User Tools

Site Tools


toh:huawei:hg556a

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Previous revision
toh:huawei:hg556a [2012/10/28 18:13]
toh:huawei:hg556a [2015/02/27 14:01] (current)
danitool [OEM easy installation]
Line 1: Line 1:
 ====== Huawei EchoLife HG556a ====== ====== Huawei EchoLife HG556a ======
 +Supported since [[https://​dev.openwrt.org/​changeset/​35011|R35011]].
 +
 The HG556A is an adsl wifi router mainly distributed by Vodafone to their customers. The HG556A is an adsl wifi router mainly distributed by Vodafone to their customers.
  
 +:!: It's a good idea to backup the [[#​cal_data|cal_data]] area at the flash-chip. The WLAN calibration data is specific for your device. ​ If you wipe it accidentally it will be difficult to restore, it cannot be restored by flashing back a vendor firmware.
  
-:!: **WARNING** Before trying to run OpenWRT, do backup the flash, especially the bootloader and the [[#​ath_data|ath_data]] area. The nvram data embedded in the bootloader and the WLAN calibration data in ath_data are specific for your device and difficult to restore otherwise. They cannot be restored by flashing back a vendor firmware. (See [[toh:​linksys:​wag160nv2|WAG160NV2]])+===== Supported Versions =====
  
-<html+^ Board model ^ Wifi chip ^ Vdf Version ​<nowiki>*</​nowiki>​ ^ Serial number (first 5 digits) ^  OpenWrt file (≥CC) ​ ^Flash chip erasesize <​nowiki>​**</​nowiki>​ ^ cal_data offset ^ Supported ^ Notes ^ 
-This is some <span style="​font-size:50%;">inline HTML</span+| **HG55VDFA VER.C** | Atheros AR9223 |  HG556**<color crimson>​A</​color>​**VDFA ​ | 30462, 30605, 30608 |  **A**  | 0x10000 ​ | 0xf7e000 | **Yes** ​ |<color crimson>​ADSL not supported\\ VoiP not supported </​color> ​ | 
-</html>+::: | ::: |  HG556**<​color crimson>B</color>**VDFA ​ | 30562, 30692, 30693, 31300, 30634 |  **B**  | 0x20000 ​ | 0xefe000 | ::: | ::: | 
 +| **HG56BZRB VER.A** ​ | Ralink RT3062F |  HG556**<​color crimson>​C</color>**VDFA ​ | 30695, 30694, 31301, 31507, 30555, 31525, 31935, 31901, 31902 |  **C**  | 0x20000 ​ | 0xeffe00 | **Yes** ​ | ::: |
  
-===== Supported Versions ===== 
  
-Preliminary patches at ticket [[https://dev.openwrt.org/ticket/10741|#​10741]]  +<​nowiki>​*)</​nowiki>​You can check the version from the OEM firmware executing the command: //hwversion show//
-^ Board model ^ Wifi chip ^ Supported ^ Notes ^ +
-| HG55VDFA VER.C   ​| ​ Atheros AR9223 ​ |  **Yes** ​ | - | +
-| HG56BZRB VER.A   ​| ​ Ralink RT3062F ​ |  **Yes** ​ | - |+
  
-About where the wifi calibration data is located in the flash chip see [[#​notes]]. +<nowiki>**)</nowiki>You can check the flash memory chip erasesize with the command (in openwrt): //cat /proc/mtd// 
- +  * 0x20000 = 128 KiB  
-<HTML> +  * 0x10000 = 64 KiB 
-<p style="​overflow:​Auto">​ +<WRAP center round info 60%
-<​table>​ +The important parameters for choosing the correct OpenWrt file firmware are the flash chip **erasesize**,​ and **cal_data offset** 
-<​tr>​ +</WRAP>
-<​td><​IMG SRC="/​_media/​meta/​icons/​tango/dialog-information.png"​></​td>​ +
-<​td>​Currently there are no firmwares for downloads at Openwrt, thus you will need to build it yourself. However you can use the danitool'​s precompiled firmware if you are too lazy for building your own. Use it at your own risk: <​br><​br>​ <a href="​http://files.myopera.com/danitool/linux/hg556a/OpenWrt_hg556a_r30964.zip">​OpenWrt_hg556a_r30964.zip</​a>​ only for HG55VDFA VER.C boards</​td>​ +
-</tr> +
-</table+
-</p> +
-</HTML>+
  
 ===== Hardware Highlights ===== ===== Hardware Highlights =====
 ^ SoC ^ Ram ^ Flash ^ Network ^ USB ^ Serial ^ JTag ^ ^ SoC ^ Ram ^ Flash ^ Network ^ USB ^ Serial ^ JTag ^
 | Broadcom 6358 | 64MiB | 16MiB | 4 x 1| Yes | Yes | Yes | | Broadcom 6358 | 64MiB | 16MiB | 4 x 1| Yes | Yes | Yes |
- 
- 
- 
  
  
Line 42: Line 33:
  
 ==== Flash Layout ==== ==== Flash Layout ====
-Please check out the article [[doc:​techref:​Flash Layout]]. It contains an example and a couple of explanations. +Please check out the article [[doc:​techref:​Flash.Layout]]. It contains an example and a couple of explanations.
- +
-FIXME this is just a draft +
-^ partition ^ name^ function ^ +
-| mtd0 | CFE | bootloader | +
-| mtd1 | kernel | kernel | +
-| mtd2 | rootfs | root file system | +
-| mtd3 | ath_data | wifi calibration data | +
-| mtd4 | nvram | OEM configuration data |+
  
 +^ partition ^ name ^ filesystem ^ description ^
 +| mtd0 | **CFE** | n/a | bootloader |
 +| n/a | n/a | n/a | firmware tag |
 +| mtd1 | **kernel** | RAM executable | kernel |
 +| mtd2 | **rootfs** | squashfs | root |
 +| mtd3 | **rootfs_data** | jffs2 | configuration,​ install new packages |
 +| mtd4 | **cal_data** | n/a | wifi calibration data |
 +| mtd5 | **nvram** | n/a | OEM configuration data |
 +| mtd6 | **linux** | n/a | OpenWrt upgrade |
  
 ==== OEM easy installation ==== ==== OEM easy installation ====
-This section deals with how you install OpenWrt from the device freshly opened. +This section deals with how you install OpenWrt from the device freshly opened.  
-  *Unplug the power cord+ 
 +=== Get the firmware === 
 + 
 +| **Version** | Release date | **firmware link** | **Notes** | 
 +| **Trunk** (unstable) | continuously | [[https://​downloads.openwrt.org/​snapshots/​trunk/​brcm63xx/​generic/​openwrt-HG556a_A-squashfs-cfe.bin|openwrt-HG556a_A-squashfs-cfe.bin]]\\ [[https://​downloads.openwrt.org/​snapshots/​trunk/​brcm63xx/​generic/​openwrt-HG556a_B-squashfs-cfe.bin|openwrt-HG556a_B-squashfs-cfe.bin]]\\ [[https://​downloads.openwrt.org/​snapshots/​trunk/​brcm63xx/​generic/​openwrt-HG556a_C-squashfs-cfe.bin|openwrt-HG556a_C-squashfs-cfe.bin]] | See [[#​Supported_Versions]|supported versions]]. USB and wireless drivers **NOT** included. LuCI web interface **NOT** included.\\ Development version ↔ BUGS, updates | 
 +| **Barrier Breaker** | 2014-10-02 | [[https://​downloads.openwrt.org/​barrier_breaker/​14.07/​brcm63xx/​generic/​openwrt-HW556-squashfs-cfe.bin|openwrt-HW556-squashfs-cfe.bin]] | All versions, LuCI included, USB and wireless drivers **NOT** included | 
 +| **Attitude Adjustment** | 2013-04-25 | [[https://​docs.google.com/​uc?​export=download&​id=0B-EMoBe-_OdBdU5VTHc5Q2o2aEU|hg556a_backport_12.09.zip]] | all versions, unofficial backport, LuCI included, USB and wireless drivers included | 
 +| **Backfire** | 2011-12-21 | [[https://​docs.google.com/​uc?​export=download&​id=0B-EMoBe-_OdBSGRHSjlDb3pjOWM|hg556a_ath_backport_10.03.1.zip]] | only **VER.C** boards, unofficial backport, USB and wireless drivers included | 
 + 
 +=== Installation === 
 +With this procedure you will flash the firmware using the [[doc/​techref/​bootloader|bootloader]] web interface (foolproof) 
 +  *Set a **static IP** on your computer, use 192.168.1.35 (or any compatible),​ and connect the ethernet cable to the router
 +  *Unplug the router'​s ​power cord
   *Press the button labeled as //​RESTART//,​ don't release it yet!   *Press the button labeled as //​RESTART//,​ don't release it yet!
   *Plug the power cord   *Plug the power cord
-  *Wait 10 seconds+  *Wait 12 seconds ​or more
   *Release the //RESTART// button   *Release the //RESTART// button
-  *Browse to http://​192.168.1.1 +  *Browse to http://​192.168.1.1 ​and you should see this screen: {{:​media:​doc:​cfe63xx_web-upgrade.png?​150|}} 
-  *Upload ​.bin file to router +  *Select ​.bin firmware 
-  *Upgrade ​the image+  *Press //Update Software// to start the firmware update process
   *Wait for it to reboot   *Wait for it to reboot
   *Telnet to 192.168.1.1 and set a root password, or browse to http://​192.168.1.1 if LuCI is installed.   *Telnet to 192.168.1.1 and set a root password, or browse to http://​192.168.1.1 if LuCI is installed.
  
