Differences

This shows you the differences between two versions of the page.

toh:huawei:hg556a [2013/01/04 17:33]
toh:huawei:hg556a [2014/06/04 19:37] (current)
danitool
Line 4: Line 4:
The HG556A is an adsl wifi router mainly distributed by Vodafone to their customers. The HG556A is an adsl wifi router mainly distributed by Vodafone to their customers.
-:!: **WARNING** Before trying to run OpenWRT, do backup the flash, especially the bootloader and the [[#ath_data|ath_data]] area. The nvram data embedded in the bootloader and the WLAN calibration data in ath_data are specific for your device and difficult to restore otherwise. They cannot be restored by flashing back a vendor firmware. (See [[toh:linksys:wag160nv2|WAG160NV2]]+:!: It's a good idea to backup the [[#cal_data|cal_data]] area at the flash-chip. The WLAN calibration data is specific for your device.  If you wipe it accidentally it will be difficult to restore, it cannot be restored by flashing back a vendor firmware. 
 +About where the wifi calibration data is located in the flash chip see [[#notes]].
===== Supported Versions ===== ===== Supported Versions =====
-^ Board model ^ Wifi chip ^ Supported ^ Notes ^ +^ Board model ^ Wifi chip ^ Vdf Version <nowiki>*</nowiki> ^ Serial number (first 5 digits) ^ Flash chip erasesize <nowiki>**</nowiki> ^ cal_data offset ^ Supported ^ Notes ^ 
-| HG55VDFA VER.C   | Atheros AR9223  |  **Yes**  | - +| **HG55VDFA VER.C** | Atheros AR9223 |  HG556**<color crimson>A</color>**VDFA | 30462, 30608 0x10000  | 0xf7e000 | **Yes**  |<color crimson>ADSL not supported\\ VoiP not supported </color> 
-| HG56BZRB VER.A   | Ralink RT3062F  |  **Yes**  | - |+| ::: | ::: |  HG556**<color crimson>B</color>**VDFA  | 30562, 30692, 30693, 31300, 30634 |  0x20000  | 0xefe000 | ::: | ::: | 
 +| **HG56BZRB VER.A** | Ralink RT3062F |  HG556**<color crimson>C</color>**VDFA | 30695, 30694, 31301, 31507, 30555, 31525, 31935, 31901, 31902 0x20000  | 0xeffe00 | **Yes**  | ::: |
-About where the wifi calibration data is located in the flash chip see [[#notes]].+ 
 +<nowiki>*)</nowiki>You can check the version from the OEM firmware executing the command: //hwversion show// 
 + 
 +<nowiki>**)</nowiki>You can check the flash memory chip erasesize with the command: //cat /proc/mtd// 
 +  * 0x20000 = 128 KiB  
 +  * 0x10000 = 64 KiB
===== Hardware Highlights ===== ===== Hardware Highlights =====
^ SoC ^ Ram ^ Flash ^ Network ^ USB ^ Serial ^ JTag ^ ^ SoC ^ Ram ^ Flash ^ Network ^ USB ^ Serial ^ JTag ^
| Broadcom 6358 | 64MiB | 16MiB | 4 x 1| Yes | Yes | Yes | | Broadcom 6358 | 64MiB | 16MiB | 4 x 1| Yes | Yes | Yes |
- 
- 
- 
Line 29: Line 32:
Please check out the article [[doc:techref:Flash Layout]]. It contains an example and a couple of explanations. Please check out the article [[doc:techref:Flash Layout]]. It contains an example and a couple of explanations.
-FIXME this is just a draft +^ partition ^ name ^ filesystem ^ description
-^ partition ^ name^ function +| mtd0 | **CFE** | n/a | bootloader
-| mtd0 | CFE | bootloader | +| n/a | n/a | n/a | firmware tag
-| mtd1 | kernel | kernel | +| mtd1 | **kernel** | RAM executable | kernel | 
-| mtd2 | rootfs | squashfs | +| mtd2 | **rootfs** | squashfs | root
-| mtd3 | rootfs_data | jffs2 | +| mtd3 | **rootfs_data** | jffs2 | configuration, install new packages
-| mtd4 | cal_data | wifi calibration data | +| mtd4 | **cal_data** | n/a | wifi calibration data | 
-| mtd5 | nvram | OEM configuration data |+| mtd5 | **nvram** | n/a | OEM configuration data
 +| mtd6 | **linux** | n/a | OpenWrt upgrade |
==== OEM easy installation ==== ==== OEM easy installation ====
This section deals with how you install OpenWrt from the device freshly opened. This section deals with how you install OpenWrt from the device freshly opened.
 +  *Download [[http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-HW556-squashfs-cfe.bin|openwrt-HW556-squashfs-cfe.bin]]. You may also be interested on [[#Backports|Backports]]
  *Unplug the power cord   *Unplug the power cord
  *Press the button labeled as //RESTART//, don't release it yet!   *Press the button labeled as //RESTART//, don't release it yet!
Line 52: Line 57:
==== OEM installation using the TFTP method ==== ==== OEM installation using the TFTP method ====
 +  * Connect the [[#serial|serial]] TTL cable to send commands to CFE for loading the firmware via tftp.
