This commit adds support for the Cisco Meraki MX64 and MX65 devices which
use the Broadcom NSP SoC, which is compatible with the bcm53xx platform.
MX64 Hardware info:
- CPU: Broadcom BCM58625 Cortex A9 @ 1200Mhz
- RAM: 2 GB (4 x 4Gb SK Hynix H5TC4G83CFR)
- Storage: 1 GB (Micron MT29F8G08ABACA)
- Networking: BCM58625 internal switch (5x 1GbE ports)
- USB: 1x USB2.0
- Serial: Internal header
MX65 Hardware info:
- CPU: Broadcom BCM58625 Cortex A9 @ 1200Mhz
- RAM: 2 GB (4 x 4Gb SK Hynix H5TC4G83CFR)
- Storage: 1 GB (Micron MT29F8G08ABACA)
- Networking: BCM58625 switch (2x 1GbE ports, used for WAN ports 1 & 2)
2x Qualcomm QCA8337 switches (10x 1GbE ports, used for LAN ports 3-12)
- PSE: Broadcom BCM59111KMLG connected to LAN ports 11 & 12
- USB: 1x USB2.0
- Serial: Internal header
Notes:
- The Meraki provided GPL source are available at [2].
- Wireless capability on the MX64W and MX65W exists in the form of 2x
Broadcom BCM43520KMLG, which is not supported. These devices will work
otherwise as standard MX64 or MX65 devices.
- Early MX64 units use an A0 variant of the BCM958625 SoC which lacks
cache coherency and uses a different "secondary-boot-reg". As a
consequence a different device tree is needed.
- Installation of OpenWrt requires changing u-boot to a custom version.
This is due to the stock u-boot "nand read" command being limited to
load only 2MB, in spite of the bootkernel1 and bootkernel2 partitions
both being 3MB in the stock layout. It is also required to allow
booting via USB, enabling cache coherency and setting up the QCA
switches and Serdes link on the MX65. The modified sources for U-boot
are available for the MX64[3] and MX65[4].
- Initial work on this device used a small bootloader within the OEM
partition scheme. To allow booting of larger kernels, UBI and bootm
support has been added, along with ability to store env variables to
the NAND. The Shmoo and newly created env partitions have been moved
to the extra space available after the nvram data.
- Users who installed the previous non-UBI supporting bootloader will
need to convert to the new one before flashing a compatible image.
These steps are detailed below.
References:
[1] https://www.broadcom.com/products/embedded-and-networking-processors/c
ommunications/bcm5862x
[2] https://dl.meraki.net/wired-14-39-mx64-20190426.tar.bz2
[3] https://github.com/clayface/U-boot-MX64-20190430_MX64
[4] https://github.com/clayface/U-boot-MX64-20190430_MX65
Installation guide:
Initial installation steps:
1. Compile or obtain OpenWrt files for the MX64 or MX65, including
u-boot[3][4], initramfs and sysupgrade images.
2. A USB disk with DOS partition scheme and primary FAT partition is
required.
3. If installing onto an MX64, set up a local web server.
4. On the device, boot into diagnostic mode by holding reset when
powering on the device. Continue to hold reset until the orange LED
begins to flash white. On used units the white flash may be difficult
to see.
5. Plug an Ethernet cable into the first LAN port, set the host to
192.168.1.2 and confirm telnet connectivity to 192.168.1.1.
U-boot installation - MX64 Only:
1. Newer fw versions require extra steps to support OpenWrt. To check,
please connect via telnet and run:
`cat /sys/block/mtdblock0/ro`
If the result is 1, your mtd0 is locked will need to perform extra
steps 4 and 5 in this section. If the result is 0 then skip these.
2. Check which SoC is in use by running the following command:
`devmem 0x18000000`
If devmem is not found then try:
`devmem2 0x18000000`
If the output begins with anything between "0x3F00-0x3F03" you will
need to use the A0 release. For any other output, eg "0x3F04" or
higher, use the regular MX64 image.
3 Confirm the size of the device's boot(mtd0) partition. In most
cases it should be 0x100000 or larger. If this is the case, please
proceed to use the uboot_mx64 image. If the reported size is
0x80000, please use the uboot_mx64_small image, then follow the
later guide to change to the larger image.
