Meraki MR26 is an EOL wireless access point featuring a
PoE ethernet port and two dual-band 3x3 MIMO 802.11n
radios and 1x1 dual-band WIFI dedicated to scanning.
Thank you Amir for the unit and PSU.
Hardware info:
SOC : Broadcom BCM53015A1KFEBG (dual-core Cortex-A9 CPU at 800 MHz)
RAM : SK hynix Inc. H5TQ1G63EFR, 1 Gbit DDR3 SDRAM = 128 MiB
NAND : Spansion S34ML01G100TF100, 1 Gbit SLC NAND Flash = 128 MiB
ETH : 1 GBit Ethernet Port - PoE
WIFI1 : Broadcom BCM43431KMLG, BCM43431 802.11 abgn
WIFI1 : Broadcom BCM43431KMLG, BCM43431 802.11 abgn
WIFI3 : Broadcom BCM43428 abgn (1x1:1 - id: 43428)
BUTTON: one reset button
LEDS : RGB-LED
MISC : Atmel AT24C64 8KiB EEPROM (i2c - seems empty)
: Ti INA219 26V, 12-bit, i2c output current/voltage/power monitor
: TPS23754, High Power/High Efficiency PoE Interface+DC/DC Controller
SERIAL:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has a populated
right angle 1x4 0.1" pinheader.
The pinout is: VCC (next to J3, has little white arrow), RX, TX, GND.
This flashing procedure for the MR26 was tested with firmware:
"22-143410M-gf25cbf5a-asa".
U-Boot 2012.10-00063-g83f9fe4 (Jun 04 2014 - 21:22:39)
A guide how to open up the device is available on the wiki:
<https://openwrt.org/toh/meraki/mr26>
Notes:
- The WIFI do work to a degree. Limited to 802.11bg in the 2.4GHz band.
- the WIFI macs are made up.
0. Create a separate Ethernet LAN which can't have access to the internet.
Ideally use 192.168.1.2 for your PC. The new OpenWrt firmware will setup
the network via DHCP Discovery, so make sure your PC is running
a DHCP-Server (i.e.: dnsmasq)
'# dnsmasq -i eth# -F 192.168.1.5,192.168.1.50
Download the openwrt-meraki-mr26 initramfs file from openwrt.org and
rename it to something simple like mr26.bin. Then put it into the tftp's
server directory.
1. Disassemble the MR26 device by removing all screws (4 screws are located
under the 4 rubber feets!) and prying open the plastic covers without
breaking the plastic retention clips. Once inside, remove the plastic
back casing. Be careful, there some "hidden" retention clips on both
sides of the LAN port, you need a light to see those. Next, you want to
remove all the screws on the outer metal shielding to get to the PCB.
It's not necessary to remove the antennas!
2. Connect the serial cable to the serial header and Ethernet patch cable
to the device.
4. Before connecting the power, get ready flood the serial console program
with the magic: xyzzy . This is necessary in order to get into the
u-boot prompt. Once Ready: connect power cable.
5. If you don't get the "u-boot>" prompt within the first few seconds,
you have to disconnect and reconnect the power cable and try again.
6. In the u-boot prompt enter:
setenv ipaddr 192.168.1.4
setenv serverip 192.168.1.2
tftpboot ${meraki_loadaddr} mr26.bin; bootm
this will boot a in-ram-only OpenWrt image.
7. Once it booted use sysupgrade to permanently install OpenWrt.
To do this: Download the latest sysupgrade.bin file and move
it to the device. Then use sysupgrade *sysupgrade.bin to install it.
WARNING: DO NOT DELETE the "storage" ubi volume!
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
platform_nand_pre_upgrade() is gone since commit 790692dde2
("base-files: drop support for the platform_nand_pre_upgrade()").
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
List of supported formats grew over time and implementation got a bit
messy. There are multiple functions with format-specific parameters and
commands.
Refactor it by making platform_identify() setup all required info right
after detecting firmware format. This simplifies formats handling in
platform_other_check_image() and platform_do_upgrade() a lot.
This has been tested on:
1. SmartRG SR400ac (TRX): non-NAND sysupgrade
2. Netgear R8000 (CHK): NAND aware and standard sysupgrade-s
3. D-Link DIR-885L (Seama): NAND aware and standard sysupgrade-s
4. Luxul XWR-3150 (LXL): NAND aware and standard sysupgrade-s
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
This patch adds support for Cisco Meraki MR32.
The unit was donated by Chris Blake. Thank you!
WARNING:
Only the 1x1:1 abgn Air Marshal WIPS wifi is currently supported by b43:
b43-phy2: Found PHY: Analog 9, Type 4 (N), Revision 16
b43-phy2: Found Radio: Manuf 0x17F, ID 0x2057, Revision 9, Version 1
b43-phy2: Loading firmware version 784.2 (2012-08-15 21:35:19)
and only as 802.11ABG!
while WIFI1 and WIFI2 (both BCM4352) are not:
b43-phy0: Broadcom 4352 WLAN found (core revision 42)
b43-phy0 ERROR: FOUND UNSUPPORTED PHY (Analog 12, Type 11 (AC), Revision 1)
Hardware Highlights:
SoC: Broadcom BCM53016A1 (1 GHz, 2 cores)
RAM: 128 MiB
NAND: 128 MiB Spansion S34ML01G2 (~114 MiB useable)
ETH: 1GBit Ethernet Port - PoE
WIFI1: Broadcom BCM43520 an+ac (2x2:2 - id: 0x4352)
WIFI2: Broadcom BCM43520 bgn (2x2:2 - id: 0x4352)
WIFI3: Broadcom BCM43428 abgn (1x1:1 - id: 43428)
BLE: Broadcom BCM20732 (ttyS1)
LEDS: 1 x Programmable RGB Status LED (driven by a PWM)
1 x White LED (GPIO)
1 x Orange LED Fault Indicator (GPIO)
2 x LAN Activity / Speed LEDs (On the RJ45 Port)
BUTTON: one Reset button
MISC: AT24C64 8KiB EEPROM (i2c - stores Ethernet MAC + Serial#!)
ina219 hardware monitor (i2c)
Kensington Lock
SERIAL:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has a populated
right angle 1x4 0.1" pinheader.
