Sercomm SHG1500

This page is about the above mentioned device also know as Vodafone Station 2.

In compliance with the GPLv2, the source code of the latest Italian (and possibly European) software release for this device has been, at long last, released by Vodafone on April 30, 2018. A copy of it can be downloaded here:!gVhmwIbQ!IMRnnRIWNOgrfSTBYQYOpC--FxgkfnylM_wE_3BijoE

Version/Model Launch Date S/N OpenWrt Version Supported Model Specific Notes
v1 2011-12 - - -
CPU Ram Flash Network USB Serial JTag
Broadcom BCM6361KFEBG 128MiB 64MiB Nand 3 + 1 gigE Yes Yes ?

Physical inspection revealed SoC SKU BCM6361KFEBG, but some other boards may have BCM6361EKFEBG.

JELO CPUJ L1CI JELO CPUJ L1CI DRAM ---- PHYS ZQDN PHYE DINT LASY USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F MAIN NAN1 BT00 NAN9 NAN9 NAN3 RFS1 NAN5 ................................................................................ ............................******* DSP: Found BCM96362 ******* ******* DSP: In PCM Mode ******* ******* DSP: PCM running in 16 bit mode ******* gInterruptCounter = 0x811D7D84 gInterruptErrors = 0x811D7D88 gNextRxDesc = 0x811D7D64 gNextTxDesc = 0x811D7D60 gDectTestMode = 0x811d7d2c gDectBuffStart = 0x811d7d30 32 ms ECAN tail-length *** gStartRxDesc[0] = 0xA61E2000 *** gBufferSizeBytes = 640 *** gStartTxDesc[0] = 0xA61E3000 halPcmInit 341 nextTxDesc = 0xA61E3000 halPcmInit 341 nextTxDesc = 0xA61E3008 halPcmInit 345 Ownership for TX desc not set. Use this buffer. DSP: Interrupt Masks --------------- IrqMask = 0x00000003 IrqMask1 = 0x00000010 DSP: Interrupt Status ----------------- IrqStatus = 0x00000000 IrqStatus1 = 0x00000000

The bootloader doesn't show the full boot log. Note CFE seems to be blocked. It doesn't receive any key from the serial.

Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.

Port Switch port
LAN 1 1
LAN 2 2
LAN 3 3
Internet (WAN) gigE 4

hardware.button on howto use and configure the hardware button(s).

The Sercom SHG1500 has two buttons. They are Reset and Secure Easy Setup. Here, we merely name the buttons, so we can use them in the above Howto:

Reset reset
Secure Easy Setup ses
Architecture MIPS
Vendor Broadcom
bootloader cfe
System-On-Chip BCM6361
CPU/Speed 400 MHz
Flash-Chip STMicroelectronics NAND512W3A2DN6
Flash size 64 MiB NAND
RAM 128 MiB NANYA NT5TU64M16GG-AC / DDR2-800
Wireless Broadcom integrated 2.4GHz/5GHz 802.11abgn
Ethernet swconfig
Internet xDSL/CABLE/3g
USB Yes 3 x 2.0
Serial Yes

The serial port is J302, on the left of the soc


Settings are 115200 8N1

For a while, people thought the JTAG port was JP2, located near the serial port; but today we know it isn't.

JP2 pins are an I2C port for the capacitive keypad of the router (see this article:

So, the real JTAG port remains undiscovered.

There is an empty layout for a mini-pcie socket U34.

I think, it can be added easy.

There also an other empty layout for a SD socket T121.

Unfortunately, the thread has been removed because of legal threats from Vodafone:

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2020/06/28 11:07
  • by danitool