同洲N8609I机顶盒

来自IPTV爱好者
跳转至: 导航搜索

主板照片

N8609I.jpg

EPG地址

上海:http://epg.zte.online.sh.cn:8080/iptvepg/http://218.83.163.91:8080/iptvepg/

江苏:http://221.231.144.4:8080/iptvepg/

上海升级地址:http://218.83.169.104/coshipupdate/

江苏升级地址:http://221.231.144.100/coshipupdate/

启动信息截屏

BCM97401 
AB
1s
K1
K2

K3

K4

K5
00000007 00000014 00000017 0000003A 0000000F 00000027 0000000F 00000014 0000000F 0000003A 00000027 00000007 00000027 00000017 00000027 0000000F 00000010 00000026 2
Copy Code...UCF34TUCV


Common Firmware Environment (CFE) version 1.1 for BCM97401C1, (Little Endian Mode)
Build Date: Tue Dec 11 09:50:58     2007 (901419@fengbin)
Copyright (C) 2000-2007 Broadcom Corporation.

Initializing Arena.
Initializing Devices.

FLASH CHECKSUM FAILED.
INVALID FLASH IMAGE
Wrong board type (0xFFFFFF).
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
X  MAC ADDRESS NOT SET, Use Command macprog Set And Restart  X
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
CPU speed: 297MHz
Total memory: 0x8000000 bytes (128MB)

Total memory used by CFE:  0x87000000 - 0x870AF5D4 (718292)
Initialized Data:          0x870A3F10 - 0x870A63A8 (9368)
BSS Area:                  0x870A63A8 - 0x870AF5D4 (37420)
Local Heap:                0x870AF654 - 0x8B0AF654 (67108864)
Stack Area:                0x8B0AF654 - 0x8B0B1654 (8192)
Text (code) segment:       0x87000000 - 0x87028FC4 (167876)

[csip_osd_init] start ! 
[csip_osd_init] CSIP_BRD_Init sucess ! 
[csip_osd_init] CSIP_Booter_Display_Open sucess ! 
[csip_osd_init] CSIP_Booter_OSD_Init sucess ! 
[csip_osd_init] CSIP_Booter_OSD_CreateRegion sucess ! 

Booter Code Star...
Begin establish session!(3807)
Z?  �  Ystablish session timeout(4811)!
Start Agent failed
[Booter]: INFO! Find Boot Information Success
[Booter]: INFO! Boot Start From Index 2
[Booter_BootApplication]: INFO! Parse App Information Finished
[Booter_BootAPP]: INFO! ZIP Flag Is 1
Loading: 0x80001000/3321990 0x8032c086/147334 Entry address is 0x8030b000
total=  bytes
Starting program at 0x8030b000
RUN!
<5>Linux version 2.6.12-4.1-brcmstb (root@localhost.localdomain) (gcc version 3.4.6) #2 Fri Jul 11 20:47:22 CST 2008
c->processor_id == 00020000
MIPs 7401 id = 20000
Before: firmhandl=870ae1c0, firmentry=8702c70c, seal=43464531,bootParmsAddr=8032d5e4
The cmdline args were:
@8032d5e4=root=/dev/romblock21 rootfstype=cramfs mem=80M rw
Before: firmhandl=870ae1c0, firmentry=8702c70c, seal=43464531,bootParmsAddr=8032d5e4
Ethernet MAC address was not set in CFE
Done initializing UARTC at b0400b00
HI WORLD!!!
gathering mode: 0x00000264 at 0x0xb000040c
split mode: 0x00000001 at 0xb0000410
board_init_once: regval=44a16102, ddr_strap=3, 4 chips, pci_size=2
Detected 256 MB on board
cfeBootParms ===> root=/dev/romblock21 rootfstype=cramfs mem=80M rw
Number of Nand Chips = 0
Kernel boot options: root=/dev/romblock21 rootfstype=cramfs mem=80M rw console=ttyS0,115200

Initial CP0 22 value : 0x00010020
Updated CP0 22 value : 0x00000020
CP0 reg 22 sel 0 to 5: 0xe3800000 0x00000020 0x00000000 0x00000020 0x00000000 0x00000020
Sundry 0xb0404000, chipId 0x00007401, bcm7401Cx 0x21
CPU revision is: 00020000
Determined physical RAM map:
 memory: 10000000 @ 00000000 (usable)
User-defined physical RAM map:
node [00000000, 05000000: RAM]
node [05000000, 0b000000: RSVD]
<4>bootmem_init: map 0 type 1
<4>bootmem_init: curr_pfn 0x00000351 last_pfn 0x0000ffff max_low_pfn 0x00010000
<4>bootmem_init: Done 
<7>On node 0 totalpages: 65536
<7>  DMA zone: 65536 pages, LIFO batch:31
<7>  Normal zone: 0 pages, LIFO batch:1
<7>  HighMem zone: 0 pages, LIFO batch:1
Before resource_init
After resource_init
Built 1 zonelists
<5>Kernel command line: root=/dev/romblock21 rootfstype=cramfs mem=80M rw console=ttyS0,115200
before init RAC 0x02a00000	0x00000000
after init RAC 0x02a0000f	0x0fff0000
Primary instruction cache 32kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, linesize 16 bytes.
MIPS_CACHE_ALIASES = ON
end of ld_mmu_r4xx0
end of local_tlb_init
Wired: 17
Index:  0 pgmask=16Mb va=d0000000 asid=00
			[pa=d0000000 c=2 d=1 v=1 g=1]
			[pa=d1000000 c=2 d=1 v=1 g=1]

