Which version of OpenWRT are you trying to use?

[jodoe]

Hello, I'm interested in the progress of you project, I was given an older AP320 and would like to shoe horn OpenWRT onto it myself. They seem to be very similar in architecture, although slightly older hardware.

[Qwertylex]

I got an AP320 a few years ago... I'll document my work on it hopefully soon.
I dumped both OEM images from u-boot (primary and the fallback image
I also stumbled upon the undocumented "shell" command... by the way I cracked my AP320's shadow hash in 2015... turns out to be "meru2002"

I may flash the openwrt image I see in this repo to my AP320 to see if that works
and I'll also make a forum post on ddwrt so they can also support this unit.

http://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2018/03-26-2018-r35531/mikrotik-rb600/

ddwrt apparently has an image for an RB600 which has the same CPU as the AP320 I don't know if it'll boot though?

[jodoe]

Hi Qwertylex, glad to hear someone else has been playing with these.

I've dumped the whole flash via JTAG and chopped it up a little, recreated images with different kernels and generally ham fisted my way around it. I can rebuild an image fine, but I couldn't get any of the RB600 images to boot, nor could I get a fresh kernel to boot. The original kernel config is within the filesystem so you can import some of it to a newer build which is helpful, but still didn't get me where I wanted to be.

I've also tried building a new u-boot loader without success, the board seems to be based around a MPC8349ITX according to the kernel config, but I could be wrong, it has some similarity. I've erased the whole flash and rebuilt it from scratch, it's quite easy to unbrick once you have the u-boot loader, but the JTAG tool I use is very slow. I suspect the watchdog timer will be a pain, but haven't got that far yet.

I have a AP332i which is very similar in design, just better/smaller hardware based around a PPC CPU, although the shell access is removed so you can't get to the root.

I'd love to compare notes some day so if you start a thread else where, let me know :)

[cz172638]

i have several ap433is and ap332.
all have mpc8378e while ap320 mpc8347e

[RowdyChildren]

@jodoe Could you possibly drop us a line at club@w0unc.org with your U-Boot Loader?

[jodoe]

Sure, I'll drop you an email with the full flash and the carved out sections I used to recover the device, which include the U-boot loader.

[Qwertylex]

I loaded the https://github.com/w0unc/meru_hsmm/blob/master/Files/openwrt-mpc85xx-generic-zImage image to my AP320 and it just hangs after loading the kernel followed by a reboot.

[Qwertylex]

I extracted two flash images from my AP320, one from 2011 and one from 2008.
I used md.b 0xFFA00000 0x4ce595 at uboot's prompt to copy it over serial.
How would I go about copying my bootloader other than using JTAG?

[Qwertylex]

javelin > imls
Image at FF500000:
   Image Name:   Linux Multiboot-Image
   Created:      2008-03-12  18:26:16 UTC
   Image Type:   PowerPC Linux Multi-File Image (gzip compressed)
   Data Size:    3830563 Bytes =  3.7 MB
   Load Address: 00000000
   Entry Point:  00000000
   Contents:
   Image 0:  1229283 Bytes =  1.2 MB
   Image 1:  2601267 Bytes =  2.5 MB
   Verifying Checksum ... OK
Image at FFA00000:
   Image Name:   Linux Multiboot-Image
   Created:      2011-03-16  22:15:08 UTC
   Image Type:   PowerPC Linux Multi-File Image (gzip compressed)
   Data Size:    5039509 Bytes =  4.8 MB
   Load Address: 00000000
   Entry Point:  00000000
   Contents:
   Image 0:  5039501 Bytes =  4.8 MB
   Verifying Checksum ... OK
javelin > md.b 0xFFA00000 0x4ce595

[jodoe]

I did all my flash memory writing with a JTAG tool, can you actually write to the flash via U-boot? I gather you can copy data to the RAM and then maybe copy that to the flash once you've unlocked/erased?

From my own notes these areas are essential just to boot U-boot.

0xFF000000 <-boot strap?

0xFFF00000 <-U-Boot

0xFFFC0000 <-U- boot env variables

I tested repacked images over TFPT, which was the easiest option.

[RowdyChildren]

@jodoe I've bricked a couple when I wrote to the flash using tftp. It doesn't look like much of anything on the flash is write-protected.

[Qwertylex]

@jodoe thanks, I'll dump just those sections on mine, then I'll dump the entire 16MB flash over serial.

[jodoe]

@Qwertylex I wasn't aware of the md.b command, thanks for the heads up, looks like I went about this the hard way 👎

@RowdyChildren FFF00000 & FFF20000 and FFFC0000 & FFFE0000 are marked Read Only, the rest seems to be fair game!

[Qwertylex]

@jodoe what about the protect command?
protect - enable or disable FLASH write protection

[jodoe]

@Qwertylex I only used the protection commands when writing, disabling the sections as required.

[Alex1260]

Hello friends! I am a newbie. I do not know how to program, but I know how to solder and work with programmers well. I bought a very cheap Acess Point Meru Networks AP320, but I do not have a controller, I want to use it as a home point after the router. For many days I can not find the answer how to do this? The path led to this topic. Help, who managed to make a home AP. How to patch and where to get the firmware. Thanks!

[Alex1260]

I used the program to read USR-TCP232-Test-V1.3.exe and got the logfile that I attached. Please help me make a home access point! Good design, sorry to disassemble for parts ...
myMeru.txt
Photo of my Meru, version 1.0, next to the S1 reset button, there is also a S2 button, for which - I don’t know, it is closed by the front panel. There is a J2 connector, I think that COM power is on the board.

