I’ve mentioned earlier that (if you have a serial cable connected) you can interrupt u-boot’s startup and tell it to TFTP-boot your own kernel (allows you to write your own passwd and shadow files, for example).<\/p>\n
Here, I’ll document how to build your own openwrt-based kernel (with embedded “initramfs” root filesystem).<\/p>\n
NOTE: If you don’t want to bother building your own kernel, I’ve uploaded a pre-built binary image here<\/a>.<\/p>\n First, download the openwrt source code (I’m assuming you are using Linux):<\/p>\n Next, you need to edit the file “target\/linux\/ar71xx\/generic\/config-default”. \u00a0It should contain the following:<\/p>\n The “CONFIG_CMDLINE=” is important (in order to get serial console access, and to boot from the initramfs instead of the image in the Circle’s flash). \u00a0The remaining items are required to enable access to the eMMC flash (a USB mass storage device).<\/p>\n Then, you need to configure the build for the correct chipset\/target. \u00a0Use the command “make menuconfig” to build\/run the configuration utility.<\/p>\n Under “Target System”, choose “Atheros AR7xxx\/AR9xxx”, and under “Subtarget”, choose “Generic” (these should be the defaults).<\/p>\n Under “Target Profile”, scroll down and select the\u00a0“TP-LINK TL-WR841N\/ND” profile.<\/p>\n Under “Target Images”, select “ramdisk” (should default to “lzma” compression) and de-select “squashfs”.<\/p>\n Save your configuration.<\/p>\n Then, type “make” (or “make -j12” for faster parallel build) and wait (it’ll take a while).<\/p>\n When you are finished, there will be a lot of images in the “bin\/ar71xx” subdirectory. \u00a0Copy the file named “openwrt-ar71xx-generic-vmlinux-initramfs.bin” to your TFTP server’s root directory (call it “tftp-kernel.bin”):<\/p>\n I am assuming that you know how to configure a TFTP server on your machine, and that it is all setup. \u00a0My TFTP server’s IP address is 172.16.0.1, so I am using that subnet in my example below.<\/p>\n Connect to your Circle device using the serial port (minicom, for example). \u00a0It defaults to 115,200bps 8\/n\/1. \u00a0Connect an ethernet cable from your Circle device to the TFTP server.<\/p>\n Power-ON the Circle. \u00a0Be prepared to interrupt the u-boot startup on your serial console (by pressing a key when u-boot says “Hit any key to stop autobooting”):<\/p>\n As I said, my TFTP server is at 172.16.0.1. \u00a0I’ll set “serverip” to that, and set the Circle’s IP address (“ipaddr”) to 172.16.0.5:<\/p>\n Now, load the kernel using the “tftpboot” command:<\/p>\n Now, start the kernel with the “go” command (start address is 0x0400 bytes after the load address used for the “tftpboot” command):<\/p>\n Press ENTER to get to the Linux prompt:<\/p>\n I’ve mentioned earlier that (if you have a serial cable connected) you can interrupt u-boot’s startup and tell it to TFTP-boot your own kernel (allows you to write your own passwd and shadow files, for example). Here, I’ll document how to build your own openwrt-based kernel (with embedded “initramfs” root filesystem). NOTE: If you don’t … Continue reading “Building your own TFTP-bootable