Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revisionLast revisionBoth sides next revision | ||
| toh:sercomm:h500s [2021/01/27 18:46] – [Installation] remove snapshots links to avoid bricks with untested firmwares danitool | toh:sercomm:h500-s [2024/02/12 08:58] – external edit | ||
|---|---|---|---|
| Line 8: | Line 8: | ||
| ===== Supported Versions ===== | ===== Supported Versions ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | headers | + | " |
| - | align : c,c,c,c,c,l,c | + | " |
| - | filter | + | " |
| - | ---- | + | " |
| + | | ||
| + | } --> | ||
| {{: | {{: | ||
| Line 23: | Line 25: | ||
| ===== Hardware Highlights ===== | ===== Hardware Highlights ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | header | + | " |
| - | align : c, | + | " |
| - | filter | + | " |
| - | ---- | + | |
| + | | ||
| + | } --> | ||
| ===== Installation ===== | ===== Installation ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | headers | + | " |
| - | align : c,c,c | + | " |
| - | filter | + | " |
| - | ---- | + | " |
| + | | ||
| + | } --> | ||
| <WRAP center round important 60%> | <WRAP center round important 60%> | ||
| - | **Warning**: | + | **Warning**: |
| - | </ | + | |
| - | <WRAP center round alert 60%> | + | **Warning**: On the **H500-s lowi** model There is no known way to stop the bootloader at the command line on the serial console. |
| - | **Alert**:The **H500-s lowi** model is unrecoverable after a brick. | + | |
| </ | </ | ||
| Line 60: | Line 64: | ||
| ==== Flashing via bootloader web ==== | ==== Flashing via bootloader web ==== | ||
| - | With this procedure you will flash the firmware using the [[docs: | + | With this procedure you will flash the firmware using the [[docs: |
| Spite this router comes with web interface in the bootloader for flashing purposes, the procedure is still unknown. | Spite this router comes with web interface in the bootloader for flashing purposes, the procedure is still unknown. | ||
| + | |||
| + | ===== Recovery ===== | ||
| + | Please, first try -> [[docs: | ||
| + | |||
| + | **Broken firmware:** | ||
| + | |||
| + | The bootloader (CFE) comes with a proprietary Sercomm module for recovering purposes. If for some reason the router is unable to boot due to a faulty firmware, you can recover the router by putting it into Sercomm Upgrade mode. Follow these steps: | ||
| + | |||
| + | - Power off the router | ||
| + | - Press the WPS button, don't release it yet! | ||
| + | - Power on the router | ||
| + | - Wait 5 seconds or more until the power LED blinks in red | ||
| + | - Release the WPS button | ||
| + | - Execute the sercomm-recovery utility as root in your OS-linux computer: <code bash> | ||
| + | *************************************************** | ||
| + | Sercomm Boot Version 0.0.4.0 | ||
| + | |||
| + | *************************************************** | ||
| + | WPS Button is pressed! | ||
| + | Correctable ECC Error detected: addr=0x00a8d000, | ||
| + | Correctable ECC Error detected: addr=0x04c58200, | ||
| + | Disabling Switch ports. | ||
| + | Flushing Receive Buffers... | ||
| + | 0 buffers found | ||
| + | Closing DMA Channels | ||
| + | |||
| + | Resetting board in 0 seconds...HELO</ | ||
| + | - Wait until the router restarts and inits completely the stock firmware | ||
| + | <WRAP center round download 60%> | ||
| + | Recovery image: [[https:// | ||
| + | |||
| + | Sercomm recovery utility: https:// | ||
| + | </ | ||
| + | |||
| + | |||
| ===== OEM firmware ===== | ===== OEM firmware ===== | ||
| Line 69: | Line 108: | ||
| | MOD VFES 3.4.17 | [[https:// | | MOD VFES 3.4.17 | [[https:// | ||
