Problems when flashing Omeda AP11D

RolandoMagico · February 23, 2023, 1:03pm

Hi,
can you give me some advice how to flash AP11D? I followed the instructions on this page but it results in this message when executing run ramboot_openwrt:

eth0 up: 1 Gb/s full duplex
Using eth0 device
TFTP from server 192.168.1.75; our IP address is 192.168.1.105
Filename 'ipq40xx.ari'.
Load address: 0x84000000
Loading: #################################################################
         ##########################################
         564.5 KiB/s
done
Bytes transferred = 6784992 (6787e0 hex)
Invalid image format version: 0x6787e0

I am also not able to revert to stock image, this is the boot log:


APBoot 2.6.2.9 (build 81770)
Built: 2021-10-05 at 22:07:12

Model: AP11D
DRAM:  512 MiB
Flash: Detected W25Q32FV_SPI: total 4 MiB
NAND:  Detected MX35LFxGE4AB: total 128 MiB
Power: DC
Volume aos1 not found!
Creating dynamic volume aos1 of size 30982144
Net:   eth0
Radio: ipq4029#0, ipq4029#1
Reset: warm
FIPS:  passed

Hit <Enter> to stop autoboot:  0
Checking image @ 0x0
Copying image from 0x84000000

Image is signed; verifying checksum... passed
SHA2 Signature available
Signer Cert OK
Policy Cert OK
RSA signature verified using SHA2.
   Uncompressing Kernel Image ... OK
[    0.000000]
[    0.000000] Instant On
[    0.000000] ArubaOS Version 1.4.1.0 (build 74478 / label #74478)
[    0.000000] Built by p4build@pr-hpn-build01 on 2020-02-27 at 23:01:18 AST (gcc version 5.3.0)
[    0.000000]
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.016241] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.052503] i2c-gpio driver registered
[    2.536405] Bad eraseblock 33 at 0x000000420000
[    4.513756] 3 ofpart partitions found on MTD device spi0.1
[    4.566956] Creating 3 MTD partitions on "spi0.1":
[    4.624231] 0x000000000000-0x000002000000 : "aos0"
[    4.683217] 0x000002000000-0x000004000000 : "aos1"
[    4.740374] 0x000004000000-0x000008000000 : "ubifs"
[    4.802474] m25p80 spi0.0: found w25q32, expected n25q128a11
[    4.896166] Found AT97SC3203 on i2c_1.8
[    4.940772] Key type dns_resolver registered
[    4.980646] Registering SWP/SWPB emulation handler
[    5.440079] There is no gpio reset info
[    5.507804]
Starting Kernel SHA1 KAT ...
[    5.542279] Completed Kernel SHA1 KAT
[    5.589294] Starting Kernel HMAC-SHA1 KAT ...
[    5.639375] Starting Kernel DES KAT ...[    5.685017] Completed Kernel DES KAT
[    5.728816] Starting Kernel AES KAT ...
[    5.772512] Completed Kernel AES KAT
[    5.772512]
[    5.836120] Starting Kernel AESGCM KAT ...
[    5.882858] Completed Kernel AESGCM KAT
[    5.932631] Completed Kernel HMAC-SHA1 KAT
Thu Jan  1 00:00:00 PST 1970
ls: ubi?: No such file or directory[    6.106881] UBIFS error (pid 1140): ubifs_mount: cannot open "/dev/ubifs", error -22

mount: Mounting /dev/ubifs on /aruba/fs failed: Invalid argument
Mounting ubifs failed
apfcutil: apfc_read failed: Cache uninitialized
Will reboot to mount ubifs
killall: nanny: no process killed
killall: sapd: no process killed
cd: 23: can't cd to /tmp/apfc
apfcutil: read failed: Is a directory
killall: wdg: no process killed
SIOCSIFADDR: No such device

frollic · February 23, 2023, 1:32pm

try Issues with installing OpenWrt on Aruba AP11D - #2 by Feighery

RolandoMagico · February 23, 2023, 1:36pm

But according to this site, the AP303H is the same as the AP11D:

The Aruba Instant On AP11D is a much cheaper version of this device and is based on the same platform, the OpenWrt firmware for Aruba AP-303H can also be flashed onto the Aruba Instant On AP11D.

frollic · February 23, 2023, 1:37pm

that's why I changed my post

RolandoMagico · February 23, 2023, 1:40pm

too fast for me
I saw the post you linked. I also checked the command line and I already put everything in one line. I think the linked post only is if you copy/past from the git commit message. Copy/paste from https://openwrt.org/toh/aruba/ap-303h shoudn't be affected.

frollic · February 23, 2023, 1:47pm

stop the auto boot, and post the printenv.

