BT Home Hub 5.0 Type A

Information on this page also applies to the 'Plusnet Hub One' and 'BT Business Hub 5'. This is a router manufactured by Sagemcom under contract for BT. The OEM design is a Askey RTV7505W-D18.

There is also a Type B based on BCM63268, but for 802.11ac it uses the BCM4360 which has no open drivers, so it's a far less attractive target.

To install OpenWrt on your HH5A or to recover from a failed u-boot flash you can boot the device via UART (serial console). This requires that:

1. you are able to connect to the serial console of the device (using for example a USB to serial adapter)
2. you are able to create an electrical connection to four points on the device PCB (easy no-soldering approach linked in download table, or you can solder a few wires to SMD solder points)

See the download table above for how to get serial access in 10 minutes WITHOUT soldering or you can solder a few wires to SMD solder points (a bit fiddly).

If you do choose to solder, be sure to glue of fix the wires to the PCB so that you don't pull the pads off or break the solder connection when you move the router. You're going to need to connect the wires to an adapter, plug and unplug a USB drive and ethernet cable and even small stresses on tiny soldering joins might break them.

The baud rate is 115200.

Once you have prepared everything you can boot u-boot via UART:

1. Power off your HH5A
2. Enable UART boot by connecting boot_sel2 to GND.
3. Power on your device
   You should see a message similar to this:

   ROM VER: 1.1.4
   CFG 04
   UART

4. IMPORTANT: Remove the connection between boot_sel2 and GND as QUICKLY as possible. There have reported cases where HH5a remains stuck in 'CFG 04' which may have been caused by electronic component damage.
5. Load u-boot via serial console into the device's memory (this takes approx. 3 minutes): lede-lantiq-bthomehubv5a_ram-u-boot.asc using the instructions for Microsoft Windows or Linux as follows.

If you're having trouble be sure to check that your serial adapter is working correctly: if you connect the tx and rx pins on your adapter you should see your keys echoed back to you when you type in the console. This is sometimes called a loopback test. It's possible for just transmission or reception to be broken.

Microsoft Windows

Download and study the “Serial console instructions using MS Windows” and “LEDE Installation Guide for BT Home Hub 5A” documents listed in the Downloads section of this page.

Linux

You can use picocom to connect as follows:

picocom -b 115200 /dev/ttyUSB0 --send-cmd="cat"

In picocom, press <Ctrl-a> <Ctrl-s> and enter the full path to the lede-lantiq-bthomehubv5a_ram-u-boot.asc to send the bootcode.

nb. Do NOT use the u-boot.asc found in OpenWrt downloads page. TFTP does not work.

Alternatively, open another terminal and execute the following command to send the bootcode

cat lede-lantiq-bthomehubv5a_ram-u-boot.asc > /dev/ttyUSB0

Now you should see the BTHOMEHUBV5A# u-boot prompt.

Note that operating in this mode is atypically slow. The CPU clock (normally 500MHz) and buses (normally 250MHz) are running at 125MHz for some reason, but the installed system will run at full speed.

(one reason that it's running very slowly is that the cache is turned off for the serially loaded u-boot build)

Use these instructions to install all stable and snapshot builds of LEDE released after 30 November 2016, and all stable and snapshots of OpenWrt released from January 2018.

Go to HomeHub 5 Type A install image web page and download the following files:

It is also recommended to download and study the 190 page OpenWrt/LEDE Installation Guide for BT Home Hub 5A and the BT HH5A Openwrt LEDE Windows instructions. Both documents contain screenshots of each step of the installation process and other useful information but it basically boils down to the following steps:

1. Make sure all serial connections are right (pins and tty address/COM port) and working at 115200 kbps baud rate.
2. Open up a Serial console to communicate with the router. For Linux you can use cu, screen, minicom, putty or GTKTerm. For Windows you can use Putty, TeraTerm, Termite or Arduino's Serial Monitor. Test to see if everything works by booting up the router and and seeing all the boot process on screen.
3. Boot the router in UART Mode mode by grounding the boot_sel2 pin when powering up then removing from ground as soon as you see CFG 04 on screen.
4. Copy the binary contents in: openwrt-lantiq-bthomehubv5a_ram-u-boot.asc or lede-lantiq-bthomehubv5a_ram-u-boot.asc file then paste it into the serial terminal and hit Enter to send it over (it may take a minute or two and screen will fill up with *).
5. Configure PC with static IP address 192.168.1.2, and connect to any yellow LAN port on the HomeHub over ethernet. Ensure that the address 192.168.1.1 is free for the HomeHub to use.
6. Serve lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin over TFTP. For Windows users, you can use TFTPD64.exe then setting the Server Interface at 192.168.1.2 and Current Directory to where the install file is. On a Linux machine:

