Sometimes even bad news have their good sides. My satellite receiver (Clarke-Tech ET9000, some Linux box) is broken and I need to return it to customer support. A bit of digging (it has a serial output for early boot messages) showed that the OS flash memory is broken (even though I haven't done anything) and needs to be replaced. The bootloader is in a separate flash, so that one still works. I'll send the box to customer support tomorrow.
But since I was already logged into the boot console, I thought I'd use the opportunity and play around a little. It turned out that the bootloader is based on Broadcom's Common Firmware Environment (CFE) and features a simple command line interface. The commands include some diagnostic stuff, memory dumps, directory listing of a USB stick, flashing images from TFTP or USB stick, loading files into memory and even booting some kernel (in ELF or raw binary format, uncompressed or gzip compressed) from USB, TFTP or flash. I wrote a very simple "Hello world!" assembly kernel printing some message to serial and managed to boot it from USB. It's quite some fun to play with this device, dig into MIPS assembly and figure out how things work.
I think I should write some wiki article here at OSDev including my "Hello world!" kernel, just in case...
Here's some hardware info on this device, including the boot process, which I just figured out today:
http://hardware.wikinet.org/wiki/ET9000http://hardware.wikinet.org/wiki/BCM7405BTW, the articles on BCM7405 and BCM2835 in my wiki are exceptionally popular - searching Google for those two ICs returns my wiki articles on the first few pages...