 +  * Start a TFTP server in your PC. Copy the //**openwrt-HW556-squashfs-cfe.bin**// firmware to the server.
 +  * Set the IP at your pc to 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
 +This is a session of flashing via TFTP:
 +<HTML>
 +<p style="padding: 10px;border:1px solid grey;height:350px;font:9px/12px Georgia, Garamond, Serif;overflow:Auto;background-color:#DEE4E7">
 +<code>CFE> f 192.168.1.35:openwrt-HW556-squashfs-cfe.bin
 +Loading 192.168.1.35:openwrt-HW556-squashfs-cfe.bin ...
-If you want to upgrade using TFTP you follow these steps (as an alternative to the above install process.+Finished loading 2883588 bytes 
 + 
 + 
 +Flashing root file system and kernel at 0xbe020000:  
 + ~~~~~~~Flag: 3  
 + 
 +baseAddr 0xbe000000  
 + 
 +kernelAddr 0xbe020100  
 + 
 +rootfsAddr 0xbe020100  
 + 
 +tagFs 0x80800000  
 + 
 + 
 +. 
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 +
 + 
 + 
 +
 + 
 +Backup flag .  
 + 
 + ~~~~~~~Flag: 1  
 + 
 +
 +*** Image flash done *** ! 
 +Resetting board... 
 + 
 +</code> 
 +</p> 
 +</HTML>
==== Upgrading OpenWrt ==== ==== Upgrading OpenWrt ====
Line 73: Line 137:
<code> <code>
cd /tmp/ cd /tmp/
-wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc +wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-HW556-squashfs-cfe.bin 
-sysupgrade /tmp/xxx.abc+sysupgrade /tmp/openwrt-HW556-squashfs-cfe.bin
</code> </code>
Line 81: Line 145:
<code> <code>
cd /tmp/ cd /tmp/
-wget http://http://downloads.openwrt.org/snapshots/trunk/XXX/xxx.abc +wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-HW556-squashfs-cfe.bin 
-mtd write /tmp/xxx.abc linux && reboot</code>+mtd write /tmp/openwrt-HW556-squashfs-cfe.bin linux && reboot</code> 
 + 
 +=== CFE Upgrade Process === 
 +This is a clean and safe upgrade, using the booloader web interface. Just use the [[#oem.easy.installation|OEM installation]] procedure. 
 + 
 +=== Cleaning old garbage === 
 +| {{:meta:icons:tango:48px-emblem-important.svg.png|}}| If after upgrading OpenWrt you get the message: <code>jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes </code> And you can't save changes. Or you are unsure if old data is messing your new firmware. Enter OpenWrt [[#failsafe.mode|failsafe]] mode if needed. Then execute this command:\\ <code>mtd erase -r rootfs_data</code> |
===== Basic configuration ===== ===== Basic configuration =====
Line 95: Line 165:
^ Interface Name ^ Description ^ Default configuration ^ ^ Interface Name ^ Description ^ Default configuration ^
| br-lan | LAN & WiFi | 192.168.1.1/24 | | br-lan | LAN & WiFi | 192.168.1.1/24 |
-| eth0 | LAN ports (1 to 4) | None |  +| eth0 | LAN ports (1 to 4) | bridged
-| wlan0 | WiFi | Disabled | +| wlan0 | WiFi | bridged (disabled) |
==== Switch Ports (for VLANs) ==== ==== Switch Ports (for VLANs) ====
-This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 will be the  +This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 (LAN4) will be the Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on. 
-Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on. +^ Port label^ Switch port ^ Mode ^ 
-^ Port ^ Switch port ^ Mode ^ +| LAN1  | 0 | lan | 
-| LAN 1 | 0 | lan | +| LAN2  | 1 | lan | 
-| LAN 2 | 1 | lan | +| LAN3  | 2 | lan |  
-| LAN 3 | 2 | lan |  +| LAN4  | 3 | Internet (WAN)
-| LAN 4 | 3 | Internet (WAN) |+|  n/a  |  5t  | to CPU |
<HTML> <HTML>
-<div style="height:350px;font:10px/13px Georgia, Garamond, Serif;overflow-y:Auto"> +<p style=";padding: 10px;border:1px dashed grey;height:400px;font:9px/11px Georgia, Garamond, Serif;overflow:Auto"> 
-<p style=""> +<code># path: /etc/config/network 
-<code> +# LAN4 = WAN
- +
-# path: /etc/config/network +
-# port 4 = WAN+
config interface loopback config interface loopback
Line 123: Line 190:
config interface lan config interface lan
        option type    bridge         option type    bridge
-        option ifname  eth0.0+        option ifname  eth0.1
        option proto    static         option proto    static
        option ipaddr  192.168.1.1         option ipaddr  192.168.1.1
        option netmask  255.255.255.0         option netmask  255.255.255.0
-        option nat      1 
config interface wan config interface wan
-        option ifname eth0.+        option ifname eth0.2
-        option macaddr 00:11:22:33:44:55+
        option proto dhcp         option proto dhcp
-        option defaultroute 1 
- 
config switch eth0 config switch eth0
Line 143: Line 206:
config switch_vlan config switch_vlan
option device eth0 option device eth0
- option vlan 0+ option vlan 1
option ports "0 1 2 5t" option ports "0 1 2 5t"
config switch_vlan config switch_vlan
option device eth0 option device eth0
- option vlan 1+ option vlan 2
option ports "3 5t" option ports "3 5t"
- +</code></p>
-</code> +
-</p+
-</div>+
</HTML> </HTML>
- 
- 
==== Failsafe mode ==== ==== Failsafe mode ====
-> [[doc:howto:generic.failsafe]] -> [[doc:howto:generic.failsafe]]
 +**Openwrt failsafe:** Power on the router, press the button //RESTART// repeatedly to enter failsafe mode (the power led starts blinking very fast)
 +**CFE failsafe:** This is for entering in the bootloader command line. Use a [[#serial|serial]] cable and press any key while loading CFE.
