Show pagesourceOld revisionsBacklinksBack to top × Table of Contents Broadcom BCM63xx Linux support Finished tasks Broadcom xDSL Dual Core How to help Existent 63xx variants CPU caches Internal BUS TRNG Cipher Engine SPI Locating slave selects on the board GPIOs External IRQs Bootloader U-Boot Dump the flash Overclocking BCM6348 BCM6368, BCM6369 Pinouts BCM6338 pinout BCM6348 pinout BCM6358 pinout BCM6328 pinout BCM6368 pinout BCM6361 partial pinout BCM6838 pinout BCM63168 pinout Known 63xx platforms Some 6328 platforms*: Known 6338 platforms*: Known 6345 platforms*: Some 6348 platforms*: Some 6358 platforms*: Known 6361 platforms*: Known 6362 platforms*: Known 6368 platforms*: Known 63137 platforms*: Known 63167 platforms*: Known 63168 platforms*: Known 63268 platforms*: Devices Broadcom BCM63xx This page covers the BCM63xx soc specificities, but the BCM33xx SoC (excluding BCM3302 which is a CPU) are the exact same chip, except that the DSL core is replaced with a DOCSIS/EuroDOCSIS one. Broadcom63xx SoC integrates ADSL/ADSL2+ features, routing, and external Wireless NIC. This SoC is widely used by most xDSL platforms in the world. It is one of the most successful xDSL platforms due to the simplicity of migrating old platforms (e.g: BCM6345) to new ones without much software impact. For older SoCs, the architecture is based on the MIPS32 Big Endian instruction set, and shares some features with the R4000 microprocessor. For newer SoCs (see bcm63138 as an example), however, the architecture is now based on the ARMv7a Little Endian instruction set. Linux support The OpenWrt support for the Broadcom BCM63xx SoC family currently only works with following models: 6318 6328 6338 6345 6348 6358 / 6359 6361 / 6362 6368 / 6369 63167 / 63168 / 63169 / 63268 / 63269 There are working drivers for USB Host (OHCI and EHCI) and Ethernet under the GPL. USB Device drivers are also supported but only for BCM6368 and newer SoCs. → brcm63xx.imagetag Finished tasks The support for Broadcom 63xx is at this state : Runtime detection of the SoC: Full Linux support on which the kernel is running. Ethernet / switch: GPL driver. USB OHCI, EHCI: GPL driver. Watchdog: GPL driver. SPI: GPL driver, with minor bugs. Dual core: supported in BMC6368/6362/63268 and no support in BCM6358. NAND flash chips are supported since r13271 (kernel 5.4). SPU (Secure Processing Unit): The Cipher Engine has drivers since Linux kernel 4.11, but still not integrated into OpenWrt/LEDE Wifi core: not supported, initial work: WIP: bcm63xx: internal wireless support FAP (Broadcom Forwarding Assist Processor) not supported. This looks like some kind of hardware NAT. No available drivers (neither binary, nor GPL) for DSL, ATM, VoIP, on-board SLIC/SLAC, Broadcom xDSL xDSL and ATM are NOT SUPPORTED. Not by some binary nor are there GPL drivers available! Netgear has released some sources for DSL-driver: DG834GBv4 GPL and closed code https://forum.openwrt.org/viewtopic.php?id=24271 https://web.archive.org/web/20160622160227/http://comments.gmane.org/gmane.comp.embedded.openwrt.devel/17440 http://www.neufbox4.org/forum/viewtopic.php?pid=15930#p15930 https://github.com/cubieb/hg556a_source/tree/master/bcmdrivers/broadcom/char/adsl/bcm96358 here seems to be a quite complete stack for bcm6348/58 kernel 2.6 → BCM63xx ADSL Support on Linux kernel 2.6.8.1 effort to make it work again on Linux kernel 2.6.8.1 from 2004-08-14 Dual Core Some SoCs like BCM6358, BCM6361, BCM6362 and BCM6368 have two cores. BCM6358 