/proc/mtd gives sizes, so the location of the kernel is by adding incrementally...
0x04 + 0x01 + 0x05 + 0x18 = 0x22
this corresponds to the address given to the loader
so we are indeed on the same image and flash platform as ENS202EXT and similar
1 Like
sorry I should explain, its actually the location of the rootfs because the location that used to be the kernel will become the location of the kernel loader
OK that's what I needed to know. To be clear, I've flashed a few devices in the past, understand the uboot prompt, and am compiling my own kernel and packages already. Your expertise with the Senao devices is of course helpful.
I have no intention of flashing random kernels and rootfsesto my device, but even if I did, I could unbrick, given that I have serial console access and can reach the uboot prompt. Worst case I use the rescue image again or even reflash the copy I have of the mtd partitions.
Guys I fried another USB/TTL adapter. I tilted my laptop a little when it was plugged in and now I can't transmit. Ebay garbage. Does anyone know a good vendor of something a little more durable? Waveshare products look interesting
In the meantime I succeeded in compiling a kernel for this device. I don't quite understand how preinit works yet, it's like a tiny chainloader? Thanks
I recommend this one
Although I have never bought it before, it has benefits:
- it has the same FT232R chip that my adapter uses, one of the best
- it has a case around the board
- it has jumpers to select between 3v and 5v, and test loopback
- seller has been selling this one for many years
1 Like
the kernel has become too large for the old bootloaders to properly decompress, because of how it was written. in order to get it to boot, we have a separate program called the lzma-loader placed where the bootloader expects the kernel to be which then loads the kernel afterward.
got it, so CONFIG_PREINITOPT=y should compile the correct kernel?
Is the preinit lumped into the kernel gz or do I need to TFTP that in seperately?
Thanks for the FTDI adapter link. I found some solid looking products at Waveshare:
there's no specific reason to touch this config option. I recommend not changing anything in build configuration...
there is much less work to do than you think... just get a build to finish, TFTP the initramfs.bin, see if everything works, and we go from there...
I don't care which brand of boards you get, but I recommend the FTDI chipsets regardless... many boards from many sellers have them.
Got it, thanks. Really want to continue work on the project so I will try again to get the TTL adapters working. Shipping from China is so slow.
OK thanks for sticking with me, I've got uboot console access again. tftp won't work until I plug and unplug the network cable after halting boot process. I'm able to transfer a kernel in using tftp now. I've tried loading it to several different addresses with commands like
tftpboot 0x9f0a0000 kernel.bin
and then
bootm 0x9f0a0000
but it just loads the old kernel, perhaps this is a failsafe or I'm using the wrong address? Not really sure what addresses to use and what files I want to tftp in, I thought I load the kernel to the lower address and the rootfs to the higher one? I should be able to figure it out from the environment variables but I'm not doing well just guessing stuff. Thanks for any help
Found some updated firmware for this device and flashed it:
https://www.engeniustech.com/wp_firmware/enh220ext-fcc-v2.0.216.0.bin
tftp 0x84000000 kernel.bin
can load a kernel now, not sure what address to load the rootfs to?
you ought to reread everything I said since 15 posts ago
command is tftpboot
RAM starts at 0x80 (automatically)
image used is initramfs-kernel.bin (but you likely renamed it)
image requested automatically is related to the model name
there is no rootfs.bin, they are combined
I've read the thread, didn't realize the initramfs-kernel.bin contains rootfs. It boots OK into the same failsafe mode as the kernel I tftped in (tftpboot command does nothing different than tftp btw). I seem to have no network interfaces but I guess that makes sense given I had no rootfs when I booted. I guess I need to pivot or chroot to load drivers and kernel modules?
firstboot command fails with "MTD partition 'rootfs_data' not found"
Not sure if my initramfs is missing modules or I'm doing something wrong. I don't see too much documentation on this process but maybe I'm not looking in the right place.
ath> tftp 0x84000000 initramfs-kernel.bin
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.1.101; our IP address is 192.168.1.1
Filename 'initramfs-kernel.bin'.
Load address: 0x84000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
################################
done
Bytes transferred = 5152911 (4ea08f hex)
ath> bootm 0x84000000
## Booting image at 00000000 ...
Bad Magic Number
ath> bootm 0x84000000
## Booting image at 84000000 ...
Image Name: MIPS OpenWrt Linux-5.15.167
Created: 2024-09-23 12:34:46 UTC
Image Type: MIPS Linux Kernel Image (uncompressed)
Data Size: 5152847 Bytes = 4.9 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum at 0x84000040 ...OK
OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728
Starting kernel ...
OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80060000...
