Cisco DPC3825/EPC3825
This is a DOCSIS 3.0 Wireless cable Residential Gateway. It uses an eCos operating system. It seems it shares the same hardware with the Netgear CG3100D/CG3101D, Motorola SBG6580, Virgin Media Super Hub VMDG480.
More info at cisco website:
The SoC might be similar to bcm63xx platforms. Here some patches useful to start developing Openwrt support for this SoC:
http://alphacore.org/~florian/openwrt/bcm33xx/
| There exist GPL sources available from Netgear FTP: CG3100_GPL_src.zip eCos source code (38 MB) CG3100Dv2_V5.5.5.83.mp2_LxG1.0.5.83.mp2_EU_src.zip eCos and Linux source code visit Netgear FTP, models CG3xxx seems to share similar hardware |
Hardware Highlights
| SoC | Ram | Flash | Network | USB | Serial | JTag |
|---|---|---|---|---|---|---|
| BCM3380 | 64MiB | 8MiB | 4 | Yes | Yes | ? |
Bootlogs
OEM bootlog
BCM338031 TP0
1
Sync:1
346890
SA BootLoader Version: 2.3.0_R3(S) Release Gnu spiboot reduced DDR drive
Build Date: Sep 21 2009
Build Time: 15:57:39
SPI flash ID 0x010216, size 8MB, block size 64KB, write buffer 256, busy bit 1
Found image 1 at offset 20000
Found image 2 at offset 400000
eCos - hal_diag_init
Init device '/dev/BrcmTelnetIoDriver'
Init device '/dev/ttydiag'
Init tty channel: 80ec4bb8
Init device '/dev/tty0'
Init tty channel: 80ec4bd8
Init device '/dev/haldiag'
HAL/diag SERIAL init
Init device '/dev/ser0'
BCM 33XX SERIAL init - dev: 0.2
Set output buffer - buf: 0x80f6da48 len: 2048
Set input buffer - buf: 0x80f6e248 len: 2048
BCM 33XX SERIAL config
LsSpiInit 3380
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver...
[00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0x10216
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Permanent NonVol would fit in the boot block of this flash device, but I found existing NonVol in the following block; using this location instead...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully.
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices...
Detecting the next image number that we will store to by default...
Bootloader indicates we are running image 2
By default, we will dload to image number 1!
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully.
SAHttpCacheVariables::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
Setting up the SAHttpCacheVariables singleton pointer.
CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
BcmCmSANonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it!
Reading Permanent settings from non-vol...
Checksum for permanent settings: 0x5777d9d0
[00:00:02 01/01/1970] [tStartup] BcmHalIfNonVolSettings::ReadFromImpl: (HalIf NonVol Settings) WARNING - Read older version of the settings (0.20); they have been upgraded to version 0.21, preserving original settings.
[00:00:02 01/01/1970] [tStartup] BcmWiFi80211NonVolSettings::ReadFromImpl: (WiFi 802.11 NonVol Settings) WARNING - Read older version of the settings (0.8); they have been upgraded to version 0.9, preserving original settings.
[00:00:02 01/01/1970] [tStartup] BcmCmSANonVolSettings::ReadFromImpl: (CM SA NonVol Settings) WARNING - Read older version of the settings (0.9); they have been upgraded to version 0.10, preserving original settings.
[00:00:02 01/01/1970] [tStartup] BcmeRouterNonVolSettings::IsDefault: (eRouter NonVol Settings) Permanent settings are default!
*
*
* One or more of the settings groups was missing, possibly as a result of a code upgrade.
*
*
*
*
* One or more o
Failsafe mode
Hardware
Info
| Architecture: | MIPS |
| Vendor: | Broadcom |
| Bootloader: | Unknown (see bootlog and guess) |
| System-On-Chip: | Broadcom BCM338031 |
| CPU/Speed | ![]() |
| Flash-Chip: | SPI flash ID 0x010216 |
| Flash size: | 8192 KiB |
| RAM: | Samsung K4T51163QI-HCE6 / DDR2-667 |
| RAM size: | 64 MiB |
| Wireless: | Broadcom BCM43224 (802.11a/b/g/n) (MiniPCIe) |
| Ethernet: | switch Gigabit w/ vlan support swconfig |
| Internet: | DOCSIS 3.0 |
| USB: | Yes 1 x 2.0 |
| Serial: | Yes |
| JTAG: | ? |
Photos
Model Number
Front:
Photo of front of the casing
Back:
Photo of back of the casing
Opening the case
Serial
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port of this specific device:
Use a serial TTL adapter to connect.
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
Can use SPI programmer without desoldering flash memory, like this: ISP SBG6580 ISP CG3100D
Debricking
Bootloader Mods
- you could read about bootloader in general
Notes
Ressources
- VMDG480 (disassembling, hardware specifications)
—-
Tags
For some Help with the Tags, please have a look here: tags
toh/cisco/epc3825.txt · Last modified: 2013/05/17 12:59 by pasha.t