only uses 1 core. Spite there being SMP code for using two cores in the kernel (see smp-bmips.c), it seems hard to use both cores: it is needed to initialize the second cpu; also the irq code code currently only enables irqs on the first cpu, so only userspace can use the second core, all interrupt handlers will use the first one. → SMP/CMT Broadcom 63xx How to help Download: DG834GBv4 GPL and closed code and help writing specification for the DSL core, the place to host specifications is BCM63xx at Sipsolutions.net. Improve the bcm63xx SPI driver. Dual core SMP/CMT still needs further work, specially for BCM6358 with a shared TLB. If you know how to get rid of the problem of having a shared TLB between 2 cores, with working code, please contact with developers see → TLB exception handlers BCM63168 with Kernel 3.4 source can be found here: 100AAJX8_4.16L.02A GPL and closed code. BCM63168D0 with Kernel 2.6.30 source can be found here: 100AAPP7D0_4.12L.06B_consumer_release GPL and open source code. Existent 63xx variants SoC CPU MHz Dual Core RAM NAND USB Device USB Host PCMCIA / PCCARD PCI PCIe Wireless NIC Switch ADSL2 ADSL2+ VDSL VDSL2 Fiber OpenWrt bcm6318 333 ☐ DDR ☐ 2.0 2.0 ☐ ☐ ✔ ☐ ✔ ✔ ✔ ☐ ☐ ☐ bcm6328 320 ☐ DDR2 ✔ 2.0 2.0 ☐ ☐ ✔ ☐ ✔ ✔ ✔ ☐ ☐ ☐ 12.09 bcm6329 320 ✔ DDR2 ✔ 2.0 2.0 ☐ ☐ ✔ ☐ ✔ ☐ ☐ ☐ ☐ ☐ bcm6335 140 ☐ SDR ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ✔ ☐ ☐ ☐ ☐ bcm6338 240 ☐ SDR ☐ 1.1 ☐ ☐ ☐ ☐ ☐ ☐ ✔ ✔ ☐ ☐ ☐ 10.03 bcm6345 140 ☐ SDR ☐ 1.1 ☐ ✔ ☐ ☐ ☐ ☐ ✔ ☐ ☐ ☐ ☐ 10.03 bcm6348 256 ☐ SDR ☐ 1.1 1.1 ✔ ✔ ☐ ☐ ☐ ✔ ✔ ☐ ☐ ☐ 10.03 bcm6358 300 ✔ DDR ☐ 1.1 2.0 ✔ ✔ ☐ ☐ ☐ ✔ ✔ ☐ ☐ ☐ 10.03 bcm6359 300 ✔ DDR ☐ 2.0 2.0 ✔ ✔ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ 10.03 bcm6361 bcm6362 400 ✔ DDR2 ✔ 2.0 2.0 ☐ ☐ ✔ ✔ ✔ ✔ ✔ ☐ ☐ ☐ r32923 bcm6367 400 ✔ DDR ✔ 2.0 2.0 ✔ ✔ ☐ ☐ ✔ ✔ ✔ ✔ ☐ ☐ 12.09 bcm6368 400 ✔ DDR ✔ 2.0 2.0 ✔ ✔ ☐ ☐ ✔ ✔ ✔ ✔ ✔ ☐ 12.09 bcm6369 400 ✔ DDR ✔ 2.0 2.0 ✔ ✔ ☐ ☐ ✔ ☐ ☐ ☐ ☐ ☐ bcm63167 bcm63168 bcm63268 400 ✔ DDR2/3 ✔ 2.0 2.0 ☐ ☐ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ☐ bcm63169 bcm63269 400 ✔ DDR2 ✔ 2.0 2.0 ☐ ☐ ✔ ✔ ✔ ☐ ☐ ☐ ☐ ☐ bcm6816 400 ✔ DDR2 ✔ 2.0 2.0 ✔ ✔ ✔ ☐ ✔ ☐ ☐ ☐ ☐ ✔ bcm6818 400 ✔ DDR2 ✔ 2.0 2.0 ✔ ✔ ✔ ☐ ✔ ☐ ☐ ☐ ☐ ✔ bcm63138 1000 ✔ DDR3 ✔ 3.0 3.0 ☐ ☐ ✔ ☐ ? ✔ ✔ ✔ ✔ ☐ bcm63139 1000 ✔ DDR3 ✔ 3.0 3.0 ☐ ☐ ? ☐ ✔ ? ? ? ? ☐ The third digit, when set to 3 (like in BCM6335, BCM6338) denotes a single-chip and cost-reduction oriented design. There are also some other variants like bcm6341, which is a DSP used in VoIP products in conjunction with a BCM6348 SoC. The bcm63138 supports G.fast, G.inp and SRA. CPU caches icache dcache SoC CPU version Core Size (kB) Associativity Linesize (bytes) Cache policy Size (kB) Associativity Aliases Linesize (bytes) Cache policy BCM6348 BMIPS3300 V0.7 0 16 2-way 16 VIPT 8 2-way ☐ 16 VIPT BCM6318 BMIPS3300 v3.3 0 64 4-way 16 VIPT 32 2-way ✔ 16 VIPT BCM6358 BMIPS4350 V1.0 0 32 2-way 16 VIPT 16 2-way ✔ 16 VIPT 1 16 2-way 16 VIPT BCM6368 BMIPS4350 V3.1 0 64 4-way 16 VIPT 32 2-way ✔ 16 VIPT 1 64 4-way 16 VIPT BCM6361 BMIPS4350 V7.0 0 32 4-way 16 VIPT 32 2-way ✔ 16 VIPT 1 32 4-way 16 VIPT BCM6328 BMIPS4350 v7.5 0 32 4-way 16 VIPT 32 2-way ✔ 16 VIPT BCM63168 BMIPS4350 V8.0 0 64 4-way 16 VIPT 32 2-way ✔ 16 VIPT 1 64 4-way 16 VIPT VIPT = Virtually indexed, physically tagged See → http://www.linux-mips.org/wiki/Caches Internal BUS SSB: 6348, 6358, 6368 BCMA: 6318, 6328, 6362, 63168, 63268 TRNG Hardware random number generator Only available in BCM6362, BCM6368, BCM6816. GPL