Running/flashing initramfs/CFE

For Developers
1

I have 2 routers, same model, same soc, maybe same board (one of them is newer, so it can have revisions). Although they have the same hardware, they differ in software. On router A, which has an older software, I can access CFE and a shell over UART; on router B (newer), I can only access CFE because the Linux output/input for UART was disabled by some parameters in the nvram.

My goal is to be able to access the shell on router B like in router A. Since output/input is disabled, the options are running initramfs (maybe it will output) or flashing a new CFE with more commands (the CFE is very poor).

I'm a beginner, and so far I only tried to run an initramfs from the host with no success (never tried flashing the CFE since I'm afraid of bricking it). I tried the Actiontec T1200H initramfs (because it was the closest one to my board), and since that failed, I made a custom initramfs with the dts from the router, and that failed too.

How should I proceed? Initramfs, CFE, or try something else?

(Chip off approach is off the table)

CPU Model: Broadcom BMIPS4350 V8.0

CFE Boot

CFE version 1.0.. for BCM96838 (32bit,SP,BE)

Boot Strap Register:  0x800078ff
Chip ID: BCM68380_B0, MIPS: 600MHz, DDR: 533MHz, Bus: 240MHz
RDP: 800MHz
Main Thread: TP0
Total Memory: 268435456 bytes (256MB)
Boot Address: 0xbfc00000

NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: , id 0xeff1 block 128KB size 131072KB

Booting from latest image (address 0xc3980000, flash offset 0x03d80000) ...
Decompression LZ4 Image OK!
Entry at 0x804ab210
Starting program at 0x804ab210
/memory = 0x10000000

CFE Commands

CFE> help
Available commands:

cras                Configure ring admin status
vrpd                View Ring packet descriptor
sar                 Show available Runner to CPU rings
x                   Change extra partitions size
find                Find string in NAND
comp                Compare NAND blocks
fb                  Find NAND bad blocks
dn                  Dump NAND contents along with spare area
phy                 Set memory or registers.
meminfo             Display CFE System Memory
sm                  Set memory or registers.
dm                  Dump memory or registers.
db                  Dump bytes.
dh                  Dump half-words.
dw                  Dump words.
w                   Write the whole image start from beginning of the flash
e                   Erase NAND flash
ws                  Write whole image (priviously loaded by kermit or JTAG) to flash .
ldt                 load device tree blob from tftp server.
loadb               load binary via network or kermit protocol.
r                   Run program from flash image or from host depending on [f/h/c] flags
p                   Print boot line and board parameter info
c                   Change booline parameters
i                   Erase persistent storage data
a                   Change board AFE ID
b                   Change board parameters
reset               Reset the board
pmdio               Pseudo MDIO access for external switches.
spi                 Legacy SPI access of external switch.
force               override chipid check for images.
help                Obtain help for CFE commands

Initramfs loading error

0x81000000/5795362 Entry at 0x81000000
Closing network.
Starting program at 0x81000000
/memory = 0x10000000
**Exception 32: EPC=820003E0, Cause=0000001C (BusErrWr )
                RA=820005A8, VAddr=00000000

        0  ($00) = 00000000     AT ($01) = 00000000
        v0 ($02) = 00000001     v1 ($03) = B0000000
        a0 ($04) = 0000000A     a1 ($05) = 82001680
        a2 ($06) = 00000022     a3 ($07) = 43464531
        t0 ($08) = 82000128     t1 ($09) = 82586E60
        t2 ($10) = 00000010     t3 ($11) = DEBFF7E7
        t4 ($12) = 00000000     t5 ($13) = 00000000
        t6 ($14) = 00000000     t7 ($15) = 3F1B8C86
        s0 ($16) = 00000000     s1 ($17) = 00000022
        s2 ($18) = 82001680     s3 ($19) = 82001680
        s4 ($20) = 0000000A     s5 ($21) = 00000006
        s6 ($22) = 00000000     s7 ($23) = 00000001
        t8 ($24) = 00000000     t9 ($25) = 00000000
        k0 ($26) = DB4E9CBD     k1 ($27) = EC7FBEFF
        gp ($28) = 80A9C220     sp ($29) = 82588C70
        fp ($30) = 80A9C578     ra ($31) = 820005A8


Resetting board in 60 seconds...
2

What debice we are talking about?

1 Like
4

As you probably know, this device is not supported by OpenWrt. Further, because of this:

it probably never will be officially supported. Obviously if you're planning to do the development work yourself, by all means. But be aware that the wifi will not work, nor will the analog telephone features and the coax. I'm also fairly certain that the optical will not work, either.... so this device would only really work as an Ethernet device.

1 Like
5

So what you're saying is, I have to figure out how to build kernel/initramfs/CFE from scratch for this router?

1 Like
6

Broadcom wifi6 has no open drivers, GPON can only be supported if it is a discrete SFP module )if it is separate SFP you can try, though likely it is still laser driven from PCB) containing subscription secure element. Best way is to proceed is to convert the CPE into passthrough mode. Failing to find that - "DMZ Host" somewhat works to front normal OpenWrt.

2 Likes