 ==== OEM installation using the TFTP method ==== ==== OEM installation using the TFTP method ====
 +  * Connect the [[#​serial|serial]] TTL cable to send commands to CFE for loading the firmware via tftp.
 +  * Start a TFTP server in your PC. Copy the //​**openwrt-HW556-squashfs-cfe.bin**//​ firmware to the server.
 +  * Set the IP at your pc to 192.168.1.35 (or any compatible),​ and connect the ethernet cable to the router.
 +This is a session of flashing via TFTP:
 +<​HTML>​
 +<p style="​padding:​ 10px;​border:​1px solid grey;​height:​350px;​font:​11px/​12px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​DEE4E7">​
 +<​code>​CFE>​ f 192.168.1.35:​openwrt-HW556-squashfs-cfe.bin
 +Loading 192.168.1.35:​openwrt-HW556-squashfs-cfe.bin ...
  
-If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.+Finished loading 2883588 bytes 
 + 
 + 
 +Flashing root file system and kernel at 0xbe020000:  
 + ​~~~~~~~Flag:​ 3  
 + 
 +baseAddr 0xbe000000  
 + 
 +kernelAddr 0xbe020100  
 + 
 +rootfsAddr 0xbe020100  
 + 
 +tagFs 0x80800000  
 + 
 + 
 +. 
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 + 
 + 
 +
 + 
 +Backup flag .  
 + 
 + ​~~~~~~~Flag:​ 1  
 + 
 +
 +*** Image flash done *** ! 
 +Resetting board... 
 + 
 +</​code>​ 
 +</​p>​ 
 +</​HTML>​
  
 ==== Upgrading OpenWrt ==== ==== Upgrading OpenWrt ====
Line 88: Line 151:
 <​code>​ <​code>​
 cd /tmp/ cd /tmp/
-wget http://http://​downloads.openwrt.org/​snapshots/​trunk/​XXX/xxx.abc +wget http://​downloads.openwrt.org/​snapshots/​trunk/​brcm63xx/openwrt-HW556-squashfs-cfe.bin 
-sysupgrade /tmp/xxx.abc+sysupgrade /tmp/openwrt-HW556-squashfs-cfe.bin
 </​code>​ </​code>​
  
Line 96: Line 159:
 <​code>​ <​code>​
 cd /tmp/ cd /tmp/
-wget http://http://​downloads.openwrt.org/​snapshots/​trunk/​XXX/xxx.abc +wget http://​downloads.openwrt.org/​snapshots/​trunk/​brcm63xx/openwrt-HW556-squashfs-cfe.bin 
-mtd write /tmp/xxx.abc linux && reboot</​code>​+mtd write /tmp/openwrt-HW556-squashfs-cfe.bin linux && reboot</​code>​ 
 + 
 +=== CFE Upgrade Process === 
 +This is a clean and safe upgrade, using the booloader web interface. Just use the [[#​oem_easy_installation|OEM installation]] procedure. 
 + 
 +=== Cleaning old garbage === 
 +<WRAP left round important>​ 
 +If after upgrading OpenWrt you get the message: <​code>​jffs2:​ Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes </​code>​ And you can't save changes. Or you are unsure if old data is messing your new firmware. Enter OpenWrt [[#​failsafe_mode|failsafe]] mode if needed. Then execute this command:\\ <​code>​mtd erase -r rootfs_data</​code>​ 
 +</​WRAP>​ 
 + 
 + 
 +==== Original firmware ==== 
 +These are the default passwords in the OEM firmware 
 +^ Firware ^ user ^ password ^ 
 +| new firmwares | advanced | advanced | 
 +| all | emtest | zbbtest | 
 +| spanish versions | admin | VF-EShg556 | 
 +| irish versions | admin | VF-IRhg556 | 
 +| kiwi versions | admin | VF-NZhg556 | 
 + 
 +If you want back to the OEM firmware, once you installed OpenWrt, you can use the OpenWrt Luci web interface for flashing it as a regular firmware. 
 + 
 +It's weird but sometimes OEM firmwares can't be flashed correctly by CFE. Looks like only OEM firmwares with a CFE included in the header are flashed correctly by CFE. 
  
 ===== Basic configuration ===== ===== Basic configuration =====
Line 103: Line 188:
 Set up your Internet connection, configure wireless, configure USB port, etc. Set up your Internet connection, configure wireless, configure USB port, etc.
  
 +As default some firmware versions doesn'​t include wireless drivers. For installing these drivers first give OpenWrt internet access (see [[#​switch_ports_for_vlans]]) and execute: 
 +  * if your router has an Atheros wifi chip: <​code>​opkg update 
 +opkg install kmod-ath9k</​code>​ 
 +  * or, if your router version has a Ralink wifi chip <​code>​opkg update 
 +opkg install kmod-rt2800-pci</​code>​ 
 +  * you may also want to install USB drivers<​code>​opkg install kmod-usb-ohci kmod-usb2</​code>​ 
 +  * If you are using a trunk version, you may want to install luci: <​code>​opkg install luci 
 +/​etc/​init.d/​uhttpd enable</​code>​ 
 + 
 ===== Specific Configuration ===== ===== Specific Configuration =====
 ==== Interfaces ==== ==== Interfaces ====
Line 110: Line 203:
 ^ Interface Name ^ Description ^ Default configuration ^ ^ Interface Name ^ Description ^ Default configuration ^
 | br-lan | LAN & WiFi | 192.168.1.1/​24 |  | br-lan | LAN & WiFi | 192.168.1.1/​24 | 
-| eth0 | LAN ports (1 to 4) | None |  +| eth0 | LAN ports (1 to 4) | bridged ​
-| wlan0 | WiFi | Disabled ​+| wlan0 | WiFi | bridged (disabled) ​
  
 ==== Switch Ports (for VLANs) ==== ==== Switch Ports (for VLANs) ====
-This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 will be the  +This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 (LAN4) ​will be the Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on. 
-Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on. +^ Port label^ Switch port ^ Mode ^ 
-^ Port ^ Switch port ^ Mode ^ + ​LAN1  ​  | lan | 
-LAN 1 | 0 | lan | + ​LAN2  ​  | lan | 
-LAN 2 | 1 | lan | + ​LAN3  ​  | lan |  
-LAN 3 | 2 | lan |  + ​LAN4  ​  | Internet (WAN) 
-LAN 4 | 3 | Internet (WAN) |+|  n/a  |  5t  | to CPU |
  
 <​HTML>​ <​HTML>​
-<div style="​height:​350px;font:10px/13px Georgia, Garamond, Serif;​overflow-y:Auto">​ +<style="​padding: 10px;​border:​1px dashed grey;height:400px;font:9px/11px Georgia, Garamond, Serif;​overflow:​Auto">​ 
-<p style="​">​ +<​code>#​ path: /​etc/​config/​network 
-<​code>​ +LAN4 = WAN
- +
-# path: /​etc/​config/​network +
-port 4 = WAN+
  
 config interface loopback config interface loopback
Line 138: Line 228:
 config interface lan config interface lan
         option type     ​bridge         option type     ​bridge
-        option ifname ​  eth0.0+        option ifname ​  eth0.1
         option proto    static         option proto    static
         option ipaddr ​  ​192.168.1.1         option ipaddr ​  ​192.168.1.1
         option netmask ​ 255.255.255.0         option netmask ​ 255.255.255.0
-        option nat      1 
  
 config interface wan config interface wan
-        option ifname eth0.+        option ifname eth0.2
-        option macaddr 00:​11:​22:​33:​44:​55+
         option proto dhcp          option proto dhcp 
-        option defaultroute 1 
- 
  
 config switch eth0 config switch eth0
Line 158: Line 244:
 config switch_vlan config switch_vlan
  option device eth0  option device eth0
- option vlan 0+ option vlan 1
  option ports "0 1 2 5t"  option ports "0 1 2 5t"
  
 config switch_vlan config switch_vlan
  option device eth0  option device eth0
- option vlan 1+ option vlan 2
  option ports "3 5t"  option ports "3 5t"
 +</​code></​p>​
 +</​HTML>​
  
