OpenWrt Forum Archive

Topic: Cisco Meraki MR24 Support

The content of this topic has been archived on 19 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

We've replaced our MR16s and MR24s with MR32s and have no official use for the hardware due to Meraki's cloud licensing.  I've got OpenWRT running on a 16 and thought I would get this topic started to see if it goes anywhere.

The PCB is labeled UART and utilizes the same pinout as the MR12/16 devices.  So I am able to provide some info on the unit.
PIN 1 has a white arrow
P1->empty (VCC)
P2->RX
P3->TX
P4->GND

Stock Boot
U-Boot 2010.06-00036-g4e1a276 Meraki MR24 (May 11 2012 - 16:57:49)

CPU:   AMCC PowerPC  UNKNOWN (PVR=12c41c83) at 800 MHz (PLB=200 OPB=100 EBC=100)
       Bootstrap Option H - Boot ROM Location I2C (Addr 0x52), booting from NAND
       32 kB I-Cache 32 kB D-Cache
Board: MR24 - Meraki MR24 Cloud Managed Access Point
============================
BoardID: 0 0
POE-PWR_DET Status: 0
ADAPTER_DET Status: 1
Reset Button Status: 1
============================
SDR0_PERCLK=0x40000300
I2C:   ready
DRAM:  128 MiB
I2C write: failed 4
NAND:  32 MiB
*** Warning - bad CRC or NAND, using default environment

Configure Max Payload 256B
PCIE0: successfully set as root-complex
        03  00  168c  0030  0280  ff
        02  02  111d  8039  0604  00
        04  00  168c  0030  0280  ff
        02  03  111d  8039  0604  00
        01  00  111d  8039  0604  00
I2C read: failed 4
I2C write: failed 4
I2C read: failed 4
I2C read: failed 4
I2C write: failed 4
Net:   ppc_4xx_eth0
RESET is un-pushed

