Starting up a thread here for Linksys EA2700. First attempt, learning as I go.
It's a pretty basic device, no usb or special things.
Hardware specs:
system type : Broadcom BCM5357 chip rev 2
processor : 0
cpu model : MIPS 74K V4.9
BogoMIPS : 239.20
wait instruction : no
microsecond timers : yes
tlb_entries : 64
extra interrupt vector : no
hardware watchpoint : yes
ASEs implemented : mips16 dsp
VCED exceptions : not available
VCEI exceptions : not available
unaligned_instructions : 1369
dcache hits : 2147483648
dcache misses : 2641854191
icache hits : 2147483648
icache misses : 4151390068
instructions : 2147483648
cat /proc/meminfo
MemTotal: 59524 kB
cat /proc/mtd
dev: size erasesize name
mtd0: 00080000 00004000 "boot"
mtd1: 00180000 00004000 "nvram"
mtd2: 01200000 00004000 "linux"
mtd3: ffe232e4 00004000 "rootfs"
mtd4: 01200000 00004000 "linux2"
mtd5: 010232e4 00004000 "rootfs2"
mtd6: 01900000 00004000 "brcmnand"
CFE output:
Device Name Description
uart0 NS16550 UART at 0x18000300
nflash0 Hynix NAND flash size 65536KB
nflash0.boot Hynix NAND flash offset 00000000 size 512KB
nflash0.nvram Hynix NAND flash offset 00080000 size 1536KB
nflash0.trx Hynix NAND flash offset 00200000 size 1KB
nflash0.os Hynix NAND flash offset 0020001C size 18432KB
nflash0.trx2 Hynix NAND flash offset 01400000 size 1KB
nflash0.os2 Hynix NAND flash offset 0140001C size 18432KB
nflash1.boot Hynix NAND flash offset 00000000 size 512KB
nflash1.nvram Hynix NAND flash offset 00080000 size 1536KB
nflash1.trx Hynix NAND flash offset 00200000 size 18432KB
nflash1.trx2 Hynix NAND flash offset 01400000 size 18432KB
nflash1.brcmnand Hynix NAND flash offset 02600000 size 26624KB
eth0 Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller
More info on initial report in OpenWRT:
https://wiki.openwrt.org/toh/linksys/ea2700
But, seems nobody attempted to get it supported in OpenWRT/LEDE.
Device has a 'fallback' mechanism to boot other kernel after certain amount of failed boot attempts.
Though, does seem to share same kernel between normal and fail-safe (mtd2/mtd4) while rootfs is different.
Now you start with these goals
- Attach serial cable this is your last resort if something goes wrong.
-- Dump CFE (boot partition) and NVRAM. DDWRT forum already has this.
- Find cpu type, arch type, partition type
-- In this case it is brcm47xx same cpu as wndr3400v2
-- It has dual partitions. Linux and Linux2. Each of these have kernel (not seen above) and rootfs
- Verify that you can upload firmware using tftp method.
- The firmware format is trx for this router
- Get the vlan port info from CFE
Making Code changes
- Add your router in linux/target/brcm47xx/image/Makefile. Use existing router which has trx firmware as example.
- Add network vlan port config to brcm47xx/base_files/uci_defaults/02_network
From there on you tweak the firmware to support other things
@npcomplete, Thanks for helping!
I already had serial console soldered, have access to the CFE.
How do the image/Makefile variables DEVICE_ID and VERSION reference anywhere? I don't see/recognized how they're used for detection, if any.
Currently, running the stock firmware and running /proc/cpuinfo it doesn't show a model/type. So, detection has to be on board type/num initially.
Though, I thought I first attempt to use a initramfs image to load so find all the correct detections and network config. But, for some reason I don't get the CFE to boot an initramfs-kernel.bin.
Attempted using tftp upload, no go: Loading: PANIC: out of memory!
Entry at 0x00000000
Attempted using CFE load command from tftp server, no go: just stops at loading... nothing happens.
Attempted using CFE boot command from tftp server, no go: Loading: PANIC: out of memory!
Tried different compression methods for the ramdisk image, none/gzip/lzma, doesn't matter.
So, I guess have to dive into the .bin and figure out the (load) addr + max (no of bytes) to load...
Ok, little progress here...
Used uncompressed ELF image (vmlinux-initramfs.elf) from build_dir and used tftp boot from CFE to run it. It's generic, so no specific board config in there, I suppose
Immediately some errors to note:
Sun Jul 9 09:46:08 2017 kern.debug kernel: [ 0.000000] bcma: bus0: Found rev 9 PMU (capabilities 0x28A42A09)
Sun Jul 9 09:46:08 2017 kern.debug kernel: [ 0.000000] bcma: bus0: Found serial flash
Sun Jul 9 09:46:08 2017 kern.err kernel: [ 0.000000] bcma: bus0: Unsupported ST serial flash (id: 0x0, id2: 0x0)
Sun Jul 9 09:46:08 2017 kern.debug kernel: [ 0.000000] bcma: bus0: Found NAND flash
Sun Jul 9 09:46:08 2017 kern.info kernel: [ 0.000000] bcma: bus0: Early bus registered
Sun Jul 9 09:46:08 2017 kern.info kernel: [ 0.000000] MIPS: machine is Unknown Board
Sun Jul 9 09:46:08 2017 kern.info kernel: [ 9.280688] b43-phy0: Broadcom 5357 WLAN found (core revision 28)
Sun Jul 9 09:46:08 2017 kern.info kernel: [ 9.287951] b43-phy0: Found PHY: Analog 9, Type 4 (N), Revision 9
Sun Jul 9 09:46:08 2017 kern.err kernel: [ 9.294172] b43-phy0 ERROR: FOUND UNSUPPORTED RADIO (Manuf 0x17F, ID 0x2057, Revision 5, Version 2)
Sun Jul 9 09:46:08 2017 kern.warn kernel: [ 9.303497] b43: probe of bcma0:1 failed with error -122
Sun Jul 9 09:46:08 2017 kern.info kernel: [ 9.309237] Broadcom 43xx driver loaded [ Features: NL ]
The errors you see can be ignored. Except the radio error - but it can be ignored for now. You seem to have booting kernel. Which is good news.
Am having difficulty attempting to generate a .trx with initramfs support, which would help me to figure out the mtd partitioning.
@npcomplete, you have some pointers how to get an image uploaded in flash that could work (incl mtd support for rootfs)?
Easiest thing is to use existing config for a router that has initramfs enabled. I know few routers under bcm53xx have it enabled.
There is a module that supports mtd parsing under mtd kernel config. It has brcm47xx in the name.