Support for Meraki MS220-8P

iHell · November 27, 2018, 7:00am

Hey,

I stumbled upon a thread in the archive that's about getting LEDE/OpenWrt support for the Meraki MS220-8P:

They gathered some good information about the device including an tarball with the GPL licensed source code from Meraki, that is still downloadable from their page:

switch-8-10-20170825.tar.bz2

This tarball includes the Linux kernel-release 2.6.32.63. Maybe we should ask for an updated version of the GPL source code.

For me, I think it's a bit sad, that this POE switch is laying around here unused. Unfortunately, I'm not understanding the process of adopting the Meraki specific adjustments and additions to successfully build LEDE/OpenWrt.
So, I'm hoping that there are some other folks around here that are having this switch too and want to get LEDE/OpenWrt support for the device.

For now, I've managed to get access to the devices console (without any accessible commands) and dumped the SPI NOR Flash. I hoped for an 14-Pin EJTAG header besides the NOR Flash, but haven't got it working yet.

There is a 16MB NOR Flash and a 128MB NAND Flash onboard.

Macronix MB25L12805D - 16MB NOR Flash
Micron MT29F1G08ABADAWP - 128 MB NAND Flash - SLC, page size: 2048, OOB size: 64

Like the others said, it seems to heavily rely on Vitesse. Under the main cooler switches an Vitesse VSC7424XJG-02. ("btw... if we are getting support for it, can u recommend some thermal adhesive for getting that thing back on ")

Just ask, if you would like to have the dump of the SPI Nor Flash.

