@bool2 Thanks for promising to help us out! I’m now at the same stage as @chepo, where my device no longer boots after recreating the squashfs and uploading.
I started looking at the bootloader code in an online copy of the development kit and saw there is some checking of checksums there which would stop the boot process. But it looks like if there is a problem with that root filesystem, I should have seen an error message on the console. But if you have already worked out how the filesystem should look, I’d be really grateful for you to share that. Thank you!
These are the steps I followed:
Prepare the root image
dd if=spiflash.bin of=rootfs.bin bs=1 \
skip=$((0x000000200000)) count=$((0x000000400000-0x000000200000))`
unsquashfs rootfs.bin
- Edit /etc/passwd, removing the link and replacing with a new password that I know:
mkpasswd -m descrypt NewPassword
mksquashfs squashfs-root newroot.squashfs -noappend -always-use-fragments -all-root -comp xz
Upload the image
On the serial console, set the IP address you wish to use on your network, and disable auto flashing the tftp image (this only works if you transfer an image starting with a new linux kernel)
<Realtek> ipconfig 192.168.10.10
Target Address=192.168.10.10
<RealTek>autoburn 0
AutoBurning=0
Then start the TFTP transfer in binary mode. I needed to use this command:
$ tftp 172.28.1.6 -m binary -c put newroot.squashfs
On the console I observed:
**TFTP Client Upload, File Name: newroot.squashfs
**TFTP Client Upload File Size = 000E1000 Bytes at 80500000
I then needed to write the transferred image to flash memory:
<RealTek>FLW 200000 80500000 000E1000
Write 0x000e1000 Bytes to SPI flash#1, offset 0x00200000<0xbd200000>, from RAM 0x80500000 to 0x805e1000
(Y)es, (N)o->y
<RealTek>
Boot from within the bootloader prompt
At this point, the device does not boot any more and remains in the bootloader.
I found a way to manually boot the device from here by looking at where the boot image is expected to be placed in memory and the code is executed:
FLR 80500000 20000 001E0000
J 80c00000
@chepo you can try the above commands on your box.
Entering the above commands results in the kernel booting:
<RealTek>FLR 80500000 20000 001E0000
Flash read from 00020000 to 80500000 with 001E0000 bytes ?
(Y)es , (N)o ? --> y
<RealTek>J 80c00000
---Jump to address=80C00000
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x80003780
Linux version 3.10.90 (dingsl@dingsl-pc) (gcc version 4.6.4 (Realtek RSDK-4.6.4 Build 2080) ) #27 Mon Oct 12 20:33:38 CST 2020
From there, I was able to follow the rest of the instructions, disable tuya, install the serial gateway and connect Homeassistant. However, the box still ends up in the bootloader when power cycled.