==== Buttons ==== ==== Buttons ====
->[[doc:howto:hardware.button]] ->[[doc:howto:hardware.button]]
-The HG556a has four buttons. + 
 +The HG556a has four buttons.
^ BUTTON label ^ Event (OEM) ^ GPIO ^ Openwrt name ^ Openwrt code ^ ^ BUTTON label ^ Event (OEM) ^ GPIO ^ Openwrt name ^ Openwrt code ^
-| ? | diagnostic |  8  | diagnostic | BTN_0 +| ? | diagnostic |  8  | **help**  | KEY_HELP
-| <nowiki>(())</nowiki>| wifi on/off |  9  | wifi | KEY_WPS_BUTTON +| <nowiki>((i))</nowiki>| wifi on/off |  9  | **wlan**  | KEY_WLAN
-| RESTART | reboot |  10  | restart | BTN_1 +| RESTART | reboot |  10  | **restart**  | KEY_RESTART
-| RESET | reset |  11  | reset | KEY_RESTART |+| RESET | reset |  11  | **reset**  | KEY_CONFIG | 
 + 
 +==== Leds ==== 
 +->[[doc:uci:system#leds|System configuration: Leds]] 
 +^  HG55VDFA VER.C  ^^^^ 
 +^ Label ^^ description ^ GPIO ^ 
 +|  {{:media:toh:huawei:led-message_red.png?22&nolink}}  || message  |  0  | 
 +|  {{:media:toh:huawei:led-hspa_red.png?22&nolink}}    || hspa    |  1  | 
 +|  {{:media:toh:huawei:led-wifi_red.png?22&nolink}}    || wifi    | n/a | 
 +|  {{:media:toh:huawei:led-dsl_red.png?22&nolink}}      || dsl      |  2  | 
 +|  {{:media:toh:huawei:led-power_red.png?22&nolink}}    || power    |  3  | 
 +|  n/a                                                  || all      |  6  | 
 +| LAN1 | {{:media:toh:huawei:led-dot_green.png?22&nolink}} |  |  12  | 
 +| :::  | {{:media:toh:huawei:led-dot_red.png?22&nolink}}  |  |  13  | 
 +| LAN2 | {{:media:toh:huawei:led-dot_green.png?22&nolink}} |  |  15  | 
 +| :::  | {{:media:toh:huawei:led-dot_red.png?22&nolink}}  |  |  22  | 
 +| LAN3 | {{:media:toh:huawei:led-dot_green.png?22&nolink}} |  |  23  | 
 +| :::  | {{:media:toh:huawei:led-dot_red.png?22&nolink}}  |  |  26  | 
 +| LAN4 | {{:media:toh:huawei:led-dot_green.png?22&nolink}} |  |  27  | 
 +| :::  | {{:media:toh:huawei:led-dot_red.png?22&nolink}}  |  |  28  | 
 + 
 +^  HG56BZRB VER.A  ^^^^ 
 +^ Label ^^ description ^ GPIO ^ 
 +|  {{:media:toh:huawei:led-message_red.png?22&nolink}}  || message  |  12  | 
 +|  {{:media:toh:huawei:led-hspa_red.png?22&nolink}}    || hspa    |  15  | 
 +|  {{:media:toh:huawei:led-wifi_red.png?22&nolink}}    || wifi    | n/a | 
 +|  {{:media:toh:huawei:led-dsl_red.png?22&nolink}}      || dsl      |  2  | 
 +|  {{:media:toh:huawei:led-power_red.png?22&nolink}}    || power    |  3  | 
 +| LAN1 | {{:media:toh:huawei:led-dot_green.png?22&nolink}} |  |  0  | 
 +| :::  | {{:media:toh:huawei:led-dot_red.png?22&nolink}}  |  |  13  | 
 +| LAN2 | {{:media:toh:huawei:led-dot_green.png?22&nolink}} |  |  1  | 
 +| :::  | {{:media:toh:huawei:led-dot_red.png?22&nolink}}  |  |  22  | 
 +| LAN3 | {{:media:toh:huawei:led-dot_green.png?22&nolink}} |  |  23  | 
 +| :::  | {{:media:toh:huawei:led-dot_red.png?22&nolink}}  |  |  26  | 
 +| LAN4 | {{:media:toh:huawei:led-dot_green.png?22&nolink}} |  |  27  | 
 +| :::  | {{:media:toh:huawei:led-dot_red.png?22&nolink}}  |  |  28  |
===== Hardware ===== ===== Hardware =====
==== Info ==== ==== Info ====
-| **[[wp>Instruction set|Architecture]]:**   | [[wp>MIPS architecture|MIPS]] || +| ^ HG55VDFA VER.C ^ HG56BZRB VER.A ^ 
-| **Vendor:**          | [[wp>Broadcom]] || +| **[[wp>Instruction set]]:** | [[wp>MIPS architecture|MIPS]] | [[wp>MIPS architecture|MIPS]]
