CPU: BCM63167
Wi-Fi: BCM435F + BCM4352KMLG
Rom: 16 mb spi 25Q128FVSG
Ram: 128 mb
Bootloader is bcm63xx cfe.
Can someone help to bring up openwrt for it? I have CH341A and linux kernel development experience with qualcomm android devices, but have never worked with bcm, so no idea how to work there.
Boot log:
Base: 4.16_03
CFE version 1.0.38-116.174 for BCM963268 (32bit,SP,BE)
Build Date: Mon Jun 13 09:06:44 CST 2016 (wuwenjie@tp-link.com.cn)
Copyright (C) 2000-2013 Broadcom Corporation.
Boot Strap Register: 0x1e7febf
Chip ID: BCM63167D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000
HS Serial flash device: ID_W25X128, id 0xef18 sector 64KB size 16384KB
Flash not used for Auxillary File System
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host/tftp (f/h/c) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Default host ramdisk file name :
Default ramdisk store address :
Board Id (0-35) : 963167TP
Number of MAC Addresses (1-32) : 11
Base MAC Address : e0:05:c5:04:00:01
PSI Size (1-64) KBytes : 48
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
Main Thread Number [0|1] : 0
WLan Feature : 0x00
*** Press 't' to stop auto run (0.1 seconds) ***
Code Address: 0x80010000, Entry Address: 0x803daf90
Decompression OK!
Entry at 0x803daf90
Starting program at 0x803daf90
Linux version 3.4.11-rt19 (wuwenjie@tp-link.com.cn) (gcc version 4.6.2 (Buildroo
HS Serial flash device: ID_W25X128, id 0xef18 sector 64KB size 16384KB
963167TP prom init
CPU revision is: 0002a080 (Broadcom BMIPS4350)
DSL SDRAM reserved: 0x132000
Determined physical RAM map:
memory: 07ece000 @ 00000000 (usable)
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x00007ece
Movable zone start PFN for each node
Early memory PFN ranges
0: 0x00000000 -> 0x00007ece
On node 0 totalpages: 32462
free_area_init_node: node 0, pgdat 804dd130, node_mem_map 81000000
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 222 pages used for memmap
Normal zone: 28144 pages, LIFO batch:7
PERCPU: Embedded 7 pages/cpu @81103000 s5360 r8192 d15120 u32768
pcpu-alloc: s5360 r8192 d15120 u32768 alloc=8*4096
pcpu-alloc: [0] 0 [0] 1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32208
Kernel command line: ro noinitrd irqaffinity=0
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Memory: 122668k/129848k available (3935k kernel code, 7180k reserved, 983k data,
Preemptible hierarchical RCU implementation.
NR_IRQS:128
console [ttyS0] enabled
Calibrating delay loop... 397.31 BogoMIPS (lpj=198656)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
--Kernel Config--
SMP=1
PREEMPT=1
DEBUG_SPINLOCK=0
DEBUG_MUTEXES=0
Broadcom Logger v0.1 Jun 12 2016 14:41:46
CPU revision is: 0002a080 (Broadcom BMIPS4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Brought up 2 CPUs
NET: Registered protocol family 16
Flash not used for Auxillary File System
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0xa0f00000-0xa0ffffff]
pci_bus 0000:00: root bus resource [io 0xa2000000-0xa200ffff]
pci 0000:00:00.0: [14e4:435f] type 00 class 0x028000
pci 0000:00:00.0: reg 10: [mem 0x10004000-0x10005fff]
pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310
pci 0000:00:09.0: reg 10: [mem 0x10002600-0x100026ff]
pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320
pci 0000:00:0a.0: reg 10: [mem 0x10002500-0x100025ff]
PCI host bridge to bus 0000:01
pci_bus 0000:01: root bus resource [mem 0x11000000-0x11efffff]
pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
pci 0000:01:00.0: [14e4:6326] type 01 class 0x060400
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:02:00.0: [14e4:4360] type 00 class 0x028000
pci 0000:02:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit]
pci 0000:02:00.0: supports D1 D2
pci 0000:01:00.0: BAR 8: assigned [mem 0x11000000-0x110fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0x11000000-0x11007fff 64bit]
pci 0000:01:00.0: PCI bridge to [bus 02-02]
pci 0000:01:00.0: bridge window [mem 0x11000000-0x110fffff]
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated
bcmleg_spi bcmleg_spi.0: master is unqueued, this is deprecated
skbFreeTask created successfully
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Jun 12 2016 14:45:16 initialized
Broadcom GBPM v0.1 Jun 12 2016 14:45:16 initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
PCI: CLS mismatch (64 != 16), using 16 bytes
bcm_tstamp initialized, (hpt_freq=200000000 2us_div=200 2ns_mult=5 2ns_shift=0)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
exFAT: Version 1.2.9
fuse init (API version 7.18)
msgmni has been set to 239
io scheduler noop registered (default)
bcm963xx_mtd driver
Registered device mtd:rootfs dev0 Address=0xb81d1370 Size=11198464
PPP generic driver version 2.4.2
NET: Registered protocol family 24
brcmboard: brcm_board_init entry
WIFI: Button Interrupt 0x3 is enabled
RESET: Button Interrupt 0x0 is enabled
SES: Button Interrupt 0x1 is enabled
SES: LED GPIO 0x8016 is enabled
Register flash device: flash0
Serial: BCM63XX driver $Revision: 3.00 $
Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported
ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX
Total # RxBds=1448
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized
bcmPktDma_init: Broadcom Packet DMA Library initialized
pppox_fastpath_init!