Bootlog

LinuxLoader built Nov 12 2014 18:01:50
init_pll ok
init_spi ok
init_memctl ok
wait_memctl ok
Training DRAM ok
init_irq ok
init_dram_uncached ok
init_icache ok
init_dcache ok
enable_caches ok
init_board ok
Low level initialization complete, exiting boot mode
[ 0.000000] Linux version 3.18.102-meraki-elemental (ssegal@sf201.meraki.com) (gcc version 5.4.0 (GCC) ) #1 Fri Apr 13 11:18:08 PDT 2018
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 02019654 (MIPS 24KEc)
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 00317000 @ 00100000 (usable)
[ 0.000000] memory: 00079000 @ 00417000 (usable after init)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 07ff0000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x07feffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x07feffff]
[ 0.000000] Initmem setup node 0 [mem 0x00000000-0x07feffff]
[ 0.000000] Reserving 0MB of memory at 0MB for crashkernel
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32496
[ 0.000000] Kernel command line: console=ttyS0,115200 mtdparts=m25p80:0x40000(loader1),0x3c0000(boot1),0x40000(loader2),0x3c0000(boot2),0x80000(rsvd),0x600000(bootubi),0x40000(conf),0x100000(stackconf),0x40000(syslog) ubi.mtd=bootub2
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Writing ErrCtl register=800004fe
[ 0.000000] Readback ErrCtl register=800004fe
[ 0.000000] Cache parity protection enabled
[ 0.000000] Memory: 125064K/131008K available (2655K kernel code, 135K rwdata, 364K rodata, 484K init, 101K bss, 5944K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:66
[ 0.000000] sched_clock: 32 bits at 1kHz, resolution 1000000ns, wraps every 2147483648000000ns
[ 0.001000] Calibrating delay loop... 276.99 BogoMIPS (lpj=138496)
[ 0.012000] pid_max: default: 32768 minimum: 301
[ 0.013000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.014000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.020000] devtmpfs: initialized
[ 0.023000] NET: Registered protocol family 16
[ 0.049000] Switched to clocksource MIPS
[ 0.059000] NET: Registered protocol family 2
[ 0.066000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.073000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.079000] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.085000] TCP: reno registered
[ 0.089000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.095000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.101000] NET: Registered protocol family 1
[ 0.644000] VCORE-III Watchdog Timer enabled (30 seconds). Prev boot was not caused by WDT reset.
[ 0.654000] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.676000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.682000] msgmni has been set to 244
[ 0.716000] io scheduler noop registered
[ 0.720000] io scheduler deadline registered (default)
[ 0.726000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.736000] console [ttyS0] disabled
[ 0.739000] serial8250.0: ttyS0 at MMIO 0x70100000 (irq = 14, base_baud = 13020833) is a 16550A
[ 0.748000] console [ttyS0] enabled
[ 0.748000] console [ttyS0] enabled
[ 0.755000] bootconsole [early0] disabled
[ 0.755000] bootconsole [early0] disabled
[ 0.766000] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xf1
[ 0.772000] nand: Micron MT29F1G08ABADAWP
[ 0.777000] nand: 128MiB, SLC, page size: 2048, OOB size: 64
[ 0.788000] Scanning device for bad blocks
[ 0.895000] m25p80 spi0.1: found mx25l12805d, expected m25p80
[ 0.901000] m25p80 spi0.1: mx25l12805d (16384 Kbytes)
[ 0.907000] 9 cmdlinepart partitions found on MTD device m25p80
[ 0.913000] Creating 9 MTD partitions on "m25p80":
[ 0.917000] 0x000000000000-0x000000040000 : "loader1"
[ 0.933000] 0x000000040000-0x000000400000 : "boot1"
[ 0.944000] 0x000000400000-0x000000440000 : "loader2"
[ 0.952000] 0x000000440000-0x000000800000 : "boot2"
[ 0.962000] 0x000000800000-0x000000880000 : "rsvd"
[ 0.972000] 0x000000880000-0x000000e80000 : "bootubi"
[ 0.983000] 0x000000e80000-0x000000ec0000 : "conf"
[ 0.991000] 0x000000ec0000-0x000000fc0000 : "stackconf"
[ 1.001000] 0x000000fc0000-0x000001000000 : "syslog"
[ 1.012000] i2c /dev entries driver
[ 1.017000] TCP: cubic registered
[ 1.020000] NET: Registered protocol family 17
[ 1.025000] 8021q: 802.1Q VLAN Support v1.8
[ 1.029000] Meraki MS220-8 board detected
[ 1.039000] i2c-gpio i2c-gpio.1: using pins 6 (SDA) and 5 (SCL)
[ 1.052000] UBI: attaching mtd6 to ubi0
[ 2.062000] UBI: scanning is finished
[ 2.103000] UBI: attached mtd6 (name "bootubi", size 6 MiB) to ubi0
[ 2.109000] UBI: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 2.116000] UBI: min./max. I/O unit sizes: 1/256, sub-page size 1
[ 2.122000] UBI: VID header offset: 64 (aligned 64), data offset: 128
[ 2.128000] UBI: good PEBs: 1536, bad PEBs: 0, corrupted PEBs: 0
[ 2.134000] UBI: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 2.141000] UBI: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 2638649064
[ 2.150000] UBI: available PEBs: 1532, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 2.160000] UBI: background thread "ubi_bgt0d" started, PID 222
[ 2.166000] UBI: attaching mtd0 to ubi1
[ 2.896000] UBI: scanning is finished
[ 2.930000] UBI: attached mtd0 (name "gen_nand.0", size 128 MiB) to ubi1
[ 2.937000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes
[ 2.944000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 512
[ 2.951000] UBI: VID header offset: 512 (aligned 512), data offset: 2048
[ 2.957000] UBI: good PEBs: 1024, bad PEBs: 0, corrupted PEBs: 0
[ 2.963000] UBI: user volume: 12, internal volumes: 1, max. volumes count: 128
[ 2.971000] UBI: max/mean erase counter: 2517/1477, WL threshold: 4096, image sequence number: 1276936678
[ 2.980000] UBI: available PEBs: 462, total reserved PEBs: 562, PEBs reserved for bad PEB handling: 20
[ 2.990000] UBI: background thread "ubi_bgt1d" started, PID 228
[ 3.064000] devtmpfs: mounted
[ 3.078000] Freeing unused kernel memory: 484K
[ 3.085000] random: init urandom read with 43 bits of entropy available
[ 3.092000] Made it into bootsh: Apr 13 2018 11:17:18
[ 3.098000] bootsh build T-201804131017-Gcbd29c59-ssegal
[ 3.251000] UBIFS: background thread "ubifs_bgt1_4" started, PID 313
[ 3.304000] UBIFS: recovery needed
[ 3.635000] UBIFS: recovery completed
[ 3.639000] UBIFS: mounted UBI device 1, volume 4, name "storage"
[ 3.645000] UBIFS: LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 3.654000] UBIFS: FS size: 7354368 bytes (7 MiB, 57 LEBs), journal size 1032193 bytes (0 MiB, 6 LEBs)
[ 3.664000] UBIFS: reserved for root: 347364 bytes (339 KiB)
[ 3.669000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, small LPT model
In manufacturing: FALSE
In rma mode: FALSE
[ 8.621000] random: nonblocking pool is initialized
[ 11.951000] kexec: Starting new kernel
[ 11.955000] Will call new kernel at 0047a4f0
[ 11.955000] Bye ...
[ 0.000000] Linux version 3.18.57-meraki-elemental (jenkins@dal247.meraki.com) (gcc version 5.4.0 (GCC) ) #2 Fri Aug 24 13:22:04 PDT 2018
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 02019654 (MIPS 24KEc)
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 0046d000 @ 00100000 (usable)
[ 0.000000] memory: 00cb3000 @ 0056d000 (usable after init)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 07ff0000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x07feffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x07feffff]
[ 0.000000] Initmem setup node 0 [mem 0x00000000-0x07feffff]
[ 0.000000] Reserving 0MB of memory at 0MB for crashkernel
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32496
[ 0.000000] Kernel command line: console=ttyS0,115200 mtdparts=m25p80:0x40000(loader1),0x3c0000(boot1),0x40000(loader2),0x3c0000(boot2),0x80000(rsvd),0x600000(bootubi),0x40000(conf),0x100000(stackconf),0x40000(syslog) ubi.mtd=bootub0
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Writing ErrCtl register=800004fe
[ 0.000000] Readback ErrCtl register=800004fe
[ 0.000000] Cache parity protection enabled
[ 0.000000] Memory: 111160K/131008K available (3592K kernel code, 195K rwdata, 736K rodata, 13004K init, 119K bss, 19848K reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS:66
[ 0.000000] sched_clock: 32 bits at 1kHz, resolution 1000000ns, wraps every 2147483648000000ns
[ 0.002000] Calibrating delay loop... 276.99 BogoMIPS (lpj=138496)
[ 0.013000] pid_max: default: 32768 minimum: 301
[ 0.014000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.015000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.018000] ftrace: allocating 12018 entries in 24 pages
[ 0.045000] Performance counters: mips/24K PMU enabled, 2 32-bit counters available to each CPU, irq -1 (share with timer interrupt)
[ 0.052000] devtmpfs: initialized
[ 0.058000] NET: Registered protocol family 16
[ 0.059000] ramoops: using module parameters
[ 0.060000] pstore: Registered ramoops as persistent store backend
[ 0.061000] ramoops: attached 0x10000@0x7ff0000, ecc: 0/0
[ 0.123000] Switched to clocksource MIPS
[ 0.155000] NET: Registered protocol family 2
[ 0.161000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.168000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.175000] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.181000] TCP: reno registered
[ 0.184000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.190000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.197000] NET: Registered protocol family 1
[ 4.459000] VCORE-III Watchdog Timer enabled (30 seconds). Prev boot was not caused by WDT reset.
[ 4.470000] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 4.502000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 4.508000] msgmni has been set to 217
[ 5.243000] io scheduler noop registered
[ 5.247000] io scheduler deadline registered (default)
[ 5.360000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 5.382000] console [ttyS0] disabled
[ 5.386000] serial8250.0: ttyS0 at MMIO 0x70100000 (irq = 14, base_baud = 13020833) is a 16550A
[ 5.394000] console [ttyS0] enabled
[ 5.394000] console [ttyS0] enabled
[ 5.401000] bootconsole [early0] disabled
[ 5.401000] bootconsole [early0] disabled
[ 5.489000] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xf1
[ 5.495000] nand: Micron MT29F1G08ABADAWP
[ 5.499000] nand: 128MiB, SLC, page size: 2048, OOB size: 64
[ 5.511000] Scanning device for bad blocks
[ 6.488000] m25p80 spi0.1: found mx25l12805d, expected m25p80
[ 6.494000] m25p80 spi0.1: mx25l12805d (16384 Kbytes)
[ 6.499000] 9 cmdlinepart partitions found on MTD device m25p80
[ 6.505000] Creating 9 MTD partitions on "m25p80":
[ 6.510000] 0x000000000000-0x000000040000 : "loader1"
[ 6.666000] 0x000000040000-0x000000400000 : "boot1"
[ 6.674000] 0x000000400000-0x000000440000 : "loader2"
[ 6.714000] 0x000000440000-0x000000800000 : "boot2"
[ 6.731000] 0x000000800000-0x000000880000 : "rsvd"
[ 6.807000] 0x000000880000-0x000000e80000 : "bootubi"
[ 6.863000] 0x000000e80000-0x000000ec0000 : "conf"
[ 6.871000] 0x000000ec0000-0x000000fc0000 : "stackconf"
[ 7.002000] 0x000000fc0000-0x000001000000 : "syslog"
[ 7.116000] tun: Universal TUN/TAP device driver, 1.6
[ 7.121000] tun: (C) 1999-2004 Max Krasnyansky maxk@qualcomm.com
[ 7.390000] i2c /dev entries driver
[ 7.396000] TCP: cubic registered
[ 7.400000] Initializing XFRM netlink socket
[ 7.407000] NET: Registered protocol family 10
[ 7.430000] NET: Registered protocol family 17
[ 7.435000] NET: Registered protocol family 15
[ 7.439000] 8021q: 802.1Q VLAN Support v1.8
[ 7.444000] Meraki MS220-8 board detected
[ 7.499000] i2c-gpio i2c-gpio.1: using pins 6 (SDA) and 5 (SCL)
[ 7.616000] UBI: attaching mtd6 to ubi0
[ 8.461000] random: nonblocking pool is initialized
[ 9.380000] UBI: scanning is finished
[ 9.425000] UBI: attached mtd6 (name "bootubi", size 6 MiB) to ubi0
[ 9.431000] UBI: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[ 9.438000] UBI: min./max. I/O unit sizes: 1/256, sub-page size 1
[ 9.444000] UBI: VID header offset: 64 (aligned 64), data offset: 128
[ 9.450000] UBI: good PEBs: 1536, bad PEBs: 0, corrupted PEBs: 0
[ 9.456000] UBI: user volume: 0, internal volumes: 1, max. volumes count: 23
[ 9.463000] UBI: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 2638649064
[ 9.473000] UBI: available PEBs: 1532, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[ 9.482000] UBI: background thread "ubi_bgt0d" started, PID 414
[ 9.508000] UBI: attaching mtd0 to ubi1
[ 10.256000] UBI: scanning is finished
[ 10.298000] UBI: attached mtd0 (name "gen_nand.0", size 128 MiB) to ubi1
[ 10.305000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes
[ 10.311000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 512
[ 10.318000] UBI: VID header offset: 512 (aligned 512), data offset: 2048
[ 10.325000] UBI: good PEBs: 1024, bad PEBs: 0, corrupted PEBs: 0
[ 10.331000] UBI: user volume: 12, internal volumes: 1, max. volumes count: 128
[ 10.338000] UBI: max/mean erase counter: 2517/1477, WL threshold: 4096, image sequence number: 1276936678
[ 10.348000] UBI: available PEBs: 462, total reserved PEBs: 562, PEBs reserved for bad PEB handling: 20
[ 10.357000] UBI: background thread "ubi_bgt1d" started, PID 418
[ 11.534000] devtmpfs: mounted
[ 11.757000] Freeing unused kernel memory: 13004K (8056d000 - 81220000)
[ 12.055000] Made it into bootsh: Aug 24 2018 13:15:33
[ 12.061000] bootsh build switch-10-201808241214-G0a4ba17b-rel-owner
[ 12.213000] UBIFS: background thread "ubifs_bgt1_4" started, PID 564
[ 12.307000] UBIFS: recovery needed
[ 12.592000] UBIFS: recovery completed
[ 12.596000] UBIFS: mounted UBI device 1, volume 4, name "storage"
[ 12.603000] UBIFS: LEB size: 129024 bytes (126 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 12.612000] UBIFS: FS size: 7354368 bytes (7 MiB, 57 LEBs), journal size 1032193 bytes (0 MiB, 6 LEBs)
[ 12.621000] UBIFS: reserved for root: 347364 bytes (339 KiB)
[ 12.627000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, small LPT model
In manufacturing: FALSE
In rma mode: FALSE
init started: BusyBox v1.25.1 (2018-08-24 12:51:28 PDT)
WARNING! THIS CONSOLE IS LOGGED! UNAUTHORIZED ACCESS FORBIDDEN!
[ 13.828000] sysctl: error: 'kernel.softlockup_panic' is an unknown key
[ 13.836000] sysctl: error: 'kernel.watchdog_thresh' is an unknown key
[ 14.080000] sh: write error: Device or resource busy
[ 14.194000] vtss_core: module license '(c) Vitesse Semiconductor Inc.' taints kernel.
[ 14.202000] Disabling lock debugging due to kernel taint
[ 14.802000] switch: 'Meraki MS220-8' board detected
[ 15.755000] sysctl -w vm.panic_on_oom=2
[ 15.782000] vm.panic_on_oom = 2
[ 16.416000] click: starting router thread pid 746 (80c03b00)
[ 17.266000] Single synchronous check for reset
[ 17.574000]
[ 17.611000] boot 20 build switch-10-201808241214-G0a4ba17b-rel-owner board elemental mac XX:XX:XX:XX:XX:XX
[ 17.646000] Module: vtss_core .text=0xc1411000 .data=0xc14a90b0 .bss=0xc14a9320
[ 17.646000] Module: proclikefs .text=0xc007c000 .data= .bss=0xc007d040
[ 17.646000] Module: merakiclick .text=0xc182c000 .data=0xc197c800 .bss=0xc197ca80
[ 17.646000] Module: elts_meraki .text=0xc1f59000 .data=0xc224faa0 .bss=0xc22513d0
[ 17.646000] Module: vc_click .text=0xc23ba000 .data=0xc23ebfa0 .bss=0xc23ec130
[ 17.811000] ls -1 /sys/fs/pstore/dmesg-ramoops-* 2>/dev/null
[ 17.842000] /usr/bin/check_bootreason: reading file : No such file or directory
[ 21.005000] !!!!! {/usr/bin/switch_brain} opening /click/switch_port_table/dump_stack_info_and_reset_stack_change failed: No such file or directory
[ 22.886000] chatter: from_sw0 :: FromVitesse: initializing fdma
[ 24.083000] chatter: dhcp_tracker :: DHCPTracker: skipping undersized restore buffer (buf size: 0)
[ 26.550000] !!!!! {/usr/bin/switch_brain} failed writing /click/switch_port_table/set_port_storm_control errno 2 len 211 data: "PORT 1, ENABLED true\nPORT 2, ENABLED ..."
[ 27.478000] chatter: big_acl :: BigACL: skipping undersized restore buffer (buf size: 0)
[ 28.546000] ethernet_port wired0, ip X.X.X.X, netmask X.X.X.X, gw X.X.X.X, mtu 1500, bcast X.X.X.X, dns1 X.X.X.X, is_static true, vid 1, static_ip_failover false, dhcp_vlan_failover false
[ 28.841000] ethernet_port wired0, ip6local fe80::XXXX:XXXX:XXXX:XXXX, ip6 ::/0, gw ::, mtu 1500, vid 0

Some Pictures:
ms220%20(4)

joslyndm · December 10, 2018, 4:55pm

I've got one that I'd be willing to do testing/troubleshooting on. I would really like to get openwrt running on this thing. I'm an IT professional, not necessarily a hardware hacker but I'll contribute however I can.

