OpenWrt Forum Archive

Topic: Cisco Meraki Z1 WiFi Router

The content of this topic has been archived between 31 Mar 2018 and 28 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Got another piece of equipment here, also outside its license and otherwise useless.  Same UART interface as the other Meraki stuff so I captured the boot info and dropped into shell with 's' magic key.

Stock Boot
find_hif: bootstrap = 0xaf055b
WASP BootROM Ver. 1.1
Nand Flash init
Table[5]: Control setting = 0xb44
hdr: [0xbd001000 : 0xbd001000 : 0x6104 : 0xb8a746df]
nand_load_fw: read 12 pages
nand_load_fw: 0x10000 0x800 0xbd0017f0
nand_load_fw: 0x20000 0x800 0xbd001ff0
nand_load_fw: 0x30000 0x800 0xbd0027f0
nand_load_fw: 0x40000 0x800 0xbd002ff0
nand_load_fw: 0x50000 0x800 0xbd0037f0
nand_load_fw: 0x60000 0x800 0xbd003ff0
nand_load_fw: 0x70000 0x800 0xbd0047f0
nand_load_fw: 0x80000 0x800 0xbd004ff0
nand_load_fw: 0x90000 0x800 0xbd0057f0
nand_load_fw: 0xa0000 0x800 0xbd005ff0
nand_load_fw: 0xb0000 0x800 0xbd0067f0
nand_load_fw: 0xc0000 0x800 0xbd006ff0
f/w 0 read complete, jumping to 0xbd001000



Meraki Atheros LinuxLoader built Jul 23 2012 15:31:10
init_ddr ok
test_memory ok
D-cache size: 64K
I-cache size: 32K
init_dram_uncached ok
init_icache ok
init_dcache ok
enable_caches ok
test_memory ok
init_usb_phy ok
init_pcie_plls ok
nand_flash_init ok
loading fw at 64
hdr: [0x4d495053 : 0x80002000 : 0x41d3c0 : 0x802a76a0, : 0x74887c61]
................................
Linux version 2.6.32.60-svn123774 (meraki@buildbot102.meraki.com) (gcc version 4                                                                       .5.3 (GCC) ) #1 Fri Jan 17 19:45:12 PST 2014
flash_size passed from bootloader = 2239
bootconsole [early0] enabled
CPU revision is: 0001974c (MIPS 74Kc)
ath_sys_frequency: cpu srif ddr srif cpu 560 ddr 400 ahb 200
Booting Atheros AR934x
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 07ffc000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00007ffc
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00007ffc
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32508
Kernel command line: console=ttyS0,115200 mtdparts=ath-nand:128K(loader1),8064K(                                                                       bootkernel1),128K(loader2),8064K(bootkernel2),114560K(ubi),128K(origcaldata) ubi                                                                       .mtd=ubi mem=131056K
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 125440k/131056k available (2748k kernel code, 5448k reserved, 764k data,                                                                        700k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 278.52 BogoMIPS (lpj=557056)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI init:ath_pcibios_init
ath_pcibios_init(294): PCI CMD write: 0x356
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
vgaarb: loaded
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: PME# supported from D0 D1 D3hot
pci 0000:00:00.0: PME# disabled
Returning IRQ 64
Switching to clocksource MIPS
ATHR_GMAC: Length per segment 512
ATHR_GMAC: fifo cfg 3 01f00140
ATHR_GMAC: RX TASKLET - Pkts per Intr:100
ATHR_GMAC: Mac address for unit 0:bfff0000
ATHR_GMAC: 00:00:00:00:00:00
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   100
ATHR_GMAC: Max rx descriptor count :   252
ATHR_GMAC: Mac capability flags    :   2381
WASP  ----> S17 PHY *
ATHR_GMAC: Powered down LAN port phys
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
MERAKI GLUON INIT
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering unionfs 2.5.10 (for 2.6.32.46)
msgmni has been set to 245
io scheduler noop registered
io scheduler deadline registered (default)
Trying to register dev faulty etc
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
console [ttyS0] enabled, bootconsole disabled 19) is a 16550A
console [ttyS0] enabled, bootconsole disabled
brd: module loaded
ONFI flash detected
ONFI param page 0 valid
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix H27U1G8F2BTR-BC)
Scanning device for bad blocks
6 cmdlinepart partitions found on MTD device ath-nand
Creating 6 MTD partitions on "ath-nand":
0x000000000000-0x000000020000 : "loader1"
0x000000020000-0x000000800000 : "bootkernel1"
0x000000800000-0x000000820000 : "loader2"
0x000000820000-0x000001000000 : "bootkernel2"
0x000001000000-0x000007fe0000 : "ubi"
0x000007fe0000-0x000008000000 : "origcaldata"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    129024 bytes
UBI: smallest flash I/O unit:    2048
UBI: sub-page size:              512
UBI: VID header offset:          512 (aligned 512)
UBI: data offset:                2048
UBI: max. sequence number:       17192
UBI: attached mtd4 to ubi0
UBI: MTD device name:            "ubi"
UBI: MTD device size:            111 MiB
UBI: number of good PEBs:        895
UBI: number of bad PEBs:         0
UBI: number of corrupted PEBs:   0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     5
UBI: available PEBs:             91
UBI: total number of reserved PEBs: 804
UBI: number of PEBs reserved for bad PEB handling: 16
UBI: max/mean erase counter: 25/20
UBI: image sequence number:  1610524614
UBI: background thread "ubi_bgt0d" started, PID 175
Atheros(R) L2 Ethernet Driver - version 2.2.3
Copyright (c) 2007 Atheros Corporation.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V1.0
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver cdc_eem
usbcore: registered new interface driver cdc_subset
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004
ath-ehci ath-ehci.0: ATH EHCI
ath-ehci ath-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci ath-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci ath-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: ATH EHCI
usb usb1: Manufacturer: Linux 2.6.32.60-svn123774 ehci_hcd
usb usb1: SerialNumber: platform
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapter                                                                       s
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
USB Serial support registered for Qualcomm USB modem
usbcore: registered new interface driver qcserial
USB Serial support registered for Sierra USB modem
usbcore: registered new interface driver sierra
sierra: v.1.7.40:USB Driver for Sierra Wireless USB modems
input: gpio-keys as /class/input/input0
usbcore: registered new interface driver usbhid
usbhid: v2.6:USB HID core driver
oprofile: using mips/74K performance monitoring.
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
ath_otp_init: Registering OTP success
ath_clksw_init: Registering Clock Switch Interface success
Freeing unused kernel memory: 700k freed
Made it into bootsh: Jan 17 2014 19:39:18
bootsh build wired-8-126593

