User Tools

Site Tools


toh:bt:homehub_v2a

BT HomeHub 2.0 Type A

NEWSFLASH (JANUARY 2014):

Following the sad closure of http://psidoc.com, all members of the BT Home Hub Openwrt community are now encouraged to join in ongoing development efforts, concentrated on the Home Hub 2B, at http://openwrt.ebilan.co.uk.

Black boxes given away with a bt broadband subscription. It comes in two versions Type A and Type B. The two versions look identical, and although they provide similar functionality, they are quite different on the inside.

  • Type A is made by Thomson, and is broadcom based, using Thomson linux based firmware.
  • Type B is made by SHC (Siemens), and is Infineon/Lantiq Danube based, using OpenRG based linux firmware. Bootloader is u-boot.

The homehub V2 includes ADSL2+, 802.11b/g/n wireless, host USB port, 4 wired ethernet ports, DECT, FXS & FXO ports and VOIP functionality.

The firmware of both units can be successfully hacked for use on other ISPs. The Type A firmware is a little more flexible than the Type B firmware in terms of what can be done after gaining access. Some initial work has been done: here

Hardware Highlights

SoC CPU Speed Ram Flash Ethernet USB Wifi Serial JTag VOIP FXS
Broadcom 6358 300MHz 64MiB 16MiB 4x1 Yes 11n/g Yes Yes yes yes

