I've access to meraki mr12, license for cloud manage is expired, i want to run openwrt.
I've open the AP to try access to boot loader/console and i've found this

PB93 (ar7241 - Virian) U-boot
DRAM: 
sri
ar7240_ddr_initial_config(133): virian ddr1 init
#### TAP VALUE 1 = 0x2, 2 = 0x2 [0x1d0cc0: 0x21f7]
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 272k for U-Boot at: 83fb8000
Reserving 192k for malloc() at: 83f88000
Reserving 44 Bytes for Board Info at: 83f87fd4
Reserving 36 Bytes for Global Data at: 83f87fb0
Reserving 128k for boot params() at: 83f67fb0
Stack Pointer at: 83f67f98
Now running in RAM - U-Boot at: 83fb8000
id read 0x100000ff
flash size 16MB, sector count = 256
Flash: 16 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
Fetching MAC Address from 0x83fe7ea0
Virian External MII mode MDC CFG Value ==> 6
: cfg1 0xf cfg2 0x7014
eth0 link down
ATHRSF1_PHY: PHY unit 0x0, address 0x4, ID 0xd04e,
ATHRSF1_PHY: Port 0, Neg Success
ATHRSF1_PHY: unit 0 port 0 phy addr 4
eth0 up
eth0
RESET is un-pushed
Hit any key to stop autoboot:  0
ar7240> bdinfo
boot_params = 0x83F67FB0
memstart    = 0x80000000
memsize     = 0x04000000
flashstart  = 0x9F000000
flashsize   = 0x01000000
flashoffset = 0x0003A060
ethaddr     = 00:AA:BB:CC:DD:EE
ip_addr     = 192.168.1.1
baudrate    = 115200 bps
ar7240> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ar7240-nor0:256k(u-boot),256k(u-boot-env),6144k(rootfs),1024k(uImage),256k(NVRAM),8448k(ART)
bootcmd=cpckgo.b 0x9f2c0000 0x9f940000 0x80060000
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.1
serverip=192.168.1.101
loadUboot=tftpboot 0x80010000 u-boot.bin;erase 0x9f000000 +0x40000;cp.b 0x80010000 0x9f000000 0x40000
loadLinux=tftpboot 0x80010000 vmlinux.gz.uImage;erase 0x9f680000 +0x200000;cp.b 0x80010000 0x9f680000 0x200000
loadFiles=tftpboot 0x80010000 ap96-jffs2;erase 0x9f080000 +0x600000;cp.b 0x80010000 0x9f080000 0x600000
loadAll=run loadUboot;run loadLinux;run loadFiles
factory_boot=tftpboot 0x3000000 vmlinux.gz.uImage;bootm 0x3000000
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

i've made a full dump of spi MX25L12845EMI

Thanks for you support

I've also got a Meraki MR12 laying around. Been googling around and it seems it's an atheros based SoC.

i've asked to merwaki gpl soure code. They use openwrt in their device

no source from meraki, they give gpl source only for old product....

print default firmware bootlog

This is bootlog without network cable:

.

U-Boot 1.1.4-g0c3911dd (Mar  3 2011 - 17:08:51)

PB93 (ar7241 - Virian) U-boot
DRAM: 
sri
ar7240_ddr_initial_config(133): virian ddr1 init
#### TAP VALUE 1 = 0x2, 2 = 0x2 [0x38: 0x0]
64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 272k for U-Boot at: 83fb8000
Reserving 192k for malloc() at: 83f88000
Reserving 44 Bytes for Board Info at: 83f87fd4
Reserving 36 Bytes for Global Data at: 83f87fb0
Reserving 128k for boot params() at: 83f67fb0
Stack Pointer at: 83f67f98
Now running in RAM - U-Boot at: 83fb8000
id read 0x100000ff
flash size 16MB, sector count = 256
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
Fetching MAC Address from 0x83fe7ea0
Virian External MII mode MDC CFG Value ==> 6
: cfg1 0xf cfg2 0x7014
eth0 link down
ATHRSF1_PHY: PHY unit 0x0, address 0x4, ID 0xd04e,
ATHRSF1_PHY: Port 0, Neg Success
ATHRSF1_PHY: unit 0 port 0 phy addr 4
eth0 up
eth0
RESET is un-pushed
Hit any key to stop autoboot:  1 ... 0
part0: Copying image to memory ... done.
part0: Checking sha1 (from 0x80060000 length 4432552) ... match
part0: sha1 calculated: d63574f49f2fca7ac4fecd1bc38f5101d1de2de6
## Starting application at 0x80060000 ...
starting stage2
decompressing embedded kernel image 0x81a02640(0x437c4a)
got osize 1044610
....................done
starting linux
Booting AR7240(Python)...
.
[     0.000] Linux version 2.6.16.16-meraki-ar7100 (meraki@buildbot102.meraki.com) (gcc version 4.7.1 (GCC) ) #2 Mon Oct 7 17:43:15 PDT 2013

[     0.000] flash_size passed from bootloader = -1

[     0.000] setting it to 16 anyway

[     0.000] CPU revision is: 00019374

[     0.000] Determined physical RAM map:

[     0.000]  memory: 04000000 @ 00000000 (usable)

[     0.000] Built 1 zonelists

[     0.000] Kernel command line: "console=ttyS0,115200 root=01:00 rd_start=0x80600000 rd_size=8388608 init=/sbin/init"

[     0.000] Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.

