I have a DDW36C router with a BCM933843MWVG SoC. I want to port OpenWrt to it, but the problem is that while the SDK supports Linux and eCos, I don't have the SDK and the manufacturer chose eCos. Unfortunately for me, this means that every single function on the entire system is packed into one giant binary with no symbols, making it nearly impossible to reverse engineer.
I know it can support Linux, but how can I actually start the port? I have full access to the router and can write to memory and flash, but have no idea where to start. The wiki only has general instructions for once you have extensive information about the router
there will never be wireless support for that device
there will never be support for the docsis cable modem
there will never be support for phone features
…and if the OEM chose eCos, there typically is a reason for that - and it typically means there isn't enough flash/ RAM to boot linux in the first place.
…and if the OEM chose eCos, there typically is a reason for that - and it typically means there isn't enough flash/ RAM to boot linux in the first place.
This isn't necessarily true, the SDK for the exact chip supports Linux but they chose eCos for some reason, I just don't have a binary for it. Although the other points probably still stand
Determining the amount of flash and RAM likely isn't that hard -- UART output or inspection of the chips should reveal those details. However, as stated, this isn't a device worth developing against.
16 MB flash, >240 MB RAM, so it meets the minimum requirements at least. I'd still like to try, even though it's probably a dead end. I don't really need wireless features, and would like to try experimenting with the DOCSIS hardware, since there seems to be almost zero research put into it. If I'm lucky maybe some of it is handled by the DOCSIS device's firmware itself. It's probably better then getting an attenuator at least
But it all depends on whether the manufacturer cares about GPL or not. Hopefully I can get some kind of Linux config, I have binary dumps of the entire flash and can read and write to all flash and RAM through UART
then you absolutely, positively don't want OpenWrt. The DOCSIS modem functions are not, never has been, and probably never will be supported by OpenWrt.
And, FWIW, there is essentially zero user-side configurability of a DOCSIS system (the modem itself). This is all handled by the ISP. All the user can do is configure secondary features of a device (such as if it is a combo router) and typically view the status and statistics of the modem itself.
That again rules out Broadcom. Most-if-not-All their devices come with ancient kernels, no (useful) source, and no long.term support. You're expected to bin their devices every 3 years, and buy a new one.
then you absolutely, positively don't want OpenWrt. The DOCSIS modem functions are not, never has been, and probably never will be supported by OpenWrt.
I'm planning on just using it as a better OS, not for the drivers, because experimenting on the eCos system that doesn't even have a shell, and cannot execute any custom code, is simply impossible. I can't even figure out how to change basic settings, so porting OpenWrt would be a huge improvement even though it isn't planning to support DOCSIS.
Not saying it's feasible to port it (as you pointed out, it isn't without more information), but if it were, it would be incredibly useful for my use case. Would porting something like DD-WRT would be any easier?
That again rules out Broadcom. Most-if-not-All their devices come with ancient kernels, no (useful) source, and no long.term support. You're expected to bin their devices every 3 years, and buy a new one.
This is Ubee (it just uses Broadcom's SoC and SDK), which is probably the same situation, but this router has gotten an update in 2020 (according to the copyright text) despite being created in 2015...
So at the end of the day, what exactly do you want/expect to be able to do with the device? As mentioned, wifi will be non-(or barely-) functional. DOCSIS won't work at all, neither will the phone features. So you might have at best a device that is the equivalent of an older wired router (assuming the Ethernet ports work properly).
Basic settings with respect to what? WiFi? DOCSIS? Routing? Something else?
So at the end of the day, what exactly do you want/expect to be able to do with the device? As mentioned, wifi will be non-(or barely-) functional. DOCSIS won't work at all, neither will the phone features. So you might have at best a device that is the equivalent of an older wired router (assuming the Ethernet ports work properly).
It doesn't have phone features, just DOCSIS. I'm aware that it wouldn't have Wi-Fi or DOSCIS capabilities, but I have another router with OpenWrt that I could use for Wi-Fi.