kernel”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"http:\/\/www.hackspot.net\/CircleBlog\/wp-json\/wp\/v2\/posts\/79"}],"collection":[{"href":"http:\/\/www.hackspot.net\/CircleBlog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.hackspot.net\/CircleBlog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.hackspot.net\/CircleBlog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.hackspot.net\/CircleBlog\/wp-json\/wp\/v2\/comments?post=79"}],"version-history":[{"count":10,"href":"http:\/\/www.hackspot.net\/CircleBlog\/wp-json\/wp\/v2\/posts\/79\/revisions"}],"predecessor-version":[{"id":103,"href":"http:\/\/www.hackspot.net\/CircleBlog\/wp-json\/wp\/v2\/posts\/79\/revisions\/103"}],"wp:attachment":[{"href":"http:\/\/www.hackspot.net\/CircleBlog\/wp-json\/wp\/v2\/media?parent=79"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.hackspot.net\/CircleBlog\/wp-json\/wp\/v2\/categories?post=79"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.hackspot.net\/CircleBlog\/wp-json\/wp\/v2\/tags?post=79"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Configure\/build the kernel<\/h5>\n
git clone git:\/\/git.openwrt.org\/15.05\/openwrt.git openwrt\r\ncd openwrt<\/pre>\n
CONFIG_CMDLINE=\"console=ttyS0,115200 loglevel=7 root=\/dev\/ram0 rootfstype=ramfs board=TL-MR3420-v2\"\r\nCONFIG_SCSI=y\r\nCONFIG_BLK_DEV_SD=y\r\nCONFIG_USB=y\r\nCONFIG_USB_COMMON=y\r\nCONFIG_USB_EHCI_ATH79=y\r\nCONFIG_USB_EHCI_HCD=y\r\nCONFIG_USB_EHCI_HCD_PLATFORM=y\r\nCONFIG_USB_EHCI_PCI=y\r\nCONFIG_USB_SUPPORT=y\r\nCONFIG_USB_STORAGE=y\r\nCONFIG_EXT4_FS=y<\/pre>\n
make menuconfig<\/pre>\n
cp bin\/ar71xx\/openwrt-ar71xx-generic-vmlinux-initramfs.bin \/var\/lib\/tftpboot\/tftp-kernel.bin<\/pre>\n
TFTP-booting your new kernel image<\/h5>\n
********************************************* \r\n* U-Boot 1.1.4 (Sep 26 2015, 08:47:34) * \r\n********************************************* \r\n \r\nAP123 (AR9341) U-Boot for TL-MR3420 v2 \r\n \r\nDRAM: 64 MB DDR 32-bit \r\nFLASH: Macronix MX25L64 (8 MB) \r\nCLOCKS: 535\/400\/200\/25 MHz (CPU\/RAM\/AHB\/SPI)\r\n\r\nLED on during eth initialization...\r\n\r\nHit any key to stop autobooting: 0\r\n\r\nuboot><\/pre>\n
uboot> setenv serverip 172.16.0.1<\/strong>\r\nuboot> setenv ipaddr 172.16.0.5<\/strong><\/pre>\n
uboot> tftpboot 0x80060000 tftp-kernel.bin<\/strong>\r\nLink down: eth0\r\nEthernet mode (duplex\/speed): 1\/1000 Mbps\r\nTFTP from IP: 172.16.0.1\r\n Our IP: 172.16.0.5\r\n Filename: 'tftp-kernel.bin'\r\nLoad address: 0x80060000\r\n Using: eth1\r\n\r\nLoading: ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ########################################\r\n ###################\r\n\r\nTFTP transfer complete!\r\n\r\nBytes transferred: 5212820 (0x4f8a94)\r\n\r\nuboot><\/pre>\n
uboot> go 0x80060400<\/strong>\r\n## Starting application at 0x80060400...\r\n[ 0.000000] Linux version 3.18.29 (paulbart@localhost.localdomain) (gcc version 4.8.3 (OpenWrt\/Linaro GCC 4.8-2014.04 r49294) ) #2 Tue May 3 21:59:28 EDT 2016\r\n[ 0.000000] bootconsole [early0] enabled\r\n[ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)\r\n[ 0.000000] SoC: Atheros AR9341 rev 3\r\n[ 0.000000] Determined physical RAM map:\r\n[ 0.000000] memory: 04000000 @ 00000000 (usable)\r\n[ 0.000000] Initrd not found or empty - disabling initrd\r\n[ 0.000000] Zone ranges:\r\n[ 0.000000] Normal [mem 0x00000000-0x03ffffff]\r\n[ 0.000000] Movable zone start for each node\r\n[ 0.000000] Early memory node ranges\r\n[ 0.000000] node 0: [mem 0x00000000-0x03ffffff]\r\n[ 0.000000] Initmem setup node 0 [mem 0x00000000-0x03ffffff]\r\n[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.