Huawei EchoLife HG556a

Supported since R35011.

The HG556A is an adsl wifi router mainly distributed by Vodafone to their customers.

:!: It's a good idea to backup the cal_data area at the flash-chip. The WLAN calibration data is specific for your device. If you wipe it accidentally it will be difficult to restore, it cannot be restored by flashing back a vendor firmware. About where the wifi calibration data is located in the flash chip see notes.

Supported Versions

Board model Wifi chip Vdf Version * Serial number (first 5 digits) Flash chip erasesize ** cal_data offset Supported Notes
HG55VDFA VER.C Atheros AR9223 HG556AVDFA 30462, 30608 0x10000 0xf7e000 Yes ADSL not supported
VoiP not supported
HG556BVDFA 30562, 30692, 30693, 31300, 30634 0x20000 0xefe000
HG56BZRB VER.A Ralink RT3062F HG556CVDFA 30695, 30694, 31301, 31507, 30555, 31525, 31935, 31901, 31902 0x20000 0xeffe00 Yes

*)You can check the version from the OEM firmware executing the command: hwversion show

**)You can check the flash memory chip erasesize with the command: cat /proc/mtd

  • 0x20000 = 128 KiB
  • 0x10000 = 64 KiB

Hardware Highlights

SoC Ram Flash Network USB Serial JTag
Broadcom 6358 64MiB 16MiB 4 x 1 Yes Yes Yes

Installation

Flash Layout

Please check out the article Flash Layout. It contains an example and a couple of explanations.

partition name filesystem description
mtd0 CFE n/a bootloader
n/a n/a n/a firmware tag
mtd1 kernel RAM executable kernel
mtd2 rootfs squashfs root
mtd3 rootfs_data jffs2 configuration, install new packages
mtd4 cal_data n/a wifi calibration data
mtd5 nvram n/a OEM configuration data
mtd6 linux n/a OpenWrt upgrade

OEM easy installation

This section deals with how you install OpenWrt from the device freshly opened.

Get the firmware

Version firmware link Notes
Trunk openwrt-HG556a_A-squashfs-cfe.bin
openwrt-HG556a_B-squashfs-cfe.bin
openwrt-HG556a_C-squashfs-cfe.bin
see supported versions
Barrier Braker openwrt-HW556-squashfs-cfe.bin all versions
Attitude Adjustment hg556a_backport_12.09.zip all versions, unofficial backport
Backfire hg556a_ath_backport_10.03.1.zip only VER.C boards, unofficial backport

Installation

  • Unplug the power cord
  • Press the button labeled as RESTART, don't release it yet!
  • Plug the power cord
  • Wait 10 seconds
  • Release the RESTART button
  • Upload .bin file to router
  • Upgrade the image
  • Wait for it to reboot
  • Telnet to 192.168.1.1 and set a root password, or browse to http://192.168.1.1 if LuCI is installed.

OEM installation using the TFTP method

  • Connect the serial TTL cable to send commands to CFE for loading the firmware via tftp.
  • Start a TFTP server in your PC. Copy the openwrt-HW556-squashfs-cfe.bin firmware to the server.
  • Set the IP at your pc to 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.

This is a session of flashing via TFTP:

CFE> f 192.168.1.35:openwrt-HW556-squashfs-cfe.bin Loading 192.168.1.35:openwrt-HW556-squashfs-cfe.bin ... Finished loading 2883588 bytes Flashing root file system and kernel at 0xbe020000: ~~~~~~~Flag: 3 baseAddr 0xbe000000 kernelAddr 0xbe020100 rootfsAddr 0xbe020100 tagFs 0x80800000 . . . . . . . . . . . . . . . . . . . . . . . Backup flag . ~~~~~~~Flag: 1 . *** Image flash done *** ! Resetting board...

Upgrading OpenWrt

generic.sysupgrade

If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

LuCI Web Upgrade Process

Terminal Upgrade Process

  • Login as root via SSH on 192.168.1.1
  • Use the following commands to upgrade.

cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-HW556-squashfs-cfe.bin
sysupgrade /tmp/openwrt-HW556-squashfs-cfe.bin

  • If sysupgrade does not support this router, use the following commands.

cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-HW556-squashfs-cfe.bin
mtd write /tmp/openwrt-HW556-squashfs-cfe.bin linux && reboot

CFE Upgrade Process

This is a clean and safe upgrade, using the booloader web interface. Just use the OEM installation procedure.

Cleaning old garbage

If after upgrading OpenWrt you get the message:
jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes 
And you can't save changes. Or you are unsure if old data is messing your new firmware. Enter OpenWrt failsafe mode if needed. Then execute this command:
mtd erase -r rootfs_data

Basic configuration

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

Specific Configuration

Interfaces

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi 192.168.1.1/24
eth0 LAN ports (1 to 4) bridged
wlan0 WiFi bridged (disabled)

Switch Ports (for VLANs)

This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 (LAN4) will be the Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on.

Port label Switch port Mode
LAN1 0 lan
LAN2 1 lan
LAN3 2 lan
LAN4 3 Internet (WAN)
n/a 5t to CPU

# path: /etc/config/network # LAN4 = WAN config interface loopback option ifname lo option proto static option ipaddr 127.0.0.1 option netmask 255.0.0.0 config interface lan option type bridge option ifname eth0.1 option proto static option ipaddr 192.168.1.1 option netmask 255.255.255.0 config interface wan option ifname eth0.2 option proto dhcp config switch eth0 option enable 1 option reset 1 option enable_vlan 1 config switch_vlan option device eth0 option vlan 1 option ports "0 1 2 5t" config switch_vlan option device eth0 option vlan 2 option ports "3 5t"

Failsafe mode

generic.failsafe

Openwrt failsafe: Power on the router, press the button RESTART repeatedly to enter failsafe mode (the power led starts blinking very fast)

CFE failsafe: This is for entering in the bootloader command line. Use a serial cable and press any key while loading CFE.

Buttons

hardware.button

The HG556a has four buttons.

BUTTON label Event (OEM) GPIO Openwrt name Openwrt code
? diagnostic 8 help KEY_HELP
((i)) wifi on/off 9 wlan KEY_WLAN
RESTART reboot 10 restart KEY_RESTART
RESET reset 11 reset KEY_CONFIG

Leds

System configuration: Leds

HG55VDFA VER.C
Label description GPIO
message 0
hspa 1
wifi n/a
dsl 2
power 3
n/a all 6
LAN1 12
13
LAN2 15
22
LAN3 23
26
LAN4 27
28
HG56BZRB VER.A
Label description GPIO
message 12
hspa 15
wifi n/a
dsl 2
power 3
LAN1 0
13
LAN2 1
22
LAN3 23
26
LAN4 27
28

Hardware

Info

HG55VDFA VER.C HG56BZRB VER.A
Instruction set: MIPS MIPS
Vendor: Broadcom Broadcom
Bootloader: CFE CFE
Board Id: HW556 HW556
System-On-Chip: BCM6358KFBG BCM6358KFBG
CPU @Frq BMIPS4350 V1.0 @300 Mhz BMIPS Dual Core BMIPS4350 V1.0 / 300 Mhz BMIPS Dual Core
Flash-Chip: Macronix MX29GL128EH
Macronix MX29LV128DB
Spansion S29GL128P10
MX29GL128EHT2I-90G
Flash size: 16 MiB 16 MiB
RAM: HY5DU121622DTP-J / DDR-333 ?
RAM size: 64 MiB 64 MiB
Wireless: Atheros AR9223 802.11b/g/n (onboard) Ralink RT3062F 802.11b/g/n (onboard)
Antenna: 2x, onboard, non detachable 2x, onboard, non detachable
Switch: Broadcom BCM5325E w/ vlan support swconfig Broadcom BCM5325E w/ vlan support swconfig
Internet: ADSL2+ ADSL2+
VoIP: Zarlink Le88266DLC Zarlink Le88266DLC
USB: 1x2.0 SoC → 2x2.0 SMSC HUB USB2502-AEZG 1x2.0 SoC → 2x2.0 Genesys HUB GL850G
+ 1x 2.0 SoC + 1x 2.0 SoC
Power adapter: 12V DC 2A / APS24W-12V2A-EU 12V DC 2A / APS24W-12V2A-EU
Serial: Yes Yes
JTAG: Yes ?

