I asked Meraki about the U-Boot source code. It's available there: https://0x0.st/iwNP.bz2
It seems the stop str is still "xyzzy", but I didn't manage to go further than that.
2 Likes
Is this usable in a release state?
1 Like
Any updates on the MR42? I have recently come across a large number of them and I would be very interested in getting openwrt installed on them, to the point where I would consider supplying a unit to some able body.
I also am interested. I have a few also from a dead company. I like to help with this project
what are the serial parms? I can only get garbage on putty trying common speeds and data and parity
so the baudrate was 115200
and xyzzy during the boot got a pound prompt
will the mr33 binaries work on the 42's ?
I'd like to help too, just got one some days ago, and hardware-wise seems promising, way better than what I'd get on a general electronics shop, and if we can get it run I could do a comparative test between mr42 and mr33 (which is my current ap of my home)
No, while the MR33 is IPQ4029 based (e.g. OpenWrt target ipq40xx) the MR42 is IPQ8068 based (e.g. OpenWrt target ipq806x).
Seeking OpenWrt Gurus!
Judging from this thread there seems to be quite a lot of interest around getting OpenWrt running on the MR42. I have a pretty solid engineering background and want to help out and learn more on how to do this. I have access to basic stuff like soldering equipment and serial-port dongles etc. If someone could offer some mentor-ship I will put the hours in!
PM me please!
I also volunteer to help. I have a decent workbench. I have added a header and can get to root on my test ME42. I have 12 or so to convert once there is a solution.
Steve
2 Likes
Now we have U-Boot source code. https://0x0.st/iwNP.bz2
Can we compile openwrt compatibile u-boot from this? This device does not have the brick that we see on MR33. So far we still can intrerupt boot with "xyzzy".
Also, it looks like there is a firmware recovery procedure that works on MR42 too.
Quote from here:
There's a reset button between the ethernet ports. Hold the reset button down, during boot, until the led starts blinking white. At this stage clicking the button will toggle the led, blue or red. Once "selected", just wait and it'll continue booting. Blue is for the "recovery/diagnostic" firmware and red is the Meraki one.
What do i have on my MR42 ?
BusyBox v1.19.4 (2015-07-29 13:30:55 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
--------------------------------------------
IPQ806X.LN.1.3.4-CSu2(r00057.1), r37758
RNAQ-MR1 v0.3.a Release
Linux 3.4.103 on ARMv7
--------------------------------------------
root@OpenWrt:/#
There is static IP assigned to it: 192.168.1.1. Telnet works without any UART.
root@OpenWrt:/# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan
root@OpenWrt:/# uname -a
Linux OpenWrt 3.4.103 #22 SMP PREEMPT Mon Sep 21 12:54:05 CST 2015 armv7l GNU/Linux
root@OpenWrt:/# df -h
Filesystem Size Used Available Use% Mounted on
tmpfs 120.1M 80.0K 120.0M 0% /tmp
tmpfs 512.0K 0 512.0K 0% /dev
root@OpenWrt:/# free -m
total used free shared buffers
Mem: 245908 126224 119684 0 0
-/+ buffers: 126224 119684
Swap: 0 0 0
root@OpenWrt:/# ifconfig
br-lan Link encap:Ethernet HWaddr 1E:0D:6C:E5:68:ED
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::1c0d:6cff:fee5:68ed/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6779 errors:0 dropped:9 overruns:0 frame:0
TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:742162 (724.7 KiB) TX bytes:1392 (1.3 KiB)
eth0 Link encap:Ethernet HWaddr 1E:0D:6C:E5:68:ED
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6802 errors:0 dropped:18 overruns:0 frame:0
TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:847262 (827.4 KiB) TX bytes:1400 (1.3 KiB)
Interrupt:5
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
root@OpenWrt:/#
1 Like
^ 
does this mean you have gotten openwrt installed and running? 
No. Looks like that recovery mode is actually a fork of openwrt, some older version.
What i really don't know if we can have fully openwrt installed from here.
Hi
I also managed to get a hold on an MR42; is there any way to help in order to try to install OpenWRT on this ?
Hello,
Has anynody managed to flash OpenWRT on MR42?
I have two devices available for testing.
I played with its U-Boot but that does not allow any Ethernet access. Then I played a little bit with its recovery OpenWrt but it does not allow any useful flash access. So my next step is trying to get an Ethernet enabled custom U-Boot going...
It's very typical for Meraki to disable network entirely to prevent people from easily flashing 3rd party fw. I do not own this device but here are some hints that I learned from the MR33 that might be able to help you on the u-boot stuff:
-
First, ask Cisco for a copy of the source, they might be willing to send you a copy even if u-boot is not GPL. Evidence: https://github.com/riptidewave93/meraki-uboot
-
Try compiling the legacy QSDK u-boot.
- This legacy QSDK u-boot is mostly what these vendors base their stuff on. https://source.codeaurora.org/quic/qsdk/oss/boot/uboot-1.0/tree/
- You might want to modify
include/configs/ipq806x_cdp.hto your liking and enable stuff if you need to, export the cross compile environment variables,make ipq806x_cdp_configthenmake, there will probably be a huge flood of warnings but it should at least compile. - Use an appropriate toolchain (idk what arch ipq806x is, check openwrt sources I suppose, try
arm-eabi), linking gcc4.9 because this is vintage code and new compilers usually just won't work: https://releases.linaro.org/components/toolchain/binaries/latest-4/ - From personal experience, this u-boot should at least run and be able to access NAND (because the Spansion flash should be ONFI compliant), network and serial, which is all we need to easily modify the flash contents.
-
Once you have a u-boot binary the MR33 instructions might be of use. Visit the Google Drive link on this readme page and download the ubootwrite tool that riptidewave93 has modified, do not use the upstream ubootwrite project (it will not emit the xyzzy magic key seq to interrupt u-boot). Try uploading the ipq806x u-boot binary you just compiled with that tool, and then with any luck, you will be able to at least dump the entire flash or boot files transferred in from TFTP.
https://github.com/riptidewave93/LEDE-MR33
Good luck 
Yep, yep. I am fully aware of all that. Thanks!
Cool, guess this would still be able to serve as a reference to others then.
1 Like