Meraki wrote the ethernet MAC-address of the device
onto the eeprom (AT24C64) at the fixed location 0x66
to 0x6C. Let's fetch it from there.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
1. Add leds and configs
2. Add network configs
3. Add script to clear partial boot flag
4. Hack to use port 5 as cpu port as port 8 connected to eth2
wont pass any frames
5. Enable EA9500 image generation
Hardware Info:
- Processor - Broadcom BCM4709C0KFEBG dual-core @ 1.4 GHz
- Switch - BCM53012 in BCM4709C0KFEBG & external BCM53125
- DDR3 RAM - 256 MB
- Flash - 128 MB (Toshiba TC58BVG0S3HTA00)
- 2.4GHz - BCM4366 4×4 2.4/5G single chip 802.11ac SoC
- Power Amp - Skyworks SE2623L 2.4 GHz power amp (x4)
- 5GHz x 2 - BCM4366 4×4 2.4/5G single chip 802.11ac SoC
- Power Amp - PLX Technology PEX8603 3-lane, 3-port PCIe switch
- Ports - 8 Ports, 1 WAN Ports
- Antennas - 8 Antennas
- Serial Port - @j6 [GND,TX,RX] (VCC NC) 115200 8n1
Flashing Instructions:
1. Connect a USB-TTL table to J6 on the router as well as a
ethernet cable to a lan port and your PC.
2. Power-on the router.
3. Use putty or a serial port program to view the terminal.
Hit Ctrl+C and interrupt the CFE terminal terminal.
4. Setup a TFTP server on your local machine at setup you
local IP to 192.168.1.2
5. Start the TFTP Server
6. Run following commands at the CFE terminal
flash -noheader 192.168.1.2:/openwrt.trx nflash0.trx
flash -noheader 192.168.1.2:/openwrt.trx nflash0.trx2
nvram set bootpartition=0 && nvram set partialboots=0 && nvram commit
7. Reboot router to be presented by OpenWrt
Note: Only installation method via serial cable is supported at the moment.
The trx firmware has to be flashed to both the partitions using following
commands from CFE prompt. This will cover US and Non-US variants.
Signed-off-by: Vivek Unune <npcomplete13@gmail.com>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
So far, board.d files were having execute bit set and contained a
shebang. However, they are just sourced in board_detect, with an
apparantly unnecessary check for execute permission beforehand.
Replace this check by one for existance and make the board.d files
"normal" files, as would be expected in /etc anyway.
Note:
This removes an apparantly unused '#!/bin/sh /etc/rc.common' in
target/linux/bcm47xx/base-files/etc/board.d/01_network
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This patch adds support for Cisco Meraki MR32.
The unit was donated by Chris Blake. Thank you!
WARNING:
Only the 1x1:1 abgn Air Marshal WIPS wifi is currently supported by b43:
b43-phy2: Found PHY: Analog 9, Type 4 (N), Revision 16
b43-phy2: Found Radio: Manuf 0x17F, ID 0x2057, Revision 9, Version 1
b43-phy2: Loading firmware version 784.2 (2012-08-15 21:35:19)
and only as 802.11ABG!
while WIFI1 and WIFI2 (both BCM4352) are not:
b43-phy0: Broadcom 4352 WLAN found (core revision 42)
b43-phy0 ERROR: FOUND UNSUPPORTED PHY (Analog 12, Type 11 (AC), Revision 1)
Hardware Highlights:
SoC: Broadcom BCM53016A1 (1 GHz, 2 cores)
RAM: 128 MiB
NAND: 128 MiB Spansion S34ML01G2 (~114 MiB useable)
ETH: 1GBit Ethernet Port - PoE
WIFI1: Broadcom BCM43520 an+ac (2x2:2 - id: 0x4352)
WIFI2: Broadcom BCM43520 bgn (2x2:2 - id: 0x4352)
WIFI3: Broadcom BCM43428 abgn (1x1:1 - id: 43428)
BLE: Broadcom BCM20732 (ttyS1)
LEDS: 1 x Programmable RGB Status LED (driven by a PWM)
1 x White LED (GPIO)
1 x Orange LED Fault Indicator (GPIO)
2 x LAN Activity / Speed LEDs (On the RJ45 Port)
BUTTON: one Reset button
MISC: AT24C64 8KiB EEPROM (i2c - stores Ethernet MAC + Serial#!)
ina219 hardware monitor (i2c)
Kensington Lock
SERIAL:
WARNING: The serial port needs a TTL/RS-232 3V3 level converter!
The Serial setting is 115200-8-N-1. The board has a populated
right angle 1x4 0.1" pinheader.
The pinout is: VCC, RX, TX, GND. (Use a multimeter)
Flashing needs a serial adaptor (due to the lack of a working dropbear on
the original firmware).
This flashing procedure for the MR32 was tested with firmware:
"r23-149867:150252-aacharya".
0. Create a seperate Ethernet LAN which does not have access to the internet.
Ideally use 192.168.1.2 for your PC. Make sure to reserve 192.168.1.1 it
will be used later on by the OpenWrt firmware. The original Meraki firmware
will likely try to setup the network via DHCP Discovery, so make sure your
PC is running a DHCP-Server (i.e.: dnsmasq)
'# dnsmasq -i eth# -F 192.168.1.5,192.168.1.50
Furthermore, the PC needs a supported ssh/http/ftp server in order to
retrieve the initramfs + dtb file
1. Disassemble the MR32 device by removing all screws (4 screws are located
under the 4 rubber feets!) and prying open the plastic covers without
breaking the plastic retention clips. Once inside, remove all the screws
on the outer metal shielding to get to the PCB. It's not necessary to
remove the antennas!
