Help with Inteno XG6846

Welcome, @csom! I had a good mind to go sign up to sweclockers and ask you how you got on. It seems like the best way to go about this is for someone to ask for a newer source drop. I suspect that the broadcom toolchain contains various image finishing tools. Did you manage to find that ( toolchains_bcm963xx_4.06L.02.tgz)?

I found about 75 different ways how not to build an initramfs for this platform via openwrt source. I think I'm close, but the load address is still wrong, and it crashes when I load via tftp (several examples in these forums). I want to have something working before I attempt to flash it, first. Don't want to wear out the flash. Anyway, I've been keeping away from manually finishing the vmlinux file... this particular board may need special touches. But it runs a standard kernel.

Many attempts via tftp look like this (note the wrong code and entry addrs):

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Retry loading it as a compressed image.
Loading ...
Finished loading 5264506 bytes
Code Address: 0x6D000080, Entry Address: 0x00574a3d
LZMA: Prossible old LZMA format, trying to decompress..
Decompression OK!
Entry at 0x00574a3d
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x00574a3d
**Exception 8: EPC=C0A80100, Cause=80E4ABDA (Exc22    )

This was done using master, kernel version 5.10. Not tried the source only 5.15 yet. The bmips platform looks a lot more organized and complete. See differences

@NPeca75 couple of questions:

  1. did you ever tftp boot with a vmlinux image?
  2. if so, how did you build it?
  3. or did you just go kamikaze and flash a built image directly via the bootloader?

Hi @systemcrash

as you could see at start of this tread, it was successful boot via initramfs with , hmmm, 19.07 or 08 ??
yes, it was bmips target
sorry, but my device is dead, storm is killed ethernet ports, so i have no further way of experimenting

i know that was a mess with switch, it always show as 100mbps, suppose it was internal switch what i saw and not the external

anyway, gpio's are found, most of them, so .. good luck
and sorry i could not help any further

1 Like

hi @mrhaav

no, actually no
i booted ubuntu 14 in VM to try to compile, but no luck
and, believe me, INTENO was very very slow with responses about GPL
3 or 4 month to get this tarball, so i give up

I compiled with latest master and boot via initramfs, as @NPeca75.
But, still the Marvell switch is not visible, only the internal switch. But that is not used. The internal switch has just 100M interfaces.

My theory is that the CPU is connected with the MII interface to the Marvell switch and control via MDIO. But, I don´t know how to define the MDIO. I can´t find it in the bcm6328.dtsi.

How did you get a tftp bootable initramfs? Everything my environment produces just crashes at tftp load.

What does your target/linux/bcm63xx/image/ section look like? or did you go with bmips?

The GPL source mentions in the Makefile that the switch is:

#Switch Type: MV88E6352 depend on XAVI_SWITCH_DRIVER.

It seems like there is source for this switch chip. Something like this, @mrhaav ?

I load the .elf file with CFE> r The file should not be bigger than ~4M.


define Device/inteno_xg6846
  IMAGES := cfe-4M.bin cfe-8M.bin
  CFE_BOARD_ID := 96328avng
  CHIP_ID := 6328
  DEVICE_PACKAGES := $(USB2_PACKAGES) kmod-gpio-button-hotplug kmod-sfp kmod-i2c-gpio ethtool
TARGET_DEVICES += inteno_xg6846

Interesting, but what is cpu-port-0 and cpu-port-1?

	mvsw61xx {
		#address-cells = <1>;
		#size-cells = <0>;
		compatible = "marvell,88e6352";
		status = "okay";
		reg = <0x10>;

		mii-bus = <&mdio>;
		cpu-port-0 = <5>;
		cpu-port-1 = <6>;

OK - custom config? I just went with most defaults except to make a ramfs img.

Basically the same as mine. Can't get anything lzma compressed to get past Starting program at ..., or the elf loaders just seem to hang with e.g. 0x80a00000/4519626 - but is this because the kernels are bigger than 4MB?

Not sure - checking out lede 17 and grepping the DTS for those might shed some more light. Could just try commenting out and see what happens.

Is your device type the -R1? The sticker on the bottom should say XG6846-R1 or so.

Yes, the one I´m playing with is a XG6846-R1, but I have one XG6846 as well.
But, I dont know that the difference are, except the USB. The XG6846 has an USB connector.

Anything interesting in these from the source drop?


Hi @NPeca75,

I've successfully compiled the source on a Ubuntu 14 VM. I extracted the gz-file and in that folder I also put the toolchain uclibc-crosstools-gcc-4.4.2-1 so the ./consumer_install script install the toolchain in the right place. After that I used Apt to install build-essential bison flex lib32z1 lib32ncurses5 lib32stdc++6. Then to achieve a successful build the file userspace/private/apps/httpd/Makefile needs to be edited on line 9 and remove the html/*.gif-part since there are no .gif files in the http-directory.

@systemcrash I did not manage to find that file, sorry.

/B.R. csoM

1 Like

So you run these successful builds? ( If so then the toolchain is unnecessary )

The only toolchain I use besides the prerequirements I mentioned is uclibc-crosstools-gcc-4.4.2-1 tar-file. I first tried Ubuntu 16.04 with minor problems and decided to try Fedora 16 since the readme sugests that and succeeded, I also tried Ubuntu 14.04 with a successful build.

The only thing that was a problem after that was the in /sbin. This script monitors the TR069 client, so it’s not a big issue. But to get a 100% complete firmware I extracted this file from another already compiled firmware from my ISP, and then used that in my source-dir.

B.R, csoM

I see, so you don't run the compiled firmware.

We just wait until other formal requests for newer firmware sources turn up.

I use the compiled firmware on two of my XG6846-R1's. When I switched out the the firmware worked flawlessly and has been online for almost 48 hours without any problems. I even use my own ACS-server to control them over TR069-protocol.


For a newer source I was in contact with who provide's a new software iowrt for these switches. I haven't got a response from them yet. I know that there exists a 01.99 version at least now because I got this answer from a Swedish retail seller who claimed that they used that version on their switches and this was over a year ago.


I guess that's about as close as one gets to a custom firmware with these devices, so far. The source drop contains a few .ko files intended for a single kernel version in the drop.

@mrhaav any progress with the switch?

1 Like

I've modified the consumer_relasese and added some features to busybox including lsmod, modinfo and vimand added iptables as a binary with including kernel modules.
I've also managed to list the modules loaded with lsmod. Maby the output can help with the switch issue?


# lsmod
Module                  Size  Used by
xavi_port_limit         3920  0 
xavi_led_mode           4048  0 
xavi_sfp_fiber          8480  2 xavi_port_limit,xavi_led_mode
igmpsnooping_swis      12016  0 
mvsw                   25344  2 xavi_port_limit,igmpsnooping_swis
bcm_enet              148384  4 xavi_led_mode,xavi_sfp_fiber,igmpsnooping_swis,mvsw
pktflow                51872  0 
bcm_bpm               210848  0 [permanent]
bcm_ingqos             10048  0 
chipinfo                1792  0 

/B.R. csoM

Is it possible to print the GPIO and MDIO configuration?

Hi @mrhaav,

I don't know how to do that. I can't find any folder named /sys/class/gpio.
How would I list the GPIO and MDIO?


Older 2.x kernels maybe didn't have those set up like that.

Does your build have strace? Could figure out gpios that way, perhaps.