GACT probability NOT on
Mirror/redirect action on
u32 classifier
input device check on
Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1916 buckets, 10240 max)
gre: GRE over IPv4 demultiplexor driver
ip_gre: GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
ebt_ftos registered
ebt_wmm_mark registered
8021q: 802.1Q VLAN Support v1.8
SQUASHFS error: Xattrs in filesystem, these will be ignored
SQUASHFS error: unable to read xattr id index table
VFS: Mounted root (squashfs filesystem) readonly on device 31:0.
Freeing unused kernel memory: 212k freed
starting pid 213, tty '': '/etc/init.d/rcS'
L2TP core: blog_l2tp_rcv_check
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
pppol2tp_fastpath_init!
chipinfo: module license 'proprietary' taints kernel.
Disabling lock debugging due to kernel taint
brcmchipinfo: brcm_chipinfo_init entry
bcmxtmrt: Broadcom BCM3167D0 ATM/PTM Network Device v0.6 Jun 12 2016 14:50:51
Broadcom Ingress QoS Module Char Driver v0.1 Jun 12 2016 14:48:00 Registered<24
Broadcom Ingress QoS ver 0.1 initialized
BPM: tot_mem_size=134217728B (128MB), buf_mem_size <15%> =20132655B (19MB), num
Broadcom BPM Module Char Driver v0.1 Jun 12 2016 14:47:52 Registered<244>
NBUFF v1.0 Initialized
Initialized fcache state
Broadcom Packet Flow Cache Char Driver v2.2 Jun 12 2016 14:48:00 Registered<242
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
[FHW] pktDbgLvl[0xc00af290]=0
[FHW] fhw_construct:
Initialized Fcache HW accelerator layer state
flwStatsThread created
Constructed Broadcom Packet Flow Cache v2.2 Jun 12 2016 14:48:00
chipId 0x631670D0
Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jun 12 2016 14:47:52
Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
FAP Debug values at 0xa5da2330 0xa5e22330
fapGso_LoopBkThread created successfully
Allocated FAP0 SWQ_HOST2FAP_GSO_LOOPBACK_Q mem=a79c0000 : 16384 bytes
Allocated FAP0 SWQ_FAP2HOST_GSO_LOOPBACK_Q mem=a7970000 : 16384 bytes
GSO LOOPBACK Cached HOST2FAP Q INFO:
Swq =b0825e50 qStart=a79c0000 qEnd=a79c4000 msgSize=4 dqm=18 fapId=0
GSO LOOPBACK Cached FAP2HOST Q INFO:
Swq =b0825e20 qStart=a7970000 qEnd=a7974000 msgSize=2 dqm=19 fapId=0
Allocated FAP0 SWQ_FAP2HOST_WFD_Q mem=a7b7e000 : 7200 bytes
Allocated FAP1 SWQ_FAP2HOST_WFD_Q mem=a7b3a000 : 7200 bytes
Allocated FAP0 SWQ_FAP2HOST_WFD_Q mem=a6342000 : 7200 bytes
Allocated FAP1 SWQ_FAP2HOST_WFD_Q mem=a6346000 : 7200 bytes
Allocated FAP0 TM SDRAM Queue Storage (a5dafbc0) : 390144 bytes @ a5e80000
Allocated FAP1 TM SDRAM Queue Storage (a5e2fbc0) : 390144 bytes @ a5f00000
[NTC fapProto] fapReset : Reset FAP Protocol layer
Broadcom Packet Flow Cache HW acceleration enabled.
[FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><4576>, free <2080>
[FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><4576>, free <2080>
[FAP0] PSM : addr<0x80002000>, used <24304>, free <272>, total <24576>
[FAP1] PSM : addr<0x80002000>, used <24304>, free <272>, total <24576>
[FAP0] DQM : availableMemory 14668 bytes, nextByteAddress 0xE00048B0
[FAP1] DQM : availableMemory 14668 bytes, nextByteAddress 0xE00048B0
[FAP0] Initializing FAP4KE GSO LOOPBACK on fapIdx=0 ...
[FAP1] IC Timer started
[FAP0] SWQ: HOST2FAP_GSO_LOOPBACK
[FAP1] FAP4KE WFD Init Done...
[FAP0] >>>>------------------
[FAP1] FAP BPM Initialized.
[FAP0] swq =80007e50 msgSize =4 words , maxDepth=1024
[FAP0] qStart =a79c0000 qEnd=a79c4000
[FAP0] rdPtr =a79c0000 wrPtr=a79c0000 count=0
[FAP0] swq->interrupts 0 processed =0 dropped =0
[FAP0] Associated DQM=18 dir HOST2FAP
[FAP0] ------------------<<<<
[FAP0] SWQ: FAP2HOST_GSO_LOOPBACK
[FAP0] >>>>------------------
[FAP0] swq =80007e20 msgSize =2 words , maxDepth=2048
[FAP0] qStart =a7970000 qEnd=a7974000
[FAP0] rdPtr =a7970000 wrPtr=a7970000 count=0
[FAP0] swq->interrupts 0 processed =0 dropped =0
[FAP0] Associated DQM=19 dir FAP2HOST
[FAP0] ------------------<<<<
[FAP0] FAP4KE GSO LOOPBACK Init Done...
[FAP0] IC Timer started
[FAP0] FAP4KE WFD Init Done...
[FAP0] FAP BPM Initialized.
fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes
fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes
bcmPktDma_bind: FAP Driver binding successfull
[FAP0] FAP TM: ON
[FAP1] FAP TM: ON
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
Broadcom BCM63167D0 Ethernet Network Device v0.1 Jun 12 2016 14:50:42
Broadcom GMAC Char Driver v0.1 Jun 12 2016 14:50:50 Registered<249>
Broadcom GMAC Driver v0.1 Jun 12 2016 14:50:50 Initialized
fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000
ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650
fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000
ETH Init: Ch:1 - 200 tx BDs at 0xb0820650
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184
ETH Init: Ch:0 - 600 rx BDs at 0xb0821910
[FAP0] enetRxChannel 0
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184
ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910
[FAP1] enetRxChannel 1
eth0.2: <Int sw port: 0> <Logical : 00> PHY_ID <0x00000001 : 0x01> MAC : 50:C7:B
eth0.3: <Int sw port: 1> <Logical : 01> PHY_ID <0x00000002 : 0x02> MAC : 50:C7:B
eth0.4: <Int sw port: 2> <Logical : 02> PHY_ID <0x00000003 : 0x03> MAC : 50:C7:B
eth0.5: <Int sw port: 3> <Logical : 03> PHY_ID <0x00000004 : 0x04> MAC : 50:C7:B
Ethernet Auto Power Down and Sleep: Enabled
Chip WAN Only Port 00000000, Defined WAN Only Port 00000000, WAN Only Port Res
Chip WAN Preffered Port 00000000, Defined WAN Preffered Port 00000000, WAN Pre
Chip LAN Only Port 00000000, Defined LAN Only Port 00000000, LAN Only Port Res
[NTC arl] arlEnable : Enabled ARL binding to FAP
Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Jun 12 2016 1
Broadcom 802.1Q VLAN Interface, v0.1
Wifi Forwarding Driver is initialized!
