User Tools

Site Tools


toh:bt:homehub_v1

BT HomeHub 1.0 and 1.5

White or black boxes given away with a bt broadband subscription. It comes in two versions The V1 and the V1.5. The first noticeable difference between the two versions is the shape and size. Under the cover they are identical apart from a slight pcb revision, addition of 5 extra red led's and two extra buttons on the V1.5.

There are other routers based on the same board as the homehub V1. Known to me are: speedtouch 7g and Aolbox. There may be more.

The homehub includes ADSL2+, 802.11b/g wireless, host and slave USB ports, 2 wired ethernet ports, DECT, FXS & FXO ports and VOIP functionality.

Following the sad closure of http://psidoc.com, all members of the BT Home Hub Openwrt community are now encouraged to join in ongoing development efforts, concentrated on the Home Hub 2B, at http://openwrt.ebilan.co.uk.

Supported Versions

Not supported yet. However you can install OpenWrt (no ADSL) using a custom CFE.

Bootloader (CFE), OpenWrt prebuilt firmware, and patches to build your own firmware:
HomeHubV1-openwrt_12.09_wl-CFE.zip

Hardware Highlights

SoC Ram Flash Ethernet USB Wireless Serial JTag VOIP FXS
Broadcom BCM96348 32MB 8MB 2 Yes yes Yes Yes yes yes

OEM Flash Layout

Based on FIrmware 6.2.2.6

0x00000000-0x0003FFFF Space allocated for bootloader - includes board parameters (serial number, Board type, MAC address, etc)
0x00040000-0x000FFFFF JFFS2 User partition
0x00100000-0x0010000F Firmware version magic
0x00100010-0x001AFFFF Linux Kernel
0x001B0000-0x007FFFFF Squashfs root fs

It is somewhat different from the usual Broadcom layout. Probably due to the fact that this board does not use the CFE bootloader but uses a proprietory loader instead who's origins are unknown. This supplied bootloader is useless. I went through Tens of bootloaders before i come across a redboot loader from the inventel livebox and modified it to work with the homehub. Now i have recently discovered that this very same bootloader from the livebox is used in the Aolbox wich has a board identical to the homehub but uses different RAM memory thus the Aolbox/livebox and homehub bootloaders are not directly interchangeable.

Flash Details

You can access the flash via jtag at 1f400000 provided the homehub bootloader is running. If the loader is not running ie, bad flash you can access bootloader at 1fc00000+. The The flash chip is actually mapped at 1f800000-1fffffff while the mips boot address is 1fc00000 (half way through the physical flash address). The hub bootloader actally remaps the 4MB at 1fc00000 back before the physical start of the flash. Eg, actual 1f800000-1fffffff # copy 1fc00000-1fffffff to 1f400000 # now the flash lives at 1f400000-1fbfffff.

Installation

Flash Layout

Please check out the article Flash.Layout. It contains an example and a couple of explanations.

CFE easy installation

This section deals with how you install OpenWrt once the OEM bootloader is replaced by a new CFE.

  • Unplug the power cord
  • Press the button labeled as reset, don't release it yet!
  • Plug the power cord
  • Wait 10 seconds
  • Release the reset button
  • Select .bin file
  • Upgrade the image
  • Wait for it to reboot
  • Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed. or browse to http://192.168.1.1 if LuCI is installed.

OEM installation using the TFTP method

Upgrading OpenWrt

generic.sysupgrade

If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

LuCI Web Upgrade Process

Terminal Upgrade Process

  • Login as root via SSH on 192.168.1.1
  • Use the following commands to upgrade.

cd /tmp/
wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
sysupgrade /tmp/xxx.abc

  • If sysupgrade does not support this router, use the following commands.

cd /tmp/
wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc
mtd write /tmp/xxx.abc linux && reboot

Basic configuration

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

Specific Configuration

Interfaces

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi 192.168.1.1/24
eth0 WAN dhcp
eth1 LAN bridged
wlan0 WiFi disabled

Failsafe mode

Buttons

hardware.button on howto use and configure the hardware button(s).

The HomeHub1 has only 1 button

BUTTON Event
Reset reset

Hardware

Info

Instruction set: MIPS
Vendor: Broadcom
Bootloader: Unknown (custom Thomson)
Can be replaced by CFE
System-On-Chip: BCM6348
CPU/Speed BMIPS3300 V0.7 / 256 MHz
Flash-Chip: Spansion S29GL064A11TFIR4, 64Mbit, 8MByte, Pointless bottom boot blocks
Flash size: 8 MiB
RAM-Chip: Qimonda HYB39SC256160FE-7, 8Mbitx16bit, 32MByte, 133MHz
RAM size: 32 MiB
Wireless: BCM4318 802.11b/g (onboard), using seperate radio amplifier and diversity switch via pci
Ethernet: 1x internal PHY + 1x external PHY (Altima AC101 MII PHY)
Internet: ADSL2+, not supported in OpenWrt
USB: Yes
DECT: Philips/NXP PCD80705 Baseband DECT processor via spi
Slic: Silicon Labs si3230 ProSLIC
Serial: Yes
JTAG: Yes

Photos

There are plenty of pictures of the homehub on the internet so i wont fill this space with its cover on.

