Install OpenWrt on P.RG AV4202N router

AV4202N is an xDSL modem and WiFi router based on the BCM6368 SoC manufactured by Broadcom. The CPU has 2 cores running at 400 MHz, with 64 MB RAM and 16 MB flash memory. It also has 2 USB 2.0 ports and 2 WiFi internal antennas.

Currently, although the BCM63xx platform is supported by OpenWrt, there are no releases for this device. Neither LEDE Project has released a stable build for this device, but they are offering a development snapshot [3]. The problem with LEDE snapshots is that they don't work out of the box without additional software packages (you don’t get any web interface).

But, LEDE can’t be installed on the device due to the locked bootloader. This article will show you how to use JTAG to install a different bootloader that can be used to flash OpenWRT/LEDE firmware. Part 2 details LEDE configuration and internet connection.

Note! If the mentioned device was offered to you by an ISP for xDSL internet access, doing what is described next will void the warranty of the device and make it unusable. You should not attempt to change firmware in this situation. Third party firmware does not support xDSL!

Make a buffered JTAG adapter (Wiggler)

JTAG is an in-circuit programming and debugging interface. It specifies the use of a dedicated debug port implementing a serial communications interface for low-overhead access without requiring direct external access to the system address and data buses. The interface connects to an on-chip test access port (TAP) that implements a stateful protocol to access a set of test registers that present chip logic levels and device capabilities of various parts.

JTAG interface is supported by many devices as a convenient way of rewriting firmware (specially boot loaders) when other methods fail. Using JTAG, the ROM memory can be directly written without desoldering it from PCB to program it using a specific programmer.

In most cases, you will need JTAG access to a device with a no longer working bootloader. Otherwise, if the bootloader runs, there should be easier ways of debricking the deice. Most of the times, a device with corrupt bootloader will not display any signs of working (i.e. no LEDs turned on in case of routers, no display on front panel of set-top-boxes). Nor any ports of the device will work (i.e. no serial port response, no network detected).

Debrick Huawei HG553 (BCM6358 based router)

Huawei Echolife HG553 is an ADSL2+ modem with WiFi router which was used by some ISP companies in Italy and Spain. The device features a Broadcom BCM6358 dual core processor clocked at 300 MHz with 64 MB RAM. The operating system is stored in a 16 MB flash memory.

The original firmware doesn't offer too many options, but there are alternate firmwares, including OpenWrt which turns this router into a highly configurable network device. If you want to use it for ADSL line, Roleo firmware (D-Link based) is the best choice. For all the other things, OpenWrt remains the best option.

Unlocking and firmware installation procedures are described in various sites. One example is OpenWrt dedicated wiki page for HG553. This post will describe the ultimate debricking procedure: writing bootloader via JTAG. After an unsuccessful firmware update and a forced restart, my router became completely unresponsive. Neither the power LED was on when powered. Reset, Failsafe mode, Telnet for this device didn't exist anymore. In this cases, there is only one solution left: JTAG.

Huawei HG553 main board