Set serverpath and run meraki_netboot to netboot

Hit any key to stop autoboot:  0
Creating 1 MTD partitions on "nand0":
0x000000180000-0x000002000000 : "mtd=2"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size:   16384 bytes (16 KiB)
UBI: logical eraseblock size:    15872 bytes
UBI: smallest flash I/O unit:    512
UBI: sub-page size:              256
UBI: VID header offset:          256 (aligned 256)
UBI: data offset:                512
UBI: attached mtd1 to ubi0
UBI: MTD device name:            "mtd=2"
UBI: MTD device size:            30 MiB
UBI: number of good PEBs:        1952
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       92
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     4
UBI: available PEBs:             266
UBI: total number of reserved PEBs: 1686
UBI: number of PEBs reserved for bad PEB handling: 19
UBI: max/mean erase counter: 344/276
Volume part1 found at volume id 0
read 0 bytes from volume 0 to c00000(buf address)
Read [8983552] bytes
## Booting kernel from Legacy Image at 00c10000 ...
   Image Name:   Linux-3.4.106+
   Created:      2015-09-21  21:46:57 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    1550370 Bytes = 1.5 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 00e00000 ...
   Image Name:   Simple Ramdisk Image
   Created:      2015-09-21  21:47:12 UTC
   Image Type:   PowerPC Linux RAMDisk Image (lzma compressed)
   Data Size:    5205373 Bytes = 5 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 00c00400
   Booting using the fdt blob at 0xc00400
   Uncompressing Kernel Image ... OK
   Loading Ramdisk to 07677000, end 07b6dd7d ... OK
[    0.000000] Using PowerPC 44x Platform machine description
[    0.000000] Linux version 3.4.106+ (meraki@buildbot104.meraki.com) (gcc version 4.8.3 (GCC) ) #4 Mon Sep 21 14:46:48 PDT 2015
[    0.000000] Found initrd at 0xc7677000:0xc7b6dd7d
[    0.000000] Zone PFN ranges:
[    0.000000]   DMA      0x00000000 -> 0x00002000
[    0.000000]   Normal   empty
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00002000
[    0.000000] MMU: Allocated 1088 bytes of context maps for 255 contexts
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8176
[    0.000000] Kernel command line: root=/dev/ram console=ttyS0,115200 ubi.mtd=ubi MERAKI_BOARD=mr24 mtdoops.mtddev=oops
[    0.000000] PID hash table entries: 512 (order: -3, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 2, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 1, 32768 bytes)
[    0.000000] Memory: 122208k/131072k available (2960k kernel code, 8864k reserved, 176k data, 91k bss, 160k init)
[    0.000000] Kernel virtual memory layout:
[    0.000000]   * 0xfffdc000..0xffffc000  : fixmap
[    0.000000]   * 0xfd600000..0xfe000000  : consistent mem
[    0.000000]   * 0xfd600000..0xfd600000  : early ioremap
[    0.000000]   * 0xd1000000..0xfd600000  : vmalloc & ioremap
[    0.000000] SLUB: Genslabs=15, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:512 nr_irqs:512 16
[    0.000000] UIC0 (32 IRQ sources) at DCR 0xc0
[    0.000000] UIC1 (32 IRQ sources) at DCR 0xd0
[    0.000000] UIC2 (32 IRQ sources) at DCR 0xe0
[    0.000000] UIC3 (32 IRQ sources) at DCR 0xf0
[    0.000000] clocksource: timebase mult[1400000] shift[24] registered
[    0.000067] pid_max: default: 32768 minimum: 301
[    0.000241] Mount-cache hash table entries: 2048
[    0.003010] devtmpfs: initialized
[    0.003533] NET: Registered protocol family 16
[    0.005720] 256k L2-cache enabled
[    0.005808] PCIE0: Checking link...
[    0.005815] PCIE0: Device detected, waiting for link...
[    0.005824] PCIE0: link is up !
[    0.110621] PCI host bridge /plb/pciex@d00000000 (primary) ranges:
[    0.110647]  MEM 0x0000000e00000000..0x0000000e7fffffff -> 0x0000000080000000
[    0.110662]  MEM 0x0000000f00000000..0x0000000f000fffff -> 0x0000000000000000
[    0.110676]   IO 0x0000000f80000000..0x0000000f8000ffff -> 0x0000000000000000
[    0.110690]  Removing ISA hole at 0x0000000f00000000
[    0.110704] 4xx PCI DMA offset set to 0x00000000
[    0.110712] 4xx PCI DMA window base to 0x0000000000000000
[    0.110720] DMA window size 0x0000000080000000
[    0.110737] /plb/pciex@d00000000: Legacy ISA memory support enabled
[    0.110756] PCIE0: successfully set as root-complex
[    0.111148] gpiochip_add: registered GPIOs 224 to 255 on device: /plb/opb/gpio@ef600b00
[    0.111400] PCI: Probing PCI hardware
[    0.111563] PCI host bridge to bus 0000:40
[    0.111580] pci_bus 0000:40: root bus resource [io  0x0000-0xffff]
[    0.111596] pci_bus 0000:40: root bus resource [mem 0xe00000000-0xe7fffffff] (bus address [0x80000000-0xffffffff])
[    0.111709] PCI: Hiding 4xx host bridge resources 0000:40:00.0
[    0.111949] pci 0000:40:00.0: PCI bridge to [bus 41-7f]
[    0.111988] pci 0000:41:00.0: bridge configuration invalid ([bus 02-04]), reconfiguring
[    0.112363] pci 0000:41:00.0: PCI bridge to [bus 42-ff]
[    0.112410] pci 0000:42:02.0: bridge configuration invalid ([bus 03-03]), reconfiguring
[    0.112428] pci 0000:42:03.0: bridge configuration invalid ([bus 04-04]), reconfiguring
[    0.112725] pci 0000:42:02.0: PCI bridge to [bus 43-ff]
[    0.113122] pci 0000:42:03.0: PCI bridge to [bus 44-ff]
[    0.114685] pci 0000:40:00.0: BAR 8: assigned [mem 0xe00000000-0xe001fffff]
[    0.114702] pci 0000:40:00.0: BAR 9: assigned [mem 0xe00200000-0xe003fffff pref]
[    0.114719] pci 0000:41:00.0: BAR 8: assigned [mem 0xe00000000-0xe001fffff]
[    0.114733] pci 0000:41:00.0: BAR 9: assigned [mem 0xe00200000-0xe003fffff pref]
[    0.114749] pci 0000:42:02.0: BAR 8: assigned [mem 0xe00000000-0xe000fffff]
[    0.114763] pci 0000:42:02.0: BAR 9: assigned [mem 0xe00200000-0xe002fffff pref]
[    0.114777] pci 0000:42:03.0: BAR 8: assigned [mem 0xe00100000-0xe001fffff]
[    0.114791] pci 0000:42:03.0: BAR 9: assigned [mem 0xe00300000-0xe003fffff pref]
[    0.114807] pci 0000:43:00.0: BAR 0: assigned [mem 0xe00000000-0xe0001ffff 64bit]
[    0.114829] pci 0000:43:00.0: BAR 6: assigned [mem 0xe00200000-0xe0020ffff pref]
[    0.114843] pci 0000:42:02.0: PCI bridge to [bus 43-43]
[    0.114857] pci 0000:42:02.0:   bridge window [mem 0xe00000000-0xe000fffff]
[    0.114871] pci 0000:42:02.0:   bridge window [mem 0xe00200000-0xe002fffff pref]
[    0.114889] pci 0000:44:00.0: BAR 0: assigned [mem 0xe00100000-0xe0011ffff 64bit]
[    0.114910] pci 0000:44:00.0: BAR 6: assigned [mem 0xe00300000-0xe0030ffff pref]
[    0.114922] pci 0000:42:03.0: PCI bridge to [bus 44-44]
[    0.114936] pci 0000:42:03.0:   bridge window [mem 0xe00100000-0xe001fffff]
[    0.114949] pci 0000:42:03.0:   bridge window [mem 0xe00300000-0xe003fffff pref]
[    0.114964] pci 0000:41:00.0: PCI bridge to [bus 42-44]
[    0.114977] pci 0000:41:00.0:   bridge window [mem 0xe00000000-0xe001fffff]
[    0.114991] pci 0000:41:00.0:   bridge window [mem 0xe00200000-0xe003fffff pref]
[    0.115006] pci 0000:40:00.0: PCI bridge to [bus 41-7f]
[    0.115018] pci 0000:40:00.0:   bridge window [mem 0xe00000000-0xe001fffff]
[    0.115032] pci 0000:40:00.0:   bridge window [mem 0xe00200000-0xe003fffff pref]
[    0.119737] bio: create slab <bio-0> at 0
[    0.121062] Switching to clocksource timebase
[    0.122976] NET: Registered protocol family 2
[    0.129839] IP route cache hash table entries: 4096 (order: 0, 16384 bytes)
[    0.130118] TCP established hash table entries: 4096 (order: 1, 32768 bytes)
[    0.130245] TCP bind hash table entries: 4096 (order: 0, 16384 bytes)
[    0.130310] TCP: Hash tables configured (established 4096 bind 4096)
[    0.130320] TCP: reno registered
[    0.130332] UDP hash table entries: 1024 (order: 0, 16384 bytes)
[    0.130389] UDP-Lite hash table entries: 1024 (order: 0, 16384 bytes)
[    0.130592] NET: Registered protocol family 1
[    0.130808] Unpacking initramfs...
[    4.734697] Freeing initrd memory: 5104k freed
[    5.085330] msgmni has been set to 248
[    5.095778] io scheduler noop registered
[    5.095793] io scheduler deadline registered (default)
[    5.118529] Serial: 8250/16550 driver, 1 ports, IRQ sharing enabled
[    5.150727] serial8250.0: ttyS0 at MMIO 0x4ef600400 (irq = 21) is a U6_16550A
[    5.738621] console [ttyS0] enabled
[    5.754225] 4ef600400.serial: ttyS0 at MMIO 0x4ef600400 (irq = 21) is a 16550
[    5.769439] Trying to register dev faulty etc
[    5.802074] NAND device: Manufacturer ID: 0xad, Chip ID: 0x75 (Hynix NAND 32MiB 3,3V 8-bit)
[    5.810413] Scanning device for bad blocks
[    5.920759] 4 ofpart partitions found on MTD device 4e4000000.ndfc.nand
[    5.927395] Creating 4 MTD partitions on "4e4000000.ndfc.nand":
[    5.933302] 0x000000000000-0x000000170000 : "firmware"
[    5.949329] 0x000000170000-0x000000180000 : "oops"
[    5.963656] mtdoops: Attached to MTD device 1
[    5.978216] 0x000000180000-0x000002000000 : "ubi"
[    5.999544] 0x000000000000-0x000002000000 : "all"
[    6.033127] UBI: attaching mtd2 to ubi0
[    6.036965] UBI: physical eraseblock size:   16384 bytes (16 KiB)
[    6.043070] UBI: logical eraseblock size:    15872 bytes
[    6.048355] UBI: smallest flash I/O unit:    512
[    6.052957] UBI: sub-page size:              256
[    6.057558] UBI: VID header offset:          256 (aligned 256)
[    6.063375] UBI: data offset:                512
[    6.237779] UBI: max. sequence number:       539115
[    6.268811] UBI: attached mtd2 to ubi0
[    6.272599] UBI: MTD device name:            "ubi"
[    6.277367] UBI: MTD device size:            30 MiB
[    6.282228] UBI: number of good PEBs:        1952
[    6.286914] UBI: number of bad PEBs:         0
[    6.291343] UBI: number of corrupted PEBs:   0
[    6.295770] UBI: max. allowed volumes:       92
[    6.300280] UBI: wear-leveling threshold:    4096
[    6.304968] UBI: number of internal volumes: 1
[    6.309395] UBI: number of user volumes:     4
[    6.313825] UBI: available PEBs:             247
[    6.318424] UBI: total number of reserved PEBs: 1705
[    6.323372] UBI: number of PEBs reserved for bad PEB handling: 38
[    6.329441] UBI: max/mean erase counter: 344/276
[    6.334043] UBI: image sequence number:  1992864020
[    6.338998] UBI: background thread "ubi_bgt0d" started, PID 386
[    6.407247] PPC 4xx OCP EMAC driver, version 3.54
[    6.412345] MAL v2 /plb/mcmal, 1 TX channels, 1 RX channels
[    6.427522] RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
[    6.434989] TAH /plb/opb/emac-tah@ef601350 initialized
[    6.444130] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
[    6.459289] eth0: EMAC-0 /plb/opb/ethernet@ef600c00, MAC 00:01:73:01:23:41
[    6.466187] eth0: found Atheros 8305 Gigabit Ethernet PHY (0x01)
[    6.480232] input: gpio_keys_polled.6 as /devices/plb.0/opb.3/gpio_keys_polled.6/input/input0
[    6.502956] i2c /dev entries driver
[    6.518655] ibm-iic 4ef600700.i2c: using standard (100 kHz) mode
[    6.530865] rtc-m41t80 0-0068: chip found, driver version 0.05
[    6.538552] rtc-m41t80 0-0068: read error
[    6.545047] rtc-m41t80 0-0068: rtc core: registered m41t80 as rtc0
[    6.553019] rtc-m41t80 0-0068: Can't clear HT bit
[    6.560046] rtc-m41t80: probe of 0-0068 failed with error -5
[    6.576204] ibm-iic 4ef600800.i2c: using standard (100 kHz) mode
[    6.589979] lm90 0-004c: Register 0x4 read failed (-121)
[    6.595319] lm90 0-004c: Failed to read convrate register!
[    6.602760] lm90 0-004c: Register 0x3 read failed (-121)
[    6.608057] lm90 0-004c: Initialization failed!
[    7.451090] booke_wdt: powerpc book-e watchdog driver loaded
[    7.487620] oprofile: using timer interrupt.
[    7.492112] TCP: bic registered
[    7.495245] TCP: cubic registered
[    7.498545] TCP: westwood registered
[    7.502113] TCP: htcp registered
[    7.505332] NET: Registered protocol family 17
[    7.530545] /disk/instance1/meraki/buildslave/build_powerpc-upload-r23/build/linux-3.4/drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[    7.543347] ### of_selftest(): No testcase data in device tree; not running tests
[    7.550937] devtmpfs: mounted
[    7.556752] Freeing unused kernel memory: 160k freed
[    7.564662] Made it into bootsh: Sep 21 2015 14:37:58
[    7.569859] bootsh build 23-177858
[    7.586087] UBIFS: recovery needed
[    7.608687] UBIFS: recovery completed
[    7.612363] UBIFS: mounted UBI device 0, volume 3, name "storage"
[    7.618438] UBIFS: file system size:   8237568 bytes (8044 KiB, 7 MiB, 519 LEBs)
[    7.625812] UBIFS: journal size:       412672 bytes (403 KiB, 0 MiB, 26 LEBs)
[    7.632922] UBIFS: media format:       w4/r0 (latest is w4/r0)
[    7.638729] UBIFS: default compressor: lzo
[    7.642813] UBIFS: reserved for root:  389080 bytes (379 KiB)
init started: BusyBox v1.20.2 (2015-09-21 13:46:14 PDT)
[    7.775551] Sat Jan  1 00:00:00 UTC 2000
WARNING! THIS CONSOLE IS LOGGED! UNAUTHORIZED ACCESS FORBIDDEN!
<Meraki> [    7.869954] sh: write error: Device or resource busy
[    7.875034] /etc/init.d/S10boot: line 201: can't create /sys/class/gpio/gpio240/direction: nonexistent directory
[    7.976531] sysctl: error: 'vm.extfrag_threshold' is an unknown key
[    8.063560] wired0: link is down
[    8.216085] sysctl -w vm.panic_on_oom=2
[    8.226773] vm.panic_on_oom = 2
[    8.438708] click: starting router thread pid 689 (c6172200)
[    8.512634] elts_meraki: module license 'unspecified' taints kernel.
[    8.749820] Single synchronous check for reset
[    8.772413]
[    8.780298] boot 38 build 23-177858 board powerpc mac 00:18:0A:27:2D:F2
[    8.791316] Module: dummy  .text=0xd1120000 .data=0xd1120540 .bss=
[    8.791329] Module: proclikefs  .text=0xd1138000 .data= .bss=0xd1138d40
[    8.791335] Module: merakiclick  .text=0xd5b40000 .data=0xd5c4611c .bss=0xd5c465a0
[    8.791341] Module: elts_meraki  .text=0xd6034000 .data=0xd62324a4 .bss=0xd6232c0c
[   20.056828] adf: module license 'Proprietary' taints kernel.
[   20.068457] asf: module license 'Proprietary' taints kernel.
[   20.100276] ath_hal: module license 'Proprietary' taints kernel.
[   20.128504] ath_hal: 0.9.17.1 (AR5416, AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
[   20.147048] ath_dfs: module license 'Proprietary' taints kernel.
[   20.155833] ath_dfs: Version 2.0.0
[   20.155840] Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
[   20.177669] ath_rate_atheros: module license 'Proprietary' taints kernel.
[   20.186694] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
[   20.209137] ath_dev: module license 'Proprietary' taints kernel.
[   20.229447] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
[   20.247984] ath_pktlog: module license 'unspecified' taints kernel.
[   20.314162] ath_pci: 9.5.5.36 (Atheros/multi-bss)
[   20.318999] __ath_attach: Set global_scn[0]
[   20.323218] ACBKMinfree = 48
[   20.326085] ACBEMinfree = 32
[   20.328954] ACVIMinfree = 16
[   20.331827] ACVOMinfree = 0
[   20.334613] CABMinfree = 48
[   20.337395] UAPSDMinfree = 0
[   20.537255] ath_get_caps[6084] rx chainmask mismatch actual 7 sc_chainmak 0
[   20.544218] ath_get_caps[6058] tx chainmask mismatch actual 7 sc_chainmak 0
[   20.577076] wifi0: Atheros 9380: mem=0xe00000000, irq=19 hw_base=0xd6780000
[   20.584194] __ath_attach: Set global_scn[1]
[   20.588362] ACBKMinfree = 48
[   20.591244] ACBEMinfree = 32
[   20.594115] ACVIMinfree = 16
[   20.596983] ACVOMinfree = 0
[   20.599766] CABMinfree = 48
[   20.602553] UAPSDMinfree = 0
[   20.789803] ath_get_caps[6084] rx chainmask mismatch actual 7 sc_chainmak 0
[   20.796772] ath_get_caps[6058] tx chainmask mismatch actual 7 sc_chainmak 0
[   20.817332] wifi1: Atheros 9380: mem=0xe00100000, irq=20 hw_base=0xd67c0000
[   20.901522] brain: unloading click config
[   20.905717] brain: spring cleaning pages
[   20.946464] wlan_vap_create : enter. devhandle=0xc60343a0, opmode=IEEE80211_M_HOSTAP, flags=0x0
[   20.955555] wlan_vap_create : exit. devhandle=0xc60343a0, opmode=IEEE80211_M_HOSTAP, flags=0x0.
[   21.395069] wlan_vap_create : enter. devhandle=0xc603c3a0, opmode=IEEE80211_M_HOSTAP, flags=0x0
[   21.404156] wlan_vap_create : exit. devhandle=0xc603c3a0, opmode=IEEE80211_M_HOSTAP, flags=0x0.

