Vodafone Station Revolution / Vox2.5
This is the Vodafone Vox2.5 CPE shipped for different type of fixed lines technology in various countries. There exists three known clones of the same product made by different vendors over time (ADB, Huawei and Sercomm) which share the same exact hardware specs and firmware releases, despite different board designs. It supports both ADSL2+/VDSL2 broadband connections through DSL modem and fiber lines by Ethernet WAN port. Provides also two FXS ports for VoIP-to-POTS telephony gateway features.
This Vox2.5 has been marketed with different names in some countries, like:
- Vodafone Router Avanzado (SHG2500)
- Vodafone EasyBox 804 (SHG2500)
- Vodafone Station Revolution (AHG2500/HHG2500/SHG2500)
- Vodafone Connect Wi-Fi Router (HHG2500)
The Vodafone firmware image variant, its UI design and features set differ by country.
The ADB AHG2500 clone share the same board of ADB VV5820 (aka “Fastweb Fibra Top”). The Sercomm SHG2500 clone share the same board of Sercomm VD625 (aka “Smart Modem TIM”).
Supported Versions
Hardware Highlights
Installation
Warning: If for some reason, you brick the device (non working firmware) you may need to use the sercomm upgrade mode
Warning: On the SHG2500 model There is no known way to stop the bootloader at the command line on the serial console.
OEM easy install
We'll need to get admin access to the OEM firmware web interface. Therefore if you don't know the admin password, first a factory reset to the default config is required, otherwise start at step 4.
- Power on the router and wait for the OEM firmware to load.
- Press the reset button, hold it about 8 or more seconds until a LED starts blinking. Release the button. Now the router will restart.
- Wait until the router restarted and access to its web interface:
- Address:
http://192.168.0.1
- User:
admin
- Password:
VF-ESvox2.5
Note : As you can easily imagine, this guide can only be taken into consideration by owners of a Spanish VS. In the Italian one there is no username unless there is some hidden page for login
- ssh to 192.168.1.1 and set a root password, or browse to
http://192.168.1.1
if LuCI is installed.
Hardware
Info
Architecture: | MIPS | |
Vendor: | Broadcom | |
bootloader: | cfe | |
Board ID: | 963168MBV3 | |
System-On-Chip: | Broadcom BCM63168 | |
CPU/Speed | BMIPS4350 V8.0 / 400 MHz BMIPS Dual Core | |
NOR Flash Chip: | None | |
NAND Flash Chip: | AHGx | Spansion S34ML02G100TF100 |
HHGx | Micron MT29F2G08ABAEAWP | |
SHGx | ESMT F59L2G81A | |
NAND Flash size: | 256 MiB | |
RAM-Chips: | AHGx | Winbond W631GG6KB-15 |
HHGx | Micron MT47H64M16HR-25E | |
SHGx | Etrontech EM6GC16EWXD-15H | |
RAM size: | 128 MiB | |
Wireless: | BCM63168 (in SoC) | 802.11b/g/n |
BCM4360 | 802.11b/g/n/ac | |
Ethernet: | Broadcom BCM53124S w/ vlan support swconfig | |
DECT | No | |
USB | 2x 2.0 | |
Serial: | Yes | |
JTAG: | Yes, 20-pin header |
Photos
Insert photo of front of the casing
Insert photo of back of the casing
Insert photo of backside label
BOARD
Opening the case
All versions share the same casing appearance but screws are in different position. All models have internal clips all around the borders that keep both front and rear casing together.
The Huawei version has a single screw under the back label. The ADB version is the same but the screw is a torx one. The Sercomm version has three screws, one under a rubber pin inside the rear USB internet key slot, two other under rubber pins of the base stand.
