HG556 A

skip to content
User Tools
Register
Log In
Site Tools
Recent Changes
Media Manager
Sitemap
OpenWrt Wiki Table of Hardware Huawei Huawei EchoLife HG556a
toh:huawei:hg556a
Table of Contents
Supported Versions
Hardware Highlights
Installation
o Flash Layout
o OEM easy installation
Get the firmware
Installation
o OEM installation using the TFTP method

o Upgrading OpenWrt
LuCI Web Upgrade Process
Terminal Upgrade Process
CFE Upgrade Process
Cleaning old garbage
o Original firmware
Basic configuration
Specific Configuration
o Interfaces
o Basic internet configuration
o Switch Ports (for VLANs)
o Main Core
o Failsafe mode
Hardware
o Info
o Photos
o Opening the case
Photo of PCB
o Serial
o JTAG
o GPIOs
Buttons
Leds
Other
o SPI
o VoIP
o Relays
Debricking
CFE Bootloader
Hardware mods
o External antenna mod
o Buzzer mod
Firmware mods
o Backports
BOOTLOGS
o OEM bootlog
o Openwrt bootlog
Notes
o cal_data
Tags
Huawei EchoLife HG556a

The HG556a was an adsl wifi router mainly distributed by Vodafone to their customers.
It comes in three versions A, B and C:
A, B versions have identical boards coming with an Atheros wifi chip and they only
differ in the flash chip erasesize.
C version is quite different on the inside, coming with a totally different board, equiped
with a Ralink wifi chip, and worse quality (no metal shieldings on the onboard chips).
It's a good idea to backup the cal_data area at the flash-chip. The WLAN calibration
data is specific for your device. If you wipe it accidentally it will be difficult to restore, it cannot
be restored by flashing back a vendor firmware. For doing this under Openwrt, mount a pendrive
(after installing proper drivers for USB mass storage), and copy the cal_data partition into it,
example:
mount /dev/sda1 /mnt
dd if=/dev/mtd4 of=/mnt/hg556a-cal_data-backup.bin
umount /mnt
Supported Versions
Supported since R35011 (Barrier Breaker). Internal ADSL/VoIP not supported.
Router
version
Serial Flash
number chip
Vdf Version *
(first 5 erasesiz
digits)
e **
30462,
30562,
HG556AVDF
30605, 0x10000
A
30608,
HG55VDFA Atheros
30634
VER.C
AR9223
30692,
30693,
HG556BVDFA
0x20000
31110,
31300
30555,
30694,
30695,
31301,
HG56BZR Ralink HG556CVDF 31507,
0x20000
B VER.A RT3062F A
31525,
31901,
31902,
31935,
32505
Board
model
Wifi
chip
cal_data Supporte
offset
d
Notes
0xf7e00
0
Yes
0xefe000
ADSL
not
supported
VoIP not
supported
0xeffe00 Yes
*)You can check the version from the OEM firmware executing the command: hwversion show
**)You can check the flash memory chip erasesize with the command (in openwrt): cat
/proc/mtd
0x20000 = 128 KiB
0x10000 = 64 KiB
The important parameters for choosing the correct OpenWrt file firmware are the flash chip
erasesize, and cal_data offset. But it's harmless to flash an incorrect firmware, it won't brick it.
Probably the GPIO4 and GPIO5 (input reading), are used by the OEM bootloader/firmware to
identify the board version (GetHG556aBoardVersion)
Hardware Highlights
SoC
Broadcom 6358
Ram
64MiB
Flash
16MiB
Network
4x1
USB
Serial
Yes
Yes
JTag
Yes
Installation
1. obtain.firmware
2. Install OpenWrt
Flash Layout
Please check out the article Flash.Layout. It contains an example and a couple of explanations.
partition
mtd0
n/a
mtd1
mtd2
mtd3
mtd4
mtd5
mtd6
name
CFE
n/a
kernel
rootfs
rootfs_data
cal_data
nvram
linux
filesystem
n/a
n/a
RAM executable
squashfs
jffs2
n/a
n/a
n/a
description
bootloader
firmware tag
kernel
root
configuration, install new packages
wifi calibration data
OEM configuration data
OpenWrt upgrade
OEM easy installation

This section deals with how you install OpenWrt from the device freshly opened.
Get the firmware
Since OpenWrt Chaos Calmer (migration to DTS), every version of this router (A, B, C) has its
own firmware. See supported versions to know your router version.
Release
firmware link
Notes
date
Trunk
continuous https://downloads.openwrt.org/snapshots/trunk/brcm63xx/ge Developme
(unstable) ly
neric/
nt version
Version
Chaos
Calmer
2015-0911
Barrier
Breaker
2014-1002
Attitude
2013-04Adjustme
25
nt
Backfire
2011-1221
Installation
BUGS,
updates,
USB and
wireless
drivers
NOT
included.
LuCI web
interface
NOT
included.
LuCI
included,
http://downloads.openwrt.org/chaos_calmer/15.05/brcm63x USB and
x/generic/
wireless
drivers
included
All
versions,
LuCI
included,
openwrt-HW556-squashfs-cfe.bin
USB and
wireless
drivers
NOT
included
All
versions,
unofficial
backport,
LuCI
hg556a_backport_12.09.zip
included,
USB and
wireless
drivers
included
Only for A,
B versions,
unofficial
backport,
hg556a_ath_backport_10.03.1.zip
USB and
wireless
drivers
included
With this procedure you will flash the firmware using the bootloader web interface (foolproof)
Set a static IP on your computer, use 192.168.1.35 (or any compatible), and connect the
ethernet cable to the router.
Unplug the router's power cord
Press the button labeled as RESTART, don't release it yet!
Plug the power cord
Wait 12 seconds or more
Release the RESTART button
Browse to http://192.168.1.1 and you should see this screen:
Select .bin firmware
Press Update Software to start the firmware update process
Wait for it to reboot
Telnet / ssh to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if

LuCI is installed.
OEM installation using the TFTP method
Connect the serial TTL cable to send commands to CFE for loading the firmware via tftp.
Start a TFTP server in your PC. Copy the openwrt-HW556-squashfs-cfe.bin firmware to

the server.
Set the IP at your pc to 192.168.1.35 (or any compatible), and connect the ethernet cable
to the router.
This is a session of flashing via TFTP:

CFE> f 192.168.1.35:openwrt-HW556-squashfs-cfe.bin
Loading 192.168.1.35:openwrt-HW556-squashfs-cfe.bin ...
Finished loading 2883588 bytes
Flashing root file system and kernel at 0xbe020000:
~~~~~~~Flag: 3
baseAddr 0xbe000000
kernelAddr 0xbe020100
rootfsAddr 0xbe020100
tagFs 0x80800000
......................
.
Backup flag .
~~~~~~~Flag: 1
.
*** Image flash done *** !
Resetting board...
Firmwares > 8MB size return an error about CRC check:
Finished loading 8388608 bytes Illegal image ! Image crc failed.
CFE web interface should be used in this case.
Upgrading OpenWrt
generic.sysupgrade
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt
version you can upgrade using the mtd command line tool. It is important that you put the
firmware image into the ramdisk (/tmp) before you start flashing.
LuCI Web Upgrade Process
Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL
Upload image file for sysupgrade to LuCI
Wait for reboot
Terminal Upgrade Process
Login as root via SSH on 192.168.1.1
Use the following commands to upgrade\\
cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrtHW556-squashfs-cfe.bin
sysupgrade /tmp/openwrt-HW556-squashfs-cfe.bin
If sysupgrade does not support this router, use the following commands
cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrtHW556-squashfs-cfe.bin
mtd write /tmp/openwrt-HW556-squashfs-cfe.bin linux && reboot
CFE Upgrade Process

This is a clean and safe upgrade, using the booloader web interface. Just use the OEM
installation procedure.
Cleaning old garbage
If after upgrading OpenWrt you get the message:
jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2
nodes
And you can't save changes. Or you are unsure if old data is messing your new firmware. Enter
OpenWrt failsafe mode if needed. Then execute this command:
mtd erase -r rootfs_data
Original firmware
These are the default administrator passwords in the OEM firmware
Firmware
new firmwares
all
spanish versions
irish versions
kiwi versions
user
advanced
emtest
admin
admin
admin
password
advanced
zbbtest
VF-EShg556
VF-IRhg556
VF-NZhg556
If you want back to the OEM firmware, once you installed OpenWrt, you can use the OpenWrt
Luci web interface for flashing it as a regular firmware.
Basic configuration
Basic configuration After flashing, proceed with this.

Set up your Internet connection, configure wireless, configure USB port, etc.
As default some firmware versions doesn't include wireless drivers. For installing these drivers
first give OpenWrt internet access (see Basic_internet_configuration or switch_ports_for_vlans)
and execute:
if your router has an Atheros wifi chip:
opkg update
opkg install kmod-ath9k
or, if your router version has a Ralink wifi chip
opkg update
opkg install kmod-rt2800-pci
you may also want to install USB drivers

opkg install kmod-usb-ohci kmod-usb2
If you are using a trunk version, you may want to install luci:
opkg install luci

/etc/init.d/uhttpd enable
Specific Configuration
Interfaces
The default network configuration is:
Interface Name
br-lan
eth0
wlan0
Description
LAN & WiFi
LAN ports (1 to 4)
WiFi
Default configuration
192.168.1.1/24
bridged
bridged (disabled)
Basic internet configuration

You can set a basic internet configuration with uci commands. Assuming your main router
(gateway) has the IP 192.168.1.1 (the most common). Follow these steps.
1. Connect only the ethernet cable from the HG556a to your computer, and telnet it or ssh.
2. Execute these commands
3.
4.
5.
6.
uci
uci
uci
uci
uci
set network.lan.ipaddr=192.168.1.254
set network.lan.netmask=255.255.255.0
set network.lan.gateway=192.168.1.1
set network.lan.dns='8.8.8.8 192.168.1.1'
commit network
7. You may also need to disable the dhcp server

/etc/init.d/dnsmasq disable
8. Reboot the HG556a and connect the ethernet cable to the main router (gateway).
9. Now the HG556a IP is 192.168.254, telnet or ssh it.
10. Ping any internet address, or install a package
11. opkg update
opkg install luci
Switch Ports (for VLANs)

This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the
unit, number 3 (LAN4) will be the Internet (WAN), 5 is the internal connection to the router
itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on.
Port label
LAN1
LAN2
LAN3
LAN4
n/a
Switch port
0
1
2
3
5t
lan
lan
lan
Internet (WAN)
to CPU
# path: /etc/config/network
# LAN4 = WAN
config interface loopback
option ifname
lo
option proto
static
option ipaddr
127.0.0.1
option netmask 255.0.0.0
config interface lan
option type
option ifname
option proto
option ipaddr
option netmask
config interface wan
option ifname
option proto
Mode
bridge
eth0.1
static
192.168.1.1
255.255.255.0
eth0.2
dhcp
config switch eth0

option enable 1
option reset
1
option enable_vlan 1
config switch_vlan
option device
option vlan
option ports
eth0
1
"0 1 2 5t"
config switch_vlan
option device
option vlan
option ports
eth0
2
"3 5t"
Main Core
The BCM6358 SoC has two CPU cores. Unfortunately Linux kernel can only manage one core.
The TLB is shared between the two cores, and there isn't code to deal with this problem.
As default the second core is the main. Since the cores in BCM6358 have different features, with
double icache in the first one, we may want to use it as the main one more icache = better
performance. The problem for using the core0 is the initialization, this task is made by the
bootloader, not OpenWrt.
We can manually hex-edit the bootloader to force initialization of the first core as the Main
thread. Or just use this utility in OpenWrt:
tp0set_1.0-1_brcm63xx.ipk
(looks like the binary is only compatible with Barrier Breaker or earlier versions of OpenWrt).
Tested dozen times with success.
Just install it and execute:
tp0set 0
then reboot the router.

