Hi,
What do you think is the chance of running OpenWRT on the MR46 ?
Wifi Chip: QCN5124
CPU: ?
FCC:
Hi,
What do you think is the chance of running OpenWRT on the MR46 ?
Wifi Chip: QCN5124
CPU: ?
FCC:
Currently, no Qualcomm AX radios are supported by the Openwrt (via the Linux kernel), WIP.
Thanks Frolic,
They actually write about it in this thread.
I wonder if you can find somewhere on the Internet what CPU is used on the MR46.
Orginal bootlog from device
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00147
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B - 201 - PBL, Start
B - 2735 - bootable_media_detect_entry, Start
B - 3441 - bootable_media_detect_success, Start
B - 3446 - elf_loader_entry, Start
B - 6107 - auth_hash_seg_entry, Start
B - 43696 - auth_hash_seg_exit, Start
B - 105765 - elf_segs_hash_verify_entry, Start
B - 168462 - PBL, End
B - 179706 - SBL1, Start
B - 231586 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 238052 - pm_device_init, Start
B - 359107 - PM_SET_VAL:Skip
D - 120444 - pm_device_init, Delta
B - 361364 - pm_driver_init, Start
D - 5337 - pm_driver_init, Delta
B - 367860 - clock_init, Start
D - 2104 - clock_init, Delta
B - 371886 - boot_flash_init, Start
D - 12566 - boot_flash_init, Delta
B - 388204 - boot_config_data_table_init, Start
D - 3111 - boot_config_data_table_init, Delta - (575 Bytes)
B - 395707 - Boot Setting : 0x00000e18
B - 399611 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:6
B - 406534 - sbl1_ddr_set_params, Start
B - 410347 - CPR configuration: 0x30c
B - 413702 - cpr_init, Start
B - 416599 - Rail:0 Mode: 5 Voltage: 792000
B - 421693 - CL CPR settled at 744000mV
B - 424529 - Rail:1 Mode: 5 Voltage: 880000
B - 428799 - Rail:1 Mode: 7 Voltage: 888000
D - 16531 - cpr_init, Delta
B - 435601 - Pre_DDR_clock_init, Start
B - 439688 - Pre_DDR_clock_init, End
B - 442982 - DDR Type : PCDDR4
B - 449722 - do ddr sanity test, Start
D - 1067 - do ddr sanity test, Delta
B - 453535 - DDR: Start of HAL DDR Boot Training
B - 458171 - DDR: End of HAL DDR Boot Training
B - 463966 - DDR: Checksum to be stored on flash is 2144543284
B - 474275 - Image Load, Start
D - 506147 - QSEE Image Loaded, Delta - (1380336 Bytes)
B - 980514 - Image Load, Start
D - 61 - SEC Image Loaded, Delta - (0 Bytes)
B - 988200 - Image Load, Start
D - 293989 - DEVCFG Image Loaded, Delta - (32404 Bytes)
B - 1282281 - Image Load, Start
D - 307928 - RPM Image Loaded, Delta - (108988 Bytes)
B - 1590300 - Image Load, Start
D - 345108 - APPSBL Image Loaded, Delta - (372432 Bytes)
B - 1935530 - QSEE Execution, Start
D - 61 - QSEE Execution, Delta
B - 1941355 - USB D+ check, Start
D - 0 - USB D+ check, Delta
B - 1947730 - SBL1, End
D - 1770342 - SBL1, Delta
S - Flash Throughput, 6678 KB/s (1895407 Bytes, 283796 us)
S - DDR Frequency, 600 MHz
S - Core 0 Frequency, 1651 MHz
U-Boot 2018.01-RELEASE-gb0bd058b3f (Nov 25 2019 - 16:41:18 -0800)
DRAM: 2 GiB
Setting bus to 0
Valid chip addresses: 56
Meraki Product (major num): 58
NAND: ONFI device found
256 MiB
Using default environment
In: serial@78B3000
Out: serial@78B3000
Err: serial@78B3000
Device Tree: QCA, IPQ807x-HK01
machid: 8010006
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 237 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 1900, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 163441361
ubi0: available PEBs: 1170, total reserved PEBs: 730, PEBs reserved for bad PEB handling: 40
Secure boot enabled.
Read 0 bytes from volume part.safe to 50000000
No size specified -> Using max size (25915392)
Validating 18b6900 bytes @ addr 50000000
Valid image
## Loading kernel from FIT Image at 50000028 ...
Using 'config_58' configuration
Trying 'kernel@1' kernel subimage
Description: Axes Kernel
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x50000128
Data Size: 3308517 Bytes = 3.2 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x41080000
Entry Point: 0x41080000
## Loading ramdisk from FIT Image at 50000028 ...
Using 'config_58' configuration
Trying 'ramdisk@1' ramdisk subimage
Description: Axe Ramdisk
Type: RAMDisk Image
Compression: uncompressed
Data Start: 0x50327db8
Data Size: 21836204 Bytes = 20.8 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x45000000
Entry Point: unavailable
Loading ramdisk from 0x50327db8 to 0x45000000
## Loading fdt from FIT Image at 50000028 ...
Using 'config_58' configuration
Trying 'fdt@3' fdt subimage
Description: MR46 Device Tree
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x51823e70
Data Size: 84107 Bytes = 82.1 KiB
Architecture: AArch64
Load Address: 0x43000000
Loading fdt from 0x51823e70 to 0x43000000
Booting using the fdt blob at 0x43000000
Any idea how enter to U-Boot ? there is possibility? Any key doesn't work there no blowe fuse security i thinks
I would ask Cisco for the GPL sources. I seem to recall that they do actually provide them when requested.
Then I would reference how clayface added Meraki MR42/MR52 support:
in particular I would grep the hell out of MR52 uboot GPL tarball for 'xyzzy' which ubootwrite.py seems to use to get a uboot prompt. And then see if your MR46 tarball might be similar. I will point out the process requires you cracking open the device & having a USB->serial adapter as well.
Then I would be lost.
Thanks BashfulBladder,
The device is already connected to the UART console inside there were no problems with it. I pasted the bootlog above. I will be looking to check combinations with MR33. It is comforting that the device does not burn e-fuses
Is the secure boot enabled?
Unfortunately yes, Secure boot is enabled. I don't have experience and does that mean there's no point in continuing to play with it?
No, we have some boards with secure boot enabled working fine with OpenWrt, however the default bootcmd must be replaced with a manual boot recipe to avoid calling the bootipq command which checks for the image signature
I find some meraki's uboot-gpl file https://archive.org/download/meraki-uboot-gpl but not for MR46 there is easy to find
CONFIG_AUTOBOOT_STOP_STR="xyzzy"
bad there isn't a 46 to take a look at
The thing is that in U-boot you don't really have to have a string that stops autoboot at all, I have one switch that does exactly that meaning that there isn't really a way to stop autoboot.
One combination that may or may not work is CTRL+C
Unfortunately Ctrl+C,^C,0x3 and similar doesn't work, for now I give up and thanks for the help everyone.
i got a bunch of MR36, MR46, MR56 and i am curios whether its going to be possible to fix those
I can connect using a ftdi or similar, but thats it