User Tools

Site Tools


toh:meraki:mr18

Meraki MR18

Hardware

Info

Architecture: MIPS
Vendor: Atheros/Qualcomm
Bootloader: Cisco Nandloader
System-On-Chip: Atheros/Qualcomm QCA9557-AT4A
CPU Speed: 720MHz
Flash-Chip: Hynix H27U1G8F2BTR-BC TSOP48 ONFI NAND
Flash size: 128MiB
RAM: 2x Unknown DDR2 64MiB
RAM Size: 128MiB
Wireless: SoC AR9550 + 2x Atheros AR9582-AR1A
Switch: None
Ethernet ports: 1x Gigabit Atheros AR8035-A, 802.3af PoE capable
USB: No
Serial: Yes, settings
JTAG: Yes

WikiDevi Page is at https://wikidevi.com/wiki/Cisco_Meraki_MR18

Serial

Connect on UART (Console). J4 is closest to the boot set jumper under the console pins.

J4: VCC
J3: RX
J2: TX
J1: GND

Photos

Flash Layout

Stock

[    0.352000] Creating 5 MTD partitions on "ath79-nand":     
[    0.356000] 0x000000000000-0x000000080000 : "nandloader"                     
[    0.364000] 0x000000080000-0x000000880000 : "part1"                          
[    0.372000] 0x000000880000-0x000001080000 : "part2"                          
[    0.376000] 0x000001080000-0x000007f80000 : "ubi"                            
[    0.384000] 0x000007fe0000-0x000008000000 : "odm-caldata"     

OpenWRT

/ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "nandloader"
mtd1: 00800000 00020000 "kernel"
mtd2: 00800000 00020000 "recovery"
mtd3: 06f00000 00020000 "ubi"
mtd4: 00020000 00020000 "odm-caldata"

OpenWRT Installation

Prerequisites

  • 1x Meraki MR18
  • 1x UART adapter wired to the console port (speed is 115200).
  • Local computer (Static IP of 192.168.1.101) directly wired to the AP.
  • A local webserver application (apache, nginx, xampp, python script, etc.)

Note that before you start flashing, there are a few different flashing methods depending on your firmware version. If you have a MR18 that has never been used with Meraki, proceed with the "Factory" flash method. All other users will need to attempt the "Revised" flashing method.

If neither of the below flashing methods work for you or your device, then you will either need to JTAG your device (info at bottom of the page), or wait for another root method to be released.

Flashing (Factory Method)

1. Hookup UART and Ethernet to the MR18, with the Ethernet directly wired to your local machine. This is also done to prevent the MR18 from reaching the internet.

2. Once you have your UART console open hold down "s" on your keyboard, and plug in the power to the MR18. After a bit, you should then be dropped into a limited root shell.

3. From here, you will next need to bootstrap the rootfs filesystem. To do this, you will want to run the following command:

cat > /storage/root.sh

4. Note that at this point the console will sit empty, as this is normal. You will now want to copy and paste the following script into the console:

#!/bin/sh
ROOTFSMTD=$(cat /proc/mtd | grep -e "-1\"" | grep rootfs | awk '{ print substr($1, 4, length($1)-4) }')
if ! test -f /MERAKI_ARCH ; then
  # Mount new root
  mkdir /rootfs
  mount /dev/mtdblock$ROOTFSMTD /rootfs
  # Set up special filesystems
  mount -t devtmpfs dev /rootfs/dev
  mount -t proc proc /rootfs/proc
  mount -t sysfs sys /rootfs/sys
  mount -t tmpfs tmp /rootfs/tmp
  # Mount storage
  mount -t ubifs /dev/ubivol/storage /rootfs/storage
  # Switch to new root and continue execution
  cp "$0" /rootfs/tmp/root.sh
  busybox chroot /rootfs sh /tmp/root.sh
else
  # Setup network
  ifconfig eth0 192.168.1.1 netmask 255.255.255.0 up
  # Give ourselves a shell
  sh
fi

5. Once the code is copied, you can press CTRL+C to exit, which should take you back to a command prompt. Now make the script executable and run it:

chmod +x /storage/root.sh
/storage/root.sh

6. You should now be back to a new root prompt, but with working network connectivity. At this point, you'll want to download the firmware image for the MR18 from the repo at https://github.com/riptidewave93/Openwrt-MR18/releases and then extract the files to the root of your local webserver. Once this is done and you have verified that the 4 images are extracted and in the webroot folder, you can download the initramfs image to the MR18 and flash it:

wget http://192.168.1.2/openwrt-ar71xx-nand-mr18-initramfs.bin -O /storage/openwrt.bin
dd if=/storage/openwrt.bin of=/dev/mtdblock2

7. If both commands above completed without error, then you have successfully flashed the initramfs image to your device! To boot this, you will then want to unplug the power from the MR18, hold down "2" on your keyboard, and then plug in power to your MR18. This will then boot up the OpenWRT initramfs build.