`cat /proc/mtd`
Example output:
`# cat /proc/mtd
cat /proc/mtd
dev: size erasesize name
mtd0: 00100000 00040000 "boot"
mtd1: 00080000 00040000 "shmoo"
mtd2: 00300000 00040000 "bootkernel1"
mtd3: 00100000 00040000 "nvram"
mtd4: 00300000 00040000 "bootkernel2"
mtd5: 3f700000 00040000 "ubi"
mtd6: 40000000 00040000 "all"`
4. Set up a webserver to serve the appropriate uboot_mx64 from the
following location and verify the SHA512:
https://github.com/clayface/U-boot-MX64-20190430_MX64
5. (Only if mtd0 is locked) You will also need the mtd-rw.ko kernel
module to unlock the partition from the same repo. An mtd executable
is also needed to write the mtd block. Place these on the web server
as well.
6. (Only if mtd0 is locked) Use wget to retrieve the files on the MX64:
`wget http://192.168.1.2/mtd-rw.ko`
`insmod mtd-rw.ko i_want_a_brick=1`
and confirm the unlock is set with dmesg
`mtd-rw: mtd0: setting writeable flag`
7. Download the appropriate u-boot image according to step 3. If you
did not need to unlock the mtd0 partition then use dd to write the
file, with caution:
`wget http://192.168.1.2/uboot_mx64`
`dd if=uboot_mx64 of=/dev/mtdblock0`
If you needed to unlock the mtd0 partition using the mtd-rw module,
run these commands instead to install u-boot instead:
`wget http://192.168.1.2/mtd`
`chmod +x mtd`
`wget http://192.168.1.2/uboot_mx64`
`./mtd write uboot_mx64 /dev/mtd0`
8. Once this has successfully completed, power off the device. If you
did not need to install the small u-boot image, proceed to
"OpenWrt Installation". Otherwise proceed to "UBI supporting
bootloader installation".
U-boot installation - MX65 Only:
1. Obtain telnet access to the MX65.
2. Confirm the size of the device's boot(mtd0) partition. In most
cases it should be 0x100000 or larger. If this is the case, please
proceed to use the uboot_mx65 image. If the reported size is
0x80000, please use the uboot_mx65_small image, then follow the
later guide to change to the larger image.
`cat /proc/mtd`
3. Prepare a USB drive formatted to FAT. Download the appropriate
uboot_mx65 to the USB drive from the following location and verify
the SHA512:
https://github.com/clayface/U-boot-MX64-20190430_MX65
3. Once you have telnet access to the MX65, plug in the USB disk and
run the following commands, with caution. The USB disk should
automount but if it does not, you will need to power off and on
again with reset held. Depending on step 2, use the uboot_mx65 or
uboot_mx65_small image accordingly:
`cd /tmp/media/sda1`
`dd if=uboot_mx65 of=/dev/mtdblock0`
4. Once this has successfully completed, power off the device. If you
did not need to install the small u-boot image, proceed to
"OpenWrt Installation". Otherwise proceed to "UBI supporting
bootloader installation".
UBI supporting bootloader installation:
These steps need to be followed if the older u-boot image was
installed, either because the Meraki diagnostic partition scheme used
0x80000 as the mtd0 size, or because you installed the u-boot provided
while OpenWrt support was still under development. If using OpenWrt,
please make a backup before proceeding.
1. Obtain the relevant image from the MX64(A0) or MX65 u-boot repo:
`openwrt-bcm5862x-generic-meraki_XXXX-initramfs-kernel.bin`
2. With the USB drive already inserted, power on the device while
holding the reset button. A white/orange flashing pattern will
occur shortly after power on. Let go of the reset button. The
device is now booting into OpenWrt initramfs stored on the USB
disk.
3. Connect by SSH to 192.168.1.1 and flash the embedded u-boot image,
changing X as appropriate:
`mtd write /root/uboot_mx6X /dev/mtd0`
You do not need to reboot as this image can handle "Kernel-in-UBI"
OpenWrt installation.
4. You can proceed to obtain and flash the appropriate OpenWrt image
at "OpenWrt Installation" Step 3.
5. Reboot will take significantly longer due to Shmoo calibration. In
case the device does not come online after several minute, power-
cycle the device and see if it boots. If you see an orange/white
flashing pattern, this indicates UBI booting was not successful and
you will need to copy a new bcm53xx image to a USB disk before
booting it and attempting to install OpenWrt again - refer to
"OpenWrt Installation" step 1. Do not attempt to reflash u-boot in
this scenario.
OpenWrt Installation:
1. Having obtained an OpenWrt image, please copy the file
`openwrt-bcm53xx-generic-meraki_XXXX-initramfs.bin`
to the base directory of a FAT formatted USB drive using DOS
partition scheme ,where XXXX is mx64, mx64_a0 or mx65 depending on
which device you have.
