Meraki MR42 seems bricked

Hi!

I come here for help since I am stuck in my openwrt installation. I hope some of you will take time to have a look. Thank you in advance !

The device is an access point meraki mr42, I followed the instructions from the mr42 thread, from the @clayface post on this github page and from that youtube video :

Following is what i've done :

Installation via UART

  • Connect my USBtoSerial to the board (TX - RX - GND)
  • setup tftp with ip 192.168.1.250 10Mbps half duplex
  • run the ubootwrite.py script properly, it worked well up to 100% (in about 20minutes) then the image is loaded properly via tftp.

I log in as root via ssh and can see the openwrt banner. i launch the following commands :

insmod mtd-rw i_want_a_brick=1
mtd erase /dev/mtd8
nandwrite -pam /dev/mtd8 /root/mr42_u-boot.mbn

I get the expeced result

Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000

So far everything worked perfectly :slight_smile: let's continue...

I followed the optional point :

for i in diagnostic1 part.old storage part.safe ; do
ubirmvol /dev/ubi0 -N $i
done

And then.... I rebooted the meraki. I did not launch the sysupgrade command :cry:

From that moment the meraki is in bootloop. I can get this bootlog from ttyUSB0 :

U-Boot 2012.07 [local,local] (May 10 2021 - 17:19:50)
                                                     
DRAM:  235 MiB                                       
cdp: machid 4971                                     
NAND:  128 MiB                                       
Using default environment                            
                                                     
In:    serial                                        
Out:   serial                                        
Err:   serial
late_init: machid 4971
Net:   Full duplex link
Link 3 up, Phy_status = b0a0a0a                                                 
Port:3 speed 1000Mbps                                                           
eth0                                                                            
                                                                                
NAND read: device 0 offset 0x2c40000, size 0xa80000                             
 11010048 bytes read: OK                                                        
bootm 0x42000000#config@1## Booting kernel from FIT Image at 42000000 ...       
   Using 'config@1' configuration                                               
   Trying 'kernel@1' kernel subimage                                            
     Description:  Boot Kernel                                                  
     Type:         Kernel Image                                                 
     Compression:  uncompressed                                                 
     Data Start:   0x420000f8                                                   
     Data Size:    1557224 Bytes = 1.5 MiB                                      
     Architecture: ARM                                                          
     OS:           Linux                                                        
     Load Address: 0x41508000                                                   
     Entry Point:  0x41508000                                                   
     Hash algo:    sha1                                                         
     Hash value:   328ecf71d73d196ff2a213bb133b8ff77360fb7d                     
   Verifying Hash Integrity ... sha1+ OK                                        
## Loading init Ramdisk from FIT Image at 42000000 ...                          
   Using 'config@1' configuration                                               
   Trying 'ramdisk@1' ramdisk subimage                                          
     Description:  Cryptid Ramdisk                                              
     Type:         RAMDisk Image                                                
     Compression:  lzma compressed                                              
     Data Start:   0x4217c4cc                                                   
     Data Size:    405986 Bytes = 396.5 KiB                                     
     Architecture: ARM                                                          
     Hash algo:    sha1                                                         
     Hash value:   4cabd04e46feb35944457613aa1ddce95e97b12b                     
   Verifying Hash Integrity ... sha1+ OK                                        
## Flattened Device Tree from FIT Image at 42000000                             
   Using 'config@1' configuration                                               
   Trying 'fdt@1' FDT blob subimage                                             
     Description:  MR42 Device Tree                                             
     Type:         Flat Device Tree                                             
     Compression:  uncompressed                                                 
     Data Start:   0x421df79c                                                   
     Data Size:    5273 Bytes = 5.1 KiB                                         
     Architecture: ARM                                                          
     Hash algo:    sha1                                                         
     Hash value:   d08fd6b7f03bbae31703f96f4de792aaf7f82727                     
   Verifying Hash Integrity ... sha1+ OK                                        
   Loading FDT from 0x421df79c to 0x41501000                                    
   Booting using the fdt blob at 0x41501000                                     
   Loading Kernel Image ... OK                                                  
OK                                                                              
   Loading Ramdisk to 4ea9c000, end 4eaff1e2 ... OK                             
   Loading Device Tree to 4ea97000, end 4ea9b498 ... OK                         
Using machid 0x136b from environment                                            
                                                                                
Starting kernel ...                                                             
                                                                                
