Cisco DPC3825/EPC3825

BCM33xx

This is a DOCSIS 3.0 Wireless cable Residential Gateway. It uses an eCos operating system. It seems it shares the same hardware with the Netgear CG3100D/CG3101D, Motorola SBG6580, Virgin Media Super Hub VMDG480.

More info at cisco website:

modem_DPC3825

The SoC might be similar to bcm63xx platforms. Here some patches useful to start developing Openwrt support for this SoC:

http://alphacore.org/~florian/openwrt/bcm33xx/

There exist GPL sources available from Netgear FTP:
CG3100_GPL_src.zip eCos source code (38 MB)
CG3100Dv2_V5.5.5.83.mp2_LxG1.0.5.83.mp2_EU_src.zip eCos and Linux source code

visit Netgear FTP, models CG3xxx seems to share similar hardware

Hardware Highlights

SoC Ram Flash Network USB Serial JTag
BCM3380 64MiB 8MiB 4 Yes Yes ?

Bootlogs

OEM bootlog

BCM338031 TP0 1 Sync:1 346890 SA BootLoader Version: 2.3.0_R3(S) Release Gnu spiboot reduced DDR drive Build Date: Sep 21 2009 Build Time: 15:57:39 SPI flash ID 0x010216, size 8MB, block size 64KB, write buffer 256, busy bit 1 Found image 1 at offset 20000 Found image 2 at offset 400000 eCos - hal_diag_init Init device '/dev/BrcmTelnetIoDriver' Init device '/dev/ttydiag' Init tty channel: 80ec4bb8 Init device '/dev/tty0' Init tty channel: 80ec4bd8 Init device '/dev/haldiag' HAL/diag SERIAL init Init device '/dev/ser0' BCM 33XX SERIAL init - dev: 0.2 Set output buffer - buf: 0x80f6da48 len: 2048 Set input buffer - buf: 0x80f6e248 len: 2048 BCM 33XX SERIAL config LsSpiInit 3380 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver... [00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0x10216 [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Permanent NonVol would fit in the boot block of this flash device, but I found existing NonVol in the following block; using this location instead... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully. [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices... Detecting the next image number that we will store to by default... Bootloader indicates we are running image 2 By default, we will dload to image number 1! [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully. SAHttpCacheVariables::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! Setting up the SAHttpCacheVariables singleton pointer. CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! BcmCmSANonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! Reading Permanent settings from non-vol... Checksum for permanent settings: 0x5777d9d0 [00:00:02 01/01/1970] [tStartup] BcmHalIfNonVolSettings::ReadFromImpl: (HalIf NonVol Settings) WARNING - Read older version of the settings (0.20); they have been upgraded to version 0.21, preserving original settings. [00:00:02 01/01/1970] [tStartup] BcmWiFi80211NonVolSettings::ReadFromImpl: (WiFi 802.11 NonVol Settings) WARNING - Read older version of the settings (0.8); they have been upgraded to version 0.9, preserving original settings. [00:00:02 01/01/1970] [tStartup] BcmCmSANonVolSettings::ReadFromImpl: (CM SA NonVol Settings) WARNING - Read older version of the settings (0.9); they have been upgraded to version 0.10, preserving original settings. [00:00:02 01/01/1970] [tStartup] BcmeRouterNonVolSettings::IsDefault: (eRouter NonVol Settings) Permanent settings are default! * * * One or more of the settings groups was missing, possibly as a result of a code upgrade. * * * * * One or more o

Failsafe mode

Hardware

Info

Architecture: MIPS
Vendor: Broadcom
Bootloader: Unknown (see bootlog and guess)
System-On-Chip: Broadcom BCM338031
CPU/Speed FIXME
Flash-Chip: SPI flash ID 0x010216
Flash size: 8192 KiB
RAM: Samsung K4T51163QI-HCE6 / DDR2-667
RAM size: 64 MiB
Wireless: Broadcom BCM43224 (802.11a/b/g/n) (MiniPCIe)
Ethernet: switch Gigabit w/ vlan support swconfig
Internet: DOCSIS 3.0
USB: Yes 1 x 2.0
Serial: Yes
JTAG: ?

Photos

Model Number

Front:

Photo of front of the casing

Back:

Photo of back of the casing

Opening the case

Note: This will void your warranty!

  • To remove the cover do a/b/c


Photo of PCB

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:


Photo of PCB with markings

Use a serial TTL adapter to connect.

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Can use SPI programmer without desoldering flash memory, like this: ISP SBG6580 ISP CG3100D

Debricking

Bootloader Mods

  1. you could read about bootloader in general

Notes

Ressources

  • VMDG480 (disassembling, hardware specifications)

—-

Tags

For some Help with the Tags, please have a look here: tags

Back to top

toh/cisco/epc3825.txt · Last modified: 2013/05/17 12:59 by pasha.t