About the CFE of HND routers

[Yota]

Having done some research, maybe our understanding of CFE is completely wrong, for HND there is no our CFE at all, and it is not encrypted either.

I translated and published this article on GitHub: How to flash the CFE of RT-AC86U and other HND routers
Please note that I do not guarantee this is correct

Also, I don't support modifying the CFE to unlock some settings at all, especially those that are illegal!


This is just a discussion of CFE and the "factory nvram", not trying to break the rules of the forum or help someone else get some kind of hack. just discuss!

Hope it didn't violate the forum rules, if it does, please delete it.

 

[Tech9]

just discuss!

Discuss what exactly?

 

[RMerlin]

HND 5.02 (BCM490x) uses CFE:

May  5 01:05:03 kernel: klogd started: BusyBox v1.25.1 (2022-01-30 23:42:50 EST)
May  5 01:05:03 kernel: Linux version 4.1.51 (merlin@ubuntu-dev) (gcc version 5.5.0 (Buildroot 2017.11.1) ) #2 SMP PREEMPT Sun Jan 30 23:44:40 EST 2022
May  5 01:05:03 kernel: CPU: AArch64 Processor [420f1000] revision 0
May  5 01:05:03 kernel: Kernel command line: coherent_pool=4M cpuidle_sysfs_switch pci=pcie_bus_safe rootwait
...
May  5 01:05:03 kernel: cfe-v^A: 1.0.38-163.181

Broadcom only switched to U-Boot for newer devices, such as the BCM4912 used by the GT-AX6000.

May  5 05:05:15 kernel: klogd started: BusyBox v1.24.1 (2021-10-21 19:21:24 CST)
May  5 05:05:15 kernel: Linux version 4.19.183 (defjovi@ubuntu) (gcc version 9.2.0 (Buildroot 2019.11.1)) #1 SMP PREEMPT Thu Oct 21 19:22:33 CST 2021
May  5 05:05:15 kernel: random: get_random_bytes called from start_kernel+0x9c/0x454 with crng_init=0
May  5 05:05:15 kernel: Kernel command line: coherent_pool=4M cpuidle_sysfs_switch pci=pcie_bus_safe console=ttyAMA0,115200 earlycon rootwait mtdparts=brcmnand.0:2097152(loader),264241152@2097152(image),524288@266338304(crashlog) root=/dev/ubiblock0_6 ubi.mtd=image ubi.block=0,6 rootfstype=squashfs cma=0M
May  5 05:05:15 kernel: CCI hardware cache coherency enabled
May  5 05:05:15 kernel: bootloader version  U-Boot 2019.07 (Oct 21 2021 - 23:55:38 +0800), Build: 5.04L.0

 

[Yota]

HND 5.02 (BCM490x) uses CFE:

May  5 01:05:03 kernel: klogd started: BusyBox v1.25.1 (2022-01-30 23:42:50 EST)
May  5 01:05:03 kernel: Linux version 4.1.51 (merlin@ubuntu-dev) (gcc version 5.5.0 (Buildroot 2017.11.1) ) #2 SMP PREEMPT Sun Jan 30 23:44:40 EST 2022
May  5 01:05:03 kernel: CPU: AArch64 Processor [420f1000] revision 0
May  5 01:05:03 kernel: Kernel command line: coherent_pool=4M cpuidle_sysfs_switch pci=pcie_bus_safe rootwait
...
May  5 01:05:03 kernel: cfe-v^A: 1.0.38-163.181

Broadcom only switched to U-Boot for newer devices, such as the BCM4912 used by the GT-AX6000.

May  5 05:05:15 kernel: klogd started: BusyBox v1.24.1 (2021-10-21 19:21:24 CST)
May  5 05:05:15 kernel: Linux version 4.19.183 (defjovi@ubuntu) (gcc version 9.2.0 (Buildroot 2019.11.1)) #1 SMP PREEMPT Thu Oct 21 19:22:33 CST 2021
May  5 05:05:15 kernel: random: get_random_bytes called from start_kernel+0x9c/0x454 with crng_init=0
May  5 05:05:15 kernel: Kernel command line: coherent_pool=4M cpuidle_sysfs_switch pci=pcie_bus_safe console=ttyAMA0,115200 earlycon rootwait mtdparts=brcmnand.0:2097152(loader),264241152@2097152(image),524288@266338304(crashlog) root=/dev/ubiblock0_6 ubi.mtd=image ubi.block=0,6 rootfstype=squashfs cma=0M
May  5 05:05:15 kernel: CCI hardware cache coherency enabled
May  5 05:05:15 kernel: bootloader version  U-Boot 2019.07 (Oct 21 2021 - 23:55:38 +0800), Build: 5.04L.0

Thanks, it seems there are a bunch of questions here, I don't like this mysterious little box of Broadcom, no documentation, no discussion, everything is so mysterious.