\r\n[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes\r\n[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256\r\n[ 0.000000] Kernel command line: 0x80060400 console=ttyS0,115200 loglevel=7 root=\/dev\/ram0 rootfstype=ramfs board=TL-MR3420-v2\r\n[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)\r\n[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)\r\n[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)\r\n[ 0.000000] Writing ErrCtl register=00000000\r\n[ 0.000000] Readback ErrCtl register=00000000\r\n[ 0.000000] Memory: 58576K\/65536K available (3008K kernel code, 146K rwdata, 636K rodata, 1960K init, 191K bss, 6960K reserved)\r\n[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1\r\n[ 0.000000] NR_IRQS:51\r\n[ 0.000000] Clocks: CPU:535.000MHz, DDR:400.000MHz, AHB:200.000MHz, Ref:25.000MHz\r\n[ 0.000000] Calibrating delay loop... 266.64 BogoMIPS (lpj=1333248)\r\n[ 0.080000] pid_max: default: 32768 minimum: 301\r\n[ 0.080000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)\r\n[ 0.090000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)\r\n[ 0.100000] NET: Registered protocol family 16\r\n[ 0.100000] MIPS: machine is TP-LINK TL-MR3420 v2\r\n[ 0.570000] SCSI subsystem initialized\r\n[ 0.570000] usbcore: registered new interface driver usbfs\r\n[ 0.580000] usbcore: registered new interface driver hub\r\n[ 0.580000] usbcore: registered new device driver usb\r\n[ 0.590000] Switched to clocksource MIPS\r\n[ 0.590000] NET: Registered protocol family 2\r\n[ 0.600000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)\r\n[ 0.600000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)\r\n[ 0.610000] TCP: Hash tables configured (established 1024 bind 1024)\r\n[ 0.620000] TCP: reno registered\r\n[ 0.620000] UDP hash table entries: 256 (order: 0, 4096 bytes)\r\n[ 0.630000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)\r\n[ 0.640000] NET: Registered protocol family 1\r\n[ 3.010000] futex hash table entries: 256 (order: -1, 3072 bytes)\r\n[ 3.020000] squashfs: version 4.0 (2009\/01\/31) Phillip Lougher\r\n[ 3.030000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.\r\n[ 3.040000] msgmni has been set to 114\r\n[ 3.060000] io scheduler noop registered\r\n[ 3.060000] io scheduler deadline registered (default)\r\n[ 3.070000] Serial: 8250\/16550 driver, 1 ports, IRQ sharing disabled\r\n[ 3.080000] console [ttyS0] disabled\r\n\u00b7 3.100000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A\r\n[ 3.110000] console [ttyS0] enabled\r\n[ 3.110000] console [ttyS0] enabled\r\n[ 3.120000] bootconsole [early0] disabled\r\n[ 3.120000] bootconsole [early0] disabled\r\n[ 3.130000] m25p80 spi0.0: found mx25l6405d, expected m25p80\r\n[ 3.130000] m25p80 spi0.0: mx25l6405d (8192 Kbytes)\r\n[ 3.140000] 5 tp-link partitions found on MTD device spi0.0\r\n[ 3.150000] Creating 5 MTD partitions on \"spi0.0\":\r\n[ 3.150000] 0x000000000000-0x000000020000 : \"u-boot\"\r\n[ 3.160000] 0x000000020000-0x00000012e5fc : \"kernel\"\r\n[ 3.160000] 0x00000012e5fc-0x0000007f0000 : \"rootfs\"\r\n[ 3.170000] mtd: device 2 (rootfs) set to be root filesystem\r\n[ 3.170000] 1 squashfs-split partitions found on MTD device rootfs\r\n[ 3.180000] 0x0000004d0000-0x0000007f0000 : \"rootfs_data\"\r\n[ 3.190000] 0x0000007f0000-0x000000800000 : \"art\"\r\n[ 3.190000] 0x000000020000-0x0000007f0000 : \"firmware\"\r\n[ 3.220000] libphy: ag71xx_mdio: probed\r\n[ 3.820000] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:00 [uid=004dd042, driver=Generic PHY]\r\n[ 3.830000] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII\r\n[ 4.420000] ag71xx-mdio.1: Found an AR934X built-in switch\r\n[ 4.460000] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII\r\n[ 4.470000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver\r\n[ 4.470000] ehci-pci: EHCI PCI platform driver\r\n[ 4.480000] ehci-platform: EHCI generic platform driver\r\n[ 4.480000] ehci-platform ehci-platform: EHCI Host Controller\r\n[ 