User Tools

Site Tools

This wiki is read only and for archival purposes only. >>>>>>>>>> Please use the new OpenWrt wiki at <<<<<<<<<<

BT HomeHub 5.0 Type A

Information on this page also applies to the 'Plusnet Hub One' and 'BT Business Hub 5'

There is also a type B based on BCM63268, but for 802.11ac it uses the BCM4360 which has no open drivers, so it's a far less attractive target.

Supported Versions

OpenWrt support is available with these patches (currently only in trunk):


Branch Type Download link
n/a UART u-boot (allows booting via serial console) for installing LEDE lede-lantiq-bthomehubv5a_ram-u-boot.asc
n/a Image which can be booted via TFTP to simplify the switch from OEM firmware to OpenWRT/LEDE lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin
n/a LEDE Installation Guide for BT Home Hub 5A Ebilan forum Mirror
n/a LEDE 17.01.4 (Oct 2017) squashfs sysupgrade - stable build lede-17.01.4-lantiq-xrx200-BTHOMEHUBV5A-squashfs-sysupgrade.bin
n/a OpenWRT squashfs sysupgrade - snapshot build openwrt-lantiq-xrx200-bt_homehub-v5a-squashfs-sysupgrade.bin
n/a Serial console instructions using MS Windows Ebilan forum Mirror
n/a Safe easy serial access without soldering, takes 10 mins (PDF) dmcdonnell



Architecture: MIPS
Vendor: Lantiq
Bootloader: U-Boot
System-On-Chip: Lantiq Xway VR9 VRX268 PSB 80910 (MIPS 34Kc) v1.2.1
CPU/Speed: 500 MHz
NOR Flash: n/a
NAND Flash: 128MiB Spansion ML01G100BHI00
RAM Chip: Samsung K4T1G164QF-BCF7
RAM Specs: DDR2 128MiB @ 250MHz
Wireless: Atheros AR9227 b/g/n 2x2 +
Qualcomm QCA9880-BR4A a/b/g/n+ac 3x3
Ethernet: 5x 10/100/1000 BASE-TX Ethernet Interface (1x WAN, 4x LAN)
(2x XWAY VR9 GPHY 11G & 3x XWAY PEF7071 via RGMII)
Switch: Internal configurable (Infineon)
xDSL: Lantiq XWAY VRX208
ADSL1/2/2+ (G.992.1/3/5) Annexes A, B, I, J, M, L,
VDSL1 (G.993.1, T1.424, TS 101 270),
VDSL2 (G.993.2),
ITU-T G 998.2 Bonding,
EFM (IEEE 802.3ah)
USB: 1x USB 2.0
DECT: no
Serial: Yes
GPIO Buttons: WPS, Restart and Reset buttons
Power: External 12V 1.5A

Case opening

The following video shows how to open the case without damaging it. Youtube video

PCB Photos


Example: (note: gnd soldered to pins 1 and 4 on the 5 pin header. First 3 pins on header are gnd+serial, 4th and 5th pins gnd+boot-sel2 for link to select uart boot; header protrudes from base).

Resistor number Function Info Notes
R77 Serial TX Bottom of the board, below the NAND flash You can also solder to the pad right of it
R78 Serial RX Below R78 You can also solder to the pad right of it
R45 boot_sel2 Vertically mounted, below R78 You can also solder to the pad above it
R46 boot_sel3 Front of the PCB, next to SW4 (WPS button); not needed for installation over serial -
GND Outer part of the USB connector where it passes through PCB -

Serial uses Baud rate 115200.

To boot via UART you need to pull boot_sel2 (results in CFG 0x4) to GND.

Installation over serial

To install OpenWrt on your HH5A or to recover from a failed u-boot flash you can boot the device via UART (serial console). This requires that:

  1. you are able to connect to the serial console of the device (using for example a USB to serial adapter)
  2. you are able to solder four wires to the PCB of the device (three of them are SMD solder points)!
  3. see the download table above for how to get serial access in 10 minutes WITHOUT soldering!

Once you have prepared everything you can boot u-boot via UART:

  1. Power off your HH5A
  2. Enable UART boot by connecting boot_sel2 to GND
  3. Power on your device
    You should see a message similar to this:
    ROM VER: 1.1.4
    CFG 04
  4. Remove the connection between boot_sel2 and GND
  5. Load u-boot via serial console into the device's memory (this takes approx. 3 minutes): lede-lantiq-bthomehubv5a_ram-u-boot.asc. under linux you can use picocom to connect as follows:

picocom -b 115200 /dev/ttyUSB0
NEW: In picocom, press <Ctrl-a> <Ctrl-s> and enter the full path to the lede-lantiq-bthomehubv5a_ram-u-boot.asc to send the bootcode.