   mkdir -p /tftpboot
   wget -O /tftpboot/lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin https://github.com/mkresin/BTHH5a-installimage/releases/download/v0.1/lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin
   chmod 777 /tftpboot
   atftpd --bind-address 192.168.1.2 --daemon --no-fork /tftpboot/

7. Over the serial console, type the following:

   tftpboot 0x81000000 lede-lantiq-xrx200-BTHOMEHUBV5A-installimage.bin; bootm 0x81000000

   
   Upon a successful transfer you should see the row of ### loading. If it shows only T for timeout, make sure your IP addresses are right, your TFTP program is not blocked and Wifi is off then try again. When the transfer is complete, booting will be very slow - typically takes 7 minutes!

8. Back up the original stock firmware using the instructions provided on screen. A USB flash drive formatted FAT32 or exFAT is required. Check the size of the file saved to USB flash drive is approx 128 MiB before continuing any further! If you do not create the nand backup, or the saved file is significantly less than 128MiB, and the OpenWRT installation subsequently fails, you will NOT be able to unbrick the hub !!!!
9. There are a few scripts that save you time so you don't have to type lots of commands manually. You can run them when br-lan: entered forwarding state appears.
   1. Reminder: Did you run the nanddump command to save a copy of the original firmware, and to store the file in a safe place?
   2. Run prepare script to prepare the LEDE installation.
   3. Carefully read the instructions that the script provides.
   4. Once the script is finished you have unlocked u-boot and changed the UBI volumes/partitions (LEDE is not installed yet and there is no going back). ¹⁾
   5. Installing OpenWrt/LEDE is usually easy: get your sysupgrade image onto the router and run sysupgrade on it. The router will spew text for a bit before rebooting.
      1. Download the image on your PC, copy it to a memory stick and insert it in the router.
      2. Due to problems with some memory sticks, it is recommended to copy the file from memory stick to the /tmp folder. cp /tmp/mounts/USB-A1/openwrt-blah-blah-squashfs-sysupgrade.bin /tmp
      3. Then install with command: sysupgrade /tmp/openwrt-blah-blah-squashfs-sysupgrade.bin and you're all set. If you get a nand upgrade failed error, you need to reboot the router, upload the install image and try again with 192.168.1.10 IP and sysupgrade from /tmp.
   6. The device may reboot to CFG 04 again or straight to OpenWrt/LEDE. Power cycle the router if it's gets stuck at CFG 04 prompt.
      1. If the hub presents you with a 'VR9 #' prompt, execute these two commands, and power cycle the hub to enable LEDE to boot: setenv bootcmd ubi part UBI\; ubi read \$(loadaddr) kernel\; bootm \$(loadaddr) then saveenv
   7. Once the initial OpenWrt/LEDE firmware has been installed, newer firmware can be installed using the LuCI web interface or sysupgrade (note: snapshot releases don't come with LuCI, you need to install it later). Make a backup of your settings before updating.

If OpenWrt/LEDE installation fails, or you discover there is no wireless interfaces, you should restore the original stock firmware from the earlier 128 MiB Nanddump file you created, and try again to install OpenWRT. See section 5 of the OpenWrt/LEDE Installation Guide for BT Home Hub 5A which describes how to use the restore script in detail. Restoring stock firmware can be completed in as little as 3 minutes, otherwise, it normally takes just over an hour. Once Nanddump restoration is complete, the script offers the option to install OpenWrt/LEDE again. Otherwise, the hub will reboot and launch stock BT/Plusnet firmware.

The following video shows how to open the case without damaging it. Youtube video

Dismantling the router and photos of the board and the chassis Disassembling HH5A BT HomeHub 5.0 Type A

The motherboard and chassis close-up: Youtube video

Serial uses Baud rate 115200.

