User Tools

Site Tools




Model Status Target(s) Platform CPU Speed (MHz) Flash (MB) RAM (MB) SoC DSP WLAN
ah4021 OK bcm63xx Broadcom 6348 256 4 16 BCM6348KPB BCM6341KPB BCM4318KFBG

Openwrt is able to run on this device. The only problem is : there is an hardware thing which does not allow another firmware's file from provider. The only solution is to cut of one of the electronics component pin :

The identified pin should be removed to allow owrt to boot properly pin : very little chip between processor and leds > top range (when you see ehernet wires at the top, leds at bottom), then the second pin from the LEFT

then owrt should boot properly

[Thanks to Frédéric Darcel who found this trick]

Installing OWRT

Few words :
TFTP= the method, the protocol which is used to talk between yyour computer and your router, to transfer the owrt image to your embedded device
CFE = Common Firmware Interface, a little software made by Broadcom which is used on them hardware to allow software boot of it (if i'm right?) it's like the bios/efi for a computer.
Hit a key during the first second of the boot, using the serial connection (see usb⇔ttl adapter for hardware connection) to interrupt it, and acced to the main CFE's features, like download an alternative firmware, etc
.Bin image = Openwrt is compiled into an image, which contains all needed files of owrt to install it on your router.
You've guessed it, you can't install openwrt with floppies on an embedded device. SquashFS filesystems are recommended for beginners
USB⇔TTL adapter = your computer have maybe few serial ports (old computers) using 5V signal. Routers only needs 3V3.
If you plug directly 5V serial computer on a 3V router, it will break it immediatly. That's why you need a ttl converter to adapt the voltage to your embedded device. Check at the parameters to know how to connect router's console properly

YOu can install openwrt through two ways :
by using the web interface (few old alicebox models allows that) > then try to upload an image (like :
Or by using the TFTP method :
First, you need to have a TFTP server on your computer, linked by ethernet to the TV port of the router.
The TFTP server address should be
Put your openwrt's image in the format name required by the CFE Open your router and connect to serial on it via usb/ttl3v3 adapter (only tx/rx/gnd needed), open a serial connection on your computer with a serial client (like putty on serial0 or minicom on /dev/ttyUSB0), then turn on your router :
you should see the hardware boot, you only have one second to hit a key on the keyboard to interrupt the boot :
then you will be in the CFE (Common Firmware Interface) menu, and you will be able with "F" to download a bcm9633x_fs_kernel onn your ftfp root (you'll see your switch led blinking few seconds) then if the image format is right it should flash and after reboot on owrt.

I personnaly advice to run owrt kamikaze or backfire releases dues to hardware specs

/!\ You should know about owrt running on this device : switch is not working on owrt's releases att/adj and higher, i strongly recommend to use only BF/KKZ on it.

Last note : i don't thought adsl modem works on that device, due to broadcom's driver for adsl modems



