0.064840] ASID allocator initialised with 65536 entries
[ 0.154913] Detected VIPT I-cache on CPU1
[ 0.154956] CPU1: Booted secondary processor [51af8014]
[ 0.184890] Detected VIPT I-cache on CPU2
[ 0.184918] CPU2: Booted secondary processor [51af8014]
[ 0.214913] Detected VIPT I-cache on CPU3
[ 0.214939] CPU3: Booted secondary processor [51af8014]
[ 0.214991] Brought up 4 CPUs
[ 0.241416] SMP: Total of 4 processors activated.
[ 0.244540] CPU features: detected feature: 32-bit EL0 Support
[ 0.249230] CPU: All CPU(s) started at EL1
[ 0.255397] devtmpfs: initialized
[ 0.275309] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.275363] futex hash table entries: 1024 (order: 5, 131072 bytes)
[ 0.284669] pinctrl core: initialized pinctrl subsystem
[ 0.291494] NET: Registered protocol family 16
[ 0.320255] cpuidle: using governor ladder
[ 0.350269] cpuidle: using governor menu
[ 0.350705] NET: Registered protocol family 42
[ 0.353321] vdso: 2 pages (1 code @ ffffffc000719000, 1 data @ ffffffc000718000)
[ 0.357533] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[ 0.365231] DMA: preallocated 256 KiB pool for atomic allocations
[ 0.371949] CPU: IPQ6010, SoC Version: 1.0
[ 0.378541] IPC logging disabled
[ 0.381804] IPC logging disabled
[ 0.385201] IPC logging disabled
[ 0.388424] IPC logging disabled
[ 0.391612] IPC logging disabled
[ 0.412838] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel !
[ 0.414108] sps:sps is ready.
[ 0.422302] irq: no irq domain found for /soc/smp2p-wcss/slave-kernel !
[ 0.432552] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[ 0.469368] ACPI: Interpreter disabled.
[ 0.471101] pps_core: LinuxPPS API ver. 1 registered
[ 0.472007] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[ 0.477290] PTP clock support registered
[ 0.488421] rpmsg_dev_probe: No pm domain
[ 0.492258] clocksource: Switched to clocksource arch_sys_counter
[ 0.494527] pnp: PnP ACPI: disabled
[ 0.502942] NET: Registered protocol family 2
[ 0.503961] TCP established hash table entries: 8192 (order: 4, 65536 bytes)
[ 0.508145] TCP bind hash table entries: 8192 (order: 5, 131072 bytes)
[ 0.515330] TCP: Hash tables configured (established 8192 bind 8192)
[ 0.521562] UDP hash table entries: 512 (order: 2, 16384 bytes)
[ 0.528056] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
[ 0.533846] NET: Registered protocol family 1
[ 0.540850] Trying to unpack rootfs image as initramfs...
[ 10.049011] Freeing initrd memory: 19108K
[ 10.049662] hw perfevents: enabled with armv8_cortex_a53 PMU driver, 7 counters available
[ 10.053691] Initialise system trusted keyring
[ 10.106807] Key type asymmetric registered
[ 10.106842] Asymmetric key parser 'x509' registered
[ 10.109822] io scheduler noop registered
[ 10.114621] io scheduler deadline registered (default)
[ 10.120990] 20000000.pci supply vdda not found, using dummy regulator
[ 10.123996] 20000000.pci supply vdda_phy not found, using dummy regulator
[ 10.130246] 20000000.pci supply vdda_refclk not found, using dummy regulator
[ 10.137450] PCI host bridge /soc/pci@20000000 ranges:
[ 10.144165] IO 0x20200000..0x202fffff -> 0x20200000
[ 10.149038] MEM 0x20300000..0x302fffff -> 0x20300000
[ 10.403796] qcom-pcie 20000000.pci: link up
[ 10.403987] qcom-pcie 20000000.pci: PCI host bridge to bus 0000:00
[ 10.406790] pci_bus 0000:00: root bus resource [bus 00-ff]
[ 10.413072] pci_bus 0000:00: root bus resource [io 0x0000-0xfffff] (bus address [0x20200000-0x202fffff])
[ 10.418511] pci_bus 0000:00: root bus resource [mem 0x20300000-0x302fffff]
[ 10.428509] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 10.436344] pci 0000:00:00.0: BAR 8: assigned [mem 0x20300000-0x205fffff]
