Skip to content

Latest commit

 

History

History
191 lines (142 loc) · 5.19 KB

README.md

File metadata and controls

191 lines (142 loc) · 5.19 KB
Raw

Opensourcing the hardware (Investigation stage: WIP)

OEM Firmware

Included here is an OEM OTA update: 13782324_ES5000_HG2380_02_07_03_48.bin for Tilgin 2381 (and by all indications 238x).

To extract it:

tar -xf 13782324_ES5000_HG2380_02_07_03_48.bin

Inside are the UBI images, including: rootfs.img, appfs.img (empty), uImage (kernel)

the .img files are squashfsv2.1 FS

change sqlz (73 71 6C 7A) magic to sqsh (73 71 73 68).

echo 73 71 73 68 | xxd -r -p -o 0 - rootfs.img
echo 73 71 73 68 | xxd -r -p -o 0 - appfs.img

Some archivers won't like it. Keka handles it fine.

UART Serial

A serial UART J1 is available on the 2381 board beside the heatsink, 'above' the LAN1 and 2 ethernet buffer chips. +3.3V, UART1_RX, UART1_TX, GND.

UART

Connect your Serial adaptor TX to UART1_RX, and RX to UART1_TX and also GND to GND.

Hardware

According to some hardware wikis, the hardware in the HG238x is very similar to D-Links DWR-966 for which D-Links source is available here. The DWR-966 lacks a dedicated WAN port and phone/DECT ports, but has a GSM module and a SIM port.

DTS

A corresponding DTS file for the DWR-966 (above) appears to be target/linux/lantiq/image/dts/P02003.dts, which describes a demo board. The serial port is listed as J8. So some differences from the 2381 can be expected, but the chipset looks identical.

Data Encryption Unit

The /dev character devices present in the 2381 OEM firmware indicate that crypto hardware accelerators are available, for mostly deprecated cryptos: (3)DES, AES, MD5, SHA1, ARC4, and their corresponding HMACs. Likely for IPsec. Search bootlogs for IFX DEU (Data Encryption Unit). Not bad to have. Kernel drivers appear to be available for it. See here and here (old original driver) and here (openwrt git). Uncertain whether the driver is still disabled in newer kernels.

Cellular / GSM

Bootlogs suggest that at least drivers are included for USB GSM dongles. Board inspection reveals an absence of anything built in to the HG2381. The Zyxel has one, however.

DECT/FXS

A Lantiq (now Intel) FXS chip is included in the HG2381 devices. A S613NN81, SLL98 (Batch, part number). Other devices in the wild have similar chips. This manages the two RJ11 phone sockets. A 2384 (HKBN) includes a S633NN58, SLL98. Datasheet as usual unavailable. A forum post documents an S828NN26, SLL98 on a UK market model.

It seems a Lantiq VR9 kernel driver exists for the chip. You may need to dump the <1MB firmware blob for the FXS chip. See here.

USB EHCI PCI

At least two USB ports are available on the HG2381, and bootlogs show the EHCI controller.

  • USB1 (back)
  • USB2 (side)

GPIOs

HG2384

The 2384 (HKBN) bootlog reveals:

gpio-stp-xway 1e100bb0.stp: Init done
...
gpio-export gpio-export.8: 1 gpio(s) exported
...
tilgin-hg-ltq-gphy tilgin-hg-ltq-gphy.9: gpio_base=166
...
gpio 183 (name 3:green)
gpio 184 (name 3:red)
gpio 180 (name 4:green)
gpio 181 (name 4:red)
gpio 192 (name 5:green)
gpio 179 (name 5:red)
gpio 220 (name 6:green)
gpio 187 (name 7:green)
gpio 188 (name 7:red)
gpio 193 (name 8:green)
gpio 186 (name 8:red)
gpio 185 (name 1:red)
gpio 191 (name 6:red)

The 2384 has 7 multicolour LEDs on the front panel, from left to right:

  • Power (booting, booted)
  • WAN
  • LAN
  • WiFi
  • USB
  • Telephone
  • DECT

HG2381

The 2381 bootlog reveals:

on-off-sw-gpio:0
on-off-sw-gpio:1
on-off-sw-gpio:2
on-off-sw-gpio:3
on-off-sw-gpio:4
...
danube-gpio danube-gpio.0: gpio_base=0
danube-gpio danube-gpio.1: gpio_base=16
danube-gpio danube-gpio.2: gpio_base=32
Lantiq Danube/Twinpass/Vinax LED controller GPO
danube-ledc-gpo danube-ledc-gpo: gpio_base=64
...
GPIO-based on/off switch with auto-off
...
tilgin-hg-ltq-gphy: gpio_base=96
...
Registered led device: 1:red
Registered led device: 3:green
Registered led device: 3:red
Registered led device: 4:green
Registered led device: 4:red
Registered led device: 5:green
Registered led device: 5:red
Registered led device: 6:red
Registered led device: 6:green
Registered led device: 7:red
Registered led device: 7:green
Registered led device: 8:red
Registered led device: 8:green

The 2381 has 7 multicolour LEDs on the front panel, from left to right:

  • Power (booting, booted)
  • WAN
  • LAN
  • WiFi
  • USB
  • Telephone
  • Extra (DECT?)

The 2381 PCB has two push buttons.

  • "reset" (S2)
  • "WiFi" (S4)
  • empty position S3

Contact / Further info.

If you have any datasheets for the chipsets, open an issue here or reach out to me on my email (see any commit) :)