OpenWrt Forum Archive

Topic: BCM63xx CFE settings

The content of this topic has been archived on 12 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi all.

While trying to flash openwrt to my DSL-2640B H/W T1 ( BCM6333 ) I made a stupid mistake to change the board ID of the CFE from 7 ( 96333W ) to 3 ( 96338W ).
At serial console the modem still boots the CFE but freeze and no commands are recognized.

CFE version 1.0.37-10.3 for BCM96338 (32bit,SP,BE)
Build Date: Fri Jul  3 19:16:30 CST 2009 (root@localhost.localdomain)
Copyright (C) 2000-2006 Broadcom Corporation.

Boot Address 0xbfc00000

Initializing Arena.
Initializing Devices.
Serial flash device: name NX25P32, id 0xef15, size 4096KB
Flash Layout: Boot[63,0xbfff0000] Kern[1,0xbfc10000]
              AuxFS[61,0xbffd0000] Misc[61,0xbffd0000] PSI[63,0xbfff0000]
Flash RootFS Partition Length: 3932160
CPU type 0x29010: 240MHz
Total memory: 16777216 bytes (16MB)

Total memory used by CFE:  0x80401000 - 0x80528970 (1210736)
Initialized Data:          0x8041E050 - 0x80420170 (8480)
BSS Area:                  0x80420170 - 0x80426970 (26624)
Local Heap:                0x80426970 - 0x80526970 (1048576)
Stack Area:                0x80526970 - 0x80528970 (8192)
Text (code) segment:       0x80401000 - 0x8041E044 (118852)
Boot area (physical):      0x00529000 - 0x00569000
Relocation Factor:         I:00000000 - D:00000000

Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host (f/h)         : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Board Id (0-9)                    : 96338W
Number of MAC Addresses (1-32)    : 11
Base MAC Address                  : 00:24:01:f9:29:dd
PSI Size (1-64) KBytes            : 24
Flash Block Size (1-128) in KBytes: 0
Auxillary File System Size Percent: 0

udp_send finished

Anyone have any idea where the board ID is located at the serial flash device ? are any easy way to flashing SPI devices ?

Anyone have a guide or could help me to dump the serial flash ? I want to try recover this hardware.

you must restore board id to original value and perhaps reset nvram.
try to use help command on serial console from CFE boot.

edit
sorry, i read fast and i mistake you can't enter any command from CFE boot. You must read/reflash CFE with JTAG

(Last edited by t3l3m4k0 on 13 May 2010, 23:58)

t3l3m4k0 wrote:

you must restore board id to original value and perhaps reset nvram.
try to use help command on serial console from CFE boot.

edit
sorry, i read fast and i mistake you can't enter any command from CFE boot. You must read/reflash CFE with JTAG

The board doesn't have a jtag connector. sad

The serial flash chip is a 25X32VSIG. Googling about it and found the pinout but I have no knowledge in how to backup/restore the contents.

I found that the leds behaviour of the board changed. Ex. OSS led lights up when pluged a cat5 cable at port 3.

(Last edited by zhadoom on 14 May 2010, 02:16)

Hi, did you manage to solve this ?

Not yet. I'm trying to collect enough knowledge about spi devices and how to use spipgm software. My goal is to remove the 25X32, full dump the chip and analyse to discover how to back to the original state. Painfull job ....
Today I'm looking for a dump of the firmware + CFE from another 2640B H/W T1. I think that this way will be more simple to recover the modem.

I know this is late, and that you probably have already bought 10 new routers, but just to have it said. All chips in the BCM63xx series should have JTAG pins on them. Find them and connect.

PopOpen wrote:

I know this is late, and that you probably have already bought 10 new routers, but just to have it said. All chips in the BCM63xx series should have JTAG pins on them. Find them and connect.

Where can I find that info about 96333 JTAG pins ? The damned broadcom 96333 is almost unknown even in google .... sad

If you want good help, you need to be precise. If you're not careful with details, I really do not recommend you to flash or solder anything!

You are doing some weird things!
a) Why would you wanna change the Board ID?
b) I've never heard of a BCM96333 are you sure?

Post some pictures!! We'd love to know about "new" stuff!
Compare with: http://pudeev.livejournal.com/35872.html#cutid1

If it is a 6338, it may be similar to the 6348 in pin layout. Which you can find here:
http://www.f-x.fr/wikini/wakka.php?wiki=Bcm6348PinOut
http://pudeev.livejournal.com/37410.html
Count your pins, and start testing!

(Last edited by PopOpen on 30 Apr 2011, 20:52)

a) my mistake to change that parameter
b) I opened the modem and is BCM96333

I will take a look at the links.

How did it go with this project?

I'm interested in the BCM96333 chip, can you post a picture of your board with the chip?

Hi PopOpen,

Are you still interested in the BCM96333? I have the same version of zhadoom and I'll be uploading a picture of it tonight (~9pm BRT (UTC-3)).

I'm interested in installing the OpenWrt into this modem (DSL-2640B H/W: T1) but I'm not having success... sad

Have a good day.

The discussion might have continued from here.