2. With the USB drive already inserted, power on the device. Boot time
will be longer than usual while Shmoo calibration takes place. A
different white/orange flashing pattern will eventually occur to
indicate device is now booting into OpenWrt initramfs stored on the
USB disk.
3. Ensuring Ethernet is plugged into a LAN port with IP set in the
192.168.1.0/24 subnet excluding 192.168.1.1, use SCP to copy the
sysupgrade file to 192.168.1.1:/tmp, eg:
`scp openwrt-bcm53xx-generic-meraki_XXXX-squashfs.sysupgrade.bin\
192.168.1.1:/tmp`
4. Connect by SSH to 192.168.1.1 and run sysupgrade:
`sysupgrade \
/tmp/openwrt-bcm53xx-generic-meraki_XXXX-squashfs.sysupgrade.bin`
5. OpenWrt should now be installed on the device.
Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
[ Rebase kernel configuration for 6.6,
fix failsafe by making kmod-eeprom-at24 and kmod-dsa-qca8k built-in,
resolve conflicts,
add LED aliases,
fix eth0 MAC address at probe ]
TODO:
- fix multiple LED colors not applied despite aliases - due to custom
/etc/diag.sh
- fix race condition between preinit and probing of the DSA tree,
causing no network interface available in failsafe mode (in general
case - to allow moving drivers back to modules)
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16634
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds "REQUIRE_IMAGE_METADATA=1" requirement for the MR26 and
MR32, with REQUIRE_IMAGE_METADATA explicitly 0 elsewhere. This is based
upon bcm63xx's base-files/lib/upgrade/platform.sh.
Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16634
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The DIR-890L is very similar to DIR-885L, but has both USB2
and USB3. The signature for the wrgac36 board was copied from
DD-Wrt.
The DIR-890L bootstrap will only load the first 2 MB after
the SEAMA header in the NAND flash, uncompress it with LZMA
and execute it. Since the compressed kernel will not fit in
2 MB we have a problem. Solve this by putting a LZMA
compressed U-Boot into the first 128 KB of the flash
followed by the kernel. The bootstrap will then uncompress
and execute U-Boot and then we let U-Boot read the kernel
from flash and execute it.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Meraki MR26 is an EOL wireless access point featuring a
PoE ethernet port and two dual-band 3x3 MIMO 802.11n
radios and 1x1 dual-band WIFI dedicated to scanning.
Thank you Amir for the unit and PSU.
Hardware info:
SOC : Broadcom BCM53015A1KFEBG (dual-core Cortex-A9 CPU at 800 MHz)
RAM : SK hynix Inc. H5TQ1G63EFR, 1 Gbit DDR3 SDRAM = 128 MiB
NAND : Spansion S34ML01G100TF100, 1 Gbit SLC NAND Flash = 128 MiB
ETH : 1 GBit Ethernet Port - PoE
WIFI1 : Broadcom BCM43431KMLG, BCM43431 802.11 abgn
WIFI1 : Broadcom BCM43431KMLG, BCM43431 802.11 abgn
WIFI3 : Broadcom BCM43428 abgn (1x1:1 - id: 43428)
BUTTON: one reset button
LEDS : RGB-LED
MISC : Atmel AT24C64 8KiB EEPROM (i2c - seems empty)
: Ti INA219 26V, 12-bit, i2c output current/voltage/power monitor
: TPS23754, High Power/High Efficiency PoE Interface+DC/DC Controller
SERIAL:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has a populated
right angle 1x4 0.1" pinheader.
The pinout is: VCC (next to J3, has little white arrow), RX, TX, GND.
This flashing procedure for the MR26 was tested with firmware:
"22-143410M-gf25cbf5a-asa".
U-Boot 2012.10-00063-g83f9fe4 (Jun 04 2014 - 21:22:39)
A guide how to open up the device is available on the wiki:
<https://openwrt.org/toh/meraki/mr26>
Notes:
- The WIFI do work to a degree. Limited to 802.11bg in the 2.4GHz band.
- the WIFI macs are made up.
0. Create a separate Ethernet LAN which can't have access to the internet.
Ideally use 192.168.1.2 for your PC. The new OpenWrt firmware will setup
the network via DHCP Discovery, so make sure your PC is running
a DHCP-Server (i.e.: dnsmasq)
'# dnsmasq -i eth# -F 192.168.1.5,192.168.1.50
Download the openwrt-meraki-mr26 initramfs file from openwrt.org and
rename it to something simple like mr26.bin. Then put it into the tftp's
server directory.