[     0.000] Primary data cache 32kB, 4-way, linesize 32 bytes.

[     0.000] Synthesized TLB refill handler (20 instructions).

[     0.000] Synthesized TLB load handler fastpath (32 instructions).

[     0.000] Synthesized TLB store handler fastpath (32 instructions).

[     0.000] Synthesized TLB modify handler fastpath (31 instructions).

[     0.000] Cache parity protection disabled

[     0.000] PID hash table entries: 512 (order: 9, 8192 bytes)

[     0.000] Using 200.000 MHz high precision timer.

[     0.001] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)

[     0.002] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)

[     0.009] Memory: 47360k/65536k available (1445k kernel code, 18148k reserved, 359k data, 14852k init, 0k highmem)

[     0.032] Mount-cache hash table entries: 512

[     0.033] Checking for 'wait' instruction...  available.

[     0.035] unpacking initramfs....done in 0.176000

[     0.213] NET: Registered protocol family 16

[     0.214] PCI init:ar7240_pcibios_init

[     0.215] ar7240_pcibios_init(298): PCI CMD write: 0x356

[     0.222] Algorithmics/MIPS FPU Emulator v1.5

[     0.238] Returning IRQ 48

[     0.314] ar7240_wdt_init: last reboot watchdog: 1

[     0.491] JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.

[     0.492] Initializing Cryptographic API

[     0.493] io scheduler noop registered

[     0.494] io scheduler deadline registered (default)

[     0.527] Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled

[     0.538] serial8250: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A

[     0.570] AG7240: Length per segment 1536

[     0.571] AG7240: Max segments per packet 2

[     0.572] AG7240: Max tx descriptor count    200

[     0.573] AG7240: Max rx descriptor count    252

[     0.574] AG7240: fifo cfg 3 01f00140

[     0.575] AG7240CHH: Mac address for unit 0

[     0.576] AG7240CHH: 00:03:7f:ff:ff:ff

[     0.787] AG7240CHH: Mac address for unit 1

[     0.788] AG7240CHH: 00:03:7f:ff:ff:fe

[     1.010] tun: Universal TUN/TAP device driver, 1.6

[     1.011] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>

[     1.022] Creating 8 MTD partitions on "ar7100-nor0":

[     1.023] 0x00000000-0x00080000 : "Uboot & env"

[     1.055] 0x00080000-0x000a0000 : "board config"

[     1.087] 0x000a0000-0x000c0000 : "panic"

[     1.119] 0x000c0000-0x002c0000 : "storage"

[     1.151] 0x00fe0000-0x01000000 : "caldata"

[     1.168] 0x002c0000-0x007e0000 : "part1"

[     1.181] 0x00940000-0x00e60000 : "part2"

[     1.213] 0x00000000-0x01000000 : "ALL"

[     1.235] i2c /dev entries driver

[     1.246] NET: Registered protocol family 2

[     1.291] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)

[     1.292] TCP established hash table entries: 4096 (order: 3, 32768 bytes)

[     1.293] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)

[     1.294] TCP: Hash tables configured (established 4096 bind 4096)

[     1.295] TCP reno registered

[     1.296] TCP bic registered

[     1.297] NET: Registered protocol family 1

[     1.298] NET: Registered protocol family 17

[     1.302] Freeing unused kernel memory: 2129028k freed

init started: BusyBox v1.20.2 (2013-10-07 17:24:22 PDT)
[     2.136] sysctl: error: 'kernel.softlockup_panic' is an unknown key

[     2.137] sysctl: error: 'kernel.hung_task_panic' is an unknown key

[     2.138] sysctl: error: 'vm.panic_on_oom' is an unknown key

[     2.240] module load for dummy load 0.027000 init 0.025000 total 0.052000

[     2.339] ag7240_ring_alloc Allocated 3200 at 0x83230000

[     2.340] ag7240_ring_alloc Allocated 4032 at 0x8324c000

[     2.342] Virian CFG Value ==> 6

[     2.343] Virian MDC CFG Value ==> 6

[     2.344] ATHRSF1_PHY: athr_reg_init

[     2.345] Setting PHY...

[     2.346] ATHRSF1_PHY: Port 0, Neg Success

[     2.347] ATHRSF1_PHY: unit 0 phy addr 4 Not enabling interrupts in AR7242 yet...