What I'm looking for is a way to experiment with writing a DOCSIS driver, and Broadcom Foundation Classes, the firmware pre-installed on it, is impossible to use. Since no open source project has put any research into DOCSIS, it's not like another project would be any better, so I don't see why not to use OpenWrt. In theory my goal would be to create a DOCSIS to Ethernet bridge, using only open source software, but that's almost certainly not going to happen without years of work, so I'll be satisfied if I could just connect to the DOCSIS hardware at all
Basic settings with respect to what? WiFi? DOCSIS? Routing? Something else?
A lot. I can change things on the web GUI, but if I try to do something like make the LAN have higher priority (LAN gets extremely throttled), it's impossible to use the UART console because everything is poorly documented and makes no sense. Also the router randomly stops working, shows cryptic error messages on the log, and I just have to reboot it since I can't troubleshoot the issue.
The OS that is installed is an absolute nightmare to use without access to the source code, and reverse engineering is pretty much impossible because every function, from the syscalls to the web GUI, is packed into the same binary with no way to know which is which. So I have an image that is ~200 MB of pure code, no symbols, and it's impossible to get any useful information from Ghidra. It doesn't even have an OS shell, just some stupid proprietary Broadcom shell with a few predefined operations, and almost no information on the Internet about it. It's awful, and porting OpenWrt would be a godsend.
Ok... let's circle back on expectations and the reality of what you are trying to accomplish.
Setting aside DOCSIS here for a moment, you can do a ton with OpenWrt, and you won't need to do any special development work if you simply select a router that currently has OpenWrt support. The easiest path here is to do the following"
Obtain a standard router that can run OpenWrt. There are nearly 2000 different devices supported by the latest version.
Use a DOCSIS modem that works in bridge mode (maybe yours can be switched into bridge mode to pass the IP address through to the router; if not, get a modem-only device).
Let's start with what was already stated about the customer side of the equation -- there is, by design, nothing for the customer to adjust or configure on a DOCSIS modem. This is handled entirely and exclusively by the ISP.
Moving onto the logistics of actually writing your own drivers, I hope that you have a background (or practical experience) with both software and hardware (RF specifically) engineering, as writing drivers for DOCSIS will not be easy. You'll probably also need electrical/RF test equipment, too, since you will need to be able to observe the effect of the various registers on the DOCSIS chipset on the signal. I'm not aware of any DOCSIS development efforts by the open source community in part because this is typically the domain of the device manufacturers who have labs equipped with test equipment in the range of $100,000 USD (and likely higher). Those companies specifically partner with the chipset manufacturer (Broadcom in this case) and the Cable ISPs to tune and qualify the devices on the various ISP networks. And, they would have access to chipset data sheets under NDA -- stuff you will not be able to access.
So the task ahead of you is to entirely reverse-engineer the DOCSIS modem section of the device, and then re-write the whole thing in a new environment. And, this all comes after you can port OpenWrt to your device (which is a complicated endeavor on its own and not certain to succeed).
To be clear... if they haven't provided source code of any sort, and then you say that
where do you honestly expect to start? And to what end?
This may be true, but it does actually operate the device such that you get a functional bit of kit.
What you're talking about would be a multi-year project for several talented hardware/software/firmware engineers.
If you want to continue forward, feel free to follow this guide. You should expect to do this alone, as is doubtful that anybody will want to help with this effort for all the reasons already discussed in this thread.
If you manage to succeed, you will likely have spent many years --- likely half a decade -- on this process. And, by then, the entire device will be obsolete and you'll want a new unit that can provide faster DOCSIS connectivity.
It's unclear to me why you specifically want to bother with this device, when it is so much easier, faster, and cheaper (when you consider your invested time and possibly the test equipment you'll need) to simply buy a DOCSIS modem + OpenWrt supported router.
I will say, though, that if you are able to achieve this on your own, it will be an impressive feat and would probably be quite a resume booster, especially if you want to work in firmware engineering on complex products like DOCSIS cable modems or cellular systems (I am being serious here).
Obtain a standard router that can run OpenWrt. There are nearly 2000 different devices supported by the latest version.
Already have one, its antenna isn't great but it works pretty well
Use a DOCSIS modem that works in bridge mode (maybe yours can be switched into bridge mode to pass the IP address through to the router; if not, get a modem-only device).