This thermal adhesive seems to be highly rated.

joslyndm · December 14, 2018, 5:47pm

Actually, Can you provide the dump of the SPI NOR flash for me? I may have a coworker or two that may be able to help.

iHell · December 21, 2018, 9:42pm

Hey Dane,

I've sent you the download link for the dump of the SPI NOR flash. Have a look into your messages.

micj · January 19, 2019, 2:40am

Hi All,
I've got one of these units and the older root access methods seem to work (connect serial port header, change serial number, reboot unit and hit key for shell access).

I've downloaded a copy of the open source package above and managed to build it.
From what I can tell we are missing:

Complete script to build it to a complete, flashable image (the code builds the toolchain and packages for the target but no kernel or UBI image structure)
Confirmation we can boot via other targets on the bootloader, or shall we just keep the same UBI names?

In regards to updated kernel etc. I think this should come later as Vitesse support has likely been deprecated over the years. Let's just build on 2.6.32 for now.
Realistically this is a fairly simplistic switch, so I think the most we could ask for is to run openwrt with VLAN and PoE support, and perhaps STP.

micj · January 19, 2019, 11:39pm

I know there's a bootlog here but here is my bootlog, from a switch that has never been connected to the internet so never updated to a later kernel (also means I have a switch that is easier to root):

Bootlog

LinuxLoader built Dec 11 2014 11:27:10
init_pll ok
init_spi ok
init_memctl ok
wait_memctl ok
Training DRAM ok
init_irq ok
init_dram_uncached ok
init_icache ok
init_dcache ok
enable_caches ok
init_board ok
Low level initialization complete, exiting boot mode
[    0.000000] Linux version 2.6.32.62-meraki-elemental (jimroewe@jimroewe-linux) (gcc version 4.7.1 (GCC) ) #1 Thu Dec 11 11:28:32 PST 2014
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 02019654 (MIPS 24Kc)
[    0.000000] Determined physical RAM map:
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 07ff0000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00007ff0
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00007ff0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32496
[    0.000000] Kernel command line: console=ttyS0,115200 mtdparts=m25p80:0x40000(loader1),0x3c0000(boot1),0x40000(loader2),0x3c0000(boot2),0x80000(rsvd),0x600000(bootubi),0x40000(conf),0x100000(stackconf),0x40000(syslog) ubi.mtd=bootubi ubi.mtd=gen_nand.0 mem=134152192
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=80001092
[    0.000000] Readback ErrCtl register=80001092
[    0.000000] Cache parity protection enabled
[    0.000000] Memory: 124928k/131008k available (2117k kernel code, 5904k reserved, 574k data, 956k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:66
[    0.001000] Calibrating delay loop... 277.50 BogoMIPS (lpj=138752)
[    0.023000] Mount-cache hash table entries: 512
[    0.026000] devtmpfs: initialized
[    0.029000] NET: Registered protocol family 16
[    0.045000] bio: create slab <bio-0> at 0
[    0.049000] Switching to clocksource MIPS
[    0.056000] NET: Registered protocol family 2
[    0.060000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.068000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.075000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.082000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.088000] TCP reno registered
[    0.092000] NET: Registered protocol family 1
[    0.126000] VCORE-III Watchdog Timer enabled (30 seconds).  Prev boot was not caused by WDT reset.
[    0.139000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.145000] Registering unionfs 2.5.10 (for 2.6.32.46)
[    0.150000] msgmni has been set to 244
[    0.168000] io scheduler noop registered
[    0.172000] io scheduler deadline registered (default)
[    0.179000] Trying to register dev faulty etc
[    0.185000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.194000] serial8250.0: ttyS0 at MMIO 0x70100000 (irq = 14) is a 16550A
[    0.201000] console [ttyS0] enabled, bootconsole disabled
[    0.201000] console [ttyS0] enabled, bootconsole disabled
[    0.214000] m25p80 spi0.1: found mx25l12805d, expected m25p80
[    0.220000] m25p80 spi0.1: mx25l12805d (16384 Kbytes)
[    0.225000] 9 cmdlinepart partitions found on MTD device m25p80
[    0.231000] Creating 9 MTD partitions on "m25p80":
[    0.236000] 0x000000000000-0x000000040000 : "loader1"
[    0.245000] 0x000000040000-0x000000400000 : "boot1"
[    0.254000] 0x000000400000-0x000000440000 : "loader2"
[    0.263000] 0x000000440000-0x000000800000 : "boot2"
[    0.272000] 0x000000800000-0x000000880000 : "rsvd"
[    0.281000] 0x000000880000-0x000000e80000 : "bootubi"
[    0.290000] 0x000000e80000-0x000000ec0000 : "conf"
[    0.299000] 0x000000ec0000-0x000000fc0000 : "stackconf"
[    0.309000] 0x000000fc0000-0x000001000000 : "syslog"
[    0.319000] ONFI flash detected
[    0.323000] ONFI param page 0 valid
[    0.326000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron MT29F1G08ABADAWP)
[    0.340000] Scanning device for bad blocks
[    0.451000] UBI: attaching mtd5 to ubi0
[    0.455000] UBI: physical eraseblock size:   4096 bytes (4 KiB)
[    0.461000] UBI: logical eraseblock size:    3968 bytes
[    0.467000] UBI: smallest flash I/O unit:    1
[    0.471000] UBI: VID header offset:          64 (aligned 64)
[    0.477000] UBI: data offset:                128
[    1.414000] UBI: max. sequence number:       2
[    1.453000] UBI: attached mtd5 to ubi0
[    1.457000] UBI: MTD device name:            "bootubi"
[    1.462000] UBI: MTD device size:            6 MiB
[    1.467000] UBI: number of good PEBs:        1536
[    1.472000] UBI: number of bad PEBs:         0
[    1.476000] UBI: number of corrupted PEBs:   0
[    1.481000] UBI: max. allowed volumes:       23
[    1.485000] UBI: wear-leveling threshold:    4096
[    1.490000] UBI: number of internal volumes: 1
[    1.495000] UBI: number of user volumes:     0
[    1.499000] UBI: available PEBs:             1532
[    1.504000] UBI: total number of reserved PEBs: 4
[    1.509000] UBI: number of PEBs reserved for bad PEB handling: 0
[    1.515000] UBI: max/mean erase counter: 2/1
[    1.519000] UBI: image sequence number:  -1930387409
[    1.524000] UBI: background thread "ubi_bgt0d" started, PID 147
[    1.530000] UBI: attaching mtd9 to ubi1
[    1.535000] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    1.541000] UBI: logical eraseblock size:    129024 bytes
[    1.547000] UBI: smallest flash I/O unit:    2048
[    1.551000] UBI: sub-page size:              512
[    1.556000] UBI: VID header offset:          512 (aligned 512)
[    1.562000] UBI: data offset:                2048
[    2.305000] UBI: max. sequence number:       1620
[    2.343000] UBI: attached mtd9 to ubi1
[    2.347000] UBI: MTD device name:            "gen_nand.0"
[    2.353000] UBI: MTD device size:            128 MiB
[    2.358000] UBI: number of good PEBs:        1024
[    2.362000] UBI: number of bad PEBs:         0
[    2.367000] UBI: number of corrupted PEBs:   0
[    2.371000] UBI: max. allowed volumes:       128
[    2.376000] UBI: wear-leveling threshold:    4096
[    2.381000] UBI: number of internal volumes: 1
[    2.385000] UBI: number of user volumes:     12
[    2.390000] UBI: available PEBs:             407
[    2.395000] UBI: total number of reserved PEBs: 617
[    2.399000] UBI: number of PEBs reserved for bad PEB handling: 20
[    2.406000] UBI: max/mean erase counter: 4/2
[    2.410000] UBI: image sequence number:  1363641321
[    2.415000] UBI: background thread "ubi_bgt1d" started, PID 161
[    2.471000] tun: Universal TUN/TAP device driver, 1.6
[    2.476000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    2.483000] i2c /dev entries driver
[    2.491000] TCP cubic registered
[    2.494000] NET: Registered protocol family 17
[    2.499000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    2.505000] All bugs added by David S. Miller <davem@redhat.com>
[    2.512000] Meraki MS220-8 board detected
[    2.518000] i2c-gpio i2c-gpio.1: using pins 6 (SDA) and 5 (SCL)
[    2.536000] devtmpfs: mounted
[    2.555000] Freeing unused kernel memory: 956k freed
[    2.563000] Made it into bootsh: Dec 11 2014 11:26:54
[    2.569000] bootsh build switch-5-150928
grep meraki-board-config /proc/misc | awk '{print $1}'
[    6.282000] Algorithmics/MIPS FPU Emulator v1.5
[    6.413000] UBIFS: recovery needed
[    6.560000] UBIFS: recovery completed
[    6.564000] UBIFS: mounted UBI device 1, volume 4, name "storage"
[    6.570000] UBIFS: file system size:   7354368 bytes (7182 KiB, 7 MiB, 57 LEBs)
[    6.578000] UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
[    6.585000] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    6.591000] UBIFS: default compressor: lzo
[    6.595000] UBIFS: reserved for root:  347364 bytes (339 KiB)
Press S for a shell, or another [    6.652000] Mapping magic key...

