From 03045951eeae1c31d2c1a4b7acf6b53c7fc8d563 Mon Sep 17 00:00:00 2001 From: Hal Martin Date: Sun, 19 Oct 2025 12:15:19 +0200 Subject: [PATCH] ipq40xx: add support for Cisco Meraki MR30H This commit adds support for the Cisco Meraki MR30H. The MR30H is a POE powered 802.11ac access point with an integrated 5 port Gigabit switch. MR30H hardware info: * CPU: Qualcomm IPQ4029 * RAM: 256MB DDR3 * Storage: 128 MB (S34ML01G200TFV00) * Networking: QCA8075 internal switch (5x 1GbE ports) * WiFi: QCA4019 802.11b/g/n/ac, QCA9889 802.11/b/g/n/ac scanning radio * Serial: Internal header (J8, 2.54mm, populated) LAN5 (rear) is for POE input. LAN4 has POE output (802.3af) when powered by an 802.3at source. The LAN4 port is used for tftp booting in U-Boot. This device does not have secure boot, but cannot be flashed without external programmers (TSOP48 NAND) as Meraki disabled interrupting U-Boot for any device that updated after ~2017. Disassembly: * Remove the two T10 screws on the rear of the AP. * Using a guitar pick or similar plastic tool, insert it on the side between the grey metal plate and the white plastic body and pry up gently. * The rubberised border on the metal plate does not need to be removed. * The metal back plate has several latches around the perimeter (but none on the bottom by the Ethernet ports). * Once you have removed the metal back plate, push up gently on the bottom Ethernet ports while pulling gently on the rear-mounted Ethernet port to remove the PCB. * The PCB should come free from the plastic housing, pull the bottom (4 Ethernet ports) up as if you are opening a book. * If done carefully, there is no need to remove the WiFi antenna connectors to access the NAND flash. * The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the opposite side of the PCB. * To flash, you need to desolder the TSOP48 or use a 360 clip. Installation: The dumps to flash can be found in this repository: https://github.com/halmartin/meraki-openwrt-docs/tree/main/mr30h The device has the following flash layout (offsets with OOB data): ``` 0x000000000000-0x000000100000 : "sbl1" 0x000000100000-0x000000200000 : "mibib" 0x000000200000-0x000000300000 : "bootconfig" 0x000000300000-0x000000400000 : "qsee" 0x000000400000-0x000000500000 : "qsee_alt" 0x000000500000-0x000000580000 : "cdt" 0x000000580000-0x000000600000 : "cdt_alt" 0x000000600000-0x000000680000 : "ddrparams" 0x000000700000-0x000000900000 : "u-boot" 0x000000900000-0x000000b00000 : "u-boot-backup" 0x000000b00000-0x000000b80000 : "ART" 0x000000c00000-0x000007c00000 : "ubi" ``` * Dump your original NAND (if using nanddump, include OOB data). * Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump contains OOB data) and overwrite the `u-boot` portion of NAND from `0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data. * Resolder the NAND after overwriting the `u-boot` regions. OpenWrt Installation: * After flashing NAND with the external programmer. Plug an Ethernet cable into port 4. Power up the device. * The new U-Boot build uses the space character `" "` (without quotes) to interrupt boot. * Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your tftp server ``` dhcp setenv serverip tftpboot openwrt-ipq40xx-generic-meraki_mr30h-initramfs-uImage.itb ``` * Once booted into the OpenWrt initramfs, `scp` the `sysupgrade` image to the device and run the normal `sysupgrade` procedure: ``` scp -O openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/ ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin" ``` * OpenWrt should now be installed on the device. Alternative installation steps if your device has U-Boot older than: `U-Boot 2017.07-RELEASE-g78ed34f31579 (Sep 29 2017 - 07:43:44 -0700)` **BIG FAT WARNING BEGIN** Attmping to interrupt boot on a newer U-Boot release may permanently brick your device! See: riptidewave93/LEDE-MR33#13 **BIG FAT WARNING END** * Use `ubootwrite.py` from the above GitHub repository to transfer the `u-boot.itb` image to the router. ``` ./ubootwrite.py --serial=/dev/ttyUSB0 --write u-boot.itb ``` * To avoid