Be aware the ADSL part will never be supported in OpenWrt in this and other bcm6348 routers.

Version A and version B are identical, the only one difference is the Board Id.

notes.

1. → obtain.firmware
2. → Install OpenWrt

Please check out the article Flash Layout. It contains an example and a couple of explanations.

Get the firmware openwrt-USR9108-squashfs-cfe.bin

• Unplug the power cord
• Press the reset button, don't release it yet!
• Plug the power cord
• Wait 10 seconds
• Release the reset button
• Browse to http://192.168.1.1
• Upload .bin file to router
• Upgrade the image
• Wait for it to reboot
• Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.

If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.

→ generic.sysupgrade

If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

• Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
• Upload image file for sysupgrade to LuCI
• Wait for reboot

• Login as root via SSH on 192.168.1.1
• Use the following commands to upgrade.

cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

• If sysupgrade does not support this router, use the following commands.

cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
mtd write /tmp/xxx.abc linux && reboot

CFE version 1.0.37-4.3 for BCM96348 (32bit,SP,BE) Build Date: Tue Jan 17 07:46:56 CST 2006 (root@new-host-2) Copyright (C) 2000-2005 Broadcom Corporation. Boot Address 0xbfc00000 Initializing Arena. Initializing Devices. Parallel flash device: name M29W320ET, id 0x2256, size 4096KB CPU type 0x29107: 256MHz, Bus: 128MHz, Ref: 32MHz Total memory: 16777216 bytes (16MB) Total memory used by CFE: 0x80401000 - 0x805252C0 (1196736) Initialized Data: 0x8041C590 - 0x8041EA50 (9408) BSS Area: 0x8041EA50 - 0x804232C0 (18544) Local Heap: 0x804232C0 - 0x805232C0 (1048576) Stack Area: 0x805232C0 - 0x805252C0 (8192) Text (code) segment: 0x80401000 - 0x8041C590 (112016) Boot area (physical): 0x00526000 - 0x00566000 Relocation Factor: I:00000000 - D:00000000 Board IP address : 192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : 96348GW-A Psi size in KB : 24 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:14:c1:xx:xx:xx Ethernet PHY Type : External Switch Using Reverse MII Memory size in MB : 16 Country code : FR *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 Code Address: 0x80010000, Entry Address: 0x80010000 Decompression OK! Entry at 0x80010000 Closing network. Starting program at 0x80010000 Linux version 2.6.27.13 (user@debian) (gcc version 4.1.2) #13 Sun Feb 8 10:53:18 CET 2009 Detected Broadcom 0x6348 CPU revision b0 CPU frequency is 256000000 Hz 16MB of RAM installed board_bcm963xx: CFE version: 1.0.37-4.3 console [early0] enabled CPU revision is: 00029107 (Broadcom BCM6348) board_bcm963xx: board name: 96348GW-A Determined physical RAM map: memory: 01000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00001000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00001000 Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064 Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 init=/etc/preinit noinitrd console=ttyS0,115200 Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes PID hash table entries: 64 (order: 6, 256 bytes) Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Memory: 13720k/16384k available (1866k kernel code, 2664k reserved, 323k data, 120k init, 0k highmem) Calibrating delay loop... 254.97 BogoMIPS (lpj=509952) Mount-cache hash table entries: 512 net_namespace: 592 bytes NET: Registered protocol family 16 registering 37 GPIOs registering PCI controller with io_map_base unset bus: 00 index 0 io port: [8000000, 800ffff] bus: 00 index 1 mmio: [30000000, 37ffffff] NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered NET: Registered protocol family 1 audit: initializing netlink socket (disabled) type=2000 audit(0.276:1): initialized squashfs: version 3.0 (2006/03/15) Phillip Lougher Registering mini_fo version $Id$ JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. msgmni has been set to 26 io scheduler noop registered io scheduler cfq registered (default) bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart console handover: boot [early0] -> real [ttyS0] bcm63xx_enet MII bus: probed bcm963xx_flash: 0x00400000 at 0x1fc00000 bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 bcm963xx: Swapping erase regions for broken CFI table. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. bcm963xx_flash: Read Signature value of CFE1CFE1 bcm963xx_flash: CFE bootloader detected bcm963xx_flash: CFE boot tag found with version 6 and board type 96348GW-A. bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000 bcm963xx_flash: Partition 1 is kernel offset 10100 and length bb46b bcm963xx_flash: Partition 2 is rootfs offset d0000 and length 320000 bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000 Creating 4 MTD partitions on "bcm963xx": 0x00000000-0x00010000 : "CFE" 0x00010100-0x000cb56b : "kernel" mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only 0x000d0000-0x003f0000 : "rootfs" mtd: partition "rootfs" set to be root filesystem mtd: partition "rootfs_data" created automatically, ofs=280000, len=170000 0x00280000-0x003f0000 : "rootfs_data" 0x003f0000-0x00400000 : "nvram" TCP bic registered NET: Registered protocol family 17 VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 120k freed Please be patient, while OpenWrt loads ... Algorithmics/MIPS FPU Emulator v1.5 - preinit - Press CTRL-C for failsafe switching to jffs2 mini_fo: using base directory: / mini_fo: using storage directory: /jffs - init - Please press Enter to activate this console. bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)] bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)] eth1: link forced UP - 100/full - flow control off/off device eth1 entered promiscuous mode br-lan: topology change detected, propagating br-lan: port 1(eth1) entering forwarding state br-lan: port 1(eth1) entering disabled state br-lan: topology change detected, propagating br-lan: port 1(eth1) entering forwarding state ieee80211: 802.11 data/management/control stack, git-1.1.13 ieee80211: Copyright (C) 2004-2005 Intel Corporation cfg80211: Using static regulatory domain info cfg80211: Regulatory domain: US (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) (2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm) (5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm) (5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm) (5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm) (5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm) (5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm) cfg80211: Calling CRDA for country: US SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb PCI: Enabling device 0000:00:01.0 (0000 -> 0002) b43-phy0: Broadcom 4318 WLAN found (core revision 9) Broadcom 43xx driver loaded [ Features: PL, Firmware-ID: FW13 ] ip_tables: (C) 2000-2006 Netfilter Core Team Driver 'sd' needs updating - please use bus_type methods nf_conntrack version 0.5.0 (1024 buckets, 4096 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. bcm63xx_ohci bcm63xx_ohci.0: BCM63XX integrated OHCI controller bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bus number 1 bcm63xx_ohci bcm63xx_ohci.0: irq 20, io mem 0xfffe1b00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. BusyBox v1.11.3 (2009-02-03 18:31:56 CET) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - | _ | -__| | | | | _| _| |_ ^ |_____|__| ^ ^ | |____| |__| W I R E L E S S F R E E D O M KAMIKAZE (bleeding edge, r14432) ------------------- * 10 oz Vodka Shake well with ice and strain * 10 oz Triple sec mixture into 10 shot glasses. * 10 oz lime juice Salute! --------------------------------------------------- root@OpenWrt:/#