21028864 bytes for /dev/mtdblock/part1
[   12.958000] Ehdr.e_entry = 803228e0 Ehdr.e_phoff = 34
[   12.964000] Phdr.p_offset = 2000 phdr.p_vaddr=80100000 phdr.p_filesz=cb1bbc phdr.p_memsz=ccb858
Got magic key S
[   13.294000] Mapping 21028864 bytes for /dev/mtdblock/part1
[   19.600000] Ehdr.e_entry = 803228e0 Ehdr.e_phoff = 34
[   19.605000] Phdr.p_offset = 2000 phdr.p_vaddr=80100000 phdr.p_filesz=cb1bbc phdr.p_memsz=ccb858
[   19.913000] UBIFS: un-mount UBI device 1, volume 4
[   19.921000] Starting new kernel
[   19.925000] Will call new kernel at 803228e0
[   19.925000] Bye ...
[    0.000000] Linux version 2.6.32.62-meraki-elemental (pbuonado@sf100.meraki.com) (gcc version 4.7.1 (GCC) ) #3 Thu Sep 10 11:36:08 PDT 2015
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 02019654 (MIPS 24Kc)
[    0.000000] Determined physical RAM map:
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 07ff0000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00007ff0
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00007ff0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32496
[    0.000000] Kernel command line: console=ttyS0,115200 mtdparts=m25p80:0x40000(loader1),0x3c0000(boot1),0x40000(loader2),0x3c0000(boot2),0x80000(rsvd),0x600000(bootubi),0x40000(conf),0x100000(stackconf),0x40000(syslog) ubi.mtd=bootubi ubi.mtd=gen_nand.0 mem=134152192
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=80001092
[    0.000000] Readback ErrCtl register=80001092
[    0.000000] Cache parity protection enabled
[    0.000000] Memory: 115584k/131008k available (2226k kernel code, 15256k reserved, 598k data, 10172k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:66
[    0.001000] Calibrating delay loop... 277.50 BogoMIPS (lpj=138752)
[    0.023000] Mount-cache hash table entries: 512
[    0.026000] devtmpfs: initialized
[    0.029000] NET: Registered protocol family 16
[    0.046000] bio: create slab <bio-0> at 0
[    0.052000] Switching to clocksource MIPS
[    0.059000] NET: Registered protocol family 2
[    0.064000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.071000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.079000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.085000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.091000] TCP reno registered
[    0.095000] NET: Registered protocol family 1
[    3.270000] Algorithmics/MIPS FPU Emulator v1.5
[    3.310000] VCORE-III Watchdog Timer enabled (30 seconds).  Prev boot was not caused by WDT reset.
[    3.441000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    3.447000] Registering unionfs 2.5.10 (for 2.6.32.46)
[    3.482000] msgmni has been set to 226
[    3.507000] io scheduler noop registered
[    3.511000] io scheduler deadline registered (default)
[    3.519000] Trying to register dev faulty etc
[    3.537000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    3.582000] console [ttyS0] enabled, bootconsole disabled 14) is a 16550A
[    3.582000] console [ttyS0] enabled, bootconsole disabled
[    3.679000] m25p80 spi0.1: found mx25l12805d, expected m25p80
[    3.685000] m25p80 spi0.1: mx25l12805d (16384 Kbytes)
[    3.690000] 9 cmdlinepart partitions found on MTD device m25p80
[    3.696000] Creating 9 MTD partitions on "m25p80":
[    3.701000] 0x000000000000-0x000000040000 : "loader1"
[    3.780000] 0x000000040000-0x000000400000 : "boot1"
[    3.819000] 0x000000400000-0x000000440000 : "loader2"
[    3.881000] 0x000000440000-0x000000800000 : "boot2"
[    3.951000] 0x000000800000-0x000000880000 : "rsvd"
[    4.017000] 0x000000880000-0x000000e80000 : "bootubi"
[    4.081000] 0x000000e80000-0x000000ec0000 : "conf"
[    4.143000] 0x000000ec0000-0x000000fc0000 : "stackconf"
[    4.215000] 0x000000fc0000-0x000001000000 : "syslog"
[    4.299000] ONFI flash detected
[    4.302000] ONFI param page 0 valid
[    4.306000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron MT29F1G08ABADAWP)
[    4.319000] Scanning device for bad blocks
[    4.548000] UBI: attaching mtd5 to ubi0
[    4.559000] UBI: physical eraseblock size:   4096 bytes (4 KiB)
[    4.565000] UBI: logical eraseblock size:    3968 bytes
[    4.570000] UBI: smallest flash I/O unit:    1
[    4.575000] UBI: VID header offset:          64 (aligned 64)
[    4.580000] UBI: data offset:                128
[    5.579000] UBI: max. sequence number:       2
[    5.622000] UBI: attached mtd5 to ubi0
[    5.626000] UBI: MTD device name:            "bootubi"
[    5.631000] UBI: MTD device size:            6 MiB
[    5.636000] UBI: number of good PEBs:        1536
[    5.640000] UBI: number of bad PEBs:         0
[    5.645000] UBI: number of corrupted PEBs:   0
[    5.649000] UBI: max. allowed volumes:       23
[    5.654000] UBI: wear-leveling threshold:    4096
[    5.659000] UBI: number of internal volumes: 1
[    5.663000] UBI: number of user volumes:     0
[    5.668000] UBI: available PEBs:             1532
[    5.672000] UBI: total number of reserved PEBs: 4
[    5.677000] UBI: number of PEBs reserved for bad PEB handling: 0
[    5.683000] UBI: max/mean erase counter: 2/1
[    5.687000] UBI: image sequence number:  -1930387409
[    5.692000] UBI: background thread "ubi_bgt0d" started, PID 220
[    5.710000] UBI: attaching mtd9 to ubi1
[    5.714000] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    5.721000] UBI: logical eraseblock size:    129024 bytes
[    5.726000] UBI: smallest flash I/O unit:    2048
[    5.731000] UBI: sub-page size:              512
[    5.736000] UBI: VID header offset:          512 (aligned 512)
[    5.742000] UBI: data offset:                2048
[    6.477000] UBI: max. sequence number:       1621
[    6.608000] UBI: attached mtd9 to ubi1
[    6.612000] UBI: MTD device name:            "gen_nand.0"
[    6.617000] UBI: MTD device size:            128 MiB
[    6.622000] UBI: number of good PEBs:        1024
[    6.627000] UBI: number of bad PEBs:         0
[    6.632000] UBI: number of corrupted PEBs:   0
[    6.636000] UBI: max. allowed volumes:       128
[    6.641000] UBI: wear-leveling threshold:    4096
[    6.645000] UBI: number of internal volumes: 1
[    6.650000] UBI: number of user volumes:     12
[    6.654000] UBI: available PEBs:             407
[    6.659000] UBI: total number of reserved PEBs: 617
[    6.664000] UBI: number of PEBs reserved for bad PEB handling: 20
[    6.670000] UBI: max/mean erase counter: 4/2
[    6.674000] UBI: image sequence number:  1363641321
[    6.680000] UBI: background thread "ubi_bgt1d" started, PID 241
[    7.453000] tun: Universal TUN/TAP device driver, 1.6
[    7.458000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    7.556000] i2c /dev entries driver
[    7.655000] TCP cubic registered
[    7.658000] Initializing XFRM netlink socket
[    7.663000] NET: Registered protocol family 17
[    7.667000] NET: Registered protocol family 15
[    7.672000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    7.679000] All bugs added by David S. Miller <davem@redhat.com>
[    7.685000] Meraki MS220-8 board detected
[    7.823000] i2c-gpio i2c-gpio.1: using pins 6 (SDA) and 5 (SCL)
[    8.281000] devtmpfs: mounted
[    8.458000] Freeing unused kernel memory: 10172k freed

[    8.527000] Made it into bootsh: Sep 10 2015 11:14:06
[    8.533000] bootsh build switch-5-176774
[    8.587000] mount_bootpartition: mounting bootroot: No such file or directory
grep meraki-board-config /proc/misc | awk '{print $1}'
[    8.621000] unmount_bootpartition: unmounting bootroot: No such file or directory
[    8.895000] UBIFS: mounted UBI device 1, volume 4, name "storage"
[    8.901000] UBIFS: file system size:   7354368 bytes (7182 KiB, 7 MiB, 57 LEBs)
[    8.908000] UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
[    8.915000] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    8.921000] UBIFS: default compressor: lzo
[    8.925000] UBIFS: reserved for root:  347364 bytes (339 KiB)
Press S for a shell, or another magic key...

init started: BusyBox v1.20.2 (2015-09-10 10:39:02 PDT)


BusyBox v1.20.2 (2015-09-10 10:39:02 PDT) built-in shell (ash)
Enter 'help' for a list of built-in commands.

