Broadcom BCM33xx

This page covers the BCM33xx SoC specificities, but the BCM63xx SoC are mostly the same chip, except that the DOCSIS/EuroDOCSIS core is replaced with a DSL one.

• The Broadcom BCM33xx currently only begins booting with the SB4xxx cable modems

• The OpenWrt support for the Broadcom BCM33xx SoC family currently only works with following models, using the target BCM63xx:
  • 3368

• We have no GPL'd drivers for Ethernet or DOCSIS so this makes the board pretty useless. DOCSIS would require images to be signed by CableLabs if to be used in a real environment, anyway.

Broadcom33xx SoC integrates DOCSIS/EuroDOCSIS features and routing.

There are many 33xx variants. Only those with a TLB will be supported:

This chip does not include a CPU itself.

Known platforms:

• 3Com HomeConnect Cable Modem
• Aastra PipeRider HM200
• Ambit 60098E/U
• Arris CM200[U]
• Askey CME03x
• Cisco uBR924
• Com21 DOXport 1010
• E-Tech ICE 200
• E-Tech ITCM
• GVC USB Cable Modem
• Motorola SURFboard 3100A/B
• Samsung InfoRanger ITCM/SCM-110R
• Thomson RCA DCM 205/215/225
• Zyxel Prestige 941

This chip seems to be a general-purpose MIPS CPU. It is usually included with other platforms like bcm47xx and such.

Known platforms:

• Motorola SURFboard 4200 cable modem
• Hitron BRG-3520

http://www.datasheetcatalog.org/datasheets2/15/155898_1.pdf

Known platforms:

• Motorola SURFboard 5100
• Motorola SBG900E
• Scientific-Atlanta WebStar DPX-2100
• Thomson TCM390

Known platforms:

• Motorola SURFboard 5101
• Scientific-Atlanta WebStar DPC2100
• Scientific-Atlanta WebStar EPX2203

Source code:

• Commscope SourceForge SB5101/SB5102

Known platforms:

• Motorola SURFboard 4000/410x
• Ambit 60218P
• Ambit 60194E
• Askey CME063
• Com21 DOXport 1110
• Hitron BRG-3510
• Icable ICS-110
• Linksys BEFCMUH4/BEFCMU10
• Thomson RCA DCM 235/305
• USRobotics USR6000

MIPS R3000 CPU without a TLB (random register always reads a 0)

Note: Ralf says this is just mostly R3000-*compatible*, so -march=mips32 is safer.

http://www.datasheetcatalog.org/datasheets/134/404172_DS.pdf

read_c0_prid() ⇒ 0x28000

NS16550 serial UART

i82559 Ethernet

Used in the SB4100 cable modem

Known platforms:

• Netgear CVG834G
• Scientific-Atlanta WebStar DPX/EPC 2203
• Cisco EPC2425
• Thomson AGC905

Known platforms:

• Cisco DPC3212/EPC3212
• Cisco DPC3825/EPC3825
• Cisco EPC3925
• Netgear CG3100
• Netgear CG3100v3
• Motorola SBG6580
• Thomson TWG870

Firmware and additional sources available for Technicolor TC7200

As per the readme for Broadcom's open source bootloader for the bcm3384, the SoC has 2 big-endian MIPS32R1 processors:

• One 'Viper' (BMIPS4355) core responsible for the cable modem/DOCSIS subsystem, running the eCos RTOS.
• One 'Zephyr' (BMIPS5000) application processor responsible for running other services, in most cases it runs a form of Linux.

The Viper core runs first, performing tasks including basic peripheral initialisation and preperation of the Linux image for the Zephyr.

Firmware and additional sources available for Technicolor TC7210 and TC7230

Known platforms:

• Motorola/Arris/Commscope SB8200/CM8200 (Linux kernel + eCos source: Commscope SourceForge 8200)

The support for Broadcom 33xx is at this state :

• Linux 2.6.x booting before failing to find init on bcm3348 (SB4200)
• Linux 2.6.x booting to BusyBox shell on bcm3349 (WebSTAR DPC2100)

• Talk with Broadcom related vendors to make them release some sources
• A u-boot port is required to get around secure boot (not secure app)/to replace the original bootloader and an ethernet driver needs to be written (binary blob Linux driver is a virtual link to eCos)

The Netgear CVG834G uses a bcm33xx chip and has GPL'd eCos. Netgear modified the Atlas driver in eCos to add the bcm3350.

• Technicolor opensourced some platforms: Github account of Technicolor
• Technicolor additional information for certain products Technicolor internal business website
• Commscope opensourced many platforms: Commscope SourceForge project list

Surfboard modems use a VxWorks bootloader (headers). For other modems, the official broadcom bootloaders are used (BOLT and cmboot); both bootloaders are proprietary. BOLT is used on bcm3384 and later, especially on bcm3390.

If a device is using the official broadcom bootloader (cmboot), it is possible to determine whether secure boot is enabled by looking for a “Cust key size” message on the serial console.

It should be noted that secure boot != secure app, where the former refers to bootrom validation of code stored in flash, and secure app refers to the validation of images passed to cmboot.

While secure boot might not let you replace cmboot with another bootloader, it is still possible to boot up a 2nd-stage bootloader if secure app is not enabled.

The list of related devices: bcm3368, bcm3380, bcm3383, bcm3384, bcm3390, bcm33xx