Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
toh:sercomm:h500s [2021/01/27 18:46] – [Installation] remove snapshots links to avoid bricks with untested firmwares danitooltoh:sercomm:h500-s [2024/07/24 19:38] (current) – Vodafone-H-500-s_SERCOMM_VFES_3510.img deerhunter
Line 8: Line 8:
  
 ===== Supported Versions ===== ===== Supported Versions =====
----- datatable ---- +<!-- ToH: { 
-cols    BrandModelVersions, Supported Current Rel, Unsupported Functions_unsupporteds, Forum search_search-forumsDevice Techdata_pageid +  "source""json", 
-headers Brand, Model, Version, Current Release, Unsupported Functions, Forum SearchTechnical Data +  "dom": "t", 
-align   c,c,c,c,c,l,c +  "paging": false
-filter  : Model*~H500-s +  "rotate"true
-----+  "shownColumns"["brand""model""version""supportedcurrentrel""unsupported_functions""forumsearch", "deviceid"]
 +  "filterColumns"{"model": "H500-s"} 
 +-->
  
 {{:media:sercomm:h500s:h500s-label_lowi.jpg?0x120}} {{:media:sercomm:h500s:h500s-label_vfes.jpg?0x120}} {{:media:sercomm:h500s:h500s-label_lowi.jpg?0x120}} {{:media:sercomm:h500s:h500s-label_vfes.jpg?0x120}}
Line 23: Line 25:
  
 ===== Hardware Highlights ===== ===== Hardware Highlights =====
----- datatable ---- +<!-- ToH: { 
-cols    ModelVersionsCPUCPU MHzCPU Cores_numcores_, Flash MB_mbflashs, RAM MB_mbram, WLAN Hardware, WLAN 2.4Ghz, WLAN 5.0Ghz, Ethernet 100M ports_, Ethernet Gbit ports_, Modem, USB ports_, Device Techdata_pageid +  "source""json", 
-header  : ModelVersion,SoC,CPU MHzCPU CoresFlash MB,RAM MB,WLAN Hardware,WLAN2.4,WLAN5.0,100M ports,Gbit ports,Modem,USBTechnical Data +  "dom": "t", 
-align   : c,c,c,c,c,c,c,c,c,c,c,c,c +  "paging": false, 
-filter  : Model*~H500-s +  "rotate": true
-----+  "shownColumns"["model""version""cpu""cpumhz""cpucores""flashmb""rammb""wlanhardware""wlan24ghz""wlan50ghz""ethernet100mports""ethernet1gports""modem""usbports""deviceid"]
 +  "filterColumns"{"model": "H500-s"} 
 +-->
  
  
 ===== Installation ===== ===== Installation =====
  
----- datatable ---- +<!-- ToH: { 
-cols    ModelVersionsSupported Current RelFirmware OpenWrt Install URL_url, Firmware OpenWrt Upgrade URL_urlFirmware OEM Stock URL_url +  "source""json", 
-headers ModelVersionCurrent ReleaseFirmware OpenWrt stable InstallFirmware OpenWrt  stable UpgradeFirmware OEM Stock +  "dom": "t", 
-align   : c,c,c +  "paging": false, 
-filter  : Model*~H500-s +  "rotate": true
-----+  "shownColumns"["model""version""supportedcurrentrel""firmwareopenwrtinstallurl""firmwareopenwrtupgradeurl""firmwareoemstockurl"]
 +  "filterColumns"{"model": "H500-s"} 
 +-->
 <WRAP center round important 60%> <WRAP center round important 60%>
-**Warning**: If for some reason, you brick the device at the kernel level (i.e not able to load rootfs)you will need [[#serial]] console to make a recovering. You may also need an Openwrt ramdisk version. +**Warning**: If for some reason, you brick the device (non working firmware) you may need to use the sercomm upgrade mode, see -> [[#recovery]]
-</WRAP>+
  