Serial
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port:
Use a serial TTL adapter to connect your PC with the router. Only connect TX, RX and GND. |
Settings:
- Baudrate: 115200
- Data bits: 8
- Parity: None
- Stop bits: 1
AHG2500
HHG2500
SHG2500
Bootlogs
OEM bootlog
From Sercomm SHG2500 with OpenRG firmware variant
HELO CPUI L1CI HELO CPUI L1CI DRAM ---- PHYS STRF 400H PHYE DDR3 SIZ4 SIZ3 SIZ2 DINT USYN LSYN MFAS LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN RO08 SUN2 find flag find flag SUN6 000 000 001 001 RAM2 NAN3 RFS0 NAN5 CFE version 1.0.38-114.185 for BCM963268 (32bit,SP,BE) Build Date: Fri Sep 18 16:13:20 CST 2015 (jeremy@localhost) Copyright (C) 2000-2011 Broadcom Corporation. NAND flash device: name , id 0xc2da block 128KB size 262144KB External switch id = 53125 Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 find flag begin read flash map Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-26) : 963168MBV3 Number of MAC Addresses (1-32) : 12 Base MAC Address : e0:60:66:79:75:5e PSI Size (1-64) KBytes : 24 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Auxillary File System Size Percent: 0 Main Thread Number [0|1] : 0 Voice Board Configuration (0-9) : LE9672_ZSI *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 0 *************************************************** Sercomm Boot Version 1.0.2.0 *************************************************** Entering Firmware : Everything is OK. begin check sum safe value is 255 check sum ok Booting from BackUp image (0xbb720000) ... Correctable ECC Error detected: addr=0x03850600, intrCtrl=0x00000090, accessCtrl=0xF7FF1010 Correctable ECC Error detected: addr=0x0388ba00, intrCtrl=0x00000090, accessCtrl=0xF7FF1010 Correctable ECC Error detected: addr=0x0388ce00, intrCtrl=0x00000090, accessCtrl=0xF7FF1010 Decompression OK! Entry at 0x803e1e40 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. Starting program at 0x803e1e40 Linux version 2.6.30 (sharon@ubuntu) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #3 SMP PREEMPT Tue Feb 23 10:34:27 CST 2016 BCM Flash API. Flash device is not found. 963168MBV3 prom init CPU revision is: 0002a080 (Broadcom4350) DSL SDRAM reserved: 0x132000 Determined physical RAM map: memory: 07ece000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00007ece Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00007ece On node 0 totalpages: 32462 free_area_init_node: node 0, pgdat 804dde70, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 222 pages used for memmap Normal zone: 28144 pages, LIFO batch:7 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32208 Kernel command line: root=mtd:rootfs rw rootfstype=jffs2 console=ttyS0,115200 wait instruction: enabled Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes NR_IRQS:128 PID hash table entries: 512 (order: 9, 2048 bytes) console [ttyS0] enabled Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Allocating memory for DSP module core and initialization code Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0 Memory: 123032k/129848k available (3945k kernel code, 6644k reserved, 992k data, 168k init, 0k highmem) Calibrating delay loop... 398.33 BogoMIPS (lpj=199168) Mount-cache hash table entries: 512 --Kernel Config-- SMP=1 PREEMPT=1 DEBUG_SPINLOCK=0 DEBUG_MUTEXES=0 Broadcom Logger v0.1 Feb 23 2016 09:51:00 CPU revision is: 0002a080 (Broadcom4350) Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Calibrating delay loop... 402.43 BogoMIPS (lpj=201216) Brought up 2 CPUs CPU0 attaching sched-domain: domain 0: span 0-1 level CPU groups: 0 1 CPU1 attaching sched-domain: domain 0: span 0-1 level CPU groups: 1 0 net_namespace: 1140 bytes NET: Registered protocol family 16 Total Flash size: 0K with -1 sectors Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00008d6f-00008d79=-10<300) registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10005fff] pci 0000:00:00.0: supports D1 D2 pci 0000:00:00.0: PME# supported from D0 D3hot D3cold pci 0000:00:00.0: PME# disabled pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff] pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff] pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:01:00.0: PME# disabled pci 0000:02:00.0: reg 10 64bit mmio: [0x000000-0x007fff] pci 0000:02:00.0: supports D1 D2 pci 0000:01:00.0: PCI bridge, secondary bus 0000:02 pci 0000:01:00.0: IO window: disabled pci 0000:01:00.0: MEM window: 0x11000000-0x110fffff pci 0000:01:00.0: PREFETCH window: disabled PCI: Enabling device 0000:01:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:01:00.0 to 64 skbFreeTask created successfully BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 Feb 23 2016 10:02:00 initialized Broadcom GBPM v0.1 Feb 23 2016 10:02:01 initialized NET: Registered protocol family 8 NET: Registered protocol family 20 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 3, 32768 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered NET: Registered protocol family 1 NTFS driver 2.1.29 [Flags: R/W]. JFFS2 version 2.2. (NAND) c 2001-2006 Red Hat, Inc. fuse init (API version 7.11) msgmni has been set to 240 io scheduler noop registered (default) PCI: Setting latency timer of device 0000:01:00.0 