→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is: The default network configuration is:

Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.

→ generic.failsafe

→ hardware.button on howto use and configure the hardware button(s).

The usr9108 has one reset buttons.

Model Number

Front:

Photo of front of the casing

Back:

Photo of back of the casing

Note: This will void your warranty!

• To remove the cover do a/b/c

Main PCB

Photo of PCB

→ port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Photo of PCB with markings

→ port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

→ generic.debrick

1. you could read about bootloader in general

1. as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

Special thanks to Karol for the photos — danitool 2012/03/09 11:32

Version A and version B have identical board parameters. Some leds and buttons weren't added to OpenWrt (a patch is needed to solve it).

From the OEM sourcecode:

static BOARD_PARAMETERS g_bcm96348gw =
{
    "96348GW-A",                            /* szBoardId */
    {{BP_ENET_NO_PHY},                      /* ucPhyType */
     {BP_ENET_EXTERNAL_SWITCH,              /* ucPhyType */
      0x00,                                 /* ucPhyAddress */
      BP_NOT_DEFINED,                       /* usGpioPhySpiSck */
      BP_NOT_DEFINED,                       /* usGpioPhySpiSs */
      BP_NOT_DEFINED,                       /* usGpioPhySpiMosi */
      BP_NOT_DEFINED,                       /* usGpioPhySpiMiso */
      BP_NOT_DEFINED,                       /* usGpioPhyReset */
      0x04,                                 /* numSwitchPorts */
      BP_ENET_CONFIG_SPI_SSB_0,             /* usConfigType */
      BP_ENET_REVERSE_MII}},                /* usReverseMii */
    {{BP_VOIP_NO_DSP},                      /* ucDspType */
     {BP_VOIP_NO_DSP}},                     /* ucDspType */
    BP_MEMORY_16MB_2_CHIP,                  /* usSdramSize */
    BP_PSI_DEFAULT_SIZE,                    /* usPsiSize */
    BP_NOT_DEFINED,                         /* usGpioRj11InnerPair */
    BP_NOT_DEFINED,                         /* usGpioRj11OuterPair */
    BP_GPIO_33_AL,                          /* usGpioPressAndHoldReset */
    BP_NOT_DEFINED,                         /* usGpioPcmciaReset */
    BP_NOT_DEFINED,                         /* usGpioUartRts */
    BP_NOT_DEFINED,                         /* usGpioUartCts */
    BP_NOT_DEFINED,                         /* usGpioLedAdsl */
    BP_GPIO_2_AL,                           /* usGpioLedAdslFail */
    BP_NOT_DEFINED,                         /* usGpioLedWireless */
    BP_GPIO_0_AL,                           /* usGpioLedUsb */
    BP_NOT_DEFINED,                         /* usGpioLedHpna */
    BP_GPIO_3_AL,                           /* usGpioLedWanData */
    BP_GPIO_3_AL,                           /* usGpioLedPpp */
    BP_GPIO_4_AL,                           /* usGpioLedPppFail */
    BP_GPIO_0_AL,                           /* usGpioLedBlPowerOn */
    BP_NOT_DEFINED,                         /* usGpioLedBlAlarm */
    BP_GPIO_3_AL,                           /* usGpioLedBlResetCfg */
    BP_GPIO_1_AL,                           /* usGpioLedBlStop */
    BP_NOT_DEFINED,                         /* usExtIntrWireless */
    BP_HW_DEFINED,                          /* usExtIntrAdslDyingGasp */
    BP_NOT_DEFINED,                         /* usExtIntrHpna */
    BP_NOT_DEFINED,                         /* usCsHpna */
    BP_WLAN_ANT_MAIN,                       /* usAntInUseWireless */
    BP_GPIO_35_AH,                          /* usGpioSesBtnWireless */
    BP_EXT_INTR_3,                          /* usExtIntrSesBtnWireless */
    BP_NOT_DEFINED  /* BP_GPIO_0_AL   */    /* usGpioLedSesWireless */
};

Then the board parameters at build_dir/linux-brcm63xx/linux-3.3.8/arch/mips/bcm63xx/boards/board_bcm963xx.c should be something like this:

static struct board_info __initdata board_96348gw_a = {
	.name				= "96348GW-A",
	.expected_cpu_id		= 0x6348,
 
	.has_uart0			= 1,
	.has_enet1			= 1,
	.has_pci			= 1,
 
	.enet1 = {
		.force_speed_100	= 1,
		.force_duplex_full	= 1,
	},
 
	.has_ohci0 = 1,
 
	.leds = {
		{
			.name		= "96348GW-A::power",
			.gpio		= 0,
			.active_low	= 1,
			.default_trigger = "default-on",
		}
		{
			.name		= "96348GW-A::wifi",
			.gpio		= 1,
			.active_low	= 1,
		}
		{
			.name		= "96348GW-A::adsl",
			.gpio		= 2,
			.active_low	= 1,
		}
		{
			.name		= "96348GW-A::internet",
			.gpio		= 3,
			.active_low	= 1,
		},
		{
			.name		= "96348GW-A::printer",
			.gpio		= 4,
			.active_low	= 1,
		},
	},
 
	.buttons = {
		{
			.desc		= "reset",
			.gpio		= 33,
			.active_low	= 1,
			.type		= EV_KEY,
			.code		= KEY_RESTART,
			.debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL,
		},
	},
};

For some Help with the Tags, please have a look here: tags