2. Connect the serial cable to the serial header.
3. Partially reassemble the outer metal shielding to ensure that the SoC
has a proper heat sink.
4. Connect the Ethernet patch cable to the device and the power cable.
5. Wait for the device to boot and enter the root shell.
(rooting is not discussed in detail here please refer to
Chris Blake - "pwning the meraki mr18" blog post:
<https://servernetworktech.com/2016/02/pwning-the-meraki-mr18/>
(The same method works with the MR32's r23-149867:150252-aacharya)
Wait for the MR32 to enter the "<Meraki>" prompt and enter:
<Meraki> odm serial_num read
(Verify that it matches what's on the S/N Sticker on the back!)
<Meraki> odm serial_num write Q2XX-XXXX-XXXV
<Meraki> odm serial_num read
(Verify that the S/N has changed - and the LED start to flash)
now to flash the firmware:
<Meraki> odm firmware part.safe "http://192.168.1.2/mr32-initramfs.bin"
Once OpenWrt booted use sysupgrade to permanently install
OpenWrt. To do this: Download the latest sysupgrade.bin file
for the MR32 to the device and use sysupgrade *sysupgrade.bin
to install it.
WARNING: DO NOT DELETE the "storage" ubi volume!
To flash later MR32 Firmwares like r25-201804051805-G885d6d78-dhow-rel
requires in-circut-i2c tools to access the I2C EEPROM AT24C64 next to
the SoC. The idea is pretty much the same as from Step 5 from above:
Change the serial number to Q2XXXXXXXXXV (should be around 0x7c), then
attach a serial cable, ethernet (but make sure the device can't reach
the internet!) hit "s" (the small s!) during boot to enter the root-shell
and add the following commands to the /storage/config there:
serial_allow_odm true
serial_access_enabled true
serial_access_check false
valid_config true
and then hit exit to let it finish booting.
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This reverts commit b1f6a5d9df.
In this particular case, the echo command was _not_ useless, but
converted the newlines back to spaces.
Add a comment into the code to make that obvious for the next one
looking at it like me.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The output is already produced in the inner $() brackets, no need
to catch and echo it again.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This prepares support for models XAP-1610 and XWR-3150. Flashing
requires using Luxul firmware version:
1) 8.1.0 or newer for XAP-1610
2) 6.4.0 or newer for XWR-3150
and uploading firmware using "Firmware Update" web UI page.
Signed-off-by: Dan Haab <dan.haab@legrand.com>
1. Use functions for cleaner code
2. Always execute WAN interface generic code
Before this change WAN interface code wasn't executed on all devices due
to an early "exit 0".
Acked-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Luxul ABR-4500 and XBR-4500 devices are wired routers with 5 Ethernet
ports and 1 USB 3.0 port. Flashing requires using Luxul firmware 6.4.0
or newer and uploading firmware using "Firmware Update" web UI page.
Signed-off-by: Dan Haab <dan.haab@legrand.com>
Do not parse /tmp/sysinfo/board_name, /proc/cpuinfo or the device tree
compatible string directly. Always use the board_name function to get
the board name.
The admswconfig package still reads /proc/cpuinfo directly. The code
looks somehow broken and the whole adm5120 which uses this package
looks unmaintained. Leave it as it is for now.
Signed-off-by: Mathias Kresin <dev@kresin.me>
It's needed for macaddr_add.
Fixes: 50efd403e6 ("bcm53xx: set WAN MAC address to don't share one with LAN interface")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
After analyzing numerous NVRAMs and vendor firmwares it seems the base
MAC address is used for LAN interface. WAN interface has different one
which sometimes is set directly in NVRAM and sometines needs to be
calculated.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
We override default Ethernet interface with eth0 which often uses random
MAC due to missing proper NVRAM entry. Fix this by manually assigning
MAC in the config.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Replace former uci-defaults.sh implementation with the uci-defaults-new.sh one
and update all users accordingly.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 47867
This removes calls to ucidef_set_interfaces_lan_wan() and
ucidef_set_interfaces_lan() on boards where all relevant info can be
inferred from the switch definition.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 47722
This changes uci-defaults-new.sh, config_generate and all relevant board.d
files in order combine ucidef_add_switch() and ucidef_add_switch_ports() into
a single function.
Also removes now superfluous enable and reset arguments.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
SVN-Revision: 47721
According to the info from NVRAM we should use port 8 for the CPU (and
interface eth2). Unfortunately it doesn't work right now, so lets switch
to the port 5.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Forwardport of r46586 from 15.05
SVN-Revision: 47281
This device seems to have switch port 7 connected to the CPU:
vlan1ports=1 2 3 5 7*
vlan2ports=0 7u
it should be handled by eth1 and NVRAM seems to confirm that (no
et0macaddr entry, existing et1macaddr & et1phyaddr entries).
One of the remaining ports (4/8?) may be connected to the Quantenna SoC.
Original firmware boot log contains following messages:
(0x00,0x5d)Port 5 States Override: 0xfb
(0x00,0x5f)Port 7 States Override: 0xfb
(0x00,0x0e)Port 8 States Override: 0x0a
(why does it force port 5 state?!)
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45692
It has 3 Ethernet interfaces, each of them connected to separated switch
port. Default NVRAM uses switch port 8 as CPU which is connected to the
3rd interface (eth2).
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 45681
