This is for BCM3383, but looks interesting
V5.5.4 of CG3000D / CG3100D / CG3101D / CG3000D-1CHNAS / CG3000D-1CXNAS / CG3100D-1DANDS may be interesting.
CG3100L_V1.0.4_Linux_src/shared/opensource/include/bcm963xx/3380_map_part.h contains the base address of some peripherals
CG3100L_V1.0.4_Linux_src/shared/broadcom/include/bcm963xx/3380_map.h contains a more complete list of base address, see line 244, 283.
CG3100L_V1.0.4_Linux_src/shared/opensource/include/bcm963xx/bcm_hwdefs.h contains some information about the address space:
/*****************************************************************************/
/* Note that the addresses above are physical addresses and that programs */
/* have to use converted addresses defined below: */
/*****************************************************************************/
#define DRAM_BASE (0x80000000 | PHYS_DRAM_BASE) /* cached DRAM */
#define DRAM_BASE_NOCACHE (0xA0000000 | PHYS_DRAM_BASE) /* uncached DRAM */
DRAM_BASE_NOCACHE ors uart0: serial@14e00200 in U-boot dts gives #define UART_BASE 0xb4e00200. In the OpenWrt dts, the base addresses are partial.
May be we can contact this guy
Some very old Broadcom material
There were examples of BCM6328.dtsi that uses "brcm,bcm3380-l2-intc" and "brcm,bcm6345-l1-intc". I tried "brcm,bcm3380-l2-intc" first but it doesnt work. When the bcm63xx-uart driver requests for an IRQ, the IRQ driver defers indefinitely (returns -EPROBE_DEFER, -517 everytime). I have to switch to "brcm,bcm6345-l1-intc".
By comparing the register definition of BCM6358 and its OpenWrt dtsi, I partially understand the usage of "brcm,bcm6345-l1-intc". Two question remains:
- Does the order of the two entries in
regmatter? I found some code describes the ISR dispatch, but cannot relate it to my question. - Where are these number come from:
interrupts = <2>, <3>;
I found some generic info about MIPS interrupt.
The plat_irq_dispatch(void) function in this code provides critical information on how the CPU interrupt lines are connected to the peripheral interrupt mux. Critical parts are:
#if defined(CONFIG_BCM93380)
static struct _int_ctl_ perf[5] =
{
{&PERF->PeriphIrq[2].iStatus, &PERF->PeriphIrq[2].iMask, INTERNAL_ISR_TABLE_OFFSET},
{&PERF->IopIrq[0].iStatus, &PERF->IopIrq[0].iMask, ((32 * 1) + INTERNAL_ISR_TABLE_OFFSET)},
{&PERF->DocsisIrq[2].iStatus, &PERF->DocsisIrq[2].iMask, ((32 * 2) + INTERNAL_ISR_TABLE_OFFSET)},
{&PERF->PeriphIrq[3].iStatus, &PERF->PeriphIrq[3].iMask, INTERNAL_ISR_TABLE_OFFSET},
{&PERF->IopIrq[1].iStatus, &PERF->IopIrq[1].iMask, ((32 * 1) + INTERNAL_ISR_TABLE_OFFSET)}
};
#elif
...
#endif
static void irq_dispatch_int(int i) {
...
pendingIrqs = (*perf[i].pStatus) & (*perf[i].pMask);
...
}
asmlinkage void plat_irq_dispatch(void) {
...
#if defined(CONFIG_BCM93380)
#if defined(CONFIG_BCM_LOT1)
else if (cause & CAUSEF_IP4)
irq_dispatch_int(3);
else if (cause & CAUSEF_IP6)
irq_dispatch_int(4);
#endif
else if (cause & CAUSEF_IP3)
irq_dispatch_int(0);
else if (cause & CAUSEF_IP5)
irq_dispatch_int(1);
...
}We are targeting BCM3380, so CONFIG_BCM93380 must be defined. Looking at the perf array, we know that PERF->PeriphIrq[2] and PERF->PeriphIrq[3] are referenced here. plat_irq_dispatch() further suggests that CAUSEF_IP4 maps to PERF->PeriphIrq[2] and CAUSEF_IP3 maps to PERF->PeriphIrq[3]. The address of PERF->PeriphIrq[x] can be simply found as INTC_BASE + 0x30 + x*sizeof(IntMaskStatus), where:
INTC_BASEis 0x14e00000 or 0xb4e000000x30is the offset of the first mask-flag combinationIntMaskStatusis a struct representing a mask-flag combination:
// Interrupt Controller mask and status group
typedef struct
{
uint32 iMask;
uint32 iStatus;
} IntMaskStatus;Since we don't know what is CONFIG_BCM_LOT1 (likely identifies each core in the SoC), we have to try both combinations. Here is our final result:
periph_intc: interrupt-controller@14e00048 {
#address-cells = <1>;
compatible = "brcm,bcm6345-l1-intc";
reg = <0x14e00048 0x08>,
<0x14e00040 0x08>;
interrupt-controller;
#interrupt-cells = <1>;
interrupt-parent = <&cpu_intc>;
interrupts = <4>, <3>;
};
This dts will produce an OpenWrt image that drops us to a serial shell. If the IRQ is not correctly configured, the bcm63xx-uart's tx interrupt handler wont work, and you wont see Please press Enter to activate this console. in your console. The kernel outputs seem to write to the UART hardware FIFO directly.
We may use this trick to adjust the order of the above mapping: https://github.com/ghostnup/asuswrt-merlin.ng/blob/991f9b4abe1f24f4e24ef2169c28fa4cd39cd7e2/release/src-rt-5.02hnd/cfe/cfe/arch/mips/board/bcm63xx_rom/src/bcm63xx_impl2_rom_boot.S#L96
Connect to a Netgear CG3100 via the serial port
https://foro.seguridadwireless.net/openwrt/(desarrollo)-openwrt-en-netgear-cg3100dv3/
VOOdoo - Remotely Compromising VOO Cable Modems
https://github.com/Swyter/netgear-cg3100-config-decoder
Use this to enable the cache.
What are you trying to do? This is an obsolete SoC and you will find very little public information on Broadcom stuff, so bringing up OpenWrt on this platform is really not worth the effort. Trust me I've been there...