RCA DSB772WE Streaming Media Player

Description
The RCA Wi-Fi Streaming Media Player brings you a world of movies, TV shows, music, online apps and more — without monthly cable TV or satellite TV subscriptions. Just connect it to your Wi-Fi network, connect its 1080p HDMI output to your HDTV and you're ready to enjoy internet-connected content on your time and your terms. The product can instantly stream Netflix movies and TV shows (Netflix subscription required). You can rent or buy HD movies and TV shows from VUDU. You can also watch your favorite TV shows and movies on demand from Hulu Plus (subscription required). The player also delivers you a wealth of free services, such as YouTube, VUDU Apps, Pandora Internet Radio and Picasa.

Available from Wal-Mart.

NOTE: I have confirmed that this devices is using Linux Kernel 2.6.28.9 - see Linux Support below

Basic Info

 * Broadcom BCM7615 Set-Top processor based - MIPS 24K based SoC
 * USB0 (4-pin header) is populated by Zioncom wifi module
 * USB1 Pads
 * can use usb host connector from Sparkfun
 * can use usb host cable from Amazon.com
 * pads for ethernet jack
 * jack needs to contain the magnetics
 * standard MagJack pads
 * can be populated with MagJack from Sparkfun.com
 * pads for Console UART
 * 3.3V TTL
 * can be interfaced using a USB->UART
 * one Hynix HY27UF082G2B NAND Flash (2Gbit - 256MB)
 * two Hynix H5TQ1G63DFR 1Gb DDR3 SDRAM
 * one 27MHz crystal
 * one TI DRV632 DirectPath™, 2-VRMS Line Driver With Adjustable Gain
 * one TI PCM1754 24-Bit 192Khz 106dB SNR Stereo DAC (H/W Control)
 * wifi module chipset is a Broadcom BCM43235
 * infrared remote manufactured by SDI Technologies Inc

Pictures










Hacking
update/ update/squashfs-7615c0.img update/cfe-2.1.13-7631-b1-v10-cfe-le-secure-signed.elf update/vmlinuz-2628.9_760-7631 update/ucfe-2.1.13-7631-b1-v10-ucfe-le-secure-BK1-MFC-signed.bin update/product_software_update.dat
 * appears to be similar design as the LG ST600 / ST650 unit.
 * ST600 unit *may* have been imported version of Desay Electronics model DS-HM22
 * Tommy J has located the LG ST600 source code
 * Download HERE by selecting "AV & Security Device" and "ST600"
 * or DIRECT_LINK
 * You can also request the source code by emailing sourcecode [at] lge.com
 * I added a usb host connection to the pads marked USB1. it does enumerate HID devices and mass storage devices.
 * next, connect a serial port to the tx/rx lines to check on console access
 * the board appears to have been originally populated with the ethernet jack and then removed.
 * firmware update manifest available at: http://us-rca-bdplayer.getfirmware.com/deviceupdate/DSB772WE-1101/DSB772WE-1101.XML
 * current firmware as per manifest: http://c263474.r74.cf1.rackcdn.com/alco_7615_v035_012_1123_RCA_DSB772WE_update_pmc1101.fwu
 * firmware contents:

Root shell
To get a root prompt, you have to press Control-C and login with "root" and now password. The downside to this method is that the device reboots 30 seconds after you killed the foreground process (which you did by pressing Control-C). A work around for that is boot -elf -z flash0.vmlinux.0: 'root=/dev/romblock10 rootfstype=squashfs console=0,115200n8 BDVD_BOOT_AUTOSTART=n BAPP_OUT=/dev/null BNET=y ro'
 * After connecting power quickly press Control-C, this should drop you to a "CFE>" prompt
 * Now enter the following:
 * This will not start the media software and will directly give you a "(none) login:" prompt
 * log in with user root and no password and the device will not reboot after 30 seconds

USB storage
The original firmware automatically mounts attached USB thumb drives as /mnt/removable/usba
 * vfat,ext2,ext3 support is confirmed

NAND reading/writing
The manufacturer was kind enough to
 * enable both NAND reading AND writing in kernel
 * prepare two partitions for both kernel and rom, meaning we have a safety net

To dump the contents of a NAND partition just obtain a root shell, insert a USB drive into the second USB port (where you soldered a connector) and do the following nanddump /dev/mtd10 -f rootfs.0 This will dump the first rootfs partition. Whatever you do, DO NOT, I repeat DO NOT overwrite any other NAND partition other than /dev/mtd12 (rootfs.1) and /dev/mtd15 (vmlinux.1) if you are not ABSOLUTELY sure of what you are doing. These two are the second kernel and root partition and even if you overwrite them with garbage the device will still work afterwards

To write to a NAND partition, just do the following nandwrite /dev/mtd12 shinynewsquashfsrootimage

Root File System
The root file system is present in squashfs 3.0 format. In order to build new root images you will have to use an old version of squashfs-tools from http://sourceforge.net/projects/squashfs/files/squashfs/squashfs3.0/

To unpack a dumped root file system called rootfs.0 into the directory rootfs-dump just enter unsquashfs rootfs.0 -d rootfs-dump/

