Sysupgrade is failing for Siemens WS-AP3610: Kernel loader cannot find OpenWrt image

Hi, I am trying to install OpenWrt to a Siemens WS-AP3610. I am following the guide posted in this forum post, which is just the guide from the git commit extended by an additional command to automatically boot the available OpenWrt image after a reboot.

This is the guide I am following, copied for reference from the forum post:

Installation:

Download the OpenWrt initramfs-image.
Place it into a TFTP server root directory and rename it to 1401A8C0.img
Configure the TFTP server to listen at 192.168.1.66/24.

Connect the TFTP server to the access point.

Connect to the serial console of the access point. Speed: 115200!
Attach power and interrupt the boot procedure when prompted.

Configure U-Boot for booting OpenWrt from ram and flash:
$ setenv boot_openwrt 'setenv bootargs; bootm 0xbf080000'
$ setenv ramboot_openwrt 'setenv serverip 192.168.1.66; tftpboot; bootm'
$ setenv bootcmd 'run boot_openwrt'
$ saveenv

Load OpenWrt into memory:
$ run ramboot_openwrt

Transfer the OpenWrt sysupgrade image to the device.
Write the image to flash using sysupgrade:
$ sysupgrade -n /tmp/openwrt-sysupgrade.bin

I am able to follow this guide without problems -- I can load the initramfs image over TFTP and am then able to copy over the squashfs image by SCP with no issues. But after doing a sysupgrade, the AP cannot boot OpenWrt, as the Kernel loader is not able to find the OpenWrt image.

To give you a complete picture, first here is the log of the (successful) ramboot over TFTP:

U-Boot 1.2.0.07-dirty (Aug 22 2016 - 15:44:00)

Primary Image

DRAM:  128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
Net:   eth0
Hit any key to stop autoboot:  0
Boot-> setenv boot_openwrt 'setenv bootargs; bootm 0xbf080000'
Boot-> setenv ramboot_openwrt 'setenv serverip 192.168.1.66; tftpboot; bootm'
Boot-> setenv bootcmd 'run boot_openwrt'
Boot-> saveenv
Saving Environment to Flash...
Un-Protected 1 sectors
Un-Protected 1 sectors
Erasing Flash...Erasing Flash - 0xe80000 - 0xebffff
Erasing Sector: 0xe80000
Erased 1 sectors
Writing to Flash... done
Protected 1 sectors
Protected 1 sectors
Boot-> run ramboot_openwrt
*** Warning: no boot file name; using '1401A8C0.img'
Using eth0 device
TFTP from server 192.168.1.66; our IP address is 192.168.1.20
Filename '1401A8C0.img'.
Load address: 0x80100000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
T #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###################################################
done
Bytes transferred = 14570613 (de5475 hex)
## Booting image at 80100000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.117
   Created:      2021-05-11   0:05:38 UTC
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    14570549 Bytes = 13.9 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
OK

Starting kernel ...

