OpenWrt support for Meraki MR46

Hi,

What do you think is the chance of running OpenWRT on the MR46 ?

Wifi Chip: QCN5124
CPU: ?

FCC:

Currently, no Qualcomm AX radios are supported by the Openwrt (via the Linux kernel), WIP.

2 Likes

Thanks Frolic,

They actually write about it in this thread.

I wonder if you can find somewhere on the Internet what CPU is used on the MR46.

Orginal bootlog from device


Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00147
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B -       201 - PBL, Start
B -      2735 - bootable_media_detect_entry, Start
B -      3441 - bootable_media_detect_success, Start
B -      3446 - elf_loader_entry, Start
B -      6107 - auth_hash_seg_entry, Start
B -     43696 - auth_hash_seg_exit, Start
B -    105765 - elf_segs_hash_verify_entry, Start
B -    168462 - PBL, End
B -    179706 - SBL1, Start
B -    231586 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B -    238052 - pm_device_init, Start
B -    359107 - PM_SET_VAL:Skip
D -    120444 - pm_device_init, Delta
B -    361364 - pm_driver_init, Start
D -      5337 - pm_driver_init, Delta
B -    367860 - clock_init, Start
D -      2104 - clock_init, Delta
B -    371886 - boot_flash_init, Start
D -     12566 - boot_flash_init, Delta
B -    388204 - boot_config_data_table_init, Start
D -      3111 - boot_config_data_table_init, Delta - (575 Bytes)
B -    395707 - Boot Setting :  0x00000e18
B -    399611 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:6
B -    406534 - sbl1_ddr_set_params, Start
B -    410347 - CPR configuration: 0x30c
B -    413702 - cpr_init, Start
B -    416599 - Rail:0 Mode: 5 Voltage: 792000
B -    421693 - CL CPR settled at 744000mV
B -    424529 - Rail:1 Mode: 5 Voltage: 880000
B -    428799 - Rail:1 Mode: 7 Voltage: 888000
D -     16531 - cpr_init, Delta
B -    435601 - Pre_DDR_clock_init, Start
B -    439688 - Pre_DDR_clock_init, End
B -    442982 - DDR Type : PCDDR4
B -    449722 - do ddr sanity test, Start
D -      1067 - do ddr sanity test, Delta
B -    453535 - DDR: Start of HAL DDR Boot Training
B -    458171 - DDR: End of HAL DDR Boot Training
B -    463966 - DDR: Checksum to be stored on flash is 2144543284
B -    474275 - Image Load, Start
D -    506147 - QSEE Image Loaded, Delta - (1380336 Bytes)
B -    980514 - Image Load, Start
D -        61 - SEC Image Loaded, Delta - (0 Bytes)
B -    988200 - Image Load, Start
D -    293989 - DEVCFG Image Loaded, Delta - (32404 Bytes)
B -   1282281 - Image Load, Start
D -    307928 - RPM Image Loaded, Delta - (108988 Bytes)
B -   1590300 - Image Load, Start
D -    345108 - APPSBL Image Loaded, Delta - (372432 Bytes)
B -   1935530 - QSEE Execution, Start
D -        61 - QSEE Execution, Delta
B -   1941355 - USB D+ check, Start
D -         0 - USB D+ check, Delta
B -   1947730 - SBL1, End
D -   1770342 - SBL1, Delta
S - Flash Throughput, 6678 KB/s  (1895407 Bytes,  283796 us)
S - DDR Frequency, 600 MHz
S - Core 0 Frequency, 1651 MHz




U-Boot 2018.01-RELEASE-gb0bd058b3f (Nov 25 2019 - 16:41:18 -0800)



DRAM:  2 GiB

Setting bus to 0

Valid chip addresses: 56

Meraki Product (major num): 58

NAND:  ONFI device found

256 MiB

Using default environment



In:    serial@78B3000

Out:   serial@78B3000

Err:   serial@78B3000

Device Tree: QCA, IPQ807x-HK01

machid: 8010006

ubi0: attaching mtd1

ubi0: scanning is finished

ubi0: attached mtd1 (name "mtd=0", size 237 MiB)

ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes

ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048

ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096

ubi0: good PEBs: 1900, bad PEBs: 0, corrupted PEBs: 0

ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128

ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 163441361

ubi0: available PEBs: 1170, total reserved PEBs: 730, PEBs reserved for bad PEB handling: 40
Secure boot enabled.



Read 0 bytes from volume part.safe to 50000000

No size specified -> Using max size (25915392)

Validating 18b6900 bytes @ addr 50000000

Valid image

## Loading kernel from FIT Image at 50000028 ...

   Using 'config_58' configuration

   Trying 'kernel@1' kernel subimage

     Description:  Axes Kernel

     Type:         Kernel Image

     Compression:  gzip compressed

     Data Start:   0x50000128

     Data Size:    3308517 Bytes = 3.2 MiB

     Architecture: AArch64

     OS:           Linux

     Load Address: 0x41080000

     Entry Point:  0x41080000

## Loading ramdisk from FIT Image at 50000028 ...

   Using 'config_58' configuration

   Trying 'ramdisk@1' ramdisk subimage

     Description:  Axe Ramdisk

     Type:         RAMDisk Image

     Compression:  uncompressed

     Data Start:   0x50327db8

     Data Size:    21836204 Bytes = 20.8 MiB

     Architecture: AArch64

     OS:           Linux

     Load Address: 0x45000000

     Entry Point:  unavailable

   Loading ramdisk from 0x50327db8 to 0x45000000

## Loading fdt from FIT Image at 50000028 ...

   Using 'config_58' configuration

   Trying 'fdt@3' fdt subimage

     Description:  MR46 Device Tree

     Type:         Flat Device Tree

     Compression:  uncompressed

     Data Start:   0x51823e70

     Data Size:    84107 Bytes = 82.1 KiB

     Architecture: AArch64

     Load Address: 0x43000000

   Loading fdt from 0x51823e70 to 0x43000000

   Booting using the fdt blob at 0x43000000

Any idea how enter to U-Boot ? :thinking: there is possibility? Any key doesn't work there no blowe fuse security i thinks

I would ask Cisco for the GPL sources. I seem to recall that they do actually provide them when requested.

Then I would reference how clayface added Meraki MR42/MR52 support:

in particular I would grep the hell out of MR52 uboot GPL tarball for 'xyzzy' which ubootwrite.py seems to use to get a uboot prompt. And then see if your MR46 tarball might be similar. I will point out the process requires you cracking open the device & having a USB->serial adapter as well.

Then I would be lost.

1 Like

Thanks BashfulBladder,

The device is already connected to the UART console inside there were no problems with it. I pasted the bootlog above. I will be looking to check combinations with MR33. It is comforting that the device does not burn e-fuses

Is the secure boot enabled?

Unfortunately yes, Secure boot is enabled. I don't have experience and does that mean there's no point in continuing to play with it?

No, we have some boards with secure boot enabled working fine with OpenWrt, however the default bootcmd must be replaced with a manual boot recipe to avoid calling the bootipq command which checks for the image signature

2 Likes

I find some meraki's uboot-gpl file https://archive.org/download/meraki-uboot-gpl but not for MR46 :frowning: there is easy to find CONFIG_AUTOBOOT_STOP_STR="xyzzy" bad there isn't a 46 to take a look at

The thing is that in U-boot you don't really have to have a string that stops autoboot at all, I have one switch that does exactly that meaning that there isn't really a way to stop autoboot.

One combination that may or may not work is CTRL+C