Flashing mr18 via Raspberry Pi 4 and JTAG

I wonder if anyone has done this successfully. I have an mr18 WAP but the firmware on it was too recent to do the flashing via serial so I'm attempting the JTAG route.
I'm following the guide https://openwrt.org/toh/meraki/mr18/jtag but seem to be stumbling at the point of disabling the hardware watchdog. The JTAG console comes back with a "target not halted" message, despite halting the boot sequence early on.

I've followed the guide, created the config files, edited them to match the Raspberry Pi 4 clock frequency, connected up the UART and JTAG pins, etc.

Here's what I get with openocd:

$ sudo openocd -f raspberrypi-native.cfg -f mr18.cfg -c "init; halt"
Open On-Chip Debugger 0.10.0+dev-00114-g41bcbc67d-dirty (2021-01-18-16:43)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
DEPRECATED! use 'adapter driver' not 'interface'
BCM2835 GPIO config: trst = 7

Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Warn : Transport "jtag" was already selected
DEPRECATED! use 'adapter speed' not 'adapter_khz'
adapter speed: 1000 kHz

Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 1000 kHz
Info : JTAG tap: ar9344.cpu tap/device found: 0x00000001 (mfg: 0x000 (<invalid>), part: 0x0000, ver: 0x0)
Info : starting gdb server for ar9344.cpu on 3333
Info : Listening on port 3333 for gdb connections
Error: isa info not available, failed to read cp0 config register: 0
target halted in MIPS32 mode due to debug-request, pc: 0x00000000
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : accepting 'telnet' connection on tcp/4444

I can then telnet to the device and connect, but issuing the mww command fails:

$ telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> mww 0xb8060008 0x0
target not halted

Any thoughts where to go from here?

1 Like

Looks like the halt part of the -c "init; halt" command has not been picked up / recognised. I think you can just type halt in either your openocd or telnet session and then try to disable the watchdog again.

I've flashed 2 MR18s a few weeks ago using an older raspberry pi. The process works but I needed to run it quite a few times before it was successful. It seems that you need to interrupt the boot process very early which can be a bit challenging. I found that it helped by plugging the 12v power supply into a wall socket with a switch such that it is easy to start the MR18 with one hand and immediately issue the command in the terminal window with the other hand.

Thanks. I'll try again.
I already tried several times at different points including very early on.
On one occasion, I did get further but then it failed to load the firmware. I'll see if I can get that far and post the exact error message.

OK, If I try it within like one second, it gets this far into booting:

Terminal ready
 
__________________sri____________________
944x BootROM Ver. (asic) 1.0 [Nov  8 2011 13:42:57]
_________________________________________
find_hif: bootstrap = 0x31c58
Nand Flash init
hdr: [0xbd000400 : 0xbd000400 : 0x6fb4 : 0xe5c86b84]
nand_load_fw: read 13 pages
nand_load_fw: 0x10000 0x800 0xbd000bf0
nand_load_fw: 0x20000 0x800 0xbd0013f0
nand_load_fw: 0x30000 0x800 0xbd001bf0
nand_load_fw: 0x40000 0x800 0xbd0023f0
nand_load_fw: 0x50000 0x800 0xbd002bf0
nand_load_fw: 0x60000 0x800 0xbd0033f0
nand_load_fw: 0x70000 0x800 0xbd003bf0
nand_load_fw: 0x80000 0x800 0xbd0043f0
nand_load_fw: 0x90000 0x800 0xbd004bf0
nand_load_fw: 0xa0000 0x800 0xbd0053f0
nand_load_fw: 0xb0000 0x800 0xbd005bf0
nand_load_fw: 0xc0000 0x800 0xbd0063f0
nand_load_fw: 0xd0000 0x800 0xbd006bf0
f/w 0 read complete, jumping to 0xbd000400



Meraki Atheros LinuxLoader MR18 built Jan 31 2014 15:53:22
qca955x_init_ddr ok
test_memory ok
D-cache size: 64K
I-cache size: 32K
init_dram_uncached ok
init_icache ok
init_dcache ok
enable_caches ok
test_memory ok
nand_flash_init ok
loading fw at 256
hdr: [0x8e73ed8a : 0x400 : 0x15ccd8 ]
part1: Copying image to memory ... ........

Is that already too far? At this point, I still get the target not halted message.
Do I need to interrupt it during the Nand flash init part and before the Meraki Atheros LinuxLoader section?

