Cannot install OpenWrt on Siemens WS-AP3610

Hi. I'm try to installing last snapshots for Siemens WS-AP3610. All doing by the guide from commit:

  1. Download the OpenWrt initramfs-image. Place it into a TFTP server
    root directory and rename it to 1401A8C0.img. Configure the TFTP
    server to listen at 192.168.1.66/24.

  2. Connect the TFTP server to the access point.

  3. Connect to the serial console of the access point. Attach power and
    interrupt the boot procedure when prompted (bootdelay is 1 second).

  4. Configure the U-Boot environment for booting OpenWrt from Ram and
    flash:

    $ setenv boot_openwrt 'setenv bootargs; bootm 0xbf080000'
    $ setenv ramboot_openwrt 'setenv serverip 192.168.1.66; tftpboot; bootm'
    $ saveenv

  5. Load OpenWrt into memory:

    $ run ramboot_openwrt

    Wait for the image to boot.

  6. Transfer the OpenWrt sysupgrade image to the device by winscp to the /tmp folder. Write the image
    to flash using sysupgrade:

    $ sysupgrade -n /tmp/sysupgrade.bin

But after install I have this error:

U-Boot 1.2.0.07-dirty (Sep 23 2015 - 14:24:57)

Primary Image

DRAM:  128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
Net:   eth0
Hit any key to stop autoboot:  0
### JFFS2 loading 'boot_kernel.img2' to 0x80400000
Scanning JFFS2 FS: . done.
find_inode failed for name=boot_kernel.img2
load: Failed to find inode
### JFFS2 LOAD ERROR<0> for boot_kernel.img2!
### JFFS2 loading 'boot_kernel.bak2' to 0x80400000
find_inode failed for name=boot_kernel.bak2
load: Failed to find inode
### JFFS2 LOAD ERROR<0> for boot_kernel.bak2!
ERROR: Problem with boot script, dropping to interactive shell
Boot->

Full install log:


U-Boot 1.2.0.07-dirty (Sep 23 2015 - 14:24:57)

Primary Image

DRAM:  128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
Net:   eth0
Hit any key to stop autoboot:  0
Boot-> setenv boot 'setenv bootargs; bootm 0xbf080000'
Boot-> setenv openwrt 'setenv serverip 192.168.1.66; tftpboot; bootm'
Boot-> saveenv
Saving Environment to Flash...
Un-Protected 1 sectors
Un-Protected 1 sectors
Erasing Flash...Erasing Flash - 0xe80000 - 0xebffff
Erasing Sector: 0xe80000
Erased 1 sectors
Writing to Flash... done
Protected 1 sectors
Protected 1 sectors
Boot-> setenv boot_openwrt 'setenv bootargs; bootm 0xbf080000'
Boot-> setenv ramboot_openwrt 'setenv serverip 192.168.1.66;
Boot-> tftpboot; bootm'
Boot-> saveenv
Saving Environment to Flash...
Un-Protected 1 sectors
Un-Protected 1 sectors
Erasing Flash...Erasing Flash - 0xec0000 - 0xefffff
Erasing Sector: 0xec0000
Erased 1 sectors
Writing to Flash... done
Protected 1 sectors
Protected 1 sectors
Boot-> run ramboot_openwrt
Boot-> run ramboot_openwrt
Boot-> setenv boot_openwrt 'setenv bootargs; bootm 0xbf080000'
Boot-> setenv ramboot_openwrt 'setenv serverip 192.168.1.66; tftpboot; bootm'
Boot-> saveenv
Saving Environment to Flash...
Un-Protected 1 sectors
Un-Protected 1 sectors
Erasing Flash...Erasing Flash - 0xe80000 - 0xebffff
Erasing Sector: 0xe80000
Erased 1 sectors
Writing to Flash... done
Protected 1 sectors
Protected 1 sectors
Boot-> run ramboot_openwrt
*** Warning: no boot file name; using '1401A8C0.img'
Using eth0 device
TFTP from server 192.168.1.66; our IP address is 192.168.1.20
Filename '1401A8C0.img'.
Load address: 0x80100000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
T checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
T checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
T T T T T T T T #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #############################################
done
Bytes transferred = 14537365 (ddd295 hex)
## Booting image at 80100000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.101
   Created:      2021-03-01   7:15:48 UTC
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    14537301 Bytes = 13.9 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
OK

Starting kernel ...

