Supported since R35011.
The HG556A is an adsl wifi router mainly distributed by Vodafone to their customers.
It's a good idea to backup the cal_data area at the flash-chip. The WLAN calibration data is specific for your device. If you wipe it accidentally it will be difficult to restore, it cannot be restored by flashing back a vendor firmware.
| Board model |
Wifi chip |
Supported |
Notes |
| HG55VDFA VER.C |
Atheros AR9223 |
Yes |
without ADSL |
| HG56BZRB VER.A |
Ralink RT3062F |
Yes |
without ADSL |
About where the wifi calibration data is located in the flash chip see notes.
| SoC |
Ram |
Flash |
Network |
USB |
Serial |
JTag |
| Broadcom 6358 |
64MiB |
16MiB |
4 x 1 |
Yes |
Yes |
Yes |
Please check out the article Flash Layout. It contains an example and a couple of explanations.
| partition |
name |
filesystem |
function |
| mtd0 |
CFE |
n/a |
bootloader |
| n/a |
n/a |
n/a |
firmware tag |
| mtd1 |
kernel |
RAM executable |
kernel |
| mtd2 |
rootfs |
squashfs |
root |
| mtd3 |
rootfs_data |
jffs2 |
configuration, install new packages |
| mtd4 |
cal_data |
n/a |
wifi calibration data |
| mtd5 |
nvram |
n/a |
OEM configuration data |
| mtd6 |
linux |
n/a |
OpenWrt upgrade |
This section deals with how you install OpenWrt from the device freshly opened.
-
Unplug the power cord
Press the button labeled as RESTART, don't release it yet!
Plug the power cord
Wait 10 seconds
Release the RESTART button
-
Upload .bin file to router
Upgrade the image
Wait for it to reboot
Telnet to 192.168.1.1 and set a root password, or browse to
http://192.168.1.1 if LuCI is installed.
Connect the
serial TTL cable to send commands to CFE for loading the firmware via tftp.
Start a TFTP server in your PC. Copy the openwrt-HW556-squashfs-cfe.bin firmware to the server.
Set the IP at your pc to 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
This is a session of flashing via TFTP:
CFE> f 192.168.1.35:openwrt-HW556-squashfs-cfe.bin
Loading 192.168.1.35:openwrt-HW556-squashfs-cfe.bin ...
Finished loading 2883588 bytes
Flashing root file system and kernel at 0xbe020000:
~~~~~~~Flag: 3
baseAddr 0xbe000000
kernelAddr 0xbe020100
rootfsAddr 0xbe020100
tagFs 0x80800000
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
Backup flag .
~~~~~~~Flag: 1
.
*** Image flash done *** !
Resetting board...
→ generic.sysupgrade
If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-HW556-squashfs-cfe.bin
sysupgrade /tmp/openwrt-HW556-squashfs-cfe.bin
cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-HW556-squashfs-cfe.bin
mtd write /tmp/openwrt-HW556-squashfs-cfe.bin linux && reboot
This is a clean and safe upgrade, using the booloader web interface. Just use the OEM installation procedure.
 |
If after upgrading OpenWrt you get the message: jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes
And you can't save changes. Enter OpenWrt failsafe mode if needed. Then execute this command:
mtd erase -r rootfs_data && reboot |
→ Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.
The default network configuration is:
| Interface Name |
Description |
Default configuration |
| br-lan |
LAN & WiFi |
192.168.1.1/24 |
| eth0 |
LAN ports (1 to 4) |
bridged |
| wlan0 |
WiFi |
bridged (disabled) |
This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 will be the
Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on.
| Port |
Switch port |
Mode |
| LAN 1 |
0 |
lan |
| LAN 2 |
1 |
lan |
| LAN 3 |
2 |
lan |
| LAN 4 |
3 |
Internet (WAN) |
# path: /etc/config/network
# port 4 = WAN
config interface loopback
option ifname lo
option proto static
option ipaddr 127.0.0.1
option netmask 255.0.0.0
config interface lan
option type bridge
option ifname eth0.0
option proto static
option ipaddr 192.168.1.1
option netmask 255.255.255.0
option nat 1
config interface wan
option ifname eth0.1
option macaddr 00:11:22:33:44:55
option proto dhcp
option defaultroute 1
config switch eth0
option enable 1
option reset 1
option enable_vlan 1
config switch_vlan
option device eth0
option vlan 0
option ports "0 1 2 5t"
config switch_vlan
option device eth0
option vlan 1
option ports "3 5t"
→ generic.failsafe
Openwrt failsafe: Power on the router, press the button RESTART repeatedly to enter failsafe mode (the power led starts blinking very fast)
CFE failsafe: This is for entering in the bootloader command line. Use a serial cable and press any key while loading CFE.
→hardware.button
The HG556a has four buttons.
| BUTTON label |
Event (OEM) |
GPIO |
Openwrt name |
Openwrt code |
| ? |
diagnostic |
8 |
help |
KEY_HELP |
| ((i)) |
wifi on/off |
9 |
wlan |
KEY_WLAN |
| RESTART |
reboot |
10 |
restart |
KEY_RESTART |
| RESET |
reset |
11 |
reset |
KEY_CONFIG |
Photo of front and back of the casing:
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port of this specific device:
 |
Use a serial TTL adapter to connect your PC with HG556a. Only connect TX, RX and GND. |
Settings:
Baudrate: 112500
Data bits: 8
Parity: None
Stop bits: 1
Photo of PCB with markings
With Cutecom (or other serial console software), open /dev/ttyUSB0 (you must have right permissions).
→ port.jtag general information about the JTAG port, JTAG cable, etc.
10 pin header marked J400 (see back of board picture below). Uses AVR JTAG layout. Broadcom CPU recognised by TJTAG version 3.0.1
Photo of PCB with markings (VER.C)
We can use the updated version of debrick on Google Docs
But we'll need to change a couple of things
--- wrt54g.c
+++ wrt54g.c
@@ -252,6 +252,7 @@
{ 0x0535217F, 8, "Broadcom BCM5352 Rev 1 CPU" },
{ 0x0536517F, 8, "Broadcom BCM5365 Rev 1 CPU" }, // BCM5365 Not Completely Verified Yet
{ 0x0634817F, 5, "Broadcom BCM6348 Rev 1 CPU" }, // is bigendian
+ { 0x0635817F, 5, "Broadcom BCM6358 Rev 1 CPU" }, //flash base: 0x1e000000 0x1e800000 0x1f000000 0x1f800000
{ 0x0634517F, 5, "Broadcom BCM6345 Rev 1 CPU" }, // BCM6345 Not Completely Verified Yet
{ 0x0000100F, 5, "TI AR7WRD TNETD7300GDU Rev 1 CPU" }, // TI AR7WRD Only Partially Verified
{ 0x0470417F, 8, "Broadcom BCM4704 Rev 8 CPU" }, // BCM4704 chip (used in the WRTSL54GS units)
@@ -1287,7 +1288,7 @@
// Default to Standard Flash Window for Detection if not CUSTOM
if (strcasecmp(AREA_NAME,"CUSTOM")==0)
FLASH_MEMORY_START = selected_window;
- else FLASH_MEMORY_START = 0x1FC00000;
+ else FLASH_MEMORY_START = 0x1e000000;
printf("\nProbing Flash at (Flash Window: 0x%08x) ... ", FLASH_MEMORY_START);
We can use a unbuffered cable, but not longer than 15 cm.
