Locating the boot loader from userspace - embedded-linux

Question

I'm trying to locate the boot loader on an embedded device, I've found the root / squashfs image on /dev/mtdblock0 by cating the device, but other devices fail to cat (I get this output for /dev/mtd0-4 and /dev/mtdblock1-7):
# cat /dev/mtd0
cat: can't open '/dev/mtd0': No such device or address
Kernel command line
root=31:0 ro noinitrd console=ttyS0,115200
Another question, the flash device has 8192KB of space, but only 6488064 bytes can be accessed, How can I access the rest?
df
Filesystem 1024-blocks Used Available Use% Mounted on
/dev/root 6336 6336 0 100% /
cat /proc/mtd
# cat /proc/mtd
dev: size erasesize name
mtd0: 0062b000 0062b000 "Physically mapped flash"
boot log
<5>Linux version 2.6.30 (joan#bb4compile) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 SMP PREEMPT Tue Jun 5 15:40:48 CST 2012
<4>HS Serial flash device: name S25FL064, id 0x0116 size 8192KB
<4>963168VX prom init
<6>CPU revision is: 0002a080 (Broadcom4350)
<4>DSL SDRAM reserved: 0x132000
<6>Determined physical RAM map:
<6> memory: 03ece000 # 00000000 (usable)
<4>Zone PFN ranges:
<4> DMA 0x00000000 -> 0x00001000
<4> Normal 0x00001000 -> 0x00003ece
<4>Movable zone start PFN for each node
<4>early_node_map[1] active PFN ranges
<4> 0: 0x00000000 -> 0x00003ece
<7>On node 0 totalpages: 16078
<7>free_area_init_node: node 0, pgdat 803ccd10, node_mem_map 81000000
<7> DMA zone: 32 pages used for memmap
<7> DMA zone: 0 pages reserved
<7> DMA zone: 4064 pages, LIFO batch:0
<7> Normal zone: 94 pages used for memmap
<7> Normal zone: 11888 pages, LIFO batch:1
<4>Built 1 zonelists in Zone order, mobility grouping on. Total pages: 15952
<5>Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
<4>wait instruction: enabled
<4>Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
<4>Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
<6>NR_IRQS:128
<4>PID hash table entries: 256 (order: 8, 1024 bytes)
<6>console [ttyS0] enabled
<6>Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
<6>Memory: 59416k/64312k available (2979k kernel code, 4876k reserved, 866k data, 144k init, 0k highmem)
<6>Calibrating delay loop... 399.36 BogoMIPS (lpj=199680)
<4>Mount-cache hash table entries: 512
<6>--Kernel Config--
<6> SMP=1
<6> PREEMPT=1
<6> DEBUG_SPINLOCK=0
<6> DEBUG_MUTEXES=0
<4>Broadcom Logger v0.1 Jun 1 2012 11:30:49
<6>CPU revision is: 0002a080 (Broadcom4350)
<4>Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
<4>Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
<6>Calibrating delay loop... 402.43 BogoMIPS (lpj=201314)
<6>Brought up 2 CPUs
<6>net_namespace: 828 bytes
<6>NET: Registered protocol family 16
<4>Total Flash size: 8192K with 128 sectors
<4>Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00008e93-00008e80=19<300)
<4>registering PCI controller with io_map_base unset
<4>registering PCI controller with io_map_base unset
<4>bio: create slab <bio-0> at 0
<5>SCSI subsystem initialized
<6>usbcore: registered new interface driver usbfs
<6>usbcore: registered new interface driver hub
<6>usbcore: registered new device driver usb
<7>pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10013fff]
<7>pci 0000:00:00.0: reg 30 32bit mmio: [0x000000-0x0007ff]
<7>pci 0000:00:00.0: supports D1 D2
<6>pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
<6>pci 0000:00:00.0: PME# disabled
<7>pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]
<7>pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]
<6>pci 0000:01:00.0: PME# supported from D0 D3hot
<6>pci 0000:01:00.0: PME# disabled
<6>pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
<6>pci 0000:01:00.0: IO window: disabled
<6>pci 0000:01:00.0: MEM window: disabled
<6>pci 0000:01:00.0: PREFETCH window: disabled
<7>PCI: Setting latency timer of device 0000:01:00.0 to 64
<4>BLOG v3.0 Initialized
<4>BLOG Rule v1.0 Initialized
<4>Broadcom IQoS v0.1 Jun 1 2012 11:38:18 initialized
<4>Broadcom GBPM v0.1 Jun 1 2012 11:38:19 initialized
<6>NET: Registered protocol family 8
<6>NET: Registered protocol family 20
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 2048 (order: 2, 16384 bytes)
<6>TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
<6>TCP: Hash tables configured (established 2048 bind 2048)
<6>TCP reno registered
<6>NET: Registered protocol family 1
<6>squashfs: version 4.0 (2009/01/31) Phillip Lougher
<6>squashfs: version 4.0 with LZMA457 ported by BRCM
<6>NTFS driver 2.1.29 [Flags: R/W].
