Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Next revisionBoth sides next revision
toh:sercomm:h500-s [2021/04/18 21:56] – ↷ Page name changed from toh:sercomm:h500s to toh:sercomm:h500-s tmomastoh:sercomm:h500-s [2023/04/06 18:55] – [Serial] make it more clear danitool
Line 40: Line 40:
 ---- ----
 <WRAP center round important 60%> <WRAP center round important 60%>
-**Warning**: If for some reason, you brick the device at the kernel level (i.e not able to load rootfs)you will need [[#serial]] console to make a recovering. You may also need an Openwrt ramdisk version. +**Warning**: If for some reason, you brick the device (non working firmware) you may need to use the sercomm upgrade mode, see -> [[#recovery]]
-</WRAP>+
  
-<WRAP center round alert 60%> +**Warning**: On the **H500-s lowi** model There is no known way to stop the bootloader at the command line on the serial console.
-**Alert**:The **H500-s lowi** model is unrecoverable after a brick. There is no known way to stop the bootloader at the command line on the serial console.+
 </WRAP> </WRAP>
  
Line 60: Line 58:
  
 ==== Flashing via bootloader web ==== ==== Flashing via bootloader web ====
-With this procedure you will flash the firmware using the [[docs:techref:bootloader|bootloader]] web interface (foolproof)+With this procedure you will flash the firmware using the [[docs:techref:bootloader|bootloader]] web interface
  
 Spite this router comes with web interface in the bootloader for flashing purposes, the procedure is still unknown. Spite this router comes with web interface in the bootloader for flashing purposes, the procedure is still unknown.
 +
 +===== Recovery =====
 +Please, first try -> [[docs:guide-user:troubleshooting:failsafe_and_factory_reset]], if you bricked Openwrt while configuring after installation.
 +
 +**Broken firmware:**
 +
 +The bootloader (CFE) comes with a proprietary Sercomm module for recovering purposes. If for some reason the router is unable to boot due to a faulty firmware, you can recover the router by putting it into Sercomm Upgrade mode. Follow these steps:
 +
 +  - Power off the router
 +  - Press the WPS button, don't release it yet!
 +  - Power on the router
 +  - Wait 5 seconds or more until the power LED blinks in red
 +  - Release the WPS button
 +  - Execute the sercomm-recovery utility as root in your OS-linux computer: <code bash>sercomm-recovery -v eth0 flash_burn.bin</code> If you have the serial console attached to the router, you'll see an output like this:<code log>
 +***************************************************
 +    Sercomm Boot Version 0.0.4.0
 +
 +***************************************************
 +WPS Button is pressed!
 +Correctable ECC Error detected: addr=0x00a8d000, intrCtrl=0x000000B0, accessCtrl=0xE3441010
 +Correctable ECC Error detected: addr=0x04c58200, intrCtrl=0x00000090, accessCtrl=0xE3441010
 +Disabling Switch ports.
 +Flushing Receive Buffers...
 +0 buffers found
 +Closing DMA Channels
 +
 +Resetting board in 0 seconds...HELO</code> 
 +  - Wait until the router restarts and inits completely the stock firmware
 +  <WRAP center round download 60%>
 +Recovery image: [[https://drive.google.com/uc?export=download&id=11wOiPCYkNSe-tDhp-EqNGUzC0YRlCBVz|h500s_vfes-recovery-flash_burn.zip]]
 +
 +Sercomm recovery utility: https://github.com/danitool/sercomm-recovery
 +</WRAP>
 +
 +
  