I see old support for PPC 44x devices and no recent changes so maybe a lot of this work is already complete?  Happy to help however I can.

Thanks tmo26!  I see there is only one other Applied Micro APM82181 device in the TOH, the Netgear WNDR4700.  Unfortunately it doesn't look like it's supported despite natively running an OEM-modified OpenWRT, and the thread for it seemed to die off.

Confirmed within my Stock Boot post at the top, found these lines:

[   20.577076] wifi0: Atheros 9380: mem=0xe00000000, irq=19 hw_base=0xd6780000
[   20.817332] wifi1: Atheros 9380: mem=0xe00100000, irq=20 hw_base=0xd67c0000

Check out this mad antenna layout smile
http://i63.tinypic.com/sbhi6o.jpg

Thought I would add this too

=> printenv
bootdelay=1
baudrate=115200
loads_echo=
preboot=echo;echo Set serverpath and run meraki_netboot to netboot;echo
nload=${netloadmethod} 600000 ${serverpath}u-boot-nand.bin
nupdate=nand erase 0 0x00170000 ;nand write 600000 0 0x00100000
nupd=run nload nupdate
kernel_addr=fc000000
fdt_addr=fc1e0000
ramdisk_addr=fc200000
pciconfighost=1
pcie_mode=RP:RP
netdev=eth0
netloadmethod=dhcp
ethact=ppc_4xx_eth0
ethaddr=00:01:73:01:23:41
boardtype=pcie
mtd_addr_r=0x4000000
kernel_size=0x400000
fdt_size=0x25000
bootcmd=run meraki_boot
meraki_bootargs=setenv bootargs root=/dev/ram console=ttyS0,${baudrate} ubi.mtd=ubi MERAKI_BOARD=mr24 mtdoops.mtddev=oops ${extra_bootargs}
meraki_bootfile=mr24.bin
meraki_bootlinux=bootm ${meraki_loadaddr_kernel} ${meraki_loadaddr_ramdisk} ${meraki_loadaddr_fdt}
meraki_boot=run meraki_ubi meraki_bootargs ; run meraki_load1 meraki_checkpart meraki_bootlinux; run meraki_load2 meraki_bootlinux
meraki_checkpart=meraki checkpart ${meraki_loadaddr}
meraki_netboot=run meraki_load_net meraki_bootargs meraki_bootlinux
meraki_loadaddr=c00000
meraki_loadaddr_kernel=c10000
meraki_loadaddr_fdt=c00400
meraki_loadaddr_ramdisk=e00000
meraki_load1=ubi read ${meraki_loadaddr} part1
meraki_load2=ubi read ${meraki_loadaddr} part2
meraki_load_net=${netloadmethod} ${meraki_loadaddr} ${serverpath}${meraki_bootfile}
meraki_ubi=ubi part ubi
meraki_ubifile=mr24-ubi.bin
meraki_ubi_loadfile=${netloadmethod} 600000 ${serverpath}${meraki_ubifile}
meraki_ubi_update_nand=nand erase 0x00180000 0x01e80000 ; nand write 600000 0x00180000 ${filesize}
meraki_ubi_update=run meraki_ubi_loadfile meraki_ubi_update_nand
meraki_update_part1=run meraki_ubi meraki_load_net meraki_write1
meraki_update_part2=run meraki_ubi meraki_load_net meraki_write2
meraki_write1=ubi write ${meraki_loadaddr} part1 ${filesize}
meraki_write2=ubi write ${meraki_loadaddr} part2 ${filesize}
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x00170000@0(firmware),0x00010000@0x00170000(panic),0x01e80000@0x00180000(ubi)
ipaddr=192.168.1.1
serverip=192.168.1.101
gatewayip=192.168.1.1
netmask=255.255.255.0
factory_cmdline=setenv bootargs root=/dev/ram ramdisk_size=${factory_ramdisk_size} rw ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}:${netdev}:off panic=1 console=ttyS1,${baudrate}
factory_ramdisk_file=uRamdisk
factory_bootfile=uImage
factory_fdt_file=bluestone.dtb
factory_kernel_addr_r=0x600000
factory_fdt_addr_r=0xa00000
factory_mtd_addr_r=0x4000000
factory_ramdisk_size=0x200000
factory_boot=tftp ${factory_kernel_addr_r} ${factory_bootfile};tftp ${factory_fdt_addr_r} ${factory_fdt_file};tftp ${factory_mtd_addr_r} ${factory_ramdisk_file};run factory_cmdline;bootm ${factory_kernel_addr_r} ${factory_mtd_addr_r} ${factory_fdt_addr_r}
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 2010.06-00036-g4e1a276 Meraki MR24 (May 11 2012 - 16:57:49)

