This is for BCM3383, but looks interesting
V5.5.4 of CG3000D / CG3100D / CG3101D / CG3000D-1CHNAS / CG3000D-1CXNAS / CG3100D-1DANDS may be interesting.
CG3100L_V1.0.4_Linux_src/shared/opensource/include/bcm963xx/3380_map_part.h contains the base address of some peripherals
CG3100L_V1.0.4_Linux_src/shared/broadcom/include/bcm963xx/3380_map.h contains a more complete list of base address, see line 244, 283.
CG3100L_V1.0.4_Linux_src/shared/opensource/include/bcm963xx/bcm_hwdefs.h contains some information about the address space:
/*****************************************************************************/
/* Note that the addresses above are physical addresses and that programs */
/* have to use converted addresses defined below: */
/*****************************************************************************/
#define DRAM_BASE (0x80000000 | PHYS_DRAM_BASE) /* cached DRAM */
#define DRAM_BASE_NOCACHE (0xA0000000 | PHYS_DRAM_BASE) /* uncached DRAM */
DRAM_BASE_NOCACHE ors uart0: serial@14e00200 in U-boot dts gives #define UART_BASE 0xb4e00200. In the OpenWrt dts, the base addresses are partial.
May be we can contact this guy
Some very old Broadcom material
There were examples of BCM6328.dtsi that uses "brcm,bcm3380-l2-intc" and "brcm,bcm6345-l1-intc". I tried "brcm,bcm3380-l2-intc" first but it doesnt work. When the bcm63xx-uart driver requests for an IRQ, the IRQ driver defers indefinitely (returns -EPROBE_DEFER, -517 everytime). I have to switch to "brcm,bcm6345-l1-intc".
By comparing the register definition of BCM6358 and its OpenWrt dtsi, I partially understand the usage of "brcm,bcm6345-l1-intc". Two question remains:
- Does the order of the two entries in
regmatter? I found some code describes the ISR dispatch, but cannot relate it to my question. - Where are these number come from:
interrupts = <2>, <3>;
I found some generic info about MIPS interrupt.
The plat_irq_dispatch(void) function in this code provides critical information on how the CPU interrupt lines are connected to the peripheral interrupt mux. Critical parts are:
#if defined(CONFIG_BCM93380)
static struct _int_ctl_ perf[5] =
{
{&PERF->PeriphIrq[2].iStatus, &PERF->PeriphIrq[2].iMask, INTERNAL_ISR_TABLE_OFFSET},
{&PERF->IopIrq[0].iStatus, &PERF->IopIrq[0].iMask, ((32 * 1) + INTERNAL_ISR_TABLE_OFFSET)},
{&PERF->DocsisIrq[2].iStatus, &PERF->DocsisIrq[2].iMask, ((32 * 2) + INTERNAL_ISR_TABLE_OFFSET)},
{&PERF->PeriphIrq[3].iStatus, &PERF->PeriphIrq[3].iMask, INTERNAL_ISR_TABLE_OFFSET},
{&PERF->IopIrq[1].iStatus, &PERF->IopIrq[1].iMask, ((32 * 1) + INTERNAL_ISR_TABLE_OFFSET)}
};
#elif
...
#endif
static void irq_dispatch_int(int i) {
...
pendingIrqs = (*perf[i].pStatus) & (*perf[i].pMask);
...
}
asmlinkage void plat_irq_dispatch(void) {
...
#if defined(CONFIG_BCM93380)
#if defined(CONFIG_BCM_LOT1)
else if (cause & CAUSEF_IP4)
irq_dispatch_int(3);
else if (cause & CAUSEF_IP6)
irq_dispatch_int(4);
#endif
else if (cause & CAUSEF_IP3)
irq_dispatch_int(0);
else if (cause & CAUSEF_IP5)
irq_dispatch_int(1);
...
}We are targeting BCM3380, so CONFIG_BCM93380 must be defined. Looking at the perf array, we know that PERF->PeriphIrq[2] and PERF->PeriphIrq[3] are referenced here. plat_irq_dispatch() further suggests that CAUSEF_IP4 maps to PERF->PeriphIrq[2] and CAUSEF_IP3 maps to PERF->PeriphIrq[3]. The address of PERF->PeriphIrq[x] can be simply found as INTC_BASE + 0x30 + x*sizeof(IntMaskStatus), where:
INTC_BASEis 0x14e00000 or 0xb4e000000x30is the offset of the first mask-flag combinationIntMaskStatusis a struct representing a mask-flag combination:
// Interrupt Controller mask and status group
typedef struct
{
uint32 iMask;
uint32 iStatus;
} IntMaskStatus;Since we don't know what is CONFIG_BCM_LOT1 (likely identifies each core in the SoC), we have to try both combinations. Here is our final result:
periph_intc: interrupt-controller@14e00048 {
#address-cells = <1>;
compatible = "brcm,bcm6345-l1-intc";
reg = <0x14e00048 0x08>,
<0x14e00040 0x08>;
interrupt-controller;
#interrupt-cells = <1>;
interrupt-parent = <&cpu_intc>;
interrupts = <4>, <3>;
};
This dts will produce an OpenWrt image that drops us to a serial shell. If the IRQ is not correctly configured, the bcm63xx-uart's tx interrupt handler wont work, and you wont see Please press Enter to activate this console. in your console. The kernel outputs seem to write to the UART hardware FIFO directly.
We may use this trick to adjust the order of the above mapping: https://github.com/ghostnup/asuswrt-merlin.ng/blob/991f9b4abe1f24f4e24ef2169c28fa4cd39cd7e2/release/src-rt-5.02hnd/cfe/cfe/arch/mips/board/bcm63xx_rom/src/bcm63xx_impl2_rom_boot.S#L96
Connect to a Netgear CG3100 via the serial port
https://foro.seguridadwireless.net/openwrt/(desarrollo)-openwrt-en-netgear-cg3100dv3/
VOOdoo - Remotely Compromising VOO Cable Modems
https://github.com/Swyter/netgear-cg3100-config-decoder
There are a lot of second-hand cable modems out there powered by BCM3380 and BCM3384. Each only costs a few dollars. You may even get them for free. Of course, the DOCSIS cable modem part is not going to work, and neither is the WIFI. However, if we can get the ethernet to work, it will still be a good router for running free firmware. Most of those modems come with dual-core CPU and 64/128MB of RAM, which is still good for today's use.
How far did you go with BCM3380? I managed to make the OpenWrt boot on this device and successfully obtained a serial console. Apart from the UART peripheral, only the interrupt controller and reset controller have worked so far. You can find my progress here:
https://github.com/rikka0w0/openwrt-fast3864op/tree/bcm3380-20241014
I'm trying to get the SPI peripheral working so that it will be possible to flash the firmware permanently. I looked at the source code of the stocked firmware. The register layout seems to match BCM6358. I used that in DTS, and it does not work. I used my oscilloscope to probe the SPI interface of the flash; once the kernel boots, there are no more SPI activities, and all SPI data exchange returns 0. Any suggestion on this?