Warning: The first step of the following guide puts a foreign bootloader onto your device. This has the consequence that you won't be able to recover the original firmware unless you have a backup. To get a backup you have to dump the flash ROM via JTAG which requires some soldering on your device, a JTAG adapter and suitable software. I do have a backup of the original firmware but as it's copyrighted I will not send a copy of it to you, so please don't ask for it! Furthermore, there is no reliable ADM6996 driver for uClinux and the CX82100 yet, so if you put uClinux onto your BEFSX41 you won't no longer be able to use it as router. Before you actually perform any of the following steps, first completely read this document and be sure to understand everything and that you have a working BOOTP/DHCP/NFS server. Last but not least, even if everything works as expected, it may still kill your BEFSX41. You have been warned!

Usually, one of the hardest things when trying to put Linux onto an embedded device is to put a suitable bootloader onto the flash ROM. However, Linksys has left a nice backdoor in the firmware which really makes it easy. All you need is a suitable TFTP client (from http://redsand.net/projects/linksys-tftp/linksys-tftp.php) and a bootloader image (this is a compiled bootloader from the CX82100 bootloader page).

Just rename the bootloader image file to "boot.bin" and send it to your BEFSX41 while keeping your fingers crossed:

linksys-tftp <your-befsx41-ip>
put boot.bin <your-befsx41-admin-password>

As soon as the TFTP transfer is complete, the original Linksys firmware will shutdown. Wait a minute and just unplug the power supply for now.

The new bootloader will send BOOTP requests with source MAC address 84:db:e0:00:74:a3 (hardcoded in tftp.c of the bootloader source code). A suitable dhcpd.conf file for answering these requests is:

ddns-updates off;
ddns-update-style none;

authoritative;

subnet 192.168.0.0 netmask 255.255.255.0 {
}

host befsx41 {
  hardware ethernet 84:db:e0:00:74:a3;
  allow bootp;
  fixed-address 192.168.0.254;
  server-name "192.168.0.100";
  filename "befsx41-linux-nfsroot.bin";
}

This would assign 192.168.0.254 to the bootloader via BOOTP and tell it to get its kernel by requesting a file named "befsx41-linux-nfsroot.bin" via TFTP from 192.168.0.100 (your workstation/server). This file must contain an uncompressed uClinux kernel image compiled for the CX82100.

The kernel itself will then send DHCP requests, but this time with source MAC address 00:30:cd:00:02:cc (hardcoded in linux/arch/armnommu/mach-cx821xx/cnxtbsp.c). In order to let dhcpd reply to these DHCP requests, you will have add an entry to dhcpd.conf, e.g.:

host befsx41-linux {
  hardware ethernet 00:30:cd:00:02:cc;
  fixed-address 192.168.0.254;
  option root-path "192.168.0.100:/var/befsx41-root";
}

This entry will assign 192.168.0.254 to the Linux kernel on your BEFSX41 and tell it to get its root filesystem via NFS from 192.168.0.100, directory /var/befsx41-root. A NFS server must be running on 192.168.0.100 with an entry in /etc/exports like this:

/var/befsx41-root 192.168.0.254(rw,no_root_squash,sync)

Just put a minimalistic root filesystem to /var/befsx41-root (pay attention when unpacking the tarball: be sure to untar it in /var, so that /var/befsx41-root/linuxrc exists and you don't have a /var/befsx41-root/befsx41-root/ directory). Also note that you have restart your DHCP and NFS server after you have changed the configuration files. Now power up your BEFSX41 again and it should boot Linux. It's reachable via telnet now with the IP address assigned via DHCP (192.168.0.254 in the example files). You can log in as root without password.