Difference between revisions of "Talk:RCA DSB772WE Streaming Media Player"

From eLinux.org
Jump to: navigation, search
(Created page with "The LG BD5xx players seem to have also had similar internals as the RCA-DSB and ST6xx media players. I came across these instructions on getting a terminal from a defunct BD5xx h...")
 
m (moved Talk:RCA DSB772WE to Talk:RCA DSB772WE Streaming Media Player: expanded the title with description of the device)
 
(3 intermediate revisions by one other user not shown)
Line 1: Line 1:
 
The LG BD5xx players seem to have also had similar internals as the RCA-DSB and ST6xx media players. I came across these instructions on getting a terminal from a defunct BD5xx hacking site, still listed on archive.org
 
The LG BD5xx players seem to have also had similar internals as the RCA-DSB and ST6xx media players. I came across these instructions on getting a terminal from a defunct BD5xx hacking site, still listed on archive.org
  
As terminal software can be used PuTTY. COM1 - 115200 8 N 1. After connecting the converter and runnig PuTTY you should poweron player and  
+
As terminal software can be used PuTTY. COM1 - 115200 8 N 1. After connecting the converter and runnig PuTTY you should power on player and  
 
 
 
quickly press Ctrl+C. You can see on the screen:
 
quickly press Ctrl+C. You can see on the screen:
 
    
 
    
 
   
 
   
 
  BCM76300010
 
  BCM76300010
Setting NAND Params
+
Setting NAND Params
 
+
CFE starting from ROM
CFE starting from ROM
+
Chip specific init
Chip specific init
+
TLB init
TLB init
+
Board init
Board init
+
Starting memory configuration  
Starting memory configuration  
+
Valid memory config = D3128256
Valid memory config = D3128256
+
Disable refresh - set byte lane 8
Disable refresh - set byte lane 8
+
Setting up PLL
Setting up PLL
+
Setting up memory controller
Setting up memory controller
+
Enable DDR encryption
Enable DDR encryption
+
SoooooooooooooooR
SoooooooooooooooR
+
Preparing to copy code to RAM
Preparing to copy code to RAM
+
Prepare for NAND loading
Prepare for NAND loading
+
Starting code in RAM
 
+
Booting Secured CFE...
 
+
BCM97630 B0-SEC-lg8_100126r0  CFE v2.11.10 (CFE core v2.11, BSP_REV 10), Endian Mode: Little
Starting code in RAM
+
Build Date: 2010. 01. 26. (í) 11:36:34 KST (khy2766@nexus)
Booting Secured CFE...
+
Copyright (C) Broadcom Corporation.
 
+
*jjc* PROD_REVISION is 0x76300010
 
+
*jjc* is 7630
BCM97630 B0-SEC-lg8_100126r0  CFE v2.11.10 (CFE core v2.11, BSP_REV 10), Endian Mode: Little
+
DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz
Build Date: 2010. 01. 26. (í) 11:36:34 KST (khy2766@nexus)
+
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
Copyright (C) Broadcom Corporation.
+
NAND vendor timing        : 98da9015 Toshiba TC58NVG1S3ETA00 SLC  t1(33535233) t2(80000b98)
 
+
Secure boot                : Enabled
 
+
Port lock                  : Enabled
*jjc* PROD_REVISION is 0x76300010
+
doupdatecheck: nothing new and no try_count
*jjc* is 7630
+
Timestamp started ...
 
+
booting ARM...
DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz
+
Reading flash0.ofefw.1 to V:0x80000000 from offset 0 len 1048576
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
+
validating ofe fw_ldt@0x800fffb0 ...
NAND vendor timing        : 98da9015 Toshiba TC58NVG1S3ETA00 SLC  t1(33535233) t2(80000b98)
+
parsed fw_ldt@800fffb0 : ws0_sadr=0xc0000 ws0_eadr=0xdffff prodid:BD READER R02
Secure boot                : Enabled
+
parsed fw_ws @800c0000 : vendor: LGH08SAN prodid: LG H08SAN BC7630
Port lock                  : Enabled
+
Reading flash0.ofews.1 to V:0x80100000 from offset 0 len 131072
 
+
parsed  WS@80100000 :  Vendor:LGH08SAN Prodid:LG H08SAN BC7630
doupdatecheck: nothing new and no try_count
+
updating fw_ws@800c0000 with flash0.ofews.1
 
+
ws was updated in the fw image succesfully
Timestamp started ...
+
booting ARM...ofefw@0x2fd00000
booting ARM...
+
done
Reading flash0.ofefw.1 to V:0x80000000 from offset 0 len 1048576
+
Elapsed time  263mS (263280 uS)
validating ofe fw_ldt@0x800fffb0 ...
+
Automatic startup canceled via Ctrl-C
parsed fw_ldt@800fffb0 : ws0_sadr=0xc0000 ws0_eadr=0xdffff prodid:BD READER R02
+
CFE> ^C
parsed fw_ws @800c0000 : vendor: LGH08SAN prodid: LG H08SAN BC7630
 
Reading flash0.ofews.1 to V:0x80100000 from offset 0 len 131072
 
parsed  WS@80100000 :  Vendor:LGH08SAN Prodid:LG H08SAN BC7630
 
updating fw_ws@800c0000 with flash0.ofews.1
 
ws was updated in the fw image succesfully
 
booting ARM...ofefw@0x2fd00000
 
done
 
 
 
Elapsed time  263mS (263280 uS)
 
 
 
 
 
Automatic startup canceled via Ctrl-C
 
CFE> ^C
 
 
  
 
You can use some CFE commands to see some important information. First try to type HELP <ENTER>  
 
You can use some CFE commands to see some important information. First try to type HELP <ENTER>  
 
 
 
   
 
   
 
  CFE> help
 
  CFE> help
Available commands:
+
Available commands:
 
