BT Home Hub 1.0 and 1.5
White or black boxes given away with a BT (British Telecom) broadband subscription in UK. The first noticeable difference between V1 and the V1.5 is the shape and size. Under the cover they are identical apart from a slight pcb revision, addition of 5 extra red led's and two extra buttons on the V1.5.
There are other routers based on the same board as the Home Hub V1. Known are: Speedtouch 7g and Aolbox although there may be more.
The Home Hub includes ADSL2+, 802.11b/g wireless, host and slave USB ports, 2 wired ethernet ports, DECT, FXS & FXO ports and VOIP functionality.
All members of the BT Home Hub OpenWrt community are now encouraged to join in ongoing development efforts on later models at http://openwrt.ebilan.co.uk.
Supported Versions
Not supported yet. However you can install OpenWrt (no ADSL) using a custom CFE.
 | Bootloader (CFE), OpenWrt prebuilt firmware, and patches to build your own firmware: HomeHubV1-openwrt_12.09_wl-CFE.zip |
Hardware Highlights
| SoC | Ram | Flash | Ethernet | USB | Wireless | Serial | JTag | VOIP | FXS |
|---|---|---|---|---|---|---|---|---|---|
| Broadcom BCM96348 | 32MB | 8MB | 2 | Yes | yes | Yes | Yes | yes | yes |
OEM Flash Layout
Based on FIrmware 6.2.2.6
| 0x00000000-0x0003FFFF | Space allocated for bootloader - includes board parameters (serial number, Board type, MAC address, etc) |
| 0x00040000-0x000FFFFF | JFFS2 User partition |
| 0x00100000-0x0010000F | Firmware version magic |
| 0x00100010-0x001AFFFF | Linux Kernel |
| 0x001B0000-0x007FFFFF | Squashfs root fs |
It is somewhat different from the usual Broadcom layout. Probably due to the fact that this board does not use the CFE bootloader but uses a proprietory loader instead who's origins are unknown. This supplied bootloader is useless. I went through Tens of bootloaders before i come across a redboot loader from the inventel livebox and modified it to work with the Home Hub. Now i have recently discovered that this very same bootloader from the livebox is used in the Aolbox wich has a board identical to the Home Hub but uses different RAM memory thus the Aolbox/livebox and Home Hub bootloaders are not directly interchangeable.
Flash Details
You can access the flash via jtag at 1f400000 provided the Home Hub bootloader is running. If the loader is not running ie, bad flash you can access bootloader at 1fc00000+. The The flash chip is actually mapped at 1f800000-1fffffff while the mips boot address is 1fc00000 (half way through the physical flash address). The hub bootloader actally remaps the 4MB at 1fc00000 back before the physical start of the flash. Eg, actual 1f800000-1fffffff # copy 1fc00000-1fffffff to 1f400000 # now the flash lives at 1f400000-1fbfffff.
Installation
Flash Layout
Please check out the article flash.layout. It contains an example and a couple of explanations.
CFE easy installation
This section deals with how you install OpenWrt once the OEM bootloader is replaced by a new CFE.
- Unplug the power cord
- Press the button labeled as reset, don't release it yet!
- Plug the power cord
- Wait 10 seconds
- Release the reset button
- Browse to http://192.168.1.1
- Select .bin file
- Upgrade the image
- Wait for it to reboot
- Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed. or browse to http://192.168.1.1 if LuCI is installed.
OEM installation using the TFTP method
Upgrading OpenWrt
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
LuCI Web Upgrade Process
- Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
- Upload image file for sysupgrade to LuCI
- Wait for reboot
Terminal Upgrade Process
- Login as root via SSH on 192.168.1.1
- Use the following commands to upgrade.
cd /tmp/ wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc sysupgrade /tmp/xxx.abc
- If sysupgrade does not support this router, use the following commands.
cd /tmp/ wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc mtd write /tmp/xxx.abc linux && reboot
Basic configuration
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
Specific Configuration
Interfaces
The default network configuration is:
| Interface Name | Description | Default configuration |
|---|---|---|
| br-lan | LAN & WiFi | 192.168.1.1/24 |
| eth0 | WAN | dhcp |
| eth1 | LAN | bridged |
| wlan0 | WiFi | disabled |
Failsafe mode
Buttons
→ hardware.button on howto use and configure the hardware button(s).
