U-Boot

U-Boot is the most popular open-source bootloader, supporting almost all router architectures.

U-Boot (Das U-Boot) is an open-source embedded bootloader developed by DENX.

Official Website: https://www.denx.de/wiki/U-Boot/

Main Features:

1. Fully open source
2. Supports multiple CPU architectures (MIPS/ARM/PowerPC/x86)
3. Rich boot commands
4. Supports network boot (TFTP/NFS)
5. Powerful environment variable system
6. Can load from Flash, network, or serial

1. Common in MediaTek MT7620/MT7621
2. Some TP-Link, Xiaomi, Huawei models
3. Typical address: 0x9f000000 (Flash)

1. Broadcom BCM47xx/BCM53xx series
2. Qualcomm IPQ series
3. Some Xiaomi/Netgear/ASUS models

1. Software routers
2. Intel/AMD platforms

U-Boot 1.1.4 (Dec  6 2021 - 11:13:09)
CPU: MediaTek MT7621AT
RAM: 256MB DDR3
Flash: W25Q128JV

1. Reads environment variable bootcmd
2. Executes boot command
3. Loads kernel from Flash/network
4. Passes parameters to kernel

Press any key during boot to enter command line:

Hit any key to stop autoboot:  0

# View all environment variables
printenv

# View specific variable
printenv ipaddr
printenv bootcmd

# Set variable
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.100

# Save to Flash
saveenv

# Restore defaults
env default -a
saveenv

# Read Flash info
sf probe

# Read memory
md.l 0x81000000 10    # Read 10 32-bit words
md.b 0x81000000 100  # Read 100 bytes

# Write memory
mw.l 0x81000000 0x12345678 1

# Set environment variables
setenv ipaddr 192.168.1.1        # Router IP
setenv serverip 192.168.1.100   # TFTP server IP

# Load firmware from TFTP to memory
tftpboot 0x81000000 openwrt.bin
# Or shorthand
tftp 0x81000000 openwrt.bin

# Boot firmware
bootm 0x81000000

# Erase Flash partition
# Syntax: erase <start> +<length>
erase 0x9f020000 +0x300000

# Copy data
# Syntax: cp.b <src> <dst> <length>
cp.b 0x81000000 0x9f020000 0x300000

# Write from memory to Flash
sf write 0x81000000 0x9f020000 0x300000

# Boot directly from specified address
bootm 0x9f020000

# Boot from network
bootp 0x81000000 firmware.bin
bootm 0x81000000

# Boot from SD card (some devices)
load mmc 0:1 0x81000000 uImage
bootm 0x81000000

# Reset
reset

# Print version
version

# Help
help

# List devices
printenv bootdev

Defines auto boot command:

bootcmd=bootm 0x9f020000
# Or network boot
bootcmd=tftp 0x81000000 openwrt.bin; bootm 0x81000000

Parameters passed to the kernel:

bootargs=console=ttyS0,115200 root=/dev/mtdblock2 rootfstype=squashfs mtdparts=spi0.0:256k(u-boot),64k(u-boot-env),3000k(kernel),-(rootfs)

Flash partition definition:

mtdparts=spi0.0:256k(u-boot),64k(config),3000k(kernel),-(rootfs)

Using TFTPD64:

1. Set TFTP root directory
2. Confirm firewall allows it
3. Ensure wired connection is used

sudo apt install tftpd-hpa
sudo systemctl start tftpd-hpa
# Put firmware in /srv/tftp/

sudo launchctl load -w /System/Library/LaunchDaemons/tftp.plist
# Put firmware in /private/tftpboot/

# Restore defaults
setenv bootcmd bootm 0x9f020000
saveenv
reset

1. Confirm computer and router IP are on the same subnet
2. Check firewall
3. Confirm TFTP server is running
4. Use ping to test connectivity

1. Confirm address is correct
2. Flash may be corrupted
3. Try erasing before writing

1. Environment variables are stored in a specific Flash partition
2. Use saveenv to save
3. Recovery method: setenv default and saveenv

1. Breed
2. CFE
3. TFTP Recovery
4. TTL Serial Unbrick