OpenWrt Forum Archive

Topic: Comtrend CT-6373

The content of this topic has been archived between 8 Feb 2018 and 16 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I have seen that some Models of Comtrend are supported.
My Comtrend DSL-Router CT-6373 is not on the list.
Is there are chance to support this device?

Probably it can be supported. I think this board uses a bcm6358 SoC which is already supported with other boards.

Some information is needed to achieve support:
- CFE board ID,
- are you able access to the CFE web interface?
- do you have access to the router via serial port?
- memory flash-chip model

Do you have any flasheable firmware from the manufacturer to watch the header? I should be necessary to produce an Openwrt firmware which CFE can accept it.

Also it would be nice some quality pics of the board to start adding info to the wiki.

in the evening I will bring you the rest of your wanted information.
Here the Versions of my Router

Board ID: CT6373-1
Software Version: I111-S306CTL-C01_R04
Bootloader (CFE) Version: 1.0.37-6.8
VDSL Software Version: 09.03.02, 2006-12-24
Wireless Driver Version:
ADSL Version: A2pB021g.d19d

Onboard Chips:
ST M29W640FB

Some Specs

I can access the Webinterface. Is the CFE Interface diffrent then the managment WebIF?

(Last edited by netbus on 14 Feb 2012, 08:35)

Ok from the firmware you posted whe have this (for future image builds):

tagVersion (0-3) Version of the image tag  = 6
sig_1 (4-23) Company Line 1 = Broadcom Corporatio
sig_2 (24-37) Company Line 2 = ver. 2.0
chipid (38-43) Chip this image is for = 6358
boardid (44-59) Board name = CT6373-1
big_endian (60-61) Map endianness -- 1 BE 0 LE = 1

totalLength (62-71) Total length of image = 4601899
cfeAddress (72-83) Address in memory of CFE = 0
cfeLength (84-93) Size of CFE =  0
flashImageStart  (94-105)   Address in memory of image start (kernel for OpenWRT, rootfs for stock firmware) = 3217096960
flashRootLength (106-115)  Size of rootfs for flashing = 4014080
kernelAddress (116-127)  Address in memory of kernel = 3221111040
kernelLength (128-137)  Size of kernel = 587819
dualImage (138-139) Unused at present
inactiveFlag (140-141) Unused at present
rsa_signature (142-161) RSA Signature (unused at present; some vendors may use this)
information1 (162-191) Compilation and related information (not generated/used by OpenWRT)
flashLayoutVer (192-195) Version flash layout
fskernelCRC (196-199) kernel+rootfs CRC32
information2 (200-215) Unused at present except Alice Gate where is is information
imageCRC (216-219) CRC32 of image less imagetag (kernel for Alice Gate) = CB5F1858
rootfsCRC (220-223) CRC32 of rootfs partition = D7818653
kernelCRC (224-227) CRC32 of kernel partition = B199FF62
imageSequence (228-231) Image sequence number
rootLength (232-235) steal from reserved1 to keep the real root length so we can use in the flash map even after we have change the rootLength to 0 to satisfy devices that check CRC on every boot
headerCRC (236-239) CRC32 of header excluding tagVersion   = DB4C6488
reserved2 (240-255) Unused at present

Only blue values are important. It seems easy at least to generate a compatible image. But it will be more important to know  better the hardware, and of course a bootlog would help.

Here pictures from the hardware.

Hardware Pictures

Do you know how the get a bootlog?
I can not find any serial pins :-(

I've built a firmare for your router …

Could you test it?

Try to flash it with CFE doing something like this:

Get the firmware openwrt-CT6373-squashfs-cfe.bin
- Unplug the power cord
- Press the reset button, don't release it yet!
- Plug the power cord
- Wait >15 seconds
- Release the reset button
- Browse to
- Upload .bin file to router
- Upgrade the image
- Wait for it to reboot
- Telnet to and set a root password, or browse to

Also I suspect this is the serial port
Could you confirm it?

