bbigg wrote:Doesn't this suggest that CFE, although its role is only as a boot monitor/loader, *is* getting built into the images I build. See the following output from the build script:
/opt/bcm963xx_router/hostTools/bcmImageBuilder \
--output bcm96368G1_cfe_fs_kernel \
--chip 6368 --board "96368VVW" --blocksize 64 \
--cfefile /opt/bcm963xx_router/targets/cfe/cfe6368.bin \
--rootfsfile rootfs.img \
--kernelfile vmlinux.lz \
--include-cfe
as well as:
createimg: Creating image with the following inputs:
Board id : 96368VVW
Number of Mac Addresses : 11
Base Mac Address: : 02:10:18:01:00:01
Main Thread Number: : 0
PSI Size: : 24
Input File Name : bcm96368G1_cfe_fs_kernel
Output File Name : bcm96368G1_flash_image_96368VVW
Image components offsets
cfe offset : 0xbfc00000 -- Length: 56856
file tag offset : 0xbfc10000 -- Length: 256
rootfs offset : 0xbfc10100 -- Length: 4141056
kernel offset : 0xc0003100 -- Length: 988308
I disassembled bcmImageBuilder to discover why it requires a --cfefile. The contents of the CFE are irrelevant to bcmImageBuilder. However, the file size of the CFE is used in the calculation of the offsets of the rootfs and the kernel images.
For example, if the CFE is found to be 58200 bytes and the flash IC uses an erase block size of 65536 bytes, then the tag header will start at $FLASH_BASE+0x10000, and the rootfs will start at $FLASH_BASE+0x10100, and the kernel will follow the end of the rootfs.
The CFE isn't always under 65536 bytes. For example, the CFE bootloader image in the bloaty firmware of the Zyxel P-2812HNU-51c, takes up nearly two 64KB flash blocks.[1]
The bcmImageBuilder tool requires a copy of the CFE bootloader to establish its file size, and to make those calculations of the rootfs and the kernel image offsets. The open source alternatives to the bcmImageBuilder tool typically allow the firmware hacker to specify his own offsets, but that increases the likelihood of errors.
Incidentally, using imagetag as a base, I developed a 100% compatible open source alternative to bcmImageBuilder. [2] It has identical command-line options to bcmImageBuilder (bIM), support for little-endian images, and it correctly calculates the image CRC where the image contains the CFE as well as the rootfs and kernel images. In coding that tool, I discovered a few oddities about bIM. For example, it's possible to use the tool to create a Broadcom flash image that contains ONLY the CFE bootloader.
cheers,
asbokid
[1] http://www.jstic.com/Newsgroup/Zyxel/P- … _infos.txt
[2] https://docs.google.com/leaf?id=0B6wW18 … p;hl=en_US
(Last edited by asbokid on 23 Jul 2011, 04:40)
