Broadcom BCM33xx

This page covers the BCM33xx SoC specificities, but the BCM63xx SoC are mostly the same chip, except that the DOCSIS/EuroDOCSIS core is replaced with a DSL one.

  • The Broadcom BCM33xx currently only begins booting with the SB4xxx cable modems
  • The OpenWrt support for the Broadcom BCM33xx SoC family currently only works with following models, using the target BCM63xx:
    • 3368
  • We have no GPL'd drivers for Ethernet or DOCSIS so this makes the board pretty useless. DOCSIS would require images to be signed by CableLabs if to be used in a real environment, anyway.

Broadcom33xx SoC integrates DOCSIS/EuroDOCSIS features and routing.

There are many 33xx variants. Only those with a TLB will be supported:

Chip CPU MHz USB Device VoIP WiFi DOCSIS TLB Product ID -march Surfboard
bcm3300 n/a - - - 1.0/1.1 Yes - mips32 3100
bcm3302 ? ? ? ? - ? ? ? ?
bcm3345 140Mhz MIPS (1x) 1.1 - - 1.0/1.1 Yes? 0x28000 mips32 4200
bcm3348 200Mhz MIPS (1x) 1.1 - - 1.0/1.1/2.0 Yes ? mips32 5100
bcm3349 200Mhz MIPS (1x) 1.1 - EBI/PCMCIA 1.0/1.1/2.0 Yes ? mips32? 5101
bcm3350 100Mhz MIPS (1x) 1.1 - - 1.0/1.1 No 0x28000 mips32 4100
bcm3368 300Mhz MIPS (1x) 1.1 2 lines Expansion Bus 2.0 Yes ? mips32 -
bcm3380 333Mhz MIPS (1x) 1.1 2 lines miniPCIe 3.0 Yes ? mips32 -
bcm3382 400Mhz MIPS (2x) - 2 lines - 3.0 Yes ? mips32 6182
bcm3383 600Mhz MIPS (2x) 2.0 2 lines miniPCIe 3.0 Yes ? mips32 -
bcm3384 600Mhz MIPS (2x) 2.0 ? miniPCIe 3.0 Yes ? mips32 -
bcm3390 1.5Ghz ARM (2x), 675Mhz MIPS (2x) 2.0/3.0 - miniPCIe 3.1 Yes ? armv7-a/mips32 8200

This chip does not include a CPU itself.

Known platforms:

  • 3Com HomeConnect Cable Modem
  • Aastra PipeRider HM200
  • Ambit 60098E/U
  • Arris CM200[U]
  • Askey CME03x
  • Cisco uBR924
  • Com21 DOXport 1010
  • E-Tech ICE 200
  • E-Tech ITCM
  • GVC USB Cable Modem
  • Motorola SURFboard 3100A/B
  • Samsung InfoRanger ITCM/SCM-110R
  • Thomson RCA DCM 205/215/225
  • Zyxel Prestige 941

This chip seems to be a general-purpose MIPS CPU. It is usually included with other platforms like bcm47xx and such.

Known platforms:

Known platforms:

MIPS R3000 CPU without a TLB (random register always reads a 0)

Note: Ralf says this is just mostly R3000-*compatible*, so -march=mips32 is safer.

read_c0_prid() ⇒ 0x28000

NS16550 serial UART

i82559 Ethernet

Used in the SB4100 cable modem

Known platforms:

Firmware and additional sources available for Technicolor TC7200

Known platforms:

As per the readme for Broadcom's open source bootloader for the bcm3384, the SoC has 2 big-endian MIPS32R1 processors:

  • One 'Viper' (BMIPS4355) core responsible for the cable modem/DOCSIS subsystem, running the eCos RTOS.
  • One 'Zephyr' (BMIPS5000) application processor responsible for running other services, in most cases it runs a form of Linux.

The Viper core runs first, performing tasks including basic peripheral initialisation and preperation of the Linux image for the Zephyr.

Firmware and additional sources available for Technicolor TC7210 and TC7230

Known platforms:

The support for Broadcom 33xx is at this state :

  • Linux 2.6.x booting before failing to find init on bcm3348 (SB4200)
  • Linux 2.6.x booting to BusyBox shell on bcm3349 (WebSTAR DPC2100)
  • Talk with Broadcom related vendors to make them release some sources
  • A u-boot port is required to get around secure boot (not secure app)/to replace the original bootloader and an ethernet driver needs to be written (binary blob Linux driver is a virtual link to eCos)

The Netgear CVG834G uses a bcm33xx chip and has GPL'd eCos. Netgear modified the Atlas driver in eCos to add the bcm3350.

Surfboard modems use a VxWorks bootloader (headers). For other modems, the official broadcom bootloaders are used (BOLT and cmboot); both bootloaders are proprietary. BOLT is used on bcm3384 and later, especially on bcm3390.

Determining if secure boot is enabled

If a device is using the official broadcom bootloader (cmboot), it is possible to determine whether secure boot is enabled by looking for a “Cust key size” message on the serial console.

cmboot: secure boot and/or secure app?

It should be noted that secure boot != secure app, where the former refers to bootrom validation of code stored in flash, and secure app refers to the validation of images passed to cmboot.

While secure boot might not let you replace cmboot with another bootloader, it is still possible to boot up a 2nd-stage bootloader if secure app is not enabled.

The list of related devices: , , , , ,

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/19 16:43
  • by rikka0w0