| | OEM lowi 3.3.05 | [[https:// | | OEM lowi 3.3.05 | [[https:// | ||
| + | | OEM Finetwork 3612| [[https:// | ||
| | GPL source code | [[https:// | | GPL source code | [[https:// | ||
| Default password: | Default password: | ||
| ^ Model ^ User ^ Default Password ^ | ^ Model ^ User ^ Default Password ^ | ||
| - | ^ H500-s vfes | admin | VF-ESVodafone-H-500-s | | + | ^ H500-s vfes | admin | '' |
| - | ^ H500-s lowi | admin | l033i-h500s | | + | ^ H500-s lowi | admin | '' |
| + | ^ H500-s finetwork | admin | '' | ||
| ==== OEM NAND flash layout ==== | ==== OEM NAND flash layout ==== | ||
| ^ index ^ partition | ^ index ^ partition | ||
| - | ^ 00 | mtd0 | cferom | + | ^ 00 | mtd0 | cferom |
| - | ^ 01 | mtd1 | + | ^ 01 | **mtd1** | **part_map** | '' |
| - | ^ 02 | mtd2 | cferam1 | + | ^ 02 | mtd2 | cferam1 |
| - | ^ 03 | mtd3 | cferam2 | + | ^ 03 | mtd3 | cferam2 |
| - | ^ 04 | mtd4 | pcba-sn | + | ^ 04 | mtd4 | pcba-sn |
| - | ^ 05 | mtd5 | protect_data | + | ^ 05 | mtd5 | protect_data |
| - | ^ 06 | mtd6 | kernel_fs1 | + | ^ 06 | mtd6 | kernel_fs1 |
| - | ^ 07 | mtd12 | lib_1 | 0x2320000 | + | ^ 07 | mtd12 | lib_1 | '' |
| - | ^ 08 | mtd7 | kernel_fs2 | + | ^ 08 | mtd7 | kernel_fs2 |
| - | ^ 09 | mtd13 | lib_2 | 0x5520000 | + | ^ 09 | mtd13 | lib_2 | '' |
| - | ^ 10 | mtd8 | boot_flag1 | + | ^ 10 | mtd8 | boot_flag1 |
| - | ^ 11 | mtd9 | boot_flag2 | + | ^ 11 | mtd9 | boot_flag2 |
| - | ^ 12 | mtd10 | xml_cfg | + | ^ 12 | mtd10 | xml_cfg |
| - | ^ 13 | mtd11 | app_data | + | ^ 13 | mtd11 | app_data |
| <WRAP center round download 60%> | <WRAP center round download 60%> | ||
| Line 97: | Line 138: | ||
| </ | </ | ||
| + | The // | ||
| + | |||
| + | < | ||
| + | 00000800: 00000001 00000005 00000005 | ||
| + | 0000080c: 00000006 0000000f 0000000a | ||
| + | 00000818: 00000010 00000019 0000000a | ||
| + | 00000824: 0000001a 0000001e 00000005 | ||
| + | 00000830: 0000001f 00000028 0000000a | ||
| + | 0000083c: 00000029 00000119 000000f1 | ||
| + | 00000848: 0000011a 000001b9 000000a0 | ||
| + | 00000854: 000001ba 000002a9 000000f0 | ||
| + | 00000860: 000002aa 00000349 000000a0 | ||
| + | 0000086c: 0000034a 00000353 0000000a | ||
| + | 00000878: 00000354 0000035d 0000000a | ||
| + | 00000884: 0000035e 00000371 00000014 | ||
| + | 00000890: 00000372 00000385 00000014 | ||
| + | 0000089c: 0000eeee 0000eeee 0000eeee | ||
| + | 000008a8: 00000000 00000000 00000000 | ||
| + | The value in each column should be multiplied by //0x20000// (block size): | ||
| + | '' | ||
| + | The first column is the real offset, the second is the end offset and the third is the size. | ||
| ===== Hardware ===== | ===== Hardware ===== | ||
| ==== Info ==== | ==== Info ==== | ||
| Line 140: | Line 202: | ||
| <WRAP center round alert 60%> | <WRAP center round alert 60%> | ||
| - | The heatsink over the SoC is **<color crimson> | + | The heatsink over the SoC is **<color crimson> |
| </ | </ | ||
| Line 152: | Line 214: | ||
| {{: | {{: | ||
| + | We only can configure the internal switch in **bcm63xx**. The external switch will behave as a dumb switch and viewed as one LAN port in LuCi. The WAN port belongs to the internal switch and can be configured in LuCi. | ||
| + | |||
| + | {{: | ||
| + | |||
| + | The external switch can be configured using the **bmips** target with support for [[https:// | ||
| ==== Wifi ==== | ==== Wifi ==== | ||
| Wi-Fi CERTIFIED n: | Wi-Fi CERTIFIED n: | ||
| Line 461: | Line 528: | ||
| To make the Quantenna wifi work: | To make the Quantenna wifi work: | ||
| - | | + | |
| uci set network.lan2.ifname=@lan | uci set network.lan2.ifname=@lan | ||