Press S for a shell, or another magic key...

trying to ubi mount: bootcustom
mounting ubifs: Invalid argument
trying to ubi mount: storage
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 4, name "storage"
UBIFS: file system size:   82704384 bytes (80766 KiB, 78 MiB, 641 LEBs)
UBIFS: journal size:       4128768 bytes (4032 KiB, 3 MiB, 32 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  3906332 bytes (3814 KiB)
trying rootfs path: /dev/mtdblock/rootfs-wired-8-126593-1
Attempting to setup root /dev/mtdblock/rootfs-wired-8-126593-1...
About to try exec
init started: BusyBox v1.20.2 (2014-01-17 18:58:06 PST)
Algorithmics/MIPS FPU Emulator v1.5
: mount: mounting /dev/ubivol/storage on /storage failed: Device or resource bus                                                                       y

: sysctl -w vm.panic_on_oom=2

: vm.panic_on_oom = 2

unionfs: new lower inode mtime (bindex=1, name=lib)
ath_hal: 0.9.17.1 (AR5212, AR5416, AR9380, RF5111, RF5112, RF2413, RF5413, RF2316, RF2317, DEBUG, WRITE_EEPROM, 11D)
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 9.2.0_U10.5.13 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
Bootstrap clock 40MHz
Wasp Enterprise mode: 0x00000000
ar9300RadioAttach: Need analog access recipe!!
dfs_attach: use DFS enhancements
Overriding DFS domain with 1
DFS min filter rssiThresh = 18
DFS max pulse dur = 151 ticks
ath_get_caps[5335] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[5309] tx chainmask mismatch actual 3 sc_chainmak 0
wifi0: Atheros 9340: mem=0xb8100000, irq=2
ath_pci: 9.2.0_U10.5.13 (Atheros/multi-bss)
__ath_attach: Set global_scn[1]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
dfs_attach: use DFS enhancements
Overriding DFS domain with 1
DFS min filter rssiThresh = 18
DFS max pulse dur = 151 ticks
ath_get_caps[5335] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[5309] tx chainmask mismatch actual 3 sc_chainmak 0
wifi1: Atheros ???: mem=0x10000000, irq=64 hw_base=0xb0000000
unionfs: new lower inode mtime (bindex=1, name=console)
Single synchronous check for reset
unionfs: new lower inode mtime (bindex=1, name=console)

!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
unionfs: new lower inode mtime (bindex=1, name=console)

!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
unionfs: new lower inode mtime (bindex=1, name=console)

!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
unionfs: new lower inode mtime (bindex=1, name=console)

!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
unionfs: new lower inode mtime (bindex=1, name=etc)
: mknod: /dev/ttyUSB0: File exists

