User Tools

Site Tools


toh:observatelecom:vh4032n

Observa Telecom VH4032N

Router provided by Vodafone VDSL customers.

Hardware Highlights

SoC CPU MHz Flash MB RAM MB WLAN Hardware WLAN2.4 100M ports USB
BCM6368 2x 400 32 128 BCM43222 (onboard) b/g/n 4 3x 2.0

Installation

Installation via CFE web (http) server

The RESET button doesn't work in this router for entering CFE failsafe. We will use the serial port TX-RX shortcircuit trick, otherwise a serial TTL adapter is required. The Openwrt image size should be at least 16 MB size to avoid the double image backup, otherwise CFE could decide to flash the image at the middle of the flash and Openwrt won't boot this way.

  1. Set a static IP on your computer, use 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
  2. Unplug the router's power cord
  3. Shortcircuit TX and RX serial pins (this will simulate keyboard buttons pressing on the serial port; ugly but it should work)
  4. Plug the router's power cord and wait 3 or more seconds
  5. Remove the TX-RX shortcircuit.
  6. Browse to http://192.168.1.1, you should see this screen:
  7. Send the new firmware and wait some minutes until the firmware upgrade finish.
  8. ssh / telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.

It's also possible to attach a serial console (serial TTL cable adapter required). Press any key at the console when starting up the router.

Hardware

Info

Instruction set: MIPS
Vendor: Broadcom
Bootloader: CFE
Board ID: 96368VVW
System-On-Chip: Broadcom BCM6368
CPU/Speed BMIPS4350 v3.1 / 2x 400 MHz
Flash-Chip: S29GL256P10 / 128Kbyte Sector size x 256 sectors
Flash size: 32 MiB
RAM-Chip: EM6AB160TSA-5G / DDR-400
RAM size: 128 MiB
Wireless: BCM43222 (14e4:a8d6) 802.11b/g/n (onboard)
Antenna 2x internal, PCB detachable (UFL connectors)
Ethernet: 4x 100M, BCM6368 integrated
USB 3x 2.0 (NEC 720114 USB HUB)
Serial: Yes
JTAG: Yes

Photos

Main PCB
observa_vh4032n_board_top.jpg

USB HUB IC:
observa_vh4032n_board_usb.jpg

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

You can attach the typical USB to UART 3.3V TTL serial adapter, only connect TX, RX and GND.

  • Baudrate: 115200

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

12 pin J201 pinheader, near the serial port:

- 1 2 GND
TDI 3 4 GND
TDO 5 6 GND
TMS 7 8 GND
TCK 9 10 GND
- 11 12 GND

Not yet verified/tested.

GPIOs

GPIO pin active description, location
0 BCM6302 CHIP
1 R247
2 low LED Dsl blue
3 R1044, relay RJ11
4 TP202
5 low LED Dsl red
6 low LED Lan1
7 low LED Lan2
8 low LED Lan3
9 low LED Lan4
10 R917, U902, U1002
11 low LED Hspa blue
12 low LED Hspa red
13 FB206
14 R245
21 R246
22 high LED Power blue
23 R247
24 high LED Power red
25 low LED Voice blue
26 low LED Voice red
27 low USB HUB RST#
28 U902
29 U1002
30 R1045, rj11 relay
31 TP214
32 R248
34 low BUTTON Reset
35 low BUTTON WPS
36 U1002
37 U902

Hardware mods

→ as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

Overclocking

As default the CPU is configured to operate at 400 MHz. Soldering a 4,7 kohm resistor at R238, R235 and R240, will configure the CPU to operate at 533 MHz

