User Tools

Site Tools


BT HomeHub 5.0 Type A

Information on this page also applies to the 'Plusnet Hub One' and 'BT Business Hub 5'

There is also a type B based on BCM63268, but for 802.11ac it uses the BCM4360 which has no open drivers, so it's a far less attractive target.

The ZyXEL P2812HNU-Fx series is similar and HH5A support was based upon it.

Supported Versions

OpenWrt support is available with these patches (currently only in trunk):


Branch Type Download link
external tree UART u-boot (allows booting via serial console) for installing OpenWrt or LEDE openwrt-lantiq-bthomehubv5a_ram-u-boot.asc
external tree open source u-boot with new/LEDE partition layout (replaces the original bootloader) lede-lantiq-bthomehubv5a_nandspl-u-boot.img
external tree (not recommended for most users - keep the stock u-boot to minimize risks during flashing)
open source u-boot with old/OpenWrt partition layout
can be used to replace the original bootloader
n/a Image which can be booted via TFTP to simplify the switch from OEM firmware to OpenWrt (Recommend installing LEDE as it contains newer patches) openwrt-lantiq-xrx200-BTHOMEHUBV5A-install-uImage-initramfs
n/a UART u-boot (allows booting via serial console) for installing LEDE lede-lantiq-bthomehubv5a_ram-u-boot.asc
n/a Image which can be booted via TFTP to simplify the switch from OEM firmware to LEDE lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin
n/a LEDE installation and configuration guide for HH5A Guide for installing LEDE r2363+ and 17.01.x
n/a LEDE 17.01.3 (Oct 2017) squashfs sysupgrade file - LEDE stable build lede-17.01.3-lantiq-xrx200-BTHOMEHUBV5A-squashfs-sysupgrade.bin
external tree LEDE squashfs sysupgrade snapshot builds (See external tree) LEDE squashfs sysupgrade snapshot builds
n/a Serial console instructions using MS Windows Serial console instructions using MS Windows



Architecture: MIPS
Vendor: Lantiq
Bootloader: U-Boot
System-On-Chip: Lantiq Xway VR9 VRX268 PSB 80910 (MIPS 34Kc) v1.2.1
CPU/Speed: 500 MHz
NOR Flash: n/a
NAND Flash: 128MiB Spansion ML01G100BHI00
RAM Chip: Samsung K4T1G164QF-BCF7
RAM Specs: DDR2 128MiB @ 250MHz
Wireless: Atheros AR9227 b/g/n 2x2 +
Qualcomm QCA9880-BR4A a/b/g/n+ac 3x3
Ethernet: 5x 10/100/1000 BASE-TX Ethernet Interface (1x WAN, 4x LAN)
(2x XWAY VR9 GPHY 11G & 3x XWAY PEF7071 via RGMII)
Switch: Internal configurable (Infineon)
xDSL: Lantiq XWAY VRX208
ADSL1/2/2+ (G.992.1/3/5) Annexes A, B, I, J, M, L,
VDSL1 (G.993.1, T1.424, TS 101 270),
VDSL2 (G.993.2),
ITU-T G 998.2 Bonding,
EFM (IEEE 802.3ah)
USB: 1x USB 2.0
DECT: no
Serial: Yes
GPIO Buttons: WPS, Restart and Reset buttons
Power: External 12V 1.5A

Case opening

The following video shows how to open the case without damaging it. Youtube video

PCB Photos


Example: (note: gnd soldered to pins 1 and 4 on the 5 pin header. First 3 pins on header are gnd+serial, 4th and 5th pins gnd+boot-sel2 for link to select uart boot; header protrudes from base).

Resistor number Function Info Notes
R77 Serial TX Bottom of the board, below the NAND flash You can also solder to the pad right of it
R78 Serial RX Below R78 You can also solder to the pad right of it
R45 boot_sel2 Vertically mounted, below R78 You can also solder to the pad above it
R46 boot_sel3 Front of the PCB, next to SW4 (WPS button); not needed for installation over serial -
GND Outer part of the USB connector where it passes through PCB -

Serial uses Baud rate 115200.