bricking your router, it is highly recommended at this point that you flash the unlocked U-Boot to the `part.safe` ubi volume. ``` run set_ubi && ubi write $loadaddr part.safe 0x2fd48 ``` * Power cycle the router. The stock Meraki U-Boot will boot `part.safe` which is now the unlocked U-Boot. * Use the new U-Boot build (`" "` to interrupt boot) to `tftpboot` the OpenWrt initramfs image: ``` dhcp setenv serverip tftpboot openwrt-ipq40xx-generic-meraki_mr30h-initramfs-uImage.itb bootm ``` * It is only recommended to flash U-Boot to the `u-boot` NAND region from Linux: ``` insmod mtd-rw i_want_a_brick=1 ``` * Copy `u-boot.elf` to the router: ``` scp -O u-boot.elf root@192.168.1.1:/tmp/ ``` Note: If any of the below commands fails, YOU WILL HAVE A BRICK IF YOU REBOOT OR LOSE POWER. Only a hardware programmer can recover the device. ``` flash_erase /dev/mtd8 0 0 nandwrite -p /dev/mtd8 /tmp/u-boot.elf ``` Note: ONLY use `u-boot.elf` when flashing the `u-boot` region (`/dev/mtd8`); `u-boot.bin` or `u-boot.itb` will BRICK YOUR DEVICE * `scp` the `sysupgrade` image to the device and run the normal `sysupgrade` procedure: ``` scp -O openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/ ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr30h-squashfs-sysupgrade.bin" ``` * OpenWrt should now be installed on the device. Signed-off-by: Hal Martin Link: https://github.com/openwrt/openwrt/pull/17026 Signed-off-by: Robert Marko --- package/firmware/ipq-wifi/Makefile | 2 + .../ipq40xx/base-files/etc/board.d/01_leds | 10 ++ .../ipq40xx/base-files/etc/board.d/02_network | 3 + .../base-files/lib/upgrade/platform.sh | 1 + .../arm/boot/dts/qcom/qcom-ipq4029-mr30h.dts | 155 ++++++++++++++++++ target/linux/ipq40xx/image/generic.mk | 1 + 6 files changed, 172 insertions(+) create mode 100644 target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4029-mr30h.dts diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile index 9188baf4a52..3c4d9af3286 100644 --- a/package/firmware/ipq-wifi/Makefile +++ b/package/firmware/ipq-wifi/Makefile @@ -57,6 +57,7 @@ ALLWIFIBOARDS:= \ linksys_mx8500 \ linksys_spnmx56 \ linksys_whw03 \ + meraki_mr30h \ meraki_z3 \ netgear_lbr20 \ netgear_rax120v2 \ @@ -231,6 +232,7 @@ $(eval $(call generate-ipq-wifi-package,linksys_mx5500,Linksys MX5500)) $(eval $(call generate-ipq-wifi-package,linksys_mx8500,Linksys MX8500)) $(eval $(call generate-ipq-wifi-package,linksys_spnmx56,Linksys SPNMX56)) $(eval $(call generate-ipq-wifi-package,linksys_whw03,Linksys WHW03)) +$(eval $(call generate-ipq-wifi-package,meraki_mr30h,Meraki MR30H)) $(eval $(call generate-ipq-wifi-package,meraki_z3,Meraki Z3)) $(eval $(call generate-ipq-wifi-package,netgear_lbr20,Netgear LBR20)) $(eval $(call generate-ipq-wifi-package,netgear_rax120v2,Netgear RAX120v2)) diff --git a/target/linux/ipq40xx/base-files/etc/board.d/01_leds b/target/linux/ipq40xx/base-files/etc/board.d/01_leds index 96ad9032448..2ab1b679abe 100644 --- a/target/linux/ipq40xx/base-files/etc/board.d/01_leds +++ b/target/linux/ipq40xx/base-files/etc/board.d/01_leds @@ -109,6 +109,16 @@ meraki,z3) ucidef_set_led_netdev "lan4_link" "LAN5 (link)" "green:lan-8" "lan5" "link" ucidef_set_led_netdev "lan4_act" "LAN5 (txrx)" "green:lan-9" "lan5" "tx rx" ;; +meraki,mr30h) + ucidef_set_led_netdev "lan1_link" "LAN1 (link)" "green:lan-0" "lan1" "link" + ucidef_set_led_netdev "lan1_act" "LAN1 (txrx)" "amber:lan-1" "lan1" "tx rx" + ucidef_set_led_netdev "lan2_link" "LAN2 (link)" "green:lan-2" "lan2" "link" + ucidef_set_led_netdev "lan2_act" "LAN2 (txrx)" "amber:lan-3" "lan2" "tx rx" + ucidef_set_led_netdev "lan3_link" "LAN3 (link)" "green:lan-4" "lan3" "link" + ucidef_set_led_netdev "lan3_act" "LAN3 (txrx)" "amber:lan-5" "lan3" "tx rx" + ucidef_set_led_netdev "lan4_link" "LAN4 (link)" "green:lan-6" "lan4" "link" + ucidef_set_led_netdev "lan4_act" "LAN4 (txrx)" "amber:lan-7" "lan4" "tx rx" + ;; netgear,ex6100v2 |\ netgear,ex6150v2) ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:router" "phy0tpt" diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network