Made some progress, I guess.
I've been able to interrupt and disable the watchdog. This was successful at this point of the boot:

__________________sri____________________
944x BootROM Ver. (asic) 1.0 [Nov  8 2011 13:42:57]
_________________________________________
find_hif: bootstrap = 0x31c58
Nand Flash init
hdr: [0xbd000400 : 0xbd000400 : 0x6fb4 : 0xe5c86b84]
nand_load_fw: read 13 pages
nand_load_fw: 0x10000 0x800 0xbd000bf0
nand_load_fw: 0x20000 0x800 0xbd0013f0
nand_load_fw: 0x30000 0x800 0xbd001bf0
nand_load_fw: 0x40000 0x800 0xbd0023f0
nand_load_fw: 0x50000 0x800 0xbd002bf0
nand_load_fw: 0x60000 0x800 0xbd0033f0
nand_load_fw: 0x70000 0x800 0xbd003bf0
nand_load_fw: 0x80000 0x800 0xbd0043f0
nand_load_fw: 0x90000 0x800 0xbd004bf0
nand_load_fw: 0xa0000 0x800 0xbd0053f0
nand_load_fw: 0xb0000 0x800 0xbd005bf0
nand_load_fw: 0xc0000 0x800 0xbd0063f0
nand_load_fw: 0xd0000 0x800 0xbd006bf0
f/w 0 read complete, jumping to 0xbd000400



Meraki Atheros LinuxLoader MR18 built Jan 31 2014 15:53:22
qca955x_init_ddr ok
test_memory ok
D-cache size: 64K
I-cache size: 32K
init_dram_uncached ok
init_icache ok
init_dcache ok
enable_caches ok
test_memory ok
nand_flash_init ok
loading fw at 256
hdr: [0x8e73ed8a : 0x400 : 0x15ccd8 ]
part1: Copying image to memory ... .........B..
done.
part1: Checking sha1 (from 0x80060000 length 1428696) ... match
part1: sha1 calculated: dd59e7a34e25b59bc181277e16c01ecbc96dd64b
starting stage2
decompressing embedded kernel image 0x81a024f0(0x15a7c8)
got osize 4090c4
.. <== got this far when the halt command was issued via openocd

Now I'm at the stage of being unable to load the image...

telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> mww 0xb8060008 0x0                                                 
> load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
No working area available
Falling back to non-bulk write

>

I've flashed 2 more MR18s this evening following the instructions. The process is not very reliable and I had to restart the MR18 and retry maybe 10 - 20 times before I managed to flash it successfully. So the only advice I can give is just to keep trying until it works.

I did read some issues with the RPi4 so I've ordered a 3+ in case that helps and will try with that.

I must have tried like 50 times now with only two or three attempts getting me to the load_image stage.

@konus : did any of your attempts fail with the no working area available error?

No I've not seen that error. That is an odd one since it should be defined in the mr18.cfg file. One thing to check is to make sure that copying the text from the webpage has not introduced any additional end of line characters especially if you use windows. That is a common issue when moving files from windows to linux.

I've used a old raspberry pi 1B so I know that one works but it does take quite a few tries.

Right, some progress I guess.
I've now tried with a RPi 3B+ instead of a 4. The results are better in that I can systematically get the mww interrupt recognised.
But I now systematically fail on the load_image with the same "No working area available
Falling back to non-bulk write" message.
I'm actually working on the Pi and have been careful in copying / pasting the config files. I will check again.

I'm wondering if the length of cable could be an issue. My hookup to the JTAG is effectively around 50cm so maybe timing or voltage drop is an issue. I will see if I can try with a shorter cable.

I'll keep on persevering, but since I can now reliably get the interrupt accepted but seem to always fail at the next hurdle, I might have something wrong.

I'm wondering if in all my attempts, I've somehow bricked the mr18 - I do get a load of error messages on the serial connection if I let it boot up normally into the Cisco firmware. But I would have hoped that interrupting the boot process at such an early stage and at such a low level would mean that you can still fix / flash.

Looking into it in more detail and activating debug logging, it looks like it's having issues writing.

Debug: 400 40097 command.c:146 script_debug(): command - load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
Debug: 402 40097 configuration.c:97 find_file(): found openwrt-ar71xx-nand-mr18-initramfs-kernel.bin
Debug: 403 40097 configuration.c:97 find_file(): found openwrt-ar71xx-nand-mr18-initramfs-kernel.bin
Debug: 404 40125 target.c:2199 target_write_buffer(): writing buffer of 6353004 byte at 0x8005fc00
Debug: 405 40125 mips_m4k.c:1088 mips_m4k_write_memory(): address: 0x8005fc00, size: 0x00000004, count: 0x00183c1b
Debug: 406 40125 mips_m4k.c:1215 mips_m4k_bulk_write_memory(): address: 0x8005fc00, count: 0x00183c1b
Debug: 407 40125 target.c:1840 target_alloc_working_area_try(): MMU disabled, using physical address for working memory 0x81000000
Debug: 408 40126 target.c:1894 target_alloc_working_area_try(): allocated new working area of 128 bytes at address 0x81000000
Debug: 409 40126 mips_m4k.c:1029 mips_m4k_read_memory(): address: 0x81000000, size: 0x00000004, count: 0x00000020
Debug: 410 40126 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff20060c, expected ff200200
Debug: 411 40127 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 412 40128 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address fe200204, expected ff200204
Debug: 413 40129 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 414 40137 mips32_pracc.c:197 mips32_pracc_exec(): unexpected write at address ff2002c4
Error: 415 40137 mips_m4k.c:1230 mips_m4k_bulk_write_memory(): No working area available
Warn : 416 40137 mips_m4k.c:1099 mips_m4k_write_memory(): Falling back to non-bulk write
Debug: 417 40190 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff200244, expected ff200200
Debug: 418 40191 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 419 40195 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address fe200234, expected ff200234
Debug: 420 40205 command.c:627 run_command(): Command 'load_image' failed with error code -107