Bootlogs

OEM bootlog

DDR2 test.. VCDL test. Decompressing Bootloader................................ Version BL: 1.0.2 Reading cpu info...........bcm96358 tp0 revision 1 MIPS is in Big endian mode Icache : 32Kb Icachelinesize : 16 bytes Dcache : 16Kb Dcachelinesize : 16 bytes BCM config reg CP0 : e30e1006 Instruction cache enabled Data cache enabled Data cache is nonblocking C0_CONFIG reg = 80008083 standard TLB config Cacheable, write-back Multicore enable; Booting Linux kernel pfuncjmp = A0001840 Reading cpu info...........bcm96358 tp0 revision 1 MIPS is in Big endian mode Icache : 16Kb Icachelinesize : 16 bytes Dcache : 16Kb Dcachelinesize : 16 bytes BCM config reg CP0 : 230e1006 Data cache is nonblocking C0_CONFIG reg = 80008082 standard TLB config Noncacheable JTAG select tp1 BOOTING THE THOMSON LINUX KERNEL Starting the kernel @ 0x801df018 memsize=0x3F7D000serial initialized Linux version 2.6.8.1 (buildmgm@dslws-zhangjw.beijing.ap.thmulti.com) (gcc version 3.4.6) #1 Mon Sep 14 12:05:33 CST 2009 CPU revision is: 0002a010 bcm63xx : initiazation of mpi bus ............... Determined physical RAM map: memory: 03f7d000 @ 00002000 (usable) On node 0 totalpages: 16255 DMA zone: 4096 pages, LIFO batch:1 Normal zone: 12159 pages, LIFO batch:2 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=/dev/mtdblock1 rootfstype=squashfs brcm mips: enabling icache and dcache... Primary instruction cache 32kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 16kB 2-way, linesize 16 bytes. PID hash table entries: 256 (order 8: 2048 bytes) Using 150.000 MHz high precision timer. Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Allocating memory for DSP module core and initialization code Allocated DSP module memory - CORE=0x81099bc0 SIZE=900000, INIT=0x81175760 SIZE=5000 Memory: 61380k/65012k available (1428k kernel code, 3564k reserved, 420k data, 68k init, 0k highmem) Calibrating delay loop... 297.98 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... available. NET: Registered protocol family 16 usbcore: registered new driver usbfs usbcore: registered new driver hub Bluetooth: Core ver 2.6 NET: Registered protocol family 31 Bluetooth: HCI device and connection manager initialized Bluetooth: HCI socket layer initialized inotify device minor=63 squashfs: version 3.3 (2007/10/31) Phillip Lougher squashfs: LZMA suppport for slax.org by jro JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc. bcm963xx_serial driver v2.0 BTHub: initialize parser Using noop io scheduler Thomson Speedtouch flash mapping flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 flash: CFI does not contain boot bank location. Assuming top. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. flash mapping initialized parse_bthub_partitions (block_size: 131072) bthub: header of CORE partition is detected bthub: kernel is at offset (be1a001a), size (94f1b) corefs_pattern: info is at offset (bea00004), size (4) including a header of (4) corefs_pattern: ds is at offset (bea00008), size (24) including a header of (4) bthub: a signature has been stored bthub: SquashFS is expected at be235000, found magic is 71736873 bthub: SquashFS (start: be235000, size 1eb000) bthub: SquashFS is expected at be420000, found magic is 71736873 bthub: SquashFS (start: be420000, size 5e0000) bthub: user partition is created bthub: no valid extended partition detected. An empty one will be created. bthub mtd: user (be020000, 180000), write(1), sdram(0) bthub mtd: rootfs (be420000, 5e0000), write(0), sdram(0) bthub mtd: modfs (be235000, 1eb000), write(0), sdram(0) bthub mtd: extfs (bea21000, 59f000), write(0), sdram(0) bthub mtd: extended (bea20000, 5e0000), write(1), sdram(0) bthub mtd: flash (be000000, 1000000), write(1), sdram(0) PT: creating a tree under /proc... [ flash ] [ core ] [ corefs ] [ kernel ] [ modfs ] [ rootfs ] [ user ] [ extended ] [ extfs ] PT: done. 6 BTHub partitions found on MTD device flash Creating 6 MTD partitions on "flash": 0x00020000-0x001a0000 : "user" 0x00420000-0x00a00000 : "rootfs" 0x00235000-0x00420000 : "modfs" 0x00a21000-0x00fc0000 : "extfs" 0x00a20000-0x01000000 : "extended" 0x00000000-0x01000000 : "flash" Bluetooth: HCI UART driver ver 2.1 Bluetooth: HCI H4 protocol initialized Bluetooth: HCI BCSP protocol initialized brcmboard: brcm_board_init entry NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 4096 bind 8192) NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 68k freed init started: BusyBox v1.00 (2009.09.14-04:06+0000) multi-call binary init started: BusyBox v1.00 (2009.09.14-04:06+0000) multi-call binary Starting pid 40, console /dev/ttyS0: '/etc/init.d/rcS' Algorithmics/MIPS FPU Emulator v1.5 SQUASHFS error: Can't find a SQUASHFS superblock on mtdblock3 mount: Mounting /dev/mtdblock3 on /extfs