BCM6358-based b/g/n router, (heavily) branded for/by Vodafone. 3 USB ports, one preconfigured for a 3G modem and others used for printer or hard disk sharing functionality. 2 phone connections. 1 ADSL port.

WARNING Before trying to run OpenWRT, do backup the flash, especially the bootloader and the ath_data area. The nvram data embedded in the bootloader and the WLAN calibration data in ath_data are specific for your device and difficult to restore otherwise. They cannot be restored by flashing back a vendor firmware. Running OpenWRT voids any guarantee and may brick your device! (See WAG160NV2 and soc.broadcom.bcm63xx)

Work in progress.

• →obtain.firmware
• →generic.flashing

→ basic.config

Model Number

Front:

Back:

Photo of back

Note: This will void your warranty!

• One screw, to be found under the centre of the WAN MAC barcode.
• Starting at the bottom, open the case following the red stripe.

Main PCB

Photo of PCB

→ port.Serial

The HG556 has a 5 pin header just under the antenna labeled J401.

From left to right the pins are:

/-----------------------------------\
| ANTENNA                           |
\-----------------------------------/

  /-----------------------------\
  | RX  | ??? | VCC | GND  | TX |
  \-----------------------------/

→ port.JTAG

10 pin header marked J400 (see back of board picture above)

Uses AVR JTAG layout

Broadcom CPU recognised by TJTAG version 3.0.1

MX29GL128E flash chip required the following line to be added to tjtag.c

{ 0x00C2, 0x227E, size16MB, CMD_TYPE_AMD,"MX29GL128E  U              (16MB)"
,128,size128K,  0,0,      0,0,        0,0        },

Note: YMMV, this router appears to come with a number of different flash chips.

The default network configuration is:

→ generic.failsafe

→hardware.button The HG556a has four buttons.

The location of the ath_data information (starts with 0xA55A) is displayed on bootup. The fInfo.* values appear to be embedded in the kernel

Boot log reports

...
Total Flash size: 16384K with 128 sectors
Board id is set HW556, ucHardwareType 0
fInfo.flash_wlanparam_start_blk = 119
fInfo.flash_wlanparam_number_blk = 1
fInfo.flash_wlanparam_length = 0x2000
fInfo.flash_wlanparam_blk_offset = 0x1e000

HW556 prom init
...