[ 10.442860] pci 0000:00:00.0: BAR 9: assigned [mem 0x20600000-0x207fffff 64bit pref]
[ 10.449760] pci 0000:00:00.0: BAR 0: assigned [mem 0x20800000-0x20800fff 64bit]
[ 10.457603] pci 0000:00:00.0: BAR 7: assigned [io 0x1000-0x1fff]
[ 10.464629] pci 0000:01:00.0: BAR 0: assigned [mem 0x20400000-0x205fffff 64bit]
[ 10.470911] pci 0000:01:00.0: BAR 6: assigned [mem 0x20300000-0x2030ffff pref]
[ 10.477992] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 10.485278] pci 0000:00:00.0: bridge window [io 0x1000-0x1fff]
[ 10.490379] pci 0000:00:00.0: bridge window [mem 0x20300000-0x205fffff]
[ 10.496397] pci 0000:00:00.0: bridge window [mem 0x20600000-0x207fffff 64bit pref]
[ 10.503226] PCIe: RC0 enabled during bootup
[ 10.542681] msm_rpm_log_probe: OK
[ 10.543100] msm-dcc b3000.dcc: DCC XPU is not specified
[ 10.545418] msm-dcc b3000.dcc: DCC REG dump setup failed
[ 10.550025] msm-dcc b3000.dcc: DCC SRAM dump setup failed
[ 10.555758] msm-dcc b3000.dcc: jiffies_64: 0xffff8eea, cntvct_64: 0x223a84ae
[ 10.560869] msm-dcc b3000.dcc: gcnt_hi: 0x00000000(0xffffff800007e004)
[ 10.568015] msm-dcc b3000.dcc: gcnt_lo: 0x223f0211(0xffffff800007e000)
[ 10.575443] TZ SMMU State: SMMU Stage2 Enabled
[ 10.580908] TZ Log : Will warn on Access Violation, as paniconaccessviolation is not set
[ 10.585666] rpmsg_dev_probe: No pm domain
[ 10.594728] msm_serial 78b1000.serial: msm_serial: detected port #0
[ 10.597464] msm_serial 78b1000.serial: uartclk = 1843199
[ 10.603577] 78b1000.serial: ttyMSM0 at MMIO 0x78b1000 (irq = 5, base_baud = 115199) â–’+HHâ–’Lâ–’â–’617576] console [ttyMSM0] enabled
[ 10.617576] console [ttyMSM0] enabled
[ 10.620205] bootconsole [uart0] disabled
[ 10.620205] bootconsole [uart0] disabled
[ 10.628394] msm_serial 78b3000.serial: msm_serial: detected port #1
[ 10.631789] msm_serial 78b3000.serial: uartclk = 24000000
[ 10.637811] 78b3000.serial: ttyMSM1 at MMIO 0x78b3000 (irq = 6, base_baud = 1500000) is a MSM
[ 10.643874] msm_serial: driver initialized
[ 10.651818] Trying to register dev faulty etc
[ 10.666487] brd: module loaded
[ 10.713075] loop: module loaded
[ 10.714628] nand: device found, Manufacturer ID: 0x01, Chip ID: 0xaa
[ 10.715024] nand: AMD/Spansion S34MS02G2
[ 10.721618] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 128
[ 10.728033] 17 ofpart partitions found on MTD device qcom_nand.0
[ 10.732949] Creating 17 MTD partitions on "qcom_nand.0":
[ 10.739166] 0x000000000000-0x000000180000 : "sbl1"
[ 10.746782] 0x000000180000-0x000000280000 : "mibib"
[ 10.763333] 0x000000280000-0x000000300000 : "bootconfig"
[ 10.777237] 0x000000300000-0x000000380000 : "bootconfig1"
[ 10.781409] 0x000000380000-0x000000700000 : "qsee"
[ 10.796297] 0x000000700000-0x000000a80000 : "qsee_1"
[ 10.802995] 0x000000a80000-0x000000b00000 : "devcfg"
[ 10.806738] 0x000000b00000-0x000000b80000 : "devcfg_1"
[ 10.813757] 0x000000b80000-0x000000c00000 : "rpm"
[ 10.817334] 0x000000c00000-0x000000c80000 : "rpm_1"
[ 10.820978] 0x000000c80000-0x000000d00000 : "cdt"
[ 10.824597] 0x000000d00000-0x000000d80000 : "cdt_1"
[ 10.833292] 0x000000d80000-0x000000e00000 : "appsblenv"
[ 10.849987] 0x000000e00000-0x000000f80000 : "appsbl"
[ 10.860605] 0x000000f80000-0x000001100000 : "appsbl_1"
[ 10.877155] 0x000001100000-0x000001180000 : "ART"
[ 10.891649] 0x000001280000-0x000010000000 : "ubi"
[ 11.098772] libphy: Fixed MDIO Bus: probed
[ 11.319956] qca-mdio 90000.mdio: Could not find phy-reset-gpio
[ 11.320144] libphy: qca_mdio: probed
[ 11.332492] qca-mdio 90000.mdio: qca-mdio driver was registered
[ 11.332775] tun: Universal TUN/TAP device driver, 1.6
[ 11.337209] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 11.342625] Unable to create IPC log context!