(Last edited by danitool on 14 Feb 2012, 17:47)

You are right. This is the Serial Connection.
I connected my DKU-5 Cable and get a bootlog
Here the Bootlog


I testet your Firmware and it works great. No problem so far.
I attached a dmesg too

(Last edited by netbus on 14 Feb 2012, 22:01)

Now, where the device is working, I have a question.
Where can I configure the adsl settings or which packet do I have to install for adsl?

Sadly, Broadcom didn't release any source code for the adsl part.

WIKI wrote:

The support for Broadcom 63xx is at this state :

Full Linux support for BCM6338, BCM6345, BCM6348 and BCM6358 with runtime detection of the SoC on which the kernel is running
GPL drivers for Ethernet, OHCI, EHCI, SPI, Watchdog
No available drivers (neither binary, nor GPL) for DSL, ATM, VoIP, on-board SLIC/SLAC

Spite there is some work on the adsl drivers
there aren't anything still usable.

Could you locate the gpio's of leds?
Use gpioctl:

gpioctl set X
gpioctl clear X

X is a number = 0 to 40

Also you can try to locate the gpio for the reset button:

press the button
gpioctl get X
release the button
gpioctl get X

if the state of the gpio changes, that gpio is the reset button.

Also would be interesting to make a backup of your bootloder. It might help to hack others bcm6358 routers.

dd if=/dev/mtd0 of=/tmp/CFE_ct6373_backup.rom

Here the bootloader
gpio I will check this evening.
but how shall I check the reset button.
when i press it the device is not reachable anymore, correct?

So, after testing with gpioctl i'm a little confused.
Because gpio 6 was Low, I set it to high.
At the first time power + adsl led went up.
After a clear and set again gpio 6, the Line Led went up. And so on.
Only USB and Power are working normal.
Here my testing.

0 = power
3 = USB
6 = *
9 = Wifi
35 = Button

1x6 = power + adsl
2x6 = Line
3x6 = FXS1
4x6 = FXS2

I'm not sure if some gpios are controlled with a 74HC64 IC in your router, do you have this chip at the board?

Since I've never had this behavior, my knowledge is the same as yours about the gpio 6 weird function.

you are right. there is a chip with this name onboard.

what does this mean and my major problem, what about adsl?
actualy its only a hotspot devices :-)

This means the board structure for controlling those leds is more complex, something like this
But I have no idea how make the same with the 74HC64 in your board structure.

About the adsl drivers we can say: there is nothing.
But still you can use it as a regular router without adls configuring (with VLANs) one switch port as WAN.

Thanks for your support.
For the Future, which Firmware can i use for this Router?
Or shall I use the Image Builder?

one more thing.
this router has two pots connectors.
Can I use them with pbx software?

I've made some patches for this router: …

- Apply this patches before building: CT-6373-1_network.diff , image.diff
- And drop the patch CT-6373-1.patch into the trunk/target/linux/brcm63xx/patches-3.0/ directory

About the port connectors, do you mean the FXS ports? Probably you can't use it, as far as I know there aren't drivers, but I'm not totally sure of this.

(Last edited by danitool on 16 Feb 2012, 14:49)

sorry, I have never build a image bevore.
where shall I apply this diff files and where can i get a trunk image builder?

Install the needed applications for building like svn and other stuff and get the build tree:

svn co svn://

then apply the patches

patch -p0 -i CT-6373-1_network.diff
patch -p0 -i image.diff

drop CT-6373-1.patch into the trunk/target/linux/brcm63xx/patches-3.0/ directory

make menuconfig

select your target, and the stuff you want for your firmware
and make the world:

make V=99

(Last edited by danitool on 16 Feb 2012, 15:51)

i compiled it and uploaded the new firmware but the router was not reachable anymore.
perhaps i forgot some checkboxes in the "make menuconfig"
now i installed your firmware again :-(

If you have a serial port, you can locate where is the problem. You can post here the bootlog, it might be a negligible error.

Here the Log

CFE version 1.0.37-10.1-1 for BCM96358 (32bit,SP,BE)
Build Date: Fri Jun 22 16:26:35 CST 2007 (root@rd4-linux)
Copyright (C) 2000-2006 Broadcom Corporation.