 +==== Main Core ====
 +The BCM6358 SoC has two CPU cores. Unfortunately Linux kernel can only manage one core. The TLB is shared ​ between the two cores, and there isn't code to deal with this problem.
 +
 +As default the second core is the main. Since the cores in BCM6358 have different features, with double icache in the first one, we may want to use it as the main one -> **more icache = better performance**. The problem for using the core0 is the initialization,​ this task is made by the bootloader, not OpenWrt.
 +
 +We can manually hex-edit the bootloader to force initialization of the first core as the Main thread. Or just use this utility in OpenWrt:
 +<WRAP center round download 60%>
 +[[https://​drive.google.com/​uc?​export=download&​id=0B-EMoBe-_OdBREU4TTc2MWZZQVk|tp0set_1.0-1_brcm63xx.ipk]]\\
 +(looks like the binary is only compatible with Barrier Breaker or earlier versions of OpenWrt). Tested dozen times with success.
 +</​WRAP>​
 +
 +Just install it and execute: <​code>​tp0set 0</​code>​ then reboot the router.
 +
 +This is a session of installing and executing **tp0set**
 +<​code>​
 +root@OpenWrt:/​tmp#​ opkg install tp0set_1.0-1_brcm63xx.ipk ​
 +Installing tp0set (1.0-1) to root...
 +Configuring tp0set.
 +root@OpenWrt:/​tmp#​ tp0set 0
 +setting TP0 main core
 +MTD Type: 3
 +MTD total size: 20000 bytes
 +MTD erase size: 20000 bytes
 +Eraseing Block 0
 +Writting to /​dev/​mtd0...
 +Done!!
 +root@OpenWrt:/​tmp#​
 +</​code>​
 +
 +This is what you will see in dmesg:
 +  * Before: ''​[ ​   0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.''​
 +  * After: ''​[ ​   0.000000] Primary instruction cache 32kB, VIPT, 2-way, linesize 16 bytes.''​
 +
 +<wrap hi>Some people reported +15∼20% extra performance with this change.</​wrap>​
 +
 +And this is the source code of //tp0set//
 +<code C>#​include <​stdio.h>​
 +#include <​fcntl.h>​
 +#include <​sys/​ioctl.h>​
 +#include <​mtd/​mtd-user.h>​
 +#include <​string.h>​
 +
 +#define DATA_OFFSET 20
 +#define RAWBYTES_LEN 4
 +
 +int main(int argc, char *argv[])
 +{
 +    mtd_info_t mtd_info; ​          // the MTD structure
 +    erase_info_t ei;               // the erase block structure
 +    int m;
 +    unsigned int rawBytes; //the bytes we want to write
 +    ​
 +    if (argc != 2) {
 +            printf("​Usage:​ tp0set [0/​1]\n"​);​
 +            return 1;
 +    }
 +    ​
 +    m = atoi(argv[1]);​ //convert argument to integer
 +    if( m == 1) {
 +        rawBytes = 0x10000000;
 + printf("​setting TP1 main core\n"​); ​        
 +    }
 +    else if ( m == 0 ) {
 +        rawBytes = 0x00000000;
 + printf("​setting TP0 main core\n"​); ​        
 +    }
 +    else {
 +      ​printf("​only 0 or 1 allowed\n"​);​
 +      ​return 1;
 +    }
 +    ​
 +    unsigned char read_buf[0x20000] = {0x00}; ​   // empty array for reading ​
 +
 +    int fd = open("/​dev/​mtd0",​ O_RDWR); // open the mtd device for reading and 
 +                                        // writing. Note you want mtd0 not mtdblock0
 +                                        // also you probably need to open permissions
 +                                        // to the dev (sudo chmod 777 /dev/mtd0)
 +
 +    ioctl(fd, MEMGETINFO, &​mtd_info); ​  // get the device info
 +
 +    // dump it for a sanity check, should match what's in /proc/mtd
 +    printf("​MTD Type: %x\nMTD total size: %x bytes\nMTD erase size: %x bytes\n",​
 +         ​mtd_info.type,​ mtd_info.size,​ mtd_info.erasesize);​
 +
 +    lseek(fd, 0, SEEK_SET); ​              // go to the first block
 +    read(fd, read_buf, sizeof(read_buf));​ // read and store CFE in read_buf
 +    memcpy(read_buf + DATA_OFFSET,​ (unsigned char*)&​rawBytes,​ RAWBYTES_LEN);​ //write some bytes to CFE
 +    ​
 +    ei.length = mtd_info.erasesize; ​  //set the erase block size
 +    for(ei.start = 0; ei.start < mtd_info.size;​ ei.start += ei.length)
 +    {
 +        ioctl(fd, MEMUNLOCK, &ei);
 +         ​printf("​Eraseing Block %#​x\n",​ ei.start); // show the blocks erasing
 +                                                  // warning, this might print a lot!
 +        ioctl(fd, MEMERASE, &ei);
 +    }
 +
 +    printf("​Writting to /​dev/​mtd0...\n"​);​ // 
 +    lseek(fd, 0, SEEK_SET); ​       // go back to first block'​s start
 +    write(fd, read_buf, ​ sizeof(read_buf));​ // write our modified CFE
 +
 +    close(fd);
 +
 +    printf("​Done!!\n"​);​
 +    ​
 +    return 0;
 +
 </​code>​ </​code>​
-</p> 
-</​div>​ 
-</​HTML>​ 
  
 +The changes survives forever, no matter if we install a new firmware, even erasing totally the previous firmware, since this setting is stored in CFE itself.
  
 +**Note**: You can't use the first core as the Main thread with the OEM firmware, it will cause hardware failure when initializating VoIP hardware stuff.
  
 ==== Failsafe mode ==== ==== Failsafe mode ====
 -> [[doc:​howto:​generic.failsafe]] -> [[doc:​howto:​generic.failsafe]]
  
 +**Openwrt failsafe:** Power on the router, press the button //RESTART// repeatedly to enter failsafe mode (the power led starts blinking very fast)
  
 +**CFE failsafe:** This is for entering in the bootloader command line. Use a [[#​serial|serial]] cable and press any key while loading CFE.
  
 ==== Buttons ==== ==== Buttons ====
 ->​[[doc:​howto:​hardware.button]] ->​[[doc:​howto:​hardware.button]]
-The HG556a has four buttons. ​+ 
 +The HG556a has four buttons.
  
