BT Home Hub 1.0 and 1.5

White or black boxes given away with a BT (British Telecom) broadband subscription in UK. The first noticeable difference between V1 and the V1.5 is the shape and size. Under the cover they are identical apart from a slight pcb revision, addition of 5 extra red led's and two extra buttons on the V1.5.

There are other routers based on the same board as the Home Hub V1. Known are: Speedtouch 7g and Aolbox although there may be more.

The Home Hub includes ADSL2+, 802.11b/g wireless, host and slave USB ports, 2 wired ethernet ports, DECT, FXS & FXO ports and VOIP functionality.

All members of the BT Home Hub OpenWrt community are now encouraged to join in ongoing development efforts on later models at

Not supported yet. However you can install OpenWrt (no ADSL) using a custom CFE.

Bootloader (CFE), OpenWrt prebuilt firmware, and patches to build your own firmware:
SoC Ram Flash Ethernet USB Wireless Serial JTag VOIP FXS
Broadcom BCM96348 32MB 8MB 2 Yes yes Yes Yes yes yes

Based on FIrmware

0x00000000-0x0003FFFF Space allocated for bootloader - includes board parameters (serial number, Board type, MAC address, etc)
0x00040000-0x000FFFFF JFFS2 User partition
0x00100000-0x0010000F Firmware version magic
0x00100010-0x001AFFFF Linux Kernel
0x001B0000-0x007FFFFF Squashfs root fs

It is somewhat different from the usual Broadcom layout. Probably due to the fact that this board does not use the CFE bootloader but uses a proprietory loader instead who's origins are unknown. This supplied bootloader is useless. I went through Tens of bootloaders before i come across a redboot loader from the inventel livebox and modified it to work with the Home Hub. Now i have recently discovered that this very same bootloader from the livebox is used in the Aolbox wich has a board identical to the Home Hub but uses different RAM memory thus the Aolbox/livebox and Home Hub bootloaders are not directly interchangeable.

You can access the flash via jtag at 1f400000 provided the Home Hub bootloader is running. If the loader is not running ie, bad flash you can access bootloader at 1fc00000+. The The flash chip is actually mapped at 1f800000-1fffffff while the mips boot address is 1fc00000 (half way through the physical flash address). The hub bootloader actally remaps the 4MB at 1fc00000 back before the physical start of the flash. Eg, actual 1f800000-1fffffff # copy 1fc00000-1fffffff to 1f400000 # now the flash lives at 1f400000-1fbfffff.

Please check out the article flash.layout. It contains an example and a couple of explanations.

This section deals with how you install OpenWrt once the OEM bootloader is replaced by a new CFE.

  • Unplug the power cord
  • Press the button labeled as reset, don't release it yet!
  • Plug the power cord
  • Wait 10 seconds
  • Release the reset button
  • Select .bin file
  • Upgrade the image
  • Wait for it to reboot
  • Telnet to and set a root password, or browse to if LuCI is installed. or browse to if LuCI is installed.


If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

LuCI Web Upgrade Process

Terminal Upgrade Process

  • Login as root via SSH on
  • Use the following commands to upgrade.
cd /tmp/
wget http://
sysupgrade /tmp/
  • If sysupgrade does not support this router, use the following commands.
cd /tmp/
wget http://
mtd write /tmp/ linux && reboot

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi
eth0 WAN dhcp
eth1 LAN bridged
wlan0 WiFi disabled

hardware.button on howto use and configure the hardware button(s).

The Home Hub 1 has only 1 button

Reset reset
Instruction set MIPS
Vendor Broadcom
bootloader Unknown (custom Thomson)
Can be replaced by cfe
System-On-Chip BCM6348
CPU/Speed BMIPS3300 V0.7 / 256 MHz
Flash-Chip Spansion S29GL064A11TFIR4, 64Mbit, 8MByte, Pointless bottom boot blocks
Flash size 8 MiB
RAM-Chip Qimonda HYB39SC256160FE-7, 8Mbitx16bit, 32MByte, 133MHz
RAM size 32 MiB
Wireless BCM4318 802.11b/g (onboard), using seperate radio amplifier and diversity switch via pci
Ethernet 1x internal PHY + 1x external PHY (Altima AC101 MII PHY)
Internet ADSL2+, not supported in OpenWrt
DECT Philips/NXP PCD80705 Baseband DECT processor via spi
Slic Silicon Labs si3230 ProSLIC
Serial Yes

There are plenty of pictures of the Home Hub on the internet so i wont fill this space with its cover on.





