]> git.ipfire.org Git - thirdparty/openwrt.git/commitdiff
ipq40xx: add support for Cisco Meraki MR30H 17026/head
authorHal Martin <hal.martin@gmail.com>
Sun, 19 Oct 2025 10:15:19 +0000 (12:15 +0200)
committerRobert Marko <robimarko@gmail.com>
Sun, 19 Oct 2025 17:33:18 +0000 (19:33 +0200)
This commit adds support for the Cisco Meraki MR30H. The MR30H is a POE
powered 802.11ac access point with an integrated 5 port Gigabit switch.

MR30H hardware info:
* CPU: Qualcomm IPQ4029
* RAM: 256MB DDR3
* Storage: 128 MB (S34ML01G200TFV00)
* Networking: QCA8075 internal switch (5x 1GbE ports)
* WiFi: QCA4019 802.11b/g/n/ac, QCA9889 802.11/b/g/n/ac scanning radio
* Serial: Internal header (J8, 2.54mm, populated)

LAN5 (rear) is for POE input. LAN4 has POE output (802.3af) when powered
by an 802.3at source.

The LAN4 port is used for tftp booting in U-Boot.

This device does not have secure boot, but cannot be flashed without
external programmers (TSOP48 NAND) as Meraki disabled interrupting U-Boot
for any device that updated after ~2017.

Disassembly:

* Remove the two T10 screws on the rear of the AP.

* Using a guitar pick or similar plastic tool, insert it on the side between
the grey metal plate and the white plastic body and pry up gently.
    * The rubberised border on the metal plate does not need to be removed.

* The metal back plate has several latches around the perimeter (but none on
the bottom by the Ethernet ports).

* Once you have removed the metal back plate, push up gently on the bottom
Ethernet ports while pulling gently on the rear-mounted Ethernet port to remove
the PCB.

* The PCB should come free from the plastic housing, pull the bottom
(4 Ethernet ports) up as if you are opening a book.
    * If done carefully, there is no need to remove the WiFi antenna connectors
    to access the NAND flash.

* The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the
opposite side of the PCB.

* To flash, you need to desolder the TSOP48 or use a 360 clip.

Installation:

The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/mr30h

The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```

* Dump your original NAND (if using nanddump, include OOB data).

* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.

* Resolder the NAND after overwriting the `u-boot` regions.

OpenWrt Installation:

* After flashing NAND with the external programmer. Plug an Ethernet
cable into port 4. Power up the device.

* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.

* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_mr30h-initramfs-uImage.itb
```

* Once booted into the OpenWrt initramfs, `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin"
```

* OpenWrt should now be installed on the device.

Alternative installation steps if your device has U-Boot older than:
`U-Boot 2017.07-RELEASE-g78ed34f31579 (Sep 29 2017 - 07:43:44 -0700)`

**BIG FAT WARNING BEGIN**

Attmping to interrupt boot on a newer U-Boot release may permanently
brick your device! See: riptidewave93/LEDE-MR33#13

**BIG FAT WARNING END**

* Use `ubootwrite.py` from the above GitHub repository to transfer the
`u-boot.itb`
image to the router.
```
./ubootwrite.py --serial=/dev/ttyUSB0 --write u-boot.itb
```

* To avoid bricking your router, it is highly recommended at this point that
you flash the unlocked U-Boot to the `part.safe` ubi volume.
```
run set_ubi && ubi write $loadaddr part.safe 0x2fd48
```

* Power cycle the router. The stock Meraki U-Boot will boot `part.safe` which
is now the unlocked U-Boot.

* Use the new U-Boot build (`" "` to interrupt boot) to
`tftpboot` the OpenWrt initramfs image:
```
dhcp
setenv serverip <tftp_server_addr>
tftpboot openwrt-ipq40xx-generic-meraki_mr30h-initramfs-uImage.itb
bootm
```

* It is only recommended to flash U-Boot to the `u-boot` NAND region from
Linux:
```
insmod mtd-rw i_want_a_brick=1
```

* Copy `u-boot.elf` to the router:
```
scp -O u-boot.elf root@192.168.1.1:/tmp/
```

Note: If any of the below commands fails, YOU WILL HAVE A BRICK IF YOU
REBOOT OR LOSE POWER. Only a hardware programmer can recover the device.
```
flash_erase /dev/mtd8 0 0
nandwrite -p /dev/mtd8 /tmp/u-boot.elf
```

Note: ONLY use `u-boot.elf` when flashing the `u-boot` region (`/dev/mtd8`);
`u-boot.bin` or `u-boot.itb` will BRICK YOUR DEVICE

