Just use OpenWrt
This is experimental support for OpenWrt, I am upstreaming all patches but that requires actual work and takes time. It may eat your dog.
- Download factory-2026-10-20.y3
- Install this from the UI on the router.
- Maybe the normal UI on the router has a way to download y3 firmware files? I don't know, I reflashed mine.
- One way to get into this is to mount a UART and hammer ENTER after turning on power so you get the CFE> prompt
- At this point the device presents a web download UI at http://192.168.1.1/ if you statically configure your host as e.g. 192.168.1.2.
- Download and flash the new firmware using that UI.
- Your device has OpenWrt, enjoy.
UART Hacking Howto
- Mount a UART on your XG6846B. This is exactly the same UART as used by the predessor Inteno XG6846.
- Set up a TFTP server on your host computer
- Get uboot-0x03000000.bin
- Get latest zImage that I cooked up
- Plug local ethernet into one of the LAN ports (yellow)
- Power on the device
- Break into CFE on the UART (just hammer ENTER when the memory test is scrolling by)
- Wait for any screen noise to settle while ethernet plugs are detected etc
-
loadb n 0x03000000 192.168.1.2:uboot-0x03000000.bin go 0x03000000 loady
- Then send the kernel zImage using ymodem (such as Ctrl+A S in minicom)
- You will see that U-Boot has been preconfigured to load the kernel at 0x00200000 (we have some reserved memory at 0x00000000 for things like PSCI so we can't load the kernel there).
- Wait for the 6.8 MB to upload to target...
- go 0x00200000 to execute the kernel.
Status
- 2026-10-20 Actually all of OpenWrt with ethernet and all works now...
- 2026-10-12 Managed to bring the secondary CPU online (patch).
- 2024-10-19 Merged the basic device tree for the XG6846B to the Linux kernel
- 2024-10-19 Improved the BCM6846 device tree with random number generator, watchdog, GPIO blocks, MDIO control block, LED controller and PL081 DMA block. (Later on, I also patched similar additions to all the other BCMBCA SoCs because why not, I had the speed going...
- 2024-09-17 Enabled MTD NAND and poked around in the NAND flash using U-Boot
- 2024-09-10 Managed to boot a very stripped-down Linux (just one CPU) from U-Boot
- 2024-09-08 Managed to execute U-Boot at 0x03000000
Kernel TODO
Admittedly I make very slow progress with this SoC so it would be great if others could try to help out...
- BCMBCA PMB clock, reset and HWMON development branch. One patch iteration posted.
- XRDP Ethernet development branch, can't post this before the above is merged.
- Make the secondary CPU boot - apparently only one of the CPU cores support NEON instructions. The DTSI claims the CPU is to be booted with PSCI, but sources seem so be using hidden registers in the GPIO block to boot the secondary CPU. Proposed patch that works!
- Get the network going - this is the real trick. See the image on the side.
- The Marvell MC88E6320 switch is connected to the SoC using MDIO.
- WAN networking is connected directly to the Marvell MV88E6320 DSA switch using serdes, and the BCM68460 serdes driver is missing in the Linux kernel.
- The physical LAN ethernet ports are connected to the BCM68460 SoC where they appear on the MDIO link, but the actual LAN traffic goes through the MV88E6320 switch, and the RGMII is looped back from the switch to the SoC.
- All traffic is using the runner accelerator: all the networking in the switch achieve speed by using this accelerator.
OpenWrt TODO
- OpenWrt development branch for XG6846B.
Links
- BCM96846 hack branch for U-Boot - subject to constant change and including all my uglyhacks
- bcm6846-uboot.mak the Makefile that I use to reconfigure and build U-Boot
- Linux kernel sources - subject to constant change and including all my uglyhacks
- bcm6846.mak the Makefile that I use to reconfigure and build the kernel
- Source code to some Broadcom drivers that are used in this SoC/device