Initializing WLCSM Module
WLCSM Module loaded successfully
--SMP support
wl: dsl_tx_pkt_flush_len=338
wl: norm_wmark_tot=3552, pktc_wmark_tot=3552
wl 0000:00:00.0: setting latency timer to 64
wl: passivemode=1
wl0: creating kthread wl0-kthrd
wl: napimode=0
Neither SPROM nor OTP has valid image
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl: ID=sb/0/
wl: ID=sb/0/
wl: loading /etc/wlan/bcm6362_map.bin
wl: updating srom from flash...
wl: updating srom from flash...
srom rev:8
wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=208
wl0: allocskbmode=1 currallocskbsz=1024
wfd_bind: Dev wl%d wfd_idx 0 Type skb configured WFD thread wfd0-thrd RxQId (20
Instantiating WFD 0 thread
+++++ Added gso loopback support for dev=wl0 <87b32000>
wl0: Broadcom BCM435f 802.11 Wireless Controller 7.14.89.3303.cpe4.16L03.0u1-kdb
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)
wl: passivemode=1
wl1: creating kthread wl1-kthrd
wl: napimode=0
initvars_cis_pci: Not CIS format
sprom_read_pci: buf[0] = 0xffff, returning bad-crc
sprom_read_pci: buf[0] = 0xffff, returning bad-crc
sprom_read_pci: buf[0] = 0xffff, returning bad-crc
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl: ID=pci/2/0/
wl: ID=pci/2/0/
wl: loading /etc/wlan/bcm4352_map.bin
wl: updating srom from flash...
wl: updating srom from flash...
srom rev:11
wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=208
wl: reading /etc/wlan/bcm4352_nvramvars.bin, file size=320
wl1: allocskbmode=1 currallocskbsz=2048
wfd_bind: Dev wl%d wfd_idx 1 Type skb configured WFD thread wfd1-thrd RxQId (21
Instantiating WFD 1 thread
+++++ Added gso loopback support for dev=wl1 <87b32800>
wl1: Broadcom BCM4360 802.11 Wireless Controller 7.14.89.3303.cpe4.16L03.0u1-kdb
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
ehci_hcd 0000:00:0a.0: setting latency timer to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ohci_hcd 0000:00:09.0: setting latency timer to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
hub 1-0:1.0: over-current condition on port 2
dns_init
PPP MPPE Compression module registered
PPTP driver version 0.8.5
pptp fastpath module init ...
Please press Enter to activate this console. [ dm_readFile ] 2061: can not open
[ initKernelMonitmonitor task is initialized pid= 460
orFd ] 441: kernelMonitorFd=7
[ initKernelMonitorFd ] 459: registered fd 7 with kernel monitor
Note: Loading 6300 MDK (default) driver for 63167 chip
Switch MDK: num_switches = 1
Switch MDK: unit = 0; phy_pbmp = 0xf; config_pbmp = 0xf
Switch MDK link poll thread: unit=0; phypbmp=0xf config_pbmp=0xf
Energy Efficient Ethernet: Enabled
[ oal_eth_setPauseEnable ] 1014: ZYH: value: 00821f0f
ioctl: No such device
ADDRCONF(NETDEV_UP): eth0.2: link is not ready
device eth0.2 entered promiscuous mode
Success
ADDRCONF(NETDEV_UP): eth0.3: link is not ready
device eth0.3 entered promiscuous mode
Success
ADDRCONF(NETDEV_UP): eth0.4: link is not ready
device eth0.4 entered promiscuous mode
Success
[ rsl_wan_wanMacConnToolInit ] 1039: finish rsl_wan_wanMacConnToolInit
open DNS error: No such file or directory
[ oal_sys_getOldTZInfo ] 535: Open TZ file error!
