I got one of these from a flea market.

I did some exploration after finding the serial port.
J1 appeared to work but quit after I installed openwrt.
J505 square pin 1 ground
                   pin 2 tx out
                   pin 3 rx in
On boot up of original firmware:
CFE version 1.0.37-102.9.2 for BCM96368 (32bit,SP,BE)
Build Date: Thu Mar 31 11:18:06 PST 2011 (bcm@localhost.localdomain)
Copyright (C) 2000-2009 Broadcom Corporation.

Parallel flash device: name AM29LV320MT, id 0x2201, size 32768KB
ethsw_mdio_wreg: timeout!
ethsw_mdio_wreg: timeout!
CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz
CPU running TP0
Total memory: 67108864 bytes (64MB)
Boot Address 0xb8000000

Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host (f/h)         : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Boot image (0=latest, 1=previous) : 0
Board Id (0-11)                   : 96368MVWG
Number of MAC Addresses (1-32)    : 8
Base MAC Address                  : 00:26:88:02:a0:e0
PSI Size (1-64) KBytes            : 64
Main Thread Number [0|1]          : 0
Board Serial Number               : CVGR0401505011
Factory FW Version                : 31.30L.55
WPS PIN                           : 89046968
WPA KEY                           : 17820076692eb1a77761441270

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Booting from latest image (0xb8020000) ...
Code Address: 0x80010000, Entry Address: 0x802a5000
Decompression OK!
Entry at 0x802a5000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x802a5000
Linux version 2.6.21.5 (bcm@localhost.localdomain) (gcc version 4.2.3) #1 Thu Mar 31 11:24:30 PST 2011
Parallel flash device: name AM29LV320MT, id 0x2201, size 32768KB
96368MVWG prom init
CPU revision is: 0002a031
Determined physical RAM map:
memory: 03f00000 @ 00000000 (usable)
On node 0 totalpages: 16128
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 94 pages used for memmap
  Normal zone: 11938 pages, LIFO batch:1
Built 1 zonelists.  Total pages: 16002
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 64kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (21 instructions).
Synthesized TLB load handler fastpath (33 instructions).
Synthesized TLB store handler fastpath (33 instructions).
Synthesized TLB modify handler fastpath (32 instructions).
PID hash table entries: 256 (order: 8, 1024 bytes)
Usýÿ

CFE version 1.0.37-102.9.2 for BCM96368 (32bit,SP,BE)
Build Date: Thu Mar 31 11:18:06 PST 2011 (bcm@localhost.localdomain)
Copyright (C) 2000-2009 Broadcom Corporation.

Parallel flash device: name AM29LV320MT, id 0x2201, size 32768KB
ethsw_mdio_wreg: timeout!
ethsw_mdio_wreg: timeout!
CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz
CPU running TP0
Total memory: 67108864 bytes (64MB)
Boot Address 0xb8000000
Hold the reset on power up until power light turns red. This also enables a web page 192.168.1.1 to flash firmware.

CFE> help
Available commands:

sm                  Set memory or registers.
dm                  Dump memory or registers.
w                   Write the whole image start from beginning of the flash
e                   Erase [n]vram or [a]ll flash except bootrom
r                   Run program from flash image or from host depend on [f/h] flag
p                   Print boot line and board parameter info
c                   Change booline parameters
f                   Write image to the flash
i                   Erase persistent storage data
b                   Change board parameters
reset               Reset the board
flashimage          Flashes a compressed image after the bootloader.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0

To change board type enter "b"
CFE> b
Press:  <enter> to use current value
        '-' to go previous parameter
        '.' to clear the current value
        'x' to exit this command
96368VVW         ------- 0
96368MVWG        ------- 1
96368SV2         ------- 2
96369PVG         ------- 3
GM684WG          ------- 4
GH684WG          ------- 5
VB784WG          ------- 6
VB681            ------- 7
R1000H           ------- 8
V1000H           ------- 9
V1000            ------- 10
96368MBG         ------- 11
Board Id (0-11)                   :  0  x
*** command status = 0

I used http://downloads.openwrt.org/attitude_a … 8k-cfe.bin as it had the correct board type. Others would not flash or had issues.

I used the original V1000h selection to upload the openwrt firmware, then interrupted the boot process and selected 96368MVWG        ------- 1. I kept hiting enter until I was out and the booting started again.

Reverse the order that is reselect (9) V1000h to re-flash a new firmware and then repeat the process as above.

It boots up ok wifi and usb works. Etherports are dead. Probably the bcm53115 switch config or driver.
I haven't figured that out yet.

