Longterm for these devices, increasing kernel partition size seems to be our best option.
@hnyman made a comment about it here https://github.com/openwrt/openwrt/pull/3205#issuecomment-687068670
I have made an untested patch for mamba here by comparing it against cobra.
From what I gather that is all that is needed, the hard part is the flashing process/migration.
Does anyone have more information? Anyone else attempt to do this?
Dump the uboot vars and see if it expects the kernel at a fixed location.
I think flashing from OpenWrt will work. OEM maybe.
Booting is the interesting question for me.
While I don't have the device(s) in question, when I last looked for information about this, I think to remember that u-boot was only reading 3072KB from flash. This would mean the kernel would be only loaded into RAM partially and crash immediately after.
I'm quite confident that changing the u-boot environment to load 6 MB into RAM might help, this is a rather finicky process for most users and would require a two-step migration from OEM (and even more fun for migrating back to OEM).
I have the device myself, is there anyway to dump uboot cars without serial TTL?
fw_printenv (packaged in uboot-envtools, which should be preinstalled on these devices) should work.
The partition resizing may be the only option with 5.10.x on the horizon.
CASset=min
MALLOC_len=5
MPmode=smp
alt_kern_addr=0x3200000
alt_kern_size=0x400000
altnandboot=run linksys_altnandboot
amp_enable=no
auto_recovery=yes
autoload=no
badcount=0
baudrate=115200
boot_order=hd_scr hd_img pxe net_img net_scr
boot_part_ready=3
bootargs_dflt=$console $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel
bootargs_end=:10.4.50.254:255.255.255.0:DSMP:eth0:none
bootargs_root=root=/dev/nfs rw
bootbadcount=0
bootcmd_auto=stage_boot $boot_order
bootcmd_bak=stage_boot $boot_order
bootcmd_lgcy=tftpboot 0x2000000 $image_name; setenv bootargs $bootargs_dflt; bootm 0x2000000;
bootdelay=3
buffbadcount=0
cacheShare=no
console=console=ttyS0,115200
default_load_addr=0x2000000
default_mtdparts=mtdparts=armada-nand:1024K(uboot)ro,256K(u_env),256K(s_env),1m@9m(devinfo),40m@10m(kernel),37m@13m(rootfs),40m@50m(alt_kernel),37m@53m(alt_rootfs),80m@10m(ubifs),-@90m(syscfg)
device=1
device_partition=0:1
disL2Cache=yes
disL2Prefetch=yes
disaMvPnp=no
eeeEnable=no
enaAutoRecovery=yes
enaClockGating=no
enaCpuStream=no
enaDCPref=yes
enaFPU=yes
enaICPref=yes
enaLPAE=no
enaWrAllo=no
eth1addr=00:50:43:02:00:00
eth1mtu=1500
eth2addr=00:50:43:00:00:02
eth2mtu=1500
eth3addr=00:50:43:00:02:02
eth3mtu=1500
ethact=egiga0
ethaddr=94:10:3E:85:B5:25
ethmtu=1500
ethprime=egiga0
fdt_addr=2040000
fileaddr=2000000
filesize=0x1e00000
firmware_name=blk-mamba.128mb.img
flash_alt_image=tftp $default_load_addr $firmware_name; nand erase $alt_kern_addr 0x4000000;nand write $default_load_addr $alt_kern_addr ${filesize};
flash_pri_image=tftp $default_load_addr $firmware_name; nand erase $pri_kern_addr 0x4000000;nand write $default_load_addr $pri_kern_addr ${filesize};
flash_ubi_image=mw.b 0x2000000 0x00 0x1e00000;tftp $default_load_addr blk-mamba.128mb.ubi.img; nand erase $pri_kern_addr 0x3600000; nand write $default_load_addr $pri_kern_addr 0x3600000
fs=ext2
fs_bootargs=console=ttyS0,115200 mtdparts=armada-nand:1024K(uboot)ro,256K(u_env),256K(s_env),256K(devinfo),4M(Linux),31M(rootfs),4M(Linux2),31M(rootfs2),-(syscfg)
fs_bootargs_root=ubi.mtd=6 root=ubi0:rootfs rootfstype=ubifs rootflags=sync
fs_type=jffs2