failed: Invalid argument telnetd: starting port: 23; login program: /bin/sh Using /lib/modules/2.6.8.1/kernel/drivers/usb/host/ohci-hcd.ko ohci_hcd: 2004 Feb 02 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI) ohci_hcd: block sizes: ed 64 td 64 PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ohci_hcd 0000:00:09.0: PCI device 14e4:6300 (Broadcom Corporation) PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: irq 13, pci mem c00cb400 ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 1 hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected Using /lib/modules/2.6.8.1/kernel/drivers/usb/host/ehci-hcd.ko PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) ehci_hcd 0000:00:0a.0: PCI device 14e4:6300 (Broadcom Corporation) PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0: irq 18, pci mem c00cf300 ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 2 PCI: cache line size of 32 is not supported by device 0000:00:0a.0 ehci_hcd 0000:00:0a.0: USB f.f enabled, EHCI 1.00, driver 2004-May-10 hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected hub 2-0:1.0: over-current change on port 2 rm: cannot remove `/rw/dl/usbabsent': No such file or directory Using /nmon/nmon.ko nmon: module license 'unspecified' taints kernel. Button: Character device registered successfully. AnnexCParam=0x00000000 AnnexAParam=0x00000000 adsl2=0x00000000 pSdramPHY=0xA3FFFFF8, 0x48000000 0x0 [BCM ADSL] Firmware load : 431156 431156 LMEM=(0xFFF00000, 49488) SDRAM=(0xA3FA0000, 381660) AdslCoreHwReset: AdslOemDataAddr = 0xA3FFC1C4 AnnexCParam=0x00000000 AnnexAParam=0x00000000 adsl2=0x00000000 ADSL PHY version is A2pBT010i.d20h b6w_init mpi: No Card is in the PCMCIA slot mpi: device 0x432c found in PCI slot 1, function 0 IPSecControl Character device registered successfully. NET: Registered protocol family 3 NET: Registered protocol family 9 NET: Registered protocol family 4 NET: Registered protocol family 5 NET: Registered protocol family 18 NET: Registered protocol family 25 Using /lib/modules/tty_spi.ko usage: insmod tty_spi speed n CS=2 date: Sep 14 2009 time: 12:31:13, speed 1 Using /lib/modules/krtp.ko krtp ver 2.8 softdsp-vad-multiline-wb (Sep 14 2009 12:24:47) Using /lib/modules/dspdd.ko load dspdd.ko: core_size=825584, init_size=0 DSP Driver: DSP init stub Using /lib/modules/endpointdd.ko Endpoint: endpoint_init entry Endpoint: endpoint_init COMPLETED Using /lib/modules/bt_reset.ko Using /lib/modules/2.6.8.1/kernel/net/bluetooth/l2cap.ko Bluetooth: L2CAP ver 2.3 Bluetooth: L2CAP socket layer initialized Device ikanos not present. Starting pid 231, console /dev/ttyS0: '/etc/init.d/rc' Switching to RUNLEVEL 1 ... MDG on SPI MDG version: 40-1, expect 40-1 RAD : rad started..... RAD : Reading /etc/rad.conf RAD : found entry 1, path /usr/bin/upnp_dect_ui RAD : found entry 2, path /usr/bin/gw_numberL2C RAD : found entry 3, path /usr/bin/loader_alertL2C RAD : found entry 4, path /usr/bin/TI_number_menu RAD : found entry 5, path /usr/bin/hyper_accept RAD : found entry 6, path /usr/bin/send_base_IP_address RAD : found entry 7, path /usr/bin/osis_channel_conf RAD : found entry 8, path /usr/bin/osis_wizard RAD : found entry 9, path /usr/bin/npab_connect RAD : Reading /etc/hsupd.conf RAD : found entry 1, path /usr/bin/hyper_update RAD : found entry 2, path /usr/bin/hs_eep_update RAD : Waiting for connection on psm : RAD : A01 RAD : A06 Writing /var/run/rad.pid linux application start ... wait for linux_appl to initialize (1) wait for linux_appl to initialize (2) ************* ERROR RECORD ************* 000000:00:00.000000 Application NMON started after POWERON. ****************** END ***************** appl_init: build verified dip_init() : button[FACTORY_RESET] has number[1] wait for linux_appl to initialize (3) End of initialisation start storagepl ... storagepl is started Using /lib/modules/2.6.8.1/kernel/drivers/usb/host/ohci-hcd.ko insmod: cannot insert `/lib/modules/2.6.8.1/kernel/drivers/usb/host/ohci-hcd.ko': Success (17): Success modprobe: failed to load module ohci-hcd Using /lib/modules/2.6.8.1/kernel/drivers/usb/host/ehci-hcd.ko insmod: cannot insert `/lib/modules/2.6.8.1/kernel/drivers/usb/host/ehci-hcd.ko': Success (17): Success modprobe: failed to load module ehci-hcd Using /lib/modules/2.6.8.1/kernel/drivers/usb/class/usblp.ko usblp: falsely claims to have parameter proto_bias usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver modprobe: module usbserial not found. modprobe: failed to load module usbserial id: unknown user name: nobody id: unknown user name: nobody Using /lib/modules/2.6.8.1/kernel/drivers/scsi/scsi_mod.ko SCSI subsystem initialized Using /lib/modules/2.6.8.1/kernel/drivers/scsi/sd_mod.ko Using /lib/modules/2.6.8.1/kernel/drivers/usb/storage/usb-storage.ko Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB Mass Storage support registered. Using /lib/modules/2.6.8.1/kernel/fs/fat/fat.ko Using /lib/modules/2.6.8.1/kernel/fs/vfat/vfat.ko Using /lib/modules/2.6.8.1/kernel/fs/msdos/msdos.ko Using /lib/modules/2.6.8.1/kernel/fs/nls/nls_cp437.ko Using /lib/modules/2.6.8.1/kernel/fs/nls/nls_iso8859-1.ko mount all usbdisks not implemented ! Name: /etc/usbmgr/usbmgr.conf Load_from_file: /etc/usbmgr/preload.conf checkd start ... checkd: daemonized with blocked parent process checkd: parent process released. S67stopload: wait until configuration load reaches phase 9... linuxappl: start loading after [ 3034ms ] ---- WL firmwarecode (0--1-0-0) kernel::endpoint_open kernel::endpoint_open COMPLETED [adsl] trace = 5 0 [LED] led_drv_init() userspace usb 2-1: new high speed USB device using address 2 scsi0 : SCSI emulation for USB Mass Storage devices Vendor: Kingston Model: DataTraveler G3 Rev: 1.00 Type: Direct-Access ANSI SCSI revision: 02 SCSI device sda: 31272544 512-byte hdwr sectors (16012 MB) sda: assuming Write Enabled sda: assuming drive cache: write through sda: sda1 Attached scsi removable disk sda at scsi0, channel 0, id 0, lun 0 USB Mass Storage device found at 2 ADSL configuration: adslmultimode = adsl2plus syslog = disabled [mlp] Invalid/duplicate username or user database full. [mlp] Invalid/duplicate username or user database full. [mlp] Invalid/duplicate username or user database full. stopping the pureftp-server ... the pureftp-server is stopped stopping the pure-authd ... the pure-authd is stopped HAUSWARE HOST LIBRARY => BUILD DATE = Jul 4 2008, BUILD TIME = 15:17:51 *** gStartRxDesc[0] = 0xA0E2D000 *** gBufferSizeBytes = 1280 *** gStartTxDesc[0] = 0xA0E2F000 hal6358PcmInit 260 nextTxDesc = 0xA0E2F000 hal6358PcmInit 260 nextTxDesc = 0xA0E2F008 hal6358PcmInit 264 Ownership for TX desc not set. Use this buffer. PERF->IrqMask = 0xA8060427 PERF->IrqMask1 = 0x00800000 Starting su_interface ... su_interface: running Starting la_interface ... la_interface: running /extfs/etc/finally.sh: 1: shareroot: not found Load_from_file: /etc/usbmgr/class/08/06/module Start to load end of loop really the end 9 (len 8) Module_load name: þC8 Load_from_file: /etc/usbmgr/class/08/06/script Start to load end of loop really the end 8 (len 7) Path: /etc/usbmgr/storage Cmd2 : storage id: unknown user name: nobody id: unknown user name: nobody Disk dev is sda Mounting all partitions of sda checking sda1 514 Trying to mounting device: SQUASHFS error: Can't find a SQUASHFS superblock on sda1 Mounted /var/usbmount/sda1 succesfully * Determine managed disk based on a marker file on the disk. Could not open marker files Device nr /var/usbmount/sda1/Settings/manageddisk_marker is NOT the managed disk Device 514 is not a managed disk checking sda2 514 open() failed: No such device or address checking sda3 514 starting the upnp av server open() failed: No such device or address checking sda4 514 open() failed: No such device or address Username : checking sda5 514 open() failed: No such device or address samba: stopping ... ILibMediaProfiler: ILibMediaProf_CheckState: Media profiling finished checking sda6 514 killall: smbd: no process killed open() failed: No such device or address checking sda7 514 killall: nmbd: no process killed open() failed: No such device or address checking sda8 514 killall: cifscl: no process killed samba: initializing ... open() failed: No such device or address samba: wait for cifscl to initialize (1) checking sda9 514 open() failed: No such device or address checking sda10 514 open() failed: No such device or address checking sda11 514 open() failed: No such device or address checking sda12 514 open() failed: No such device or address checking sda13 514 open() failed: No such device or address checking sda14 514 open() failed: No such device or address checking sda 514 /etc/usbmgr/usbledctrl: 38: ledctrl: not found envp2 addr 0x7ffe3f18 samba: wait for cifscl to initialize (2) samba: wait for cifscl to initialize (3) samba: wait for cifscl to initialize (4) samba: wait for cifscl to initialize (5) samba: wait for cifscl to initialize (6) samba: wait for cifscl to initialize (7) samba: wait for cifscl to initialize (8) samba: wait for cifscl to initialize (9) samba: wait for cifscl to initialize (10) samba: wait for cifscl to initialize (11) samba: wait for cifscl to initialize (12) samba: wait for cifscl to initialize (13) samba: wait for cifscl to initialize (14) samba: wait for cifscl to initialize (15) samba: wait for cifscl to initialize (16) samba: wait for cifscl to initialize (17) samba: wait for cifscl to initialize (18) samba: wait for cifscl to initialize (19) samba: wait for cifscl to initialize (20) cifscl time out samba: starting ...''