+
info                Show CFE configuration information
info                Show CFE configuration information
+
splashsd            Load's and Display's yuv:422 Splash Screen image
splashsd            Load's and Display's yuv:422 Splash Screen image
+
splash              Load's and Display's yuv:422 Splash Screen image
splash              Load's and Display's yuv:422 Splash Screen image
+
loop                Loop a command
loop                Loop a command
+
dir                List the directory of a FAT file system
dir                List the directory of a FAT file system
+
macprog            Program MAC addresses.
macprog            Program MAC addresses.
+
macprog2            Program a specific MAC address.
macprog2            Program a specific MAC address.
+
initadv7622        Initialze adv7622 for HDMI showing CFE Logo
initadv7622        Initialze adv7622 for HDMI showing CFE Logo
+
tstamp              Time stamp utility
tstamp              Time stamp utility
+
flashmarkbb        Marks a specified block bad
flashmarkbb        Marks a specified block bad
+
flasherase          Erases a flash partition
flasherase          Erases a flash partition
+
flasheeprom        Update the EEPROM device on board
flasheeprom        Update the EEPROM device on board
+
flash              Update a flash memory device
flash              Update a flash memory device
+
memtest            Test memory.
memtest            Test memory.
+
f                  Fill contents of memory.  
f                  Fill contents of memory.  
+
e                  Modify contents of memory.
e                  Modify contents of memory.
+
d                  Dump memory.
d                  Dump memory.
+
u                  Disassemble instructions.
u                  Disassemble instructions.
+
reboot              Invoke hardware reboot.
reboot              Invoke hardware reboot.
+
batch              Load a batch file into memory and execute it
batch              Load a batch file into memory and execute it
+
go                  Start a previously loaded program.
go                  Start a previously loaded program.
+
load                Load an executable file into memory without executing it
load                Load an executable file into memory without executing it
+
save                Save a region of memory to a remote file via TFTP
save                Save a region of memory to a remote file via TFTP
+
boot                Load an executable file into memory and execute it
boot                Load an executable file into memory and execute it
+
ping                Ping a remote IP host.
ping                Ping a remote IP host.
+
ifconfig            Configure the Ethernet interface
ifconfig            Configure the Ethernet interface
+
sleep              Sleep for specified milliseconds.
sleep              Sleep for specified milliseconds.
+
show heap          Display information about CFE's heap
show heap          Display information about CFE's heap
+
show memory        Display the system physical memory map.
show memory        Display the system physical memory map.
+
show devices        Display information about the installed devices.
show devices        Display information about the installed devices.
+
unsetenv            Delete an environment variable.
unsetenv            Delete an environment variable.
+
printenv            Display the environment variables
printenv            Display the environment variables
+
setenv              Set an environment variable.
setenv              Set an environment variable.
+
help                Obtain help for CFE commands
help                Obtain help for CFE commands
+
For more information about a command, enter 'help command-name'
 
+
*** command status = 0
For more information about a command, enter 'help command-name'
+
CFE>  
*** command status = 0
 
CFE>  
 
 
    
 
    
  
Line 114: Line 96:
 
   
 
   
 
  CFE> info
 
  CFE> info
========================================================================
+
========================================================================
DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz
+
DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
+
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
NAND vendor timing        : 98da9015 Toshiba TC58NVG1S3ETA00 SLC  t1(33535233) t2(80000b98)
+
NAND vendor timing        : 98da9015 Toshiba TC58NVG1S3ETA00 SLC  t1(33535233) t2(80000b98)
Secure boot                : secure boot enabled, BSECK locked
+
Secure boot                : secure boot enabled, BSECK locked
Port lock                  : Enabled
+
Port lock                  : Enabled
 
+
Total memory used by CFE:  0x87000000 - 0x870936E4 (603876)
Total memory used by CFE:  0x87000000 - 0x870936E4 (603876)
+
Initialized Data:          0x8708F860 - 0x87092C00 (13216)
Initialized Data:          0x8708F860 - 0x87092C00 (13216)
+
BSS Area:                  0x87092D00 - 0x870936E4 (2532)
BSS Area:                  0x87092D00 - 0x870936E4 (2532)
+
Local Heap:                0x87093800 - 0x87893800 (8388608)
Local Heap:                0x87093800 - 0x87893800 (8388608)
+
Stack Area:                0x87893800 - 0x87895800 (8192)
Stack Area:                0x87893800 - 0x87895800 (8192)
+
Text (code) segment:      0x87000000 - 0x87023E18 (146968)
Text (code) segment:      0x87000000 - 0x87023E18 (146968)
+
CFE driver build information:
 
+
LDR:  ELF  1; BIN  1; SREC  1
CFE driver build information:
+
UI:    LEVEL 3; MIN  0
LDR:  ELF  1; BIN  1; SREC  1
+
FS:    FAT  1; FAT32 1
UI:    LEVEL 3; MIN  0
+
NET:  STACK 1; ENET  1; TCP  0
FS:    FAT  1; FAT32 1
+
USB:  STACK 0; ETH  1; DISK  1; SERIAL  1; HID 1
NET:  STACK 1; ENET  1; TCP  0
+
FLASH: NAND
USB:  STACK 0; ETH  1; DISK  1; SERIAL  1; HID 1
+
p starts at b152a004, ends at b152a004
FLASH: NAND
+
Total mem_sys_init write to register 0 times
p starts at b152a004, ends at b152a004
+
Step    Address        Value
 
+
=====================================
Total mem_sys_init write to register 0 times
+
*** command status = 0
Step    Address        Value
+
CFE>
=====================================
 
 
 
=====================================
 
========================================================================
 
*** command status = 0
 
CFE>
 
  
 
Important command PRINTENV shows information about system STARTUP. Don't try to change anything here using SETENV command!!!
 