[ 11.349062] cnss[2]: INFO: Platform driver probed successfully. plat ffffffc039250018 tgt 0xfffd
[ 11.353934] input: soc:gpio_keys as /devices/platform/soc/soc:gpio_keys/input/input0
[ 11.362104] i2c /dev entries driver
[ 11.371856] at24 1-0056: 8192 byte 24c64 EEPROM, writable, 1 bytes/write
[ 11.373986] Driver for 1-wire Dallas network protocol.
[ 11.380704] ina2xx 0-0040: error configuring the device: -6
[ 11.415690] lp5562 0-0030: internal clock used
[ 11.425609] qcom-q6v5-wcss-pil cd00000.qcom_q6v5_wcss: ssr registeration success qcom_q6v5_wcss
[ 11.425847] remoteproc remoteproc0: cd00000.qcom_q6v5_wcss is available
[ 11.434502] meraki-config soc:board_data_0: Meraki config device loaded
[ 11.442795] NET: Registered protocol family 10
[ 11.447057] NET: Registered protocol family 17
[ 11.451881] Loading compiled-in X.509 certificates
[ 11.459835] Loaded X.509 cert 'Cisco Meraki: Auto-generated kernel signing key: ae79d3fd82174a22f48490d071fc4256edf3f047'
[ 11.462595] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[ 11.471786] qcom_wdt b017000.watchdog: boot reason:0
[ 11.478586] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[ 11.484147] ubi0: attaching mtd16
[ 11.727828] random: nonblocking pool is initialized
[ 12.842612] ubi0: scanning is finished
[ 12.854369] ubi0: attached mtd16 (name "ubi", size 237 MiB)
[ 12.854403] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 12.858751] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 12.866124] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 12.872586] ubi0: good PEBs: 1900, bad PEBs: 0, corrupted PEBs: 0
[ 12.879323] ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
[ 12.885590] ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 792484089
[ 12.892708] ubi0: available PEBs: 1073, total reserved PEBs: 827, PEBs reserved for bad PEB handling: 40
[ 12.901655] ubi0: background thread "ubi_bgt0d" started, PID 946
[ 12.945830] hctosys: unable to open rtc device (rtc0)
[ 12.956567] clk: Not disabling unused clocks
[ 12.956696] devtmpfs: mounted
[ 12.960250] Freeing unused kernel memory: 208K
[ 12.962873] Freeing alternatives memory: 32K
[ 13.386371] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 1164
[ 13.424774] UBIFS (ubi0:1): recovery needed
[ 13.542493] UBIFS (ubi0:1): recovery completed
[ 13.542603] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "storage"
[ 13.545866] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 13.553425] UBIFS (ubi0:1): FS size: 15618048 bytes (14 MiB, 123 LEBs), journal size 1015809 bytes (0 MiB, 6 LEBs)
[ 13.563292] UBIFS (ubi0:1): reserved for root: 737678 bytes (720 KiB)
[ 13.573532] UBIFS (ubi0:1): media format: w4/r0 (latest is w4/r0), UUID 97CCFEF3-6981-41E1-8232-7F0D31D9FC68, small LPT model
[ 13.829716] storage-recovery: /storage mounted RW
WARNING! THIS CONSOLE IS LOGGED! UNAUTHORIZED ACCESS FORBIDDEN!