This is a session of installing and executing tp0set
root@OpenWrt:/tmp# opkg install tp0set_1.0-1_brcm63xx.ipk
Installing tp0set (1.0-1) to root...
Configuring tp0set.
root@OpenWrt:/tmp# tp0set 0
setting TP0 main core
MTD Type: 3
MTD total size: 20000 bytes
MTD erase size: 20000 bytes
Eraseing Block 0
Writting to /dev/mtd0...
Done!!
root@OpenWrt:/tmp#
This is what you will see in dmesg:
Before: [ 0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize
After: [ 0.000000] Primary instruction cache 32kB, VIPT, 2-way, linesize
16 bytes.
16 bytes.
Some people reported +1520% extra performance with this change.

And this is the source code of tp0set
#include
#include
#include
#include
#include
<stdio.h>
<fcntl.h>
<sys/ioctl.h>
<mtd/mtd-user.h>
<string.h>
#define DATA_OFFSET 20
#define RAWBYTES_LEN 4
int main(int argc, char *argv[])
{
mtd_info_t mtd_info;
// the MTD structure
erase_info_t ei;
// the erase block structure
int m;
unsigned int rawBytes; //the bytes we want to write
if (argc != 2) {
printf("Usage: tp0set [0/1]\n");
return 1;
}
m = atoi(argv[1]); //convert
if( m == 1) {
rawBytes = 0x10000000;
printf("setting TP1 main
}
else if ( m == 0 ) {
rawBytes = 0x00000000;
printf("setting TP0 main
}
else {
printf("only 0 or 1
return 1;
}
argument to integer
core\n");
core\n");
allowed\n");
unsigned char read_buf[0x20000] = {0x00};
// empty array for reading
int fd = open("/dev/mtd0", O_RDWR); // open the mtd device for reading and
// writing. Note you want mtd0 not
mtdblock0
// also you probably need to open
permissions
/dev/mtd0)
ioctl(fd, MEMGETINFO, &mtd_info);
// to the dev (sudo chmod 777

// get the device info
// dump it for a sanity check, should match what's in /proc/mtd

printf("MTD Type: %x\nMTD total size: %x bytes\nMTD erase size: %x
bytes\n",
mtd_info.type, mtd_info.size, mtd_info.erasesize);
lseek(fd, 0, SEEK_SET);
// go to the first block
read(fd, read_buf, sizeof(read_buf)); // read and store CFE in read_buf
memcpy(read_buf + DATA_OFFSET, (unsigned char*)&rawBytes,
RAWBYTES_LEN); //write some bytes to CFE
ei.length = mtd_info.erasesize;
//set the erase block size
for(ei.start = 0; ei.start < mtd_info.size; ei.start += ei.length)
{
ioctl(fd, MEMUNLOCK, &ei);
printf("Eraseing Block %#x\n", ei.start); // show the blocks erasing
// warning, this might print
a lot!
ioctl(fd, MEMERASE, &ei);
}
printf("Writting to /dev/mtd0...\n"); //
lseek(fd, 0, SEEK_SET);
// go back to first block's start
write(fd, read_buf, sizeof(read_buf)); // write our modified CFE
close(fd);
printf("Done!!\n");
return 0;
}
Source code, only for compiling in the OpenWrt buildroot:

tp0set.tar.gz
The changes survives forever, no matter if we install a new firmware, even erasing totally the
previous firmware, since this setting is stored in CFE itself.
Note: You can't use the first core as the Main thread with the OEM firmware, it will cause
hardware failure when initializating VoIP hardware stuff.
Failsafe mode
generic.failsafe
Openwrt failsafe: Power on the router, press the button RESTART repeatedly to enter failsafe
mode (the power led starts blinking very fast)
CFE failsafe: This is for entering in the bootloader command line. Use a serial cable and press
any key while loading CFE.
Hardware
Info
HG556a A, B (HG55VDFA VER.C) HG556a C (HG56BZRB VER.A)
Instruction set: MIPS
Vendor:
Broadcom
Bootloader:
CFE
Board Id:
HW556
System-OnBCM6358KFBG
Chip:
CPU @Frq
BMIPS4350 V1.0 @300 Mhz BMIPS Dual Core
Macronix MX29GL128EH
Flash-Chip:
Macronix MX29LV128DB
MX29GL128EHT2I-90G
Spansion S29GL128P10
Flash size:
16 MiB
RAM:
HY5DU121622DTP-J / DDR-333
?
RAM size:
64 MiB
Ralink RT3062F 802.11b/g/n
Wireless:
Atheros AR9223 802.11b/g/n (onboard)
(onboard)
Antenna:
2x, onboard, non detachable
Switch:
Broadcom BCM5325E w/ vlan support swconfig
Internet:
ADSL2+, not supported in OpenWrt
VoIP:
Zarlink Le88266DLC drivers https://github.com/pgid69/bcm63xx-phone
1x2.0 SoC 2x2.0 SMSC HUB
1x2.0 SoC 2x2.0 Genesys HUB
USB2502-AEZG
GL850G
USB:
+ 1x 2.0 SoC
+ 1x 2.0 SoC
Power adapter: 12V DC 2A / APS24W-12V2A-EU
Serial:
Yes
JTAG:
Yes
Photos
Photo of front and back of the casing:
Opening the case

Note: This will void your warranty!
To remove the cover:
remove the screw hidden under the label at the back of the router
remove the router's foot
carefully separate both parts of the casing
Photo of PCB
HG556a A, B (HG55VDFA VER.C)
HG556a C (HG56BZRB VER.A)
Serial
port.serial general information about the serial port, serial port cable, etc.
Photo of PCB with markings
Versions A,B
This board version also has a second serial UART1 port available at GPIO29 (TXD1, see other
GPIOs), RXD1 is unknown or not available.
Version C
Use a serial TTL adapter to connect your PC with HG556a. With an USB adapter connect only
TX, RX and GND. With Cutecom (or other serial console software), open /dev/ttyUSB0 (you
must have right permissions).
Settings:
Baudrate: 115200
Data bits: 8
Parity: None
Stop bits: 1
JTAG
port.jtag general information about the JTAG port, JTAG cable, etc.
Photo of PCB with markings:
Versions A, B
10 pin header marked J400 (see back of board picture). Uses AVR JTAG layout. Broadcom CPU
recognised by TJTAG version 3.0.1
Version C
These pins are also accesible on the other side of the board: hg556a_c-jtag2.jpg
There are several utilities that support BCM6358 for flashing via JTAG cable. In our examples
we will use zJTAG (ver 1.8) with a WIGGLER buffered cable. It is also possible to use a
DLC5 unbuffered cable, but not longer than 15 cm.
A command to check if our CPU is recognized:
./zjtag -probeonly /window:1e000000 /nompi /BE /wiggler
A session of bootloader backup:

# ./zjtag -backup:custom /window:1e000000 /start:1e000000 /length:20000 /nompi
/wiggler /BE ============================================== zJTAG
EJTAG Debrick Utility v1.8 RC3
============================================== cable=wiggler,
cabletype=3 Detected IR chain length = 32 There are 1 device(s) in the JTAG chain
IDCODE for device 1 is 0x0635817F (IR length:1) Probing bus ... Done Defined IR
Length is 5 bits CPU assumed running under BIG endian CPU Chip ID:
00000110001101011000000101111111 (0x0635817F) *** Found a Broadcom
manufactured BCM6358 REV 01 CPU *** - EJTAG IMPCODE ....... :
00000000100000011000100100000100 (0x00818904) - EJTAG Version ....... : 1 or 2.0 EJTAG DMA Support ... : Yes - EJTAG Implementation flags: R4k MIPS16 MIPS32
Issuing Processor / Peripheral Reset ... Done Enabling Memory Writes ... Done Halting
Processor ... <Processor did NOT enter Debug Mode!> ... Done Clearing Watchdog ...
Done Loading CPU Configuration Code ... Skipped Probing Flash at Address:
0x1E000000 ... Detected Chip ID (VenID:DevID = C27E : 2101) *** Found a CFI
Compatiable Flash Chip from Macronix - Flash Chip Window Start .... : 1E000000 Flash Chip Window Length ... : 01000000 - Selected Area Start ........ : 1E000000 Selected Area Length ....... : 00020000 *** You Selected to Backup the CUSTOM.BIN
*** ========================= Backup Routine Started
========================= Saving CUSTOM.BIN.SAVED_20150207_145734 to
Disk... Done (CUSTOM.BIN.SAVED_20150207_145734 saved to Disk OK) bytes
written: 131072 ========================= Backup Routine Complete
========================= elapsed time: 35 seconds *** REQUESTED
OPERATION IS COMPLETE ***
A session of restoring CFE

