OpenWrt support for Actiontec T3200M

For Developers
1

Also posted on reddit: https://www.reddit.com/r/openwrt/comments/11t8ljj/findings_on_the_actiontec_rebranded_telus_t3200m/

So I was digging around today, and I found some interesting stuff regarding a modem I have lying around from my telus days - the "Telus" T3200M. I believe it is still in use today (by telus, at least in my area), and it's relatively cheap to find second hand. I'm interested in getting OpenWRT running on it.

A quick look will tell you it's just an actiontec router of the same model, rebranded for telus to rent to their customers.

It's a decent little thing; 2.4 and 5ghz, 1 WAN 4 LAN RJ45 jacks, an SFP port for fibre optic, and a Coax port for MoCA. That, and it has a daughter board for DSL - home phone afaik.

But onto my findings. I found a page from actiontec with the source code they used to compile their firmware, which contained some interesting nuggets.

For one, it's the full source code. Second, it gave me a little insight on what SoC it's using. It appears to be a Broadcom BCM63138/63148, according to make menuconfig in one of the directories.

Speaking of which, the source code tree seems to be very similar to OpenWRT - the README says that in order to compile the firmware, you should run make PROFILE="<profile_name>". Exactly the same as OpenWRT image builder.

I wasn't able to find much more than that, as I'm not super familiar with inspecting source code. The only interesting thing was that it was running linux kernel 3.4 - as was indicated by the kernel/linux-3.4rt/.

This gives me hope that it could in fact be hackable.

This was where I found the mention to the Broadcom BCM63138/63148 - by cding to the kernel/linux-3.4rt/ directory and running make menuconfig (this is on my [Fedora] machine which has the prerequisites for building OpenWRT installed).

As one last thing, I've also found pictures of the internals - courtesy of FCC. I wasn't able to tell if it had a UART port, the photos were quite blurry.

As I said in the beginning, I'm curious if I can get OpenWRT installed. I have one of the routers on hand, and I have no other use for it- I'm happy to donate it or try flashing firmware here if need be.

Links and Info

FCC info page
https://fccid.io/LNQT3200M
Internal photos
https://fccid.io/LNQT3200M/Internal-Photos/Internal-Photos-3002334
Source code

Actiontec product information page

SoC Chipset info

Source code tree -L 5 at_bcm963xx_t3200m_31.164l.22_gpl_consumer_release

2

Unfortunately, Broadcom generally means no OpenWrt support

3

You might find that the T3200M has just taken the OpenWRT source at some time, and then hacked in the required SoC support (likely with Broadcom help, perhaps the Broadcom Hardware Development Kit included it).
Where your problem is likely to come up is with the additional controllers that make the chip useful, like the wifi, or the ethernet, or the cable connection... things that are a bit more specialised, and hence might not leverage the general purpose CPU core, and hence can be independent of the OpenWRT code.
These will often have proprietary firmware that is closed source, and doesn't need to be disclosed.

In fact if you look in the source dump, you'll see a couple of directories that lead this way.
The bcmdrivers in the root, then there's a bunch of header files that will get compiled with the kernel. These form part of the GPL requirements, so they're in the opensource folder.
But... the 'broadcom' folder is full of blobs, things like wl963138BGW.o_save which is an almost 5MB dump of binary stuff.
The header files will probably call into this library in some fashion to do some magic stuff. But the actual source code that is being executed within this library will not be visible... It might rely on a certain version of the linux kernel, and even certain fixed memory locations for things.

It would be a monumental effort to reverse engineer these blobs to make them 'open source'.
Getting them to work with a newer version of the kernel, or with any build configuration changes (sometimes even a different compiler release will break interaction with them), would likely be too difficult.