Backup the whole flash:
nice ./debrick -backup:custom /window:1e000000 /start:1e000000 /length:1000000 /silent
Swap bytes for extracting or whatever you want with the backup
cat CUSTOM.BIN | ./switchend > HG556a_backup.bin
Backup the calibration data:
nice ./debrick -backup:custom /window:1EEFE000 /start:1EEFE000 /length:2000 /silent
or for the flash chip MX29LV128DB:
nice ./debrick -backup:custom /window:1EF7E000 /start:1EF7E000 /length:2000 /silent
-
With a serial console we can get some interesting info
About the version and build:
CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE)
Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)
And about the possible boards compatible with this CFE:
CFE>
b
Press: <enter> to use current value
'-' to go previous parameter
'.' to clear the current value
'x' to exit this command
Board Id Name (0-11)
HW6358GW_A ------- 0
HW6358GW_B ------- 1
HW550 ------- 2
HW550_FXO ------- 3
HW553 ------- 4
HW556 ------- 5
HW556aV2 ------- 6
96358VW2 ------- 7
96358VW-16 ------- 8
96358GW ------- 9
96358GW-16 ------- 10
96358M ------- 11 : 5
This is the backup of my bootloader: hg556a_CFE.zip — danitool 2012/01/06 15:39
→ as a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!
No mods yet.
CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE)
Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)
Copyright (C) 2006 Huawei Technologies Co. Ltd.
Boot Address 0xbe000000
Initializing Arena.
Initializing Devices.
@w45260: Flash Manufacture id :c2
@w45260Flash Device id :2201
@w45260flipCFIGeometry:1
Parallel flash device: name , id 0x2201, size 16384KB
*** GetHG556aBoardVersion = <0> ***
CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
Total memory: 67108864 bytes (64MB)
Total memory used by CFE: 0x80401000 - 0x8052A510 (1217808)
Initialized Data: 0x8041F3C0 - 0x80421B60 (10144)
BSS Area: 0x80421B60 - 0x80428510 (27056)
Local Heap: 0x80428510 - 0x80528510 (1048576)
Stack Area: 0x80528510 - 0x8052A510 (8192)
Text (code) segment: 0x80401000 - 0x8041F3B4 (123828)
Boot area (physical): 0x0052B000 - 0x0056B000
Relocation Factor: I:00000000 - D:00000000
*** GetHG556aBoardVersion = <0> ***
Board IP address : 192.168.1.1
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id Name : HW556
Psi size in KB : 64
Number of MAC Addresses (1-32) : 14
Base MAC Address : 5c:4c:a9:6e:4a:a2
Ethernet PHY Type : Internal
Memory size in MB : 64
CMT Thread Number : 1
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 110
boot kernel from be9b2100
Code Address: 0x80010000, Entry Address: 0x8022a018
Decompression OK!
Entry at 0x8022a018
Closing network.
Starting program at 0x8022a018
Linux version 2.6.8.1 (root@IBM_x346) (gcc version 3.4.2) #2 Wed Jun 9 14:58:23 CST 2010
@w45260: Flash Manufacture id :c2
@w45260Flash Device id :2201
@w45260flipCFIGeometry:1
Parallel flash device: name , id 0x2201, size 16384KB
Total Flash size: 16384K with 128 sectors
Board id is set HW556, ucHardwareType 0
fInfo.flash_wlanparam_start_blk = 119
fInfo.flash_wlanparam_number_blk = 1
fInfo.flash_wlanparam_length = 0x2000
fInfo.flash_wlanparam_blk_offset = 0x1e000
HW556 prom init
CPU revision is: 0002a010
Determined physical RAM map:
memory: 03f91920 @ 00000000 (usable)
On node 0 totalpages: 16273
DMA zone: 16273 pages, LIFO batch:3
Normal zone: 0 pages, LIFO batch:1
HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd
brcm mips: enabling icache and dcache...
Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 16kB 2-way, linesize 16 bytes.
PID hash table entries: 256 (order 8: 2048 bytes)
Using 150.000 MHz high precision timer.
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x81099cc0 SIZE=732896, INIT=0x0 SIZE=0
Memory: 61212k/65092k available (1828k kernel code, 3816k reserved, 319k data, 76k init, 0k highmem)
Calibrating delay loop... 299.00 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction... unavailable.
softirq policy:0
softirq nice:0, prio:120
NET: Registered protocol family 16
Can't analyze prologue code at 801d7a94
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
NTFS driver 2.1.15 [Flags: R/O].
Initializing Cryptographic API
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v1.0
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
ehci_hcd 0000:00:0a.0: EHCI Host Controller
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: irq 18, pci mem c0000300
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
PCI: cache line size of 32 is not supported by device 0000:00:0a.0
ehci_hcd 0000:00:0a.0: USB f.f enabled, EHCI 1.00, driver 2004-May-10
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: 2004 Feb 02 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI)
ohci_hcd: block sizes: ed 64 td 64
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ohci_hcd 0000:00:09.0: OHCI Host Controller
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: irq 13, pci mem c0002400
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
drivers/usb/serial/usb-serial.c: USB Serial support registered for Generic
usbcore: registered new driver usbserial_generic
usbcore: registered new driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial Driver core v2.0
brcmboard: brcm_board_init entry
SES: Button GPIO 0x8009 is enabled
SES: LED GPIO 0x8009 is enabled
@@Board@@ GetHarewareType = 0x0
bcm963xx_serial driver v2.0
u32 classifier
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 8192)
Initializing IPsec netlink socket
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
NET: Registered protocol family 8
NET: Registered protocol family 20
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
cfi_flash_sched_init!!!