[    0.000000] Linux version 5.4.101 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16045-acbea54bc2)) #0 Mon Mar 1 07:15:48 2021
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is Siemens WS-AP3610
[    0.000000] SoC: Atheros AR7161 rev 2
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00077ef2
[    0.000000] Readback ErrCtl register=00077ef2
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 114316K/131072K available (5236K kernel code, 188K rwdata, 1188K rodata, 8612K init, 205K bss, 16756K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] random: get_random_bytes called from start_kernel+0x32c/0x520 with crng_init=0
[    0.000000] CPU clock: 680.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5621354254 ns
[    0.000008] sched_clock: 32 bits at 340MHz, resolution 2ns, wraps every 6316128254ns
[    0.007808] Calibrating delay loop... 451.58 BogoMIPS (lpj=903168)
[    0.041961] pid_max: default: 32768 minimum: 301
[    0.046731] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.054038] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.065532] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.075305] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.082193] pinctrl core: initialized pinctrl subsystem
[    0.089634] NET: Registered protocol family 16
[    0.399656] PCI host bridge /ahb/apb/pcie-controller@17010000 ranges:
[    0.406115]  MEM 0x0000000010000000..0x0000000016ffffff
[    0.411338]   IO 0x0000000000000000..0x0000000000000000
[    0.433058] PCI host bridge to bus 0000:00
[    0.437196] pci_bus 0000:00: root bus resource [mem 0x10000000-0x16ffffff]
[    0.444057] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.449626] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.456404] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.464732] pci 0000:00:11.0: [168c:0027] type 00 class 0x028000
[    0.470754] pci 0000:00:11.0: reg 0x10: [mem 0x00000000-0x0000ffff]
[    0.477074] pci 0000:00:11.0: PME# supported from D0 D3hot
[    0.482771] pci 0000:00:12.0: [168c:0027] type 00 class 0x028000
[    0.488813] pci 0000:00:12.0: reg 0x10: [mem 0x00000000-0x0000ffff]
[    0.495130] pci 0000:00:12.0: PME# supported from D0 D3hot
[    0.501085] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    0.507731] pci 0000:00:11.0: BAR 0: assigned [mem 0x10000000-0x1000ffff]
[    0.514513] pci 0000:00:12.0: BAR 0: assigned [mem 0x10010000-0x1001ffff]
[    0.521387] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    0.534593] clocksource: Switched to clocksource MIPS
[    0.540696] NET: Registered protocol family 2
[    0.545903] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.554317] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.561987] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.569038] TCP: Hash tables configured (established 1024 bind 1024)
[    0.575534] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.582098] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.589316] NET: Registered protocol family 1
[    0.593758] PCI: CLS 0 bytes, default 32
[    0.718534] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.731191] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.737058] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.758337] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.768261] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.776705] printk: console [ttyS0] disabled
[    0.781071] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 10, base_baud = 10625000) is a 16550A
[    0.789867] printk: console [ttyS0] enabled
[    0.789867] printk: console [ttyS0] enabled
[    0.798211] printk: bootconsole [early0] disabled
[    0.798211] printk: bootconsole [early0] disabled
[    0.815713] spi-nor spi0.0: m25p128 (16384 Kbytes)
[    0.820608] 9 fixed-partitions partitions found on MTD device spi0.0
[    0.826965] Creating 9 MTD partitions on "spi0.0":
[    0.831753] 0x000000000000-0x000000040000 : "u-boot"
[    0.837566] 0x000000040000-0x000000080000 : "u-boot-bak"
[    0.843751] 0x000000080000-0x000000e80000 : "firmware"
[    0.852796] 2 uimage-fw partitions found on MTD device firmware
