Meraki MR18 installation using JTAG and OpenOCD

[zsoltko]

Hi Guys,

I'm trying to install OpenWRT on my MR18 using the JTAG method with RPI. The serial connection works fine, I can halt and resume the boot process.
Although I issue exactly the same commands as the guide described I got some issues and the OpenWRT image doesn't load:

Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger

load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
mini program did not return to start
6353004 bytes written at address 0x8005fc00
downloaded 6353004 bytes in 34.503567s (179.811 KiB/s)
target halted in MIPS32 mode due to debug-request, pc: 0x00000000
verify_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00

reg r4 0
r4 (/32): 0x00000000
reg r5 0
r5 (/32): 0x00000000
reg r6 0
r6 (/32): 0x00000000
reg r7 0
r7 (/32): 0x00000000
resume 0x80060000
failed to restore 128 bytes of working area at address 0x81000000
target halted in MIPS32 mode due to target-not-halted, pc: 0x80060000
target halted in MIPS32 mode due to target-not-halted, pc: 0x80060000

I can see that something isn't correct during the copy process "mini program did not return to start" , even though it says downloaded, but I cannot understand what goes wrong.

Could you please give some advice here?

Thanks,
Zs

[larsen]

I believe you have some communication problem between rpi and mr18.
Too many targets halted in MIPS32 ....
In particular

target halted in MIPS32 mode due to debug-request, pc: 0x00000000

was an error that did not allow me to enter debug mode and communicate with mr18.
I can't tell you more as. I used that guide but with usb-blaster, DLC 5 and wiggler unbuffer cables. All successfully with many mr18.

[zsoltko]

I've checked every wire, the soldering and even I made a new Raspbian install and still the same issue. I tried to lower the adapter speed too and tweaking different settings with no success.
It looks to me it has a problem with the RPI 4 Model B board. I will check it with an RP3 later.

[rod4openwrt]

did you disable the watchdog???

mww 0xb8060008 0x0

[markbirss]

You could check below

I used a Raspberry Pi Zero W, but @vuhuy suggested to other users that were having issues to check proper timings for the specific Raspberry Pi being used

Refer to

Meraki18 using Raspberry and Openocd

Sorry for my late reply. I hadn't got time to look to the docs. Your problem here is that the Pi model 1 differs from model 2 and 3. And to even more complicated, the model 3B uses a different SOC so even there there could be a difference. I see you're using the raspberrypi-native.cfg interface script while you're using a RPI3 B+ as the timings are different between the between models. I made a list for you based on the different RPI models. RPI 1A/A+/B/B+ with 700 MHz base clock bcm2835gpio_…

[rod4openwrt]

i use a Raspberry Pi B+ and everything worked fine (i see the OpenWRT linux booting in the serial console) till i have to connect my notebook to the device, because i cant open the website of OpenWRT. i didnt get any IP address, so i changed to manual IP address, but that didnt help either.
i wonder is it because i halted the booting too early or too late. first i thought the ethernet port is broken, but both of the LEDs are blinking.

[oloco]

Hi,
I know its a quite old post, but I'm facing the same problem as you, zsoltko. Did you finally manage to get it working?

Guys, any idea on how to solve it?
Here I post an screenshot with the issue.

I'm using Rpi 4B (4GB RAM), and the rpi config as shown:

> interface bcm2835gpio
> bcm2835gpio_jtag_nums 11 25 10 9
> bcm2835gpio_peripheral_base 0xFE000000bcm2835gpio_speed_coeffs 236181 60
> bcm2835gpio_trst_num 7

Thanks in advance!!

[zsoltko]

Hi oloco,

Unfortunately, no. I didn't have a chance to get another board to test it. It doesn't work with my RPI 4 Model B.
If you can manage to flash it, please share

BR,
Zsolt

[oloco]

Hi,

I managed to get another version of Rpi. I this case, it was Rpi 3B. Changing the values in the config file, the same kind of problems appears, or even worst.. as It fails before I can load the image to the MR18. I checkd all the cables, double-soldered links... but no luck at all.
Now, I'm looking for somebody in Europe who could flash my device, but I'm not having any lock at all. I don't know what else to try.

I hope you get more luck than me

Regards

[larsen]

I used a usb blaster

MR18 JTAG with RPI error pls hlp

https://www.ebay.com/sch/i.html?_from=R40&_nkw=usb+blaster+altera&_sacat=0&LH_TitleDesc=0&_sop=15 https://www.amazon.com/s?k=usb+blaster+altera&crid=22DPHK0IPNZY5&sprefix=usb+blaste%2Caps%2C288&ref=nb_sb_ss_ac-o-p_1_10 [image] Connect only TDI TDO TMS TCK nTRST + 1 GND

Also works dlc5 & wiggler unbuffered jtag cables,

[oloco]

Hi Larsen.

Thanks so much for your reply.

Well, some minutes ago I managed to resold all the wires and I got a good connecion to MR18. Now My problem is the last command: resume 0x80060000. The AP terminal doesn,t show any activity. Sometimes a pair of strange symbols, but nothing else. In troubleshooting, the gide says to repeat the comands halt and resume... but I'm not being lucky. I tried multiple times, while stoping the AP in different moments, but I can't find the way to load openwrt kernel.

Anyway, If I get tired of trying this way, maybe I will use your methid, as it seems to be quite cheap,and I cant's spend more money.

Again, thanks for your info.

Regards

[larsen]

1. You have to stop the AP as soon as possible, immediately.
2. If "resume 0x80060000" doesn't work the first time, give the halt command, reset the registers again and again "resume 0x80060000". This for 2/3 times. If it doesn't work, repeat everything from the beginning.
   I have flash many mr18. All the first time it didn't work. But all 2/3 times successfully.

[oloco]

You are right.

Yesterday I tried for the very last time, and I got it working. I think the trick was to stop it in the very very begginning. Once done, all steps are just quite easy.

Thanks a lot for your support

Regards

[larsen]

Good!

Regards

[couscous]

Hi guys,

Attempted the JTAG procedure 21 times (yes .. I counted ...).
Worked like a charm the 22nd !!!!

Just wanted to share where I had to halt the MR18 boot . It seems that it is the key factor for upgrade with success.
(too soon, can't even properly load image,
too late get either errors; or random characters)

I also skipped the verify image; as it appears to resume sometimes the device, but no proof of that.

( Halt performed at "part1; copying image to memory ...", the rest is just the resume that worked)

Good luck to you all.

Will try on another MR18. Wish me luck !

[larsen]

@couscous

I also skipped the verify image; as it appears to resume sometimes the device, but no proof of that.

If you have problems with image verification, it is a communication problem between the jtag and the AP.

[thomasthep]

I had the same issue and couldn't figure out the cause and thought my pi or some other device was at fault. While testing it with another pi I attached the Pi's ground directly to the JTAG ground as UART was running on another pi and was working. Worked straight away. Tried it on my initial pi with ground and worked on the first try.
Maybe this should be added or at least mentioned that proper grounding is very important.

[xromansx]

I'm geting "ecc unrecoverable error" during flash write and it doesn't work, I think nand has problem with ecc correction did someone try to use nandwrite or nanddump to write openwrt image, I think when used standart method it doesn't handle ecc errors.

[ricktendo]

Here is a video I made on how to flash the MR18 with USBJTAG, should also work similarly with the UlinkNT

Flashing the Meraki MR18 with USBJTAG NT

P.S. Anybody know when/if we will get the MR18 supported on OpenWRT 21.x?

[YakovOnline]

Latest current release is 19.07.8!