Zyxel VMG1312-B10D support?

Hi,

My first post in the forum. :slight_smile:
I am trying to get openwrt working on Zyxel VMG1312-B10D. The chip is broadcom BCM63381UKMMLG (TE1522 P2Q, P27H-19 3B W). Bootloader is CFE. Could someone please let me know if it's possible to get this router installed with openwrt?

Some details that I found after access the router via UART are as follows:

CFE> atbl
Board IP address                  : x.x.x.x:ffffff00  
Host IP address                   : x.x.x.x  
Gateway IP address                :   
Run from flash/host/tftp (f/h/c)  : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 0  
Boot image (0=latest, 1=previous) : 0  
Default host ramdisk file name    :   
Default ramdisk store address     :     
Number of MAC Addresses (1-32)    : 12  
PSI Size (1-128) KBytes           : 64  
Enable Backup PSI [0|1]           : 0  
System Log Size (0-256) KBytes    : 0  
Auxillary File System Size Percent: 0  
Main Thread Number [0|1]          : 0  
WLan Feature                      : 0x00  
Partition 1 Size (MB)             :   
Partition 2 Size (MB)             :   
Partition 3 Size (MB)             :   
Partition 4 Size (MB) (Data)      : 4MB  

*** command status = 0

output of /proc/cpuinfo

system type             : 963381_VMG1312
processor               : 0
cpu model               : Broadcom BMIPS4350 V8.1
BogoMIPS                : 598.01
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

processor               : 1
cpu model               : Broadcom BMIPS4350 V8.1
BogoMIPS                : 606.20
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

Does anyone have any info about this model or at least some hints on how to proceed further. I'm fairly tech savy and can manage on my own (if needed); just need someone to point me in the right direction. :slight_smile:

I wonder why CFE supports only a few commands: here is what it supports:

CFE> athe
Available commands:

ATMB                Use for multiboot.
ATSH                dump manufacturer related data from NVRAM
ATGO                Run program from flash image or from host depend on 
                    [f/h] flag.
ATSE                show the seed of password generator
ATEN                set BootExtension Debug Flag
ATPH                Set/Get PHY`s registers.
ATBL                Print boot line and board parameter info
ATSR                System reboot
ATUR                Upload router firmware to flash from TFTP
ATHE                print help

Here are the details, I get in CFE:

Base: 4.16_05
CFE version 1.0.38-118.3 for BCM963381 (32bit,SP,BE)
Build Date: 08/04/2017 (raghu@ubuntu)
Copyright (C) 2000-2015 Broadcom Corporation.

Boot Strap Register:  0x187ffff
Chip ID: BCM63381B0, MIPS: 600MHz, DDR: 400MHz, Bus: 300MHz
Main Thread: TP0
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000

NAND ECC Hamming, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: ESMT F59L1G81MA, id 0xc8d1 block 128KB size 131072KB
pmc_init:PMC using DQM mode
illegal rom_param(2001221), ignore it
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.33  
Gateway IP address                :   
Run from flash/host/tftp (f/h/c)  : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 0  
Boot image (0=latest, 1=previous) : 0  
Default host ramdisk file name    :   
Default ramdisk store address     :   
Board Id (0-12)                   : 963381_VMG1312  
Number of MAC Addresses (1-32)    : 12  
Base MAC Address                  : 04:bf:6d:0c:19:64  
PSI Size (1-128) KBytes           : 64  
Enable Backup PSI [0|1]           : 0  
System Log Size (0-256) KBytes    : 0  
Auxillary File System Size Percent: 0  
Main Thread Number [0|1]          : 0  
WLan Feature                      : 0x00  
Partition 1 Size (MB)             :   
Partition 2 Size (MB)             :   
Partition 3 Size (MB)             :   
Partition 4 Size (MB) (Data)      : 4MB  

Multiboot can only receive RAS.bin smaller than 57081856.
Multiboot client version: 1.3

Hit any key to stop autoboot:004
CFE> 

As a crude test, I compiled, openwrt (version closest to my router's version) and loading it via tftp provides the following results:

CFE> atur 192.168.1.33:openwrt-bcm63xx-smp-brcm_bcm96338gw-squashfs-cfe.bin
Loading 192.168.1.33:openwrt-bcm63xx-smp-brcm_bcm96338gw-squashfs-cfe.bin ...
Finished loading 4718596 bytes at 0x80770000
Illegal ZyXEL image header of whole flash image!

ERROR
*** command status = -1
CFE> 

Could someone let me know if this is the correct way to load firmware?

I'm always liked working in the OSS community and so far have a good experience with fair bit of encouragement until I opened a thread in OpenWRT.
With the feedback, I received on this forum, I'm pretty disappointed. My end goal was to make this particular router work with OpenWRT, however, it seems far from reality as it seems those with more knowledge in the field are not willing to provide any kind of support. Overall a very disappointed experience. :-1:

What do you expect?
…it's a Broadcom based device.

