User Tools

Site Tools


toh:huawei:hg556a

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Previous revision
toh:huawei:hg556a [2013/01/04 17:33]
toh:huawei:hg556a [2016/02/20 01:05] (current)
danitool [Supported Versions]
Line 1: Line 1:
 +====== Huawei EchoLife HG556a ======
  
 +The HG556a was an adsl wifi router mainly distributed by Vodafone to their customers.
 +
 +{{media:​huawei:​hg556:​hg556a.png?​0x250|}}
 +
 +It comes in three versions **A**, **B** and **C**:
 +  * A, B versions have identical boards coming with an Atheros wifi chip and they only differ in the flash chip erasesize.
 +  * C version is quite different on the inside, coming with a totally different board, equiped with a Ralink wifi chip, and worse quality (no metal shieldings on the onboard chips).
 +
 +:!: It's a good idea to backup the [[#​cal_data|cal_data]] area at the flash-chip. The WLAN calibration data is specific for your device. ​ If you wipe it accidentally it will be difficult to restore, it cannot be restored by flashing back a vendor firmware. For doing this under Openwrt, mount a pendrive (after installing proper drivers for USB mass storage), and copy the cal_data partition into it, example:
 +>''​mount /dev/sda1 /​mnt''​
 +>''​dd if=/​dev/​mtd4 of=/​mnt/​hg556a-cal_data-backup.bin''​
 +>''​umount /​mnt''​
 +
 +===== Supported Versions =====
 +
 +Supported since [[https://​dev.openwrt.org/​changeset/​35011|R35011]] (Barrier Breaker). Internal ADSL/VoIP not supported.
 +
 +^ Router version ^ Board model ^ Wifi chip ^ Vdf Version <​nowiki>​*</​nowiki>​ ^ Serial number (first 5 digits) ^ Flash chip erasesize <​nowiki>​**</​nowiki>​ ^ cal_data offset ^ Supported ^ Notes ^
 +|  **A**  | **HG55VDFA VER.C** | Atheros AR9223 |  HG556**<​color crimson>​A</​color>​**VDFA ​ | 30462, 30562, 30605, 30608, 30634 |  0x10000 ​ | 0xf7e000 | **Yes** ​ |<color crimson>​ADSL not supported\\ VoIP not supported </​color> ​ |
 +|  **B**  | ::: | ::: |  HG556**<​color crimson>​B</​color>​**VDFA ​ | 30692, 30693, 31110, 31300 |  0x20000 ​ | 0xefe000 | ::: | ::: |
 +|  **C**  | **HG56BZRB VER.A** ​ | Ralink RT3062F |  HG556**<​color crimson>​C</​color>​**VDFA ​ | 30555, 30694, 30695, 31301, 31507, 31525, 31901, 31902, 31935, 32505 |  0x20000 ​ | 0xeffe00 | **Yes** ​ | ::: |
 +
 +
 +<​nowiki>​*)</​nowiki>​You can check the version from the OEM firmware executing the command: ''​hwversion show''​
 +
 +<​nowiki>​**)</​nowiki>​You can check the flash memory chip erasesize with the command (in openwrt): ''​cat /​proc/​mtd''​
 +  * 0x20000 = 128 KiB 
 +  * 0x10000 = 64 KiB
 +
 +<WRAP center round info 60%>
 +The important parameters for choosing the correct OpenWrt file firmware are the flash chip **erasesize**,​ and **cal_data offset**. But it's harmless to flash an incorrect firmware, it won't brick it.
 +</​WRAP>​
 +
 +Probably the **GPIO4** and **GPIO5** (input reading), are used by the OEM bootloader/​firmware to identify the board version (//​GetHG556aBoardVersion//​)
 +===== Hardware Highlights =====
 +^ SoC             ^ Ram     ^ Flash   ^ Network ​  ^ USB   ^ Serial ​  ^ JTag   ^
 +| Broadcom 6358   | 64MiB   | 16MiB   | 4 x 1     | Yes   | Yes      | Yes    |
 +
 +
 +===== Installation =====
 +  - -> [[doc:​howto:​obtain.firmware]]
 +  - -> [[doc:​howto:​generic.flashing|Install OpenWrt]]
 +
 +==== Flash Layout ====
 +Please check out the article [[doc:​techref:​Flash.Layout]]. It contains an example and a couple of explanations.
 +
 +^ partition ​  ^ name              ^ filesystem ​      ^ description ​                          ^
 +| mtd0        | **CFE** ​          | n/a              | bootloader ​                           |
 +| n/a         | n/a               | n/a              | firmware tag                          |