HomeHub V1.0 HomeHub V1.5
Top view Top view
homehub1_pcb_top.jpg homehub15_pcb_top.jpg
This one has had its led wiring changed to suit the Speedtouch 7G firmware Note the extra 2 buttons and their position and the shape of the board. The led's are now on the other side too.
Bottom view Bottom view
homehub1_pcb_bottom.jpg homehub15_pcb_bottom.jpg
Note changes to the led type. They are now tri colour (green+red=orange). I have fitted it with a crude jtag connector.

port.gpio general information about GPIO


label color GPIO active
Lan Activity green 0 high
Upgrade green 1 high
Broadband (ADSL) green 2 high
WiFi green 3 high
Phone (icon) green 4 high
name GPIO active
reset 36 low


label color GPIO active
name GPIO active
reset 35 FIXME

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:
- Solder a 4 pin header - Use a TTL serial cable

Photo of PCB with markings


  • Baudrate: 115200
  • Data bits: 8
  • Parity: None
  • Stop bits: 1

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

For reading/writing to the flash you can use UrJTAG (latest svn). UrJTAG is able to operate in DMA mode with bcm63xx boards, then it's faster than hairydairymaid.

Backup whole flash

  1. Connect your JTAG cable from your computer to your board
  2. Execute UrJTAG in root mode:
    sudo jtag
  3. Power on the board
  4. Immediately execute these commands:
    cable dlc5 ppdev /dev/parport0
    endian big
    initbus ejtag_dma
    detectflash 0x1f800000
    readmem 0x1f800000 0x800000 homehub1_backup.bin

Restore whole flash

  1. Connect your JTAG cable from your computer to your board
  2. Execute UrJTAG in root mode:
    sudo jtag
  3. Power on the board
  4. Immediately execute these commands:
    cable dlc5 ppdev /dev/parport0
    endian big
    initbus ejtag_dma
    detectflash 0x1f800000
    flashmem 0x1f800000 homehub1_backup.bin

Flashing a bootloader

  1. Connect your JTAG cable from your computer to your board
  2. Execute UrJTAG in root mode:
    sudo jtag
  3. Power on the board
  4. Immediately flash the new bootloader:
    cable dlc5 ppdev /dev/parport0
    endian big
    initbus ejtag_dma
    detectflash 0x1f800000
    flashmem 0x1fc00000 CFE_homehub1-nvr.bin

