[原创]BroadCom 6338 芯片 固件的初步研究

hugebird

报告大家一个好消息， 通过JTAG Cable, 上海贝尔的这个BCM96338已经刷成Dynalink RTA1335， 还没有进行测试。先上载一段Log文件，大家先看看。
准备写个教程，需要大家动手做一快RS232电平转换板和一条JTAG电缆。
另外需要一些工具，

CFE version 1.0.37-0.6.7 for BCM96338 (32bit,SP,BE)
Build Date: Thu Aug  3 17:27:19 CST 2006 (michaelc)
Flash Config: CS0(1fc00008,1f),Base(bfc00000),Size(2MB)
Ethernet Network Device: External PHY
bank 0 invalid
** Image information not found. **

*** Board is not initialized properly ***
Press:  <enter> to use current value
Board Id Name (A-H)
RTA1320          -------- A
RTA1320B         -------- B
RTA1320_16M      -------- C
RTA1320B_16M     -------- D
RTA1330          -------- E
V210             -------- F
V210_BB          -------- G
V190_AOL         -------- H     :[]:
CFE version 1.0.37-0.6.7 for BCM96338 (32bit,SP,BE)
Build Date: Thu Aug  3 17:27:19 CST 2006 (michaelc)
Flash Config: CS0(1fc00008,1f),Base(bfc00000),Size(2MB)
Ethernet Network Device: External PHY
bank 0 invalid
** Image information not found. **

*** Board is not initialized properly ***
Press:  <enter> to use current value
Board Id Name (A-H)
RTA1320          -------- A
RTA1320B         -------- B
RTA1320_16M      -------- C
RTA1320B_16M     -------- D
RTA1330          -------- E
V210             -------- F
V210_BB          -------- G
V190_AOL         -------- H     :[]:a
Invalid board id;  Try again!
Board Id Name (A-H)
RTA1320          -------- A
RTA1320B         -------- B
RTA1320_16M      -------- C
RTA1320B_16M     -------- D
RTA1330          -------- E
V210             -------- F
V210_BB          -------- G
V190_AOL         -------- H     :[]:b
Invalid board id;  Try again!
Board Id Name (A-H)
RTA1320          -------- A
RTA1320B         -------- B
RTA1320_16M      -------- C
RTA1320B_16M     -------- D
RTA1330          -------- E
V210             -------- F
V210_BB          -------- G
V190_AOL         -------- H     :[]:A
Number of MAC Addresses (1-32)  :[0]:  11
Ethernet MAC Address            :[]:00:74:04:e4:38:1a
Save and Exit  (y/n):y
Save your new configuration to nvram........done
Press any key to reset the board:
CFE version 1.0.37-0.6.7 for BCM96338 (32bit,SP,BE)
Build Date: Thu Aug  3 17:27:19 CST 2006 (michaelc)
Flash Config: CS0(1fc00008,1f),Base(bfc00000),Size(2MB)
Ethernet Network Device: External PHY
bank 0 invalid
** Image information not found. **

Board IP address                : 192.168.1.1  
Host IP address                 : 192.168.1.2  
Gateway IP address              :   
Run from flash/host (f/h)       : f  
Default host run file name      :   
Default host flash file name    : bcmModelName_fs_kernel  
Boot delay (1-9 seconds)        : 1  
Board Id Name                   : RTA1320  
Psi size in KB                  : 24
Number of MAC Addresses (1-32)  : 11  
Ethernet MAC Address            : 00:74:04:e4:38:1a  
Memory size in MB               : 8
CFE> c
Press:  <enter> to use current value
Board IP address                :[192.168.1.1]:  
Host IP address                 :[192.168.1.2]:  192.168.1.10
Gateway IP address              :[]:
Run from flash/host (f/h)       :[f]:  h
Default host run file name      :[]:
Default host flash file name    :[bcmModelName_fs_kernel]:  bcm96xxx_fs_kernal
Boot delay (1-9 seconds)        :[1]:  5
*** command status = 0
CFE> c
Press:  <enter> to use current value
Board IP address                :[192.168.1.1]:  
Host IP address                 :[192.168.1.10]:  
Gateway IP address              :[]:
Run from flash/host (f/h)       :[h]:  
Default host run file name      :[]:
Default host flash file name    :[bcm96xxx_fs_kernal]:  bcm96xxx_fs_kernel
Boot delay (1-9 seconds)        :[5]:  
*** command status = 0
CFE> f
Loading 192.168.1.10:bcm96xxx_fs_kernel ...
Finished loading 1864654 bytes
Flashing CFE: ....

