BT Home Hub 3.0 Type A

The BT Home Hub 3A is supported since Chaos Calmer stable release (V15.5), and in trunk. But installation is tricky (see Installation). Although sharing identical cases, the Home Hub 3.0a has totally different hardware to the BT Home Hub 3.0b and the BT Business Hub 3.0.

For identification purposes, the white boilerplate on the base of the device distinguishes the model number. The HH3.0a and the BT Business 3.0a, and the HH3.0b also have DC input sockets with a different diameter.

ModelVersionSoCCPU MHzFlash MBRAM MBWLAN HardwareWLAN2.4WLAN5.0100M portsGbit portsModemUSB
Home Hub 3Type ALantiq XWAY ARX1683333264Atheros AR9227b/g/n-32ADSL2+1x 2.0

The solderless install is easier, as it does not require any tools or need to open the case. It is described as risky as although includes as many fallbacks as possible, if things go wrong at some stage during the installation to go back to the previous stage, but the fallbacks may not yet cover all cases and may not always work. The upshot is that you may well end up in a state where the only way to unbrick is via a serial console. You have been warned! However, resorting to serial console is no worse than second method.

The basic idea is to replace the default uboot environment with one set up to download an openwrt ramdisk image via tftp and boot into that. This ramdisk image can then be used to complete the installation procedure.

STEP 0 (Preparation)
  • Make sure you have ssh and telnet clients on your PC.
  • Set up tftp server with address 192.168.1.10.
  • Connect Ethernet cable!
  • Check firewall settings so tftp can work.
  • Download the latest image files openwrt-xxxxxx-lantiq-xway-BTHOMEHUBV3A-squashfs-sysupgrade.tar and openwrt-xxxxxx-lantiq-xway-BTHOMEHUBV3A-uImage-initramfs from the Installation section above
  • Place the Factory install (…initramfs) in the tftpd directory on your PC and check permissions. It needs to be readable by everyone
STEP 1 (OpenRG)

The traditional install method is downloading over serial port by opening and soldering wires to the JTAG points. This is more difficult than the Solderless Install method as it requires tools, opening the case, soldering iron and skills, but it is less risky as at all points you should be able to backtrack and if necessary 'unbrick' your router. If this is within your skills then the full procedure can be found here on ebilan forum: https://openwrt.ebilan.co.uk/viewtopic.php?f=5&t=104

Most likely your router has been connected to the Internet and automatically downloaded the latest OEM firmware at some time. You'll likely want to downgrade your OEM firmware to older open version 4.7.5.1.83.8.57.1.3

  1. Download the firmware file and extract the RMS file: HUB3A_4.7.5.1.83.8.57_prod.rar
  2. Make sure you are connected to the router via an Ethernet cable (we're flashing a firmware here so we don't want any wireless hiccups!)
  3. Boot up your router
    Tip: Normally when booting OEM firmware the [Power] light settles to solid blue. If it goes out, flashes continuously or stays orange then perform a Factory Reset
    Tip: To Factory Reset OEM firmware, press and hold the ‘Reset’ button with pin/paperclip for 20 seconds and release
  4. Open your web browser and type in: http://192.168.1.254/firmware_upgrade
    Tip: The factory default IP address of OEM firmware is 192.168.1.254. If you do not know the router's customised IP address, reset it with a Factory Reset as above
  5. Put in your password for the router (found on the little pull out plastic tab on the top of the router or bottom plate)
    Tip: If you don't know the password for the OEM firwmware, you can override it:
    * Click [Override Password]
    * Press and hold the Wireless WPS button on the back of your Hub 3 for 20 seconds:

    * This will put the Hub into Password Override mode. All three lights on the front of the Hub will flash blue. You've then got two minutes to put in the required new information
    * Enter the Wireless key of your Hub. If you haven't changed it, you can find the default key on the pull-out Hub Settings Card, or on the label under the base of your Hub
    * Enter the Serial Number of your Hub. This can be found on the label under the base
    * Enter your new password
    * Re-enter the new password
    * If you like you can put in a password hint, such as a word or phrase that will help remember the password
    * Click on Use password override and create new password
  6. Once logged in click the Browse button on the Firmware Upgrade page and select your HUB3A_4.7.5.1.83.8.57_prod.rms update file
  7. Click OK. You may be warned that all your settings will be wiped out. This is normal, and besides if you're installing OpenWrt later you haven't configered it to work your way anyway!
  8. The Hub may ask you are you sure about the update. Click yes. The hub will now reboot and the power light will remain orange for a minute or so. Don't panic - this IS normal!
  9. After the hub will reboot again and it will take slightly longer than normal to reboot to the blue lights - don't worry this is normal too!
  10. After successfull installation the version number “4.7.5.1.83.8.57.1.3” should now be shown in the page footers
Architecture MIPS
Vendor Lantiq
bootloader U-Boot
System-On-Chip Lantiq ARX100 “AR9” ARX168 PSB50810 (MIPS 34Kc)
CORES 1
CPU/Speed 333 MHz
NAND Flash 32MiB NAND256W3A2BZA6
RAM Chip
RAM Specs 64 MiB
Wireless Atheros AR9227 b/g/n (2.4GHz only)
Ethernet Infineon, 5x 100M
USB 1x 2.0
DECT
Slic
Serial Yes
JTAG ?