<Meraki> [ 14.268147] Ignoring manufacturing reset button check: Not in RMA or MFG mode
[ 14.565601] Creating CNSS cal data /lib/firmware/IPQ6018/caldata.bin
[ 14.568585] Creating CNSS cal data /wifi1.caldata
[ 14.863789] Sat Jan 1 00:00:00 GMT 2000
[ 14.902066] cat: can't open '/storage/vm_config': No such file or directory
[ 15.114397] Quick boot reason lookup:
[ 15.117743] No valid safe config available or fallback disabled, remove unsafe config
[ 15.128938] ip_local_port_range: prefer different parity for start/end values.
[ 15.129635] sysctl: error: 'kernel.hung_task_panic' is an unknown key
[ 15.135402] sysctl: error: 'vm.extfrag_threshold' is an unknown key
[ 15.141617] Unsafe core_pattern used with suid_dumpable=2. Pipe handler or fully qualified core dump path required.
[ 15.169875] sysctl: error reading key 'net.ipv6.conf.all.stable_secret': I/O error
[ 15.171912] sysctl: error reading key 'net.ipv6.conf.default.stable_secret': I/O error
[ 15.172062] net.ipv6.conf.all.accept_ra = 0
[ 15.186212] sysctl: error reading key 'net.ipv6.conf.lo.stable_secret': I/O error
[ 15.189462] ICMPv6: process `sysctl' is using deprecated sysctl (syscall) net.ipv6.neigh.default.base_reachable_time - use net.ipv6.neigh.default.base_reachable_time_ms instead
[ 15.199258] nr_pdflush_threads exported in /proc is scheduled for removal
[ 15.214878] net.ipv6.conf.default.accept_ra = 0
[ 15.220467] net.ipv6.conf.lo.accept_ra = 0
[ 15.244495] sysctl: error reading key 'net.ipv6.conf.all.stable_secret': I/O error
[ 15.246464] sysctl: error reading key 'net.ipv6.conf.default.stable_secret': I/O error
[ 15.246667] net.ipv6.conf.all.dad_transmits = 0
[ 15.260781] sysctl: error reading key 'net.ipv6.conf.lo.stable_secret': I/O error
[ 15.270327] net.ipv6.conf.default.dad_transmits = 0
[ 15.273168] net.ipv6.conf.lo.dad_transmits = 0
[ 15.296843] sysctl: error reading key 'net.ipv6.conf.all.stable_secret': I/O error
[ 15.298803] sysctl: error reading key 'net.ipv6.conf.default.stable_secret': I/O error
[ 15.298898] net.ipv6.conf.all.accept_dad = 0
[ 15.313194] sysctl: error reading key 'net.ipv6.conf.lo.stable_secret': I/O error
[ 15.322725] net.ipv6.conf.default.accept_dad = 0
[ 15.344610] sysctl: error reading key 'net.ipv6.conf.all.stable_secret': I/O error
[ 15.346512] sysctl: error reading key 'net.ipv6.conf.default.stable_secret': I/O error
[ 15.352968] sysctl: error reading key 'net.ipv6.conf.lo.stable_secret': I/O error
[ 15.363132] net.ipv6.neigh.default.base_reachable_time_ms = 70000
[ 15.368770] net.ipv6.neigh.lo.base_reachable_time_ms = 70000
[ 15.376050] cat: can't open '/LINUX_KFOM_VERSION': No such file or directory
[ 15.657883] DFU file size:15768
[ 15.657912] Syncing.application boot failed
[ 17.660945] .DFU OK
Bootloader version: 0x10a0004
[ 17.661146] not upgrading bootloader: 0x010a0004 => 0x010a0004
[ 17.692718] killall: ble_dfu: no process killed
[ 17.754397] qca_ssdk: loading out-of-tree module taints kernel.
[ 17.766593] ssdk_switch_device_num_init[1159]:INFO:ess-switch dts node number: 1
[ 17.766707] ssdk_dt_get_switch_node[970]:INFO:ess-switch DT exist!
