Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Next revisionBoth sides next revision
toh:sercomm:shg1500 [2017/08/23 10:59] – [Sercom SHG1500] danitooltoh:sercomm:shg1500 [2023/03/22 10:31] – [Hardware Highlights] lukepicci
Line 1: Line 1:
 +====== Vodafone Station 2 / Vox1.5 ======
  
 +This page is about the above mentioned device also know as Vodafone Station 2 (codenamed Vox1.5) in its two variants, both sharing the same OEM firmware:
 +  * Huawei HH1500
 +  * Sercomm SHG1500
 +
 +In compliance with the GPLv2, the source code of the latest Italian (and possibly European) software release for this device has been, at long last, released by Vodafone on April 30, 2018. A copy of it can be downloaded here: [[https://mega.nz/#!gVhmwIbQ!IMRnnRIWNOgrfSTBYQYOpC--FxgkfnylM_wE_3BijoE]]
 +
 +===== Supported Versions =====
 +None
 +/*
 +^ Version/Model   ^ Launch Date   ^ S/N   ^ OpenWrt Version Supported   ^ Model Specific Notes   ^
 +| v1              |    2011-12    | -     | -                           | -                      |
 +*/
 +
 +===== Hardware Highlights =====
 +^ CPU                     ^ Ram      ^ Flash        ^ Network      ^ USB   ^ Serial   ^ JTag   ^
 +| Broadcom BCM6361KFEBG   | 128MiB   | 64MiB Nand   | 3 + 1 gigE   | Yes   | Yes      | ?      |
 +
 +Physical inspection revealed SoC SKU BCM6361KFEBG, but some other boards may have BCM6361EKFEBG.
 +
 +After HHG1500, there exist at least 2 revisions of the SHG1500:
 +  *  As as per [[#Photos]] it uses an FPGA-drived LCD front display and front keypad connected to JP7 I2C port
 +  *  As per [[https://www.onetransistor.eu/2018/10/router-lcd-and-keypad-to-arduino.html|Driving LCD from Arduino]] this has similar but clearly different  board layout and uses a Truly LCD front display part and leaves JP7 unpopulated, more pictures at [[https://www.ilpuntotecnico.com/forum/index.php/topic,79024.msg236351.html#msg236351|this italian forum post]]
 +
 +==== OEM bootlog ====
 +<WRAP bootlog>
 +<nowiki>JELO
 +CPUJ
 +L1CI
 +JELO
 +CPUJ
 +L1CI
 +DRAM
 +----
 +PHYS
 +ZQDN
 +PHYE
 +DINT
 +LASY
 +USYN
 +MSYN
 +LMBE
 +PASS
 +----
 +ZBSS
 +CODE
 +DATA
 +L12F
 +MAIN
 +NAN1
 +BT00
 +NAN9
 +NAN9
 +NAN3
 +RFS1
 +NAN5
 +................................................................................
 +............................******* DSP: Found BCM96362 *******
 +******* DSP: In PCM Mode *******
 +******* DSP: PCM running in 16 bit mode *******
 +gInterruptCounter     = 0x811D7D84
 +gInterruptErrors      = 0x811D7D88
 +gNextRxDesc           = 0x811D7D64
 +gNextTxDesc           = 0x811D7D60
 +gDectTestMode         = 0x811d7d2c
 +gDectBuffStart        = 0x811d7d30
 +32 ms ECAN tail-length
 +*** gStartRxDesc[0] = 0xA61E2000
 +*** gBufferSizeBytes = 640
 +*** gStartTxDesc[0] = 0xA61E3000
 +halPcmInit 341 nextTxDesc = 0xA61E3000
 +halPcmInit 341 nextTxDesc = 0xA61E3008
 +halPcmInit 345 Ownership for TX desc not set. Use this buffer.
 +DSP: Interrupt Masks
 +---------------
 +IrqMask                   = 0x00000003
 +IrqMask1                  = 0x00000010
 +
 +DSP: Interrupt Status
 +-----------------
 +IrqStatus                 = 0x00000000
 +IrqStatus1                = 0x00000000</nowiki>
 +</WRAP>\\
 +
 +The bootloader doesn't show the full boot log.
 +Note CFE seems to be blocked.
 +It doesn't receive any key from the serial.