[    0.000000] Linux version 5.4.117 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16708-e7249669d2)) #0 Tue May 11 00:05:38 2021
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is Siemens WS-AP3610
[    0.000000] SoC: Atheros AR7161 rev 2
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=0000c002
[    0.000000] Readback ErrCtl register=0000c002
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 114252K/131072K available (5242K kernel code, 192K rwdata, 1192K rodata, 8660K init, 205K bss, 16820K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] random: get_random_bytes called from start_kernel+0x358/0x54c with crng_init=0
[    0.000000] CPU clock: 680.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5621354254 ns
[    0.000008] sched_clock: 32 bits at 340MHz, resolution 2ns, wraps every 6316128254ns
[    0.007807] Calibrating delay loop... 452.19 BogoMIPS (lpj=2260992)
[    0.074063] pid_max: default: 32768 minimum: 301
[    0.078831] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.086125] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.097738] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.107604] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.114485] pinctrl core: initialized pinctrl subsystem
[    0.121975] NET: Registered protocol family 16
[    0.432569] PCI host bridge /ahb/apb/pcie-controller@17010000 ranges:
[    0.439024]  MEM 0x0000000010000000..0x0000000016ffffff
[    0.444246]   IO 0x0000000000000000..0x0000000000000000
[    0.466327] PCI host bridge to bus 0000:00
[    0.470434] pci_bus 0000:00: root bus resource [mem 0x10000000-0x16ffffff]
[    0.477351] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.482912] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.489690] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.498043] pci 0000:00:11.0: [168c:0027] type 00 class 0x028000
[    0.504077] pci 0000:00:11.0: reg 0x10: [mem 0x00000000-0x0000ffff]
[    0.510384] pci 0000:00:11.0: PME# supported from D0 D3hot
[    0.516087] pci 0000:00:12.0: [168c:0027] type 00 class 0x028000
[    0.522104] pci 0000:00:12.0: reg 0x10: [mem 0x00000000-0x0000ffff]
[    0.528433] pci 0000:00:12.0: PME# supported from D0 D3hot
[    0.534399] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    0.541050] pci 0000:00:11.0: BAR 0: assigned [mem 0x10000000-0x1000ffff]
[    0.547835] pci 0000:00:12.0: BAR 0: assigned [mem 0x10010000-0x1001ffff]
[    0.554708] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    0.568054] clocksource: Switched to clocksource MIPS
[    0.574106] NET: Registered protocol family 2
[    0.579364] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.587730] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.595431] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.602489] TCP: Hash tables configured (established 1024 bind 1024)
[    0.608982] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.615507] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.622758] NET: Registered protocol family 1
[    0.627157] PCI: CLS 0 bytes, default 32
[    0.751837] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.764442] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.770319] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.791850] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.801776] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.810189] printk: console [ttyS0] disabled
[    0.814513] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 10, base_baud = 10625000) is a 16550A
[    0.823349] printk: console [ttyS0] enabled
[    0.823349] printk: console [ttyS0] enabled
[    0.831698] printk: bootconsole [early0] disabled
[    0.831698] printk: bootconsole [early0] disabled
[    0.849353] spi-nor spi0.0: m25p128 (16384 Kbytes)
[    0.854193] 9 fixed-partitions partitions found on MTD device spi0.0
[    0.860586] Creating 9 MTD partitions on "spi0.0":
[    0.865368] 0x000000000000-0x000000040000 : "u-boot"
[    0.871191] 0x000000040000-0x000000080000 : "u-boot-bak"
[    0.877286] 0x000000080000-0x000000e80000 : "firmware"
[    0.886309] 2 uimage-fw partitions found on MTD device firmware
[    0.892276] Creating 2 MTD partitions on "firmware":
[    0.897233] 0x000000000000-0x000000240000 : "kernel"
[    0.903017] 0x000000240000-0x000000e00000 : "rootfs"
[    0.908803] mtd: device 4 (rootfs) set to be root filesystem
[    0.916111] 1 squashfs-split partitions found on MTD device rootfs
[    0.922348] 0x000000500000-0x000000e00000 : "rootfs_data"
[    0.928654] 0x000000e80000-0x000000ec0000 : "cfg1"
[    0.934255] 0x000000ec0000-0x000000f00000 : "cfg2"
[    0.939924] 0x000000f00000-0x000000f40000 : "nvram1"
[    0.945670] 0x000000f40000-0x000000f80000 : "nvram2"
[    0.951504] 0x000000f80000-0x000000fc0000 : "rsvd1"
[    0.957202] 0x000000fc0000-0x000001000000 : "rsvd2"
[    0.964468] libphy: Fixed MDIO Bus: probed
[    0.971355] ag71xx 19000000.eth: invalid MAC address, using random address
[    1.319869] libphy: ag71xx_mdio: probed
[    1.375666] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=0143bca2, driver=Broadcom BCM5481]
[    1.385575] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii-id
[    1.392322] i2c /dev entries driver
[    1.397969] NET: Registered protocol family 10
[    1.407311] Segment Routing with IPv6
[    1.411139] NET: Registered protocol family 17
[    1.415624] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.428574] 8021q: 802.1Q VLAN Support v1.8
[    1.433783] hctosys: unable to open rtc device (rtc0)
[    1.465148] Freeing unused kernel memory: 8660K
[    1.469701] This architecture does not have kernel memory protection.
[    1.476117] Run /init as init process
[    1.801971] init: Console is alive
[    1.805581] init: - watchdog -
[    1.826954] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.836214] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.854297] init: - preinit -
[    2.528094] random: fast init done
[    2.544840] random: jshn: uninitialized urandom read (4 bytes read)
[    2.666183] random: jshn: uninitialized urandom read (4 bytes read)
[    2.701374] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.998617] eth0: link up (1000Mbps/Full duplex)
[    7.003261] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    7.013174] eth0: link down
[    7.026505] procd: - early -
[    7.030210] procd: - watchdog -
[    7.618177] procd: - watchdog -
[    7.621677] procd: - ubus -
[    7.632455] urandom_read: 5 callbacks suppressed
[    7.632463] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.675105] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.684541] procd: - init -
Please press Enter to activate this console.
[    8.233272] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.282782] Loading modules backported from Linux version v5.10.34-0-g0aa66717f684
[    8.290400] Backport generated by backports.git v5.10.34-1-0-g7b5533e1
[    8.343805] xt_time: kernel timezone is -0000
[    8.460497] PPP generic driver version 2.4.2
[    8.478861] NET: Registered protocol family 24
[    8.558710] ath9k 0000:00:11.0: enabling device (0000 -> 0002)
[   10.121130] ath: phy0: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff
[   10.128271] ath: phy0: random mac address will be used: 76:db:f9:f1:71:b8
[   10.155713] ieee80211 phy0: Atheros AR9160 MAC/BB Rev:1 AR5133 RF Rev:b0 mem=0xb0000000, irq=15
[   10.164639] ath9k 0000:00:12.0: enabling device (0000 -> 0002)
[   11.727173] ath: phy1: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff
[   11.734318] ath: phy1: random mac address will be used: 96:d2:b7:2f:ae:f4
[   11.755465] ieee80211 phy1: Atheros AR9160 MAC/BB Rev:1 AR2133 RF Rev:b0 mem=0xb0010000, irq=16
[   11.903753] urngd: v1.0.2 started.
[   12.302664] random: crng init done
[   14.869780] kmodloader: done loading kernel modules from /etc/modules.d/*
[   47.010860] eth0: link up (1000Mbps/Full duplex)
[   47.016229] br-lan: port 1(eth0) entered blocking state
[   47.021527] br-lan: port 1(eth0) entered disabled state
[   47.027039] device eth0 entered promiscuous mode
[   47.050132] br-lan: port 1(eth0) entered blocking state
[   47.055356] br-lan: port 1(eth0) entered forwarding state
[   48.038149] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready



