EXPIRED Meraki MR52 29,90€ (gone)

usbTypeD

New Member
Apr 2, 2020
26
12
3
Looks great!
Would you explain what is possible from this prompt / in this mode? Would this give us the possibility to write an alternative firmware to the device?
 

hmartin

Active Member
Sep 20, 2017
270
189
43
35
The u-boot release used by Meraki on the MR52 does not have networking, so it is not possible to tftpboot an image.

The command bootbk is a custom command that Meraki added to u-boot, which sets a few environment variables before booting:
Code:
int do_bootbk (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
{
        ulong addr;
        char cmd[128];
        char cmdline[128];

        /* Validate arguments */
        if (argc != 4)
                return -1;

        do_panic_download();
#ifdef CONFIG_IPQ806X_PCI
        board_pci_deinit();
#endif /* CONFIG_IPQ806X_PCI */

        addr = simple_strtoul(argv[1], NULL, 16);

        sprintf(cmdline, "loader=u-boot part=%s",argv[2]);
        setenv("bootargs", cmdline);
        setenv("machid", "136b");
        sprintf(cmd, "bootm 0x%x#%s", (unsigned int)addr, argv[3]);
        printf(cmd);
        return run_command(cmd, 0);
}

U_BOOT_CMD(bootbk, 4, 0, do_bootbk,
           "Boot Meraki bootkernel",
           "bootbk <address> <partition-name> <itb config>");
So if you want to manipulate the boot arguments, you need to skip executing bootbk and do it manually yourself:
Code:
setenv bootargs console=ttyHSL1,115200n8 maxcpus=0 rdinit=/bin/sh part=bootkernel2 loader=u-boot
setenv machid 136b
nand read 0x42000000 0x02c40000 0x00a80000
bootm 0x42000000#config@2
Meraki seems to use a 2 step boot process on their products, so the OS you boot into with this command is not the normal MR52 OS and there is no networking. The built-in tools are rather limited and bootsh/init are binaries.

Simply put, I did not post this with a solution in mind, it was just interesting to note that there is a way into the device. Now, how to actually boot OpenWrt is still an open question...
 
  • Like
Reactions: usbTypeD

hmartin

Active Member
Sep 20, 2017
270
189
43
35
Big, big thanks to @clayface who did all the work to get the MR42 and MR52 supported in OpenWrt: ipq806x: add support for Cisco Meraki MR42/MR52 by clayface · Pull Request #4158 · openwrt/openwrt

For installation, you will need to disassemble your MR52 and use a USB to UART adapter to load a modified u-boot build with networking via UART. You will also need a tftp server to serve the initramfs image. Due to the recovery OS on the MR52 being very locked down, it is not possible to install OpenWrt without the use of UART.

Do not overwrite the stock u-boot or you will end up with a brick.
 

usbTypeD

New Member
Apr 2, 2020
26
12
3
Thats incredible news! Big thanks to @clayface !

The linked pull request does mention flashing an uboot. hmartin you mention to not
Do not overwrite the stock u-boot or you will end up with a brick.
. How do both infos align?
 

okrasit

Member
Jun 28, 2019
40
26
18
Managed to resolve this last night (at the third attempt). Have confirmed u-boot flashing is working having successfully tested on three devices.

If anyone has the means to manually write to a NAND I have two bricked MR42s and an MX65 available:D
I'm interested :p want to swap two bricked mr42:s for one untouched mr52 ?
 
Last edited:

usbTypeD

New Member
Apr 2, 2020
26
12
3
I followed the guide in the merge request but omitted the step "Proceed to flash the sysupgrade image...".
I was so happy seeing the usual openwrt luci frontend on screen that i unplugged the device to close the case.
Now it does pretty much nothing not even write anything on the UART. Do i own a brick now ? Any thing i could try?
 

clayface

New Member
Aug 16, 2020
4
3
3
I followed the guide in the merge request but omitted the step "Proceed to flash the sysupgrade image...".
I was so happy seeing the usual openwrt luci frontend on screen that i unplugged the device to close the case.
Now it does pretty much nothing not even write anything on the UART. Do i own a brick now ? Any thing i could try?
Do you have a terminal log? Omitting the sysupgrade shouldn't be an issue. When the device is powered on is there any LED activity?
 

usbTypeD

New Member
Apr 2, 2020
26
12
3
unfortunately i dont have a terminal log.
I know i flashed the network enabled uboot (hopefully correctly but the total absence of info coming in via UART lets me doubt that).
I also deleted the miraki OS partitions.
Via the terminal i then set the ip to something in my reachable range and accessed the luci web interface. Happy with that success i then unplugged the device to close the case fully and now i hate myself.

When plugged in the device switches on the red led, which stays red. The network interface led are off.
 

clayface

New Member
Aug 16, 2020
4
3
3
unfortunately i dont have a terminal log.
I know i flashed the network enabled uboot (hopefully correctly but the total absence of info coming in via UART lets me doubt that).
I also deleted the miraki OS partitions.
Via the terminal i then set the ip to something in my reachable range and accessed the luci web interface. Happy with that success i then unplugged the device to close the case fully and now i hate myself.

When plugged in the device switches on the red led, which stays red. The network interface led are off.
Did you try holding reset when powering on (and keep holding it for about 5 seconds)? Keep the tftp server active and IP to 192.168.1.250.
 

usbTypeD

New Member
Apr 2, 2020
26
12
3
Connected to POE while pressing down reset. UART connected to putty.
No output to terminal, no change to any leds. Red onboard led still on.
 

usbTypeD

New Member
Apr 2, 2020
26
12
3
Haven't heard anything from the seller despite paying on Monday... :confused:
same here. Asked the seller for some tracking info. Lets see

Got feedback that he will send the package today and add tracking # asap in ebay
 
Last edited:

hmartin

Active Member
Sep 20, 2017
270
189
43
35
It arrived and I can confirm it's functionally an MR32 in a weather sealed enclosure. Mine seems somewhat flaky, sometimes it just stays with a red LED with no output on UART and doesn't boot :confused:

Unfortunately the firmware is too new to use the reset button method mentioned in the OpenWrt installation instructions. I'll further disassemble it to modify the I2C EEPROM and then try the OpenWrt MR32 build.
 
  • Like
Reactions: legopc and usbTypeD