# ./zjtag -flash:custom /window:1e000000 /start:1e000000 /length:20000 /wiggler /BE
============================================== zJTAG EJTAG Debrick
Utility v1.8 RC3 ==============================================
cable=wiggler, cabletype=3 Detected IR chain length = 32 There are 1 device(s) in the
JTAG chain IDCODE for device 1 is 0x0635817F (IR length:1) Probing bus ... Done
Defined IR Length is 5 bits CPU assumed running under BIG endian CPU Chip ID:
00000110001101011000000101111111 (0x0635817F) *** Found a Broadcom
manufactured BCM6358 REV 01 CPU *** - EJTAG IMPCODE ....... :
00000000100000011000100100000100 (0x00818904) - EJTAG Version ....... : 1 or 2.0 EJTAG DMA Support ... : Yes - EJTAG Implementation flags: R4k MIPS16 MIPS32
Issuing Processor / Peripheral Reset ... Done Enabling Memory Writes ... Done Halting
Processor ... <Processor Entered Debug Mode!> ... Done Clearing Watchdog ... Done
Loading CPU Configuration Code ... Skipped Detecting Flash Base Address... Read MPI
register value : 1E00000C MPI register show Flash Access Base Addr : 1E000000
Probing Flash at Address: 0x1E000000 ... Detected Chip ID (VenID:DevID = C27E :
2101) *** Found a CFI Compatiable Flash Chip from Macronix - Flash Chip Window
Start .... : 1E000000 - Flash Chip Window Length ... : 01000000 - Selected Area
Start ........ : 1E000000 - Selected Area Length ....... : 00020000 *** You Selected to Flash
the CUSTOM.BIN *** ========================= Flashing Routine Started
========================= Total Blocks to Erase: 1 Erasing block: 1 (addr =
1E000000)...Done Loading CUSTOM.BIN to Flash Memory... Done (CUSTOM.BIN
loaded into Flash Memory OK) ========================= Flashing Routine
Complete ========================= elapsed time: 174 seconds ***
REQUESTED OPERATION IS COMPLETE ***
Backup the whole flash: ./zjtag -backup:custom /window:1e000000
Backup the calibration data: ./zjtag -backup:custom /window:1e000000
/start:1e000000 /length:1000000 /wiggler /BE
/start:1EEFE000 /length:2000 /wiggler /BE

or for the flash chip MX29LV128DB: ./zjtag -backup:custom
/window:1e000000 /start:1EF7E000 /length:2000 /wiggler /BE
It's also possible to use UrJTAG. It's faster compared with HairyDairymaid based software.
Sometimes it fails to enter debug mode, but after several attempts, once entered debug mode, it
works totally ok. Probably deleting the bootloader before using UrJTAG would help to enter
debug mode. Using the nTRST pin would also help to enter debug mode.
The following is a session of flashing the bootloader using UrJTAG, it only took one
minute included the verification:
# jtag UrJTAG 0.10 #2051 Copyright (C) 2002, 2003 ETC s.r.o. Copyright (C) 2007,
2008, 2009 Kolja Waschk and the respective authors UrJTAG is free software, covered
by the GNU General Public License, and you are welcome to change it and/or distribute
copies of it under certain conditions. There is absolutely no warranty for UrJTAG.
warning: UrJTAG may damage your hardware! Type "quit" to exit, "help" for help. jtag>
cable wiggler ppdev /dev/parport0 Initializing ppdev port /dev/parport0 jtag> detect IR
length: 5 Chain length: 1 Device Id: 00000110001101011000000101111111
(0x0635817F) Manufacturer: Broadcom (0x17F) Part(0): BCM6358 (0x6358) Stepping:
V1 Filename: /usr/share/urjtag/broadcom/bcm6358/bcm6358 jtag> endian big jtag>
initbus ejtag_dma ImpCode=00000110001101011000000101111111 EJTAG version: <=
2.0 EJTAG Implementation flags: R4k ASID_6 MIPS16 DMA MIPS64 Clear memory
protection bit in DCR Clear Watchdog Potential flash base address: [0x0], [0x1e00000c]
Processor successfully switched in debug mode. jtag> detectflash 0x1e000000 Query
identification string: Primary Algorithm Command Set and Control Interface ID Code:
0x0002 (AMD/Fujitsu Standard Command Set) Alternate Algorithm Command Set and
Control Interface ID Code: 0x0000 (null) Query system interface information: Vcc Logic
Supply Minimum Write/Erase or Write voltage: 2700 mV Vcc Logic Supply Maximum
Write/Erase or Write voltage: 3600 mV Vpp [Programming] Supply Minimum
Write/Erase voltage: 0 mV Vpp [Programming] Supply Maximum Write/Erase voltage: 0

mV Typical timeout per single byte/word program: 8 us Typical timeout for maximumsize multi-byte program: 64 us Typical timeout per individual block erase: 512 ms
Typical timeout for full chip erase: 524288 ms Maximum timeout for byte/word program:
64 us Maximum timeout for multi-byte program: 2048 us Maximum timeout per
individual block erase: 4096 ms Maximum timeout for chip erase: 2097152 ms Device
geometry definition: Device Size: 16777216 B (16384 KiB, 16 MiB) Flash Device
Interface Code description: 0x0002 (x8/x16) Maximum number of bytes in multi-byte
program: 64 Number of Erase Block Regions within device: 1 Erase Block Region
Information: Region 0: Erase Block Size: 131072 B (128 KiB) Number of Erase Blocks:
128 Primary Vendor-Specific Extended Query: Major version number: 1 Minor version
number: 3 Address Sensitive Unlock: Required Process Technology: Bad value Erase
Suspend: Read/write Sector Protect: 1 sectors per group Sector Temporary Unprotect:
Supported Sector Protect/Unprotect Scheme: Bad value Simultaneous Operation: Not
supported Burst Mode Type: Supported Page Mode Type: 8 word Page ACC
(Acceleration) Supply Minimum: 9500 mV ACC (Acceleration) Supply Maximum:
10500 mV Top/Bottom Sector Flag: Uniform top boot device Program Suspend: Not
supported jtag> flashmem 0x1e000000 cfe6358-nvr.bin Chip: AMD Flash Manufacturer:
Macronix Chip: Unknown (ID 0x227e) Protected: 0000 program: flash_unlock_block
0x1E000000 IGNORE block 0 unlocked flash_erase_block 0x1E000000
flash_erase_block 0x1E000000 DONE erasing block 0: 0 addr: 0x1E00F6EA verify:
addr: 0x1E00F6EA Done. jtag>
GPIOs
Buttons
hardware.button
The HG556a has four buttons:
BUTTON label Event (OEM)
?
diagnostic
wifi on/off
RESTART
reboot
RESET
reset
Openwrt name
help
wlan
restart
reset
Openwrt code
KEY_HELP
KEY_WLAN
KEY_RESTART
KEY_CONFIG
GPIO (A, B)
8
9
10
11
GPIO (C)
36
9
10
11
Leds
System configuration: Leds
Label
description
message
GPIO (A, B)
0
GPIO (C)
12
Label
description
n/a
GPIO (A, B)
GPIO (C)
hspa
15
wifi
dsl
n/a
2
n/a
2
power
all
3
6
12
3
n/a
0
13
15
13
1
22
23
22
23
26
27
26
27
28
28
LAN1
LAN2
LAN3
LAN4
Other
PCB markings
location
hg556a_ab-gpios-extra.jpg
R427
R446
R906
R602
VIA-R415
hg556a_spi_le88266.jpg
Le88266
GPIO (A,B)
4
5
25
29
30
24
32
GPIOs 25 and 29 are unused. GPIO29 can be converted to TXD1, for a second serial UART port
after kernel patching http://pastebin.com/qcjGAfJZ. GPIOs 4 and 5 are used by the bootloader
to get the board model. For the GPIO30, we can safely cut the trace that goes to the memory
flash chip.
location
R446/R440
R476/R441
U400
R450
R906/R923/U900
R415
Le88266DLC/R433
R429/R939
R946/R430
GPIO (C)
4
5
6
7
25
30
32
34
37
SPI
Serial Peripheral Interface
The BCM6358 SoC has a SPI controller. The HG556a SPI pins are exposed on the board, at the
place for a Si3050 chip which isn't soldered. We can use this SPI interface for connecting our
own SPI stuff, but we need to build the kernel with the drivers and proper platform data code for
registering the SPI device. This is the pinout:
This SPI interface is also connected to the Le88266 VoiP chip, but using the Slave Select 2
(GPIO32): hg556a_spi_le88266.jpg le88286-pinout.png
Code example for spidev kernel module board support, the added code is highlighted in green:
static struct spi_board_info hw556_spi_info[] = {
{
.bus_num = 0,
.chip_select
= 1,
.mode
= 0,
.max_speed_hz
= 781000,
.modalias
= "spidev",
},
};
static struct board_info __initdata board_HW556_B = {
.name
= "HW556_B",
.expected_cpu_id
= 0x6358,
.has_uart0
.has_pci
.has_ohci0
.has_ehci0
.num_usbh_ports
= 1,
= 1,
= 1,
= 1,
= 2,
.has_caldata
.caldata = {
{
},
= 1,
.vendor
.caldata_offset
.slot
.endian_check
.led_pin
=
=
=
=
PCI_VENDOR_ID_ATHEROS,
0xefe000,
1,
1,
= 2,
},
.has_enet1
.enet1 = {
.has_phy
.phy_id
.force_speed_100
.force_duplex_full
},
= 1,
= 1,
= 1,
= 0,
= 1,
.spis = hw556_spi_info,
.num_spis = ARRAY_SIZE(hw556_spi_info),
};
The SPI controller is able to work with these speeds (kHz): 20000, 12500, 6250, 3125, 1563,
781(default), 391
Demo video connecting a SPI display, (781 kHz):
using 20 MHz:
Unfortunatelly the bcm63xx SPI driver is a bit broken. Some stuff might not work.
VoIP
The HG556a has two FXS ports for connecting a phone, allowing to use VoIP features. The
board has Le88266 VoiP chip, connected via SPI interface and using the Slave Select 2
(GPIO32), the RESET# pin is connected to the GPIO24.
Not officially supported, but some drivers are available (not tested):
https://github.com/pgid69/bcm63xx-phone
Relays
The board is equiped with two AXICOM IM02N relays. One of them is controlled via GPIO14.
AXICOM IM02N
Vdcnom = 4.5 V Vdcmin = 3.38 V Vdcmax = 10.8 V

Coil power =140 mW Coil resistance = 145 ohm
Switching power 60 W / 62.5 VA Switching
voltage 220 VDC / 250VAC Switching current 2
A Non-latching, Monostable
On the bottom side we can see clearer how these relays are wired
Debricking
generic.debrick
CFE Bootloader
1. you could read about bootloader in general
With a serial console we can get some interesting info
About the version and build:
CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE)
Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)
And about the possible boards compatible with this CFE:

CFE>
b
Press:
<enter> to use current value

'-' to go previous parameter
'.' to clear the current value
'x' to exit this command
Board Id Name (0-11)

HW6358GW_A
------- 0
HW6358GW_B
------- 1
HW550
------- 2
HW550_FXO
------- 3
HW553
------- 4
HW556
------- 5
HW556aV2
------- 6
96358VW2
------- 7
96358VW-16
------- 8
96358GW
------- 9
96358GW-16
------- 10
96358M
------- 11
Borked Board ID:

If you play with the CFE settings you may end with messed Board ID which OpenWrt doesn't
recognize, spite CFE itself is able to read it correctly
CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE) Build Date: Wed Nov 11 10:36:35
CST 2009 (Lihua_68693) Copyright (C) 2006 Huawei Technologies Co. Ltd. Boot Address
0xbe000000 Initializing Arena. Initializing Devices. @w45260: Flash Manufacture id :c2
@w45260Flash Device id :2201 @w45260flipCFIGeometry:1 Parallel flash device: name , id
0x2201, size 16384KB *** GetHG556aBoardVersion = <0> *** CPU type 0x2A010: 300MHz,
Bus: 133MHz, Ref: 64MHz Total memory: 67108864 bytes (64MB) Total memory used by CFE:
0x80401000 - 0x8052A510 (1217808) Initialized Data: 0x8041F3C0 - 0x80421B60 (10144)
BSS Area: 0x80421B60 - 0x80428510 (27056) Local Heap: 0x80428510 - 0x80528510

(1048576) Stack Area: 0x80528510 - 0x8052A510 (8192) Text (code) segment: 0x80401000 0x8041F3B4 (123828) Boot area (physical): 0x0052B000 - 0x0056B000 Relocation Factor:
I:00000000 - D:00000000 *** GetHG556aBoardVersion = <0> *** Board IP address :
192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f
Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot
delay (0-9 seconds) : 1 Board Id Name : HW556 Psi size in KB : 64 Number of MAC Addresses
(1-32) : 14 Base MAC Address : 64:16:f0:dd:f1:fa Ethernet PHY Type : Internal Memory size in
MB : 64 CMT Thread Number : 1 *** Press any key to stop auto run (1 seconds) *** Auto run
second count down: 1\0x081\0x080 boot kernel from be020100 Code Address: 0x80010000,
Entry Address: 0x80010000 Decompression OK! Entry at 0x80010000 Closing network. Starting
program at 0x80010000 [ 0.000000] Linux version 3.3.8 (dani@tool) (gcc version 4.6.3
20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #2 Mon Feb 9 16:10:39 CET 2015
[ 0.000000] Detected Broadcom 0x6358 CPU revision a1 [ 0.000000] CPU frequency is 300
MHz [ 0.000000] 64MB of RAM installed [ 0.000000] registering 40 GPIOs [ 0.000000]
gpiochip_add: registered GPIOs 0 to 39 on device: bcm63xx-gpio [ 0.000000] board_bcm963xx:
Resetting USB PLL... done [ 0.000000] board_bcm963xx: Boot address 0xbe000000 [ 0.000000]
board_bcm963xx: CFE version: 100.48.56-49.46 [ 0.000000] board_bcm963xx: unknown
bcm963xx board: HW556_CW_B [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU
revision is: 0002a010 (Broadcom BMIPS4350) [ 0.000000] Kernel panic - not syncing: unable to
detect bcm963xx board
To solve it, enter in the CFE command line and first change the board ID to 96358GW, then
reboot and change it again to HW556.
see https://dev.openwrt.org/ticket/14063
Hardware mods
as a beginner, you really should inform yourself about soldering in general and then obtain
some practical experience!
External antenna mod

On the HG55VDFA VER.C board there are two antennas. One is an Airgain A2430GN antenna
(6dbi peak gain), the other is a crappy PCB antenna commonly used by manufacturers to save
costs.
For this mod the PCB antenna is invalidated by cutting the signal trace on the board. Then just
solder the pigtail cable with the signal wire before the cut, and the shield to any point near the
small connector, or on the connector itself.
Buzzer mod
In this mod we will add an active buzzer (DC buzzer) to the router. We will use this simple
circuit
The buzzer will be soldered to a LED on the board, this way we can control both at the same
time.
Components:
Active buzzer, AKA DC buzzer.
1 kohm resistor
1 PNP transistor (2N3906 or other)
Solder the components on the board following the previous schematic:
Now configure the LED where the buzzer was soldered. Or use /sys/class/leds interface.
Example:
Install the morse led trigger:
opkg update opkg install kmod-ledtrig-morse
Send an SOS to the world

echo morse > /sys/class/leds/HW556:green:lan4/trigger
echo "SOS" > /sys/class/leds/HW556:green:lan4/message
more details at buzzer-mod
Firmware mods
Backports
Backfire backport (10.03.1). Only HG55VDFA VER.C boards:

hg556a_ath_backport_10.03.1.zip
Attitude Adjustment backport (12.09):

hg556a_backport_12.09.zip
BOOTLOGS
OEM bootlog
192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f
(1-32) : 14 Base MAC Address : 5c:4c:a9:6e:4a:a2 Ethernet PHY Type : Internal Memory size in
second count down: 110 boot kernel from be9b2100 Code Address: 0x80010000, Entry Address:
0x8022a018 Decompression OK! Entry at 0x8022a018 Closing network. Starting program at
0x8022a018 Linux version 2.6.8.1 (root@IBM_x346) (gcc version 3.4.2) #2 Wed Jun 9 14:58:23
CST 2010 @w45260: Flash Manufacture id :c2 @w45260Flash Device id :2201

@w45260flipCFIGeometry:1 Parallel flash device: name , id 0x2201, size 16384KB Total Flash
size: 16384K with 128 sectors Board id is set HW556, ucHardwareType 0
fInfo.flash_wlanparam_start_blk = 119 fInfo.flash_wlanparam_number_blk = 1
fInfo.flash_wlanparam_length = 0x2000 fInfo.flash_wlanparam_blk_offset = 0x1e000 HW556
prom init CPU revision is: 0002a010 Determined physical RAM map: memory: 03f91920 @
00000000 (usable) On node 0 totalpages: 16273 DMA zone: 16273 pages, LIFO batch:3 Normal
zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel
command line: root=31:0 ro noinitrd brcm mips: enabling icache and dcache... Primary
instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 16kB 2way, linesize 16 bytes. PID hash table entries: 256 (order 8: 2048 bytes) Using 150.000 MHz
high precision timer. Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache
hash table entries: 8192 (order: 3, 32768 bytes) Allocating memory for DSP module core and
initialization code Allocated DSP module memory - CORE=0x81099cc0 SIZE=732896,
INIT=0x0 SIZE=0 Memory: 61212k/65092k available (1828k kernel code, 3816k reserved, 319k
data, 76k init, 0k highmem) Calibrating delay loop... 299.00 BogoMIPS Mount-cache hash table
entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... unavailable. softirq policy:0
softirq nice:0, prio:120 NET: Registered protocol family 16 Can't analyze prologue code at
801d7a94 SCSI subsystem initialized usbcore: registered new driver usbfs usbcore: registered
new driver hub NTFS driver 2.1.15 [Flags: R/O]. Initializing Cryptographic API PPP generic
driver version 2.4.2 NET: Registered protocol family 24 Using noop io scheduler bcm963xx_mtd
driver v1.0 PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) ehci_hcd 0000:00:0a.0: EHCI
Host Controller PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0:
irq 18, pci mem c0000300 ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number
1 PCI: cache line size of 32 is not supported by device 0000:00:0a.0 ehci_hcd 0000:00:0a.0:
USB f.f enabled, EHCI 1.00, driver 2004-May-10 hub 1-0:1.0: USB hub found hub 1-0:1.0: 2
ports detected ohci_hcd: 2004 Feb 02 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI)
ohci_hcd: block sizes: ed 64 td 64 PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ohci_hcd
0000:00:09.0: OHCI Host Controller PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: irq 13, pci mem c0002400 ohci_hcd 0000:00:09.0: new USB bus
registered, assigned bus number 2 hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected
usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class
driver Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB
Mass Storage support registered. drivers/usb/serial/usb-serial.c: USB Serial support registered
for Generic usbcore: registered new driver usbserial_generic usbcore: registered new driver
usbserial drivers/usb/serial/usb-serial.c: USB Serial Driver core v2.0 brcmboard:
brcm_board_init entry SES: Button GPIO 0x8009 is enabled SES: LED GPIO 0x8009 is enabled
@@Board@@ GetHarewareType = 0x0 bcm963xx_serial driver v2.0 u32 classifier NET:
Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash
tables configured (established 4096 bind 8192) Initializing IPsec netlink socket NET: Registered
protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15
Ebtables v2.0 registered NET: Registered protocol family 8 NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David
S. Miller <davem@redhat.com> cfi_flash_sched_init!!! VFS: Mounted root (squashfs
filesystem) readonly. Freeing unused kernel memory: 76k freed usb 1-1: new high speed USB
device using address 2 hub 1-1:1.0: USB hub found hub 1-1:1.0: 2 ports detected init started:
BusyBox v1.00 (2010.06.09-07:05+0000) multi-call binary Algorithmics/MIPS FPU Emulator

