Topic: Actiontec gt784wnv wireless / bcm43225

The content of this topic has been archived on 5 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 1

Post #1

sycophantic

10 Mar 2013, 20:48

I managed to get the 96328avng-16M (trunk) image flashed to a Actiontec gt784wnv (Verizon DSL modem/router) and started a wiki entry:

http://wiki.openwrt.org/toh/actiontec/gt784wnv

I noticed there were some patches related to failing sprom and the bcm43225 submitted last summer. I guess the goal is just to get the wireless working and it could be used without DSL support as a router.

Here is the output from the bootlog:

[    9.812000] bcma: bus0: Found chip with id 0xA8D9, rev 0x01 and package 0x0A
[    9.820000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x22, class 0x0)
[    9.828000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x17, class 0x0)
[    9.836000] bcma: bus0: Core 2 found: PCIe (manuf 0x4BF, id 0x820, rev 0x0F, class 0x0)
[    9.884000] bcma: bus0: invalid sprom read from the PCIe card, try to use fallback sprom
[    9.892000] bcma: bus0: Using fallback SPROM failed (err -2)
[    9.900000] bcma: bus0: No SPROM available
[    9.912000] bcma: bus0: Bus registered
[   10.228000] b43-phy0: Broadcom 43225 WLAN found (core revision 23)
[   10.236000] b43-phy0: Found PHY: Analog 8, Type 4 (N), Revision 6

(Last edited by sycophantic on 10 Mar 2013, 20:50)

Post #2

Zajec

11 Mar 2013, 08:26

I'm not sure if there is support for SPROM fallback on bcm63xx. SPROM entries for PCIe card should be present in nvram. Can you provide output of "nvram show | grep pci"? If nothing appears, then please provide output of "nvram show".

Btw.
Can you provide also an output of "lspci -nn"? It's the first time I can see such a low N-PHY revision on BCMA bus.

Post #3

sycophantic

11 Mar 2013, 11:58

Here's the output of lspci -nn

root@OpenWrt:/# lspci -nn
00:00.0 PCI bridge [0604]: Broadcom Corporation Device [14e4:6328]
01:00.0 Network controller [0280]: Broadcom Corporation Device [14e4:a8d8] (rev 01)

This build of openwrt doesn't have an nvram command or compiled binary for it. I think the factory firmware has a copy so I'll flash that later today and get the output.

Post #4

Zajec

11 Mar 2013, 12:26

sycophantic wrote:

Here's the output of lspci -nn

root@OpenWrt:/# lspci -nn
00:00.0 PCI bridge [0604]: Broadcom Corporation Device [14e4:6328]
01:00.0 Network controller [0280]: Broadcom Corporation Device [14e4:a8d8] (rev 01)

OMG... Really? Did you copy&paste it? Or can this be a typo? It's really weird that your BCM43225 chipset has 14e4:a8d8. I expected some different PCI id. Does your dmesg also contain something like

pci ...: [14e4:a8d8] type ... class ...

sycophantic wrote:

This build of openwrt doesn't have an nvram command or compiled binary for it. I think the factory firmware has a copy so I'll flash that later today and get the output.

Maybe bootloader has "nvram" command too?

Post #5

sycophantic

11 Mar 2013, 13:58

It is a cut and paste, and the chip is a BCM43225 from looking at the actual board. Here is what I found in dmesg

[    0.308000] pci 0000:01:00.0: [14e4:a8d8] type 00 class 0x028000
[    0.308000] pci 0000:01:00.0: reg 10: [mem 0x00000000-0x00003fff 64bit]
[    0.308000] pci 0000:01:00.0: supports D1 D2

Here is the CFE output:

CFE> help
Available commands:

sm                  Set memory or registers.
dm                  Dump memory or registers.
w                   Write the whole image start from beginning of the flash
e                   Erase [n]vram or [a]ll flash except bootrom
r                   Run program from flash image or from host depend on [f/h] flag
p                   Print boot line and board parameter info
c                   Change booline parameters
f                   Write image to the flash 
i                   Erase persistent storage data
a                   Change board AFE ID
b                   Change board parameters
reset               Reset the board
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0

CFE> p
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Board Id (0-3)                    : 96328avng  
Number of MAC Addresses (1-32)    : 6  
Base MAC Address                  : 00:7f:28:8f:23:a0  
PSI Size (1-64) KBytes            : 64  
Enable Backup PSI [0|1]           : 1  
System Log Size (0-256) KBytes    : 0  
Main Thread Number [0|1]          : 0  
SSID                              : SBN9H  
Board Serial Number               : CREA2422508781  
Factory FW Version                : GT784WN-VZ-1.1.6  
WPS PIN                           : 93914130  
WPA KEY                           : JW2HJXBJ844477P3  
Voice Board Configuration (0-11)  : SI3226  

*** command status = 0

Post #6

Zajec

11 Mar 2013, 14:08

sycophantic wrote:

It is a cut and paste, and the chip is a BCM43225 from looking at the actual board. Here is what I found in dmesg
[    0.308000] pci 0000:01:00.0: [14e4:a8d8] type 00 class 0x028000
[    0.308000] pci 0000:01:00.0: reg 10: [mem 0x00000000-0x00003fff 64bit]
[    0.308000] pci 0000:01:00.0: supports D1 D2

Huh, OK... It's just weird that 14e4:a8d8 can be BCM43224 (see Netgear WNDR3400) or BCM43225 (see your device) Thanks for checking that for me.