Thanks to Warryor for locating these resistors

Bootlogs

OEM Bootlog

TODO


OpenWrt Bootlog

CFE version 1.0.37-102.15 for BCM96368 (32bit,SP,BE) Build Date: Wed Feb 10 09:57:47 CST 2010 (link@hpnb) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201, size 32768KB CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz CPU running TP0 Total memory: 134217728 bytes (128MB) Boot Address 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 3 Board Id (0-4) : 96368VVW Number of MAC Addresses (1-32) : 11 Base MAC Address : e4:c1:46:bd:9b:bf PSI Size (1-64) KBytes : 64 Main Thread Number [0|1] : 0 Serial Number (20) : V130B41018888 Vendor Specific 01 (40) : HFcpVwykkruPxX Vendor Specific 02 (40) : Vendor Specific 03 (40) : *** Press any key to stop auto run (3 seconds) *** Auto run second count down: 0 Booting from only image (0xb8020000) ... Code Address: 0x80A00000, Entry Address: 0x80a00000 LZMA: Prossible old LZMA format, trying to decompress.. Decompression OK! Entry at 0x80a00000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 30 buffers found. Closing DMA Channels. Starting program at 0x80a00000 [ 0.000000] Linux version 4.1.20 (tki2k@Ubuntu) (gcc version 5.3.0 (OpenWrt GCC 5.3.0 r49199) ) #1 SMP Sun May 1 21:29:43 UTC 2016 [ 0.000000] Detected Broadcom 0x6368 CPU revision b2 [ 0.000000] CPU frequency is 400 MHz [ 0.000000] 128MB of RAM installed [ 0.000000] board_bcm963xx: Boot address 0xb8000000 [ 0.000000] board_bcm963xx: CFE version: 1.0.37-102.15 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0002a031 (Broadcom BMIPS4350) [ 0.000000] board: board name: VH4032N [ 0.000000] MIPS: machine is Observa VH4032N [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] PERCPU: Embedded 10 pages/cpu @81106000 s10048 r8192 d22720 u40960 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Memory: 124180K/131072K available (3175K kernel code, 139K rwdata, 732K rodata, 1320K init, 203K bss, 6892K reserved, 0K cma-reserved) [ 0.000000] Hierarchical RCU implementation. [ 0.000000] NR_IRQS:256 [ 0.000000] clocksource MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns [ 0.000016] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns [ 0.008673] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648) [ 0.046960] pid_max: default: 32768 minimum: 301 [ 0.052386] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.059167] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.072778] SMP: Booting CPU1... [ 11.408647] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 11.408663] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 11.408969] CPU1 revision is: 0002a031 (Broadcom BMIPS4350) [ 0.124962] Synchronize counters for CPU 1: [ 0.124963] SMP: CPU1 is running [ 0.124981] done. [ 0.125175] Brought up 2 CPUs [ 0.144036] clocksource jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns [ 0.155442] NET: Registered protocol family 16 [ 0.165594] registering PCI controller with io_map_base unset [ 0.196222] PCI host bridge to bus 0000:00 [ 0.200464] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff] [ 0.207665] pci_bus 0000:00: root bus resource [io 0x8000000-0x800ffff] [ 0.214524] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0] [ 0.221509] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.237501] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x30003fff] [ 0.247407] Switched to clocksource MIPS [ 0.254387] PCI: Enabling device 0000:00:01.0 (0000 -> 0002) [ 0.280469] ssb: Found chip with id 0xA8D6, rev 0x00 and package 0x08 [ 0.345633] ssb: Sonics Silicon Backplane found on PCI device 0000:00:01.0 [ 0.353571] NET: Registered protocol family 2 [ 0.359768] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 0.366988] TCP bind hash table entries: 1024 (order: 1, 8192 bytes) [ 0.373538] TCP: Hash tables configured (established 1024 bind 1024) [ 0.380252] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 0.386281] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 0.393234] NET: Registered protocol family 1 [ 0.400271] futex hash table entries: 512 (order: 1, 8192 bytes) [ 0.408015] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.414046] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.427200] io scheduler noop registered [ 0.431253] io scheduler deadline registered (default) [ 0.438722] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 10, base_baud = 1Š[ 0.448365] console [ttyS0] enabled [ 0.448365] console [ttyS0] enabled [ 0.455489] bootconsole [early0] disabled [ 0.455489] bootconsole [early0] disabled [ 0.464745] bcm63xx-rng bcm63xx-rng: registered RNG driver [ 0.472102] 18000000.nor: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x000001 Chip ID 0x002201 [ 0.482441] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.487704] Amd/Fujitsu Extended Query version 1.3. [ 0.492879] number of CFI chips: 1 [ 0.496707] bcm63xxpart: CFE boot tag found with version 6 and board type 96368VVW [ 