flashed openwrt by command and it booted:
Base: 4.16_02A
CFE version 1.0.38-116.140 for BCM963268 (32bit,SP,BE)
Build Date: Wed Oct 15 09:22:13 PDT 2014 (jpeshkin@bcacpe-sqa)
Copyright (C) 2000-2013 Broadcom Corporation.
Chip ID: BCM63167D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000
HS Serial flash device: ID_W25X128, id 0xef18 sector 4KB size 16384KB
Flash not used for Auxillary File System
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host/tftp (f/h/c) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Default host ramdisk file name :
Default ramdisk store address :
Board Id (0-29) : 963168XFG3
Number of MAC Addresses (1-32) : 11
Base MAC Address : e0:05:c5:04:00:01
PSI Size (1-64) KBytes : 48
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
Main Thread Number [0|1] : 0
WLan Feature : 0x00
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Booting from only image (0xb8010000) ...
Code Address: 0x80A00000, Entry Address: 0x80a00000
Decompression OK!
Entry at 0x80a00000
Starting program at 0x80a00000
[ 0.000000] Linux version 5.10.147 (dani@tool) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r20947-63e5ba8e69) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 SMP Fri Oct 14 18:51:35 2022
[ 0.000000] Detected Broadcom 0x63268 CPU revision d0
[ 0.000000] CPU frequency is 400 MHz
[ 0.000000] 128MB of RAM installed
[ 0.000000] board_bcm963xx: Boot address 0xb8000000
[ 0.000000] board_bcm963xx: CFE version: 1.0.38-116.140
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0002a080 (Broadcom BMIPS4350)
[ 0.000000] board: board name: 963167TP
[ 0.000000] MIPS: machine is TP-Link Archer VR400 v1
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] percpu: Embedded 14 pages/cpu s27472 r8192 d21680 u57344
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] Kernel command line: rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 119740K/131072K available (6443K kernel code, 633K rwdata, 1316K rodata, 1328K init, 211K bss, 11332K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] NR_IRQS: 256
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns
[ 0.000015] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns
[ 0.008272] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656)
[ 0.074689] pid_max: default: 32768 minimum: 301
[ 0.079795] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.087316] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.101012] rcu: Hierarchical SRCU implementation.
[ 0.106761] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[ 0.115314] smp: Bringing up secondary CPUs ...
[ 0.121862] SMP: Booting CPU1...
[ 10.623772] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[ 10.623791] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 10.624069] CPU1 revision is: 0002a080 (Broadcom BMIPS4350)
[ 0.190170] Synchronize counters for CPU 1:
[ 0.210835] SMP: CPU1 is running
[ 0.210842] done.
[ 0.220750] smp: Brought up 1 node, 2 CPUs
[ 0.235978] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.246154] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[ 0.253355] pinctrl core: initialized pinctrl subsystem
[ 0.261094] NET: Registered protocol family 16
[ 0.515823] registering PCI controller with io_map_base unset
[ 0.605922] PCI host bridge to bus 0000:00
[ 0.610104] pci_bus 0000:00: root bus resource [mem 0x11000000-0x11efffff]
[ 0.617456] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.624396] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.631410] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.639598] pci 0000:00:00.0: [14e4:6326] type 01 class 0x060400
[ 0.645852] pci 0000:00:00.0: PME# supported from D0 D3hot
[ 0.652706] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.661228] pci 0000:01:00.0: [14e4:4360] type 00 class 0x028000
[ 0.667408] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x00007fff 64bit]
[ 0.674632] pci 0000:01:00.0: supports D1 D2
[ 0.679014] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[ 0.695523] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[ 0.702292] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[ 0.709154] pci 0000:00:00.0: BAR 8: assigned [mem 0x11000000-0x110fffff]
[ 0.716096] pci 0000:01:00.0: BAR 0: assigned [mem 0x11000000-0x11007fff 64bit]
[ 0.723654] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 0.728725] pci 0000:00:00.0: bridge window [mem 0x11000000-0x110fffff]
[ 0.739386] clocksource: Switched to clocksource MIPS
[ 0.748565] NET: Registered protocol family 2
[ 0.753823] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.763664] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[ 0.772536] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.780693] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.788100] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.795480] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.802409] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.810837] NET: Registered protocol family 1
[ 0.815456] PCI: CLS 0 bytes, default 16
[ 0.827003] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 0.845434] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.851463] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.867210] bcm63268-pinctrl 100000c0.pin-controller: registered at mmio (ptrval)
[ 0.875777] pcieport 0000:00:00.0: enabling device (0000 -> 0002)
[ 0.883735] 10000180.serial: ttyS0 at MMIO 0x10000180 (irq = 13, base_baud = 1562500) is a bcm63xx_uart
[ 0.893519] printk: console [ttyS0] enabled
[ 0.893519] printk: console [ttyS0] enabled
[ 0.902114] printk: bootconsole [early0] disabled
[ 0.902114] printk: bootconsole [early0] disabled
