LEDE/OpenWRT — Installing Firmware on Meraki MR18

We haven’t made a habit of posting guides on how to flash specific devices (purely because there are so many of them) but as Meraki have issued a new firmware update that prevents any further flashing, it’s now or never if you want to free your MR18!

Before we get started, we need to thank OpenWRT and in particular riptide_wave who did the work to enable OpenWRT on Meraki.

This is a One-Way Road.

Read the full guide before proceeding and make sure you understand the implications of the flash commands. Any error is likely to brick your device.
At this time there is no way to recover from a bricked Meraki short of desoldering the SOIC and reprogramming.

Setting up

Before you get started you will need to ensure you have the following:

• MR18 (firmware build T-123302-gfc0d5962-aachary)
• UART adapter
• Computer connected to MR18 via Ethernet
• Webserver app (e.g Python)
• Copy of the MR18 firmware
• Copy of the initramfs image

Flashing

In the directory that you have stored the MR18 firmware, initialise your webserver. In this example, we are going to use python:

python -m SimpleHTTPServer

You should see an output similar to the following, make sure to take note of the port it is running on:

Serving HTTP on 0.0.0.0 port 8000 ...

Connect UART to your MR18 with the following settings:
- Speed: 115200
- Pinout (left to right): VCC/RX/TX/GND

Connect Ethernet cable between your computer and MR18, and set your computer’s IP to 192.168.1.2

Open UART console, then hold down “s” while you power the unit on. Wait holding, and you will be put into a root shell.

Now we need to run the following command:

cat > /storage/root.sh

This will bootstrap the rootfs filesystem.

You will see an empty console window. Copy and paste in the following script:

#!/bin/sh
ROOTFSMTD=$(cat /proc/mtd | grep -e "-1\"" | grep rootfs | awk '{ print substr($1, 4, length($1)-4) }')
if ! test -f /MERAKI_ARCH ; then
	# Mount new root
	mkdir /rootfs
	mount /dev/mtdblock$ROOTFSMTD /rootfs
	# Set up special filesystems
	mount -t devtmpfs dev /rootfs/dev
	mount -t proc proc /rootfs/proc
	mount -t sysfs sys /rootfs/sys
	mount -t tmpfs tmp /rootfs/tmp
	# Mount storage
	mount -t ubifs /dev/ubivol/storage /rootfs/storage
	# Switch to new root and continue execution
	cp "$0" /rootfs/tmp/root.sh
	busybox chroot /rootfs sh /tmp/root.sh
else
	# Setup network
	ifconfig eth0 192.168.1.1 netmask 255.255.255.0 up
	# Give ourselves a shell
	sh
fi

Once the code is added, exit back to the command prompt and run the following to run the script:

chmod +x /storage/root.sh
/storage/root.sh

You will find yourself back at the root prompt, but with working network connectivity.

Now we need to run the following command to flash the initramfs image to your MR18, making sure to replace the port with the port that your server is running on.

wget http://192.168.1.2:8080/openwrt-ar71xx-nand-mr18-initramfs.bin -O /storage/openwrt.bin
dd if=/storage/openwrt.bin of=/dev/mtdblock2

If both commands above complete without error, then you have successfully flashed the initramfs image.

To boot initramfs, unplug the power from your MR18, hold down "2" and power on your MR18.

With initramfs running, brows to http://192.168.1.1 to access the LuCI interface.

Login and go to the System Upgrade tab, selecting the downloaded MR18 image (openwrt-ar71xx-nand-mr18-squashfs-sysupgrade.tar). Then de-select the save config option, and confirm the upgrade.

If you found this post helpful please let us know by clicking the ♥ below.

This blog was brought to you by Cucumber Wi-Fi. Cucumber helps you run a more efficient Wi-Fi network. Check it out here.

Cucumber Wi-Fi — control any (Wi-Fi) device from the cloud.