This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
toh:cisco:epc3925 [2014/03/02 18:57] fel2009 |
toh:cisco:epc3925 [2015/12/14 16:02] (current) tmomas New bootlog formatting applied |
||
---|---|---|---|
Line 1: | Line 1: | ||
+ | ====== Cisco EPC3925 ====== | ||
+ | [[doc:hardware:soc:soc.broadcom.bcm33xx|BCM33xx]] | ||
+ | This is a DOCSIS 3.0 Wireless cable Residential Gateway. It uses an eCos operating system. It seems it shares the same hardware with the Netgear CG3100D/CG3101D, Motorola SBG6580, Virgin Media Super Hub VMDG480. | ||
+ | |||
+ | | {{:meta:icons:tango:package-x-generic.png|}} | There exist GPL sources available from [[ftp://downloads.netgear.com/files/GPL/|Netgear FTP]]:\\ [[ftp://downloads.netgear.com/files/GPL/CG3100_GPL_src.zip|CG3100_GPL_src.zip]] eCos source code (38 MB) \\ [[ftp://downloads.netgear.com/files/GPL/CG3100Dv2_V5.5.5.83.mp2_LxG1.0.5.83.mp2_EU_src.zip|CG3100Dv2_V5.5.5.83.mp2_LxG1.0.5.83.mp2_EU_src.zip]] eCos and Linux source code\\ \\ visit [[ftp://downloads.netgear.com/files/GPL/|Netgear FTP]], models CG3xxx seems to share similar hardware | | ||
+ | |||
+ | ===== Hardware Highlights ===== | ||
+ | ^ SoC ^ Ram ^ Flash ^ Network ^ USB ^ Serial ^ JTag ^ | ||
+ | | BCM3380 | 64MiB | 16MiB | 4 | Yes | Yes | ? | | ||
+ | |||
+ | ==== Failsafe mode ==== | ||
+ | -> [[doc:howto:generic.failsafe]] | ||
+ | |||
+ | ===== Hardware ===== | ||
+ | ==== Info ==== | ||
+ | | **[[wp>Instruction set|Instruction set]]:** | [[wp>MIPS architecture|MIPS]] | | ||
+ | | **Vendor:** | [[wp>Broadcom]] | | ||
+ | | **[[doc:techref:Bootloader]]:** | Unknown (see bootlog and guess) | | ||
+ | | **[[doc:hardware:soc|System-On-Chip]]:** | [[http://datasheet.elcodis.com/pdf/48/45/484522/bcm3380dkfsbg.pdf|Broadcom BCM3380]] | | ||
+ | | **[[doc:hardware:cpu|CPU]] @Frq** | FIXME @333MHz| | ||
+ | | **Flash-Chip:** | Macronix MX25L12845EMI-10G (SPI) | | ||
+ | | **Flash size:** | 16 MiB | | ||
+ | | **RAM:** | FIXME / DDR2-667 | | ||
+ | | **RAM size:** | 64 MiB | | ||
+ | | **Wireless:** | Broadcom BCM43225 (802.11b/g/n) (MiniPCIe) | | ||
+ | | **Ethernet:** | Atheros AR8316, switch Gigabit w/ vlan support [[doc:techref:swconfig]] | | ||
+ | | **Internet:** | DOCSIS 3.0 | | ||
+ | | **USB:** | Yes 1 x 2.0 | | ||
+ | | **[[doc:hardware:port.serial|Serial]]:** | [[#Serial|Yes]] | | ||
+ | | **[[doc:hardware:port.jtag|JTAG]]:** | [[#JTAG|?]] | | ||
+ | |||
+ | ==== Photos ==== | ||
+ | **Casing**\\ | ||
+ | {{media:cisco:epc3925_case1.jpeg?350x200|}} | ||
+ | {{media:cisco:epc3925_case2.jpg?500x200|}} | ||
+ | |||
+ | ==== Opening the case ==== | ||
+ | **Note:** This will void your warranty! | ||
+ | *To remove the cover just unscrew the screws at the bottom of the case. | ||
+ | |||
+ | **Photo of PCB**\\ | ||
+ | {{media:cisco:epc3925_board0.jpg?500|}} | ||
+ | |||
+ | ==== Serial ==== | ||
+ | -> [[doc:hardware:port.serial]] general information about the serial port, serial port cable, etc. | ||
+ | |||
+ | FIXME | ||
+ | |||
+ | How to connect to the Serial Port of this specific device: | ||
+ | |||
+ | FIXME | ||
+ | **Photo of PCB with markings** | ||
+ | |||
+ | Use a serial TTL adapter to connect. | ||
+ | |||
+ | ==== Flash chip programming ==== | ||
+ | -> [[doc:hardware:port.jtag]] general information about the JTAG port, JTAG cable, etc. | ||
+ | |||
+ | FIXME | ||
+ | |||
+ | {{media:cisco:epc3925_flashchip0.jpg?500x300|}} | ||
+ | |||
+ | ===== Debricking ===== | ||
+ | -> [[doc:howto:generic.debrick]] | ||
+ | |||
+ | ===== Bootloader Mods ===== | ||
+ | |||
+ | Currently none. | ||
+ | |||
+ | ===== Bootlogs ===== | ||
+ | ==== OEM bootlog ==== | ||
+ | <WRAP bootlog> | ||
+ | <nowiki>P | ||
+ | BCM3380A1 TP0 | ||
+ | 1 | ||
+ | Sync:1 | ||
+ | 346890 | ||
+ | |||
+ | |||
+ | SA BootLoader Version: 2.3.0_R1(S) Release Gnu pcminit spiboot reduced DDR drive | ||
+ | |||
+ | Build Date: Jul 1 2009 | ||
+ | |||
+ | Build Time: 19:20:01 | ||
+ | |||
+ | SPI flash ID 0xc22018, size 16MB, block size 64KB, write buffer 256, busy bit 1 | ||
+ | |||
+ | |||
+ | Found image 1 at offset 20000 | ||
+ | |||