[    0.000000] Booting Linux on physical CPU 0                                  
[    0.000000] Linux version 3.4.113 (samrat@sf117.meraki.com) (gcc version 4.80
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5387d  
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache  
[    0.000000] Machine: Qualcomm Atheros AP160 reference board, model: Meraki M)
[    0.000000] msm_reserve_memory: 0x44600000, 0x200000                         
[    0.000000] memory pool 3 (start 5fe00000 size 100000) initialized           
[    0.000000] Memory policy: ECC disabled, Data cache writealloc               
[    0.000000] smem_find(137, 80): wrong size 72                                
[    0.000000] socinfo_init: v6, id=204, ver=2.0, raw_id=2313, raw_ver=2313, hw6
[    0.000000]  accessory_chip=0 hw_plat_subtype=0                              
[    0.000000] PERCPU: Embedded 8 pages/cpu @c0b15000 s10240 r8192 d14336 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pa2
[    0.000000] Kernel command line: ubi.mtd=ubi ubi.mtd=art root=/dev/ram rw co2
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)              
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)  
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)   
[    0.000000] Memory: 49MB 438MB = 487MB total                                 
[    0.000000] Memory: 486424k/489496k available, 12264k reserved, 0K highmem   
[    0.000000] Virtual kernel memory layout:                                    
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)                
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)                
[    0.000000]     vmalloc : 0xdf000000 - 0xff000000   ( 512 MB)                
[    0.000000]     lowmem  : 0xc0000000 - 0xdea00000   ( 490 MB)                
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)                
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)                
[    0.000000]       .text : 0xc0008000 - 0xc04d3000   (4908 kB)                
[    0.000000]       .init : 0xc0500000 - 0xc0602800   (1034 kB)                
[    0.000000]       .data : 0xc0604000 - 0xc06710e0   ( 437 kB)                
[    0.000000]        .bss : 0xc0671104 - 0xc070f84c   ( 634 kB)                
[    0.000000] SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=2, 1
[    0.000000] Hierarchical RCU implementation.                                 
[    0.000000] NR_IRQS:921                                                      
[    0.000000] sched_clock: 32 bits at 32kHz, resolution 31240ns, wraps every 1s
[    0.000000] Console: colour dummy device 80x30                               
[    0.150421] Calibrating delay using timer specific routine.. 12.55 BogoMIPS )
[    0.150452] pid_max: default: 32768 minimum: 301                             
[    0.150796] Mount-cache hash table entries: 512                              
[    0.153420] CPU: Testing write buffer coherency: ok                          
[    0.153608] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000                 
[    0.153608] hw perfevents: enabled with ARMv7 Krait PMU driver, 5 counters ae
[    0.153701] Setting up static identity map for 0x41808b78 - 0x41808c00       
[    0.154295] Brought up 1 CPUs                                                
[    0.154295] SMP: Total of 1 processors activated (12.55 BogoMIPS).           
[    0.155263] devtmpfs: initialized                                            
[    0.169103] dummy:                                                           
[    0.169540] NET: Registered protocol family 16                               
[    0.170228] AXI: msm_bus_fabric_init_driver(): msm_bus_fabric_init_driver    
[    0.172383] meminfo_init: smem ram ptable found: ver: 0 len: 5               
[    0.172414] Found 1 memory banks grouped into 8 memory regions               
[    0.172664] smem_find(137, 80): wrong size 72                                
[    0.172664] socinfo_init: v6, id=204, ver=2.0, raw_id=2313, raw_ver=2313, hw6
[    0.172696]  accessory_chip=0 hw_plat_subtype=0                              
[    0.172727] msm_rpm_init: RPM firmware 3.0.16777342                          
[    0.179162] clk_tbl_nss - loaded                                             
[    0.205342] gpiochip_add: registered GPIOs 0 to 151 on device: msmgpio       
[    0.206872] No ATAGs?                                                        
[    0.206904] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint.
[    0.206904] hw-breakpoint: maximum watchpoint size is 8 bytes.               
[    0.207247] msm_dmov_memcpy_init: Success                                    
[    0.214807] sps:BAM 0x12244000 enabled: ver:0x5, number of pipes:20          
[    0.214839] sps:BAM 0x12244000 is registered.                                
[    0.215057] sps:sps is ready.                                                
[    0.230677] bio: create slab <bio-0> at 0                                    
[    0.235270] i2c-gpio 1.i2c: using pins 24 (SDA) and 25 (SCL)                 
[    0.235301] i2c-gpio 1.i2c: sending recovery sequence                        
[    0.236238] i2c-gpio 2.i2c: using pins 29 (SDA) and 30 (SCL)                 
[    0.237613] Switching to clocksource gp_timer                                
[    0.259044] NET: Registered protocol family 2                                
[    0.267135] IP route cache hash table entries: 4096 (order: 2, 16384 bytes)  
[    0.267510] TCP established hash table entries: 16384 (order: 5, 131072 byte)