-<WRAP center round alert 60%> +**Warning**: On the **H500-s lowi** model There is no known way to stop the bootloader at the command line on the serial console.
-**Alert**:The **H500-s lowi** model is unrecoverable after a brick. There is no known way to stop the bootloader at the command line on the serial console.+
 </WRAP> </WRAP>
  
Line 60: Line 64:
  
 ==== Flashing via bootloader web ==== ==== Flashing via bootloader web ====
-With this procedure you will flash the firmware using the [[docs:techref:bootloader|bootloader]] web interface (foolproof)+With this procedure you will flash the firmware using the [[docs:techref:bootloader|bootloader]] web interface
  
 Spite this router comes with web interface in the bootloader for flashing purposes, the procedure is still unknown. Spite this router comes with web interface in the bootloader for flashing purposes, the procedure is still unknown.
 +
 +===== Recovery =====
 +Please, first try -> [[docs:guide-user:troubleshooting:failsafe_and_factory_reset]], if you bricked Openwrt while configuring after installation.
 +
 +**Broken firmware:**
 +
 +The bootloader (CFE) comes with a proprietary Sercomm module for recovering purposes. If for some reason the router is unable to boot due to a faulty firmware, you can recover the router by putting it into Sercomm Upgrade mode. Follow these steps:
 +
 +  - Power off the router
 +  - Press the WPS button, don't release it yet!
 +  - Power on the router
 +  - Wait 5 seconds or more until the power LED blinks in red
 +  - Release the WPS button
 +  - Execute the sercomm-recovery utility as root in your OS-linux computer: <code bash>sercomm-recovery -v eth0 flash_burn.bin</code> If you have the serial console attached to the router, you'll see an output like this:<code log>
 +***************************************************
 +    Sercomm Boot Version 0.0.4.0
 +
 +***************************************************
 +WPS Button is pressed!
 +Correctable ECC Error detected: addr=0x00a8d000, intrCtrl=0x000000B0, accessCtrl=0xE3441010
 +Correctable ECC Error detected: addr=0x04c58200, intrCtrl=0x00000090, accessCtrl=0xE3441010
 +Disabling Switch ports.
 +Flushing Receive Buffers...
 +0 buffers found
 +Closing DMA Channels
 +
 +Resetting board in 0 seconds...HELO</code> 
 +  - Wait until the router restarts and inits completely the stock firmware
 +  <WRAP center round download 60%>
 +Recovery image: [[https://drive.google.com/uc?export=download&id=11wOiPCYkNSe-tDhp-EqNGUzC0YRlCBVz|h500s_vfes-recovery-flash_burn.zip]]
 +
 +Sercomm recovery utility: https://github.com/danitool/sercomm-recovery
 +</WRAP>
 +
 +
  
