User Tools

Site Tools


doc:hardware:soc:soc.broadcom.bcm63xx

Broadcom BCM63xx

This page covers the BCM63xx SoC specificities, but the BCM33xx SoC (excluding BCM3302 which is a CPU) are the exact same chip, except that the DSL core is replaced with a DOCSIS/EuroDOCSIS one.

Broadcom63xx SoC integrates ADSL/ADSL2+ features, routing, and external Wireless NIC.

This SoC is widely used by most xDSL platforms in the world. It is one of the most successful xDSL platforms due to the simplicity of migrating old platforms (e.g: BCM6345) to new ones without much software impact.

The Architecture is based on a standard MIPS32 Big Endian Instruction Set, and shares some features with the R4000 microprocessor.

Linux support

  • The OpenWrt support for the Broadcom BCM63xx SoC family currently only works with following models:
    • 6318
    • 6328
    • 6338
    • 6345
    • 6348
    • 6358 / 6359
    • 6361 / 6362
    • 6368 / 6369
    • 63168 / 63169 / 63268 / 63269
  • There are working drivers for USB Host (OHCI and EHCI) and Ethernet under the GPL. USB Device drivers are also supported but only for BCM6368 and newer SoCs.

Broadcom xDSL

Dual Core

Some SoCs like BCM6358 or BCM6368 have two cores, however OpenWrt only uses 1 core. Spite there being SMP code for using two cores in the kernel (see smp-bmips.c), it seems hard to use both cores: it is needed to initialize the second cpu; also the irq code code currently only enables irqs on the first cpu, so only userspace can use the second core, all interrupt handlers will use the first one.

SMP/CMT Broadcom 63xx

Finished tasks

The support for Broadcom 63xx is at this state :

  • Full Linux support for BCM63xx with runtime detection of the SoC on which the kernel is running.
  • GPL drivers for Ethernet/switch, OHCI, EHCI, SPI, Watchdog
  • Dual core partially supported in BM6362/6368 and no support in BCM6358.
  • No available drivers (neither binary, nor GPL) for DSL, ATM, VoIP, on-board SLIC/SLAC
  • Still not ported to OpenWrt but with available drivers under the GPL:

How to help

Existent 63xx variants

SoC CPU MHz Dual Core RAM USB Device USB Host PCMCIA/PCCARD PCI PCIe Wireless NIC ADSL2 ADSL2+ VDSL VDSL2 Fiber OpenWrt
bcm6318 333 DDR2 2.0 2.0
bcm6328 320 DDR2 2.0 2.0 12.09
bcm6329 320 DDR2 2.0 2.0
bcm6335 140 SDR
bcm6338 240 SDR 1.1 10.03
bcm6345 140 SDR 1.1 10.03
bcm6348 240|256 SDR 1.1 1.1 10.03
bcm6358 300 DDR 2.0 2.0 10.03
bcm6359 300 DDR 2.0 2.0 10.03
bcm6361
bcm6362
400 DDR2 2.0 2.0 r32923
bcm6367 400 DDR 2.0 2.0 12.09
bcm6368 400 DDR 2.0 2.0 12.09
bcm6369 400 DDR 2.0 2.0
bcm63168
bcm63268
400 DDR2 2.0 2.0
bcm63169
bcm63269
400 ? 2.0 2.0
bcm6816 300 ? 2.0 2.0
bcm6818 400 ? 2.0 2.0
bcm63138 1000 ? 3.0 3.0
  • The third digit, when set to 3 (like in BCM6335, BCM6338) denotes a single-chip and cost-reduction oriented design.
  • There are also some other variants like bcm6341, which is a DSP used in VoIP products in conjunction with a BCM6348 SoC.
  • The bcm63138 supports G.fast, G.inp and SRA.