[    0.267728] TCP bind hash table entries: 16384 (order: 5, 131072 bytes)      
[    0.267916] TCP: Hash tables configured (established 16384 bind 16384)       
[    0.267916] TCP: reno registered                                             
[    0.267947] UDP hash table entries: 256 (order: 1, 8192 bytes)               
[    0.267978] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)          
[    0.268259] NET: Registered protocol family 1                                
[    0.268509] Unpacking initramfs...                                           
[    0.507528] Freeing initrd memory: 396K                                      
[    0.515370] Detected 5 counters on the L2CC PMU.                             
[    0.523398] smd: register irq failed on wcnss_a11                            
[    0.523398] smd: deregistering IRQs                                          
[    0.523461] SMD: smd_core_platform_init() failed                             
[    0.525616] smem_find(427, 88): wrong size 24                                
[    0.525616] smem_find(427, 96): wrong size 24                                
[    0.525648] get_bootconfig_partition: no dual boot v2 info in shared memory  
[    0.690315] acpuclk-ipq806x acpuclk-ipq806x: SPEED BIN: 0                    
[    0.690315] acpuclk-ipq806x acpuclk-ipq806x: ACPU PVS: 1                     
[    0.694470] acpuclk-ipq806x acpuclk-ipq806x: CPU0: 6 frequencies supported   
[    0.694501] acpuclk-ipq806x acpuclk-ipq806x: CPU1: 6 frequencies supported   
[    0.705498] msm_rpm_log_probe: OK                                            
[    0.899406] msgmni has been set to 950                                       
[    0.908747] NET: Registered protocol family 38                               
[    0.908809] io scheduler noop registered                                     
[    0.908809] io scheduler deadline registered (default)                       
[    0.909372] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled         
[    0.925335] msm_serial_hs module loaded                                      
[    0.925492] msm_serial_hsl: detected port #1                                 
[    0.925648] msm_serial_hsl.1: ttyHSL1 at MMIO 0x16340000 (irq = 184) is a MSM
[    0.926054] msm_serial_hsl: console setup on port #1                         
[    1.478725] console [ttyHSL1] enabled                                        
[    1.487472] msm_serial_hsl: detected port #0                                 
[    1.490877] msm_serial_hsl.0: ttyHSL0 at MMIO 0x12450000 (irq = 225) is a MSM
[    1.503030] msm_serial_hsl: driver initialized                               
[    1.506591] at24 1-0056: 8192 byte 24c64 EEPROM, writable, 32 bytes/write    
[    1.530709] msm_nand_probe: phys addr 0x1ac00000                             
[    1.534364] msm_nand_probe: dmac 0x3                                         
[    1.538019] msm_nand_probe: allocated dma buffer at ffdfe000, dma_addr 5f8ba0
[    1.550952] status: 20                                                       
[    1.552264] nandid: 1580a101 maker 01 device a1                              
[    1.556794] ONFI probe : Found an ONFI compliant device S34MS01G2           
[    1.564073] Found a supported NAND device                                    
[    1.567947] NAND Controller ID : 0x4030                                      
[    1.571727] NAND Device ID  : 0x1580a101                                     
[    1.575632] Buswidth : 8 Bits                                                
[    1.578662] Density  : 128 MByte                                             
[    1.581786] Pagesize : 2048 Bytes                                            
[    1.585098] Erasesize: 131072 Bytes                                          
[    1.588597] Oobsize  : 64 Bytes                                              
[    1.591690] CFG0 Init  : 0xa8d408c0                                          
[    1.595157] CFG1 Init  : 0x0004745c                                          
[    1.598656] ECCBUFCFG  : 0x00000203                                          
[    1.602249] 15 ofpart partitions found on MTD device msm_nand                
[    1.607872] Creating 15 MTD partitions on "msm_nand":                        
[    1.612870] 0x000000040000-0x000000180000 : "mibib"                          
[    1.628741] 0x000000000000-0x000000040000 : "sbl1"                           
[    1.647172] 0x000000180000-0x0000002c0000 : "sbl2"                           
[    1.666104] 0x0000002c0000-0x000000540000 : "sbl3"                           
[    1.685785] 0x000000540000-0x000000660000 : "ddrconfig"                      
[    1.705060] 0x000000660000-0x000000780000 : "ssd"                            
[    1.723773] 0x000000780000-0x000000a00000 : "tz"                             
[    1.743392] 0x000000a00000-0x000000c80000 : "rpm"                            
[    1.763230] 0x000001fc0000-0x000002140000 : "u-boot"                         
[    1.782630] 0x0000021c0000-0x000002c40000 : "bootkernel1"                    
[    1.811402] 0x000002c40000-0x0000036c0000 : "bootkernel2"                    
[    1.840081] 0x0000036c0000-0x000007d80000 : "ubi"                            
[    1.930677] 0x000007d80000-0x000007f80000 : "art"                            
[    1.950078] 0x000007f80000-0x000007fc0000 : "panic"                          
[    1.968509] 0x000000000000-0x000008000000 : "all"                            
[    2.133552] UBI: attaching mtd11 to ubi0                                     
