Adventures in reverse engineering Broadcom NIC firmware

For some time now, I’ve been reverse engineering the firmware of the Broadcom BCM5719 Ethernet NIC chip, so that open source firmware can be produced for it. The reason for this was the first big break that gave a starting point to assign meaning to register addresses: Broadcom (rather unusually for them) actually publishes a register manual for the BCM5719, and the register addresses in that manual actually appeared to correspond with many of the register accesses found inside the MIPS firmware. The story appears to go like this: once upon a time, the distant ancestors of the BCM5719 had two MIPS cores per port; an “RX RISC” (CPU 0) and a “TX RISC” (CPU 1), which were involved in the actual transmission/reception process.

Source: www.devever.net