supported. bcm63xx-rng.c dev-rng.c To take advantage of this hardware feature, rng-tools should be installed. Cipher Engine BCM63xx SoCs have cryptographic hardware accelerators. The Cipher engine accelerates the IPSec protocol by using dedicated hardware blocks. BCM63XX SoCs (all family? ) are implemented with the Encapsulating Security Payload (ESP) and Authentication Header (AH) IPSec protocols: AES and DES/3DES hardware encryption and decryption. AES in both Cipher Block Chaining (CBC) mode and Counter (CTR) mode. Can be performed in 128-, 192-, and 256-bit modes. DES, 3DES in Cipher Block Chaining (CBC) mode HMAC-SHA1 and HMAC-MD5 authentication in hardware. This what Broadcom calls SPU (Secure Processing Unit). The driver is available with GPL http://code.google.com/p/gfiber-gflt100/source/browse/bcmdrivers/opensource/char/spudd/impl2/ The SPU drivers has been added since Linux kernel v4.11 → https://github.com/torvalds/linux/commit/9d12ba8 But there isn't still support for SPU under OpenWrt/LEDE. SPI Serial Peripheral Interface Two types of SPI controllers are present in BCM63xx: SPI : Not available in 6318, 6328, 6345 HSSPI: High speed SPI, only available in 6318, 6328, 6362, 63268 SoCs By default only one or two (more in newer SoCs) Slave Selects are available. Additional Slave Selects are at GPIO lines, but they need to be enabled. (SPI) Slave Select 0 Slave Select 1 Slave Select 2 Slave Select 3 Slave Select 4 Slave Select 5 BCM6338 ✔ ✔ ✔ ☐ ☐ ☐ BCM6348 ✔ GPIO29 GPIO30 GPIO31 ☐ ☐ BCM6358 ✔ ✔ GPIO32 GPIO33 ☐ ☐ BCM6368 BCM6816 BCM6818 ✔ ✔ GPIO28 GPIO29 GPIO30 GPIO31 BCM6362 ✔ ✔ GPIO9 GPIO10 ☐ ☐ (HSSPI) Slave Select 0 Slave Select 1 Slave Select 2 Slave Select 3 Slave Select 4 Slave Select 5 Slave Select 6 Slave Select 7 BCM6328 ✔ ✔ ✔ ✔ ☐ ☐ ☐ ☐ BCM6828 ✔ ✔ GPIO16 GPIO17 GPIO9 ☐ ☐ ☐ BCM63268 ✔ ✔ ✔ ✔ GPIO16 GPIO17 GPIO8 GPIO9 Snippet code example for enabling these extra slave-selects at GPIOs: /* BCM6348 */ u32 val; /* Enable Extra SPI CS */ /* GPIO 29 is SS1, GPIO 30 is SS2, GPIO 31 is SS2 */ val = bcm_gpio_readl(GPIO_MODE_REG); val |= GPIO_MODE_6348_G1_SPI_MASTER; bcm_gpio_writel(val, GPIO_MODE_REG); /* BCM6358 */ u32 val; /* Enable Overlay for SPI SS Pins */ val = bcm_gpio_readl(GPIO_MODE_REG); val |= GPIO_MODE_6358_EXTRA_SPI_SS; bcm_gpio_writel(val, GPIO_MODE_REG); /* Enable SPI Slave Select as Output Pins */ /* GPIO 32 is SS2, GPIO 33 is SS3 */ val = bcm_gpio_readl(GPIO_CTL_HI_REG); val |= 0x0003; bcm_gpio_writel(val, GPIO_CTL_HI_REG); /* BCM6368 */ u32 val; /* Enable Extra SPI CS */ val = bcm_gpio_readl(GPIO_MODE_REG); val |= (GPIO_MODE_6368_SPI_SSN2 | GPIO_MODE_6368_SPI_SSN3 | GPIO_MODE_6368_SPI_SSN4 | GPIO_MODE_6368_SPI_SSN5); bcm_gpio_writel(val, GPIO_MODE_REG); /* Enable SPI Slave Select as Output Pins */ /* GPIO 28 is SS2, GPIO 29 is SS3, GPIO 30 is SS4, GPIO 31 is SS5*/ val = bcm_gpio_readl(GPIO_CTL_LO_REG); val |= (GPIO_MODE_6368_SPI_SSN2 | GPIO_MODE_6368_SPI_SSN3 | GPIO_MODE_6368_SPI_SSN4 | GPIO_MODE_6368_SPI_SSN5); bcm_gpio_writel(val, GPIO_CTL_LO_REG); /* BCM6328 */ #define SEL_SPI2 8 #define PINMUX_SEL_SPI2_MASK (3 << SEL_SPI2) #define PINMUX_SEL_SPI2 (2 << SEL_SPI2) u32 val; /* configure pinmux to SPI extra Slave Select */ val = bcm_gpio_readl(GPIO_PINMUX_OTHR_REG); val &= ~PINMUX_SEL_SPI2_MASK; bcm_gpio_writel(val, GPIO_PINMUX_OTHR_REG); val = bcm_gpio_readl(GPIO_PINMUX_OTHR_REG); val |= PINMUX_SEL_SPI2; bcm_gpio_writel(val, GPIO_PINMUX_OTHR_REG); /* BCM63268 */ #define GPIO_MODE_63268_HSSPI_SSN4 (1 << 16) #define