2q8sz1i.jpg 2dvoqxu.jpg

Board:

HomeHub V1 HomeHub V1.5
Top view Top view
This one has had its led wiring changed to suit the Speedtouch 7G firmware Note the extra 2 buttons and their position and the shape of the board. The led's are now on the other side too.
Bottom view Bottom view
Note changes to the led type. They are now tri colour (green+red=orange). I have fitted it with a crude jtag connector.

GPIOs

port.gpio general information about GPIO

V1

1t54ic.jpg

LEDS 2up8mew.jpg
label color GPIO active
Lan Activity green 0 high
Upgrade green 1 high
Broadband (ADSL) green 2 high
WiFi green 3 high
Phone (icon) green 4 high
BUTTONS
name GPIO active
reset 36 low

V1.5

LEDS
label color GPIO active
FIXME green 0 FIXME
FIXME green 1 FIXME
FIXME green 2 FIXME
FIXME green 3 FIXME
FIXME green 4 FIXME
FIXME red 5 FIXME
FIXME red 22 FIXME
FIXME red 7 FIXME
FIXME red 29 FIXME
FIXME red 30 FIXME
BUTTONS
name GPIO active
reset 35 FIXME
WPS 36 FIXME

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
- Solder a 4 pin header - Use a TTL serial cable

Photo of PCB with markings
1zof0uv.jpg

Settings:

  • Baudrate: 112500
  • Data bits: 8
  • Parity: None
  • Stop bits: 1

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

For reading/writing to the flash you can use UrJTAG (latest svn). UrJTAG is able to operate in DMA mode with bcm63xx boards, then it's faster than hairydairymaid.

Backup whole flash

  1. Connect your JTAG cable from your computer to your board
  2. Execute UrJTAG in root mode:
    sudo jtag
  3. Power on the board
  4. Immediately execute these commands:
    cable dlc5 ppdev /dev/parport0
    detect
    endian big
    initbus ejtag_dma
    detectflash 0x1f800000
    readmem 0x1f800000 0x800000 homehub1_backup.bin

Restore whole flash

  1. Connect your JTAG cable from your computer to your board
  2. Execute UrJTAG in root mode:
    sudo jtag
  3. Power on the board
  4. Immediately execute these commands:
    cable dlc5 ppdev /dev/parport0
    detect
    endian big
    initbus ejtag_dma
    detectflash 0x1f800000
    flashmem 0x1f800000 homehub1_backup.bin

Flashing a bootloader

  1. Connect your JTAG cable from your computer to your board
  2. Execute UrJTAG in root mode:
    sudo jtag
  3. Power on the board
  4. Immediately flash the new bootloader:
    cable dlc5 ppdev /dev/parport0
    detect
    endian big
    initbus ejtag_dma
    detectflash 0x1f800000
    flashmem 0x1fc00000 CFE_homehub1-nvr.bin