: mknod: /dev/ttyUSB1: File exists

: mknod: /dev/ttyUSB2: File exists

unionfs: new lower inode mtime (bindex=1, name=console)

unionfs: new lower inode mtime (bindex=1, name=console)
init-boot: boot 58 build wired-8-126593 board wired-mips mac 00:18:0A:17:61:08

unionfs: new lower inode mtime (bindex=1, name=console)
Module: adf  .text=0x8725c000 .data= .bss=
Module: asf  .text=0x8724a000 .data=0x8724b560 .bss=0x8724b710
Module: ath_hal  .text=0x86c00000 .data=0x86cb8aa0 .bss=0x86cc1100
Module: ath_dfs  .text=0x87270000 .data=0x8727a7e0 .bss=0x8727a930
Module: ath_rate_atheros  .text=0x86cd0000 .data=0x86cd7140 .bss=0x86cdca80
Module: ath_dev  .text=0x87280000 .data=0x872bd980 .bss=0x872bde50
Module: athunionfs: new lower inode mtime (bindex=1, name=console)
_pktlog  .text= .data= .bss=
Module: umac  .text=0x86d00000 .data=0x86d8c920 .bss=0x86d8e0c0
Module: proclikefs  .text=0x86db0000 .data= .bss=0x86db0dc0
Module: merakiclick  .text=0x85000000 .data=0x85266420 .bss=0x852668b0
Module: scsi_wait_scan  .text= .data= .bss=

!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
click: starting router thread pid 574 (87234ac0)
phram: phram-oops device: 0x4000 at 0x7ffc000
unionfs: new lower inode mtime (bindex=1, name=usr)
unionfs: new lower inode mtime (bindex=1, name=console)

!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
unionfs: new lower inode mtime (bindex=1, name=etc)
unionfs: new lower inode mtime (bindex=1, name=etc)
unionfs: new lower inode mtime (bindex=1, name=etc)
unionfs: new lower inode mtime (bindex=1, name=etc)
device sw0 entered promiscuous mode
athr_gmac_ring_alloc Allocated 1600 at 0x8432d800
athr_gmac_ring_alloc Allocated 4032 at 0x83f94000
Setting Drop CRC Errors, Pause Frames and Length Error frames
athrs17_reg_init:done
Setting PHY...
unionfs: new lower inode mtime (bindex=1, name=etc)
unionfs: new lower inode mtime (bindex=1, name=etc)
chatter: to_hostlan :: ToHost: device 'hostlan' went down
chatter: to_hostlan :: ToHost: device 'hostlan' came up
unionfs: new lower inode mtime (bindex=1, name=etc)
unionfs: new lower inode mtime (bindex=1, name=etc)


wifi0: ath_tid_stuck_checker txq 3 stall detected 1 bufs last scheduled 5.508 ago
Shell
Press S for a shell, or another magic key...

trying to ubi mount: bootcustom
mounting ubifs: Invalid argument
trying to ubi mount: storage
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 4, name "storage"
UBIFS: file system size:   82704384 bytes (80766 KiB, 78 MiB, 641 LEBs)
UBIFS: journal size:       4128768 bytes (4032 KiB, 3 MiB, 32 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  3906332 bytes (3814 KiB)
Got magic key s
Algorithmics/MIPS FPU Emulator v1.5


BusyBox v1.20.2 (2014-01-17 18:58:06 PST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # help
Built-in commands:
------------------
        . : [ [[ alias bg break cd chdir command continue echo eval exec
        exit export false fg getopts hash help jobs kill let local printf
        pwd read readonly return set shift source test times trap true
        type ulimit umask unalias unset wait

Noticed lack of tftpboot command, which is all I'm familiar with so far.

http://i66.tinypic.com/23u6e54.jpg

http://i68.tinypic.com/2vnqw6t.jpg

Like a tool, I left the power switched on when I connected LAN prior to disconnecting the far side of the cable to plug-in to the laptop running Ubuntu and it contacted Meraki and updated to their more restrictive FW.  Now if I boot it only gives the <Meraki> prompt similar to the scenario with the MR18 AP.  I've fumbled around trying to short resistors and only get this far, at least it mentions magic key (tried 's' and '2').

bootkernel 1 failed!
loading fw at 4160
ecc failed to calculate
hdr: [0x495053 : 0x80060000 : 0x4d5772c0 : 0x803460a0, : 0x893fcc]
magic is not correct
bootkernel 2 failed!
error booting
find_hif: bootstrap = 0xaf055b

can you take off the shields and give some close up shots of the board?

the MR18 had a jumper pads for what appeared to be booting to a backup partition (I dont remember the exact terms).

gbx wrote:

can you take off the shields and give some close up shots of the board?

the MR18 had a jumper pads for what appeared to be booting to a backup partition (I dont remember the exact terms).