[    0.858769] Creating 2 MTD partitions on "firmware":
[    0.863744] 0x000000000000-0x000000240000 : "kernel"
[    0.869510] 0x000000240000-0x000000e00000 : "rootfs"
[    0.875312] mtd: device 4 (rootfs) set to be root filesystem
[    0.882715] 1 squashfs-split partitions found on MTD device rootfs
[    0.888934] 0x000000500000-0x000000e00000 : "rootfs_data"
[    0.895234] 0x000000e80000-0x000000ec0000 : "cfg1"
[    0.900906] 0x000000ec0000-0x000000f00000 : "cfg2"
[    0.906575] 0x000000f00000-0x000000f40000 : "nvram1"
[    0.912413] 0x000000f40000-0x000000f80000 : "nvram2"
[    0.918274] 0x000000f80000-0x000000fc0000 : "rsvd1"
[    0.924041] 0x000000fc0000-0x000001000000 : "rsvd2"
[    0.931309] libphy: Fixed MDIO Bus: probed
[    0.937964] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.174586] random: fast init done
[    1.260394] libphy: ag71xx_mdio: probed
[    1.316700] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=0143bca2, driver=Broadcom BCM5481]
[    1.326651] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii-id
[    1.333342] i2c /dev entries driver
[    1.339066] NET: Registered protocol family 10
[    1.348209] Segment Routing with IPv6
[    1.352032] NET: Registered protocol family 17
[    1.356532] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.369470] 8021q: 802.1Q VLAN Support v1.8
[    1.374752] hctosys: unable to open rtc device (rtc0)
[    1.406008] Freeing unused kernel memory: 8612K
[    1.410557] This architecture does not have kernel memory protection.
[    1.416987] Run /init as init process
[    1.755098] init: Console is alive
[    1.758831] init: - watchdog -
[    1.780672] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.789899] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.808074] init: - preinit -
[    2.490980] random: jshn: uninitialized urandom read (4 bytes read)
[    2.611384] random: jshn: uninitialized urandom read (4 bytes read)
[    2.646280] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.895021] eth0: link up (1000Mbps/Full duplex)
[    6.900386] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    6.954412] eth0: link down
[    6.968456] procd: - early -
[    6.971499] procd: - watchdog -
[    7.561555] procd: - watchdog -
[    7.565099] procd: - ubus -
[    7.575970] urandom_read: 5 callbacks suppressed
[    7.575979] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.618661] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.628045] procd: - init -
Please press Enter to activate this console.
[    8.195124] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.228424] Loading modules backported from Linux version v5.10.16-0-gde53befa79cf
[    8.236052] Backport generated by backports.git v5.10.16-1-0-g21d2a1d2
[    8.295124] xt_time: kernel timezone is -0000
[    8.413280] PPP generic driver version 2.4.2
[    8.427380] NET: Registered protocol family 24
[    8.507228] ath9k 0000:00:11.0: enabling device (0000 -> 0002)
[   10.069706] ath: phy0: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff
[   10.076854] ath: phy0: random mac address will be used: 7a:23:06:53:e9:78
[   10.104366] ieee80211 phy0: Atheros AR9160 MAC/BB Rev:1 AR5133 RF Rev:b0 mem=0xb0000000, irq=15
[   10.113288] ath9k 0000:00:12.0: enabling device (0000 -> 0002)
[   11.675988] ath: phy1: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff
[   11.683133] ath: phy1: random mac address will be used: 9a:ee:bf:4e:9c:4b
[   11.704270] ieee80211 phy1: Atheros AR9160 MAC/BB Rev:1 AR2133 RF Rev:b0 mem=0xb0010000, irq=16
[   11.844077] urngd: v1.0.2 started.
[   12.252683] random: crng init done
[   14.822465] kmodloader: done loading kernel modules from /etc/modules.d/*
[   34.729042] eth0: link up (1000Mbps/Full duplex)
[   34.734658] br-lan: port 1(eth0) entered blocking state
[   34.739895] br-lan: port 1(eth0) entered disabled state
[   34.745430] device eth0 entered promiscuous mode
[   34.766741] br-lan: port 1(eth0) entered blocking state
[   34.771987] br-lan: port 1(eth0) entered forwarding state
[   35.726679] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready



BusyBox v1.33.0 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r16045-acbea54bc2
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# sysupgrade -n /tmp/sysupgrade.bin
Mon Mar  1 07:17:48 UTC 2021 upgrade: Commencing upgrade. Closing all shell sessions.
Watchdog handover: fd=3
- watchdog -
killall: telnetd: no process killed
Mon Mar  1 07:17:48 UTC 2021 upgrade: Sending TERM to remaining processes ... logd hostapd wpa_supplicant netifd odhcpd ntpd dnsmasq ubusd urngd
Mon Mar  1 07:17:51 UTC 2021 upgrade: Sending KILL to remaining processes ...
[  132.669976] sh (2211): drop_caches: 3
Mon Mar  1 07:17:52 UTC 2021 upgrade: Switching to ramdisk...
Mon Mar  1 07:17:55 UTC 2021 upgrade: Performing system upgrade...
[  134.745170] sh (2211): drop_caches: 3
Unlocking firmware ...

Writing from <stdin> to firmware ...
Mon Mar  1 07:18:54 UTC 2021 upgrade: Upgrade completed
Mon Mar  1 07:18:55 UTC 2021 upgrade: Rebooting system...
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
[  195.267090] reboot: Restarting system
▒

U-Boot 1.2.0.07-dirty (Sep 23 2015 - 14:24:57)

Primary Image

DRAM:  128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
Net:   eth0
Hit any key to stop autoboot:  0
### JFFS2 loading 'boot_kernel.img2' to 0x80400000
Scanning JFFS2 FS: . done.
find_inode failed for name=boot_kernel.img2
load: Failed to find inode
### JFFS2 LOAD ERROR<0> for boot_kernel.img2!
### JFFS2 loading 'boot_kernel.bak2' to 0x80400000
find_inode failed for name=boot_kernel.bak2
load: Failed to find inode
### JFFS2 LOAD ERROR<0> for boot_kernel.bak2!
ERROR: Problem with boot script, dropping to interactive shell
Boot->

@YakovOnline , welcome to the community!

What happens if you just use the LuCI web GUI after booting the initramfs-image?

screen80

Yes, I'm trying to install via Luci. But the problem was the same :frowning:
I made a video:

Ummmmmm...

  • Can you run the command to boot the relevant section of flash???

That didn't show nor prove that OpenWrt wasn't installed...it shows your boot environment in the bootloader may be misconfigured.

:bulb: If you can successfully run the command manually at the bootloader, you might simply need to fix the commands in the "boot environment".

https://www.denx.de/wiki/view/DULG/UBoot

1 Like

I don't understand how to implement this. Look at the log, can you have any ideas how to fix it?

Boot-> help
?       - alias for 'help'
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
bootvx  - Boot vxWorks from an ELF image
chenv   - manipulate environment variables
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
defenv  - get environment variables from default block
dhcp    - invoke DHCP client to obtain IP/boot params
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
flashtest  - do flash check from 0xbf000000 to 0xbff00000
flinfo  - print FLASH memory information
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
go      - start application at address 'addr'
help    - print online help
iminfo  - print header information for application image
imls    - list all images found in flash
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
ls      - list files in a directory (default /)
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
version - print monitor version
Boot-> chenv boot
Usage:
chenv   - manipulate environment variables

Boot-> bdinfo
boot_params = 0x87D2EFB0
memstart    = 0x80000000
memsize     = 0x08000000
flashstart  = 0xBF000000
flashsize   = 0x01000000
flashoffset = 0x00000000
ethaddr     = 00:1F:45:94:1E:49
ip_addr     = 192.168.1.20
baudrate    = 115200 bps
Boot-> flinfo

Bank # 1: STM STM25P128 (128 Mbit, uniform sector size)
  Size: 16384 KB in 64 Sectors
  Sector Start Addresses:
    BF000000      BF040000      BF080000      BF0C0000      BF100000
    BF140000      BF180000      BF1C0000      BF200000      BF240000
    BF280000      BF2C0000      BF300000      BF340000      BF380000
    BF3C0000      BF400000      BF440000      BF480000      BF4C0000
    BF500000      BF540000      BF580000      BF5C0000      BF600000
    BF640000      BF680000      BF6C0000      BF700000      BF740000
    BF780000      BF7C0000      BF800000      BF840000      BF880000
    BF8C0000      BF900000      BF940000      BF980000      BF9C0000
    BFA00000      BFA40000      BFA80000      BFAC0000      BFB00000
    BFB40000      BFB80000      BFBC0000      BFC00000      BFC40000
    BFC80000      BFCC0000      BFD00000      BFD40000      BFD80000
    BFDC0000      BFE00000      BFE40000      BFE80000      BFEC0000
    BFF00000      BFF40000 E    BFF80000 E    BFFC0000 E
Boot-> fsinfo
### filesystem type is JFFS2
Compression: NONE
        frag count: 1711
        compressed sum: 6817613
        uncompressed sum: 6817613
Compression: ZERO
        frag count: 0
        compressed sum: 0
        uncompressed sum: 0
Compression: RTIME
        frag count: 0
        compressed sum: 0
        uncompressed sum: 0
Compression: RUBINMIPS
        frag count: 0
        compressed sum: 0
        uncompressed sum: 0
Compression: COPY
        frag count: 0
        compressed sum: 0
        uncompressed sum: 0
Compression: DYNRUBIN
        frag count: 0
        compressed sum: 0
        uncompressed sum: 0
Compression: ZLIB
        frag count: 21
        compressed sum: 29518
        uncompressed sum: 67845
Boot-> iminfo