 ===== OEM firmware ===== ===== OEM firmware =====
Line 69: Line 102:
 | MOD VFES 3.4.17 | [[https://drive.google.com/uc?export=download&id=1rL68-16JV-6KFIMtffrpsvdt4KQDflOd|Vodafone-H-500-s_SERCOMM_VFES_3417_MOD.img]] | telnetd port 2323 | | MOD VFES 3.4.17 | [[https://drive.google.com/uc?export=download&id=1rL68-16JV-6KFIMtffrpsvdt4KQDflOd|Vodafone-H-500-s_SERCOMM_VFES_3417_MOD.img]] | telnetd port 2323 |
 | OEM lowi 3.3.05 | [[https://drive.google.com/uc?export=download&id=18bMs0e-y0cwgkW4rGIwjms9IBjGbtJoP|lowi-h500s_SERCOMM_LOWI_3305_OEM.img]] | telnetd port 2323 | | OEM lowi 3.3.05 | [[https://drive.google.com/uc?export=download&id=18bMs0e-y0cwgkW4rGIwjms9IBjGbtJoP|lowi-h500s_SERCOMM_LOWI_3305_OEM.img]] | telnetd port 2323 |
 +| OEM Finetwork 3612| [[https://drive.google.com/file/d/1LKMZ99jK2RSKJ_vW4splvMz6kLTHwsc9/view?usp=sharing|ASCK1MZ-W1H-004-0000003612.img]] | telnetd port ? |
 | GPL source code | [[https://mega.nz/#!K1JmCaDJ!MQ1mt8_jf5ydx1oXqr712mlTeNCdadrc24s5ezSRWqM|H500s V3305.rar]] | | | GPL source code | [[https://mega.nz/#!K1JmCaDJ!MQ1mt8_jf5ydx1oXqr712mlTeNCdadrc24s5ezSRWqM|H500s V3305.rar]] | |
 Default password: Default password:
 ^ Model        ^ User ^ Default Password ^ ^ Model        ^ User ^ Default Password ^
-^ H500-s vfes | admin | VF-ESVodafone-H-500-s | +^ H500-s vfes | admin | ''VF-ESVodafone-H-500-s'' 
-^ H500-s lowi | admin | l033i-h500s |+^ H500-s lowi | admin | ''l033i-h500s''
 +^ H500-s finetwork | admin | ''admin'' |
  
 ==== OEM NAND flash layout ==== ==== OEM NAND flash layout ====
  
 ^ index ^ partition  ^ part_name        ^ offset         ^ size        ^  size (KiB) ^ ^ index ^ partition  ^ part_name        ^ offset         ^ size        ^  size (KiB) ^
-^ 00    | mtd0       | cferom           | 0x0000000      | 0x0020000    128 | +^ 00    | mtd0       | cferom           ''0x0000000''      | 0x0020000    128 | 
-^ 01    | mtd1       | part_map         | 0x0020000      | 0x00a0000    640 | +^ 01    | **mtd1**   **part_map**     ''0x0020000''      | 0x00a0000    640 | 
-^ 02    | mtd2       | cferam1          | 0x00c0000      | 0x0140000    1280 | +^ 02    | mtd2       | cferam1          | ''0x00c0000''      | 0x0140000    1280 | 
-^ 03    | mtd3       | cferam2          | 0x0200000      | 0x0140000    1280 | +^ 03    | mtd3       | cferam2          | ''0x0200000''      | 0x0140000    1280 | 
-^ 04    | mtd4       | pcba-sn          | 0x0340000      | 0x00a0000    640 | +^ 04    | mtd4       | pcba-sn          | ''0x0340000''      | 0x00a0000    640 | 
-^ 05    | mtd5       | protect_data     | 0x03e0000      | 0x0140000    1280 | +^ 05    | mtd5       | protect_data     ''0x03e0000''      | 0x0140000    1280 | 
-^ 06    | mtd6       | kernel_fs1       | 0x0520000      | 0x1e00000    30720 | +^ 06    | mtd6       | kernel_fs1       ''0x0520000''      | 0x1e00000    30720 | 
-^ 07    | mtd12      | lib_1            | 0x2320000      | 0x1400000    20480 | +^ 07    | mtd12      | lib_1            | ''0x2320000''      | 0x1400000    20480 | 
-^ 08    | mtd7       | kernel_fs2       | 0x3720000      | 0x1e00000    30720 | +^ 08    | mtd7       | kernel_fs2       ''0x3720000''      | 0x1e00000    30720 | 
-^ 09    | mtd13      | lib_2            | 0x5520000      | 0x1400000    20480 | +^ 09    | mtd13      | lib_2            | ''0x5520000''      | 0x1400000    20480 | 
-^ 10    | mtd8       | boot_flag1       | 0x6920000      | 0x0140000    1280 | +^ 10    | mtd8       | boot_flag1       ''0x6920000''      | 0x0140000    1280 | 
-^ 11    | mtd9       | boot_flag2       | 0x6a60000      | 0x0140000    1280 | +^ 11    | mtd9       | boot_flag2       ''0x6a60000''      | 0x0140000    1280 | 
-^ 12    | mtd10      | xml_cfg          | 0x6ba0000      | 0x0280000    2560 | +^ 12    | mtd10      | xml_cfg          | ''0x6ba0000''      | 0x0280000    2560 | 
-^ 13    | mtd11      | app_data         | 0x6e20000      | 0x0280000    2560 |+^ 13    | mtd11      | app_data         ''0x6e20000''      | 0x0280000    2560 |
  