Alternatively, open another terminal and execute the following command to send the bootcode

cat lede-lantiq-bthomehubv5a_ram-u-boot.asc > /dev/ttyUSB0
Now you should see the BTHOMEHUBV5A# u-boot prompt.

Note that operating in this mode is atypically slow. The CPU clock (normally 500MHz) and buses (normally 250MHz) are running at 125MHz for some reason, but the installed system will run at full speed.

(one reason that it's running very slowly is that the cache is turned off for the serially loaded u-boot build)

Installing OpenWRT/LEDE (switching from original BT/Plusnet firmware to LEDE)

Use these instructions to install all stable and snapshot builds of LEDE released after 30 November 2016, and all snapshots of OpenWRT released from January 2018.

Go to HomeHub 5 Type A install image web page and download the following files:

LEDE custom U-boot: lede-lantiq-bthomehubv5a_ram-u-boot.asc
LEDE HH5A installation image: lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin

It is also recommended to download and study the LEDE Installation Guide for BT Home Hub 5A.

  1. Use the earlier instructions to start U-boot with either: openwrt-lantiq-bthomehubv5a_ram-u-boot.asc or lede-lantiq-bthomehubv5a_ram-u-boot.asc file.
  2. Connect to the HomeHub over ethernet (any port works) at address Ensure that the address is free for the HomeHub to use.
  3. Serve lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin over TFTP. For example, on a Linux machine:
    mkdir -p /tftpboot
    wget -O /tftpboot/lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin
    chmod 777 /tftpboot
    atftpd --bind-address --daemon --no-fork /tftpboot/
  4. Over the serial console, type
    tftpboot 0x81000000 lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin; bootm 0x81000000

    Booting at this stage is very slow - this might take 10 to 15 minutes!
  5. Back up the original stock firmware using the instructions provided on screen. You will need a USB flash drive, formatted FAT32 or exFAT. Check the size of the saved file is approx 128 MiB.
  6. There are a few scripts that save you time so you don't have to type lots of commands manually.
    1. run ``prepare`` to prepare the LEDE installation
    2. Carefully read the instructions that the script provides
    3. Once the script is finished you have unlocked u-boot and changed the UBI volumes/partitions (LEDE is not installed yet)
    4. Installing LEDE is usually easy: use wget to download lede-lantiq-xrx200-BTHOMEHUBV5A-squashfs-sysupgrade.bin (to /tmp), then run:
      sysupgrade /tmp/lede-lantiq-xrx200-BTHOMEHUBV5A-squashfs-sysupgrade.bin
      or more easily download and copy the lede-lantiq-xrx200-BTHOMEHUBV5A-squashfs-sysupgrade.bin image to the USB stick you used to backup the firmware earlier. You can then run
      sysupgrade /mnt/lede-lantiq-xrx200-BTHOMEHUBV5A-squashfs-sysupgrade.bin
    5. After the installation has completed, the device will reboot automatically back to boot-over-UART (CFG 04) mode. Power cycle the hub to enable LEDE to boot.
    6. If the hub presents you with a 'VR9 #' prompt, execute these two commands, and power cycle the hub to enable LEDE to boot:
      setenv bootcmd ubi part UBI\; ubi read \$(loadaddr) kernel\; bootm \$(loadaddr)
    7. Once the initial LEDE firmware has been installed, newer firmware can be installed using the LuCI web interface. Make a backup of your settings before updating.


Case label swconfig/kernel port number
1 4
2 2
3 0
4 1
WAN (red) 5
- 6 (CPU)
- 3 (unused)

Depending on your version of LuCI and your /etc/board.json, LuCI may display ports in various orders (matching the labels/matching the swconfig numbering/not matching anything) and may or may not list the WAN port even though it's available via swconfig.

  • If LuCI lists seven ports (Port 0 – Port 5 + CPU), it's probably using the swconfig numbering and ignoring /etc/board.json. Put up with the internal numbering or upgrade LuCI. On the bright side, you don't need to edit anything to make use of the WAN port.
  • If LuCI lists five ports (LAN 1 – LAN 4 + CPU), it's probably using either the case label numbering or a made-up numbering. Either way, it's probably based on /etc/board.json. You can either use /etc/config/network instead or edit /etc/board.json to make the UI include the WAN port (and if necessary, correct the numbering).