-| **[[doc:techref:Bootloader]]:**    | [[doc:techref:bootloader:CFE|CFE]] || +| **Vendor:**          | [[wp>Broadcom]] | [[wp>Broadcom]]
-| **[[doc:hardware:soc|System-On-Chip]]:**  | Broadcom 6358KFBG || +| **[[doc:techref:Bootloader]]:**    | [[doc:techref:bootloader:CFE|CFE]] | [[doc:techref:bootloader:CFE|CFE]] | 
-| **[[doc:hardware:cpu|CPU]]/Speed**        | BMIPS4350 V1.0 / 300 Mhz || +| **Board Id:**  | HW556 | HW556
-| **Flash-Chip:**      | Macronix MX29GL128EH \\ Macronix MX29LV128DB \\ Spansion S29GL128P10 || +| **[[doc:hardware:soc|System-On-Chip]]:**  | BCM6358KFBG | BCM6358KFBG
-| **Flash size:**      | 16 MiB || +| **[[doc:hardware:cpu|CPU]] @Frq**        | BMIPS4350 V1.0 @300 Mhz  [[doc:hardware:soc:soc.broadcom.bcm63xx:smp|BMIPS Dual Core]] | BMIPS4350 V1.0 / 300 Mhz [[doc:hardware:soc:soc.broadcom.bcm63xx:smp|BMIPS Dual Core]]
-| **RAM:**            | 64 MiB  || +| **Flash-Chip:**      | Macronix MX29GL128EH \\ Macronix MX29LV128DB \\ Spansion S29GL128P10 | MX29GL128EHT2I-90G
-| **Wireless:**        | Atheros AR9223 802.11b/g/n \\ Ralink RT3062F 802.11b/g/n | HG55VDFA VER.C\\ HG56BZRB VER.A +| **Flash size:**      | 16 MiB | 16 MiB
-| **Ethernet:**        | Broadcom  [[http://wiki.openwrt.org/_media/toh/bcm5325_pinout.png|BCM5325]] w/ vlan support [[doc:uci:network#swconfig]] || +| **RAM:**            | [[http://www.hynix.com/datasheet/pdf/dram/HY5DU124(8,16)22D(L)TP(Rev0.1).pdf|HY5DU121622DTP-J]] / DDR-333  | ? | 
-| **Internet:**        | ADSL2+ || +| **RAM size:**        | 64 MiB  | 64 MiB
-| **VoIP:**       | Zarlink Le88266DLC, Si3050 DAA  || +| **Wireless:**        | Atheros AR9223 802.11b/g/n (onboard) | Ralink RT3062F 802.11b/g/n (onboard) | 
-| **USB:**            | 2x 2.0 / SMSC HUB [[http://www.smsc.com/index.php?tid=295&pid=19|USB2502-AEZG]] \\ 1x 1.1 || +| **Antenna:**       | 2x, onboard, non detachable | 2x, onboard, non detachable
-| **[[doc:hardware:port.serial|Serial]]:**          | [[#Serial|Yes]] || +| **[[doc:hardware:Switch]]:**        | Broadcom  [[http://wiki.openwrt.org/_media/toh/bcm5325_pinout.png|BCM5325E]] w/ vlan support [[doc:uci:network#swconfig]] | Broadcom  [[http://wiki.openwrt.org/_media/toh/bcm5325_pinout.png|BCM5325E]] w/ vlan support [[doc:uci:network#swconfig]]
-| **[[doc:hardware:port.jtag|JTAG]]:**            | [[#JTAG|Yes]]  ||+| **Internet:**        | ADSL2+ | ADSL2+
 +| **VoIP:**           | Zarlink Le88266DLC | Zarlink Le88266DLC
 +| **USB:**            | 1x2.0 SoC -> 2x2.0 SMSC HUB [[http://www.smsc.com/index.php?tid=295&pid=19|USB2502-AEZG]] | 1x2.0 SoC -> 2x2.0 Genesys HUB [[http://www.genesyslogic.com/en/product_view.php?show=21|GL850G]] | 
 +| ::: | + 1x 2.0 SoC | + 1x 2.0 SoC | 
 +| **Power adapter:** | 12V DC 2A / APS24W-12V2A-EU | 12V DC 2A / APS24W-12V2A-EU
 +| **[[doc:hardware:port.serial|Serial]]:**          | [[#Serial|Yes]] | [[#Serial|Yes]]
 +| **[[doc:hardware:port.jtag|JTAG]]:**            | [[#JTAG|Yes]]  | ? |
==== Photos ==== ==== Photos ====
 +
 +Photo of front and back of the casing:\\
 +{{:media:toh:huawei:hg556a-front.jpg?300x300|}}{{:media:toh:huawei:hg556a-back.jpg?300x300|}}
 +
 +==== Opening the case ====
 +**Note:** This will void your warranty!