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 76k freed
usb 1-1: new high speed USB device using address 2
hub 1-1:1.0: USB hub found
hub 1-1:1.0: 2 ports detected
init started: BusyBox v1.00 (2010.06.09-07:05+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5
BusyBox v1.00 (2010.06.09-07:05+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
Loading drivers and kernel modules...
fuse init (API version 7.8)
fuse distribution version: 2.7.3
atmapi: module license 'Proprietary' taints kernel.
blaadd: blaa_detect entry
adsl: adsl_init entry
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6358A1 Ethernet Network Device v0.3 Jul 14 2010 19:38:55
Config Ethernet Switch Through MDIO Pseudo PHY Interface
dgasp: kerSysRegisterDyingGaspHandler: eth0 registered
eth0: MAC Address: 5C:4C:A9:6E:4A:A2
DSP Driver: DSP init stub
Endpoint: endpoint_init entry
BOS: Enter bosInit
Enter bosAppInit
Exit bosAppInit
BOS: Exit bosInit
Endpoint: GetHarewareType <0>
Endpoint: endpoint_init COMPLETED
drivers/usb/serial/usb-serial.c: USB Serial support registered for option1
usbcore: registered new driver option
drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1
147
eth0 Link UP.
ip is 192.168.0.1mask is 255.255.255.0, ipbegin is 192.168.0.192, ipend is 192.168.0.254
===7163=attrvalue is 2 set to 104
===7163=attrvalue is 2 set to 104
xmlGetDhcpHostNameNode(appName dhcphostname, objName Entry, attrName option12, attrValue Huawei-HG556a
==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492==
xmlEndIgmpProxyNode(calling cfm to get appName igmpproxy, objName proxy_node)
==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492==
==IpExt:psixml.cpp:xmlGetPppAttr:14204:mac is ==
value is 0
BcmDb_setSecEnblCfg :fw_enable 0, inflt 0, outflt 0, macflt 0, macmngr 0, nat_enable 1
===7163=attrvalue is 2 set to 104
===7163=attrvalue is 2 set to 104
xmlGetDhcpHostNameNode(appName dhcphostname, objName Entry, attrName option12, attrValue Huawei-HG556a
==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492==
xmlEndIgmpProxyNode(calling cfm to get appName igmpproxy, objName proxy_node)
==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492==
==IpExt:psixml.cpp:xmlGetPppAttr:14204:mac is ==
value is 0
BcmAdsl_Initialize=0xC0066438, g_pFnNotifyCallback=0xC007F3F4
AnnexCParam=0x7FFF7EA8 AnnexAParam=0x00003987 adsl2=0x00000003
pSdramPHY=0xA3FFFFF8, 0x150EA5 0xDEADBEEF
AdslCoreHwReset: AdslOemDataAddr = 0xA3FFBB64
AnnexCParam=0x7FFF7EA8 AnnexAParam=0x00003987 adsl2=0x00000003
dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered
atmapi: prioritize receive packets
ip_tables: (C) 2000-2002 Netfilter core team
ip_conntrack version 2.1 (508 buckets, 0 max) - 368 bytes per conntrack
ip_conntrack_pptp version 2.1 loaded
ip_nat_pptp version 2.0 loaded
==> Bcm963xx Software Version: V100R001C10B050SP01 <==
device eth0 entered promiscuous mode
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
*******go there ,the pOption66 is *******:
*******go there the pOption67 is ********:
*******go there the pOption160 is *******:
getopt returned char k
setIndexName3
pvc2684d: Interface "nas_0_44" created sucessfully
setIndexName3
pvc2684d: Communicating over ATM 0.0.44, encapsulation: LLC
setIndexName3
pvc2684d: Interface "ipa_0_34" created sucessfully
setIndexName3
pvc2684d: Communicating over ATM 0.0.34, encapsulation: LLC
Open file fail in Function: BcmNtwk_initWandevice eth0 left promiscuous mode
br0: port 1(eth0) entering disabled state
device eth0 entered promiscuous mode
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
in bcmmac_init
acbuf is null
init syslog is end
Sean@WLAN CHIP Vendor=, ProductId=<0xff1d>
ath_hal: 0.9.14.25 (<7>AR5212<7>, AR5416<7>, RF5111<7>, RF5112<7>, RF2413<7>, RF5413<7>, DEBUG<7>)
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
wlan: 0.8.4.2 (Atheros/multi-bss)
ath_rate_atheros: Version 2.0.1
Copyright (c) 2001-2004 Atheros Communications, Inc, All Rights Reserved
ath_pci: 0.9.4.5 (Atheros/multi-bss)
ath_pci: CR-LSDK-1.3.1.71
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
Chan Freq RegPwr HT CTL CTL_U CTL_L DFS
1 2412n 20 HT20 1 0 1 N
1 2412n 20 HT40 1 0 1 N
2 2417n 20 HT40 1 0 1 N
3 2422n 20 HT40 1 1 1 N
4 2427n 20 HT40 1 1 1 N
5 2432n 20 HT40 1 1 1 N
6 2437n 20 HT40 1 1 1 N
7 2442n 20 HT40 1 1 1 N
8 2447n 20 HT40 1 1 1 N
9 2452n 20 HT40 1 1 1 N
10 2457n 20 HT40 1 1 1 N
11 2462n 20 HT40 1 1 1 N
12 2467n 20 HT40 1 1 0 N
13 2472n 20 HT40 1 1 0 N
dfs_init_radar_filters: dfs->dfs_rinfo.rn_numradars: 0
DFS min filter rssiThresh = 21
DFS max pulse dur = 131 ticks
wifi0: 11ng rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wifi0: 11ng MCS: 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
wifi0: mac 47.2 phy 13.0<7> radio 12.0<7>
wifi0: Use hw queue 1 for WME_AC_BE traffic
wifi0: Use hw queue 0 for WME_AC_BK traffic
wifi0: Use hw queue 2 for WME_AC_VI traffic
wifi0: Use hw queue 3 for WME_AC_VO traffic
wifi0: Use hw queue 8 for CAB traffic
wifi0: Use hw queue 9 for beacons
wifi0: Use hw queue 7 for UAPSD
wifi0: Atheros 5416 Owl emulation: mem=0x10000000, irq=39 hw_base=0xb0000000
wlan: mac acl policy registered
WlanSetupAll start
killall: hostapd: no process killed
SIOCGIFFLAGS: No such device
wlanconfig: ioctl: No such device
wlNBwCap[1]wlNCtrlsb[-1]
Set WLAN Radio = 1
==DEBUG==Atheros_SetupOneVAP,4427==bWpaPskMode:1,m_wlMssidVar[AthIndex].wlWep:disabled.
2xMaxPowerLevel: 30 (LEG)
2xMaxPowerLevel: 28 (LEG)
ath0
Setting Max Stations:33
2xMaxPowerLevel: 28 (LEG)
2xMaxPowerLevel: 28 (LEG)
ath_newstate: Resetting VAP dfswait_run
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2412, Flags 10080, PF 0
device ath0 entered promiscuous mode
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2412, Flags 30080, PF 0
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2417, Flags 30082, PF 0
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2422, Flags 30082, PF 0
br0: port 2(ath0) entering disabled state
Send SIG(1) to pid 402 on eth down
2xMaxPowerLevel: 28 (LEG)
ath_newstate: Resetting VAP dfswait_run
br0: port 2(ath0) entering learning state
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2412, Flags 10080, PF 0
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
E+E+E+E+E+hostapd is running.
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2412, Flags 30080, PF 0
register normal.