NOTE: In the initramfs image, you may notice wifi does not work. This is because the factory MR18 firmware does not properly populate the UBI caldata partition with the required information, but we will take care of this shortly.

Second Note: If you are unable to boot to the initramfs by holding "2" down, this normally means you are not holding "2" at the right time. You need to hold this down at the exact same time power is applied to the MR18 for the bootloader to recognize the input.

8. Now that we have the initramfs build working, you'll want to browse to http://192.168.1.1/ which should then take you to the LuCI web interface. From here, you can just press login to enter as no password is set. Now, just go to the System Upgrade tab, and select the downloaded sysupgrade image named openwrt-ar71xx-nand-mr18-squashfs-sysupgrade.tar. Once selected, de-select the save config option and then press Upgrade. Once on the confirmation page, go ahead and flash the image.

9. This will remove the stock Meraki kernel, flash OpenWRT, fix the caldata partition if needed, and auto-expand rootfs_data to use the rest of the UBI free space.

Extras

- Video walkthrough: https://www.youtube.com/watch?v=ZTywBt3_W8Y

Here are a few ways to run a simple HTTP server on Linux/OS X:

lorenzo@miruna ~/meraki_fw $ python -m SimpleHTTPServer
Serving HTTP on 0.0.0.0 port 8000 ...

lorenzo@miruna ~/meraki_fw $ php -S 0.0.0.0:8081
PHP 5.5.9-1ubuntu4.11 Development Server started at Tue Sep  8 02:08:29 2015
Listening on http://0.0.0.0:8081
Document root is /home/lorenzo/meraki_fw
Press Ctrl-C to quit.

Flashing (Revised Method)

1. Hookup UART and Ethernet to the MR18, with the Ethernet directly wired to your local machine. This is also done to prevent the MR18 from reaching the internet.

2. On the MR18, hold down the reset button for 12~ seconds. The LED should start blinking, and then turn off. After the LED turns off, release the reset button. This will remove any configurations on the device. Let the AP reboot.

3. At this point you should be at a <Meraki> Prompt once the device reboots. Once here, please follow the guide over at https://servernetworktech.com/2016/02/pwning-the-meraki-mr18/ to help you re-enable access to the root shell.

4. Once the above steps are done, please move to the "Factory Method" of flashing as you will use the exact same commands.