Environment size: 2848/16379 bytes
=> mtdparts

device nand0 <nand0>, # parts = 3
 #: name                size            offset          mask_flags
 0: firmware            0x00170000      0x00000000      0
 1: panic               0x00010000      0x00170000      0
 2: ubi                 0x01e80000      0x00180000      0

active partition: nand0,0 - (firmware) 0x00170000 @ 0x00000000

defaults:
mtdids  : none
mtdparts: none

I built OpenWRT with ppc44x support and have tried booting openwrt-ppc44x-uImage with tftpboot from various addresses.  I guess either I don't fully understand where that location comes from or I have a bad uImage file that wouldn't work regardless.  I've used the MR16 location of 0x81000000, changing the boot file of course, and it goes all glitched and resets then boots from the Meraki image.  If I change the address around I get it to load and stop without resetting but that's all:

=> tftpboot 0x4000000 openwrt-ppc44x-uImage; bootm
Waiting for PHY auto negotiation to complete... done
ENET Speed is 1000 Mbps - FULL duplex connection (EMAC0)
Using ppc_4xx_eth0 device
TFTP from server 192.168.1.101; our IP address is 192.168.1.1
Filename 'openwrt-ppc44x-uImage'.
Load address: 0x4000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####
done
Bytes transferred = 1685700 (19b8c4 hex)
## Booting kernel from Legacy Image at 04000000 ...
   Image Name:   Linux-3.18.26
   Created:      2016-02-02  17:14:47 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    1685636 Bytes = 1.6 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
=> bdinfo
memstart    = 0x00000000
memsize     = 0x08000000
flashstart  = 0x00000000
flashsize   = 0x00000000
flashoffset = 0x00000000
sramstart   = 0x00000000
sramsize    = 0x00000000
bootflags   = 0x00000002
intfreq     =    800 MHz
busfreq     =    200 MHz
ethaddr     = 00:01:73:01:23:41
IP addr     = 192.168.1.1
baudrate    = 115200 bps
relocaddr   = 0x07F74000

At 0x100000 I get this:

## Booting kernel from Legacy Image at 00100000 ...
   Image Name:   Linux-3.18.20
   Created:      2015-09-04  16:51:42 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    1516032 Bytes = 1.4 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... Error: inflate() returned -3
▒▒▒▒▒▒▒<$ncompress, out-of-mem or overwrite error - must RESET board to recover

And then it resets.

I got a little further but nothing spectacular.  I'm emulating the reset boot process where it looks for uImage, bluestone.dtb and uRamdisk files from TFTP.  I've created the uImage and uRamdisk files but I need the DTB file specific to this board.  Hopefully I'm missing something easy and I can pull it out of a memory location somewhere?  I grabbed a canyonlands.dtb and renamed it hoping to be in the right ballpark but no luck.

TFTP from server 192.168.1.101; our IP address is 192.168.1.1
Filename 'uImage'.
Load address: 0x600000
Loading: T #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####
done
Bytes transferred = 1685700 (19b8c4 hex)
Using ppc_4xx_eth0 device
TFTP from server 192.168.1.101; our IP address is 192.168.1.1
Filename 'bluestone.dtb'.
Load address: 0xa00000
Loading: ##########################
done
Bytes transferred = 131072 (20000 hex)
Using ppc_4xx_eth0 device
TFTP from server 192.168.1.101; our IP address is 192.168.1.1
Filename 'uRamdisk'.
Load address: 0x4000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###############
done
Bytes transferred = 5064160 (4d45e0 hex)
## Booting kernel from Legacy Image at 00600000 ...
   Image Name:   Linux-3.18.26
   Created:      2016-02-02  17:14:47 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    1685636 Bytes = 1.6 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 04000000 ...
   Image Name:   Linux PPC44x Ramdisk Image
   Created:      2016-02-17  15:33:15 UTC
   Image Type:   PowerPC Linux RAMDisk Image (gzip compressed)
   Data Size:    5064096 Bytes = 4.8 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 00a00000
   Booting using the fdt blob at 0xa00000
   Uncompressing Kernel Image ... OK
   Loading Ramdisk to 0769a000, end 07b6e5a0 ... OK
Unable to update property NAND0 NDFC mapping, err=FDT_ERR_NOTFOUND

(Last edited by tbs_david on 18 Feb 2016, 14:01)

Alright I can get to a point, using the factory boot commands, where the bluestone.dtb file I need is loaded into memory at 0xc00400 size 0x25000 - how can I get this copied off to elsewhere?  The limited shell doesn't have dd or netcat or a true tftp client (just tftpboot command).  Here's what's available under help:

=> help
?       - alias for 'help'
askenv  - get environment variables from stdin
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
chip_config- program the I2C bootstrap EEPROM
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
cpuclk  - cpuclk - change cpu clock frequency

crc32   - checksum calculation
date    - get/set/reset date & time
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
editenv - edit environment variable
eeprom  - EEPROM sub-system
exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
getdcr  - Get an AMCC PPC 4xx DCR's value
getidcr - Get a register value via indirect DCR addressing
go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
icache  - enable or disable instruction cache
iminfo  - print header information for application image
imxtract- extract a part of a multi-image
interrupts- enable or disable interrupts
irqinfo - print information about IRQs
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
loopw   - infinite write loop on address range
md      - memory display
mdc     - memory display cyclic
meraki  - Meraki sub-system
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
mwc     - memory write cyclic
nand    - NAND sub-system
nboot   - boot from NAND device
ndfc    - ndfc - enable|disable NDFC

nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pca9670 - pca953x gpio access
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reginfo - print register information
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
sdram_config- sdram_config - Configure SDRAM as 32-bit or 16-bit

setdcr  - Set an AMCC PPC 4xx DCR's value
setenv  - set environment variables
setidcr - Set a register value via indirect DCR addressing
showvar - print local hushshell variables
sleep   - delay execution for some time
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
ubi     - ubi commands
version - print monitor version

I had an idea and it seemed to have worked...to a point.  I loaded the Meraki stuff into memory using info from printenv commands, following the normal boot process, but then I used md to display the address and alleged length of the bluestone.dtb FDT file to the terminal, captured it, stripped it down to hex only, pasted it into HxD and saved it back to the TFTP server.  Whew!

Then I had the idea since I now have the alleged FDT and I know where the Meraki kernel and ramdisk are, maybe I'll just try booting their kernel with my ramdisk...but I get this error.

[    0.130810] Unpacking initramfs...
[    0.130822] Initramfs unpacking failed: junk in compressed archive

Doh!

I fired up another MR24 unit with an older build on it (4/2015 instead of 9/2015) but have the same limitations.  At the common Meraki rooting method doesn't work on either of these.  I have more which are probably even older but I'd have to find them.

And just in time, I found an original MR24 never installed with 2013 dates on it! FW 20-102298!  Let it boot up to find it drops me right into the system shell.

U-Boot 2010.06-00036-g4e1a276 Meraki MR24 (May 11 2012 - 16:57:49)

CPU:   AMCC PowerPC  UNKNOWN (PVR=12c41c83) at 800 MHz (PLB=200 OPB=100 EBC=100)
       Bootstrap Option H - Boot ROM Location I2C (Addr 0x52), booting from NAND
       32 kB I-Cache 32 kB D-Cache
Board: MR24 - Meraki MR24 Cloud Managed Access Point
============================
BoardID: 0 0
POE-PWR_DET Status: 0
ADAPTER_DET Status: 1
Reset Button Status: 1
============================
SDR0_PERCLK=0x40000300
I2C:   ready
DRAM:  128 MiB
I2C write: failed 4
NAND:  32 MiB
*** Warning - bad CRC or NAND, using default environment

Configure Max Payload 256B
PCIE0: successfully set as root-complex
        03  00  168c  0030  0280  ff
        02  02  111d  8039  0604  00
        04  00  168c  0030  0280  ff
        02  03  111d  8039  0604  00
        01  00  111d  8039  0604  00
I2C read: failed 4
I2C write: failed 4
I2C read: failed 4
I2C read: failed 4
I2C write: failed 4
Net:   ppc_4xx_eth0
RESET is un-pushed