The Home Hub 1 has only 1 button
| BUTTON | Event |
|---|---|
| Reset | reset |
Hardware
Info
| Instruction set | MIPS |
|---|---|
| Vendor | Broadcom |
| bootloader | Unknown (custom Thomson) Can be replaced by cfe |
| System-On-Chip | BCM6348 |
| CPU/Speed | BMIPS3300 V0.7 / 256 MHz |
| Flash-Chip | Spansion S29GL064A11TFIR4, 64Mbit, 8MByte, Pointless bottom boot blocks |
| Flash size | 8 MiB |
| RAM-Chip | Qimonda HYB39SC256160FE-7, 8Mbitx16bit, 32MByte, 133MHz |
| RAM size | 32 MiB |
| Wireless | BCM4318 802.11b/g (onboard), using seperate radio amplifier and diversity switch via pci |
| Ethernet | 1x internal PHY + 1x external PHY (Altima AC101 MII PHY) |
| Internet | ADSL2+, not supported in OpenWrt |
| USB | Yes |
| DECT | Philips/NXP PCD80705 Baseband DECT processor via spi |
| Slic | Silicon Labs si3230 ProSLIC |
| Serial | Yes |
| JTAG | Yes |
Photos
There are plenty of pictures of the Home Hub on the internet so i wont fill this space with its cover on.
V1.0
V2.0
Board:
| HomeHub V1.0 | HomeHub V1.5 |
|---|---|
| Top view | Top view |
 |  |
| This one has had its led wiring changed to suit the Speedtouch 7G firmware | Note the extra 2 buttons and their position and the shape of the board. The led's are now on the other side too. |
| Bottom view | Bottom view |
 |  |
| Note changes to the led type. They are now tri colour (green+red=orange). I have fitted it with a crude jtag connector. |
GPIOs
→ port.gpio general information about GPIO
V1.0
| LEDS | |||
|---|---|---|---|
| label | color | GPIO | active |
| Lan Activity | green | 0 | high |
| Upgrade | green | 1 | high |
| Broadband (ADSL) | green | 2 | high |
| WiFi | green | 3 | high |
| Phone (icon) | green | 4 | high |
| BUTTONS | ||
|---|---|---|
| name | GPIO | active |
| reset | 36 | low |
V1.5
| LEDS | |||
|---|---|---|---|
| label | color | GPIO | active |
| | green | 0 | |
| | green | 1 | |
| | green | 2 | |
| | green | 3 | |
| | green | 4 | |
| | red | 5 | |
| | red | 22 | |
| | red | 7 | |
| | red | 29 | |
| | red | 30 | |
| BUTTONS | ||
|---|---|---|
| name | GPIO | active |
| reset | 35 | |
| WPS | 36 | |
Serial
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port of this specific device:
- Solder a 4 pin header
- Use a TTL serial cable
Photo of PCB with markings
Settings:
- Baudrate: 115200
- Data bits: 8
- Parity: None
- Stop bits: 1
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
Photo of PCB with markings
 | For reading/writing to the flash you can use UrJTAG (latest svn). UrJTAG is able to operate in DMA mode with bcm63xx boards, then it's faster than hairydairymaid. |
Backup whole flash
- Connect your JTAG cable from your computer to your board
- Execute UrJTAG in root mode:
sudo jtag
- Power on the board
- Immediately execute these commands:
cable dlc5 ppdev /dev/parport0 detect endian big initbus ejtag_dma detectflash 0x1f800000 readmem 0x1f800000 0x800000 homehub1_backup.bin
Restore whole flash
- Connect your JTAG cable from your computer to your board
- Execute UrJTAG in root mode:
sudo jtag
- Power on the board
- Immediately execute these commands:
cable dlc5 ppdev /dev/parport0 detect endian big initbus ejtag_dma detectflash 0x1f800000 flashmem 0x1f800000 homehub1_backup.bin
Flashing a bootloader
- Connect your JTAG cable from your computer to your board
- Execute UrJTAG in root mode:
sudo jtag
- Power on the board