BusyBox v1.33.0 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r16708-e7249669d2
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

Afterwards, this is the log of the (failed!) sysupgrade, that I want to perform using the sqashfs image that I copied over using SCP:

BusyBox v1.33.0 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r16708-e7249669d2
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# ^C
root@OpenWrt:/# sysupgrade -n /tmp/openwrt-ath79-generic-siemens_ws-ap3610-squas
hfs-sysupgrade\(2\).bin
Tue May 11 00:11:42 UTC 2021 upgrade: Commencing upgrade. Closing all shell sessions.
Watchdog handover: fd=3
- watchdog -
killall: telnetd: no process killed
Tue May 11 00:11:42 UTC 2021 upgrade: Sending TERM to remaining processes ... logd hostapd wpa_supplicant netifd odhcpd ntpd dnsmasq ubusd urngd
Tue May 11 00:11:45 UTC 2021 upgrade: Sending KILL to remaining processes ...
[  376.542592] sh (2164): drop_caches: 3
Tue May 11 00:11:46 UTC 2021 upgrade: Switching to ramdisk...
Tue May 11 00:11:48 UTC 2021 upgrade: Performing system upgrade...
[  378.608946] sh (2164): drop_caches: 3
Unlocking firmware ...

Writing from <stdin> to firmware ...
Tue May 11 00:13:11 UTC 2021 upgrade: Upgrade completed
Tue May 11 00:13:12 UTC 2021 upgrade: Rebooting system...
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
[  462.160999] reboot: Restarting system
▒

U-Boot 1.2.0.07-dirty (Aug 22 2016 - 15:44:00)

Primary Image

DRAM:  128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
Net:   eth0
Hit any key to stop autoboot:  0
## Booting image at bf080000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.117
   Created:      2021-05-11   0:05:38 UTC
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    2182927 Bytes =  2.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
OK

Starting kernel ...



OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Looking for OpenWrt image... not found!

System halted!