[    2.136457] UBI: physical eraseblock size:   131072 bytes (128 KiB)          
[    2.142767] UBI: logical eraseblock size:    126976 bytes                    
[    2.148141] UBI: smallest flash I/O unit:    2048                            
[    2.152764] UBI: VID header offset:          2048 (aligned 2048)             
[    2.158825] UBI: data offset:                4096                            
[    2.628459] UBI: max. sequence number:       1250521                         
[    2.642330] UBI: attached mtd11 to ubi0                                      
[    2.645110] UBI: MTD device name:            "ubi"                           
[    2.649953] UBI: MTD device size:            70 MiB                          
[    2.654764] UBI: number of good PEBs:        566                             
[    2.659387] UBI: number of bad PEBs:         0                               
[    2.663792] UBI: number of corrupted PEBs:   0                               
[    2.668259] UBI: max. allowed volumes:       128                             
[    2.672820] UBI: wear-leveling threshold:    4096                            
[    2.677507] UBI: number of internal volumes: 1                               
[    2.681943] UBI: number of user volumes:     0                               
[    2.686348] UBI: available PEBs:             557                             
[    2.690971] UBI: total number of reserved PEBs: 9                            
[    2.695626] UBI: number of PEBs reserved for bad PEB handling: 5             
[    2.701655] UBI: max/mean erase counter: 3355/2215                           
[    2.706404] UBI: image sequence number:  1279175790                          
[    2.711340] UBI: background thread "ubi_bgt0d" started, PID 782              
[    2.718931] UBI: attaching mtd12 to ubi1                                     
[    2.721805] UBI: physical eraseblock size:   131072 bytes (128 KiB)          
[    2.728116] UBI: logical eraseblock size:    126976 bytes                    
[    2.733458] UBI: smallest flash I/O unit:    2048                            
[    2.738175] UBI: VID header offset:          2048 (aligned 2048)             
[    2.744111] UBI: data offset:                4096                            
[    2.761324] UBI: max. sequence number:       3                               
[    2.777257] UBI: attached mtd12 to ubi1                                      
[    2.780131] UBI: MTD device name:            "art"                           
[    2.784848] UBI: MTD device size:            2 MiB                           
[    2.789628] UBI: number of good PEBs:        16                              
[    2.794126] UBI: number of bad PEBs:         0                               
[    2.798562] UBI: number of corrupted PEBs:   0                               
[    2.802967] UBI: max. allowed volumes:       128                             
[    2.807560] UBI: wear-leveling threshold:    4096                            
[    2.812277] UBI: number of internal volumes: 1                               
[    2.816682] UBI: number of user volumes:     1                               
[    2.821149] UBI: available PEBs:             0                               
[    2.825554] UBI: total number of reserved PEBs: 16                           
[    2.830334] UBI: number of PEBs reserved for bad PEB handling: 2             
[    2.836301] UBI: max/mean erase counter: 2/1                                 
[    2.840581] UBI: image sequence number:  1631089732                          
[    2.845517] UBI: background thread "ubi_bgt1d" started, PID 787              
[    2.862824] bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[    2.981693] i2c /dev entries driver                                          
[    2.994564] restart_reason wdt:0 r:311742036                                 
[    3.004967] cpuidle: using governor ladder                                   
[    3.008091] cpuidle: using governor menu                                     
[    3.031427] meraki-config board-data.6: Meraki config device loaded          
[    3.041549] TCP: bic registered                                              
[    3.043642] TCP: cubic registered                                            
[    3.046954] TCP: westwood registered                                         
[    3.050609] TCP: htcp registered                                             
[    3.053733] NET: Registered protocol family 17                               
[    3.058231] 8021q: 802.1Q VLAN Support v1.8                                  
[    3.062417] VFP support v0.3: implementor 51 architecture 64 part 4d variant0
[    3.070103] Registering SWP/SWPB emulation handler                           
[    3.074820] clock_late_init: Removing enables held for handed-off clocks     
[    3.092033] ipq_nss_get_mac_addr: MAC[0]: ff:ff:ff:ff:ff:ff                  
[    3.098625] ipq_nss_get_mac_addr: MAC[1]: ff:ff:ff:ff:ff:ff                  
[    3.103436] ipq_nss_get_mac_addr: MAC[2]: ff:ff:ff:ff:ff:ff                  
[    3.109028] ipq_nss_get_mac_addr: MAC[3]: ff:ff:ff:ff:ff:ff                  
[    3.114464] no pmic restart interrupt specified                              
[    3.124867] devtmpfs�[    3.127460] Freeing init memory: 1032K               
mount: mounting none on /dev failed: Device or resource busy                    
mount: mounting /dev/ubivol/storage on /storage failed: Invalid argument        
                                                                                