## Checking Image at 80400000 ...
   Bad Magic Number
Boot-> imls
Image at BF080000:
   Image Name:   MIPS OpenWrt Linux-5.4.101
   Created:      2021-03-02   1:42:34 UTC
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    2178699 Bytes =  2.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
Boot-> ls
 drwxr-xr-x        0 Sat Jan 01 00:00:22 2000 var
 drwxr-xr-x        0 Sat Jan 01 00:00:06 2000 home
 -rw-r--r--  5354713 Sat Jan 01 00:01:54 2000 primary.gz.uImage
 -rw-r--r--  5353911 Sun Oct 07 11:52:44 2018 secondary.gz.uImage
Boot-> printenv
bootargs=console=ttyS0,115200n81 mtdparts=ar7100-nor0:256K(BootBAK)ro,256K(BootPRI),14336K(FS),256K(CFG1),256K(CFG2),256K(NVRAM1),256K(NVRAM2),256K(RSVD1),256K(RSVD2) BOOT_KERNEL=primary BOOT_BOOTROM=unknown mem=130560K panic=30 ro
bootcmd=run boot_flash
baudrate=115200
ipaddr=192.168.1.20
gatewayip=192.168.1.1
netmask=255.255.255.0
PB44_CONFIG1_ADDR=0xBFE80000
PB44_CONFIG1_SIZE=0x40000
PB44_CONFIG2_ADDR=0xBFEC0000
PB44_CONFIG2_SIZE=0x40000
WATCHDOG_LIMIT=3
BOOT_KERNEL=primary
BOOT_BOOTROM=unknown
SERVICEATTRS=ac_manager,ru_manager
VERSIONBASE=0
REGION=NA
mtdparts=mtdparts=ar7100-nor0:256K(BootBAK)ro,256K(BootPRI),14336K(FS),256K(CFG1),256K(CFG2),256K(NVRAM1),256K(NVRAM2),256K(RSVD1),256K(RSVD2)
static_bootargs=console=ttyS0,115200n81 mem=130560K panic=30 ro
boot_flash=order="img2 bak2"; for script in ${order}; do if fsload 0x80400000 boot_kernel.${script}; then if imi 0x80400000; then autoscr 0x80400000; exit; fi; fi; done; echo ERROR: Problem with boot script, dropping to interactive shell
ethact=eth0
DEFAULT_SETTING=0
CURR_VER=U-Boot 1.2.0.07 (Oct 9 2009 - 13:09:54)
MODEL=AP3610-1
SERIAL#=11030053235K0000
ethaddr=00:1F:45:94:1E:49
RADIOADDR0=00:1F:45:99:42:40
RADIOADDR1=00:1F:45:99:42:48
HW_RELEASE=5
MB81_CTL_VER=2
MB82_CTL_VER=1
SERVICETYPE=siemens
AC_HOSTNAME=Controller
APSK=02FF2877220A2A4FCC49F7F2C6D86973E8E7E4C629EFCD886C92A2CB89F5B6D43C
bootdelay=1
filesize=ba3
LOAD_SENSOR_IMG=0
MOSTRECENTKERNEL=1
WATCHDOG_COUNT=0
boot=setenv bootargs; bootm 0xbf080000
openwrt=setenv serverip 192.168.1.66; tftpboot; bootm
serverip=192.168.1.66
boot_openwrt=setenv bootargs; bootm 0xbf080000
ramboot_openwrt=setenv serverip 192.168.1.66; tftpboot; bootm
stdin=serial
stdout=serial
stderr=serial
mem=130560k
ver=U-Boot 1.2.0.07-dirty (Sep 23 2015 - 14:24:57)

Environment size: 1775/4091 bytes
Boot->

Try to run the command to boot this section of flash, let us know your results.