I've tried several times with no success :frowning:

Just to update: I can now get it to the stage of loading the firmware (I've switched to a RPi 3B+), but it fails at the point of trying to upload the kernel file with the message:

Debug: 278 11974 mips32_pracc.c:197 mips32_pracc_exec(): unexpected write at address ff20025c
Error: 279 11974 mips_m4k.c:1230 mips_m4k_bulk_write_memory(): No working area available
Warn : 280 11974 mips_m4k.c:1099 mips_m4k_write_memory(): Falling back to non-bulk write

I'm probably going to give up as debugging this is beyond me.

If anyone has any suggestions, please do shout.

Is the error at the same address every time? Maybe you could try to move the working area to a slightly different location to see if you can avoid it? Just an easy thing to try. I don't know enough about jtag & hardware to understand why it doesn't work for you.

I figured it was the grinding in my case. Try to connect the Raspberry Pi's grinding directly to one of the JTAG grounds instead of just relying on the UART ground.

@konus , no, it's different! I noticed this in my numerous attempts, and not sure why it's different.

Debug: 260 16967 command.c:146 script_debug(): command - load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
Debug: 262 16968 configuration.c:97 find_file(): found openwrt-ar71xx-nand-mr18-initramfs-kernel.bin
Debug: 263 16968 configuration.c:97 find_file(): found openwrt-ar71xx-nand-mr18-initramfs-kernel.bin
Debug: 264 16995 target.c:2199 target_write_buffer(): writing buffer of 6353004 byte at 0x8005fc00
Debug: 265 16995 mips_m4k.c:1088 mips_m4k_write_memory(): address: 0x8005fc00, size: 0x00000004, count: 0x00183c1b
Debug: 266 16995 mips_m4k.c:1215 mips_m4k_bulk_write_memory(): address: 0x8005fc00, count: 0x00183c1b
Debug: 267 16995 target.c:1840 target_alloc_working_area_try(): MMU disabled, using physical address for working memory 0x81000000
Debug: 268 16995 target.c:1894 target_alloc_working_area_try(): allocated new working area of 128 bytes at address 0x81000000
Debug: 269 16995 mips_m4k.c:1029 mips_m4k_read_memory(): address: 0x81000000, size: 0x00000004, count: 0x00000020
Debug: 270 16996 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff200200, expected ff200208
Error: 271 16996 mips_m4k.c:1230 mips_m4k_bulk_write_memory(): No working area available
Warn : 272 16997 mips_m4k.c:1099 mips_m4k_write_memory(): Falling back to non-bulk write
Debug: 273 17049 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff200208, expected ff200200
Debug: 274 17051 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 275 17055 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff600214, expected ff200214
Debug: 276 17060 command.c:627 run_command(): Command 'load_image' failed with error code -107

Then repeat, and I get different addresses:

Debug: 398 140554 command.c:146 script_debug(): command - load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
Debug: 400 140554 configuration.c:97 find_file(): found openwrt-ar71xx-nand-mr18-initramfs-kernel.bin
Debug: 401 140555 configuration.c:97 find_file(): found openwrt-ar71xx-nand-mr18-initramfs-kernel.bin
Debug: 402 140583 target.c:2199 target_write_buffer(): writing buffer of 6353004 byte at 0x8005fc00
Debug: 403 140583 mips_m4k.c:1088 mips_m4k_write_memory(): address: 0x8005fc00, size: 0x00000004, count: 0x00183c1b
Debug: 404 140583 mips_m4k.c:1215 mips_m4k_bulk_write_memory(): address: 0x8005fc00, count: 0x00183c1b
Debug: 405 140583 target.c:1894 target_alloc_working_area_try(): allocated new working area of 128 bytes at address 0x81000000
Debug: 406 140583 mips_m4k.c:1029 mips_m4k_read_memory(): address: 0x81000000, size: 0x00000004, count: 0x00000020
Debug: 407 140585 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff600210, expected ff200210
Error: 408 140585 mips_m4k.c:1230 mips_m4k_bulk_write_memory(): No working area available
Warn : 409 140585 mips_m4k.c:1099 mips_m4k_write_memory(): Falling back to non-bulk write

@thomasthep thanks. I'll see if I can do that. A little tricky as I've soldered a right-angled connector so cannot get access easily to the other row of points where the ground connections are.