To repack a modified root file system enter mksquashfs rootfs-dump rootfs-modified and make sure that the squashfs version is 3.0 and the block size is 65536

This new file system can be written to /dev/mtd12. You then just have to boot from root=/dev/romblock12

Binary Format
The architecture of the device is mipsel, eg MIPS little endian. It is confirmed that openwrt mipsel binaries do run on it bc 1.06 Copyright 1991-1994, 1997, 1998, 2000 Free Software Foundation, Inc. This is free software with ABSOLUTELY NO WARRANTY. For details type `warranty'. 23+42 65 $ file bc                                                                           [01-15 15:40] bc: ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), dynamically linked (uses shared libs), corrupted section header size One might be able to utilize the openwrt build chain to create a new root file system
 * 1) ./bc

Linux Support
system type : BCM97xxx Settop Platform processor : 0 cpu model : MIPS 24Kc V7.12 cpu MHz : 508.41 BogoMIPS : 508.41 ( udelay_val : 254208 HZ = 1000 ) wait instruction : yes microsecond timers : yes tlb_entries : 64 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0003, 0x0000] ASEs implemented : mips16 shadow register sets : 1 core : 0 VCED exceptions : not available VCEI exceptions : not availabled
 * NEW - Github repo with BCM9763x Support
 * Linux on Broadcom Processors
 * Detailed compile of Linux on Broadcom-based TV's at OpenLGTV.org.ru
 * Bootlog from a BCM7630 based DVD Player
 * Howto get rootfs from BCM7601 device and mount it AVSForums.com
 * i have been able to boot a custom kernel using the BCM7635 code from OpenDreamBox
 * [[media:RCA-DSB772WE-bootlog.txt|boot log]]
 * /proc/cpuinfo listing
 * 1) cat /proc/cpuinfo

(*) Direct/Interface: Loaded 'JPEG' implementation of 'IDirectFBImageProvider'.
 * root access is available

(none) login: (none) login: (none) login: root total 0 drwxr-xr-x 2 root root   3 Aug  9 12:23. drwx-- 16 root root 190 Nov 23 03:44 .. total 0 drwxr-xr-x 2 root root   3 Aug  9 12:23. drwx-- 16 root root 190 Nov 23 03:44 .. bin etc      home  lib      mnt   root  share  tmp  var dev etc.img  init  libexec  proc  sbin  sys    usr rootfs on / type rootfs (rw) /dev/root on / type squashfs (ro) none on /proc type proc (rw) none on /dev/pts type devpts (rw,mode=600) none on /var type tmpfs (rw,size=64k,mode=777) none on /var/tmp type tmpfs (rw,size=64k,mode=777) none on /etc/config type tmpfs (rw,size=64k,mode=777) none on /sys type sysfs (rw) /dev/mtdblock19 on /var/log type yaffs2 (rw) /dev/mtdblock20 on /mnt/psnv type yaffs2 (rw) /dev/mtdblock21 on /mnt/pstor type yaffs2 (rw) bitsPerSample 65535 != 16Loader:elf Filesys:raw Dev:flash0.vmlinux.1 File: Options:root=/dev/romblock12 rootfstype=squashfs ro BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console panic=8 Loading: 0x80008000/5108544 0x804e7340/306944 Successfully loaded secure elf image.... Entry address is 0x8000c870 Starting program at 0x8000c870
 * 1) ls -al
 * 1) ls -al
 * 1) ls -al
 * 1) ls -al
 * 1) ls -al
 * 1) cd /
 * ls
 * partitions
 * 1) mount
 * kernel boot log section