Flashing root file system and kernel: ............................
Resetting board...
CFE version 1.0.37-0.6.7 for BCM96338 (32bit,SP,BE)
Build Date: Thu Aug  3 17:27:19 CST 2006 (michaelc)
Flash Config: CS0(1fc00008,1f),Base(bfc00000),Size(2MB)
Ethernet Network Device: External PHY
Board IP address                : 192.168.1.1  
Host IP address                 : 192.168.1.10  
Gateway IP address              :   
Run from flash/host (f/h)       : f  
Default host run file name      :   
Default host flash file name    : bcm96xxx_fs_kernel  
Boot delay (1-9 seconds)        : 5  
Board Id Name                   : RTA1320  
Psi size in KB                  : 24
Number of MAC Addresses (1-32)  : 11  
Ethernet MAC Address            : 00:74:04:e4:38:1a  
Memory size in MB               : 8
==== Press space key to stop auto run (5 seconds) ====
Auto run second count down(before hit space key): 5543210
Code Address: 0x80010000, Entry Address: 0x80187018
Decompression OK!
Entry at 0x80187018
Closing network.
Starting program at 0x80187018
Linux version 2.6.8.1 (compiled by michaelc) (gcc version 3.4.2) &#35;1 Wed Aug 16 15:14:08 CST 2006
man/device id c2/2249
FLASH_BASE bfc00000,blk 0
Total Flash size: 2048K with 35 sectors NVRAM @0 block
Scratch pad is not used for this flash part.
CPU revision is: 00029010
Determined physical RAM map:
memory: 007a0000 @ 00000000 (usable)
On node 0 totalpages: 1952
  DMA zone: 1952 pages, LIFO batch:1
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 8kB 2-way, linesize 16 bytes.
PID hash table entries: 32 (order 5: 256 bytes)
Using 120.000 MHz high precision timer.
Dentry cache hash table entries: 2048 (order: 1, 8192 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Memory: 6004k/7808k available (1305k kernel code, 1784k reserved, 190k data, 68k init, 0k highmem)
Calibrating delay loop... 238.38 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for ';wait'; instruction...  unavailable.
NET: Registered protocol family 16
Can';t analyze prologue code at 80154f6c
1.parse options inodes 753 block 753
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v1.0
rootfs_addr 0bfc10100
brcmboard: brcm_board_init entry
bcm963xx_serial driver v2.0
u32 classifier
    OLD policer on
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET: Registered protocol family 1
NET: Registered protocol family 17
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 68k freed
init started:  BusyBox v1.00 (2005) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5
tmpfs size 262144
1.parse options inodes 761 block 64

BusyBox v1.00 (2005) Built-in shell (msh)
Enter ';help'; for a list of built-in commands.

Loading drivers and kernel modules...
atmapi: module license ';Proprietary'; taints kernel.
blaadd: blaa_detect entry
adsl: adsl_init entry
Broadcom BCMPROCFS v1.0 initialized
External Switch Detected !!
Broadcom BCM6338A2 Ethernet Network Device v0.3 Aug 16 2006 15:12:48
Config Ethernet Switch Through SPI Slave Select 1
eth0: MAC Address: 00:74:04:E4:38:1A
pSdramPHY=0xA07FFFF8, 0xFFFDBFF7 0xBFEFBFFF
eth0 Link UP.
AdslCoreHwReset: AdslOemDataAddr = 0xA07FB404
==>   [1;36mDynalink ADSL2+ Router RTA1335AU Software Version: 3.29a_A2pB021g.d19b [0m   <==
disable vlan
vlan disable eth0
ip_tables: (C) 2000-2002 Netfilter core team
ip_conntrack version 2.1 (61 buckets, 0 max) - 368 bytes per conntrack
ip_conntrack_pptp version 2.1 loaded
ip_nat_pptp version 2.0 loaded
ip_conntrack_h323: init
ip_nat_h323: initialize the module!
ip_conntrack_rtsp v0.01 loading
board_ioctl: boot complete!
Boot finished and auto provision on lan not triggered: Exit from autoprovisionlan process

Login name: admin
Password:
>
> help
?
help
logout
reboot
adsl
atm
brctl
cat
df
dumpcfg
echo
ifconfig
kill
arp
defaultgateway
dhcpserver
dns
lan
passwd
ppp
remoteaccess
localaccess
restoredefault
route
save
swversion
wan
ping
ps
pwd
sntp
sysinfo
tftp
> ic fconfig
br0             Link encap:Ethernet  HWaddr 00:74:04:E4:38:1A  
                inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
                UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
                RX packets:1 errors:0 dropped:0 overruns:0 frame:0
                TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
                collisions:0 txqueuelen:0
                RX bytes:46 (46.0 B)  TX bytes:540 (540.0 B)
eth0            Link encap:Ethernet  HWaddr 00:74:04:E4:38:1A  
                UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
                RX packets:1 errors:0 dropped:0 overruns:0 frame:0
                TX packets:9 errors:0 dropped:0 overruns:0 carrier:0
                collisions:0 txqueuelen:1000
                RX bytes:64 (64.0 B)  TX bytes:576 (576.0 B)
                Interrupt:23 Base address:0x2800
lo              Link encap:Local Loopback  
                inet addr:127.0.0.1  Mask:255.0.0.0
                UP LOOPBACK RUNNING  MTU:16436  Metric:1
                RX packets:0 errors:0 dropped:0 overruns:0 frame:0
                TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
                collisions:0 txqueuelen:0
                RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
> vconfig
vconfig: not found
> cd sbin
cd sbin: not found
> dir
dir: not found
> ls
ls: not found
> cat     echo *
CVS bin dev etc lib linuxrc mnt proc sbin usr var webs
> cd sbin
cd sbin: not found
> cd /
cd /: not found
> pwd
/
> cd sbin
cd sbin: not found
> cd etc
cd etc: not found
> cd /sbin
cd /sbin: not found
> sh