Absolutely, and thank you for stopping by.  Really impressed with your work on the MR18 project!

Find pics here.  Anything else I can provide, just ask.
https://drive.google.com/folderview?id= … sp=sharing

tbs_david wrote:
gbx wrote:

can you take off the shields and give some close up shots of the board?

the MR18 had a jumper pads for what appeared to be booting to a backup partition (I dont remember the exact terms).

Absolutely, and thank you for stopping by.  Really impressed with your work on the MR18 project!

Find pics here.  Anything else I can provide, just ask.
https://drive.google.com/folderview?id= … sp=sharing

Any chance of getting a pic of the SoC without the thermal pad on it? I may try and see if I can get a Z1 for the cheap off of Ebay. Also, you may want to try the root method I published over at https://servernetworktech.com/2016/02/p … raki-mr18/ as it should actually work on most meraki devices.

Edit: Have a Z1 on the way. smile

(Last edited by riptide_wave on 15 Feb 2016, 17:45)

Really glad to see you in the thread riptide.  I hadn't seen those rooting instructions yet, so I'll try it out on Weds.  I also have some MR24s to figure out as well.  At least I didn't let that one I started testing on get the newest firmware downloaded.

tbs_david wrote:

Really glad to see you in the thread riptide.  I hadn't seen those rooting instructions yet, so I'll try it out on Weds.  I also have some MR24s to figure out as well.  At least I didn't let that one I started testing on get the newest firmware downloaded.

Sounds good. As for the Z1, any chance you can share the output from the following when ran from the initramfs shell environment?

cat /proc/cmdline
cat /proc/partitions
cat /proc/version
cat /proc/cpuinfo
cat /proc/mtd
cat /proc/mounts
dmesg

Will help me get a better idea as to what is needed to get this board up and going with OpenWRT. As for the MR24, I don't have my hands on one so not sure if I could be much help in getting that ported over currently. If possible, could you get some pics from that as well? (that device should get it's own thread though to keep things organized)

riptide_wave wrote:
tbs_david wrote:

Really glad to see you in the thread riptide.  I hadn't seen those rooting instructions yet, so I'll try it out on Weds.  I also have some MR24s to figure out as well.  At least I didn't let that one I started testing on get the newest firmware downloaded.

Sounds good. As for the Z1, any chance you can share the output from the following when ran from the initramfs shell environment?

cat /proc/cmdline
cat /proc/partitions
cat /proc/version
cat /proc/cpuinfo
cat /proc/mtd
cat /proc/mounts
dmesg
Here we go!
/ # cat /proc/cmdline
 console=ttyS0,115200 machtype=MERAKI_Z1 mtdparts=ath79-nand:128K(loader1),8064K(bootkernel1),128K(loader2),8064K(bootkernel2),114560K(ubi),128K(origcaldata) ubi.mtd=ubi mem=131056K
/ # cat /proc/partitions
major minor  #blocks  name