to 64 Driver 'sd' needs updating - please use bus_type methods PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered NET: Registered protocol family 24 bcm963xx_mtd driver v2.0 Failed to read image tag from flash Broadcom DSL NAND controller (BrcmNand Controller) -->brcmnand_scan: CS=0, numchips=1, csi=0 mtd->oobsize=0, mtd->eccOobSize=0 NAND_CS_NAND_XOR=00000000 Disabling XOR on CS#0 brcmnand_scan: Calling brcmnand_probe for CS=0 B4: NandSelect=40000001, nandConfig=16152300, chipSelect=0 brcmnand_read_id: CS0: dev_id=c2da9095 After: NandSelect=40000001, nandConfig=16152300 DevId c2da9095 may not be supported. Will use config info Spare Area Size = 16B/512B Block size=00020000, erase shift=17 NAND Config: Reg=16152300, chipSize=256 MB, blockSize=128K, erase_shift=11 busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff timing1 not adjusted: 6574845b timing2 not adjusted: 00001e96 brcmnand_adjust_acccontrol: gAccControl[CS=0]=00000000, ACC=f7ff1010 ECC level changed to 15 OOB size changed to 16 BrcmNAND mfg 0 0 UNSUPPORTED NAND CHIP 256MB on CS0 Found NAND on CS0: ACC=f7ff1010, cfg=16152300, flashId=c2da9095, tim1=6574845b, tim2=00001e96 BrcmNAND version = 0x0400 256MB @00000000 brcmnand_scan: Done brcmnand_probe brcmnand_scan: B4 nand_select = 40000001 brcmnand_scan: After nand_select = 40000001 100 CS=0, chip->ctrl->CS[0]=0 ECC level 15, threshold at 1 bits reqEccLevel=0, eccLevel=15 190 eccLevel=15, chip->ecclevel=15, acc=f7ff1010 brcmnand_scan 10 200 CS=0, chip->ctrl->CS[0]=0 200 chip->ecclevel=15, acc=f7ff1010 page_shift=11, bbt_erase_shift=17, chip_shift=28, phys_erase_shift=17 brcmnand_scan 220 Brcm NAND controller version = 4.0 NAND flash size 256MB @10000000 brcmnand_scan 230 brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000 brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=15, isMLC=0, chip->cellinfo=0 ECC layout=brcmnand_oob_bch4_4k brcmnand_scan: mtd->oobsize=64 brcmnand_scan: oobavail=50, eccsize=512, writesize=2048 brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=15, eccbytes=3 300 CS=0, chip->ctrl->CS[0]=0 500 chip=87ab9190, CS=0, chip->ctrl->CS[0]=0 -->brcmnand_default_bbt brcmnand_default_bbt: bbt_td = bbt_main_descr Bad block table Bbt0 found at page 0001ffc0, version 0x01 for chip on CS0 Bad block table 1tbB found at page 0001ff80, version 0x01 for chip on CS0 brcmnand_scan 99 ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0: EHCI Host Controller ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500 ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver PCI: Enabling device 0000:00:09.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: OHCI Host Controller ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected usbcore: registered new interface driver usblp Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. brcmboard: brcm_board_init entry Serial: BCM63XX driver $Revision: 3.00 $ Magic SysRq enabled (type ^ h for list of supported commands) ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX Total # RxBds=1448 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized bcmPktDma_init: Broadcom Packet DMA Library initialized bcmxtmrt: Broadcom BCM3168D0 ATM/PTM Network Device v0.4 Feb 23 2016 10:01:03 p8021ag: p8021ag_init entry IPSEC SPU: SUCCEEDED GACT probability NOT on Mirror/redirect action on u32 classifier input device check on Actions configured Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (2028 buckets, 8112 max) GRE over IPv4 tunneling driver nf_nat_pt: no ports specified ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 10 lo: Disabled Privacy Extensions ip6_tables: (C) 2000-2006 Netfilter Core Team IPv6 over IPv4 tunneling driver sit0: Disabled Privacy Extensions NET: Registered protocol family 17 NET: Registered protocol family 15 Initializing MCPD Module Ebtables v2.0 registered ebt_time registered ebt_tcpmss registered ebt_ftos registered ebt_wmm_mark registered 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03850600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:0388ba00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:0388ce00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9c000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9d000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03c19c00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03c21800 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d06600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d35000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03e29c00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04107c00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04135800 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04169a00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04182000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:041a0600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:041a0600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04260000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:042e5400 