So can you explain its partition structure? Are there three partitions as in the article?

 

[Yota]

the BCM4912 used by the GT-AX6000.

I did a search for the BCM4912 and I was surprised that their latest router flagship SoC still uses the Cortex-A53 architecture, although 16nm is good news.

Wonder if the AX6000 has a new SDK and a new kernel?

The dual 2.5 GbE we were looking for is finally here, but Qualcomm did dual 10 GbE years ago.....

Anyway, this router is full of progress, but given the pandemic they've been slow, I would like to see routers like the RT-AXE86U on the new platform, Just changing the name in case someone downloads the wrong firmware

 

[RMerlin]

So can you explain its partition structure? Are there three partitions as in the article?

I can't, because it's been years since I've looked at the layout (and that layout changes between platforms). I don't remember the details. But it's probably more than three partitions. Off the top of my head there's CFE, nvram, kernel, rootfs, brcmnand, and at least one or two extra partitions depending on the model. Newer models also have two copies of kernel and rootfs, so flashing can be done on a non-live filesystem, and it boots from the two other partitions after flashing.

Wonder if the AX6000 has a new SDK and a new kernel?

GT-AX6000 uses a newer SDK, and kernel 4.19.

 

[Yota]

I can't, because it's been years since I've looked at the layout (and that layout changes between platforms). I don't remember the details. But it's probably more than three partitions. Off the top of my head there's CFE, nvram, kernel, rootfs, brcmnand, and at least one or two extra partitions depending on the model. Newer models also have two copies of kernel and rootfs, so flashing can be done on a non-live filesystem, and it boots from the two other partitions after flashing.

I'm curious about CFEs because they are very similar to the CPU used by the raspberry pi, if the boot part is open source or we figured out a way, maybe, just maybe we can boot to raspberry pi supported systems.

GT-AX6000 uses a newer SDK, and kernel 4.19.

Glad to hear that.

 

[sfx2000]

I did a search for the BCM4912 and I was surprised that their latest router flagship SoC still uses the Cortex-A53 architecture, although 16nm is good news.

Technically the SoC cores are Brahma B53, which are 64 bit versions of B15...

Broadcom is/was an architecture licensee, similar to Apple, Qualcomm, Marvell, Samsung.

 

[sfx2000]

I'm curious about CFEs because they are very similar to the CPU used by the raspberry pi, if the boot part is open source or we figured out a way, maybe, just maybe we can boot to raspberry pi supported systems.

RPi doesn't use CFE...

 

[John Fitzgerald]

Maybe a bit off topic, but have been wondering for some time:

Is the CFE only updated via Factory Firmware and can/does RMerlin firmware update the CFE or do you need to flash back to stock for any updates?

 

[RMerlin]

Maybe a bit off topic, but have been wondering for some time:

Is the CFE only updated via Factory Firmware and can/does RMerlin firmware update the CFE or do you need to flash back to stock for any updates?

CFE updates part of a stock firmware are also integrated into my firmware.

 

[Yota]

Technically the SoC cores are Brahma B53, which are 64 bit versions of B15...

Broadcom is/was an architecture licensee, similar to Apple, Qualcomm, Marvell, Samsung.

RPi doesn't use CFE...

thanks for the explanation and clarification.

CFE updates part of a stock firmware are also integrated into my firmware.

The article points out that CFE has three partitions, mtd0, mtd10 for saving factory nvram variables, and mtd9 for user nvram variables.

I'm wondering if this is correct, and if so, every time I update the firmware with cfe_rom, it flashes three partitions, or does it just change the nvram variable?

 

[RMerlin]

The article points out that CFE has three partitions, mtd0, mtd10 for saving factory nvram variables, and mtd9 for user nvram variables.

It varies between devices. Pre-HND, CFE was just one single partition, with a few models like the RT-AC56U, RT-AC68U and RT-AC3200 containing CFE updates within the firmware (for the RT-AC3200 for instance it was to increase the nvram partition to 128 KB).