Too bad your CFE doesn't have "nvram" command. So there are three options:
1) Install "nvram" tool in OpenWRT
2) Use original firmware to read NVRAM
3) Use OpenWRT and dump NVRAM partition. Something like

cat /dev/mtdblockX > nvram.bin

you just have to figure out which mtdblock corresponds to the NVRAM partition.

Post #7

sycophantic

11 Mar 2013, 14:28

Zajec wrote:

sycophantic wrote:
It is a cut and paste, and the chip is a BCM43225 from looking at the actual board. Here is what I found in dmesg
[    0.308000] pci 0000:01:00.0: [14e4:a8d8] type 00 class 0x028000
[    0.308000] pci 0000:01:00.0: reg 10: [mem 0x00000000-0x00003fff 64bit]
[    0.308000] pci 0000:01:00.0: supports D1 D2
Huh, OK... It's just weird that 14e4:a8d8 can be BCM43224 (see Netgear WNDR3400) or BCM43225 (see your device) Thanks for checking that for me.

Too bad your CFE doesn't have "nvram" command. So there are three options:
1) Install "nvram" tool in OpenWRT
2) Use original firmware to read NVRAM
3) Use OpenWRT and dump NVRAM partition. Something like
cat /dev/mtdblockX > nvram.bin
you just have to figure out which mtdblock corresponds to the NVRAM partition.

I was able to dump the NVRAM, this was the only partition that was 65535 bytes long.

