Vodafone Station 2 / Vox1.5

This page is about the above mentioned device also know as Vodafone Station 2 (codenamed Vox1.5) in its two variants, both sharing the same OEM firmware:

  • Huawei HH1500
  • Sercomm SHG1500

In compliance with the GPLv2, the source code of the latest Italian (and possibly European) software release for this device has been, at long last, released by Vodafone on April 30, 2018. A copy of it can be downloaded here: https://mega.nz/#!gVhmwIbQ!IMRnnRIWNOgrfSTBYQYOpC--FxgkfnylM_wE_3BijoE


CPU Ram Flash Network USB Serial JTag
Broadcom BCM6361KFEBG 128MiB 64MiB Nand 3 fastE + 1 gigE + 11n WiFi Yes Yes ?

Physical inspection revealed SoC SKU BCM6361KFEBG, but some other boards may have BCM6361EKFEBG.

After HHG1500, there exist at least 2 revisions of the SHG1500 board:

  • As per Photos it uses a Xilinx FPGA-driven LCD front display and front keypad connected to JP7 I2C port
  • As per Driving LCD from Arduino this has similar but clearly different board layout and uses a Truly LCD front display part and leaves JP7 unpopulated, more pictures at this italian forum post

JELO CPUJ L1CI JELO CPUJ L1CI DRAM ---- PHYS ZQDN PHYE DINT LASY USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F MAIN NAN1 BT00 NAN9 NAN9 NAN3 RFS1 NAN5 ................................................................................ ............................******* DSP: Found BCM96362 ******* ******* DSP: In PCM Mode ******* ******* DSP: PCM running in 16 bit mode ******* gInterruptCounter = 0x811D7D84 gInterruptErrors = 0x811D7D88 gNextRxDesc = 0x811D7D64 gNextTxDesc = 0x811D7D60 gDectTestMode = 0x811d7d2c gDectBuffStart = 0x811d7d30 32 ms ECAN tail-length *** gStartRxDesc[0] = 0xA61E2000 *** gBufferSizeBytes = 640 *** gStartTxDesc[0] = 0xA61E3000 halPcmInit 341 nextTxDesc = 0xA61E3000 halPcmInit 341 nextTxDesc = 0xA61E3008 halPcmInit 345 Ownership for TX desc not set. Use this buffer. DSP: Interrupt Masks --------------- IrqMask = 0x00000003 IrqMask1 = 0x00000010 DSP: Interrupt Status ----------------- IrqStatus = 0x00000000 IrqStatus1 = 0x00000000

The bootloader doesn't show the full boot log. Note CFE seems to be blocked. It doesn't receive any key from the serial.

Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.

Port Switch port
LAN 1 1
LAN 2 2
LAN 3 3
Internet (WAN) gigE 4

hardware.button on howto use and configure the hardware button(s).

The Sercom SHG1500 has two buttons. They are Reset and Secure Easy Setup. Here, we merely name the buttons, so we can use them in the above Howto:

Reset reset
Secure Easy Setup ses
Architecture MIPS
Vendor Broadcom
bootloader cfe
System-On-Chip BCM6361
CPU/Speed 400 MHz
Flash-Chip STMicroelectronics NAND512W3A2DN6
Flash size 64 MiB NAND
RAM 128 MiB NANYA NT5TU64M16GG-AC / DDR2-800
Wireless Broadcom integrated 2.4GHz/5GHz 802.11abgn
Ethernet swconfig
Internet xDSL/CABLE/3g
USB Yes 3 x 2.0
Serial Yes

The serial port is J302, on the left of the soc


Settings are 115200 8N1

For a while, people thought the JTAG port was JP2, located near the serial port; but today we still don'know what it is.

Despite being sometimes unpopulated, JP7 pins are an alternative I2C port for the capacitive keypad of the router used in older hardware revisions (see this article: https://www.onetransistor.eu/2018/10/router-lcd-and-keypad-to-arduino.html)

So, the real JTAG port remains undiscovered.

There is an empty layout for a mini-pcie socket U34.

I think, it can be added easy.

There also an other empty layout for a SD socket T121.

Unfortunately, the thread has been removed because of legal threats from Vodafone: https://twitter.com/JackVendicator/status/489082981399924736

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2023/05/29 18:59
  • by lukepicci