[     2.411] ag7240_ring_alloc Allocated 3200 at 0x81027000

[     2.412] ag7240_ring_alloc Allocated 4032 at 0x80237000

[     2.414] Virian mac 1 CFG Value ==> 6

[     2.415] Virian MDC CFG Value ==> 6

[     2.416] ATHRS26: resetting s26

[     2.517] ATHRS26: s26 reset done

[     2.521] Setting PHY...

[     4.271] ath_hal: module license 'Proprietary' taints kernel.

[     4.305] ath_hal: 0.9.17.1 (AR5416, DEBUG, REGOPS_FUNC, PRIVATE_DIAG, WRITE_EEPROM, 11D, AH_SUPPORT_EEPROM_AR9287)

[     4.312] module load for ath_hal load 0.044000 init 0.007000 total 0.051000

[     4.495] ath_dfs: Version 2.0.0

[     4.495] Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved

[     4.496] module load for ath_dfs load 0.032000 init 0.001000 total 0.033000

[     4.598] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved

[     4.599] module load for ath_rate_atheros load 0.031000 init 0.001000 total 0.032000

[     4.753] wlan: 0.8.4.2 (Atheros/multi-bss)

[     4.754] module load for wlan load 0.076000 init 0.001000 total 0.077000

[     4.858] ath_spectral: Version 2.0.0

[     4.858] Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved

[     4.859] SPECTRAL module built on Oct  7 2013 17:41:45

[     4.860] module load for ath_spectral load 0.032000 init 0.002000 total 0.034000

[     4.986] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved

[     4.987] module load for ath_dev load 0.051000 init 0.001000 total 0.052000

[     5.086] module load for proclikefs load 0.028000 init 0.000000 total 0.028000

[     5.157] Single synchronous check for reset

[     5.266] ath_pci: 0.9.4.5 (Atheros/multi-bss)

[     5.304] ath_descdma_setup: tx DMA map: a3820000 (75776) -> 3820000 (75776)

[     5.306] ath_descdma_setup: beacon DMA map: a12cc000 (2960) -> 12cc000 (2960)

[     5.307] ath_descdma_setup: rx DMA map: a12d0000 (37888) -> 12d0000 (37888)

[     5.335] wifi0: Atheros 9280: mem=0x10000000, irq=48 hw_base=0xb0000000 ver=0x80 rev=0x2

[     5.336] module load for ath_pci load 0.044000 init 0.070000 total 0.114000

[     5.759] module load for merakiclick load 0.244000 init 0.001000 total 0.245000

[     5.796] click: starting router thread pid 272 (83358780)

[     5.910] module load for pca9534 load 0.027000 init 0.025000 total 0.052000

[     6.029] wlan: mac acl policy registered

[     6.030] module load for wlan_acl load 0.027000 init 0.001000 total 0.028000

[     6.150] module load for wlan_ccmp load 0.029000 init 0.000000 total 0.029000

[     6.271] module load for wlan_scan_ap load 0.030000 init 0.000000 total 0.030000

[     6.393] module load for wlan_scan_sta load 0.030000 init 0.000000 total 0.030000

[     6.513] module load for wlan_tkip load 0.029000 init 0.000000 total 0.029000

[     6.631] module load for wlan_wep load 0.027000 init 0.000000 total 0.027000

[     6.749] module load for wlan_xauth load 0.026000 init 0.000000 total 0.026000

[     6.936]

[     6.971] boot 38 build 20-118937 board ar7100 mac 00:18:0A:22:60:E1

[     6.982] Module: dummy  .text=0xc0053000 .data=0xc0053700 .bss=0xc0053860

[     6.982] Module: ath_hal  .text=0xc00b5000 .data=0xc00fc1d0 .bss=0xc00ffc60

[     6.982] Module: ath_dfs  .text=0xc0067000 .data=0xc0070610 .bss=0xc0070780

[     6.982] Module: ath_rate_atheros  .text=0xc0061000 .data=0xc0065070 .bss=0xc0065400

[     6.982] Module: wlan  .text=0xc016d000 .data=0xc01b28e0 .bss=0xc01b42c0

[     6.982] Module: ath_spectral  .text=0xc0091000 .data=0xc009aa00 .bss=0xc009ab80

[     6.982] Module: ath_dev  .text=0xc01b6000 .data=0xc01dff10 .bss=0xc01e0300

[     6.982] Module: proclikefs  .text=0xc0050000 .data=0xc00515e0 .bss=0xc0051720

[     6.982] Module: ath_pci  .text=0xc010c000 .data=0xc0119880 .bss=0xc0119e40

[     6.982] Module: merakiclick  .text= .data= .bss=

[     6.982] Module: pca9534  .text=0xc009f000 .data=0xc009fd50 .bss=0xc00a01a0

[     6.982] Module: wlan_acl  .text=0xc00a4000 .data=0xc00a5030 .bss=0xc00a5180

[     6.982] Module: wlan_ccmp  .text=0xc00ad000 .data=0xc00aefd0 .bss=0xc00af120