[ 0.928191] bcm63xx-spi 10000800.spi: at [mem 0x10000800-0x10000f0b flags 0x200] (irq 88, FIFOs size 542)
[ 0.946086] spi-nor spi1.0: w25q128 (16384 Kbytes)
[ 0.952218] 3 fixed-partitions partitions found on MTD device spi1.0
[ 0.958905] OF: Bad cell count for /ubus@10000000/spi@10001000/flash@0/partitions
[ 0.966808] OF: Bad cell count for /ubus@10000000/spi@10001000/flash@0/partitions
[ 0.974889] Creating 3 MTD partitions on "spi1.0":
[ 0.979852] 0x000000000000-0x000000010000 : "cfe"
[ 0.986048] 0x000000010000-0x000000ff0000 : "linux"
[ 0.994740] parser_imagetag: rootfs: CFE image tag found at 0x0 with version 6, board type 963167TP
[ 1.004150] parser_imagetag: Partition 0 is kernel offset 100 and length 278014
[ 1.011803] parser_imagetag: Partition 1 is rootfs offset 278114 and length d67eec
[ 1.019635] parser_imagetag: Spare partition is offset 4e0004 and length affffc
[ 1.027329] 2 bcm963xx-imagetag partitions found on MTD device linux
[ 1.033840] Creating 2 MTD partitions on "linux":
[ 1.038717] 0x000000000100-0x000000278114 : "kernel"
[ 1.043768] mtd: partition "kernel" doesn't start on an erase/write block boundary -- force read-only
[ 1.054516] 0x000000278114-0x000000fe0000 : "rootfs"
[ 1.059643] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[ 1.070765] mtd: device 3 (rootfs) set to be root filesystem
[ 1.079050] 1 squashfs-split partitions found on MTD device rootfs
[ 1.085415] 0x0000004e0000-0x000000fe0000 : "rootfs_data"
[ 1.092267] 0x000000ff0000-0x000001000000 : "nvram"
[ 1.161375] b53_common: found switch: BCM63xx, rev 0
[ 1.167200] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec
[ 1.174481] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 1.181715] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 1.188902] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 1.196079] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 1.203223] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null))
[ 1.210891] bcma-pci-bridge 0000:01:00.0: enabling device (0000 -> 0002)
[ 1.217898] bcma-pci-bridge 0000:01:00.0: bus0: Found chip with id 0x4352, rev 0x03 and package 0x01
[ 1.227385] bcma-pci-bridge 0000:01:00.0: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x2B, class 0x0)
[ 1.238376] bcma-pci-bridge 0000:01:00.0: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x2A, class 0x0)
[ 1.249466] bcma-pci-bridge 0000:01:00.0: bus0: Core 2 found: ARM CR4 (manuf 0x4BF, id 0x83E, rev 0x02, class 0x0)
[ 1.260185] bcma-pci-bridge 0000:01:00.0: bus0: Core 3 found: PCIe Gen2 (manuf 0x4BF, id 0x83C, rev 0x01, class 0x0)
[ 1.271030] bcma-pci-bridge 0000:01:00.0: bus0: Core 4 found: USB 2.0 Device (manuf 0x4BF, id 0x81A, rev 0x11, class 0x0)
[ 1.314222] bcma-pci-bridge 0000:01:00.0: bus0: Invalid SPROM read from the PCIe card, trying to use fallback SPROM
[ 1.324938] bcma-pci-bridge 0000:01:00.0: bus0: Using fallback SPROM failed (err -2)
[ 1.332908] bcma-pci-bridge 0000:01:00.0: bus0: No SPROM available
[ 1.342408] bcma-pci-bridge 0000:01:00.0: bus0: Bus registered
[ 1.351067] NET: Registered protocol family 10
[ 1.359453] Segment Routing with IPv6
[ 1.363341] NET: Registered protocol family 17
[ 1.368106] 8021q: 802.1Q VLAN Support v1.8
[ 1.404443] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[ 1.425972] Freeing unused kernel memory: 1328K
[ 1.430580] This architecture does not have kernel memory protection.
[ 1.437247] Run /sbin/init as init process
[ 2.380960] init: Console is alive
[ 2.385174] init: - watchdog -
[ 3.404033] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 3.662988] usbcore: registered new interface driver usbfs
[ 3.668972] usbcore: registered new interface driver hub
[ 3.674644] usbcore: registered new device driver usb
[ 3.693971] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 3.704349] ehci-fsl: Freescale EHCI Host controller driver
[ 3.714193] ehci-platform: EHCI generic platform driver
[ 3.845976] ehci-platform ehci-platform: EHCI Host Controller
[ 3.851891] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[ 3.860447] ehci-platform ehci-platform: irq 18, io mem 0xb0002500
[ 3.905951] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00, overcurrent ignored
[ 3.915637] hub 1-0:1.0: USB hub found
[ 3.919749] hub 1-0:1.0: 2 ports detected
[ 3.938440] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 3.947929] ohci-platform: OHCI generic platform driver
[ 3.953443] ohci-platform ohci-platform: Generic Platform OHCI controller
[ 3.960504] ohci-platform ohci-platform: new USB bus registered, assigned bus number 2
[ 3.968907] ohci-platform ohci-platform: irq 17, io mem 0xb0002600
[ 4.041364] hub 2-0:1.0: USB hub found
[ 4.045373] hub 2-0:1.0: 2 ports detected
[ 4.052400] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 4.063395] init: - preinit -
[ 4.387442] random: crng init done
[ 7.424220] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[ 7.431128] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on LAN1, 100Mbps, full-duplex
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 8.456357] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 9.971951] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[ 9.986807] urandom-seed: Seed file not found (/etc/urandom.seed)
[ 10.216522] procd: - early -
[ 10.220011] procd: - watchdog -
[ 10.991280] procd: - watchdog -
[ 11.209018] procd: - ubus -
[ 11.345026] procd: - init -
Please press Enter to activate this console.
[ 12.968689] kmodloader: loading kernel modules from /etc/modules.d/*
[ 13.193774] PPP generic driver version 2.4.2
[ 13.203753] NET: Registered protocol family 24
[ 13.233571] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 13.412063] urngd: v1.0.2 started.