Index:  1 pgmask=16Mb va=d2000000 asid=00
			[pa=d2000000 c=2 d=1 v=1 g=1]
			[pa=d3000000 c=2 d=1 v=1 g=1]

Index:  2 pgmask=16Mb va=d4000000 asid=00
			[pa=d4000000 c=2 d=1 v=1 g=1]
			[pa=d5000000 c=2 d=1 v=1 g=1]

Index:  3 pgmask=16Mb va=d6000000 asid=00
			[pa=d6000000 c=2 d=1 v=1 g=1]
			[pa=d7000000 c=2 d=1 v=1 g=1]

Index:  4 pgmask=16Mb va=d8000000 asid=00
			[pa=d8000000 c=2 d=1 v=1 g=1]
			[pa=d9000000 c=2 d=1 v=1 g=1]

Index:  5 pgmask=16Mb va=da000000 asid=00
			[pa=da000000 c=2 d=1 v=1 g=1]
			[pa=db000000 c=2 d=1 v=1 g=1]

Index:  6 pgmask=16Mb va=dc000000 asid=00
			[pa=dc000000 c=2 d=1 v=1 g=1]
			[pa=dd000000 c=2 d=1 v=1 g=1]

Index:  7 pgmask=16Mb va=de000000 asid=00
			[pa=de000000 c=2 d=1 v=1 g=1]
			[pa=df000000 c=2 d=1 v=1 g=1]

Index:  8 pgmask=16Mb va=e0000000 asid=00
			[pa=e0000000 c=2 d=1 v=1 g=1]
			[pa=e1000000 c=2 d=1 v=1 g=1]

Index:  9 pgmask=16Mb va=e2000000 asid=00
			[pa=e2000000 c=2 d=1 v=1 g=1]
			[pa=e3000000 c=2 d=1 v=1 g=1]

Index: 10 pgmask=16Mb va=e4000000 asid=00
			[pa=e4000000 c=2 d=1 v=1 g=1]
			[pa=e5000000 c=2 d=1 v=1 g=1]

Index: 11 pgmask=16Mb va=e6000000 asid=00
			[pa=e6000000 c=2 d=1 v=1 g=1]
			[pa=e7000000 c=2 d=1 v=1 g=1]

Index: 12 pgmask=16Mb va=e8000000 asid=00
			[pa=e8000000 c=2 d=1 v=1 g=1]
			[pa=e9000000 c=2 d=1 v=1 g=1]

Index: 13 pgmask=16Mb va=ea000000 asid=00
			[pa=ea000000 c=2 d=1 v=1 g=1]
			[pa=eb000000 c=2 d=1 v=1 g=1]

Index: 14 pgmask=16Mb va=ec000000 asid=00
			[pa=ec000000 c=2 d=1 v=1 g=1]
			[pa=ed000000 c=2 d=1 v=1 g=1]

Index: 15 pgmask=16Mb va=ee000000 asid=00
			[pa=ee000000 c=2 d=1 v=1 g=1]
			[pa=ef000000 c=2 d=1 v=1 g=1]

Index: 16 pgmask=16Mb va=f0000000 asid=00
			[pa=f0000000 c=2 d=1 v=1 g=1]
			[pa=f1000000 c=2 d=1 v=1 g=1]

$$$$$$$$$$ 1394 dev id ffffffff
$$$$$$$$$$ mini slot dev id ffffffff
$$$$$$$$$$ external dev id ffffffff
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
timer irq 67 end 57
PID hash table entries: 2048 (order: 11, 32768 bytes)
mips_counter_frequency = 148000000 from Calibration, = 148500000 from header(CPU_MHz/2)
Using 148.501 MHz high precision timer.
Console: colour dummy device 80x25
################## brcm_serial_console_init, sercon=802e2f60
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
free_all_bootmem_core: Free allocator bitmap
Memory: 75908k/262144k available (2649k kernel code, 186096k reserved, 458k data, 132k init, 0k highmem)
Mount-cache hash table entries: 512
get_RSVD_size: Returning Size 0x0b000000
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
JFFS2 version 2.2. (NAND) (C) 2001-2003 Red Hat, Inc.
yaffs Jul 11 2008 20:44:44 Installing. 
Broadcom serial driver version 1.00 (2000-11-09) with no serial options enabled
Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 1 ports, IRQ sharing disabled
ttyS0 at MMIO 0x0 (irq = 66) is a 16550A
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered
loop: loaded (max 8 devices)
Broadcom BCM740121 Ethernet Network Device v1.0 Jul 11 2008 20:45:31
: MAC Address: 00:0E:09:96:88:A1
SUNDRY revision = 74010021, have IP Hdr Opt=1
init_buffers: 104 descriptors initialized
init_buffers: 00000068 descriptors initialized, from flowctl
BCMINTMAC: 10 MB Half-Duplex (assumed)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
Broadcom STB NAND controller (BrcmNand Controller)
brcmnand_probe: CS1: dev_id=ecf10095
NAND Config: Reg=55042200, chipSize=128MB, blockSize=128K, erase_shift=11
busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
timing1 not adjusted: 5363444f
timing2 not adjusted: 00000fc6
BrcmNAND mfg ec f1 Samsung K9F1G08U0A 128MB