- Immediately flash the new bootloader:
cable dlc5 ppdev /dev/parport0 detect endian big initbus ejtag_dma detectflash 0x1f800000 flashmem 0x1fc00000 CFE_homehub1-nvr.bin
Debricking
Bootlogs
OEM bootlog
Decompressing Bootloader................................. Speedtouch initialization sequence started. BOOTING THE THOMSON LINUX KERNEL Starting the kernel @ 0x801bc018 serial initialized Linux version 2.6.8.1 (debusb@cplx82.edegem.eu.thmulti.com) (gcc version 3.4.2) #1 Mon Nov 12 09:53:50 CET 2007 CPU revision is: 00029107 bcm63xx : initiazation of mpi bus ............... Determined physical RAM map: memory: 01f7d000 @ 00002000 (usable) On node 0 totalpages: 8063 DMA zone: 4096 pages, LIFO batch:1 Normal zone: 3967 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=/dev/mtdblock1 rootfstype=squashfs brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 8kB 2-way, linesize 16 bytes. PID hash table entries: 128 (order 7: 1024 bytes) Using 128.000 MHz high precision timer. Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 29968k/32244k available (1450k kernel code, 2232k reserved, 258k data, 68k init, 0k highmem) Calibrating delay loop... 251.39 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... available. NET: Registered protocol family 16 usbcore: registered new driver usbfs usbcore: registered new driver hub Bluetooth: Core ver 2.6 NET: Registered protocol family 31 Bluetooth: HCI device and connection manager initialized Bluetooth: HCI socket layer initialized squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher squashfs: LZMA suppport for slax.org by jro JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc. bcm963xx_serial driver v2.0 Inotify sysfs create file = 0 Inotify sysfs create file = 0 Inotify sysfs create file = 0 inotify device minor=63 Using noop io scheduler Thomson BCM963xx flash mapping for BTHub flash: Found 1 x16 devices at 0x0 in 16-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. flash mapping initialized Creating 3 MTD partitions on "flash": 0x00040000-0x00100000 : "user" 0x001b0000-0x00800000 : "rootfs" 0x00100010-0x001b0000 : "kernel" mtd: partition "kernel" doesn't start on an erase block boundary -- force read-only Bluetooth: HCI UART driver ver 2.1 Bluetooth: HCI H4 protocol initialized Bluetooth: HCI BCSP protocol initialized brcmboard: brcm_board_init entry ERROR - Invalid number of MAC addresses (1007714320) is configured. NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 2048 bind 4096) NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 68k freed init started: BusyBox v1.00 (2007.11.12-09:05+0000) multi-call binary init started: BusyBox v1.00 (2007.11.12-09:05+0000) multi-call binary Starting pid 36, console /dev/ttyS0: '/etc/init.d/rcS' Algorithmics/MIPS FPU Emulator v1.5 Using /nmon/nmon.ko nmon: module license 'unspecified' taints kernel. Button: Character device registered successfully. *** OH G997Init: txIdle set to TRUE pSdramPHY=0xA1FFFFF8, 0x2FE05 0xDEADBEEF [BCM ADSL] Firmware load : 446280 446280 LMEM=(0xFFF00000, 54108) SDRAM=(0xA1FA0000, 392164) AdslCoreHwReset: AdslOemDataAddr = 0xA1FFE458 ADSL PHY version is A2pBT009a2.d18 b6w_init mpi: device 0x4318 found in PCI slot 1, function 0 wl: srom not detected, using main memory mapped srom info (wombo board) IPSecControl Character device registered successfully. NET: Registered