CPU caches

icache dcache
SoC CPU version Core Size (kB) Associativity Linesize (bytes) Cache policy Size (kB) Associativity Aliases Linesize (bytes) Cache policy
BCM6348 BMIPS3300 V0.7 0 16 2-way 16 VIPT 8 2-way 16 VIPT
BCM6358 BMIPS4350 V1.0 0 32 2-way 16 VIPT 16 2-way 16 VIPT
1 16 2-way 16 VIPT
BCM6368 BMIPS4350 V3.1 0 64 4-way 16 VIPT 32 2-way 16 VIPT
1 64 4-way 16 VIPT
BCM6328 BMIPS4350 v7.5 0 32 4-way 16 VIPT 32 2-way 16 VIPT
BCM63168 BMIPS4350 V8.0 0 64 4-way 16 VIPT 32 2-way 16 VIPT
1 64 4-way 16 VIPT

VIPT = Virtually indexed, physically tagged

See → http://www.linux-mips.org/wiki/Caches

TRNG

Hardware random number generator

Only available in BCM6368 SoC. GPL supported. bcm63xx-rng.c dev-rng.c

To take advantage of this hardware feature, rng-tools should be installed.

Cipher Engine

BCM63xx SoCs have cryptographic hardware accelerators. The Cipher engine accelerates the IPSec protocol by using dedicated hardware blocks. BCM63XX SoCs (all family? FIXME) are implemented with the Encapsulating Security Payload (ESP) and Authentication Header (AH) IPSec protocols:

  • AES and DES/3DES hardware encryption and decryption.
    • AES in both Cipher Block Chaining (CBC) mode and Counter (CTR) mode. Can be performed in 128-, 192-, and 256-bit modes.
    • DES, 3DES in Cipher Block Chaining (CBC) mode
  • HMAC-SHA1 and HMAC-MD5 authentication in hardware.

This what Broadcom calls SPU. The driver is available with GPL

http://code.google.com/p/gfiber-gflt100/source/browse/bcmdrivers/opensource/char/spudd/impl2/

this code isn't still ported to OpenWRT, thus no crypto acceleration available

SPI

Serial Peripheral Interface

Two types of SPI controllers are present in BCM63xx:

  • SPI : Not available in BCM6318/BCM6328/BCM6345
  • HSSPI: High speed SPI, only available in BCM6318/BCM6328/BCM6362/63268 SoCs

By default only one or two (probably more in newer boards) Slave Selects are available. Additional Slave Selects are at GPIO lines, but they need to be enabled.

(SPI) Slave Select 0 Slave Select 1 Slave Select 2 Slave Select 3 Slave Select 4 Slave Select 5
BCM6348 GPIO29 GPIO30 GPIO31
BCM6358 GPIO32 GPIO33
BCM6368
BCM6816
BCM6818
GPIO28 GPIO29 GPIO30 GPIO31
BCM6362 GPIO9 GPIO10
(HSSPI) Slave Select 0 Slave Select 1 Slave Select 2 Slave Select 3 Slave Select 4 Slave Select 5 Slave Select 6 Slave Select 7
BCM6328 GPIO9 :?:
BCM6828 GPIO16 GPIO17 GPIO9
BCM63268 GPIO16 GPIO17 GPIO8 GPIO9

Snippet code example for enabling these extra slave-selects at GPIOs:

/* BCM6348 */
	u32 val;
	/* Enable Extra SPI CS */
	/* GPIO 29 is SS1, GPIO 30 is SS2, GPIO 31 is SS2 */
	val = bcm_gpio_readl(GPIO_MODE_REG);
	val |= GPIO_MODE_6348_G1_SPI_MASTER;
	bcm_gpio_writel(val, GPIO_MODE_REG);
 
/* BCM6358 */
	u32 val;
	/* Enable Overlay for SPI SS Pins */
	val = bcm_gpio_readl(GPIO_MODE_REG);
	val |= GPIO_MODE_6358_EXTRA_SPI_SS;
	bcm_gpio_writel(val, GPIO_MODE_REG);
	/* Enable SPI Slave Select as Output Pins */
        /* GPIO 32 is SS2, GPIO 33 is SS3 */
	val = bcm_gpio_readl(GPIO_CTL_HI_REG);
	val |= 0x0003;
	bcm_gpio_writel(val, GPIO_CTL_HI_REG);
 