Some openwrt boot info:
BusyBox v1.19.4 (2012-11-18 11:01:03 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
|       |.-----.-----.-----.|  |  |  |.----.|  |_
|   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
|_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
-----------------------------------------------------
ATTITUDE ADJUSTMENT (12.09-rc1, r34185)
-----------------------------------------------------
  * 1/4 oz Vodka      Pour all ingredients into mixing
  * 1/4 oz Gin        tin with ice, strain into glass.
  * 1/4 oz Amaretto
  * 1/4 oz Triple sec
  * 1/4 oz Peach schnapps
  * 1/4 oz Sour mix
  * 1 splash Cranberry juice
-----------------------------------------------------
root@OpenWrt:/# dmesg
[    0.000000] Linux version 3.3.8 (blogic@Debian-60-squeeze-64-minimal) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Sun Nov 18 13:11:17 UTC 2012
[    0.000000] Detected Broadcom 0x6368 CPU revision b1
[    0.000000] CPU frequency is 400 MHz
[    0.000000] 64MB of RAM installed
[    0.000000] registering 38 GPIOs
[    0.000000] gpiochip_add: registered GPIOs 0 to 37 on device: bcm63xx-gpio
[    0.000000] board_bcm963xx: Boot address 0xb8000000
[    0.000000] board_bcm963xx: CFE version: 1.0.37-102.9
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0002a031 (Broadcom BMIPS4350)
[    0.000000] board_bcm963xx: board name: 96368MVWG
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00004000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00004000
[    0.000000] On node 0 totalpages: 16384
[    0.000000] free_area_init_node: node 0, pgdat 802dab40, node_mem_map 81000000
[    0.000000]   Normal zone: 128 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16256 pages, LIFO batch:3
[    0.000000] Reserving 0MB of memory at 0MB for crashkernel
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.000000] Memory: 61512k/65536k available (2358k kernel code, 4024k reserved, 501k data, 204k init, 0k highmem)
[    0.000000] NR_IRQS:128
[    0.000000] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648)
[    0.032000] pid_max: default: 32768 minimum: 301
[    0.036000] Mount-cache hash table entries: 512
[    0.044000] NET: Registered protocol family 16
[    0.052000] registering PCI controller with io_map_base unset
[    0.056000] registering PCI controller with io_map_base unset
[    0.064000] bio: create slab <bio-0> at 0
[    0.068000] PCI host bridge to bus 0000:00
[    0.072000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff]
[    0.076000] pci_bus 0000:00: root bus resource [io  0x8000000-0x8007fff]
[    0.080000] pci 0000:00:01.0: [14e4:432b] type 0 class 0x000280
[    0.080000] pci 0000:00:01.0: reg 10: [mem 0x00000000-0x00003fff]
[    0.092000] pci 0000:00:01.0: supports D1 D2
[    0.092000] pci 0000:00:01.0: PME# supported from D0 D3hot D3cold
[    0.092000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30003fff]
[    0.096000] PCI host bridge to bus 0000:01
[    0.100000] pci_bus 0000:01: root bus resource [mem 0x38000000-0x3fffffff]
[    0.104000] pci_bus 0000:01: root bus resource [io  0x8008000-0x800ffff]
[    0.108000] pci 0000:01:1e.0: [14e4:6368] type 2 class 0x000607
[    0.108000] pci 0000:01:1e.0: CardBus bridge to [bus 02-05]
[    0.112000] pci 0000:01:1e.0:   bridge window [io  0x0001-0x0000]
[    0.116000] pci 0000:01:1e.0:   bridge window [io  0x0001-0x0000]
[    0.120000] pci 0000:01:1e.0:   bridge window [mem 0x00000001-0x00000000]
[    0.124000] PCI: Enabling device 0000:01:1e.0 (0000 -> 0003)
[    0.128000] pci 0000:01:1e.0: setting latency timer to 64
[    0.128000] Switching to clocksource MIPS
[    0.132000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
[    0.140000] b43-pci-bridge 0000:00:01.0: setting latency timer to 64
[    0.164000] ssb: Found chip with id 0x4322, rev 0x01 and package 0x09
[    0.172000] ssb: Core 0 found: ChipCommon (cc 0x800, rev 0x17, vendor 0x4243)
[    0.172000] ssb: Core 1 found: IEEE 802.11 (cc 0x812, rev 0x10, vendor 0x4243)
[    0.172000] ssb: Core 2 found: PCI-E (cc 0x820, rev 0x0B, vendor 0x4243)
[    0.172000] ssb: Core 3 found: PCI (cc 0x804, rev 0x0E, vendor 0x4243)
[    0.172000] ssb: Core 4 found: USB 2.0 Device (cc 0x81A, rev 0x05, vendor 0x4243)
[    0.172000] ssb: Core 5 found: ARM Cortex M3 (cc 0x82A, rev 0x00, vendor 0x4243)
[    0.172000] ssb: Core 6 found: Internal Memory (cc 0x80E, rev 0x03, vendor 0x4243)
[    0.232000] ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0
[    0.240000] NET: Registered protocol family 2
[    0.244000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.252000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[    0.260000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.268000] TCP: Hash tables configured (established 2048 bind 2048)
[    0.272000] TCP reno registered
[    0.276000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.284000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.292000] NET: Registered protocol family 1
