SETUP

1. Build your own, or just grab tested images from here
2. Copy these files to your tftp server
   • u-boot.itb
   • mr53-factory.bin
   • mr53linux.itb
3. serial cable wired to the internal console port: same as MR52
4. see below for more details but in a nutshell:
   • load u-boot.itb into ram via ubootwrite-cryptid.py (both in releases) python3 ubootwrite-cryptid.py --verbose --write=u-boot.itb
   • connect serial console (eg picocom -b115200 /dev/ttyUSB0)
   • hit enter to bring up the prompt, and boot the new uboot: bootm 0x42000000#config@3
   • setup IP addresses, and make it an OpenWRT box

setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.254
run provision_all
boot

---

Intro

This Openwrt thread is where all the action happened.

• Source is under components
• Binary releases are here

Contents

• u-boot as redudant bootkernel1 and bootkernel2 replacing the Meraki ramdisk linux boot kernels. Meraki stock bootloader happily boots our u-boot instead.
  • with working GbE to allow tftpboot of our fit (.itb) version of uboot
  • helper functions to pull via tftp, and write the redundant bootkernels, and ubi images for openwrt.
  • 3 second "any key" break into console rather than funky escape string.
  • understanding the new nand layout for our OpenWRT, and booting that.
• OpenWRT with support for this platform and its unique hardware setup
  • uses the QCA8511 as a mac layer media converter to allow the use of a 2.5G phy with SGMII+
  • IPQ8068 SOC connects its 4 MACs via QSGMII to the switch
    • switch uses 3 of its QSGMII ports in an isolated channel, combined as a LACP bond, as is the host using the 3 MAC channels.
    • This allows the 2.5Gb Aquantia PHY on the PoE port to pass >1Gb traffic through the aggregation.
    • gmac0 is wired to a SGMII port on the 1GBe second PHY.
  • Added support for QSGMII to the dwmac driver for ipq8 soc.
    • additional device tree properties- including naming the gmac (.cpu0 thru .cpu3) and sequencing the probing so that the name indexes align with hardware.
  • Added a shim driver that is device tree configured, to map the MDIO bus of the PHYs to new virtual network interfaces- labelled lan1 and lan2
    • lan1 is configured in the device tree to create the linux bond interface of gmacs 1-3, and use the mdio interface of the Aquantia phy
      • internally we name the auto-managed bond interface .cpu123, and it claims macs .cpu1, .cpu2, and .cpu3
    • lan2 claims .cpu0, and maps to the mdio of the Gbe PHY.
  • default config sets up LEDs in system, and bridges lan1 and lan2 in br-lan
  • feeds point to branches of luci and packages with some tweaks to remove ppp by default from luci, and fixes to dawn wifi AP management app to use with multicast.

---

Cloning the Repo (yes it uses submodules)

git clone --recurse-submodules https://github.com/slow-boat/meraki-mr53.git

Or if you already cloned without submodules:

git submodule update --init --recursive

Updating from component source repos

when the components change, you can pull them in manually

git submodule update --remote

Network Architecture of the MR53

Physical Layer

graph TD
    subgraph CPU["CPU — IPQ8068"]
        M0["mac .cpu0<br/>QSGMII 1G FD"]
        M1["mac .cpu1<br/>QSGMII 1G FD"]
        M2["mac .cpu2<br/>QSGMII 1G FD"]
        M3["mac .cpu3<br/>QSGMII 1G FD"]
    end

    subgraph SW["Switch — QCA8511"]
        P1["Port 1<br/>QSGMII"]
        P2["Port 2<br/>QSGMII"]
        P3["Port 3<br/>QSGMII"]
        P4["Port 4<br/>QSGMII"]
        P26["Port 26<br/>SGMII"]
        P27["Port 27<br/>SGMII+"]
        PRF1["Profile 1<br/>LACP Bond<br/>Ports 2+3+4 → 27"]
        PRF2["Profile 2<br/>Port 1 → 26"]
    end

    PHY1["ATH8033<br/>GbE PHY"]
    PHY2["AQR105<br/>Multi-GbE PHY"]

    M0 <-->|QSGMII| P1
    M1 <-->|QSGMII| P2
    M2 <-->|QSGMII| P3
    M3 <-->|QSGMII| P4

    P26 <-->|SGMII| PHY1
    P27 <-->|SGMII+| PHY2

    P2 & P3 & P4 --- PRF1
    P1 --- PRF2
    PRF1 --- P27
    PRF2 --- P26

Loading

---

MDIO / Management Layer

graph LR
    DRV_SW["QCA8511 Driver"]
    DRV_AQ["AQR105 Driver"]
    DRV_PP["phy-proxy Driver"]