Set serverpath and run meraki_netboot to netboot

Hit any key to stop autoboot:  0
Creating 1 MTD partitions on "nand0":
0x000000180000-0x000002000000 : "mtd=2"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size:   16384 bytes (16 KiB)
UBI: logical eraseblock size:    15872 bytes
UBI: smallest flash I/O unit:    512
UBI: sub-page size:              256
UBI: VID header offset:          256 (aligned 256)
UBI: data offset:                512
UBI: attached mtd1 to ubi0
UBI: MTD device name:            "mtd=2"
UBI: MTD device size:            30 MiB
UBI: number of good PEBs:        1952
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       92
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     4
UBI: available PEBs:             340
UBI: total number of reserved PEBs: 1612
UBI: number of PEBs reserved for bad PEB handling: 19
UBI: max/mean erase counter: 2/1
Volume part1 found at volume id 0
read 0 bytes from volume 0 to c00000(buf address)
Read [8396288] bytes
## Booting kernel from Legacy Image at 00c10000 ...
   Image Name:   Linux-2.6.32.59
   Created:      2013-02-01   1:35:25 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    1477742 Bytes = 1.4 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 00e00000 ...
   Image Name:   Simple Ramdisk Image
   Created:      2013-02-01   1:35:33 UTC
   Image Type:   PowerPC Linux RAMDisk Image (lzma compressed)
   Data Size:    5817263 Bytes = 5.5 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 00c00400
   Booting using the fdt blob at 0xc00400
   Uncompressing Kernel Image ... OK
   Loading Ramdisk to 075e2000, end 07b6e3af ... OK
[    0.000000] Using PowerPC 44x Platform machine description
[    0.000000] Linux version 2.6.32.59 (meraki@buildbot101.meraki.com) (gcc version 4.7.1 (GCC) ) #2 Thu Jan 31 17:35:19 PST 2013
[    0.000000] Found initrd at 0xc75e2000:0xc7b6e3af
[    0.000000] Zone PFN ranges:
[    0.000000]   DMA      0x00000000 -> 0x00002000
[    0.000000]   Normal   0x00002000 -> 0x00002000
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00002000
[    0.000000] MMU: Allocated 1088 bytes of context maps for 255 contexts
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8176
[    0.000000] Kernel command line: root=/dev/ram console=ttyS0,115200 ubi.mtd=ubi MERAKI_BOARD=mr24 mtdoops.mtddev=oops
[    0.000000] PID hash table entries: 512 (order: -3, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 2, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 1, 32768 bytes)
[    0.000000] Memory: 121760k/131072k available (2864k kernel code, 9312k reserved, 224k data, 93k bss, 160k init)
[    0.000000] Kernel virtual memory layout:
[    0.000000]   * 0xffff8000..0xffffc000  : fixmap
[    0.000000]   * 0xfd600000..0xfe000000  : consistent mem
[    0.000000]   * 0xfd600000..0xfd600000  : early ioremap
[    0.000000]   * 0xd1000000..0xfd600000  : vmalloc & ioremap
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:512
[    0.000000] UIC0 (32 IRQ sources) at DCR 0xc0
[    0.000000] UIC1 (32 IRQ sources) at DCR 0xd0
[    0.000000] UIC2 (32 IRQ sources) at DCR 0xe0
[    0.000000] UIC3 (32 IRQ sources) at DCR 0xf0
[    0.000000] WARNING: Estimating plb frequency (not found)
[    0.000000] clocksource: timebase mult[500000] shift[22] registered
[   10.738388] Mount-cache hash table entries: 2048
[   10.741308] NET: Registered protocol family 16
[   10.743325] OCM1: 32768 Bytes (enabled)
[   10.743498] OCM1: 32768 Bytes (non-cached)
[   10.743504] OCM1: 0 Bytes (cached)
[   10.743640] 256k L2-cache enabled
[   10.743724] PCIE0: Checking link...
[   10.743733] PCIE0: Device detected, waiting for link...
[   10.743739] PCIE0: link is up !
[   10.847964] PCI host bridge /plb/pciex@d00000000 (primary) ranges:
[   10.847994]  MEM 0x0000000e00000000..0x0000000e7fffffff -> 0x0000000080000000
[   10.848006]  MEM 0x0000000f00000000..0x0000000f000fffff -> 0x0000000000000000
[   10.848017]   IO 0x0000000f80000000..0x0000000f8000ffff -> 0x0000000000000000
[   10.848027]  Removing ISA hole at 0x0000000f00000000
[   10.848039] 4xx PCI DMA offset set to 0x00000000
[   10.848049] /plb/pciex@d00000000: Legacy ISA memory support enabled
[   10.848063] PCIE0: successfully set as root-complex
[   10.848636] PCI: Probing PCI hardware
[   10.848857] PCI: Hiding 4xx host bridge resources 0000:40:00.0
[   10.848995] pci 0000:41:00.0: PME# supported from D0 D3hot D3cold
[   10.849005] pci 0000:41:00.0: PME# disabled
[   10.849156] pci 0000:42:02.0: PME# supported from D0 D3hot D3cold
[   10.849165] pci 0000:42:02.0: PME# disabled
[   10.849254] pci 0000:42:03.0: PME# supported from D0 D3hot D3cold
[   10.849262] pci 0000:42:03.0: PME# disabled
[   10.849529] pci 0000:43:00.0: PME# supported from D0 D1 D3hot
[   10.849538] pci 0000:43:00.0: PME# disabled
[   10.849857] pci 0000:44:00.0: PME# supported from D0 D1 D3hot
[   10.849866] pci 0000:44:00.0: PME# disabled
[   10.851314] pci 0000:42:02.0: PCI bridge, secondary bus 0000:43
[   10.851323] pci 0000:42:02.0:   IO window: disabled
[   10.851333] pci 0000:42:02.0:   MEM window: 0x80000000-0x800fffff
[   10.851343] pci 0000:42:02.0:   PREFETCH window: 0x80200000-0x802fffff
[   10.851362] pci 0000:42:03.0: PCI bridge, secondary bus 0000:44
[   10.851369] pci 0000:42:03.0:   IO window: disabled
[   10.851378] pci 0000:42:03.0:   MEM window: 0x80100000-0x801fffff
[   10.851387] pci 0000:42:03.0:   PREFETCH window: 0x80300000-0x803fffff
[   10.851397] pci 0000:41:00.0: PCI bridge, secondary bus 0000:42
[   10.851404] pci 0000:41:00.0:   IO window: disabled
[   10.851413] pci 0000:41:00.0:   MEM window: 0x80000000-0x801fffff
[   10.851421] pci 0000:41:00.0:   PREFETCH window: 0x80200000-0x803fffff
[   10.851432] pci 0000:40:00.0: PCI bridge, secondary bus 0000:41
[   10.851438] pci 0000:40:00.0:   IO window: disabled
[   10.851446] pci 0000:40:00.0:   MEM window: 0x80000000-0x801fffff
[   10.851455] pci 0000:40:00.0:   PREFETCH window: 0x80200000-0x803fffff
[   10.851645] CPM0: pm-iic-device resource /plb/opb/i2c@ef600700
[   10.851664] CPM0: pm-emac-device resource /plb/opb/ethernet@ef600c00
[   10.851677] CPM0: DCR at 0x160
[   10.851705] CPM: ocm suspend address 0xd1010000
[   10.851710] CPM: ocm resume address 0xd1010400
[   10.851716] CPM: ocm data address 0xd10107d0
[   10.854773] bio: create slab <bio-0> at 0
[   10.855539] Switching to clocksource timebase
[   10.856774] NET: Registered protocol family 2
[   10.857009] IP route cache hash table entries: 4096 (order: 0, 16384 bytes)
[   10.857724] TCP established hash table entries: 4096 (order: 1, 32768 bytes)
[   10.857835] TCP bind hash table entries: 4096 (order: 0, 16384 bytes)
[   10.857904] TCP: Hash tables configured (established 4096 bind 4096)
[   10.857911] TCP reno registered
[   10.858049] NET: Registered protocol family 1
[   10.858211] Unpacking initramfs...
[   15.557965] Freeing initrd memory: 5680k freed
[   15.612175] msgmni has been set to 248
[   15.615466] async_tx: api initialized (async)
[   15.615512] io scheduler noop registered
[   15.615519] io scheduler deadline registered (default)
[   15.627252] Trying to register dev faulty etc
[   15.632927] Serial: 8250/16550 driver, 1 ports, IRQ sharing enabled
[   15.638518] serial8250.0: ttyS0 at MMIO 0x4ef600400 (irq = 21) is a 16550A
[   16.154260] console [ttyS0] enabled
[   16.163215] 4ef600400.serial: ttyS0 at MMIO 0x4ef600400 (irq = 21) is a 16550
[   16.177724] NAND device: Manufacturer ID: 0xad, Chip ID: 0x75 (Hynix NAND 32MiB 3,3V 8-bit)
[   16.186129] Scanning device for bad blocks
[   16.292615] Creating 4 MTD partitions on "4e4000000.ndfc.nand":
[   16.298521] 0x000000000000-0x000000170000 : "firmware"
[   16.311122] 0x000000170000-0x000000180000 : "oops"
[   16.319908] mtdoops: Attached to MTD device 1
[   16.329777] 0x000000180000-0x000002000000 : "ubi"
[   16.342010] 0x000000000000-0x000002000000 : "all"
[   16.359653] UBI: attaching mtd2 to ubi0
[   16.363581] UBI: physical eraseblock size:   16384 bytes (16 KiB)
[   16.369725] UBI: logical eraseblock size:    15872 bytes
[   16.375016] UBI: smallest flash I/O unit:    512
[   16.379619] UBI: sub-page size:              256
[   16.384218] UBI: VID header offset:          256 (aligned 256)
[   16.390029] UBI: data offset:                512
[   16.561272] UBI: max. sequence number:       1286
[   16.582814] UBI: attached mtd2 to ubi0
[   16.586612] UBI: MTD device name:            "ubi"
[   16.591379] UBI: MTD device size:            30 MiB
[   16.596240] UBI: number of good PEBs:        1952
[   16.600925] UBI: number of bad PEBs:         0
[   16.605349] UBI: number of corrupted PEBs:   0
[   16.609779] UBI: max. allowed volumes:       92
[   16.614292] UBI: wear-leveling threshold:    4096
[   16.618980] UBI: number of internal volumes: 1
[   16.623407] UBI: number of user volumes:     4
[   16.627836] UBI: available PEBs:             321
[   16.632437] UBI: total number of reserved PEBs: 1631
[   16.637383] UBI: number of PEBs reserved for bad PEB handling: 38
[   16.643453] UBI: max/mean erase counter: 2/1
[   16.647708] UBI: image sequence number:  1992864020
[   16.652702] UBI: background thread "ubi_bgt0d" started, PID 173
[   16.686770] PPC 4xx OCP EMAC driver, version 3.54
[   16.691639] mal0: descriptor-memory = ocm
[   16.695995] MAL: Enabled Interrupt Coal TxCnt: 32 RxCnt: 8
[   16.701463]                             TxTimer: 100000 RxTimer: 5000
[   16.707889] MAL v2 /plb/mcmal, 1 TX channels, 1 RX channels
[   16.716871] RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
[   16.724254] TAH /plb/opb/emac-tah@ef601350 initialized
[   16.732881] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
[   16.740657] eth0: EMAC-0 /plb/opb/ethernet@ef600c00, MAC 00:01:73:01:23:41
[   16.747543] eth0: found Atheros 8305 Gigabit Ethernet PHY (0x01)
[   16.760593] i2c /dev entries driver
[   16.771446] ibm-iic 4ef600700.i2c: using standard (100 kHz) mode
[   16.779566] rtc-m41t80 0-0068: chip found, driver version 0.05
[   16.788820] rtc-m41t80 0-0068: rtc core: registered m41t80 as rtc0
[   16.795120] rtc-m41t80 0-0068: Can't clear HT bit
[   16.800230] rtc-m41t80: probe of 0-0068 failed with error -5
[   16.811694] ibm-iic 4ef600800.i2c: using standard (100 kHz) mode
[   16.821201] lm90 0-004c: Register 0x3 read failed (-121)
[   16.826565] lm90 0-004c: Initialization failed!
[   17.365562] PowerPC Book-E Watchdog Timer Loaded
[   17.370563] apm82181-adma: Probing AMCC APM82181 ADMA engines...
[   17.385940] AMCC(R) APM82181 ADMA Engine found [1]: ( capabilities: memcpy )
[   17.392966] --------------- dma_async_device_register: 683-------------------------
[   17.404160] apm82181 adma1: allocated 512 descriptor slots
[   17.409839] AMCC(R) APM82181 ADMA Engine found [2]: ( capabilities: memcpy )
[   17.416877] --------------- dma_async_device_register: 683-------------------------
[   17.425077] apm82181 adma2: allocated 512 descriptor slots
[   17.430700] AMCC(R) APM82181 ADMA Engine found [3]: ( capabilities: memcpy )
[   17.437735] --------------- dma_async_device_register: 683-------------------------
[   17.448857] apm82181 adma3: allocated 512 descriptor slots
[   17.454553] AMCC(R) APM82181 ADMA Engine found [4]: ( capabilities: xor int )
[   17.461703] --------------- dma_async_device_register: 683-------------------------
[   17.469783] apm82181 adma4: allocated 204 descriptor slots
[   17.478498] oprofile: using timer interrupt.
[   17.483582] TCP bic registered
[   17.486662] TCP cubic registered
[   17.489879] TCP westwood registered
[   17.493352] TCP htcp registered
[   17.496494] NET: Registered protocol family 17
[   17.500945] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[   17.507708] All bugs added by David S. Miller <davem@redhat.com>
[   17.519659] /var/local/meraki/buildbot/buildslave/build_powerpc_upload/build/linux-2.6.32/drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
[   17.534450] Freeing unused kernel memory: 160k init
init started: BusyBox v1.20.2 (2013-01-31 16:57:37 PST)