Photos

Photo of front and back of the casing:

Opening the case

Note: This will void your warranty!

  • To remove the cover:
remove the screw hidden under the label at the back of the router
remove the router's foot
carefully separate both parts of the casing

Photo of PCB

HG55VDFA VER.C HG56BZRB VER.A
Top view Top view
Bottom view Bottom view

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

Use a serial TTL adapter to connect your PC with HG556a. Only connect TX, RX and GND.

Settings:

  • Baudrate: 115200
  • Data bits: 8
  • Parity: None
  • Stop bits: 1

Photo of PCB with markings

With Cutecom (or other serial console software), open /dev/ttyUSB0 (you must have right permissions).

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

10 pin header marked J400 (see back of board picture below). Uses AVR JTAG layout. Broadcom CPU recognised by TJTAG version 3.0.1

Photo of PCB with markings (VER.C)

We can use the updated version of debrick on Google Docs

But we'll need to change a couple of things

--- wrt54g.c
+++ wrt54g.c
@@ -252,6 +252,7 @@
    { 0x0535217F, 8, "Broadcom BCM5352 Rev 1 CPU" },
    { 0x0536517F, 8, "Broadcom BCM5365 Rev 1 CPU" },         // BCM5365 Not Completely Verified Yet
    { 0x0634817F, 5, "Broadcom BCM6348 Rev 1 CPU" },         // is bigendian  
+   { 0x0635817F, 5, "Broadcom BCM6358 Rev 1 CPU" }, //flash base: 0x1e000000 0x1e800000 0x1f000000 0x1f800000
    { 0x0634517F, 5, "Broadcom BCM6345 Rev 1 CPU" },         // BCM6345 Not Completely Verified Yet
    { 0x0000100F, 5, "TI AR7WRD TNETD7300GDU Rev 1 CPU" },   // TI AR7WRD Only Partially Verified
    { 0x0470417F, 8, "Broadcom BCM4704 Rev 8 CPU" },         // BCM4704 chip (used in the WRTSL54GS units)
@@ -1287,7 +1288,7 @@
     // Default to Standard Flash Window for Detection if not CUSTOM
     if (strcasecmp(AREA_NAME,"CUSTOM")==0)
          FLASH_MEMORY_START = selected_window;
-    else FLASH_MEMORY_START = 0x1FC00000;
+    else FLASH_MEMORY_START = 0x1e000000;
 
     printf("\nProbing Flash at (Flash Window: 0x%08x) ... ", FLASH_MEMORY_START);

We can use a unbuffered cable, but not longer than 15 cm.

Backup the whole flash:

nice ./debrick -backup:custom /window:1e000000 /start:1e000000 /length:1000000 /silent

Swap bytes for extracting or whatever you want with the backup

cat CUSTOM.BIN | ./switchend > HG556a_backup.bin

Backup the calibration data:

nice ./debrick -backup:custom /window:1EEFE000 /start:1EEFE000 /length:2000 /silent

or for the flash chip MX29LV128DB:

nice ./debrick -backup:custom /window:1EF7E000 /start:1EF7E000 /length:2000 /silent

SPI

Serial Peripheral Interface

The BCM6358 SoC has a SPI controller. The HG556a SPI pins are exposed on the board, at the place for a Si3050 chip which isn't soldered. We can use this SPI interface for connecting our own SPI stuff, but we need to build the kernel with the drivers and proper platform data code for registering the SPI device. This is the pinout:

This SPI interface is also connected to the Le88266 VoiP chip, but using the Slave Select 2 (GPIO32):

Kernel code example for spidev kernel module, the added code is highlighted in green:

static struct spi_board_info hw556_spi_info[] = {
	{
		.bus_num	= 0,
		.chip_select	= 1,
		.mode		= 0,
		.max_speed_hz	= 781000,
		.modalias	= "spidev",
	},
};

static struct board_info __initdata board_HW556 = {
	.name					= "HW556",
	.expected_cpu_id			= 0x6358,

	.has_uart0				= 1,
	.has_pci				= 1,
	.has_ohci0				= 1,
	.has_ehci0				= 1,
	.num_usbh_ports				= 2,

	.has_caldata				= 1,
	.caldata = {
		{
			.caldata_offset		= 0xe00000,
		},
	},

	.has_enet1				= 1,
	.enet1 = {
		.has_phy			= 1,
		.phy_id				= 0,
		.force_speed_100		= 1,
		.force_duplex_full		= 1,
	},

	.leds = {
		{
			.name			= "HW556:red:message",
			.gpio			= 0,
			.active_low		= 1,
		},
		{
			.name			= "HW556:red:hspa",
			.gpio			= 1,
			.active_low		= 1,
		},
		{
			.name			= "HW556:red:dsl",
			.gpio			= 2,
			.active_low		= 1,
		},
		{
			.name			= "HW556:red:power",
			.gpio			= 3,
			.active_low		= 1,
			.default_trigger	= "default-on",
		},
		{
			.name			= "HW556:red:all",
			.gpio			= 6,
			.active_low		= 1,
			.default_trigger	= "default-on",
		},
	},

	.buttons = {
		{
			.desc			= "help",
			.gpio			= 8,
			.active_low		= 1,
			.type			= EV_KEY,
			.code			= KEY_HELP,
			.debounce_interval	= BCM963XX_KEYS_DEBOUNCE_INTERVAL,
		},
		{
			.desc			= "wlan",
			.gpio			= 9,
			.active_low		= 1,
			.type			= EV_KEY,
			.code			= KEY_WLAN,
			.debounce_interval	= BCM963XX_KEYS_DEBOUNCE_INTERVAL,
		},
		{
			.desc			= "restart",
			.gpio			= 10,
			.active_low		= 1,
			.type			= EV_KEY,
			.code			= KEY_RESTART,
			.debounce_interval	= BCM963XX_KEYS_DEBOUNCE_INTERVAL,
		},
		{
			.desc			= "reset",
			.gpio			= 11,
			.active_low		= 1,
			.type			= EV_KEY,
			.code			= KEY_CONFIG,
			.debounce_interval	= BCM963XX_KEYS_DEBOUNCE_INTERVAL,
		},
	},
	.spis = hw556_spi_info,
	.num_spis = ARRAY_SIZE(hw556_spi_info),
};

The SPI controller is able to work with these speeds (kHz): 20000, 12500, 6250, 3125, 1563, 781(default), 391

  • Demo video connecting a SPI display, (781 kHz):


    using 20 MHz:

Debricking

CFE Bootloader

  1. you could read about bootloader in general

With a serial console we can get some interesting info

About the version and build:

CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE)
Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)

And about the possible boards compatible with this CFE:

CFE> 
b
Press:  <enter> to use current value

        '-' to go previous parameter

        '.' to clear the current value

        'x' to exit this command

Board Id Name (0-11) 
HW6358GW_A       -------  0
HW6358GW_B       -------  1
HW550            -------  2
HW550_FXO        -------  3
HW553            -------  4
HW556            -------  5
HW556aV2         -------  6
96358VW2         -------  7
96358VW-16       -------  8
96358GW          -------  9
96358GW-16       ------- 10
96358M           ------- 11       :  5  

Hardware mods

→ as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

No mods yet.