This is currently possible with my device, but I wanted to experiment for fun, and as a bonus get the advantages of OpenWrt. It seems that this is impractical however, as you and stragies have explained, so this project will probably be left unfinished (if I even attempt it at this point)
I'm not aware of any DOCSIS development efforts by the open source community in part because this is typically the domain of the device manufacturers who have labs equipped with test equipment in the range of $100,000 USD (and likely higher). Those companies specifically partner with the chipset manufacturer (Broadcom in this case) and the Cable ISPs to tune and qualify the devices on the various ISP networks. And, they would have access to chipset data sheets under NDA -- stuff you will not be able to access.
So the task ahead of you is to entirely reverse-engineer the DOCSIS modem section of the device, and then re-write the whole thing in a new environment. And, this all comes after you can port OpenWrt to your device (which is a complicated endeavor on its own and not certain to succeed).
What I was hoping is that most of it is handled by a separate SoC on the device, and that the driver's only job is to send the proper information (certificates and IP addresses) to the DOCSIS controller, just like a lot of modern computer hardware works (and a big reason why companies like NVIDIA release open source drivers, because they basically just ask the firmware to do something). This is obviously just a guess, but since I can get a second DDW36C for only $20 on eBay to experiment with, it might still be worth trying
To be clear... if they haven't provided source code of any sort, and then you say that
Hopefully they'll provide source code for the Linux port, even though I don't have any binaries of the full Linux image, and then that will help port OpenWrt
If you manage to succeed, you will likely have spent many years --- likely half a decade -- on this process. And, by then, the entire device will be obsolete and you'll want a new unit that can provide faster DOCSIS connectivity.
I highly doubted I'd succeed in the first place, my only hope is that it's separate from the normal SoC. Also this device has been obsolete for several years now, but the only routers my ISP (Spectrum) will issue at this point are ones that only let you change the SSID, password and port forwarding, and only through a terrible, buggy Android app. For that reason, I don't want to ask them for a new router just for faster Internet
Unless you require a symmetric speed tier, you can bring your own modem:
There are a bunch of compatible modems, all easily purchased on the retail market. Get a modem-only device and then add whatever router you want behind it.
There are 2 DOCSIS chips used in the market. Unfortunately, I’m more familiar with Puma (MaxLinear) than Broadcom. On the Puma side, all the DOCSIS logic lives in Linux. There is no separate SoC that can just be “talked” to.
Both chipmakers use a dual-cpu design embedded in one chip. Puma has an armv6 big endian core that handles the DOCSIS logic and an x86 core that handles the RG (router-gateway) side. There’s a fork here that adds support for the x86 side only; no DOCSIS. https://github.com/cocus/openwrt/tree/refs/heads/testing-intelce
Broadcom’s DOCSIS 3.0 chips are a BCM338*. There’s a PR here to get router side functionality here https://github.com/openwrt/openwrt/pull/17464
The modem CPU is actually booted by the ARM core, and the eCos binary is loaded from the ARM filesystem.
DOCSIS 3.1 are using the BCM3390. It has a MIPS core for the DOCSIS part, and an ARM core (maybe it’s dual core?) for the RG side.
The sucky part is starting with the DOCSIS 3.1 generation, both chipmakers have added secureboot functionality, and many, but not all, have it enabled. It is a good implementation of it too, so finding modern modems that can even boot a custom OS is only getting harder.
EDIT: I think secureboot was actually available on D3.0 modems, but nobody used it.
Unless you require a symmetric speed tier, you can bring your own modem:
I had no idea, that's a great option. Thanks for finding that
The sucky part is starting with the DOCSIS 3.1 generation, both chipmakers have added secureboot functionality, and many, but not all, have it enabled. It is a good implementation of it too, so finding modern modems that can even boot a custom OS is only getting harder.
How annoying, fortunately I have a DOCSIS 3.0 router, but the bootloader is confusing; it seems to be compressed and I can't reverse engineer it. There seem to be only 2 or 3 strings, which can't be right
No, it is one ethernet port wan others lan, and with extreme effort maybe one of wigis can be squeezed to do wifi-g or n or an (what limited support means, varies from device to device, certainly lrsd than OEM fw does)
If the USB is supported, the device could find use a some sort of Home Assistant satellite/gateway, for e.g. remoted serial or sound, or a VoiceAssist satellite with local wakeword detection