Here's some interesting bits I found while poking around:



> cat /proc/mtd dev: size erasesize name mtd0: 00100000 00010000 "SPI NOR Flash Partition1" mtd1: 00300000 00010000 "SPI: kernel" mtd2: 00300000 00010000 "Ramdisk"

So it looks like mtd1 holds the kernel and mtd2 holds the initrd. The 0x300000 = 3MB size limit on the initrd corresponds to what fernjager found. I'm not sure what mtd0 holds - possibly part of the bootloader? Unfortunately I get an error when I try to dump the contents:



cat: can't open '/dev/mtd0': No such device or address

(Pretty sure I'm doing something wrong here - let me know if you figure out the trick.)

I'm also interested in how the flashing process works. To flash the firmware, you put 'program.bin' and some other files on the root of the SD card and reboot, and somehow 'program.bin' gets executed. But there's no reference to program.bin in the 1.7 kernel image, and the only references in the 1.7 initrd are for deleting the files after a successful upgrade. So it must be running directly from the bootloader somehow. This seems to agree with the boot log in Kazu-zamasu's github repo, which has a reference to program.bin before the first kernel messages appear. Compare:



....reading program.bin .................<mmc1>go 208000 <4>(192-96-1) console [ttyS0] enabled

vs.



> dmesg (192-96-1) console [ttyS0] enabled Mount-cache hash table entries: 512

By the way, the same repo has a kernel config, which (if it works) might be useful since there doesn't seem to be one with the official GPL release (available here - click on "Wireless and Multimedia Products" / "Wi-Fi SD Card" / "Wi-Fi SD Card" / (either model), and it's listed under "Driver/Firmware" as "WiFiSD_GPL".)

It seems like there is something useful in this blog post, but it's in French and I haven't tried reading a translated version yet. I see some references to U-Boot though, which is interesting because program.bin seems to be able to flash that along with the kernel/initrd if it's present:



$ strings program.bin | grep program # snip found u-boot.bin, start program. found image3, start program. found image, start program.

Though there is no u-boot.bin in the official 1.7 firmware release.