Bootlogs

Stock Bootlog

__________________sri____________________ 944x BootROM Ver. (asic) 1.0 [Nov 8 2011 13:42:57] _________________________________________ find_hif: bootstrap = 0x31458 Nand Flash init hdr: [0xbd000400 : 0xbd000400 : 0x6fb4 : 0xe5c86b84] nand_load_fw: read 13 pages nand_load_fw: 0x10000 0x800 0xbd000bf0 nand_load_fw: 0x20000 0x800 0xbd0013f0 nand_load_fw: 0x30000 0x800 0xbd001bf0 nand_load_fw: 0x40000 0x800 0xbd0023f0 nand_load_fw: 0x50000 0x800 0xbd002bf0 nand_load_fw: 0x60000 0x800 0xbd0033f0 nand_load_fw: 0x70000 0x800 0xbd003bf0 nand_load_fw: 0x80000 0x800 0xbd0043f0 nand_load_fw: 0x90000 0x800 0xbd004bf0 nand_load_fw: 0xa0000 0x800 0xbd0053f0 nand_load_fw: 0xb0000 0x800 0xbd005bf0 nand_load_fw: 0xc0000 0x800 0xbd0063f0 nand_load_fw: 0xd0000 0x800 0xbd006bf0 f/w 0 read complete, jumping to 0xbd000400 Meraki Atheros LinuxLoader MR18 built Jan 31 2014 15:53:22 qca955x_init_ddr ok test_memory ok D-cache size: 64K I-cache size: 32K init_dram_uncached ok init_icache ok init_dcache ok enable_caches ok test_memory ok nand_flash_init ok loading fw at 256 hdr: [0x8e73ed8a : 0x400 : 0x169718 ] part1: Copying image to memory ... ........... done. part1: Checking sha1 (from 0x80060000 length 1480472) ... match part1: sha1 calculated: 412910ca51c6ada1ba83e036562ef3427dc6ece0 starting stage2 decompressing embedded kernel image 0x81a02640(0x1670b7) got osize 430c44 .....................done starting linux [ 0.000000] Linux version 3.4.80-meraki-ar7100+ (meraki@buildbot105.meraki.c4 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 00019750 (MIPS 74Kc) [ 0.000000] SoC: Qualcomm Atheros QCA9558 rev 0 [ 0.000000] Clocks: CPU:720.000MHz, DDR:600.000MHz, AHB:200.000MHz, Ref:40.0z [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 07fb0000 @ 00050000 (usable) [ 0.000000] Wasting 2560 bytes for tracking 80 unused pages [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000050 -> 0x00008000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] Early memory PFN ranges [ 0.000000] 0: 0x00000050 -> 0x00008000 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pa2 [ 0.000000] Kernel command line: console=ttyS0,115200 machtype=Meraki ubi.m8 [ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32s [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] Memory: 125084k/130752k available (2224k kernel code, 5668k rese) [ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, N1 [ 0.000000] NR_IRQS:51 [ 0.000000] Calibrating delay loop... 359.42 BogoMIPS (lpj=718848) [ 0.028000] pid_max: default: 32768 minimum: 301 [ 0.032000] Mount-cache hash table entries: 512 [ 0.036000] Performance counters: mips/74K PMU enabled, 4 32-bit counters av3 [ 0.040000] devtmpfs: initialized [ 0.044000] NET: Registered protocol family 16 [ 0.048000] gpiochip_add: registered GPIOs 0 to 23 on device: ath79 [ 0.052000] MIPS: machine is Meraki Access Point [ 0.056000] registering PCI controller with io_map_base unset [ 0.060000] registering PCI controller with io_map_base unset [ 0.068000] bio: create slab <bio-0> at 0 [ 0.072000] PCI host bridge to bus 0000:00 [ 0.076000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff] [ 0.080000] pci_bus 0000:00: root bus resource [io 0x0000] [ 0.084000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x1001ffff 64b] [ 0.088000] pci 0000:00:00.0: BAR 6: assigned [mem 0x10020000-0x1002ffff pre] [ 0.092000] PCI host bridge to bus 0000:01 [ 0.096000] pci_bus 0000:01: root bus resource [mem 0x12000000-0x13ffffff] [ 0.100000] pci_bus 0000:01: root bus resource [io 0x0001] [ 0.104000] pci 0000:01:00.0: BAR 0: assigned [mem 0x12000000-0x1201ffff 64b] [ 0.108000] pci 0000:01:00.0: BAR 6: assigned [mem 0x12020000-0x1202ffff pre] [ 0.112000] pci 0000:00:00.0: using irq 40 for pin 1 [ 0.116000] pci 0000:01:00.0: using irq 41 for pin 1 [ 0.120000] Switching to clocksource MIPS [ 0.124000] NET: Registered protocol family 2 [ 0.128000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.136000] TCP established hash table entries: 4096 (order: 3, 32768 bytes) [ 0.144000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes) [ 0.148000] TCP: Hash tables configured (established 4096 bind 4096) [ 0.156000] TCP: reno registered [ 0.160000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.164000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.172000] NET: Registered protocol family 1 [ 0.188000] Detected Meraki MR18 [ 0.204000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.208000] msgmni has been set to 244 [ 0.216000] io scheduler noop registered [ 0.216000] io scheduler deadline registered (default) [ 0.224000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled [ 0.252000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A [ 0.256000] console [ttyS0] enabled, bootconsole disabled [ 0.256000] console [ttyS0] enabled, bootconsole disabled [ 0.268000] Trying to register dev faulty etc [ 0.276000] ONFI param page 0 valid [ 0.276000] ONFI flash detected [ 0.280000] NAND device: Manufacturer ID: 0xad, Chip ID: 0xf1 (Hynix H27U1G8) [ 0.292000] Scanning device for bad blocks [ 0.352000] Creating 5 MTD partitions on "ath79-nand": [ 0.356000] 0x000000000000-0x000000080000 : "nandloader" [ 0.364000] 0x000000080000-0x000000880000 : "part1" [ 0.372000] 0x000000880000-0x000001080000 : "part2" [ 0.376000] 0x000001080000-0x000007f80000 : "ubi" [ 0.384000] 0x000007fe0000-0x000008000000 : "odm-caldata" [ 0.388000] UBI: attaching mtd3 to ubi0 [ 0.392000] UBI: physical eraseblock size: 131072 bytes (128 KiB) [ 0.400000] UBI: logical eraseblock size: 129024 bytes [ 0.404000] UBI: smallest flash I/O unit: 2048 [ 0.412000] UBI: sub-page size: 512 [ 0.416000] UBI: VID header offset: 512 (aligned 512) [ 0.420000] UBI: data offset: 2048 [ 0.564000] UBI: max. sequence number: 1947 [ 0.580000] UBI: attached mtd3 to ubi0 [ 0.584000] UBI: MTD device name: "ubi" [ 0.588000] UBI: MTD device size: 111 MiB [ 0.592000] UBI: number of good PEBs: 888 [ 0.596000] UBI: number of bad PEBs: 0 [ 0.600000] UBI: number of corrupted PEBs: 0 [ 0.604000] UBI: max. allowed volumes: 128 [ 0.612000] UBI: wear-leveling threshold: 4096 [ 0.616000] UBI: number of internal volumes: 1 [ 0.620000] UBI: number of user volumes: 7 [ 0.624000] UBI: available PEBs: 486 [ 0.628000] UBI: total number of reserved PEBs: 402 [ 0.636000] UBI: number of PEBs reserved for bad PEB handling: 8 [ 0.640000] UBI: max/mean erase counter: 10/2 [ 0.644000] UBI: image sequence number: 0 [ 0.648000] UBI: background thread "ubi_bgt0d" started, PID 201 [ 0.664000] tun: Universal TUN/TAP device driver, 1.6 [ 0.668000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> [ 0.676000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled/in0 [ 0.688000] TCP: cubic registered [ 0.692000] NET: Registered protocol family 17 [ 0.696000] devtmpfs: mounted [ 0.708000] Freeing unused kernel memory: 1468k freed [ 0.712000] Made it into bootsh: Nov 24 2014 18:15:08 [ 0.716000] bootsh build 22-149780 [ 0.728000] Mapping 5596 bytes for /lib/modules/leds-gpio.ko [ 0.736000] Mapping 133512 bytes for /lib/modules/ag7240_mod.ko [ 0.748000] qca955x_GMAC: Length per segment 1536 [ 0.752000] 955x_GMAC: qca955x_gmac_attach [ 0.756000] 955x_GMAC: qca955x_set_gmac_caps [ 0.760000] Currently in polling mode unit0 [ 0.764000] Registering AR8033 Phy.... [ 0.768000] qca955x_GMAC: Mac address for unit 0:bfff1000 [ 0.772000] qca955x_GMAC: 00:00:00:00:00:00 [ 0.780000] qca955x_GMAC: Max segments per packet : 1 [ 0.784000] qca955x_GMAC: Max tx descriptor count : 100 [ 0.788000] qca955x_GMAC: Max rx descriptor count : 252 [ 