[    0.296000] PCI: CLS 0 bytes, default 16
[    0.296000] audit: initializing netlink socket (disabled)
[    0.304000] type=2000 audit(0.304:1): initialized
[    0.308000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.312000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.324000] msgmni has been set to 120
[    0.328000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[    0.336000] io scheduler noop registered
[    0.340000] io scheduler deadline registered (default)
[    0.348000] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 10) is a bcm63xx_uart
[    0.356000] console [ttyS0] enabled, bootconsole disabled
[    0.368000] bcm63xx-rng bcm63xx-rng: registered RNG driver
[    0.376000] physmap platform flash device: 08000000 at 18000000
[    0.380000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002201
[    0.392000] Amd/Fujitsu Extended Query Table at 0x0040
[    0.396000]   Amd/Fujitsu Extended Query version 1.3.
[    0.400000] number of CFI chips: 1
[    0.404000] bcm63xxpart: CFE boot tag found with version 6 and board type 96368MVWG
[    0.412000] bcm63xxpart: Partition 0 is CFE offset 0 and length 20000
[    0.420000] bcm63xxpart: Partition 1 is kernel offset 20100 and length fff00
[    0.428000] bcm63xxpart: Partition 2 is rootfs offset 120000 and length 1ec0000
[    0.436000] bcm63xxpart: Partition 3 is nvram offset 1fe0000 and length 20000
[    0.444000] bcm63xxpart: Partition 4 is linux offset 20000 and length 1fc0000
[    0.448000] bcm63xxpart: Spare partition is offset 3f0004 and length 1befffc
[    0.456000] 5 bcm63xxpart partitions found on MTD device physmap-flash.0
[    0.464000] Creating 5 MTD partitions on "physmap-flash.0":
[    0.468000] 0x000000000000-0x000000020000 : "CFE"
[    0.476000] 0x000000020100-0x000000120000 : "kernel"
[    0.480000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.496000] 0x000000120000-0x000001fe0000 : "rootfs"
[    0.504000] mtd: partition "rootfs" set to be root filesystem
[    0.508000] split_squashfs: no squashfs found in "physmap-flash.0"
[    0.516000] 0x000001fe0000-0x000002000000 : "nvram"
[    0.524000] 0x000000020000-0x000001fe0000 : "linux"
[    0.564000] bcm63xx-wdt bcm63xx-wdt:  started, timer margin: 30 sec
[    0.572000] Registered led device: 96368MVWG:green:adsl
[    0.572000] Registered led device: 96368MVWG:green:ppp
[    0.572000] Registered led device: 96368MVWG:green:power
[    0.572000] Registered led device: 96368MVWG:green:wps
[    0.572000] Registered led device: 96368MVWG:green:ppp-fail
[    0.572000] TCP cubic registered
[    0.576000] NET: Registered protocol family 17
[    0.580000] Bridge firewalling registered
[    0.584000] 8021q: 802.1Q VLAN Support v1.8
[    1.228000] jffs2_scan_eraseblock(): End of filesystem marker found at 0x2c0000
[    1.236000] jffs2_build_filesystem(): unlocking the mtd device... done.
[    1.244000] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
[  108.500000] JFFS2 notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  108.516000] VFS: Mounted root (jffs2 filesystem) readonly on device 31:2.
[  108.528000] Freeing unused kernel memory: 204k freed
[  110.296000] roboswitch: Probing device eth0:
[  110.304000] bcm63xx_enet: could not find a used port with phy_id 0, assuming phy is external
[  110.312000] found a 53115! It's a 5350.
[  111.352000] There is already a switch registered on the device 'eth0'
[  116.504000] Compat-drivers backport release: compat-drivers-2012-09-04-2-gddac993
[  116.512000] Backport based on wireless-testing.git master-2012-09-07
[  116.516000] compat.git: wireless-testing.git
[  116.672000] cfg80211: Calling CRDA to update world regulatory domain
[  116.676000] cfg80211: World regulatory domain updated:
[  116.684000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[  116.692000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[  116.700000] cfg80211:   (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[  116.708000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[  116.716000] cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[  116.724000] cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[  116.840000] There is already a switch registered on the device 'eth0'
[  117.364000] b43-phy0: Broadcom 4322 WLAN found (core revision 16)
[  117.416000] b43-phy0: Found PHY: Analog 8, Type 4 (N), Revision 4
[  117.444000] Broadcom 43xx driver loaded [ Features: PNL ]
[  117.484000] Button Hotplug driver version 0.4.1
[  117.628000] PPP generic driver version 2.4.2
[  117.668000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[  117.668000] Registered led device: b43-phy0::tx
[  117.668000] Registered led device: b43-phy0::rx
[  117.668000] Registered led device: b43-phy0::radio
[  117.736000] ip_tables: (C) 2000-2006 Netfilter Core Team
[  117.896000] NET: Registered protocol family 24
[  117.952000] nf_conntrack version 0.5.0 (964 buckets, 3856 max)
[  120.988000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port3, 100Mbps, full-duplex

