Hi all, firts of all, I want to introduce my self:
I'm ferix, from Spain, and I love linux and openwrt.
Now, I'll present you my little project: porting linux to a Motorola SB4200.
I took the current stable kernel and I messed It a bit to make It runable on SB4200.
I started modifying the bcm63xx arch, and ripping off all the CFE stuff (SB4200 doen't have CFE).
After two days of work, I got a loadable and working linux kernel, so I tested It on my cablemodem.
It ran flawlesly 
But loading It from the cablemodem bootloader is a pain... so I decided to port u-boot to It, as well...
Porting u-boot was a very hard reverse engineering task, but finally I got It.
So, this is the current project status:
- U-boot: fully working, but no net... by now. You can load your test kernel using ymodem or kermit...
- Linux: working and stable, but It hungs when you try to bring up the network interface... I'm not sure why...
Here's the log:
U-Boot 2009.11.1 (jul 28 2010 - 16:23:16)
__ __ __ ______ ______ ______
| | | | | | / \ / \ / \
______ | | | |_| | \___ | | __ | | __ |
/ \ | |____ | | __| | | | | | | | | |
| __/ | \ \___ | / __/ | | | | | | | |
\__ \ | __ | | | | |___ | |__| | | |__| |
/ | | | | | | \ | | | |
\______/ \______/ |__| \______/ \______/ \______/
__ __
| | | |
| | | |_
__ __ | |____ ______ ______ | |
| | | | ___ | \ / \ / \ | |-
| | | | | | | __ | | __ | | __ | | |__
| -- | --- | | | | | | | \
\______/ \______/ \______/ \______/ \____/
*** by ferix ***
Board: Motorola SB4200 mips CPU: Broadcom BCM3345 proc_id=0x28000
DRAM: 8 MB
Flash: 2 MB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
## Booting kernel from Legacy Image at bfc50000 ...
Image Name: Linux 2.6.34 bcm3345
Created: 2010-07-28 17:54:39 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 801410 Bytes = 782.6 kB
Load Address: 80010000
Entry Point: 800143f0
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
Linux version 2.6.34 (ferix@Deimos) (gcc version 4.1.2) #1 Wed Jul 28 19:09:30 CEST 2010
Detected Broadcom 0x3345 CPU revision a1
CPU frequency is 140 MHz
8MB of RAM installed
registering 16 GPIOs
bootconsole [early0] enabled
CPU revision is: 00028000 (Broadcom BCM3345)
board_sb4200: Motorola SB4200 board support
board_sb4200: (C) 2010 by ferix <ferix.98@gmail.com>
board_sb4200: board name: sb4200
Determined physical RAM map:
memory: 00800000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0x00000000 -> 0x00000800
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00000800
Built 1 zonelists in Zone order, mobility grouping off. Total pages: 2032
Kernel command line: root=/dev/mtdblock4 rootfstype=cramfs console=ttyS0,38800
PID hash table entries: 32 (order: -5, 128 bytes)
Dentry cache hash table entries: 1024 (order: 0, 4096 bytes)
Inode-cache hash table entries: 1024 (order: 0, 4096 bytes)
Primary instruction cache 8kB, VIPT, 2-way, linesize 16 bytes.
Primary data cache 4kB, 2-way, VIPT, no aliases, linesize 16 bytes
Memory: 5560k/8192k available (1828k kernel code, 2632k reserved, 406k data, 132k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:128
Console: colour dummy device 80x25
Calibrating delay loop... 92.67 BogoMIPS (lpj=185344)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
ROMFS MTD (C) 2007 Red Hat, Inc.
msgmni has been set to 16
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
brd: module loaded
loop: module loaded
flash mapping: 200000 at 1fc00000
Motorola SB4200 bootflash: Found 1 x16 devices at 0x0 in 16-bit bank
Intel/Sharp Extended Query Table at 0x0035
Using auto-unlock on power-up/resume
cfi_cmdset_0001: Erase suspend on write enabled
Creating 5 MTD partitions on "Motorola SB4200 bootflash":
0x000000000000-0x000000200000 : "WHOLEFLASH"
0x000000000000-0x000000040000 : "u-boot"
0x000000040000-0x000000050000 : "env"
0x000000050000-0x000000120000 : "kernel"
0x000000120000-0x000000200000 : "rootfs"
bcm63xx_enet MII bus: probed
SLIP: version 0.8.4-NET3.019-NEWTTY (dynamic channels, max=256).
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
TCP cubic registered
NET: Registered protocol family 17
VFS: Mounted root (cramfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 132k freed
Algorithmics/MIPS FPU Emulator v1.5
Mounting filesystems... done.
Setting hostname... done.
________ ___ ___
/ _____/ ___ / / / /
/ /__ /__/ / /_/ /
/ ___/ _____ _____ ___ > __ <
/ / / _ / / __/ / / / / / /
/ / / ___/ / / / / / / / /
/__/ /____/ /__/ /__/ /__/ /__/
-=[ Welcome to sb4200 ]=-
sb4200 login: root
Jan 1 00:00:05 login[27]: root login on 'ttyS0'
BusyBox v1.16.2 (2010-07-14 11:10:07 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
# cat /proc/cpuinfo
system type : bcm63xx/sb4200 (0x3345/0x00A1)
processor : 0
cpu model : Broadcom BCM3345 V0.0
BogoMIPS : 92.67
wait instruction : no
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : yes
hardware watchpoint : no
ASEs implemented :
shadow register sets : 1
core : 0
VCED exceptions : not available
VCEI exceptions : not available
#Now, I'm analyzing the original firmware, trying to understand how the ethernet hardware works, and how different It is from the bcm63xx one.
If you want to give It a try, just download the flash image from http://www.megaupload.com/?d=UX6F09XT, flash It to your modem, attach your serial cable, configure your terminal to 38400 8N1, and reset your modem 
All suggestions and comments are welcome.
PD: sorry for my poor english.
edit: I take no responsibility if you break your modem.
(Last edited by ferix on 28 Jul 2010, 19:49)