| uci set network.lan2.proto=static | uci set network.lan2.proto=static | ||
| Line 467: | Line 534: | ||
| uci set network.lan2.netmask=255.0.0.0 | uci set network.lan2.netmask=255.0.0.0 | ||
| uci commit network | uci commit network | ||
| + | / | ||
| </ | </ | ||
| - | | + | |
| uci set dhcp.@dnsmasq[-1].tftp_root=/ | uci set dhcp.@dnsmasq[-1].tftp_root=/ | ||
| - | uci commit dhcp</ | + | uci commit dhcp |
| - | | + | / |
| + | | ||
| + | opkg install libtirpc | ||
| + | opkg install call_qcsapi_1.0.1-1_mips_mips32.ipk</ | ||
| The qcsapi client, source code and built package. It includes the Quantenna TFTP files, and a script to make a basic configuration: | The qcsapi client, source code and built package. It includes the Quantenna TFTP files, and a script to make a basic configuration: | ||
| * https:// | * https:// | ||
| - | * [[https:// | + | * [[https:// |
| </ | </ | ||
| - | * Using the command call_qcsapi_sockrpc we can start the wifi. Use these commands to perform a basic configuration: <code bash> | + | Using the command call_qcsapi_sockrpc we can start the wifi. Example: <code bash> |
| call_qcsapi_sockrpc --host 1.1.1.2 startprod | call_qcsapi_sockrpc --host 1.1.1.2 startprod | ||
| call_qcsapi_sockrpc --host 1.1.1.2 rfstatus | call_qcsapi_sockrpc --host 1.1.1.2 rfstatus | ||
| Line 485: | Line 556: | ||
| </ | </ | ||
| + | See [[https:// | ||
| ==== Serial ==== | ==== Serial ==== | ||
| -> [[docs: | -> [[docs: | ||
| - | How to connect to the Serial Port of this specific device:\\ | + | How to connect to the Serial Port of this specific device: |
| + | ***BCM63167** serial port:\\ <a2s> | ||
| + | ▽ 4 | ||
| + | # | ||
| + | |.-. .-. .-. .-. | | ||
| + | |' | ||
| + | # | ||
| + | | ||
| + | </ | ||
| - | <a2s> | + | ***QT3740BC** serial port: |
| ▽ 4 | ▽ 4 | ||
| # | # | ||
| |.-. .-. .-. .-. | | |.-. .-. .-. .-. | | ||
| |' | |' | ||
| - | # | + | # |
| | | ||
| - | </ | + | </ |
| - | Only connect GND, TX and RX. Baud rate: 115200 | + | |
| - | + | ||
| - | ***BCM63167** serial port\\ {{: | + | |
| - | + | ||
| - | ***QT3740BC** serial port\\ | + | |
| + | Only connect GND, TX and RX. | ||
| + | Baud rate: 115200 | ||
| ==== GPIOs ==== | ==== GPIOs ==== | ||
| Line 536: | Line 613: | ||
| | 21 | R558 (near main SoC [NAND flash bootstrap]) | | 21 | R558 (near main SoC [NAND flash bootstrap]) | ||
| + | ==== Bootloader ==== | ||
| + | The board uses CFE. The //lowi// version seems to be blocked and there is no known way to enter into the CLI. However the vfes version allows to break into the CFE. Both CFEs are interchangeable since the boards are identical. | ||
| + | |||
| + | About the possible boards compatible with this CFE: | ||
| + | |||
| + | <code bash> | ||
| + | Press: | ||
| + | ' | ||
| + | ' | ||
| + | ' | ||
| + | 963268SV1 | ||
| + | 963268MBV(obsolete) | ||
| + | 963168VX | ||
| + | 963168VX_P300 | ||
| + | 963268BU | ||
| + | 963268BU_P300 | ||
| + | 963268SV2_EXTSW | ||
| + | 963168MBV_17A | ||
| + | 963168MBV_30A | ||
| + | 963168XH | ||
| + | 963168XH5 | ||
| + | 963168MP | ||
| + | 963268V30A | ||
| + | 963168MEDIA | ||
| + | 963268SV2 | ||
| + | 963168XFG3 | ||
| + | 963168XF | ||
| + | 963168XM | ||
| + | 963168MBV3 | ||
| + | 963168MBV17A302 | ||
| + | 963168MBV30A302 | ||
| + | 963168VX_P400 | ||
| + | 963168VX_ext1p8 | ||
| + | 963269BHR | ||
| + | 963168ACH5 | ||
| + | 963168AC5 | ||
| + | 963168XN5 | ||
| + | 963168XM5 | ||
| + | 963168XM5_6302 | ||
| + | 963168WFAR | ||
| + | 963167REF1 | ||
| + | 963167REF3(obsolete) | ||
| + | 963168PLC | ||
| + | 963168PLC_MOCAW | ||
| + | Board Id (0-33) | ||
| + | </ | ||
| ===== Bootlogs ===== | ===== Bootlogs ===== | ||