 +
 +  *To remove the cover:
 +
 +| {{:media:toh:huawei:hg556a_rcase0.jpg?200x150|}} | remove the screw hidden under the label at the back of the router |
 +| {{:media:toh:huawei:hg556a_rcase1.jpg?200x150|}} | remove the router's foot |
 +| {{:media:toh:huawei:hg556a_rcase2.jpg?200x150|}} | carefully separate both parts of the casing |
 +=== Photo of PCB ===
<sortable> <sortable>
^ HG55VDFA VER.C ^ HG56BZRB VER.A ^ ^ HG55VDFA VER.C ^ HG56BZRB VER.A ^
Line 197: Line 312:
| {{:toh:huawei:hg556a_board_a.jpg?400|}} | {{:toh:huawei:hg556a-board_ralink.jpg?400|}} | | {{:toh:huawei:hg556a_board_a.jpg?400|}} | {{:toh:huawei:hg556a-board_ralink.jpg?400|}} |
|  **Bottom view**  |  **Bottom view**  | |  **Bottom view**  |  **Bottom view**  |
-| {{:toh:huawei:hg556a_board_b.jpg?400|}} | |+| {{:toh:huawei:hg556a_board_b.jpg?400|}} | {{:toh:huawei:hg556a-board_ralink_b.jpg?400|}}|
</sortable> </sortable>
-==== Opening the case ==== 
-**Note:** This will void your warranty! 
-  *To remove the cover do a/b/c 
-//Main PCB//+==== Serial ==== 
 +-> [[doc:hardware:port.serial]] general information about the serial port, serial port cable, etc. 
 + 
 +How to connect to the Serial Port of this specific device: 
 + 
 +| {{:doc:hardware:usbtors232.ttl.jpeg?100|}} | Use a [[doc/hardware/port.serial#usb.to.rs232.ttl.converter.module|serial TTL]] adapter to connect your PC with HG556a. Only connect TX, RX and GND. | 
 +**Settings:** 
 +  * Baudrate: 115200 
 +  * Data bits: 8 
 +  * Parity: None 
 +  * Stop bits: 1 
 + 
 +**Photo of PCB with markings** 
 + 
 +{{:toh:huawei:hg556a_serial_ttl.jpg?400|}} 
 + 
 +With [[http://cutecom.sourceforge.net/|Cutecom]] (or other serial console software), open <color blue>/dev/ttyUSB0</color> (you must have right permissions). 
 + 
 +==== JTAG ==== 
 +-> [[doc:hardware:port.jtag]] general information about the JTAG port, JTAG cable, etc. 
 + 
 +10 pin header marked J400 (see back of board picture below). Uses [[http://www.jtagtest.com/pinouts/avr|AVR JTAG]] layout. Broadcom CPU recognised by TJTAG version 3.0.1 
 + 
 +**Photo of PCB with markings (VER.C)** 
 + 
 +{{:media:toh:huawei:hg556ac_jtag_j400.jpg?400x250|}} 
 + 
 +We can use [[https://docs.google.com/leaf?id=0B07LcVZMfvdkZTc1MDA5MjUtZTMzYy00OGQzLWE5MjAtODFiN2RkMTJmNDQ5&sort=name&layout=list&num=50|the updated version of debrick on Google Docs]] 
 + 
 +But we'll need to change a couple of things 
 +<code diff> 
 +--- wrt54g.c 
 ++++ wrt54g.c 
 +@@ -252,6 +252,7 @@ 
 +    { 0x0535217F, 8, "Broadcom BCM5352 Rev 1 CPU" }, 
 +    { 0x0536517F, 8, "Broadcom BCM5365 Rev 1 CPU" },        // BCM5365 Not Completely Verified Yet 
 +    { 0x0634817F, 5, "Broadcom BCM6348 Rev 1 CPU" },        // is bigendian   
 ++  { 0x0635817F, 5, "Broadcom BCM6358 Rev 1 CPU" }, //flash base: 0x1e000000 0x1e800000 0x1f000000 0x1f800000 
 +    { 0x0634517F, 5, "Broadcom BCM6345 Rev 1 CPU" },        // BCM6345 Not Completely Verified Yet 
 +    { 0x0000100F, 5, "TI AR7WRD TNETD7300GDU Rev 1 CPU" },  // TI AR7WRD Only Partially Verified 
 +    { 0x0470417F, 8, "Broadcom BCM4704 Rev 8 CPU" },        // BCM4704 chip (used in the WRTSL54GS units) 
 +@@ -1287,7 +1288,7 @@ 
 +    // Default to Standard Flash Window for Detection if not CUSTOM 
 +    if (strcasecmp(AREA_NAME,"CUSTOM")==0) 
 +          FLASH_MEMORY_START = selected_window; 
 +-    else FLASH_MEMORY_START = 0x1FC00000; 
 ++    else FLASH_MEMORY_START = 0x1e000000; 
 +  
 +    printf("\nProbing Flash at (Flash Window: 0x%08x) ... ", FLASH_MEMORY_START);</code> 
 + 
 +We can use a unbuffered cable, but not longer than 15 cm. 