offset size content
0x0 0x200 nand preload
0x200 0x7E00 nand bootstrap + last page DDR tune params.
0x8000 0x4c000 uboot code
0x54000 0x10000 empty ?
0x64000 0x4000 - uboot config
0x68000 0xc000 empty?
0x74000 0xaf0000 - first openrg image
0xB64000 0x147c000 - second openrg image
0x17e0000 0x20000 - jffs partition (ath data and rgconfig data)

IFX GPIO Pin Usage

0 1 2 3 4 5 6 7
P0 LED LED LED Available Available LED LED Available
P1 SSC SSC SSC Available Available PCI Available NAND
P2 INT_SW USB Available Available Available Available Available INT_SW
P3 NAND NAND Available Available BUTTONS BUTTONS BUTTONS Available
8 9 10 11 12 13 14 15
P0 Available LED Available LED LED NAND LED LED
P1 NAND Available Available Available Available Available Available Available
P2 Available Available INT_SW INT_SW Available INT_SW Available Available
P3 N/A N/A N/A N/A N/A N/A N/A N/A

Serial port location:
homehub3a_serial_detail.jpg

Configuration pin location (it is nessary to boot processor in UART booting mode):
homehub3a_configpin_detail.jpg

ROM VER: 1.1.3 CFG 06 NAND NAND Read OK ROM VER: 1.1.3 CFG 06 NAND NAND Read OK MC_DC15 0x00000147 MC_DC21 0x00001745 MC_DC22 0x00001616 MC_DC24 0x00000068 DDR Access auto data-eye tuning Rev 0.3a DDR size from 0xa0000000 - 0xa3ffffff DDR check ok... start booting... U-Boot 1.1.5-LANTIQ-v-1.8.14 (Apr 13 2011 - 14:29:58) Boot from NAND flash AR9 BOARD CLOCK CPU 333M RAM 166M DRAM: 64 MB relocate_code start relocate_code finish. 32 MiB In: serial Out: serial Err: serial Net: switch chip id=00002599 amazon_s Switch Type "run flash_nfs" to mount root filesystem over NFS Hit any key to stop autoboot: 0 Looking for active section/image: 0. section: type:10 not an image 1. section: type:8 not an image 2. section: type:9 not an image 3. section: type:2 image. reading section header @0xaf3f6c... Reading data from 0xaf3f6c -- 100% complete. counter:0x3 4. section: type:2 image. reading section header @0x15e3f6c... Reading data from 0x15e3f6c -- 100% complete. counter:0x2 5. section: type:7 not an image 6. section: type:3 not an image 7. section: type:3 not an image 8. section: type:1 not an image 9. section: type:11 not an image Verifying image(s): 3. section: image. reading image content 0x92f55d@0x74000... Reading data from 0x9a3400 -- 100% complete. checking ... ok: 'Downloaded at: Wed Jan 1 00:13:15 2003' 0x92f55d@0xa1000000 count:0x3 Active image: 0xa1000280. ## Booting image at a1000280 ... Image Name: OpenRG Created: 2011-01-24 3:53:48 UTC Image Type: MIPS Linux Kernel Image (gzip compressed) Data Size: 9630365 Bytes = 9.2 MB Load Address: 80002000 Entry Point: 8033e000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 8033e000) ... ## Giving linux memsize in MB, 64 Starting kernel ...


ROM VER: 1.1.3
CFG 06
NAND
NAND Read OK

ROM VER: 1.1.3
CFG 06
NAND
NAND Read OK
MC_DC15 0x00000147
MC_DC21 0x00001745
MC_DC22 0x00001616
MC_DC24 0x00000068
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa3ffffff
DDR check ok... start booting...



U-Boot 1.1.5-LANTIQ-v-1.8.14 (Apr 13 2011 - 14:29:58)

Boot from NAND flash
AR9 BOARD
CLOCK CPU 333M RAM 166M
DRAM:  64 MB

 relocate_code start
 relocate_code finish.
32 MiB
In:    serial
Out:   serial
Err:   serial
Net:
switch chip id=00002599
amazon_s Switch

Type "run flash_nfs" to mount root filesystem over NFS

Hit any key to stop autoboot:  0
AMAZON_S #
AMAZON_S # help
?       - alias for 'help'
askenv  - get environment variables from stdin
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dualimage - sets openrg_start and openrg_size according to the current active image.
echo    - echo args to console
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
imls    - list all images found in flash
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
tftpboot- boot image via network using TFTP protocol
upgrade - forward/backward copy memory to pre-defined flash location
version - print monitor version
AMAZON_S #

Grounding config ping gets this

ROM VER: 1.1.3
CFG 04
UART

ram u-boot can be sent using serial port using ZModem/ or plaintext file transfer, plain text file transfer worked for me in CuteCom had problem with others

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2021/08/10 08:34
  • by tmomas