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04302000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:0445dc00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:046c7600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:0492be00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:049efe00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04ac1e00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04b38a00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04b39a00 VFS: Mounted root (jffs2 filesystem) readonly on device 31:7. brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:057e8000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:058c3000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:059aee00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:05a25200 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:05af3400 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:05b32600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:05c02e00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:05c0da00 Freeing unused kernel memory: 168k freed init started: BusyBox v1.15.3 () starting pid 261, tty '': '/etc/rcS' jffs2_scan_dirent_node(): Node CRC failed on node at 0x00220fe4: Read 0xffffffff, calculated 0x0d19b389 Empty flash at 0x00221018 ends at 0x00221800 JFFS2 notice: (291) check_node_data: wrong data CRC in data node at 0x000c02cc: read 0xd0cf7ce8, calculated 0x7800a27f. brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d35000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d35000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d06600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d06600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d06600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d06600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d06600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d06600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04169a00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04135800 MCU module loaded ok v0.1 Feb 23 2016 09:57:56 bcm_ingqos: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint Broadcom Ingress QoS Module Char Driver v0.1 Feb 23 2016 09:57:53 Registered<243> Broadcom Ingress QoS ver 0.1 initialized BPM: tot_mem_size=134217728B (128MB), buf_mem_size=20132655B (19MB), num of buffers=9460, buf size=2128 Broadcom BPM Module Char Driver v0.1 Feb 23 2016 09:55:33 Registered<244> [NTC bpm] bpm_set_status: BPM status : enabled NBUFF v1.0 Initialized Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 Feb 23 2016 09:57:55 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. Constructed Broadcom Packet Flow Cache v2.2 Feb 23 2016 09:57:55 chipId 0x631680D0 Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Feb 23 2016 09:57:42 Registered <241> Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done FAP Debug values at 0xa5f9d300 0xa581d300 Allocated FAP0 GSO Buffers (0xA5FAE388) : 1048576 bytes @ 0xA5900000 Allocated FAP1 GSO Buffers (0xA582E388) : 1048576 bytes @ 0xA5A00000 Allocated FAP0 TM SDRAM Queue Storage (a5fae38c) : 341376 bytes @ a5880000 Allocated FAP1 TM SDRAM Queue Storage (a582e38c) : 341376 bytes @ a5b00000 [NTC fapProto] fapReset : Reset FAP Protocol layer [FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3968>, free <2688>, total<8192> [FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3968>, free <2688>, total<8192> [FAP0] PSM : addr<0x80002000>, used <23436>, free <1140>, total <24576> [FAP1] PSM : addr<0x80002000>, used <23436>, free <1140>, total <24576> [FAP0] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948 [FAP1] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948 [FAP0] GSO Buffer set to 0xA5900000 [FAP1] GSO Buffer set to 0xA5A00000 [FAP0] FAP BPM Initialized. [FAP1] FAP BPM Initialized. fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes bcmPktDma_bind: FAP Driver binding successfull [FAP0] FAP TM: ON [FAP1] FAP TM: ON bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM63168D0 Ethernet Network Device v0.1 Feb 23 2016 10:00:50 fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000 ETH Init: Ch:0 - 200 tx BDs at 0xb0820650 fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000 ETH Init: Ch:1 - 200 tx BDs at 0xb0a20650 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184 ETH Init: Ch:0 - 600 rx BDs at 0xb0821910 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184 ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910 dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered eth0: MAC Address: E0:60:66:79:75:5E eth1: MAC Address: E0:60:66:79:75:5E eth2: MAC Address: E0:60:66:79:75:5E eth3: MAC Address: E0:60:66:79:75:5E eth4: MAC Address: E0:60:66:79:75:5E [NTC arl] arlEnable : Enabled ARL binding to FAP Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Feb 23 2016 09:55:32 Registered <245> Broadcom 802.1Q VLAN Interface, v0.1 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04107c00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04107c00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04107c00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04107c00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:04107c00 Endpoint: endpoint_init entry Endpoint: endpoint_init COMPLETED Success Note: Loading 6300 MDK (default) driver for 63168 chip Note: Forcing 53115 driver