 + 
 +Backup the whole flash: 
 +  nice ./debrick -backup:custom /window:1e000000 /start:1e000000 /length:1000000 /silent 
 + 
 +Swap bytes for extracting or whatever you want with the backup 
 +  cat CUSTOM.BIN | ./switchend > HG556a_backup.bin 
 + 
 +Backup the calibration data: 
 +  nice ./debrick -backup:custom /window:1EEFE000 /start:1EEFE000 /length:2000 /silent 
 +or for the flash chip MX29LV128DB: 
 +  nice ./debrick -backup:custom /window:1EF7E000 /start:1EF7E000 /length:2000 /silent 
 + 
 +==== SPI ==== 
 +**[[wp>Serial_Peripheral_Interface_Bus|Serial Peripheral Interface]]**  
 + 
 +The BCM6358 SoC has a [[doc/hardware/soc/soc.broadcom.bcm63xx#spi|SPI]] controller. The HG556a SPI pins are exposed on the board, at the place for a **Si3050** chip which isn't soldered. We can use this SPI interface for connecting our own SPI stuff, but we need to build the kernel with the drivers and proper platform data code for registering the SPI device. This is the pinout: 
 + 
 +{{:media:toh:huawei:hg556a-spi.jpg?500x300|}} 
 + 
 +This SPI interface is also connected to the **Le88266** VoiP chip, but using the Slave Select 2 (GPIO32): 
 + 
 +{{:media:toh:huawei:hg556a-spi_le88266.jpg?500x300|}} 
 + 
 +Kernel code example for **spidev** kernel module, the added code is highlighted in green: 
 +<HTML> 
 +<pre class="code" style="font:11px/12px monospace"> 
 +<font color="green">static struct spi_board_info hw556_spi_info[] = { 
 +
 + .bus_num = 0, 
 + .chip_select = 1, 
 + .mode = 0, 
 + .max_speed_hz = 781000, 
 + .modalias = "spidev", 
 + }, 
 +};</font> 
 + 
 +static struct board_info __initdata board_HW556 = { 
 + .name = "HW556", 
 + .expected_cpu_id = 0x6358, 
 + 
 + .has_uart0 = 1, 
 + .has_pci = 1, 
 + .has_ohci0 = 1, 
 + .has_ehci0 = 1, 
 + .num_usbh_ports = 2, 
 + 
 + .has_caldata = 1, 
 + .caldata = { 
 +
 + .caldata_offset = 0xe00000, 
 + }, 
 + }, 
 + 
 + .has_enet1 = 1, 
 + .enet1 = { 
 + .has_phy = 1, 
 + .phy_id = 0, 
 + .force_speed_100 = 1, 
 + .force_duplex_full = 1, 
 + }, 
 + 
 + .leds = { 
 +
 + .name = "HW556:red:message", 
 + .gpio = 0, 
 + .active_low = 1, 
 + }, 
 +
 + .name = "HW556:red:hspa", 
 + .gpio = 1, 
 + .active_low = 1, 
 + }, 
 +
 + .name = "HW556:red:dsl", 
 + .gpio = 2, 
 + .active_low = 1, 
 + }, 
 +
 + .name = "HW556:red:power", 
 + .gpio = 3, 
 + .active_low = 1, 
 + .default_trigger = "default-on", 
 + }, 
 +
 + .name = "HW556:red:all", 
 + .gpio = 6, 
 + .active_low = 1, 
 + .default_trigger = "default-on", 
 + }, 
 + }, 
 + 
 + .buttons = { 
 +
 + .desc = "help", 
 + .gpio = 8, 
 + .active_low = 1, 
 + .type = EV_KEY, 
 + .code = KEY_HELP, 
 + .debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL, 
 + }, 
 +
 + .desc = "wlan", 
 + .gpio = 9, 
 + .active_low = 1, 
 + .type = EV_KEY, 
 + .code = KEY_WLAN, 
 + .debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL, 
 + }, 
 +
 + .desc = "restart", 
 + .gpio = 10, 
 + .active_low = 1, 
 + .type = EV_KEY, 
 + .code = KEY_RESTART, 
 + .debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL, 
 + }, 
 +
 + .desc = "reset", 
 + .gpio = 11, 
 + .active_low = 1, 
 + .type = EV_KEY, 
 + .code = KEY_CONFIG, 
 + .debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL, 
 + }, 
 + }, 
 +<font color="green"> .spis = hw556_spi_info, 
 + .num_spis = ARRAY_SIZE(hw556_spi_info),</font> 
 +}; 
 +</pre> 
 +</HTML> 
 + 
 +The SPI controller is able to work with these speeds (kHz): 20000, 12500, 6250, 3125, 1563, 781(default), 391 
 + 
 + 
 +  * Demo video connecting a SPI display, (781 kHz):\\ <HTML><iframe width="560" height="315" src="//www.youtube.com/embed/3BNs52wyl1s" frameborder="0" allowfullscreen></iframe></HTML>\\ using 20 MHz:\\ <HTML><iframe width="560" height="315" src="//www.youtube.com/embed/9LltQ8kO2b0" frameborder="0" allowfullscreen></iframe></HTML> 
 + 
 + 
 +===== Debricking ===== 
 +-> [[doc:howto:generic.debrick]] 