GPIO_MODE_63268_HSSPI_SSN5 (1 << 17) #define GPIO_MODE_63268_HSSPI_SSN6 (1 << 8) #define GPIO_MODE_63268_HSSPI_SSN7 (1 << 9) u32 val; /* GPIO 16 is SS4, GPIO 17 is SS5, GPIO 8 is SS6, GPIO 9 is SS7*/ val = bcm_gpio_readl(GPIO_MODE_REG); val |= (GPIO_MODE_63268_HSSPI_SSN4 | GPIO_MODE_63268_HSSPI_SSN5 | GPIO_MODE_63268_HSSPI_SSN6 | GPIO_MODE_63268_HSSPI_SSN7); bcm_gpio_writel(val, GPIO_MODE_REG); Locating slave selects on the board We can locate slave selects on the board by toggling the state of them. Build a firmware with devmem enabled in busybox and kernel Use this script to blink a slave select #!/bin/sh # Toggle the SPI_SS_POLARITY, "blink" the SPI chip select # Example: "blink" the chip select 2 # ./sstoggle.sh 2 #6318 #SPIBASE=0x10003000 #6328 6362 63268 SPIBASE=0x10001000 DEFAULT=`devmem $SPIBASE` OFF=`printf "0x%x" "$(( $DEFAULT | (1 << $1) ))"` ON=`printf "0x%x" "$(( $DEFAULT & ~(1 << $1) ))"` while true; do devmem $SPIBASE 32 $OFF echo "[OFF]: $SPIBASE 32 $OFF" sleep 1 devmem $SPIBASE 32 $ON echo "[ON ]: $SPIBASE 32 $ON" sleep 1 done Use a voltimeter or a led (with a 270 ohm series resistor) to see if the candidate for the SPI slave select on the board blinks The script is only valid for HSSPI. GPIOs General Purpose Input/Output On bcm63xx boards the GPIOs are used for diferent purposes: software leds: the GPIOs are controled by the linux kernel, and can be user configured by using led triggers drivers. hardware leds: the GPIOs are multiplexed to act as pure leds controled by hardware. The GPIO functionality is lost, avoiding to control them with OpenWrt. They can monitor LAN activity, serial activity, and so on. They can be software controled again by writing some particular registers of the SoC. buttons: configured as inputs, software controled using the polling method. Can be configured by the user to trigger events. other hardware: some GPIOs are wired to hardware specific interfaces, such as PCI, PCMCIA, ethernet, UART, SPI, and so on. They are multiplexed and enabled by OpenWrt during initialization of the board devices. See BCM6348 GPIO pinmux The amount of GPIOs of each SoC model is different: BCM6333 BCM6338 BCM6345 BCM6348 BCM6358 BCM6368 BCM6318 BCM6328 BCM6362 BCM63268 GPIO count 5 8 16 37 38 38 50 32 48 52 When having more than 32 GPIOs they are splitted between 2 gpiochips. The labels in the Linux kernel are: bcm63xx-gpio.0 bcm63xx-gpio.1 External IRQs A few GPIOs are shared with external IRQs on most SoCs except BCM6338 External interrupts IRQ_EXT_0 IRQ_EXT_1 IRQ_EXT_2 IRQ_EXT_3 IRQ_EXT_4 IRQ_EXT_5 BCM6318 GPIO32 GPIO33 ? ? ☐ ☐ BCM6328 GPIO23 GPIO24 GPIO15 GPIO12 ☐ ☐ BCM6338 ✔ ✔ ☐ ☐ ☐ ☐ BCM6345 ? ? ? ? ☐ ☐ BCM6348 GPIO32 GPIO33 GPIO34 GPIO35 GPIO36 ☐ BCM6358 GPIO34 GPIO35 GPIO36 GPIO37 GPIO32 GPIO33 BCM6368 BCM6362 GPIO24 GPIO25 GPIO26 GPIO27 ☐ ☐ BCM63268 GPIO32 GPIO33 GPIO34 GPIO35 ☐ ☐ *) Guessed Caveats: IRQ_EXT_4 and IRQ_EXT_5 aren't defined in the kernel driver IRQ_EXT_4 and IRQ_EXT_5 aren't implemented in BCM6358 SoC (OpenWrt ≤ Barrier Breaker). Proposed patch for Barrier Breaker → http://pastebin.com/xaqJznWw IRQ_EXT_4 in BCM6348 cannot be managed because it seems there isn't enough CP0 CAUSE registers to do the job. In Chaos Calmer version the external IRQs are broken → https://dev.openwrt.org/ticket/21613 Since LEDE Reboot there is full support for external IRQs with “gpio to irq” translation. → https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=dd7079e79a Snippet kernel code example: a button press triggers an IRQ, printing something on the console. Tested on BCM6348, Openwrt 12.09 and GPIO33 connected to an external button. #include <linux/kernel.h> #include <linux/err.h> #include <linux/module.h> #include <linux/spinlock.h> #include <linux/interrupt.h> #include <bcm63xx_cpu.h> #include <bcm63xx_io.h> #include <bcm63xx_regs.h> #include <bcm63xx_irq.h> static irqreturn_t gpio_interrupt(int irq, void *dev_id) { printk("my IRQ triggered!!!!