Please press Enter to activate this console. [   17.567741] Sat Jan  1 00:00:00 UTC 2000
[   17.660908] UBIFS: recovery needed
[   17.680901] UBIFS: recovery completed
[   17.684557] UBIFS: mounted UBI device 0, volume 3, name "storage"
[   17.690646] UBIFS: file system size:   8237568 bytes (8044 KiB, 7 MiB, 519 LEBs)
[   17.698015] UBIFS: journal size:       412672 bytes (403 KiB, 0 MiB, 26 LEBs)
[   17.705119] UBIFS: media format:       w4/r0 (latest is w4/r0)
[   17.710938] UBIFS: default compressor: lzo
[   17.715020] UBIFS: reserved for root:  389080 bytes (379 KiB)
[   18.116333] wired0: link is down
[   18.224683] PowerPC Book-E Watchdog Timer Enabled (wdt_period=3)
[   18.234366] sysctl -w vm.panic_on_oom=2
[   18.241735] vm.panic_on_oom = 2
[   18.462040] ath_hal: 0.9.17.1 (AR5212, AR5416, AR9380, RF5111, RF5112, RF2413, RF5413, RF2316, RF2317, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
[   18.533526] ath_dfs: Version 2.0.0
[   18.533532] Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
[   18.574515] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
[   18.656040] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
[   18.814053] ath_pci: 9.2.0_U10.5.13 (Atheros/multi-bss)
[   18.819464] __ath_attach: Set global_scn[0]
[   18.823636] ACBKMinfree = 48
[   18.826518] ACBEMinfree = 32
[   18.829390] ACVIMinfree = 16
[   18.832257] ACVOMinfree = 0
[   18.835040] CABMinfree = 48
[   18.837829] UAPSDMinfree = 0
[   18.844998] ar9300RadioAttach: Need analog access recipe!!
[   19.042073] ath_get_caps[5340] rx chainmask mismatch actual 7 sc_chainmak 0
[   19.049032] ath_get_caps[5314] tx chainmask mismatch actual 7 sc_chainmak 0
[   19.069541] wifi0: Atheros 9380: mem=0xe00000000, irq=19 hw_base=0xd5f40000
[   19.076671] __ath_attach: Set global_scn[1]
[   19.080840] ACBKMinfree = 48
[   19.083707] ACBEMinfree = 32
[   19.086590] ACVIMinfree = 16
[   19.089462] ACVOMinfree = 0
[   19.092244] CABMinfree = 48
[   19.095026] UAPSDMinfree = 0
[   19.102099] ar9300RadioAttach: Need analog access recipe!!
[   19.282045] ath_get_caps[5340] rx chainmask mismatch actual 7 sc_chainmak 0
[   19.289002] ath_get_caps[5314] tx chainmask mismatch actual 7 sc_chainmak 0
[   19.309558] wifi1: Atheros 9380: mem=0xe00100000, irq=20 hw_base=0xd5f80000
[   19.356176] Single synchronous check for reset
[   21.159005] click: starting router thread pid 567 (c6372b40)
[   21.208355]
[   21.216117] boot 5 build 20-102298 board powerpc mac 00:18:0A:27:2D:D6
[   21.224508] Module: dummy  .text=0xd5980000 .data=0xd598028c .bss=
[   21.224520] Module: adf  .text=0xd59b4000 .data= .bss=
[   21.224524] Module: asf  .text=0xd59e4000 .data=0xd59e55a8 .bss=0xd59e5758
[   21.224528] Module: ath_hal  .text=0xd5b00000 .data=0xd5baf210 .bss=0xd5bb783c
[   21.224532] Module: ath_dfs  .text=0xd5c24000 .data= .bss=0xd5c2d2b4
[   21.224536] Module: ath_rate_atheros  .text=0xd5c6c000 .data=0xd5c72798 .bss=0xd5c780e4
[   21.224541] Module: ath_dev  .text=0xd5cfc000 .data=0xd5d33d38 .bss=0xd5d3420c
[   21.224545] Module: ath_pktlog  .text= .data= .bss=
[   21.224549] Module: umac  .text=0xd5e5c000 .data=0xd5edc624 .bss=0xd5eddd84
[   21.224553] Module: proclikefs  .text=0xd5f74000 .data= .bss=0xd5f74b74
[   21.224557] Module: merakiclick  .text=0xd637c000 .data=0xd65860c4 .bss=0xd6586754
[   22.485223] brain: unloading click config
[   23.077257] brain: loading click config
[   24.213109] device wired0 entered promiscuous mode
[   24.220770] device wired1 entered promiscuous mode



BusyBox v1.20.2 (2013-01-31 16:57:37 PST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

Welcome to Meraki.

