![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
gdtA while back I bought a PVR. It's hard disk is failing and needs to be replaced. So let's have a look at the box.
Topfield allows packages of software to be installed. TMSTelnetd.tap includes Busybox. Install it and reboot. You can then telnet to the machine, log in as root with no password.
# cat /proc/cpuinfo system type : BCM97xxx Settop Platform build target : 7405b0-topfield processor : 0 cpu model : BMIPS4380 V4.4 FPU V0.1 cpu MHz : 402.43 BogoMIPS : 402.43 ( udelay_val : 201216 HZ = 1000 ) wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : yes hardware watchpoint : no ASEs implemented : mips16 VCED exceptions : not available VCEI exceptions : not available RAC setting : Unknown unaligned access : 7938 rdhwr/brdhwr traps : 0 / 0 process migrations : 109 processor : 1 cpu model : BMIPS4380 V4.4 FPU V0.1 cpu MHz : 404.48 BogoMIPS : 404.48 ( udelay_val : 202240 HZ = 1000 ) wait instruction : yes microsecond timers : yes tlb_entries : 32 extra interrupt vector : yes hardware watchpoint : no ASEs implemented : mips16 VCED exceptions : not available VCEI exceptions : not available RAC setting : Unknown
# pwd /root # ls fuse.ko libtap.so rc.user libgcc_s.so module.inc rt2870sta.ko libgcc_s.so.1 nexus.ko rt5370sta.ko libstdc++.so ntfs-3g rt73.ko libstdc++.so.6 osd51.bin run libstdc++.so.6.0.9 pvr
# lsmod Module Size Used by Tainted: P fuse 53168 0 - Live 0xc01d7000 rt73 306416 0 - Live 0xc0226000 rt2870sta 883584 0 - Live 0xc0417000 rt5370sta 1077760 0 - Live 0xc030e000 nexus 3905872 32 - Live 0xc065b000
So this is a Broadcom PVR system-on-chip. Broadcom provide the nexus.ko as a API to the system. That is pretty much a showstopper for a simple upgrade of the kernel. The pvr program is a C++ program which implements the user interface, recording reservations and so on. When pvr exits the system shuts down.
# cat /proc/version Linux version 2.6.18-7.1 (songhn@hdpvr.topfield.co.kr) (gcc version 4.2.0 20070124 (prerelease) - BRCM 11ts-20090508) #2 SMP Mon Nov 18 20:01:29 KST 2013
Why would we want to upgrade the kernel? Because the kernel version 2.6.18 has no explicit support for Advanced Format (4KB sector) hard disks.
# mount rootfs on / type rootfs (rw) none on /proc type proc (rw) none on /sys type sysfs (rw) none on /dev/pts type devpts (rw) none on /proc/bus/usb type usbfs (rw) /dev/sda1 on /mnt/games type jfs (rw,nointegrity) /dev/sda2 on /mnt/hd type jfs (rw,nointegrity)
"nointegrity" is why when the PVR crashes you lose your recorded program. It's not clear to me why a designer would make that choice.
# cat /proc/cmdline mac=00:0E:9E:03:D2:19 sysid=32030 version=258 flashsize=0x1000000 console=ttyS0,115200 rw
Looks like the bootloader passes in the MAC address.
# cat meminfo MemTotal: 319076 kB MemFree: 242964 kB Buffers: 8 kB Cached: 51100 kB SwapCached: 0 kB Active: 20848 kB Inactive: 33476 kB HighTotal: 0 kB HighFree: 0 kB LowTotal: 319076 kB LowFree: 242964 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 3192 kB Mapped: 2768 kB Slab: 8796 kB PageTables: 380 kB NFS_Unstable: 0 kB Bounce: 0 kB CommitLimit: 159536 kB Committed_AS: 8120 kB VmallocTotal: 786424 kB VmallocUsed: 7912 kB VmallocChunk: 776096 kB
# cat /proc/mtd dev: size erasesize name mtd0: 00c00000 00020000 "program" mtd1: 00080000 00020000 "cfe" mtd2: 00260000 00020000 "kernel" mtd3: 00100000 00020000 "data" mtd4: 00020000 00020000 "nvram"
# cat partitions major minor #blocks name 8 0 488386584 sda 8 1 2097152 sda1 8 2 486286849 sda2 31 0 12288 mtdblock0 31 1 512 mtdblock1 31 2 2432 mtdblock2 31 3 1024 mtdblock3 31 4 128 mtdblock4
The usual plague of unused devices, but the Nexus devices stand out.