protocol family 3 NET: Registered protocol family 9 NET: Registered protocol family 4 NET: Registered protocol family 5 NET: Registered protocol family 18 NET: Registered protocol family 25 SIOCSIFADDR: No such device killall: smbd: no process killed killall: nmbd: no process killed level: 24 ls: /var/usbmount: No such file or directory Using /lib/modules/2.6.8.1/kernel/drivers/usb/host/ohci-hcd.ko ohci_hcd: 2004 Feb 02 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI) ohci_hcd: block sizes: ed 64 td 64 PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ohci_hcd 0000:00:09.0: OHCI Host Controller PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: irq 20, pci mem c0155b00 ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 1 hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected Using /lib/modules/2.6.8.1/kernel/drivers/usb/class/usblp.ko usblp: falsely claims to have parameter proto_bias usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Starting print_server modprobe: module printer.o not found. modprobe: failed to load module printer.o starting lpdsrv Mounting device Using /lib/modules/2.6.8.1/kernel/drivers/scsi/scsi_mod.ko SCSI subsystem initialized Using /lib/modules/2.6.8.1/kernel/drivers/scsi/sd_mod.ko Using /lib/modules/2.6.8.1/kernel/drivers/usb/storage/usb-storage.ko Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB Mass Storage support registered. Using /lib/modules/2.6.8.1/kernel/fs/fat/fat.ko Using /lib/modules/2.6.8.1/kernel/fs/vfat/vfat.ko Using /lib/modules/2.6.8.1/kernel/fs/nls/nls_cp437.ko Using /lib/modules/2.6.8.1/kernel/fs/nls/nls_iso8859-1.ko usbmgr[280]: start 0.4.8 usbmgr[280]: sleep time -1 micro sec Name: /etc/usbmgr/usbmgr.conf Load_from_file: /etc/usbmgr/preload.conf killall: hciattach: no process killed Using /lib/modules/krtp.ko krtp ver 2.8 softdsp-vad-multiline-wb (Nov 12 2007 10:10:08) Copyright (C) 2004 Inventel Systemes Written 2004 by David Libault <david.libault@inventel.fr> Written 2004 by Bruce Forgues <bruce.forgues@inventel.fr> Written 2004 by Eric Humbert <eric.humbert@inventel.fr> usbmgr[282]: buffer line: remove T usbmgr[282]: class:0x9 subclass:0x0 protocol:0x0 usbmgr[282]: try /etc/usbmgr/class/09/00/00/module usbmgr[282]: try /etc/usbmgr/class/09/00/module usbmgr[282]: try /etc/usbmgr/class/09/module usbmgr[282]: try /etc/usbmgr/class/module Using /lib/modules/bt_reset.ko usbmgr[282]: USB device isn't matched the configuration Using /lib/modules/tty_spi.ko Console is free again MDG on CS0 MDG version: 1192-1, expect 1192-1 MDG Current Eeprom version : 51, expect 51 LOADER: Register timer for first check LOADER: Register SIGUSR1 - rescue LOADER: Register SIGUSR2 - broadcast alert LOADER: Register SIGHUP - test serial link with handset trough charger LOADER: Register HCI sniffer for Handset update request notifications Using /lib/modules/2.6.8.1/kernel/net/bluetooth/l2cap.ko Bluetooth: L2CAP ver 2.3 Bluetooth: L2CAP socket layer initialized Starting pid 333, console /dev/ttyS0: '/nmon/linux_appl.exe' ************* ERROR RECORD ************* 000000:00:00.000000 Application NMON started after POWERON. ****************** END ***************** appl_init: BUILD VERIFIED with the boardname WL firmwarecode (9-5-B0G0_9-6) WARNING: Unknown Parameter Type ipintf [adsl] trace = 5 0 [CWMP] NoIpTimeout must be minimum 120 s. Invalid option => Username :