After rebooting again, these are the results of the printenv, bdinfo, coninfo, flinfo, iminfo and imls commands:

U-Boot 1.2.0.07-dirty (Aug 22 2016 - 15:44:00)

Primary Image

DRAM:  128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
Net:   eth0
Hit any key to stop autoboot:  0
Boot-> printenv
bootargs=console=ttyS0,115200n81 mtdparts=ar7100-nor0:256K(BootBAK)ro,256K(BootPRI),14336K(FS),256K(CFG1),256K(CFG2),256K(NVRAM1),256K(NVRAM2),256K(RSVD1),256K(RSVD2) BOOT_KERNEL=primary BOOT_BOOTROM=unknown mem=130560K panic=30 ro
baudrate=115200
gatewayip=192.168.1.1
netmask=255.255.255.0
PB44_CONFIG1_ADDR=0xBFE80000
PB44_CONFIG1_SIZE=0x40000
PB44_CONFIG2_ADDR=0xBFEC0000
PB44_CONFIG2_SIZE=0x40000
WATCHDOG_LIMIT=3
BOOT_KERNEL=primary
BOOT_BOOTROM=unknown
SERVICEATTRS=ac_manager,ru_manager
VERSIONBASE=0
REGION=NA
mtdparts=mtdparts=ar7100-nor0:256K(BootBAK)ro,256K(BootPRI),14336K(FS),256K(CFG1),256K(CFG2),256K(NVRAM1),256K(NVRAM2),256K(RSVD1),256K(RSVD2)
static_bootargs=console=ttyS0,115200n81 mem=130560K panic=30 ro
boot_flash=order="img2 bak2"; for script in ${order}; do if fsload 0x80400000 boot_kernel.${script}; then if imi 0x80400000; then autoscr 0x80400000; exit; fi; fi; done; echo ERROR: Problem with boot script, dropping to interactive shell
ethact=eth0
DEFAULT_SETTING=0
CURR_VER=U-Boot 1.2.0.05 (Mar 26 2008 - 16:44:22)
MODEL=AP3610-1
SERIAL#=0500009243050757
ethaddr=00:1F:45:5A:5F:DF
RADIOADDR0=00:1F:45:5A:7F:00
RADIOADDR1=00:1F:45:5A:7F:08
HW_RELEASE=5
MB81_CTL_VER=2
MB82_CTL_VER=3
SERVICETYPE=siemens
AC_HOSTNAME=Controller
APSK=02C7BD6ED1B2791CFCE191B39B29A247396B42A2F18B03B4DD13470205B73E54D7
bootdelay=1
filesize=ba3
LOAD_SENSOR_IMG=0
MOSTRECENTKERNEL=0
WATCHDOG_COUNT=0
serverip=192.168.1.66
ipaddr=192.168.1.20
boot_openwrt=setenv bootargs; bootm 0xbf080000
ramboot_openwrt=setenv serverip 192.168.1.66; tftpboot; bootm
bootcmd=run boot_openwrt
stdin=serial
stdout=serial
stderr=serial
mem=130560k
ver=U-Boot 1.2.0.07-dirty (Aug 22 2016 - 15:44:00)

Environment size: 1685/4091 bytes
Boot-> bdinfo
boot_params = 0x87D2EFB0
memstart    = 0x80000000
memsize     = 0x08000000
flashstart  = 0xBF000000
flashsize   = 0x01000000
flashoffset = 0x00000000
ethaddr     = 00:1F:45:5A:5F:DF
ip_addr     = 192.168.1.20
baudrate    = 115200 bps
Boot-> coninfo
List of available devices:
serial   80000003 SIO stdin stdout stderr
Boot-> flinfo

Bank # 1: STM STM25P128 (128 Mbit, uniform sector size)
  Size: 16384 KB in 64 Sectors
  Sector Start Addresses:
    BF000000      BF040000      BF080000      BF0C0000      BF100000
    BF140000      BF180000      BF1C0000      BF200000      BF240000
    BF280000      BF2C0000      BF300000      BF340000      BF380000
    BF3C0000      BF400000      BF440000      BF480000      BF4C0000
    BF500000      BF540000      BF580000      BF5C0000      BF600000
    BF640000      BF680000      BF6C0000      BF700000      BF740000
    BF780000      BF7C0000      BF800000      BF840000      BF880000
    BF8C0000      BF900000      BF940000      BF980000      BF9C0000
    BFA00000      BFA40000      BFA80000      BFAC0000      BFB00000
    BFB40000      BFB80000      BFBC0000      BFC00000      BFC40000
    BFC80000      BFCC0000      BFD00000      BFD40000      BFD80000
    BFDC0000      BFE00000      BFE40000      BFE80000      BFEC0000
    BFF00000      BFF40000 E    BFF80000 E    BFFC0000 E
Boot-> iminfo