Found NAND: ACC=c3000000, cfg=55042200, flashId=ecf10095, tim1=5363444f, tim2=00000fc6
BrcmNAND version = 0x0001 128MB @00000000
Found NAND chip on Chip Select 1, chipSize=128MB, usable size=112MB, base=11000000
ACC_CONTROL B4: c3000000
ACC_CONTROL after: e3000000
page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
Brcm NAND controller version = 0.1 NAND flash size 128MB @11000000
Rescanning .....
----- Contents of BBT -----
Bad block at 02360000
Bad block at 04500000
Bad block at 04780000
Bad block at 05340000
Bad block at 05660000
Bad block at 063a0000
----- END Contents of BBT -----
	numchips=1, size=07000000
Creating 25 MTD partitions on "bcm7xxx-nand.0":
0x00000000-0x00060000 : "SYSCFG"
0x00060000-0x000c0000 : "MANUINFO"
0x000c0000-0x00120000 : "HDCPKEY"
0x00120000-0x00180000 : "USERCFG"
0x00180000-0x001e0000 : "ISPCFG"
0x001e0000-0x00240000 : "SYSCFGBAK"
0x00240000-0x002a0000 : "MANUINFOBAK"
0x002a0000-0x00300000 : "HDCPKEYBAK"
0x00300000-0x00360000 : "USERCFGDEF"
0x00360000-0x003c0000 : "ISPCFGDEF"
0x003c0000-0x00420000 : "RESERVEDA"
0x00420000-0x00480000 : "RESERVEDABAK"
0x00480000-0x00500000 : "RESERVEDB"
0x00500000-0x00580000 : "RESERVEDBBAK"
0x00580000-0x00780000 : "LOGO"
0x00780000-0x00980000 : "LOGOBAK"
0x00980000-0x00a00000 : "SWAP"
0x00a00000-0x02a00000 : "FILEJFFS"
0x02a00000-0x02f00000 : "APPKNL"
0x02f00000-0x04600000 : "APPROOTFS"
0x04600000-0x04b00000 : "SAFEKNL"
0x04b00000-0x06200000 : "SAFEROOTFS"
0x06200000-0x06201000 : "DEBUG"
mtd: partition "DEBUG" doesn't end on an erase block -- force read-only
0x06201000-0x06300000 : "NVM"
mtd: partition "NVM" doesn't start on an erase block boundary -- force read-only
0x06300000-0x06400000 : "BBT"
ehci_hcd_brcm_init: Initializing 1 EHCI devices
10 Dec 2004 USB 2.0 'Enhanced' Host Controller (EHCI) Driver (EHCI-brcm-0)
drivers/usb/host/ehci-brcm.c: starting brcm EHCI USB Controller
 - USB h/w setup mode <N>
 - USB power enable set for active HIGH mode
 - Resetting at b0480310
<-- brcm_ehci_hw_init
brcm-ehci brcm-ehci.0: BRCM EHCI
brcm-ehci brcm-ehci.0: new USB bus registered, assigned bus number 1
brcm-ehci brcm-ehci.0: irq 62, io mem 0x10480300
brcm-ehci brcm-ehci.0: park 0
brcm-ehci brcm-ehci.0: USB 0.0 initialized, EHCI 1.00, driver 10 Dec 2004
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
2004 Nov 08 USB 1.1 'Open' Host Controller (OHCI) Driver (OHCI-brcm-0)
drivers/usb/host/ohci-brcm.c: starting brcm OHCI USB Controller
 - Resetting at b0480408
<-- brcm_start_hc
brcm-ohci-0 brcm-ohci-0.0: BRCM OHCI
brcm-ohci-0 brcm-ohci-0.0: new USB bus registered, assigned bus number 2
brcm-ohci-0 brcm-ohci-0.0: irq 63, io mem 0x10480400
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
usbcore: registered new driver usbhid
drivers/usb/input/hid-core.c: v2.01:USB HID core driver
pegasus: v0.6.13 (2005/11/13), Pegasus/Pegasus II USB Ethernet driver
usbcore: registered new driver pegasus
drivers/usb/net/rtl8150.c: rtl8150 based usb-ethernet driver v0.6.2 (2004/08/27)
usbcore: registered new driver rtl8150
usbcore: registered new driver asix
NET: Registered protocol family 2
IP: routing cache hash table of 2048 buckets, 16Kbytes
TCP established hash table entries: 16384 (order: 5, 131072 bytes)
TCP bind hash table entries: 16384 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 16384 bind 16384)
NET: Registered protocol family 1
NET: Registered protocol family 17
VFS: Mounted root (cramfs filesystem) readonly.
free_initmem: init_begin=8030b000, init_end=8032c000
Freeing unused kernel memory: 132k freed
Algorithmics/MIPS FPU Emulator v1.5
Restore RW directories
grep: /proc/mounts: No such file or directory
mountType=
mount -nt tmpfs -o size=512k,mode=777 /tmpfsvar.img /var
Mount /proc fs
Mount /dev/pts
ln: /etc/mtab: File exists
Cleaning up utmp and wtmp
Configure Network interface
/etc/init.d/rcS: /proc/sys/net/ipv4/conf/eth0/force_igmp_version: No such file or directory
start services
telnetd: starting
  port: 9911; interface: any; login program: /bin/login
start user services
bcmdriver: module license 'Proprietary' taints kernel.
Initializing bcmdriver version $ 9 $
MCK - Using Interrupt Definition for 7402c0-nand (uname -a)
chipConfigs[19].maxNumIrq = 65
Global Interrupt Mask Low: 0xD15F7FFF, High: 0x1C0C11D3
Initialization complete...
&&&&&&&&&&&&&&&&&&&&&MainControl's pid is : 41
[basemodules/csip/osporting/src/linux/csip_sem.c :0194]:[level-0] semget - No such file or directory 
Start init Jul 11 2008
-----------------------------Init envioment-----------------------------
--0--enviorment_init----Flash init ok 
[csip_System_Init] success! 
[csip_System_Init] tHeapMem.unOffset:     05000000, tHeapMem.pAddr: 0x2ac3c000, tHeapMem.unSize: 03000000
[csip_System_Init] tHeapMem.unOffset:     05000000, tHeapMem.pAddrCached: 0x2dc3c000, tHeapMem.unSize: 03000000
[csip_System_Init] tRegMem.unOffset:     10000000, tRegMem.pAddr: 0x30c3c000, tRegMem.unSize: 00B00000
BI2C_SaveI2cRegHandle   is =f66310  
[csip_Bsp_Init] sucess! 
Using realtime priority for the ISR handlerisr_task started
[CSIP_BRD_Init] success! 
--1--enviorment_init----Borad init ok!
[CSIP_VDIS_Init] success! 
--2--enviorment_init----Display init ok!
--3--enviorment_init----Graphics init ok!
--4--enviorment_init----Demux init ok!
[CSIP_VDEC_Init] BXVD_Open success! HXvd = 0x00f844f0 
[CSIP_VDEC_Init] success! 
--5--enviorment_init----Video decoder init ok!
--6--enviorment_init----Audio output nit ok!
--7--enviorment_init----Audio decoder init ok!