 <WRAP center round download 60%> <WRAP center round download 60%>
Line 97: Line 132:
 </WRAP> </WRAP>
  
 +The //part_map// (offset ''0x0020000'') stores the real partition offsets (there might be bad blocks) and sizes. This partition starts with the **SCFLMAPOK** string. The partitions are at the offset 0x800 grouped in 3 columns (12 bytes). E.g:
 +
 +<code>$ xxd -g 4 -c 12 -s $((0x800)) -l $((0xb4)) part_map          
 +00000800: 00000001 00000005 00000005  ............
 +0000080c: 00000006 0000000f 0000000a  ............
 +00000818: 00000010 00000019 0000000a  ............
 +00000824: 0000001a 0000001e 00000005  ............
 +00000830: 0000001f 00000028 0000000a  .......(....
 +0000083c: 00000029 00000119 000000f1  ...)........
 +00000848: 0000011a 000001b9 000000a0  ............
 +00000854: 000001ba 000002a9 000000f0  ............
 +00000860: 000002aa 00000349 000000a0  .......I....
 +0000086c: 0000034a 00000353 0000000a  ...J...S....
 +00000878: 00000354 0000035d 0000000a  ...T...]....
 +00000884: 0000035e 00000371 00000014  ...^...q....
 +00000890: 00000372 00000385 00000014  ...r........
 +0000089c: 0000eeee 0000eeee 0000eeee  ............
 +000008a8: 00000000 00000000 00000000  ............</code>
  
 +The value in each column should be multiplied by //0x20000// (block size):
  
 +''**real_value** = column_value * 0x20000''
  
 +The first column is the real offset, the second is the end offset and the third is the size.
 ===== Hardware ===== ===== Hardware =====
 ==== Info ==== ==== Info ====
Line 152: Line 208:
 {{:media:sercomm:h500s:h500s-switch_diagram.png?direct&600|}} {{:media:sercomm:h500s:h500s-switch_diagram.png?direct&600|}}
  
 +We only can configure the internal switch in **bcm63xx**. The external switch will behave as a dumb switch and viewed as one LAN port in LuCi. The WAN port belongs to the internal switch and can be configured in LuCi.
 +
 +{{:media:sercomm:h500s:h500s-switch_luci.png?direct&600|}}
 +
 +The external switch can be configured using the **bmips** target with support for [[https://www.kernel.org/doc/html/latest/networking/dsa/index.html|DSA]]. See commit [[commit>6df12200d903338d36008cb207a41bd456346b5d|bmips: add support for Sercomm H-500s]]
 ==== Wifi ==== ==== Wifi ====
 Wi-Fi CERTIFIED n: Wi-Fi CERTIFIED n:
Line 461: Line 522:
  