Hmm I'm wondering if this isn't a clue:
Debug: 291 9161 target.c:1894 target_alloc_working_area_try(): allocated new working area of 128 bytes at address 0x81000000

128 bytes? If this is the "working area", then 128 bytes isn't enough to upload a 6MB image!

@tfboy The working area thing is just a workaround to be able to fast write without addressing the space as the start address.

The errors regarding unexpected address all look like bit flips which is another hint that it could be a connection fault. Since you soldered the other connectors, this is probably most likely just a grounding issue.

I printed a small clamp with insertable pogo pins as I didn't want to have to remove the board and do any soldering for 10+ devices. This has other up and down sides.

I've checked the grounding and I think it's good. When I disconnect or make it flaky, there's loads of garbage that comes out of the serial. I've tried also connecting to the ground pins of the JTAG (it's common with the ground of the UART) and it makes no difference.

$ sudo openocd -f raspberrypi-native.cfg -f mr18.cfg -c "init; halt" -d3
Open On-Chip Debugger 0.10.0+dev-00114-g41bcbc67d-dirty (2021-01-18-16:43)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
User : 13 5 options.c:63 configuration_output_handler(): debug_level: 3
User : 14 5 options.c:63 configuration_output_handler(): 
Debug: 15 5 options.c:244 add_default_dirs(): bindir=/usr/bin
Debug: 16 5 options.c:245 add_default_dirs(): pkgdatadir=/usr/share/openocd
Debug: 17 5 options.c:246 add_default_dirs(): exepath=/usr/bin
Debug: 18 5 options.c:247 add_default_dirs(): bin2data=../share/openocd
Debug: 19 5 configuration.c:42 add_script_search_dir(): adding /root/.config/openocd
Debug: 20 5 configuration.c:42 add_script_search_dir(): adding /root/.openocd
Debug: 21 5 configuration.c:42 add_script_search_dir(): adding /usr/bin/../share/openocd/site
Debug: 22 5 configuration.c:42 add_script_search_dir(): adding /usr/bin/../share/openocd/scripts
Debug: 23 5 configuration.c:97 find_file(): found raspberrypi-native.cfg
Debug: 24 5 command.c:146 script_debug(): command - adapter driver bcm2835gpio
Debug: 26 5 command.c:352 register_command_handler(): registering 'bcm2835gpio_jtag_nums'...
Debug: 27 5 command.c:352 register_command_handler(): registering 'bcm2835gpio_tck_num'...
Debug: 28 5 command.c:352 register_command_handler(): registering 'bcm2835gpio_tms_num'...
Debug: 29 5 command.c:352 register_command_handler(): registering 'bcm2835gpio_tdo_num'...
Debug: 30 5 command.c:352 register_command_handler(): registering 'bcm2835gpio_tdi_num'...
Debug: 31 5 command.c:352 register_command_handler(): registering 'bcm2835gpio_swd_nums'...
Debug: 32 6 command.c:352 register_command_handler(): registering 'bcm2835gpio_swclk_num'...
Debug: 33 6 command.c:352 register_command_handler(): registering 'bcm2835gpio_swdio_num'...
Debug: 34 6 command.c:352 register_command_handler(): registering 'bcm2835gpio_srst_num'...
Debug: 35 6 command.c:352 register_command_handler(): registering 'bcm2835gpio_trst_num'...
Debug: 36 6 command.c:352 register_command_handler(): registering 'bcm2835gpio_speed_coeffs'...
Debug: 37 6 command.c:352 register_command_handler(): registering 'bcm2835gpio_peripheral_base'...
Debug: 38 6 command.c:146 script_debug(): command - bcm2835gpio_peripheral_base 0x3E000000
Debug: 40 6 command.c:146 script_debug(): command - bcm2835gpio_speed_coeffs 194938 48
Debug: 42 6 command.c:146 script_debug(): command - bcm2835gpio_jtag_nums 11 25 10 9
Debug: 44 6 command.c:146 script_debug(): command - bcm2835gpio_swd_nums 11 25
Debug: 46 6 command.c:146 script_debug(): command - bcm2835gpio_trst_num 7
User : 48 6 options.c:63 configuration_output_handler(): BCM2835 GPIO config: trst = 7
User : 49 6 options.c:63 configuration_output_handler(): 
Debug: 50 6 configuration.c:97 find_file(): found mr18.cfg
Debug: 51 6 command.c:146 script_debug(): command - transport select
Info : 52 6 transport.c:286 jim_transport_select(): auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Debug: 53 6 command.c:352 register_command_handler(): registering 'jtag_flush_queue_sleep'...
Debug: 54 6 command.c:352 register_command_handler(): registering 'jtag_rclk'...
Debug: 55 6 command.c:352 register_command_handler(): registering 'jtag_ntrst_delay'...
Debug: 56 6 command.c:352 register_command_handler(): registering 'jtag_ntrst_assert_width'...
Debug: 57 6 command.c:352 register_command_handler(): registering 'scan_chain'...
Debug: 58 6 command.c:352 register_command_handler(): registering 'runtest'...
Debug: 59 6 command.c:352 register_command_handler(): registering 'irscan'...
Debug: 60 6 command.c:352 register_command_handler(): registering 'verify_ircapture'...