# ls -l crw------- 1 root root 5, 1 Jan 1 00:00 console crw------- 1 root root 13, 64 Jan 1 00:00 event0 crw------- 1 root root 13, 65 Jan 1 00:00 event1 crw------- 1 root root 13, 66 Jan 1 00:00 event2 crw------- 1 root root 13, 67 Jan 1 00:00 event3 brw------- 1 root root 3, 0 Jan 1 00:00 hda brw------- 1 root root 3, 1 Jan 1 00:00 hda1 brw------- 1 root root 3, 2 Jan 1 00:00 hda2 brw------- 1 root root 3, 3 Jan 1 00:00 hda3 brw------- 1 root root 3, 4 Jan 1 00:00 hda4 brw------- 1 root root 3, 5 Jan 1 00:00 hda5 brw------- 1 root root 3, 6 Jan 1 00:00 hda6 brw------- 1 root root 22, 0 Jan 1 00:00 hdc brw------- 1 root root 22, 1 Jan 1 00:00 hdc1 brw------- 1 root root 22, 2 Jan 1 00:00 hdc2 brw------- 1 root root 22, 3 Jan 1 00:00 hdc3 brw------- 1 root root 22, 4 Jan 1 00:00 hdc4 brw------- 1 root root 22, 5 Jan 1 00:00 hdc5 brw------- 1 root root 22, 6 Jan 1 00:00 hdc6 crw------- 1 root root 1, 2 Jan 1 00:00 kmem srw-rw-rw- 1 root root 0 Jan 1 00:00 log brw------- 1 root root 7, 0 Jan 1 00:00 loop0 brw------- 1 root root 7, 1 Jan 1 00:00 loop1 brw------- 1 root root 7, 10 Jan 1 00:00 loop10 brw------- 1 root root 7, 11 Jan 1 00:00 loop11 brw------- 1 root root 7, 12 Jan 1 00:00 loop12 brw------- 1 root root 7, 13 Jan 1 00:00 loop13 brw------- 1 root root 7, 14 Jan 1 00:00 loop14 brw------- 1 root root 7, 15 Jan 1 00:00 loop15 brw------- 1 root root 7, 2 Jan 1 00:00 loop2 brw------- 1 root root 7, 3 Jan 1 00:00 loop3 brw------- 1 root root 7, 4 Jan 1 00:00 loop4 brw------- 1 root root 7, 5 Jan 1 00:00 loop5 brw------- 1 root root 7, 6 Jan 1 00:00 loop6 brw------- 1 root root 7, 7 Jan 1 00:00 loop7 brw------- 1 root root 7, 8 Jan 1 00:00 loop8 brw------- 1 root root 7, 9 Jan 1 00:00 loop9 crw------- 1 root root 1, 1 Jan 1 00:00 mem crw------- 1 root root 90, 0 Jan 1 00:00 mtd0 crw------- 1 root root 90, 2 Jan 1 00:00 mtd1 crw------- 1 root root 90, 4 Jan 1 00:00 mtd2 crw------- 1 root root 90, 6 Jan 1 00:00 mtd3 crw------- 1 root root 90, 8 Jan 1 00:00 mtd4 crw------- 1 root root 90, 10 Jan 1 00:00 mtd5 crw------- 1 root root 90, 12 Jan 1 00:00 mtd6 brw------- 1 root root 31, 0 Jan 1 00:00 mtdblock0 brw------- 1 root root 31, 1 Jan 1 00:00 mtdblock1 brw------- 1 root root 31, 2 Jan 1 00:00 mtdblock2 brw------- 1 root root 31, 3 Jan 1 00:00 mtdblock3 brw------- 1 root root 31, 4 Jan 1 00:00 mtdblock4 brw------- 1 root root 31, 5 Jan 1 00:00 mtdblock5 brw------- 1 root root 31, 6 Jan 1 00:00 mtdblock6 crw------- 1 root root 90, 1 Jan 1 00:00 mtdr0 crw------- 1 root root 90, 3 Jan 1 00:00 mtdr1 crw------- 1 root root 90, 5 Jan 1 00:00 mtdr2 crw------- 1 root root 90, 7 Jan 1 00:00 mtdr3 crw------- 1 root root 90, 9 Jan 1 00:00 mtdr4 crw------- 1 root root 90, 11 Jan 1 00:00 mtdr5 crw------- 1 root root 90, 13 Jan 1 00:00 mtdr6 crw-r--r-- 1 root root 33, 3 Jan 1 00:00 nexus_audio crw-r--r-- 1 root root 33, 14 Jan 1 00:00 nexus_core crw-r--r-- 1 root root 33, 2 Jan 1 00:00 nexus_display crw-r--r-- 1 root root 33, 9 Jan 1 00:00 nexus_dma crw-r--r-- 1 root root 33, 11 Jan 1 00:00 nexus_gpio crw-r--r-- 1 root root 33, 6 Jan 1 00:00 nexus_graphics2d crw-r--r-- 1 root root 33, 5 Jan 1 00:00 nexus_hdmi_output