ide_path=/
image_name=uImage
initrd_name=uInitrd
interface=ide
ipaddr=192.168.1.1
jffs2_mtdparts=mtdparts=armada-nand:1024K(uboot)ro,256K(u_env),256K(s_env),1m@9m(devinfo),40m@10m(kernel),37m@13m(rootfs),40m@50m(alt_kernel),37m@53m(alt_rootfs),80m@10m(ubifs),-@90m(syscfg)
kernel_addr_r=2080000
lcd0_enable=0
lcd0_params=640x480-16@60
lcd_panel=0
linksys_altnandboot=nand read $default_load_addr $alt_kern_addr $alt_kern_size; setenv bootargs $console $default_mtdparts root=/dev/mtdblock7 ro rootfstype=$fs_type init=/sbin/init; bootm $default_load_addr;
linksys_nandboot=nand read $default_load_addr $pri_kern_addr $pri_kern_size; setenv bootargs $console $default_mtdparts root=/dev/mtdblock5 ro rootfstype=$fs_type init=/sbin/init; bootm $default_load_addr;
loadaddr=0x02000000
loads_echo=0
mfg_fs_bootargs=console=ttyS0,115200 mtdparts=armada-nand:640k(uboot)ro,128k@640k(u_env),128k@768k(s_env),3m@1m(kernel),16m@4m(rootfs),1m@20m(syscfg),4m@21m(data),3m@25m(alt_kernel),16m@28m(alt_rootfs),20m@44m(downloads)
mtdids=nand0=armada-nand
mtdparts=mtdparts=armada-nand:1024K(uboot)ro,256K(u_env),256K(s_env),1m@9m(devinfo),40m@10m(kernel),37m@13m(rootfs),40m@50m(alt_kernel),37m@53m(alt_rootfs),80m@10m(ubifs),-@90m(syscfg)
mvNetConfig=mv_net_config=4,(00:50:43:11:11:11,0:1:2:3),mtu=1500
mv_pon_addr=00:50:43:00:00:02
nandEcc=1bit
nandboot=run linksys_nandboot
netbsd_en=no
netmask=255.255.255.0
netretry=no
nfsboot=tftpboot $default_load_addr $image_name; setenv bootargs $fs_bootargs $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig; bootm $default_load_addr
openwrt_altnandboot=nand read $default_load_addr $alt_kern_addr $openwrt_fw_size; setenv bootargs $console $default_mtdparts root=/dev/mtdblock7 ro rootfstype=$fs_type init=/sbin/init; bootm $default_load_addr;
openwrt_fw_size=0x4000000
openwrt_mtdparts=mtdparts=armada-nand:1024K(uboot)ro,256K(u_env),256K(s_env),1m@9m(devinfo),40m@10m(kernel),37m@13m(rootfs),40m@50m(alt_kernel),37m@53m(alt_rootfs),80m@10m(ubifs),-@90m(syscfg)
openwrt_nandboot=nand read $default_load_addr $pri_kern_addr $openwrt_fw_size; setenv bootargs $console $default_mtdparts root=/dev/mtdblock5 ro rootfstype=$fs_type init=/sbin/init; bootm $default_load_addr;
pcieTune=no
pexMode=rc
prefix=/boot/
pri_kern_addr=0xa00000
pri_kern_size=0x400000
pxe_files_load=:default.arm-armadaxp-db:default.arm-armadaxp:default.arm
pxefile_addr_r=3100000
ramdisk_addr_r=2880000
rcvrip=169.254.100.100
rootpath=/home/work/AXP/fs/rootfs
sata_delay_reset=0
sata_dma_mode=yes
script_addr_r=3000000
script_name=boot.scr
senvbadcount=0
serverip=192.168.1.99
standalone=fsload 0x2000000 $image_name;setenv bootargs $console $mtdparts root=/dev/mtdblock0 rw ip=$ipaddr:$serverip$bootargs_end; bootm 0x2000000;
stderr=serial
stdin=serial
stdout=serial
ubiboot=nand read $default_load_addr $pri_kern_addr $pri_kern_size; setenv bootargs $console $jffs2_mtdparts root=ubi0:rootfs rw ubi.mtd=8 rootfstype=ubifs init=/sbin/init; bootm $default_load_addr;
uenvbadcount=0
update_both_images=run flash_pri_image;run flash_alt_image
usb0Mode=host
usb1Mode=host
usb2Mode=device
usbActive=0
vxworks_en=no
yuk_ethaddr=00:00:00:EE:51:81
boot_part=2
bootcmd="run altnandboot"
and a bootlog
0x400000 = 4'194'304 bytes = 4096 KB (which makes me wonder why the kernel size is limited to 3072 KB)
And that now has me scratching my noggin. I know that last time I tried going back to OEM on this device it would not boot. @solidus1983 can you check if yours is the same.