Welcome to Meraki.

Usage of this device is governed by Meraki's End User License
Agreement, available at http://meraki.com/legal.

(none):/# [    9.225000] ln: /dev/board-config: File exists
[    9.595000] sysctl: error: 'vm.extfrag_threshold' is an unknown key
[    9.738000] sh: write error: Device or resource busy
[   10.719000] switch: 'Meraki MS220-8' board detected
[   10.724000] vtss_phy_chip_temp_init_private:7060 Temperature reading not supported for family: None
[   11.108000] mknod: /dev/switch: File exists
[   11.615000] sysctl -w vm.panic_on_oom=2
[   11.635000] vm.panic_on_oom = 2
[   17.465000] click: starting router thread pid 633 (80850280)
[   23.153000] Single synchronous check for reset
[   23.560000] pd690xx 1-0030: device found
[   23.575000] poe: pd690xx as /class/poe/poe0
[   24.623000] pd690xx 1-0030: Controller 0 boot finished
[   24.736000] 
[   24.775000] boot 30 build switch-5-176774 board elemental mac E0:CB:XX:XX:XX:XX
[   24.799000] Module: vtss_core  .text=0xc1482000 .data=0xc1503960 .bss=0xc1503cf0
[   24.799000] Module: vtss_ioctl  .text=0xc162e000 .data=0xc163bf70 .bss=0xc163c140
[   24.799000] Module: proclikefs  .text=0xc10fd000 .data= .bss=0xc10fdee0
[   24.799000] Module: merakiclick  .text=0xc1896000 .data=0xc199b490 .bss=0xc199b6e0
[   24.799000] Module: elts_meraki  .text=0xc1d78000 .data=0xc1eee570 .bss=0xc1eeecb0
[   24.799000] Module: pd690xx_poe  .text=0xc1ff5000 .data=0xc1ff7370 .bss=
[   24.799000] Module: vc_click  .text=0xc205c000 .data=0xc2086a90 .bss=0xc2086c70
[   24.927000] phram: phram-oops device: 0x10000 at 0x7ff0000
[   28.667000] chatter: from_sw0 :: FromVitesse: initializing fdma

micj · January 20, 2019, 10:59pm

Attached mtdinfo and ubinfo, showing the split between the NOR partitions and UBI.

I have successfully dumped and transferred MTD0 (loader1), MTD1 (boot1) and MTD5 (bootubi) as these are our missing pieces of the puzzle to help understand how to boot a squashfs image.
I am having trouble mounting them, 0 & 1 are raw data images so not sure how to read the data inside them. MTD5 is UBI so should be able to attach it to a dummy block device once I have all the dependencies installed on my CentOS box.

mtdinfo -a

# mtdinfo -a
Count of MTD devices:           23
Present MTD devices:            mtd0, mtd1, mtd2, mtd3, mtd4, mtd5, mtd6, mtd7, mtd8, mtd9, mtd10, mtd11, mtd12, mtd13, mtd14, mtd15, mtd16, mtd17, mtd18, mtd19, mtd20, mtd21, mtd22
Sysfs interface supported:      yes

mtd0
Name:                           loader1
Type:                           nor
Eraseblock size:                4096 bytes, 4.0 KiB
Amount of eraseblocks:          64 (262144 bytes, 256.0 KiB)
Minimum input/output unit size: 1 byte
Sub-page size:                  1 byte
Character device major/minor:   90:0
Bad blocks are allowed:         false
Device is writable:             true

mtd1
Name:                           boot1
Type:                           nor
Eraseblock size:                4096 bytes, 4.0 KiB
Amount of eraseblocks:          960 (3932160 bytes, 3.8 MiB)
Minimum input/output unit size: 1 byte
Sub-page size:                  1 byte
Character device major/minor:   90:2
Bad blocks are allowed:         false
Device is writable:             true

mtd2
Name:                           loader2
Type:                           nor
Eraseblock size:                4096 bytes, 4.0 KiB
Amount of eraseblocks:          64 (262144 bytes, 256.0 KiB)
Minimum input/output unit size: 1 byte
Sub-page size:                  1 byte
Character device major/minor:   90:4
Bad blocks are allowed:         false
Device is writable:             true

mtd3
Name:                           boot2
Type:                           nor
Eraseblock size:                4096 bytes, 4.0 KiB
Amount of eraseblocks:          960 (3932160 bytes, 3.8 MiB)
Minimum input/output unit size: 1 byte
Sub-page size:                  1 byte
Character device major/minor:   90:6
Bad blocks are allowed:         false
Device is writable:             true

mtd4
Name:                           rsvd
Type:                           nor
Eraseblock size:                4096 bytes, 4.0 KiB
Amount of eraseblocks:          128 (524288 bytes, 512.0 KiB)
Minimum input/output unit size: 1 byte
Sub-page size:                  1 byte
Character device major/minor:   90:8
Bad blocks are allowed:         false
Device is writable:             true

mtd5
Name:                           bootubi
Type:                           nor
Eraseblock size:                4096 bytes, 4.0 KiB
Amount of eraseblocks:          1536 (6291456 bytes, 6.0 MiB)
Minimum input/output unit size: 1 byte
Sub-page size:                  1 byte
Character device major/minor:   90:10
Bad blocks are allowed:         false
Device is writable:             true

mtd6
Name:                           conf
Type:                           nor
Eraseblock size:                4096 bytes, 4.0 KiB
Amount of eraseblocks:          64 (262144 bytes, 256.0 KiB)
Minimum input/output unit size: 1 byte
Sub-page size:                  1 byte
Character device major/minor:   90:12
Bad blocks are allowed:         false
Device is writable:             true

mtd7
Name:                           stackconf
Type:                           nor
Eraseblock size:                4096 bytes, 4.0 KiB
Amount of eraseblocks:          256 (1048576 bytes, 1024.0 KiB)
Minimum input/output unit size: 1 byte
Sub-page size:                  1 byte
Character device major/minor:   90:14
Bad blocks are allowed:         false
Device is writable:             true

mtd8
Name:                           syslog
Type:                           nor
Eraseblock size:                4096 bytes, 4.0 KiB
Amount of eraseblocks:          64 (262144 bytes, 256.0 KiB)
Minimum input/output unit size: 1 byte
Sub-page size:                  1 byte
Character device major/minor:   90:16
Bad blocks are allowed:         false
Device is writable:             true

mtd9
Name:                           gen_nand.0
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          1024 (134217728 bytes, 128.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  512 bytes
OOB size:                       64 bytes
Character device major/minor:   90:18
Bad blocks are allowed:         true
Device is writable:             true

mtd10
Name:                           board-config
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          1 (129024 bytes, 126.0 KiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:20
Bad blocks are allowed:         false
Device is writable:             true

mtd11
Name:                           bootroot
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          59 (7712768 bytes, 7.4 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:22
Bad blocks are allowed:         false
Device is writable:             true

mtd12
Name:                           part1
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          163 (21030912 bytes, 20.1 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:24
Bad blocks are allowed:         false
Device is writable:             true

mtd13
Name:                           part2
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          163 (21030912 bytes, 20.1 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:26
Bad blocks are allowed:         false
Device is writable:             true

mtd14
Name:                           storage
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          66 (8515584 bytes, 8.1 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:28
Bad blocks are allowed:         false
Device is writable:             true

mtd15
Name:                           SMBStaX-24
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          16 (2145712 bytes, 2.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:30
Bad blocks are allowed:         false
Device is writable:             true

mtd16
Name:                           SMBStaX-48
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          20 (2695744 bytes, 2.6 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:32
Bad blocks are allowed:         false
Device is writable:             true

mtd17
Name:                           SMBStaX-MS220-8
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          17 (2296560 bytes, 2.2 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:34
Bad blocks are allowed:         false
Device is writable:             true

mtd18
Name:                           SMBStaX-MS220-24
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          17 (2276864 bytes, 2.2 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:36
Bad blocks are allowed:         false
Device is writable:             true

mtd19
Name:                           SMBStaX-MS220-48
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          21 (2735240 bytes, 2.6 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:38
Bad blocks are allowed:         false
Device is writable:             true

mtd20
Name:                           SMBStaX-MS320-24
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          21 (2746304 bytes, 2.6 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:40
Bad blocks are allowed:         false
Device is writable:             true

mtd21
Name:                           SMBStaX-MS320-48
Type:                           ubi
Eraseblock size:                129024 bytes, 126.0 KiB
Amount of eraseblocks:          21 (2738824 bytes, 2.6 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:42
Bad blocks are allowed:         false
Device is writable:             true

mtd22
Name:                           phram-oops
Type:                           ram
Eraseblock size:                4096 bytes, 4.0 KiB
Amount of eraseblocks:          16 (65536 bytes, 64.0 KiB)
Minimum input/output unit size: 1 byte
Sub-page size:                  1 byte
Character device major/minor:   90:44
Bad blocks are allowed:         false
Device is writable:             true

ubinfo -a

# ubinfo -a
UBI version:                    1
Count of UBI devices:           2
UBI control device major/minor: 10:62
Present UBI devices:            ubi0, ubi1

ubi0
Volumes count:                           0
Logical eraseblock size:                 3968 bytes, 3.9 KiB
Total amount of logical eraseblocks:     1536 (6094848 bytes, 5.8 MiB)
Amount of available logical eraseblocks: 1532 (6078976 bytes, 5.8 MiB)
Maximum count of volumes                 23
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  0
Current maximum erase counter value:     2
Minimum input/output unit size:          1 byte
Character device major/minor:            254:0