This command boot OpenWRT.
How fix this error:

ERROR: There is a global environment variable with the same name.
Unknown command 'bootargs' - try 'help'

Log:

Boot-> boot_openwrt=setenv bootargs; bootm 0xbf080000
ERROR: There is a global environment variable with the same name.
Unknown command 'bootargs' - try 'help'
## Booting image at bf080000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.101
   Created:      2021-03-02   1:42:34 UTC
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    2178699 Bytes =  2.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
OK

Starting kernel ...



OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Looking for OpenWrt image... found at 0xbf082000
Decompressing kernel... done!
Starting kernel at 80060000...

[    0.000000] Linux version 5.4.101 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16059-e3ab355dde)) #0 Tue Mar 2 01:42:34 2021
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is Siemens WS-AP3610
[    0.000000] SoC: Atheros AR7161 rev 2
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00077ef2
[    0.000000] Readback ErrCtl register=00077ef2
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 121740K/131072K available (5236K kernel code, 188K rwdata, 1188K rodata, 1188K init, 205K bss, 9332K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] random: get_random_bytes called from start_kernel+0x32c/0x520 with crng_init=0
[    0.000000] CPU clock: 680.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5621354254 ns
[    0.000008] sched_clock: 32 bits at 340MHz, resolution 2ns, wraps every 6316128254ns
[    0.007809] Calibrating delay loop... 451.58 BogoMIPS (lpj=903168)
[    0.041961] pid_max: default: 32768 minimum: 301
[    0.046731] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.054039] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.065535] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.075305] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.082192] pinctrl core: initialized pinctrl subsystem
[    0.089637] NET: Registered protocol family 16
[    0.399658] PCI host bridge /ahb/apb/pcie-controller@17010000 ranges:
[    0.406115]  MEM 0x0000000010000000..0x0000000016ffffff
[    0.411340]   IO 0x0000000000000000..0x0000000000000000
[    0.433206] PCI host bridge to bus 0000:00
[    0.437346] pci_bus 0000:00: root bus resource [mem 0x10000000-0x16ffffff]
[    0.444214] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.449782] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.456560] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.464887] pci 0000:00:11.0: [168c:0027] type 00 class 0x028000
[    0.470911] pci 0000:00:11.0: reg 0x10: [mem 0x00000000-0x0000ffff]
[    0.477228] pci 0000:00:11.0: PME# supported from D0 D3hot
[    0.482928] pci 0000:00:12.0: [168c:0027] type 00 class 0x028000
[    0.488967] pci 0000:00:12.0: reg 0x10: [mem 0x00000000-0x0000ffff]
[    0.495276] pci 0000:00:12.0: PME# supported from D0 D3hot
[    0.501233] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    0.507879] pci 0000:00:11.0: BAR 0: assigned [mem 0x10000000-0x1000ffff]
[    0.514670] pci 0000:00:12.0: BAR 0: assigned [mem 0x10010000-0x1001ffff]
[    0.521545] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    0.534775] clocksource: Switched to clocksource MIPS
[    0.540885] NET: Registered protocol family 2
[    0.546087] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.554499] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.562169] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.569220] TCP: Hash tables configured (established 1024 bind 1024)
[    0.575713] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.582280] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.589497] NET: Registered protocol family 1
[    0.593939] PCI: CLS 0 bytes, default 32
[    0.601113] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.613644] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.619518] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.640659] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.650352] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.658887] printk: console [ttyS0] disabled
[    0.663218] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 10, base_baud = 10625000) is a 16550A
[    0.672020] printk: console [ttyS0] enabled
[    0.672020] printk: console [ttyS0] enabled
[    0.680368] printk: bootconsole [early0] disabled
[    0.680368] printk: bootconsole [early0] disabled
[    0.697673] spi-nor spi0.0: m25p128 (16384 Kbytes)
[    0.702578] 9 fixed-partitions partitions found on MTD device spi0.0
[    0.708927] Creating 9 MTD partitions on "spi0.0":
[    0.713719] 0x000000000000-0x000000040000 : "u-boot"
[    0.719568] 0x000000040000-0x000000080000 : "u-boot-bak"
[    0.725769] 0x000000080000-0x000000e80000 : "firmware"
[    0.734623] 2 uimage-fw partitions found on MTD device firmware
[    0.740596] Creating 2 MTD partitions on "firmware":
[    0.745569] 0x000000000000-0x000000240000 : "kernel"
[    0.751380] 0x000000240000-0x000000e00000 : "rootfs"
[    0.757146] mtd: device 4 (rootfs) set to be root filesystem
[    0.764415] 1 squashfs-split partitions found on MTD device rootfs
[    0.770652] 0x000000500000-0x000000e00000 : "rootfs_data"
[    0.776909] 0x000000e80000-0x000000ec0000 : "cfg1"