* `scp` the `sysupgrade` image to the device and run the normal `sysupgrade`
procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin"
```

* OpenWrt should now be installed on the device.

Signed-off-by: Hal Martin <hal.martin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17026
Signed-off-by: Robert Marko <robimarko@gmail.com>
package/firmware/ipq-wifi/Makefile
target/linux/ipq40xx/base-files/etc/board.d/01_leds
target/linux/ipq40xx/base-files/etc/board.d/02_network
target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4029-mr30h.dts [new file with mode: 0644]
target/linux/ipq40xx/image/generic.mk

index 9188baf4a526ca2faef2febfe9451c7b089408bd..3c4d9af3286f6e297b803f9aea3570358e8a95e9 100644 (file)
@@ -57,6 +57,7 @@ ALLWIFIBOARDS:= \
        linksys_mx8500 \
        linksys_spnmx56 \
        linksys_whw03 \
+       meraki_mr30h \
        meraki_z3 \
        netgear_lbr20 \
        netgear_rax120v2 \
@@ -231,6 +232,7 @@ $(eval $(call generate-ipq-wifi-package,linksys_mx5500,Linksys MX5500))
 $(eval $(call generate-ipq-wifi-package,linksys_mx8500,Linksys MX8500))
 $(eval $(call generate-ipq-wifi-package,linksys_spnmx56,Linksys SPNMX56))
 $(eval $(call generate-ipq-wifi-package,linksys_whw03,Linksys WHW03))
+$(eval $(call generate-ipq-wifi-package,meraki_mr30h,Meraki MR30H))
 $(eval $(call generate-ipq-wifi-package,meraki_z3,Meraki Z3))
 $(eval $(call generate-ipq-wifi-package,netgear_lbr20,Netgear LBR20))
 $(eval $(call generate-ipq-wifi-package,netgear_rax120v2,Netgear RAX120v2))
index 96ad90324481849791fe48772c4b832f8b36202c..2ab1b679abe4032c97b918941c53fe89283e9379 100644 (file)
@@ -109,6 +109,16 @@ meraki,z3)
        ucidef_set_led_netdev "lan4_link" "LAN5 (link)" "green:lan-8" "lan5" "link"
        ucidef_set_led_netdev "lan4_act" "LAN5 (txrx)" "green:lan-9" "lan5" "tx rx"
        ;;
+meraki,mr30h)
+       ucidef_set_led_netdev "lan1_link" "LAN1 (link)" "green:lan-0" "lan1" "link"
+       ucidef_set_led_netdev "lan1_act" "LAN1 (txrx)" "amber:lan-1" "lan1" "tx rx"
+       ucidef_set_led_netdev "lan2_link" "LAN2 (link)" "green:lan-2" "lan2" "link"
+       ucidef_set_led_netdev "lan2_act" "LAN2 (txrx)" "amber:lan-3" "lan2" "tx rx"
+       ucidef_set_led_netdev "lan3_link" "LAN3 (link)" "green:lan-4" "lan3" "link"
+       ucidef_set_led_netdev "lan3_act" "LAN3 (txrx)" "amber:lan-5" "lan3" "tx rx"
+       ucidef_set_led_netdev "lan4_link" "LAN4 (link)" "green:lan-6" "lan4" "link"
+       ucidef_set_led_netdev "lan4_act" "LAN4 (txrx)" "amber:lan-7" "lan4" "tx rx"
+       ;;
 netgear,ex6100v2 |\
 netgear,ex6150v2)
        ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:router" "phy0tpt"
index af92401a304e2e535a4991dbf3f77ecaeccae3d0..a96bb64b4d9a55986ffd9d4f4ca963209af008df 100644 (file)
@@ -138,6 +138,9 @@ ipq40xx_setup_interfaces()
                ucidef_set_interface_lan "lan1 lan2"
                ucidef_set_interface "wan" device "/dev/cdc-wdm0" protocol "qmi"
                ;;
+       meraki,mr30h)
+               ucidef_set_interface_lan "lan1 lan2 lan3 lan4 lan5"
+               ;;
        *)
                echo "Unsupported hardware. Network interfaces not initialized"
                ;;
index cea5b0ce6964dae214873bfb16bc8212cccfdcef..bbf618716f254cc81f393c667481466f295a36ab 100644 (file)
@@ -178,6 +178,7 @@ platform_do_upgrade() {
        linksys,whw03)
                platform_do_upgrade_linksys_emmc "$1"
                ;;
+       meraki,mr30h |\
        meraki,mr33 |\
        meraki,mr74)
                CI_KERNPART="part.safe"
diff --git a/target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4029-mr30h.dts b/target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4029-mr30h.dts
new file mode 100644 (file)
index 0000000..1789646
--- /dev/null
@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: GPL-2.0-only
+// Device Tree Source for Meraki MR30H (Noisy Cricket)
+
+#include "qcom-ipq4029-wired-qca-common.dtsi"
+
+/ {
+       model = "Meraki MR30H";
+       compatible = "meraki,mr30h";
+
+       soc {
+               /* for USB PHY, device has no USB port */