Firmware mods

Backports

BOOTLOGS

OEM bootlog:

CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE) Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) Copyright (C) 2006 Huawei Technologies Co. Ltd. Boot Address 0xbe000000 Initializing Arena. Initializing Devices. @w45260: Flash Manufacture id :c2 @w45260Flash Device id :2201 @w45260flipCFIGeometry:1 Parallel flash device: name , id 0x2201, size 16384KB *** GetHG556aBoardVersion = <0> *** CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz Total memory: 67108864 bytes (64MB) Total memory used by CFE: 0x80401000 - 0x8052A510 (1217808) Initialized Data: 0x8041F3C0 - 0x80421B60 (10144) BSS Area: 0x80421B60 - 0x80428510 (27056) Local Heap: 0x80428510 - 0x80528510 (1048576) Stack Area: 0x80528510 - 0x8052A510 (8192) Text (code) segment: 0x80401000 - 0x8041F3B4 (123828) Boot area (physical): 0x0052B000 - 0x0056B000 Relocation Factor: I:00000000 - D:00000000 *** GetHG556aBoardVersion = <0> *** Board IP address : 192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : HW556 Psi size in KB : 64 Number of MAC Addresses (1-32) : 14 Base MAC Address : 5c:4c:a9:6e:4a:a2 Ethernet PHY Type : Internal Memory size in MB : 64 CMT Thread Number : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 110 boot kernel from be9b2100 Code Address: 0x80010000, Entry Address: 0x8022a018 Decompression OK! Entry at 0x8022a018 Closing network. Starting program at 0x8022a018 Linux version 2.6.8.1 (root@IBM_x346) (gcc version 3.4.2) #2 Wed Jun 9 14:58:23 CST 2010 @w45260: Flash Manufacture id :c2 @w45260Flash Device id :2201 @w45260flipCFIGeometry:1 Parallel flash device: name , id 0x2201, size 16384KB Total Flash size: 16384K with 128 sectors Board id is set HW556, ucHardwareType 0 fInfo.flash_wlanparam_start_blk = 119 fInfo.flash_wlanparam_number_blk = 1 fInfo.flash_wlanparam_length = 0x2000 fInfo.flash_wlanparam_blk_offset = 0x1e000 HW556 prom init CPU revision is: 0002a010 Determined physical RAM map: memory: 03f91920 @ 00000000 (usable) On node 0 totalpages: 16273 DMA zone: 16273 pages, LIFO batch:3 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=31:0 ro noinitrd brcm mips: enabling icache and dcache... Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 16kB 2-way, linesize 16 bytes. PID hash table entries: 256 (order 8: 2048 bytes) Using 150.000 MHz high precision timer. Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Allocating memory for DSP module core and initialization code Allocated DSP module memory - CORE=0x81099cc0 SIZE=732896, INIT=0x0 SIZE=0 Memory: 61212k/65092k available (1828k kernel code, 3816k reserved, 319k data, 76k init, 0k highmem) Calibrating delay loop... 299.00 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for 'wait' instruction... unavailable. softirq policy:0 softirq nice:0, prio:120 NET: Registered protocol family 16 Can't analyze prologue code at 801d7a94 SCSI subsystem initialized usbcore: registered new driver usbfs usbcore: registered new driver hub NTFS driver 2.1.15 [Flags: R/O]. Initializing Cryptographic API PPP generic driver version 2.4.2 NET: Registered protocol family 24 Using noop io scheduler bcm963xx_mtd driver v1.0 PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) ehci_hcd 0000:00:0a.0: EHCI Host Controller PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0: irq 18, pci mem c0000300 ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 PCI: cache line size of 32 is not supported by device 0000:00:0a.0 ehci_hcd 0000:00:0a.0: USB f.f enabled, EHCI 1.00, driver 2004-May-10 hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ohci_hcd: 2004 Feb 02 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI) ohci_hcd: block sizes: ed 64 td 64 PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ohci_hcd 0000:00:09.0: OHCI Host Controller PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: irq 13, pci mem c0002400 ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB Mass Storage support registered. drivers/usb/serial/usb-serial.c: USB Serial support registered for Generic usbcore: registered new driver usbserial_generic usbcore: registered new driver usbserial drivers/usb/serial/usb-serial.c: USB Serial Driver core v2.0 brcmboard: brcm_board_init entry SES: Button GPIO 0x8009 is enabled SES: LED GPIO 0x8009 is enabled @@Board@@ GetHarewareType = 0x0 bcm963xx_serial driver v2.0 u32 classifier NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 4096 bind 8192) Initializing IPsec netlink socket NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 Ebtables v2.0 registered NET: Registered protocol family 8 NET: Registered protocol family 20 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller cfi_flash_sched_init!!! VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 76k freed usb 1-1: new high speed USB device using address 2 hub 1-1:1.0: USB hub found hub 1-1:1.0: 2 ports detected init started: BusyBox v1.00 (2010.06.09-07:05+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v1.00 (2010.06.09-07:05+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... fuse init (API version 7.8) fuse distribution version: 2.7.3 atmapi: module license 'Proprietary' taints kernel. blaadd: blaa_detect entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6358A1 Ethernet Network Device v0.3 Jul 14 2010 19:38:55 Config Ethernet Switch Through MDIO Pseudo PHY Interface dgasp: kerSysRegisterDyingGaspHandler: eth0 registered eth0: MAC Address: 5C:4C:A9:6E:4A:A2 DSP Driver: DSP init stub Endpoint: endpoint_init entry BOS: Enter bosInit Enter bosAppInit Exit bosAppInit BOS: Exit bosInit Endpoint: GetHarewareType <0> Endpoint: endpoint_init COMPLETED drivers/usb/serial/usb-serial.c: USB Serial support registered for option1 usbcore: registered new driver option drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1 147 eth0 Link UP. ip is 192.168.0.1mask is 255.255.255.0, ipbegin is 192.168.0.192, ipend is 192.168.0.254 ===7163=attrvalue is 2 set to 104 ===7163=attrvalue is 2 set to 104 xmlGetDhcpHostNameNode(appName dhcphostname, objName Entry, attrName option12, attrValue Huawei-HG556a ==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492== xmlEndIgmpProxyNode(calling cfm to get appName igmpproxy, objName proxy_node) ==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492== ==IpExt:psixml.cpp:xmlGetPppAttr:14204:mac is == value is 0 BcmDb_setSecEnblCfg :fw_enable 0, inflt 0, outflt 0, macflt 0, macmngr 0, nat_enable 1 ===7163=attrvalue is 2 set to 104 ===7163=attrvalue is 2 set to 104 xmlGetDhcpHostNameNode(appName dhcphostname, objName Entry, attrName option12, attrValue Huawei-HG556a ==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492== xmlEndIgmpProxyNode(calling cfm to get appName igmpproxy, objName proxy_node) ==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492== ==IpExt:psixml.cpp:xmlGetPppAttr:14204:mac is == value is 0 BcmAdsl_Initialize=0xC0066438, g_pFnNotifyCallback=0xC007F3F4 AnnexCParam=0x7FFF7EA8 AnnexAParam=0x00003987 adsl2=0x00000003 pSdramPHY=0xA3FFFFF8, 0x150EA5 0xDEADBEEF AdslCoreHwReset: AdslOemDataAddr = 0xA3FFBB64 AnnexCParam=0x7FFF7EA8 AnnexAParam=0x00003987 adsl2=0x00000003 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered atmapi: prioritize receive packets ip_tables: (C) 2000-2002 Netfilter core team ip_conntrack version 2.1 (508 buckets, 0 max) - 368 bytes per conntrack ip_conntrack_pptp version 2.1 loaded ip_nat_pptp version 2.0 loaded ==> Bcm963xx Software Version: V100R001C10B050SP01 <== device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state *******go there ,the pOption66 is *******: *******go there the pOption67 is ********: *******go there the pOption160 is *******: getopt returned char k setIndexName3 pvc2684d: Interface "nas_0_44" created sucessfully setIndexName3 pvc2684d: Communicating over ATM 0.0.44, encapsulation: LLC setIndexName3 pvc2684d: Interface "ipa_0_34" created sucessfully setIndexName3 pvc2684d: Communicating over ATM 0.0.34, encapsulation: LLC Open file fail in Function: BcmNtwk_initWandevice eth0 left promiscuous mode br0: port 1(eth0) entering disabled state device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state