 ^ BUTTON label ^ Event (OEM) ^ GPIO ^ Openwrt name ^ Openwrt code ^ ^ BUTTON label ^ Event (OEM) ^ GPIO ^ Openwrt name ^ Openwrt code ^
-| ? | diagnostic |  8  | diagnostic ​BTN_0 +| ? | diagnostic |  8  |  ​**help**  ​KEY_HELP ​
-| <​nowiki>​(())</​nowiki>​| wifi on/off |  9  | wifi KEY_WPS_BUTTON ​ | +| <​nowiki>​((i))</​nowiki>​| wifi on/off |  9  |  ​**wlan**  ​KEY_WLAN ​ | 
-| RESTART | reboot |  10  | restart | BTN_1 +| RESTART | reboot |  10  |  **restart**  ​KEY_RESTART ​
-| RESET | reset |  11  | reset | KEY_RESTART ​|+| RESET | reset |  11  |  **reset**  ​KEY_CONFIG | 
 + 
 +==== Leds ==== 
 +->​[[doc:​uci:​system#​leds|System configuration:​ Leds]] 
 +^  HG55VDFA VER.C  ^^^^ 
 +^ Label ^^ description ^ GPIO ^ 
 +|  {{:​media:​toh:​huawei:​led-message_red.png?​22&​nolink}} ​ || message ​ |  0  | 
 +|  {{:​media:​toh:​huawei:​led-hspa_red.png?​22&​nolink}} ​    || hspa     ​| ​ 1  | 
 +|  {{:​media:​toh:​huawei:​led-wifi_red.png?​22&​nolink}} ​    || wifi     | n/a | 
 +|  {{:​media:​toh:​huawei:​led-dsl_red.png?​22&​nolink}} ​     || dsl      |  2  | 
 +|  {{:​media:​toh:​huawei:​led-power_red.png?​22&​nolink}} ​   || power    |  3  | 
 +|  n/a                                                  || all      |  6  | 
 +| LAN1 | {{:​media:​toh:​huawei:​led-dot_green.png?​22&​nolink}} |  |  12  | 
 +| :::  | {{:​media:​toh:​huawei:​led-dot_red.png?​22&​nolink}} ​  ​| ​ |  13  | 
 +| LAN2 | {{:​media:​toh:​huawei:​led-dot_green.png?​22&​nolink}} |  |  15  | 
 +| :::  | {{:​media:​toh:​huawei:​led-dot_red.png?​22&​nolink}} ​  ​| ​ |  22  | 
 +| LAN3 | {{:​media:​toh:​huawei:​led-dot_green.png?​22&​nolink}} |  |  23  | 
 +| :::  | {{:​media:​toh:​huawei:​led-dot_red.png?​22&​nolink}} ​  ​| ​ |  26  | 
 +| LAN4 | {{:​media:​toh:​huawei:​led-dot_green.png?​22&​nolink}} |  |  27  | 
 +| :::  | {{:​media:​toh:​huawei:​led-dot_red.png?​22&​nolink}} ​  ​| ​ |  28  | 
 + 
 +^  HG56BZRB VER.A  ^^^^ 
 +^ Label ^^ description ^ GPIO ^ 
 +|  {{:​media:​toh:​huawei:​led-message_red.png?​22&​nolink}} ​ || message ​ |  12  | 
 +|  {{:​media:​toh:​huawei:​led-hspa_red.png?​22&​nolink}} ​    || hspa     ​| ​ 15  | 
 +|  {{:​media:​toh:​huawei:​led-wifi_red.png?​22&​nolink}} ​    || wifi     | n/a | 
 +|  {{:​media:​toh:​huawei:​led-dsl_red.png?​22&​nolink}} ​     || dsl      |  2  | 
 +|  {{:​media:​toh:​huawei:​led-power_red.png?​22&​nolink}} ​   || power    |  3  | 
 +| LAN1 | {{:​media:​toh:​huawei:​led-dot_green.png?​22&​nolink}} |  |  0   | 
 +| :::  | {{:​media:​toh:​huawei:​led-dot_red.png?​22&​nolink}} ​  ​| ​ |  13  | 
 +| LAN2 | {{:​media:​toh:​huawei:​led-dot_green.png?​22&​nolink}} |  |  1   | 
 +| :::  | {{:​media:​toh:​huawei:​led-dot_red.png?​22&​nolink}} ​  ​| ​ |  22  | 
 +| LAN3 | {{:​media:​toh:​huawei:​led-dot_green.png?​22&​nolink}} |  |  23  | 
 +| :::  | {{:​media:​toh:​huawei:​led-dot_red.png?​22&​nolink}} ​  ​| ​ |  26  | 
 +| LAN4 | {{:​media:​toh:​huawei:​led-dot_green.png?​22&​nolink}} |  |  27  | 
 +| :::  | {{:​media:​toh:​huawei:​led-dot_red.png?​22&​nolink}} ​  ​| ​ |  28  ​|
  
 ===== Hardware ===== ===== Hardware =====
 ==== Info ==== ==== Info ====
-| **[[wp>​Instruction set|Architecture]]:**    | [[wp>​MIPS architecture|MIPS]] | +| ^ HG556a A, B (HG55VDFA VER.C) ^ HG556a C (HG56BZRB VER.A) ^ 
-| **Vendor:​** ​         | [[wp>​Broadcom]] | +| **[[wp>​Instruction set]]:** | [[wp>​MIPS architecture|MIPS]] ​|
-| **[[doc:​techref:​Bootloader]]:​** ​    | [[doc:​techref:​bootloader:​CFE|CFE]] | +| **Vendor:​** ​         | [[wp>​Broadcom]] ​|
-| **[[doc:​hardware:​soc|System-On-Chip]]:​** ​ | Broadcom 6358KFBG ​+| **[[doc:​techref:​Bootloader]]:​** ​    | [[doc:​techref:​bootloader:​CFE|CFE]] ​|| 
-| **[[doc:​hardware:​cpu|CPU]]/Speed**        | BMIPS4350 V1.0 300 Mhz | +| **Board Id:**  | HW556 |
-| **Flash-Chip:​** ​     | Macronix MX29GL128EH \\ Macronix MX29LV128DB \\ Spansion S29GL128P10 | +| **[[doc:​hardware:​soc|System-On-Chip]]:​** ​ | BCM6358KFBG |
-| **Flash size:​** ​     | 16 MiB | +| **[[doc:​hardware:​cpu|CPU]] ​@Frq**        | BMIPS4350 V1.0 @300 Mhz  ​[[doc:​hardware:​soc:​soc.broadcom.bcm63xx:​smp|BMIPS Dual Core]] |
-| **RAM:​** ​            | 64 MiB   | +| **Flash-Chip:​** ​     | Macronix MX29GL128EH \\ Macronix MX29LV128DB \\ Spansion S29GL128P10 ​| MX29GL128EHT2I-90G ​
-| **Wireless:​** ​       | Atheros AR9223 802.11b/​g/​n ​\\ Ralink RT3062F 802.11b/g/n | +| **Flash size:​** ​     | 16 MiB |
-| **Ethernet:**        | Broadcom  ​{{:toh:​bcm5325_datasheet.pdf|BCM5325}} ​w/ vlan support [[doc:​uci:​network#​swconfig]] | +| **RAM:​** ​            | [[http://​www.hynix.com/​datasheet/​pdf/​dram/​HY5DU124(8,​16)22D(L)TP(Rev0.1).pdf|HY5DU121622DTP-J]] / DDR-333 ​ | ? | 
-| **Internet:​** ​       | ADSL2+ ​ +| **RAM size:​** ​       ​| 64 MiB   |
-| **VoIP:​** ​       | Zarlink Le88266DLC, ​Si3050 DAA  | +| **Wireless:​** ​       | Atheros AR9223 802.11b/​g/​n ​(onboard) | Ralink RT3062F 802.11b/​g/​n ​(onboard) ​
-| **USB:​** ​            ​| ​2x 2.0  / ​SMSC HUB [[http://​www.smsc.com/​index.php?​tid=295&​pid=19|USB2502-AEZG]] ​\\ 1x 1.+| **Antenna:​**  ​      | 2x, onboard, non detachable || 
-| **[[doc:​hardware:​port.serial|Serial]]:​** ​         | [[#​Serial|Yes]] | +| **[[doc:​hardware:​Switch]]:**        | Broadcom  ​[[http://​wiki.openwrt.org/​_media/​toh/​bcm5325_pinout.png|BCM5325E]] ​w/ vlan support [[doc:​uci:​network#​swconfig]] ​|
-| **[[doc:​hardware:​port.jtag|JTAG]]:​** ​           | [[#​JTAG|Yes]] ​ |+| **Internet:​** ​       | ADSL2+, not supported in OpenWrt |
 +| **VoIP:​** ​           | Zarlink Le88266DLC, ​not supported in OpenWrt ​ |
 +| **USB:​** ​            ​| ​1x2.0 SoC -> 2x2.0 SMSC HUB [[http://​www.smsc.com/​index.php?​tid=295&​pid=19|USB2502-AEZG]] ​| 1x2.0 SoC -> 2x2.0 Genesys HUB [[http://​www.genesyslogic.com/​en/​product_view.php?​show=21|GL850G]] | 
 +| ::: | + 1x 2.0 SoC | + 1x 2.0 SoC | 
 +| **Power adapter:** | 12V DC 2A / APS24W-12V2A-EU |
 +| **[[doc:​hardware:​port.serial|Serial]]:​** ​         | [[#​Serial|Yes]] ​|
 +| **[[doc:​hardware:​port.jtag|JTAG]]:​** ​           | [[#​JTAG|Yes]]  ​| :?: |
  
 ==== Photos ==== ==== Photos ====
 +
 +Photo of front and back of the casing:\\
 +{{:​media:​toh:​huawei:​hg556a-front.jpg?​300x300|}}{{:​media:​toh:​huawei:​hg556a-back.jpg?​300x300|}}
 +
 +==== Opening the case ====
 +**Note:** This will void your warranty!
 +
 +  *To remove the cover:
 +
 +| {{:​media:​toh:​huawei:​hg556a_rcase0.jpg?​200x150|}} | remove the screw hidden under the label at the back of the router |
 +| {{:​media:​toh:​huawei:​hg556a_rcase1.jpg?​200x150|}} | remove the router'​s foot |
 +| {{:​media:​toh:​huawei:​hg556a_rcase2.jpg?​200x150|}} | carefully separate both parts of the casing |
 +=== Photo of PCB ===
 <​sortable>​ <​sortable>​
 ^ HG55VDFA VER.C ^ HG56BZRB VER.A ^ ^ HG55VDFA VER.C ^ HG56BZRB VER.A ^
Line 212: Line 463:
 | {{:​toh:​huawei:​hg556a_board_a.jpg?​400|}} | {{:​toh:​huawei:​hg556a-board_ralink.jpg?​400|}} | | {{:​toh:​huawei:​hg556a_board_a.jpg?​400|}} | {{:​toh:​huawei:​hg556a-board_ralink.jpg?​400|}} |
 |  **Bottom view** ​ |  **Bottom view** ​ | |  **Bottom view** ​ |  **Bottom view** ​ |
-| {{:​toh:​huawei:​hg556a_board_b.jpg?​400|}} | |+| {{:​toh:​huawei:​hg556a_board_b.jpg?​400|}} | {{:​toh:​huawei:​hg556a-board_ralink_b.jpg?​400|}}|
 </​sortable>​ </​sortable>​
  
-==== Opening the case ==== 
-**Note:** This will void your warranty! 
  