Bootkernel Meraki Build is 25-202011091102-G3b808583-samrat-paper               
Board is MR42                                                                   
grep: /storage/config: No such file or directory                                
Booting part.safe                                                               
                                                                                
Cannot open `/dev/ubivol/part.safe': No such file or directory                  
Booting part.old                                                                
                                                                                
Cannot open `/dev/ubivol/part.old': No such file or directory                   
[    3.257700] mkp_lg: Attempted to kill init! exitcode=0x00000100              
[    3.257700]                                                                  
[    3.264042] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00
[    3.264042]   

I'm stuck at this point I cannot interract with the meraki. The ubootwrite.py script fails and also the tftp upload.

user@pc:~/openwrt-cryptid$ sudo python3 ubootwrite.py --write=mr42_u-boot.bin
Waiting for device...
Traceback (most recent call last):
  File "ubootwrite.py", line 223, in <module>
    main()
  File "ubootwrite.py", line 218, in main
    upload(ser, options.write, int(options.size, 0), int(options.addr, 0), options.verbose, debug, options.shell)
  File "ubootwrite.py", line 171, in upload
    ret = memwrite(ser, path, size, start_addr, verbose, debug, shell)
  File "ubootwrite.py", line 94, in memwrite
    prompt = getprompt(ser, start_addr, verbose, shell)
  File "ubootwrite.py", line 60, in getprompt
    buf = ser.read(256)
  File "/home/user/.local/lib/python3.6/site-packages/serial/serialposix.py", line 596, in read
    'device reports readiness to read but returned no data '
serial.serialutil.SerialException: device reports readiness to read but returned no data (device disconnected or multiple access on port?)

What can I do to retry an fresh install? Is it dead?
Thanks you all

Benoit

Since your boot loader seems intact, tried booting the initramfs from uboot ?

(can it be interrupted?)

1 Like

Hi frollic, thank you for your help.

I tried to interrupt boot sequence by sending endlessly some char via UART ("enter" , "escape" and "xyzzy") with my keyboard and also with a modified version of ubootwrite.py. (extract below)

LINE_FEED = "\n"
ESCAPE_FEED = "\x1b\r"

# Wait for the prompt
def getprompt(ser, addr, verbose, shell):
	if not shell:
		while True:
			ser.write(str.encode("xyzzy"));
			ser.write(str.encode(LINE_FEED));
			ser.write(str.encode(ESCAPE_FEED));

I can see the result via minicom :

...
...
...
xyzzgrep: /storage/config: No such file or directory                            
Booting part.safe                                                               
                                                                                
y                                                                               
^[                                                                              
xyzzy                                                                           
^[                                                                              
xyzzy                                                                           
^[                                                                              
xyzzy                                                                           
^[                                                                              
xyzzy                                                                           
^[                                                                              
xyzzy                                                                           
^[                                                                              
xyzzCannot open `/dev/ubivol/part.safe': No such file or directory              
Booting part.old                                                                
                                                                                
Cannot open `/dev/ubivol/part.old': No such file or directory                   
[    3.337769] mkp_lg: Attempted to kill init! exitcode=0x00000100              
[    3.337800]                                                                  
[    3.344142] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00
[    3.344142]         

I guess the commands are sent properly but no way to interrupt the boot sequence. Is there a better way to do it?

Is there something else I can try?

Thank you

Hi again. I'm still stuck on this problem. Any idea?