[    0.782584] 0x000000ec0000-0x000000f00000 : "cfg2"
[    0.788249] 0x000000f00000-0x000000f40000 : "nvram1"
[    0.794094] 0x000000f40000-0x000000f80000 : "nvram2"
[    0.799938] 0x000000f80000-0x000000fc0000 : "rsvd1"
[    0.805705] 0x000000fc0000-0x000001000000 : "rsvd2"
[    0.812942] libphy: Fixed MDIO Bus: probed
[    0.819646] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.140582] libphy: ag71xx_mdio: probed
[    1.174767] random: fast init done
[    1.178377] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=0143bca2, driver=Broadcom BCM5481]
[    1.188269] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii-id
[    1.195002] i2c /dev entries driver
[    1.200679] NET: Registered protocol family 10
[    1.209835] Segment Routing with IPv6
[    1.213649] NET: Registered protocol family 17
[    1.218152] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.231094] 8021q: 802.1Q VLAN Support v1.8
[    1.236321] hctosys: unable to open rtc device (rtc0)
[    1.249598] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    1.260275] Freeing unused kernel memory: 1188K
[    1.264821] This architecture does not have kernel memory protection.
[    1.271250] Run /sbin/init as init process
[    2.335401] init: Console is alive
[    2.339117] init: - watchdog -
[    3.775811] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.064388] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.082612] init: - preinit -
[    6.002617] random: jshn: uninitialized urandom read (4 bytes read)
[    6.270701] random: jshn: uninitialized urandom read (4 bytes read)
[    6.305427] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    9.551220] eth0: link up (100Mbps/Full duplex)
[    9.555927] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   11.148075] jffs2: notice: (564) jffs2_build_xattr_subsystem: complete building xattr subsystem, 27 of xdatum (21 unchecked, 2 orphan) and 41 of xref (2 dead, 0 orphan) found.
[   11.170167] mount_root: switching to jffs2 overlay
[   11.180653] overlayfs: upper fs does not support tmpfile.
[   11.198598] urandom-seed: Seeding with /etc/urandom.seed
[   11.375281] eth0: link down
[   11.399030] procd: - early -
[   11.402009] procd: - watchdog -
[   12.054623] procd: - watchdog -
[   12.059936] procd: - ubus -
[   12.169113] urandom_read: 5 callbacks suppressed
[   12.169121] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.239622] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.249053] procd: - init -
Please press Enter to activate this console.
[   13.158267] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.400256] Loading modules backported from Linux version v5.10.16-0-gde53befa79cf
[   13.407879] Backport generated by backports.git v5.10.16-1-0-g21d2a1d2
[   13.468789] xt_time: kernel timezone is -0000
[   13.593503] PPP generic driver version 2.4.2
[   13.607607] NET: Registered protocol family 24
[   13.691405] ath9k 0000:00:11.0: enabling device (0000 -> 0002)
[   15.253886] ath: phy0: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff
[   15.261033] ath: phy0: random mac address will be used: 6a:e0:8c:fd:a0:fa
[   15.288612] ieee80211 phy0: Atheros AR9160 MAC/BB Rev:1 AR5133 RF Rev:b0 mem=0xb0000000, irq=15
[   15.297532] ath9k 0000:00:12.0: enabling device (0000 -> 0002)
[   16.860169] ath: phy1: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff
[   16.867311] ath: phy1: random mac address will be used: a6:7f:ad:9a:e6:de
[   16.888480] ieee80211 phy1: Atheros AR9160 MAC/BB Rev:1 AR2133 RF Rev:b0 mem=0xb0010000, irq=16
[   16.985146] urngd: v1.0.2 started.
[   17.353663] random: crng init done
[   20.458363] kmodloader: done loading kernel modules from /etc/modules.d/*
[   33.398011] eth0: link up (100Mbps/Full duplex)
[   33.403740] br-lan: port 1(eth0) entered blocking state
[   33.409021] br-lan: port 1(eth0) entered disabled state
[   33.414559] device eth0 entered promiscuous mode
[   33.459882] br-lan: port 1(eth0) entered blocking state
[   33.465159] br-lan: port 1(eth0) entered listening state
[   35.470822] br-lan: port 1(eth0) entered learning state
[   36.398266] br-lan: port 2(wlan1) entered blocking state
[   36.403636] br-lan: port 2(wlan1) entered disabled state
[   36.409283] device wlan1 entered promiscuous mode
[   36.810213] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[   36.816791] br-lan: port 2(wlan1) entered blocking state
[   36.822133] br-lan: port 2(wlan1) entered listening state
[   36.850096] br-lan: port 3(wlan0) entered blocking state
[   36.855470] br-lan: port 3(wlan0) entered disabled state
[   36.861117] device wlan0 entered promiscuous mode
[   36.866006] br-lan: port 3(wlan0) entered blocking state
[   36.871349] br-lan: port 3(wlan0) entered listening state
[   36.963440] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   37.486829] br-lan: port 1(eth0) entered forwarding state
[   37.492262] br-lan: topology change detected, sending tcn bpdu
[   37.498406] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   38.894820] br-lan: port 3(wlan0) entered learning state
[   38.959892[   40.910810] br-lan: port 3(wlan0) entered forwarding state
[   40.916301] br-lan: topology change detected, sending tcn bpdu
[   40.975002] br-lan: port 2(wlan1) entered forwarding state
[   40.980515] br-lan: topology change detected, sending tcn bpdu



