Meraki MR18: load_image: No working area available

Installing and Using OpenWrt
1

I too am struggling to get the Meraki MR18 flashed, this is as far as I get. Gave up on the Pi UART as gave strange results, fell back to a USB UART cheapie from ebay.

Model: Raspberry Pi Zero Rev 1.3
Raspbian GNU/Linux 10 (buster)

pi@zero01:~$ sudo openocd -f raspberrypi-native.cfg -f mr18.cfg -c "init; halt"
Open On-Chip Debugger 0.10.0+dev-00114-g41bcbc67d-dirty (2021-01-18-16:43)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
BCM2835 GPIO config: trst = 7

Info : auto-selecting first available session transport "jtag". To override use 'transport select '.
adapter speed: 500 kHz

Info : BCM2835 GPIO JTAG/SWD bitbang driver

I've been trying different speeds (mentioned on another forum) but this makes no difference

Info : clock speed 500 kHz
Info : JTAG tap: ar9344.cpu tap/device found: 0x00000001 (mfg: 0x000 (), part: 0x0000, ver: 0x0)
Info : starting gdb server for ar9344.cpu on 3333
Info : Listening on port 3333 for gdb connections
Error: isa info not available, failed to read cp0 config register: 0
target halted in MIPS32 mode due to debug-request, pc: 0x00000000
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Error: isa info not available, failed to read cp0 config register: 0
target halted in MIPS32 mode due to debug-request, pc: 0x00000000

##########################

pi@zero01:~$ telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger

halt
init
mww 0xb8060008 0x0

load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
No working area available
Falling back to non-bulk write

This is where I get stuck, nothing I do makes this transfer work, bugger

2

The process starts must stop immediately with the initial command

sudo openocd -f raspberrypi-native.cfg -f mr18.cfg -c "init; halt"

Not in a second time with telnet

halt
init
3

That's just me trying alternatives, makes no difference

4

Trying with another Pi, a 1B I think. even more flaky and end up back here

Model: Raspberry Pi Model B Rev 2

pi@raspberrypi:~$ sudo openocd -f raspberrypi-native.cfg -f mr18.cfg -c "init; halt"
Open On-Chip Debugger 0.10.0+dev-00114-g41bcbc67d-dirty (2021-01-18-16:43)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
BCM2835 GPIO config: trst = 7

Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
Warn : Transport "jtag" was already selected
adapter speed: 100 kHz

Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : clock speed 100 kHz
Info : JTAG tap: ar9344.cpu tap/device found: 0x00000001 (mfg: 0x000 (<invalid>), part: 0x0000, ver: 0x0)
Info : starting gdb server for ar9344.cpu on 3333
Info : Listening on port 3333 for gdb connections
Error: Failed to enter Debug Mode!
Info : Halt timed out, wake up GDB.
Error: timed out while waiting for target halted

Either this:

mww 0xb8060008 0x0
target not halted

Or this:

load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
No working area available
Falling back to non-bulk write
5

Adding the -d3 parameter to enable debuging

#This one appears to work but the debuging indicates not

mww 0xb8060008 0x0

Debug: 581 470925 command.c:146 script_debug(): command - mww 0xb8060008 0x0
Debug: 583 470929 mips_m4k.c:1088 mips_m4k_write_memory(): address: 0xb8060008, size: 0x00000004, count: 0x00000001
Debug: 586 471932 mips32_pracc.c:94 wait_for_pracc_rw(): DEBUGMODULE: No memory access in progress!
Debug: 587 471934 command.c:627 run_command(): Command 'mww' failed with error code -107
User : 588 471937 command.c:692 command_run_line():

#Then there is this one

load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
No working area available
Falling back to non-bulk write