 ===== OEM firmware ===== ===== OEM firmware =====
Line 68: Line 107:
 ^ OEM firmware ^^^ ^ OEM firmware ^^^
 | MOD VFES 3.4.17 | [[https://drive.google.com/uc?export=download&id=1rL68-16JV-6KFIMtffrpsvdt4KQDflOd|Vodafone-H-500-s_SERCOMM_VFES_3417_MOD.img]] | telnetd port 2323 | | MOD VFES 3.4.17 | [[https://drive.google.com/uc?export=download&id=1rL68-16JV-6KFIMtffrpsvdt4KQDflOd|Vodafone-H-500-s_SERCOMM_VFES_3417_MOD.img]] | telnetd port 2323 |
 +| VFES 3.5.10 | [[http://www.mediafire.com/file/hx4z48nzchrzu16/Vodafone-H-500-s_SERCOMM_VFES_3510.img|Vodafone-H-500-s_SERCOMM_VFES_3510.img]] | ? |
 | OEM lowi 3.3.05 | [[https://drive.google.com/uc?export=download&id=18bMs0e-y0cwgkW4rGIwjms9IBjGbtJoP|lowi-h500s_SERCOMM_LOWI_3305_OEM.img]] | telnetd port 2323 | | OEM lowi 3.3.05 | [[https://drive.google.com/uc?export=download&id=18bMs0e-y0cwgkW4rGIwjms9IBjGbtJoP|lowi-h500s_SERCOMM_LOWI_3305_OEM.img]] | telnetd port 2323 |
 +| OEM Finetwork 3612| [[https://drive.google.com/file/d/1LKMZ99jK2RSKJ_vW4splvMz6kLTHwsc9/view?usp=sharing|ASCK1MZ-W1H-004-0000003612.img]] | telnetd port ? |
 | GPL source code | [[https://mega.nz/#!K1JmCaDJ!MQ1mt8_jf5ydx1oXqr712mlTeNCdadrc24s5ezSRWqM|H500s V3305.rar]] | | | GPL source code | [[https://mega.nz/#!K1JmCaDJ!MQ1mt8_jf5ydx1oXqr712mlTeNCdadrc24s5ezSRWqM|H500s V3305.rar]] | |
 Default password: Default password:
 ^ Model        ^ User ^ Default Password ^ ^ Model        ^ User ^ Default Password ^
-^ H500-s vfes | admin | VF-ESVodafone-H-500-s | +^ H500-s vfes | admin | ''VF-ESVodafone-H-500-s'' 
-^ H500-s lowi | admin | l033i-h500s |+^ H500-s lowi | admin | ''l033i-h500s''
 +^ H500-s finetwork | admin | ''admin'' |
  
 ==== OEM NAND flash layout ==== ==== OEM NAND flash layout ====
  
 ^ index ^ partition  ^ part_name        ^ offset         ^ size        ^  size (KiB) ^ ^ index ^ partition  ^ part_name        ^ offset         ^ size        ^  size (KiB) ^
-^ 00    | mtd0       | cferom           | 0x0000000      | 0x0020000    128 | +^ 00    | mtd0       | cferom           ''0x0000000''      | 0x0020000    128 | 
-^ 01    | mtd1       | part_map         | 0x0020000      | 0x00a0000    640 | +^ 01    | **mtd1**   **part_map**     ''0x0020000''      | 0x00a0000    640 | 
-^ 02    | mtd2       | cferam1          | 0x00c0000      | 0x0140000    1280 | +^ 02    | mtd2       | cferam1          | ''0x00c0000''      | 0x0140000    1280 | 
-^ 03    | mtd3       | cferam2          | 0x0200000      | 0x0140000    1280 | +^ 03    | mtd3       | cferam2          | ''0x0200000''      | 0x0140000    1280 | 
-^ 04    | mtd4       | pcba-sn          | 0x0340000      | 0x00a0000    640 | +^ 04    | mtd4       | pcba-sn          | ''0x0340000''      | 0x00a0000    640 | 
-^ 05    | mtd5       | protect_data     | 0x03e0000      | 0x0140000    1280 | +^ 05    | mtd5       | protect_data     ''0x03e0000''      | 0x0140000    1280 | 
-^ 06    | mtd6       | kernel_fs1       | 0x0520000      | 0x1e00000    30720 | +^ 06    | mtd6       | kernel_fs1       ''0x0520000''      | 0x1e00000    30720 | 
-^ 07    | mtd12      | lib_1            | 0x2320000      | 0x1400000    20480 | +^ 07    | mtd12      | lib_1            | ''0x2320000''      | 0x1400000    20480 | 
-^ 08    | mtd7       | kernel_fs2       | 0x3720000      | 0x1e00000    30720 | +^ 08    | mtd7       | kernel_fs2       ''0x3720000''      | 0x1e00000    30720 | 
-^ 09    | mtd13      | lib_2            | 0x5520000      | 0x1400000    20480 | +^ 09    | mtd13      | lib_2            | ''0x5520000''      | 0x1400000    20480 | 
-^ 10    | mtd8       | boot_flag1       | 0x6920000      | 0x0140000    1280 | +^ 10    | mtd8       | boot_flag1       ''0x6920000''      | 0x0140000    1280 | 
-^ 11    | mtd9       | boot_flag2       | 0x6a60000      | 0x0140000    1280 | +^ 11    | mtd9       | boot_flag2       ''0x6a60000''      | 0x0140000    1280 | 
-^ 12    | mtd10      | xml_cfg          | 0x6ba0000      | 0x0280000    2560 | +^ 12    | mtd10      | xml_cfg          | ''0x6ba0000''      | 0x0280000    2560 | 
-^ 13    | mtd11      | app_data         | 0x6e20000      | 0x0280000    2560 |+^ 13    | mtd11      | app_data         ''0x6e20000''      | 0x0280000    2560 |
  