BusyBox v1.00 (2005) Built-in shell (msh)
Enter ';help'; for a list of built-in commands.
&#35; pwd
/
&#35; d   dir
dir: not found
&#35; p ls
ls: not found
&#35; echo *
CVS bin dev etc lib linuxrc mnt proc sbin usr var webs
&#35; cd sbin
&#35; v ip fconfig
br0             Link encap:Ethernet  HWaddr 00:74:04:E4:38:1A  
                inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
                UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
                RX packets:2 errors:0 dropped:0 overruns:0 frame:0
                TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
                collisions:0 txqueuelen:0
                RX bytes:92 (92.0 B)  TX bytes:582 (582.0 B)
eth0            Link encap:Ethernet  HWaddr 00:74:04:E4:38:1A  
                UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
                RX packets:2 errors:0 dropped:0 overruns:0 frame:0
                TX packets:10 errors:0 dropped:0 overruns:0 carrier:0
                collisions:0 txqueuelen:1000
                RX bytes:128 (128.0 B)  TX bytes:640 (640.0 B)
                Interrupt:23 Base address:0x2800
lo              Link encap:Local Loopback  
                inet addr:127.0.0.1  Mask:255.0.0.0
                UP LOOPBACK RUNNING  MTU:16436  Metric:1
                RX packets:0 errors:0 dropped:0 overruns:0 frame:0
                TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
                collisions:0 txqueuelen:0
                RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
&#35; vconfig
BusyBox v1.00 (2005) multi-call binary
Usage: vconfig COMMAND [OPTIONS] ...
vconfig lets you create and remove virtual ethernet devices.
Options:
add             [interface-name] [vlan_id]
rem             [vlan-name]
set_flag        [interface-name] [flag-num]       [0 | 1]
set_egress_map  [vlan-name]      [skb_priority]   [vlan_qos]
set_ingress_map [vlan-name]      [skb_priority]   [vlan_qos]
set_name_type   [name-type]
&#35; cd    cat /proc/cpuinfo
system type: RTA1320
processor: 0
cpu model: BCM6338 V1.0
BogoMIPS: 238.38
wait instruction: no
microsecond timers: yes
tlb_entries: 32
extra interrupt vector: yes
hardware watchpoint: no
VCED exceptions: not available
VCEI exceptions: not available
&#35; cat /proc/meminfo
MemTotal:         6092 kB
MemFree:           520 kB
Buffers:            84 kB
Cached:           1284 kB
SwapCached:          0 kB
Active:           1976 kB
Inactive:          212 kB
HighTotal:           0 kB
HighFree:            0 kB
LowTotal:         6092 kB
LowFree:           520 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:               0 kB
Writeback:           0 kB
Mapped:           1820 kB
Slab:             2020 kB
Committed_AS:     3104 kB
PageTables:        240 kB
VmallocTotal:  1048560 kB
VmallocUsed:       892 kB
VmallocChunk:  1047656 kB
&#35; cat /proc/version
Linux version 2.6.8.1 (compiled by michaelc) (gcc version 3.4.2) &#35;1 Wed Aug 16 15:14:08 CST 2006
&#35; cat /     ps
  PID  Uid     VmSize Stat Command
    1 admin       240 S   init               
    2 admin           SWN [ksoftirqd/0]
    3 admin           SW< [events/0]
    4 admin           SW< [khelper]
    5 admin           SW< [kblockd/0]
    6 admin           SW  [pdflush]
