OpenWrt support for Meraki MR46

DariuszJJ · November 22, 2022, 9:07am

Hi,

What do you think is the chance of running OpenWRT on the MR46 ?

Wifi Chip: QCN5124
CPU: ?

FCC:

frollic · November 22, 2022, 9:58am

Currently, no Qualcomm AX radios are supported by the Openwrt (via the Linux kernel), WIP.

DariuszJJ · November 22, 2022, 12:16pm

Thanks Frolic,

They actually write about it in this thread.

I wonder if you can find somewhere on the Internet what CPU is used on the MR46.

dariopl · November 24, 2022, 6:27pm

Orginal bootlog from device


Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00147
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B -       201 - PBL, Start
B -      2735 - bootable_media_detect_entry, Start
B -      3441 - bootable_media_detect_success, Start
B -      3446 - elf_loader_entry, Start
B -      6107 - auth_hash_seg_entry, Start
B -     43696 - auth_hash_seg_exit, Start
B -    105765 - elf_segs_hash_verify_entry, Start
B -    168462 - PBL, End
B -    179706 - SBL1, Start
B -    231586 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B -    238052 - pm_device_init, Start
B -    359107 - PM_SET_VAL:Skip
D -    120444 - pm_device_init, Delta
B -    361364 - pm_driver_init, Start
D -      5337 - pm_driver_init, Delta
B -    367860 - clock_init, Start
D -      2104 - clock_init, Delta
B -    371886 - boot_flash_init, Start
D -     12566 - boot_flash_init, Delta
B -    388204 - boot_config_data_table_init, Start
D -      3111 - boot_config_data_table_init, Delta - (575 Bytes)
B -    395707 - Boot Setting :  0x00000e18
B -    399611 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:6
B -    406534 - sbl1_ddr_set_params, Start
B -    410347 - CPR configuration: 0x30c
B -    413702 - cpr_init, Start
B -    416599 - Rail:0 Mode: 5 Voltage: 792000
B -    421693 - CL CPR settled at 744000mV
B -    424529 - Rail:1 Mode: 5 Voltage: 880000
B -    428799 - Rail:1 Mode: 7 Voltage: 888000
D -     16531 - cpr_init, Delta
B -    435601 - Pre_DDR_clock_init, Start
B -    439688 - Pre_DDR_clock_init, End
B -    442982 - DDR Type : PCDDR4
B -    449722 - do ddr sanity test, Start
D -      1067 - do ddr sanity test, Delta
B -    453535 - DDR: Start of HAL DDR Boot Training
B -    458171 - DDR: End of HAL DDR Boot Training
B -    463966 - DDR: Checksum to be stored on flash is 2144543284
B -    474275 - Image Load, Start
D -    506147 - QSEE Image Loaded, Delta - (1380336 Bytes)
B -    980514 - Image Load, Start
D -        61 - SEC Image Loaded, Delta - (0 Bytes)
B -    988200 - Image Load, Start
D -    293989 - DEVCFG Image Loaded, Delta - (32404 Bytes)
B -   1282281 - Image Load, Start
D -    307928 - RPM Image Loaded, Delta - (108988 Bytes)
B -   1590300 - Image Load, Start
D -    345108 - APPSBL Image Loaded, Delta - (372432 Bytes)
B -   1935530 - QSEE Execution, Start
D -        61 - QSEE Execution, Delta
B -   1941355 - USB D+ check, Start
D -         0 - USB D+ check, Delta
B -   1947730 - SBL1, End
D -   1770342 - SBL1, Delta
S - Flash Throughput, 6678 KB/s  (1895407 Bytes,  283796 us)
S - DDR Frequency, 600 MHz
S - Core 0 Frequency, 1651 MHz




U-Boot 2018.01-RELEASE-gb0bd058b3f (Nov 25 2019 - 16:41:18 -0800)



DRAM:  2 GiB

Setting bus to 0

Valid chip addresses: 56

Meraki Product (major num): 58

NAND:  ONFI device found

256 MiB

Using default environment



In:    serial@78B3000

Out:   serial@78B3000

Err:   serial@78B3000

Device Tree: QCA, IPQ807x-HK01

machid: 8010006

ubi0: attaching mtd1

ubi0: scanning is finished

ubi0: attached mtd1 (name "mtd=0", size 237 MiB)

ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes

ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048

ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096

ubi0: good PEBs: 1900, bad PEBs: 0, corrupted PEBs: 0

ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128

ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 163441361

ubi0: available PEBs: 1170, total reserved PEBs: 730, PEBs reserved for bad PEB handling: 40
Secure boot enabled.