4.490000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1\r\n[ 4.500000] ehci-platform ehci-platform: TX-TX IDP fix enabled\r\n[ 4.500000] ehci-platform ehci-platform: irq 3, io mem 0x1b000000\r\n[ 4.530000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00\r\n[ 4.530000] hub 1-0:1.0: USB hub found\r\n[ 4.540000] hub 1-0:1.0: 1 port detected\r\n[ 4.540000] usbcore: registered new interface driver usb-storage\r\n[ 4.550000] TCP: cubic registered\r\n[ 4.550000] NET: Registered protocol family 17\r\n[ 4.560000] bridge: automatic filtering via arp\/ip\/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.\r\n[ 4.570000] 8021q: 802.1Q VLAN Support v1.8\r\n[ 4.590000] Freeing unused kernel memory: 1960K (80416000 - 80600000)\r\n[ 4.610000] init: Console is alive\r\n[ 4.620000] init: - watchdog -\r\n[ 4.860000] usb 1-1: new high-speed USB device number 2 using ehci-platform\r\n[ 5.010000] usb-storage 1-1:1.0: USB Mass Storage device detected\r\n[ 5.020000] scsi host0: usb-storage 1-1:1.0\r\n[ 5.620000] init: - preinit -\r\n[ 5.920000] random: procd urandom read with 9 bits of entropy available\r\nPress the [f] key and hit [enter] to enter failsafe mode\r\nPress the [1], [2], [3] or [4] key and hit [enter] to select the debug level\r\n[ 6.020000] scsi 0:0:0:0: Direct-Access Generic STORAGE DEVICE 0250 PQ: 0 ANSI: 0\r\n[ 6.160000] sd 0:0:0:0: [sda] 15269888 512-byte logical blocks: (7.81 GB\/7.28 GiB)\r\n[ 6.160000] sd 0:0:0:0: [sda] Write Protect is off\r\n[ 6.170000] sd 0:0:0:0: [sda] No Caching mode page found\r\n[ 6.180000] sd 0:0:0:0: [sda] Assuming drive cache: write through\r\n[ 6.190000] sda: sda1 sda2 sda3\r\n[ 6.200000] sd 0:0:0:0: [sda] Attached SCSI removable disk\r\n[ 9.090000] procd: - early -\r\n[ 9.090000] procd: - watchdog -\r\n[ 9.680000] procd: - ubus -\r\n[ 10.690000] procd: - init -\r\nPlease press Enter to activate this console.<\/strong>\r\n[ 11.390000] NET: Registered protocol family 10\r\n[ 11.400000] ip6_tables: (C) 2000-2006 Netfilter Core Team\r\n[ 11.420000] Loading modules backported from Linux version v4.4-rc5-1913-gc8fdf68\r\n[ 11.430000] Backport generated by backports.git backports-20151218-0-g2f58d9d\r\n[ 11.440000] ip_tables: (C) 2000-2006 Netfilter Core Team\r\n[ 11.450000] nf_conntrack version 0.5.0 (945 buckets, 3780 max)\r\n[ 11.500000] xt_time: kernel timezone is -0000\r\n[ 11.580000] PPP generic driver version 2.4.2\r\n[ 11.590000] NET: Registered protocol family 24\r\n[ 11.670000] ieee80211 phy0: Atheros AR9340 Rev:3 mem=0xb8100000, irq=47\r\n[ 19.720000] device eth1 entered promiscuous mode\r\n[ 19.740000] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready\r\n[ 19.780000] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready\r\n[ 21.820000] eth0: link up (100Mbps\/Full duplex)\r\n[ 21.820000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready\r\n<\/pre>\n
BusyBox v1.23.2 (2016-05-03 21:54:25 EDT) built-in shell (ash)\r\n\r\n _______ ________ __\r\n | |.-----.-----.-----.| | | |.----.| |_\r\n | - || _ | -__| || | | || _|| _|\r\n |_______|| __|_____|__|__||________||__| |____|\r\n |__| W I R E L E S S F R E E D O M\r\n -----------------------------------------------------\r\n CHAOS CALMER (Chaos Calmer, r49294)\r\n -----------------------------------------------------\r\n * 1 1\/2 oz Gin Shake with a glassful\r\n * 1\/4 oz Triple Sec of broken ice and pour\r\n * 3\/4 oz Lime Juice unstrained into a goblet.\r\n * 1 1\/2 oz Orange Juice\r\n * 1 tsp. Grenadine Syrup\r\n -----------------------------------------------------\r\nroot@OpenWrt:\/#<\/pre>\n","protected":false},"excerpt":{"rendered":"