## Checking Image at 80100000 ...
   Bad Magic Number
Boot-> imls
Image at BF080000:
   Image Name:   MIPS OpenWrt Linux-5.4.117
   Created:      2021-05-11   0:05:38 UTC
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    2182927 Bytes =  2.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
Boot->

In a forum post for another device, a user suggests executing the command sysupgrade -v --test before doing the sysupgrade, to check the image for errors. Doing so does not result in any output.

Another user in the same post suggests stopping all user services/processes and flashing the image directly to the firmware using mtd -r write /tmp/[image] firmware. I have tried this, but it leads to the same result -- the OpenWrt image cannot be found by the Kernel loader.

Do you have any idea what could be the solution to my issue?

Thank you very much in advance!

Copy to "tmp" and rename file to "openwrt-sysupgrade.bin" or "sysupgrade.bin", then use command:
sysupgrade -n /tmp/openwrt-sysupgrade.bin
or
sysupgrade -n /tmp/sysupgrade.bin

Hi Yakov,

thanks for your reply! I did try out your suggestion and renamed the file, but sadly it still gives me the same error...

Here is my log:


BusyBox v1.33.0 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r16709-4e385a27d6
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# sysuprade -n /tmp/sys
sysinfo/        sysupgrade.bin
root@OpenWrt:/# sysuprade -n /tmp/sysupgrade.bin
/bin/ash: sysuprade: not found
root@OpenWrt:/# sysupgrade -n /tmp/sysupgrade.bin
Wed May 12 08:16:14 UTC 2021 upgrade: Commencing upgrade. Closing all shell sessions.
Watchdog handover: fd=3
- watchdog -
killall: telnetd: no process killed
Wed May 12 08:16:15 UTC 2021 upgrade: Sending TERM to remaining processes ... logd dnsmasq hostapd wpa_supplicant netifd odhcpd ntpd ubusd urngd
Wed May 12 08:16:18 UTC 2021 upgrade: Sending KILL to remaining processes ...
[  195.284985] sh (2151): drop_caches: 3
Wed May 12 08:16:19 UTC 2021 upgrade: Switching to ramdisk...
Wed May 12 08:16:21 UTC 2021 upgrade: Performing system upgrade...
[  197.358646] sh (2151): drop_caches: 3
Unlocking firmware ...

Writing from <stdin> to firmware ...
Wed May 12 08:17:23 UTC 2021 upgrade: Upgrade completed
Wed May 12 08:17:24 UTC 2021 upgrade: Rebooting system...
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
[  260.138284] reboot: Restarting system
▒

U-Boot 1.2.0.07 (Oct  9 2009 - 13:09:54)

Primary Image

DRAM:  128 MB
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
Net:   eth0
Hit any key to stop autoboot:  0
## Booting image at bf080000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.117
   Created:      2021-05-12   8:13:12 UTC
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    2182972 Bytes =  2.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
OK

Starting kernel ...



OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Looking for OpenWrt image... not found!

System halted!

Do you have another idea?

Halt boot firmware and show your printenv

@mpratt14 - please look at this!

I believe this is a bug introduced by commit 1b8bd17c2d07 ("ath79: lzma-loader: allow setting custom kernel magic"). The OKLI loader can now be built with support for different kernel magics. The problem is that the build daemons only will build one of them, and apply it to all images.... Which doesn't work out well.