Boot Address 0xbe000000

Initializing Arena.
Initializing Devices.
Parallel flash device: name STM29W640FB, id 0x22fd, size 8192KB
CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
CPU running TP0
Total memory: 33554432 bytes (32MB)

Total memory used by CFE:  0x80401000 - 0x805282D0 (1209040)
Initialized Data:          0x8041D950 - 0x8041FB00 (8624)
BSS Area:                  0x8041FB00 - 0x804262D0 (26576)
Local Heap:                0x804262D0 - 0x805262D0 (1048576)
Stack Area:                0x805262D0 - 0x805282D0 (8192)
Text (code) segment:       0x80401000 - 0x8041D948 (117064)
Boot area (physical):      0x00529000 - 0x00569000
Relocation Factor:         I:00000000 - D:00000000

Board IP address                  :  
Host IP address                   :  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Board Id (0-12)                   : CT6373-1  
Number of MAC Addresses (1-32)    : 11  
Base MAC Address                  : 64:68:0c:f5:d0:e6  
PSI Size (1-64) KBytes            : 24  
Main Thread Number [0|1]          : 0  

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Booting from only image (0xbe010000) ...
Code Address: 0x80010000, Entry Address: 0x80010000
Decompression OK!
Entry at 0x80010000
Closing network.
Starting program at 0x80010000
[    0.000000] Linux version 3.0.18 (user@lubuntu) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Thu Feb 16 14:35:11 EST 2012
[    0.000000] Detected Broadcom 0x6358 CPU revision a1
[    0.000000] CPU frequency is 300 MHz
[    0.000000] 32MB of RAM installed
[    0.000000] registering 40 GPIOs
[    0.000000] board_bcm963xx: Boot address 0xbe000000
[    0.000000] board_bcm963xx: CFE version: 1.0.37-10.1
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0002a010 (Broadcom BMIPS4350)
[    0.000000] board_bcm963xx: board name: CT6373-1
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00002000
[    0.000000] Movable zone start PFN for each node
[    0.000000] early_node_map[1] active PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00002000
[    0.000000] Reserving 0MB of memory at 0MB for crashkernel
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line:  root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[    0.000000] P299.26 BogoMIPS (lpj=598528)
[    0.036000] pid_max: default: 32768 minimum: 301
[    0.040000] Mount-cache hash table entries: 512
299.26 BogoMIPS (lpj=598528)
[    0.036000] pid_max: default: 32768 minimum: 301
[    0.040000] Mount-cache hash table entries: 512
.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Primary instruction cache 32kB, VIPT, 2-way, linesize 16 bytes.
[    0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.000000] Memory: 29568k/32768k available (2108k kernel code, 3200k reserved, 362k data, 172k init, 0k highmem)
[    0.000000] NR_IRQS:128
[    0.000000] Calibrating delay loop... [    0.052000] NET: Registered protocol family 16
[    0.064000] registering PCI controller with io_map_base unset
[    0.072000] bio: create slab <bio-0> at 0
[    0.096000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30001fff]
[    0.100000] pci 0000:00:01.0: BAR 0: set to [mem 0x30000000-0x30001fff] (PCI address [0x30000000-0x30001fff])
[    0.104000] Switching to clocksource MIPS
[    0.116000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
[    0.192000] ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0
[    0.200000] NET: Registered protocol family 2
[    0.204000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.212000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.220000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.228000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.236000] TCP reno registered
[    0.236000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.244000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.252000] NET: Registered protocol family 1
[    0.260000] audit: initializing netlink socket (disabled)
[    0.264000] type=2000 audit(0.264:1): initialized
[    0.272000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.276000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.288000] msgmni has been set to 57
[    0.292000] io scheduler noop registered
[    0.296000] io scheduler deadline registered (default)
[    0.304000] bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0100 (irq = 10) is a bcm63xx_uart
[    0.312000] console [ttyS0] enabled, bootconsole disabled
[    0.312000] console [ttyS0] enabled, bootconsole disabled
[    0.328000] bcm963xx-flash bcm963xx-flash.0: 0x02000000 at 0x1e000000
[    0.332000] bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000020 Chip ID 0x0022fd
[    0.344000] Amd/Fujitsu Extended Query Table at 0x0040
[    0.348000]   Amd/Fujitsu Extended Query version 1.3.
[    0.356000] number of CFI chips: 1
[    0.356000] bcm963xx_flash: Read Signature value of CFE1CFE1
[    0.364000] bcm963xx-flash bcm963xx-flash.0: CFE bootloader detected
[    0.372000] bcm963xx_flash: CFE boot tag found with version 6 and board type CT6373-1
[    0.380000] bcm963xx_flash: Partition 0 is CFE offset 0 and length 10000
[    0.384000] bcm963xx_flash: Partition 1 is kernel offset 10100 and length dff00
[    0.392000] bcm963xx_flash: Partition 2 is rootfs offset f0000 and length 700000
[    0.400000] bcm963xx_flash: Partition 3 is nvram offset 7f0000 and length 10000
[    0.408000] bcm963xx_flash: Partition 4 is linux offset 10000 and length 7e0000
[    0.416000] bcm963xx_flash: Spare partition is 330000 offset and length 4c0000
[    0.424000] Creating 5 MTD partitions on "bcm963xx":
[    0.428000] 0x000000000000-0x000000010000 : "CFE"
[    0.436000] 0x000000010100-0x0000000f0000 : "kernel"
[    0.440000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.456000] 0x0000000f0000-0x0000007f0000 : "rootfs"
[    0.468000] mtd: partition "rootfs" set to be root filesystem
[    0.472000] mtd: partition "rootfs_data" created automatically, ofs=320000, len=4D0000 
[    0.480000] 0x000000320000-0x0000007f0000 : "rootfs_data"
[    0.488000] 0x0000007f0000-0x000000800000 : "nvram"
[    0.500000] 0x000000010000-0x0000007f0000 : "linux"
[    0.512000] bcm63xx-wdt bcm63xx-wdt.0:  started, timer margin: 30 sec
[    0.524000] TCP westwood registered
[    0.528000] NET: Registered protocol family 17
[    0.532000] 802.1Q VLAN Support v1.8
[    0.544000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    0.556000] Freeing unused kernel memory: 172k freed
awk: /proc/cpuinfo: No such file or directory
[    3.020000] roboswitch: Probing device eth0: found a 5325! It's a 5350.
[    4.076000] There is already a switch registered on the device 'eth0'
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
[    8.656000] JFFS2 notice: (292) jffs2_build_xattr_subsystem: complete building xattr subsystem, 22 of xdatum (0 unchecked, 21 orphan) and 25 of xref (0 dead, 21 orphan) found.
switching to jffs2
- init -