-  *To remove the cover do a/b/c 
  
-//Main PCB//+==== Serial ==== 
 +-> [[doc:​hardware:​port.serial]] general information about the serial port, serial port cable, etc.
  
-**Photo of PCB** +How to connect to the Serial Port of this specific device: 
-==== BOOTLOGS ​==== + 
-=== OEM bootlog: ===+| {{:​doc:​hardware:​usbtors232.ttl.jpeg?​100|}} | Use a [[doc/​hardware/​port.serial#​usb.to.rs232.ttl.converter.module|serial TTL]] adapter to connect your PC with HG556a. Only connect TX, RX and GND. | 
 +**Settings:​** 
 +  * Baudrate: 115200 
 +  * Data bits: 8 
 +  * Parity: None 
 +  * Stop bits: 1 
 + 
 +**Photo of PCB with markings** 
 + 
 +{{:​toh:​huawei:​hg556a_serial_ttl.jpg?​400|}} 
 + 
 +With [[http://​cutecom.sourceforge.net/​|Cutecom]] (or other serial console software), open <color blue>/​dev/​ttyUSB0</​color>​ (you must have right permissions). 
 + 
 +==== JTAG ==== 
 +-> [[doc:​hardware:​port.jtag]] general information about the JTAG port, JTAG cable, etc. 
 + 
 +10 pin header marked J400 (see back of board picture below). Uses [[http://​www.jtagtest.com/​pinouts/​avr|AVR JTAG]] layout. Broadcom CPU recognised by TJTAG version 3.0.1 
 + 
 +**Photo of PCB with markings (VER.C)** 
 + 
 +{{:​media:​toh:​huawei:​hg556ac_jtag_j400.jpg?​400x250|}} 
 + 
 +There are several utilities that support BCM6358 for flashing via JTAG cable. In our examples we will use **zJTAG** (ver 1.8) with a **WIGGLER** buffered cable. It is also possible to use a **DLC5** unbuffered cable, but not longer than 15 cm. 
 + 
 + 
 +  * A command to check if our CPU is recognized:​\\ <​code>​./​zjtag -probeonly /​window:​1e000000 /nompi /BE /​wiggler</​code>​ 
 +  * A session of bootloader backup:<​HTML>​ 
 +<p style="​padding:​ 10px;​border:​1px solid grey;​height:​350px;​font:​11px/​12px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​DEE4E7">​ 
 +<​code>#​ ./zjtag -backup:​custom /​window:​1e000000 /​start:​1e000000 /​length:​20000 /nompi /wiggler /BE 
 +                                                                                                                                             
 +        ​============================================== ​                                                                                      
 +               zJTAG EJTAG Debrick Utility v1.8 RC3                                                                                          
 +        ============================================== ​                                                                                      
 +                                                                                                                                             
 +cable=wiggler,​ cabletype=3 ​                                                                                                                  
 +                                                                                                                                             
 +Detected IR chain length = 32                                                                                                                
 +                                                                                                                                             
 +There are 1 device(s) in the JTAG chain                                                                                                      
 + ​IDCODE for device 1 is 0x0635817F (IR length:1)                                                                                             
 +                                                                                                                                             
 +Probing bus ... Done                                                                                                                         
 +                                                                                                                                             
 +Defined IR Length is 5 bits                                                                                                                  
 +                                                                                                                                             
 +CPU assumed running under BIG endian ​                                                                                                        
 +                                                                                                                                             
 +CPU Chip ID: 00000110001101011000000101111111 (0x0635817F) ​                                                                                  
 +*** Found a Broadcom manufactured BCM6358 REV 01 CPU ***                                                                                     
 +                                                                                                                                             
 +    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (0x00818904) ​                                                                 
 +    - EJTAG Version ....... : 1 or 2.0                                                                                                       
 +    - EJTAG DMA Support ... : Yes                                                                                                            
 +    - EJTAG Implementation flags: R4k MIPS16 MIPS32 ​                                                                                         
 +                                                                                                                                             
 +Issuing Processor / Peripheral Reset ... Done                                                                                                
 +Enabling Memory Writes ... Done                                                                                                              
 +Halting Processor ... <​Processor did NOT enter Debug Mode!> ... Done                                                                         
 +Clearing Watchdog ... Done                                                                                                                   
 +Loading CPU Configuration Code ... Skipped ​                                                                                                  
 + 
 +Probing Flash at Address: 0x1E000000 ... 
 +Detected Chip ID (VenID:​DevID ​C27E : 2101) 
 +*** Found a CFI Compatiable Flash Chip from Macronix 
 + 
 +    - Flash Chip Window Start .... : 1E000000 
 +    - Flash Chip Window Length ... : 01000000 
 +    - Selected Area Start ........ : 1E000000 
 +    - Selected Area Length ....... : 00020000 
 + 
 +*** You Selected to Backup the CUSTOM.BIN *** 
 + 
 +========================= 
 +Backup Routine Started 
 +========================= 
 + 
 +Saving CUSTOM.BIN.SAVED_20150207_145734 to Disk... 
 +Done  (CUSTOM.BIN.SAVED_20150207_145734 saved to Disk OK) 
 + 
 +bytes written: 131072 
 +========================= 
 +Backup Routine Complete 
 +========================= 
 +elapsed time: 35 seconds 
 + 
 + 
 + *** REQUESTED OPERATION IS COMPLETE ***</​code>​ 
 +</​p>​ 
 +</​HTML>​ 
 + 
 +  * A session of restoring CFE<​HTML>​ 
 +<p style="​padding:​ 10px;​border:​1px solid grey;​height:​350px;​font:​11px/​12px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​DEE4E7">​ 
 +<​code>#​ ./zjtag -flash:​custom /​window:​1e000000 /​start:​1e000000 /​length:​20000 /wiggler /BE 
 + 
 +        ============================================== 
 +               zJTAG EJTAG Debrick Utility v1.8 RC3 
 +        ============================================== 
 + 
 +cable=wiggler,​ cabletype=3 
 + 
 +Detected IR chain length = 32 
 + 
 +There are 1 device(s) in the JTAG chain 
 + ​IDCODE for device 1 is 0x0635817F (IR length:1) 
 + 
 +Probing bus ... Done 
 + 
 +Defined IR Length is 5 bits 
 + 
 +CPU assumed running under BIG endian 
 + 
 +CPU Chip ID: 00000110001101011000000101111111 (0x0635817F) 
 +*** Found a Broadcom manufactured BCM6358 REV 01 CPU *** 
 + 
 +    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (0x00818904) 
 +    - EJTAG Version ....... : 1 or 2.0 
 +    - EJTAG DMA Support ... : Yes 
 +    - EJTAG Implementation flags: R4k MIPS16 MIPS32 
 + 
 +Issuing Processor / Peripheral Reset ... Done 
 +Enabling Memory Writes ... Done 
 +Halting Processor ... <​Processor Entered Debug Mode!> ... Done 
 +Clearing Watchdog ... Done 
 +Loading CPU Configuration Code ... Skipped 
 +Detecting Flash Base Address... 
 +Read MPI register value : 1E00000C 
 +MPI register show Flash Access Base Addr : 1E000000 
 + 
 +Probing Flash at Address: 0x1E000000 ... 
 +Detected Chip ID (VenID:​DevID = C27E : 2101) 
 +*** Found a CFI Compatiable Flash Chip from Macronix 
 + 
 +    - Flash Chip Window Start .... : 1E000000 
 +    - Flash Chip Window Length ... : 01000000 
 +    - Selected Area Start ........ : 1E000000 
 +    - Selected Area Length ....... : 00020000 
 + 
 +*** You Selected to Flash the CUSTOM.BIN *** 
 + 
 +========================= 
 +Flashing Routine Started 
 +========================= 
 +Total Blocks to Erase: 1 
 + 
 +Erasing block: 1 (addr = 1E000000)...Done 
 + 
 +Loading CUSTOM.BIN to Flash Memory... 
 +Done  (CUSTOM.BIN loaded into Flash Memory OK) 
 + 
 +========================= 
 +Flashing Routine Complete 
 +========================= 
 +elapsed time: 174 seconds 
 + 
 + 
 + *** REQUESTED OPERATION IS COMPLETE *** </​code>​ 
 +</​p>​ 
 +</​HTML>​ 