SIP: can't Retrieve psi object 11 in app Voice when DialPlan table size loading, errno 3
SIP: can't Retrieve psi object 13 in app Voice when CallForward table size loading, errno 3
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2417, Flags 30082, PF 0
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2422, Flags 30082, PF 0
original call init_spanish_mib
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2427, Flags 30082, PF 0
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2432, Flags 30082, PF 0
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2437, Flags 30082, PF 0
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2442, Flags 30082, PF 0
BOS: Enter bosInit
bosTimerInit
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2447, Flags 30082, PF 0
Enter bosAppInit
Exit bosAppInit
BOS: Exit bosInit
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2452, Flags 30082, PF 0
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2457, Flags 30082, PF 0
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2462, Flags 30082, PF 0
[DMM]:Endpoit(3) receives an error digitmap string!, file = Dmm.c, line = 2371
UNSPT
^
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2467, Flags 30082, PF 0
SipMsgThread MsgThread pid=605
------------------------------------------------------------
at 946684845.994999 *** Received signal 18 on thread with PID 601
------------------------------------------------------------
------------------------------------------------------------
at 946684846.059999 *** Received signal 18 on thread with PID 601
------------------------------------------------------------
------------------------------------------------------------
at 946684846.124999 *** Received signal 18 on thread with PID 601
------------------------------------------------------------
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2472, Flags 30082, PF 0
------------------------------------------------------------
at 946684846.199999 *** Received signal 18 on thread with PID 601
------------------------------------------------------------
Process[voice] set voip status to [1]Process[voice] set voip status to [0]<7>ath_newstate: Resetting VAP dfswait_run
2xMaxPowerLevel: 28 (LEG)
ath_chan_set: Changing to channel 2412, Flags 10080, PF 0
kernel::endpoint_open
kernel::endpoint_open COMPLETED
PstnInit Success!Created queue HDSP
00:00:46 CALLCLIENT: Initializing endpoints callSipClientMain
voipqosapi: sendto returned -1
sipConfig: sipzParamp=0x7fff7150 sipzParamp->regname= line 59 file hsip.c
sipConfig: sipzParamp=0x7fff7150line 69 file hsip.c
sipConfig: &mgscb=0x1000e9f0line 82 file hsip.c
00:00:46 CALLCLIENT: Initializing endpoints
00:00:46 Endpoint will be initialized for country ESP (country code = 17)
00:00:46 Endpoint Event task started with pid 628...
00:00:46 Endpoint Packet task started with pid 629 ...
Enter bosStartApp
bosAppRootTask() - Is it morning already? Spawning app task (epoch #0)...
bosAppRootTask() - Is it morning already? Spawning app task (epoch #0)...
Enter TaskCreate aoAP
TaskCreate - spawn new task aoAP
Exit TaskCreate
AppResetDetectionEnable() - Enabled reset detection.
Exit bosStartApp
PLL init completed. PLL registers set to:
PCM->pcm_pll_ctrl1 = 0x00020001
PCM->pcm_pll_ctrl2 = 0x0008492B
PCM->pcm_pll_ctrl3 = 0x00001E1C
Set up PCM registers
Channel 0 assigned to timeslot 0
Channel 1 assigned to timeslot 8
Channel 2 assigned to timeslot 1
Channel 3 assigned to timeslot 9
Channel 4 assigned to timeslot 2
Tx Desc (0xA29DE000): chan 0, buf 0, sts 0xe000, len 1280, bufp 0x29f4000
Tx Desc (0xA29DE008): chan 0, buf 1, sts 0x7000, len 1280, bufp 0x29f4510
Rx Desc (0xA28FF000): chan 0, buf 0, sts 0x8000, len 1280, bufp 0x36b7000
Rx Desc (0xA28FF008): chan 0, buf 1, sts 0x9000, len 1280, bufp 0x36b7510
initIudma: chan 0, descBase 0xa28ff000, descBaseIudma 0x28ff000
initIudma: chan 1, descBase 0xa29de000, descBaseIudma 0x29de000
PCM ENABLE INFO: DMA0 IRQ STATUS 0x00000000
PCM ENABLE INFO: DMA0 IRQ MASK 0x00000005
PCM ENABLE INFO: DMA1 IRQ STATUS 0x00000000
PCM ENABLE INFO: DMA1 IRQ MASK 0x00000005
PCM ENABLE INFO: PCM IRQ MASK 0x00000003
PCM ENABLE INFO: PCM IRQ PENDING 0x00000007
Enter TaskCreate CMT_EXCEPTION_IST
TaskCreate - spawn new task CMT_EXCEPTION_IST
Exit TaskCreate
regStatus (reg 12 sel 0) = 0x10008501
regStatus (reg 12 sel 7) = 0x00000101
regCause (reg 13 sel 0) = 0x00000000
regCause (reg 13 sel 7) = 0x00808000
regCMT (reg 22 sel 0) = 0xe30e1006
regCMT (reg 22 sel 1) = 0xe8008003
Kicking off secondary thread processor at entry point 0x81099D00...
Secondary thread processor entry point at 0x81099d00
Thread processor handshake. Secondary app initialized properly.
Enter TaskCreate HTSK
TaskCreate - spawn new task HTSK
Exit TaskCreate
SUCCESS: Took semaphore
SUCCESS: Gave semaphore
INFO: MSPI POLLING MODE
INFO: IRQ MASK 0xa0020424
INFO: IRQ STATUS 0x400000
INFO: BLOCK ENABLES 0x3e0320
MSPI INITIALIZED
HG55VDFA DoControlRelayStatus: disconnect PSTN relay
#########slicLe88221CalDcDc=CH[0]
Read data from Rev ID register: 0x04, 0xB3
@@@@@@@@@@@@SWcal=[0x1]
####normalChan0Cal: 0x08 normalChan1Cal: 0x08
DAA rstGpioPin=25, rlyGpioPin=14
DAA DBG: DAA read failed!!!
DAA DBG: ISOCAP lock count = 0
Si3050 SLAC Initialised, Line side device = Si: 3010 (0xf)
System dev rev: 0xf, Line dev rev: 0xf
Line dev status: FDT:0x1, LCS: 0x1f
DAA initialized with country code 17
Detect FXO Chip Failed...
Skip daa6358Si3050SetFlyMode due to Not Si3050 Detected.