\n"); return IRQ_HANDLED; } int bcm63xx_button_init(void) { int ret, irq; printk("TEST IRQ (GPIO-button)\n"); irq = IRQ_EXT_1; ret = request_irq(irq, gpio_interrupt, 0, "bcm63xx_extIRQ", NULL); if (ret) { printk(KERN_ERR "bcm63xx-extIRQ: failed to register irq %d\n",irq); return ret; } printk("Mapped IRQ %d\n", irq ); return 0; } arch_initcall(bcm63xx_button_init); Bootloader bootloader: Some devices use redboot such as Inventel Liveboxes. Most of the others use cfe with a built-in LZMA decompressor. CFE is not using standard LZMA compression arguments, and most noticeably, changes the dictionary size, so beware. Thomson routers have their own bootloader. There is released source code for RedBoot (Inventel Livebox), and probably can be modified to work with other routers. Also there is some source code for uboot. TBSBOOT (crippled U-Boot) source code with the toolchain included for vx160 SoCs but with some code for bcm6338, bcm6348 and bcm6358: UBOOT-sourcecode-vx160.tar.gz RedBoot source code for Inventel Liveboxes (bcm6348) : REDBOOT-sourcecode-blue5g.tar.gz On several CPE (Customer-premises equipment) hardware devices and especially on smart phones, the OEM bootloaders are feature poor (no netboot, no booting from a USB stick, etc.), obfuscated (require some magic values to be correct) or completely messed up and make it cumbersome, difficult or impossible to install free software on the device. It is thus paramount to always have at least some products available, that have OEM bootloaders that keep installing free software easy (cf. generic.flashing). And it could be interesting to port such bootloaders to devices, which happen to come with a restricted bootloader. Compare the available bootloader out there, their license, available code and feature sets. Please also remember that available source code it NOT enough, it has to be under some license, that allow for modification and redistribution. U-Boot bcm63xx boards have U-boot support thanks to the developer Álvaro Fernández (Noltari). Currently only available for the RAM bootloader version. The ROM version requires low level initialisations to be integrated into U-Boot (TODO). https://github.com/Noltari/u-boot/commits/master?author=noltari There is an official broadcom u-boot port for 63137/63138, 63158, and 63178; it is able to replace cfe, but there is no GPL release of this yet. Dump the flash There exists an utility to backup the entire flash: cfetool You must connect your PC with the bcm63xx router via serial TTL port while CFE is running. Then execute cfetool with a command like this, maybe different with different boot address / flash sizes. ./cfetool.py --read=dump.bin --addr=0xB8000000 --size=0x1000000 --block=0x10000 --addr=0xB8000000 -> Flash Memory Address (see CFE bootlog --> Boot Address) --size=0x1000000 -> 16Mb Flash --block=0x10000 -> Memory dumped each iteration (default is 10Kb 0x2800) cfetool expects the serial port used is /dev/ttyUSB0 in your PC, but you can change it with “--serial=/dev/ttyUSB1”. Note: not all CFEs have