MikroTik Hex S (RB760iGS) can't boot via TFTP

Hi,

I have been trying to netboot OpenWrt 23.05 on a MikroTik Hex S for some days now.

I think I've set up everything correctly, but evidently there is something I am missing.
After pressing & keeping the reset button and plugging the power, in Wireshark I see a BOOTP request, then a BOOTP reply on my side, then the router's bootloader requests the openwrt-initramfs image and my PC sends it.

At this point OpenWRT should be up in RAM and reachable on LAN ports 2-5 on 192.168.1.1.

However, what I observe is that after a short delay the routerboard beeps twice and reboots to RouterOS.

What am I missing? I've tried to upgrade & downgrade to various versions. I've then returned to the factory version that came with my device. I've also tried both the default bootloader (== push the reset button after plugging in the power cord) and the backup one (== push the reset button before plugging in the power cord).

What am I missing?

Thanks!

Routerborad:

       routerboard: yes
        board-name: hEX S
             model: RB760iGS
          revision: r2
     serial-number: HEN08KCMYM3
     firmware-type: mt7621L
  factory-firmware: 6.48.6
  current-firmware: 6.48.6
  upgrade-firmware: 6.48.6

Fedora Linux 38:

#!/usr/bin/env bash
#
# Modified form https://openwrt.org/toh/mikrotik/common#run_a_dhcpbootptftp_netboot_server on 2023-08-08

# source: https://stackoverflow.com/questions/59895/how-do-i-get-the-directory-where-a-bash-script-is-located-from-within-the-script#246128
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )

IFNAME=eno1 # change as necessary

sudo systemctl stop NetworkManager # beware: you'll probably lose Internet access here

# Fedora 38-specific - START (necessary, but BEWARE of what you are doing)
sudo systemctl stop firewalld.service
sudo setenforce 0
# Fedora 38-specific. You might not want to do it

sudo ip addr replace 192.168.1.10/24 dev "${IFNAME}"
sudo ip link set dev "${IFNAME}" up

sudo dnsmasq \
        --no-daemon \
        --listen-address 192.168.1.10 \
        --interface "${IFNAME}" \
        --bind-interfaces \
        -p0 \
        --dhcp-authoritative \
        --dhcp-range=192.168.1.100,192.168.1.200 \
        --bootp-dynamic \
        --dhcp-boot=openwrt-23.05.0-initramfs.bin \
        --log-dhcp \
        --log-queries \
        --log-debug \
        --enable-tftp \
        --tftp-root "${SCRIPT_DIR}"

Fedora-specific: in order to work, I had to disable firewalld and SElinux. I did not try if just one of them was sufficient.

In the previous script, I've symlinked the OpenWRT image to a shorter name (just in case):

ln -s openwrt-23.05.0-ramips-mt7621-mikrotik_routerboard-760igs-initramfs-kernel.bin openwrt-23.05.0-initramfs.bin

Guess we are up against the bootloader memory limits for the self-extracting kernel. See https://github.com/openwrt/openwrt/issues/13255
Saw a report that the image for 23.05.0-rc3 did boot, with an entry point address of 0x80b81000, so should be possible to netboot that rc3 image, and install the stable sysupgrade from there.

Thank you, @johnth! That was the problem, indeed!

I've tried the previous procedure using the rc3 image and I was able to netboot! I then proceeded to flash the non-rc OpenWRT 23.05 image.

Just for information, there are the entry points of rc2, rc3 ant the release image of OpenWRT 25.03. Only the rc3 is usable for netbooting:

$ readelf -h openwrt-23.05.0-rc2-ramips-mt7621-mikrotik_routerboard-760igs-initramfs-kernel.bin | grep Entry
  Entry point address:               0x80b91000   <-- BAD
$ readelf -h openwrt-23.05.0-rc3-ramips-mt7621-mikrotik_routerboard-760igs-initramfs-kernel.bin | grep Entry
  Entry point address:               0x80b81000   <-- GOOD
$ readelf -h openwrt-23.05.0-ramips-mt7621-mikrotik_routerboard-760igs-initramfs-kernel.bin | grep Entry
  Entry point address:               0x80b91000   <-- BAD

I tried to request access to the wiki some time ago in order to keep https://openwrt.org/toh/mikrotik/rb760igs updated, but I did not get it. Leaving the information here in the meantime.

Thanks again!