[ 17.773137] ssdk_dt_parse_access_mode[856]:INFO:switch_access_mode: local bus
[ 17.779043] ssdk_dt_parse_access_mode[869]:INFO:switchreg_base_addr: 0x3a000000
[ 17.786283] ssdk_dt_parse_access_mode[870]:INFO:switchreg_size: 0x1000000
[ 17.793397] ssdk_dt_parse_mac_mode[295]:INFO:mac mode = 0x0
[ 17.800309] ssdk_dt_parse_mac_mode[304]:INFO:mac mode1 = 0xff
[ 17.805715] ssdk_dt_parse_mac_mode[313]:INFO:mac mode2 = 0xff
[ 17.811655] ssdk_dt_parse_uniphy[332]:INFO:ess-uniphy DT exist!
[ 17.817774] ssdk_plat_init start
[ 17.904664] ssdk_gcc_clock_init[1046]:INFO:SSDK gcc clock init successfully!
[ 17.905091] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[ 17.905381] HPPE initializing...
[ 17.905585] ssdk_phy_driver_init[338]:INFO:dev_id = 0, phy_adress = 5, phy_id = 0x6820805 phytype doesn't match
[ 17.905592] malibu_phy_api_ops_init[2849]:INFO:qca probe malibu phy driver succeeded!
[ 17.909084] regi_init[3541]:INFO:Initializing HPPE!!
[ 18.122270] ssdk_ppe_reset_init[1278]:INFO:ppe reset successfully!
[ 18.125473] qca_hppe_tdm_hw_init[674]:INFO:tdm setup num=96
[ 18.127610] qca_hppe_portctrl_hw_init[102]:INFO:Cypress PPE port initializing
[ 18.242702] __adpt_hppe_uniphy_psgmii_mode_set[658]:INFO:uniphy 0 psgmii channel selection
[ 18.457511] ssdk_switch_register[1703]:INFO:Chip version 0x1501
[ 18.457545] qca_link_polling_select[1308]:INFO:link-polling-required node does not exist
[ 18.462230] ssdk_switch_register[1729]:INFO:polling is selected
[ 18.470574] regi_init[3545]:INFO:Initializing HPPE Done!!
[ 18.476294] regi_init[3605]:INFO:qca-ssdk module init succeeded!
[ 18.490414]
[ 18.490698] SSDK Init OK!
[ 18.490698] operation done.
[ 18.490698]
[ 18.493126]
[ 18.497918] SSDK Init OK!
[ 18.497918] operation done.
[ 18.497918]
[ 18.501510]
[ 18.506340] SSDK Init OK!
[ 18.506340] operation done.
[ 18.506340]
[ 18.509913]
[ 18.514749] SSDK Init OK!
[ 18.514749] operation done.
[ 18.514749]
[ 18.518374]
[ 18.523219] SSDK Init OK!
[ 18.523219] operation done.
[ 18.523219]
[ 18.526805]
[ 18.531545] SSDK Init OK!
[ 18.531545] operation done.
[ 18.531545]
[ 18.550712] EDMA ver 1 hw init
[ 18.550971] EDMA HW Reset completed succesfully
[ 18.552761] Num rings - TxDesc:1 (23-23) TxCmpl:1 (23-23)
[ 18.557085] RxDesc:1 (15-15) RxFill:1 (7-7)
[ 18.563331] GMAC2(ffffffc0395d5b80) Invalid MAC@ - using c2:6c:43:1d:a3:5f
[ 18.566997] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[ 18.567937] GMAC3(ffffffc0395d7b00) Invalid MAC@ - using f6:01:28:3e:26:5e
[ 18.569217] GMAC4(ffffffc0395f9c80) Invalid MAC@ - using a2:98:e1:11:31:ae
[ 18.570575] GMAC5(ffffffc0395fbc00) Invalid MAC@ - using f6:ad:63:46:57:be
[ 18.571891] **********************************************************
[ 18.571893] * NSS Data Plane driver
[ 18.571895] **********************************************************
[ 18.611754] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[ 18.711353] nss_driver - fw of size 758688 bytes copied to load addr: 40000000, nss_id : 0
[ 18.713730] Supported Frequencies -
[ 18.718501] 187.2 MHz 748.8 MHz
[ 18.724578] 1.4976 GHz [ 18.725442]
[ 18.727827] ffffffbffc2c5f80: set sdma ffffffc0390f0b00
[ 18.729410] node size 2 # items 4
[ 18.734230] memory: 40000000 1072693248 (avl 1108852736) items 4 active_cores 1
