'nicknamed': Sparky

The Meraki Outdoor (FCCID:UDX-MERAKI-OTDR) is a variant of the Meraki Mini with a weather sealed enclosure, two ethernet ports and a more powerful 200 mW radio. The system is built on a Atheros AR2317. This device is very similar to the older Meraki Mini units and has similar software layout. 99% of the entries on the Mini apply to the sparky unit.

Watchdog guards this device...

The stock firmware both a software watchdog that writes to the ar2315 hardware watchdog. 90 seconds after power up, unless the software watchdog starts, the system reboots. Care must be taken in flashing device as Redboot will reboot the device after 5 minutes. I believe this does it by activating the hardware watchdog with a 5 minute heartbeat. Meraki has released the source code to its RedBoot here. This compiles (there is a syntax error with tail +2), and the existing Reboot will execute the new Redboot. It can be tested on the device by naming it art_ap51.elf and putting it on

Restore, with watchdog

I sucked the existing flash partitions of a virgin Meraki Outdoor unit:

ssh meraki@ 'dd if=/dev/mtd1 bs=64k' >stage2.bak
ssh meraki@ 'dd if=/dev/mtd2 bs=64k' >storage.bak
ssh meraki@ 'dd if=/dev/mtd3 bs=64k' >part1.bak
ssh meraki@ 'dd if=/dev/mtd4 bs=64k' >part2.bak
ssh meraki@ 'dd if=/dev/mtd5 bs=64k' >redboot-config.bak

The most important is the Storage Partition. The part1 and part2 are scrambled (?) and copied to ram by the stage2 bootloader. If you make changes to the storage partition that leave the device in an un-ssh'able state, you will need to restore the storage partition.

I was able to restore the stock Meraki flash from a bad flash by flashing in parts. Each flash takes <5 minutes: This was done by: telnet 9000 in the first 10 seconds after power-on

load -r -b 0x80150000 part1.bak
fis write -b 0x80150000 -l 0x1a0000 -f 0xa8150000
load -r -b 0x80150000 part1.bak
fis write -b 0x802f0000 -l 0x1a0000 -f 0xa82f0000
load -r -b 0x80150000 part2.bak
fis write -b 0x80150000 -l 0x1a0000 -f 0xa8490000
load -r -b 0x80150000 part2.bak
fis write -b 0x802f0000 -l 0x1a0000 -f 0xa8630000
load -r -b 0x80150000 stage2.bak
fis create
stage2            0xA8030000  0x80100000  0x00020000  0x80100000

Restore Storage Parition

load -r -b 0x80050000 storage.bak
fis write -b 0x80050000 -l 0x100000 -f 0xa8050000

* I think this will take longer than 5 mins. You may need to be quick, or do it in parts like part1.bak or part2.bak.

The watchdog: meraki_watchdog and the ar2315_wdt (Hardware watchdog)

To run a vanilla OpenWrt without periodic reboots, it would seem that either the reset needs to be disabled, or an alternate watchdog needs to poke the right thing. Use of the busybox 'watchdog' module may work, if the hardware watchdog is supported in the kernel. I believe the source to this device was released by Meraki and merged into the openwrt linux kernel source. In the stock Meraki firmware, a process called 'meraki_watchdog' connects to /dev/watchdog and checks:

* device has enough memory (7*1024 in kB) * /click filesystem is mounted * 'brain' process is running * ping to (or another IP) is successful * if the device is upgrading

The brain process sends the wireless interfaces up and down and configured. It starts the udhcpc client and hostapd daemons.

If the meraki_watchdog process is terminated, the hardware watchdog is not updated and the device hard reboots after 90 seconds. If the brain or click is terminated, the watchdog software reboots it after 5 minutes.

The meraki_watchdog process can be terminated if "watchdog -t 30 /dev/watchdog" is called afterward. This busybox module will update the hardware watchdog to prevent reboots.

After the meraki_watchdog process has been terminated the 'brain' terminated and click filesystem can be dismounted.

Breaking in...

The stock firmware gives 2 entry points into the boot process. It looks for /storage/ and /storage/ The is called just after the meraki_watchdog executes and before the brain/meraki specific processes are run.

I made a new file /storage/S80meraki:

ip route flush table main dev wired0
/sbin/udhcpc -i wired0 -f -p /var/run/ -R >> /var/log/udhcpc.wired0.lo
ip route flush table main dev wired1
/sbin/udhcpc -i wired1 -f -p /var/run/ -R >> /var/log/udhcpc.wired1.lo

if [ -f /storage/ ]; then
     * /storage/

if [ -d /storage/late-startup ]; then
    for i in /storage/late-startup/*; do
        [ -x $i ] && $i

I put this in /storage/

rm /etc/init.d/S80meraki
cp /storage/S80meraki /etc/init.d/S80meraki

I put this in /storage/

killall meraki_watchdog
watchdog -t 30 /dev/watchdog

These files are on the storage partition and will be called as part of the usual startup. This will prevent the brain and click from being started, and terminate the meraki_watchdog. The busybox watchdog will keep the device alive (Tested for 8 hours+).

The device is now yours and will not dial home! Am working on getting radio to work correctly now.

Back to top

oldwiki/openwrtdocs/hardware/meraki/outdoor.txt · Last modified: 2009/04/23 12:41 (external edit)