 +  * Backup the whole flash: ''​./​zjtag -backup:​custom /​window:​1e000000 /​start:​1e000000 /​length:​1000000 /wiggler /​BE''​ 
 +  * Backup the calibration data: ''​./​zjtag -backup:​custom /​window:​1e000000 /​start:​1EEFE000 /​length:​2000 /wiggler /​BE''​\\ or for the flash chip MX29LV128DB: ​ ''​./​zjtag -backup:​custom /​window:​1e000000 /​start:​1EF7E000 /​length:​2000 /wiggler /​BE''​ 
 + 
 +It's also possible to use **UrJTAG**. It's faster compared with HairyDairymaid based software. Sometimes it fails to enter debug mode, but after several attempts, once entered debug mode, it works totally ok. Probably deleting the bootloader before using UrJTAG would help to enter debug mode. Using the nTRST pin would also help to enter debug mode. 
 +  * The following is a session of flashing the bootloader using UrJTAG, it only took one minute included the verification:<​HTML>​ 
 +<p style="​padding:​ 10px;​border:​1px solid grey;​height:​350px;​font:​11px/​12px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​DEE4E7">​ 
 +<​code>​ 
 +# jtag        
 + 
 +UrJTAG 0.10 #2051 
 +Copyright (C) 2002, 2003 ETC s.r.o. 
 +Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors 
 + 
 +UrJTAG is free software, covered by the GNU General Public License, and you are 
 +welcome to change it and/or distribute copies of it under certain conditions. 
 +There is absolutely no warranty for UrJTAG. 
 + 
 +warning: UrJTAG may damage your hardware! 
 +Type "​quit"​ to exit, "​help"​ for help. 
 + 
 +jtag> cable wiggler ppdev /​dev/​parport0 
 +Initializing ppdev port /​dev/​parport0 
 +jtag> detect ​           
 +IR length: 5 
 +Chain length: 1 
 +Device Id: 00000110001101011000000101111111 (0x0635817F) 
 +  Manufacturer:​ Broadcom (0x17F) 
 +  Part(0): ​     BCM6358 (0x6358) 
 +  Stepping: ​    V1 
 +  Filename: ​    /​usr/​share/​urjtag/​broadcom/​bcm6358/​bcm6358 
 +jtag> endian big  
 +jtag> initbus ejtag_dma 
 +ImpCode=00000110001101011000000101111111 
 +EJTAG version: <= 2.0 
 +EJTAG Implementation flags: R4k ASID_6 MIPS16 DMA MIPS64 
 +Clear memory protection bit in DCR 
 +Clear Watchdog 
 +Potential flash base address: [0x0], [0x1e00000c] 
 +Processor successfully switched in debug mode. 
 +jtag> detectflash 0x1e000000 
 +Query identification string: 
 +        Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/​Fujitsu Standard Command Set) 
 +        Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null) 
 +Query system interface information:​ 
 +        Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV 
 +        Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV 
 +        Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV 
 +        Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV 
 +        Typical timeout per single byte/word program: 8 us 
 +        Typical timeout for maximum-size multi-byte program: 64 us 
 +        Typical timeout per individual block erase: 512 ms 
 +        Typical timeout for full chip erase: 524288 ms 
 +        Maximum timeout for byte/word program: 64 us 
 +        Maximum timeout for multi-byte program: 2048 us 
 +        Maximum timeout per individual block erase: 4096 ms 
 +        Maximum timeout for chip erase: 2097152 ms 
 +Device geometry definition:​ 
 +        Device Size: 16777216 B (16384 KiB, 16 MiB) 
 +        Flash Device Interface Code description:​ 0x0002 (x8/x16) 
 +        Maximum number of bytes in multi-byte program: 64 
 +        Number of Erase Block Regions within device: 1 
 +        Erase Block Region Information:​ 
 +                Region 0: 
 +                        Erase Block Size: 131072 B (128 KiB) 
 +                        Number of Erase Blocks: 128 
 +Primary Vendor-Specific Extended Query: 
 +        Major version number: 1 
 +        Minor version number: 3 
 +        Address Sensitive Unlock: Required 
 +        Process Technology: Bad value 
 +        Erase Suspend: Read/​write 
 +        Sector Protect: 1 sectors per group 
 +        Sector Temporary Unprotect: Supported 
 +        Sector Protect/​Unprotect Scheme: Bad value 
 +        Simultaneous Operation: Not supported 
 +        Burst Mode Type: Supported 
 +        Page Mode Type: 8 word Page 
 +        ACC (Acceleration) Supply Minimum: 9500 mV 
 +        ACC (Acceleration) Supply Maximum: 10500 mV 
 +        Top/Bottom Sector Flag: Uniform top boot device 
 +        Program Suspend: Not supported 
 +jtag> flashmem 0x1e000000 cfe6358-nvr.bin 
 +Chip: AMD Flash 
 +        Manufacturer:​ Macronix 
 +        Chip: Unknown (ID 0x227e) 
 +        Protected: 0000 
 +program: 
 +flash_unlock_block 0x1E000000 IGNORE 
 + 
 +block 0 unlocked 
 +flash_erase_block 0x1E000000 
 +flash_erase_block 0x1E000000 DONE 
 +erasing block 0: 0 
 +addr: 0x1E00F6EA 
 +verify: 
 +addr: 0x1E00F6EA 
 +Done. 
 +jtag> 
 +</​code>​ 
 +</​p>​ 
 +</​HTML>​ 
 +==== SPI ==== 
 +**[[wp>​Serial_Peripheral_Interface_Bus|Serial Peripheral Interface]]**  
 + 
 +The BCM6358 SoC has a [[doc/​hardware/​soc/​soc.broadcom.bcm63xx#​spi|SPI]] controller. The HG556a SPI pins are exposed on the board, at the place for a **Si3050** chip which isn't soldered. We can use this SPI interface for connecting our own SPI stuff, but we need to build the kernel with the drivers and proper platform data code for registering the SPI device. This is the pinout: 
 + 
 +{{:​media:​toh:​huawei:​hg556a-spi.jpg?​500x300|}} 
 + 
 +This SPI interface is also connected to the **Le88266** VoiP chip, but using the Slave Select 2 (GPIO32): 
 + 
 +{{:​media:​toh:​huawei:​hg556a-spi_le88266.jpg?​500x300|}} {{:​media:​toh:​huawei:​le88286-pinout.png?​direct&​350x300|}} 
 + 
 +Kernel code example for **spidev** kernel module, the added code is highlighted in green: 
 +<​HTML>​ 
 +<pre class="​code"​ style="​font:​11px/​12px monospace">​ 
 +<font color="​green">​static struct spi_board_info hw556_spi_info[] = { 
 +
 + .bus_num = 0, 
 + .chip_select = 1, 
 + .mode = 0, 
 + .max_speed_hz = 781000, 
 + .modalias = "​spidev",​ 
 + }, 
 +};</​font>​ 
 + 
 +static struct board_info __initdata board_HW556 = { 
 + .name = "​HW556",​ 
 + .expected_cpu_id = 0x6358, 
 + 
 + .has_uart0 = 1, 
 + .has_pci = 1, 
 + .has_ohci0 = 1, 
 + .has_ehci0 = 1, 
 + .num_usbh_ports = 2, 
 + 
 + .has_caldata = 1, 
 + .caldata = { 
 +
 + .caldata_offset = 0xe00000, 
 + }, 
 + }, 
 + 
 + .has_enet1 = 1, 
 + .enet1 = { 
 + .has_phy = 1, 
 + .phy_id = 0, 
 + .force_speed_100 = 1, 
 + .force_duplex_full = 1, 
 + }, 
 + 
 + .leds = { 
 +
 + .name = "​HW556:​red:​message",​ 
 + .gpio = 0, 
 + .active_low = 1, 
 + }, 
 +
 + .name = "​HW556:​red:​hspa",​ 
 + .gpio = 1, 
 + .active_low = 1, 
 + }, 
 +
 + .name = "​HW556:​red:​dsl",​ 
 + .gpio = 2, 
 + .active_low = 1, 
 + }, 
 +
 + .name = "​HW556:​red:​power",​ 
 + .gpio = 3, 
 + .active_low = 1, 
 + .default_trigger = "​default-on",​ 
 + }, 
 +
 + .name = "​HW556:​red:​all",​ 
 + .gpio = 6, 
 + .active_low = 1, 
 + .default_trigger = "​default-on",​ 
 + }, 
 + }, 
 + 
 + .buttons = { 
 +
 + .desc = "​help",​ 
 + .gpio = 8, 
 + .active_low = 1, 
 + .type = EV_KEY, 
 + .code = KEY_HELP, 
 + .debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL,​ 
 + }, 
 +
 + .desc = "​wlan",​ 
 + .gpio = 9, 
 + .active_low = 1, 
 + .type = EV_KEY, 
 + .code = KEY_WLAN, 
 + .debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL,​ 
 + }, 
 +
 + .desc = "​restart",​ 
 + .gpio = 10, 
 + .active_low = 1, 
 + .type = EV_KEY, 
 + .code = KEY_RESTART,​ 
 + .debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL,​ 
 + }, 
 +
 + .desc = "​reset",​ 
 + .gpio = 11, 
 + .active_low = 1, 
 + .type = EV_KEY, 
 + .code = KEY_CONFIG,​ 
 + .debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL,​ 
 + }, 
 + }, 
 +<font color="​green">​ .spis = hw556_spi_info,​ 
 + .num_spis = ARRAY_SIZE(hw556_spi_info),</​font>​ 
 +}; 
 +</​pre>​ 
 +</​HTML>​ 
 + 
 +The SPI controller is able to work with these speeds (kHz): 20000, 12500, 6250, 3125, 1563, 781(default),​ 391 
 + 
 + 
 +  * Demo video connecting a SPI display, (781 kHz):\\ <​HTML><​iframe width="​560"​ height="​315"​ src="//​www.youtube.com/​embed/​3BNs52wyl1s"​ frameborder="​0"​ allowfullscreen></​iframe></​HTML>​\\ using 20 MHz:\\ <​HTML><​iframe width="​560"​ height="​315"​ src="//​www.youtube.com/​embed/​9LltQ8kO2b0"​ frameborder="​0"​ allowfullscreen></​iframe></​HTML>​ 
 + 
 + 
 +===== Debricking ===== 
 +-> [[doc:​howto:​generic.debrick]] 
 + 
 +===== CFE Bootloader ===== 
 +  - you could read about [[doc:​techref:​bootloader]] in general 
 + 
 +With a serial console we can get some interesting info 
 + 
 +About the version and build: 
 + 
 +| <​code>​ CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE) 
 +Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)</​code>​ | 
 + 
 +And about the possible boards compatible with this CFE: 
 +| <​code>​CFE>​  
 +
 +Press: ​ <​enter>​ to use current value 
 + 
 +        '​-'​ to go previous parameter 
 + 
 +        '​.'​ to clear the current value 
 + 
 +        '​x'​ to exit this command 
 + 
 +Board Id Name (0-11)  
 +HW6358GW_A ​      ​------- ​ 0 
 +HW6358GW_B ​      ​------- ​ 1 
 +HW550            ------- ​ 2 
 +HW550_FXO ​       ------- ​ 3 
 +HW553            ------- ​ 4 
 +HW556            ------- ​ 5 
 +HW556aV2 ​        ​------- ​ 6 
 +96358VW2 ​        ​------- ​ 7 
 +96358VW-16 ​      ​------- ​ 8 
 +96358GW ​         ------- ​ 9 
 +96358GW-16 ​      ​------- 10 
 +96358M ​          ​------- 11       : ​ 5  </​code>​ | 
 + 
 +<WRAP round important>​ 
 +**Borked Board ID:**\\  
 +If you play with the CFE settings you may end with messed Board ID which OpenWrt doesn'​t recognize, spite CFE itself is able to read it correctly 
 +</​WRAP>​
  