Important command PRINTENV shows information about system STARTUP. Don't try to change anything here using SETENV command!!!
Line 150: Line 126:
 
   
 
   
 
  CFE> printenv
 
  CFE> printenv
Variable Name        Value
+
Variable Name        Value
-------------------- --------------------------------------------------
+
-------------------- --------------------------------------------------
 
         BOOT_CONSOLE uart0
 
         BOOT_CONSOLE uart0
 
         ETH0_HWADDR E8:5B:5B:A1:48:0D
 
         ETH0_HWADDR E8:5B:5B:A1:48:0D
 
             STARTUP splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384  
 
             STARTUP splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384  
 
+
                    OFE_SB=y quiet console=0,115200n8'
OFE_SB=y quiet console=0,115200n8'
 
 
         CFE_VERSION 2.11.19
 
         CFE_VERSION 2.11.19
 
       CFE_BOARDNAME BCM97630 B0-SEC-RDEN400
 
       CFE_BOARDNAME BCM97630 B0-SEC-RDEN400
 
       CFE_MEMORYSIZE 128
 
       CFE_MEMORYSIZE 128
*** command status = 0
+
*** command status = 0
CFE>
+
CFE>
 
    
 
    
 
Aby uzyskac dostep do ROOT systemu operacyjnego i ujrzec caly proces BOOT playera trzeba w linie polecen CFE wpisac komende:
 
 
If you want to get an access to ROOT of operating system and see BOOT process you need to use command below:
 
If you want to get an access to ROOT of operating system and see BOOT process you need to use command below:
  
 
splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose debug  
 
splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose debug  
 
 
console=0,115200n8 single ro'
 
console=0,115200n8 single ro'
 
    
 
    
 
   
 
   
 
  CFE> splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose  
 
  CFE> splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose  
 
+
console=0,115200n8 single ro'
console=0,115200n8 single ro'
+
  Display splash screen
   
+
Using valid user input parameters - Resolution 576p on Component
 
+
[ Default Video ] :  Current Video Output : Component @ Resolution : 576p
Display splash screen
+
Loading PAL SD image to 0x06646c00 size 829440 bytes
Using valid user input parameters - Resolution 576p on Component
+
Reading flash0.splash to V:0xa6646c00 from offset 4838400 len 829440
[ Default Video ] :  Current Video Output : Component @ Resolution : 576p
+
Done displaying splash screen
Loading PAL SD image to 0x06646c00 size 829440 bytes
+
Reading flash0.splash to V:0xa6e00000 from offset 5667840 len 44
Reading flash0.splash to V:0xa6646c00 from offset 4838400 len 829440
+
Loader:elf Filesys:raw Dev:flash0.kernel File: Options:root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y  
Done displaying splash screen
+
verbose console=0,115200n8 single ro
Reading flash0.splash to V:0xa6e00000 from offset 5667840 len 44
+
Loading: 0x80008000/5427744 0x80535220/1327744
Loader:elf Filesys:raw Dev:flash0.kernel File: Options:root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y  
+
Successfully loaded secure elf image....
 
+
Entry address is 0x8000c330
verbose console=0,115200n8 single ro
+
Starting program at 0x8000c330
Loading: 0x80008000/5427744 0x80535220/1327744
+
[    0.000000] -- DDR Bank 0: 128 MB
Successfully loaded secure elf image....
+
[    0.000000] -- DDR Bank 1: 256 MB
Entry address is 0x8000c330
+
[    0.000000] Linux version 2.6.28.9 (ykhong@hyori) (gcc version 4.2.0 20070124 (prerelease) - BRCM 10ts-20080721) #189 Thu Jan 28  
Starting program at 0x8000c330
+
18:54:14 KST 2010
 
+
[    0.000000] Kernel command line: root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose  
[    0.000000] -- DDR Bank 0: 128 MB
+
console=0,115200n8 single ro
[    0.000000] -- DDR Bank 1: 256 MB
+
[4294667.366000] DIGSIG: no valid key, digsig security disabled
[    0.000000] Linux version 2.6.28.9 (ykhong@hyori) (gcc version 4.2.0 20070124 (prerelease) - BRCM 10ts-20080721) #189 Thu Jan 28  
+
[4294667.389000] checker_0 control 0x00000008 addr low 0x00001000 hi 0x003be000
 
+
[4294667.396000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00000000
18:54:14 KST 2010
+
[4294667.405000] checker_1 control 0x00000008 addr low 0x003bf000 hi 0x027fff80
[    0.000000] Kernel command line: root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose  
+
[4294667.412000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00e4f8a0
 
+
[4294667.421000] checker_2 control 0x00000008 addr low 0x20000000 hi 0x238fff80
console=0,115200n8 single ro
+
[4294667.428000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00e4f8a0
[4294667.366000] DIGSIG: no valid key, digsig security disabled
+
[4294667.437000] checker_3 control 0x00000010 addr low 0x2fd00000 hi 0x2fdfff80
[4294667.389000] checker_0 control 0x00000008 addr low 0x00001000 hi 0x003be000
+
[4294667.444000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00010000
[4294667.396000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00000000
+
[4294667.466000] Driver 'sd' needs updating - please use bus_type methods
[4294667.405000] checker_1 control 0x00000008 addr low 0x003bf000 hi 0x027fff80
+
[4294667.473000] Driver 'sr' needs updating - please use bus_type methods
[4294667.412000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00e4f8a0
+
[4294667.487000] scsi 0:0:0:0: CD-ROM            LGH08SAN LG H08SAN BC7630 0591 PQ: 0 ANSI: 5
[4294667.421000] checker_2 control 0x00000008 addr low 0x20000000 hi 0x238fff80
+
[4294667.497000] sr 0:0:0:0: Attached scsi generic sg0 type 5
[4294667.428000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00e4f8a0
+
[4294667.544000] brcmnand_probe: Found SLC device TOSHIBA SLC TC58NVG1S3ETA00
[4294667.437000] checker_3 control 0x00000010 addr low 0x2fd00000 hi 0x2fdfff80
+
[4294667.550000] brcmnand_probe() oobSize: 16,  pageSize : 2048, blockSize: 131072<7>Writing nand config register 0x01402848 with  
[4294667.444000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00010000
+
0x16152300  
[4294667.466000] Driver 'sd' needs updating - please use bus_type methods
+
[4294667.585000] Creating 20 MTD partitions on "bcm7xxx-nand":
[4294667.473000] Driver 'sr' needs updating - please use bus_type methods
+
[4294667.591000] 0x00000000-0x00100000 : "cfe"
[4294667.487000] scsi 0:0:0:0: CD-ROM            LGH08SAN LG H08SAN BC7630 0591 PQ: 0 ANSI: 5
+
[4294667.596000] 0x00100000-0x00700000 : "splash"
[4294667.497000] sr 0:0:0:0: Attached scsi generic sg0 type 5
+
[4294667.601000] 0x00700000-0x00700090 : "macadr"
[4294667.544000] brcmnand_probe: Found SLC device TOSHIBA SLC TC58NVG1S3ETA00
+
[4294667.606000] mtd: partition "macadr" doesn't end on an erase block -- force read-only
[4294667.550000] brcmnand_probe() oobSize: 16,  pageSize : 2048, blockSize: 131072<7>Writing nand config register 0x01402848 with  
+
[4294667.614000] 0x00700090-0x00700800 : "nvram"
 