internally the dm/sm command, as a result of this cfetool may not work with some devices. Alternatively you can dump the flash via traditional methods like JTAG or with an OpenWrt ramdisk firmware version. Overclocking BCM6348 On the BCM6348 the MPI interface is wired to both the flash chip and the miniPCI interface. The CPU clock configuration is strapped from 5 pins on this interface. These 5 pins use pulldown resistors (4.7 or 10 kohm) to configure the CPU clock: Flash pin DQ0 DQ8 DQ1 DQ9 DQ10 CPU clock (MHz) mPCI pin AD27 AD28 AD29 AD30 AD31 Pulldown resistor ☐ ✔ ✔ ✔ ✔ 200 ☐ ✔ ☐ ✔ ✔ 240 ✔ ☐ ☐ ✔ ✔ 256 ☐ ☐ ☐ ✔ ✔ 264 ☐ ✔ ✔ ☐ ✔ 300 Example of CPU clock modification → Comtrend CT5361 overclocking Note: only tested on BCM6348KPBG BCM6368, BCM6369 The same pins used in BCM6348 are also used in the BCM6368 SoC. 4.7 kohm pull down resistors are also used to configure the CPU frequency. Flash pin DQ0 DQ8 DQ1 DQ9 DQ10 CPU clock (MHz) mPCI pin AD27 AD28 AD29 AD30 AD31 Pulldown resistor ☐ ☐ ✔ ☐ ✔ 266 ☐ ☐ ☐ ☐ ✔ 320 ☐ ☐ ☐ ✔ ☐ 384 ☐ ☐ ☐ ☐ ☐ 400 ☐ ☐ ✔ ☐ ☐ 426 ☐ ☐ ✔ ✔ ✔ 533 Pinouts BCM6338 pinout BCM6348 pinout BCM6358 pinout BCM6328 pinout BCM6368 pinout BCM6361 partial pinout BCM6838 pinout BCM63168 pinout Known 63xx platforms Some 6328 platforms*: CPU↓ BrandPageBroadcom BCM6328ActiontecTechdata: Actiontec GT784WNV 5ABroadcom BCM6328ADBTechdata: ADB P.DG A4001N A-000-1A1-AEBroadcom BCM6328ADBTechdata: ADB P.DG A4001N A-000-1A1-AXBroadcom BCM6328ADBTechdata: ADB P.DG A4101N A-000-1A1-AEBroadcom BCM6328ADBTechdata: ADB P.DG A4001N1Broadcom BCM6328Arcadyan / AstoriaTechdata: Arcadyan / Astoria AR7516 (Orange / EE Bright Box)Broadcom BCM63281BillionTechdata: Billion BiPAC 7700NBroadcom BCM6328ComtrendTechdata: Comtrend AR-5381uBroadcom BCM6328ComtrendTechdata: Comtrend AR-5387unBroadcom BCM6328D-LinkTechdata: D-Link DSL-2730U C1Broadcom BCM6328D-LinkTechdata: D-Link DSL-2740B/1B F1 (EU)Broadcom BCM6328D-LinkTechdata: D-Link DSL-2750B T1Broadcom BCM63281D-LinkTechdata: D-Link DSL-2750u C1Broadcom BCM6328InnacommTechdata: Innacomm W3400V6Broadcom BCM6328NETGEARTechdata: NETGEAR DGN2200 v2Broadcom BCM6328NuComtoh:hwdata:nucom:nucom_r5010unBroadcom BCM6328SagemTechdata: Sagem F@ST2704 V2Broadcom BCM6328SercommTechdata: Sercomm AD1018 NORBroadcom BCM6328SercommTechdata: Sercomm AD1018 v1Broadcom BCM6328SercommTechdata: Sercomm AD1018 v2Broadcom BCM63281TechnicolorTechdata: Technicolor TG582n DANT-1Broadcom BCM63281TechnicolorTechdata: Technicolor TG582n DANT-TBroadcom BCM6328TechnicolorTechdata: Technicolor TG582n DANT-VBroadcom BCM6328TP-LinkTechdata: TP-Link TD-W8960N v4Broadcom BCM63281ZTETechdata: ZTE ZXHN H108N v1 Known 6338 platforms*: ASUS AM602 Huawei EchoLife HG510 Netgear DM111P Dynalink RTA1320 (Nateks Unispot21) Siemens CL 110 Zhone 6211 Zhone 6212-l2/-l3 tp-link tp-8840 Thomson SpeedTouch ST516 v6 Thomson SpeedTouch ST530 v6 (same as above with USB port) Swisscom Internet-Box Light RTV1900VW CPU↓ BrandPage Nothing found Known 6345 platforms*: BT Voyager 2100 Dynalink RTA230 Dynalink RTA770W ZTE ZXDSL 831A Siemens SE515 Paradyne 6211-A1 US Robotics USR9105 US Robotics USR9106 Belkin F5D7632 v2 CPU↓ BrandPage Nothing found Some 6348 platforms*: 3Com 3CRWDR200A-75 ASUS AM604 ASUS AM604g ASUS WL-600G ASUS AM200G Belkin f5d7633-4 BT Voyager 2091 Comtrend CT-638/1 Dynalink RTA1046VW Freebox v4 Freebox v5 Huawei EchoLife HG520 Huawei EchoLife HG550 Linksys WAG325N Linksys WAG300N Netcomm NB8W (Re-branded Comtrend CT-536) Netcomm NB9 (Re-branded Comtrend