Linux version ( (gcc version 4.3.3 (GCC) ) #5 Wed Dec 21 05:51:40 CET 2011 Detected Broadcom 0x6348 CPU revision b0 CPU frequency is 256 MHz 16MB of RAM installed registering 37 GPIOs board_bcm963xx: CFE version: 1.0.37-0.6 bootconsole [early0] enabled CPU revision is: 00029107 (Broadcom BCM6348) board_bcm963xx: board name: 96348GW Determined physical RAM map: memory: 01000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00001000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00001000 On node 0 totalpages: 4096 free_area_init_node: node 0, pgdat 802981f0, node_mem_map 802df000 Normal zone: 32 pages used for memmap Normal zone: 0 pages reserved Normal zone: 4064 pages, LIFO batch:0 Built 1 zonelists in Zone order, mobility grouping off. Total pages: 4064 Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 PID hash table entries: 64 (order: -4, 256 bytes) Dentry cache hash table entries: 2048 (order: 1, 8192 bytes) Inode-cache hash table entries: 1024 (order: 0, 4096 bytes) Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. Primary data cache 8kB, 2-way, VIPT, no aliases, linesize 16 bytes Memory: 13284k/16384k available (2140k kernel code, 3100k reserved, 453k data, 140k init, 0k highmem) Hierarchical RCU implementation. NR_IRQS:128 Calibrating delay loop... 254.97 BogoMIPS (lpj=509952) Mount-cache hash table entries: 512 NET: Registered protocol family 16 registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 pci 0000:00:01.0: reg 10 32bit mmio: [0x000000-0x001fff] pci 0000:01:1e.0: CardBus bridge, secondary bus 0000:02 pci 0000:01:1e.0: IO window: 0x8008000-0x80080ff pci 0000:01:1e.0: IO window: 0x8008400-0x80084ff pci 0000:01:1e.0: MEM window: 0x38000000-0x3fffffff PCI: Enabling device 0000:01:1e.0 (0000 -> 0003) PCI: Setting latency timer of device 0000:01:1e.0 to 64 Switching to clocksource MIPS PCI: Enabling device 0000:00:01.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:01.0 to 64 ssb: Core 0 found: ChipCommon (cc 0x800, rev 0x0D, vendor 0x4243) ssb: Core 1 found: IEEE 802.11 (cc 0x812, rev 0x09, vendor 0x4243) ssb: Core 2 found: PCI (cc 0x804, rev 0x0C, vendor 0x4243) ssb: Core 3 found: PCMCIA (cc 0x80D, rev 0x07, vendor 0x4243) ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 512 (order: 0, 4096 bytes) TCP bind hash table entries: 512 (order: -1, 2048 bytes) TCP: Hash tables configured (established 512 bind 512) TCP reno registered NET: Registered protocol family 1 audit: initializing netlink socket (disabled) type=2000 audit(0.342:1): initialized squashfs: version 4.0 (2009/01/31) Phillip Lougher Registering mini_fo version $Id$ JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. msgmni has been set to 25 io scheduler noop registered io scheduler deadline registered (default) gpiodev: gpio device registered with major 254 gpiodev: gpio platform device registered with access mask FFFFFFFF bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0300 (irq = 10) is a bcm63xx_uart console [ttyS0] enabled, bootconsole disabled bcm963xx_flash: 0x00400000 at 0x1fc00000 bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank CFI mfr 0x000000c2 CFI id 0x000022a7 Amd/Fujitsu Extended Query Table at 0x0040 Amd/Fujitsu Extended Query version 1.1. bcm963xx: Swapping erase regions for broken CFI table. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. bcm963xx_flash: Read Signature value of CFE1CFE1 bcm963xx_flash: CFE bootloader detected bcm963xx_flash: CFE boot tag found with version 6 and board type 96348GW bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000 bcm963xx_flash: Partition 1 is kernel offset 10100 and length dff00 bcm963xx_flash: Partition 2 is rootfs offset f0000 and length 300000 bcm963xx_flash: Partition 3 is nvram offset 3f0000 and length 10000 bcm963xx_flash: Partition 4 is linux offset 10000 and length 3e0000 bcm963xx_flash: Spare partition is 2b0000 offset and length 140000 Creating 5 MTD partitions on "bcm963xx": 0x000000000000-0x000000010000 : "CFE" 0x000000010100-0x0000000f0000 : "kernel" mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only 0x0000000f0000-0x0000003f0000 : "rootfs" mtd: partition "rootfs" set to be root filesystem mtd: partition "rootfs_data" created automatically, ofs=2B0000, len=140000 0x0000002b0000-0x0000003f0000 : "rootfs_data" 0x0000003f0000-0x000000400000 : "nvram" 0x000000010000-0x0000003f0000 : "linux" bcm63xx_enet MII bus: probed bcm63xx_wdt started, timer margin: 30 sec Registered led device: adsl-fail Registered led device: power Registered led device: stop Registered led device: line1 Registered led device: line2 Registered led device: line3 Registered led device: tel Registered led device: eth TCP westwood registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <> All bugs added by David S. Miller <> VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 140k freed Please be patient, while OpenWrt loads ... mini_fo: using base directory: / mini_fo: using storage directory: /overlay bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (1)] eth1: link forced UP - 100/full - flow control off/off device eth1 entered promiscuous mode br-lan: port 1(eth1) entering forwarding state eth0: link UP - 100/full - flow control off Compat-wireless backport release: compat-wireless-2011-11-08-1-g4ab9b62 Backport based on wireless-testing.git master-2011-11-15 cfg80211: Calling CRDA to update world regulatory domain cfg80211: World regulatory domain updated: cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) roboswitch: Probing device eth0: Failed to enable switch roboswitch: Probing device eth1: No Robo switch in managed mode found, phy_id = 0xffffffff roboswitch: Probing device eth2: No such device roboswitch: Probing device eth3: No such device eth0: link DOWN eth0: link UP - 100/full - flow control off b43-phy0: Broadcom 4318 WLAN found (core revision 9) ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' Registered led device: b43-phy0::tx Registered led device: b43-phy0::rx Registered led device: b43-phy0::radio Broadcom 43xx driver loaded [ Features: PL ] PPP generic driver version 2.4.2 ip_tables: (C) 2000-2006 Netfilter Core Team NET: Registered protocol family 24 nf_conntrack version 0.5.0 (209 buckets, 836 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. xt_time: kernel timezone is -0000 u32 classifier Performance counters on input device check on Actions configured Mirror/redirect action on b43-phy0: Loading firmware version 508.1084 (2009-01-14 01:32:01) b43-phy0: Loading firmware version 508.1084 (2009-01-14 01:32:01) device wlan0 entered promiscuous mode br-lan: port 2(wlan0) entering forwarding state device wlan0 left promiscuous mode br-lan: port 2(wlan0) entering disabled state device wlan0 entered promiscuous mode br-lan: port 2(wlan0) entering forwarding state

