This page is about the above mentioned device also know as Vodafone Station 2.
In compliance with the GPLv2, the source code of the latest Italian (and possibly European) software release for this device has been, at long last, released by Vodafone on April 30, 2018. A copy of it can be downloaded here: https://mega.nz/#!gVhmwIbQ!IMRnnRIWNOgrfSTBYQYOpC--FxgkfnylM_wE_3BijoE
|Version/Model||Launch Date||S/N||OpenWrt Version Supported||Model Specific Notes|
|Broadcom BCM6361KFEBG||128MiB||64MiB Nand||3 + 1 gigE||Yes||Yes||?|
Physical inspection revealed SoC SKU BCM6361KFEBG, but some other boards may have BCM6361EKFEBG.
JELO CPUJ L1CI JELO CPUJ L1CI DRAM ---- PHYS ZQDN PHYE DINT LASY USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F MAIN NAN1 BT00 NAN9 NAN9 NAN3 RFS1 NAN5 ................................................................................ ............................******* DSP: Found BCM96362 ******* ******* DSP: In PCM Mode ******* ******* DSP: PCM running in 16 bit mode ******* gInterruptCounter = 0x811D7D84 gInterruptErrors = 0x811D7D88 gNextRxDesc = 0x811D7D64 gNextTxDesc = 0x811D7D60 gDectTestMode = 0x811d7d2c gDectBuffStart = 0x811d7d30 32 ms ECAN tail-length *** gStartRxDesc = 0xA61E2000 *** gBufferSizeBytes = 640 *** gStartTxDesc = 0xA61E3000 halPcmInit 341 nextTxDesc = 0xA61E3000 halPcmInit 341 nextTxDesc = 0xA61E3008 halPcmInit 345 Ownership for TX desc not set. Use this buffer. DSP: Interrupt Masks --------------- IrqMask = 0x00000003 IrqMask1 = 0x00000010 DSP: Interrupt Status ----------------- IrqStatus = 0x00000000 IrqStatus1 = 0x00000000
The bootloader doesn't show the full boot log. Note CFE seems to be blocked. It doesn't receive any key from the serial.
Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.
|Internet (WAN) gigE||4|
→ hardware.button on howto use and configure the hardware button(s).
The Sercom SHG1500 has two buttons. They are Reset and Secure Easy Setup. Here, we merely name the buttons, so we can use them in the above Howto:
|Secure Easy Setup||ses|
|Flash size||64 MiB NAND|
|RAM||128 MiB NANYA NT5TU64M16GG-AC / DDR2-800|
|Wireless||Broadcom integrated 2.4GHz/5GHz 802.11abgn|
|USB||Yes 3 x 2.0|
The serial port is J302, on the left of the soc
Settings are 115200 8N1
For a while, people thought the JTAG port was JP2, located near the serial port; but today we know it isn't.
JP2 pins are an I2C port for the capacitive keypad of the router (see this article: https://www.onetransistor.eu/2018/10/router-lcd-and-keypad-to-arduino.html)
So, the real JTAG port remains undiscovered.
Unfortunately, the thread has been removed because of legal threats from Vodafone: https://twitter.com/JackVendicator/status/489082981399924736