1. Disassemble the MR26 device by removing all screws (4 screws are located
under the 4 rubber feets!) and prying open the plastic covers without
breaking the plastic retention clips. Once inside, remove the plastic
back casing. Be careful, there some "hidden" retention clips on both
sides of the LAN port, you need a light to see those. Next, you want to
remove all the screws on the outer metal shielding to get to the PCB.
It's not necessary to remove the antennas!
2. Connect the serial cable to the serial header and Ethernet patch cable
to the device.
4. Before connecting the power, get ready flood the serial console program
with the magic: xyzzy . This is necessary in order to get into the
u-boot prompt. Once Ready: connect power cable.
5. If you don't get the "u-boot>" prompt within the first few seconds,
you have to disconnect and reconnect the power cable and try again.
6. In the u-boot prompt enter:
setenv ipaddr 192.168.1.4
setenv serverip 192.168.1.2
tftpboot ${meraki_loadaddr} mr26.bin; bootm
this will boot a in-ram-only OpenWrt image.
7. Once it booted use sysupgrade to permanently install OpenWrt.
To do this: Download the latest sysupgrade.bin file and move
it to the device. Then use sysupgrade *sysupgrade.bin to install it.
WARNING: DO NOT DELETE the "storage" ubi volume!
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
platform_nand_pre_upgrade() is gone since commit 790692dde2
("base-files: drop support for the platform_nand_pre_upgrade()").
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
List of supported formats grew over time and implementation got a bit
messy. There are multiple functions with format-specific parameters and
commands.
Refactor it by making platform_identify() setup all required info right
after detecting firmware format. This simplifies formats handling in
platform_other_check_image() and platform_do_upgrade() a lot.
This has been tested on:
1. SmartRG SR400ac (TRX): non-NAND sysupgrade
2. Netgear R8000 (CHK): NAND aware and standard sysupgrade-s
3. D-Link DIR-885L (Seama): NAND aware and standard sysupgrade-s
4. Luxul XWR-3150 (LXL): NAND aware and standard sysupgrade-s
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
This patch adds support for Cisco Meraki MR32.
The unit was donated by Chris Blake. Thank you!
WARNING:
Only the 1x1:1 abgn Air Marshal WIPS wifi is currently supported by b43:
b43-phy2: Found PHY: Analog 9, Type 4 (N), Revision 16
b43-phy2: Found Radio: Manuf 0x17F, ID 0x2057, Revision 9, Version 1
b43-phy2: Loading firmware version 784.2 (2012-08-15 21:35:19)
and only as 802.11ABG!
while WIFI1 and WIFI2 (both BCM4352) are not:
b43-phy0: Broadcom 4352 WLAN found (core revision 42)
b43-phy0 ERROR: FOUND UNSUPPORTED PHY (Analog 12, Type 11 (AC), Revision 1)
Hardware Highlights:
SoC: Broadcom BCM53016A1 (1 GHz, 2 cores)
RAM: 128 MiB
NAND: 128 MiB Spansion S34ML01G2 (~114 MiB useable)
ETH: 1GBit Ethernet Port - PoE
WIFI1: Broadcom BCM43520 an+ac (2x2:2 - id: 0x4352)
WIFI2: Broadcom BCM43520 bgn (2x2:2 - id: 0x4352)
WIFI3: Broadcom BCM43428 abgn (1x1:1 - id: 43428)
BLE: Broadcom BCM20732 (ttyS1)
LEDS: 1 x Programmable RGB Status LED (driven by a PWM)
1 x White LED (GPIO)
1 x Orange LED Fault Indicator (GPIO)
2 x LAN Activity / Speed LEDs (On the RJ45 Port)
BUTTON: one Reset button
MISC: AT24C64 8KiB EEPROM (i2c - stores Ethernet MAC + Serial#!)
ina219 hardware monitor (i2c)
Kensington Lock
SERIAL:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has a populated
right angle 1x4 0.1" pinheader.
The pinout is: VCC, RX, TX, GND. (Use a multimeter)
Flashing needs a serial adaptor (due to the lack of a working dropbear on
the original firmware).
This flashing procedure for the MR32 was tested with firmware:
"r23-149867:150252-aacharya".
