Engenius ENH-200

Introduction

The Engenius ENH-200 is an AR7240 based board with an AR9285 wifi chip and a panel antenna.

By default it runs OpenWRT-Kamikaze but with an Atheros LSDK 9.2 closed-source driver. Odd, but not too odd.

Preparing the unit

For now, the only way to flash FreeBSD-HEAD on this device is to directly manipulate things from uboot.

Luckily, the device isn't terribly complicated to disassemble. There's a four pin serial header on the board which provides 3.3v RS-232.

The 4 port serial header has an arrow silk-screened above one of the pins (closest to the wifi antenna connectors at the far edge of the board.) Take that as pin 1:

• Pin 1 - 3.3v (normally don't need to connect)
• Pin 2 - GND
• Pin 3 - TX
• Pin 4 - RX

Now, for the nasty details:

• The default flash layout includes a recovery image and some 320k space for "custom". Since FreeBSD is a bit bigger than an OpenWRT build, we sacrifice the whole flash (minus uboot and calibration data, of course.)
• This involves deleting a bunch of things from flash (and not uboot/calibration!) and resetting the boot command to point to the new image location

So..

• Build an image!

  cd /path/to/freebsd-head-src/

  /path/to/build enh200 buildworld buildkernel installworld installkernel mfsroot fsimage uboot

• Connect via serial (8n1, 115200) to the uboot console. You can break the boot process by hitting a key at the right time. It'll say when.

• Assign a useful IP address. Here my build server is on 192.168.169.2.

  ar7240> setenv ipaddr 192.168.169.3 ar7240> setenv serverip 192.168.169.2

• Erase the kernel space:

  ar7240> erase 0x9f050000 +0x1b0000

• Erase the filesystem space:

  ar7240> erase 0x9f200000 +0x5e0000

• TFTP the kernel image over, ensuring that the resulting filesize is less than 0x1b0000 bytes in length!

  ar7240> tftpboot 0x80050000 kernel.ENH200.lzma.uImage ar7240> cp.b 0x80050000 0x9f050000 $filesize

• TFTP the userland image over, ensuring the resulting filesize is less than 0x5e0000 bytes in length!

  ar7240> tftpboot 0x80050000 mfsroot-enh200.img.ulzma ar7240> cp.b 0x80050000 0x9f200000 $filesize

• Reset the boot argument to point to the new kernel location in flash:

  ar7240> setenv bootcmd 'bootm 0x9f050000' ar7240> saveenv

• Reboot!

  ar7240> reset

The unit should now boot FreeBSD-HEAD.

Uboot Log

U-Boot 1.1.4 (Jul 13 2012 - 20:55:07)

ENH200 (ar7240) U-boot
DRAM:  
sri
ar7240_ddr_initial_config(145): python ddr init
#### TAP VALUE 1 = 9, 2 = a
32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 238k for U-Boot at: 81fc4000
Reserving 192k for malloc() at: 81f94000
Reserving 44 Bytes for Board Info at: 81f93fd4
Reserving 36 Bytes for Global Data at: 81f93fb0
Reserving 128k for boot params() at: 81f73fb0
Stack Pointer at: 81f73f98
Now running in RAM - U-Boot at: 81fc4000
Flash Manuf Id 0x20, DeviceId0 0x20, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
Fetching MAC Address from 0x81fed584
Fetching MAC Address from 0x81fed584
: cfg1 0xf cfg2 0x7114
eth0: 00:02:6f:fa:81:13
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:02:6f:fa:81:13
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
eth_set_enetaddr(num=0, addr=00:02:6f:fa:81:13)
Setting new HW address on eth0
New Address is             00:02:6F:FA:81:13
eth_set_enetaddr(num=0, addr=00:02:6f:fa:81:13)
Setting new HW address on eth0
New Address is             00:02:6F:FA:81:13
eth_set_enetaddr(num=1, addr=00:02:6f:fa:81:13)
Setting new HW address on eth1
New Address is             00:02:6F:FA:81:13
Hit any key to stop autoboot:  0 
ar7240>