+
[4294667.619000] mtd: partition "nvram" doesn't start on an erase block boundary -- force read-only
0x16152300  
+
[4294667.628000] 0x00700800-0x00800000 : "virtual"
[4294667.585000] Creating 20 MTD partitions on "bcm7xxx-nand":
+
[4294667.633000] mtd: partition "virtual" doesn't start on an erase block boundary -- force read-only
[4294667.591000] 0x00000000-0x00100000 : "cfe"
+
[4294667.642000] 0x00800000-0x00900000 : "bct"
[4294667.596000] 0x00100000-0x00700000 : "splash"
+
[4294667.647000] 0x00900000-0x00b00000 : "dbg"  
[4294667.601000] 0x00700000-0x00700090 : "macadr"
+
[4294667.652000] 0x00b00000-0x00f00000 : "kernel1"
[4294667.606000] mtd: partition "macadr" doesn't end on an erase block -- force read-only
+
[4294667.657000] 0x00f00000-0x01300000 : "kernel"
[4294667.614000] 0x00700090-0x00700800 : "nvram"
+
[4294667.662000] 0x01300000-0x07900000 : "rootfs1"
[4294667.619000] mtd: partition "nvram" doesn't start on an erase block boundary -- force read-only
+
[4294667.668000] 0x07900000-0x0df00000 : "rootfs"
[4294667.628000] 0x00700800-0x00800000 : "virtual"
+
[4294667.674000] 0x0df00000-0x0e000000 : "drmregion"
[4294667.633000] mtd: partition "virtual" doesn't start on an erase block boundary -- force read-only
+
[4294667.679000] 0x0e000000-0x0e100000 : "eeprom"
[4294667.642000] 0x00800000-0x00900000 : "bct"
+
[4294667.684000] 0x0e100000-0x0f900000 : "setup"
[4294667.647000] 0x00900000-0x00b00000 : "dbg"  
+
[4294667.689000] 0x0f900000-0x0fb00000 : "ofefw.0"
[4294667.652000] 0x00b00000-0x00f00000 : "kernel1"
+
[4294667.695000] 0x0fb00000-0x0fc00000 : "ofews.0"
[4294667.657000] 0x00f00000-0x01300000 : "kernel"
+
[4294667.700000] 0x0fc00000-0x0fe00000 : "ofefw.1"
[4294667.662000] 0x01300000-0x07900000 : "rootfs1"
+
[4294667.705000] 0x0fe00000-0x0ff00000 : "ofews.1"
[4294667.668000] 0x07900000-0x0df00000 : "rootfs"
+
[4294667.710000] 0x00700000-0x00800000 : "config"
[4294667.674000] 0x0df00000-0x0e000000 : "drmregion"
+
[4294667.715000] 0x00000000-0x0ff00000 : "all"
[4294667.679000] 0x0e000000-0x0e100000 : "eeprom"
+
#
[4294667.684000] 0x0e100000-0x0f900000 : "setup"
 
[4294667.689000] 0x0f900000-0x0fb00000 : "ofefw.0"
 
[4294667.695000] 0x0fb00000-0x0fc00000 : "ofews.0"
 
[4294667.700000] 0x0fc00000-0x0fe00000 : "ofefw.1"
 
[4294667.705000] 0x0fe00000-0x0ff00000 : "ofews.1"
 
[4294667.710000] 0x00700000-0x00800000 : "config"
 
[4294667.715000] 0x00000000-0x0ff00000 : "all"
 
#
 
 
 
 
 
   
 
   
Masz dostep do ROOT uCLinux w trybie pojedynczego uzytkownika
 
 
 
You have an ROOT access of uCLinux in single mode
 
You have an ROOT access of uCLinux in single mode
 
+
 
 
 
  # cat /etc/fstab
 
  # cat /etc/fstab
 
+
none    /dev/pts        devpts  gid=5,mode=620  0 0
 
+
none    /sys            sysfs  defaults        0 0
none    /dev/pts        devpts  gid=5,mode=620  0 0
+
none    /proc          proc    defaults        0 0
none    /sys            sysfs  defaults        0 0
+
none    /proc/bus/usb  usbfs  defaults        0 0
none    /proc          proc    defaults        0 0
+
none    /usr/vfs        ramfs  size=5m        0 0
none    /proc/bus/usb  usbfs  defaults        0 0
+
none    /filecache      ramfs  size=72m        0 0
none    /usr/vfs        ramfs  size=5m        0 0
+
none    /tmp            tmpfs  size=60m        0 0
none    /filecache      ramfs  size=72m        0 0
+
none    /var            tmpfs  size=32k        0 0
none    /tmp            tmpfs  size=60m        0 0
+
  #
none    /var            tmpfs  size=32k        0 0
 
   
 
 
    
 
    
 
Ponizej opisuje procedure zrzutu Kernel oraz Rootfs na serwer TFTP w LAN zakladajac, ze adres serwera TFTP to 192.168.1.150 a adres
 
 
playera 192.168.1.200. [msg] oznacza komunikat Linux
 
 
 
Kernel and Rootfs dump procedure is decribed below assuming that TFTP server has address 192.168.1.150 and player address is  
 
Kernel and Rootfs dump procedure is decribed below assuming that TFTP server has address 192.168.1.150 and player address is  
 
 
192.168.1.200.[msg] means a Linux reply.
 
