I try to change firmware on Cisco Meraki MR18 with firmware rootfs-25-201804051805-G885d6d78-dhow-rel.
I entered diagnostic mode as root and have a working network. So I can use tftp to transfer a new firmware. Maybe someone know how to properly use dd, because odm is not accessible in diagnostic mode?
Should I use Method A from https://openwrt.org/toh/meraki/mr18#flashing_method_a?
in /dev there is no rootfs file.
caldata i2c-3 mtdblock3 mtdr0 ptyp2 tty1 ttyp1
console kmem mtdblock4 null ram0 tty2 ttyp2
dk0 mem mtdblock5 nvram random ttyS0 urandom
dk1 mtd0 mtdblock6 ptmx sda ttyS1 watchdog
i2c-0 mtdblock0 mtdblock7 pts sdb ttyS2 zero
i2c-1 mtdblock1 mtdblock8 ptyp0 tty ttyUSB0
i2c-2 mtdblock2 mtdblock9 ptyp1 tty0 ttyp0
I tried it but without any effect. @YakovOnline - are You sure You have version 25.11+?
I realized that before Meraki goes to diagnostic mode it write these logs:
[ 16.804000] Mapping 8724480 bytes for /dev/mtdblock/diagnostic1
[ 16.828000] Ehdr.e_entry = 80211840 Ehdr.e_phoff = 34
[ 16.832000] Phdr.p_offset = 2000 phdr.p_vaddr=80002000 phdr.p_filesz=79a6bb phdr.p_memsz=15be330
[ 17.804000] UBIFS: un-mount UBI device 0, volume 1
[ 17.812000] Starting new kernel
[ 17.816000] Will call new kernel at 80211840
[ 17.816000] Bye ...
so, it is preparation, and next:
▒inux version 2.6.31--LSDK-188.8.131.52-ga2a05dd-dirty (email@example.com) (gcc version 4.3.3 (GCC) ) #6 Mon Nov 4 21:01:20 PST 2013
flash_size passed from bootloader = -2147434496
CPU revision is: 00019750 (MIPS 74Kc)
cpu apb ddr apb ath_sys_frequency: cpu 720 ddr 600 ahb 200
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 08000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00008000
Movable zone start PFN for each node
early_node_map active PFN ranges
0: 0x00000000 -> 0x00008000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
Kernel command line: console=ttyS0,115200 rdinit=/sbin/init mtdparts=ath-nand:130944k(meraki),128k(caldata) mem=128M
Look at the kernel command line: in mtd0 we have all 4 original partitions:
nandloader, part1, part2, ubi
because the end address of ubi is the same as meraki partition in diagnostic mode.
The original kernel command line looks like:
Kernel command line: console=ttyS0,115200 machtype=Meraki ubi.mtd=3 root=/dev/mtdblock8
The one trick could be to modify mtd and set proper address ranges of MTD blocks, but we must load kernel if we want it (or maybe someone knows how to do it without kernel reload?).
Another trick is to use the method with loading diagnostic mode - load to memory new image/kernel and do a soft reset if it is possible.
Or, copy some tools to MR18 (eg. mtd-tools) and use them.
Is it has any sense?
I received ST LINK V2, but it has not a TDI pin, so I bought Blaster. I also found the library to Arduino: https://github.com/mrjimenez/JTAG, which could also be used. Maybe someone used it and have an idea how to flash MR18 with it?