Hi, all. Some time ago, a have become an owner of a bunch of cable modems based on the SoC's I have mentioned in the title. There are about 5 scientific atlanta webstars (bcm3349) 2 U.S. Robotics with bcm 3350 and several motorolas, I have not yet disassembled to find out the internals. I'm interested in porting linux to them, since I would like to use their ethernet to contol a bunch of homebrew AVR hardware over the net and do some data processing as well. Searching along the wiki I have found, that the initial steps such as running busybox on them were already made, the only thing missing were - kernel .configs and how to load and run kernel.
I am an embedded developer, although I have mostly dealt with ARMs and AVRs so far. I need some info to get started with these pieces of hardware. Perhaps someone can tell me who should I contact, who already has experience with these modems.
You can find my contacts (email, icq, jabber) in my profile.
Topic: hacking around BCM3349/BCM3350-based cable modems
The content of this topic has been archived on 20 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.
Page 1 of 1
Okay. The first modem I started around was USR6000, based on bcm3550.
I connected the serial and got some stuff, that I shall post here (the wiki doesn't seem to allow any kind of editing( )
The boot sequence
BCM3350
134c7865ab
Boot Code SW Version 3.5.1
BCM3350
SDv12c7865abDetect MXIC MX219LV160B Flash
Ambit Cable Modem Console Management
--------------------------------------------------------------------------
NETWORK INTERFACE PARAMETERS:
IP address on LAN is 192.168.100.1
LAN interface's subnet mask is 255.255.255.0
HARDWARE PARAMETERS:
This board's Ethernet hardware address is 00:C0:49:A2:0C:46
This board's USB Interface hardware address is 00:C0:49:A2:0C:47
CABLE MODEM APPLICATION PARAMETERS:
IP address of the TFTP host is [0.0.0.0]
The file to download and start is ram.bin
--------------------------------------------------------------------------
To change any of this, press any key within 2 seconds
Detect MXIC MX219LV160B Flash
Running image1 !!!!!
BCM3350
SDv12c7865abDetect MXIC MX219LV160B Flash
<USB ni init>
Location of Root is 8010600c
Running from RAM
Detect MXIC MX219LV160B Flash
ROM MAC ADDR: 00c0:49a2:0c46
This is image1
Detect a filesystem
DNS service enable
CM application's DNS entry[0]=cablemodem.web
function dhcpEnable() is called
DHCP Server enable(Default)
dhcp_enable_use_default is called
dhcp_server t_create is called
Add CM[00:c0:49:a2:0c:46] to DA filter
16dhcp_server q_vrecv is called
Upstream Queues Configured.
Creating USB task
Flushing event log
This code version is 9086.6000.1.6.2.13.60045
Issue software reset
Waiting for reset finished
Init EMAC registers
Write MAC address
CAM address match on index: 0
Ethernet is 10 Half mode
USBD started
DoUSB NDIS Driver
USB bMacAddress: 00C049A20C47
USB Vendor ID: af0b, deviceid: e500
Reading programmed USB Configuration...
USB_RESET_RECV
USB init OK
wnstrUSB_SUSPEND_RECV
eam frequency is 825000000 Init Mibs
Hz
Annex B mode selected
Downstream symbol rate is 5056941 symbols per second
Test port setsid == ffffffff
ting is 0x00
Initial upstream power is 61 dBmV
Send encryption key requests
Use DHCP
VoIP card interface is NOT enabled.
The tuner is a Temic 4937_8769
The upstream amplifier is a MicroTune 1530
The downstream reference frequency is 24.000 MHz
The upstream reference frequency is 24.000 MHz
The input frequency to the 3300 is 43.750 MHz
Stored upstream channel ID is 0x01
Periodic ranging timeouts are enabled
Preamble type will be set by the burst profiles
Use default MCNS symbol rates.
SetTXPower 61.00 (61.000000)
Hit a key in 2 seconds to enter the diag menu...
Start to search a downstream frequency
Start history frequency search:
History frequency:825000000 hz, result-->Channel does not exist!
History frequency:807000000 hz, result-->Channel does not exist!
History frequency:813000000 hz, result-->Channel does not exist!
End of history frequency search
Searching for a downstream channel from 825000000 hz to 855000000 hz (IRC/STD frequency plan)
Checking center frequency of 825000000... nothing!
Checking center frequency of 831000000... nothing!
Checking center frequency of 837000000... nothing!
Checking center frequency of 843000000... nothing!Or the boot menu:
Ambit Cable Modem Console Management
--------------------------------------------------------------------------
NETWORK INTERFACE PARAMETERS:
IP address on LAN is 192.168.100.1
LAN interface's subnet mask is 255.255.255.0
HARDWARE PARAMETERS:
This board's Ethernet hardware address is 00:C0:49:A2:0C:46
This board's USB Interface hardware address is 00:C0:49:A2:0C:47
CABLE MODEM APPLICATION PARAMETERS:
IP address of the TFTP host is [0.0.0.0]
The file to download and start is ram.bin
--------------------------------------------------------------------------
To change any of this, press any key within 2 seconds
1) set Image1 Primary
2) set Image2 Primary
3) Download Image1
4) Download Image2
5) Download BootCode
6) Parameters Setup
99) Exit
Choice :I will download and start disassembling the images asap.
Have you had any luck with the images? I've got a couple Com21 modems here based on the BCM3350 that I was looking into using just as a general SBC, either that or I'm just going to take a torch to it and knock off the through-hole connectors for other projects 
I got in touch with the guy Luke-jr who had initial success starting linux kernel on bcm3349. He says that 3350 is out of luck, because it has no mmu. I have some tips about running custom code there (probably a linux (uclinux) kernel as well) so you can contact me via jabber if you want to try that hardware.
Anything ever happen with that? My question is how is the serial port written to? Once that is done, so you can see what's going on, it should be a breeze eh
neutronscott wrote:
Anything ever happen with that? My question is how is the serial port written to? Once that is done, so you can see what's going on, it should be a breeze eh
Well, I have posted the image packer I have written a whiule ago on the mailing lists, so that the kernel can now be uploaded as a firmware image, but I have been really busy since then at work and didn't have any luck to hack the modems. I hope I will find some time this summer - really looking to finally taking a break from work.
neutronscott wrote:
Anything ever happen with that? My question is how is the serial port written to? Once that is done, so you can see what's going on, it should be a breeze eh
There's a bcm_mem_part.h from an old kernel and it has adresses of serial port registers, so it should be pretty straightforward.
What a coincidence that someone decided to bump this thread today... just as I was searching for this info :-)
Would appreciate just some quick info how to set up a build, what to put into the packer you built, and how you flash the device...
It sounds it is at quite an early stage yet...
btw this is for a few identical bcm3349 devices I don't know what to do with... and if I can help to get anywhere further let me know
They are Scientific Atlanta EPX2203
(Last edited by Autoguy on 18 May 2010, 22:48)
The discussion might have continued from here.
Page 1 of 1