<6>fuse init (API version 7.11)
<6>msgmni has been set to 116
<6>io scheduler noop registered (default)
<7>PCI: Setting latency timer of device 0000:01:00.0 to 64
<4>Driver 'sd' needs updating - please use bus_type methods
<6>PPP generic driver version 2.4.2
<6>PPP Deflate Compression module registered
<6>PPP BSD Compression module registered
<6>NET: Registered protocol family 24
<4>bcm963xx_mtd driver v1.0
<4>File system address: 0xb8010100
<6>ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
<4>PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
<7>PCI: Setting latency timer of device 0000:00:0a.0 to 64
<6>ehci_hcd 0000:00:0a.0: EHCI Host Controller
<6>ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
<4>ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
<6>ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
<6>ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
<6>usb usb1: configuration #1 chosen from 1 choice
<6>hub 1-0:1.0: USB hub found
<6>hub 1-0:1.0: 2 ports detected
<6>ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
<4>PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
<7>PCI: Setting latency timer of device 0000:00:09.0 to 64
<6>ohci_hcd 0000:00:09.0: OHCI Host Controller
<6>ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
<6>ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
<6>usb usb2: configuration #1 chosen from 1 choice
<6>hub 2-0:1.0: USB hub found
<6>hub 2-0:1.0: 2 ports detected
<6>usbcore: registered new interface driver usblp
<6>Initializing USB Mass Storage driver...
<6>usbcore: registered new interface driver usb-storage
<6>USB Mass Storage support registered.
<4>brcmboard: brcm_board_init entry
<4>SES: Button Interrupt 0x1 is enabled
<4>SES: LED GPIO 0xc00f is enabled
<4>PCIe: No device found - Powering down
<6>Serial: BCM63XX driver $Revision: 3.00 $
<6>Magic SysRq enabled (type ^ h for list of supported commands)
<6>ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
<6>ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX
<4>bcmPktDma_init: Broadcom Packet DMA Library initialized
<4>Total # RxBds=1448
<4>bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized
<4>
<4>bcmxtmrt: Broadcom BCM3168C0 ATM/PTM Network Device v0.4 Jun 1 2012 11:36:30
<4>p8021ag: p8021ag_init entry
<3>IPSEC SPU: SUCCEEDED
<4>GACT probability NOT on
<4>Mirror/redirect action on
<4>u32 classifier
<4> input device check on
<4> Actions configured
<6>TCP cubic registered
<6>Initializing XFRM netlink socket
<6>NET: Registered protocol family 17
<6>NET: Registered protocol family 15
<6>Initializing MCPD Module
<6>Ebtables v2.0 registered
<6>ebt_time registered
<6>ebt_ftos registered
<6>ebt_wmm_mark registered
<6>802.1Q VLAN Support v1.8 Ben Greear <greearb#candelatech.com>
<6>All bugs added by David S. Miller <davem#redhat.com>
<4>VFS: Mounted root (squashfs filesystem) readonly on device 31:0.
<6>Freeing unused kernel memory: 144k freed
<4>bcm_ingqos: module license 'Proprietary' taints kernel.
<4>Disabling lock debugging due to kernel taint
<4>Broadcom Ingress QoS Module Char Driver v0.1 Jun 5 2012 15:35:13 Registered<243>
<4>
<4>Broadcom Ingress QoS ver 0.1 initialized
<4>BPM: tot_mem_size=67108864B (64MB), buf_mem_size=10066329B (9MB), num of buffers=4802, buf size=2096
<4>Broadcom BPM Module Char Driver v0.1 Jun 1 2012 11:34:43 Registered<244>
<4>[NTC bpm] bpm_set_status: BPM status : enabled
<4>
<4>NBUFF v1.0 Initialized
<4>Initialized fcache state
<4>Broadcom Packet Flow Cache Char Driver v2.2 Jun 5 2012 11:35:15 Registered<242>
<4>Created Proc FS /procfs/fcache
<4>Broadcom Packet Flow Cache registered with netdev chain
<4>Broadcom Packet Flow Cache learning via BLOG enabled.