 <WRAP center round download 60%> <WRAP center round download 60%>
Line 97: Line 139:
 </WRAP> </WRAP>
  
 +The //part_map// (offset ''0x0020000'') stores the real partition offsets (there might be bad blocks) and sizes. This partition starts with the **SCFLMAPOK** string. The partitions are at the offset 0x800 grouped in 3 columns (12 bytes). E.g:
 +
 +<code>$ xxd -g 4 -c 12 -s $((0x800)) -l $((0xb4)) part_map          
 +00000800: 00000001 00000005 00000005  ............
 +0000080c: 00000006 0000000f 0000000a  ............
 +00000818: 00000010 00000019 0000000a  ............
 +00000824: 0000001a 0000001e 00000005  ............
 +00000830: 0000001f 00000028 0000000a  .......(....
 +0000083c: 00000029 00000119 000000f1  ...)........
 +00000848: 0000011a 000001b9 000000a0  ............
 +00000854: 000001ba 000002a9 000000f0  ............
 +00000860: 000002aa 00000349 000000a0  .......I....
 +0000086c: 0000034a 00000353 0000000a  ...J...S....
 +00000878: 00000354 0000035d 0000000a  ...T...]....
 +00000884: 0000035e 00000371 00000014  ...^...q....
 +00000890: 00000372 00000385 00000014  ...r........
 +0000089c: 0000eeee 0000eeee 0000eeee  ............
 +000008a8: 00000000 00000000 00000000  ............</code>
  
 +The value in each column should be multiplied by //0x20000// (block size):
  
 +''**real_value** = column_value * 0x20000''
  
 +The first column is the real offset, the second is the end offset and the third is the size.
 ===== Hardware ===== ===== Hardware =====
 ==== Info ==== ==== Info ====
Line 140: Line 203:
  
 <WRAP center round alert 60%> <WRAP center round alert 60%>
-The heatsink over the SoC is **<color crimson>plastic</color>** made. The conductivity is unknown. Furthermore, in some units it's likely the heatsink is loose. Please, check this part to avoid further damage on your unit.+The heatsink over the SoC is **<color crimson>plastic</color>** made. The conductivity is unknown. Furthermore, in some units it's likely loose. Please, check this part to avoid further damage on your unit.
 </WRAP> </WRAP>
  
Line 152: Line 215:
 {{:media:sercomm:h500s:h500s-switch_diagram.png?direct&600|}} {{:media:sercomm:h500s:h500s-switch_diagram.png?direct&600|}}
  
 +We only can configure the internal switch in **bcm63xx**. The external switch will behave as a dumb switch and viewed as one LAN port in LuCi. The WAN port belongs to the internal switch and can be configured in LuCi.
 +
 +{{:media:sercomm:h500s:h500s-switch_luci.png?direct&600|}}
 +
 +The external switch can be configured using the **bmips** target with support for [[https://www.kernel.org/doc/html/latest/networking/dsa/index.html|DSA]]. See commit [[commit>6df12200d903338d36008cb207a41bd456346b5d|bmips: add support for Sercomm H-500s]]
 ==== Wifi ==== ==== Wifi ====
 Wi-Fi CERTIFIED n: Wi-Fi CERTIFIED n:
Line 461: Line 529:
  
