Differences

This shows you the differences between two versions of the page.

--- docs:techref:hardware:soc:soc.broadcom.bcm33xx [2019/09/02 15:04] – broken links fixed; proper table syntax applied tmomas
+++ docs:techref:hardware:soc:soc.broadcom.bcm33xx [2024/10/22 16:46] (current) – Add Netgear CG3000-2STAUS to the list rikka0w0
@@ Line 1: / Line 1: @@
 ====== Broadcom BCM33xx ======
 This page covers the BCM33xx SoC specificities, but the [[docs:techref:hardware:soc:soc.broadcom.bcm63xx|BCM63xx]] SoC are mostly the same chip, except that the DOCSIS/EuroDOCSIS core is replaced with a DSL one.
-  * The Broadcom BCM33xx currently only begins booting with the SB4xxx cable modems
+  * <del>The Broadcom BCM33xx currently only begins booting with the SB4xxx cable modems</del>. This only worked on [[https://github.com/openwrt/openwrt/pull/14559|the dropped bcm63xx target]].
 ===== Linux support =====
-  * The OpenWrt support for the Broadcom BCM33xx SoC family currently only works with following models, using the target [[docs:techref:hardware:soc:soc.broadcom.bcm63xx|BCM63xx]]:
+  * <del>The OpenWrt support for the Broadcom BCM33xx SoC family currently only works with following models, using the target [[docs:techref:hardware:soc:soc.broadcom.bcm63xx|BCM63xx]]</del>:
-    * **3368**
+    * <del>**3368**</del>
+BCM33xx support was partially introduced in the BCM63xx target. However, the BCM63xx target has been superseded by the BMIPS target, and we lost BCM33xx support (for now).
+There is a WIP support for BCM3380 on Netgear CG3100D:
+https://github.com/rikka0w0/openwrt-fast3864op/tree/bcm3380-20241014
+More progress can be found here:
+https://gist.github.com/rikka0w0/4e4d5feb3a50a8b64224750140f859ef
+There is an attempt to run Linux on TC7200 (BCM3383):
+https://github.com/jclehner/linux-technicolor-tc7200
 ===== Broadcom DOCSIS =====
-  * We have no GPL'd drivers for Ethernet or DOCSIS so this makes the board pretty useless
+  * We have no GPL'd drivers for Ethernet or DOCSIS so this makes the board pretty useless. DOCSIS would require images to be signed by CableLabs if to be used in a real environment, anyway.
 ===== What is this Broadcom 33xx stuff? =====
@@ Line 15: / Line 27: @@
 ===== What are 33xx variants? =====
 There are many 33xx variants. Only those with a TLB will be supported:
-^ Chip ^ CPU MHz ^ USB Device ^ VoIP ^ WiFi ^ DOCSIS ^ TLB ^ Product ID ^ -march ^ Surfboard ^
+^ Chip                                                                               ^ CPU MHz                             ^ USB Device  ^ VoIP     ^ WiFi           ^ DOCSIS       ^ TLB   ^ Product ID  ^ -march          ^ Surfboard  ^
-| [[http://www.datasheetcatalog.org/datasheets2/13/131978_1.pdf|bcm3300]]           |  n/a |   -   | - | - | 1.0/1.1 | - | - | - | 3100 |
+| [[http://www.datasheetcatalog.org/datasheets2/13/131978_1.pdf|bcm3300]]            |                                 n/a |  -          | -        | -              | 1.0/1.1      | Yes   | -           | mips32          | 3100       |
-| bcm3302                                                                           |  ?   |   ?   | ? | ? | - | ? | ? | ? | ? |
+| bcm3302                                                                            |  ?                                  |  ?          | ?        | ?              | -            | ?     | ?           | ?               | ?          |
-| [[http://www.datasheetcatalog.org/datasheets2/15/155898_1.pdf|bcm3345]]           |  140 |  1.1  | - | - | 1.0/1.1 | Yes? | 0x28000 | mips32? | 4200 |
+| [[http://www.datasheetcatalog.org/datasheets2/15/155898_1.pdf|bcm3345]]            |                    140Mhz MIPS (1x) |  1.1        | -        | -              | 1.0/1.1      | Yes?  | 0x28000     | mips32          | 4200       |
-| [[http://www.datasheetcatalog.org/datasheets/166/404171_DS.pdf|bcm3348]]          |  200 |  1.1  | - | - | 1.0/1.1/2.0 | Yes? | ? | mips32? | 5100 |
+| [[http://www.datasheetcatalog.org/datasheets/166/404171_DS.pdf|bcm3348]]           |                    200Mhz MIPS (1x) |  1.1        | -        | -              | 1.0/1.1/2.0  | Yes   | ?           | mips32          | 5100       |
-| [[http://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3349|bcm3349]]  |  200 |  1.1  | - | EBI/PCMCIA | 1.0/1.1/2.0 | Yes? | ? | mips32? | 5101 |
+| [[http://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3349|bcm3349]]   |                    200Mhz MIPS (1x) |  1.1        | -        | EBI/PCMCIA     | 1.0/1.1/2.0  | Yes   | ?           | mips32?         | 5101       |