RolandoMagico · February 23, 2023, 1:49pm

Output of printenv:

autoload=n
autostart=yes
baudrate=9600
boardname=Aberlour
bootargs=console=ttyMSM0,9600n8
bootargs_openwrt=setenv bootargs console=ttyMSM0,9600n8
bootcmd=run nandboot_openwrt
bootdelay=2
bootfile=ipq40xx.ari
ethact=eth0
ethaddr=xx:xx:xx:xx:xx:xx
fdt_high=0x87000000
fileaddr=84000000
filesize=5d4698
ipaddr=192.168.1.105
machid=8010001
mtddevname=aos0
mtddevnum=0
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x2000000@0x0(aos0),0x2000000@0x2000000(aos1),0x4000000@0x4000000(ubifs)
nandboot_openwrt=run bootargs_openwrt; ubi part aos1; ubi read 0x85000000 kernel; set fdt_high 0x87000000; bootm 0x85000000
partition=nand0,0
ramboot_openwrt=run bootargs_openwrt; setenv ipaddr 192.168.1.105; setenv serverip 192.168.1.75; netget; set fdt_high 0x87000000; bootm
serverip=192.168.1.75
servername=aruba-master
stderr=serial
stdin=serial
stdout=serial

RolandoMagico · February 23, 2023, 1:58pm

did factory_reset in uboot:

Clearing state...
Checking OS image and flags

Image is signed; verifying checksum... passed
Preserving image partition 0
Erasing UBIFS ...done

Purging environment...
Erasing SPI flash...Writing to SPI flash...done

Now it's booting to the OEM firmware again, good to know that there is a recovery possibilty.

RolandoMagico · February 24, 2023, 2:24pm

Looks like uBoot is checking byte 4-7 in the image after loading the image and expects a specific version. Not yet sure which value must be written there and if a specific file header is required to get it working

RolandoMagico · February 24, 2023, 2:26pm

Output of mtd in uBoot, don't know if there is a difference to other devices:

device nand0 <nand0>, # parts = 3
 #: name                size            offset          mask_flags
 0: aos0                0x02000000      0x00000000      0
 1: aos1                0x02000000      0x02000000      0
 2: ubifs               0x04000000      0x04000000      0

active partition: nand0,0 - (aos0) 0x02000000 @ 0x00000000

defaults:
mtdids  : nand0=nand0
mtdparts: none

frollic · February 24, 2023, 2:34pm

try starting from an older release

https://downloads.openwrt.org/releases/21.02.0/targets/ipq40xx/generic/

RolandoMagico · February 24, 2023, 2:45pm

Same here, bytes 4-7 are read from the image and interpreted as image version:

Invalid image format version: 0x5d4698

RolandoMagico · February 25, 2023, 2:49pm

Update: Seems like there must be 512? bytes header at the beginning of the image and image format 0x00 0x00 0x00 0x02 seems to be accepted.

RolandoMagico · February 25, 2023, 3:18pm

When trying around with different header conent, I now got the message "Invalid Instant Small Business image" during download. I also see certificates at the end of other images I found, maybe an indication for signed images?
Looks similar to this topic. In this case, the bootloader has to be replaced

RolandoMagico · March 1, 2023, 4:38pm

Same problem with latest AP11 (without D) also with APBoot 2.6.2.9 (build 81770)

RolandoMagico · March 8, 2023, 6:35pm

Is there any chance to replace the stock bootloader with another one which allows me to run OpenWrt on the devices? Maybe somebody has experience with this topic.

RolandoMagico · March 11, 2023, 12:29pm

I did a dump of the NOR flash. Edit: Update post, seems there was an issue when reading out the date the first time:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
19472         0x4C10          Ubiquiti partition header, header size: 56 bytes, name: "PARTNUM_SHFT", base address: 0x08A16B46, data size: -1912995176 bytes
80268         0x1398C         Unix path: /dev/icbcfg/boot
263424        0x40500         ATAGs msm parition table (msmptbl), version: 4, number of paritions: 15
393216        0x60000         ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
614007        0x95E77         XML document, version: "1.0"
983040        0xF0000         ELF, 32-bit LSB shared object, ARM, version 1 (SYSV)
1215984       0x128DF0        SHA256 hash constants, little endian
1221385       0x12A309        Certificate in DER format (x509 v3), header length: 4, sequence length: 1284
1221501       0x12A37D        Certificate in DER format (x509 v3), header length: 4, sequence length: 1288
1276728       0x137B38        SHA256 hash constants, little endian
1292828       0x13BA1C        CRC32 polynomial table, little endian
1293852       0x13BE1C        CRC32 polynomial table, little endian
1365425       0x14D5B1        Certificate in DER format (x509 v3), header length: 4, sequence length: 1300
1401036       0x1560CC        Unix path: /usr/lib/ld.so.1
2032176       0x1F0230        gzip compressed data, maximum compression, from Unix, last modified: 2022-08-23 22:48:06```

RolandoMagico · March 12, 2023, 7:08pm

Conclusion: OpenWrt is currently not running out of the box on AP11 and AP11D with the new bootloader. The bootloader must be downgraded as described here

system · March 22, 2023, 7:09pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.