/* BCM6368 */
	u32 val;
	/* Enable Extra SPI CS */
	val = bcm_gpio_readl(GPIO_MODE_REG);
	val |= (GPIO_MODE_6368_SPI_SSN2 | GPIO_MODE_6368_SPI_SSN3 | GPIO_MODE_6368_SPI_SSN4 | GPIO_MODE_6368_SPI_SSN5);
	bcm_gpio_writel(val, GPIO_MODE_REG);
	/* Enable SPI Slave Select as Output Pins */            
        /* GPIO 28 is SS2, GPIO 29 is SS3, GPIO 30 is SS4, GPIO 31 is SS5*/   
	val = bcm_gpio_readl(GPIO_CTL_LO_REG);
	val |= (GPIO_MODE_6368_SPI_SSN2 | GPIO_MODE_6368_SPI_SSN3 | GPIO_MODE_6368_SPI_SSN4 | GPIO_MODE_6368_SPI_SSN5);
	bcm_gpio_writel(val, GPIO_CTL_LO_REG);
 
/* BCM6328 */
#define SEL_SPI2                 8
#define PINMUX_SEL_SPI2_MASK     (3 << SEL_SPI2)
#define PINMUX_SEL_SPI2          (2 << SEL_SPI2)
	u32 val;
	/* configure pinmux to SPI extra Slave Select */
	val = bcm_gpio_readl(GPIO_PINMUX_OTHR_REG);
	val &= ~PINMUX_SEL_SPI2_MASK;
	bcm_gpio_writel(val, GPIO_PINMUX_OTHR_REG);
 
	val = bcm_gpio_readl(GPIO_PINMUX_OTHR_REG);
	val |= PINMUX_SEL_SPI2;
	bcm_gpio_writel(val, GPIO_PINMUX_OTHR_REG);
 
/* BCM63268 */
#define GPIO_MODE_63268_HSSPI_SSN4		(1 << 16)
#define GPIO_MODE_63268_HSSPI_SSN5		(1 << 17)
#define GPIO_MODE_63268_HSSPI_SSN6		(1 << 8)
#define GPIO_MODE_63268_HSSPI_SSN7		(1 << 9)
	u32 val;
	/* GPIO 16 is SS4, GPIO 17 is SS5, GPIO 8 is SS6, GPIO 9 is SS7*/   
	val = bcm_gpio_readl(GPIO_MODE_REG);
	val |= (GPIO_MODE_63268_HSSPI_SSN4 | GPIO_MODE_63268_HSSPI_SSN5 | GPIO_MODE_63268_HSSPI_SSN6 | GPIO_MODE_63268_HSSPI_SSN7);
	bcm_gpio_writel(val, GPIO_MODE_REG);

GPIOs

General Purpose Input/Output

BCM63xx GPIO lines aren't capable of generating interrupts, they use the polling method when configured as inputs (buttons). As a result of this, some input drivers using GPIO interrupts won't work.

Bootloader

Bootloader: Some devices use RedBoot such as Inventel Liveboxes. Most of the others use CFE with a built-in LZMA decompressor. CFE is not using standard LZMA compression arguments, and most noticeably, changes the dictionary size, so beware. Thomson routers have their own bootloader.

There is released source code for RedBoot (Inventel Livebox), and probably can be modified to work with other routers. Also there is some source code for Uboot.

On several CPE (Customer-premises equipment) hardware devices and especially on smart phones, the OEM bootloaders are feature poor (no netboot, no booting from a USB stick, etc.), obfuscated (require some magic values to be correct) or completely messed up and make it cumbersome, difficult or impossible to install free software on the device. It is thus paramount to always have at least some products available, that have OEM bootloaders that keep installing free software easy (cf. generic.flashing). And it could be interesting to port such bootloaders to devices, which happen to come with a restricted bootloader. Compare the available bootloader out there, their license, available code and feature sets. Please also remember that available source code it NOT enough, it has to be under some license, that allow for modification and redistribution.