  31        0        128 mtdblock0
  31        1       8064 mtdblock1
  31        2        128 mtdblock2
  31        3       8064 mtdblock3
  31        4     114560 mtdblock4
  31        5        128 mtdblock5
  31        6        126 mtdblock6
  31        7       8694 mtdblock7
  31        8       8616 mtdblock8
  31        9      82026 mtdblock9
  31       10        252 mtdblock10
/ # cat /proc/version
Linux version 3.4.104-svn173619 (meraki@buildbot106.meraki.com) (gcc version 4.8.3 (GCC) ) #3 Fri Aug 14 17:11:10 PDT 2015
/ # cat /proc/cpuinfo
system type             : Atheros AR9344 rev 2
machine                 : Meraki Z1
processor               : 0
cpu model               : MIPS 74Kc V4.12
BogoMIPS                : 278.78
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0000, 0x0a98, 0x0cb0, 0x0368]
ASEs implemented        : mips16 dsp
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available
/ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00020000 "loader1"
mtd1: 007e0000 00020000 "bootkernel1"
mtd2: 00020000 00020000 "loader2"
mtd3: 007e0000 00020000 "bootkernel2"
mtd4: 06fe0000 00020000 "ubi"
mtd5: 00020000 00020000 "origcaldata"
mtd6: 0001f800 0001f800 "board-config"
mtd7: 0087d800 0001f800 "rootfs-wired-10-174276-2"
mtd8: 0086a000 0001f800 "rootfs-wired-10-174276-1"
mtd9: 0501a800 0001f800 "storage"
mtd10: 0003f000 0001f800 "caldata"
/ # cat /proc/mounts
rootfs / rootfs rw 0 0
devtmpfs /dev devtmpfs rw,relatime,mode=0755 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/ubivol/storage /storage ubifs rw,relatime 0 0
/ # dmesg
[    0.000000] Linux version 3.4.104-svn173619 (meraki@buildbot106.meraki.com) (gcc version 4.8.3 (GCC) ) #3 Fri Aug 14 17:11:10 PDT 2015
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0001974c (MIPS 74Kc)
[    0.000000] SoC: Atheros AR9344 rev 2
[    0.000000] Clocks: CPU:560.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:40.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 07fb0000 @ 00050000 (usable)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 07ffc000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00007ffc
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00007ffc
[    0.000000] On node 0 totalpages: 32764
[    0.000000] free_area_init_node: node 0, pgdat 80415a50, node_mem_map 81000000
[    0.000000]   Normal zone: 256 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32508 pages, LIFO batch:7
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32508
[    0.000000] Kernel command line:  console=ttyS0,115200 machtype=MERAKI_Z1 mtdparts=ath79-nand:128K(loader1),8064K(bootkernel1),128K(loader2),8064K(bootkernel2),114560K(ubi),128K(origcaldata) ubi.mtd=ubi mem=131056K
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 123812k/131056k available (3026k kernel code, 7244k reserved, 778k data, 1792k init, 0k highmem)
[    0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 278.78 BogoMIPS (lpj=557568)
[    0.036000] pid_max: default: 4096 minimum: 301
[    0.040000] Mount-cache hash table entries: 512
[    0.044000] devtmpfs: initialized
[    0.048000] NET: Registered protocol family 16
[    0.052000] gpiochip_add: registered GPIOs 0 to 22 on device: ath79
[    0.056000] MIPS: machine is Meraki Z1
[    0.060000] registering PCI controller with io_map_base unset
[    0.080000] bio: create slab <bio-0> at 0
[    0.084000] SCSI subsystem initialized
[    0.088000] usbcore: registered new interface driver usbfs
[    0.092000] usbcore: registered new interface driver hub
[    0.096000] usbcore: registered new device driver usb
[    0.100000] PCI host bridge to bus 0000:00
[    0.104000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x13ffffff]
[    0.108000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.112000] pci 0000:00:00.0: [168c:ff1c] type 00 class 0x020000
[    0.112000] pci 0000:00:00.0: reg 10: [mem 0x00000000-0x0000ffff 64bit]
[    0.112000] pci 0000:00:00.0: supports D1
[    0.112000] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.112000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1000ffff 64bit]
[    0.116000] pci 0000:00:00.0: using irq 40 for pin 1
[    0.120000] Switching to clocksource MIPS
[    0.124000] ATHR_GMAC: Length per segment 1536
[    0.128000] ATHR_GMAC: fifo cfg 3 01f00140
[    0.132000] mac:0 Registering S17....
[    0.136000] ATHR_GMAC: Mac address for unit 0:bfff1000
[    0.144000] ATHR_GMAC: 00:00:00:00:00:00
[    0.696000] ATHR_GMAC: Max segments per packet :   1
[    0.700000] ATHR_GMAC: Max tx descriptor count :   100
[    0.704000] ATHR_GMAC: Max rx descriptor count :   252
[    0.712000] ATHR_GMAC: Mac capability flags    :   4201
[    0.716000] WASP  ----> S17 PHY *
[    0.720000] ATHR_GMAC: Powered down LAN port phys
[    0.724000] NET: Registered protocol family 2
[    0.744000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.748000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.756000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.764000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.768000] TCP: reno registered
[    0.772000] NET: Registered protocol family 1
[    0.776000] PCI: CLS 0 bytes, default 32
[    0.820000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.824000] msgmni has been set to 241
[    0.828000] io scheduler noop registered