Debug: 61 6 command.c:352 register_command_handler(): registering 'verify_jtag'...
Debug: 62 6 command.c:352 register_command_handler(): registering 'tms_sequence'...
Debug: 63 6 command.c:352 register_command_handler(): registering 'wait_srst_deassert'...
Debug: 64 6 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 65 6 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 66 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 67 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 68 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 69 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 70 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 71 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 72 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 73 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 74 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 75 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 76 7 command.c:352 register_command_handler(): registering 'jtag'...
Debug: 77 7 command.c:352 register_command_handler(): registering 'svf'...
Debug: 78 7 command.c:352 register_command_handler(): registering 'xsvf'...
Debug: 79 7 command.c:146 script_debug(): command - transport select
Debug: 80 7 command.c:146 script_debug(): command - jtag newtap ar9344 cpu -irlen 5 -expected-id 0x00000001
Debug: 81 7 tcl.c:605 jim_newtap_cmd(): Creating New Tap, Chip: ar9344, Tap: cpu, Dotted: ar9344.cpu, 4 params
Debug: 82 7 tcl.c:665 jim_newtap_cmd(): Processing option: -irlen
Debug: 83 7 tcl.c:665 jim_newtap_cmd(): Processing option: -expected-id
Debug: 84 7 core.c:1488 jtag_tap_init(): Created Tap: ar9344.cpu @ abs position 0, irlen 5, capture: 0x1 mask: 0x3
Debug: 85 7 command.c:146 script_debug(): command - target create ar9344.cpu mips_m4k -endian big -chain-position ar9344.cpu
Debug: 86 7 target.c:1991 target_free_all_working_areas_restore(): freeing all working areas
Debug: 87 7 command.c:352 register_command_handler(): registering 'mips32'...
Debug: 88 7 command.c:352 register_command_handler(): registering 'mips32'...
Debug: 89 7 command.c:352 register_command_handler(): registering 'mips_m4k'...
Debug: 90 7 command.c:352 register_command_handler(): registering 'mips_m4k'...
Debug: 91 8 command.c:352 register_command_handler(): registering 'mips_m4k'...
Debug: 92 8 command.c:352 register_command_handler(): registering 'mips_m4k'...
Debug: 93 8 command.c:352 register_command_handler(): registering 'mips_m4k'...
Debug: 94 8 command.c:352 register_command_handler(): registering 'mips_m4k'...
Debug: 95 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 96 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 97 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 98 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 99 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 100 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 101 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 102 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 103 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 104 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 105 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 106 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 107 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 108 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 109 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 110 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 111 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 112 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 113 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 114 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 115 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 116 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 117 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 118 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 119 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 120 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 121 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 122 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 123 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 124 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 125 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 126 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 127 8 command.c:352 register_command_handler(): registering 'ar9344.cpu'...
Debug: 128 8 command.c:146 script_debug(): command - ar9344.cpu configure -work-area-phys 0x81000000 -work-area-size 0x4000 -work-area-backup 1
Debug: 129 8 target.c:1991 target_free_all_working_areas_restore(): freeing all working areas
Debug: 130 8 target.c:1991 target_free_all_working_areas_restore(): freeing all working areas