for 53125 Switch MDK: num_switches = 2 Switch MDK: unit = 0; phy_pbmp = 0x8; config_pbmp = 0x18 Switch MDK link poll thread: unit=0; phypbmp=0x8 Switch MDK link poll thread: unit=1; phypbmp=0x1e VOX25_SERCOMM_VFES_3106 Tue Feb 23 10:48:14 UTC 2016 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d35000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d35000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d06600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d06600 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9d000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9c000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03ae0c00 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9d000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9c000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03d35000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9c000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9c000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9c000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9d000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9d000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03a9d000 brcmnand_ctrl_verify_ecc: Correctable ECC error at 00000000:03ae0c00 ap_name=syslogd, action=start ap_name=coredump, action=start ap_name=energy_saving, action=start ap_name=dnrd, action=start ap_name=phy, action=start ap_name=dnsmasq, action=start ap_name=lanip, action=start ap_name=firewall, action=start ap_name=telnetd, action=start ap_name=sshd, action=start ap_name=httpd, action=start ap_name=redirect, action=start ap_name=dnrd, action=start bind: Address already in use ap_name=ftpd, action=start ap_name=networkmap, action=start ap_name=srt, action=restart ap_name=rp, action=start ap_name=udpecho, action=start ap_name=ntp, action=start ap_name=wlan, action=start ap_name=ingress_qos, action=start ap_name=ingress_classify, action=start ap_name=qos, action=start ap_name=qos_cls, action=start /bin/wlctl: Not Found /bin/wlctl: Not Found /bin/wlctl: Not Found /bin/wlctl: Not Found Setting SSID: "test" Setting SSID: "_ONOWiFi" Setting SSID: "_AUTO_ONOWiFi" ifconfig: SIOCGIFFLAGS: No such device Chanspec set to 0x1803 /bin/wlctl: Not In Range /bin/wlctl: Not In Range ifconfig: SIOCGIFFLAGS: No such device Setting SSID: "test_5G" Setting SSID: "_ONOWiFi" Setting SSID: "_AUTO_ONOWiFi" ifconfig: SIOCGIFFLAGS: No such device Chanspec set to 0xe06a /bin/wlctl: Not In Range /bin/wlctl: Not In Range ifconfig: SIOCGIFFLAGS: No such device Success Success Success ap_name=qos_remark, action=start ACSD >>main(499): No interface specified, exiting...connect failed: Connection refused connect failed: Connection refused killall: wps_det: no process killed ap_name=ipv6wd, action=start ap_name=duplexmode, action=start ap_name=cpm, action=start ap_name=igd_upnp, action=start ap_name=dnsr, action=start ap_name=cron, action=start ap_name=cups, action=start ap_name=snmp, action=start ap_name=3g, action=start ap_name=emrd, action=start ap_name=fon, action=start starting pid 1560, tty '': '/sbin/getty ttyS0 115200' VOX25 login:
OEM Firmwares:
The usual stock Vox2.5 firmware is based on OpenRG 5.4. See OpenRG User, Administrator and Developer manuals for further details (all available for OpenRG 5.5).
OpenRG firmware remote upgrade images are in .rms file format, binwalk+fmk is capable of unpacking the rootfs image found in these files. Bootloader doesn't get updated and its version string matches the first firmware image originally flashed in factory.
OpenRG for Vodafone Station Revolution variant
There exist VSR firmware variants for all three hardware versions described in this page. The same firmware upgrade .rms file is shared among all of them. For safety, we assume each device can't run a firmware older then its bootloader, as older firmwares are likely not supporting newer clones boards.
Hardware type | Bootloader version | Minimum firmware version |
---|---|---|
ADB 963168_ADBVOX25 | 5.4.8.1.160.11.61 | >= bootloader |
Huawei 963168_HUAWEIVOX25 | 5.4.8.1.160.12.39 | |
Sercomm 963168_SERCOMMVOX25 | 5.4.8.1.287.1.54.1.1.1.6 |
Sources
OpenRG GPL toolchain and sources for this variant can be found here:
- 5.4.8.1.287.1.81.1.18.2.1 GPL.zip MEGA or Archive.org
- 5.4.8.1.327.1.51 GPL.zip MEGA
The available toolchain runs on 32-bit Linux systems.
Firmware upgrades
Firmware upgrade is automatically managed by CWMP. Setup an ACS and upload from there.
OpenRG for EasyBox 804 variant
When marketed as EasyBox 804, the SHG2500 board ships with a quite different OEM firmware.
Sources
OpenRG GPL toolchain and sources for this variant can be found here:
- CIS804_05.02_5_4_8_1_325_1_21_1_8_gpl MEGA or Archive.org
The available toolchain runs on 32-bit Linux systems.
Firmware upgrades
Here is a sample OEM firmware image which belongs to this variant:
- cis804-firmware-05-02-easybox-804.zip https://www.vodafone.de/business/hilfe-support/support-firmware-easybox-804-dsl-modem.html#rights
For this variant, you can simply upgrade firmware by placing the rms image into an usb drive.
Notes
Italian forum thread with lots of details on all versions of this device -→ External Link