0.796000] qca955x_GMAC: Mac capability flags : 4200 [ 0.800000] 955x_GMAC: qca955x_gmac_attach [ 0.804000] 955x_GMAC: qca955x_set_gmac_caps [ 0.808000] Currently in polling mode unit1 [ 0.812000] Registering AR8033 Phy.... [ 0.816000] qca955x_GMAC: Mac address for unit 1:bfff1006 [ 0.824000] qca955x_GMAC: 00:00:00:00:00:00 [ 0.828000] qca955x_GMAC: Max segments per packet : 1 [ 0.832000] qca955x_GMAC: Max tx descriptor count : 100 [ 0.840000] qca955x_GMAC: Max rx descriptor count : 252 [ 0.844000] qca955x_GMAC: Mac capability flags : 4200 [ 1.472000] UBIFS: recovery needed [ 1.560000] UBIFS: recovery completed [ 1.564000] UBIFS: mounted UBI device 0, volume 1, name "storage" [ 1.568000] UBIFS: file system size: 19869696 bytes (19404 KiB, 18 MiB, 15) [ 1.576000] UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 8 LEB) [ 1.584000] UBIFS: media format: w4/r0 (latest is w4/r0) [ 1.588000] UBIFS: default compressor: lzo [ 1.592000] UBIFS: reserved for root: 938494 bytes (916 KiB) [ 1.632000] Bootsh: trying rootfs path: /dev/mtdblock/rootfs-22-149780-1 Attempting to setup root /dev/mtdblock/rootfs-22-149780-1... [ 2.440000] Mapping 5596 bytes for /lib/modules/leds-gpio.ko [ 2.676000] insmod: error initializing module /lib/modules/leds-gpio.ko: Fils [ 2.684000] Mapping 133512 bytes for /lib/modules/ag7240_mod.ko [ 2.696000] insmod: error initializing module /lib/modules/ag7240_mod.ko: Fis init started: BusyBox v1.20.2 (2014-11-24 17:48:19 PST) [ 2.988000] Algorithmics/MIPS FPU Emulator v1.5 [ 3.200000] Sat Jan 1 00:00:00 UTC 2000 WARNING! THIS CONSOLE IS LOGGED! UNAUTHORIZED ACCESS FORBIDDEN! <Meraki> [ 4.820000] athr_gmac_ring_alloc Allocated 1600 at 0x803ad800 [ 4.828000] athr_gmac_ring_alloc Allocated 4032 at 0x87639000 [ 5.132000] 955x_GMAC: eth0 in RGMII MODE [ 5.136000] 955x_GMAC: qca955x_gmac_sgmii_res_cal cal value = 0xe [ 5.156000] Scorpion -----> 8033 PHY [ 5.160000] athrs_ar8033_reg_init: Done [ 5.164000] Setting Drop CRC Errors, Pause Frames and Length Error frames [ 5.172000] Setting PHY... [ 5.472000] sysctl -w vm.panic_on_oom=2 [ 5.484000] vm.panic_on_oom = 2 [ 6.376000] click: starting router thread pid 454 (87725e00) [ 7.260000] elts_meraki: module license 'unspecified' taints kernel. [ 7.428000] Single synchronous check for reset [ 7.716000] [ 7.728000] boot 9 build 22-149780 board ar7100 mac 00:censored:00 [ 7.740000] Module: dummy .text=0xc02b1000 .data=0xc02b13b0 .bss= [ 7.740000] Module: mach_meraki_mr18_radios .text= .data= .bss=0xc02b8270 [ 7.740000] Module: proclikefs .text=0xc02c3000 .data= .bss=0xc02c3dc0 [ 7.740000] Module: merakiclick .text=0xc04ba000 .data=0xc05b0e90 .bss=0xc00 [ 7.740000] Module: elts_meraki .text=0xc09de000 .data=0xc0b9dda0 .bss=0xc00 [ 8.000000] phram: phram-oops device: 0x4000 at 0x10000 [ 8.112000] ramoops: platform device not found, using module parameters [ 8.144000] ln: /usr/bin/slowfcgi: File exists [ 10.016000] adf: module license 'Proprietary' taints kernel. [ 10.028000] asf: module license 'Proprietary' taints kernel. [ 10.252000] ath_spectral: module license 'Proprietary' taints kernel. [ 10.260000] ath_spectral: Version 2.0.0 [ 10.260000] Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights d [ 10.272000] SPECTRAL module built on Nov 24 2014 18:10:57 [ 10.308000] ath_hal: module license 'Proprietary' taints kernel. [ 10.328000] ath_hal: 0.9.17.1 (AR5416, AR9380, DEBUG, REGOPS_FUNC, WRITE_EEP) [ 10.464000] ath_dfs: module license 'Proprietary' taints kernel. [ 10.472000] ath_dfs: Version 2.0.0 [ 10.472000] Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights d [ 10.500000] ath_rate_atheros: module license 'Proprietary' taints kernel. [ 10.508000] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communicationsd [ 10.536000] ath_dev: module license 