Comparing a hexdump of the initial part of a snapshot with a 21.02-rc1 image clearly shows the problem:

@@ -1,7 +1,7 @@
-00000000  27 05 19 56 a6 bc b8 f0  60 9c 03 03 00 21 4e f3  |'..V....`....!N.|
-00000010  80 06 00 00 80 06 00 00  f5 27 5b 44 05 05 02 00  |.........'[D....|
+00000000  27 05 19 56 79 ac ac 8d  60 7c 04 c1 00 1f 26 ba  |'..Vy...`|....&.|
+00000010  80 06 00 00 80 06 00 00  89 1d 9b 9b 05 05 02 00  |................|
 00000020  4d 49 50 53 20 4f 70 65  6e 57 72 74 20 4c 69 6e  |MIPS OpenWrt Lin|
-00000030  75 78 2d 35 2e 34 2e 31  31 37 00 00 00 00 00 00  |ux-5.4.117......|
+00000030  75 78 2d 35 2e 34 2e 31  31 31 00 00 00 00 00 00  |ux-5.4.111......|
 00000040  40 80 90 00 40 80 98 00  40 80 68 00 40 08 60 00  |@...@...@.h.@.`.|
 00000050  3c 09 10 00 35 29 00 1f  01 09 40 25 39 08 00 1f  |<...5)....@%9...|
 00000060  40 88 60 00 00 00 00 c0  40 08 80 00 24 09 ff f8  |@.`.....@...$...|
@@ -159,7 +159,7 @@
 000009e0  26 31 08 fc af b6 00 60  af b5 00 5c af b4 00 58  |&1.....`...\...X|
 000009f0  02 00 f8 09 af b3 00 54  3c 04 81 80 02 00 f8 09  |.......T<.......|
 00000a00  24 84 15 cc 3c 04 81 80  02 00 f8 09 24 84 16 04  |$...<.......$...|
-00000a10  02 20 f8 09 26 44 20 00  3c 03 73 71 24 63 4f 4b  |. ..&D .<.sq$cOK|
+00000a10  02 20 f8 09 26 44 20 00  3c 03 4f 4b 24 63 4c 49  |. ..&D .<.OK$cLI|
 00000a20  14 43 02 de 3c 04 81 80  3c 04 81 80 36 45 20 00  |.C..<...<...6E .|
 00000a30  24 84 16 bc 02 00 f8 09  3c 13 81 80 26 44 20 0c  |$.......<...&D .|
 00000a40  02 20 f8 09 3c 14 81 80  26 44 20 10 02 20 f8 09  |. ..<...&D .. ..|
@@ -370,31 +370,31 @@
 00001710  6e 6f 74 20 66 6f 75 6e  64 21 0a 00 00 00 00 00  |not found!......|
 00001720  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 *
-00002000  4f 4b 4c 49 fd 88 d0 69  60 9c 03 03 00 21 2e f3  |OKLI...i`....!..|
-00002010  80 06 00 00 80 06 00 00  f0 74 1d 38 05 05 02 03  |.........t.8....|
+00002000  4f 4b 4c 49 8a ab 70 ef  60 7c 04 c1 00 1f 06 ba  |OKLI..p.`|......|
+00002010  80 06 00 00 80 06 00 00  86 61 a0 d5 05 05 02 03  |.........a......|

So you see that the kernel images both start with the expected "OKLI" magic (0x4f4b4c49) at 0x2000. The headers are of course different, due to different versions and checksums. But the diff inside the loader at 0xa10 is unexpected. If shows that the snapshot loader is looking for the 0x73714f4b magic used by senao devices. Which obviously fails.

This is one of those diffcult build bugs, which will not show up if you build your own images. It only affects the build daemons which build images for multiple devices. Somehow the loader build rules need to make sure that it builds a new copy every time the magic changes.

3 Likes

Try this image for istall.
https://drive.google.com/drive/folders/1pJVrNCnXuFEJRgjoYo3lslRMEEAWDG3I?usp=sharing

1 Like

Yeah sorry about this.....a very sneaky and frustrating regression...

It is caused by the related makefile variables not being cleared / set to null between device builds.

see discussion here

this commit fixes it

now we are just waiting for enough people to test the first commit, the original purpose of the PR, which they are reluctant to merge too soon.

@bmork very good investigative work by the way :+1:

2 Likes

now fixed in master, sorry again for the trouble
also note that 21.02 branch never had this problem by the way

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commitdiff;h=bf8c16dfa2cddd529f889510ca5fa5160606c325

2 Likes

Thank you Yakov, I was able to successfully flash my device with your firmware!

1 Like

Thank you very much @mpratt14 and also @bmork for your quick identification of the problem, and then solving it in no time!

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.