Notes about this quirky layout:

  • According to swconfig eth0 is the (only) interface through which the switch is configured, yet if you want to see traffic on switch port 5 (WAN) you'll need to add it to a VLAN and you'll see the traffic on eth1.N, which isn't presented as a choice in LuCI. (eth1 seems to behave both as a second CPU port and as a physical port on the switch, depending on context.)
    • For example, in the typical wired-WAN setup where you've put ports 1–4 in VLAN 1 and the WAN port in VLAN 2, you'd set InterfacesWANPhysical SettingsCustom Interface: eth1.2.
  • Since commit 3ea9c85e (mid-Aug 2016) LuCI can hide some of the layout oddness. /etc/board.d/02_network generates /etc/board.json which newer LuCI uses when presenting the Network → Switch page.
    • OpenWrt has an incorrect /etc/board.d/02_network as of r48941, but (with newer LuCI) you can edit /etc/board.json.
    • LEDE has a correct /etc/board.d/02_network as of 96f6bd501 so should have a correct /etc/board.json, but may not expose the WAN port.
  • In at least LEDE, at the kernel/driver/switch level the layout seems unlikely to change, so kernel messages and swconfig will use the non-obvious switch port numbering for the foreseeable future.
  • It's possible that configurations using eth1 may be unstable.
  • LAN and WAN may have been separated this way to avoid "tx ring" kernel errors; more clarity needed.
  • Changeset 40317 created the DTS with this odd layout and changeset 46223 copied it to create HH5A support — but it may simply reflect equally odd hardware layout.

Example board.json tweak


  • you want to use the WAN port, not DSL, for your uplink
  • you're using a LuCI newer than commit 3ea9c85e (mid-Aug 2016) meaning you see LAN 1 – LAN 4; either you're annoyed that you can't see port 5, or you're annoyed at the UI not matching the labelled ports
  • you can edit config files, probably via (serial or SSH) CLI access
  • you've made a backup copy of /etc/board.json already, or you're confident you can regenerate defaults using /etc/board.d/* later

Replace /etc/board.json with the following. Note that by doing this, you're not configuring anything. /etc/board.json is only meant to describe hardware properties and defaults. The changes to roles and network are just for internal consistency. Nonetheless, you should put your own unit's MAC address in network:*:macaddr.

{ "model": { "id": "BTHOMEHUBV5A", "name": "BT Home Hub 5A" }, "led": { "wifi": { "name": "wifi", "type": "trigger", "sysfs": "bthomehubv5a:blue:wireless", "trigger": "phy0tpt" }, "internet": { "name": "internet", "type": "netdev", "sysfs": "bthomehubv5a:blue:broadband", "device": "nas0", "mode": "link tx rx" }, "dimmed": { "name": "dimmed", "sysfs": "dimmed", "default": "0" } }, "switch": { "switch0": { "enable": true, "reset": true, "ports": [ { "num": 0, "role": "lan", "index": 3 }, { "num": 1, "role": "lan", "index": 4 }, { "num": 2, "role": "lan", "index": 2 }, { "num": 4, "role": "lan", "index": 1 }, { "num": 5, "role": "wan", "index": 5 }, { "num": 6, "device": "eth0", "need_tag": true } ], "roles": [ { "role": "lan", "ports": "0 1 2 4 6t", "device": "eth0.1" } { "role": "wan", "ports": "5 6t", "device": "eth1.2" } ] } }, "network": { "lan": { "ifname": "eth0.1", "protocol": "static", "macaddr": "18:62:2c:XX:XX:XX" }, "wan": { "ifname": "eth1.2", "protocol": "dhcp", "macaddr": <copy this from lan above, bump last octet up by one> } } }

Use with 'BT' Infinity (FTTC) UK VDSL

For my FTTC, in luci 'network/interfaces' I set 'dsl' to 'Annex B(all)' and left 'tone' where it was at 'A43C + J43 + A43 + V43', selected PTM, and VDSL.

In 'WAN' I set PPPoE and username and password (I'm on plusnet, so it's <username> + pwd). In Physical Settings, I selected 'Custom Interface' and entered 'ptm0.101' (apparently sets vlan 101 for BT network compatibility). A little guesswork….

Seems to work nicely.