[Qwertylex]

I haven't gotten openwrt to boot on mine yet
I have the same goal as you.
however I have a patch somewhere from an openwrt dev that could help me compile it for this platform but ... I need the .dtb for the meru and I dunno how to source that.

[Celliwig]

Has anyone out there got the BSDL file for the MPC8347? Have kernel (5.4) up and running on the AP320. Unfortunately the old u-boot is slightly FUBAR. It won't decompress a kernel fully when it's over about 8MB, so need to build a new version, and hence need to rewrite the flash.

[jodoe]

AP320recovery.zip
The BSDL files are only available from NXP, but if you can create a working u-boot loader do you need it? The u-boot loader lives at FFF0FFF2.

I've attached a zip containing the images i use for recovering the loader on my device.

[Celliwig]

Chances of creating a working u-boot on first build are nil :). So need to be able to reflash in situ, and, unless I'm missing a trick, need the BSDL to rewrite the flash over JTAG.

[jodoe]

I seem to have lost half of my notes in an office move (annoying!), so I can't be 100% on this but if memory serves me I used UrJTAG with a compatible BSDL file, not the actual one, but one that worked fine for writing the entire flash over JTAG, Which is why I had the recovery files I posted as I made some very badly broken u-boot loaders that didn't work, but could roll it back.

[Celliwig]

Working on a similar line. I have it hooked up and communicating with urjtag, but I haven't been able to work out what might be a compatible BSDL. Might have to create from scratch....

[jodoe]

The QUICC II CPU is in a wide range of MPC83xx models, some of those BSD files are available from the NXP website.

One thing that took me the longest to work out was mux setting for the memory.

[jodoe]

I've found some notes I'd made in a backup (hoorah!), I used the following commands when reading from the device with a knock off usbblaster;

cable usbblaster
bsdl path bsdl/l
detect
initbus mpc837x
initbus mpc837x mux width=8
bus 1
readmem 0xFF500000 0x003DCDD2

I can see i was referring to the BSDL folder, but I no longer have the files I used. If i find anything else I'll post it here.

[jodoe]

bsdl.zip

OK, I found the BSDL files :) Have fun @Celliwig

[RowdyChildren]

Thanks sir! I was waiting on a reply from someone who has them. You beat me to it :)

On Sun, Jun 28, 2020 at 12:10 PM jodoe ***@***.***> wrote: bsdl.zip <https://github.com/w0unc/meru_hsmm/files/4842582/bsdl.zip> OK, I found the BSDL files :) Have fun @Celliwig <https://github.com/Celliwig> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABPVPR4RGG26OPJ3TPC6EDDRY5TPZANCNFSM4ENMWNDA> .

-- Riley Childs Cell: 704-497-2086 Discord: TheDuck#0001

[Celliwig]

Awesome, many thanks jodoe!

[jodoe]

Good luck gentlemen, do let us know how you get on. I was trying to run the existing image under qemu last night, I didn't get very far 😆

[Celliwig]

Thanks once again. Finally got urjtag to work with the bsdl files (ended up building it, Ubuntu is packaged with an OLD version...). Have to say that reading is slow, glacially so. And I thought loady was bad :)

[jodoe]

Ha! Yes its very slow, a complete dump was an over night affair. Before I stopped looking at the ap320 I did consider interfacing with the fashchip directly, but I never quite got that far.

[Celliwig]

If anybody is interested, U-boot is pretty much done (still a little rough around the edges). Here's the repo:

https://github.com/Celliwig/Meru-AP320-uboot

U-boot's ABI changed some time ago, so the ORIGINAL IMAGES WON'T WORK and the environment is incompatible as well.
Also working on kernel/OpenWRT, but they're not ready yet...

[jodoe]

Well done @Celliwig !

[Celliwig]

Thanks @jodoe. U-boot is now done I think. There's also an OpenWRT repo:

https://github.com/Celliwig/Meru-AP320-openwrt

This will build a squashfs/jffs2 image. It's a little basic (i.e. no upgrade support), but should have everything needed for an AP.

[adam-ht]

Hi @Celliwig I have a problem.
On what system you compiled that OpenWRT and what version of OpenWRT was that?
Do we need your U-boot for OpenWRT ?
I've tried ubuntu 20.10 and 18.04 and I compile two version of OpenWRT (r18012 and r17950) and when I try to load it the board restarts
I tried to compile older versions like 18.06.0 and 19.07.0 and I have always the same error

[Celliwig]

Sorry @adam-ht for not replying sooner. Currently rebuilding my machines, but I'm pretty sure that was cross-compiled on the previous Ubuntu LTS. Can't tell you currently what version of OpenWRT I used because the AP's offline awaiting a rebuild as well :).It would have been the master branch (I believe) at the time I did it, notable for using the linux 5.4 kernel as I recall. You will need my U-boot unfortuantely for 2 reasons I think. The main one is that the original U-boot has the 'feature' that it trucates the decompression of a uImage wrapped kernel at 8MB, which will leave you wondering why the kernel starts to load and then reboots! Took a while to work that one out.Also the the API for passing system info between U-boot and the kernel changed, you could try and work around that but I found it easier just to create a new U-boot. Hoping to be able to take a look at the AP over the Christmas period, so there could well be an update to follow in the next couple of weeks. Hope that helps, C On 05/11/2021 at 10:11 PM, "adam-ht" wrote: Hi @Celliwig I have a problem. On what system you compiled that OpenWRT and what version of OpenWRT was that? Do we need your U-boot for OpenWRT ? I've tried ubuntu 20.10 and 18.04 and I compile two version of OpenWRT (r18012 and r17950) and when I try to load it the board restarts I tried to compile older versions like 18.06.0 and 19.07.0 and I have always the same error — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android.