Skip to content

bcm53xx: add support for D-Link DIR-868L B1#20684

Open
LTe wants to merge 1 commit intoopenwrt:mainfrom
LTe:bcm53xx-dir868l-b1
Open

bcm53xx: add support for D-Link DIR-868L B1#20684
LTe wants to merge 1 commit intoopenwrt:mainfrom
LTe:bcm53xx-dir868l-b1

Conversation

@LTe
Copy link
Copy Markdown

@LTe LTe commented Nov 7, 2025 •
edited
Loading

Add support for D-Link DIR-868L B1 wireless router based on BCM47081 SoC with 256 MB RAM and 128 MB NAND flash.

Device Specifications

Component Specification
SoC Broadcom BCM47081 (ARM Cortex-A9, single core, ~800 MHz)
RAM 256 MB DDR3
Flash 128 MB NAND
WLAN 2x Broadcom BCM4360 (2.4GHz 3x3 + 5GHz 3x3, AC1750)
Ethernet 5x 1GbE (BCM53012 switch, 1 WAN + 4 LAN)
USB 1x USB 3.0
LEDs Power (green/amber), WAN (green/amber), USB (white)
Buttons WPS, Reset
Serial Yes, 115200 8N1
Bootloader U-Boot

Obtaining Device Access

Physical access to the running device was obtained through CVE-2018-19988, a critical OS command injection vulnerability in the HNAP (Home Network Administration Protocol).

Telnet Access Achieved:

$ telnet 192.168.0.1
BusyBox v1.14.1 (2015-04-19 15:55:54 CST) built-in shell (msh)
# id
uid=0(root) gid=0(root)
# uname -a
Linux dlinkrouter 2.6.36.4brcmarm+ #1 SMP PREEMPT Sun Apr 19 15:24:40 CST 2015 armv7l GNU/Linux

Hardware Information Gathering

With root shell access via telnet, comprehensive hardware information was collected:

CPU Information

# cat /proc/cpuinfo
Processor       : ARMv7 Processor rev 0 (v7l)
processor       : 0
BogoMIPS        : 1599.07
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x3
CPU part        : 0xc09  # ARM Cortex-A9
CPU revision    : 0

Memory

# cat /proc/meminfo
MemTotal:        254936 kB  # 256 MB RAM

Flash Partition Layout

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"      # 256 KB, 64 KB erase blocks
mtd1: 00010000 00010000 "devconf"     #  64 KB, 64 KB erase blocks
mtd2: 00010000 00010000 "devdata"     #  64 KB, 64 KB erase blocks
mtd3: 00170000 00010000 "mydlink"     # 1.4 MB, 64 KB erase blocks
mtd4: 00020000 00010000 "langpack"    # 128 KB, 64 KB erase blocks
mtd5: 00010000 00010000 "nvram"       #  64 KB, 64 KB erase blocks
mtd6: 00200000 00010000 "flash"       #   2 MB, 64 KB erase blocks (SPI)
mtd7: 02000000 00020000 "upgrade"     #  32 MB, 128 KB erase blocks
mtd8: 01e3ffa0 00020000 "rootfs"      # ~30 MB, 128 KB erase blocks
mtd9: 08000000 00020000 "nflash"      # 128 MB, 128 KB erase blocks (total)
mtd10: 06000000 00020000 "storage"    #  96 MB, 128 KB erase blocks

GPIO Mappings:

  • Power LED (green): GPIO 2 (active low)
  • Power LED (amber): GPIO 0 (active low)
  • WAN LED (amber): GPIO 1 (active low)
  • WAN LED (green): GPIO 3 (active low)
  • USB LED (white): GPIO 10 (active low)
  • WPS button: GPIO 7 (active low)
  • Reset button: GPIO 11 (active low)

Installation

Method 1: Stock Firmware Web Interface (Recommended)

  1. Build OpenWrt SEAMA factory image:

    make target/linux/bcm53xx

  2. Generated image location:

    bin/targets/bcm53xx/generic/openwrt-bcm53xx-generic-dlink_dir-868l-b1-squashfs.bin

  3. Flash via D-Link web interface:

    • Login to http://192.168.0.1
    • Navigate to Firmware Upgrade
    • Upload OpenWrt bin file
    • Wait for flash and automatic reboot

Method 2: D-Link Recovery Mode

  1. Power off router
  2. Hold Reset button
  3. Power on while holding Reset (power LED will flash)
  4. Access http://192.168.0.1 (recovery web interface)
  5. Upload firmware
  6. Wait for completion and reboot

Related: #3964

@github-actions github-actions bot added the target/bcm53xx pull request/issue for bcm53xx target label Nov 7, 2025
@LTe LTe marked this pull request as ready for review November 7, 2025 14:17
@hauke
Copy link
Copy Markdown
Member

hauke commented Nov 9, 2025

Please refresh the patches with make target/{clean,refresh} V=99

@LTe LTe force-pushed the bcm53xx-dir868l-b1 branch 3 times, most recently from 5394ce4 to 69f7739 Compare March 17, 2026 18:04
@LTe
Copy link
Copy Markdown
Author

LTe commented Mar 17, 2026

@hauke updated

@github-actions github-actions bot added the core packages pull request/issue for core (in-tree) packages label Mar 17, 2026
@LTe LTe force-pushed the bcm53xx-dir868l-b1 branch from 69f7739 to a2fc661 Compare March 18, 2026 05:24
@LTe
bcm53xx: add support for D-Link DIR-868L B1
540d131 
Add support for D-Link DIR-868L B1 wireless router based on
BCM47081 SoC with 256 MB DDR2 RAM and 128 MB NAND flash.

Hardware specifications:
- SoC: Broadcom BCM47081 (ARM Cortex-A9, single core, 800 MHz)
- RAM: 256 MB DDR2 (128 MB @ 0x00000000 + 128 MB @ 0x88000000)
- Flash: 128 MB NAND (Spansion S34ML01G, BCH-8 ECC) + 2 MB SPI NOR
- WiFi: BCM4331 (2.4 GHz) + BCM4360 (5 GHz) - no open-source driver
- Ethernet: BCM53011 5-port GbE switch (4 LAN + 1 WAN)
- USB: 1x USB 3.0 + 1x USB 2.0
- Firmware format: SEAMA

U-Boot is used as a shim bootloader because CFE's LZMA decompressor
only handles the first 2 MB and the kernel exceeds this limit.
Uses stock upstream U-Boot (bcmns config) with no patches.

Installation via D-Link recovery mode web interface.

Signed-off-by: Piotr Niełacny <[email protected]>
@LTe LTe force-pushed the bcm53xx-dir868l-b1 branch from a2fc661 to 540d131 Compare March 18, 2026 07:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

core packages pull request/issue for core (in-tree) packages target/bcm53xx pull request/issue for bcm53xx target

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@LTe @hauke