CT-638) Netgear DG834PN Thomson Speedtouch TG605/TG605S Thomson Speedtouch ST716(g) Thomson Speedtouch ST780(i)WL US Robotics USR9107 US Robotics USR9108 Zhone 6218 Zhone 6238 ZTE ZXDSL 831CII CPU↓ BrandPageBroadcom BCM6348AsmaxTechdata: Asmax AR 1004g 1Broadcom BCM6348ASUSTechdata: ASUS WL-600gBroadcom BCM6348BTTechdata: BT Home Hub 1 1.0, 1.5Broadcom BCM6348ComtrendTechdata: Comtrend HG-536+Broadcom BCM6348ComtrendTechdata: Comtrend CT-5365Broadcom BCM6348ComtrendTechdata: Comtrend CT-536+Broadcom BCM6348ComtrendTechdata: Comtrend CT-5361Broadcom BCM6348ComtrendTechdata: Comtrend CT-5621Broadcom BCM6348DavolinkTechdata: Davolink DV-201AMRBroadcom BCM6348InventelTechdata: Inventel Livebox 1 DV4210Broadcom BCM6348LinksysTechdata: Linksys WAG54GX2Broadcom BCM6348LinksysTechdata: Linksys WAG54G v1.1Broadcom BCM6348NetCommTechdata: NetComm NB6PLUS4W Rev1Broadcom BCM6348NETGEARTechdata: NETGEAR DG834G v4Broadcom BCM6348NETGEARTechdata: NETGEAR DG834GTBroadcom BCM6348SagemTechdata: Sagem F@ST2404Broadcom BCM6348SagemTechdata: Sagem F@ST2604Broadcom BCM6348T-Com / TelekomTechdata: T-Com / Telekom Speedport W 500VBroadcom BCM6348TecomTechdata: Tecom GW6200Broadcom BCM6348TecomTechdata: Tecom GW6000Broadcom BCM6348TelseyTechdata: Telsey CPVA502+Broadcom BCM6348TelseyTechdata: Telsey CPVA502+WBroadcom BCM6348ThomsonTechdata: Thomson ST7GBroadcom BCM6348US RoboticsTechdata: US Robotics USR9108 ABroadcom BCM6348ZTETechdata: ZTE ZXDSL 531B(II) Some 6358 platforms*: Buffalo WBMR-G300N D-Link DSL-2640B D-Link DSL-2740B hw C2, C3 Netcomm NB9WMAXX Netgear DG834N ALICE GATE VoIP 2 Plus Wi-Fi Business US Robotics USR9113 Zhone 6228 Thomson TG784 CPU↓ BrandPageBroadcom BCM6358Alcatel-SbellTechdata: Alcatel-Sbell RG100A-AA Rev 0Broadcom BCM6358BTTechdata: BT Home Hub 2 Type ABroadcom BCM6358ComtrendTechdata: Comtrend CT-6373Broadcom BCM6358D-Linktoh:hwdata:d-link:d-link_dsl-2650ubrudBroadcom BCM6358D-LinkTechdata: D-Link DSL-2740B/1B C2Broadcom BCM6358D-LinkTechdata: D-Link DSL-2740B/1B C3Broadcom BCM6358D-LinkTechdata: D-Link DSL-2740B E1Broadcom BCM6358D-LinkTechdata: D-Link DSL-2740U C2Broadcom BCM6358D-LinkTechdata: D-Link DVA-G3810BN/TL A1Broadcom BCM6358HuaweiTechdata: Huawei HG553Broadcom BCM6358HuaweiTechdata: Huawei HG556a ABroadcom BCM6358HuaweiTechdata: Huawei HG556a BBroadcom BCM6358HuaweiTechdata: Huawei HG556a CBroadcom BCM6358InventelTechdata: Inventel Livebox 1.2(Mini) BlueDSL 8GBroadcom BCM6358LinksysTechdata: Linksys WAG160N v1Broadcom BCM6358LinksysTechdata: Linksys WAG160N v2Broadcom BCM6358NETGEARTechdata: NETGEAR DGN2200 v1Broadcom BCM6358NETGEARTechdata: NETGEAR MBRN3000Broadcom BCM6358PirelliTechdata: Pirelli AliceGate AGPFBroadcom BCM6358PirelliTechdata: Pirelli FastWeb DRG A226MBroadcom BCM6358PirelliTechdata: Pirelli DRG A226MBroadcom BCM6358PirelliTechdata: Pirelli DRG A226GBroadcom BCM6358SFR (Société Française de Radiotéléphonie)Techdata: SFR (Société Française de Radiotéléphonie) Neufbox4 (NB4)Broadcom BCM6358T-Com / TelekomTechdata: T-Com / Telekom Speedport W 303V Typ BBroadcom BCM6358TelseyTechdata: Telsey CPA-ZNTE60TBroadcom BCM6358TP-LinkTechdata: TP-Link TD-W8960N v1 Known 6361 platforms*: CPU↓ BrandPageBroadcom BCM6361AztechTechdata: Aztech DSL7002GRV(S)Broadcom BCM6361BTTechdata: BT Home Hub 3 Type BBroadcom BCM6361NETGEARTechdata: NETGEAR DGND4000Broadcom BCM6361SercommTechdata: Sercomm SHG1500 VS2Broadcom BCM6361SFR (Société Française de Radiotéléphonie)Techdata: SFR (Société Française de Radiotéléphonie) Neufbox6 (NB6) Known 6362 platforms*: Motorola NVG510 Commonly used with AT&T copper Uverse, which supports VOIP but not TV. (Motorola GPL source). Also on WikiDevi CPU↓ BrandPageBroadcom BCM6362HuaweiTechdata: Huawei HG253s v2Broadcom BCM6362NETGEARTechdata: NETGEAR DGND3700 v2Broadcom BCM6362SagemTechdata: Sagem F@ST2504n v.6Broadcom BCM6362TP-LinkTechdata: TP-Link TD-W8970 v3.0Broadcom BCM6362¿ZTETechdata: ZTE ZXA10 F660 2.0 Known 6368 platforms*: Freebox Server ZyXEL P-870HN-51b (commonly shipped to VDSL2 customers by Sonera in Finland) ZyXEL P-870HN-53b (commonly shipped to ADSL/VDSL customers by T-Mobile in Czech Republic) NETGEAR VVG2000 (sold to VDSL2 customers by Bezeq in Israel) D-Link DSL-6740U (sold to VDSL2 customers by Bezeq in Israel) Cisco 867-VAE Inteno DG201 Actiontec Q2000 (commonly shipped to VDSL2 customers of Centurylink/Qwest) CPU↓ BrandPageBroadcom BCM6368ActiontecTechdata: Actiontec R1000HBroadcom BCM6368ADBTechdata: ADB AV4202NBroadcom BCM6368ADBTechdata: ADB P.DG AV4202NBroadcom BCM6368ComtrendTechdata: Comtrend VR-3025uBroadcom BCM6368ComtrendTechdata: Comtrend VR-3025unBroadcom BCM6368ComtrendTechdata: Comtrend VR-3026e v1Broadcom BCM6368HuaweiTechdata: Huawei HG622Broadcom BCM6368HuaweiTechdata: Huawei HG622uBroadcom BCM6368HuaweiTechdata: Huawei HG655bBroadcom BCM6368HuaweiTechdata: Huawei HG655dBroadcom BCM6368NETGEARTechdata: NETGEAR DGND3800BBroadcom BCM6368NETGEARTechdata: NETGEAR DGND3700 v1Broadcom BCM6368NETGEARTechdata: NETGEAR VVG2000-1Broadcom BCM6368ObservaTechdata: Observa VH4032NBroadcom BCM6368PirelliTechdata: Pirelli PRG AV4202NBroadcom BCM6368PirelliTechdata: Pirelli AV4202NBroadcom BCM6368ThomsonTechdata: Thomson TG789VNBroadcom BCM6368ZyXELTechdata: ZyXEL P-870HN-51bBroadcom BCM6368ZyXELTechdata: ZyXEL P-870HN-53bBroadcom BCM6368ZyXELTechdata: ZyXEL P-870HNU-51cBroadcom BCM6368ZyXELTechdata: ZyXEL P-870HW-51a v2 Known 63137 platforms*: BT Smart Hub (Distributed by BT since Summer 2016) CPU↓ BrandPage Nothing found Known 63167 platforms*: Zyxel VMG8924-B10D (commonly shipped to Tiscali customers in Italy) CPU↓ BrandPage Nothing found Known 63168 platforms*: Airties Air 5650 (commonly shipped to TTnet Hipernet customers in Turkey) D-Link DSL6850U SmartRG SR630N - 5-port VDSL modem, already runs some custom linux distribution SmartRG SR505N, also a VDSL modem, maybe working with Tomato? ADB VV3212 (Distributed by Slovak Telekom) Actiontec T1200H Actiontec T2200H Actiontec F2250 Kasda KW5212, also a VDSL modem. CPU↓ BrandPageBroadcom BCM63168ActiontecTechdata: Actiontec C1000A 1Broadcom BCM63168ComtrendTechdata: Comtrend VR-3032uBCM63168SercommTechdata: Sercomm SHG2500Broadcom BCM63168SkyTechdata: Sky SR102Broadcom BCM63168, Broadcom BCM4709TP-LinkTechdata: TP-Link Archer VR900v v1.0Broadcom BCM63168ZyXELTechdata: ZyXEL P8702N Known 63268 platforms*: Inteno DG301 (commonly shipped to Sonera customers in Finland) Technicolor TG799Svn v2 (commonly shipped to Telia customers in Sweden) Zyxel C1000Z CPU↓ BrandPageBroadcom BCM63268IntenoTechdata: Inteno DG301BBroadcom BCM63268 ¿T-Com / TelekomTechdata: T-Com / Telekom Speedport W 724V Typ CBroadcom BCM63268T-Com / TelekomTechdata: T-Com / Telekom Speedport W 724V Typ Ci Devices The list of related devices: bcm63xx, bcm6318, bcm6328, bcm6348, bcm6358, bcm6361, bcm6362, bcm6368, bcm6816, bcm6818 bcm63167, bcm63168, bcm63169, bcm63268, This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.OKMore information about cookies Last modified: 2023/06/30 13:36by danitool