-| [[http://www.datasheetcatalog.org/datasheets/134/404172_DS.pdf|bcm3350]]          |  100 |  1.1  | - | - | 1.0/1.1 | No  | 0x28000 | mips32? | 4100 |
+| [[http://www.datasheetcatalog.org/datasheets/134/404172_DS.pdf|bcm3350]]           |                    100Mhz MIPS (1x) |  1.1        | -        | -              | 1.0/1.1      | No    | 0x28000     | mips32          | 4100       |
-| [[http://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3368|bcm3368]]  |  300 |  1.1  | 2 lines | Expansion Bus | 2.0 | Yes | ? | mips32 | - |
+| [[http://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3368|bcm3368]]   |                    300Mhz MIPS (1x) |  1.1        | 2 lines  | Expansion Bus  | 2.0          | Yes   | ?           | mips32          | -          |
-| [[http://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3380|bcm3380]]  |  333 |  1.1  | 2 lines | miniPCIe | 3.0 | Yes | ? | mips32 | - |
+| [[http://datasheet.elcodis.com/pdf/48/45/484522/bcm3380dkfsbg.pdf|bcm3380]]        |                    333Mhz MIPS (2x) |  2.0 x2     | 2 lines  | miniPCIe       | 3.0          | Yes   | ?           | mips32          | -          |
-| [[https://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3382|bcm3382]] |    ? |  ?    | 2 lines | ? | 3.0 | ? | ? | ? | 6182 |
+| [[https://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3382|bcm3382]]  |                    400Mhz MIPS (2x) |  -          | 2 lines  | -              | 3.0          | Yes   | ?           | mips32          | 6182       |
-| [[http://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3383|bcm3383]]  |    ? |  2.0  | 2 lines | miniPCIe | 3.0 | Yes | ?  | mips32 | - |
+| [[http://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3383|bcm3383]]   |                    600Mhz MIPS (2x) |  2.0        | 2 lines  | miniPCIe       | 3.0          | Yes   | ?           | mips32          | -          |
-| [[http://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3384|bcm3384]]  |    ? |  ?    | ? | ? | 3.0| ? | ? | ? | - |
+| [[http://www.broadcom.com/products/Cable/Cable-Modem-Solutions/BCM3384|bcm3384]]   |                    600Mhz MIPS (2x) |  2.0        | ?        | miniPCIe       | 3.0          | Yes   | ?           | mips32          | -          |
+| [[https://www.broadcom.com/products/broadband/cable/modems/bcm3390|bcm3390]]       |  1.5Ghz ARM (2x), 675Mhz MIPS (2x)  |  2.0/3.0    | -        | miniPCIe       | 3.1          | Yes   | ?           | armv7-a/mips32  | 8200       |
 ==== bcm3300 ====
@@ Line 69: / Line 82: @@
   * [[https://oldwiki.archive.openwrt.org/oldwiki:openwrtdocs:hardware:scientific_atlanta:dpc2100|Scientific-Atlanta WebStar DPC2100]]
   * [[https://oldwiki.archive.openwrt.org/toh/scientific.atlanta/epx2203|Scientific-Atlanta WebStar EPX2203]]
+Source code:
+  * [[https://sourceforge.net/arris/sb5101/home/Home/|Commscope SourceForge SB5101/SB5102]]
 ==== bcm3350 ====
@@ Line 109: / Line 125: @@
   * [[toh:cisco:epc3825|Cisco DPC3825/EPC3825]]
   * [[toh:cisco:epc3925|Cisco EPC3925]]
-  * [[toh:netgear:cg3100dv3|Netgear CG3100v3]]
+  * [[:inbox:toh:openwrt:netgear_cg3100d_v3|Netgear CG3100Dv3, CG3100D]]
   * [[http://www.motorola.com/us/consumers/SBG6580-SURFboard®-eXtreme-Wireless-Cable-Modem/70902,en_US,pd.html?cgid=gateways-and-modems|Motorola SBG6580]]
-  * [[http://www.netgear.com/service-provider/products/routers-and-gateways/cable-gateways/cg3000_cg3100.aspx#two|Netgear CG3100]]
   * Thomson TWG870
@@ Line 117: / Line 132: @@
 Firmware and additional sources available for [[https://github.com/tch-opensrc/TC72XX_LxG1.0.10mp5_OpenSrc| Technicolor TC7200]]
+Known platforms:
+  * [[inbox:toh:netgear:c6300bd-1tlaus|Netgear C6300BD-1TLAUS]], [[https://www.downloads.netgear.com/files/GPL/C6300BD_1TLAUS_v1.01.03_src_20140319.zip | Firmware source code]]
+  * [[:inbox:toh:openwrt:cg3000-2staus| Netgear CG3000-2STAUS]], [[https://www.downloads.netgear.com/files/GPL/CG3000-2STAUS_V2.03.02n_GPL.zip | Firmware source code]]
+  * [[toh:netgear:cg3000dv2|Netgear CG3000Dv2 (N450)]], [[https://www.downloads.netgear.com/files/GPL/N450-100NAS_V1.02.10_src_20170912.zip | Firmware source code]]
 ==== bcm3384 ====
+As per the [[https://github.com/Broadcom/aeolus/blob/master/README.md| readme]] for Broadcom's open source bootloader for the bcm3384, the SoC has 2 big-endian MIPS32R1 processors:
+  * One 'Viper' (BMIPS4355) core responsible for the cable modem/DOCSIS subsystem, running the eCos RTOS.
