Entering the U-Boot prompt

When the board powers on, U-Boot waits for a short time for default boot sequence. The exact key sequence depends on the vendor:

• Press Enter on some boards.
• Type tpl on others.
• Any key may also work.

A typical countdown message appears:

Enter magic string to stop autoboot in 1 seconds

Successful entry drops you into the shell:

4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Feb  1 2023 - 10:23:39)
MT7621 #

Boot flow variables

bootcmd contains the default boot sequence. Inspect it with printenv:

MT7621 # printenv
bootargs=console=ttyS1,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/etc/preinit mtdparts=raspi:256k(uboot),3200k(uImage),12864k@0x360000(rootfs),64k@0xff0000(ART)
bootcmd=tftp
bootdelay=0x1
baudrate=115200
ethaddr="00:AA:BB:CC:DD:EE"
ipaddr=192.168.0.1
serverip=192.168.0.5
stdin=serial
stdout=serial
stderr=serial

Environment size: 323/4092 bytes

Re-defining the boot sequence for UBI-based firmware

setenv setup_ubi 'set mtdids nand0=nand0; set mtdparts mtdparts=nand0:0x7680000@0x900000(fs); ubi part fs'
setenv load_kernel 'ubi read 0x84000000 kernel && bootm'
setenv bootargs 'ubi.mtd=ubi root=/dev/ubiblock0_1 rootfstype=squashfs,ubi'
setenv boot_chain 'run setup_ubi; run load_kernel'
setenv bootcmd 'run boot_chain'
saveenv

Execution order:

1. bootcmd invokes boot_chain.
2. boot_chain runs setup_ubi then load_kernel.
3. setup_ubi declares the NAND partition fs starting at 0x900000 with length 0x7680000.
4. load_kernel copies the volume named kernel to RAM address 0x84000000 and launches it with bootm.
5. Kernel recieves bootargs locating root on ubiblock0_1.

Example volume layout inside the UBI image:

[kernel]
mode=ubi
vol_id=0
vol_type=dynamic
vol_name=kernel
image=zImage.itb

[rootfs]
mode=ubi
vol_id=1
vol_type=dynamic
vol_name=rootfs
image=root.squashfs
vol_size=5437440

[rootfs_data]
mode=ubi
vol_id=2
vol_type=dynamic
vol_name=rootfs_data
vol_size=10MiB
vol_flags=autoresize

Flashing firmware images

NAND flash (QCA4019)

nand erase 0x00900000 0x7700000
setenv serverip 192.168.0.15 && setenv ipaddr 192.168.0.71 && tftpboot root.ubi
nand write 0x84000000 0x00900000 0x008c0000
reset

NOR flash (QCA4019)

setenv serverip 192.168.0.88 && setenv ipaddr 192.168.0.77
tftpboot 0x84000000 flash.bin
sf probe && sf erase 0x0 +0x2000000 && sf write 0x84000000 0x0 0x2000000

NOR flash (MT7621)

setenv ipaddr 192.168.0.33 && setenv serverip 192.168.0.88
tftp 0x80800000 flash.bin
erase 0x9f000000 +0xffffff
cp.b 0x80800000 0x9f000000 0xff0000
reset

Determining erase/write offsets

Inside a running system, inspect /proc/mtd:

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00f60000 00010000 "firmware"
mtd2: 002b6ab7 00010000 "kernel"
mtd3: 00ca9549 00010000 "rootfs"
mtd4: 00680000 00010000 "rootfs_data"
mtd5: 00010000 00010000 "config"
mtd6: 00040000 00010000 "tplink"
mtd7: 00010000 00010000 "radio"

One-shot flashing with immediate boot

Enstead of writing the image to flash, load it directly into RAM and boot:

setenv serverip 192.168.0.22 && setenv ipaddr 192.168.0.71 && tftpboot u.itb && bootm

This avoids wear on flash and is useful for testing new builds.