[ 18.737697] addr/size storage words 2 2 # words 4 in DTS, ddr size 1000000
[ 18.744825] ffffffbffc2c5f80: NSS core 0 DDR from 40000000 to 41000000
[ 18.751881] ffffffbffc2c5f80: meminfo init succeed
[ 18.764239] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 4
[ 18.791034] nss-dp 3a001400.dp2 lan3: renamed from eth1
[ 18.798062] node size 2 # items 4
[ 18.798088] memory: 40000000 1072693248 (avl 1108852736) items 4 active_cores 1
[ 18.800360] addr/size storage words 2 2 # words 4 in DTS, ddr size 1000000
[ 18.807488] ffffffbffc2c5f80: nss core 0 booted successfully
[ 19.050085] IPv6: ADDRCONF(NETDEV_UP): lan3: link is not ready
[ 19.051284] nss-dp 3a001600.dp3 lan2: renamed from eth2
[ 19.289710] IPv6: ADDRCONF(NETDEV_UP): lan2: link is not ready
[ 19.290819] nss-dp 3a001800.dp4 lan1: renamed from eth3
[ 19.549650] IPv6: ADDRCONF(NETDEV_UP): lan1: link is not ready
[ 19.551301] dev.nss.n2hcfg.n2h_queue_limit_core0 = 2048
[ 19.555438] nss-dp 3a001200.dp1 wired0: renamed from eth0
[ 19.810116] IPv6: ADDRCONF(NETDEV_UP): wired0: link is not ready
[ 19.811194] wired1: renamed from dummy0
[ 20.313503] vm.panic_on_oom = 2
[ 20.313856] [2000-01-01 00:00:05.450] +sysctl -w vm.panic_on_oom=2
[ 20.376534] ntdp: module license 'Copyright (c) 2014-2019 by cisco Systems, Inc.' taints kernel.
[ 20.376572] Disabling lock debugging due to kernel taint
[ 20.395910] stile module dp init successfully
[ 20.395941] NBAR Label:BLD_POLARIS_DEV_LATEST_20190912_001934 Module timestamp: Dec 28 2021 at 00:48:03 User: ttaichol
[ 20.651293] click: starting router thread pid 1533 (ffffffc0393b3400)
[ 21.304920] Single synchronous check for reset
[ 21.402323] <NSS-CRYPTO>:module loaded Build_ID - 12/28/21, 00:47:03 SoC=ipq60xx_64
[ 21.483432]
[ 21.487511] boot 8 build 28-202112280020-G3fae9e04-L2220d220-jenkins-rel-expert board hatchet mac E4:55:A8:57:01:EB
[ 21.493466] Module: qca_ssdk .text=0xffffffbffc000000 .data=0xffffffbffc0ac8c8 .bss=0xffffffbffc0bf580
[ 21.493466] Module: qca_nss_dp .text=0xffffffbffc168000 .data=0xffffffbffc1714a0 .bss=0xffffffbffc172c00
[ 21.493466] Module: qca_nss_drv .text=0xffffffbffc182000 .data=0xffffffbffc29e378 .bss=0xffffffbffc2c5880
I don't see option to interrupt boot loader.
don't think this is good news...
perhaps @Leo-PL and @sparticle can chip in ...
We need U-boot sources. I don't think that there is any variant of IPQ60xx device from Meraki that would have a bypass like IPQ40xx stuff.
is there a way to extract it from device? or only Meraki support can help?
only they have the source code, unless someone already requested it, and published it once received.
Btw isn't it the same as here: MR36 bootloader uboot source code
only way to find out is to rewrite the boot loader, and hope the device comes back up afterwards.
or wait for Meraki to deliver the source code/read the code of the 36.
or compare the stock bootloaders of the 36H and the 36.
I have 4 devices that are useless at this moment. I received them for free so I can brick one or two with no regret or send to someone as a test devices How can I try to rewrite mr36 bootloader to MR36H?
if you can't get access to the OS or boot loader, by rewriting the flash.