===================================

ubi1
Volumes count:                           12
Logical eraseblock size:                 129024 bytes, 126.0 KiB
Total amount of logical eraseblocks:     1024 (132120576 bytes, 126.0 MiB)
Amount of available logical eraseblocks: 407 (52512768 bytes, 50.1 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  20
Current maximum erase counter value:     5
Minimum input/output unit size:          2048 bytes
Character device major/minor:            253:0
Present volumes:                         0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11

Volume ID:   0 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        1 LEBs (129024 bytes, 126.0 KiB)
State:       OK
Name:        board-config
Character device major/minor: 253:1
-----------------------------------
Volume ID:   1 (on ubi1)
Type:        static
Alignment:   1
Size:        60 LEBs (7741440 bytes, 7.4 MiB)
Data bytes:  7712768 bytes (7.4 MiB)
State:       OK
Name:        bootroot
Character device major/minor: 253:2
-----------------------------------
Volume ID:   2 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        163 LEBs (21030912 bytes, 20.1 MiB)
State:       OK
Name:        part1
Character device major/minor: 253:3
-----------------------------------
Volume ID:   3 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        163 LEBs (21030912 bytes, 20.1 MiB)
State:       OK
Name:        part2
Character device major/minor: 253:4
-----------------------------------
Volume ID:   4 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        66 LEBs (8515584 bytes, 8.1 MiB)
State:       OK
Name:        storage
Character device major/minor: 253:5
-----------------------------------
Volume ID:   5 (on ubi1)
Type:        static
Alignment:   1
Size:        17 LEBs (2193408 bytes, 2.1 MiB)
Data bytes:  2145712 bytes (2.0 MiB)
State:       OK
Name:        SMBStaX-24
Character device major/minor: 253:6
-----------------------------------
Volume ID:   6 (on ubi1)
Type:        static
Alignment:   1
Size:        21 LEBs (2709504 bytes, 2.6 MiB)
Data bytes:  2695744 bytes (2.6 MiB)
State:       OK
Name:        SMBStaX-48
Character device major/minor: 253:7
-----------------------------------
Volume ID:   7 (on ubi1)
Type:        static
Alignment:   1
Size:        18 LEBs (2322432 bytes, 2.2 MiB)
Data bytes:  2296560 bytes (2.2 MiB)
State:       OK
Name:        SMBStaX-MS220-8
Character device major/minor: 253:8
-----------------------------------
Volume ID:   8 (on ubi1)
Type:        static
Alignment:   1
Size:        18 LEBs (2322432 bytes, 2.2 MiB)
Data bytes:  2276864 bytes (2.2 MiB)
State:       OK
Name:        SMBStaX-MS220-24
Character device major/minor: 253:9
-----------------------------------
Volume ID:   9 (on ubi1)
Type:        static
Alignment:   1
Size:        22 LEBs (2838528 bytes, 2.7 MiB)
Data bytes:  2735240 bytes (2.6 MiB)
State:       OK
Name:        SMBStaX-MS220-48
Character device major/minor: 253:10
-----------------------------------
Volume ID:   10 (on ubi1)
Type:        static
Alignment:   1
Size:        22 LEBs (2838528 bytes, 2.7 MiB)
Data bytes:  2746304 bytes (2.6 MiB)
State:       OK
Name:        SMBStaX-MS320-24
Character device major/minor: 253:11
-----------------------------------
Volume ID:   11 (on ubi1)
Type:        static
Alignment:   1
Size:        22 LEBs (2838528 bytes, 2.7 MiB)
Data bytes:  2738824 bytes (2.6 MiB)
State:       OK
Name:        SMBStaX-MS320-48
Character device major/minor: 253:12

leol · January 22, 2019, 6:24am

Hi Michael,

I have little experience with building OpenWRT or embedded systems in general. However, I spent some time poking at my switch and was able to dump the NOR and NAND flash data over the last week. I was also able to modify both the first and second stage embedded initrd image to gain root access.

The loader (loader1, loader2) source code can be found from meraki-firmware/linux-2.6.32/arch/mips/vcoreiii/loader/head.S and it only loads boot1 into memory before executing it. If the loader fails to validate the image, it tries again by loading boot2. The first stage boot image (boot1, boot2) contains a header (the asm code outlines the header format including the CRC checksum), the linux kernel, and the initrd image (as a xz/cpio archive). I modified this initrd image with my own busybox binary so that I could flash a modified version of the firmware to part1 that has a root password set in /etc/passwd.

Let me know if you want copies of the dumps I have or the modified images I used.

nikor30 · February 13, 2019, 1:18pm

Hi Guy, since I also own one of these puppies would like to know if there is any progress in getting an nice open wrt switch/router with poe

Thunderwolf · April 9, 2019, 3:37am

Hello leol,

How did you dump the firmware from the device? I am able to access the various command groups via serial connection.

I have MS220-48LP I'd like to be able to convert into a locally managed device.

Is the MS220-8P firmware also applicable for the 48 port as well?