DAA Device Init completed...[19:38:34]
Initialized DAA driver functions at location 0xc0205968
boardHalInit6358: Initialization complete.
boardHalInit completed
Enter TaskCreate HRTBEAT
TaskCreate - spawn new task HRTBEAT
Exit TaskCreate
HEARTBEAT: Initialized!
g_iRtcpInterval = 3000
bosMsgQCreate: Created message queue VRGEVQ at address 0x6000c
Enter TaskCreate VRGEVPR
TaskCreate - spawn new task VRGEVPR
Exit TaskCreate
Enter TaskCreate HCAS
TaskCreate - spawn new task HCAS
Exit TaskCreate
Enter TaskCreate DMAW
TaskCreate - spawn new task DMAW
Exit TaskCreate
*** gStartRxDesc[0] = 0xA28FF000
*** gBufferSizeBytes = 1280
*** gStartTxDesc[0] = 0xA29DE000
hal6358PcmInit 263 nextTxDesc = 0xA29DE000
hal6358PcmInit 263 nextTxDesc = 0xA29DE008
hal6358PcmInit 267 Ownership for TX desc not set. Use this buffer.
PERF->IrqMask = 0xA0020424
PERF->IrqMask1 = 0x00800000
Default value for provItemId '226' did not exist
ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x50) of type: 0x0
ENDPT: Setting T.38 error correction mode for vhd 80 to 0x104
ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x51) of type: 0x0
ENDPT: Setting T.38 error correction mode for vhd 81 to 0x104
ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x52) of type: 0x0
ENDPT: Setting T.38 error correction mode for vhd 82 to 0x104
ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x53) of type: 0x0
ENDPT: Setting T.38 error correction mode for vhd 83 to 0x104
bosMsgQCreate: Created message queue PSTN_CTL_EVQ at address 0x6800d
Enter TaskCreate PSTN
TaskCreate - spawn new task PSTN
Exit TaskCreate
pstnCtlInit successful
dgasp: kerSysRegisterDyingGaspHandler: endpoint registered
@@DoVrgEndptInit reInjecitonMode=<0x0>.
00:00:50
Enter vrgEndptCasTimeParamControl... minHookFlash = 80, maxHookFlash = 250.
ENDPT: EPTYPE_FXS
ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x54) of type: 0x7
Default value for provItemId '74' did not exist
Default value for provItemId '75' did not exist
minHookFlash = 80.
maxHookFlash = 250.
Default value for provItemId '217' did not exist
Default value for provItemId '41' did not exist
Default value for provItemId '66' did not exist
Default value for provItemId '58' did not exist
Default value for provItemId '219' did not exist
ENDPT: Initialization completed successfully for endpt 0
00:00:50 SIGNAL: endpt 0, cnx -1, evt 111 (TxGain), value 0
00:00:50 SIGNAL: endpt 0, cnx -1, evt 112 (RxGain), value 0
ENDPT: EPTYPE_FXS
ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x55) of type: 0x7
Default value for provItemId '74' did not exist
Default value for provItemId '75' did not exist
minHookFlash = 80.
maxHookFlash = 250.
Default value for provItemId '217' did not exist
Default value for provItemId '41' did not exist
Default value for provItemId '66' did not exist
Default value for provItemId '58' did not exist
Default value for provItemId '219' did not exist
ENDPT: Initialization completed successfully for endpt 1
00:00:51 SIGNAL: endpt 1, cnx -1, evt 111 (TxGain), value 0
00:00:51 SIGNAL: endpt 1, cnx -1, evt 112 (RxGain), value 0
ENDPT: EPTYPE_PSTN
ENDPT: hdspVhdOpen PSTN VHD success. DSP 0, VHD (0x56) of type: 0x6
ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x57) of type: 0x7
Default value for provItemId '74' did not exist
Default value for provItemId '75' did not exist
minHookFlash = 80.
maxHookFlash = 250.
Default value for provItemId '217' did not exist
DAA driver * for chan 2 is c0244f90
Default value for provItemId '58' did not exist
Default value for provItemId '219' did not exist
DAA driver * for chan 2 is c0244f90
DAA driver * for chan 2 is c0244f90
DAA: Skip cmd[1] due to on the fly <0>,<0>...
ENDPT: Initialization completed successfully for endpt 2
00:00:51 RTP read thread started with pid 639
00:00:51 RTP read thread started with pid 640
00:00:51 RTP read thread started with pid 641
00:00:51 RTP read thread started with pid 642
00:00:51 RTCP thread started with pid 643
00:00:51 rtpInit: RTCP task created, taskId = 14351
00:00:51 ccPstnInit: Init PSTN module with dial-plan =
00:00:51 gwPstnSignal: signal-67, action-0x1, value--1
ENDPT: Enable PSTN EC.
ENDPT: ECAN Enabled for endpt 2
00:00:51 gwPstnSignal (call setup): value =
00:00:51 gwPstnSignal: signal-63, action-0x554890, value--1
vrgEndptSignal (EPSIG_PSTNCALLSETUP)
00:00:51 gwPstnSignal: signal-66, action-0x1, value--1
CMTD_CTL: Using default settings
CMTD_CTL: setFilterCoeff: filtSize79
Seized PSTN line 2
ConnectSB: connecting line2 and line0
DAA: Skip cmd[2] due to on the fly <0>,<0>...
00:00:51 gwPstnSignal: signal-68, action-0x1, value--1
ENDPT: Disable PSTN EC.
ENDPT: ECAN disabled for endpt 2
00:00:51 gwPstnSignal: signal-65, action-0x1, value--1
Released PSTN line 2
DisconnectSB: disconnecting line0 and line2
DAA: Skip cmd[0] due to on the fly <0>,<0>...
00:00:51 CALLCLIENT: Initialization complete callSipClientMain
00:00:51 ccPublishSipEventCB: event 0
PSTN_CTL: cmtdCtlConfigFilter success vhd=0x56
Enter TaskCreate TM56
TaskCreate - spawn new task TM56
Exit TaskCreate
PSTN_CTL: timerTaskMain timer task started, timeout = 5000
Get Resource file size = [779725]
@@@@Voice@@@FXO Chip Dectected result = <0>.
00:00:53
====== HSPA voice Read Thread start ======
======start No voice process 10 times=====
mkdir: Cannot create directory `/var/mnt/USBDisk_1/twonkymedia.db': No such file or directory
DLNA:syscall.c:startDlna:5682:twonkymedia.db can't be created![10]
initDeviceAssociation(entry): BcmCfm_ManageableDeviceTbl 0
initDeviceAssociation(): fopen /var/udhcpd/manageable.device failed): return error
kill: Could not kill pid '65535': No such process
Scratch pad is not initialized.
Enter TaskEnterShutdown (task=TM56)
Exit TaskEnterShutdown (task=TM56)
Enter bosTaskDestoryR, taskId = 82a38928
PSTN_CTL: cmtdCtlDisable success vhd=0x56
PstnEventCallback: PSTN_CTL_EVT_CPTONE_TIMEOUT
No scratch pad found. Initialize scratch pad...
telnet function started!
==DHCPD:files.c:write_dnsconf:498:==
==DHCPD:files.c:write_dnsconf:523:BUF[address=/#/192.168.0.1
]==
Can't get dns's pid
URL Filer: open rule file failed!