192.168.1.200.[msg] means a Linux reply.
 
 
 
   
 
   
##### start as ROOT #####
+
##### start as ROOT #####
  
mount -t proc none /proc
+
mount -t proc none /proc
mount -t /dev/sda1 /tmp
+
mount -t /dev/sda1 /tmp
cd /tmp
+
cd /tmp
ls
+
ls
cat /proc/mtd
+
cat /proc/mtd
  
[msg] dev:    size  erasesize  name
+
[msg] dev:    size  erasesize  name
[msg] mtd0: 00100000 00020000 "cfe"
+
[msg] mtd0: 00100000 00020000 "cfe"
[msg] mtd1: 00600000 00020000 "splash"
+
[msg] mtd1: 00600000 00020000 "splash"
[msg] mtd2: 00000090 00020000 "macadr"
+
[msg] mtd2: 00000090 00020000 "macadr"
[msg] mtd3: 00000770 00020000 "nvram"
+
[msg] mtd3: 00000770 00020000 "nvram"
[msg] mtd4: 000ff800 00020000 "virtual"
+
[msg] mtd4: 000ff800 00020000 "virtual"
[msg] mtd5: 00100000 00020000 "bct"
+
[msg] mtd5: 00100000 00020000 "bct"
[msg] mtd6: 00200000 00020000 "dbg"
+
[msg] mtd6: 00200000 00020000 "dbg"
[msg] mtd7: 00400000 00020000 "kernel1"
+
[msg] mtd7: 00400000 00020000 "kernel1"
[msg] mtd8: 00400000 00020000 "kernel"  <----- THIS
+
[msg] mtd8: 00400000 00020000 "kernel"  <----- THIS
[msg] mtd9: 06600000 00020000 "rootfs1"
+
[msg] mtd9: 06600000 00020000 "rootfs1"
[msg] mtd10: 06600000 00020000 "rootfs" <----- THIS
+
[msg] mtd10: 06600000 00020000 "rootfs" <----- THIS
[msg] mtd11: 00100000 00020000 "drmregion"
+
[msg] mtd11: 00100000 00020000 "drmregion"
[msg] mtd12: 00100000 00020000 "eeprom"
+
[msg] mtd12: 00100000 00020000 "eeprom"
[msg] mtd13: 01800000 00020000 "setup"
+
[msg] mtd13: 01800000 00020000 "setup"
[msg] mtd14: 00200000 00020000 "ofefw.0"
+
[msg] mtd14: 00200000 00020000 "ofefw.0"
[msg] mtd15: 00100000 00020000 "ofews.0"
+
[msg] mtd15: 00100000 00020000 "ofews.0"
[msg] mtd16: 00200000 00020000 "ofefw.1"
+
[msg] mtd16: 00200000 00020000 "ofefw.1"
[msg] mtd17: 00100000 00020000 "ofews.1"
+
[msg] mtd17: 00100000 00020000 "ofews.1"
[msg] mtd18: 00100000 00020000 "config"
+
[msg] mtd18: 00100000 00020000 "config"
[msg] mtd19: 0ff00000 00020000 "all"
+
[msg] mtd19: 0ff00000 00020000 "all"
  
ifconfig eth0 192.168.1.200 netmask 255.255.255.0 up
+
ifconfig eth0 192.168.1.200 netmask 255.255.255.0 up
  
nanddump /dev/mtd8 -f kernel.gz
+
nanddump /dev/mtd8 -f kernel.gz
  
[msg] Block size 131072, page size 2048, OOB size 64
+
[msg] Block size 131072, page size 2048, OOB size 64
[msg] Dumping data starting at 0x00000000 and ending at 0x00400000...
+
[msg] Dumping data starting at 0x00000000 and ending at 0x00400000...
  
tftp -p 192.168.1.150 -l kernel.gz
+
tftp -p 192.168.1.150 -l kernel.gz
ls
+
ls
[msg] kernel.gz
+
[msg] kernel.gz
rm kernel.gz
+
rm kernel.gz  
  
nanddump /dev/mtd10 -s 0 -l 53477375 -f rootfs_1.bin
+
nanddump /dev/mtd10 -s 0 -l 53477375 -f rootfs_1.bin
  
[msg] Block size 131072, page size 2048, OOB size 64
+
[msg] Block size 131072, page size 2048, OOB size 64
[msg] Dumping data starting at 0x00000000 and ending at 0x032fffff...
+
[msg] Dumping data starting at 0x00000000 and ending at 0x032fffff...
  
tftp -p 192.168.1.150 -l rootfs_1.bin  
+
tftp -p 192.168.1.150 -l rootfs_1.bin  
  
ls
+
ls
[msg] rootfs_1.bin
+
[msg] rootfs_1.bin
rm rootfs_1.bin
+
rm rootfs_1.bin
  
nanddump /dev/mtd10 -s 53477376 -l 53477376 -f rootfs_2.bin
+
nanddump /dev/mtd10 -s 53477376 -l 53477376 -f rootfs_2.bin
  
[msg] Block size 131072, page size 2048, OOB size 64
+
[msg] Block size 131072, page size 2048, OOB size 64
[msg] Dumping data starting at 0x03300000 and ending at 0x06600000...
+
[msg] Dumping data starting at 0x03300000 and ending at 0x06600000...
  
tftp -p 192.168.1.150 -l rootfs_2.bin
+
tftp -p 192.168.1.150 -l rootfs_2.bin
  
ls
+
ls
[msg] rootfs_2.bin
+
[msg] rootfs_2.bin
rm rootfs_2.bin
+
rm rootfs_2.bin
  
 
##### End of DUMP procedure #####
 
##### End of DUMP procedure #####
 
    
 
    
 
   
 
   
Zrzut rootfs odbyl sie w dwoch czesciach ktore pozniej zostaly scalone w jeden plik.
+
The dump of rootfs was made in two parts which were concatenated into one file.  
The dump of rootfs was made in two parts which were concatenated into one file.
+
Files to download:
 