To boot via UART you need to pull boot_sel2 (results in CFG 0x4) to GND.

Installation over serial

To install OpenWrt on your HH5A or to recover from a failed u-boot flash you can boot the device via UART (serial console). This requires that:

  1. you are able to connect to the serial console of the device (using for example a USB to serial adapter)
  2. you are able to solder four wires to the PCB of the device (three of them are SMD solder points)!

Once you have prepared everything you can boot u-boot via UART:

  1. Power off your HH5A
  2. Enable UART boot by connecting boot_sel2 to GND
  3. Power on your device
    You should see a message similar to this:
    ROM VER: 1.1.4
    CFG 04
  4. Remove the connection between boot_sel2 and GND
  5. Load u-boot via serial console into the device's memory (this takes approx. 3 minutes): openwrt-lantiq-bthomehubv5a_ram-u-boot.asc. under linux you can use

"picocom -b 115200 /dev/ttyUSB0" 
to connect and in another terminal the following will send the bootcode
"cat openwrt-lantiq-bthomehubv5a_ram-u-boot.asc > /dev/ttyUSB0"

  1. Now you should see the BTHOMEHUBV5A# u-boot prompt

Note that operating in this mode is atypically slow. The CPU clock (normally 500MHz) and buses (normally 250MHz) are running at 125MHz for some reason, but the installed system will run at full speed.

(one reason that it's running very slowly is that the cache is turned off for the serially loaded u-boot build)

Creating a backup of the original firmware

It is recommended to use a USB-stick for creating the backup.

  1. Start u-boot via UART (see above for the details)
  2. Load the installation image onto a tftp server at address, ensure that the address is free for the HomeHub to use. Any Ethernet port on the HomeHub can be used to connect to the ttp server.
  3. Upload the "initial installation image" openwrt-lantiq-xrx200-BTHOMEHUBV5A-install-uImage-initramfs via tftp:
    tftpboot openwrt-lantiq-xrx200-BTHOMEHUBV5A-install-uImage-initramfs; bootm
    Booting at this stage is very slow - this might take 10 to 15 minutes!
  4. Now you can create a backup of the full flash:
    1. Method #1: backup to a USB flash drive (has to be FAT32 formatted and needs approx. 260M free space) - note that this takes quite some time (>1/2 hour)
      mount /dev/sda1 /mnt/
      nanddump -f /mnt/hh5a.nanddump /dev/mtd6
      dd if=/dev/mtd6 of=/mnt/hh5a.dd
    2. Method #2: backup to another computer on the network using netcat. This can take around 35 minutes(!); not sure whether it's the mtd read or the ethernet write that's so slow.
      1. On the host computer run:
        ncat -l 60000 > ~/hh5a.ncat-dump
      2. On the HH5A:
        nc 60000 < /dev/mtd6
  5. Create a backup of the calibration data (WARNING: You will need this data - otherwise lots of functionality in OpenWrt will be useless)
    1. First detach any existing UBIs (NOTE: there's no problem if this fails - it just means you haven't attached any UBI FS before)
      ubidetach -m 4
      ubidetach -m 5
    2. The create the actual backup (this must NOT show any errors!)
      ubiattach -m 5
      dd if=/dev/ubi0_3 of=/tmp/hh5a-caldata-backup
    3. Then copy /tmp/hh5a-caldata-backup to a USB-stick or send it via netcat to another PC (see full backup instructions)
  6. You can carry on directly to the next step (no need to UART/TFTP again) if you like.

Installing OpenWrt (switching from original firmware to OpenWrt)

(this method is more risky than the LEDE method below, as it replaces the bootloader / u-boot and is prone to the NAND read errors)

  1. Start u-boot via UART (see above for the details)
  2. Upload the "initial installation image" openwrt-lantiq-xrx200-BTHOMEHUBV5A-install-uImage-initramfs via tftp:
    tftpboot openwrt-lantiq-xrx200-BTHOMEHUBV5A-install-uImage-initramfs; bootm