Usage of this device is governed by Meraki's End User License
Agreement, available at http://meraki.com/legal.

6.39.45.214-Spare-MR24:/$ 
[   38.517453]
[   38.517459] !!!!! reading /tmp/connection_state failed [2]: No such file or directory

6.39.45.214-Spare-MR24:/$ ls
BOOT_REASON      MERAKI_SERIAL    lib              sys
LAST_BOOT_COUNT  bin              meraki_gpio      tmp
MERAKI_ARCH      click            proc             usr
MERAKI_BOARD     dev              root             var
MERAKI_BUILD     etc              sbin             www
MERAKI_IP        include          shell_prompt
MERAKI_MAC       init             storage

Good news, thanks to the hardware donation from @tbs_david I was able to get an UnOfficial build of OpenWRT going on the MR24 using a new device target for the apm821xx CPU. Flashing instructions and images can be found at https://github.com/riptidewave93/Openwrt-MR24 and https://github.com/riptidewave93/Openwrt-MR24/releases.

Next steps are to get a Wiki page up at https://wiki.openwrt.org/toh/meraki/mr24 and to start porting this device into the somewhat dead mainline ppc44x target, as a new nand sub-target.

EDIT: Wiki page up, and added to table of hardware

(Last edited by riptide_wave on 27 Mar 2016, 16:56)

As always riptide, great work!  Hope other people out there can also benefit from your efforts.  End of Sale date on these units was May 2014 so the newest installs out there are already about 2 years old.  It'll be about time to swap them out for newer units with more modern features, and this should make for a lot of unused MR24s shortly.

Congrats on the progress!

As usual, riptide's work is flawless!  I was able to follow his instructions and get OpenWRT installed and sysupgraded on a MR24 that had the most recent Meraki firmware installed prior.  Wooo!!

Hi there, maybe a little bit of a silly question, does someone have an all ready bin file available?
I can't seem to get my compiling to work..

Thanks guys

donkawamura wrote:

Hi there, maybe a little bit of a silly question, does someone have an all ready bin file available?
I can't seem to get my compiling to work..

Thanks guys

You can get a copy from my GitHub repo at https://github.com/riptidewave93/Openwrt-MR24/releases

riptide_wave wrote:
donkawamura wrote:

Hi there, maybe a little bit of a silly question, does someone have an all ready bin file available?
I can't seem to get my compiling to work..

Thanks guys

You can get a copy from my GitHub repo at https://github.com/riptidewave93/Openwrt-MR24/releases


Thanks a lot, should have found that myself..

I bricked one this week.  Found a dusty one in a corner and thought I'd get it running as a spare.  After following the flashing steps at the 'create UBI recovery partition' it rebooted and I haven't seen text on the serial interface since.  I flashed an MR16 to confirm my serial port was fine.  After flashing about 10 Meraki APs this is the first loss.

Hi guys, i am trying  to flash MR24. I get to the point to upload the iniramfs and sysupgrade files to the tmp folder on the device and couldn't make it. Do you have any ideas?

=> run tftpboot_lede
Waiting for PHY auto negotiation to complete.... done
ENET Speed is 1000 Mbps - FULL duplex connection (EMAC0)
Using ppc_4xx_eth0 device
TFTP from server 192.168.80.7; our IP address is 192.168.80.49
Filename 'lede-apm821xx-nand-mr24-initramfs-kernel.bin'.
Load address: 0xc00000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################
done
Bytes transferred = 5111808 (4e0000 hex)
## Booting kernel from Legacy Image at 00c10000 ...
   Image Name:   POWERPC OpenWrt Linux-4.4.6
   Created:      2016-04-01  16:49:50 UTC
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    1980903 Bytes = 1.9 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Loading init Ramdisk from Legacy Image at 00e00000 ...
   Image Name:   MR24 OpenWRT rootfs
   Created:      2016-04-01  16:49:50 UTC
   Image Type:   PowerPC Linux RAMDisk Image (gzip compressed)
   Data Size:    2957075 Bytes = 2.8 MiB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 00c00400
   Booting using the fdt blob at 0xc00400
   Uncompressing Kernel Image ... OK
   Loading Ramdisk to 0789c000, end 07b6df13 ... OK
[    0.000000] Using PowerPC 44x Platform machine description
[    0.000000] Linux version 4.4.6 (riptide_wave@build01.chrisrblake.com) (gcc version 5.3.0 (OpenWrt GCC 5.3.0 r49114) ) #1 Sun Apr 3 15:56:26 UTC 2016
[    0.000000] Found initrd at 0xc789c000:0xc7b6df13
[    0.000000] bootconsole [udbg0] enabled
setup_arch: initmem
arch: exit
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] MMU: Allocated 1088 bytes of context maps for 255 contexts
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs mtdoops.mtddev=oops
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Sorting __ex_table...
[    0.000000] Memory: 122656K/131072K available (2996K kernel code, 132K rwdata, 788K rodata, 156K init, 203K bss, 8416K reserved, 0K cma-reserved)
[    0.000000] Kernel virtual memory layout:
[    0.000000]   * 0xfffdf000..0xfffff000  : fixmap
[    0.000000]   * 0xfde00000..0xfe000000  : consistent mem
[    0.000000]   * 0xfddfe000..0xfde00000  : early ioremap
[    0.000000]   * 0xd1000000..0xfddfe000  : vmalloc & ioremap
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:512 nr_irqs:512 16
[    0.000000] UIC0 (32 IRQ sources) at DCR 0xc0
[    0.000000] UIC1 (32 IRQ sources) at DCR 0xd0
[    0.000000] UIC2 (32 IRQ sources) at DCR 0xe0
[    0.000000] UIC3 (32 IRQ sources) at DCR 0xf0
[    0.000019] clocksource: timebase: mask: 0xffffffffffffffff max_cycles: 0xb881274fa3, max_idle_ns: 440795210636 ns
[    0.010243] clocksource: timebase mult[1400000] shift[24] registered
[    0.016601] pid_max: default: 32768 minimum: 301
[    0.021249] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.027767] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.038034] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns
[    0.048160] NET: Registered protocol family 16