v1.5 BusyBox v1.00 (2010.06.09-07:05+0000) Built-in shell (msh) Enter 'help' for a list of builtin commands. Loading drivers and kernel modules... fuse init (API version 7.8) fuse distribution
version: 2.7.3 atmapi: module license 'Proprietary' taints kernel. blaadd: blaa_detect entry adsl:
adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6358A1 Ethernet
Network Device v0.3 Jul 14 2010 19:38:55 Config Ethernet Switch Through MDIO Pseudo PHY
Interface dgasp: kerSysRegisterDyingGaspHandler: eth0 registered eth0: MAC Address:
5C:4C:A9:6E:4A:A2 DSP Driver: DSP init stub Endpoint: endpoint_init entry BOS: Enter
bosInit Enter bosAppInit Exit bosAppInit BOS: Exit bosInit Endpoint: GetHarewareType <0>
Endpoint: endpoint_init COMPLETED drivers/usb/serial/usb-serial.c: USB Serial support
registered for option1 usbcore: registered new driver option drivers/usb/serial/option.c: USB
Driver for GSM modems: v0.7.1 147 eth0 Link UP. ip is 192.168.0.1mask is 255.255.255.0,
ipbegin is 192.168.0.192, ipend is 192.168.0.254 ===7163=attrvalue is 2 set to 104
===7163=attrvalue is 2 set to 104 xmlGetDhcpHostNameNode(appName dhcphostname,
objName Entry, attrName option12, attrValue Huawei-HG556a
==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492==
xmlEndIgmpProxyNode(calling cfm to get appName igmpproxy, objName proxy_node)
==IpExt:psixml.cpp:xmlGetPppAttr:14204:mac is == value is 0 BcmDb_setSecEnblCfg
:fw_enable 0, inflt 0, outflt 0, macflt 0, macmngr 0, nat_enable 1 ===7163=attrvalue is 2 set to
104 ===7163=attrvalue is 2 set to 104 xmlGetDhcpHostNameNode(appName dhcphostname,
objName Entry, attrName option12, attrValue Huawei-HG556a
xmlEndIgmpProxyNode(calling cfm to get appName igmpproxy, objName proxy_node)
==IpExt:psixml.cpp:xmlGetPppAttr:14204:mac is == value is 0
BcmAdsl_Initialize=0xC0066438, g_pFnNotifyCallback=0xC007F3F4
AnnexCParam=0x7FFF7EA8 AnnexAParam=0x00003987 adsl2=0x00000003
pSdramPHY=0xA3FFFFF8, 0x150EA5 0xDEADBEEF AdslCoreHwReset: AdslOemDataAddr
= 0xA3FFBB64 AnnexCParam=0x7FFF7EA8 AnnexAParam=0x00003987 adsl2=0x00000003
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered atmapi: prioritize receive packets
ip_tables: (C) 2000-2002 Netfilter core team ip_conntrack version 2.1 (508 buckets, 0 max) 368 bytes per conntrack ip_conntrack_pptp version 2.1 loaded ip_nat_pptp version 2.0 loaded
==> Bcm963xx Software Version: V100R001C10B050SP01 <== device eth0 entered
promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected,
propagating br0: port 1(eth0) entering forwarding state *******go there ,the pOption66 is
*******: *******go there the pOption67 is ********: *******go there the pOption160 is
*******: getopt returned char k setIndexName3 pvc2684d: Interface "nas_0_44" created
sucessfully setIndexName3 pvc2684d: Communicating over ATM 0.0.44, encapsulation: LLC
setIndexName3 pvc2684d: Interface "ipa_0_34" created sucessfully setIndexName3 pvc2684d:
Communicating over ATM 0.0.34, encapsulation: LLC Open file fail in Function:
BcmNtwk_initWandevice eth0 left promiscuous mode br0: port 1(eth0) entering disabled state
device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology
change detected, propagating br0: port 1(eth0) entering forwarding state in bcmmac_init acbuf is
null init syslog is end Sean@WLAN CHIP Vendor=<Atheros>, ProductId=<0xff1d> ath_hal:
0.9.14.25 (<7>AR5212<7>, AR5416<7>, RF5111<7>, RF5112<7>, RF2413<7>, RF5413<7>,
DEBUG<7>) ath_dfs: Version 2.0.0 Copyright (c) 2005-2006 Atheros Communications, Inc. All
Rights Reserved wlan: 0.8.4.2 (Atheros/multi-bss) ath_rate_atheros: Version 2.0.1 Copyright (c)
2001-2004 Atheros Communications, Inc, All Rights Reserved ath_pci: 0.9.4.5 (Atheros/multibss) ath_pci: CR-LSDK-1.3.1.71 PCI: Enabling device 0000:00:01.0 (0000 -> 0002) Chan Freq
RegPwr HT CTL CTL_U CTL_L DFS 1 2412n 20 HT20 1 0 1 N 1 2412n 20 HT40 1 0 1 N 2
2417n 20 HT40 1 0 1 N 3 2422n 20 HT40 1 1 1 N 4 2427n 20 HT40 1 1 1 N 5 2432n 20 HT40 1
1 1 N 6 2437n 20 HT40 1 1 1 N 7 2442n 20 HT40 1 1 1 N 8 2447n 20 HT40 1 1 1 N 9 2452n 20
HT40 1 1 1 N 10 2457n 20 HT40 1 1 1 N 11 2462n 20 HT40 1 1 1 N 12 2467n 20 HT40 1 1 0 N
13 2472n 20 HT40 1 1 0 N dfs_init_radar_filters: dfs->dfs_rinfo.rn_numradars: 0 DFS min filter
rssiThresh = 21 DFS max pulse dur = 131 ticks wifi0: 11ng rates: 1Mbps 2Mbps 5.5Mbps
11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps wifi0: 11ng MCS:
0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 wifi0: mac 47.2 phy 13.0<7> radio 12.0<7> wifi0: Use hw
queue 1 for WME_AC_BE traffic wifi0: Use hw queue 0 for WME_AC_BK traffic wifi0: Use
hw queue 2 for WME_AC_VI traffic wifi0: Use hw queue 3 for WME_AC_VO traffic wifi0:
Use hw queue 8 for CAB traffic wifi0: Use hw queue 9 for beacons wifi0: Use hw queue 7 for
UAPSD wifi0: Atheros 5416 Owl emulation: mem=0x10000000, irq=39 hw_base=0xb0000000
wlan: mac acl policy registered WlanSetupAll start killall: hostapd: no process killed
SIOCGIFFLAGS: No such device wlanconfig: ioctl: No such device wlNBwCap[1]wlNCtrlsb[1] Set WLAN Radio = 1
==DEBUG==Atheros_SetupOneVAP,4427==bWpaPskMode:1,m_wlMssidVar[AthIndex].wlWe
p:disabled. 2xMaxPowerLevel: 30 (LEG) 2xMaxPowerLevel: 28 (LEG) ath0 Setting Max
Stations:33 2xMaxPowerLevel: 28 (LEG) 2xMaxPowerLevel: 28 (LEG) ath_newstate: Resetting
VAP dfswait_run 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags
10080, PF 0 device ath0 entered promiscuous mode br0: port 2(ath0) entering learning state br0:
topology change detected, propagating br0: port 2(ath0) entering forwarding state
2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 30080, PF 0
2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2422, Flags 30082, PF 0 br0:
port 2(ath0) entering disabled state Send SIG(1) to pid 402 on eth down 2xMaxPowerLevel: 28
(LEG) ath_newstate: Resetting VAP dfswait_run br0: port 2(ath0) entering learning state
2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 10080, PF 0 br0:
topology change detected, propagating br0: port 2(ath0) entering forwarding state
E+E+E+E+E+hostapd is running. 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to
channel 2412, Flags 30080, PF 0 register normal. SIP: can't Retrieve psi object 11 in app Voice
when DialPlan table size loading, errno 3 SIP: can't Retrieve psi object 13 in app Voice when
CallForward table size loading, errno 3 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to
channel 2417, Flags 30082, PF 0 iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?) 2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2422, Flags 30082, PF 0 original call init_spanish_mib
iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching
rule exist in that chain?) 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2427,
Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2432, Flags
30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2437, Flags
30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2442, Flags
30082, PF 0 BOS: Enter bosInit bosTimerInit 2xMaxPowerLevel: 28 (LEG) ath_chan_set:
Changing to channel 2447, Flags 30082, PF 0 Enter bosAppInit Exit bosAppInit BOS: Exit
bosInit 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2452, Flags 30082, PF