OpenWrt bootlog

FIXME

Starting the kernel @ 0x801f20b0 memsize=0x3F7D000[ 0.000000] Linux version 3.0.18 (user1@debian) (gcc version 4.5.4 20120201 (prerelease) (Linaro GCC 4.5-2012.02) ) #1 Sat Mar 24 09:57:43 GMT 2012 [ 0.000000] Detected Broadcom 0x6358 CPU revision a1 [ 0.000000] CPU frequency is 300 MHz [ 0.000000] 128MB of RAM installed [ 0.000000] registering 40 GPIOs [ 0.000000] enabling icache and dcache [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 0002a010 (Broadcom BMIPS4350) [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] User-defined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00004000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] early_node_map[1] active PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00004000 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 mem=64M [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Primary instruction cache 32kB, VIPT, 2-way, linesize 16 bytes. [ 0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Memory: 62360k/65536k available (1957k kernel code, 3176k reserved, 327k data, 136k init, 0k highmem) [ 0.000000] NR_IRQS:128 [ 0.000000] Calibrating delay loop... 298.32 BogoMIPS (lpj=1167360) [ 0.054687] pid_max: default: 32768 minimum: 301 [ 0.054687] Mount-cache hash table entries: 512 [ 0.070312] NET: Registered protocol family 16 [ 0.093750] registering PCI controller with io_map_base unset [ 0.117187] bio: create slab at 0 [ 0.140625] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30003fff] [ 0.148437] pci 0000:00:01.0: BAR 0: set to [mem 0x30000000-0x30003fff] (PCI address [0x30000000-0x30003fff]) [ 0.156250] Switching to clocksource MIPS [ 0.164062] Switched to NOHz mode on CPU #0 [ 0.171875] NET: Registered protocol family 2 [ 0.171875] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.179687] TCP established hash table entries: 2048 (order: 2, 16384 bytes) [ 0.187500] TCP bind hash table entries: 2048 (order: 1, 8192 bytes) [ 0.195312] TCP: Hash tables configured (established 2048 bind 2048) [ 0.203125] TCP reno registered [ 0.203125] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.210937] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.218750] NET: Registered protocol family 1 [ 0.234375] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.234375] JFFS2 version 2.2 (NAND) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.250000] msgmni has been set to 121 [ 0.250000] io scheduler noop registered (default) [ 0.257812] bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0100 (irq = 10) is a bcm63xx_uart [ 0.265625] console [ttyS0] enabled, bootconsole disabled [ 0.265625] console [ttyS0] enabled, bootconsole disabled [ 0.281250] gpiodev: gpio device registered with major 254 [ 0.289062] bcm963xx-flash bcm963xx-flash.0: 0x01000000 at 0x1e000000 [ 0.296875] bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000020 Chip ID 0x00227e [ 0.312500] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.312500] Amd/Fujitsu Extended Query version 1.3. [ 0.320312] number of CFI chips: 1 [ 0.320312] bcm963xx_flash: Read Signature value of [ 0.328125] bcm963xx_flash: assuming RedBoot bootloader [ 0.335937] bcm963xx_flash: Support extended flash 0x01000000 at 0xbe000000 [ 0.343750] Searching for RedBoot partition table in bcm963xx at offset 0xfe0000 [ 0.382812] Creating 5 MTD partitions on "bcm963xx": [ 0.390625] 0x000000000000-0x000000020000 : "RedBoot" [ 0.398437] 0x000000020000-0x000000100000 : "kernel_fs" [ 0.414062] 0x000000100000-0x000000320000 : "root_fs" [ 0.421875] 0x000000320000-0x000000fe0000 : "rootfs_data" [ 0.429687] 0x000000fe0000-0x000000fef000 : "FIS directory" [ 0.445312] bcm63xx-spi bcm63xx-spi.0: at 0xfffe0800 (irq 9, FIFOs size 542) v0.1.2 [ 0.460937] bcm63xx_enet MII bus: probed [ 0.476562] input: gpio-buttons as /devices/platform/gpio-buttons.0/input/input0 [ 0.484375] bcm63xx-wdt bcm63xx-wdt.0: started, timer margin: 30 sec [ 0.515625] TCP cubic registered [ 0.515625] NET: Registered protocol family 17 [ 0.523437] lib80211: common routines for IEEE802.11 drivers [ 0.539062] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.546875] Freeing unused kernel memory: 136k freed awk: /proc/cpuinfo: No such file or directory [ 3.703125] eth1: link forced UP - 100/full - flow control off/off [ 3.945312] roboswitch: Probing device eth0: [ 3.945312] roboswitch: [/media/scratch/trunk-31059/build_dir/linux-brcm63xx/kmod-switch/switch-robo.c:121] SIOCGETCPHYRD failed! [ 3.960937] roboswitch: [/media/scratch/trunk-31059/build_dir/linux-brcm63xx/kmod-switch/switch-robo.c:121] SIOCGETCPHYRD failed! [ 3.968750] No Robo switch in managed mode found, phy_id = 0xffffffff [ 3.976562] roboswitch: Probing device eth1: found a 5325! It's a 5350. - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - [ 9.984375] JFFS2 notice: (396) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. switching to jffs2 - init - Please press Enter to activate this console. [ 13.156250] Compat-wireless backport release: compat-wireless-2012-02-27-1-r31059 [ 13.164062] Backport based on wireless-testing.git master-2012-02-27 [ 13.250000] cfg80211: Calling CRDA to update world regulatory domain [ 14.281250] SCSI subsystem initialized [ 14.437500] cfg80211: World regulatory domain updated: [ 14.437500] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 14.453125] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 14.460937] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 14.468750] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 14.476562] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 14.484375] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 14.789062] usbcore: registered new interface driver usbfs [ 14.796875] usbcore: registered new interface driver hub [ 14.804687] usbcore: registered new device driver usb [ 15.593750] Broadcom 43xx driver loaded [ Features: PL ] [ 15.804687] Button Hotplug driver version 0.4.1 [ 16.742187] NTFS driver 2.1.30 [Flags: R/O MODULE]. [ 17.132812] loop: module loaded [ 17.804687] ip_tables: (C) 2000-2006 Netfilter Core Team [ 18.601562] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 18.609375] bcm63xx_ehci bcm63xx_ehci.0: BCM63XX integrated EHCI controller [ 18.617187] bcm63xx_ehci bcm63xx_ehci.0: new USB bus registered, assigned bus number 1 [ 18.656250] bcm63xx_ehci bcm63xx_ehci.0: irq 18, io mem 0xfffe1300 [ 18.671875] bcm63xx_ehci bcm63xx_ehci.0: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 18.679687] hub 1-0:1.0: USB hub found [ 18.687500] hub 1-0:1.0: 2 ports detected [ 18.882812] nf_conntrack version 0.5.0 (976 buckets, 3904 max) [ 20.664062] xt_time: kernel timezone is -0000 [ 21.375000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 21.382812] bcm63xx_ohci bcm63xx_ohci.0: BCM63XX integrated OHCI controller [ 21.390625] bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bus number 2 [ 21.398437] bcm63xx_ohci bcm63xx_ohci.0: irq 13, io mem 0xfffe1400 [ 21.476562] hub 2-0:1.0: USB hub found [ 21.484375] hub 2-0:1.0: 1 port detected [ 21.539062] Initializing USB Mass Storage driver... [ 21.539062] usbcore: registered new interface driver usb-storage [ 21.546875] USB Mass Storage support registered. [ 32.507812] bcm63xx_enet bcm63xx_enet.0: attached PHY at address 1 [Broadcom BCM63XX (2)] BusyBox v1.19.4 (2012-03-23 20:38:41 GMT) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ATTITUDE ADJUSTMENT (bleeding edge, r31059) ---------- * 1/4 oz Vodka Pour all ingredients into mixing * 1/4 oz Gin tin with ice, strain into glass. * 1/4 oz Amaretto * 1/4 oz Triple sec * 1/4 oz Peach schnapps * 1/4 oz Sour mix * 1 splash Cranberry juice ----------------------------------------------------- root@OpenWrt:/#