[    0.832000] io scheduler deadline registered (default)
[    0.840000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.864000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.872000] console [ttyS0] enabled, bootconsole disabled
[    0.884000] Trying to register dev faulty etc
[    0.888000] brd: module loaded
[    0.896000] ONFI param page 0 valid
[    0.900000] ONFI flash detected
[    0.900000] NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix H27U1G8F2BTR-BC)
[    0.912000] Scanning device for bad blocks
[    0.972000] 6 cmdlinepart partitions found on MTD device ath79-nand
[    0.980000] Creating 6 MTD partitions on "ath79-nand":
[    0.984000] 0x000000000000-0x000000020000 : "loader1"
[    0.992000] 0x000000020000-0x000000800000 : "bootkernel1"
[    1.000000] 0x000000800000-0x000000820000 : "loader2"
[    1.004000] 0x000000820000-0x000001000000 : "bootkernel2"
[    1.012000] 0x000001000000-0x000007fe0000 : "ubi"
[    1.020000] 0x000007fe0000-0x000008000000 : "origcaldata"
[    1.028000] UBI: attaching mtd4 to ubi0
[    1.032000] UBI: physical eraseblock size:   131072 bytes (128 KiB)
[    1.036000] UBI: logical eraseblock size:    129024 bytes
[    1.044000] UBI: smallest flash I/O unit:    2048
[    1.048000] UBI: sub-page size:              512
[    1.052000] UBI: VID header offset:          512 (aligned 512)
[    1.056000] UBI: data offset:                2048
[    1.220000] UBI: max. sequence number:       17930
[    1.232000] UBI: attached mtd4 to ubi0
[    1.236000] UBI: MTD device name:            "ubi"
[    1.244000] UBI: MTD device size:            111 MiB
[    1.248000] UBI: number of good PEBs:        895
[    1.252000] UBI: number of bad PEBs:         0
[    1.256000] UBI: number of corrupted PEBs:   0
[    1.260000] UBI: max. allowed volumes:       128
[    1.264000] UBI: wear-leveling threshold:    4096
[    1.272000] UBI: number of internal volumes: 1
[    1.276000] UBI: number of user volumes:     5
[    1.280000] UBI: available PEBs:             83
[    1.284000] UBI: total number of reserved PEBs: 812
[    1.288000] UBI: number of PEBs reserved for bad PEB handling: 16
[    1.296000] UBI: max/mean erase counter: 29/20
[    1.300000] UBI: image sequence number:  1610524614
[    1.304000] UBI: background thread "ubi_bgt0d" started, PID 260
[    1.320000] Atheros(R) L2 Ethernet Driver - version 2.2.3
[    1.324000] Copyright (c) 2007 Atheros Corporation.
[    1.332000] PPP generic driver version 2.4.2
[    1.336000] PPP BSD Compression module registered
[    1.340000] PPP Deflate Compression module registered
[    1.348000] NET: Registered protocol family 24
[    1.352000] usbcore: registered new interface driver cdc_ether
[    1.356000] usbcore: registered new interface driver cdc_eem
[    1.364000] usbcore: registered new interface driver cdc_subset
[    1.368000] usbcore: registered new interface driver cdc_ncm
[    1.376000] usbcore: registered new interface driver cdc_acm
[    1.380000] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
[    1.392000] usbcore: registered new interface driver usbserial
[    1.396000] usbcore: registered new interface driver usbserial_generic
[    1.404000] USB Serial support registered for generic
[    1.408000] usbserial: USB Serial Driver core
[    1.412000] usbcore: registered new interface driver option
[    1.420000] USB Serial support registered for GSM modem (1-port)
[    1.424000] usbcore: registered new interface driver qcserial
[    1.432000] USB Serial support registered for Qualcomm USB modem
[    1.436000] usbcore: registered new interface driver sierra
[    1.444000] USB Serial support registered for Sierra USB modem
[    1.452000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled/input/input0
[    1.460000] Registered led device: power:orange
[    1.460000] Registered led device: tricolor0:blue
[    1.460000] Registered led device: tricolor0:green
[    1.460000] Registered led device: tricolor0:red
[    1.460000] usbcore: registered new interface driver usbhid
[    1.468000] usbhid: USB HID core driver
[    1.472000] oprofile: using mips/74K performance monitoring.
[    1.476000] TCP: cubic registered
[    1.480000] Initializing XFRM netlink socket
[    1.484000] NET: Registered protocol family 17
[    1.492000] NET: Registered protocol family 15
[    1.496000] L2TP core driver, V2.0
[    1.500000] PPPoL2TP kernel driver, V2.0
[    1.504000] L2TP IP encapsulation support (L2TPv3)
[    1.508000] L2TP netlink interface
[    1.512000] L2TP ethernet pseudowire support (L2TPv3)
[    1.516000] 8021q: 802.1Q VLAN Support v1.8
[    1.524000] devtmpfs: mounted
[    1.536000] Freeing unused kernel memory: 1792k freed
[    1.544000] Made it into bootsh: Aug 14 2015 17:11:02
[    1.548000] bootsh build wired-10-174276
[    1.588000] UBIFS: recovery needed
[    1.664000] UBIFS: recovery completed
[    1.668000] UBIFS: mounted UBI device 0, volume 4, name "storage"
[    1.672000] UBIFS: file system size:   82704384 bytes (80766 KiB, 78 MiB, 641 LEBs)
[    1.680000] UBIFS: journal size:       4128768 bytes (4032 KiB, 3 MiB, 32 LEBs)
[    1.688000] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    1.696000] UBIFS: default compressor: lzo
[    1.700000] UBIFS: reserved for root:  3906332 bytes (3814 KiB)
[    1.732000] Algorithmics/MIPS FPU Emulator v1.5
tbs_david wrote:
Here we go!