[ 0.000000] Linux version 5.15.167 (mary@linux) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24106-10cc5fcd00) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Mon Sep 23 12:34:46 2024
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[ 0.000000] MIPS: machine is EnGenius ENH220EXT
[ 0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 109436K/131072K available (5683K kernel code, 588K rwdata, 1244K rodata, 12572K init, 206K bss, 21636K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] CPU clock: 720.000 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns
[ 0.000001] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns
[ 0.008347] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[ 0.075024] pid_max: default: 32768 minimum: 301
[ 0.080831] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.088621] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.102945] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.113460] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.120895] pinctrl core: initialized pinctrl subsystem
[ 0.127957] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.150446] clocksource: Switched to clocksource MIPS
[ 0.157130] NET: Registered PF_INET protocol family
[ 0.162582] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.170951] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.179969] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.188254] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.196420] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.203939] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.210837] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.217814] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.225612] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.231721] PCI: CLS 0 bytes, default 32
[ 0.310806] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 0.322560] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.328777] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.374767] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[ 0.382008] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.389460] printk: console [ttyS0] disabled
[ 0.394123] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[ 0.403338] printk: console [ttyS0] enabled
[ 0.403338] printk: console [ttyS0] enabled
[ 0.412240] printk: bootconsole [early0] disabled
[ 0.412240] printk: bootconsole [early0] disabled
[ 0.474812] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[ 0.480127] 8 fixed-partitions partitions found on MTD device spi0.0
[ 0.486653] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[ 0.493418] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[ 0.500739] Creating 8 MTD partitions on "spi0.0":
[ 0.505620] 0x000000000000-0x000000040000 : "u-boot"
[ 0.515244] 0x000000040000-0x000000050000 : "u-boot-env"
[ 0.521639] 0x000000050000-0x0000000a0000 : "custom"
[ 0.528951] 0x0000000a0000-0x0000000b0000 : "loader"
[ 0.535013] 0x0000000b0000-0x000000220000 : "fwconcat1"
[ 0.542637] 0x000000220000-0x000000d70000 : "fwconcat0"
[ 0.548882] 0x000000d70000-0x000000ff0000 : "failsafe"
[ 0.556474] 0x000000ff0000-0x000001000000 : "art"
[ 0.565720] Concatenating MTD devices:
[ 0.569538] (0): "fwconcat0"
[ 0.572498] (1): "fwconcat1"
[ 0.575414] into device "virtual_flash"
[ 0.579334] 1 fixed-partitions partitions found on MTD device virtual_flash
[ 0.586647] Creating 1 MTD partitions on "virtual_flash":
[ 0.592197] 0x000000000000-0x000000cc0000 : "firmware"
[ 1.002817] mdio_bus mdio.0: MDIO device at address 5 is missing.
[ 1.009094] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[ 1.016995] i2c_dev: i2c /dev entries driver
[ 1.023684] NET: Registered PF_INET6 protocol family
[ 1.035706] Segment Routing with IPv6
[ 1.039525] In-situ OAM (IOAM) with IPv6
[ 1.043657] NET: Registered PF_PACKET protocol family
[ 1.048853] 8021q: 802.1Q VLAN Support v1.8
[ 1.054097] ar724x-pci 180c0000.pcie-controller: PCIe link is down
[ 1.060628] PCI host bridge to bus 0000:00
[ 1.064796] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[ 1.071810] pci_bus 0000:00: root bus resource [io 0x0000]
[ 1.077465] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 1.086332] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[ 1.431541] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[ 1.771533] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[ 1.779525] clk: Disabling unused clocks
[ 1.827871] Freeing unused kernel image (initmem) memory: 12572K
[ 1.834007] This architecture does not have kernel memory protection.
[ 1.840556] Run /init as init process
[ 2.254066] init: Console is alive
[ 2.257979] init: - watchdog -
[ 2.279260] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 2.292436] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 2.310248] init: - preinit -
[ 2.350851] random: procd: uninitialized urandom read (4 bytes read)
[ 2.631608] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[ 2.661707] random: jshn: uninitialized urandom read (4 bytes read)
[ 2.813767] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
- failsafe button reset was pressed -
- failsafe -
Waiting for kernel randomness to be initialised...
[ 10.010462] random: crng init done
[ 10.013928] random: 5 urandom warning(s) missed due to ratelimiting
Generating 1024 bit rsa key, this may take a while...
when I compiled I got 5 binaries:
openwrt-ath79-generic-engenius_enh220ext-initramfs-kernel.bin
openwrt-ath79-generic-engenius_enh220ext.manifest
openwrt-ath79-generic-engenius_enh220ext-rootfs.tar.gz
openwrt-ath79-generic-engenius_enh220ext-squashfs-factory.bin
openwrt-ath79-generic-engenius_enh220ext-squashfs-sysupgrade.bin
I figured the "factory" image would be the first one to load but wasn't able to sysupgrade with it in the OEM firmware (makes sense). I also tried loading it in their failsafe mode. Both failed I believe due to checksum errors.
I tried flashing the kernel but of course it doesn't fit in their partition. Unbricking was easy with the failsafe mode they provide, then reverting to latest firmware. At least I feel comfortable with that
this is part of the process, unless you are very lucky
this is probably not true. If you lack a rootfs, almost nothing will happen, and the kernel will panic and restart the board.
although since the log is kind of short, there may be packages or modules missing
the next step is to go back to your dts and change the phy5 to phy0 or phy1, or so on until about 7 until the probe is good.
manifest is not a binary, its a list
rootfs is not supposed to be in the set of images...
since you have asked me about config options you shouldn't be touching, its possible that your configuration is messed up a little, but its likely harmless
it wouldn't hurt to do a rm .config and make menuconfig again, along with a make clean before your next build
you ought to do a make clean after any dts changes anyway...
factory will work eventually, but it is not safe to flash yet until the initramfs-kernel.bin is good
you won't get around the size limit, this is working backwards.
by the way, where did you even get 0x84 from? I have never loaded that far into the RAM
try the commands by themself with the automatic options, and if you have issues bump it up to 0x81
its a lot less work typing...
ath> tftpboot
...
ath> bootm
...Great to hear no drivers is normal, I'm making some progress here, slowly.
Would not surprise me at all
OK so I changed the references to phy5 but wasn't positive about the reg value. How does this look?
&mdio0 {
status = "okay";
phy0: ethernet-phy@0 {
reg = <0>;
eee-broken-100tx;
eee-broken-1000t;
};
};
ð0 {
status = "okay";
nvmem-cells = <&macaddr_art_0>;
nvmem-cell-names = "mac-address";
phy-handle = <&phy0>;