==DNS:option.c:read_opts:2064:conffile is /var/dnsmasq.conf==
==DNS:option.c:one_file:1870file is /var/dnsmasq.conf:==
==DNS:option.c:one_opt:968:arg is /#/192.168.0.1==
BcmWL_createAutoCfgSwTsk Called...
BcmWL_createAutoCfgSwTsk Success[1026]...
Sean@WLAN CHIP Vendor=, ProductId=<0xff1d>
==HTTPD:httpd.c:webmain:2996:ATHEROS:VHG==
==MTU:ifcuiweb.cpp:BcmWeb_getWanConInfo:1350:1492,1492,==
NTWK_INTF wanObjIndex=2, attachToIndex=1
IFC_ATM_VCC =255/65535
NTWK_INTF wanObjIndex=3, attachToIndex=2
IFC_ATM_VCC =0/44
NTWK_INTF wanObjIndex=4, attachToIndex=3
IFC_ATM_VCC =0/34
Flash Write confliction, wait...
Flash Write confliction, wait...
Line:150=====start up mac=5c:4c:a9:6e:4a:a2
Line:153=====syspwd=VF-EShg556
Flash Write confliction, wait...
Flash Write confliction, wait...
NTWK_INTF wanObjIndex=5, attachToIndex=4
IFC_ATM_VCC =0/33
Flash Write confliction, wait...
Flash Write confliction, wait...
language option, user:es_ES admin:en_US
IFC_ATM_VCC =255/65535
IFC_ATM_VCC =0/44
IFC_ATM_VCC =0/34
IFC_ATM_VCC =0/33
SSDP server socket OK!
Found INET
Found INET
Device=br0
nmbd: not found
Init port is 80
bcmIsDataPvc: ppp_255_65535_1 data ifc
Cwmp initing...
paraattribute name is HG553VF
bcmIsDataPvc: nas_0_44 data ifc(Data)
PPP@WLAN CHIP Vendor=, ProductId=<0xff1d>
Voice channel Query
[CwmpReadLoadInfoFromFlash,230]=======acTmp:ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ========
[CwmpReadLoadInfoFromFlash,245]=======pulErrCode:0,pcCmdkey:========
==DEBUG==BcmSipRegisterQuery 7426==stsOld:0,stsHspa:0,iHspaDomain:0,usVoiceChannel:1,iSipChannel:0,iVoiceRegister:0,glbAdslRegState:0,glbHspaRegState:0
sDeviceCount is 0 sSimExist is -1
Voice channel Query
==DEBUG==BcmSipRegisterQuery 7426==stsOld:0,stsHspa:0,iHspaDomain:0,usVoiceChannel:1,iSipChannel:0,iVoiceRegister:0,glbAdslRegState:0,glbHspaRegState:0
sDeviceCount is 0 sSimExist is -1
sigWanDownProcess
cDataMode is 0
AdslCoreEcUpdTmr: timeMs=1800225 ecUpdMask=0x40000
CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE)
Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)
Copyright (C) 2006 Huawei Technologies Co. Ltd.
Boot Address 0xbe000000
Initializing Arena.
Initializing Devices.
@w45260: Flash Manufacture id :c2
@w45260Flash Device id :2201
@w45260flipCFIGeometry:1
Parallel flash device: name , id 0x2201, size 16384KB
*** GetHG556aBoardVersion = <0> ***
CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
Total memory: 67108864 bytes (64MB)
Total memory used by CFE: 0x80401000 - 0x8052A510 (1217808)
Initialized Data: 0x8041F3C0 - 0x80421B60 (10144)
BSS Area: 0x80421B60 - 0x80428510 (27056)
Local Heap: 0x80428510 - 0x80528510 (1048576)
Stack Area: 0x80528510 - 0x8052A510 (8192)
Text (code) segment: 0x80401000 - 0x8041F3B4 (123828)
Boot area (physical): 0x0052B000 - 0x0056B000
Relocation Factor: I:00000000 - D:00000000
*** GetHG556aBoardVersion = <0> ***
Board IP address : 192.168.1.1
Host IP address : 192.168.1.35
Gateway IP address :
Run from flash/host (f/h) : h
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id Name : HW556
Psi size in KB : 64
Number of MAC Addresses (1-32) : 14
Base MAC Address : 5c:4c:a9:6e:4a:a2
Ethernet PHY Type : Internal
Memory size in MB : 64
CMT Thread Number : 1
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 110
0x80010000/2739096 0x802acb98/159768 Entry at 0x8021e9f0
Closing network.
Starting program at 0x8021e9f0
[ 0.000000] Linux version 2.6.39.4 (dani@tool) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #22 Sat Dec 31 02:13:30 CET 2011
[ 0.000000] Detected Broadcom 0x6358 CPU revision a1
[ 0.000000] CPU frequency is 300 MHz
[ 0.000000] 64MB of RAM installed
[ 0.000000] registering 40 GPIOs
[ 0.000000] board_bcm963xx: Boot address 0xbe000000
[ 0.000000] board_bcm963xx: CFE version: 100.48.56-49.46
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 0002a010 (Broadcom BMIPS4350)
[ 0.000000] board_bcm963xx: board name: HW556
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone PFN ranges:
[ 0.000000] Normal 0x00000000 -> 0x00004000
[ 0.000000] Movable zone start PFN for each node
[ 0.000000] early_node_map[1] active PFN ranges
[ 0.000000] 0: 0x00000000 -> 0x00004000
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
[ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
[ 0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[ 0.000000] Memory: 62016k/65536k available (2144k kernel code, 3520k reserved, 369k data, 160k init, 0k highmem)
[ 0.000000] NR_IRQS:128
[ 0.000000] Calibrating delay loop... 299.26 BogoMIPS (lpj=598528)
[ 0.036000] pid_max: default: 32768 minimum: 301
[ 0.040000] Mount-cache hash table entries: 512
[ 0.052000] NET: Registered protocol family 16
[ 0.068000] changed ath9k regdomain to 0xff
[ 0.072000] registering PCI controller with io_map_base unset
[ 0.084000] bio: create slab at 0
[ 0.092000] pci 0000:00:01.0: fixup device configuration
[ 0.096000] pci-ath9k-fixup: Writing 0x0029168c to register 0x6000
[ 0.100000] pci-ath9k-fixup: Writing 0x02800001 to register 0x6008
[ 0.104000] pci-ath9k-fixup: Writing 0x2091168c to register 0x602c
[ 0.108000] pci-ath9k-fixup: Writing 0x002a168c to register 0x5000
[ 0.112000] pci-ath9k-fixup: Writing 0x02800001 to register 0x5008
[ 0.116000] pci-ath9k-fixup: Writing 0x2091168c to register 0x502c
[ 0.120000] pci-ath9k-fixup: Writing 0x05040cc0 to register 0x5064
[ 0.124000] pci-ath9k-fixup: Writing 0x00033811 to register 0x506c
[ 0.128000] pci-ath9k-fixup: Writing 0x0040073b to register 0x4004
[ 0.132000] pci-ath9k-fixup: Writing 0x00000003 to register 0x4074
[ 0.136000] pci-ath9k-fixup: Writing 0x01c20000 to register 0x4000
[ 0.140000] pci-ath9k-fixup: Writing 0x00000044 to register 0x6034
[ 0.144000] pci-ath9k-fixup: Device vendor 0x168c, id 0x0029
[ 0.164000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x3000ffff]
[ 0.168000] pci 0000:00:01.0: BAR 0: set to [mem 0x30000000-0x3000ffff] (PCI address [0x30000000-0x3000ffff])
[ 0.172000] Switching to clocksource MIPS
[ 0.184000] NET: Registered protocol family 2
[ 0.188000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.196000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.204000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.212000] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.216000] TCP reno registered
[ 0.220000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.228000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.236000] NET: Registered protocol family 1
[ 0.240000] audit: initializing netlink socket (disabled)
[ 0.248000] type=2000 audit(0.248:1): initialized
[ 0.256000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.260000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.272000] msgmni has been set to 121
[ 0.276000] io scheduler noop registered
[ 0.280000] io scheduler deadline registered (default)
[ 0.288000] bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0100 (irq = 10) is a bcm63xx_uart
[ 0.296000] console [ttyS0] enabled, bootconsole disabled
[ 0.296000] console [ttyS0] enabled, bootconsole disabled
[ 0.312000] bcm963xx-flash bcm963xx-flash.0: 0x02000000 at 0x1e000000
[ 0.316000] bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x00227e
[ 0.328000] Amd/Fujitsu Extended Query Table at 0x0040
[ 0.332000] Amd/Fujitsu Extended Query version 1.3.