@anomeome
Aside from the MAC, my mamba uboot is identical to yours.
So if I:
fw_setenv pri_kern_size=0x0600000
fw_setenv alt_kern_size=0x0600000
then
That is all that is needed?
What are my brick chances?
I think I'll hold off until I have another one handy. 
Well, if you have a serial connected, and the uboot available to reload, seems unlikely.
I would rather try to get along with the 4096 KB the bootloader already appears to account for, while that might not last forever, it will keep you covered for quite a while to come.
Any idea as to the venom.
Disclaimer: I don't have any of these devices - and you certainly shouldn't try any of this without at least having serial console access for emergencies (and even that involves quite a risk).
All I can find (quickly) about venom/ wrt32x suggests KernSize=0x0600000 = 6'291'456 bytes.
I have no idea why quite some of these devices restrict themselves to 3072 KB, but at least for the ones listed above, the existing/ actual OEM bootloader limits appear to be 4096 KB or better.
I found a venom uboot showing 0x0600000
I will try to make a DTS bumping mamba to 4MB and venom to 6MB.
Here are updated patches:
Please check my math
Give me a few moments need to wake up fully.
Here is uboot from my WRT32x running on 5.4.94 Kernel
CASset=max
MALLOC_len=5
MPmode=SMP
SMT-2D=NK90I0202455X01
altFwSize=0x7B00000
altKernAddr=0x8400000
altKernSize=0x0600000
altnandboot=setenv bootargs console=ttyS0,115200 root=/dev/mtdblock8;nand read $defaultLoadAddr $altKernAddr $altKernSize; bootz $defaultLoadAddr
autoload=no
baudrate=115200
boot_order=hd_scr usb_scr mmc_scr hd_img usb_img mmc_img pxe net_img net_scr
boot_part_ready=3
bootargs_dflt=$console $nandEcc $mtdparts_lgcy $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel
bootargs_end=:10.4.50.254:255.255.255.0:Armada38x:eth0:none
bootargs_root=root=/dev/nfs rw
bootcmd_auto=stage_boot $boot_order
bootcmd_fdt=tftpboot 0x2000000 $image_name;tftpboot $fdtaddr $fdtfile;setenv bootargs $console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel; bootz 0x2000000 - $fdtaddr;
bootcmd_fdt_boot=tftpboot 0x2000000 $image_name; setenv bootargs $console $nandEcc $mtdparts $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end $mvNetConfig video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel; bootz 0x2000000 - $fdtaddr;
bootcmd_fdt_edit=tftpboot $fdtaddr $fdtfile; fdt addr $fdtaddr; setenv bootcmd $bootcmd_fdt_boot
bootcmd_lgcy=tftpboot 0x2000000 $image_name;setenv bootargs $console $nandEcc $mtdparts_lgcy $bootargs_root nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip$bootargs_end video=dovefb:lcd0:$lcd0_params clcd.lcd0_enable=$lcd0_enable clcd.lcd_panel=$lcd_panel; bootm $loadaddr;
bootdelay=3
cacheShare=no
console=console=ttyS0,115200
defaultLoadAddr=0x2000000
device_partition=0:1