 + 
 +===== CFE Bootloader ===== 
 +  - you could read about [[doc:techref:bootloader]] in general 
 + 
 +With a serial console we can get some interesting info 
 + 
 +About the version and build: 
 + 
 +  CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE) 
 +  Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) 
 + 
 +And about the possible boards compatible with this CFE: 
 +<code>CFE>  
 +
 +Press:  <enter> to use current value 
 + 
 +        '-' to go previous parameter 
 + 
 +        '.' to clear the current value 
 + 
 +        'x' to exit this command 
 + 
 +Board Id Name (0-11)  
 +HW6358GW_A      -------  0 
 +HW6358GW_B      -------  1 
 +HW550            -------  2 
 +HW550_FXO        -------  3 
 +HW553            -------  4 
 +HW556            -------  5 
 +HW556aV2        -------  6 
 +96358VW2        -------  7 
 +96358VW-16      -------  8 
 +96358GW          -------  9 
 +96358GW-16      ------- 10 
 +96358M          ------- 11      :  5  </code> 
 + 
 +===== Hardware mods ===== 
 + -> as a beginner, you really should inform yourself about [[doc:hardware:soldering]] in general and then obtain some practical experience! 
 + 
 +No mods yet. 
 + 
 +===== Firmware mods ===== 
 +==== Backports ==== 
 +  * Backfire backport (**10.03.1**). Only HG55VDFA VER.C boards:\\ [[https://docs.google.com/uc?export=download&id=0B-EMoBe-_OdBSGRHSjlDb3pjOWM|hg556a_ath_backport_10.03.1.zip]] 
 + 
 +  * Attitude Adjustment backport (**12.09**):\\ [[https://docs.google.com/uc?export=download&id=0B-EMoBe-_OdBdU5VTHc5Q2o2aEU|hg556a_backport_12.09.zip]] 
-**Photo of PCB** +===== BOOTLOGS ===== 
-==== BOOTLOGS ==== +==== OEM bootlog: ====
-=== OEM bootlog: ===+
<HTML> <HTML>
Line 986: Line 1333:
</HTML> </HTML>
-=== Openwrt bootlog: ===+==== Openwrt bootlog: ====
<HTML> <HTML>
Line 1283: Line 1630:
</HTML> </HTML>
-==== Serial ==== 
--> [[doc:hardware:port.serial]] general information about the serial port, serial port cable, etc. 
- 
-How to connect to the Serial Port of this specific device: 
- 
-**Photo of PCB with markings** 
- 
-{{:toh:huawei:hg556a_serial_ttl.jpg?400|}} 
- 
-==== JTAG ==== 
--> [[doc:hardware:port.jtag]] general information about the JTAG port, JTAG cable, etc. 
- 
-10 pin header marked J400 (see back of board picture below). Uses [[http://www.jtagtest.com/pinouts/avr|AVR JTAG]] layout. Broadcom CPU recognised by TJTAG version 3.0.1 
- 
-**Photo of PCB with markings** 
- 
-{{:toh:huawei:hg556a_jtagj400.jpg?300|}} 
- 
-We can use [[https://docs.google.com/leaf?id=0B07LcVZMfvdkZTc1MDA5MjUtZTMzYy00OGQzLWE5MjAtODFiN2RkMTJmNDQ5&sort=name&layout=list&num=50|the updated version of debrick on Google Docs]] 
- 
-But we'll need to change a couple of things 
-<code diff> 
---- wrt54g.c 
-+++ wrt54g.c 
-@@ -252,6 +252,7 @@ 
-    { 0x0535217F, 8, "Broadcom BCM5352 Rev 1 CPU" }, 
-    { 0x0536517F, 8, "Broadcom BCM5365 Rev 1 CPU" },        // BCM5365 Not Completely Verified Yet 
-    { 0x0634817F, 5, "Broadcom BCM6348 Rev 1 CPU" },        // is bigendian   
-+  { 0x0635817F, 5, "Broadcom BCM6358 Rev 1 CPU" }, //flash base: 0x1e000000 0x1e800000 0x1f000000 0x1f800000 
-    { 0x0634517F, 5, "Broadcom BCM6345 Rev 1 CPU" },        // BCM6345 Not Completely Verified Yet 
-    { 0x0000100F, 5, "TI AR7WRD TNETD7300GDU Rev 1 CPU" },  // TI AR7WRD Only Partially Verified 
-    { 0x0470417F, 8, "Broadcom BCM4704 Rev 8 CPU" },        // BCM4704 chip (used in the WRTSL54GS units) 
-@@ -1287,7 +1288,7 @@ 
-    // Default to Standard Flash Window for Detection if not CUSTOM 
-    if (strcasecmp(AREA_NAME,"CUSTOM")==0) 
-          FLASH_MEMORY_START = selected_window; 
--    else FLASH_MEMORY_START = 0x1FC00000; 
-+    else FLASH_MEMORY_START = 0x1e000000; 
-  
-    printf("\nProbing Flash at (Flash Window: 0x%08x) ... ", FLASH_MEMORY_START);</code> 
- 
-We can use a unbuffered cable, but not longer than 15 cm. 