 To make the Quantenna wifi work: To make the Quantenna wifi work:
-  Configure a virtual IP to let the Quantenna SoC communicate with the main SoC. I.e with uci commands: <code bash>uci set network.lan2=interface+  Configure a virtual IP to let the Quantenna SoC communicate with the main SoC. I.e with uci commands: <code bash>uci set network.lan2=interface
 uci set network.lan2.ifname=@lan uci set network.lan2.ifname=@lan
 uci set network.lan2.proto=static uci set network.lan2.proto=static
Line 467: Line 535:
 uci set network.lan2.netmask=255.0.0.0 uci set network.lan2.netmask=255.0.0.0
 uci commit network uci commit network
 +/etc/init.d/network/restart
 </code> </code>
-  Configure a TFTP server inside OpenWrt, the Quantenna images will be served in the ///etc/wlan// directory: <code bash>uci set dhcp.@dnsmasq[-1].enable_tftp=1+  Configure a TFTP server inside OpenWrt, the Quantenna images will be served in the ///etc/wlan// directory: <code bash>uci set dhcp.@dnsmasq[-1].enable_tftp=1
 uci set dhcp.@dnsmasq[-1].tftp_root=/etc/wlan uci set dhcp.@dnsmasq[-1].tftp_root=/etc/wlan
-uci commit dhcp</code> The quantenna will pick from ///etc/wlan// the files **u-boot.bin** and **topaz-linux.lzma.img** +uci commit dhcp 
-  Install the qcsapi client. <WRAP center round download 100%>+/etc/init.d/dnsmasq restart</code> The quantenna will pick from ///etc/wlan// the files **u-boot.bin** and **topaz-linux.lzma.img** 
 +  Install the qcsapi client. <code>opkg update 
 +opkg install libtirpc 
 +opkg install call_qcsapi_1.0.1-1_mips_mips32.ipk</code><WRAP center round download 100%>
 The qcsapi client, source code and built package. It includes the Quantenna TFTP files, and a script to make a basic configuration:  The qcsapi client, source code and built package. It includes the Quantenna TFTP files, and a script to make a basic configuration: 
   * https://github.com/danitool/openwrt-pkgs/tree/master/call_qcsapi   * https://github.com/danitool/openwrt-pkgs/tree/master/call_qcsapi
-  * [[https://drive.google.com/uc?export=download&id=1jA1HdJpPiUKv6zVD9gv0uq73ZFcKc_rO|call_qcsapi_1.0.1-1_mips_mips32.ipk]]+  * [[https://drive.google.com/uc?export=download&id=1_BSx7tsVHGXk53USAkm75wbb5SJDEQeq|call_qcsapi_1.0.1-1_mips_mips32-openwrt_21.02.ipk]]
 </WRAP> </WRAP>
  
-  * Using the command call_qcsapi_sockrpc we can start the wifi. Use these commands to perform a basic configuration: <code bash>call_qcsapi_sockrpc --host 1.1.1.2 is_startprod_done+Using the command call_qcsapi_sockrpc we can start the wifi. Example: <code bash>call_qcsapi_sockrpc --host 1.1.1.2 is_startprod_done
 call_qcsapi_sockrpc --host 1.1.1.2 startprod call_qcsapi_sockrpc --host 1.1.1.2 startprod
 call_qcsapi_sockrpc --host 1.1.1.2 rfstatus call_qcsapi_sockrpc --host 1.1.1.2 rfstatus
Line 485: Line 557:
 </code> </code>
  
 +See [[https://github.com/danitool/call_qcsapi_client/raw/master/Quantenna_Configuration_and_Status_APIs-INTERNAL.pdf|Quantenna_Configuration_and_Status_APIs-INTERNAL.pdf]]
  
 ==== Serial ==== ==== Serial ====
 -> [[docs:techref:hardware:port.serial]] general information about the serial port, serial port cable, etc. -> [[docs:techref:hardware:port.serial]] general information about the serial port, serial port cable, etc.
  