Read 0 bytes from volume part.safe to 50000000

No size specified -> Using max size (25915392)

Validating 18b6900 bytes @ addr 50000000

Valid image

## Loading kernel from FIT Image at 50000028 ...

   Using 'config_58' configuration

   Trying 'kernel@1' kernel subimage

     Description:  Axes Kernel

     Type:         Kernel Image

     Compression:  gzip compressed

     Data Start:   0x50000128

     Data Size:    3308517 Bytes = 3.2 MiB

     Architecture: AArch64

     OS:           Linux

     Load Address: 0x41080000

     Entry Point:  0x41080000

## Loading ramdisk from FIT Image at 50000028 ...

   Using 'config_58' configuration

   Trying 'ramdisk@1' ramdisk subimage

     Description:  Axe Ramdisk

     Type:         RAMDisk Image

     Compression:  uncompressed

     Data Start:   0x50327db8

     Data Size:    21836204 Bytes = 20.8 MiB

     Architecture: AArch64

     OS:           Linux

     Load Address: 0x45000000

     Entry Point:  unavailable

   Loading ramdisk from 0x50327db8 to 0x45000000

## Loading fdt from FIT Image at 50000028 ...

   Using 'config_58' configuration

   Trying 'fdt@3' fdt subimage

     Description:  MR46 Device Tree

     Type:         Flat Device Tree

     Compression:  uncompressed

     Data Start:   0x51823e70

     Data Size:    84107 Bytes = 82.1 KiB

     Architecture: AArch64

     Load Address: 0x43000000

   Loading fdt from 0x51823e70 to 0x43000000

   Booting using the fdt blob at 0x43000000

DariuszJJ · November 25, 2022, 10:15am

Any idea how enter to U-Boot ? there is possibility? Any key doesn't work there no blowe fuse security i thinks

BashfulBladder · November 26, 2022, 3:57am

I would ask Cisco for the GPL sources. I seem to recall that they do actually provide them when requested.

Then I would reference how clayface added Meraki MR42/MR52 support:

github.com/openwrt/openwrt

ipq806x: add support for Cisco Meraki MR42/MR52

committed 04:51PM - 28 Nov 21 UTC

clayface

+755 -1

The MR42 and MR52 are two similar IPQ806x based devices from the Cisco Meraki "C…ryptid" series. MR42 main features: - IPQ8068 1.4GHz - 512MB RAM - 128MB NAND - 2x QCA9992 (2.4 & 5GHz) - 1x QCA9889 (2.4 & 5GHz) - 1x AR8033 PHY - PoE/AC power MR52 main features: - IPQ8068 1.4GHz - 512MB RAM - 128MB NAND - 2x QCA9994 (2.4 & 5GHz) - 1x QCA9889 (2.4 & 5GHz) - 2x AR8033 PHYs - PoE/AC power (MR42 Only) Installation via diagnostic mode: If you can successfully complete step 1 then you can continue to install via this method without having to open the device. Otherwise please use the standard UART method. Please note that when booting via TFTP, some Ethernet devices, in particular those on laptops, will not connect in time, resulting in TFTP boot not succeeding. In this instance it is advised to connect via a switch. 1. Hold down reset at power on and keep holding, after around 10 seconds if the orange LED changes behaviour to begin flashing, proceed to release reset, then press reset two times. Ensure that the LED has turned blue. Note that flashing will occur on some devices, but it will not be possible to change the LED colour using the reset button. In this case it will still be possible to continue with this install method. 2. Set your IP to 192.168.1.250. Set up a TFTP server serving mr42_u-boot.mbn and openwrt-ipq806x-generic-meraki_mr42-initramfs-fit-uImage.itb, obtained from [1]. 3. Use telnet and connect to 192.168.1.1. Run the following commands to install u-boot. Note that all these commands are critical, an error will likely render the device unusable. Option 3.1: If you are sure you have set up the TFTP server correctly you can run this script on the device. This will download and flash the u-boot image immediately: `/etc/update_uboot.sh 192.168.1.250 mr42_u-boot.mbn` Once completed successfully, power off the device. Option 3.2: If you are unsure the TFTP server is correctly set up you can obtain the image and flash manually: 3.2.1. `cd /tmp` 3.2.2. `tftp-hpa 192.168.1.250 -m binary -c get mr42_u-boot.mbn` 3.2.3. Confirm file has downloaded correctly by comparing the md5sum: `md5sum mr42_u-boot.mbn` 3.2.4. The following are the required commands to write the image. `echo 1 > /sys/devices/platform/msm_nand/boot_layout mtd erase /dev/mtd1 nandwrite -pam /dev/mtd1 mr42_u-boot.mbn echo 0 > /sys/devices/platform/msm_nand/boot_layout` Important: You must observe the output of the `nandwrite` command. Look for the following to verify writing is occurring: `Writing data to block 0 at offset 0x0 Writing data to block 1 at offset 0x20000 Writing data to block 2 at offset 0x40000` If you do not see this then do not power off the device. Check your previous commands and that mr42_u-boot.mbn was downloaded correctly. Once you are sure the image has been written you can proceed to power off the device. 4. Hold the reset button and power on the device. This will immediately begin downloading the appropriate initramfs image and boot into it. Note: If the device does not download the initramfs, this is likely due to the interface not being brought up in time. Changing Ethernet source to a router or switch will likely resolve this. You can also try manually setting the link speed to 10Mb/s Half-Duplex. 5. Once a solid white LED is displayed on the device, continue to the UART installation method, step 6. Standard installation via UART - MR42 & MR52 1. Disassemble the device and connect a UART header. The header pinout is as follows: 1 - 3.3v 2 - TXD 3 - RXD 4 - GND Important: You should only connect TXD, RXD and GND. Connecting 3.3v may damage the device. 2. Set your IP to 192.168.1.250. Set up a TFTP server serving openwrt-ipq806x-generic-meraki_(mr42|mr52)-initramfs-fit-uImage.itb. Separately obtain the respective sysupgrade image. 3. Run the following commands, preferably from a Linux host. The mentioned files, including ubootwrite.py and u-boot images, can be obtained from [1]. `python ubootwrite.py --write=(mr42|mr52)_u-boot.bin` The default for "--serial" option is /dev/ttyUSB0. 4. Power on the device. The ubootwrite script will upload the image to the device and launch it. The second stage u-boot will in turn load the initramfs image by TFTP, provided the TFTP server is running correctly. This process will take about 13 minutes. Once a solid white LED is displayed, the image has successfully finished loading. Note: If the image does not load via TFTP, try again with the Ethernet link to 10Mb/s Half-Duplex. 5. (MR42 only) Do not connect over the network. Instead connect over the UART using minicom or similar tool. To replace u-boot with the network enabled version, please run the following commands. Note that in the provided initramfs images, the u-boot.mbn file is located in /root: If you have not used the provided initramfs, you must ensure you are using an image with "boot_layout" ECC configuration enabled in the Kernel. This will be version 5.10 or higher. If you do not do this correctly the device will be bricked. `insmod mtd-rw i_want_a_brick=1 mtd erase /dev/mtd8 nandwrite -pam /dev/mtd8 /root/mr42_u-boot.mbn` After running nandwrite, ensure you observe the following output: `Writing data to block 0 at offset 0x0 Writing data to block 1 at offset 0x20000 Writing data to block 2 at offset 0x40000` 6. (Optional) If you have no further use for the Meraki OS, you can remove all other UBI volumes on ubi0 (mtd11), including diagnostic1, part.old, storage and part.safe. You must not remove the ubi1 ART partition (mtd12). `for i in diagnostic1 part.old storage part.safe ; do ubirmvol /dev/ubi0 -N $i done` 7. Proceed to flash the sysupgrade image via luci, or else download or scp the image to /tmp and use the sysupgrade command. [1] The mentioned images and ubootwrite.py script can be found in this repo: https://github.com/clayface/openwrt-cryptid [2] The modified u-boot sources for the MR42 and MR52 are available: https://github.com/clayface/U-boot-MR52-20200629 Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>

