Got another piece of equipment here, also outside its license and otherwise useless. Same UART interface as the other Meraki stuff so I captured the boot info and dropped into shell with 's' magic key.
Stock Boot
find_hif: bootstrap = 0xaf055b
WASP BootROM Ver. 1.1
Nand Flash init
Table[5]: Control setting = 0xb44
hdr: [0xbd001000 : 0xbd001000 : 0x6104 : 0xb8a746df]
nand_load_fw: read 12 pages
nand_load_fw: 0x10000 0x800 0xbd0017f0
nand_load_fw: 0x20000 0x800 0xbd001ff0
nand_load_fw: 0x30000 0x800 0xbd0027f0
nand_load_fw: 0x40000 0x800 0xbd002ff0
nand_load_fw: 0x50000 0x800 0xbd0037f0
nand_load_fw: 0x60000 0x800 0xbd003ff0
nand_load_fw: 0x70000 0x800 0xbd0047f0
nand_load_fw: 0x80000 0x800 0xbd004ff0
nand_load_fw: 0x90000 0x800 0xbd0057f0
nand_load_fw: 0xa0000 0x800 0xbd005ff0
nand_load_fw: 0xb0000 0x800 0xbd0067f0
nand_load_fw: 0xc0000 0x800 0xbd006ff0
f/w 0 read complete, jumping to 0xbd001000
Meraki Atheros LinuxLoader built Jul 23 2012 15:31:10
init_ddr ok
test_memory ok
D-cache size: 64K
I-cache size: 32K
init_dram_uncached ok
init_icache ok
init_dcache ok
enable_caches ok
test_memory ok
init_usb_phy ok
init_pcie_plls ok
nand_flash_init ok
loading fw at 64
hdr: [0x4d495053 : 0x80002000 : 0x41d3c0 : 0x802a76a0, : 0x74887c61]
................................
Linux version 2.6.32.60-svn123774 (meraki@buildbot102.meraki.com) (gcc version 4 .5.3 (GCC) ) #1 Fri Jan 17 19:45:12 PST 2014
flash_size passed from bootloader = 2239
bootconsole [early0] enabled
CPU revision is: 0001974c (MIPS 74Kc)
ath_sys_frequency: cpu srif ddr srif cpu 560 ddr 400 ahb 200
Booting Atheros AR934x
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 07ffc000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
Normal 0x00000000 -> 0x00007ffc
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00007ffc
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32508
Kernel command line: console=ttyS0,115200 mtdparts=ath-nand:128K(loader1),8064K( bootkernel1),128K(loader2),8064K(bootkernel2),114560K(ubi),128K(origcaldata) ubi .mtd=ubi mem=131056K
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 125440k/131056k available (2748k kernel code, 5448k reserved, 764k data, 700k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 278.52 BogoMIPS (lpj=557056)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
PCI init:ath_pcibios_init
ath_pcibios_init(294): PCI CMD write: 0x356
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
vgaarb: loaded
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: PME# supported from D0 D1 D3hot
pci 0000:00:00.0: PME# disabled
Returning IRQ 64
Switching to clocksource MIPS
ATHR_GMAC: Length per segment 512
ATHR_GMAC: fifo cfg 3 01f00140
ATHR_GMAC: RX TASKLET - Pkts per Intr:100
ATHR_GMAC: Mac address for unit 0:bfff0000
ATHR_GMAC: 00:00:00:00:00:00
ATHR_GMAC: Max segments per packet : 1
ATHR_GMAC: Max tx descriptor count : 100
ATHR_GMAC: Max rx descriptor count : 252
ATHR_GMAC: Mac capability flags : 2381
WASP ----> S17 PHY *
ATHR_GMAC: Powered down LAN port phys
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
MERAKI GLUON INIT
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering unionfs 2.5.10 (for 2.6.32.46)
msgmni has been set to 245
io scheduler noop registered
io scheduler deadline registered (default)
Trying to register dev faulty etc
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
console [ttyS0] enabled, bootconsole disabled 19) is a 16550A
console [ttyS0] enabled, bootconsole disabled
brd: module loaded
ONFI flash detected
ONFI param page 0 valid
NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix H27U1G8F2BTR-BC)
Scanning device for bad blocks
6 cmdlinepart partitions found on MTD device ath-nand
Creating 6 MTD partitions on "ath-nand":
0x000000000000-0x000000020000 : "loader1"
0x000000020000-0x000000800000 : "bootkernel1"
0x000000800000-0x000000820000 : "loader2"
0x000000820000-0x000001000000 : "bootkernel2"
0x000001000000-0x000007fe0000 : "ubi"
0x000007fe0000-0x000008000000 : "origcaldata"
UBI: attaching mtd4 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 129024 bytes
UBI: smallest flash I/O unit: 2048
UBI: sub-page size: 512
UBI: VID header offset: 512 (aligned 512)
UBI: data offset: 2048
UBI: max. sequence number: 17192
UBI: attached mtd4 to ubi0
UBI: MTD device name: "ubi"
UBI: MTD device size: 111 MiB
UBI: number of good PEBs: 895
UBI: number of bad PEBs: 0
UBI: number of corrupted PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 5
UBI: available PEBs: 91
UBI: total number of reserved PEBs: 804
UBI: number of PEBs reserved for bad PEB handling: 16
UBI: max/mean erase counter: 25/20
UBI: image sequence number: 1610524614
UBI: background thread "ubi_bgt0d" started, PID 175
Atheros(R) L2 Ethernet Driver - version 2.2.3
Copyright (c) 2007 Atheros Corporation.