-How to connect to the Serial Port of this specific device:\\+How to connect to the Serial Port of this specific device:
  
 +  ***BCM63167** serial port:\\ <a2s>
 +  ▽           4
 +#----------------#
 +|.-. .-. .-. .-. |
 +|'-' '-' '-' '-' |
 +#----------------#  J302
 + GND  TX VCC  RX
 +</a2s>{{:media:sercomm:h500s:h500s-bcm63167_serial.jpg?direct&300|}}
  
-<a2s>+  ***QT3740BC** serial port:\\  <a2s>
   ▽           4   ▽           4
 #----------------# #----------------#
 |.-. .-. .-. .-. | |.-. .-. .-. .-. |
 |'-' '-' '-' '-' | |'-' '-' '-' '-' |
-#----------------#  J302 and JXW1+#----------------#  JXW1
  GND  TX VCC  RX  GND  TX VCC  RX
-</a2s> +</a2s>{{:media:sercomm:h500s:h500s-QT3740BC_serial.jpg?direct&300|}} 
-Only connect GND, TX and RX. Baud rate: 115200 +
- +
-  ***BCM63167** serial port\\ {{:media:sercomm:h500s:h500s-bcm63167_serial.jpg?direct&300|}} +
- +
-  ***QT3740BC** serial port\\ {{:media:sercomm:h500s:h500s-QT3740BC_serial.jpg?direct&300|}} +
  
 +Only connect GND, TX and RX.
  
 +Baud rate: 115200
  
 ==== GPIOs ==== ==== GPIOs ====
Line 536: Line 614:
 | 21 | R558 (near main SoC [NAND flash bootstrap])  | | 21 | R558 (near main SoC [NAND flash bootstrap])  |
  
 +==== Bootloader ====
 +The board uses CFE. The //lowi// version seems to be blocked and there is no known way to enter into the CLI. However the vfes version allows to break into the CFE. Both CFEs are interchangeable since the boards are identical.
 +
 +About the possible boards compatible with this CFE:
 +
 +<code bash>CFE> b
 +Press:  <enter> to use current value
 +        '-' to go previous parameter
 +        '.' to clear the current value
 +        'x' to exit this command
 +963268SV1                  ------ 0 
 +963268MBV(obsolete)        ------ 1 
 +963168VX                   ------ 2 
 +963168VX_P300              ------ 3 
 +963268BU                   ------ 4 
 +963268BU_P300              ------ 5 
 +963268SV2_EXTSW            ------ 6 
 +963168MBV_17A              ------ 7 
 +963168MBV_30A              ------ 8 
 +963168XH                   ------ 9 
 +963168XH5                  ------ 10
 +963168MP                   ------ 11
 +963268V30A                 ------ 12
 +963168MEDIA                ------ 13
 +963268SV2                  ------ 14
 +963168XFG3                 ------ 15
 +963168XF                   ------ 16
 +963168XM                   ------ 17
 +963168MBV3                 ------ 18
 +963168MBV17A302            ------ 19
 +963168MBV30A302            ------ 20
 +963168VX_P400              ------ 21
 +963168VX_ext1p8            ------ 22
 +963269BHR                  ------ 23
 +963168ACH5                 ------ 24
 +963168AC5                  ------ 25
 +963168XN5                  ------ 26
 +963168XM5                  ------ 27
 +963168XM5_6302             ------ 28
 +963168WFAR                 ------ 29
 +963167REF1                 ------ 30
 +963167REF3(obsolete)       ------ 31
 +963168PLC                  ------ 32
 +963168PLC_MOCAW            ------ 33
 +Board Id (0-33)                   :  31
 +</code>
 ===== Bootlogs ===== ===== Bootlogs =====
  
  • Last modified: 2024/07/24 19:38
  • by deerhunter