I posted the file here: http://grink.com/openwrt/nvram.bin

I flashed the factory firmware and got this nvram output

# nvram show
wl0_bss_enabled=1
wl0.2_hwaddr=52:7f:28:8f:23:a3
wl0.3_crypto=tkip+aes
wl0.3_key=1
wps_uuid=0x000102030405060708090a0b0c0d0ebb
boardnum=1234
wlmngr=done
wl0_radius_ipaddr=0.0.0.0
wl0_net_reauth=36000
wl0.1_hwaddr=52:7f:28:8f:23:a2
wl0.2_crypto=tkip+aes
wl0.1_wep=disabled
wl0.1_crypto=tkip+aes
wl0.3_mode=ap
wl0.1_akm=psk2
wl0.2_wep=disabled
wl0_wds=*DEL*
wps_modelnum=123456
wl0.1_bss_enabled=0
wl0.2_mode=ap
wl0.2_akm=psk2
wl0.3_wep=disabled
wl_wps_config_state=1
wl0_hwaddr=00:7F:28:8F:23:A1
wl0.1_mode=ap
wl0.1_radius_ipaddr=0.0.0.0
wl0.2_bss_enabled=0
wl0.3_akm=psk2
lan1_ifnames=
wl0_crypto=tkip+aes
wl0.2_radius_ipaddr=0.0.0.0
wl0.3_bss_enabled=0
eth3_hwaddr=00:7F:28:8F:23:A0
lan_ifnames=eth0 eth1 eth2 eth3 eth3 wl0
lan2_ifnames=
lan3_hwaddr=
wl_wps_reg=enabled
wl0.3_radius_ipaddr=0.0.0.0
eth2_hwaddr=00:7F:28:8F:23:A0
lan_hwaddr=00:7F:28:8F:23:A0
lan2_hwaddr=
lan3_ifnames=
wps_timeout_enable=0
wps_method=1
wl0_mode=ap
wl0_preauth=0
wl0.3_wps_mode=disabled
wl0.3_auth=0
eth1_hwaddr=00:7F:28:8F:23:A0
lan1_hwaddr=
wps_config=DONE
wl0.2_wps_mode=disabled
wl0.2_auth=0
eth0_hwaddr=00:7F:28:8F:23:A0
wps_mode=disabled
wl0.1_wps_mode=disabled
wl0.1_auth=0
lan_wps_reg=enabled
wps_currentband=
wl0_radius_port=1812
wl0.1_preauth=0
wps_restart=0
wl0.2_preauth=0
wps_proc_mac=
wl0_wps_mode=disabled
wl0.3_preauth=0
wl0_auth=0
wl0_ifname=wl0
wl0_wpa_psk=Password
wl0.1_radius_port=1812
eth3_ifname=eth3
lan3_ifname=br3
wl0.2_radius_port=1812
wl_unit=0
eth2_ifname=eth2
lan_ifname=br0
lan2_ifname=br2
wl0.3_radius_port=1812
eth1_ifname=eth1
lan1_ifname=br1
wps_device_name=BroadcomAP
wps_mfstring=Broadcom
wps_modelname=Broadcom
wl0_wpa_gtk_rekey=0
wl0.1_wpa_psk=ff7cbb63ffbf6595e5bad6656c
wl0_closed=0
eth0_ifname=eth0
wl0.2_wpa_psk=ff7cbb66ffbf6594e5bad6656e
wl0.3_radius_key=*DEL*
wl0.3_key1=1234567890123
wps_device_pin=93914130
wps_sta_pin=00000000
wl0.2_radius_key=*DEL*
wl0.3_wpa_psk=ff7cbb5fffbf6593e5bad56525
wl0.2_key1=1234567890123
wl0.3_key2=1234567890123
wl0.1_radius_key=*DEL*
wl0.1_wpa_gtk_rekey=0
wl0.1_key1=1234567890123
wl0.2_key2=1234567890123
wl0.3_key3=1234567890123
wl0_wdssec_enable=0
wps_config_command=0
wl0.2_wpa_gtk_rekey=0
wl0.1_key2=1234567890123
wl0.2_key3=1234567890123
wl0.3_key4=1234567890123
wl0.3_wpa_gtk_rekey=0
wl_key=1
wl0.1_key3=1234567890123
wl0.2_key4=1234567890123
wl0_radius_key=*DEL*
wl0_auth_mode=none
wl0_key1=873804900AAFE7ABAFE6233342
wl0.1_key4=1234567890123
wps_proc_status=0
wl0_phytype=n
wl0_radio=1
lan_wps_oob=disabled
wl0_key2=873805000AAFD7ABAFD6233341
wps_status=0
wl0.3_wps_config_state=1
wl0_key3=873805100AAFC7ABAFC6233340
wl_wep=disabled
wl0.2_wps_config_state=1
wl0.1_auth_mode=none
wl0_key4=873805200AAFB7ABAFB6233339
wps_config_method=0x84
wl0.1_radio=1
wl0.1_wps_config_state=1
wl0.3_ssid=SBN9H3
wl0.2_auth_mode=none
wl0.2_radio=1
wl0.2_ssid=SBN9H2
wl0.3_auth_mode=none
wl0_key=1
wl0.1_ssid=SBN9H1
wl0.3_radio=1
wl0.3_net_reauth=36000
wl_key1=873804900AAFE7ABAFE6233342
wl0_wps_config_state=1
wl0.2_net_reauth=36000
wl_key2=873805000AAFD7ABAFD6233341
wl0.1_net_reauth=36000
wl_key3=873805100AAFC7ABAFC6233340
wl0.1_key=1
wl0_wep=disabled
wl0_ssid=MSLN
wl0.3_hwaddr=52:7f:28:8f:23:a0
wl0_akm=psk2
wl_key4=873805200AAFB7ABAFB6233339
wl0.2_key=1
wl0_channel=0
size: 3253 bytes (29515 left)

(Last edited by sycophantic on 11 Mar 2013, 14:58)

Post #8

sycophantic

13 Mar 2013, 20:11

I checked out revision 32930 (old I know) and applied these two patches:

http://patchwork.openwrt.org/patch/2553/
http://patchwork.openwrt.org/patch/2554/

without any luck on getting the wifi to work. The funny thing is iw outputs info:

root@OpenWrt:/# iw phy0 info                                                    
Wiphy phy0                                                                      
        Band 1:                                                                 
                Frequencies:                                                    
                        * 2412 MHz [1] (20.0 dBm)                               
                        * 2417 MHz [2] (20.0 dBm)                               
                        * 2422 MHz [3] (20.0 dBm)                               
                        * 2427 MHz [4] (20.0 dBm)                               
                        * 2432 MHz [5] (20.0 dBm)                               
                        * 2437 MHz [6] (20.0 dBm)                               
                        * 2442 MHz [7] (20.0 dBm)                               
                        * 2447 MHz [8] (20.0 dBm)                               
                        * 2452 MHz [9] (20.0 dBm)                               
                        * 2457 MHz [10] (20.0 dBm)                              
                        * 2462 MHz [11] (20.0 dBm)                              
                        * 2467 MHz [12] (20.0 dBm) (passive scanning, no IBSS)  
                        * 2472 MHz [13] (20.0 dBm) (passive scanning, no IBSS)  
                        * 2484 MHz [14] (20.0 dBm) (passive scanning, no IBSS)  
                Bitrates (non-HT):                                              
                        * 1.0 Mbps                                              
                        * 2.0 Mbps (short preamble supported)                   
                        * 5.5 Mbps (short preamble supported)                   
                        * 11.0 Mbps (short preamble supported)                  
                        * 6.0 Mbps                                              
                        * 9.0 Mbps                                              
                        * 12.0 Mbps                                             
                        * 18.0 Mbps                                             
                        * 24.0 Mbps                                             
                        * 36.0 Mbps                                             
                        * 48.0 Mbps                                             
                        * 54.0 Mbps                                             
        max # scan SSIDs: 4                                                     
        max scan IEs length: 2285 bytes                                         
        Coverage class: 0 (up to 0m)                                            
        Supported Ciphers:                                                      
                * WEP40 (00-0f-ac:1)                                            
                * WEP104 (00-0f-ac:5)                                           
                * TKIP (00-0f-ac:2)                                             
                * CCMP (00-0f-ac:4)                                             
        Available Antennas: TX 0x3 RX 0x3                                       
        Configured Antennas: TX 0x3 RX 0x3                                      
        Supported interface modes:                                              
                 * IBSS                                                         
                 * managed                                                      
                 * AP                                                           
                 * AP/VLAN                                                      
                 * WDS                                                          
                 * monitor                                                      
                 * mesh point                                                   
        software interface modes (can always be added):                         
                 * AP/VLAN                                                      
                 * monitor                                                      
        interface combinations are not supported                                
        Supported commands:                                                     
                 * new_interface                                                
                 * set_interface                                                
                 * new_key                                                      
                 * new_beacon                                                   
                 * new_station                                                  
                 * new_mpath                                                    
                 * set_mesh_params                                              
                 * set_bss                                                      
                 * authenticate                                                 
                 * associate                                                    
                 * deauthenticate                                               
                 * disassociate                                                 
                 * join_ibss                                                    
                 * join_mesh                                                    
                 * set_tx_bitrate_mask                                          
                 * action                                                       
                 * frame_wait_cancel                                            
                 * set_wiphy_netns                                              
                 * set_channel                                                  
                 * set_wds_peer                                                 
                 * Unknown command (84)                                         
                 * Unknown command (87)                                         
                 * Unknown command (85)                                         
                 * connect                                                      
                 * disconnect                                                   
        Supported TX frame types:                                               
                 * IBSS: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x0060 0x0070
                 * managed: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x0060 0x0
                 * AP: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x0060 0x0070 0
                 * AP/VLAN: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x0060 0x0
                 * mesh point: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x00600
                 * P2P-client: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x00600
                 * P2P-GO: 0x0000 0x0010 0x0020 0x0030 0x0040 0x0050 0x0060 0x00
        Supported RX frame types:                                               
                 * IBSS: 0x00b0 0x00c0 0x00d0                                   
                 * managed: 0x0040 0x00d0                                       
                 * AP: 0x0000 0x0020 0x0040 0x00a0 0x00b0 0x00c0 0x00d0         
                 * AP/VLAN: 0x0000 0x0020 0x0040 0x00a0 0x00b0 0x00c0 0x00d0    
                 * mesh point: 0x00b0 0x00c0 0x00d0                             
                 * P2P-client: 0x0040 0x00d0                                    
                 * P2P-GO: 0x0000 0x0020 0x0040 0x00a0 0x00b0 0x00c0 0x00d0     
        Device supports RSN-IBSS.                                               
        HT Capability overrides:                                                
                 * MCS: ff ff ff ff ff ff ff ff ff ff                           
                 * maximum A-MSDU length                                        
                 * supported channel width                                      
                 * short GI for 40 MHz                                          
                 * max A-MPDU length exponent                                   
                 * min MPDU start spacing                                       
        Device supports TX status socket option.                                
        Device supports HT-IBSS.

Post #9

sycophantic

28 Mar 2013, 04:31

After some googling, I flashed a patched firmware from here: http://foro.seguridadwireless.net/openw … 118fbcab7f

wifi works!

(Last edited by sycophantic on 28 Mar 2013, 05:53)

Post #10

aeroxy

18 Feb 2014, 08:34

sycophantic wrote:

I managed to get the 96328avng-16M (trunk) image flashed to a Actiontec gt784wnv (Verizon DSL modem/router) and started a wiki entry:http://wiki.openwrt.org/toh/actiontec/gt784wnv

Hi, sycophantic! Thanks for sharing. I happen to have three units of Actiontec GT784WNV-VZ. I am curious to learn how to build WDR connections between them so I can extend the wireless coverage at home. It’s not clear to me how you flashed your router. Can you break it down? I am assuming you have flashed the router through the JTAG. Would you be able to elaborate how you accomplish the setup - perhaps forwarding me to some articles that may help me to understand the procedure? Thanks.

The discussion might have continued from here.

Page 1 of 1