Debug: 131 8 target.c:1991 target_free_all_working_areas_restore(): freeing all working areas
Debug: 132 8 command.c:146 script_debug(): command - transport select jtag
Warn : 133 9 transport.c:296 jim_transport_select(): Transport "jtag" was already selected
Debug: 134 9 command.c:146 script_debug(): command - echo DEPRECATED! use 'adapter speed' not 'adapter_khz'
User : 136 9 command.c:767 jim_echo(): DEPRECATED! use 'adapter speed' not 'adapter_khz'
Debug: 137 9 command.c:146 script_debug(): command - adapter speed 1000
Debug: 139 9 core.c:1822 jtag_config_khz(): handle jtag khz
Debug: 140 9 core.c:1785 adapter_khz_to_speed(): convert khz to interface specific speed value
Debug: 141 9 core.c:1785 adapter_khz_to_speed(): convert khz to interface specific speed value
User : 142 9 options.c:63 configuration_output_handler(): adapter speed: 1000 kHz
User : 143 9 options.c:63 configuration_output_handler(): 
Debug: 144 9 command.c:146 script_debug(): command - init
Debug: 146 9 command.c:146 script_debug(): command - target init
Debug: 148 9 command.c:146 script_debug(): command - target names
Debug: 149 9 command.c:146 script_debug(): command - ar9344.cpu cget -event gdb-flash-erase-start
Debug: 150 9 command.c:146 script_debug(): command - ar9344.cpu configure -event gdb-flash-erase-start reset init
Debug: 151 9 command.c:146 script_debug(): command - ar9344.cpu cget -event gdb-flash-write-end
Debug: 152 9 command.c:146 script_debug(): command - ar9344.cpu configure -event gdb-flash-write-end reset halt
Debug: 153 10 command.c:146 script_debug(): command - ar9344.cpu cget -event gdb-attach
Debug: 154 10 command.c:146 script_debug(): command - ar9344.cpu configure -event gdb-attach halt 1000
Debug: 155 10 target.c:1458 handle_target_init_command(): Initializing targets...
Debug: 156 10 command.c:352 register_command_handler(): registering 'target_request'...
Debug: 157 10 command.c:352 register_command_handler(): registering 'trace'...
Debug: 158 10 command.c:352 register_command_handler(): registering 'trace'...
Debug: 159 10 command.c:352 register_command_handler(): registering 'fast_load_image'...
Debug: 160 10 command.c:352 register_command_handler(): registering 'fast_load'...
Debug: 161 10 command.c:352 register_command_handler(): registering 'profile'...
Debug: 162 10 command.c:352 register_command_handler(): registering 'virt2phys'...
Debug: 163 10 command.c:352 register_command_handler(): registering 'reg'...
Debug: 164 10 command.c:352 register_command_handler(): registering 'poll'...
Debug: 165 10 command.c:352 register_command_handler(): registering 'wait_halt'...
Debug: 166 10 command.c:352 register_command_handler(): registering 'halt'...
Debug: 167 10 command.c:352 register_command_handler(): registering 'resume'...
Debug: 168 10 command.c:352 register_command_handler(): registering 'reset'...
Debug: 169 10 command.c:352 register_command_handler(): registering 'soft_reset_halt'...
Debug: 170 10 command.c:352 register_command_handler(): registering 'step'...
Debug: 171 10 command.c:352 register_command_handler(): registering 'mdd'...
Debug: 172 10 command.c:352 register_command_handler(): registering 'mdw'...
Debug: 173 10 command.c:352 register_command_handler(): registering 'mdh'...
Debug: 174 10 command.c:352 register_command_handler(): registering 'mdb'...
Debug: 175 10 command.c:352 register_command_handler(): registering 'mwd'...
Debug: 176 10 command.c:352 register_command_handler(): registering 'mww'...
Debug: 177 10 command.c:352 register_command_handler(): registering 'mwh'...
Debug: 178 10 command.c:352 register_command_handler(): registering 'mwb'...
Debug: 179 10 command.c:352 register_command_handler(): registering 'bp'...
Debug: 180 10 command.c:352 register_command_handler(): registering 'rbp'...
Debug: 181 10 command.c:352 register_command_handler(): registering 'wp'...
Debug: 182 11 command.c:352 register_command_handler(): registering 'rwp'...
Debug: 183 11 command.c:352 register_command_handler(): registering 'load_image'...
Debug: 184 11 command.c:352 register_command_handler(): registering 'dump_image'...
Debug: 185 11 command.c:352 register_command_handler(): registering 'verify_image_checksum'...
Debug: 186 11 command.c:352 register_command_handler(): registering 'verify_image'...
Debug: 187 11 command.c:352 register_command_handler(): registering 'test_image'...
Debug: 188 11 command.c:352 register_command_handler(): registering 'reset_nag'...
Debug: 189 11 command.c:352 register_command_handler(): registering 'ps'...
Debug: 190 11 command.c:352 register_command_handler(): registering 'test_mem_access'...
Info : 191 11 bcm2835gpio.c:458 bcm2835gpio_init(): BCM2835 GPIO JTAG/SWD bitbang driver
Debug: 192 11 bcm2835gpio.c:546 bcm2835gpio_init(): saved pinmux settings: tck 0 tms 0 tdi 0 tdo 0 trst 0 srst 0