Cool beans, seems to be using the same bootloader source as the MR18, just for the AR934x platform [0]. Also looks like another 128MB NAND device, so lots of room to play around with!

Will try to see what I can do while I wait for my Z1 to arrive. smile

[0]: https://github.com/riptidewave93/meraki … h79/loader

EDIT: Any chance you can get me a copy of one of the kernels? Can normally dump using DD, and then use the script in the MR18 thread to enable networking so you can move the files off. If not no worries, as my Z1 should arrive Monday.

(Last edited by riptide_wave on 17 Feb 2016, 17:21)

riptide_wave wrote:
tbs_david wrote:
Here we go!

Cool beans, seems to be using the same bootloader source as the MR18, just for the AR934x platform [0]. Also looks like another 128MB NAND device, so lots of room to play around with!

Will try to see what I can do while I wait for my Z1 to arrive. smile

[0]: https://github.com/riptidewave93/meraki … h79/loader

EDIT: Any chance you can get me a copy of one of the kernels? Can normally dump using DD, and then use the script in the MR18 thread to enable networking so you can move the files off. If not no worries, as my Z1 should arrive Monday.

I'll see what I can do.  Right now I'm having trouble getting back into the shell.  Worked fine this morning...

**Edit: n/m just needed to restart KiTTY and it's working as it should again. derp

(Last edited by tbs_david on 17 Feb 2016, 19:30)

Here's a copy of mtdblock1 (assuming I did it right)

There's no tftp so I had to netcat the dang thing.  Hopefully the binary stayed clean.

https://drive.google.com/open?id=0B3D8R … 0NoTVludjQ

If you want any others just give me the mtdblock # from above.

tbs_david wrote:

Here's a copy of mtdblock1 (assuming I did it right)

There's no tftp so I had to netcat the dang thing.  Hopefully the binary stayed clean.

https://drive.google.com/open?id=0B3D8R … 0NoTVludjQ

If you want any others just give me the mtdblock # from above.

Thanks, but it seems that there may be an issue with the dump.

Any chance you can also dump mtdblock3 (the backup kernel) as well?

(Last edited by riptide_wave on 17 Feb 2016, 20:52)

riptide_wave wrote:
tbs_david wrote:

Here's a copy of mtdblock1 (assuming I did it right)

There's no tftp so I had to netcat the dang thing.  Hopefully the binary stayed clean.

https://drive.google.com/open?id=0B3D8R … 0NoTVludjQ

If you want any others just give me the mtdblock # from above.

Thanks, but it seems that there may be an issue with the dump.

Any chance you can also dump mtdblock3 (the backup kernel) as well?

#3
https://drive.google.com/open?id=0B3D8R … FNJaUQ1dlk

I think I see what you're saying, in mkimage list?

In initramfs shell I'm doing (after network is up to local PC):
dd if=/dev/mtdblock3 of=/storage/mtdblock3.bin
tar -cf mtdblock3.tar mtdblock3.bin
busybox nc 192.168.1.101 1234 < mtdblock3.tar

on the Ubuntu PC I just do:
nc -l 1234 > mtdblock3.tar
gzip mtdblock3.tar

Then I UL  the tar.gz to Drive

Also tried a more simple:
dd if=/dev/mtdblock1 | nc 192.168.1.101 1234

same result from mkimage -l mtdblock1:
mkimage: Bad Magic Number: "mtdblock1" is no valid image

tbs_david wrote:

Also tried a more simple:
dd if=/dev/mtdblock1 | nc 192.168.1.101 1234

same result from mkimage -l mtdblock1:
mkimage: Bad Magic Number: "mtdblock1" is no valid image

No worries, the 2nd dump worked better, so I can start parsing together the header format used on the kernel, as it's different from the MR18. Will be sure to post any updates in this thread if/when I get a OpenWRT firmware booting.

In the meantime, can you please also get a dump of one of the system partitions? Would love to see the difference in the actual firmware code compared to the AP's. (mtdblock7 or 8)

riptide_wave wrote:
tbs_david wrote:

Also tried a more simple:
dd if=/dev/mtdblock1 | nc 192.168.1.101 1234

same result from mkimage -l mtdblock1:
mkimage: Bad Magic Number: "mtdblock1" is no valid image

No worries, the 2nd dump worked better, so I can start parsing together the header format used on the kernel, as it's different from the MR18. Will be sure to post any updates in this thread if/when I get a OpenWRT firmware booting.

In the meantime, can you please also get a dump of one of the system partitions? Would love to see the difference in the actual firmware code compared to the AP's. (mtdblock7 or 8)

Sure, here's 7 and 8.

https://drive.google.com/open?id=0B3D8R … 2xhSldCYjA

tbs_david wrote:

Sure, here's 7 and 8.

https://drive.google.com/open?id=0B3D8R … 2xhSldCYjA

Cool, also got my Z1 yesterday and got some different dumps from that as well. Time to get to work!

