Vodafone Station 2 / Vox1.5
This page is about the above mentioned device also know as Vodafone Station 2 (codenamed Vox1.5) in its two variants, both sharing the same OEM firmware:
- Huawei HH1500
- Sercomm SHG1500
In compliance with the GPLv2, the source code of the latest Italian (and possibly European) software release for this device has been, at long last, released by Vodafone on April 30, 2018. A copy of it can be downloaded here: https://mega.nz/#!gVhmwIbQ!IMRnnRIWNOgrfSTBYQYOpC--FxgkfnylM_wE_3BijoE
Supported Versions
None
Hardware Highlights
| CPU | Ram | Flash | Network | USB | Serial | JTag |
|---|---|---|---|---|---|---|
| Broadcom BCM6361KFEBG | 128MiB | 64MiB Nand | 3 fastE + 1 gigE + 11n WiFi | Yes | Yes | ? |
Physical inspection revealed SoC SKU BCM6361KFEBG, but some other boards may have BCM6361EKFEBG.
After HHG1500, there exist at least 2 revisions of the SHG1500 board:
- As per Photos it uses a Xilinx FPGA-driven LCD front display and front keypad connected to JP7 I2C port
- As per Driving LCD from Arduino this has similar but clearly different board layout and uses a Truly LCD front display part and leaves JP7 unpopulated, more pictures at this italian forum post
OEM bootlog
JELO CPUJ L1CI JELO CPUJ L1CI DRAM ---- PHYS ZQDN PHYE DINT LASY USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F MAIN NAN1 BT00 NAN9 NAN9 NAN3 RFS1 NAN5 ................................................................................ ............................******* DSP: Found BCM96362 ******* ******* DSP: In PCM Mode ******* ******* DSP: PCM running in 16 bit mode ******* gInterruptCounter = 0x811D7D84 gInterruptErrors = 0x811D7D88 gNextRxDesc = 0x811D7D64 gNextTxDesc = 0x811D7D60 gDectTestMode = 0x811d7d2c gDectBuffStart = 0x811d7d30 32 ms ECAN tail-length *** gStartRxDesc[0] = 0xA61E2000 *** gBufferSizeBytes = 640 *** gStartTxDesc[0] = 0xA61E3000 halPcmInit 341 nextTxDesc = 0xA61E3000 halPcmInit 341 nextTxDesc = 0xA61E3008 halPcmInit 345 Ownership for TX desc not set. Use this buffer. DSP: Interrupt Masks --------------- IrqMask = 0x00000003 IrqMask1 = 0x00000010 DSP: Interrupt Status ----------------- IrqStatus = 0x00000000 IrqStatus1 = 0x00000000
The bootloader doesn't show the full boot log. Note CFE seems to be blocked. It doesn't receive any key from the serial.
Basic configuration
Switch Ports (for VLANs)
Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.
| Port | Switch port |
|---|---|
| LAN 1 | 1 |
| LAN 2 | 2 |
| LAN 3 | 3 |
| Internet (WAN) gigE | 4 |
Failsafe mode
Buttons
→ hardware.button on howto use and configure the hardware button(s).
The Sercom SHG1500 has two buttons. They are Reset and Secure Easy Setup. Here, we merely name the buttons, so we can use them in the above Howto:
| BUTTON | Event |
|---|---|
| Reset | reset |
| Secure Easy Setup | ses |
Hardware
Info
| Architecture | MIPS |
|---|---|
| Vendor | Broadcom |
| bootloader | cfe |
| System-On-Chip | BCM6361 |
| CPU/Speed | 400 MHz |
| Flash-Chip | STMicroelectronics NAND512W3A2DN6 |
| Flash size | 64 MiB NAND |
| RAM | 128 MiB NANYA NT5TU64M16GG-AC / DDR2-800 |
| Wireless | Broadcom integrated 2.4GHz/5GHz 802.11abgn |
| Ethernet | swconfig |
| Internet | xDSL/CABLE/3g |
| USB | Yes 3 x 2.0 |
| Serial | Yes |
| JTAG |
Serial
The serial port is J302, on the left of the soc
Settings are 115200 8N1
JTAG
For a while, people thought the JTAG port was JP2, located near the serial port; but today we still don'know what it is.
Despite being sometimes unpopulated, JP7 pins are an alternative I2C port for the capacitive keypad of the router used in older hardware revisions (see this article: https://www.onetransistor.eu/2018/10/router-lcd-and-keypad-to-arduino.html)
So, the real JTAG port remains undiscovered.
miniPCIe
There is an empty layout for a mini-pcie socket U34.
I think, it can be added easy.
SD socket
There also an other empty layout for a SD socket T121.
Links
Unfortunately, the thread has been removed because of legal threats from Vodafone: https://twitter.com/JackVendicator/status/489082981399924736