The pinout is: VCC, RX, TX, GND. (Use a multimeter)
Flashing needs a serial adaptor (due to the lack of a working dropbear on
the original firmware).
This flashing procedure for the MR32 was tested with firmware:
"r23-149867:150252-aacharya".
0. Create a seperate Ethernet LAN which does not have access to the internet.
Ideally use 192.168.1.2 for your PC. Make sure to reserve 192.168.1.1 it
will be used later on by the OpenWrt firmware. The original Meraki firmware
will likely try to setup the network via DHCP Discovery, so make sure your
PC is running a DHCP-Server (i.e.: dnsmasq)
'# dnsmasq -i eth# -F 192.168.1.5,192.168.1.50
Furthermore, the PC needs a supported ssh/http/ftp server in order to
retrieve the initramfs + dtb file
1. Disassemble the MR32 device by removing all screws (4 screws are located
under the 4 rubber feets!) and prying open the plastic covers without
breaking the plastic retention clips. Once inside, remove all the screws
on the outer metal shielding to get to the PCB. It's not necessary to
remove the antennas!
2. Connect the serial cable to the serial header.
3. Partially reassemble the outer metal shielding to ensure that the SoC
has a proper heat sink.
4. Connect the Ethernet patch cable to the device and the power cable.
5. Wait for the device to boot and enter the root shell.
(rooting is not discussed in detail here please refer to
Chris Blake - "pwning the meraki mr18" blog post:
<https://servernetworktech.com/2016/02/pwning-the-meraki-mr18/>
(The same method works with the MR32's r23-149867:150252-aacharya)
Wait for the MR32 to enter the "<Meraki>" prompt and enter:
<Meraki> odm serial_num read
(Verify that it matches what's on the S/N Sticker on the back!)
<Meraki> odm serial_num write Q2XX-XXXX-XXXV
<Meraki> odm serial_num read
(Verify that the S/N has changed - and the LED start to flash)
now to flash the firmware:
<Meraki> odm firmware part.safe "http://192.168.1.2/mr32-initramfs.bin"
Once OpenWrt booted use sysupgrade to permanently install
OpenWrt. To do this: Download the latest sysupgrade.bin file
for the MR32 to the device and use sysupgrade *sysupgrade.bin
to install it.
WARNING: DO NOT DELETE the "storage" ubi volume!
To flash later MR32 Firmwares like r25-201804051805-G885d6d78-dhow-rel
requires in-circut-i2c tools to access the I2C EEPROM AT24C64 next to
the SoC. The idea is pretty much the same as from Step 5 from above:
Change the serial number to Q2XXXXXXXXXV (should be around 0x7c), then
attach a serial cable, ethernet (but make sure the device can't reach
the internet!) hit "s" (the small s!) during boot to enter the root-shell
and add the following commands to the /storage/config there:
serial_allow_odm true
serial_access_enabled true
serial_access_check false
valid_config true
and then hit exit to let it finish booting.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Use "truncate" to adjust size of existing file instead of "dd" which
required creating a copy. This saves space on tmpfs. It may be as low
as 2.1 MiB when using OpenWrt default user space and way more (20+ MiB)
when flashing vendor firmware.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Allow flashing Luxul devices using vendor firmware format. The next step
will be building proper images once they are conirmed to work.
Signed-off-by: Dan Haab <dan.haab@legrand.com>
This provides TRX validation result to the validation JSON. It also
prevents users from installing broken firmware files.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Calling nand_do_upgrade() from platform_pre_upgrade() was obsoleted in
the commit 30f61a34b4 ("base-files: always use staged sysupgrade").
This change brings bcm53xx in sync with other targets and allows
dropping backward compatibility code. It shouldn't change any user
visible behavior.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
This includes Linksys EA9500 support, BCM53573 timer fix and
upstream-ready partitions patch that replaces two downstream hacks.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Since BusyBox 1.25.0 dd command supports iflag=skip_bytes which allows
skipping requested amount of bytes without reducing blocksize. Thanks to
this we can leave default blocksize and let dd work more efficiently.
On Netgear R6250 "dd skip=58 iflag=skip_bytes" can be 5 times faster
than "dd bs=58 skip=1" when extracting TRX out of CHK.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Depending on busybox applet selection, paths of basic utiilties may differ,
and may not work as symlinks to busybox. Simply using whatever binary is
found in PATH and detecting symlinks automatically is more robust and
easier to maintain.
The list of binaries is also slightly cleaned up and duplicates are
removed.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Extracting TRX to separated file in /tmp/ just wastes some RAM while we
can just pass a proper extracting command to the default_do_upgrade.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45912
Extracting full TRX out of vendor format is not needed as otrx supports
passing TRX offset. This saves some RAM during sysupgrade.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45911
In most cases it allows reverting back to the vendor firmware (as they
usually don't use UBI). If users wants to do that we can't do anything
anyway. Erease counters will be just lost. The only thing we do is warn:
"Flashing firmware without UBI for rootfs. All erase counters will be
lost."
It still requires forcing sysupgrade.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45392
We can now detect that provided firmware contains kernel and UBI image
partitions. Flashing it in a sane way (keeping erase counters) still
needs to be implemented.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45391