Debug: 591 473048 mips32_pracc.c:94 wait_for_pracc_rw(): DEBUGMODULE: No memory access in progress!
Debug: 594 474051 mips32_pracc.c:94 wait_for_pracc_rw(): DEBUGMODULE: No memory access in progress!
Debug: 595 474053 mips_m4k.c:1029 mips_m4k_read_memory(): address: 0xff300000, size: 0x00000004, count: 0x00000001
Debug: 598 475056 mips32_pracc.c:94 wait_for_pracc_rw(): DEBUGMODULE: No memory access in progress!
Debug: 599 475058 target.c:2412 target_read_u32(): address: 0xff300000 failed
Debug: 602 476061 mips32_pracc.c:94 wait_for_pracc_rw(): DEBUGMODULE: No memory access in progress!
Error: 603 476063 mips32.c:717 mips32_read_config_regs(): isa info not available, failed to read cp0 config register: 0
Debug: 604 476075 mips_m4k.c:123 mips_m4k_debug_entry(): entered debug state at PC 0x0, target->state: halted
Debug: 605 476077 target.c:1646 target_call_event_callbacks(): target event 0 (gdb-halt) for core ar9344.cpu
Debug: 606 476080 target.c:1646 target_call_event_callbacks(): target event 1 (halted) for core ar9344.cpu
User : 607 476081 mips32.c:298 mips32_arch_state(): target halted in MIPS32 mode due to debug-request, pc: 0x00000000
Debug: 608 476103 command.c:146 script_debug(): command - load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
Debug: 610 476109 configuration.c:97 find_file(): found openwrt-ar71xx-nand-mr18-initramfs-kernel.bin
Debug: 611 476112 configuration.c:97 find_file(): found openwrt-ar71xx-nand-mr18-initramfs-kernel.bin
Debug: 612 476163 target.c:2199 target_write_buffer(): writing buffer of 6353004 byte at 0x8005fc00
Debug: 613 476165 mips_m4k.c:1088 mips_m4k_write_memory(): address: 0x8005fc00, size: 0x00000004, count: 0x00183c1b
Debug: 614 476168 mips_m4k.c:1215 mips_m4k_bulk_write_memory(): address: 0x8005fc00, count: 0x00183c1b
Debug: 615 476170 target.c:1894 target_alloc_working_area_try(): allocated new working area of 128 bytes at address 0x81000000
Debug: 616 476171 mips_m4k.c:1029 mips_m4k_read_memory(): address: 0x81000000, size: 0x00000004, count: 0x00000020
Debug: 619 477172 mips32_pracc.c:94 wait_for_pracc_rw(): DEBUGMODULE: No memory access in progress!
Error: 620 477174 mips_m4k.c:1230 mips_m4k_bulk_write_memory(): No working area available
Warn : 621 477180 mips_m4k.c:1099 mips_m4k_write_memory(): Falling back to non-bulk write
Debug: 624 478288 mips32_pracc.c:94 wait_for_pracc_rw(): DEBUGMODULE: No memory access in progress!
Debug: 625 478299 command.c:627 run_command(): Command 'load_image' failed with error code -107
User : 626 478301 command.c:692 command_run_line():
6

What version of firmware on your Meraki?

7

I think the chances of older firmware than this are becoming vanishingly small

[ 1.628000] Bootsh: trying rootfs path: /dev/mtdblock/rootfs-25-201804051805-G885d6d78-dhow-rel-1

8

I use RP4 for flashing this version FW. And I'm using config for RPI3, config for RPI4 not work in my way.

9

Maybe I should try to get the UART on the Pi going, the GND may be important, it gets mentioned in raspberrypi-native.cfg even.

I'm on the default settings as they are set up for the Pi zero (apparently)

pi@zero01:~$ cat raspberrypi-native.cfg | egrep "^[ab]"   
adapter driver bcm2835gpio
bcm2835gpio_peripheral_base 0x20000000
bcm2835gpio_speed_coeffs 113714 28
bcm2835gpio_jtag_nums 11 25 10 9
bcm2835gpio_swd_nums 11 25
bcm2835gpio_trst_num 7
10

I went back to the Pi Zero and got the UART going.

No change though, this seems to be the end of the road for me unless someone has something else to try:

> init ; halt ; load_image openwrt-ar71xx-nand-mr18-initramfs-kernel.bin 0x8005FC00
No working area available
Falling back to non-bulk write
11

Is it possible that my problems are related to the newer Pi Zeros being 1Ghz and the process seems to have been written for the 700Mhz older versions?

12

I've given up, I even got the code on one to run enough to dd flash it but then got an ecc error when I tried to upgrade to the latest firmware.

If anyone is in the UK and wants to send Hermes etc to collect them then they can have 2 x MR18s for the cost of shipping only.

13

I've got one here with the same firmware

If the mr18s are still available or you want to try this please let me know