Setting SSID: "TP-LINK_41EA"
Chanspec set to 0x1806
wlctl: Unsupported
wlctl: Bad Argument
cat: can't open '/proc/tplink/is_factory_reset': No such file or directory
wlctl: Not up
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: selected channel spec: 0x1004
acsd: Adjusted channel spec: 0x1004
acsd: selected DFS-exit channel spec: 0x1004
acsd: selected channel spec: 0x1004
acsd: Adjusted channel spec: 0x1004
acsd: selected channel spec: 0x1004
device wl0 entered promiscuous mode
br0: port 4(wl0) entered forwarding state
br0: port 4(wl0) entered forwarding state
brctl: iface wl0.1: No such device
brctl: iface wl0.3: No such device
brctl: iface wl0.4: No such device
brctl: iface wl0.2: No such device
Setting SSID: "TP-LINK_41EA_5G"
Chanspec set to 0xe02a
wlctl: Bad Argument
cat: can't open '/proc/tplink/is_factory_reset': No such file or directory
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: selected channel spec: 0x1004
acsd: Adjusted channel spec: 0x1004
acsd: selected DFS-exit channel spec: 0x1004
acsd: selected channel spec: 0x1004
acsd: Adjusted channel spec: 0x1004
acsd: selected channel spec: 0x1004
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: selected channel spec: 0xe02a
acsd: Adjusted channel spec: 0xe02a
acsd: selected DFS-exit channel spec: 0xe02a
acsd: selected channel spec: 0xe02a
acsd: Adjusted channel spec: 0xe02a
acsd: selected channel spec: 0xe02a
device wl1 entered promiscuous mode
br0: port 5(wl1) entered forwarding state
br0: port 5(wl1) entered forwarding state
brctl: iface wl1.1: No such device
brctl: iface wl1.3: No such device
brctl: iface wl1.4: No such device
brctl: iface wl1.2: No such device
sendto /var/tmp/8 msg 2030 error No such file or directory ,pid 355
sendto /var/tmp/9 msg 2004 error No such file or directory ,pid 355
iptables: Bad rule (does a matching rule exist in that chain?).
radvd starting
ADDRCONF(NETDEV_UP): eth0.5: link is not ready
brctl: bridge br0: Invalid argument
ADDRCONF(NETDEV_UP): eth0.5: link is not ready
[ getPidFromPidFile ] 112: Cann't open file: /var/run/zebra.pid.
[ getPidFromPidFile ] 112: Cann't open file: /var/run/ripd.pid.
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
rmmod: can't unload 'nf_nat_rtsp': unknown symbol in module, or unknown paramete
rmmod: can't unload 'nf_conntrack_rtsp': unknown symbol in module, or unknown pa
[ rsl_setLanWlanAccelation ] 9306: Set fcache enable.
ip6tables: Bad rule (does a matching rule exist in that chain?).
rsl_setStorageServiceObj(): before 0 usb devices and 0 logical volumes are alive
rsl_setStorageServiceObj(): 0 usb devices and 0 logical volumes are alive
mountflag : 3
[ rsl_setStorageServiceObj ] 1644: mountFlag is 3,We start usb server
killall: minidlnad: no process killed
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
ip6tables: Bad rule (does a matching rule exist in that chain?).
kcg 333 :GPL NetUSB up!
kc 90 : run_telnetDBGDServer start
kc 227 : init_DebugD end
INFO182B: NetUSB 1.02.80, 0003040B : Mar 10 2016 10:38:03
INFO182D: 7437: Archer VR400 :Archer VR400
INFO182E: AUTH ISOC
INFO182F: filterAudio
usbcore: registered new interface driver KC NetUSB General Driver
INFO188C: Reset device when disconnect
INFO01ED: init proc : PAGE_SIZE 4096
INFO171F: infomap c14a01a4
INFO1722: sleep to wait br0 to wake up
INFO15D9: tcpConnector() started... : br0
INFO1589: Bind to br0
Will output 1024 bit rsa secret key to '/var/tmp/dropbear/dropbear_rsa_host_key'
Generating key, this may take a while...
Public key portion is:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgwCDBE7JkDNy+A1iqEa7XALOs73PFJ26WIVyAlwI78PH 7ySvHGn5b5WYfrEeGblj90WgG26SQ5ybxyJTPHarEYfaYbHJJLUV8V7u+IDgDcTcHxBWL2xELIlpnPv8 bvok2raZx5LGHYv5XYc8j6gBUsAZVTS8vXjQgAnswdJXKdhhXsIN admin@Archer VR400
Fingerprint: md5 c1:fd:d1:62:72:0f:de:f0:a0:d9:1a:87:c0:31:24:1c
Will output 1024 bit dss secret key to '/var/tmp/dropbear/dropbear_dss_host_key'
Generating key, this may take a while...