[   0.000000] -- DDR Bank 0: 128 MB [    0.000000] -- DDR Bank 1: 128 MB [    0.000000] Linux version 2.6.28.9 (root@stbcm-and-02) (gcc version 4.2.0 20070124 (prerelease) - BRCM 11ts-20090508) #760 Tue Aug 9 08:10:53 EDT 2011 [   0.000000] Kernel command line: root=/dev/romblock12 rootfstype=squashfs ro  BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console panic=8 console=0,115200n8 LD_BIND_NOW=on [4294667.347000] DIGSIG: no valid key, digsig security disabled [4294667.370000] checker_0 control 0x00000008 addr low 0x00002000 hi 0x003a9000 [4294667.377000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00000000 [4294667.386000] checker_1 control 0x00000008 addr low 0x003aa000 hi 0x0277ff80 [4294667.393000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x28000000 _1 0x0001c9f1 [4294667.402000] checker_2 control 0x00000008 addr low 0x20000000 hi 0x21cfff80 [4294667.409000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x28000000 _1 0x0001c9f1 [4294667.418000] checker_3 control 0x00000018 addr low 0x27d00000 hi 0x27dfff80 [4294667.425000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00000200 [4294667.453000] Driver 'sd' needs updating - please use bus_type methods [4294667.460000] Driver 'sr' needs updating - please use bus_type methods [4294667.466000] vide_ofe_probe: CHIP REV 0x76150020, REQUIRES 0x763xxxxx/0x764xxxxx [4294667.474000] vide_ofe: unable to add platform device [4294667.542000] Creating 28 MTD partitions on "bcm7xxx-nand": [4294667.548000] 0x00000000-0x00180000 : "ucfe" [4294667.553000] 0x00180000-0x00200000 : "drmregion" [4294667.559000] 0x00200000-0x00280000 : "drmregion.1" [4294667.565000] 0x00280000-0x00300000 : "rawnvr" [4294667.570000] 0x00300000-0x00300090 : "macadr" [4294667.574000] mtd: partition "macadr" doesn't end on an erase block -- force read-only [4294667.583000] 0x00300090-0x00300800 : "nvram" [4294667.587000] mtd: partition "nvram" doesn't start on an erase block boundary -- force read-only [4294667.597000] 0x00300800-0x00400000 : "virtual" [4294667.602000] mtd: partition "virtual" doesn't start on an erase block boundary -- force read-only [4294667.611000] 0x00400000-0x00600000 : "cfe.0" [4294667.616000] 0x00600000-0x00800000 : "cfe.1" [4294667.622000] 0x00800000-0x00880000 : "vault-a" [4294667.627000] 0x00880000-0x06080000 : "rootfs.0" [4294667.633000] 0x06080000-0x06100000 : "vault-b" [4294667.638000] 0x06100000-0x0b900000 : "rootfs.1" [4294667.644000] 0x0b900000-0x0bd00000 : "vmlinux.0" [4294667.650000] 0x0bd00000-0x0bd80000 : "vault-c" [4294667.655000] 0x0bd80000-0x0c180000 : "vmlinux.1" [4294667.661000] 0x0c180000-0x0c200000 : "paniclog" [4294667.666000] 0x0c200000-0x0c280000 : "cfelog" [4294667.671000] 0x0c280000-0x0c880000 : "splash" [4294667.677000] 0x0c880000-0x0cc80000 : "syslog" [4294667.682000] 0x0cc80000-0x0d080000 : "psnv" [4294667.687000] 0x0d080000-0x0f600000 : "pstor" [4294667.693000] 0x0f600000-0x0f900000 : "ofefw.0" [4294667.698000] 0x0f900000-0x0fa00000 : "ofews.0" [4294667.703000] 0x0fa00000-0x0fd00000 : "ofefw.1" [4294667.709000] 0x0fd00000-0x0fe00000 : "ofews.1" [4294667.714000] 0x00300000-0x00400000 : "config" [4294667.720000] 0x00000000-0x0fe00000 : "all" rcS: BDVD_BOOT_AUTOSTART BQ  BAPP<./app_player>  BAPP_OUT  BNET<>  BNET_DLY<0> OFE_SB Mounting pstor, psnv with yaffs2! rcS: Launch PSTOR mount in background

app_ofe_sb: Failed to create device node /tmp/vide_ofe_sb syslogd: cannot create /dev/log: Address already in use Wed Jun 11 00:00:00 UTC 2008 [4294670.210000] bcmdriver: module license 'Proprietary' taints kernel. [4294670.241000] BCMDRV: Initializing bcmdriver version $ bdvd_v3.0/6 $ [4294670.247000] BCMDRV: Using Interrupt Definition for 7631 (uname -a) [4294670.254000] BCMDRV: Total intc words=2,Total Irqs=65 [4294670.259000] BCMDRV: Initialization complete... /etc/init.d/rcS: : command not found Auto startup /etc/init.d/rcS: : command not found /etc/init.d/rcS: : command not found app 74016:00:06.726 -.--- main: Application Started app 74016:00:06.726 +0.000 Time from Startup to Application Start: 12.333 seconds

Flash Partition Table
dev:   size   erasesize  name mtd0: 00180000 00020000 "ucfe" mtd1: 00080000 00020000 "drmregion" mtd2: 00080000 00020000 "drmregion.1" mtd3: 00080000 00020000 "rawnvr" mtd4: 00000090 00020000 "macadr" mtd5: 00000770 00020000 "nvram" mtd6: 000ff800 00020000 "virtual" mtd7: 00200000 00020000 "cfe.0" mtd8: 00200000 00020000 "cfe.1" mtd9: 00080000 00020000 "vault-a" mtd10: 05800000 00020000 "rootfs.0" mtd11: 00080000 00020000 "vault-b" mtd12: 05800000 00020000 "rootfs.1" mtd13: 00400000 00020000 "vmlinux.0" mtd14: 00080000 00020000 "vault-c" mtd15: 00400000 00020000 "vmlinux.1" mtd16: 00080000 00020000 "paniclog" mtd17: 00080000 00020000 "cfelog" mtd18: 00600000 00020000 "splash" mtd19: 00400000 00020000 "syslog" mtd20: 00400000 00020000 "psnv" mtd21: 02580000 00020000 "pstor" mtd22: 00300000 00020000 "ofefw.0" mtd23: 00100000 00020000 "ofews.0" mtd24: 00300000 00020000 "ofefw.1" mtd25: 00100000 00020000 "ofews.1" mtd26: 00100000 00020000 "config" mtd27: 0fe00000 00020000 "all"