'Proprietary' taints kernel. [ 10.564000] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, Ald [ 10.576000] ath_pktlog: module license 'unspecified' taints kernel. [ 10.860000] ath_ahb: 9.5.5.36 (Atheros/multi-bss) [ 10.864000] __ath_attach: Set global_scn[0] [ 10.872000] ACBKMinfree = 48 [ 10.872000] ACBEMinfree = 32 [ 10.876000] ACVIMinfree = 16 [ 10.880000] ACVOMinfree = 0 [ 10.880000] CABMinfree = 48 [ 10.884000] UAPSDMinfree = 0 [ 10.892000] Bootstrap clock 40MHz [ 10.896000] Enterprise mode: 0x40000000 [ 10.900000] ar9300_flash_map: mapping EEPROM at 804920e0 [ 10.908000] Restoring Cal data from DRAM [ 10.916000] ath_get_caps[6072] rx chainmask mismatch actual 3 sc_chainmak 0 [ 10.924000] ath_get_caps[6046] tx chainmask mismatch actual 3 sc_chainmak 0 [ 10.948000] wifi0: Qualcomm Atheros QCA955X: mem=0xb8100000, irq=47 [ 10.956000] ath_pci: 9.5.5.36 (Atheros/multi-bss) [ 10.960000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002) [ 10.964000] __ath_attach: Set global_scn[1] [ 10.968000] ACBKMinfree = 48 [ 10.972000] ACBEMinfree = 32 [ 10.976000] ACVIMinfree = 16 [ 10.980000] ACVOMinfree = 0 [ 10.980000] CABMinfree = 48 [ 10.984000] UAPSDMinfree = 0 [ 10.992000] ar9300_flash_map: mapping EEPROM at c02b9290 [ 10.996000] Restoring Cal data from DRAM [ 11.004000] ath_get_caps[6072] rx chainmask mismatch actual 3 sc_chainmak 0 [ 11.012000] ath_get_caps[6046] tx chainmask mismatch actual 3 sc_chainmak 0 [ 11.076000] wifi1: Atheros 9580: mem=0x10000000, irq=40 hw_base=0xb0000000 [ 11.080000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002) [ 11.088000] __ath_attach: Set global_scn[2] [ 11.092000] ACBKMinfree = 48 [ 11.096000] ACBEMinfree = 32 [ 11.096000] ACVIMinfree = 16 [ 11.100000] ACVOMinfree = 0 [ 11.104000] CABMinfree = 48 [ 11.108000] UAPSDMinfree = 0 [ 11.112000] ar9300_flash_map: mapping EEPROM at c02ba2b0 [ 11.120000] Restoring Cal data from DRAM [ 11.128000] ath_get_caps[6072] rx chainmask mismatch actual 1 sc_chainmak 0 [ 11.136000] ath_get_caps[6046] tx chainmask mismatch actual 1 sc_chainmak 0 [ 11.156000] wifi2: Atheros 9580: mem=0x12000000, irq=41 hw_base=0xb2000000 [ 11.480000] brain: unloading click config [ 11.484000] brain: spring cleaning pages [ 12.884000] wlan_vap_create : enter. devhandle=0x85d803c0, opmode=IEEE80211_0 [ 12.892000] wlan_vap_create : exit. devhandle=0x85d803c0, opmode=IEEE80211_M. [ 13.728000] wlan_vap_create : enter. devhandle=0x858a03c0, opmode=IEEE80211_0 [ 13.740000] wlan_vap_create : exit. devhandle=0x858a03c0, opmode=IEEE80211_M. [ 14.272000] brain: loading click config [ 15.940000] wlan_vap_create : enter. devhandle=0x877b03c0, opmode=IEEE80211_0 [ 15.948000] wlan_vap_create : exit. devhandle=0x877b03c0, opmode=IEEE80211_M. [ 16.020000] device wifi2 entered promiscuous mode [ 16.280000] In write handler 'run' for 'set_splash_ranges :: Script': [ 16.288000] While calling 'splash_ranges_lookup0.add someip/32 0': [ 16.296000] conflict with existing route 'someip/32 - 0' [ 16.388000] In write handler 'run' for 'set_splash_ranges :: Script': [ 16.396000] While calling 'splash_ranges_lookup1.add someip/32 0': [ 16.400000] conflict with existing route 'someip/32 - 0' [ 17.388000] device wired0 entered promiscuous mode [ 17.396000] device wired1 entered promiscuous mode


JTAG

There is a 14 pin EJTAG connector present, the pinout is the same as regular 14 pin JTAG.

JTAG programming can only be done by USBJTAG NT for now, it may also be possible to unbrick your device using the USBJTAG

To ID/Detect the flash you need to send a PROGRAM command after powering on the router and counting to one. Here will find a MR18 config XML and USP script

More information and how to videos can be found on the USBJTAG Forums.

Tags

toh/meraki/mr18.txt · Last modified: 2017/06/12 19:29 by dack