+  * One 'Zephyr' (BMIPS5000) application processor responsible for running other services, in most cases it runs a form of Linux.
+The Viper core runs first, performing tasks including basic peripheral initialisation and preperation of the Linux image for the Zephyr.
 Firmware and additional sources available for [[https://github.com/tch-opensrc/TC72XX_LxG1.0.10mp5_OpenSrc| Technicolor TC7210 and TC7230]]
+==== bcm3390 ====
+Known platforms:
+  * Motorola/Arris/Commscope SB8200/CM8200 (Linux kernel + eCos source: [[https://sourceforge.net/projects/c8200-cable-modem.arris/files/|Commscope SourceForge 8200]])
 ===== Finished tasks =====
@@ Line 127: / Line 157: @@
 ===== TODO =====
   * Talk with Broadcom related vendors to make them release some sources
+  * A u-boot port is required to get around secure boot (not secure app)/to replace the original bootloader and an ethernet driver needs to be written (binary blob Linux driver is a virtual link to eCos)
     The Netgear CVG834G uses a bcm33xx chip and has GPL'd eCos. Netgear modified the Atlas driver in eCos to add the bcm3350.
   * Technicolor opensourced some platforms: [[https://github.com/tch-opensrc|Github account of Technicolor]]
   * Technicolor additional information for certain products [[http://ebroot.technicolor.com/opensw/documents/|Technicolor internal business website]]
+  * Commscope opensourced many platforms: [[https://sourceforge.net/arris/wiki/Projects/|Commscope SourceForge project list]]
 ===== Firmware/Bootloader =====
-Surfboard modems use a [[docs:techref:bootloader:vxworks|VxWorks]] bootloader.
+Surfboard modems use a [[docs:techref:bootloader:vxworks|VxWorks]] bootloader ([[docs:techref:headers]]). For other modems, the official broadcom bootloaders are used (BOLT and cmboot); both bootloaders are proprietary. BOLT is used on bcm3384 and later, especially on bcm3390.
-[[docs:techref:header]]
+=== Determining if secure boot is enabled ===
+If a device is using the official broadcom bootloader (cmboot), it is possible to determine whether secure boot is enabled by looking for a "Cust key size" message on the serial console.
+=== cmboot: secure boot and/or secure app? ==
+It should be noted that secure boot != secure app, where the former refers to bootrom validation of code stored in flash, and secure app refers to the validation of images passed to cmboot.
+While secure boot might not let you replace cmboot with another bootloader, it is still possible to boot up a 2nd-stage bootloader if secure app is not enabled.
+=== Aeolus ===
+Cable modems like Netgear CG3100D use a special proprietary bootloader called [[https://github.com/Broadcom/aeolus|Aeolus]]. Broadcom has decided to [[https://github.com/Broadcom/aeolus|open-source the Aeolus implementation for BCM3384]]. Although CG3100D is based on BCM3380, the ProgramStore utility from BCM3384's Aeolus can still be used to prepend necessary headers and compress the OpenWrt firmware image.
+=== U-Boot ===
+There is [[https://github.com/u-boot/u-boot/blob/7036abbd5c3934059b020d5fd5bcb8b3bf3c788c/arch/mips/dts/netgear%2Ccg3100d.dts|a U-Boot port for Netgear CG3100D]] by [[https://github.com/Noltari|Noltari]], who's also a core OpenWrt contributor. It only boots in RAM and almost everything (including ethernet and flash) does not work. See [[:inbox:toh:openwrt:netgear_cg3100d_v3]] for how to load it to your device's memory.
 ===== Devices =====
 The list of related devices:
-{{tagpage>bcm3300}},
-{{tagpage>bcm3302}},
-{{tagpage>bcm3345}},
-{{tagpage>bcm3348}},
-{{tagpage>bcm3349}},
-{{tagpage>bcm3350}},
 {{tagpage>bcm3368}},
 {{tagpage>bcm3380}},
 {{tagpage>bcm3383}},
 {{tagpage>bcm3384}},
+{{tagpage>bcm3390}},
 {{tagpage>bcm33xx}}