****************SD Graphics*****************************
         paletteNum = 0
         paletteMode = 5
         width =716
         height=566
         unbpp = 32
         stride = 2864

*********************end*****************************
[CSIP_VDIS_OpenDisplay] BVDC_Compositor_Create success! hVdcCompositors_0  = 0x00f68070 
[CSIP_VDIS_OpenDisplay] BVDC_Display_Create success! hVdcDisplays_0  = 0x00f6cb08 
[CSIP_VDIS_OpenDisplay] success! pDisplayHandle = 0x00f3b920 
[CSIP_VDIS_OpenWindow] BVDC_Source_Create Gfx success! hVdcSource_0 = 0x00f72e08 
[CSIP_VDIS_OpenWindow] BVDC_Window_Create Gfx success! hVdcWindow_0 = 0x00f6b128 
[CSIP_VDIS_OpenWindow] success! pWindowHandle = 0x00f3ba24 
[CSIP_VDIS_SetWinSrc] success! hWindowHandle = 0x00f3ba24 
[CSIP_VDIS_SetWinAlpha] success! ucAlpha = 0xff 
[CSIP_DMX_OpenChannel] a/v channelID = 0.
[CSIP_DMX_OpenChannel] pcr channelID = 1
[CSIP_DMX_OpenChannel] a/v channelID = 2.
[CSIP_VDEC_OpenDecoder] BXVD_OpenChannel success! hXvdChannel = 0x00f88be8 
[CSIP_VDEC_OpenDecoder] csip_DMX_GetHandleInfo success!
[CSIP_VDEC_OpenDecoder] BXPT_Rave_AllocContext success! hRaveContext_0 = 0x00f83788 
[CSIP_VDEC_OpenDecoder] BXPT_Rave_AllocContext success! hRaveContext_1 = 0x00f837cc 
[CSIP_VDEC_OpenDecoder] BXPT_Rave_AllocContext success! hRaveContext_2 = 0x00f83810 
[CSIP_VDEC_OpenDecoder] success! hDecoderHandle =  0x00bb72d8 
[CSIP_VDIS_OpenWindow] BVDC_Source_Create video decoder success! hVdcSource = 0x00f70ad8 
[CSIP_VDIS_OpenWindow] BVDC_Window_Create success! hVdcWindows_0  = 0x00f68b88 
[CSIP_VDIS_OpenWindow] success! pWindowHandle = 0x00f3b92c 
[CSIP_VDIS_SetWinSrc] csip_VDEC_GetHandleInfo success! hDecoderHandle = 0x00bb72d8,  XvdChannelHandle = 0x00f88be8 
[CSIP_VDIS_SetWinSrc] BXVD_InstallInterruptCallback success!
[CSIP_VDIS_SetWinSrc] success! hWindowHandle = 0x00f3b92c 
[CSIP_ADEC_OpenDecoder] success! pDecoderHandle = 0xf85800
[CSIP_AOUT_OpenDevice] success! pOutputHandle = 0xf856c0
[CSIP_OpenChip] CSIP_AOUT_OpenDevice hAudioOutput is 
Add output port hdmi to decoder channel.
Unable to Read EDID. going on...
No DVI/HDMI Rx Device Available.
[CSIP_HDMI_Open]success! pHDMIHandle = 0xf8c748 
[CSIP_OpenChip] Success! 
--8--enviorment_init----Open devices init ok!
-----------------------------Init envioment end------------------------
nRet is 0