To update from any previously installed version of OpenWrt, or LEDE prior to r2363 (30 Nov 2016), to LEDE snapshot r2363 and later, it is recommended to restore the stock BT Firmware, and then proceed to install the latest LEDE snapshot from scratch. Alternatively, a 'migrate' script is also available where no original nanddump is available.

Obsolete Instructions

Creating a backup of the original firmware

These instructions are obsolete. Instructions for backing up stock firmware are found in the section "Installing OpenWRT/LEDE (switching from original BT/Plusnet firmware to LEDE)"

It is recommended to use a USB-stick for creating the backup.

  1. Start u-boot via UART (see above for the details)
  2. Load the installation image onto a tftp server at address, ensure that the address is free for the HomeHub to use. Any Ethernet port on the HomeHub can be used to connect to the ttp server.
  3. Upload the "initial installation image" openwrt-lantiq-xrx200-BTHOMEHUBV5A-install-uImage-initramfs via tftp:
    tftpboot openwrt-lantiq-xrx200-BTHOMEHUBV5A-install-uImage-initramfs; bootm
    Booting at this stage is very slow - this might take 10 to 15 minutes!
  4. Now you can create a backup of the full flash:
    1. Method #1: backup to a USB flash drive (has to be FAT32 formatted and needs approx. 260M free space) - note that this takes quite some time (>1/2 hour)
      mount /dev/sda1 /mnt/
      nanddump -f /mnt/hh5a.nanddump /dev/mtd6
      dd if=/dev/mtd6 of=/mnt/hh5a.dd
    2. Method #2: backup to another computer on the network using netcat. This can take around 35 minutes(!); not sure whether it's the mtd read or the ethernet write that's so slow.
      1. On the host computer run:
        ncat -l 60000 > ~/hh5a.ncat-dump
      2. On the HH5A:
        nc 60000 < /dev/mtd6
  5. Create a backup of the calibration data (WARNING: You will need this data - otherwise lots of functionality in OpenWrt will be useless)
    1. First detach any existing UBIs (NOTE: there's no problem if this fails - it just means you haven't attached any UBI FS before)
      ubidetach -m 4
      ubidetach -m 5
    2. The create the actual backup (this must NOT show any errors!)
      ubiattach -m 5
      dd if=/dev/ubi0_3 of=/tmp/hh5a-caldata-backup
    3. Then copy /tmp/hh5a-caldata-backup to a USB-stick or send it via netcat to another PC (see full backup instructions)
  6. You can carry on directly to the next step (no need to UART/TFTP again) if you like.

Installing OpenWrt (switching from original firmware to OpenWrt)

These instructions are obsolete. Please refer the the next section "Installing OpenWRT/LEDE (switching from original BT/Plusnet firmware to LEDE)" for instructions for installing snapshots released since January 2018.

(this method is more risky than the LEDE method below, as it replaces the bootloader / u-boot and is prone to the NAND read errors)

  1. Start u-boot via UART (see above for the details)
  2. Upload the "initial installation image" openwrt-lantiq-xrx200-BTHOMEHUBV5A-install-uImage-initramfs via tftp:
    tftpboot openwrt-lantiq-xrx200-BTHOMEHUBV5A-install-uImage-initramfs; bootm

    Booting that this stage is very slow - this might take 10 to 15 minutes!
  3. Make sure you made a backup using above instructions!
  4. Make sure you have a caldata backup!
  5. The "initial installation image" contains a little script that automates the installation for you
    1. Run
      (the source of the script can be found here:
    2. Carefully read the instructions that the script provides
    3. Once the script is finished you have an unlocked u-boot installed (but no OpenWrt yet)
    4. Installing OpenWrt is usually easy: use wget to download openwrt-lantiq-xrx200-BTHOMEHUBV5A-ubifs-sysupgrade.tar (to /tmp), then run:
      sysupgrade /tmp/openwrt-lantiq-xrx200-BTHOMEHUBV5A-ubifs-sysupgrade.tar
      . If it isn't available from the repositories yet and you don't want to build it yourself, you might want to use a version that forum user connchri built. The Lede snapshot (.bin) file works quite well (nov 2016).
  6. After installation, the device will reboot automatically back to boot-over-UART (CFG 04) mode (regardless of whether you have boot_sel2 grounded, but now is a good time to check that you don't any more). Power it off and on again and you should see OpenWrt booting :-)
  7. If you want a web gui, from your nice new cmd prompt, make sure you have internet, and run 'opkg update' then 'opkg install luci'.


toh/bt/homehub_v5a.txt · Last modified: 2018/02/10 15:55 by heafield