Hardware

Info

Architecture: MIPS
Vendor: Broadcom
Bootloader: unknown (custom Thomson Speedtouch bootloader)
System-On-Chip: Broadcom 6358KFBG
CPU/Speed BMIPS4350 V1.0 / 300 Mhz
Flash-Chip: Spansion S29GL128N90TFFIR2 (Parallel NOR Flash)
Flash size: 16 MiB
RAM: Hynix HY5DU121622DTP or
Samsung K4H511638D
RAM size: 64 MiB
Wireless: BCM94332MP2D 802.11a/b/g/n Mini PCI card or
soldered module
Ethernet: Broadcom BCM5325 w/ vlan support swconfig
Internet: ADSL2+
Slic: Silicon Labs Si3216-FM Programmble Wideband SLIC/CODEC with ringing/battery voltage generation
DECT Inventel DECT module appearing as Bluetooth HCI on SPI bus
USB: Yes
Serial: Yes
JTAG: Yes

Photos

FIXME

Model Number

Front:

Photo of front of the casing

Back:

Photo of back of the casing

Opening the case

FIXME

Note: This will void your warranty!

  • To remove the cover do a/b/c

Main PCB

Photo of PCB

Serial

the Type A has a 3.3v serial port it's located near the top of the board, as 4 holes designed to take a header.

to use it, you need to short two absent resistor placements on the front of the board. the connections are, from the top 3.3v TX RX GND

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

rev.1 rev.2

Buttons

GPIOKey
?Restart
1Find handset
9Factory Reset
11Wireless association

All buttons are active low.

LEDS

The LEDs are not connected directly to the GPIO lines, but instead to a couple of shift registers driven by two 74HC594. You can shift manually, or you could write module that shifts the LED data into the shift registers. GPIO 7 is data, GPIO 6 is clock, and GPIO 5 is latch.

The leds are grouped Colour bit
3 for Power Red
Orange
Blue
3 for Broadband Red
Orange
Blue
2 for phone Orange
Blue
2 for wireless Orange
Blue
1 for upgrading Orange

Tags

toh/bt/homehub_v2a.txt · Last modified: 2014/02/02 15:56 by benm