+               tcsr@194b000 {
+                       status = "disabled";
+               };
+       };
+
+       leds {
+               compatible = "gpio-leds";
+
+               power_orange: power {
+                       color = <LED_COLOR_ID_AMBER>;
+                       function = LED_FUNCTION_POWER;
+                       gpios = <&tlmm 49 GPIO_ACTIVE_LOW>;
+                       panic-indicator;
+               };
+
+               led-0 {
+                       /* LAN 1 act */
+                       color = <LED_COLOR_ID_AMBER>;
+                       function = LED_FUNCTION_ACTIVITY;
+                       gpios = <&tlmm 33 GPIO_ACTIVE_LOW>;
+               };
+
+               led-1 {
+                       color = <LED_COLOR_ID_GREEN>;
+                       function = LED_FUNCTION_LAN;
+                       function-enumerator = <1>;
+                       gpios = <&tlmm 32 GPIO_ACTIVE_LOW>;
+               };
+
+               led-2 {
+                       /* LAN 2 act */
+                       color = <LED_COLOR_ID_AMBER>;
+                       function = LED_FUNCTION_ACTIVITY;
+                       gpios = <&tlmm 27 GPIO_ACTIVE_HIGH>;
+               };
+
+               led-3 {
+                       color = <LED_COLOR_ID_GREEN>;
+                       function = LED_FUNCTION_LAN;
+                       function-enumerator = <2>;
+                       gpios = <&tlmm 26 GPIO_ACTIVE_LOW>;
+               };
+
+               led-4 {
+                       /* LAN 3 act */
+                       color = <LED_COLOR_ID_AMBER>;
+                       function = LED_FUNCTION_ACTIVITY;
+                       gpios = <&tlmm 25 GPIO_ACTIVE_LOW>;
+               };
+
+               led-5 {
+                       color = <LED_COLOR_ID_GREEN>;
+                       function = LED_FUNCTION_LAN;
+                       function-enumerator = <3>;
+                       gpios = <&tlmm 24 GPIO_ACTIVE_LOW>;
+               };
+
+               led-6 {
+                       /* LAN 4 act */
+                       color = <LED_COLOR_ID_AMBER>;
+                       function = LED_FUNCTION_ACTIVITY;
+                       gpios = <&tlmm 23 GPIO_ACTIVE_LOW>;
+               };
+
+               led-7 {
+                       color = <LED_COLOR_ID_GREEN>;
+                       function = LED_FUNCTION_LAN;
+                       function-enumerator = <4>;
+                       gpios = <&tlmm 22 GPIO_ACTIVE_LOW>;
+               };
+       };
+};
+
+&usb2_hs_phy {
+       status = "disabled";
+};
+
+&usb2 {
+       status = "disabled";
+};
+
+&usb3_hs_phy {
+       status = "disabled";
+};
+
+&usb3_ss_phy {
+       status = "disabled";
+};
+
+&usb3 {
+       status = "disabled";
+};
+
+&pcie0 {
+       status = "okay";
+       perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>;
+       wake-gpio = <&tlmm 50 GPIO_ACTIVE_LOW>;
+};
+
+&pcie_bridge0 {
+       wifi2: wifi@0,0 {
+               compatible = "qcom,ath10k";
+               status = "okay";
+               reg = <0x00010000 0 0 0 0>;
+               nvmem-cells = <&cal_factory_9000>;
+               nvmem-cell-names = "calibration";
+       };
+};
+
+&wifi0 {
+       status = "okay";
+       qcom,ath10k-calibration-variant = "Meraki-MR30H";
+};
+
+&wifi1 {
+       status = "okay";
+       qcom,ath10k-calibration-variant = "Meraki-MR30H";
+};
+
+
+&swport1 {
+       label = "lan4";
+       status = "okay";
+};
+
+&swport2 {
+       label = "lan3";
+       status = "okay";
+};
+
+&swport3 {
+       label = "lan2";
+       status = "okay";
+};
+
+&swport4 {
+       label = "lan1";
+       status = "okay";
+};
+
+&swport5 {
+       label = "lan5";
+       status = "okay";
+};
index 648e73d030e3b827d31c1b783b3799fbf4b307d1..7afe64b4159d2140e7d6124539ae3360a19eea22 100644 (file)
@@ -798,6 +798,7 @@ define Device/meraki_mr30h
        $(call Device/meraki_common)
        DEVICE_MODEL := MR30H
        DEVICE_DTS_CONFIG := config@2
+       DEVICE_PACKAGES += ipq-wifi-meraki_mr30h
 endef
 TARGET_DEVICES += meraki_mr30h