Thunderwolf · April 9, 2019, 3:54am

Serial boot dump from MS220-48LP

init_pll ok
init_spi ok
init_memctl ok
wait_memctl ok
Training DRAM ok
init_irq ok
init_dram_uncached ok
init_icache ok
init_dcache ok
enable_caches ok
init_pi ok
init_board ok
Low level initialization complete, exiting boot mode
[    0.000000] Linux version 2.6.32.62-meraki-elemental (jimroewe@jimroewe-linux) (gcc version 4.7.1 (GCC) ) #1 Thu Dec 11 11:28:32 PST 2014
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 01019654 (MIPS 24Kc)
[    0.000000] Determined physical RAM map:
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 07ff0000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00007ff0
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00007ff0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32496
[    0.000000] Kernel command line: console=ttyS0,115200 mtdparts=m25p80:0x40000(loader1),0x3c0000(boot1),0x40000(loader2),0x3c0000(boot2),0x80000(rsvd),0x600000(bootubi),0x40000(conf),0x100000(stackconf),0x40000(syslog) ubi.mtd=bootubi ubi.mtd=gen_nand.0 mem=134152192
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=80018000
[    0.000000] Readback ErrCtl register=80018000
[    0.000000] Cache parity protection enabled
[    0.000000] Memory: 124928k/131008k available (2117k kernel code, 5904k reserved, 574k data, 956k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:66
[    0.000000] VCore-III slave device ID 7460 found
[    0.002000] Calibrating delay loop... 277.50 BogoMIPS (lpj=138752)
[    0.024000] Mount-cache hash table entries: 512
[    0.027000] devtmpfs: initialized
[    0.031000] NET: Registered protocol family 16
[    0.054000] bio: create slab <bio-0> at 0
[    0.059000] Switching to clocksource MIPS
[    0.069000] NET: Registered protocol family 2
[    0.073000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.081000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.089000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.095000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.101000] TCP reno registered
[    0.105000] NET: Registered protocol family 1
[    0.152000] VCORE-III Watchdog Timer enabled (30 seconds).  Prev boot was not caused by WDT reset.
[    0.167000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.173000] Registering unionfs 2.5.10 (for 2.6.32.46)
[    0.179000] msgmni has been set to 244
[    0.199000] io scheduler noop registered
[    0.203000] io scheduler deadline registered (default)
[    0.211000] Trying to register dev faulty etc
[    0.217000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.228000] serial8250.0: ttyS0 at MMIO 0x70100000 (irq = 14) is a 16550A
[    0.235000] console [ttyS0] enabled, bootconsole disabled
[    0.235000] console [ttyS0] enabled, bootconsole disabled
[    0.250000] m25p80 spi0.1: found mx25l12805d, expected m25p80
[    0.256000] m25p80 spi0.1: mx25l12805d (16384 Kbytes)
[    0.261000] 9 cmdlinepart partitions found on MTD device m25p80
[    0.267000] Creating 9 MTD partitions on "m25p80":
[    0.272000] 0x000000000000-0x000000040000 : "loader1"
[    0.283000] 0x000000040000-0x000000400000 : "boot1"
[    0.293000] 0x000000400000-0x000000440000 : "loader2"
[    0.304000] 0x000000440000-0x000000800000 : "boot2"
[    0.315000] 0x000000800000-0x000000880000 : "rsvd"
[    0.326000] 0x000000880000-0x000000e80000 : "bootubi"
[    0.337000] 0x000000e80000-0x000000ec0000 : "conf"
[    0.348000] 0x000000ec0000-0x000000fc0000 : "stackconf"
[    0.359000] 0x000000fc0000-0x000001000000 : "syslog"
[    0.371000] ONFI flash detected
[    0.375000] ONFI param page 0 valid
[    0.378000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron MT29F1G08ABADAWP)
[    0.392000] Scanning device for bad blocks
[    0.506000] UBI: attaching mtd5 to ubi0
[    0.511000] UBI: physical eraseblock size:   4096 bytes (4 KiB)
[    0.517000] UBI: logical eraseblock size:    3968 bytes
[    0.522000] UBI: smallest flash I/O unit:    1
[    0.527000] UBI: VID header offset:          64 (aligned 64)
[    0.532000] UBI: data offset:                128
[    1.480000] UBI: max. sequence number:       2
[    1.520000] UBI: attached mtd5 to ubi0
[    1.524000] UBI: MTD device name:            "bootubi"
[    1.529000] UBI: MTD device size:            6 MiB
[    1.534000] UBI: number of good PEBs:        1536
[    1.539000] UBI: number of bad PEBs:         0
[    1.543000] UBI: number of corrupted PEBs:   0
[    1.548000] UBI: max. allowed volumes:       23
[    1.552000] UBI: wear-leveling threshold:    4096
[    1.557000] UBI: number of internal volumes: 1
[    1.562000] UBI: number of user volumes:     0
[    1.566000] UBI: available PEBs:             1532
[    1.571000] UBI: total number of reserved PEBs: 4
[    1.576000] UBI: number of PEBs reserved for bad PEB handling: 0
[    1.582000] UBI: max/mean erase counter: 2/1
[    1.586000] UBI: image sequence number:  -1000968054
[    1.591000] UBI: background thread "ubi_bgt0d" started, PID 148
[    1.597000] UBI: attaching mtd9 to ubi1
[    1.602000] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    1.608000] UBI: logical eraseblock size:    129024 bytes
[    1.614000] UBI: smallest flash I/O unit:    2048
[    1.618000] UBI: sub-page size:              512
[    1.623000] UBI: VID header offset:          512 (aligned 512)
[    1.629000] UBI: data offset:                2048
[    2.381000] UBI: max. sequence number:       2931
[    2.426000] UBI: attached mtd9 to ubi1
[    2.430000] UBI: MTD device name:            "gen_nand.0"
[    2.435000] UBI: MTD device size:            128 MiB
[    2.440000] UBI: number of good PEBs:        1024
[    2.445000] UBI: number of bad PEBs:         0
[    2.450000] UBI: number of corrupted PEBs:   0
[    2.454000] UBI: max. allowed volumes:       128
[    2.459000] UBI: wear-leveling threshold:    4096
[    2.464000] UBI: number of internal volumes: 1
[    2.468000] UBI: number of user volumes:     12
[    2.473000] UBI: available PEBs:             407
[    2.477000] UBI: total number of reserved PEBs: 617
[    2.482000] UBI: number of PEBs reserved for bad PEB handling: 20
[    2.488000] UBI: max/mean erase counter: 6/3
[    2.493000] UBI: image sequence number:  362626134
[    2.498000] UBI: background thread "ubi_bgt1d" started, PID 162
[    2.576000] tun: Universal TUN/TAP device driver, 1.6
[    2.582000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    2.589000] i2c /dev entries driver
[    2.598000] TCP cubic registered
[    2.602000] NET: Registered protocol family 17
[    2.606000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    2.613000] All bugs added by David S. Miller <davem@redhat.com>
[    2.623000] i2c-gpio i2c-gpio.1: using pins 15 (SDA) and 14 (SCL)
[    2.632000] at24 1-0051: 8192 byte at24 EEPROM (writable)
[    2.708000] i2c-gpio i2c-gpio.8: using pins 47 (SDA) and 46 (SCL)
[    2.728000] devtmpfs: mounted
[    2.749000] Freeing unused kernel memory: 956k freed
[    2.758000] Made it into bootsh: Dec 11 2014 11:26:54
[    2.764000] bootsh build switch-5-150928
grep meraki-board-config /proc/misc | awk '{print $1}'
[    6.544000] Algorithmics/MIPS FPU Emulator v1.5
[    6.833000] UBIFS: mounted UBI device 1, volume 4, name "storage"
[    6.839000] UBIFS: file system size:   7354368 bytes (7182 KiB, 7 MiB, 57 LEBs)
[    6.847000] UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
[    6.854000] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    6.860000] UBIFS: default compressor: lzo
[    6.864000] UBIFS: reserved for root:  347364 bytes (339 KiB)
[    6.975000] Mapping 21028864 bytes for /dev/mtdblock/part1
[    7.452000] UBI: scrubbed PEB 738 (LEB 2:5), data moved to PEB 974
[   13.750000] Ehdr.e_entry = 803228e0 Ehdr.e_phoff = 34
[   13.756000] Phdr.p_offset = 2000 phdr.p_vaddr=80100000 phdr.p_filesz=cb3f58 phdr.p_memsz=ccd858
[   14.105000] UBIFS: un-mount UBI device 1, volume 4
[   14.114000] Starting new kernel
[   14.118000] Will call new kernel at 803228e0
[   14.118000] Bye ...
[    0.000000] Linux version 2.6.32.62-meraki-elemental (meraki@buildbot104.meraki.com) (gcc version 4.7.1 (GCC) ) #2 Fri Sep 4 14:15:02 PDT 2015
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 01019654 (MIPS 24Kc)
[    0.000000] Determined physical RAM map:
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 07ff0000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00007ff0
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00007ff0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32496
[    0.000000] Kernel command line: console=ttyS0,115200 mtdparts=m25p80:0x40000(loader1),0x3c0000(boot1),0x40000(loader2),0x3c0000(boot2),0x80000(rsvd),0x600000(bootubi),0x40000(conf),0x100000(stackconf),0x40000(syslog) ubi.mtd=bootubi ubi.mtd=gen_nand.0 mem=134152192
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=80018000
[    0.000000] Readback ErrCtl register=80018000
[    0.000000] Cache parity protection enabled
[    0.000000] Memory: 115556k/131008k available (2226k kernel code, 15264k reserved, 606k data, 10172k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:66
[    0.000000] VCore-III slave device ID 7460 found
[    0.002000] Calibrating delay loop... 277.50 BogoMIPS (lpj=138752)
[    0.024000] Mount-cache hash table entries: 512
[    0.027000] devtmpfs: initialized
[    0.031000] NET: Registered protocol family 16
[    0.055000] bio: create slab <bio-0> at 0
[    0.063000] Switching to clocksource MIPS
[    0.073000] NET: Registered protocol family 2
[    0.078000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.086000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.093000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.100000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.106000] TCP reno registered
[    0.110000] NET: Registered protocol family 1
[    3.993000] Algorithmics/MIPS FPU Emulator v1.5
[    4.021000] VCORE-III Watchdog Timer enabled (30 seconds).  Prev boot was not caused by WDT reset.
[    4.289000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    4.295000] Registering unionfs 2.5.10 (for 2.6.32.46)
[    4.339000] msgmni has been set to 226
[    4.405000] io scheduler noop registered
[    4.409000] io scheduler deadline registered (default)
[    4.422000] Trying to register dev faulty etc
[    4.436000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    4.497000] serial8250.0: ttyS0 at MMIO 0x70100000 (irq = 14) is a 16550A
[    4.504000] console [ttyS0] enabled, bootconsole disabled
[    4.504000] console [ttyS0] enabled, bootconsole disabled
[    4.642000] m25p80 spi0.1: found mx25l12805d, expected m25p80
[    4.648000] m25p80 spi0.1: mx25l12805d (16384 Kbytes)
[    4.653000] 9 cmdlinepart partitions found on MTD device m25p80
[    4.659000] Creating 9 MTD partitions on "m25p80":
[    4.664000] 0x000000000000-0x000000040000 : "loader1"
[    4.780000] 0x000000040000-0x000000400000 : "boot1"
[    4.830000] 0x000000400000-0x000000440000 : "loader2"
[    4.914000] 0x000000440000-0x000000800000 : "boot2"
[    5.024000] 0x000000800000-0x000000880000 : "rsvd"
[    5.119000] 0x000000880000-0x000000e80000 : "bootubi"
[    5.234000] 0x000000e80000-0x000000ec0000 : "conf"
[    5.359000] 0x000000ec0000-0x000000fc0000 : "stackconf"
[    5.451000] 0x000000fc0000-0x000001000000 : "syslog"
[    5.551000] ONFI flash detected
[    5.555000] ONFI param page 0 valid
[    5.558000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron MT29F1G08ABADAWP)
[    5.572000] Scanning device for bad blocks
[    5.927000] UBI: attaching mtd5 to ubi0
[    5.937000] UBI: physical eraseblock size:   4096 bytes (4 KiB)
[    5.943000] UBI: logical eraseblock size:    3968 bytes
[    5.949000] UBI: smallest flash I/O unit:    1
[    5.953000] UBI: VID header offset:          64 (aligned 64)
[    5.959000] UBI: data offset:                128
[    7.013000] UBI: max. sequence number:       2
[    7.058000] UBI: attached mtd5 to ubi0
[    7.062000] UBI: MTD device name:            "bootubi"
[    7.067000] UBI: MTD device size:            6 MiB
[    7.072000] UBI: number of good PEBs:        1536
[    7.077000] UBI: number of bad PEBs:         0
[    7.081000] UBI: number of corrupted PEBs:   0
[    7.086000] UBI: max. allowed volumes:       23
[    7.090000] UBI: wear-leveling threshold:    4096
[    7.095000] UBI: number of internal volumes: 1
[    7.099000] UBI: number of user volumes:     0
[    7.104000] UBI: available PEBs:             1532
[    7.109000] UBI: total number of reserved PEBs: 4
[    7.113000] UBI: number of PEBs reserved for bad PEB handling: 0
[    7.119000] UBI: max/mean erase counter: 2/1
[    7.124000] UBI: image sequence number:  -1000968054
[    7.129000] UBI: background thread "ubi_bgt0d" started, PID 225
[    7.152000] UBI: attaching mtd9 to ubi1
[    7.157000] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    7.164000] UBI: logical eraseblock size:    129024 bytes
[    7.169000] UBI: smallest flash I/O unit:    2048
[    7.174000] UBI: sub-page size:              512
[    7.178000] UBI: VID header offset:          512 (aligned 512)
[    7.184000] UBI: data offset:                2048
[    7.923000] UBI: max. sequence number:       2933
[    8.071000] UBI: attached mtd9 to ubi1
[    8.075000] UBI: MTD device name:            "gen_nand.0"
[    8.080000] UBI: MTD device size:            128 MiB
[    8.085000] UBI: number of good PEBs:        1024
[    8.090000] UBI: number of bad PEBs:         0
[    8.094000] UBI: number of corrupted PEBs:   0
[    8.099000] UBI: max. allowed volumes:       128
[    8.104000] UBI: wear-leveling threshold:    4096
[    8.108000] UBI: number of internal volumes: 1
[    8.113000] UBI: number of user volumes:     12
[    8.117000] UBI: available PEBs:             407
[    8.122000] UBI: total number of reserved PEBs: 617
[    8.127000] UBI: number of PEBs reserved for bad PEB handling: 20
[    8.133000] UBI: max/mean erase counter: 6/3
[    8.137000] UBI: image sequence number:  362626134
[    8.143000] UBI: background thread "ubi_bgt1d" started, PID 242
[    9.337000] tun: Universal TUN/TAP device driver, 1.6
[    9.342000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[    9.482000] i2c /dev entries driver
[    9.722000] TCP cubic registered
[    9.726000] Initializing XFRM netlink socket
[    9.730000] NET: Registered protocol family 17
[    9.735000] NET: Registered protocol family 15
[    9.739000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    9.746000] All bugs added by David S. Miller <davem@redhat.com>
[    9.964000] i2c-gpio i2c-gpio.1: using pins 15 (SDA) and 14 (SCL)
[    9.994000] at24 1-0051: 8192 byte at24 EEPROM (writable)
[   12.932000] i2c-gpio-scl i2c-gpio-scl.2: using pins 53 (SDA) and 52 (SCL)
[   13.037000] i2c i2c-2: Added multiplexed i2c bus 3
[   13.102000] i2c i2c-2: Added multiplexed i2c bus 4
[   13.171000] i2c i2c-2: Added multiplexed i2c bus 5
[   13.225000] i2c i2c-2: Added multiplexed i2c bus 6
[   13.456000] tmp401 8-004c: Detected TI TMP411 chip
[   13.461000] i2c-gpio i2c-gpio.8: using pins 47 (SDA) and 46 (SCL)
[   13.566000] cisco-rps cisco-rps: Cisco RPS 2300 interface established
[   13.666000] at24 3-0050: 256 byte 24c02 EEPROM (read-only)
[   13.710000] at24 4-0050: 256 byte 24c02 EEPROM (read-only)
[   13.773000] at24 5-0050: 256 byte 24c02 EEPROM (read-only)
[   13.812000] at24 6-0050: 256 byte 24c02 EEPROM (read-only)
[   13.904000] devtmpfs: mounted
[   14.106000] Freeing unused kernel memory: 10172k freed
[   14.195000] Made it into bootsh: Sep  4 2015 14:12:07
[   14.201000] bootsh build switch-5-176388
[   14.279000] mount_bootpartition: mounting bootroot: No such file or directory
grep meraki-board-config /proc/misc | awk '{print $1}'
[   14.327000] unmount_bootpartition: unmounting bootroot: No such file or directory
[   14.628000] UBIFS: mounted UBI device 1, volume 4, name "storage"
[   14.634000] UBIFS: file system size:   7354368 bytes (7182 KiB, 7 MiB, 57 LEBs)
[   14.641000] UBIFS: journal size:       1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
[   14.649000] UBIFS: media format:       w4/r0 (latest is w4/r0)
[   14.655000] UBIFS: default compressor: lzo
[   14.659000] UBIFS: reserved for root:  347364 bytes (339 KiB)
init started: BusyBox v1.20.2 (2015-09-04 13:48:08 PDT)
WARNING! THIS CONSOLE IS LOGGED! UNAUTHORIZED ACCESS FORBIDDEN!
<Meraki> [   15.048000] mknod: /dev/board-config: File exists
[   15.570000] sysctl: error: 'vm.extfrag_threshold' is an unknown key
[   15.788000] sh: write error: Device or resource busy
[   16.804000] switch: 'Meraki MS220-48' board detected
[   16.809000] vtss_phy_chip_temp_init_private:7060 Temperature reading not supported for family: None
[   17.503000] mknod: /dev/switch: File exists
[   18.316000] sysctl -w vm.panic_on_oom=2
[   18.344000] vm.panic_on_oom = 2
[   25.317000] click: starting router thread pid 872 (87331980)
[   32.717000] Single synchronous check for reset
[   33.341000] pd690xx 1-0030: device found
[   33.358000] poe: pd690xx as /class/poe/poe0
[   34.992000] pd690xx 1-0030: Controller 0 boot finished
[   35.007000] pd690xx 1-0030: Controller 1 boot finished
[   35.022000] pd690xx 1-0030: Controller 2 boot finished
[   35.035000] pd690xx 1-0030: Controller 3 boot finished
[   35.149000]
[   35.191000] boot 24 build switch-5-176388 board elemental mac 88:15:44:23:15:D0
[   35.224000] Module: vtss_core  .text=0xc2556000 .data=0xc263e620 .bss=0xc2658d70
[   35.224000] Module: vtss_ioctl  .text=0xc2b5c000 .data=0xc2b70fc0 .bss=0xc2b71190
[   35.224000] Module: proclikefs  .text=0xc2b79000 .data= .bss=0xc2b79ee0
[   35.224000] Module: merakiclick  .text=0xc2dc0000 .data=0xc2ec5490 .bss=0xc2ec56e0
[   35.224000] Module: elts_meraki  .text=0xc32a2000 .data=0xc3418590 .bss=0xc3418cd0
[   35.224000] Module: pd690xx_poe  .text=0xc351f000 .data=0xc3521370 .bss=
[   35.224000] Module: vc_click  .text=0xc359b000 .data=0xc35d2200 .bss=0xc35d23e0
[   35.424000] phram: phram-oops device: 0x10000 at 0x7ff0000
[   46.699000] chatter: from_sw0 :: FromVitesse: initializing fdma