root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
rootfs                   30.8M      3.6M     27.1M  12% /
/dev/root                30.8M      3.6M     27.1M  12% /
tmpfs                    30.1M     56.0K     30.1M   0% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:/# cat /etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option ifname 'eth1'
        option type 'bridge'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'

config interface 'wan'
        option ifname 'eth0'
        option proto 'dhcp'

Original Actiontec firmware can be had at:
http://www.actiontec.com/products/produ … d=191#soft   click on Firmware Upgrade - V1000H NCS 31.30L.33

I hope someone can use this info.

~john

Hi sorry for the late reply, if you still have this hardware and are not afraid to compile trunk, please try the instructions in the thread

 https://forum.openwrt.org/viewtopic.php?pid=212426#p212426 

.... thanks ...

I have the same router but I am not able to change the board id use the above method. is there other way to change the board ID. so far without the board id change. I get Kernel panic.

First, I could never get the switch up properly. Second I blowed it up. That is I somehow wiped the boot firmware. At this  point it is dead.

(Last edited by johnisaacson on 13 Jan 2014, 09:17)

does anyone has an instruction how to change the board id from the cfe or from the openwrt source?

Thanks.

Hi I am very new to openwrt or kernel stuff.
I follow this guide and build a image but I get kernel panic.

Can some one please help.

Thanks.

I was able to boot into openwrt, but the network is not working.

For the bcm53115 some work is needed at the kernel, also in the firmware to define proper VLANs.

A board with the same switch, with correct patching:
https://github.com/openwrt-es/barrier-b … 04d032037e

Another one (mine):
https://github.com/openwrt-es/barrier-b … 53b215b3ef

As you can see, mine uses port 8 for tagging and connecting to the CPU, the number 0 is the WAN port. Whereas the other uses the port number 5 for connecting to the CPU and 4 for WAN (more common)

I have tried to follow your link to apply the patch to the trunk, but I cannot find the correct files. The path does't exists in the trunk.

Sure, you  cannot apply patches not based in the actual trunk revisions. Those patches are only for reference, they have enough info for adapting them for your board.

If you want use them, just download the git repository they belongs to.

git clone git://github.com/openwrt-es/barrier-breaker-openwrt.git -b barrier-breaker_13.12

I am getting the b53-switch  probe of spi.0.1 failed with error -22

[    0.500000] 0x000000020000-0x000001fe0000 : "linux"
[    0.508000] bcm63xx-spi bcm63xx-spi: at 0xb0000800 (irq 9, FIFOs size 542)
[    0.528000] b53-switch: probe of spi0.1 failed with error -22
[    0.568000] bcm63xx-wdt bcm63xx-wdt:  started, timer margin: 30 sec
[    0.580000] TCP: cubic registered
[    0.584000] NET: Registered protocol family 17
[    0.588000] 8021q: 802.1Q VLAN Support v1.8
[    0.600000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[    0.608000] Freeing unused kernel memory: 240K (802f4000 - 80330000)
procd: Console is alive
procd: - watchdog -
procd: - preinit -
[    3.492000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port3, 100Mbps, full-duplex

No idea on what are you doing. Next time be more specific. 

Are you using in the spi code,?

 .chip_select = 1,

 
try with

 .chip_select = 0,

it's more common

This may help.

http://opensource.actiontec.com/r1000x.html