    7 admin           SW  [pdflush]
    8 admin           SW  [kswapd0]
    9 admin           SW< [aio/0]
   10 admin           SW  [mtdblockd]
   17 admin       280 S   -sh
   35 admin       632 S   cfm
   57 admin       148 S   pvc2684d
  108 admin       228 S   igmp lo
  109 admin       216 S   dhcpd
  134 admin       544 S   telnetd
  139 admin       176 S   tftpd
  202 admin       760 S   httpd
  208 admin       172 S   mpd
  212 admin       336 R   pppd -c 8.35.1 -a 0.8.35 -u  -f 0 -w 1500 -z
  223 admin       232 S   dproxy
  230 admin       256 S   sh -c sh
  231 admin       284 S   sh
  247 admin       244 R   ps
&#35; cat /proc/modules
ipt_state 544 0 - Live 0xc00e0000
ipt_mark 416 0 - Live 0xc00de000
ipt_limit 896 0 - Live 0xc00dc000
ipt_TCPMSS 2240 0 - Live 0xc00da000
ipt_REDIRECT 768 0 - Live 0xc00d8000
ipt_MASQUERADE 1504 0 - Live 0xc00d6000
ipt_MARK 704 0 - Live 0xc00d4000
ipt_LOG 4064 0 - Live 0xc005f000
ipt_FTOS 992 0 - Live 0xc00bb000
ip_conntrack_tftp 1824 0 - Live 0xc0044000
ip_conntrack_sip 4976 0 - Live 0xc0053000
ip_conntrack_rtsp 73920 0 - Live 0xc00c0000
ip_conntrack_irc 68864 0 - Live 0xc00a9000
ip_conntrack_ftp 20576 0 - Live 0xc00a2000
ip_nat_ipsec 46592 0 - Live 0xc0095000
ip_conntrack_ipsec 30640 0 - Live 0xc0056000
ip_nat_h323 4192 0 - Live 0xc003b000
ip_conntrack_h323 69232 1 ip_nat_h323, Live 0xc0083000
ip_nat_pptp 2048 0 - Live 0xc0042000
ip_conntrack_pptp 3280 0 - Live 0xc0040000
ip_nat_gre 1280 0 - Live 0xc003e000
ip_conntrack_gre 2032 2 ip_nat_pptp,ip_conntrack_pptp, Live 0xc0021000
iptable_mangle 960 0 - Live 0xc000a000
iptable_nat 15184 6 ipt_REDIRECT,ipt_MASQUERADE,ip_nat_ipsec,ip_nat_h323,ip_nat_pptp,ip_nat_gre, Live 0xc004e000
ip_conntrack 28464 16 ipt_state,ipt_REDIRECT,ipt_MASQUERADE,ip_conntrack_tftp,ip_conntrack_sip,ip_conntrack_rtsp,ip_conntrack_irc,ip_conntrack_ftp,ip_nat_ipsec,ip_conntrack_ipsec,ip_nat_h323,ip_conntrack_h323,ip_nat_pptp,ip_conntrack_pptp,ip_conntrack_gre,iptable_nat, Live 0xc0046000
iptable_filter 928 1 - Live 0xc0014000
ip_tables 13984 12 ipt_state,ipt_mark,ipt_limit,ipt_TCPMSS,ipt_REDIRECT,ipt_MASQUERADE,ipt_MARK,ipt_LOG,ipt_FTOS,iptable_mangle,iptable_nat,iptable_filter, Live 0xc001c000
bcm_enet 19760 0 - Live 0xc0033000
bcmprocfs 12320 0 - Live 0xc000f000
adsldd 134512 0 - Live 0xc0061000
blaadd 5808 0 - Live 0xc000c000
atmapi 57936 2 adsldd,blaadd, Live 0xc0023000
&#35; ip  exit
> help
?
help
logout
reboot
adsl
atm
brctl
cat
df
dumpcfg
echo
ifconfig
kill
arp
defaultgateway
dhcpserver
dns
lan
passwd
ppp
remoteaccess
localaccess
restoredefault
route
save
swversion
wan
ping
ps
pwd
sntp
sysinfo
tftp

gzwyx

支持一下，不错的研究。

hugebird

对这个猫非常失望，依然在BT初期或者大流量时死机，不过比贝尔的固件要稳定一些。

hugebird

据说3.2和3.3版本的固件BT不稳定，国外的兄弟们都转回到2。2版本了。
那位有RTA1335或者RTA1200的2。2板固件，可否给我发一个
willingbird@gmail.com
多谢

hugebird

今天得到2.21版的固件，终于Broadcom芯片的实力表现出来了，现在BT终于不再死猫。 这次改造以成功结束。
长期稳定性还有待日后考验，单从目前的表现，可以算是完美

hugebird

教程正在编写过程中，连接在这里
http://www.516600.com/cgi-bin/lb5000/topic.cgi?forum=54&topic=16051&show=0[br][br]-=-=-=- 以下内容由 hugebird 在 2007年07月30日 00:57pm 时添加 -=-=-=-
教程的链接，上面的地址作废
http://www.516600.com/cgi-bin/lb5000/topic.cgi?forum=59&topic=426&show=50

dragon008

大哥，我的猫和你的一样，可否发原始固件给我，我的刷坏了

zwd6289218

BroadCom 6338 芯片,没想到也这么差劲:lol