[ 0.340000] Using buffer write method
[ 0.340000] Silicon revision: 10
[ 0.344000] Address sensitive unlock: Required
[ 0.352000] Erase Suspend: Read/write
[ 0.356000] Block protection: 1 sectors per group
[ 0.360000] Temporary block unprotect: Not supported
[ 0.364000] Block protect/unprotect scheme: 8
[ 0.368000] Number of simultaneous operations: 0
[ 0.376000] Burst mode: Not supported
[ 0.376000] Page mode: 8 word page
[ 0.380000] Vpp Supply Minimum Program/Erase Voltage: 9.5 V
[ 0.388000] Vpp Supply Maximum Program/Erase Voltage: 10.5 V
[ 0.392000] Top/Bottom Boot Block: Uniform, Top WP
[ 0.400000] number of CFI chips: 1
[ 0.404000] bcm963xx_flash: Read Signature value of CFE1CFE1
[ 0.408000] bcm963xx-flash bcm963xx-flash.0: CFE bootloader detected
[ 0.416000] bcm963xx_flash: CFE boot tag found with version 8 and board type HW556
[ 0.424000] bcm963xx_flash: Partition 0 is CFE offset 0 and length 20000
[ 0.428000] bcm963xx_flash: Partition 1 is kernel offset 20100 and length dff00
[ 0.436000] bcm963xx_flash: Partition 2 is rootfs offset 100000 and length d00000
[ 0.444000] bcm963xx_flash: Partition 3 is ath_data offset e00000 and length 1e0000
[ 0.452000] bcm963xx_flash: Partition 4 is nvram offset fe0000 and length 20000
[ 0.460000] bcm963xx_flash: Partition 5 is linux offset 20000 and length de0000
[ 0.468000] bcm963xx_flash: Spare partition is 340000 offset and length ac0000
[ 0.476000] Creating 6 MTD partitions on "bcm963xx":
[ 0.480000] 0x000000000000-0x000000020000 : "CFE"
[ 0.488000] mtd: Giving out device 0 to CFE
[ 0.492000] 0x000000020100-0x000000100000 : "kernel"
[ 0.500000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[ 0.512000] mtd: Giving out device 1 to kernel
[ 0.520000] 0x000000100000-0x000000e00000 : "rootfs"
[ 0.528000] mtd: Giving out device 2 to rootfs
[ 0.532000] mtd: partition "rootfs" set to be root filesystem
[ 0.540000] mtd: partition "rootfs_data" created automatically, ofs=340000, len=AC0000
[ 0.548000] 0x000000340000-0x000000e00000 : "rootfs_data"
[ 0.556000] mtd: Giving out device 3 to rootfs_data
[ 0.564000] 0x000000e00000-0x000000fe0000 : "ath_data"
[ 0.568000] mtd: Giving out device 4 to ath_data
[ 0.576000] 0x000000fe0000-0x000001000000 : "nvram"
[ 0.584000] mtd: Giving out device 5 to nvram
[ 0.588000] 0x000000020000-0x000000e00000 : "linux"
[ 0.596000] mtd: Giving out device 6 to linux
[ 0.608000] bcm63xx-wdt bcm63xx-wdt.0: started, timer margin: 30 sec
[ 0.624000] TCP westwood registered
[ 0.624000] NET: Registered protocol family 17
[ 0.632000] 802.1Q VLAN Support v1.8 Ben Greear
[ 0.636000] All bugs added by David S. Miller
[ 0.648000] mtdblock_open
[ 0.652000] ok
^@[ 0.660000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
[ 0.668000] Freeing unused kernel memory: 160k freed
awk: /proc/cpuinfo: No such file or directory
[ 3.508000] roboswitch: Probing device eth0: found a 5325! It's a 5350.
[ 4.576000] There is already a switch registered on the device 'eth0'
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
- regular preinit -
[ 9.076000] mtdblock_open
[ 9.080000] ok
[ 9.088000] mtdblock_release
[ 9.092000] ok
[ 9.172000] MTDSB: lookup_bdev() returned 0
[ 9.176000] MTDSB: New superblock for device 3 ("rootfs_data")
[ 9.224000] JFFS2 notice: (317) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 5 of xref (0 dead, 2 orphan) found.