accountnumber3 · April 10, 2019, 2:14am

I don't recognize any of these words. Does this mean that support for the 8P is likely or are you guys just fiddling for fun?

micj · April 11, 2019, 9:40am

Very keen to understand the process; I already had root on mine in NAND but if we can flash modified images to boot1 then we're a step closer to building for this device.

micj · April 11, 2019, 9:42am

I was under the impression that the 48 port was different yet again, but your dump suggests it's also board name "elemental" which is what the 8 port uses.

Not sure if the exact same firmware can be used, but the hardware is a very close match so if we can build for one device, the other will fall in line.

micj · April 11, 2019, 9:47am

OpenWRT doesn't support MIPS as a target (anymore) so it will take a lot of work to build, but it's in the early stages of getting the ability to modify the platform.

I'm quite distracted trying to also crack the MX64 Security router for my own selfish needs. I managed to obtain a small 10 port PoE+ gigabit switch so the urgency for the MS220-8P isn't there, but also frees up the device to hack on.

Entropy512 · April 11, 2019, 3:26pm

I assume you mean it doesn't support this particular MIPS variant any more, since it most definitely still supports other MIPS targets such as ath79?

leol · April 11, 2019, 10:44pm

I dumped the NOR flash by connecting to J4 using a raspberry pi with flashrom. Using this same process, I rewrote the linux initramfs to gain root access to the first stage boot loader. From there, using nanddump, I was able to copy the running linux firmware.

I haven't really done anything after gaining root access and enabling the built-in web interface externally.

If anyone is interested, I've written up what I've found on my personal wiki at https://leo.leung.xyz/wiki/Meraki_MS220-8P and https://leo.leung.xyz/wiki/Rooting_the_Meraki_MS220-8P. Keep in mind that the information might be incomplete or incorrect.

PsionicResonator · April 14, 2019, 1:30am

I just wanted to connect with you on the MX64. I have on here and the method 'https://openwrt.org/inbox/meraki/meraki_mr32' allows for the broadcom recovery mode with it's own little busybox. From there I wonder what could be done to overwrite the whole thing. (s magic key bootloops it)

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00040000 "boot"
mtd1: 00100000 00040000 "nvram"
mtd2: 01000000 00040000 "linux"
mtd3: 01000000 00040000 "rootfs"
mtd4: 06000000 00040000 "senao"
#

m6sso · July 11, 2019, 9:58pm

Just wondering if this has died in the water? Got one next to me that is useless and could really do with an open source firmware.

Drauku · July 24, 2019, 5:54pm

I would also be interested in an updated status. I just obtained an MS220-8P and an MR18. I'm a complete beginner when it comes to reverse engineering, but I'm willing to learn and use these as test-beds if someone needs another information source to help with progress.