in bcmmac_init acbuf is null init syslog is end Sean@WLAN CHIP Vendor=, ProductId=<0xff1d> ath_hal: 0.9.14.25 (<7>AR5212<7>, AR5416<7>, RF5111<7>, RF5112<7>, RF2413<7>, RF5413<7>, DEBUG<7>) ath_dfs: Version 2.0.0 Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved wlan: 0.8.4.2 (Atheros/multi-bss) ath_rate_atheros: Version 2.0.1 Copyright (c) 2001-2004 Atheros Communications, Inc, All Rights Reserved ath_pci: 0.9.4.5 (Atheros/multi-bss) ath_pci: CR-LSDK-1.3.1.71 PCI: Enabling device 0000:00:01.0 (0000 -> 0002) Chan Freq RegPwr HT CTL CTL_U CTL_L DFS 1 2412n 20 HT20 1 0 1 N 1 2412n 20 HT40 1 0 1 N 2 2417n 20 HT40 1 0 1 N 3 2422n 20 HT40 1 1 1 N 4 2427n 20 HT40 1 1 1 N 5 2432n 20 HT40 1 1 1 N 6 2437n 20 HT40 1 1 1 N 7 2442n 20 HT40 1 1 1 N 8 2447n 20 HT40 1 1 1 N 9 2452n 20 HT40 1 1 1 N 10 2457n 20 HT40 1 1 1 N 11 2462n 20 HT40 1 1 1 N 12 2467n 20 HT40 1 1 0 N 13 2472n 20 HT40 1 1 0 N dfs_init_radar_filters: dfs->dfs_rinfo.rn_numradars: 0 DFS min filter rssiThresh = 21 DFS max pulse dur = 131 ticks wifi0: 11ng rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps wifi0: 11ng MCS: 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 wifi0: mac 47.2 phy 13.0<7> radio 12.0<7> wifi0: Use hw queue 1 for WME_AC_BE traffic wifi0: Use hw queue 0 for WME_AC_BK traffic wifi0: Use hw queue 2 for WME_AC_VI traffic wifi0: Use hw queue 3 for WME_AC_VO traffic wifi0: Use hw queue 8 for CAB traffic wifi0: Use hw queue 9 for beacons wifi0: Use hw queue 7 for UAPSD wifi0: Atheros 5416 Owl emulation: mem=0x10000000, irq=39 hw_base=0xb0000000 wlan: mac acl policy registered WlanSetupAll start killall: hostapd: no process killed SIOCGIFFLAGS: No such device wlanconfig: ioctl: No such device wlNBwCap[1]wlNCtrlsb[-1] Set WLAN Radio = 1 ==DEBUG==Atheros_SetupOneVAP,4427==bWpaPskMode:1,m_wlMssidVar[AthIndex].wlWep:disabled. 2xMaxPowerLevel: 30 (LEG) 2xMaxPowerLevel: 28 (LEG) ath0 Setting Max Stations:33 2xMaxPowerLevel: 28 (LEG) 2xMaxPowerLevel: 28 (LEG) ath_newstate: Resetting VAP dfswait_run 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 10080, PF 0 device ath0 entered promiscuous mode br0: port 2(ath0) entering learning state br0: topology change detected, propagating br0: port 2(ath0) entering forwarding state 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 30080, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2417, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2422, Flags 30082, PF 0 br0: port 2(ath0) entering disabled state Send SIG(1) to pid 402 on eth down 2xMaxPowerLevel: 28 (LEG) ath_newstate: Resetting VAP dfswait_run br0: port 2(ath0) entering learning state 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 10080, PF 0 br0: topology change detected, propagating br0: port 2(ath0) entering forwarding state E+E+E+E+E+hostapd is running. 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 30080, PF 0 register normal. SIP: can't Retrieve psi object 11 in app Voice when DialPlan table size loading, errno 3 SIP: can't Retrieve psi object 13 in app Voice when CallForward table size loading, errno 3 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2417, Flags 30082, PF 0 iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2422, Flags 30082, PF 0 original call init_spanish_mib iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2427, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2432, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2437, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2442, Flags 30082, PF 0 BOS: Enter bosInit bosTimerInit 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2447, Flags 30082, PF 0 Enter bosAppInit Exit bosAppInit BOS: Exit bosInit 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2452, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2457, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2462, Flags 30082, PF 0 [DMM]:Endpoit(3) receives an error digitmap string!, file = Dmm.c, line = 2371 UNSPT ^ 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2467, Flags 30082, PF 0 SipMsgThread MsgThread pid=605 ------------------------------------------------------------ at 946684845.994999 *** Received signal 18 on thread with PID 601 ------------------------------------------------------------ ------------------------------------------------------------ at 946684846.059999 *** Received signal 18 on thread with PID 601 ------------------------------------------------------------ ------------------------------------------------------------ at 946684846.124999 *** Received signal 18 on thread with PID 601 ------------------------------------------------------------ 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2472, Flags 30082, PF 0 ------------------------------------------------------------ at 946684846.199999 *** Received signal 18 on thread with PID 601 ------------------------------------------------------------ Process[voice] set voip status to [1]Process[voice] set voip status to [0]<7>ath_newstate: Resetting VAP dfswait_run 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 10080, PF 0 kernel::endpoint_open kernel::endpoint_open COMPLETED PstnInit Success!Created queue HDSP 00:00:46 CALLCLIENT: Initializing endpoints callSipClientMain voipqosapi: sendto returned -1 sipConfig: sipzParamp=0x7fff7150 sipzParamp->regname= line 59 file hsip.c sipConfig: sipzParamp=0x7fff7150line 69 file hsip.c sipConfig: &mgscb=0x1000e9f0line 82 file hsip.c 00:00:46 CALLCLIENT: Initializing endpoints 00:00:46 Endpoint will be initialized for country ESP (country code = 17) 00:00:46 Endpoint Event task started with pid 628... 00:00:46 Endpoint Packet task started with pid 629 ... Enter bosStartApp bosAppRootTask() - Is it morning already? Spawning app task (epoch #0)... bosAppRootTask() - Is it morning already? Spawning app task (epoch #0)... Enter TaskCreate aoAP TaskCreate - spawn new task aoAP Exit TaskCreate AppResetDetectionEnable() - Enabled reset detection. Exit bosStartApp PLL init completed. PLL registers set to: PCM->pcm_pll_ctrl1 = 0x00020001 PCM->pcm_pll_ctrl2 = 0x0008492B PCM->pcm_pll_ctrl3 = 0x00001E1C Set up PCM registers Channel 0 assigned to timeslot 0 Channel 1 assigned to timeslot 8 Channel 2 assigned to timeslot 1 Channel 3 assigned to timeslot 9 Channel 4 assigned to timeslot 2 Tx Desc (0xA29DE000): chan 0, buf 0, sts 0xe000, len 1280, bufp 0x29f4000 Tx Desc (0xA29DE008): chan 0, buf 1, sts 0x7000, len 1280, bufp 0x29f4510 Rx Desc (0xA28FF000): chan 0, buf 0, sts 0x8000, len 1280, bufp 0x36b7000 Rx Desc (0xA28FF008): chan 0, buf 1, sts 0x9000, len 1280, bufp 0x36b7510 initIudma: chan 0, descBase 0xa28ff000, descBaseIudma 0x28ff000 initIudma: chan 1, descBase 0xa29de000, descBaseIudma 0x29de000 PCM ENABLE INFO: DMA0 IRQ STATUS 0x00000000 PCM ENABLE INFO: DMA0 IRQ MASK 0x00000005 PCM ENABLE INFO: DMA1 IRQ STATUS 0x00000000 PCM ENABLE INFO: DMA1 IRQ MASK 0x00000005 PCM ENABLE INFO: PCM IRQ MASK 0x00000003 PCM ENABLE INFO: PCM IRQ PENDING 0x00000007 Enter TaskCreate CMT_EXCEPTION_IST TaskCreate - spawn new task CMT_EXCEPTION_IST Exit TaskCreate regStatus (reg 12 sel 0) = 0x10008501 regStatus (reg 12 sel 7) = 0x00000101 regCause (reg 13 sel 0) = 0x00000000 regCause (reg 13 sel 7) = 0x00808000 regCMT (reg 22 sel 0) = 0xe30e1006 regCMT (reg 22 sel 1) = 0xe8008003 Kicking off secondary thread processor at entry point 0x81099D00... Secondary thread processor entry point at 0x81099d00 Thread processor handshake. Secondary app initialized properly. Enter TaskCreate HTSK TaskCreate - spawn new task HTSK Exit TaskCreate SUCCESS: Took semaphore SUCCESS: Gave semaphore INFO: MSPI POLLING MODE INFO: IRQ MASK 0xa0020424 INFO: IRQ STATUS 0x400000 INFO: BLOCK ENABLES 0x3e0320 MSPI INITIALIZED HG55VDFA DoControlRelayStatus: disconnect PSTN relay #########slicLe88221CalDcDc=CH[0] Read data from Rev ID register: 0x04, 0xB3 @@@@@@@@@@@@SWcal=[0x1] ####normalChan0Cal: 0x08 normalChan1Cal: 0x08 DAA rstGpioPin=25, rlyGpioPin=14 DAA DBG: DAA read failed!!! DAA DBG: ISOCAP lock count = 0 Si3050 SLAC Initialised, Line side device = Si: 3010 (0xf) System dev rev: 0xf, Line dev rev: 0xf Line dev status: FDT:0x1, LCS: 0x1f DAA initialized with country code 17 Detect FXO Chip Failed... Skip daa6358Si3050SetFlyMode due to Not Si3050 Detected. DAA Device Init completed...