 <​HTML>​ <​HTML>​
-<p style="​padding:​ 10px;​border:​1px solid grey;​height:​600px;​font:​10px/​14px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​FFFFFF">​+<p style="​padding:​ 10px;​border:​1px solid grey;​height:​350px;font:11px/12px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​DEE4E7">​ 
 +<​code>​CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE) 
 +Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) 
 +Copyright (C) 2006 Huawei Technologies Co. Ltd. 
 + 
 + 
 +Boot Address 0xbe000000 
 + 
 +Initializing Arena. 
 +Initializing Devices. 
 + 
 +@w45260: Flash Manufacture id :c2 
 + 
 +@w45260Flash Device id :2201 
 + 
 +@w45260flipCFIGeometry:​1 
 +Parallel flash device: name , id 0x2201, size 16384KB 
 +*** GetHG556aBoardVersion = <0> *** 
 + 
 +CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz 
 +Total memory: 67108864 bytes (64MB) 
 + 
 +Total memory used by CFE:  0x80401000 - 0x8052A510 (1217808) 
 +Initialized Data:          0x8041F3C0 - 0x80421B60 (10144) 
 +BSS Area:                  0x80421B60 - 0x80428510 (27056) 
 +Local Heap:                0x80428510 - 0x80528510 (1048576) 
 +Stack Area:                0x80528510 - 0x8052A510 (8192) 
 +Text (code) segment: ​      ​0x80401000 - 0x8041F3B4 (123828) 
 +Boot area (physical): ​     0x0052B000 - 0x0056B000 
 +Relocation Factor: ​        ​I:​00000000 - D:​00000000 
 + 
 +*** GetHG556aBoardVersion = <0> *** 
 + 
 +Board IP address ​                 : 192.168.1.1 ​  
 +Host IP address ​                  : 192.168.1.100 ​  
 +Gateway IP address ​               :    
 +Run from flash/host (f/h)         : f   
 +Default host run file name        : vmlinux ​  
 +Default host flash file name      : bcm963xx_fs_kernel ​  
 +Boot delay (0-9 seconds) ​         : 1   
 +Board Id Name                     : HW556   
 +Psi size in KB                    : 64 
 +Number of MAC Addresses (1-32) ​   : 14   
 +Base MAC Address ​                 : 64:​16:​f0:​dd:​f1:​fa ​  
 +Ethernet PHY Type                 : Internal 
 +Memory size in MB                 : 64 
 +CMT Thread Number ​                : 1 
 + 
 +*** Press any key to stop auto run (1 seconds) *** 
 +Auto run second count down: 1\0x081\0x080 
 +boot kernel from be020100 
 +Code Address: 0x80010000, Entry Address: 0x80010000 
 +Decompression OK! 
 +Entry at 0x80010000 
 +Closing network. 
 +Starting program at 0x80010000 
 +[    0.000000] Linux version 3.3.8 (dani@tool) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #2 Mon Feb 9 16:10:39 CET 2015 
 +[    0.000000] Detected Broadcom 0x6358 CPU revision a1 
 +[    0.000000] CPU frequency is 300 MHz 
 +[    0.000000] 64MB of RAM installed 
 +[    0.000000] registering 40 GPIOs 
 +[    0.000000] gpiochip_add:​ registered GPIOs 0 to 39 on device: bcm63xx-gpio 
 +[    0.000000] board_bcm963xx:​ Resetting USB PLL... ​ done 
 +[    0.000000] board_bcm963xx:​ Boot address 0xbe000000 
 +[    0.000000] board_bcm963xx:​ CFE version: 100.48.56-49.46 
 +[    0.000000] board_bcm963xx:​ unknown bcm963xx board: HW556_CW_B 
 +[    0.000000] bootconsole [early0] enabled 
 +[    0.000000] CPU revision is: 0002a010 (Broadcom BMIPS4350) 
 +[    0.000000] Kernel panic - not syncing: unable to detect bcm963xx board 
 +</​code>​ 
 +</​p>​ 
 +</​HTML>​ 
 + 
 +To solve it, enter in the CFE command line and first change the board ID to **96358GW**,​ then reboot and change it again to **HW556**. 
 + 
 +see -> https://​dev.openwrt.org/​ticket/​14063 
 + 
 +===== Hardware mods ===== 
 + -> as a beginner, you really should inform yourself about [[doc:​hardware:​soldering]] in general and then obtain some practical experience! 
 + 
 +No mods yet. 
 + 
 +===== Firmware mods ===== 
 +==== Backports ==== 
 +  * Backfire backport (**10.03.1**). Only HG55VDFA VER.C boards:\\ [[https://​docs.google.com/​uc?​export=download&​id=0B-EMoBe-_OdBSGRHSjlDb3pjOWM|hg556a_ath_backport_10.03.1.zip]] 
 + 
 +  * Attitude Adjustment backport (**12.09**):​\\ [[https://​docs.google.com/​uc?​export=download&​id=0B-EMoBe-_OdBdU5VTHc5Q2o2aEU|hg556a_backport_12.09.zip]] 
 + 
 + 
 +===== BOOTLOGS ===== 
 +==== OEM bootlog: ==== 
 + 
 +<​HTML>​ 
 +<p style="​padding: 10px;border:1px solid grey;​height:​600px;​font:​12px/14px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​FFFFFF">​
 <​code>​CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE) <​code>​CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE)
 Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)
Line 1001: Line 1768:
 </​HTML>​ </​HTML>​
  