disaMvPnp=no
eeeEnable=no
enaClockGating=no
enaCpuStream=no
enaFPU=yes
enaMonExt=no
enaWrAllo=no
eth1addr=60:38:E0:CE:37:58
eth1mtu=1500
eth2addr=60:38:E0:CE:37:58
eth2mtu=1500
eth3addr=60:38:E0:CE:37:58
eth3mtu=1500
ethact=egiga0
ethaddr=60:38:E0:CE:37:58
ethmtu=1500
ethprime=egiga0
fdt_addr=2040000
fdt_skip_update=no
fdtaddr=0x1000000
fdtfile=armada-38x-modular.dtb
fileaddr=2000000
filesize=C20000
firmwareName=venom.img
flash_alt_image=tftpboot $defaultLoadAddr $firmwareName && nand erase $altKernAddr $altFwSize && nand write $defaultLoadAddr $altKernAddr $filesize
flash_pri_image=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAddr $priFwSize && nand write $defaultLoadAddr $priKernAddr $filesize
ide_path=/
image_name=uImage
initrd_name=uInitrd
ipaddr=192.168.1.1
kernel_addr_r=2080000
lcd0_enable=0
lcd0_params=640x480-16@60
lcd_panel=0
limit_dram_size=yes
loadaddr=0x02000000
loads_echo=0
mtddevname=uboot
mtddevnum=0
mtdids=nand0=armada-nand
mtdparts=mtdparts=armada-nand:2048K(uboot)ro,128K(u_env),256K(s_env),256K@8064K(devinfo),123m@9m(firmware1),123m@132m(firmware2)
mvNetConfig=mv_net_config=4,(00:50:43:11:11:11,0:1:2:3),mtu=1500
mv_pon_addr=00:50:43:db:f5:00
nandEcc=nfcConfig=4bitecc
nandboot=setenv bootargs console=ttyS0,115200 root=/dev/mtdblock6;nand read $defaultLoadAddr $priKernAddr $priKernSize; bootz $defaultLoadAddr
netbsd_en=no
netmask=255.255.255.0
netretry=no
partition=nand0,0
pcieTune=no
pexMode=RC
priFwSize=0x7B00000
priKernAddr=0x0900000
priKernSize=0x0600000
pxe_files_load=:default.arm-armadaxp-db:default.arm-armadaxp:default.arm
pxefile_addr_r=3100000
ramdisk_addr_r=2880000
rootpath=/srv/nfs/
run_script=no
sata_delay_reset=0
sata_dma_mode=yes
script_addr_r=3000000
script_name=boot.scr
sd_detection_dat3=no
serverip=192.168.1.254
standalone=fsload 0x2000000 $image_name;setenv bootargs $console $nandEcc $mtdparts_lgcy root=/dev/mtdblock0 rw ip=$ipaddr:$serverip$bootargs_end; bootm 0x2000000;
stderr=serial
stdin=serial
stdout=serial
update_both_images=tftpboot $defaultLoadAddr $firmwareName && nand erase $priKernAddr $priFwSize && nand erase $altKernAddr $altFwSize && nand write $defaultLoadAddr $priKernAddr $filesize && nand write $defaultLoadAddr $altKernAddr $filesize
usb0Mode=host
usbActive=0
usbType=2
vxworks_en=no
yuk_ethaddr=00:00:00:EE:51:81
auto_recovery=yes
boot_part=1
bootcmd="run nandboot"
Math looked ok to me.
Is anyone volunteering to test these? I've got both devices in the cupboard but my serial cables are already hooked up to other devices i'm working on.
I would however my WRT32x is in service atm, Else I would test. Flashing firmware when no one is using it is all fine, but flashing UBoot with an adjustment as big as the patches are with the risk of a brick wouldn't do my health any good after the pitch forks come out.