in particular I would grep the hell out of MR52 uboot GPL tarball for 'xyzzy' which ubootwrite.py seems to use to get a uboot prompt. And then see if your MR46 tarball might be similar. I will point out the process requires you cracking open the device & having a USB->serial adapter as well.

Then I would be lost.

dariopl · November 26, 2022, 3:45pm

Thanks BashfulBladder,

The device is already connected to the UART console inside there were no problems with it. I pasted the bootlog above. I will be looking to check combinations with MR33. It is comforting that the device does not burn e-fuses

robimarko · November 26, 2022, 4:13pm

Is the secure boot enabled?

DariuszJJ · November 26, 2022, 4:30pm

Unfortunately yes, Secure boot is enabled. I don't have experience and does that mean there's no point in continuing to play with it?

robimarko · November 26, 2022, 4:34pm

No, we have some boards with secure boot enabled working fine with OpenWrt, however the default bootcmd must be replaced with a manual boot recipe to avoid calling the bootipq command which checks for the image signature

dariopl · November 26, 2022, 8:51pm

I find some meraki's uboot-gpl file https://archive.org/download/meraki-uboot-gpl but not for MR46 there is easy to find CONFIG_AUTOBOOT_STOP_STR="xyzzy" bad there isn't a 46 to take a look at

robimarko · November 26, 2022, 11:30pm

The thing is that in U-boot you don't really have to have a string that stops autoboot at all, I have one switch that does exactly that meaning that there isn't really a way to stop autoboot.

One combination that may or may not work is CTRL+C

dariopl · November 27, 2022, 11:45am

Unfortunately Ctrl+C,^C,0x3 and similar doesn't work, for now I give up and thanks for the help everyone.

Dom1n1c · March 27, 2023, 7:32pm

i got a bunch of MR36, MR46, MR56 and i am curios whether its going to be possible to fix those

I can connect using a ftdi or similar, but thats it

appleeimac · November 28, 2023, 2:01am

Bump. Any update on this?

Gurktomat · February 2, 2024, 2:38pm

Any update?

trickythings · February 3, 2024, 11:38pm

Bump. Any update?

DariuszJJ · February 4, 2024, 11:48am

Unfortunately, I haven't managed to do anything more at this point. Maybe someone else can advise

appleeimac · February 15, 2024, 8:40am

Is there e-fuse security like in the MR33?

DariuszJJ · April 1, 2024, 7:11am

Probably yes