    Booting that this stage is very slow - this might take 10 to 15 minutes!
  3. Make sure you made a backup using above instructions!
  4. Make sure you have a caldata backup!
  5. The "initial installation image" contains a little script that automates the installation for you
    1. Run
      (the source of the script can be found here:
    2. Carefully read the instructions that the script provides
    3. Once the script is finished you have an unlocked u-boot installed (but no OpenWrt yet)
    4. Installing OpenWrt is usually easy: use wget to download openwrt-lantiq-xrx200-BTHOMEHUBV5A-ubifs-sysupgrade.tar (to /tmp), then run:
      sysupgrade /tmp/openwrt-lantiq-xrx200-BTHOMEHUBV5A-ubifs-sysupgrade.tar
      . If it isn't available from the repositories yet and you don't want to build it yourself, you might want to use a version that forum user connchri built. The Lede snapshot (.bin) file works quite well (nov 2016).
  6. After installation, the device will reboot automatically back to boot-over-UART (CFG 04) mode (regardless of whether you have boot_sel2 grounded, but now is a good time to check that you don't any more). Power it off and on again and you should see OpenWrt booting :-)
  7. If you want a web gui, from your nice new cmd prompt, make sure you have internet, and run 'opkg update' then 'opkg install luci'.

Installing LEDE (switching from original BT/Plusnet firmware to LEDE)

NAND bad block table (BBT) support has been introduced into LEDE r2363 - a different method (than described above) is required install LEDE. See also the link at the bottom of this page for the "Guide for installing LEDE r2363+ for HH5A".

Go to HomeHub 5 Type A install image web page and download the following files:

LEDE custom U-boot: lede-lantiq-bthomehubv5a_ram-u-boot.asc
LEDE HH5A installation image: lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin
  1. Use the earlier instructions to start U-boot with either: openwrt-lantiq-bthomehubv5a_ram-u-boot.asc or lede-lantiq-bthomehubv5a_ram-u-boot.asc file.
  2. Upload the HH5A installation image via tftp:
    tftpboot 0x81000000 lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin; bootm 0x81000000

    Booting at this stage is very slow - this might take 10 to 15 minutes!
  3. There are a few scripts that save you time so you don't have to type lots of commands manually.
    1. run ``prepare`` to prepare the LEDE installation
    2. Carefully read the instructions that the script provides
    3. Once the script is finished you have unlocked u-boot and changed the UBI volumes/partitions (LEDE is not installed yet)
    4. Installing LEDE is usually easy: use wget to download lede-lantiq-xrx200-BTHOMEHUBV5A-squashfs-sysupgrade.bin (to /tmp), then run:
      sysupgrade /tmp/lede-lantiq-xrx200-BTHOMEHUBV5A-squashfs-sysupgrade.bin
    5. After the installation has completed, the device will reboot automatically back to boot-over-UART (CFG 04) mode. Power cycle the hub to enable LEDE to boot.
    6. If the 'Plusnet Hub One' or 'BT Business Hub 5' presents you with a 'VR9 #' prompt, execute these commands, and power cycle the hub to enable LEDE to boot:
      setenv bootcmd ubi part UBI\; ubi read \$(loadaddr) kernel\; bootm \$(loadaddr)


Case label swconfig/kernel port number
1 4
2 2
3 0
4 1
WAN (red) 5
- 6 (CPU)
- 3 (unused)

Depending on your version of LuCI and your /etc/board.json, LuCI may display ports in various orders (matching the labels/matching the swconfig numbering/not matching anything) and may or may not list the WAN port even though it's available via swconfig.

  • If LuCI lists seven ports (Port 0 – Port 5 + CPU), it's probably using the swconfig numbering and ignoring /etc/board.json. Put up with the internal numbering or upgrade LuCI. On the bright side, you don't need to edit anything to make use of the WAN port.
  • If LuCI lists five ports (LAN 1 – LAN 4 + CPU), it's probably using either the case label numbering or a made-up numbering. Either way, it's probably based on /etc/board.json. You can either use /etc/config/network instead or edit /etc/board.json to make the UI include the WAN port (and if necessary, correct the numbering).