Debug: 193 11 core.c:1785 adapter_khz_to_speed(): convert khz to interface specific speed value
Debug: 194 11 core.c:1789 adapter_khz_to_speed(): have interface set up
Debug: 195 11 core.c:1785 adapter_khz_to_speed(): convert khz to interface specific speed value
Debug: 196 11 core.c:1789 adapter_khz_to_speed(): have interface set up
Info : 197 11 core.c:1565 adapter_init(): clock speed 1004 kHz
Debug: 198 11 openocd.c:141 handle_init_command(): Debug Adapter init complete
Debug: 199 11 command.c:146 script_debug(): command - transport init
Debug: 201 11 transport.c:239 handle_transport_init(): handle_transport_init
Debug: 202 11 core.c:830 jtag_add_reset(): SRST line released
Debug: 203 11 core.c:855 jtag_add_reset(): TRST line released
Debug: 204 11 core.c:327 jtag_call_event_callbacks(): jtag event: TAP reset
Debug: 205 12 command.c:146 script_debug(): command - jtag arp_init
Debug: 206 12 core.c:1578 jtag_init_inner(): Init JTAG chain
Debug: 207 12 core.c:327 jtag_call_event_callbacks(): jtag event: TAP reset
Debug: 208 12 core.c:1243 jtag_examine_chain(): DR scan interrogation for IDCODE/BYPASS
Debug: 209 12 core.c:327 jtag_call_event_callbacks(): jtag event: TAP reset
Debug: 210 13 jep106.c:33 jep106_manufacturer(): BUG: Caller passed out-of-range JEP106 ID!
Info : 211 13 core.c:1142 jtag_examine_chain_display(): JTAG tap: ar9344.cpu tap/device found: 0x00000001 (mfg: 0x000 (<invalid>), part: 0x0000, ver: 0x0)
Debug: 212 13 core.c:1374 jtag_validate_ircapture(): IR capture validation scan
Error: 213 13 core.c:1426 jtag_validate_ircapture(): ar9344.cpu: IR capture error; saw 0x03 not 0x01
Debug: 214 13 core.c:327 jtag_call_event_callbacks(): jtag event: TAP reset
Warn : 215 13 core.c:1646 jtag_init_inner(): Bypassing JTAG setup events due to errors
Debug: 216 13 command.c:146 script_debug(): command - dap init
Debug: 218 13 arm_dap.c:116 dap_init_all(): Initializing all DAPs ...
Debug: 219 13 openocd.c:158 handle_init_command(): Examining targets...
Debug: 220 13 target.c:1646 target_call_event_callbacks(): target event 19 (examine-start) for core ar9344.cpu
Debug: 221 13 mips_ejtag.c:395 mips_ejtag_init(): EJTAG: Version 5.1 Detected
Debug: 222 13 mips_ejtag.c:349 ejtag_main_print_imp(): EJTAG main: features: MIPS16 DMA MIPS32
Debug: 223 13 mips_ejtag.c:339 ejtag_v26_print_imp(): EJTAG v2.6: features: R4k
Debug: 224 13 mips_ejtag.c:405 mips_ejtag_init(): EJTAG: DMA Access Mode detected. Disabling to workaround current broken code.
Debug: 225 13 target.c:1646 target_call_event_callbacks(): target event 21 (examine-end) for core ar9344.cpu
Debug: 226 13 command.c:146 script_debug(): command - flash init
Debug: 227 14 mips_m4k.c:215 mips_m4k_poll(): Reset Detected
Debug: 229 14 tcl.c:1324 handle_flash_init_command(): Initializing flash devices...
Debug: 230 14 command.c:146 script_debug(): command - nand init
Debug: 232 14 tcl.c:498 handle_nand_init_command(): Initializing NAND devices...
Debug: 233 14 command.c:146 script_debug(): command - pld init
Debug: 235 14 pld.c:206 handle_pld_init_command(): Initializing PLDs...
Info : 236 14 gdb_server.c:3503 gdb_target_start(): starting gdb server for ar9344.cpu on 3333
Info : 237 14 server.c:311 add_service(): Listening on port 3333 for gdb connections
Debug: 238 14 command.c:146 script_debug(): command - halt
Debug: 240 15 target.c:3087 handle_halt_command(): -
Debug: 241 15 mips_m4k.c:272 mips_m4k_halt(): target->state: running
Debug: 242 15 mips_ejtag.c:258 mips_ejtag_enter_debug(): ejtag_ctrl: 0x4004c008
Debug: 243 15 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff000204, expected ff200204
Debug: 244 16 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 245 17 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff200600, expected ff200200
Debug: 246 18 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 247 19 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff200208, expected ff20020c
Debug: 248 20 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff20020c, expected ff200200
Debug: 249 22 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 250 25 mips32_pracc.c:197 mips32_pracc_exec(): unexpected write at address ff200200
Debug: 251 25 mips_m4k.c:1029 mips_m4k_read_memory(): address: 0xff300000, size: 0x00000004, count: 0x00000001
Debug: 252 25 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff400204, expected ff200204
Debug: 253 26 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 254 27 mips32_pracc.c:207 mips32_pracc_exec(): writing at unexpected address ff004000
Debug: 255 27 target.c:2412 target_read_u32(): address: 0xff300000 failed
Debug: 256 27 mips32_pracc.c:197 mips32_pracc_exec(): unexpected write at address ff202000
