NEWSFLASH (JANUARY 2014):
Following the sad closure of http://psidoc.com, all members of the BT Home Hub Openwrt community are now encouraged to join in ongoing development efforts at http://openwrt.ebilan.co.uk. BT HomeHub 2.0 Type B appears to be stable with the latest set of patches against trunk r39355. Feedback from anyone willing to test these will be gratefully received!
Black boxes given away with a bt broadband subscription. It comes in two versions Type A and Type B. The two versions look identical, and although they provide similar functionality, they are quite different on the inside.
Type A is made by Thomson, and is broadcom based, using Thomson linux based firmware. Type B is made by SHC (Siemens), and is Infineon/Lantiq Danube based, using OpenRG based linux firmware. Bootloader is u-boot.
The homehub V2 includes ADSL2+, 802.11b/g/n wireless, host USB port, 4 wired ethernet ports, DECT, FXS & FXO ports and VOIP functionality.
The firmware of both units can be successfully hacked for use on other ISPs (see www.psidoc.com). The Type A firmware is a litlte more flexible than the Type B firmware in terms of what can be done after gaining access. However, the Type B can be made to work with OpenWRT.
|Version/Model||Launch Date||S/N||OpenWrt Version Supported||Model Specific Notes|
Attitude Adjustment contains a profile for the Type B, but support is incomplete. Unofficial patches do however exist to build a working image. A community build using these patches is also available, of trunk version 34686 (ie a snapshot shortly before the Attitude Adjustment release). See below for details.
Barrier Breaker contains no profile for the Type B, but work is in progress to on a set of patches suitable for merging with the official sources.
|Lantiq Danube@333MHz||64MB||32MB NAND+512k NOR||4||Yes||11ng||Yes||Yes||yes||yes|
Instructions on how to obtain access to the bootloader can be found here: http://openwrt.ebilan.co.uk/viewtopic.php?f=11&t=6
Unofficial patches and a community build based on them can be found here: http://openwrt.ebilan.co.uk/viewtopic.php?f=4&t=3
TO DO: Add more detailed installation instructions to this page.
For reference, the initial work done to get OpenWRT running on the Home Hub 2B is available here:
|NAND - 32 Mbytes:|
|0x00000000-0x00004000 : "Atheros EEPROM"|
|0x00004000-0x00E04000 : "OpenRG Image 1"|
|0x00E04000-0x00F00000 : ? (empty)|
|0x00F00000-0x01D00000 : "OpenRG Image 2 (empty)"|
|0x01D00000-0x01E00000 : ? (empty)|
|0x01E00000-0x02000000 : "Dect configuration? (empty)"|
|NOR - 512k:|
|0x00000000-0x00040000 : first u-boot|
|0x00040000-0x00050000 : u-boot stored config|
|0x00050000-0x00060000 : RG conf 1 16k|
|0x00060000-0x00070000 : RG conf 2 16k|
|0x00070000-0x00080000 : RG factory conf 16k|
in EBU region 0
Sector size 256
nand max floors 1
nand max chips 1
in EBU region 1
|System-On-Chip:||Lantiq Danube PSB-S 50712 (MIPS 24Kec)|
|CPU/Speed:||333 MHz Dual Core|
|NOR Flash:||Spansion S29AL004D 4MiB|
|NAND Flash:||Samsung K9F5608U0D-JIB0 32MiB|
|RAM Chip:||Samsung K4H511638F|
|RAM Specs:||64 MiB|
|Wireless:||Atheros 9160-BC1A 802.11b/g/n, pci, 0x18000000, irq 22|
|Slic:||Teridian 73m1966, Infineon Vinetic PEF4268F 'Ringing SLIC with Integrated DC/DC Converter'|
In the photos above, wires are soldered on to the 3.3v serial lines.
The connections are:
Note that the original u-boot has 'silent' mode enabled
The CPU has 2 x 16 possible GPIO pins.