[19:38:34] Initialized DAA driver functions at location 0xc0205968 boardHalInit6358: Initialization complete. boardHalInit completed Enter TaskCreate HRTBEAT TaskCreate - spawn new task HRTBEAT Exit TaskCreate HEARTBEAT: Initialized! g_iRtcpInterval = 3000 bosMsgQCreate: Created message queue VRGEVQ at address 0x6000c Enter TaskCreate VRGEVPR TaskCreate - spawn new task VRGEVPR Exit TaskCreate Enter TaskCreate HCAS TaskCreate - spawn new task HCAS Exit TaskCreate Enter TaskCreate DMAW TaskCreate - spawn new task DMAW Exit TaskCreate *** gStartRxDesc[0] = 0xA28FF000 *** gBufferSizeBytes = 1280 *** gStartTxDesc[0] = 0xA29DE000 hal6358PcmInit 263 nextTxDesc = 0xA29DE000 hal6358PcmInit 263 nextTxDesc = 0xA29DE008 hal6358PcmInit 267 Ownership for TX desc not set. Use this buffer. PERF->IrqMask = 0xA0020424 PERF->IrqMask1 = 0x00800000 Default value for provItemId '226' did not exist ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x50) of type: 0x0 ENDPT: Setting T.38 error correction mode for vhd 80 to 0x104 ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x51) of type: 0x0 ENDPT: Setting T.38 error correction mode for vhd 81 to 0x104 ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x52) of type: 0x0 ENDPT: Setting T.38 error correction mode for vhd 82 to 0x104 ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x53) of type: 0x0 ENDPT: Setting T.38 error correction mode for vhd 83 to 0x104 bosMsgQCreate: Created message queue PSTN_CTL_EVQ at address 0x6800d Enter TaskCreate PSTN TaskCreate - spawn new task PSTN Exit TaskCreate pstnCtlInit successful dgasp: kerSysRegisterDyingGaspHandler: endpoint registered @@DoVrgEndptInit reInjecitonMode=<0x0>. 00:00:50 Enter vrgEndptCasTimeParamControl... minHookFlash = 80, maxHookFlash = 250. ENDPT: EPTYPE_FXS ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x54) of type: 0x7 Default value for provItemId '74' did not exist Default value for provItemId '75' did not exist minHookFlash = 80. maxHookFlash = 250. Default value for provItemId '217' did not exist Default value for provItemId '41' did not exist Default value for provItemId '66' did not exist Default value for provItemId '58' did not exist Default value for provItemId '219' did not exist ENDPT: Initialization completed successfully for endpt 0 00:00:50 SIGNAL: endpt 0, cnx -1, evt 111 (TxGain), value 0 00:00:50 SIGNAL: endpt 0, cnx -1, evt 112 (RxGain), value 0 ENDPT: EPTYPE_FXS ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x55) of type: 0x7 Default value for provItemId '74' did not exist Default value for provItemId '75' did not exist minHookFlash = 80. maxHookFlash = 250. Default value for provItemId '217' did not exist Default value for provItemId '41' did not exist Default value for provItemId '66' did not exist Default value for provItemId '58' did not exist Default value for provItemId '219' did not exist ENDPT: Initialization completed successfully for endpt 1 00:00:51 SIGNAL: endpt 1, cnx -1, evt 111 (TxGain), value 0 00:00:51 SIGNAL: endpt 1, cnx -1, evt 112 (RxGain), value 0 ENDPT: EPTYPE_PSTN ENDPT: hdspVhdOpen PSTN VHD success. DSP 0, VHD (0x56) of type: 0x6 ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x57) of type: 0x7 Default value for provItemId '74' did not exist Default value for provItemId '75' did not exist minHookFlash = 80. maxHookFlash = 250. Default value for provItemId '217' did not exist DAA driver * for chan 2 is c0244f90 Default value for provItemId '58' did not exist Default value for provItemId '219' did not exist DAA driver * for chan 2 is c0244f90 DAA driver * for chan 2 is c0244f90 DAA: Skip cmd[1] due to on the fly <0>,<0>... ENDPT: Initialization completed successfully for endpt 2 00:00:51 RTP read thread started with pid 639 00:00:51 RTP read thread started with pid 640 00:00:51 RTP read thread started with pid 641 00:00:51 RTP read thread started with pid 642 00:00:51 RTCP thread started with pid 643 00:00:51 rtpInit: RTCP task created, taskId = 14351 00:00:51 ccPstnInit: Init PSTN module with dial-plan = 00:00:51 gwPstnSignal: signal-67, action-0x1, value--1 ENDPT: Enable PSTN EC. ENDPT: ECAN Enabled for endpt 2 00:00:51 gwPstnSignal (call setup): value = 00:00:51 gwPstnSignal: signal-63, action-0x554890, value--1 vrgEndptSignal (EPSIG_PSTNCALLSETUP) 00:00:51 gwPstnSignal: signal-66, action-0x1, value--1 CMTD_CTL: Using default settings CMTD_CTL: setFilterCoeff: filtSize79 Seized PSTN line 2 ConnectSB: connecting line2 and line0 DAA: Skip cmd[2] due to on the fly <0>,<0>... 00:00:51 gwPstnSignal: signal-68, action-0x1, value--1 ENDPT: Disable PSTN EC. ENDPT: ECAN disabled for endpt 2 00:00:51 gwPstnSignal: signal-65, action-0x1, value--1 Released PSTN line 2 DisconnectSB: disconnecting line0 and line2 DAA: Skip cmd[0] due to on the fly <0>,<0>... 00:00:51 CALLCLIENT: Initialization complete callSipClientMain 00:00:51 ccPublishSipEventCB: event 0 PSTN_CTL: cmtdCtlConfigFilter success vhd=0x56 Enter TaskCreate TM56 TaskCreate - spawn new task TM56 Exit TaskCreate PSTN_CTL: timerTaskMain timer task started, timeout = 5000 Get Resource file size = [779725] @@@@Voice@@@FXO Chip Dectected result = <0>. 00:00:53 ====== HSPA voice Read Thread start ====== ======start No voice process 10 times===== mkdir: Cannot create directory `/var/mnt/USBDisk_1/twonkymedia.db': No such file or directory DLNA:syscall.c:startDlna:5682:twonkymedia.db can't be created![10] initDeviceAssociation(entry): BcmCfm_ManageableDeviceTbl 0 initDeviceAssociation(): fopen /var/udhcpd/manageable.device failed): return error kill: Could not kill pid '65535': No such process Scratch pad is not initialized. Enter TaskEnterShutdown (task=TM56) Exit TaskEnterShutdown (task=TM56) Enter bosTaskDestoryR, taskId = 82a38928 PSTN_CTL: cmtdCtlDisable success vhd=0x56 PstnEventCallback: PSTN_CTL_EVT_CPTONE_TIMEOUT No scratch pad found. Initialize scratch pad... telnet function started! ==DHCPD:files.c:write_dnsconf:498:== ==DHCPD:files.c:write_dnsconf:523:BUF[address=/#/192.168.0.1 ]== Can't get dns's pid URL Filer: open rule file failed! ==DNS:option.c:read_opts:2064:conffile is /var/dnsmasq.conf== ==DNS:option.c:one_file:1870file is /var/dnsmasq.conf:== ==DNS:option.c:one_opt:968:arg is /#/192.168.0.1== BcmWL_createAutoCfgSwTsk Called... BcmWL_createAutoCfgSwTsk Success[1026]... Sean@WLAN CHIP Vendor=, ProductId=<0xff1d> ==HTTPD:httpd.c:webmain:2996:ATHEROS:VHG== ==MTU:ifcuiweb.cpp:BcmWeb_getWanConInfo:1350:1492,1492,== NTWK_INTF wanObjIndex=2, attachToIndex=1 IFC_ATM_VCC =255/65535 NTWK_INTF wanObjIndex=3, attachToIndex=2 IFC_ATM_VCC =0/44 NTWK_INTF wanObjIndex=4, attachToIndex=3 IFC_ATM_VCC =0/34 Flash Write confliction, wait... Flash Write confliction, wait... Line:150=====start up mac=5c:4c:a9:6e:4a:a2 Line:153=====syspwd=VF-EShg556 Flash Write confliction, wait... Flash Write confliction, wait... NTWK_INTF wanObjIndex=5, attachToIndex=4 IFC_ATM_VCC =0/33 Flash Write confliction, wait... Flash Write confliction, wait... language option, user:es_ES admin:en_US IFC_ATM_VCC =255/65535 IFC_ATM_VCC =0/44 IFC_ATM_VCC =0/34 IFC_ATM_VCC =0/33 SSDP server socket OK! Found INET Found INET Device=br0 nmbd: not found Init port is 80 bcmIsDataPvc: ppp_255_65535_1 data ifc Cwmp initing... paraattribute name is HG553VF bcmIsDataPvc: nas_0_44 data ifc(Data) PPP@WLAN CHIP Vendor=, ProductId=<0xff1d> Voice channel Query [CwmpReadLoadInfoFromFlash,230]=======acTmp:ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ======== [CwmpReadLoadInfoFromFlash,245]=======pulErrCode:0,pcCmdkey:======== ==DEBUG==BcmSipRegisterQuery 7426==stsOld:0,stsHspa:0,iHspaDomain:0,usVoiceChannel:1,iSipChannel:0,iVoiceRegister:0,glbAdslRegState:0,glbHspaRegState:0 sDeviceCount is 0 sSimExist is -1 Voice channel Query ==DEBUG==BcmSipRegisterQuery 7426==stsOld:0,stsHspa:0,iHspaDomain:0,usVoiceChannel:1,iSipChannel:0,iVoiceRegister:0,glbAdslRegState:0,glbHspaRegState:0 sDeviceCount is 0 sSimExist is -1 sigWanDownProcess cDataMode is 0 AdslCoreEcUpdTmr: timeMs=1800225 ecUpdMask=0x40000