<4>Constructed Broadcom Packet Flow Cache v2.2 Jun 1 2012 11:35:15
<4>chipId 0x631670E0
<4>Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jun 5 2012 15:34:45 Registered <241>
<4>FAP Debug values at 0x00000010 0x00000010
<4>Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000
<4>FAP Soft Reset Done
<4>4ke Reset Done
<4>Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000
<4>FAP Soft Reset Done
<4>4ke Reset Done
<4>Allocated FAP0 GSO Buffers (0xA29FC688) : 1048576 bytes # 0xA2B00000
<4>Allocated FAP1 GSO Buffers (0xA2A1C688) : 1048576 bytes # 0xA2400000
<4>[NTC fapProto] fapReset : Reset FAP Protocol layer
<4>[FAP0] DSPRAM : stack <0x80000000><1024>, global <0x80000400><7088>, free <80>, total<8192>
<4>[FAP1] DSPRAM : stack <0x80000000><1024>, global <0x80000400><7088>, free <80>, total<8192>
<4>[FAP0] PSM : addr<0x80002000>, used <24496>, free <80>, total <24576>
<4>[FAP1] PSM : addr<0x80002000>, used <24496>, free <80>, total <24576>
<4>[FAP0] Flows supported: 376 (dsp 85, psm 107, qsm 184)
<4>[FAP1] Flows supported: 376 (dsp 85, psm 107, qsm 184)
<4>[FAP0] DQM : availableMemory 14324 bytes, nextByteAddress 0xE001080C
<4>[FAP1] DQM : availableMemory 14324 bytes, nextByteAddress 0xE001080C
<4>[FAP0] GSO Buffer set to 0xA2B00000
<4>[FAP1] GSO Buffer set to 0xA2400000
<4>[FAP0] FAP BPM Initialized.
<4>[FAP1] FAP BPM Initialized.
<4>bcmPktDma_bind: FAP Driver binding successfull
<4>bcmxtmcfg: bcmxtmcfg_init entry
<4>adsl: adsl_init entry
<4>Broadcom BCM63168C0 Ethernet Network Device v0.1 Jun 1 2012 11:36:11
<4>fapDrv_psmAlloc: fapIdx=0, size: 3600, offset=b08206f0 bytes remaining 7408
<4>ETH Init: Ch:0 - 180 tx BDs at 0xb08206f0
<4>fapDrv_psmAlloc: fapIdx=1, size: 3600, offset=b0a206f0 bytes remaining 7408
<4>ETH Init: Ch:1 - 180 tx BDs at 0xb0a206f0
<4>fapDrv_psmAlloc: wastage 8 bytes
<4>fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821500 bytes remaining 2592
<4>ETH Init: Ch:0 - 600 rx BDs at 0xb0821500
<4>fapDrv_psmAlloc: wastage 8 bytes
<4>fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21500 bytes remaining 2592
<4>ETH Init: Ch:1 - 600 rx BDs at 0xb0a21500
<4>dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered
<4>eth0: MAC Address: AC:F1:DF:9D:43:71
<4>eth1: MAC Address: AC:F1:DF:9D:43:71
<4>eth2: MAC Address: AC:F1:DF:9D:43:71
<4>eth3: MAC Address: AC:F1:DF:9D:43:71
<4>[eth0, speed[100], Duplex[-1]]
<2>eth0 Link UP 100 mbps full duplex
<4>[eth1, speed[100], Duplex[-1]]
<2>eth1 Link UP 100 mbps full duplex
<4>[eth3, speed[100], Duplex[-1]]
<2>eth3 Link UP 100 mbps full duplex
<6>message received before monitor task is initialized kerSysSendtoMonitorTask
<4>Broadcom BCM3168C0 USB Network Device v0.4a Jun 1 2012 11:35:43
<4>usb0: MAC Address: AC F1 DF 9D 43 71
<4>usb0: Host MAC Address: AC F1 DF 9D 43 71
<3>hub 1-0:1.0: over-current change on port 2
<4>USBD Initialization done status 0
<4>USB Link DOWN.
<6>message received before monitor task is initialized kerSysSendtoMonitorTask
<4>[NTC arl] arlEnable : Enabled ARL binding to FAP
<4>Broadcom Adress Resolution Logic Processor (ARL) Char Driver v0.1 Jun 1 2012 11:34:42 Registered <245>
<4>--SMP support
<4>wl: dsl_tx_pkt_flush_len=338
<4>wl: high_wmark_tot=3121
<7>PCI: Setting latency timer of device 0000:00:00.0 to 64
<4>wl: passivemode=1
<4>wl: napimode=0
<4>wl0: allocskbmode=1 currallocskbsz=256
<4>otp_read_pci: bad crc
<4>Neither SPROM nor OTP has valid image
<4>wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
<4>wl:loading /etc/wlan/bcm6362_vars.bin
<4>Failed to open srom image from '/etc/wlan/bcm6362_vars.bin'.
<4>wl:loading /etc/wlan/bcm6362_map.bin
<4>wl0: Broadcom BCM435f 802.11 Wireless Controller 5.110.128.2018.cpe4.12L02.3
<4>dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
<6>Broadcom 802.1Q VLAN Interface, v0.1