0. Create a seperate Ethernet LAN which does not have access to the internet.
Ideally use 192.168.1.2 for your PC. Make sure to reserve 192.168.1.1 it
will be used later on by the OpenWrt firmware. The original Meraki firmware
will likely try to setup the network via DHCP Discovery, so make sure your
PC is running a DHCP-Server (i.e.: dnsmasq)
'# dnsmasq -i eth# -F 192.168.1.5,192.168.1.50
Furthermore, the PC needs a supported ssh/http/ftp server in order to
retrieve the initramfs + dtb file
1. Disassemble the MR32 device by removing all screws (4 screws are located
under the 4 rubber feets!) and prying open the plastic covers without
breaking the plastic retention clips. Once inside, remove all the screws
on the outer metal shielding to get to the PCB. It's not necessary to
remove the antennas!
2. Connect the serial cable to the serial header.
3. Partially reassemble the outer metal shielding to ensure that the SoC
has a proper heat sink.
4. Connect the Ethernet patch cable to the device and the power cable.
5. Wait for the device to boot and enter the root shell.
(rooting is not discussed in detail here please refer to
Chris Blake - "pwning the meraki mr18" blog post:
<https://servernetworktech.com/2016/02/pwning-the-meraki-mr18/>
(The same method works with the MR32's r23-149867:150252-aacharya)
Wait for the MR32 to enter the "<Meraki>" prompt and enter:
<Meraki> odm serial_num read
(Verify that it matches what's on the S/N Sticker on the back!)
<Meraki> odm serial_num write Q2XX-XXXX-XXXV
<Meraki> odm serial_num read
(Verify that the S/N has changed - and the LED start to flash)
now to flash the firmware:
<Meraki> odm firmware part.safe "http://192.168.1.2/mr32-initramfs.bin"
Once OpenWrt booted use sysupgrade to permanently install
OpenWrt. To do this: Download the latest sysupgrade.bin file
for the MR32 to the device and use sysupgrade *sysupgrade.bin
to install it.
WARNING: DO NOT DELETE the "storage" ubi volume!
To flash later MR32 Firmwares like r25-201804051805-G885d6d78-dhow-rel
requires in-circut-i2c tools to access the I2C EEPROM AT24C64 next to
the SoC. The idea is pretty much the same as from Step 5 from above:
Change the serial number to Q2XXXXXXXXXV (should be around 0x7c), then
attach a serial cable, ethernet (but make sure the device can't reach
the internet!) hit "s" (the small s!) during boot to enter the root-shell
and add the following commands to the /storage/config there:
serial_allow_odm true
serial_access_enabled true
serial_access_check false
valid_config true
and then hit exit to let it finish booting.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Use "truncate" to adjust size of existing file instead of "dd" which
required creating a copy. This saves space on tmpfs. It may be as low
as 2.1 MiB when using OpenWrt default user space and way more (20+ MiB)
when flashing vendor firmware.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Allow flashing Luxul devices using vendor firmware format. The next step
will be building proper images once they are conirmed to work.
Signed-off-by: Dan Haab <dan.haab@legrand.com>
This provides TRX validation result to the validation JSON. It also
prevents users from installing broken firmware files.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Calling nand_do_upgrade() from platform_pre_upgrade() was obsoleted in
the commit 30f61a34b4 ("base-files: always use staged sysupgrade").
This change brings bcm53xx in sync with other targets and allows
dropping backward compatibility code. It shouldn't change any user
visible behavior.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
This includes Linksys EA9500 support, BCM53573 timer fix and
upstream-ready partitions patch that replaces two downstream hacks.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Since BusyBox 1.25.0 dd command supports iflag=skip_bytes which allows
skipping requested amount of bytes without reducing blocksize. Thanks to
this we can leave default blocksize and let dd work more efficiently.
On Netgear R6250 "dd skip=58 iflag=skip_bytes" can be 5 times faster
than "dd bs=58 skip=1" when extracting TRX out of CHK.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Depending on busybox applet selection, paths of basic utiilties may differ,
and may not work as symlinks to busybox. Simply using whatever binary is
found in PATH and detecting symlinks automatically is more robust and
easier to maintain.
The list of binaries is also slightly cleaned up and duplicates are
removed.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Extracting TRX to separated file in /tmp/ just wastes some RAM while we
can just pass a proper extracting command to the default_do_upgrade.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45912
Extracting full TRX out of vendor format is not needed as otrx supports
passing TRX offset. This saves some RAM during sysupgrade.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45911
In most cases it allows reverting back to the vendor firmware (as they
usually don't use UBI). If users wants to do that we can't do anything
anyway. Erease counters will be just lost. The only thing we do is warn:
"Flashing firmware without UBI for rootfs. All erase counters will be
lost."
It still requires forcing sysupgrade.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45392
We can now detect that provided firmware contains kernel and UBI image
partitions. Flashing it in a sane way (keeping erase counters) still
needs to be implemented.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45391