Openwrt bootlog:

CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE) Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) Copyright (C) 2006 Huawei Technologies Co. Ltd. Boot Address 0xbe000000 Initializing Arena. Initializing Devices. @w45260: Flash Manufacture id :c2 @w45260Flash Device id :2201 @w45260flipCFIGeometry:1 Parallel flash device: name , id 0x2201, size 16384KB *** GetHG556aBoardVersion = <0> *** CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz Total memory: 67108864 bytes (64MB) Total memory used by CFE: 0x80401000 - 0x8052A510 (1217808) Initialized Data: 0x8041F3C0 - 0x80421B60 (10144) BSS Area: 0x80421B60 - 0x80428510 (27056) Local Heap: 0x80428510 - 0x80528510 (1048576) Stack Area: 0x80528510 - 0x8052A510 (8192) Text (code) segment: 0x80401000 - 0x8041F3B4 (123828) Boot area (physical): 0x0052B000 - 0x0056B000 Relocation Factor: I:00000000 - D:00000000 *** GetHG556aBoardVersion = <0> *** Board IP address : 192.168.1.1 Host IP address : 192.168.1.35 Gateway IP address : Run from flash/host (f/h) : h Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : HW556 Psi size in KB : 64 Number of MAC Addresses (1-32) : 14 Base MAC Address : 5c:4c:a9:6e:4a:a2 Ethernet PHY Type : Internal Memory size in MB : 64 CMT Thread Number : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 110 0x80010000/2739096 0x802acb98/159768 Entry at 0x8021e9f0 Closing network. Starting program at 0x8021e9f0 [ 0.000000] Linux version 2.6.39.4 (dani@tool) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #22 Sat Dec 31 02:13:30 CET 2011 [ 0.000000] Detected Broadcom 0x6358 CPU revision a1 [ 0.000000] CPU frequency is 300 MHz [ 0.000000] 64MB of RAM installed [ 0.000000] registering 40 GPIOs [ 0.000000] board_bcm963xx: Boot address 0xbe000000 [ 0.000000] board_bcm963xx: CFE version: 100.48.56-49.46 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 0002a010 (Broadcom BMIPS4350) [ 0.000000] board_bcm963xx: board name: HW556 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00004000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] early_node_map[1] active PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00004000 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. [ 0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Memory: 62016k/65536k available (2144k kernel code, 3520k reserved, 369k data, 160k init, 0k highmem) [ 0.000000] NR_IRQS:128 [ 0.000000] Calibrating delay loop... 299.26 BogoMIPS (lpj=598528) [ 0.036000] pid_max: default: 32768 minimum: 301 [ 0.040000] Mount-cache hash table entries: 512 [ 0.052000] NET: Registered protocol family 16 [ 0.068000] changed ath9k regdomain to 0xff [ 0.072000] registering PCI controller with io_map_base unset [ 0.084000] bio: create slab at 0 [ 0.092000] pci 0000:00:01.0: fixup device configuration [ 0.096000] pci-ath9k-fixup: Writing 0x0029168c to register 0x6000 [ 0.100000] pci-ath9k-fixup: Writing 0x02800001 to register 0x6008 [ 0.104000] pci-ath9k-fixup: Writing 0x2091168c to register 0x602c [ 0.108000] pci-ath9k-fixup: Writing 0x002a168c to register 0x5000 [ 0.112000] pci-ath9k-fixup: Writing 0x02800001 to register 0x5008 [ 0.116000] pci-ath9k-fixup: Writing 0x2091168c to register 0x502c [ 0.120000] pci-ath9k-fixup: Writing 0x05040cc0 to register 0x5064 [ 0.124000] pci-ath9k-fixup: Writing 0x00033811 to register 0x506c [ 0.128000] pci-ath9k-fixup: Writing 0x0040073b to register 0x4004 [ 0.132000] pci-ath9k-fixup: Writing 0x00000003 to register 0x4074 [ 0.136000] pci-ath9k-fixup: Writing 0x01c20000 to register 0x4000 [ 0.140000] pci-ath9k-fixup: Writing 0x00000044 to register 0x6034 [ 0.144000] pci-ath9k-fixup: Device vendor 0x168c, id 0x0029 [ 0.164000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x3000ffff] [ 0.168000] pci 0000:00:01.0: BAR 0: set to [mem 0x30000000-0x3000ffff] (PCI address [0x30000000-0x3000ffff]) [ 0.172000] Switching to clocksource MIPS [ 0.184000] NET: Registered protocol family 2 [ 0.188000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.196000] TCP established hash table entries: 2048 (order: 2, 16384 bytes) [ 0.204000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes) [ 0.212000] TCP: Hash tables configured (established 2048 bind 2048) [ 0.216000] TCP reno registered [ 0.220000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.228000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.236000] NET: Registered protocol family 1 [ 0.240000] audit: initializing netlink socket (disabled) [ 0.248000] type=2000 audit(0.248:1): initialized [ 0.256000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.260000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.272000] msgmni has been set to 121 [ 0.276000] io scheduler noop registered [ 0.280000] io scheduler deadline registered (default) [ 0.288000] bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0100 (irq = 10) is a bcm63xx_uart [ 0.296000] console [ttyS0] enabled, bootconsole disabled [ 0.296000] console [ttyS0] enabled, bootconsole disabled [ 0.312000] bcm963xx-flash bcm963xx-flash.0: 0x02000000 at 0x1e000000 [ 0.316000] bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x00227e [ 0.328000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.332000] Amd/Fujitsu Extended Query version 1.3. [ 0.340000] Using buffer write method [ 0.340000] Silicon revision: 10 [ 0.344000] Address sensitive unlock: Required [ 0.352000] Erase Suspend: Read/write [ 0.356000] Block protection: 1 sectors per group [ 0.360000] Temporary block unprotect: Not supported [ 0.364000] Block protect/unprotect scheme: 8 [ 0.368000] Number of simultaneous operations: 0 [ 0.376000] Burst mode: Not supported [ 0.376000] Page mode: 8 word page [ 0.380000] Vpp Supply Minimum Program/Erase Voltage: 9.5 V [ 0.388000] Vpp Supply Maximum Program/Erase Voltage: 10.5 V [ 0.392000] Top/Bottom Boot Block: Uniform, Top WP [ 0.400000] number of CFI chips: 1 [ 0.404000] bcm963xx_flash: Read Signature value of CFE1CFE1 [ 0.408000] bcm963xx-flash bcm963xx-flash.0: CFE bootloader detected [ 0.416000] bcm963xx_flash: CFE boot tag found with version 8 and board type HW556 [ 0.424000] bcm963xx_flash: Partition 0 is CFE offset 0 and length 20000 [ 0.428000] bcm963xx_flash: Partition 1 is kernel offset 20100 and length dff00 [ 0.436000] bcm963xx_flash: Partition 2 is rootfs offset 100000 and length d00000 [ 0.444000] bcm963xx_flash: Partition 3 is ath_data offset e00000 and length 1e0000 [ 0.452000] bcm963xx_flash: Partition 4 is nvram offset fe0000 and length 20000 [ 0.460000] bcm963xx_flash: Partition 5 is linux offset 20000 and length de0000 [ 0.468000] bcm963xx_flash: Spare partition is 340000 offset and length ac0000 [ 0.476000] Creating 6 MTD partitions on "bcm963xx": [ 0.480000] 0x000000000000-0x000000020000 : "CFE" [ 0.488000] mtd: Giving out device 0 to CFE [ 0.492000] 0x000000020100-0x000000100000 : "kernel" [ 0.500000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.512000] mtd: Giving out device 1 to kernel [ 0.520000] 0x000000100000-0x000000e00000 : "rootfs" [ 0.528000] mtd: Giving out device 2 to rootfs [ 0.532000] mtd: partition "rootfs" set to be root filesystem [ 0.540000] mtd: partition "rootfs_data" created automatically, ofs=340000, len=AC0000 [ 0.548000] 0x000000340000-0x000000e00000 : "rootfs_data" [ 0.556000] mtd: Giving out device 3 to rootfs_data [ 0.564000] 0x000000e00000-0x000000fe0000 : "ath_data" [ 0.568000] mtd: Giving out device 4 to ath_data [ 0.576000] 0x000000fe0000-0x000001000000 : "nvram" [ 0.584000] mtd: Giving out device 5 to nvram [ 0.588000] 0x000000020000-0x000000e00000 : "linux" [ 0.596000] mtd: Giving out device 6 to linux [ 0.608000] bcm63xx-wdt bcm63xx-wdt.0: started, timer margin: 30 sec [ 0.624000] TCP westwood registered [ 0.624000] NET: Registered protocol family 17 [ 0.632000] 802.1Q VLAN Support v1.8 Ben Greear [ 0.636000] All bugs added by David S. Miller [ 0.648000] mtdblock_open [ 0.652000] ok ^@[ 0.660000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.668000] Freeing unused kernel memory: 160k freed awk: /proc/cpuinfo: No such file or directory [ 3.508000] roboswitch: Probing device eth0: found a 5325! It's a 5350. [ 4.576000] There is already a switch registered on the device 'eth0' - preinit - Press the [f] key and hit [enter] to enter failsafe mode - regular preinit - [ 9.076000] mtdblock_open [ 9.080000] ok [ 9.088000] mtdblock_release [ 9.092000] ok [ 9.172000] MTDSB: lookup_bdev() returned 0 [ 9.176000] MTDSB: New superblock for device 3 ("rootfs_data") [ 9.224000] JFFS2 notice: (317) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 5 of xref (0 dead, 2 orphan) found. [ 9.256000] MTD_open [ 9.256000] MTD_ioctl [ 9.260000] MTD_ioctl [ 9.260000] MTD_close switching to jffs2 - init - ^@ Please press Enter to activate this console. [ 12.756000] Compat-wireless backport release: compat-wireless-2011-11-29 [ 12.760000] Backport based on wireless-testing.git master-2011-12-01 [ 12.984000] cfg80211: Calling CRDA to update world regulatory domain [ 13.812000] cfg80211: World regulatory domain updated: [ 13.816000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 13.824000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 13.832000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 13.844000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 13.852000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 13.860000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 14.532000] SCSI subsystem initialized [ 14.632000] There is already a switch registered on the device 'eth0' [ 15.028000] usbcore: registered new interface driver usbfs [ 15.036000] usbcore: registered new interface driver hub [ 15.048000] usbcore: registered new device driver usb [ 16.632000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002) [ 16.640000] board_bcm963xx: Setting device platform data [ 16.652000] ath: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff [ 16.660000] ath: random mac address will be used: 66:94:cc:56:b8:3c [ 16.680000] ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xc02e0000, irq=39 [ 16.692000] cfg80211: Calling CRDA for country: JP [ 16.852000] cfg80211: Regulatory domain changed to country: JP [ 16.860000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 16.868000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm) [ 16.876000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (N/A, 2000 mBm) [ 16.884000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm) [ 16.892000] cfg80211: (4910000 KHz - 4930000 KHz @ 10000 KHz), (N/A, 2300 mBm) [ 16.900000] cfg80211: (4910000 KHz - 4990000 KHz @ 40000 KHz), (N/A, 2300 mBm) [ 16.908000] cfg80211: (4930000 KHz - 4950000 KHz @ 10000 KHz), (N/A, 2300 mBm) [ 16.916000] cfg80211: (5030000 KHz - 5045000 KHz @ 10000 KHz), (N/A, 2300 mBm) [ 16.924000] cfg80211: (5030000 KHz - 5090000 KHz @ 40000 KHz), (N/A, 2300 mBm) [ 16.932000] cfg80211: (5050000 KHz - 5060000 KHz @ 10000 KHz), (N/A, 2300 mBm) [ 16.940000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (N/A, 2000 mBm) [ 16.948000] cfg80211: (5250000 KHz - 5330000 KHz @ 40000 KHz), (N/A, 2000 mBm) [ 16.956000] cfg80211: (5490000 KHz - 5710000 KHz @ 40000 KHz), (N/A, 2300 mBm) [ 16.996000] Button Hotplug driver version 0.4.1 [ 17.972000] NTFS driver 2.1.30 [Flags: R/O MODULE]. [ 18.520000] PPP generic driver version 2.4.2 [ 18.752000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 19.076000] NET: Registered protocol family 24 [ 19.324000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 19.328000] bcm63xx_ehci bcm63xx_ehci.0: BCM63XX integrated EHCI controller [ 19.336000] bcm63xx_ehci bcm63xx_ehci.0: new USB bus registered, assigned bus number 1 [ 19.368000] bcm63xx_ehci bcm63xx_ehci.0: irq 18, io mem 0xfffe1300 [ 19.384000] bcm63xx_ehci bcm63xx_ehci.0: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 19.392000] hub 1-0:1.0: USB hub found [ 19.396000] hub 1-0:1.0: 2 ports detected [ 19.712000] nf_conntrack version 0.5.0 (971 buckets, 3884 max) [ 19.832000] usb 1-1: new high speed USB device number 2 using bcm63xx_ehci [ 20.220000] hub 1-1:1.0: USB hub found [ 20.232000] hub 1-1:1.0: 2 ports detected [ 20.636000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 20.640000] bcm63xx_ohci bcm63xx_ohci.0: BCM63XX integrated OHCI controller [ 20.648000] bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bus number 2 [ 20.656000] bcm63xx_ohci bcm63xx_ohci.0: irq 13, io mem 0xfffe1400 [ 20.724000] hub 2-0:1.0: USB hub found [ 20.728000] hub 2-0:1.0: 1 port detected [ 21.008000] Initializing USB Mass Storage driver... [ 21.016000] usbcore: registered new interface driver usb-storage [ 21.020000] USB Mass Storage support registered. [ 21.232000] input: gpio-buttons as /devices/platform/gpio-buttons.0/input/input0 [ 23.260000] eth0: link forced UP - 100/full - flow control off/off [ 23.692000] device eth0 entered promiscuous mode [ 23.780000] br-lan: port 1(eth0) entering forwarding state [ 23.788000] br-lan: port 1(eth0) entering forwarding state [ 27.972000] device wlan0 entered promiscuous mode [ 27.980000] br-lan: port 2(wlan0) entering forwarding state [ 27.984000] br-lan: port 2(wlan0) entering forwarding state [ 30.392000] device wlan0 left promiscuous mode [ 30.396000] br-lan: port 2(wlan0) entering forwarding state [ 30.688000] device wlan0 entered promiscuous mode [ 30.692000] br-lan: port 2(wlan0) entering forwarding state [ 30.696000] br-lan: port 2(wlan0) entering forwarding state BusyBox v1.19.3 (2011-12-25 13:56:35 CET) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ATTITUDE ADJUSTMENT (bleeding edge, r29606) ---------- * 1/4 oz Vodka Pour all ingredients into mixing * 1/4 oz Gin tin with ice, strain into glass. * 1/4 oz Amaretto * 1/4 oz Triple sec * 1/4 oz Peach schnapps * 1/4 oz Sour mix * 1 splash Cranberry juice ----------------------------------------------------- root@OpenWrt:/#