Dump the flash

There exists an utility to backup the entire flash:
cfetool
You must connect your PC with the bcm63xx router via serial TTL port while CFE is running. Then execute cfetool with a command like this, maybe different with different boot address / flash sizes.

./cfetool.py --read=dump.bin --addr=0xB8000000 --size=0x1000000 --block=0x10000
--addr=0xB8000000 -> Flash Memory Address (see CFE bootlog --> Boot Address)
--size=0x1000000 -> 16Mb Flash
--block=0x10000 -> Memory dumped each iteration (default is 10Kb 0x2800)
cfetool expects the serial port used is /dev/ttyUSB0 in your PC, but you can change it with "–serial=/dev/ttyUSB1".

Note: not all CFEs have internally the dm/sm command, as a result of this cfetool may not work with some devices. Alternatively you can dump the flash via traditional methods like JTAG or with an OpenWrt ramdisk firmware version.

BCM6348 pinout

BCM6348 KPBG BCM6348 SKFBG

Known 63xx platforms

Known 6345 platforms*:

Known 6338 platforms*:

ASUS AM602
Huawei EchoLife HG510
Netgear DM111P
Dynalink RTA1320 (Nateks Unispot21)
Siemens CL 110
Zhone 6211
Zhone 6212-l2/-l3
tp-link tp-8840
Thomson SpeedTouch ST516 v6
Thomson SpeedTouch ST530 v6 (same as above with USB port)
Platform BrandPage
Broadcom BCM6338ComtrendTechdata: Comtrend CT-5367
Broadcom BCM6338D-LinkTechdata: D-Link DSL-2500U A1
Broadcom BCM6338D-LinkTechdata: D-Link DSL-2320B
Broadcom BCM6338D-LinkTechdata: D-Link DSL-2640U/BRU/C C1
Broadcom BCM6338D-LinkTechdata: D-Link DSL-2540U/BRU/D D1
Broadcom BCM6338D-LinkTechdata: D-Link DSL-2520U A1
Broadcom BCM6338D-LinkTechdata: D-Link DSL-2300U A1
Broadcom BCM6338D-LinkTechdata: D-Link DSL-2540U/BRU/C C1
Broadcom BCM6338D-LinkTechdata: D-Link DSL-2540U A1
Broadcom BCM6338D-LinkTechdata: D-Link DSL-2542B/3B D2 (EU)
Broadcom BCM6338IntenoTechdata: Inteno XG6749
Broadcom BCM6338NetCommTechdata: NetComm NB6 RTA1320 Rev1
Broadcom BCM6338SagemTechdata: Sagem F@ST1201S
Broadcom BCM6338SiemensTechdata: Siemens S1621-Z220-A
Broadcom BCM6338ThomsonTechdata: Thomson TG585 v7

Some 6348 platforms*:

Platform BrandPage
Broadcom BCM6348AsmaxTechdata: Asmax AR 1004g 1
Broadcom BCM6348AsusTechdata: Asus DSL-N13 1
Broadcom BCM6348AsusTechdata: Asus WL-600g
Broadcom BCM6348BTTechdata: BT Home Hub 1 1.0, 1.5
Broadcom BCM6348ComtrendTechdata: Comtrend CT-536+
Broadcom BCM6348ComtrendTechdata: Comtrend HG-536+
Broadcom BCM6348ComtrendTechdata: Comtrend CT-5361
Broadcom BCM6348ComtrendTechdata: Comtrend CT-5365
Broadcom BCM6348ComtrendTechdata: Comtrend CT-5621
Broadcom BCM6348D-LinkTechdata: D-Link DSL-2640U(B) B2 (RU)
Broadcom BCM6348DavolinkTechdata: Davolink DV-201AMR
Broadcom BCM6348DavolinkTechdata: Davolink DV-2020
Broadcom BCM6348GigasetTechdata: Gigaset SL2-141-i
Broadcom BCM6348HitachiTechdata: Hitachi AH4051
Broadcom BCM6348InventelTechdata: Inventel Livebox 1 DV4210
Broadcom BCM6348InventelTechdata: Inventel AOLBox D5213
Broadcom BCM6348InventelTechdata: Inventel Livebox 1 DV3210
Broadcom BCM6348InventelTechdata: Inventel Livebox Pro V1 DV4410
Broadcom BCM6348LinksysTechdata: Linksys WAG54G v1.1
Broadcom BCM6348LinksysTechdata: Linksys WAG54GX2
Broadcom BCM6348LinksysTechdata: Linksys WAG54GS v1.0, v1.1
Broadcom BCM6348NetCommTechdata: NetComm NB6PLUS4W Dynalink RTA1025W Rev1
Broadcom BCM6348NetCommTechdata: NetComm NB9W
Broadcom BCM6348NetgearTechdata: Netgear DG834G v4
Broadcom BCM6348NetgearTechdata: Netgear DG834GT
Broadcom BCM6348PirelliTechdata: Pirelli Alice Gate2 Plus Wi-Fi AGA
Broadcom BCM6348PirelliTechdata: Pirelli Alice Gate W2+ Vela
Broadcom BCM6348PirelliTechdata: Pirelli DRG A125G
Broadcom BCM6348SagemTechdata: Sagem F@ST2404
Broadcom BCM6348SagemTechdata: Sagem F@ST2604
Broadcom BCM6348T-Com / TelekomTechdata: T-Com / Telekom Speedport W 500V
Broadcom BCM6348TelseyTechdata: Telsey Alice W-Gate
Broadcom BCM6348TelseyTechdata: Telsey CPVA502+W
Broadcom BCM6348TelseyTechdata: Telsey CPVA502+
Broadcom BCM6348TendaTechdata: Tenda W548D
Broadcom BCM6348ThomsonTechdata: Thomson ST7G
Broadcom BCM6348ThomsonTechdata: Thomson ST585 6
Broadcom BCM6348ThomsonTechdata: Thomson ST706WL
Broadcom BCM6348US RoboticsTechdata: US Robotics USR9107
Broadcom BCM6348US RoboticsTechdata: US Robotics USR9108 A
Broadcom BCM6348ZTETechdata: ZTE ZXDSL 531B(II)

Some 6358 platforms*:

Platform BrandPage
Broadcom BCM6358ADBTechdata: ADB AV4202N
Broadcom BCM6358Alcatel-SbellTechdata: Alcatel-Sbell RG100A-AA Rev 0
Broadcom BCM6358BTTechdata: BT Home Hub 2 Type A
Broadcom BCM6358ComtrendTechdata: Comtrend CT-6373
Broadcom BCM6358D-LinkTechdata: D-Link DSL-2740B E1
Broadcom BCM6358D-LinkTechdata: D-Link DSL-2740B/1B C2, C3
Broadcom BCM6358 BMIPS4350D-LinkTechdata: D-Link DVA-G3810BN/TL A1
Broadcom BCM6358D-LinkTechdata: D-Link DSL-2650U/BRU/D D1, D2 (RU)
Broadcom BCM6358HuaweiTechdata: Huawei HG553
Broadcom BCM6358HuaweiTechdata: Huawei HG556a A, B
Broadcom BCM6358HuaweiTechdata: Huawei HG556a C
Broadcom BCM6358InventelTechdata: Inventel Livebox 1.2(Mini) BlueDSL 8G
Broadcom BCM6358LinksysTechdata: Linksys WAG160N v1
Broadcom BCM6358LinksysTechdata: Linksys WAG160N v2
Broadcom BCM6358NetgearTechdata: Netgear DGN2200 v1
Broadcom BCM6358NetgearTechdata: Netgear MBRN3000 0
Broadcom BCM6358PirelliTechdata: Pirelli AliceGate AGPF
Broadcom BCM6358PirelliTechdata: Pirelli FastWeb DRG A226M
Broadcom BCM6358SFR (Société Française de Radiotéléphonie)Techdata: SFR (Société Française de Radiotéléphonie) Neufbox4 (NB4)
Broadcom BCM6358T-Com / TelekomTechdata: T-Com / Telekom Speedport W 303V Typ B
Broadcom BCM6358TP-LinkTechdata: TP-Link TD-W8960N
Broadcom BCM6358TelseyTechdata: Telsey CPA-ZNTE60T