[     6.982] Module: wlan_scan_ap  .text=0xc00a9000 .data=0xc00ab240 .bss=0xc00ab380

[     6.982] Module: wlan_scan_sta  .text=0xc0121000 .data=0xc0123cc0 .bss=0xc0123e00

[     6.982] Module: wlan_tkip <5>brain: unloading click config

[     8.925] ath_set_country: set country to US

[     9.875] brain: loading click config

SPI MX25L12845E have this ID 0xc22018, same id have mx25l12805d what is supported by m25p80.c default kernel driver.

try build own image for example based on PB92. just edit target/linux/ar71xx/image/Makefile on line 179 (AA)

pb92_mtdlayout=mtdparts=spi0.0:256k(u-boot)ro,256k(u-boot-env)ro,1024k(kernel),6144k(rootfs),256k(nvram),8448k(art),7168k@0x80000(firmware)

and line 803

$(eval $(call SingleProfile,AthLzma,$(fs_64k),PB92,pb92,PB92,ttyS0,115200,$$(pb92_mtdlayout),1048576,6291456,KRuImage))

(Last edited by neryba on 29 Jan 2014, 08:43)

Bumping this for updates.

Anyone had any success?  I'd imagine there's a whole load of people (me included) out there looking for an alt firmware on these devices...

I've got an image built to flash (learning as I go) but not sure which method to use, serial/tftp etc?

I would try tftp loading a ramdisk based OpenWrt image first. It's enough to actually write something on the flash when everything works.

Hey Kaloz,

Thanks for the reply.

On my list of things to do this weekend.

Hmm. 

I got overconfident and failed, looks like it's bricked. 

TFTPboot worked, but when I went to flash it I think I calculated the memory values incorrectly and erased/overwrote the wrong part of the flash.  All I get now are 4 green lights and an orange.

Nothing out of serial, and the J2 ports only give me garbled nonsense so I'm presuming that's a JTAG port? 

Damn.

superpippo82xxx - if you've still got it, can you mail me the dump you took of MX25L12845EMI please?

@wooyah i've the dump, give me you adrress and i'll send you.

Superb, thanks!

Did you work out if J2 was a JTAG connection by the way?  It's only 4 pins, but if I connect a serial console to it the output is very similar to what you'd see if you connected a serial console to a JTAG connector (i.e garbled nonsense!).

Instead of email, could you post to http://www.zippyshare.com/ please?  Makes more sense thinking about it.

Guys, I think there are a ton of people watching your progress. I have an MR12 coming out of cloud license in 3 weeks, would love to convert it to OpenWRT.

All feedback MUCH appreciated....

this is the dump

http://www8.zippyshare.com/v/9347503/file.html

i''ve made dump from spi
if i remember jp2 is tty

Hey Ammaree,

Yeah I had a feeling there would be a lot of people in the same boat, particularly as Cisco are giving these APs away to everyone.

I think it's basically there, just needs the final confirmation and a write up.  I've started putting the wiki page together with bits and pieces I've found along the way already, but it's definitely lacking.

Installation wise, I think tftp/serial is the way to go as I couldn't get the raw_upgrade page (http://10.128.128.128/configure/raw_upgrade.html) to take any image at all.

Thank you very much!

Hmm, interesting.  I previously accessed the console via JP1, would it have two serial ports?  JP2 seems to have a couple of broken traces/resistors missing on the back of the board thinking about it.

Hmm, going to make flashing that SPI interesting...

Got a testing clip and an FTDI SPI programmer on the way.

One way or another this thing is going to be running OpenWRT by the weekend.

Also, noted this in the Community section:

https://forum.openwrt.org/viewtopic.php … mp;login=1

OP has had success with the MR16, again via serial flash method only but looks promising.

Hey Wooyah, if you join the #openwrt IRC channel I'll be more than happy to take a peak and see what we can do. Just PM me on IRC, I use the same nic as here.

It shouldn't be too hard getting it to run. Should be very similar to that of the MR16.

Hey parker955, will do. 

Just waiting on my test clip to arrive so I can re-write the flash.  Once I'm back up I'll drop you a line. 

Thanks.

Just wondering if anyone is having any luck on this.  A chunk of this is over my head but I'd be glad to contribute time and hardware to making this work.  Thousands of APs coming off license ---- no wonder people are interested in doing this.

(Last edited by Dingus on 31 Aug 2014, 17:25)

Struggling to rewrite my SOIC which is kind of annoying, just plain refuses to be detected in flashrom. 

Might de-solder and retry it this weekend.

I've used raspberry to write end read flash.
Do you need help?