Notes

cal_data

In this table we can see the different geometry of flash chips:

GEOMETRY S29GL128P10 MX29GL128EH MX29LV128DB
Boot Block Uniform, Top WP Uniform, Top WP Bottom boot
region 1 1 1 2
sectors 1 - 128 1 - 128 1 - 8 9 - 263
erasesize 0x20000 0x20000 0x2000 0x10000

The WIFI calibration data location (starts with 0xA55A) is displayed on bootup. . The fInfo.* values appear to be embedded in the kernel :?:

Boot log reports:


MX29GL128EH | S29GL128P10

...
Total Flash size: 16384K with 128 sectors
Board id is set HW556, ucHardwareType 0
fInfo.flash_wlanparam_start_blk = 119
fInfo.flash_wlanparam_number_blk = 1
fInfo.flash_wlanparam_length = 0x2000
fInfo.flash_wlanparam_blk_offset = 0x1e000

Based on the geometry in the above table let's calculate the offset:

119*0x20000+0x1e000 = 0xEFE000

If we make a backup of whole flash via JTAG we see it's exactly located at the offset 0xEFE000


MX29LV128DB

...
Total Flash size: 16384K with 263 sectors
Board id is set HW556, ucHardwareType 0
fInfo.flash_wlanparam_start_blk = 254
fInfo.flash_wlanparam_number_blk = 1
fInfo.flash_wlanparam_length = 0x2000
fInfo.flash_wlanparam_blk_offset = 0xe000

Based on the geometry in the above table let's calculate the offset again:

8*0x2000+(254-8)*0x10000+0xe000 = 0xF7E000

Tags

For some Help with the Tags, please have a look here: tags

Back to top

toh/huawei/hg556a.txt · Last modified: 2014/10/21 15:35 by danitool