To boot via UART you need to pull boot_sel2 (results in CFG 0x4) to GND momentarily when powering up the device. Do NOT leave boot_sel2 connected to GND any longer than necessarily because it has been known to cause the device to remain 'stuck in CFG 0x4' UART mode)

Video of UART/BOOT soldering and installing TFTP-server (macOS) ➥ https://youtu.be/ims6RT3NcoE

Update: This issue has been resolved in daily snapshots since thisthis commit). It is included in OpenWrt 21:

If you have an internet connection which is significantly faster than 70 Mbps, you may observe the maximum internet to LAN throughput with OpenWrt 18/19 is lower compared to LEDE 17.01. The following commit caused the throughput to drop from 140+ Mbps to 70+ Mbps when SMP is enabled.

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=916e33fa1e14b97daf8c9bf07a1b36f9767db679

Only one instead of both cores is used to steer packets to the LAN. OpenWrt bug 2573

Some workarounds are described in this thread:

OpenWrt forum link to modified 18.06.x image which removes the above mentioned commit.

Software Flow Offloading can also be enabled in OpenWrt 19 or later, BUT it is not compatible with Smart Queue Management (SQM).

It is also worth testing with irqbalance running (after installing with “opkg install irqbalance”).

In some cases, it may be the case that USB port does not provide enough power to run a portable HDD or even a USB stick. As it has been tested there also seems to be a reboot issue when hot-plugging a USB device. This issue is related to low power output from the USB port although the supplied power adapter provides more than enough juice for the router.

The IC used for the USB seems not to handle much load for any USB peripherals. This can be solved through using an external 12V to 5V DC-DC stepdown circuit. These circuits are easily available online in smaller forms or you can build one yourself if you please. We only need to connect the +(positive) terminal of the circuit to the +(positive) of USB and let the -(negative/ground) handle the USB itself.

For this to work, you need to remove the L9 component from the back of the USB port. This will break the connection from the USB + terminal and let you provide another power source. Once you have removed the above component, proceed to connect your circuit with the router. Choose a safe spot for the circuit to stay, possibly cover its base with some hot glue. So it does not short-circuit any chips on the PCB. Now you need two wires for the input connection, one for +ve and other one is ground. Ground can be linked from any metal holders, just like the USB outer-panel. The +ve wire needs to come from the power adapter, for this to work properly use the middle pin on the power switch. This way when you power off the device the USB power will be switched off. Once you have connected the wires for input, you only need +ve wire from the circuit output and connect it to the USB +ve, from where we removed the L9 component. Be sure to connect directly to USB +ve and not to the IC +ve output.

This will remove the strain on the USB power IC and no more problems will occur from the USB hot-plugging and you can also use a portable HDD even if it was not working before. Tested with Seagate Expansion Portable HDD 500 GBs (USB 3.0).

See the below pic for more info (click on the image for a larger picture):

A heatsink can be applied onto the CPU to improve thermal dissipation, especially if the router sits in confined spaces and ambient temperature exceeds 40°C. Use a heatsink no taller than 1cm and no wider than 3cm x 3cm. A thermal adhesive pad or glue (like 8329TFS) can be used to hold the heatsink in place. Make sure you don't touch capacitor C128.

The WiFi interfaces are surrounded by exposed PCB traces which can be used to solder a RF/EMI shield onto it. RF shields help block unwanted signals and even it's own WiFi signal from interfering with the controller chip, thus improving signal quality. Designs for the shields can be found here or here and can be sent online to a fab.

WPS isn't installed out-of-the-box. You need to remove “wpad-basic-wolfssl” package and then install “wpad-wolfssl” and “hostapd-utils” to enable it at the push button and the LuCI switch in WiFi settings. Other useful packages include “luci-app-upnp” for DLNA playback and certain online games, “luci-app-ddns” for running a server, “luci-app-wol” to wake up ethernet devices and “luci-app-sqm” to adjust QoS settings (not compatible with Software Offloading).

“WMM Mode” needs to be enabled for WiFi speeds above 54Mbps, however some WiFi cards, particularly Broadcom WiFi 802.11n, may crash.