 +
 +
 +===== Basic configuration =====
 +
 +==== Switch Ports (for VLANs) ====
 +Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.
 +^ Port                  ^ Switch port   ^
 +| LAN 1                 | 1             |
 +| LAN 2                 | 2             |
 +| LAN 3                 | 3             |
 +| Internet (WAN) gigE   | 4             |
 +
 +==== Failsafe mode ====
 +-> [[docs:guide-user:troubleshooting:failsafe_and_factory_reset]]
 +
 +==== Buttons ====
 +-> [[docs:guide-user:hardware:hardware.button]] on howto use and configure the hardware button(s).
 +
 +The Sercom SHG1500 has two buttons. They are Reset and Secure Easy Setup. Here, we merely name the buttons, so we can use them in the above Howto:
 +^ BUTTON              ^ Event   ^
 +| Reset               | reset   |
 +| Secure Easy Setup   | ses     |
 +
 +===== Hardware =====
 +
 +==== Info ====
 +^ [[wp>Instruction set|Architecture]]           | [[wp>MIPS architecture|MIPS]]                                                                      |
 +^ Vendor                                        | [[wp>Broadcom]]                                                                                    |
 +^ [[docs:techref:bootloader]]                   | [[docs:techref:bootloader:cfe]]                                                                    |
 +^ [[docs:techref:hardware:soc|System-On-Chip]]  | BCM6361                                                                                            |
 +^ [[docs:techref:hardware:cpu|CPU]]/Speed       | 400 MHz                                                                                            |
 +^ Flash-Chip                                    | STMicroelectronics NAND512W3A2DN6                                                                  |
 +^ Flash size                                    | 64 MiB NAND                                                                                        |
 +^ RAM                                           | 128 MiB [[http://www.nanya.com/NanyaAdmin/GetFiles.ashx?ID=845|NANYA NT5TU64M16GG-AC]] / DDR2-800  |
 +^ Wireless                                      | Broadcom integrated 2.4GHz/5GHz 802.11abgn                                                         |
 +^ Ethernet                                      | [[docs:techref:swconfig]]                                                                          |
 +^ Internet                                      | xDSL/CABLE/3g                                                                                      |
 +^ USB                                           | Yes 3 x 2.0                                                                                        |
 +^ [[docs:techref:hardware:port.serial|Serial]]  | [[#Serial|Yes]]                                                                                    |
 +^ [[docs:techref:hardware:port.jtag|JTAG]]      | [[#JTAG|Not found]                                                                                         |
 +
 +==== Photos ====
 +
 +[[http://www.flickr.com/photos/rway/sets/72157629732755952/]]
 +
 +==== Serial ====
 +
 +The serial port is J302, on the left of the soc
 +
 +{{media:sercomm:shg1500_serial.jpg?400x300|}}
 +
 +<a2s>
 +  ▽           4
 +#----------------#
 +|.-. .-. .-. .-. |
 +|'-' '-' '-' '-' |
 +#----------------#  J302
 + GND  TX VCC  RX
 +</a2s>
 +
 +
 +Settings are 115200 8N1
 +
 +==== JTAG ====
 +For a while, people thought the JTAG port was JP2, located near the serial port; but today we still don'know what it is.
 +
 +Despite being sometimes unpopulated, JP7 pins are an alternative I2C port for the capacitive keypad of the router used in older hardware revisions (see this article: [[https://www.onetransistor.eu/2018/10/router-lcd-and-keypad-to-arduino.html]])
 +
 +So, the real JTAG port remains undiscovered.
 +
 +==== miniPCIe ====
 +
 +There is an empty layout for a mini-pcie socket U34.
 +
 +I think, it can be added easy.
 +
 +{{media:sercomm:shg1500_mpcie.jpg?400x300|}}
 +
 +==== SD socket ====
 +
 +There also an other empty layout for a SD socket T121. 
 +
 +{{media:sercomm:shg1500_sd.jpg|}}
 +
 +===== Links =====
 +
 +//Unfortunately, the thread has been removed because of legal threats from Vodafone: [[https://twitter.com/JackVendicator/status/489082981399924736]] //
 +
 +===== Tags =====
 +[[meta:tags|How to add tags]]
 +{{tag>bcm63xx bcm6361 bcm6362 64NAND 128RAM unsupported}}
  • Last modified: 2023/05/29 18:59
  • by lukepicci