Debricking

Bootloader Mods

  1. you could read about bootloader in general

Hardware mods

  1. as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

BOOTLOGS

OEM bootlog

Decompressing Bootloader................................. Speedtouch initialization sequence started. BOOTING THE THOMSON LINUX KERNEL Starting the kernel @ 0x801bc018 serial initialized Linux version 2.6.8.1 (debusb@cplx82.edegem.eu.thmulti.com) (gcc version 3.4.2) #1 Mon Nov 12 09:53:50 CET 2007 CPU revision is: 00029107 bcm63xx : initiazation of mpi bus ............... Determined physical RAM map: memory: 01f7d000 @ 00002000 (usable) On node 0 totalpages: 8063 DMA zone: 4096 pages, LIFO batch:1 Normal zone: 3967 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=/dev/mtdblock1 rootfstype=squashfs brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 8kB 2-way, linesize 16 bytes. PID hash table entries: 128 (order 7: 1024 bytes) Using 128.000 MHz high precision timer. Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 29968k/32244k available (1450k kernel code, 2232k reserved, 258k data, 68k init, 0k highmem) Calibrating delay loop... 251.39 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... available. NET: Registered protocol family 16 usbcore: registered new driver usbfs usbcore: registered new driver hub Bluetooth: Core ver 2.6 NET: Registered protocol family 31 Bluetooth: HCI device and connection manager initialized Bluetooth: HCI socket layer initialized squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc. bcm963xx_serial driver v2.0 Inotify sysfs create file = 0 Inotify sysfs create file = 0 Inotify sysfs create file = 0 inotify device minor=63 Using noop io scheduler Thomson BCM963xx flash mapping for BTHub flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. flash mapping initialized Creating 3 MTD partitions on "flash": 0x00040000-0x00100000 : "user" 0x001b0000-0x00800000 : "rootfs" 0x00100010-0x001b0000 : "kernel" mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only Bluetooth: HCI UART driver ver 2.1 Bluetooth: HCI H4 protocol initialized Bluetooth: HCI BCSP protocol initialized brcmboard: brcm_board_init entry ERROR - Invalid number of MAC addresses (1007714320) is configured. NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 2048 bind 4096) NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 68k freed init started: BusyBox v1.00 (2007.11.12-09:05+0000) multi-call binary init started: BusyBox v1.00 (2007.11.12-09:05+0000) multi-call binary Starting pid 36, console /dev/ttyS0: '/etc/init.d/rcS' Algorithmics/MIPS FPU Emulator v1.5 Using /nmon/nmon.ko nmon: module license 'unspecified' taints kernel. Button: Character device registered successfully. *** OH G997Init: txIdle set to TRUE pSdramPHY=0xA1FFFFF8, 0x2FE05 0xDEADBEEF [BCM ADSL] Firmware load : 446280 446280 LMEM=(0xFFF00000, 54108) SDRAM=(0xA1FA0000, 392164) AdslCoreHwReset: AdslOemDataAddr = 0xA1FFE458 ADSL PHY version is A2pBT009a2.d18 b6w_init mpi: device 0x4318 found in PCI slot 1, function 0 wl: srom not detected, using main memory mapped srom info (wombo board) IPSecControl Character device registered successfully. NET: Registered protocol family 3 NET: Registered protocol family 9 NET: Registered protocol family 4 NET: Registered protocol family 5 NET: Registered protocol family 18 NET: Registered protocol family 25 SIOCSIFADDR: No such device killall: smbd: no process killed killall: nmbd: no process killed level: 24 ls: /var/usbmount: No such file or directory Using /lib/modules/2.6.8.1/kernel/drivers/usb/host/ohci-hcd.ko ohci_hcd: 2004 Feb 02 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI) ohci_hcd: block sizes: ed 64 td 64 PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ohci_hcd 0000:00:09.0: OHCI Host Controller PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: irq 20, pci mem c0155b00 ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 1 hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected Using /lib/modules/2.6.8.1/kernel/drivers/usb/class/usblp.ko usblp: falsely claims to have parameter proto_bias usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Starting print_server modprobe: module printer.o not found. modprobe: failed to load module printer.o starting lpdsrv Mounting device Using /lib/modules/2.6.8.1/kernel/drivers/scsi/scsi_mod.ko SCSI subsystem initialized Using /lib/modules/2.6.8.1/kernel/drivers/scsi/sd_mod.ko Using /lib/modules/2.6.8.1/kernel/drivers/usb/storage/usb-storage.ko Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB Mass Storage support registered. Using /lib/modules/2.6.8.1/kernel/fs/fat/fat.ko Using /lib/modules/2.6.8.1/kernel/fs/vfat/vfat.ko Using /lib/modules/2.6.8.1/kernel/fs/nls/nls_cp437.ko Using /lib/modules/2.6.8.1/kernel/fs/nls/nls_iso8859-1.ko usbmgr[280]: start 0.4.8 usbmgr[280]: sleep time -1 micro sec Name: /etc/usbmgr/usbmgr.conf Load_from_file: /etc/usbmgr/preload.conf killall: hciattach: no process killed Using /lib/modules/krtp.ko krtp ver 2.8 softdsp-vad-multiline-wb (Nov 12 2007 10:10:08) Copyright (C) 2004 Inventel Systemes Written 2004 by David Libault Written 2004 by Bruce Forgues Written 2004 by Eric Humbert usbmgr[282]: buffer line: remove T usbmgr[282]: class:0x9 subclass:0x0 protocol:0x0 usbmgr[282]: try /etc/usbmgr/class/09/00/00/module usbmgr[282]: try /etc/usbmgr/class/09/00/module usbmgr[282]: try /etc/usbmgr/class/09/module usbmgr[282]: try /etc/usbmgr/class/module Using /lib/modules/bt_reset.ko usbmgr[282]: USB device isn't matched the configuration Using /lib/modules/tty_spi.ko Console is free again MDG on CS0 MDG version: 1192-1, expect 1192-1 MDG Current Eeprom version : 51, expect 51 LOADER: Register timer for first check LOADER: Register SIGUSR1 - rescue LOADER: Register SIGUSR2 - broadcast alert LOADER: Register SIGHUP - test serial link with handset trough charger LOADER: Register HCI sniffer for Handset update request notifications Using /lib/modules/2.6.8.1/kernel/net/bluetooth/l2cap.ko Bluetooth: L2CAP ver 2.3 Bluetooth: L2CAP socket layer initialized Starting pid 333, console /dev/ttyS0: '/nmon/linux_appl.exe' ************* ERROR RECORD ************* 000000:00:00.000000 Application NMON started after POWERON. ****************** END ***************** appl_init: BUILD VERIFIED with the boardname WL firmwarecode (9-5-B0G0_9-6) WARNING: Unknown Parameter Type ipintf [adsl] trace = 5 0 [CWMP] NoIpTimeout must be minimum 120 s. Invalid option => Username :

Tags

toh/bt/homehub_v1.txt · Last modified: 2015/03/14 13:29 by danitool