crw-r--r-- 1 root root 33, 12 Jan 1 00:00 nexus_i2c crw-r--r-- 1 root root 33, 0 Jan 1 00:00 nexus_platform crw-r--r-- 1 root root 33, 15 Jan 1 00:00 nexus_proxy crw-r--r-- 1 root root 33, 10 Jan 1 00:00 nexus_security crw-r--r-- 1 root root 33, 13 Jan 1 00:00 nexus_smartcard crw-r--r-- 1 root root 33, 7 Jan 1 00:00 nexus_surface crw-r--r-- 1 root root 33, 1 Jan 1 00:00 nexus_sync_channel crw-r--r-- 1 root root 33, 8 Jan 1 00:00 nexus_transport crw-r--r-- 1 root root 33, 4 Jan 1 00:00 nexus_video_decoder crw------- 1 root root 1, 3 Jan 1 00:00 null crw------- 1 root root 5, 2 Jan 1 08:32 ptmx drwxr-xr-x 2 root root 0 Jan 1 00:00 pts brw------- 1 root root 1, 0 Jan 1 00:00 ram0 brw------- 1 root root 1, 1 Jan 1 00:00 ram1 crw------- 1 root root 1, 8 Jan 1 00:00 random brw------- 1 root root 1, 0 Jan 1 00:00 root brw------- 1 root root 11, 0 Jan 1 00:00 scd0 brw------- 1 root root 11, 1 Jan 1 00:00 scd1 brw------- 1 root root 8, 0 Jan 1 00:00 sda brw------- 1 root root 8, 1 Jan 1 00:00 sda1 brw------- 1 root root 8, 2 Jan 1 00:00 sda2 brw------- 1 root root 8, 3 Jan 1 00:00 sda3 brw------- 1 root root 8, 4 Jan 1 00:00 sda4 brw------- 1 root root 8, 5 Jan 1 00:00 sda5 brw------- 1 root root 8, 6 Jan 1 00:00 sda6 brw------- 1 root root 8, 16 Jan 1 00:00 sdb brw------- 1 root root 8, 17 Jan 1 00:00 sdb1 brw------- 1 root root 8, 18 Jan 1 00:00 sdb2 brw------- 1 root root 8, 19 Jan 1 00:00 sdb3 brw------- 1 root root 8, 20 Jan 1 00:00 sdb4 brw------- 1 root root 8, 21 Jan 1 00:00 sdb5 brw------- 1 root root 8, 22 Jan 1 00:00 sdb6 brw------- 1 root root 8, 32 Jan 1 00:00 sdc brw------- 1 root root 8, 33 Jan 1 00:00 sdc1 brw------- 1 root root 8, 34 Jan 1 00:00 sdc2 brw------- 1 root root 8, 35 Jan 1 00:00 sdc3 brw------- 1 root root 8, 36 Jan 1 00:00 sdc4 brw------- 1 root root 8, 37 Jan 1 00:00 sdc5 brw------- 1 root root 8, 38 Jan 1 00:00 sdc6 brw------- 1 root root 8, 48 Jan 1 00:00 sdd brw------- 1 root root 8, 49 Jan 1 00:00 sdd1 brw------- 1 root root 8, 50 Jan 1 00:00 sdd2 brw------- 1 root root 8, 51 Jan 1 00:00 sdd3 brw------- 1 root root 8, 52 Jan 1 00:00 sdd4 brw------- 1 root root 8, 53 Jan 1 00:00 sdd5 brw------- 1 root root 8, 54 Jan 1 00:00 sdd6 brw------- 1 root root 8, 64 Jan 1 00:00 sde brw------- 1 root root 8, 65 Jan 1 00:00 sde1 brw------- 1 root root 8, 66 Jan 1 00:00 sde2 brw------- 1 root root 8, 67 Jan 1 00:00 sde3 brw------- 1 root root 8, 68 Jan 1 00:00 sde4 brw------- 1 root root 8, 69 Jan 1 00:00 sde5 brw------- 1 root root 8, 70 Jan 1 00:00 sde6 brw------- 1 root root 11, 0 Jan 1 00:00 sr0 brw------- 1 root root 11, 1 Jan 1 00:00 sr1 crw------- 1 root root 5, 0 Jan 1 00:00 tty crw------- 1 root root 4, 0 Jan 1 00:00 tty0 crw------- 1 root root 4, 1 Jan 1 00:00 tty1 crw------- 1 root root 4, 2 Jan 1 00:00 tty2 crw------- 1 root root 4, 3 Jan 1 00:00 tty3 crw------- 1 root root 4, 4 Jan 1 00:00 tty4 crw------- 1 root root 4, 5 Jan 1 00:00 tty5 crw------- 1 root root 4, 64 Jan 1 00:00 ttyS0 crw------- 1 root root 4, 65 Jan 1 08:32 ttyS1 crw------- 1 root root 4, 66 Jan 1 00:00 ttyS2 crw------- 1 root root 1, 9 Jan 1 00:00 urandom crw------- 1 root root 1, 5 Jan 1 00:00 zero