BusyBox v1.33.0 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 ----------------------------

bootargs would be another u-boot variable, but it's not set.

seems to be working fine anyway ... ?

1 Like

Everything works exactly until reboot :frowning:

this might be relevant - https://reverseengineering.stackexchange.com/questions/19324/how-does-u-boot-get-from-this-environment-to-booting-linux

1 Like

Maybe I need to edit the variable in the loader:
boot_flash=order="img2 bak2"; for script in ${order}; do if fsload 0x80400000 boot_kernel.${script}; then if imi 0x80400000; then autoscr 0x80400000; exit; fi; fi; done; echo ERROR: Problem with boot script, dropping to interactive shell

Problem solved. I added one more variable to uboot and now AP start fine, instalation config looks like this:

Download the OpenWrt initramfs-image.
Place it into a TFTP server root directory and rename it to 1D01A8C0.img
Configure the TFTP server to listen at 192.168.1.66/24.

Connect the TFTP server to the access point.

Connect to the serial console of the access point.
Attach power and interrupt the boot procedure when prompted.

Configure U-Boot for booting OpenWrt from ram and flash:
$ setenv boot_openwrt 'setenv bootargs; bootm 0xbf080000'
$ setenv ramboot_openwrt 'setenv serverip 192.168.1.66; tftpboot; bootm'
$ setenv bootcmd 'run boot_openwrt'
$ saveenv

Load OpenWrt into memory:
$ run ramboot_openwrt

Transfer the OpenWrt sysupgrade image to the device, I made this via WinSCP.
Write the image to flash using sysupgrade:
$ sysupgrade -n /tmp/openwrt-sysupgrade.bin
2 Likes

Strange, but today, when flashing an access point, yubut required an image named 1401A8C0.img. Or I made a mistake in the previous post and entered a different name for the image. Fixed:

Installation:

Download the OpenWrt initramfs-image.
Place it into a TFTP server root directory and rename it to 1401A8C0.img
Configure the TFTP server to listen at 192.168.1.66/24.

Connect the TFTP server to the access point.

Connect to the serial console of the access point. Speed: 115200!
Attach power and interrupt the boot procedure when prompted.

Configure U-Boot for booting OpenWrt from ram and flash:
$ setenv boot_openwrt 'setenv bootargs; bootm 0xbf080000'
$ setenv ramboot_openwrt 'setenv serverip 192.168.1.66; tftpboot; bootm'
$ setenv bootcmd 'run boot_openwrt'
$ saveenv

Load OpenWrt into memory:
$ run ramboot_openwrt

Transfer the OpenWrt sysupgrade image to the device.
Write the image to flash using sysupgrade:
$ sysupgrade -n /tmp/openwrt-sysupgrade.bin

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.