Debug: 257 28 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 258 28 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff600208, expected ff200200
Debug: 259 30 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 260 30 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff200208, expected ff200200
Debug: 261 31 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 262 31 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff200208, expected ff200200
Error: 263 31 mips32.c:717 mips32_read_config_regs(): isa info not available, failed to read cp0 config register: 0
Debug: 264 31 mips_m4k.c:123 mips_m4k_debug_entry(): entered debug state at PC 0x0, target->state: halted
Debug: 265 31 target.c:1646 target_call_event_callbacks(): target event 0 (gdb-halt) for core ar9344.cpu
Debug: 266 31 target.c:1646 target_call_event_callbacks(): target event 1 (halted) for core ar9344.cpu
User : 267 31 mips32.c:298 mips32_arch_state(): target halted in MIPS32 mode due to debug-request, pc: 0x00000000
Info : 268 31 server.c:311 add_service(): Listening on port 6666 for tcl connections
Info : 269 32 server.c:311 add_service(): Listening on port 4444 for telnet connections
Debug: 270 32 command.c:146 script_debug(): command - init
Info : 272 3752 server.c:100 add_connection(): accepting 'telnet' connection on tcp/4444
Debug: 273 5200 command.c:146 script_debug(): command - mww 0xb8060008 0x0
Debug: 275 5201 mips_m4k.c:1088 mips_m4k_write_memory(): address: 0xb8060008, size: 0x00000004, count: 0x00000001
Debug: 276 5201 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff200208, expected ff200200
Debug: 277 5203 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 278 8292 command.c:146 script_debug(): command - load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
Debug: 280 8292 configuration.c:97 find_file(): found openwrt-ar71xx-nand-mr18-initramfs-kernel.bin
Debug: 281 8292 configuration.c:97 find_file(): found openwrt-ar71xx-nand-mr18-initramfs-kernel.bin
Debug: 282 8320 target.c:2199 target_write_buffer(): writing buffer of 6353004 byte at 0x8005fc00
Debug: 283 8320 mips_m4k.c:1088 mips_m4k_write_memory(): address: 0x8005fc00, size: 0x00000004, count: 0x00183c1b
Debug: 284 8320 mips_m4k.c:1215 mips_m4k_bulk_write_memory(): address: 0x8005fc00, count: 0x00183c1b
Debug: 285 8320 target.c:1840 target_alloc_working_area_try(): MMU disabled, using physical address for working memory 0x81000000
Debug: 286 8320 target.c:1894 target_alloc_working_area_try(): allocated new working area of 128 bytes at address 0x81000000
Debug: 287 8320 mips_m4k.c:1029 mips_m4k_read_memory(): address: 0x81000000, size: 0x00000004, count: 0x00000020
Debug: 288 8321 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address fe600200, expected ff200200
Debug: 289 8322 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 290 8323 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address fe200200, expected ff200200
Debug: 291 8324 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 292 8325 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff600200, expected ff200200
Debug: 293 8326 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 294 8342 mips32_pracc.c:207 mips32_pracc_exec(): writing at unexpected address ff202074
Error: 295 8342 mips_m4k.c:1230 mips_m4k_bulk_write_memory(): No working area available
Warn : 296 8343 mips_m4k.c:1099 mips_m4k_write_memory(): Falling back to non-bulk write
Debug: 297 8376 mips32_pracc.c:197 mips32_pracc_exec(): unexpected write at address ff202034
Debug: 298 8380 mips32_pracc.c:186 mips32_pracc_exec(): restarting code
Debug: 299 8384 mips32_pracc.c:227 mips32_pracc_exec(): reading at unexpected address ff600244, expected ff200244
Debug: 300 8393 command.c:627 run_command(): Command 'load_image' failed with error code -107
User : 301 8394 command.c:692 command_run_line(): 
^CDebug: 302 11169 server.c:604 sig_handler(): Terminating on Signal 2

Ground is required for differential, no doubt. Weird that using JTAG ground didn't make a difference. Electrical signals are weird, timing, capacitance, differential, interference, etc. could all be a cause. In most cases they should share a ground, but not always necessarily true. I've seen circuitry where it has been isolated from the rest of the board, for good reason.
Keep the cables as short as possible, bundle them together, make sure there are no contacts and use connections available local to the connector. JTAG ground should belong to JTAG and UART to UART.
If all fails, maybe get a professional JTAG device. Black Magic Probe is pretty awesome.

Btw, you're still getting bitflips. There's a difference of 1 bit.

Are you also using the same outlet between the pi and meraki? Is the pi getting enough power?

Hi, anyone can dump a uboot mtdblock?
изображение_2021-03-15_230542