Newer DSL firmware can be found here and WiFi 5 firmware can be found here.

isp-configurations

Depending on your ISP and the firmware on their DSLAM, you may need to try different DSL firmware versions. There is a list of firmware versions at https://xdarklight.github.io/lantiq-xdsl-firmware-info/

You install these by placing them at /lib/firmware/lantiq-vrx200-a.bin and /lib/firmware/lantiq-vrx200-b.bin (use WinSCP for Windows users) and then referencing them in “Network>Interfaces>DSL>Firmware File” in LuCI. It is recommended to keep several versions around and symlinking them, so you can easily swap versions.

Refer section 7.5 of the Open/WrtLEDE Installation Guide for BT Home Hub 5A for more details of popular ISPs in the UK.

For VDSL (FTTC):

1. Go to LuCI → Network → Interfaces.
2. Set 'DSL' parameters to 'Annex A + L + M(all)' and 'tone' set to 'A43C + J43 + A43', select PTM, and VDSL.
3. Edit the 'WAN' interface → Physical Settings tab.
4. Select 'Custom Interface' and enter 'ptm0.101' or 'dsl0.101' for LEDE 17 and OpenWrt 18 respectively to set vlan 101 for BT Openreach network compatibility.

For most ISPs except for TalkTalk and Sky/NOW broadband:

1. Edit the 'WAN' interface.
2. Choose PPPoE protocol.
3. Enter username and password.

For TalkTalk:

1. Edit the 'WAN' interface.
2. Choose DHCP protocol.

For Sky Broadband:

1. Edit the 'WAN' interface.
2. Choose DHCP protocol.
3. Go to Advanced Settings tab in that interface.
4. Change 'Client ID to send when requesting DHCP' with the hex value of the yourmacaddress@skydsl|XXXXXXXX that you get from Wireshark on your OEM router.
5. Do the same for 'WAN6'.

Learn more here: http://www.skyuser.co.uk/forum/sky-broadband-fibre-help/50483-generic-open-wrt-sky-fibre-mer-guide.html

/etc/config/network should look like this when you're done configuring a PPPoE BT OpenReach connection on OpenWrt:

config dsl 'dsl'
        option annex 'a'
        option tone 'a'
        option ds_snr_offset '0'
        option xfer_mode 'ptm'
        option line_mode 'vdsl'

config interface 'wan'
        option ifname 'dsl0.101'
        option proto 'pppoe'
        option username 'YOURUSERNAMEHERE'
        option password 'YOURPASSWORDHERE'

For ADSL (PPPoA):

1. Go to LuCI → Network → Interfaces'.
2. Set 'DSL' parameters to 'Annex A(all)' and 'tone' set to 'A43C + J43 + A43', select ATM, and ADSL.
3. Important: Remove the 'ATM bridge' section as this is incompatible with PPPoA connections.

For most ISPs.

1. Edit the 'WAN' interface.
2. Choose PPPoA protocol.
3. Enter username and password.
4. PPPoA Encapsulation: VC-Mux
5. VCI: 38
6. VPI: 0

Sky Broadband may also accept username: install@o2broadband.co.uk with no password with PPPoA protocol otherwise you need to extract the username and password with Wireshark on your OEM router.

For ADSL (PPPoE):

1. Go to LuCI → Network → Interfaces.
2. Set 'DSL' parameters to 'Annex A(all)' and 'tone' set to 'A43C + J43 + A43', select ATM, and ADSL.
3. Set 'ATM bridge' parameters, VCI: 38, VPI: 0. Encapsulation mode: LLC
4. Edit the 'WAN' interface → Physical Settings tab.
5. Select 'Custom Interface' and enter 'nas0' or 'dsl0' for LEDE 17 and OpenWrt 18 respectively.

BT and Plusnet support PPPoE protocol. (Sky/NOW and TalkTalk do not support PPPoE on ADSL)

1. Edit the 'WAN' interface.
2. Choose PPPoE protocol.
3. Enter username and password.

For other configurations, such as 'VDSL Bridge modem' (to emulate old Openreach VDSL modems), refer to the OpenWrt/LEDE Installation Guide for BT Home Hub 5A for instructions.

Because of my bad dsl signal I need to increase the ds_snr_offset. It's work very well with DSL Firmware 5.7.x, 5.8.x, 5.9.x.

It's work very well with DSL Firmware 5.9.0.

VDSL works with an extracted firmware file

Network config: vLAN from ISP is 0.2

VDSL used to work with a newer firmware, but in early February 2021 it started running slowly on a 8/1 fallback profile.