0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2457, Flags 30082, PF 0
[DMM]:Endpoit(3) receives an error digitmap string!, file = Dmm.c, line = 2371 UNSPT ^
SipMsgThread MsgThread pid=605 ------------------------------------------------------------ at
946684845.994999 *** Received signal 18 on thread with PID 601
----------------------------------------------------------------------------------------------------------------------- at 946684846.059999 *** Received signal 18
on thread with PID 601 ----------------------------------------------------------------------------------------------------------------------- at 946684846.124999 *** Received signal 18
on thread with PID 601 ------------------------------------------------------------ 2xMaxPowerLevel:
28 (LEG) ath_chan_set: Changing to channel 2472, Flags 30082, PF 0
------------------------------------------------------------ at 946684846.199999 *** Received signal 18
on thread with PID 601 ------------------------------------------------------------ Process[voice] set
voip status to [1]Process[voice] set voip status to [0]<7>ath_newstate: Resetting VAP
dfswait_run 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags
10080, PF 0 kernel::endpoint_open kernel::endpoint_open COMPLETED PstnInit Success!
Created queue HDSP 00:00:46 CALLCLIENT: Initializing endpoints callSipClientMain
voipqosapi: sendto returned -1 sipConfig: sipzParamp=0x7fff7150 sipzParamp->regname= line
59 file hsip.c sipConfig: sipzParamp=0x7fff7150line 69 file hsip.c sipConfig:
&mgscb=0x1000e9f0line 82 file hsip.c 00:00:46 CALLCLIENT: Initializing endpoints 00:00:46
Endpoint will be initialized for country ESP (country code = 17) 00:00:46 Endpoint Event task
started with pid 628... 00:00:46 Endpoint Packet task started with pid 629 ... Enter bosStartApp
bosAppRootTask() - Is it morning already? Spawning app task (epoch #0)... bosAppRootTask() Is it morning already? Spawning app task (epoch #0)... Enter TaskCreate aoAP TaskCreate spawn new task aoAP Exit TaskCreate AppResetDetectionEnable() - Enabled reset detection.
Exit bosStartApp PLL init completed. PLL registers set to: PCM->pcm_pll_ctrl1 = 0x00020001
PCM->pcm_pll_ctrl2 = 0x0008492B PCM->pcm_pll_ctrl3 = 0x00001E1C Set up PCM registers
Channel 0 assigned to timeslot 0 Channel 1 assigned to timeslot 8 Channel 2 assigned to timeslot
1 Channel 3 assigned to timeslot 9 Channel 4 assigned to timeslot 2 Tx Desc (0xA29DE000):
chan 0, buf 0, sts 0xe000, len 1280, bufp 0x29f4000 Tx Desc (0xA29DE008): chan 0, buf 1, sts
0x7000, len 1280, bufp 0x29f4510 Rx Desc (0xA28FF000): chan 0, buf 0, sts 0x8000, len 1280,
bufp 0x36b7000 Rx Desc (0xA28FF008): chan 0, buf 1, sts 0x9000, len 1280, bufp 0x36b7510
initIudma: chan 0, descBase 0xa28ff000, descBaseIudma 0x28ff000 initIudma: chan 1, descBase
0xa29de000, descBaseIudma 0x29de000 PCM ENABLE INFO: DMA0 IRQ STATUS
0x00000000 PCM ENABLE INFO: DMA0 IRQ MASK 0x00000005 PCM ENABLE INFO:
DMA1 IRQ STATUS 0x00000000 PCM ENABLE INFO: DMA1 IRQ MASK 0x00000005
PCM ENABLE INFO: PCM IRQ MASK 0x00000003 PCM ENABLE INFO: PCM IRQ
PENDING 0x00000007 Enter TaskCreate CMT_EXCEPTION_IST TaskCreate - spawn new
task CMT_EXCEPTION_IST Exit TaskCreate regStatus (reg 12 sel 0) = 0x10008501 regStatus
(reg 12 sel 7) = 0x00000101 regCause (reg 13 sel 0) = 0x00000000 regCause (reg 13 sel 7) =
0x00808000 regCMT (reg 22 sel 0) = 0xe30e1006 regCMT (reg 22 sel 1) = 0xe8008003 Kicking
off secondary thread processor at entry point 0x81099D00... Secondary thread processor entry
point at 0x81099d00 Thread processor handshake. Secondary app initialized properly. Enter
TaskCreate HTSK TaskCreate - spawn new task HTSK Exit TaskCreate SUCCESS: Took
semaphore SUCCESS: Gave semaphore INFO: MSPI POLLING MODE INFO: IRQ MASK
0xa0020424 INFO: IRQ STATUS 0x400000 INFO: BLOCK ENABLES 0x3e0320 MSPI
INITIALIZED HG55VDFA DoControlRelayStatus: disconnect PSTN relay
#########slicLe88221CalDcDc=CH[0] Read data from Rev ID register: 0x04, 0xB3
@@@@@@@@@@@@SWcal=[0x1] ####normalChan0Cal: 0x08 normalChan1Cal: 0x08
DAA rstGpioPin=25, rlyGpioPin=14 DAA DBG: DAA read failed!!! DAA DBG: ISOCAP lock
count = 0 Si3050 SLAC Initialised, Line side device = Si: 3010 (0xf) System dev rev: 0xf, Line
dev rev: 0xf Line dev status: FDT:0x1, LCS: 0x1f DAA initialized with country code 17 Detect
FXO Chip Failed... Skip daa6358Si3050SetFlyMode due to Not Si3050 Detected. DAA Device
Init completed...[19:38:34] Initialized DAA driver functions at location 0xc0205968
boardHalInit6358: Initialization complete. boardHalInit completed Enter TaskCreate HRTBEAT
TaskCreate - spawn new task HRTBEAT Exit TaskCreate HEARTBEAT: Initialized!
g_iRtcpInterval = 3000 bosMsgQCreate: Created message queue VRGEVQ at address 0x6000c
Enter TaskCreate VRGEVPR TaskCreate - spawn new task VRGEVPR Exit TaskCreate Enter
TaskCreate HCAS TaskCreate - spawn new task HCAS Exit TaskCreate Enter TaskCreate
DMAW TaskCreate - spawn new task DMAW Exit TaskCreate *** gStartRxDesc[0] =
0xA28FF000 *** gBufferSizeBytes = 1280 *** gStartTxDesc[0] = 0xA29DE000
hal6358PcmInit 263 nextTxDesc = 0xA29DE000 hal6358PcmInit 263 nextTxDesc =
0xA29DE008 hal6358PcmInit 267 Ownership for TX desc not set. Use this buffer. PERF>IrqMask = 0xA0020424 PERF->IrqMask1 = 0x00800000 Default value for provItemId '226'
did not exist ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x50)
of type: 0x0 ENDPT: Setting T.38 error correction mode for vhd 80 to 0x104 ENDPT:
hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x51) of type: 0x0 ENDPT:
Setting T.38 error correction mode for vhd 81 to 0x104 ENDPT: hdspVhdOpen Secondary
Connection VHD success. DSP 0, VHD (0x52) of type: 0x0 ENDPT: Setting T.38 error
correction mode for vhd 82 to 0x104 ENDPT: hdspVhdOpen Secondary Connection VHD
success. DSP 0, VHD (0x53) of type: 0x0 ENDPT: Setting T.38 error correction mode for vhd 83
to 0x104 bosMsgQCreate: Created message queue PSTN_CTL_EVQ at address 0x6800d Enter
TaskCreate PSTN TaskCreate - spawn new task PSTN Exit TaskCreate pstnCtlInit successful
dgasp: kerSysRegisterDyingGaspHandler: endpoint registered @@DoVrgEndptInit
reInjecitonMode=<0x0>. 00:00:50 Enter vrgEndptCasTimeParamControl... minHookFlash = 80,
maxHookFlash = 250. ENDPT: EPTYPE_FXS ENDPT: hdspVhdOpen Line VHD success. DSP
0, VHD (0x54) of type: 0x7 Default value for provItemId '74' did not exist Default value for
provItemId '75' did not exist minHookFlash = 80. maxHookFlash = 250. Default value for
provItemId '217' did not exist Default value for provItemId '41' did not exist Default value for
provItemId '219' did not exist ENDPT: Initialization completed successfully for endpt 0 00:00:50
SIGNAL: endpt 0, cnx -1, evt 111 (TxGain), value 0 00:00:50 SIGNAL: endpt 0, cnx -1, evt 112
(RxGain), value 0 ENDPT: EPTYPE_FXS ENDPT: hdspVhdOpen Line VHD success. DSP 0,
VHD (0x55) of type: 0x7 Default value for provItemId '74' did not exist Default value for
provItemId '75' did not exist minHookFlash = 80. maxHookFlash = 250. Default value for
provItemId '219' did not exist ENDPT: Initialization completed successfully for endpt 1 00:00:51
SIGNAL: endpt 1, cnx -1, evt 111 (TxGain), value 0 00:00:51 SIGNAL: endpt 1, cnx -1, evt 112
(RxGain), value 0 ENDPT: EPTYPE_PSTN ENDPT: hdspVhdOpen PSTN VHD success. DSP
0, VHD (0x56) of type: 0x6 ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x57) of
type: 0x7 Default value for provItemId '74' did not exist Default value for provItemId '75' did not
exist minHookFlash = 80. maxHookFlash = 250. Default value for provItemId '217' did not exist
DAA driver * for chan 2 is c0244f90 Default value for provItemId '58' did not exist Default
value for provItemId '219' did not exist DAA driver * for chan 2 is c0244f90 DAA driver * for
chan 2 is c0244f90 DAA: Skip cmd[1] due to on the fly <0>,<0>... ENDPT: Initialization
completed successfully for endpt 2 00:00:51 RTP read thread started with pid 639 00:00:51 RTP
read thread started with pid 640 00:00:51 RTP read thread started with pid 641 00:00:51 RTP
read thread started with pid 642 00:00:51 RTCP thread started with pid 643 00:00:51 rtpInit:
RTCP task created, taskId = 14351 00:00:51 ccPstnInit: Init PSTN module with dial-plan =
00:00:51 gwPstnSignal: signal-67, action-0x1, value--1 ENDPT: Enable PSTN EC. ENDPT:
ECAN Enabled for endpt 2 00:00:51 gwPstnSignal (call setup): value = 00:00:51 gwPstnSignal:
signal-63, action-0x554890, value--1 vrgEndptSignal (EPSIG_PSTNCALLSETUP) 00:00:51
gwPstnSignal: signal-66, action-0x1, value--1 CMTD_CTL: Using default settings CMTD_CTL:
setFilterCoeff: filtSize79 Seized PSTN line 2 ConnectSB: connecting line2 and line0 DAA: Skip
cmd[2] due to on the fly <0>,<0>... 00:00:51 gwPstnSignal: signal-68, action-0x1, value--1
ENDPT: Disable PSTN EC. ENDPT: ECAN disabled for endpt 2 00:00:51 gwPstnSignal: signal65, action-0x1, value--1 Released PSTN line 2 DisconnectSB: disconnecting line0 and line2
DAA: Skip cmd[0] due to on the fly <0>,<0>... 00:00:51 CALLCLIENT: Initialization complete
callSipClientMain 00:00:51 ccPublishSipEventCB: event 0 PSTN_CTL: cmtdCtlConfigFilter
success vhd=0x56 Enter TaskCreate TM56 TaskCreate - spawn new task TM56 Exit TaskCreate
PSTN_CTL: timerTaskMain timer task started, timeout = 5000 Get Resource file size = [779725]
@@@@Voice@@@FXO Chip Dectected result = <0>. 00:00:53 ====== HSPA voice Read
Thread start ====== ======start No voice process 10 times===== mkdir: Cannot create
directory `/var/mnt/USBDisk_1/twonkymedia.db': No such file or directory
DLNA:syscall.c:startDlna:5682:twonkymedia.db can't be created![10]
initDeviceAssociation(entry): BcmCfm_ManageableDeviceTbl 0 initDeviceAssociation(): fopen
/var/udhcpd/manageable.device failed): return error kill: Could not kill pid '65535': No such
process Scratch pad is not initialized. Enter TaskEnterShutdown (task=TM56) Exit
TaskEnterShutdown (task=TM56) Enter bosTaskDestoryR, taskId = 82a38928 PSTN_CTL:
cmtdCtlDisable success vhd=0x56 PstnEventCallback: PSTN_CTL_EVT_CPTONE_TIMEOUT
No scratch pad found. Initialize scratch pad... telnet function started!
==DHCPD:files.c:write_dnsconf:498:==
==DHCPD:files.c:write_dnsconf:523:BUF[address=/#/192.168.0.1 ]== Can't get dns's pid URL
Filer: open rule file failed! ==DNS:option.c:read_opts:2064:conffile is /var/dnsmasq.conf==
==DNS:option.c:one_file:1870file is /var/dnsmasq.conf:== ==DNS:option.c:one_opt:968:arg
is /#/192.168.0.1== BcmWL_createAutoCfgSwTsk Called... BcmWL_createAutoCfgSwTsk
Success[1026]... Sean@WLAN CHIP Vendor=<Atheros>, ProductId=<0xff1d>
==HTTPD:httpd.c:webmain:2996:ATHEROS:VHG==
==MTU:ifcuiweb.cpp:BcmWeb_getWanConInfo:1350:1492,1492,== NTWK_INTF
wanObjIndex=2, attachToIndex=1 IFC_ATM_VCC =255/65535 NTWK_INTF wanObjIndex=3,
attachToIndex=2 IFC_ATM_VCC =0/44 NTWK_INTF wanObjIndex=4, attachToIndex=3
IFC_ATM_VCC =0/34 Flash Write confliction, wait... Flash Write confliction, wait...
<TR064>Line:150=====start up mac=5c:4c:a9:6e:4a:a2 <TR064>Line:153=====syspwd=VFEShg556 Flash Write confliction, wait... Flash Write confliction, wait... NTWK_INTF
wanObjIndex=5, attachToIndex=4 IFC_ATM_VCC =0/33 Flash Write confliction, wait... Flash
Write confliction, wait... language option, user:es_ES admin:en_US IFC_ATM_VCC