There are no xDSL drivers for Broadcom (although this doesn't apply here, there wouldn't be any wireless or FXS/ DECT drivers either) - and in all likeliness there will never be any. This longstanding deficiency obviously has consequences in terms of user- and developer interest in these devices. Given that there is no chance to get this device working for its intended purpose (being a VDSL modem, maybe with a little routing on top), no one sane would buy these with the intention of using OpenWrt. As a result there are few contributors owning those and working on bcm47xx/ bcm53xx/ bcm63xx (and the few who are there, don't follow the forum regularly), even fewer with CFE- or bcm63xx specific experience who could/ would help you. If you want to see this device supported (without VDSL capability), it's mostly up to you to get it working and to present a patch set for merging. Opensource does not imply a full 24/7 support warranty with guaranteed response times, but you do have an opportunity to find like-minded people who might be willing to help you - just that this pool of interested parties is significantly lower for Broadcom devices, than for devices that can actually be fully supported.

If you're looking for OpenWrt supported xDSL modems, lantiq VRX268/ VRX288 would be an option (up to plain vectoring/ profile 17b, not super-vectoring). In terms of wireless router uses, almost anything except Broadcom, Intel WAV300/ WAV500 wireless or Realtek (lexra) has a reasonable chance of getting (or already being) supported. In order to save you a lot of trouble and frustration, you should have invested a little time in researching your options and their capabilities in regards to opensource/ OpenWrt support before buying a device.

1 Like

First, a few clarifications, I didn't buy this, it was an extra device, I got from a friend who was moving somewhere else.
I didn't ask for 24/7 support and right from the start, my motivation was to make this device work with OpenWRT and contribute something to the community (I don't even use this device; it's just an experimental device through which I wanted to contribute to OSS). Enough to know that xDSL functionality won't work at all. I'll leave it here with my findings and if someone finds them useful, please take it from here:

Summary of Finding:

  • You can get into the modem via UART.
  • Bootloader (CFE) seems to be a trimmed down(crippled) version of CFE and you can't do much with the limited set of CFE commands. Available commands are already mentioned in the previous threads.
    I found the linke (http://jg.sn.sg/ontdump/ ) useful while working with the router and as per link's words, CFE has been deliberately crippled by the manufacturer(?) though it's possible to load firmware via ftp and seems to work fine (of course a custom image fails loading with invalid image header error as mentioned previously).
  • The underlying system is BusyBox v1.20.1 (with ash) and below seems to be the partition layout.
dev:    size   erasesize  name
mtd0: 03be0000 00020000 "rootfs"
mtd1: 03be0000 00020000 "rootfs_update"
mtd2: 00400000 00020000 "data"
mtd3: 00100000 00020000 "romfile"
mtd4: 00100000 00020000 "rom-d"
mtd5: 00100000 00020000 "wwan"
mtd6: 00020000 00020000 "nvram"
mtd7: 03be0000 00020000 "image"
mtd8: 03be0000 00020000 "image_update"
$ 

The admin account is limited account that's stopped with ugly 'operation not permitted' option at each and every step.
There seems to be only 3 accounts(practically 2). Here are the contents of /etc/passwd

nobody:x:99:99:nobody:/nonexistent:/bin/false
root:x:0:0:root:/home/root:/bin/sh
admin:x:21:21:admin:/home/admin:/bin/sh

No corresponding shadow file, sha512 hashes in the same passwd file but removed intentionally.

I'm planning to buy a Cable modem in future and would be happy to know which models are supported with OpenWRT.

In terms of "cable modems", sadly none - for two reasons. On the one hand Broadcom (same absence of drivers as for their xDSL/ wireless/ FXS/ DECT offerings) basically owns that market (aside from a little portion of Intel/ lantiq puma SOCs), on the other hand cable modems need to authenticate themselves to the ISP (certificate based firmware signatures, which need to be blessed by the ISP). The reason for this is the cable segment being a shared resource, the same cable used by everyone in your neighbourhood. Your contractual throughput and fairness between all users on the same cable needs to be ensured by everyone playing fair and sticking to their own amount of time slices. With an open modem firmware, you could bump your throughput beyond your contractual limits (this has happened in the earlier days and hacked firmwares) and starve-off your neighbours' internet connection, therefore vendors and ISPs have agreed on strong encryption needed with signed modem firmwares. The (not quite-) 'un'intended consequences it that even if you had access to free drivers (and we don't), you wouldn't be able to rebuild/ sign it (with a certificate accepted by your ISP).

If you want to run OpenWrt nevertheless, look for one of the higher-end (fast enough to cope with your contractual throughput) wireless routers supported, in combination with a cable modem in bridge mode (reducing the modem to almost a mere media converter). Most ISPs should offer this option, even if they usually don't advertise plain modems (or all-in-one devices supporting real-bridge mode) to the consumer portion of their customer base that much (these are more common for business contracts, but should be available nevertheless). Cable usually means just using ethernet/ DHCP, with the ISP (often) locking to your router's MAC address for (weak) authentification - you can pick anything you like (as long as it's powerful enough to keep up with >>200 MBit/s, which is not a given) and OpenWrt (on well supported hardware) should run nicely in this capacity.

2 Likes