[basemodules/csip/public/datamanager/src/csip_data_mgr.c :1932]:[level-0] [CSIP_DM_AddOption]  option has existed 

[basemodules/csip/public/datamanager/src/csip_data_mgr.c :1932]:[level-0] [CSIP_DM_AddOption]  option has existed 

[basemodules/csip/public/datamanager/src/csip_data_mgr.c :1932]:[level-0] [CSIP_DM_AddOption]  option has existed 

[basemodules/csip/public/datamanager/src/csip_data_mgr.c :1932]:[level-0] [CSIP_DM_AddOption]  option has existed 

[basemodules/csip/public/datamanager/src/csip_data_mgr.c :1932]:[level-0] [CSIP_DM_AddOption]  option has existed 

nRet is 0

/root/S21_start: apps/streaming21/src/base_porting/csip_data.c: 336: CSIP_APP_DM_Open: Assertion `nRet == 0' failed.
/root/rc.user: line 9:    41 Aborted                 /root/S21_st
(none) login:


CFE

BCM97401 
AB
1s
K1
K2

K3

K4

K5
00000007 00000014 00000017 0000003A 0000000F 00000027 0000000F 00000014 0000000F 0000003A 00000027 00000007 00000027 00000017 00000027 0000000F 00000010 00000026 2
Copy Code...UCF34TUCV


Common Firmware Environment (CFE) version 1.1 for BCM97401C1, (Little Endian Mode)
Build Date: Tue Dec 11 09:50:58     2007 (901419@fengbin)
Copyright (C) 2000-2007 Broadcom Corporation.

Initializing Arena.
Initializing Devices.

FLASH CHECKSUM FAILED.
INVALID FLASH IMAGE
Wrong board type (0xFFFFFF).
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
X  MAC ADDRESS NOT SET, Use Command macprog Set And Restart  X
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
CPU speed: 297MHz
Total memory: 0x8000000 bytes (128MB)

Total memory used by CFE:  0x87000000 - 0x870AF5D4 (718292)
Initialized Data:          0x870A3F10 - 0x870A63A8 (9368)
BSS Area:                  0x870A63A8 - 0x870AF5D4 (37420)
Local Heap:                0x870AF654 - 0x8B0AF654 (67108864)
Stack Area:                0x8B0AF654 - 0x8B0B1654 (8192)
Text (code) segment:       0x87000000 - 0x87028FC4 (167876)

[csip_osd_init] start ! 
[csip_osd_init] CSIP_BRD_Init sucess ! 
[csip_osd_init] CSIP_Booter_Display_Open sucess ! 
[csip_osd_init] CSIP_Booter_OSD_Init sucess ! 
[csip_osd_init] CSIP_Booter_OSD_CreateRegion sucess ! 

Booter Code Star...
CFE> ^C
CFE> help
Available commands:

set console         Change the active console device
loop                Loop a command
copydisk            Copy a remote disk image to a local disk device via TFTP
test fatfs          Do a FAT file system test
macprog             Program MAC addresses.
flash               Update a flash memory device
memtest             Test memory.
f                   Fill contents of memory.
e                   Modify contents of memory.
d                   Dump memory.
u                   Disassemble instructions.
autoboot            Automatic system bootstrap.
batch               Load a batch file into memory and execute it
go                  Start a previously loaded program.
boot                Load an executable file into memory and execute it
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
ping                Ping a remote IP host.
arp                 Display or modify the ARP Table
ifconfig            Configure the Ethernet interface
show boot           Display boot block from device,
show heap           Display information about CFE's heap
show memory         Display the system physical memory map.
show devices        Display information about the installed devices.
unsetenv            Delete an environment variable.
printenv            Display the environment variables
setenv              Set an environment variable.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0
CFE> show devices
Device Name          Description
-------------------  ---------------------------------------------------------
              uart0  BCM97XXX DUART at 0xB04001A0 channel 0
         flash0.ALL  New CFI flash at 1E000000 offset 00000000 size 2048KB
      flash0.SYSCFG  New NAND flash at 11000000 offset 00000000 size 384KB
    flash0.MANUINFO  New NAND flash at 11000000 offset 00060000 size 384KB
     flash0.HDCPKEY  New NAND flash at 11000000 offset 000C0000 size 384KB
     flash0.USERCFG  New NAND flash at 11000000 offset 00120000 size 384KB
      flash0.ISPCFG  New NAND flash at 11000000 offset 00180000 size 384KB
   flash0.SYSCFGBAK  New NAND flash at 11000000 offset 001E0000 size 384KB
 flash0.MANUINFOBAK  New NAND flash at 11000000 offset 00240000 size 384KB
  flash0.HDCPKEYBAK  New NAND flash at 11000000 offset 002A0000 size 384KB
  flash0.USERCFGDEF  New NAND flash at 11000000 offset 00300000 size 384KB
   flash0.ISPCFGDEF  New NAND flash at 11000000 offset 00360000 size 384KB
   flash0.RESERVEDA  New NAND flash at 11000000 offset 003C0000 size 384KB
flash0.RESERVEDABAK  New NAND flash at 11000000 offset 00420000 size 384KB
   flash0.RESERVEDB  New NAND flash at 11000000 offset 00480000 size 512KB
flash0.RESERVEDBBAK  New NAND flash at 11000000 offset 00500000 size 512KB
        flash0.LOGO  New NAND flash at 11000000 offset 00580000 size 2048KB
     flash0.LOGOBAK  New NAND flash at 11000000 offset 00780000 size 2048KB
        flash0.SWAP  New NAND flash at 11000000 offset 00980000 size 512KB
    flash0.FILEJFFS  New NAND flash at 11000000 offset 00A00000 size 32768KB
      flash0.APPKNL  New NAND flash at 11000000 offset 02A00000 size 5120KB
   flash0.APPROOTFS  New NAND flash at 11000000 offset 02F00000 size 23552KB
     flash0.SAFEKNL  New NAND flash at 11000000 offset 04600000 size 5120KB
  flash0.SAFEROOTFS  New NAND flash at 11000000 offset 04B00000 size 23552KB
       flash0.DEBUG  New NAND flash at 11000000 offset 06200000 size 4KB
         flash0.NVM  New NAND flash at 11000000 offset 06201000 size 1020KB
         flash0.BBT  New NAND flash at 11000000 offset 06300000 size 1024KB
*** command status = 0
CFE> show memory
Range Start  Range End    Range Size     Description
------------ ------------ -------------- --------------------
000000000000-000006FFFFFF (000007000000) DRAM (available)
0000070B0000-000007FFFFFF (000000F50000) DRAM (available)
*** command status = 0


登录机顶盒

机顶盒开启了telnetd服务,端口号:9911,登录用户名:tingt,不需要密码。


(none) login: tingt

#
# pwd
/root
#
# ls -al
-rwxrwxrwx    1 1012     root           15 Jan  1  1970 .bash_history
-rw-r--r--    1 1012     root        19200 Jan  1  1970 LinkDown.bin
-rwxr-xr-x    1 root     root      8005092 Jan  1  1970 S21_start
-rw-r--r--    1 root     root        54082 Jan  1  1970 bcmdriver.ko
-rwxrwxrwx    1 1012     root       167440 Jan  1  1970 buf.bin
-rw-r--r--    1 1012     root        10800 Jan  1  1970 channel.bin
-rwxr-xr-x    1 root     root       142683 Jan  1  1970 iwconfig
-rwxr-xr-x    1 root     root       142898 Jan  1  1970 iwlist
-rwxr-xr-x    1 root     root       129403 Jan  1  1970 iwpriv
drwxr-xr-x    1 1012     246          2112 Jan  1  1970 js
-rwxrwxrwx    1 1012     root         6742 Jan  1  1970 kill
lrwxrwxrwx    1 1012     root           13 Jan  1  1970 libgcc_s.so -> libgcc_s.so.1
-rwxrwxrwx    1 1012     root        64248 Jan  1  1970 libgcc_s.so.1
lrwxrwxrwx    1 1012     root           18 Jan  1  1970 libstdc++.so -> libstdc++.so.6.0.3
lrwxrwxrwx    1 1012     root           18 Jan  1  1970 libstdc++.so.6 -> libstdc++.so.6.0.3
-rwxrwxrwx    1 1012     root       603832 Jan  1  1970 libstdc++.so.6.0.3
-rwxrwxrwx    1 1012     244          4000 Jan  1  1970 null.bin
-rwxr--r--    1 1012     246          4000 Jan  1  1970 num0.bin
-rwxr--r--    1 1012     246          4000 Jan  1  1970 num1.bin
-rwxr--r--    1 1012     246          4000 Jan  1  1970 num2.bin
-rwxr--r--    1 1012     246          4000 Jan  1  1970 num3.bin
-rwxr--r--    1 1012     246          4000 Jan  1  1970 num4.bin
-rwxr--r--    1 1012     246          4000 Jan  1  1970 num5.bin
-rwxr--r--    1 1012     246          4000 Jan  1  1970 num6.bin
-rwxr--r--    1 1012     246          4000 Jan  1  1970 num7.bin
-rwxr--r--    1 1012     246          4000 Jan  1  1970 num8.bin
-rwxr--r--    1 1012     246          4000 Jan  1  1970 num9.bin
-rwxr-xr-x    1 root     root       279124 Jan  1  1970 pppd
-rwxr--r--    1 1012     246           155 Jan  1  1970 rc.user
-rwxr-xr-x    1 root     root        32759 Jan  1  1970 rp-pppoe.so
-rwxr--r--    1 1012     users        3494 Jan  1  1970 setting.htm
-rw-r--r--    1 1012     root      1375584 Jan  1  1970 start.bin
drwxr-xr-x    1 1012     root          812 Jan  1  1970 ui
-rwxr-xr-x    1 root     root       254257 Jan  1  1970 wpa_supplicant
-rw-r--r--    1 root     root       422179 Jan  1  1970 zd1211b.ko
#