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V1.0
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver cdc_eem
usbcore: registered new interface driver cdc_subset
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Port Status 1c000004
ath-ehci ath-ehci.0: ATH EHCI
ath-ehci ath-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci ath-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 13
ehci_reset Port Status 1c000000
ath-ehci ath-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: ATH EHCI
usb usb1: Manufacturer: Linux 2.6.32.60-svn123774 ehci_hcd
usb usb1: SerialNumber: platform
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_acm
cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapter s
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
USB Serial support registered for Qualcomm USB modem
usbcore: registered new interface driver qcserial
USB Serial support registered for Sierra USB modem
usbcore: registered new interface driver sierra
sierra: v.1.7.40:USB Driver for Sierra Wireless USB modems
input: gpio-keys as /class/input/input0
usbcore: registered new interface driver usbhid
usbhid: v2.6:USB HID core driver
oprofile: using mips/74K performance monitoring.
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
ath_otp_init: Registering OTP success
ath_clksw_init: Registering Clock Switch Interface success
Freeing unused kernel memory: 700k freed
Made it into bootsh: Jan 17 2014 19:39:18
bootsh build wired-8-126593
Press S for a shell, or another magic key...
trying to ubi mount: bootcustom
mounting ubifs: Invalid argument
trying to ubi mount: storage
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 4, name "storage"
UBIFS: file system size: 82704384 bytes (80766 KiB, 78 MiB, 641 LEBs)
UBIFS: journal size: 4128768 bytes (4032 KiB, 3 MiB, 32 LEBs)
UBIFS: media format: w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root: 3906332 bytes (3814 KiB)
trying rootfs path: /dev/mtdblock/rootfs-wired-8-126593-1
Attempting to setup root /dev/mtdblock/rootfs-wired-8-126593-1...
About to try exec
init started: BusyBox v1.20.2 (2014-01-17 18:58:06 PST)
Algorithmics/MIPS FPU Emulator v1.5
: mount: mounting /dev/ubivol/storage on /storage failed: Device or resource bus y
: sysctl -w vm.panic_on_oom=2
: vm.panic_on_oom = 2
unionfs: new lower inode mtime (bindex=1, name=lib)
ath_hal: 0.9.17.1 (AR5212, AR5416, AR9380, RF5111, RF5112, RF2413, RF5413, RF2316, RF2317, DEBUG, WRITE_EEPROM, 11D)
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 9.2.0_U10.5.13 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
Bootstrap clock 40MHz
Wasp Enterprise mode: 0x00000000
ar9300RadioAttach: Need analog access recipe!!