[ 9.256000] MTD_open
[ 9.256000] MTD_ioctl
[ 9.260000] MTD_ioctl
[ 9.260000] MTD_close
switching to jffs2
- init -
^@
Please press Enter to activate this console. [ 12.756000] Compat-wireless backport release: compat-wireless-2011-11-29
[ 12.760000] Backport based on wireless-testing.git master-2011-12-01
[ 12.984000] cfg80211: Calling CRDA to update world regulatory domain
[ 13.812000] cfg80211: World regulatory domain updated:
[ 13.816000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 13.824000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 13.832000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 13.844000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
[ 13.852000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 13.860000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
[ 14.532000] SCSI subsystem initialized
[ 14.632000] There is already a switch registered on the device 'eth0'
[ 15.028000] usbcore: registered new interface driver usbfs
[ 15.036000] usbcore: registered new interface driver hub
[ 15.048000] usbcore: registered new device driver usb
[ 16.632000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
[ 16.640000] board_bcm963xx: Setting device platform data
[ 16.652000] ath: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff
[ 16.660000] ath: random mac address will be used: 66:94:cc:56:b8:3c
[ 16.680000] ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xc02e0000, irq=39
[ 16.692000] cfg80211: Calling CRDA for country: JP
[ 16.852000] cfg80211: Regulatory domain changed to country: JP
[ 16.860000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
[ 16.868000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm)
[ 16.876000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (N/A, 2000 mBm)
[ 16.884000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm)
[ 16.892000] cfg80211: (4910000 KHz - 4930000 KHz @ 10000 KHz), (N/A, 2300 mBm)
[ 16.900000] cfg80211: (4910000 KHz - 4990000 KHz @ 40000 KHz), (N/A, 2300 mBm)
[ 16.908000] cfg80211: (4930000 KHz - 4950000 KHz @ 10000 KHz), (N/A, 2300 mBm)
[ 16.916000] cfg80211: (5030000 KHz - 5045000 KHz @ 10000 KHz), (N/A, 2300 mBm)
[ 16.924000] cfg80211: (5030000 KHz - 5090000 KHz @ 40000 KHz), (N/A, 2300 mBm)
[ 16.932000] cfg80211: (5050000 KHz - 5060000 KHz @ 10000 KHz), (N/A, 2300 mBm)
[ 16.940000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (N/A, 2000 mBm)
[ 16.948000] cfg80211: (5250000 KHz - 5330000 KHz @ 40000 KHz), (N/A, 2000 mBm)
[ 16.956000] cfg80211: (5490000 KHz - 5710000 KHz @ 40000 KHz), (N/A, 2300 mBm)
[ 16.996000] Button Hotplug driver version 0.4.1
[ 17.972000] NTFS driver 2.1.30 [Flags: R/O MODULE].
[ 18.520000] PPP generic driver version 2.4.2
[ 18.752000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 19.076000] NET: Registered protocol family 24
[ 19.324000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 19.328000] bcm63xx_ehci bcm63xx_ehci.0: BCM63XX integrated EHCI controller
[ 19.336000] bcm63xx_ehci bcm63xx_ehci.0: new USB bus registered, assigned bus number 1
[ 19.368000] bcm63xx_ehci bcm63xx_ehci.0: irq 18, io mem 0xfffe1300
[ 19.384000] bcm63xx_ehci bcm63xx_ehci.0: USB 2.0 started, EHCI 1.00, overcurrent ignored
[ 19.392000] hub 1-0:1.0: USB hub found
[ 19.396000] hub 1-0:1.0: 2 ports detected
[ 19.712000] nf_conntrack version 0.5.0 (971 buckets, 3884 max)
[ 19.832000] usb 1-1: new high speed USB device number 2 using bcm63xx_ehci
[ 20.220000] hub 1-1:1.0: USB hub found
[ 20.232000] hub 1-1:1.0: 2 ports detected
[ 20.636000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 20.640000] bcm63xx_ohci bcm63xx_ohci.0: BCM63XX integrated OHCI controller
[ 20.648000] bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bus number 2
[ 20.656000] bcm63xx_ohci bcm63xx_ohci.0: irq 13, io mem 0xfffe1400
[ 20.724000] hub 2-0:1.0: USB hub found
[ 20.728000] hub 2-0:1.0: 1 port detected
[ 21.008000] Initializing USB Mass Storage driver...
[ 21.016000] usbcore: registered new interface driver usb-storage
[ 21.020000] USB Mass Storage support registered.
[ 21.232000] input: gpio-buttons as /devices/platform/gpio-buttons.0/input/input0
[ 23.260000] eth0: link forced UP - 100/full - flow control off/off
[ 23.692000] device eth0 entered promiscuous mode
[ 23.780000] br-lan: port 1(eth0) entering forwarding state
[ 23.788000] br-lan: port 1(eth0) entering forwarding state
[ 27.972000] device wlan0 entered promiscuous mode
[ 27.980000] br-lan: port 2(wlan0) entering forwarding state
[ 27.984000] br-lan: port 2(wlan0) entering forwarding state
[ 30.392000] device wlan0 left promiscuous mode
[ 30.396000] br-lan: port 2(wlan0) entering forwarding state
[ 30.688000] device wlan0 entered promiscuous mode
[ 30.692000] br-lan: port 2(wlan0) entering forwarding state
[ 30.696000] br-lan: port 2(wlan0) entering forwarding state
BusyBox v1.19.3 (2011-12-25 13:56:35 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
ATTITUDE ADJUSTMENT (bleeding edge, r29606) ----------
* 1/4 oz Vodka Pour all ingredients into mixing
* 1/4 oz Gin tin with ice, strain into glass.
* 1/4 oz Amaretto
* 1/4 oz Triple sec
* 1/4 oz Peach schnapps
* 1/4 oz Sour mix
* 1 splash Cranberry juice
-----------------------------------------------------
root@OpenWrt:/#
In this table we can see the different geometry of both flash chips:
| GEOMETRY |
S29GL128P10 |
MX29GL128EH |
MX29LV128DB |
| Boot Block |
Uniform, Top WP |
Uniform, Top WP |
Bottom boot |
| region |
1 |
1 |
1 |
2 |
| sectors |
1 - 128 |
1 - 128 |
1 - 8 |
9 - 263 |
| erasesize |
0x20000 |
0x20000 |
0x2000 |
0x10000 |
The location of the ath_data information (starts with 0xA55A) is displayed on bootup. . The fInfo.* values appear to be embedded in the kernel 
Boot log reports:
MX29GL128EH | S29GL128P10
...
Total Flash size: 16384K with 128 sectors
Board id is set HW556, ucHardwareType 0
fInfo.flash_wlanparam_start_blk = 119
fInfo.flash_wlanparam_number_blk = 1
fInfo.flash_wlanparam_length = 0x2000
fInfo.flash_wlanparam_blk_offset = 0x1e000
Based on the geometry in the above table let's calculate the offset:
119*0x20000+0x1e000 = 0xEFE000
If we make a backup of whole flash via JTAG we see it's exactly located at the offset 0xEFE000
MX29LV128DB
...
Total Flash size: 16384K with 263 sectors
Board id is set HW556, ucHardwareType 0
fInfo.flash_wlanparam_start_blk = 254
fInfo.flash_wlanparam_number_blk = 1
fInfo.flash_wlanparam_length = 0x2000
fInfo.flash_wlanparam_blk_offset = 0xe000
Based on the geometry in the above table let's calculate the offset again:
8*0x2000+(254-8)*0x10000+0xe000 = 0xF7E000
My backups hg556a_art.zip — danitool 2012/01/06 15:57
For some Help with the Tags, please have a look here: tags
Back to top
toh/huawei/hg556a.txt · Last modified: 2013/06/10 18:56 by danitool
This text is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.