I will be sure to post once I have some updates on the progress.

Awesome smile

tbs_david wrote:

Awesome smile

Slowly but surely. smile https://i.imgur.com/AzbEYkH.png

Like the MR18 this will require root access on the device to flash, and it seems that (at least for my board) the recovery partition may not work, so the flashing process will be a little different. Once I have some testable builds available I will be sure to share them in this thread.

EDIT: Update on progress. Almost everything is complete already (WOO!) but the only outstanding issue is getting the 2.4GHz wireless PCIe radio working, as it requires the ath9k fixup, but caldata is loaded from NAND. This issue may take a bit to fix, but besides that everything else should be good to go at this point, including sysupgrade.

(Last edited by riptide_wave on 27 Feb 2016, 02:27)

drool big_smile  I like this little device, can't wait to put it into action.

And let the fun of OpenWRT begin! smile Like other devices I port, current releases will be in my GitHub repo below until the code is merged upstream into the official OpenWRT repo.

Repos:

Meraki Kernel Source: https://github.com/riptidewave93/meraki-linux
OpenWRT Z1 Bringup Repo: https://github.com/riptidewave93/Openwrt-Z1

Flashing Instructions:

Prerequisites:

  • 1x Meraki Z1

  • 1x UART adapter wired to the Z1 (speed is 115200).

  • Local Computer (Static IP of 192.168.0.2) directly wired to one of the LAN ports.

  • A Local Webserver Application (apache,nginx,xampp,python script,etc)

Flashing:

  • Hookup UART and Ethernet (LAN only) to the Z1, where the ethernet is directly wired to your local machine. (To prevent the Z1 from reaching the internet)

  • Follow the steps at https://servernetworktech.com/2016/02/p … raki-mr18/ to get into the initramfs root prompt, and follow the steps to do the stock firmware root (bonus root). Once this is done and you have a full root prompt within the stock Meraki firmware, please return to this tutorial.

  • At this point, you will then want to download the firmware images for the Z1 from the repo at https://github.com/riptidewave93/Openwrt-Z1/releases and then extract the files to the root of your local webserver. Once this is done and you have verified the 2 images are extracted and in the webroot folder, you can then download the initramfs image to the Z1 and flash it:

wget http://192.168.0.2/openwrt-ar71xx-nand-z1-initramfs-kernel.bin -O /storage/openwrt.bin
dd if=/storage/openwrt.bin of=/dev/mtdblock3
  • At this point OpenWRT should be flashed to the 2nd kernel partition, but unlike the MR18 there is no way to force boot this partition. Because of this we will also want to flash this to mtdblock1, but we always START with mtdblock3 to ensure our device can failback to the initramfs image if needed. So next, we will also flash the normal kernel partition of the board:

dd if=/storage/openwrt.bin of=/dev/mtdblock1
  • If all commands above completed without error or any warnings, then you have successfully flashed the initramfs image to your device! To boot this, all you need to reboot the Z1 and this will then boot up the OpenWRT initramfs build. Note that right after flashing using dd, it's a good idea to wait 15 to 30 seconds to ensure any cached writes complete.

NOTE: In the initramfs image, you may notice wifi does not work. This is because some factory firmware images do not properly populate the UBI caldata partition with the required information, but we will take care of this shortly. smile

  • Now that we have the initramfs build working, you will want to browse to http://192.168.1.1/ which should then take you to the LuCI web interface. Note that before you can access this, you WILL NEED to change your local computer's interface to use DHCP. From here, you can just press login to enter as no password is set. You will then want to go to the System Upgrade tab, and select the downloaded sysupgrade image named openwrt-ar71xx-nand-z1-squashfs-sysupgrade.tar. Once selected, de-select the save config option and then press Upgrade. Once on the confirmation page, go ahead and flash the image. This will then flash OpenWRT, fix the caldata partition if needed, and auto create rootfs and expand rootfs_data to use the rest of the UBI free space.

NOTE: You may want to remove the Stock Meraki firmware partitions from the initramfs image before flashing the sysupgrade, as this will then give you more storage space for rootfs_data (up to 90+ MiB). For this, you will want to follow the Removal guide from the MR18 thread at https://forum.openwrt.org/viewtopic.php … 67#p311567. Be careful to NOT DELETE the board-info partition, as this holds your board's mac address.

And there you have it, at this point you should now have a fully working OpenWRT image running on your Meraki Z1! smile

Also, HUGE THANKS to Christian Lamparter, for again, helping solve the hardest issues! This time it was the pains of loading caldata from the NAND for this specific PCIe interface, as well as figuring out the kernel crc32 issue.

(Last edited by riptide_wave on 9 Mar 2016, 12:49)

Awww snap, to the KiTTY!