dfs_attach: use DFS enhancements
Overriding DFS domain with 1
DFS min filter rssiThresh = 18
DFS max pulse dur = 151 ticks
ath_get_caps[5335] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[5309] tx chainmask mismatch actual 3 sc_chainmak 0
wifi0: Atheros 9340: mem=0xb8100000, irq=2
ath_pci: 9.2.0_U10.5.13 (Atheros/multi-bss)
__ath_attach: Set global_scn[1]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
dfs_attach: use DFS enhancements
Overriding DFS domain with 1
DFS min filter rssiThresh = 18
DFS max pulse dur = 151 ticks
ath_get_caps[5335] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[5309] tx chainmask mismatch actual 3 sc_chainmak 0
wifi1: Atheros ???: mem=0x10000000, irq=64 hw_base=0xb0000000
unionfs: new lower inode mtime (bindex=1, name=console)
Single synchronous check for reset
unionfs: new lower inode mtime (bindex=1, name=console)
!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
unionfs: new lower inode mtime (bindex=1, name=console)
!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
unionfs: new lower inode mtime (bindex=1, name=console)
!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
unionfs: new lower inode mtime (bindex=1, name=console)
!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
unionfs: new lower inode mtime (bindex=1, name=etc)
: mknod: /dev/ttyUSB0: File exists
: mknod: /dev/ttyUSB1: File exists
: mknod: /dev/ttyUSB2: File exists
unionfs: new lower inode mtime (bindex=1, name=console)
unionfs: new lower inode mtime (bindex=1, name=console)
init-boot: boot 58 build wired-8-126593 board wired-mips mac 00:18:0A:17:61:08
unionfs: new lower inode mtime (bindex=1, name=console)
Module: adf .text=0x8725c000 .data= .bss=
Module: asf .text=0x8724a000 .data=0x8724b560 .bss=0x8724b710
Module: ath_hal .text=0x86c00000 .data=0x86cb8aa0 .bss=0x86cc1100
Module: ath_dfs .text=0x87270000 .data=0x8727a7e0 .bss=0x8727a930
Module: ath_rate_atheros .text=0x86cd0000 .data=0x86cd7140 .bss=0x86cdca80
Module: ath_dev .text=0x87280000 .data=0x872bd980 .bss=0x872bde50
Module: athunionfs: new lower inode mtime (bindex=1, name=console)
_pktlog .text= .data= .bss=
Module: umac .text=0x86d00000 .data=0x86d8c920 .bss=0x86d8e0c0
Module: proclikefs .text=0x86db0000 .data= .bss=0x86db0dc0
Module: merakiclick .text=0x85000000 .data=0x85266420 .bss=0x852668b0
Module: scsi_wait_scan .text= .data= .bss=
!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
click: starting router thread pid 574 (87234ac0)
phram: phram-oops device: 0x4000 at 0x7ffc000
unionfs: new lower inode mtime (bindex=1, name=usr)
unionfs: new lower inode mtime (bindex=1, name=console)
!!!!! reading /tmp/brain_dump failed [2]: No such file or directory
unionfs: new lower inode mtime (bindex=1, name=etc)
unionfs: new lower inode mtime (bindex=1, name=etc)
unionfs: new lower inode mtime (bindex=1, name=etc)
unionfs: new lower inode mtime (bindex=1, name=etc)
device sw0 entered promiscuous mode
athr_gmac_ring_alloc Allocated 1600 at 0x8432d800
athr_gmac_ring_alloc Allocated 4032 at 0x83f94000
Setting Drop CRC Errors, Pause Frames and Length Error frames
athrs17_reg_init:done
Setting PHY...
unionfs: new lower inode mtime (bindex=1, name=etc)
unionfs: new lower inode mtime (bindex=1, name=etc)
chatter: to_hostlan :: ToHost: device 'hostlan' went down
chatter: to_hostlan :: ToHost: device 'hostlan' came up
unionfs: new lower inode mtime (bindex=1, name=etc)
unionfs: new lower inode mtime (bindex=1, name=etc)
wifi0: ath_tid_stuck_checker txq 3 stall detected 1 bufs last scheduled 5.508 ago
Shell
Press S for a shell, or another magic key...
trying to ubi mount: bootcustom
mounting ubifs: Invalid argument
trying to ubi mount: storage
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 4, name "storage"
UBIFS: file system size: 82704384 bytes (80766 KiB, 78 MiB, 641 LEBs)
UBIFS: journal size: 4128768 bytes (4032 KiB, 3 MiB, 32 LEBs)
UBIFS: media format: w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root: 3906332 bytes (3814 KiB)
Got magic key s
Algorithmics/MIPS FPU Emulator v1.5
BusyBox v1.20.2 (2014-01-17 18:58:06 PST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
/ # help
Built-in commands:
------------------
. : [ [[ alias bg break cd chdir command continue echo eval exec
exit export false fg getopts hash help jobs kill let local printf
pwd read readonly return set shift source test times trap true
type ulimit umask unalias unset wait
Noticed lack of tftpboot command, which is all I'm familiar with so far.