Some 6328 platforms*:

Known 6361 platforms*:

BT HomeHub 3.0b
Sercom SHG1500 AKA Vodafone Station 2
Platform BrandPage
Broadcom BCM6361BTTechdata: BT Home Hub 3 Type B
Broadcom BCM6361SFR (Société Française de Radiotéléphonie)Techdata: SFR (Société Française de Radiotéléphonie) Neufbox6 (NB6)
Broadcom BCM6361SercomTechdata: Sercom SHG1500 VS2

Known 6362 platforms*:

Motorola NVG510 Commonly used with AT&T copper Uverse, which supports VOIP but not TV. (Motorola GPL source). Also on WikiDevi
Netgear DGND3700 (v2)

Known 6368 platforms*:

Freebox Server
ZyXEL P-870HN-51b (commonly shipped to VDSL2 customers by Sonera in Finland)
ZyXEL P-870HN-53b (commonly shipped to ADSL/VDSL customers by T-Mobile in Czech Republic)
NETGEAR VVG2000 (sold to VDSL2 customers by Bezeq in Israel)
D-Link DSL-6740U (sold to VDSL2 customers by Bezeq in Israel)
Cisco 867-VAE
Netgear DGND3700 (v1)
Inteno DG201
Thomson TG789vn
Comtrend VR-3025u
Comtrend VR-3025un
Actiontec Q2000 (commonly shipped to VDSL2 customers of Centurylink/Qwest)
Platform BrandPage
Broadcom BCM6368ADBTechdata: ADB P.DG AV4202N
Broadcom BCM6368ComtrendTechdata: Comtrend VR-3026e
Broadcom BCM6368ComtrendTechdata: Comtrend VR-3025u
Broadcom BCM6368ComtrendTechdata: Comtrend VR-3025un
Broadcom BCM6368HuaweiTechdata: Huawei HG655b
Broadcom BCM6368HuaweiTechdata: Huawei HG622
Broadcom BCM6368HuaweiTechdata: Huawei HG655d
Broadcom BCM6368NetgearTechdata: Netgear DGND3800B
Broadcom BCM6368NetgearTechdata: Netgear VVG2000-1
Broadcom BCM6368NetgearTechdata: Netgear DGND3700 v1
Broadcom BCM6368PirelliTechdata: Pirelli AV4202N
Broadcom BCM6368PirelliTechdata: Pirelli PRG AV4202N
Broadcom BCM6368ThomsonTechdata: Thomson TG789VN
Broadcom BCM6368ZyXELTechdata: ZyXEL P-870HW-51a v2
Broadcom BCM6368ZyXELTechdata: ZyXEL P-870HN-53b 1
Broadcom BCM6368ZyXELTechdata: ZyXEL P-870HNU-51c 1
Broadcom BCM6368ZyXELTechdata: ZyXEL P-870HN-51b 1

Known 63168 platforms*:

Airties Air 5650 (commonly shipped to TTnet Hipernet customers in Turkey)
D-Link DSL6850U
SmartRG sr630n - 5-port VDSL modem, already runs some custom linux distribution
ADB VV3212 (Distributed by Slovak Telekom)

Known 63268 platforms*:

Inteno DG301 (commonly shipped to Sonera customers in Finland)
Technicolor TG799Svn v2 (commonly shipped to Telia customers in Sweden)
Platform BrandPage
Broadcom BCM63268IntenoTechdata: Inteno DG301B
Broadcom BCM63268 ¿T-Com / TelekomTechdata: T-Com / Telekom Speedport W 724V Typ C
Broadcom BCM63268 ¿T-Com / TelekomTechdata: T-Com / Telekom Speedport W 724V Typ A
Broadcom BCM63268T-Com / TelekomTechdata: T-Com / Telekom Speedport W 724V Typ Ci

Tags

doc/hardware/soc/soc.broadcom.bcm63xx.txt · Last modified: 2015/08/27 22:36 by tmomas