[    0.054496] PPC4XX OCM1: 32768 Bytes (enabled)
[    0.058857] PPC4XX OCM1: 32768 Bytes (non-cached)
[    0.063516] PPC4XX OCM1: 0 Bytes (cached)
[    0.067553] debugfs ppc4xx ocm: failed to create file
[    0.072632] 256k L2-cache enabled
[    0.136076] PCIE0: Checking link...
[    0.139471] PCIE0: Device detected, waiting for link...
[    0.144654] PCIE0: link is up !
[    0.251126] PCI host bridge /plb/pciex@d00000000 (primary) ranges:
[    0.257226]  MEM 0x0000000e00000000..0x0000000e7fffffff -> 0x0000000080000000
[    0.264387]  MEM 0x0000000f00000000..0x0000000f000fffff -> 0x0000000000000000
[    0.271554]   IO 0x0000000f80000000..0x0000000f8000ffff -> 0x0000000000000000
[    0.278650] 4xx PCI DMA offset set to 0x00000000
[    0.283214] 4xx PCI DMA window base to 0x0000000000000000
[    0.288571] DMA window size 0x0000000080000000
[    0.292999] PCIE0: successfully set as root-complex
[    0.298210] PCI: Probing PCI hardware
[    0.301897] PCI host bridge to bus 0000:40
[    0.305913] pci_bus 0000:40: root bus resource [io  0x0000-0xffff]
[    0.312037] pci_bus 0000:40: root bus resource [mem 0xe00000000-0xe7fffffff] (bus address [0x80000000-0xffffffff])
[    0.322318] pci_bus 0000:40: root bus resource [mem 0xf00000000-0xf000fffff] (bus address [0x00000000-0x000fffff])
[    0.332598] pci_bus 0000:40: root bus resource [bus 40-ff]
[    0.338157] PCI: Hiding 4xx host bridge resources 0000:40:00.0
[    0.344408] pci 0000:40:00.0: PCI bridge to [bus 41-7f]
[    0.349603] pci 0000:41:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.358200] pci 0000:41:00.0: PCI bridge to [bus 42-ff]
[    0.363362] pci 0000:42:02.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.371284] pci 0000:42:03.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.379712] pci 0000:42:02.0: PCI bridge to [bus 43-ff]
[    0.385412] pci 0000:42:03.0: PCI bridge to [bus 44-ff]
[    0.390758] pci 0000:40:00.0: disabling bridge window [io  0x0000-0xffffffffffffffff] to [bus 41-7f] (unused)
[    0.400562] pci 0000:40:00.0: disabling bridge window [mem 0x00000000-0xffffffffffffffff 64bit pref] to [bus 41-7f] (unused)
[    0.411710] pci 0000:40:00.0: BAR 8: assigned [mem 0xe00000000-0xe001fffff]
[    0.418613] pci 0000:41:00.0: BAR 8: assigned [mem 0xe00000000-0xe001fffff]
[    0.425523] pci 0000:42:02.0: BAR 8: assigned [mem 0xe00000000-0xe000fffff]
[    0.432434] pci 0000:42:03.0: BAR 8: assigned [mem 0xe00100000-0xe001fffff]
[    0.439349] pci 0000:43:00.0: BAR 0: assigned [mem 0xe00000000-0xe0001ffff 64bit]
[    0.446788] pci 0000:43:00.0: BAR 6: assigned [mem 0xe00020000-0xe0002ffff pref]
[    0.454119] pci 0000:42:02.0: PCI bridge to [bus 43]
[    0.459046] pci 0000:42:02.0:   bridge window [mem 0xe00000000-0xe000fffff]
[    0.465964] pci 0000:44:00.0: BAR 0: assigned [mem 0xe00100000-0xe0011ffff 64bit]
[    0.473398] pci 0000:44:00.0: BAR 6: assigned [mem 0xe00120000-0xe0012ffff pref]
[    0.480729] pci 0000:42:03.0: PCI bridge to [bus 44]
[    0.485656] pci 0000:42:03.0:   bridge window [mem 0xe00100000-0xe001fffff]
[    0.492570] pci 0000:41:00.0: PCI bridge to [bus 42-44]
[    0.497752] pci 0000:41:00.0:   bridge window [mem 0xe00000000-0xe001fffff]
[    0.504666] pci 0000:40:00.0: PCI bridge to [bus 41-7f]
[    0.509847] pci 0000:40:00.0:   bridge window [mem 0xe00000000-0xe001fffff]
[    0.522147] clocksource: Switched to clocksource timebase
[    0.528214] NET: Registered protocol family 2
[    0.532904] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.539782] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.546074] TCP: Hash tables configured (established 1024 bind 1024)
[    0.552430] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.558178] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.564518] NET: Registered protocol family 1
[    0.569065] Unpacking initramfs...
[    0.842542] Freeing initrd memory: 2884K (c789c000 - c7b6d000)
[    0.853384] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.869274] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.875030] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.886367] io scheduler noop registered
[    0.890218] io scheduler deadline registered (default)
[    0.895646] pcieport 0000:41:00.0: enabling device (0000 -> 0002)
[    0.901790] pcieport 0000:42:02.0: enabling device (0000 -> 0002)
[    0.907980] pcieport 0000:42:03.0: enabling device (0000 -> 0002)
[    0.914307] aer: probe of 0000:40:00.0:pcie02 failed with error -22
[    0.920607] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
▒[    0.950698] serial8250.0: ttyS0 at MMIO 0x4ef600400 (irq = 21, base_baud = 462962) is a U6_16550A
[    0.959479] console [ttyS0] enabled
[    0.959479] console [ttyS0] enabled
[    0.966385] bootconsole [udbg0] disabled
[    0.966385] bootconsole [udbg0] disabled
[    0.974564] console [ttyS0] disabled
[    0.978190] console [ttyS0] enabled
[    0.982515] nand: device found, Manufacturer ID: 0xad, Chip ID: 0x75
[    0.988868] nand: Hynix NAND 32MiB 3,3V 8-bit
[    0.993212] nand: 32 MiB, SLC, erase size: 16 KiB, page size: 512, OOB size: 16
[    1.000503] Scanning device for bad blocks
[    1.107535] 3 ofpart partitions found on MTD device 4e4000000.ndfc.nand
[    1.114151] Creating 3 MTD partitions on "4e4000000.ndfc.nand":
[    1.120059] 0x000000000000-0x000000170000 : "u-boot"
[    1.125843] 0x000000170000-0x000000180000 : "oops"
[    1.131500] 0x000000180000-0x000002000000 : "ubi"
[    1.137627] PPC 4xx OCP EMAC driver, version 3.54
[    1.142585] MAL v2 /plb/mcmal, 1 TX channels, 1 RX channels
[    1.148290] RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
[    1.155406] TAH /plb/opb/emac-tah@ef601350 initialized
[    1.160792] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
[    1.168028] eth0: EMAC-0 /plb/opb/ethernet@ef600c00, MAC 00:01:73:01:23:41
[    1.174897] eth0: found Atheros 8035 Gigabit Ethernet PHY (0x01)
[    1.183187] NET: Registered protocol family 10
[    1.189099] NET: Registered protocol family 17
[    1.193605] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[    1.206177] 8021q: 802.1Q VLAN Support v1.8
[    1.212269] UBI: auto-attach mtd2
[    1.215422] ubi0: attaching mtd2
[    1.384843] ubi0: scanning is finished
[    1.396577] ubi0: attached mtd2 (name "ubi", size 30 MiB)
[    1.401983] ubi0: PEB size: 16384 bytes (16 KiB), LEB size: 15872 bytes
[    1.408579] ubi0: min./max. I/O unit sizes: 512/512, sub-page size 256
[    1.415084] ubi0: VID header offset: 256 (aligned 256), data offset: 512
[    1.421763] ubi0: good PEBs: 1952, bad PEBs: 0, corrupted PEBs: 0
[    1.427837] ubi0: user volume: 1, internal volumes: 1, max. volumes count: 92
[    1.434949] ubi0: max/mean erase counter: 951/656, WL threshold: 4096, image sequence number: 0
[    1.443614] ubi0: available PEBs: 1906, total reserved PEBs: 46, PEBs reserved for bad PEB handling: 40
[    1.453371] ubi0: background thread "ubi_bgt0d" started, PID 260
[    1.460213] Freeing unused kernel memory: 156K (c03b4000 - c03db000)
[    1.474784] init: Console is alive
[    1.487419] booke_wdt: powerpc book-e watchdog driver loaded
[    1.503569] init: - preinit -
[    1.599045] eth0: link is down
[    1.602588] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    1.623134] random: procd urandom read with 0 bits of entropy available
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    4.598365] eth0: link is up, 1000 FDX, pause enabled
[    4.603463] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    4.721419] procd: - early -
[    5.248243] procd: - watchdog -
[    5.251694] procd: - ubus -
[    5.306639] procd: - init -
Please press Enter to activate this console.
[    5.703787] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    5.715350] Loading modules backported from Linux version v4.4-rc5-1913-gc8fdf68
[    5.722737] Backport generated by backports.git backports-20151218-0-g2f58d9d
[    5.731690] ip_tables: (C) 2000-2006 Netfilter Core Team
[    5.743528] nf_conntrack version 0.5.0 (1964 buckets, 7856 max)
[    5.770779] xt_time: kernel timezone is -0000
[    5.820832] PPP generic driver version 2.4.2
[    5.826864] NET: Registered protocol family 24
[    5.856849] ath9k 0000:43:00.0: enabling device (0000 -> 0002)
[    5.971457] ieee80211 phy0: Atheros AR9300 Rev:3 mem=0xd5480000, irq=19
[    5.978124] ath9k 0000:44:00.0: enabling device (0000 -> 0002)
[    6.085761] ieee80211 phy1: Atheros AR9300 Rev:3 mem=0xd5500000, irq=20
[   10.691582] eth0: link is up, 1000 FDX, pause enabled
[   10.710872] device eth0 entered promiscuous mode
[   10.725371] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   11.693236] br-lan: port 1(eth0) entered forwarding state
[   11.698679] br-lan: port 1(eth0) entered forwarding state
[   11.716150] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   13.705139] br-lan: port 1(eth0) entered forwarding state



BusyBox v1.24.1 () built-in shell (ash)

  _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
-----------------------------------------------------
DESIGNATED DRIVER (Bleeding Edge, r49114)
-----------------------------------------------------
  * 2 oz. Orange Juice         Combine all juices in a
  * 2 oz. Pineapple Juice      tall glass filled with
  * 2 oz. Grapefruit Juice     ice, stir well.
  * 2 oz. Cranberry Juice
-----------------------------------------------------
root@OpenWrt:/#

root@OpenWrt:/#
root@OpenWrt:/# scp bin/targets/apm821xx/nand/lede-apm821xx-nand-mr24-initramfs-
kernel.bin root@<mr24-ipaddr>:/tmp/
/bin/ash: can't open mr24-ipaddr: no such file
root@OpenWrt:/# scp bin/targets/apm821xx/nand/lede-apm821xx-nand-mr24-initramfs-
kernel.bin root@192.168.80.49:/tmp/

/usr/bin/dbclient: Connection to root@192.168.80.49:22 exited: Connect failed: Network unreachable
lost connection
root@OpenWrt:/#

The discussion might have continued from here.