- 
-Backup the whole flash: 
-  nice ./debrick -backup:custom /window:1e000000 /start:1e000000 /length:1000000 /silent 
- 
-Swap bytes for extracting or whatever you want with the backup 
-  cat CUSTOM.BIN | ./switchend > HG556a_backup.bin 
- 
-Backup the calibration data: 
-  nice ./debrick -backup:custom /window:1EEFE000 /start:1EEFE000 /length:2000 /silent 
-or for the flash chip MX29LV128DB: 
-  nice ./debrick -backup:custom /window:1EF7E000 /start:1EF7E000 /length:2000 /silent 
- 
-===== Debricking ===== 
--> [[doc:howto:generic.debrick]] 
- 
-===== CFE Bootloader ===== 
-  - you could read about [[doc:techref:bootloader]] in general 
- 
-With a serial console we can get some interesting info 
- 
-About the version and build: 
- 
-  CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE) 
-  Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) 
- 
-And about the possible boards compatible with this CFE: 
-<code>CFE>  
-b 
-Press:  <enter> to use current value 
- 
-        '-' to go previous parameter 
- 
-        '.' to clear the current value 
- 
-        'x' to exit this command 
- 
-Board Id Name (0-11)  
-HW6358GW_A      -------  0 
-HW6358GW_B      -------  1 
-HW550            -------  2 
-HW550_FXO        -------  3 
-HW553            -------  4 
-HW556            -------  5 
-HW556aV2        -------  6 
-96358VW2        -------  7 
-96358VW-16      -------  8 
-96358GW          -------  9 
-96358GW-16      ------- 10 
-96358M          ------- 11      :  5  </code> 
- 
-This is the backup of my bootloader: [[http://files.myopera.com/danitool/linux/bootloaders/hg556a_CFE.zip|hg556a_CFE.zip]] --- //danitool 2012/01/06 15:39// 
- 
-===== Hardware mods ===== 
-  - as a beginner, you really should inform yourself about [[doc:hardware:soldering]] in general and then obtain some practical experience! 
-==== 128MiB RAM Mod ==== 
-==== I²C GPIO Mod ==== 
-==== I²C Tiny-USB Mod ==== 
===== Notes ===== ===== Notes =====
-==== ath_data ==== +==== cal_data ==== 
-In this table we can see the different geometry of both flash chips:+In this table we can see the different geometry of flash chips:
^ GEOMETRY ^ S29GL128P10 ^ MX29GL128EH ^  MX29LV128DB  ^^ ^ GEOMETRY ^ S29GL128P10 ^ MX29GL128EH ^  MX29LV128DB  ^^
^ Boot Block |  Uniform, Top WP  |  Uniform, Top WP  |  Bottom boot  || ^ Boot Block |  Uniform, Top WP  |  Uniform, Top WP  |  Bottom boot  ||
Line 1394: Line 1642:
^ erasesize |  0x20000  |  0x20000  | 0x2000 | 0x10000 | ^ erasesize |  0x20000  |  0x20000  | 0x2000 | 0x10000 |
-The location of the ath_data information (starts with 0xA55A) is displayed on bootup. . The fInfo.* values appear to be embedded in the kernel :?:+The WIFI calibration data location (starts with 0xA55A) is displayed on bootup. . The fInfo.* values appear to be embedded in the kernel :?:
Boot log reports: Boot log reports:
Line 1428: Line 1676:
**//8*0x2000+(254-8)*0x10000+0xe000 = 0xF7E000//** **//8*0x2000+(254-8)*0x10000+0xe000 = 0xF7E000//**
-\\ \\ \\ 
-My backups [[http://files.myopera.com/danitool/linux/hg556a_art.zip|hg556a_art.zip]] --- //danitool 2012/01/06 15:57// 
===== Tags ===== ===== Tags =====
For some Help with the Tags, please have a look here: [[meta/tags]] For some Help with the Tags, please have a look here: [[meta/tags]]
-{{tag>bcm63xx bcm6358 FastEthernet 4Port 3USB ath9k 64RAM 16Flash MIPS MIPS32 34K}}+{{tag>bcm63xx bcm6358 FastEthernet 4Port hwVLAN 3USB ath9k 802.11bgn NonDetachableAntenna 2Ant 64RAM 16Flash MIPS MIPS32}}

Back to top

toh/huawei/hg556a.1357317189.txt.bz2 · Last modified: 2013/01/04 17:33 (external edit)