# ps
  PID PORT STAT SIZE SHARED %CPU COMMAND
    1      S      0K     0K  0.2 init
    2      S      0K     0K  0.0 ksoftirqd/0
    3      S      0K     0K  0.0 events/0
    4      S      0K     0K  0.0 khelper
    5      S      0K     0K  0.0 kthread
    6      S      0K     0K  0.0 kblockd/0
    8      S      0K     0K  0.0 pdflush
    7      S      0K     0K  0.0 khubd
    9      S      0K     0K  0.0 pdflush
   11      S      0K     0K  0.0 aio/0
   10      S      0K     0K  0.0 kswapd0
   12      S      0K     0K  0.6 bcmemacd
   13      S      0K     0K  0.0 mtdblockd
   14      S      0K     0K  0.2 romblockd
   15      S      0K     0K  0.0 pegasus
   17   S0 S      0K     0K  0.0 init
   18   S0 S      0K     0K  0.0 /bin/sh /etc/init.d/rcS
   25      S      0K     0K  0.0 loop0
   35   S0 S      0K     0K  0.0 portmap
   37      Z      0K     0K  0.0 utelnetd
   38      S      0K     0K  0.0 utelnetd -d -p 9911
   40   S0 S      0K     0K  0.0 /bin/sh /root/rc.user
   42   S0 S      0K     0K  0.2 /root/S21_start
   43   S0 S      0K     0K  0.0 /root/S21_start
   44   S0 S      0K     0K  0.0 /root/S21_start
   45   S0 S      0K     0K  0.0 /root/S21_start
   46   S0 S      0K     0K  0.0 /root/S21_start
   47   S0 S      0K     0K  4.4 /root/S21_start
   48   S0 S      0K     0K  0.0 /root/S21_start
   49   S0 S      0K     0K  0.0 /root/S21_start
   50   S0 S      0K     0K  0.0 /root/S21_start
   51   S0 S      0K     0K  0.1 /root/S21_start
   52   S0 S      0K     0K  0.0 /root/S21_start
   53   S0 S      0K     0K  3.0 /root/S21_start
   57   S0 S      0K     0K  0.0 /root/S21_start
   60   S0 R      0K     0K  0.0 /root/S21_start
   67   S0 S      0K     0K  0.5 /root/S21_start
   68   S0 S      0K     0K  0.2 /root/S21_start
   69      S      0K     0K  0.0 -sh
   79      R      0K     0K  0.0 ps
#


# cat cpuinfo
system type             : BCM97xxx Settop Platform
processor               : 0
cpu model               : Brcm7401 V0.0
cpu MHz                 : 295.93
BogoMIPS                : 295.93    ( udelay_val : 147968  HZ = 1000 )
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : no
ASEs implemented        :
VCED exceptions         : not available
VCEI exceptions         : not available
RAC setting             : I/D-RAC enabled
unaligned access        : 2


# cat mtd
dev:    size   erasesize  name
mtd0: 00060000 00020000 "SYSCFG"
mtd1: 00060000 00020000 "MANUINFO"
mtd2: 00060000 00020000 "HDCPKEY"
mtd3: 00060000 00020000 "USERCFG"
mtd4: 00060000 00020000 "ISPCFG"
mtd5: 00060000 00020000 "SYSCFGBAK"
mtd6: 00060000 00020000 "MANUINFOBAK"
mtd7: 00060000 00020000 "HDCPKEYBAK"
mtd8: 00060000 00020000 "USERCFGDEF"
mtd9: 00060000 00020000 "ISPCFGDEF"
mtd10: 00060000 00020000 "RESERVEDA"
mtd11: 00060000 00020000 "RESERVEDABAK"
mtd12: 00080000 00020000 "RESERVEDB"
mtd13: 00080000 00020000 "RESERVEDBBAK"
mtd14: 00200000 00020000 "LOGO"
mtd15: 00200000 00020000 "LOGOBAK"
mtd16: 00080000 00020000 "SWAP"
mtd17: 02000000 00020000 "FILEJFFS"
mtd18: 00500000 00020000 "APPKNL"
mtd19: 01700000 00020000 "APPROOTFS"
mtd20: 00500000 00020000 "SAFEKNL"
mtd21: 01700000 00020000 "SAFEROOTFS"
mtd22: 00001000 00020000 "DEBUG"
mtd23: 000ff000 00020000 "NVM"
mtd24: 00100000 00020000 "BBT"

