Meraki MR20

From TechInfoDepot
Jump to navigationJump to search
Cloud Managed AP
Wikipedia Cisco Systems
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Supported
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
Brand • Model • Rev Cisco Meraki MR20
FCC ID none specified
Type access point
CPU1 checkY Qualcomm IPQ4029
CPU1 Type ARM Cortex-A7
CPU1 Speed 700 MHz ( 4 cores )
Flash1 Chip Brand? Model?
Flash1 Size 128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (NAND)
RAM1 Size 256 MiB268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br />
RAM1 Chip Brand? Model?
ETH chip1 Qualcomm IPQ4029
Ethernet Port Count 1-1GbE-LAN
Wired Standard IEEE 802.3i/3u/3ab

802dot11 OUI: none specified

Expansion IF types none specified
Other
3rd Party Firmware Support OpenWrt • (List | Dev | DLs)
Retail
UPC 657768338762
(UPC DB, On eBay)
ASIN B0BXQ85CTY
Radio 1
Chip1 Qualcomm IPQ4029
Wireless interface OUI none specified
Antenna Connector Type none specified
MIMO status 2x2:2
Wireless Standard IEEE 802.11b/g/n
802.11n up to 300 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
Radio 2
Chip1 Qualcomm IPQ4029
Wireless interface OUI none specified
Antenna Connector Type none specified
MIMO status 2x2:2
Wireless Standard IEEE 802.11a/n/ac
802.11ac up to 867 Mbps
802.11n up to 300 Mbps
802.11a up to 54 Mbps
WiFi Operating Frequency 5 GHz

For a list of all currently documented Qualcomm chipsets with specifications, see Qualcomm.

For a list of all currently documented Cisco devices with specifications, see Cisco.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.),
• 867 Mbps - 2SS 5GHz 802.11ac (80MHz chan.) = AC1200 class

Flashing

Flashing OpenWrt

Target: ipq40xx
Subtarget: generic
Package architecture: arm_cortex-a7_neon-vfpv4
Supported Since Commit
Support started version: unknown
Current supported version: snapshot
WLAN Hardware: Qualcomm QCA4019
Installation method(s):
see git-commit
Recovery method(s):
see git-commit
git • >> 
ipq40xx: add support for Cisco Meraki MR20
This commit adds support for the Cisco Meraki MR20/Go GR10.

The Meraki MR20 is a Cisco 802.11ac/WiFi 5 AP with 1 Ethernet port.
It can be powered by a 12V DC barrel jack (5.5x2.5mm, center positive)
or via 802.3af POE.

The Meraki Go GR10 (codename: Maggot) is identical to the MR20
(codename: Grub), so this document will refer to both devices as the MR20.

MR20 hardware info:
* CPU: Qualcomm IPQ4029
* RAM: 256MB DDR3
* Storage: 128 MB (MX30LF1G18AC)
* Networking: 1 Gigabit Ethernet
* WiFi: QCA4019 802.11b/g/n/ac
* Serial: Internal header (J10, 2.54mm, unpopulated)

This device ships with secure boot, and cannot be flashed without
external programmers (TSOP48 NAND and I2C EEEPROM)!

Disassembly:

Remove the four rubber feet on the rear of the AP and the four
Torx T8 screws under the feet.

Using a guitar pick or similar plastic tool, insert it on the side
along the seam around the edge. Push in gently while gently lifting
the front of the housing to release the plastic retention clips.

There are 15 clips in total.

Once you have removed the plastic front (shown above already removed
so you know where the clips are), remove the 4 Philips screws holding
down the two metal WiFi antennas.

Lift the PCB gently while pushing the Ethernet port into the housing
to release it. The PCB should come free from the metal heat spreader.

The TSOP48 NAND flash (U9, Macronix/MXIC MX30LF1G18AC) is located on
the opposite side of the PCB.

To flash, you need to desolder the TSOP48 or use a 360 clip.

You also need to reprogram the I2C EEPROM (U20, Atmel 24c64).

Installation:

The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/mr20_gr10

The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```

* Dump your original NAND (if using nanddump, include OOB data).

* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.

* Decompress `ubi.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `ubi` portion of NAND from
`0xc60000`-`0x8400000` (length `0x77a0000`). Offsets here include OOB data.

* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x2c` or `0x25`). Remember to re-write the EEPROM with the
modified data.
    * This can be done on Linux via the following command:
    `printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`

**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.

* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.

OpenWrt Installation:

* After flashing NAND and EEPROM with external programmers. Plug in an
Ethernet cable and power up the device.

* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.

* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_mr20-initramfs-uImage.itb
```

* Once booted into the OpenWrt initramfs, created the `ART` ubivol with
the WiFi radio calibration from the mtd partition:
```
cat /dev/mtd10 > /tmp/ART.bin
ubiupdatevol /dev/ubi0_1 /tmp/ART.bin
```

* `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_mr20-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr20-squashfs-sysupgrade.bin"
```

* OpenWrt should now be installed on the device.

Signed-off-by: Hal Martin
Link: https://github.com/openwrt/openwrt/pull/20646
Signed-off-by: Robert Marko
Retrieved from "https://techinfodepot.shoutwiki.com/w/index.php?title=Meraki_MR20&oldid=545218"