 
 
Files to download:
 
 
 
 
 
  kernel 8.31.231C.gz  - 4 MB
 
  kernel 8.31.231C.gz  - 4 MB
 
+
rootfs 8.31.231C.rar  - 67,9 MB  
rootfs 8.31.231C.rar  - 67,9 MB  
 
 
 
 
   
 
   
<begin>
+
<begin>
  
 
We will dump mtds' data directly to remote NFS mount - by Aleksey
 
We will dump mtds' data directly to remote NFS mount - by Aleksey
Line 409: Line 352:
  
  
[Restoring] - WARNING WARNING - this can be dangerous step. You should know what you're doing. Of course you have second
+
[Restoring] - WARNING WARNING - this can be dangerous step. You should know what you're doing. Of course you have second partition with kernel and rootfs and you can restore system but you must be careful :)  
                                                                  partition with kernel and rootfs and you can restore system but you must  
 
 
 
be careful :)  
 
  
 
1. Assuming you still at /mnt/nfs and there is located mtdX.dump you want to write to NAND partition mtdX.
 
1. Assuming you still at /mnt/nfs and there is located mtdX.dump you want to write to NAND partition mtdX.

Latest revision as of 09:52, 17 January 2012

The LG BD5xx players seem to have also had similar internals as the RCA-DSB and ST6xx media players. I came across these instructions on getting a terminal from a defunct BD5xx hacking site, still listed on archive.org

As terminal software can be used PuTTY. COM1 - 115200 8 N 1. After connecting the converter and runnig PuTTY you should power on player and quickly press Ctrl+C. You can see on the screen:


BCM76300010
Setting NAND Params
CFE starting from ROM
Chip specific init
TLB init
Board init
Starting memory configuration 
Valid memory config = D3128256
Disable refresh - set byte lane 8
Setting up PLL
Setting up memory controller
Enable DDR encryption
SoooooooooooooooR
Preparing to copy code to RAM
Prepare for NAND loading
Starting code in RAM
Booting Secured CFE...
BCM97630 B0-SEC-lg8_100126r0  CFE v2.11.10 (CFE core v2.11, BSP_REV 10), Endian Mode: Little
Build Date: 2010. 01. 26. (í) 11:36:34 KST (khy2766@nexus)
Copyright (C) Broadcom Corporation.
*jjc* PROD_REVISION is 0x76300010
*jjc* is 7630
DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
NAND vendor timing         : 98da9015 Toshiba TC58NVG1S3ETA00 SLC  t1(33535233) t2(80000b98)
Secure boot                : Enabled
Port lock                  : Enabled
doupdatecheck: nothing new and no try_count
Timestamp started ...
booting ARM...
Reading flash0.ofefw.1 to V:0x80000000 from offset 0 len 1048576
validating ofe fw_ldt@0x800fffb0 ...
parsed fw_ldt@800fffb0 : ws0_sadr=0xc0000 ws0_eadr=0xdffff prodid:BD READER R02
parsed fw_ws @800c0000 : vendor: LGH08SAN prodid: LG H08SAN BC7630
Reading flash0.ofews.1 to V:0x80100000 from offset 0 len 131072
parsed  WS@80100000 :  Vendor:LGH08SAN Prodid:LG H08SAN BC7630
updating fw_ws@800c0000 with flash0.ofews.1
ws was updated in the fw image succesfully
booting ARM...ofefw@0x2fd00000
done
Elapsed time  263mS (263280 uS)
Automatic startup canceled via Ctrl-C
CFE> ^C

You can use some CFE commands to see some important information. First try to type HELP <ENTER>

CFE> help
Available commands:
info                Show CFE configuration information
splashsd            Load's and Display's yuv:422 Splash Screen image
splash              Load's and Display's yuv:422 Splash Screen image
loop                Loop a command
dir                 List the directory of a FAT file system
macprog             Program MAC addresses.
macprog2            Program a specific MAC address.
initadv7622         Initialze adv7622 for HDMI showing CFE Logo
tstamp              Time stamp utility
flashmarkbb         Marks a specified block bad
flasherase          Erases a flash partition
flasheeprom         Update the EEPROM device on board
flash               Update a flash memory device
memtest             Test memory.
f                   Fill contents of memory. 
e                   Modify contents of memory.
d                   Dump memory.
u                   Disassemble instructions.
reboot              Invoke hardware reboot.
batch               Load a batch file into memory and execute it
go                  Start a previously loaded program.
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
boot                Load an executable file into memory and execute it
ping                Ping a remote IP host.
ifconfig            Configure the Ethernet interface
sleep               Sleep for specified milliseconds.
show heap           Display information about CFE's heap
show memory         Display the system physical memory map.
show devices        Display information about the installed devices.
unsetenv            Delete an environment variable.
printenv            Display the environment variables
setenv              Set an environment variable.
help                Obtain help for CFE commands
For more information about a command, enter 'help command-name'
*** command status = 0
CFE> 
 

INFO command shows information about CFE.


CFE> info
========================================================================
DDR                        : Bank0:128MB@667MHz | Bank1:256MB@667MHz
NAND Boot                  : FlashSize 256MB on CS0, BlkSize 128KB, PgSize 2048B
NAND vendor timing         : 98da9015 Toshiba TC58NVG1S3ETA00 SLC  t1(33535233) t2(80000b98)
Secure boot                : secure boot enabled, BSECK locked
Port lock                  : Enabled
Total memory used by CFE:  0x87000000 - 0x870936E4 (603876)
Initialized Data:          0x8708F860 - 0x87092C00 (13216)
BSS Area:                  0x87092D00 - 0x870936E4 (2532)
Local Heap:                0x87093800 - 0x87893800 (8388608)
Stack Area:                0x87893800 - 0x87895800 (8192)
Text (code) segment:       0x87000000 - 0x87023E18 (146968)
CFE driver build information:
LDR:   ELF   1; BIN   1; SREC  1
UI:    LEVEL 3; MIN   0
FS:    FAT   1; FAT32 1
NET:   STACK 1; ENET  1; TCP   0
USB:   STACK 0; ETH   1; DISK  1; SERIAL   1; HID 1
FLASH: NAND
p starts at b152a004, ends at b152a004
Total mem_sys_init write to register 0 times
Step    Address         Value
=====================================
*** command status = 0
CFE>

Important command PRINTENV shows information about system STARTUP. Don't try to change anything here using SETENV command!!!