The version that works right now is 5.7.6.10.0.7.

It is necessary to tag the port used for the connection. When using DSA, switch configuration is not needed.

Depending on your version of LuCI and your /etc/board.json, LuCI may display ports in various orders (matching the labels/matching the swconfig numbering/not matching anything) and may or may not list the WAN port even though it's available via swconfig.

• If LuCI lists seven ports (Port 0 -- Port 5 + CPU), it's probably using the swconfig numbering and ignoring /etc/board.json. Put up with the internal numbering or upgrade LuCI. On the bright side, you don't need to edit anything to make use of the WAN port.
• If LuCI lists five ports (LAN 1 -- LAN 4 + CPU), it's probably using either the case label numbering or a made-up numbering. Either way, it's probably based on /etc/board.json. You can either use /etc/config/network instead or edit /etc/board.json to make the UI include the WAN port (and if necessary, correct the numbering).

Notes about this quirky layout:

• According to swconfig eth0 is the (only) interface through which the switch is configured, yet if you want to see traffic on switch port 5 (WAN) you'll need to add it to a VLAN and you'll see the traffic on eth1.N, which isn't presented as a choice in LuCI. (eth1 seems to behave both as a second CPU port and as a physical port on the switch, depending on context.)
  • For example, in the typical wired-WAN setup where you've put ports 1--4 in VLAN 1 and the WAN port in VLAN 2, you'd set Interfaces → WAN → Physical Settings → Custom Interface: eth1.2.
• Since commit 3ea9c85e (mid-Aug 2016) LuCI can hide some of the layout oddness. /etc/board.d/02_network generates /etc/board.json which newer LuCI uses when presenting the Network → Switch page.
  • OpenWrt has an incorrect /etc/board.d/02_network as of r48941, but (with newer LuCI) you can edit /etc/board.json.
  • LEDE has a correct /etc/board.d/02_network as of 96f6bd501 so should have a correct /etc/board.json, but may not expose the WAN port.
• In at least LEDE, at the kernel/driver/switch level the layout seems unlikely to change, so kernel messages and swconfig will use the non-obvious switch port numbering for the foreseeable future.
• It's possible that configurations using eth1 may be unstable.
• LAN and WAN may have been separated this way to avoid "tx ring" kernel errors; more clarity needed.
• Changeset 40317 created the DTS with this odd layout and changeset 46223 copied it to create HH5A support --- but it may simply reflect equally odd hardware layout.

Assumptions:

• you want to use the WAN port, not DSL, for your uplink
• you're using a LuCI newer than commit 3ea9c85e (mid-Aug 2016) meaning you see LAN 1 -- LAN 4; either you're annoyed that you can't see port 5, or you're annoyed at the UI not matching the labelled ports
• you can edit config files, probably via (serial or SSH) CLI access
• you've made a backup copy of /etc/board.json already, or you're confident you can regenerate defaults using /etc/board.d/* later

Replace /etc/board.json with the following. Note that by doing this, you're not configuring anything. /etc/board.json is only meant to describe hardware properties and defaults. The changes to roles and network are just for internal consistency. Nonetheless, you should put your own unit's MAC address in network:*:macaddr.

• Boot loop issue affecting 22.03 and development snapshots
• 22.03.x IPv4 PPPoE software flow offload not working - **this severely affects performance**
• Reports of HH5a locking with 22.03.x

• More hardware details on wikidevi
• How to open up a HH5A
• PCB photos
• Serial connection
• boot_sel pins for booting via UART
• How to enable SSH on BT HH5a stock firmware **(NEW April 2018)**

To update from any previously installed version of OpenWrt, or LEDE prior to r2363 (30 Nov 2016), to LEDE snapshot r2363 and later, it is recommended to restore the stock BT Firmware, and then proceed to install the latest LEDE snapshot from scratch. Alternatively, a 'migrate' script is also available where no original nanddump is available - use earlier 'LEDE install image' v0.1 (Nov 2016) where the 'migrate' script has been tested. v1.0 (Nov 2017) has NOT been tested.

• Important install/upgrade information about LEDE snapshot r2363 and later
• How to restore stock BT firmware
• macOS: Youtube Playlist - Three parts of Installing OpenWRT/LEDE image BT HomeHub 4r/5.0
• YouTube video showing full installation with out USB drive

How to add tags