BT Home Hub 3.0 Type A

The BT Home Hub 3A is supported since Chaos Calmer stable release (V15.5), and in trunk. But installation is tricky (see Installation). Although sharing identical cases, the Home Hub 3.0a has totally different hardware to the BT Home Hub 3.0b and the BT Business Hub 3.0.

For identification purposes, the white boilerplate on the base of the device distinguishes the model number. The HH3.0a and the BT Business 3.0a, and the HH3.0b also have DC input sockets with a different diameter.

Installation is tricky as the 'Firmware OpenWrt Install' image does not install on factory devices. There are a couple alternative methods being developed.

The solderless install is easier, as it does not require any tools or need to open the case. It is described as risky as although includes as many fallbacks as possible, if things go wrong at some stage during the installation to go back to the previous stage, but the fallbacks may not yet cover all cases and may not always work. The upshot is that you may well end up in a state where the only way to unbrick is via a serial console. You have been warned! However, resorting to serial console is no worse than second method.

The basic idea is to replace the default uboot environment with one set up to download an openwrt ramdisk image via tftp and boot into that. This ramdisk image can then be used to complete the installation procedure.

• Make sure you have ssh and telnet clients on your PC.
• Set up tftp server with address 192.168.1.10.
• Connect Ethernet cable!
• Check firewall settings so tftp can work.
• Download the latest image files openwrt-xxxxxx-lantiq-xway-BTHOMEHUBV3A-squashfs-sysupgrade.tar and openwrt-xxxxxx-lantiq-xway-BTHOMEHUBV3A-uImage-initramfs from the Installation section above
• Place the Factory install (...initramfs) in the tftpd directory on your PC and check permissions. It needs to be readable by everyone

• To use OpenRG your router must be unlocked. If your router is not already unlocked then follow this procedure:
  • Check your OEM firmware version. If it is later than 4.7.5.1.83.8.57.1.3 then you need to downgrade to this version first (see Downgrading OEM firmware to version 4.7.5.1.83.8.57)
  • Unlock your router (see https://openwrt.ebilan.co.uk/viewtopic.php?f=12&t=9)
• Now continue the full installation procedure which can be found here on ebilan forum: https://openwrt.ebilan.co.uk/viewtopic.php?f=5&t=129 using the images downloaded in step 0

The traditional install method is downloading over serial port by opening and soldering wires to the JTAG points. This is more difficult than the Solderless Install method as it requires tools, opening the case, soldering iron and skills, but it is less risky as at all points you should be able to backtrack and if necessary 'unbrick' your router. If this is within your skills then the full procedure can be found here on ebilan forum: https://openwrt.ebilan.co.uk/viewtopic.php?f=5&t=104

Most likely your router has been connected to the Internet and automatically downloaded the latest OEM firmware at some time. You'll likely want to downgrade your OEM firmware to older open version 4.7.5.1.83.8.57.1.3

1. Download the firmware file and extract the RMS file: HUB3A_4.7.5.1.83.8.57_prod.rar
2. Make sure you are connected to the router via an Ethernet cable (we're flashing a firmware here so we don't want any wireless hiccups!)
3. Boot up your router
   Tip: Normally when booting OEM firmware the [Power] light settles to solid blue. If it goes out, flashes continuously or stays orange then perform a Factory Reset
   Tip: To Factory Reset OEM firmware, press and hold the ‘Reset’ button with pin/paperclip for 20 seconds and release
   
4. Open your web browser and type in: http://192.168.1.254/firmware_upgrade
   Tip: The factory default IP address of OEM firmware is 192.168.1.254. If you do not know the router's customised IP address, reset it with a Factory Reset as above
5. Put in your password for the router (found on the little pull out plastic tab on the top of the router or bottom plate)
   Tip: If you don't know the password for the OEM firwmware, you can override it:
   * Click [Override Password]
   * Press and hold the Wireless WPS button on the back of your Hub 3 for 20 seconds:
   
   * This will put the Hub into Password Override mode. All three lights on the front of the Hub will flash blue. You've then got two minutes to put in the required new information
   * Enter the Wireless key of your Hub. If you haven't changed it, you can find the default key on the pull-out Hub Settings Card, or on the label under the base of your Hub
   * Enter the Serial Number of your Hub. This can be found on the label under the base
   * Enter your new password
   * Re-enter the new password
   * If you like you can put in a password hint, such as a word or phrase that will help remember the password
   * Click on Use password override and create new password
6. Once logged in click the Browse button on the Firmware Upgrade page and select your HUB3A_4.7.5.1.83.8.57_prod.rms update file
7. Click OK. You may be warned that all your settings will be wiped out. This is normal, and besides if you're installing OpenWrt later you haven't configered it to work your way anyway!
8. The Hub may ask you are you sure about the update. Click yes. The hub will now reboot and the power light will remain orange for a minute or so. Don't panic - this IS normal!
9. After the hub will reboot again and it will take slightly longer than normal to reboot to the blue lights - don't worry this is normal too!
10. After successfull installation the version number “4.7.5.1.83.8.57.1.3” should now be shown in the page footers

• Lantiq "AR9" ARX168
• http://gadgetcat.wordpress.com/category/hardware/router/

IFX GPIO Pin Usage

Serial port location:

Configuration pin location (it is nessary to boot processor in UART booting mode):

ROM VER: 1.1.3
CFG 06
NAND
NAND Read OK

ROM VER: 1.1.3
CFG 06
NAND
NAND Read OK
MC_DC15 0x00000147
MC_DC21 0x00001745
MC_DC22 0x00001616
MC_DC24 0x00000068
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 1.1.5-LANTIQ-v-1.8.14 (Apr 13 2011 - 14:29:58)

Boot from NAND flash
AR9 BOARD
CLOCK CPU 333M RAM 166M
DRAM:  64 MB

 relocate_code start
 relocate_code finish.
32 MiB
In:    serial
Out:   serial
Err:   serial
Net:
switch chip id=00002599
amazon_s Switch

Type "run flash_nfs" to mount root filesystem over NFS

Hit any key to stop autoboot:  0
AMAZON_S #
AMAZON_S # help
?       - alias for 'help'
askenv  - get environment variables from stdin
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dualimage - sets openrg_start and openrg_size according to the current active image.
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
imls    - list all images found in flash
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
upgrade - forward/backward copy memory to pre-defined flash location
version - print monitor version
AMAZON_S #

Grounding config ping gets this

ROM VER: 1.1.3
CFG 04
UART

ram u-boot can be sent using serial port using ZModem/ or plaintext file transfer, plain text file transfer worked for me in CuteCom had problem with others

How to add tags