CFE> printenv
Variable Name        Value
-------------------- --------------------------------------------------
       BOOT_CONSOLE uart0
        ETH0_HWADDR E8:5B:5B:A1:48:0D
            STARTUP splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 
                    OFE_SB=y quiet console=0,115200n8'
        CFE_VERSION 2.11.19
      CFE_BOARDNAME BCM97630 B0-SEC-RDEN400
     CFE_MEMORYSIZE 128
*** command status = 0
CFE>
 

If you want to get an access to ROOT of operating system and see BOOT process you need to use command below:

splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose debug console=0,115200n8 single ro'


CFE> splash -576p; boot -z -elf flash0.kernel: 'root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose 
console=0,115200n8 single ro'
Display splash screen
Using valid user input parameters - Resolution 576p on Component
[ Default Video ] :  Current Video Output : Component @ Resolution : 576p
Loading PAL SD image to 0x06646c00 size 829440 bytes
Reading flash0.splash to V:0xa6646c00 from offset 4838400 len 829440
Done displaying splash screen
Reading flash0.splash to V:0xa6e00000 from offset 5667840 len 44
Loader:elf Filesys:raw Dev:flash0.kernel File: Options:root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y 
verbose console=0,115200n8 single ro
Loading: 0x80008000/5427744 0x80535220/1327744
Successfully loaded secure elf image....
Entry address is 0x8000c330
Starting program at 0x8000c330
[    0.000000] -- DDR Bank 0: 128 MB
[    0.000000] -- DDR Bank 1: 256 MB
[    0.000000] Linux version 2.6.28.9 (ykhong@hyori) (gcc version 4.2.0 20070124 (prerelease) - BRCM 10ts-20080721) #189 Thu Jan 28 
18:54:14 KST 2010
[    0.000000] Kernel command line: root=/dev/romblock10 ro rootfstype=squashfs videotype=PAL memcfg=384 OFE_SB=y verbose 
console=0,115200n8 single ro
[4294667.366000] DIGSIG: no valid key, digsig security disabled
[4294667.389000] checker_0 control 0x00000008 addr low 0x00001000 hi 0x003be000
[4294667.396000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00000000
[4294667.405000] checker_1 control 0x00000008 addr low 0x003bf000 hi 0x027fff80
[4294667.412000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00e4f8a0
[4294667.421000] checker_2 control 0x00000008 addr low 0x20000000 hi 0x238fff80
[4294667.428000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00e4f8a0
[4294667.437000] checker_3 control 0x00000010 addr low 0x2fd00000 hi 0x2fdfff80
[4294667.444000] read rights _0 0xffffffff _1 0xffffffff write rights _0 0x00000000 _1 0x00010000
[4294667.466000] Driver 'sd' needs updating - please use bus_type methods
[4294667.473000] Driver 'sr' needs updating - please use bus_type methods
[4294667.487000] scsi 0:0:0:0: CD-ROM            LGH08SAN LG H08SAN BC7630 0591 PQ: 0 ANSI: 5
[4294667.497000] sr 0:0:0:0: Attached scsi generic sg0 type 5
[4294667.544000] brcmnand_probe: Found SLC device TOSHIBA SLC TC58NVG1S3ETA00
[4294667.550000] brcmnand_probe() oobSize: 16,  pageSize : 2048, blockSize: 131072<7>Writing nand config register 0x01402848 with 
0x16152300 
[4294667.585000] Creating 20 MTD partitions on "bcm7xxx-nand":
[4294667.591000] 0x00000000-0x00100000 : "cfe"
[4294667.596000] 0x00100000-0x00700000 : "splash"
[4294667.601000] 0x00700000-0x00700090 : "macadr"
[4294667.606000] mtd: partition "macadr" doesn't end on an erase block -- force read-only
[4294667.614000] 0x00700090-0x00700800 : "nvram"
[4294667.619000] mtd: partition "nvram" doesn't start on an erase block boundary -- force read-only
[4294667.628000] 0x00700800-0x00800000 : "virtual"
[4294667.633000] mtd: partition "virtual" doesn't start on an erase block boundary -- force read-only
[4294667.642000] 0x00800000-0x00900000 : "bct"
[4294667.647000] 0x00900000-0x00b00000 : "dbg" 
[4294667.652000] 0x00b00000-0x00f00000 : "kernel1"
[4294667.657000] 0x00f00000-0x01300000 : "kernel"
[4294667.662000] 0x01300000-0x07900000 : "rootfs1"
[4294667.668000] 0x07900000-0x0df00000 : "rootfs"
[4294667.674000] 0x0df00000-0x0e000000 : "drmregion"
[4294667.679000] 0x0e000000-0x0e100000 : "eeprom"
[4294667.684000] 0x0e100000-0x0f900000 : "setup"
[4294667.689000] 0x0f900000-0x0fb00000 : "ofefw.0"
[4294667.695000] 0x0fb00000-0x0fc00000 : "ofews.0"
[4294667.700000] 0x0fc00000-0x0fe00000 : "ofefw.1"
[4294667.705000] 0x0fe00000-0x0ff00000 : "ofews.1"
[4294667.710000] 0x00700000-0x00800000 : "config"
[4294667.715000] 0x00000000-0x0ff00000 : "all"
#

You have an ROOT access of uCLinux in single mode

# cat /etc/fstab
none    /dev/pts        devpts  gid=5,mode=620  0 0
none    /sys            sysfs   defaults        0 0
none    /proc           proc    defaults        0 0
none    /proc/bus/usb   usbfs   defaults        0 0
none    /usr/vfs        ramfs   size=5m         0 0
none    /filecache      ramfs   size=72m        0 0
none    /tmp            tmpfs   size=60m        0 0
none    /var            tmpfs   size=32k        0 0
# 
 

Kernel and Rootfs dump procedure is decribed below assuming that TFTP server has address 192.168.1.150 and player address is 192.168.1.200.[msg] means a Linux reply.