Notes about this quirky layout:

  • According to swconfig eth0 is the (only) interface through which the switch is configured, yet if you want to see traffic on switch port 5 (WAN) you'll need to add it to a VLAN and you'll see the traffic on eth1.N, which isn't presented as a choice in LuCI. (eth1 seems to behave both as a second CPU port and as a physical port on the switch, depending on context.)
    • For example, in the typical wired-WAN setup where you've put ports 1–4 in VLAN 1 and the WAN port in VLAN 2, you'd set InterfacesWANPhysical SettingsCustom Interface: eth1.2.
  • Since commit 3ea9c85e (mid-Aug 2016) LuCI can hide some of the layout oddness. /etc/board.d/02_network generates /etc/board.json which newer LuCI uses when presenting the Network → Switch page.
    • OpenWrt has an incorrect /etc/board.d/02_network as of r48941, but (with newer LuCI) you can edit /etc/board.json.
    • LEDE has a correct /etc/board.d/02_network as of 96f6bd501 so should have a correct /etc/board.json, but may not expose the WAN port.
  • In at least LEDE, at the kernel/driver/switch level the layout seems unlikely to change, so kernel messages and swconfig will use the non-obvious switch port numbering for the foreseeable future.
  • It's possible that configurations using eth1 may be unstable.
  • LAN and WAN may have been separated this way to avoid "tx ring" kernel errors; more clarity needed.
  • Changeset 40317 created the DTS with this odd layout and changeset 46223 copied it to create HH5A support — but it may simply reflect equally odd hardware layout.

Example board.json tweak


  • you want to use the WAN port, not DSL, for your uplink
  • you're using a LuCI newer than commit 3ea9c85e (mid-Aug 2016) meaning you see LAN 1 – LAN 4; either you're annoyed that you can't see port 5, or you're annoyed at the UI not matching the labelled ports
  • you can edit config files, probably via (serial or SSH) CLI access
  • you've made a backup copy of /etc/board.json already, or you're confident you can regenerate defaults using /etc/board.d/* later

Replace /etc/board.json with the following. Note that by doing this, you're not configuring anything. /etc/board.json is only meant to describe hardware properties and defaults. The changes to roles and network are just for internal consistency. Nonetheless, you should put your own unit's MAC address in network:*:macaddr.

{ "model": { "id": "BTHOMEHUBV5A", "name": "BT Home Hub 5A" }, "led": { "wifi": { "name": "wifi", "type": "trigger", "sysfs": "bthomehubv5a:blue:wireless", "trigger": "phy0tpt" }, "internet": { "name": "internet", "type": "netdev", "sysfs": "bthomehubv5a:blue:broadband", "device": "nas0", "mode": "link tx rx" }, "dimmed": { "name": "dimmed", "sysfs": "dimmed", "default": "0" } }, "switch": { "switch0": { "enable": true, "reset": true, "ports": [ { "num": 0, "role": "lan", "index": 3 }, { "num": 1, "role": "lan", "index": 4 }, { "num": 2, "role": "lan", "index": 2 }, { "num": 4, "role": "lan", "index": 1 }, { "num": 5, "role": "wan", "index": 5 }, { "num": 6, "device": "eth0", "need_tag": true } ], "roles": [ { "role": "lan", "ports": "0 1 2 4 6t", "device": "eth0.1" } { "role": "wan", "ports": "5 6t", "device": "eth1.2" } ] } }, "network": { "lan": { "ifname": "eth0.1", "protocol": "static", "macaddr": "18:62:2c:XX:XX:XX" }, "wan": { "ifname": "eth1.2", "protocol": "dhcp", "macaddr": <copy this from lan above, bump last octet up by one> } } }

Use with 'BT' Infinity (FTTC) UK VDSL

For my FTTC, in luci 'network/interfaces' I set 'dsl' to 'Annex B(all)' and left 'tone' where it was at 'A43C + J43 + A43 + V43', selected PTM, and VDSL.

In 'WAN' I set PPPoE and username and password (I'm on plusnet, so it's <username> + pwd). In Physical Settings, I selected 'Custom Interface' and entered 'ptm0.101' (apparently sets vlan 101 for BT network compatibility). A little guesswork….

Seems to work nicely.


toh/bt/homehub_v5a.txt · Last modified: 2017/10/11 08:12 by tmomas