For each pin there are control bits:
DIR: direction (0=input, 1=output)
IN/OUT: value read from/written to pin
ALTSEL0/ALTSEL1: function multiplexed to the pin (see pinctrl driver)
OD: 0=open drain, 1='normal mode' push-pull
PUDSEL: pullup/down select (1=up)
PUDEN: pullup/down enable (1=enabled)
uboot initial values
|GPIO-01||0 in||1||1||0||1||0||0||FXO Interrupt|
|GPIO-02||0 in||1||0||0||1||0||0||Reset button|
|GPIO-03||1 out||1||0||0||1||0||0||CLK-OUT2 - (25mhz for amd9669i? - danube_clock.c in u-boot)|
|GPIO-04||1 out||1||1||0||1||0||0||- stp-st (maybe also likely boot clock select 1 = 36mhz)|
|GPIO-05||1 out||1||1||0||1||0||0||- stp-d|
|GPIO-06||1 out||1||1||0||1||0||0||- stp-sh|
|GPIO-09||1 out||1||0||1||1||0||0||- FXO Chip Select|
|GPIO-10||1 out||0||0||0||1||0||0||- FXO reset|
|GPIO-11||0 in||1||1||0||0||1||1||- pulled up|
|GPIO-13||1 out||1||1||0||1||0||0||- USB Power|
|GPIO-15||0 in||1||0||0||0||0||0||- find handset button|
|GPIO-20||1 out||1||0||0||1||1||1||- pulled up|
|GPIO-21||1 out||0||0||0||1||0||0||- PCI Reset|
|GPIO-22||0 in||1||0||0||1||1||1||- wps button pulled up|
|GPIO-23||1 out||1||1||0||1||0||0||- likely endian select 0=little|
|GPIO-27||1 out||1||1||0||0||1||1||- pulled up|
|GPIO-28||1 out||1||0||0||0||0||0||- SC14488 dect chip reset|
|GPIO-29||1 out||1||0||0||1||0||0||- pci-req1|
|GPIO-30||1 out||0||0||0||1||0||0||- pci-gnt1|
USB Power? 13
from original bootlog: FXO reset using GPIO-10 FXO interrupt using GPIO-1 FXO Chip Select using GPIO-9
from u-boot, initial values are:
The board provides a further 24? GPOs (for leds) controlled by stp.
All buttons are active low.
Near the 11 leds, there are two HC595: 8-Bit Serial-Input/Serial or Parallel-Output Shift Register with Latched 3-State Outputs (http://pdf1.alldatasheet.com/datasheet-pdf/view/46165/SLS/HC595.html)
|The leds are grouped|
|3 for Power|
|3 for Broadband|
|2 for phone|
|2 for wireless|
|1 for upgrading|
LED control base address is 0xBE100BB0 which correlates with ltq_register_gpio_stp.
|Upgrading||Orange||= bit 13 (213 with 200 base added)|
|Phone||Orange||= bit 14 (214)|
|Blue||= bit 15 (215)|
|Wireless||Orange||= bit 16 (216)|
|Blue||= bit 17 (217)|
|Broadband||Red||= bit 18 (218)|
|Orange||= bit 19 (219)|
|Blue||= bit 20 (220)|
|Power||Red||= bit 21 (221)|
|Orange||= bit 22 (222)|
|Blue||= bit 23 (223)|
Atheros 9160-BC1A 802.11b/g/n, pci, 0x18000000, irq 22, slot 14
Marked as device 168C:FF1C
The calibration data is stored in the first 0x4000 bytes of the nand
the first 0x60 of these contain PCI register fixups, organised as Reg16:Value32. These need to be written to the PCI register space BEFORE the PCI device is probed… This leads to the issue that the PCI device is probed before the nand is active, so before we can get to the data, so a scheme of hardcoding these register fixups and calling the writing routine as a DECLARE_PCI_FIXUP_EARLY routine works. The actual eeprom data can be read later as part of the ath9k initialisation by utilising the hook ltqpci_plat_dev_init().
The eeprom data needs to be byte-swapped, then the data which is meant to be words byte swapped again. We can't currently tell Ath9k to handle this without patching ath9k, but once done, it works.
unfortunately, wireless (PCI) and NAND (EBU) interact. for the moment, PCI gets inhibited while the nand chip is selected; I felt it better to have some wireless degradation rather than file system corruption.
The FXO/FXS interface for telephony is a combination of Teridian 73m1966 and Infineon Vinetic PEF4268F 'Ringing SLIC with Integrated DC/DC Converter', for which some drivers are available. I believe that as I write, some work may be being done on using SIP with the telephone interfaces.
The DECT modem (SiTel SC14488) is a processor in it's own right. It is connected to ttyLTQ0, and also to Danube PCM Lines? We would need firmware to run within the SiTel modem to talk to the Dect phones, and to understand the protocols on the serial control, as well as implement the PCM communication (which seems to be DMAed). There is an un-populated site for a serial eeprom? - so the firmware must be programmed by the main cpu at startup.
Although we have the original BT firmware for the DECT modem, there is little or no information regarding how this may be controlled. The control seems to be done from within the OpenRG application, for which we have no source.
toh/bt/homehub_v2b.txt · Last modified: 2014/02/02 15:53 by benm