CFE写Flash

首先用mkflashimage工具在需要写入的数据前加入BoardName和CRC信息。

mkflashimage -B BCM97401C1 mtd0.bin mtd0.flash

然后用objcopy工具将二进制数据转换成S-Record格式。

sb1-elf-objcopy -I binary -O srec mtd0.flash mtd0.srec

在CFE中用Flash命令写入数据。

通过串口写Flash

flash –offset=0x0 –size=0x60000 uart0 flash0.NAND

或

flash –offset=0x0 –size=0x60000 uart0 flash0.SYSCFG


通过tftp写Flash(首先要使用macprog设置MAC地址)

ifconfig eth0 -auto
flash -noheader -offset=0x0 -size=0x60000 192.168.1.100:mtd0.flash flash0.SYSCFG


把Flash中的内容保存到tftp的命令:

save 192.168.0.230:cfe.bin 1FC00000 200000

SYSCFG分析

53 41 46 45 4B 4E 4C 00 00 00 00 00 00 00 00 00
--------------------
SAFEKNL
MTD名称,共24字节

00 00 00 00 00 00 00 00 54 00 00 00 01 00 00 00
                        -----------
                       数据部分长度 

00 00 60 04 00 00 50 00 30 30 31 2E 30 31 37 2E
----------- ----------- -----------------------           
0004600000   00500000   001.017.
Flash Offset MTD Size   版本号

30 30 30 00 00 00 00 00 00 00 00 00 4A 2B 18 00
--------                            -----------
000                                 0x00182B4A
                                    有效长度

00 20 00 00 04 00 00 00 00 00 00 00 5D 22 4F 7E 
                                    ----------- 
                                    CheckSum
00 00 00 00 53 41 46 45 4B 4E 4C 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


内核Hacking

首先从kernel.org下载linux-2.6.12的标准版本,下载地址: ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-2.6.12.tar.bz2

再下载Broadcom stblinux补丁,下载地址:http://sources.dreamboxupdate.com/download/kernel-patches/linux-2.6.12-brcm-5.1.patch.bz2

解压linux-2.6.12.tar.bz2,再打补丁,然后把linux-2.6.12换名称stblinux-2.6.12。

修改stblinux-2.6.12/drivers/mtd/brcmnand/bcm7xxx-nand.c

static struct mtd_partition bcm7XXX_nand_parts[] =
{
        { name: "SYSCFG",       offset: 0x00000000,     size: 0x60000 },
        { name: "MANUINFO",     offset: 0x00060000,     size: 0x60000 },
        { name: "HDCPKEY",      offset: 0x000C0000,     size: 0x60000 },
        { name: "USERCFG",      offset: 0x00120000,     size: 0x60000 },
        { name: "ISPCFG",       offset: 0x00180000,     size: 0x60000 },
        { name: "SYSCFGBAK",    offset: 0x001E0000,     size: 0x60000 },
        { name: "MANUINFOBAK",  offset: 0x00240000,     size: 0x60000 },
        { name: "HDCPKEYBAK",   offset: 0x002A0000,     size: 0x60000 },
        { name: "USERCFGDEF",   offset: 0x00300000,     size: 0x60000 },
        { name: "ISPCFGDEF",    offset: 0x00360000,     size: 0x60000 },
        { name: "RESERVEDA",    offset: 0x003C0000,     size: 0x60000 },
        { name: "RESERVEDABAK", offset: 0x00420000,     size: 0x60000 },
        { name: "RESERVEDB",    offset: 0x00480000,     size: 0x80000 },
        { name: "RESERVEDBBAK", offset: 0x00500000,     size: 0x80000 },
        { name: "LOGO",         offset: 0x00580000,     size: 0x200000 },
        { name: "LOGOBAK",      offset: 0x00780000,     size: 0x200000 },
        { name: "SWAP",         offset: 0x00980000,     size: 0x80000 },
        { name: "FILEJFFS",     offset: 0x00A00000,     size: 0x02000000 },
        { name: "APPKNL",       offset: 0x02A00000,     size: 0x00500000 },
        { name: "APPROOTFS",    offset: 0x02F00000,     size: 0x01700000 },
        { name: "SAFEKNL",      offset: 0x04600000,     size: 0x00500000 },
        { name: "SAFEROOTFS",   offset: 0x04B00000,     size: 0x01700000 },
        { name: "DEBUG",        offset: 0x06200000,     size: 0x00001000 },
        { name: "NVM",          offset: 0x06201000,     size: 0x000FF000 },
        { name: "BBT",          offset: 0x06300000,     size: 0x00100000 }
        /* BBT 1MB not mountable by anyone */
};

修改include/linux/mtd/mtd.h,把MAX_MTD_DEVICES从16增加到24

#define MAX_MTD_DEVICES 24

CFE界面加载tftp服务器上的内核

ifconfig eth0 -auto
boot -z -elf -addr=0x80001000 192.168.3.200:/vmlinuz

内核引导参数

CONFIG_CMDLINE="root=/dev/nfs rw nfsroot=192.168.3.200:/home/share/nfs_root ip=dhcp rw mem=128M console=ttyS0,115200"

Telnet登录

telnet 机顶盒IP地址 9911
用户名:tingt
密码:无

导出机顶盒中各MTD分区的内容

tftp -p -l /dev/mtdblock0 -r mtdblock0.bin TFTP服务器地址

相关链接

Broadcom CFE

[1]

[2]

[3]

[4]