Public key portion is:
ssh-dss AAAAB3NzaC1kc3MAAACBALI7p6QSLvtTLRNcUKkCXVJauhyKuluMWktE2SIcLtl43VrWnitp mEx3IXgsXR2jAI5VaroOyF6T8eAsrlp0HluYmAC/md0qscq4uV1ijjFDBOaGMxJt1RMc3EceCABiCWRl pFNyjpaFD7hNpluMlTevmgEeJaI1hczAlW9h4DN7AAAAFQDSJegSCorwyUAJBftclV2Z7EEV4QAAAIBM 7ef8IFvmvN7xKbi9ngH1remzMy8QMEmpDxqerNGJNtKrE6iZUPvCDLT9VWfr3hw3efa+meCli9UbPIB4 CFXgOS7nGIeq6G93rW2M91Rkk4QZoZRopnEfCKefz6e0fTOpSyuiA2ggIZ3Y86hUgWuwEyvGFMyu1tFq vsg1/3e/ogAAAIAZ8F+L/xsnAwb4MstSprUGq4xFIemckGSzzNy7lDARgM3+3NkiTe29Iya9/SFfPz0F xSCCu4XR8FJz/Pt2MXHIDyoGY1T/XytZ+xUDeEk72wDJVOfZ4B8ktkHH8s1OnRMQuwIHt5aS5zufXuXM 2SOu39pvo6Xa1fLQcNixkrR7qw== admin@Archer VR400
Fingerprint: md5 e3:f2:c4:9b:b4:a7:39:3c:20:c0:ff:ec:dc:2c:14:89
open DNS error: No such file or directory
Broadcom is usually a dead end.
Maybe, but this router lying around unused, so wanna bring up it. Even unstable 2.4 wifi would be fine for my usage
Hi @Sid_key, thanks for the effort. The router should be supportable. With an SPI NOR flash it should be easier than other bcm63268 routers.
About support, the xDSL won't be supported. The wifi will ve very limited, with the embedded radio not supported, and not sure if the BCM4352KMLG would work.
We would need to guess the switch configuration for this basic support, among other minor things like GPIOs used by leds or buttons.
Are you able to stop the bootloader in rescue mode and then enter to the firmware upload web page provided by CFE? this is where we could flash an OpenWrt firmware.
Yes i can stop. I cannot install any image by webui, but was able to flash by command f ip-address something. Don't remember, since last time i tried was summer. Also i was able to flash whole image from easy option from sky router, new cfe able to boot, but openwrt didn't boot, nothing was happening after trying to boot openwrt kernel. Would recheck everything again today.
@Sid_key can you test this RAM image
vr400-v1-initramfs-0.elf
Load it via TFTP using a command like this in CFE:
r 192.168.1.7:vr400-v1-initramfs-0.elf
Router/uart freezes after it, tftpd64 doesn't show that router even tried to load it
Maybe the run image command is disabled in this CFE.
Another option is to flash the Openwrt firmware image for testing:
openwrt-vr400-v1-squashfs-cfe-0.bin
This image should be flashed via CFE webui, or with the f command.
Flashing by webui:
shows on page
"Image uploading failed. The selected file contains an illegal image."
shows in putty
"web info: Upload 5111812 bytes.
Image md5 checksum is not correct, len is 0x4e0004!"
By f command u mean "f 192.168.1.101:openwrt-vr400-v1-squashfs-cfe-0.bin image force"?
Yes, but not sure about "image force" options. In other CFEs I just used:
f 192.168.1.101:openwrt-vr400-v1-squashfs-cfe-0.bin
my command ripped cfe. I'll restore dump and would tell you about progress bit later
CFE> f 192.168.1.101:openwrt-vr400-v1-squashfs-cfe-0.bin
Loading 192.168.1.101:openwrt-vr400-v1-squashfs-cfe-0.bin ...
Finished loading 5111812 bytes
Error kernel, product id mismatch
*** command status = -1
CFE> help f
SUMMARY
Write image to the flash
USAGE
eg. f [[hostip:]filename] [type] [force] -- type: boot|kernel|rootfs|image,default is kernel; force -- donot check image
*** command status = 0
Maybe f 192.168.1.101:openwrt-vr400-v1-squashfs-cfe-0.bin kernel force?
Looks like your device uses a CFE customized by TP-link.
Can you send me the original flash dump?