          1. start as ROOT #####
mount -t proc none /proc
mount -t /dev/sda1 /tmp
cd /tmp
ls
cat /proc/mtd
[msg] dev:    size   erasesize  name
[msg] mtd0: 00100000 00020000 "cfe"
[msg] mtd1: 00600000 00020000 "splash"
[msg] mtd2: 00000090 00020000 "macadr"
[msg] mtd3: 00000770 00020000 "nvram"
[msg] mtd4: 000ff800 00020000 "virtual"
[msg] mtd5: 00100000 00020000 "bct"
[msg] mtd6: 00200000 00020000 "dbg"
[msg] mtd7: 00400000 00020000 "kernel1"
[msg] mtd8: 00400000 00020000 "kernel"  <----- THIS
[msg] mtd9: 06600000 00020000 "rootfs1"
[msg] mtd10: 06600000 00020000 "rootfs" <----- THIS
[msg] mtd11: 00100000 00020000 "drmregion"
[msg] mtd12: 00100000 00020000 "eeprom"
[msg] mtd13: 01800000 00020000 "setup"
[msg] mtd14: 00200000 00020000 "ofefw.0"
[msg] mtd15: 00100000 00020000 "ofews.0"
[msg] mtd16: 00200000 00020000 "ofefw.1"
[msg] mtd17: 00100000 00020000 "ofews.1"
[msg] mtd18: 00100000 00020000 "config"
[msg] mtd19: 0ff00000 00020000 "all"
ifconfig eth0 192.168.1.200 netmask 255.255.255.0 up
nanddump /dev/mtd8 -f kernel.gz
[msg] Block size 131072, page size 2048, OOB size 64
[msg] Dumping data starting at 0x00000000 and ending at 0x00400000...
tftp -p 192.168.1.150 -l kernel.gz
ls
[msg] kernel.gz
rm kernel.gz 
nanddump /dev/mtd10 -s 0 -l 53477375 -f rootfs_1.bin
[msg] Block size 131072, page size 2048, OOB size 64
[msg] Dumping data starting at 0x00000000 and ending at 0x032fffff...
tftp -p 192.168.1.150 -l rootfs_1.bin 
ls
[msg] rootfs_1.bin
rm rootfs_1.bin
nanddump /dev/mtd10 -s 53477376 -l 53477376 -f rootfs_2.bin
[msg] Block size 131072, page size 2048, OOB size 64
[msg] Dumping data starting at 0x03300000 and ending at 0x06600000...
tftp -p 192.168.1.150 -l rootfs_2.bin
ls
[msg] rootfs_2.bin
rm rootfs_2.bin
          1. End of DUMP procedure #####


The dump of rootfs was made in two parts which were concatenated into one file. Files to download:

kernel 8.31.231C.gz   - 4 MB
rootfs 8.31.231C.rar  - 67,9 MB 

<begin>

We will dump mtds' data directly to remote NFS mount - by Aleksey

[Preparations (if you don't already have modified rootfs with telnet)]

1. Prepare NFS share on PC, which have enough freespace (~600 Mb for full dump). Assuming you doing it at linux.

  Owner of the shared folder: root
  Access mode: rwx for all (chmod u+rwx,o+rwx,g+rwx /path/to/share)

2. Boot BD560 in verbose & single mode.

3. Run partially /etc/init.d/rcS:

  export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
  export LD_LIBRARY_PATH=.:/usr/local/lib
  mount -a
  echo /sbin/hotplug > /proc/sys/kernel/hotplug 
  cat /proc/sys/kernel/sched_rt_period_us > /proc/sys/kernel/sched_rt_runtime_us
  echo 131071 > /proc/sys/net/core/rmem_max
  echo 131071 > /proc/sys/net/core/wmem_max
  echo "4096 87380 2080768" > /proc/sys/net/ipv4/tcp_rmem
  echo "4096 16384 2080768" > /proc/sys/net/ipv4/tcp_wmem
  mkdir /var/lock /var/log /var/run /var/tmp
  touch /var/run/utmp /var/log/wtmp
  chgrp utmp /var/run/utmp /var/log/wtmp
  chmod 0664 /var/run/utmp /var/log/wtmp
  ifconfig lo 127.0.0.1 netmask 255.0.0.0 up
  date 080100002010
  portmap

4. Up the network: ifconfig eth0 192.168.1.254 (ip is example, use any you like/can)

5. Mount remote fs: mount your_pc_ip:/path/to/share /mnt/nfs

[Dumping]

1. List mtds you have (useful): cat /proc/mtd

2. Chdir to /mnt/nfs

3. This is simple inline script for dumping all mtds (type at '#' prompt):

  for n in `seq 0 19`; do nanddump -f mtd$n.dump /dev/mtd$n; done

4. You should got 20 files in your shared folder:

  leshij[/home/share/nand/new]$ ls -l 
 -rw-r--r-- 1 nobody nogroup   1048576 2010-10-17 13:43 mtd0.dump
 -rw-r--r-- 1 nobody nogroup 106954752 2010-10-17 13:45 mtd10.dump
 -rw-r--r-- 1 nobody nogroup   1048576 2010-10-17 13:45 mtd11.dump
 -rw-r--r-- 1 nobody nogroup   1048576 2010-10-17 13:45 mtd12.dump
 ...etc...


[Restoring] - WARNING WARNING - this can be dangerous step. You should know what you're doing. Of course you have second partition with kernel and rootfs and you can restore system but you must be careful :)

1. Assuming you still at /mnt/nfs and there is located mtdX.dump you want to write to NAND partition mtdX.

2. Even simplier:

  nandwrite -e /dev/mtdX mtdX.dump

3. This will flash all acontents of mtdX with erasing first (-e key).