Decompressing Bootloader................................. Speedtouch initialization sequence started. BOOTING THE THOMSON LINUX KERNEL Starting the kernel @ 0x801bc018 serial initialized Linux version ( (gcc version 3.4.2) #1 Mon Nov 12 09:53:50 CET 2007 CPU revision is: 00029107 bcm63xx : initiazation of mpi bus ............... Determined physical RAM map: memory: 01f7d000 @ 00002000 (usable) On node 0 totalpages: 8063 DMA zone: 4096 pages, LIFO batch:1 Normal zone: 3967 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=/dev/mtdblock1 rootfstype=squashfs brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 8kB 2-way, linesize 16 bytes. PID hash table entries: 128 (order 7: 1024 bytes) Using 128.000 MHz high precision timer. Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 29968k/32244k available (1450k kernel code, 2232k reserved, 258k data, 68k init, 0k highmem) Calibrating delay loop... 251.39 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... available. NET: Registered protocol family 16 usbcore: registered new driver usbfs usbcore: registered new driver hub Bluetooth: Core ver 2.6 NET: Registered protocol family 31 Bluetooth: HCI device and connection manager initialized Bluetooth: HCI socket layer initialized squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for by jro JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc. bcm963xx_serial driver v2.0 Inotify sysfs create file = 0 Inotify sysfs create file = 0 Inotify sysfs create file = 0 inotify device minor=63 Using noop io scheduler Thomson BCM963xx flash mapping for BTHub flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. flash mapping initialized Creating 3 MTD partitions on "flash": 0x00040000-0x00100000 : "user" 0x001b0000-0x00800000 : "rootfs" 0x00100010-0x001b0000 : "kernel" mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only Bluetooth: HCI UART driver ver 2.1 Bluetooth: HCI H4 protocol initialized Bluetooth: HCI BCSP protocol initialized brcmboard: brcm_board_init entry ERROR - Invalid number of MAC addresses (1007714320) is configured. NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 2048 bind 4096) NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 68k freed init started: BusyBox v1.00 (2007.11.12-09:05+0000) multi-call binary init started: BusyBox v1.00 (2007.11.12-09:05+0000) multi-call binary Starting pid 36, console /dev/ttyS0: '/etc/init.d/rcS' Algorithmics/MIPS FPU Emulator v1.5 Using /nmon/nmon.ko nmon: module license 'unspecified' taints kernel. Button: Character device registered successfully. *** OH G997Init: txIdle set to TRUE pSdramPHY=0xA1FFFFF8, 0x2FE05 0xDEADBEEF [BCM ADSL] Firmware load : 446280 446280 LMEM=(0xFFF00000, 54108) SDRAM=(0xA1FA0000, 392164) AdslCoreHwReset: AdslOemDataAddr = 0xA1FFE458 ADSL PHY version is A2pBT009a2.d18 b6w_init mpi: device 0x4318 found in PCI slot 1, function 0 wl: srom not detected, using main memory mapped srom info (wombo board) IPSecControl Character device registered successfully. NET: Registered protocol family 3 NET: Registered protocol family 9 NET: Registered protocol family 4 NET: Registered protocol family 5 NET: Registered protocol family 18 NET: Registered protocol family 25 SIOCSIFADDR: No such device killall: smbd: no process killed killall: nmbd: no process killed level: 24 ls: /var/usbmount: No such file or directory Using /lib/modules/ ohci_hcd: 2004 Feb 02 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI) ohci_hcd: block sizes: ed 64 td 64 PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ohci_hcd 0000:00:09.0: OHCI Host Controller PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: irq 20, pci mem c0155b00 ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 1 hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected Using /lib/modules/ usblp: falsely claims to have parameter proto_bias usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Starting print_server modprobe: module printer.o not found. modprobe: failed to load module printer.o starting lpdsrv Mounting device Using /lib/modules/ SCSI subsystem initialized Using /lib/modules/ Using /lib/modules/ Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB Mass Storage support registered. Using /lib/modules/ Using /lib/modules/ Using /lib/modules/ Using /lib/modules/ usbmgr[280]: start 0.4.8 usbmgr[280]: sleep time -1 micro sec Name: /etc/usbmgr/usbmgr.conf Load_from_file: /etc/usbmgr/preload.conf killall: hciattach: no process killed Using /lib/modules/krtp.ko krtp ver 2.8 softdsp-vad-multiline-wb (Nov 12 2007 10:10:08) Copyright (C) 2004 Inventel Systemes Written 2004 by David Libault <> Written 2004 by Bruce Forgues <> Written 2004 by Eric Humbert <> usbmgr[282]: buffer line: remove T usbmgr[282]: class:0x9 subclass:0x0 protocol:0x0 usbmgr[282]: try /etc/usbmgr/class/09/00/00/module usbmgr[282]: try /etc/usbmgr/class/09/00/module usbmgr[282]: try /etc/usbmgr/class/09/module usbmgr[282]: try /etc/usbmgr/class/module Using /lib/modules/bt_reset.ko usbmgr[282]: USB device isn't matched the configuration Using /lib/modules/tty_spi.ko Console is free again MDG on CS0 MDG version: 1192-1, expect 1192-1 MDG Current Eeprom version : 51, expect 51 LOADER: Register timer for first check LOADER: Register SIGUSR1 - rescue LOADER: Register SIGUSR2 - broadcast alert LOADER: Register SIGHUP - test serial link with handset trough charger LOADER: Register HCI sniffer for Handset update request notifications Using /lib/modules/ Bluetooth: L2CAP ver 2.3 Bluetooth: L2CAP socket layer initialized Starting pid 333, console /dev/ttyS0: '/nmon/linux_appl.exe' ************* ERROR RECORD ************* 000000:00:00.000000 Application NMON started after POWERON. ****************** END ***************** appl_init: BUILD VERIFIED with the boardname WL firmwarecode (9-5-B0G0_9-6) WARNING: Unknown Parameter Type ipintf [adsl] trace = 5 0 [CWMP] NoIpTimeout must be minimum 120 s. Invalid option => Username :

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2021/01/04 18:22
  • by bbutcher911