Sent in pm
It seems Tplink uses a different firmware format, at least for the header. This header is somehow hardcoded from the file reduced_data_model.xml found in the TPLINK GPL:
<?xml version="1.0" encoding="UTF-8"?>
<InternetGatewayDevice t=o r=P s=IGD_OBJ >
<DeviceInfo t=o r=P s=IGD_DEV_INFO_OBJ >
<Manufacturer t=s r=R l=64 d=TP-LINK />
<ModelName t=s r=R l=64 d="Archer VR400" />
<Description t=s r=R l=256 d="AC1200 Wireless Gigabit VDSL/ADSL Modem Router" />
<ProductClass t=s r=R l=64 d=VR400 />
<AdditionalHardwareVersion t=s r=R l=64 d=00000000 />
<X_TP_HardwareID t=s r=R l=33 al=nae d=41577AABFA3DE2A16A5417A2E38D3D76 nw=1 h=1 />
<X_TP_FirmwareID t=s r=R l=33 al=nae d=00000000000000000000000000000000 nw=1 h=1 />
<X_TP_OemID t=s r=R l=33 al=nae d=DFE698D3575D46ACE04286292E9E9B62 nw=1 h=1 />
<X_TP_DevManufacturerURL t=s r=R l=64 d=http://www.tp-link.com nw=1 h=1 />
<X_TP_DevModelVersion t=s r=R d=1.0 nw=1 h=1 />
<X_TP_ProductID t=u r=R d=0x491dfa01 nw=1 h=1 />
<X_TP_ProductVersion t=u r=R d=0x00000070 nw=1 h=1 />
<X_TP_SoftwareRevision t=u r=R d=0x55aa0001 nw=1 h=1 />
<X_TP_SpecialVersion t=u r=R d=0x00000000 nw=1 h=1 />
<X_TP_SoftwareRevisionMinor t=u r=R d=0x00 nw=1 h=1 />
<X_TP_BuildDate t=s r=W l=8 d=110929 nw=1 h=1 />
<X_TP_BuildTime t=u r=W d=57600 nw=1 h=1 />
</DeviceInfo>
<WANDevice.{i}>
<WANDSLInterfaceConfig>
<X_TP_AnnexType d="Annex A/L" />
<X_TP_SupportAdslMode d="VDSL2:A;T1.413:A;G.lite:A;G.dmt:A;ADSL2:A,A/L;ADSL2+:A,M,A/L/M;ADSL Auto Sync-up:A/L/M;Auto Sync-up:A,A/L,M,A/L/M" />
</WANDSLInterfaceConfig>
</WANDevice.{i}>
</InternetGatewayDevice>
There is also a tool inside this GPL to generate the image with a command like this:
./mkimage -E 0 -m 0x1c0000 -t 3 -p reduced_data_model.xml -b cfe63268.bin -k linux.7z -f rootfs.vr400 -v vmlinux -i /dir/image/
Help from this tool:
GPL_VR400V1/host_tools/mkimage --help
YangXv <yangxu@tp-link.com.cn> modified from trx for make image
Usage: mkimage [OPTIONS]
-m, --maxkernelsize=SIZE MAX Kernel size
-s, --flashsize=SIZE Flash size
-E, --Endian=endian Target CPU endian(0 for BE,1 for LE, default 0)
-b, --boot=FILE Boot file
-k, --kernel=FILE Kernel file
-f, --fs=FILE Filesystem file
-D, --DECT=FILE DECT image file
-M, --MFG=FILE Manufacturing config file
-o, --output=FILE Output Filename prefix
-i, --imagePath=PATH image path
-p, --xmlName=FILE reduced_data_model file
-d, --dualImage Have Dual Image(Only for 16M flash,8M up bin)
-t, --mtdType=type MTD part type
-T, --filesystem=type file system type
-C, --cloud=step support CLOUD step(1 for step1,2 for step2, default 1)
-U, --upgrade Force DUT upgrade boot
-O, --order=bits Order of the finite field for BCH encoding(only 13,14-BCM63138 MUST select 14, default 13)
-e, --ECC=bits ECC selection(only 0,1,4,8, default 0)
-z, --oobSize=size OOB size(only 16 or 27, default 16)
-h, --help Display this message
We may be able to generate an OpenWrt image using this tool. Not sure if there is an Openwrt tool for other targets that could make the same.
Maybe easier to use cfe from other devices or generic one?
Not sure. There aren't out there many known BCM63167 devices with an SPI NOR flash. A CFE for a similar SOC like BCM63268 may work or not. You can test the one from the already supported SR102:
BTW I already found and added to the wiki the info about the TP-link header firmware:
Therefore the imagetag utility from Openwrt could be adapted to generate a compatible firmware, introducing the TP-link offsets
https://git.openwrt.org/?p=project/firmware-utils.git;a=blob;f=src/bcm_tag.h
The Openwrt kernel would also need some modifications to let the bcm63xx image parser use these new offsets.