-=== Openwrt bootlog: ===+==== Openwrt bootlog: ​====
  
 <​HTML>​ <​HTML>​
-<p style="​padding:​ 10px;​border:​1px solid grey;​height:​600px;​font:​10px/14px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​FFFFFF">​+<p style="​padding:​ 10px;​border:​1px solid grey;​height:​600px;​font:​12px/14px Georgia, Garamond, Serif;​overflow:​Auto;​background-color:#​FFFFFF">​
 <​code>​CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE) <​code>​CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE)
 Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)
Line 1298: Line 2065:
 </​HTML>​ </​HTML>​
  
-==== Serial ==== 
--> [[doc:​hardware:​port.serial]] general information about the serial port, serial port cable, etc. 
- 
-How to connect to the Serial Port of this specific device: 
- 
-**Photo of PCB with markings** 
- 
-{{:​toh:​huawei:​hg556a_serial_ttl.jpg?​400|}} 
- 
-==== JTAG ==== 
--> [[doc:​hardware:​port.jtag]] general information about the JTAG port, JTAG cable, etc. 
- 
-10 pin header marked J400 (see back of board picture below). Uses [[http://​www.jtagtest.com/​pinouts/​avr|AVR JTAG]] layout. Broadcom CPU recognised by TJTAG version 3.0.1 
- 
-**Photo of PCB with markings** 
- 
-{{:​toh:​huawei:​hg556a_jtagj400.jpg?​300|}} 
- 
-We can use [[https://​docs.google.com/​leaf?​id=0B07LcVZMfvdkZTc1MDA5MjUtZTMzYy00OGQzLWE5MjAtODFiN2RkMTJmNDQ5&​sort=name&​layout=list&​num=50|the updated version of debrick on Google Docs]] 
- 
-But we'll need to change a couple of things 
-<code diff> 
---- wrt54g.c 
-+++ wrt54g.c 
-@@ -252,6 +252,7 @@ 
-    { 0x0535217F, 8, "​Broadcom BCM5352 Rev 1 CPU" }, 
-    { 0x0536517F, 8, "​Broadcom BCM5365 Rev 1 CPU" },         // BCM5365 Not Completely Verified Yet 
-    { 0x0634817F, 5, "​Broadcom BCM6348 Rev 1 CPU" },         // is bigendian  ​ 
-+   { 0x0635817F, 5, "​Broadcom BCM6358 Rev 1 CPU" }, //flash base: 0x1e000000 0x1e800000 0x1f000000 0x1f800000 
-    { 0x0634517F, 5, "​Broadcom BCM6345 Rev 1 CPU" },         // BCM6345 Not Completely Verified Yet 
-    { 0x0000100F, 5, "TI AR7WRD TNETD7300GDU Rev 1 CPU" },   // TI AR7WRD Only Partially Verified 
-    { 0x0470417F, 8, "​Broadcom BCM4704 Rev 8 CPU" },         // BCM4704 chip (used in the WRTSL54GS units) 
-@@ -1287,7 +1288,7 @@ 
-     // Default to Standard Flash Window for Detection if not CUSTOM 
-     if (strcasecmp(AREA_NAME,"​CUSTOM"​)==0) 
-          FLASH_MEMORY_START = selected_window;​ 
--    else FLASH_MEMORY_START = 0x1FC00000; 
-+    else FLASH_MEMORY_START = 0x1e000000; 
-  
-     ​printf("​\nProbing Flash at (Flash Window: 0x%08x) ... ", FLASH_MEMORY_START);</​code>​ 
- 
-We can use a unbuffered cable, but not longer than 15 cm. 
- 
-Backup the whole flash: 
-  nice ./debrick -backup:​custom /​window:​1e000000 /​start:​1e000000 /​length:​1000000 /silent 
- 
-Swap bytes for extracting or whatever you want with the backup 
-  cat CUSTOM.BIN | ./switchend > HG556a_backup.bin 
- 
-Backup the calibration data: 
-  nice ./debrick -backup:​custom /​window:​1EEFE000 /​start:​1EEFE000 /​length:​2000 /silent 
-or for the flash chip MX29LV128DB:​ 
-  nice ./debrick -backup:​custom /​window:​1EF7E000 /​start:​1EF7E000 /​length:​2000 /silent 
- 
-===== Debricking ===== 
--> [[doc:​howto:​generic.debrick]] 
- 
-===== CFE Bootloader ===== 
-  - you could read about [[doc:​techref:​bootloader]] in general 
- 
-With a serial console we can get some interesting info 
- 
-About the version and build: 
- 
-  CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE) 
-  Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) 
- 
-And about the possible boards compatible with this CFE: 
-<​code>​CFE> ​ 
-b 
-Press: ​ <​enter>​ to use current value 
- 
-        '​-'​ to go previous parameter 
- 
-        '​.'​ to clear the current value 
- 
-        '​x'​ to exit this command 
- 
-Board Id Name (0-11) ​ 
-HW6358GW_A ​      ​------- ​ 0 
-HW6358GW_B ​      ​------- ​ 1 
-HW550            ------- ​ 2 
-HW550_FXO ​       ------- ​ 3 
-HW553            ------- ​ 4 
-HW556            ------- ​ 5 
-HW556aV2 ​        ​------- ​ 6 
-96358VW2 ​        ​------- ​ 7 
-96358VW-16 ​      ​------- ​ 8 
-96358GW ​         ------- ​ 9 
-96358GW-16 ​      ​------- 10 
-96358M ​          ​------- 11       : ​ 5  </​code>​ 
- 
-This is the backup of my bootloader: [[http://​files.myopera.com/​danitool/​linux/​bootloaders/​hg556a_CFE.zip|hg556a_CFE.zip]] --- //danitool 2012/01/06 15:39// 
- 
-===== Hardware mods ===== 
-  - as a beginner, you really should inform yourself about [[doc:​hardware:​soldering]] in general and then obtain some practical experience! 
  
-==== 128MiB RAM Mod ==== 
-==== I²C GPIO Mod ==== 
-==== I²C Tiny-USB Mod ==== 
  
 ===== Notes ===== ===== Notes =====
  
-==== ath_data ​==== +==== cal_data ​==== 
-In this table we can see the different geometry of both flash chips:+In this table we can see the different geometry of flash chips:
 ^ GEOMETRY ^ S29GL128P10 ^ MX29GL128EH ^  MX29LV128DB ​  ^^ ^ GEOMETRY ^ S29GL128P10 ^ MX29GL128EH ^  MX29LV128DB ​  ^^
 ^ Boot Block |  Uniform, Top WP  |  Uniform, Top WP  |  Bottom boot  ||  ^ Boot Block |  Uniform, Top WP  |  Uniform, Top WP  |  Bottom boot  || 
Line 1409: Line 2077:
 ^ erasesize |  0x20000 ​ |  0x20000 ​ | 0x2000 | 0x10000 | ^ erasesize |  0x20000 ​ |  0x20000 ​ | 0x2000 | 0x10000 |
  
-The location ​of the ath_data information ​(starts with 0xA55A) is displayed on bootup. . The fInfo.* values appear to be embedded in the kernel :?:+The WIFI calibration data location (starts with 0xA55A) is displayed on bootup. . The fInfo.* values appear to be embedded in the kernel :?:
  
 Boot log reports: Boot log reports:
Line 1443: Line 2111:
  
 **//​8*0x2000+(254-8)*0x10000+0xe000 = 0xF7E000//​** **//​8*0x2000+(254-8)*0x10000+0xe000 = 0xF7E000//​**
-\\ \\ \\ 
-My backups [[http://​files.myopera.com/​danitool/​linux/​hg556a_art.zip|hg556a_art.zip]] --- //danitool 2012/01/06 15:57// 
  
 ===== Tags ===== ===== Tags =====
 For some Help with the Tags, please have a look here: [[meta/​tags]] For some Help with the Tags, please have a look here: [[meta/​tags]]
  
-{{tag>​bcm63xx bcm6358 FastEthernet 4Port 3USB ath9k 64RAM 16Flash MIPS MIPS32 ​34K}}+{{tag>​bcm63xx bcm6358 FastEthernet 4Port hwVLAN ​3USB ath9k 802.11bgn NonDetachableAntenna 2Ant 64RAM 16Flash MIPS MIPS32}}
toh/huawei/hg556a.1351444432.txt.bz2 · Last modified: 2012/10/28 18:13 (external edit)