+ | eCos - hal_diag_init | ||
+ | Init device '/dev/BrcmTelnetIoDriver' | ||
+ | Init device '/dev/ttydiag' | ||
+ | Init tty channel: 814566c0 | ||
+ | Init device '/dev/tty0' | ||
+ | Init tty channel: 814566e0 | ||
+ | Init device '/dev/haldiag' | ||
+ | HAL/diag SERIAL init | ||
+ | Init device '/dev/ser0' | ||
+ | BCM 33XX SERIAL init - dev: 0.2 | ||
+ | Set output buffer - buf: 0x81644810 len: 4096 | ||
+ | Set input buffer - buf: 0x81645810 len: 4096 | ||
+ | BCM 33XX SERIAL config | ||
+ | |||
+ | LsSpiInit 3380 | ||
+ | [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver... | ||
+ | detecting flash3... | ||
+ | [00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0xc22018 | ||
+ | [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Permanent NonVol would fit in the boot block of this flash device, but I found existing NonVol in the following block; using this location instead... | ||
+ | [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver... | ||
+ | [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver... | ||
+ | ProgramStoreDeviceDriver::ProgramStoreDriverInit: INFO - Initializing... | ||
+ | [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver... | ||
+ | [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully. | ||
+ | [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices... | ||
+ | Detecting the next image number that we will store to by default... | ||
+ | Bootloader indicates we are running image 1 | ||
+ | By default, we will dload to image number 2! | ||
+ | |||
+ | [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully. | ||
+ | |||
+ | BcmCmDocsisCtlThread::GetSingletonInstance: WARNING - the singleton is NULL, and someone is accessing it! | ||
+ | BcmCmDocsisCtlThread::GetSingletonInstance: WARNING - the singleton is NULL, and someone is accessing it! | ||
+ | SAHttpCacheVariables::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! | ||
+ | Setting up the SAHttpCacheVariables singleton pointer. | ||
+ | CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! | ||
+ | CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! | ||
+ | CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! | ||
+ | BcmCmSANonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! | ||
+ | [00:00:03 01/01/1970] [tStartup] BcmCmSANonVolSettings::BcmCmSANonVolSettings: (CM SA NonVol Settings) WARNING - Current CxC Version is 3.9.21.11.mp8 | ||
+ | BcmEmtaBlindDataNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! | ||
+ | ERROR: Unable to get GetCountry blind data. (BcmEmtaBlindDataNonVolSettings = NULL) | ||
+ | WARNING: ResetDefaultBlindEmtaData() -Resetting EMTA non-vol data section to default values | ||
+ | mtaNvCalcChecksum: checksum= 1273036006 | ||
+ | Reading Permanent settings from non-vol... | ||
+ | Checksum for permanent settings: 0x4f6bf263 | ||
+ | [00:00:03 01/01/1970] [tStartup] BcmMessageLogNonVolSettings::ReadFromImpl: (User Interface NonVol Settings) WARNING - Read older version of the settings (0.2); they have been upgraded to version 0.3, preserving original settings. | ||
+ | [00:00:03 01/01/1970] [tStartup] BcmHalIfNonVolSettings::ReadFromImpl: (HalIf NonVol Settings) WARNING - Read older version of the settings (0.19); they have been upgraded to version 0.21, preserving original settings. | ||
+ | [00:00:03 01/01/1970] [tStartup] BcmWiFi80211NonVolSettings::ReadFromImpl: (WiFi 802.11 NonVol Settings) WARNING - Read older version of the settings (0.8); they have been upgraded to version 0.10, preserving original settings. | ||
+ | [00:00:03 01/01/1970] [tStartup] BcmCmDocsis30NonVolSettings::ReadFromImpl: (</nowiki> | ||
+ | </WRAP>\\ | ||
+ | |||
+ | ===== Notes ===== | ||
+ | * [[http://cdkr.co.uk/projects/computers/virgin_VMDG480/|VMDG480]] (disassembling, hardware specifications) | ||
+ | * [[http://w00tsec.blogspot.com.es/2013/11/unpacking-firmware-images-from-cable.html|w00tsec]] Unpacking Firmware | ||
+ | |||
+ | ===== Tags ===== | ||
+ | [[meta:tags|How to add tags]] | ||
+ | {{tag>bcm33xx bcm3380 GigabitEthernet 5Port USB 64RAM 16Flash MIPS DOCSIS3}} |