=255/65535 IFC_ATM_VCC =0/44 IFC_ATM_VCC =0/34 IFC_ATM_VCC =0/33 SSDP server
socket OK! Found INET Found INET Device=br0 nmbd: not found Init port is 80
bcmIsDataPvc: ppp_255_65535_1 data ifc Cwmp initing... paraattribute name is HG553VF
bcmIsDataPvc: nas_0_44 data ifc(Data) PPP@WLAN CHIP Vendor=<Atheros>,
ProductId=<0xff1d> Voice channel Query
[CwmpReadLoadInfoFromFlash,230]=======acTmp:
========
[CwmpReadLoadInfoFromFlash,245]=======pulErrCode:0,pcCmdkey:========
==DEBUG==BcmSipRegisterQuery
7426==stsOld:0,stsHspa:0,iHspaDomain:0,usVoiceChannel:1,iSipChannel:0,iVoiceRegister:0,gl
bAdslRegState:0,glbHspaRegState:0 sDeviceCount is 0 sSimExist is -1 Voice channel Query
==DEBUG==BcmSipRegisterQuery
7426==stsOld:0,stsHspa:0,iHspaDomain:0,usVoiceChannel:1,iSipChannel:0,iVoiceRegister:0,gl
bAdslRegState:0,glbHspaRegState:0 sDeviceCount is 0 sSimExist is -1 sigWanDownProcess
cDataMode is 0 AdslCoreEcUpdTmr: timeMs=1800225 ecUpdMask=0x40000
Openwrt bootlog
192.168.1.1 Host IP address : 192.168.1.35 Gateway IP address : Run from flash/host (f/h) : h
(1-32) : 14 Base MAC Address : 5c:4c:a9:6e:4a:a2 Ethernet PHY Type : Internal Memory size in
second count down: 110 0x80010000/2739096 0x802acb98/159768 Entry at 0x8021e9f0 Closing
network. Starting program at 0x8021e9f0 [ 0.000000] Linux version 2.6.39.4 (dani@tool) (gcc
version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #22 Sat Dec 31 02:13:30 CET
2011 [ 0.000000] Detected Broadcom 0x6358 CPU revision a1 [ 0.000000] CPU frequency is
300 MHz [ 0.000000] 64MB of RAM installed [ 0.000000] registering 40 GPIOs [ 0.000000]
board_bcm963xx: Boot address 0xbe000000 [ 0.000000] board_bcm963xx: CFE version:
100.48.56-49.46 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is:
0002a010 (Broadcom BMIPS4350) [ 0.000000] board_bcm963xx: board name: HW556
[ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000

(usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges:
[ 0.000000] Normal 0x00000000 -> 0x00004000 [ 0.000000] Movable zone start PFN for each
node [ 0.000000] early_node_map[1] active PFN ranges [ 0.000000] 0: 0x00000000 ->
0x00004000 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages:
16256 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2
noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inodecache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Primary instruction cache
16kB, VIPT, 2-way, linesize 16 bytes. [ 0.000000] Primary data cache 16kB, 2-way, VIPT, cache
aliases, linesize 16 bytes [ 0.000000] Memory: 62016k/65536k available (2144k kernel code,
3520k reserved, 369k data, 160k init, 0k highmem) [ 0.000000] NR_IRQS:128 [ 0.000000]
Calibrating delay loop... 299.26 BogoMIPS (lpj=598528) [ 0.036000] pid_max: default: 32768
minimum: 301 [ 0.040000] Mount-cache hash table entries: 512 [ 0.052000] NET: Registered
protocol family 16 [ 0.068000] changed ath9k regdomain to 0xff [ 0.072000] registering PCI
controller with io_map_base unset [ 0.084000] bio: create slab <bio-0> at 0 [ 0.092000] pci
0000:00:01.0: fixup device configuration [ 0.096000] pci-ath9k-fixup: Writing 0x0029168c to
register 0x6000 [ 0.100000] pci-ath9k-fixup: Writing 0x02800001 to register 0x6008 [ 0.104000]
pci-ath9k-fixup: Writing 0x2091168c to register 0x602c [ 0.108000] pci-ath9k-fixup: Writing
0x002a168c to register 0x5000 [ 0.112000] pci-ath9k-fixup: Writing 0x02800001 to register
0x5008 [ 0.116000] pci-ath9k-fixup: Writing 0x2091168c to register 0x502c [ 0.120000] pciath9k-fixup: Writing 0x05040cc0 to register 0x5064 [ 0.124000] pci-ath9k-fixup: Writing
0x00033811 to register 0x506c [ 0.128000] pci-ath9k-fixup: Writing 0x0040073b to register
0x4004 [ 0.132000] pci-ath9k-fixup: Writing 0x00000003 to register 0x4074 [ 0.136000] pciath9k-fixup: Writing 0x01c20000 to register 0x4000 [ 0.140000] pci-ath9k-fixup: Writing
0x00000044 to register 0x6034 [ 0.144000] pci-ath9k-fixup: Device vendor 0x168c, id 0x0029
[ 0.164000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x3000ffff] [ 0.168000] pci
0000:00:01.0: BAR 0: set to [mem 0x30000000-0x3000ffff] (PCI address [0x300000000x3000ffff]) [ 0.172000] Switching to clocksource MIPS [ 0.184000] NET: Registered protocol
family 2 [ 0.188000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.196000]
TCP established hash table entries: 2048 (order: 2, 16384 bytes) [ 0.204000] TCP bind hash table
entries: 2048 (order: 1, 8192 bytes) [ 0.212000] TCP: Hash tables configured (established 2048
bind 2048) [ 0.216000] TCP reno registered [ 0.220000] UDP hash table entries: 256 (order: 0,
4096 bytes) [ 0.228000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.236000]
NET: Registered protocol family 1 [ 0.240000] audit: initializing netlink socket (disabled)
[ 0.248000] type=2000 audit(0.248:1): initialized [ 0.256000] squashfs: version 4.0 (2009/01/31)
Phillip Lougher [ 0.260000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME)
(CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.272000] msgmni has been set to 121
[ 0.276000] io scheduler noop registered [ 0.280000] io scheduler deadline registered (default)
[ 0.288000] bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0100 (irq = 10) is a bcm63xx_uart
[ 0.296000] console [ttyS0] enabled, bootconsole disabled [ 0.296000] console [ttyS0] enabled,
bootconsole disabled [ 0.312000] bcm963xx-flash bcm963xx-flash.0: 0x02000000 at
0x1e000000 [ 0.316000] bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID
0x0000c2 Chip ID 0x00227e [ 0.328000] Amd/Fujitsu Extended Query Table at 0x0040
[ 0.332000] Amd/Fujitsu Extended Query version 1.3. [ 0.340000] Using buffer write method
[ 0.340000] Silicon revision: 10 [ 0.344000] Address sensitive unlock: Required [ 0.352000]
Erase Suspend: Read/write [ 0.356000] Block protection: 1 sectors per group [ 0.360000]
Temporary block unprotect: Not supported [ 0.364000] Block protect/unprotect scheme: 8
[ 0.368000] Number of simultaneous operations: 0 [ 0.376000] Burst mode: Not supported
[ 0.376000] Page mode: 8 word page [ 0.380000] Vpp Supply Minimum Program/Erase Voltage:
9.5 V [ 0.388000] Vpp Supply Maximum Program/Erase Voltage: 10.5 V [ 0.392000]
Top/Bottom Boot Block: Uniform, Top WP [ 0.400000] number of CFI chips: 1 [ 0.404000]
bcm963xx_flash: Read Signature value of CFE1CFE1 [ 0.408000] bcm963xx-flash bcm963xxflash.0: CFE bootloader detected [ 0.416000] bcm963xx_flash: CFE boot tag found with version
8 and board type HW556 [ 0.424000] bcm963xx_flash: Partition 0 is CFE offset 0 and length
20000 [ 0.428000] bcm963xx_flash: Partition 1 is kernel offset 20100 and length dff00
[ 0.436000] bcm963xx_flash: Partition 2 is rootfs offset 100000 and length d00000 [ 0.444000]
bcm963xx_flash: Partition 3 is ath_data offset e00000 and length 1e0000 [ 0.452000]
bcm963xx_flash: Partition 4 is nvram offset fe0000 and length 20000 [ 0.460000]
bcm963xx_flash: Partition 5 is linux offset 20000 and length de0000 [ 0.468000]
bcm963xx_flash: Spare partition is 340000 offset and length ac0000 [ 0.476000] Creating 6
MTD partitions on "bcm963xx": [ 0.480000] 0x000000000000-0x000000020000 : "CFE"
[ 0.488000] mtd: Giving out device 0 to CFE [ 0.492000] 0x000000020100-0x000000100000 :
"kernel" [ 0.500000] mtd: partition "kernel" must either start or end on erase block boundary or
be smaller than an erase block -- forcing read-only [ 0.512000] mtd: Giving out device 1 to
kernel [ 0.520000] 0x000000100000-0x000000e00000 : "rootfs" [ 0.528000] mtd: Giving out
device 2 to rootfs [ 0.532000] mtd: partition "rootfs" set to be root filesystem [ 0.540000] mtd:
partition "rootfs_data" created automatically, ofs=340000, len=AC0000 [ 0.548000]
0x000000340000-0x000000e00000 : "rootfs_data" [ 0.556000] mtd: Giving out device 3 to
rootfs_data [ 0.564000] 0x000000e00000-0x000000fe0000 : "ath_data" [ 0.568000] mtd: Giving
out device 4 to ath_data [ 0.576000] 0x000000fe0000-0x000001000000 : "nvram" [ 0.584000]
mtd: Giving out device 5 to nvram [ 0.588000] 0x000000020000-0x000000e00000 : "linux"
[ 0.596000] mtd: Giving out device 6 to linux [ 0.608000] bcm63xx-wdt bcm63xx-wdt.0: started,
timer margin: 30 sec [ 0.624000] TCP westwood registered [ 0.624000] NET: Registered
protocol family 17 [ 0.632000] 802.1Q VLAN Support v1.8 Ben Greear
<greearb@candelatech.com> [ 0.636000] All bugs added by David S. Miller
<davem@redhat.com> [ 0.648000] mtdblock_open [ 0.652000] ok ^@[ 0.660000] VFS:
Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.668000] Freeing unused kernel
memory: 160k freed awk: /proc/cpuinfo: No such file or directory [ 3.508000] roboswitch:
Probing device eth0: found a 5325! It's a 5350. [ 4.576000] There is already a switch registered
on the device 'eth0' - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular
preinit - [ 9.076000] mtdblock_open [ 9.080000] ok [ 9.088000] mtdblock_release [ 9.092000]
ok [ 9.172000] MTDSB: lookup_bdev() returned 0 [ 9.176000] MTDSB: New superblock for
device 3 ("rootfs_data") [ 9.224000] JFFS2 notice: (317) jffs2_build_xattr_subsystem: complete
building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 5 of xref (0 dead, 2 orphan)
found. [ 9.256000] MTD_open [ 9.256000] MTD_ioctl [ 9.260000] MTD_ioctl [ 9.260000]
MTD_close switching to jffs2 - init - ^@ Please press Enter to activate this console. [ 12.756000]
Compat-wireless backport release: compat-wireless-2011-11-29 [ 12.760000] Backport based on
wireless-testing.git master-2011-12-01 [ 12.984000] cfg80211: Calling CRDA to update world
regulatory domain [ 13.812000] cfg80211: World regulatory domain updated: [ 13.816000]
cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 13.824000]
cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 13.832000]
SCSI subsystem initialized [ 14.632000] There is already a switch registered on the device 'eth0'
[ 15.028000] usbcore: registered new interface driver usbfs [ 15.036000] usbcore: registered new
interface driver hub [ 15.048000] usbcore: registered new device driver usb [ 16.632000] PCI:
Enabling device 0000:00:01.0 (0000 -> 0002) [ 16.640000] board_bcm963xx: Setting device
platform data [ 16.652000] ath: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff [ 16.660000]
ath: random mac address will be used: 66:94:cc:56:b8:3c [ 16.680000] ieee80211 phy0: Atheros
AR9280 Rev:2 mem=0xc02e0000, irq=39 [ 16.692000] cfg80211: Calling CRDA for country: JP
[ 16.852000] cfg80211: Regulatory domain changed to country: JP [ 16.860000] cfg80211:
(start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 16.868000] cfg80211:
(2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm) [ 16.876000] cfg80211:
(5490000 KHz - 5710000 KHz @ 40000 KHz), (N/A, 2300 mBm) [ 16.996000] Button Hotplug
driver version 0.4.1 [ 17.972000] NTFS driver 2.1.30 [Flags: R/O MODULE]. [ 18.520000] PPP
generic driver version 2.4.2 [ 18.752000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 19.076000] NET: Registered protocol family 24 [ 19.324000] ehci_hcd: USB 2.0 'Enhanced'
Host Controller (EHCI) Driver [ 19.328000] bcm63xx_ehci bcm63xx_ehci.0: BCM63XX
integrated EHCI controller [ 19.336000] bcm63xx_ehci bcm63xx_ehci.0: new USB bus
registered, assigned bus number 1 [ 19.368000] bcm63xx_ehci bcm63xx_ehci.0: irq 18, io mem
0xfffe1300 [ 19.384000] bcm63xx_ehci bcm63xx_ehci.0: USB 2.0 started, EHCI 1.00,
overcurrent ignored [ 19.392000] hub 1-0:1.0: USB hub found [ 19.396000] hub 1-0:1.0: 2 ports
detected [ 19.712000] nf_conntrack version 0.5.0 (971 buckets, 3884 max) [ 19.832000] usb 1-1:
new high speed USB device number 2 using bcm63xx_ehci [ 20.220000] hub 1-1:1.0: USB hub
found [ 20.232000] hub 1-1:1.0: 2 ports detected [ 20.636000] ohci_hcd: USB 1.1 'Open' Host
Controller (OHCI) Driver [ 20.640000] bcm63xx_ohci bcm63xx_ohci.0: BCM63XX integrated
OHCI controller [ 20.648000] bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered,
assigned bus number 2 [ 20.656000] bcm63xx_ohci bcm63xx_ohci.0: irq 13, io mem 0xfffe1400
[ 20.724000] hub 2-0:1.0: USB hub found [ 20.728000] hub 2-0:1.0: 1 port detected [ 21.008000]
Initializing USB Mass Storage driver... [ 21.016000] usbcore: registered new interface driver
usb-storage [ 21.020000] USB Mass Storage support registered. [ 21.232000] input: gpio-buttons
as /devices/platform/gpio-buttons.0/input/input0 [ 23.260000] eth0: link forced UP - 100/full flow control off/off [ 23.692000] device eth0 entered promiscuous mode [ 23.780000] br-lan:
port 1(eth0) entering forwarding state [ 23.788000] br-lan: port 1(eth0) entering forwarding state
[ 27.972000] device wlan0 entered promiscuous mode [ 27.980000] br-lan: port 2(wlan0)
entering forwarding state [ 27.984000] br-lan: port 2(wlan0) entering forwarding state
[ 30.392000] device wlan0 left promiscuous mode [ 30.396000] br-lan: port 2(wlan0) entering
forwarding state [ 30.688000] device wlan0 entered promiscuous mode [ 30.692000] br-lan: port
2(wlan0) entering forwarding state [ 30.696000] br-lan: port 2(wlan0) entering forwarding state
BusyBox v1.19.3 (2011-12-25 13:56:35 CET) built-in shell (ash) Enter 'help' for a list of built-in
commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______||
__|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ATTITUDE
ADJUSTMENT (bleeding edge, r29606) ---------- * 1/4 oz Vodka Pour all ingredients into
mixing * 1/4 oz Gin tin with ice, strain into glass. * 1/4 oz Amaretto * 1/4 oz Triple sec * 1/4 oz
Peach schnapps * 1/4 oz Sour mix * 1 splash Cranberry juice
----------------------------------------------------- root@OpenWrt:/#
Notes
cal_data
In this table we can see the different geometry of flash chips:
GEOMETRY
Boot Block
region
sectors
erasesize
S29GL128P10 / MX29GL128EH
Uniform, Top WP
0
0 - 127
0x20000
MX29LV128DB
Bottom boot
0
1
0-7
8 - 262
0x2000
0x10000
The WIFI calibration data location (starts with 0xA55A) is displayed on bootup. . The fInfo.*
values appear to be embedded in the kernel
Boot log reports:
MX29GL128EH | S29GL128P10
...
Total Flash size: 16384K with 128 sectors
Board id is set HW556, ucHardwareType 0
fInfo.flash_wlanparam_start_blk = 119
fInfo.flash_wlanparam_number_blk = 1
fInfo.flash_wlanparam_length = 0x2000
fInfo.flash_wlanparam_blk_offset = 0x1e000
Based on the geometry in the above table let's calculate the offset:
119*0x20000+0x1e000 = 0xEFE000
If we make a backup of whole flash via JTAG we see it's exactly located at the offset 0xEFE000
MX29LV128DB
...
Total Flash size: 16384K with 263 sectors
Board id is set HW556, ucHardwareType 0
fInfo.flash_wlanparam_start_blk = 254
fInfo.flash_wlanparam_number_blk = 1
fInfo.flash_wlanparam_length = 0x2000
fInfo.flash_wlanparam_blk_offset = 0xe000
Based on the geometry in the above table let's calculate the offset again:
8*0x2000+(254-8)*0x10000+0xe000 = 0xF7E000
Tags
How to add tags
bcm63xx, bcm6358, FastEthernet, 4Port, hwVLAN, 3USB, 1WNIC, ath9k, 802.11bgn,
NonDetachableAntenna, 2Ant, 64RAM, 16Flash, MIPS, MIPS32, 4buttons, JTAG, Serial, SPI
toh/huawei/hg556a.txt Last modified: 2016/02/20 01:05 by danitool
Page Tools
Show pagesource
Old revisions
Backlinks
Back to top
Except where otherwise noted, content on this wiki is licensed under the following license: CC
Attribution-Noncommercial-Share Alike 3.0 Unported

HG556 A

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

HG556 A

Uploaded by

Copyright:

Available Formats

skip to content

OpenWrt Wiki Table of Hardware Huawei Huawei EchoLife HG556a

Get the firmware

o OEM installation using the TFTP method

LuCI Web Upgrade Process

Terminal Upgrade Process

CFE Upgrade Process

Cleaning old garbage

Huawei EchoLife HG556a

It comes in three versions A, B and C:

0x20000 = 128 KiB

OEM easy installation

Unplug the router's power cord

Press the button labeled as RESTART, don't release it yet!

Plug the power cord

Wait 12 seconds or more

Release the RESTART button

Browse to http://192.168.1.1 and you should see this screen:

Select .bin firmware

Press Update Software to start the firmware update process

Wait for it to reboot

Telnet / ssh to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if

OEM installation using the TFTP method

Start a TFTP server in your PC. Copy the openwrt-HW556-squashfs-cfe.bin firmware to

This is a session of flashing via TFTP:

Firmwares > 8MB size return an error about CRC check:

Finished loading 8388608 bytes Illegal image ! Image crc failed.

CFE web interface should be used in this case.

Browse to http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ LuCI Upgrade URL

Upload image file for sysupgrade to LuCI

Wait for reboot

Terminal Upgrade Process

Login as root via SSH on 192.168.1.1

Use the following commands to upgrade\\

CFE Upgrade Process

Basic configuration After flashing, proceed with this.

if your router has an Atheros wifi chip:

or, if your router version has a Ralink wifi chip

you may also want to install USB drivers

opkg install luci

Basic internet configuration

7. You may also need to disable the dhcp server

Switch Ports (for VLANs)

config switch eth0

then reboot the router.

This is what you will see in dmesg:

Before: [ 0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize

After: [ 0.000000] Primary instruction cache 32kB, VIPT, 2-way, linesize

Some people reported +1520% extra performance with this change.

unsigned char read_buf[0x20000] = {0x00};

// empty array for reading

// to the dev (sudo chmod 777

// dump it for a sanity check, should match what's in /proc/mtd

Source code, only for compiling in the OpenWrt buildroot:

Photo of front and back of the casing:

Opening the case

To remove the cover:

remove the router's foot

carefully separate both parts of the casing

HG556a A, B (HG55VDFA VER.C)

HG556a C (HG56BZRB VER.A)

A command to check if our CPU is recognized:

./zjtag -probeonly /window:1e000000 /nompi /BE /wiggler