Please press Enter to activate this console. [   31.404000] There is already a switch registered on the device 'eth0'
[   32.884000] wl: module license 'unspecified' taints kernel.
[   32.892000] Disabling lock debugging due to kernel taint
[   32.996000] SSB/BCMA glue driver successfully attached
[   33.024000] wl0: Broadcom BCM4318 802.11 Wireless Controller
[   33.056000] Button Hotplug driver version 0.4.1
[   33.104000] PPP generic driver version 2.4.2
[   33.200000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   33.404000] NET: Registered protocol family 24
[   33.460000] nf_conntrack version 0.5.0 (464 buckets, 1856 max)
[   33.792000] input: gpio-buttons as /devices/platform/gpio-buttons.0/input/input0

did the bootlog end with?

[   33.792000] input: gpio-buttons as /devices/platform/gpio-buttons.0/input/input0

No errors reported, I can't locate any problem. Did the the router hang at this point?

Also you can check if you have the file


I don't know if the board structure I've defined for your router is causing some trouble. You can check it at


at the line 2039 is defined your board, you can edit, delete the defined button for example, then save, delete the associated binary board_bcm963xx.o file and make V=99 again

(Last edited by danitool on 17 Feb 2012, 18:35)

now I flashed one more time my self compiled image and unchecked "keep settings" in Luci.
Now its working. 
Is this normal?
With your Firmware I could set wifi power to 20db.
With mine the max is 18db. Have you used an other wifi driver?

(Last edited by netbus on 17 Feb 2012, 20:20)