index af92401a304..a96bb64b4d9 100644 --- a/target/linux/ipq40xx/base-files/etc/board.d/02_network +++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network @@ -138,6 +138,9 @@ ipq40xx_setup_interfaces() ucidef_set_interface_lan "lan1 lan2" ucidef_set_interface "wan" device "/dev/cdc-wdm0" protocol "qmi" ;; + meraki,mr30h) + ucidef_set_interface_lan "lan1 lan2 lan3 lan4 lan5" + ;; *) echo "Unsupported hardware. Network interfaces not initialized" ;; diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh index cea5b0ce696..bbf618716f2 100644 --- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh +++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh @@ -178,6 +178,7 @@ platform_do_upgrade() { linksys,whw03) platform_do_upgrade_linksys_emmc "$1" ;; + meraki,mr30h |\ meraki,mr33 |\ meraki,mr74) CI_KERNPART="part.safe" diff --git a/target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4029-mr30h.dts b/target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4029-mr30h.dts new file mode 100644 index 00000000000..1789646303e --- /dev/null +++ b/target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4029-mr30h.dts @@ -0,0 +1,155 @@ +// SPDX-License-Identifier: GPL-2.0-only +// Device Tree Source for Meraki MR30H (Noisy Cricket) + +#include "qcom-ipq4029-wired-qca-common.dtsi" + +/ { + model = "Meraki MR30H"; + compatible = "meraki,mr30h"; + + soc { + /* for USB PHY, device has no USB port */ + tcsr@194b000 { + status = "disabled"; + }; + }; + + leds { + compatible = "gpio-leds"; + + power_orange: power { + color = ; + function = LED_FUNCTION_POWER; + gpios = <&tlmm 49 GPIO_ACTIVE_LOW>; + panic-indicator; + }; + + led-0 { + /* LAN 1 act */ + color = ; + function = LED_FUNCTION_ACTIVITY; + gpios = <&tlmm 33 GPIO_ACTIVE_LOW>; + }; + + led-1 { + color = ; + function = LED_FUNCTION_LAN; + function-enumerator = <1>; + gpios = <&tlmm 32 GPIO_ACTIVE_LOW>; + }; + + led-2 { + /* LAN 2 act */ + color = ; + function = LED_FUNCTION_ACTIVITY; + gpios = <&tlmm 27 GPIO_ACTIVE_HIGH>; + }; + + led-3 { + color = ; + function = LED_FUNCTION_LAN; + function-enumerator = <2>; + gpios = <&tlmm 26 GPIO_ACTIVE_LOW>; + }; + + led-4 { + /* LAN 3 act */ + color = ; + function = LED_FUNCTION_ACTIVITY; + gpios = <&tlmm 25 GPIO_ACTIVE_LOW>; + }; + + led-5 { + color = ; + function = LED_FUNCTION_LAN; + function-enumerator = <3>; + gpios = <&tlmm 24 GPIO_ACTIVE_LOW>; + }; + + led-6 { + /* LAN 4 act */ + color = ; + function = LED_FUNCTION_ACTIVITY; + gpios = <&tlmm 23 GPIO_ACTIVE_LOW>; + }; + + led-7 { + color = ; + function = LED_FUNCTION_LAN; + function-enumerator = <4>; + gpios = <&tlmm 22 GPIO_ACTIVE_LOW>; + }; + }; +}; + +&usb2_hs_phy { + status = "disabled"; +}; + +&usb2 { + status = "disabled"; +}; + +&usb3_hs_phy { + status = "disabled"; +}; + +&usb3_ss_phy { + status = "disabled"; +}; + +&usb3 { + status = "disabled"; +}; + +&pcie0 { + status = "okay"; + perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>; + wake-gpio = <&tlmm 50 GPIO_ACTIVE_LOW>; +}; + +&pcie_bridge0 { + wifi2: wifi@0,0 { + compatible = "qcom,ath10k"; + status = "okay"; + reg = <0x00010000 0 0 0 0>; + nvmem-cells = <&cal_factory_9000>; + nvmem-cell-names = "calibration"; + }; +}; + +&wifi0 { + status = "okay"; + qcom,ath10k-calibration-variant = "Meraki-MR30H"; +}; + +&wifi1 { + status = "okay"; + qcom,ath10k-calibration-variant = "Meraki-MR30H"; +}; + + +&swport1 { + label = "lan4"; + status = "okay"; +}; + +&swport2 { + label = "lan3"; + status = "okay"; +}; + +&swport3 { + label = "lan2"; + status = "okay"; +}; + +&swport4 { + label = "lan1"; + status = "okay"; +}; + +&swport5 { + label = "lan5"; + status = "okay"; +}; diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk index 648e73d030e..7afe64b4159 100644 --- a/target/linux/ipq40xx/image/generic.mk +++ b/target/linux/ipq40xx/image/generic.mk @@ -798,6 +798,7 @@ define Device/meraki_mr30h $(call Device/meraki_common) DEVICE_MODEL := MR30H DEVICE_DTS_CONFIG := config@2 + DEVICE_PACKAGES += ipq-wifi-meraki_mr30h endef TARGET_DEVICES += meraki_mr30h -- 2.47.3