 To make the Quantenna wifi work: To make the Quantenna wifi work:
-  Configure a virtual IP to let the Quantenna SoC communicate with the main SoC. I.e with uci commands: <code bash>uci set network.lan2=interface+  Configure a virtual IP to let the Quantenna SoC communicate with the main SoC. I.e with uci commands: <code bash>uci set network.lan2=interface
 uci set network.lan2.ifname=@lan uci set network.lan2.ifname=@lan
 uci set network.lan2.proto=static uci set network.lan2.proto=static
Line 467: Line 528:
 uci set network.lan2.netmask=255.0.0.0 uci set network.lan2.netmask=255.0.0.0
 uci commit network uci commit network
 +/etc/init.d/network/restart
 </code> </code>
-  Configure a TFTP server inside OpenWrt, the Quantenna images will be served in the ///etc/wlan// directory: <code bash>uci set dhcp.@dnsmasq[-1].enable_tftp=1+  Configure a TFTP server inside OpenWrt, the Quantenna images will be served in the ///etc/wlan// directory: <code bash>uci set dhcp.@dnsmasq[-1].enable_tftp=1
 uci set dhcp.@dnsmasq[-1].tftp_root=/etc/wlan uci set dhcp.@dnsmasq[-1].tftp_root=/etc/wlan
-uci commit dhcp</code> The quantenna will pick from ///etc/wlan// the files **u-boot.bin** and **topaz-linux.lzma.img** +uci commit dhcp 
-  Install the qcsapi client. <WRAP center round download 100%>+/etc/init.d/dnsmasq restart</code> The quantenna will pick from ///etc/wlan// the files **u-boot.bin** and **topaz-linux.lzma.img** 
 +  Install the qcsapi client. <code>opkg update 
 +opkg install libtirpc 
 +opkg install call_qcsapi_1.0.1-1_mips_mips32.ipk</code><WRAP center round download 100%>
 The qcsapi client, source code and built package. It includes the Quantenna TFTP files, and a script to make a basic configuration:  The qcsapi client, source code and built package. It includes the Quantenna TFTP files, and a script to make a basic configuration: 
   * https://github.com/danitool/openwrt-pkgs/tree/master/call_qcsapi   * https://github.com/danitool/openwrt-pkgs/tree/master/call_qcsapi
-  * [[https://drive.google.com/uc?export=download&id=1jA1HdJpPiUKv6zVD9gv0uq73ZFcKc_rO|call_qcsapi_1.0.1-1_mips_mips32.ipk]]+  * [[https://drive.google.com/uc?export=download&id=1_BSx7tsVHGXk53USAkm75wbb5SJDEQeq|call_qcsapi_1.0.1-1_mips_mips32-openwrt_21.02.ipk]]
 </WRAP> </WRAP>
  
-  * Using the command call_qcsapi_sockrpc we can start the wifi. Use these commands to perform a basic configuration: <code bash>call_qcsapi_sockrpc --host 1.1.1.2 is_startprod_done+Using the command call_qcsapi_sockrpc we can start the wifi. Example: <code bash>call_qcsapi_sockrpc --host 1.1.1.2 is_startprod_done
 call_qcsapi_sockrpc --host 1.1.1.2 startprod call_qcsapi_sockrpc --host 1.1.1.2 startprod
 call_qcsapi_sockrpc --host 1.1.1.2 rfstatus call_qcsapi_sockrpc --host 1.1.1.2 rfstatus
Line 485: Line 550:
 </code> </code>
  
 +See [[https://github.com/danitool/call_qcsapi_client/raw/master/Quantenna_Configuration_and_Status_APIs-INTERNAL.pdf|Quantenna_Configuration_and_Status_APIs-INTERNAL.pdf]]
  
 ==== Serial ==== ==== Serial ====
 -> [[docs:techref:hardware:port.serial]] general information about the serial port, serial port cable, etc. -> [[docs:techref:hardware:port.serial]] general information about the serial port, serial port cable, etc.
  
-How to connect to the Serial Port of this specific device:\\+How to connect to the Serial Port of this specific device:
  
- +  ***BCM63167** serial port:\\ <a2s>
-<a2s>+
   ▽           4   ▽           4
 #----------------# #----------------#
 |.-. .-. .-. .-. | |.-. .-. .-. .-. |
 |'-' '-' '-' '-' | |'-' '-' '-' '-' |
-#----------------#  J302 and JXW1+#----------------#  J302
  GND  TX VCC  RX  GND  TX VCC  RX
-</a2s> +</a2s>{{:media:sercomm:h500s:h500s-bcm63167_serial.jpg?direct&300|}}
-Only connect GND, TX and RX. Baud rate115200+
  
-  ***BCM63167** serial port\\ {{:media:sercomm:h500s:h500s-bcm63167_serial.jpg?direct&300|}} +  ***QT3740BC** serial port:\\  <a2s> 
- +  ▽           4 
-  ***QT3740BC** serial port\\ {{:media:sercomm:h500s:h500s-QT3740BC_serial.jpg?direct&300|}} +#----------------# 
 +|.-. .-. .-. .-. | 
 +|'-' '-' '-' '-' | 
 +#----------------#  JXW1 
 + GND  TX VCC  RX 
 +</a2s>{{:media:sercomm:h500s:h500s-QT3740BC_serial.jpg?direct&300|}} 
  
 +Only connect GND, TX and RX.
  
 +Baud rate: 115200
  
 ==== GPIOs ==== ==== GPIOs ====
  • Last modified: 2024/07/24 19:38
  • by deerhunter