0.504605] 5 bcm63xxpart partitions found on MTD device 18000000.nor [ 0.511255] Creating 5 MTD partitions on "18000000.nor": [ 0.516731] 0x000000000000-0x000000020000 : "CFE" [ 0.523675] 0x000000020100-0x00000016a5a4 : "kernel" [ 0.530667] 0x00000016a5a4-0x000001fe0000 : "rootfs" [ 0.537662] mtd: device 2 (rootfs) set to be root filesystem [ 0.543521] 1 squashfs-split partitions found on MTD device rootfs [ 0.549871] 0x000000460000-0x000001fe0000 : "rootfs_data" [ 0.557369] 0x000000020000-0x000001fe0000 : "linux" [ 0.564550] 0x000001fe0000-0x000002000000 : "nvram" [ 0.573183] bcm63xx-spi bcm63xx-spi: at 0xb0000800 (irq 9, FIFOs size 542) [ 0.620977] b53_common: found switch: BCM63xx, rev 0 [ 0.626758] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.637821] NET: Registered protocol family 10 [ 0.645036] NET: Registered protocol family 17 [ 0.649737] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this. [ 0.662759] 8021q: 802.1Q VLAN Support v1.8 [ 0.677170] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.699248] Freeing unused kernel memory: 1320K (80406000 - 80550000) [ 2.061077] init: Console is alive [ 2.064948] init: - watchdog - [ 3.435292] usbcore: registered new interface driver usbfs [ 3.441119] usbcore: registered new interface driver hub [ 3.446759] usbcore: registered new device driver usb [ 3.459577] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 3.467911] ehci-platform: EHCI generic platform driver [ 3.575433] ehci-platform ehci-platform: EHCI Host Controller [ 3.581381] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 [ 3.589751] ehci-platform ehci-platform: irq 15, io mem 0xb0001500 [ 3.607419] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 3.617194] hub 1-0:1.0: USB hub found [ 3.621141] hub 1-0:1.0: 2 ports detected [ 3.630087] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 3.638048] ohci-platform: OHCI generic platform driver [ 3.643619] ohci-platform ohci-platform: Generic Platform OHCI controller [ 3.650637] ohci-platform ohci-platform: new USB bus registered, assigned bus number 2 [ 3.658930] ohci-platform ohci-platform: irq 13, io mem 0xb0001600 [ 3.725297] hub 2-0:1.0: USB hub found [ 3.729253] hub 2-0:1.0: 2 ports detected [ 3.736678] init: - preinit - [ 4.123473] usb 1-2: new high-speed USB device number 2 using ehci-platform [ 4.261455] hub 1-2:1.0: USB hub found [ 4.265794] hub 1-2:1.0: 2 ports detected [ 4.312931] random: procd urandom read with 56 bits of entropy available Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 7.794983] jffs2_scan_eraseblock(): End of filesystem marker found at 0x20000 [ 7.802491] jffs2_build_filesystem(): unlocking the mtd device... done. [ 7.809236] jffs2_build_filesystem(): erasing all blocks after the end marker... [ 12.215456] random: nonblocking pool is initialized [ 110.797002] done. [ 110.798970] jffs2: notice: (276) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 110.817831] mount_root: overlay filesystem has not been fully initialized yet [ 110.826846] mount_root: switching to jffs2 overlay - config restore - ifconfig: SIOCGIFFLAGS: No such device [ 111.284918] procd: - early - [ 111.288183] procd: - watchdog - [ 112.076493] procd: - ubus - [ 112.133161] procd: - init - Please press Enter to activate this console. [ 113.505135] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 113.527601] Loading modules backported from Linux version v4.4-rc5-1913-gc8fdf68 [ 113.535216] Backport generated by backports.git backports-20151218-0-g2f58d9d [ 113.546722] ip_tables: (C) 2000-2006 Netfilter Core Team [ 113.568711] nf_conntrack version 0.5.0 (1960 buckets, 7840 max) [ 113.659090] xt_time: kernel timezone is -0000 [ 113.768139] PPP generic driver version 2.4.2 [ 113.775528] NET: Registered protocol family 24 [ 113.815287] b43-phy0: Broadcom 43222 WLAN found (core revision 16) [ 113.851455] b43-phy0: Found PHY: Analog 8, Type 4 (N), Revision 6 [ 113.857766] b43-phy0: Found Radio: Manuf 0x17F, ID 0x2056, Revision 6, Version 0 [ 113.877050] Broadcom 43xx driver loaded [ Features: PNL ] [ 123.884077] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port4, 100Mbps, full-duplex [ 123.909417] device eth0.1 entered promiscuous mode [ 123.914440] device eth0 entered promiscuous mode [ 123.937495] br-lan: port 1(eth0.1) entered forwarding state [ 123.943403] br-lan: port 1(eth0.1) entered forwarding state [ 125.943450] br-lan: port 1(eth0.1) entered forwarding state BusyBox v1.24.2 () built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- DESIGNATED DRIVER (Bleeding Edge, r49199) ----------------------------------------------------- * 2 oz. Orange Juice Combine all juices in a * 2 oz. Pineapple Juice tall glass filled with * 2 oz. Grapefruit Juice ice, stir well. * 2 oz. Cranberry Juice ----------------------------------------------------- root@OpenWrt:/#


Tags

toh/observatelecom/vh4032n.txt · Last modified: 2017/09/15 13:15 by danitool