cat /proc/cpuinfo

system type             : bcm63xx/96348GW (0x6348/0x00B0)
processor               : 0
cpu model               : Broadcom BCM6348 V0.7
BogoMIPS                : 254.97
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

about MTD :

cat /proc/diskstats

  31       0 mtdblock0 0 0 0 0 0 0 0 0 0 0 0
  31       1 mtdblock1 0 0 0 0 0 0 0 0 0 0 0
  31       2 mtdblock2 67 1734 3602 608 0 0 0 0 0 584 604
  31       3 mtdblock3 1 3 32 4 0 0 0 0 0 4 4
  31       4 mtdblock4 0 0 0 0 0 0 0 0 0 0 0
  31       5 mtdblock5 0 0 0 0 0 0 0 0 0 0 0
cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00010000 00010000 "CFE"
mtd1: 000dff00 00010000 "kernel"
mtd2: 00300000 00010000 "rootfs"
mtd3: 00140000 00010000 "rootfs_data"
mtd4: 00010000 00002000 "nvram"
mtd5: 003e0000 00010000 "linux"

cat /proc/meminfo

MemTotal:          13424 kB
MemFree:            1148 kB
Buffers:            1056 kB
Cached:             3448 kB
SwapCached:            0 kB
Active:             2920 kB
Inactive:           2868 kB
Active(anon):        384 kB
Inactive(anon):      972 kB
Active(file):       2536 kB
Inactive(file):     1896 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          1300 kB
Mapped:             1328 kB
Shmem:                72 kB
Slab:               4064 kB
SReclaimable:        716 kB
SUnreclaim:         3348 kB
KernelStack:         296 kB
PageTables:          212 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:        6712 kB
Committed_AS:       3876 kB
VmallocTotal:    1032116 kB
VmallocUsed:         784 kB
VmallocChunk:    1015528 kB


toh/hitachi/ah4021.txt · Last modified: 2017/01/28 15:28 by danitool