    DRV_SW -->|"MDIO: monitors link,<br/>reconfigures SGMII+<br/>to SGMII as needed"| AQR105["AQR105 PHY"]
    DRV_AQ -->|"Device tree lock:<br/>forces SGMII+ mode,<br/>bypasses SW reconfiguration"| AQR105

    DRV_PP -->|"MDIO: link events &<br/>PHY properties"| AQR105
    DRV_PP -->|"MDIO: link events &<br/>PHY properties"| ATH8033["ATH8033 PHY"]

Loading

---

Software / Driver Layer

graph TD
    subgraph MACS["Linux MAC Interfaces"]
        C0[".cpu0"]
        C1[".cpu1"]
        C2[".cpu2"]
        C3[".cpu3"]
    end

    subgraph PP["phy-proxy Driver"]
        BOND[".cpu123<br/>LACP Bond<br/>claims .cpu1 + .cpu2 + .cpu3<br/>(matches switch Profile 1)"]
        LAN1["lan1<br/>virtual NIC<br/>claims .cpu123<br/>relocates SKBs<br/>AQR105 MDIO for link/PHY"]
        LAN2["lan2<br/>virtual NIC<br/>claims .cpu0<br/>ATH8033 MDIO for link/PHY"]
    end

    subgraph NET["Network Stack"]
        IP1["IP address / routes<br/>assigned to lan1"]
        IP2["IP address / routes<br/>assigned to lan2"]
    end

    C1 & C2 & C3 --> BOND
    BOND --> LAN1
    C0 --> LAN2

    LAN1 --> IP1
    LAN2 --> IP2

Loading

---

Summary Table

Interface	Underlying MACs	Switch Ports	Switch Profile	PHY	Link Speed
lan1	.cpu1/2/3 (bond .cpu123)	2, 3, 4 (LACP)	Profile 1 → Port 27	AQR105 (Multi-GbE)	Up to multi-Gbit
lan2	.cpu0	1	Profile 2 → Port 26	ATH8033 (GbE)	1 Gbit

Both lan1 and lan2 present to the system as standard single NIC interfaces (similar to DSA), with IP assignment handled by the normal network stack. Default uci puts them in a lan bridge.

---

U-boot (with network) for Meraki MR53

This u-boot is based on Hal Martin's work getting ethernet going, and extracting the register setup for the switch port groups and isolation which are not in the original Meraki Source

Big thanks to all the other guys on that Openwrt thread that contributed so far.

Mods:

• modified ubootwrite-cryptid.py initial uploading image via serial, or getting console access from meraki bootloader.
• modified u-boot source with working networking and autoboot of reprovisioned NAND partition matching our device tree
• build environment setup . build.sh
  • this will install the required gcc cross compiler to /opt if missing
  • run makemr53 to do a clean .itb build
• within u-boot environment there are some new commands

run provision_all

Installs u-boot.itb and mr53-factory.bin from your tftp server into nand. Do this after fist loading the u-boot.itb via ubootwrite-cryptid.py over serial port. Run boot to start the new image from nand.

You need to set up your IP addresses first- for example

setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.254
run provision_all
boot

run provision_uboot

• install u-boot.itb into bootkernel1 and bootkernel2 mtd partitions. Run reset to reboot the bootloader into our new one via nand.

setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.254
run provision_uboot
reset

run provision_ubi

• install mr53-factory.bin into mtd ubi part. Run boot to start it

setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.254
run provision_ubi
boot

run tftpbootfit

• download and boot mr53linux.itb from tftp server- doesn't touch flash. Useful for development.

setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.254
run tftpbootfit

Using serial loader for initial uboot provisioning

prerequisites

• python3
• pyserial
• picocom (or similar tool for accessing serial port)
• 3.3V level USB-serial adapter soldered onto the MR53 serial pads.
  • avoid adapters with strong bus hold... these seem to not work.
  • I bought some really cheap ones with IDC flying leads that were like this. Fail.

process

• Run this- it will put the u-boot.itb into RAM at 0x42000000. This is painfully slow... ~10minutes!

python3 ubootwrite-cryptid.py --verbose --write=u-boot.itb

• when this is finished, we can access the serial console, eg:

picocom -b115200 /dev/ttyUSB0

to exit picocom- ctrl-a-q*

Boot into our new uboot:

bootm 0x42000000#config@3

Then follow the provisioning steps above- make sure the tftp server is up etc.