 +| mtd1        | **kernel** ​       | RAM executable ​  | kernel ​                               |
 +| mtd2        | **rootfs** ​       | squashfs ​        | root                                  |
 +| mtd3        | **rootfs_data** ​  | jffs2            | configuration,​ install new packages ​  |
 +| mtd4        | **cal_data** ​     | n/a              | wifi calibration data                 |
 +| mtd5        | **nvram** ​        | n/a              | OEM configuration data                |
 +| mtd6        | **linux** ​        | n/a              | OpenWrt upgrade ​                      |
 +
 +==== OEM easy installation ====
 +This section deals with how you install OpenWrt from the device freshly opened. ​
 +
 +=== Get the firmware ===
 +Since OpenWrt Chaos Calmer (migration to DTS), every version of this router (A, B, C) has its own firmware. See [[#​Supported_Versions]|supported versions]] to know your router version.
 +| **Version** | Release date | **firmware link** | **Notes** |
 +| **Trunk** (unstable) | continuously | [[https://​downloads.openwrt.org/​snapshots/​trunk/​brcm63xx/​generic/​ ]] | Development version ↔ BUGS, updates, USB and wireless drivers **NOT** included. LuCI web interface **NOT** included. ​ |
 +| **Chaos Calmer** | 2015-09-11 | http://​downloads.openwrt.org/​chaos_calmer/​15.05/​brcm63xx/​generic/​ | LuCI included, USB and wireless drivers included |
 +| **Barrier Breaker** | 2014-10-02 | [[http://​downloads.openwrt.org/​barrier_breaker/​14.07/​brcm63xx/​generic/​openwrt-HW556-squashfs-cfe.bin|openwrt-HW556-squashfs-cfe.bin]] | All versions, LuCI included, USB and wireless drivers **NOT** included |
 +| **Attitude Adjustment** | 2013-04-25 | [[https://​docs.google.com/​uc?​export=download&​id=0B-EMoBe-_OdBdU5VTHc5Q2o2aEU|hg556a_backport_12.09.zip]] | All versions, unofficial backport, LuCI included, USB and wireless drivers included |
 +| **Backfire** | 2011-12-21 | [[https://​docs.google.com/​uc?​export=download&​id=0B-EMoBe-_OdBSGRHSjlDb3pjOWM|hg556a_ath_backport_10.03.1.zip]] | Only for **A**, **B** versions, unofficial backport, USB and wireless drivers included |
 +
 +=== Installation ===
 +With this procedure you will flash the firmware using the [[doc/​techref/​bootloader|bootloader]] web interface (foolproof)
 +  * Set a **static IP** on your computer, use 192.168.1.35 (or any compatible),​ and connect the ethernet cable to the router.
 +  * Unplug the router'​s power cord
 +  * Press the button labeled as //​RESTART//,​ **don'​t** release it yet!
 +  * Plug the power cord
 +  * Wait 12 seconds or more
 +  * Release the //RESTART// button
 +  * Browse to http://​192.168.1.1 and you should see this screen: {{:​media:​doc:​cfe63xx_web-upgrade.png?​150|}}
 +  * Select .bin firmware
 +  * Press //Update Software// to start the firmware update process
 +  * Wait for it to reboot
 +  * Telnet / ssh to 192.168.1.1 and set a root password, or browse to http://​192.168.1.1 if LuCI is installed.
 +
 +==== OEM installation using the TFTP method ====
 +  * Connect the [[#​serial|serial]] TTL cable to send commands to CFE for loading the firmware via tftp.
 +  * Start a TFTP server in your PC. Copy the //​**openwrt-HW556-squashfs-cfe.bin**//​ firmware to the server.
 +  * Set the IP at your pc to 192.168.1.35 (or any compatible),​ and connect the ethernet cable to the router.
 +This is a session of flashing via TFTP:
 +
 +<​code>​CFE>​ f 192.168.1.35:​openwrt-HW556-squashfs-cfe.bin
 +Loading 192.168.1.35:​openwrt-HW556-squashfs-cfe.bin ...
 +
 +Finished loading 2883588 bytes
 +
 +Flashing root file system and kernel at 0xbe020000: ​
 + ​~~~~~~~Flag:​ 3 
 +
 +baseAddr 0xbe000000 ​
 +
 +kernelAddr 0xbe020100 ​
 +
 +rootfsAddr 0xbe020100 ​
 +
 +tagFs 0x80800000 ​
 +
 +......................
 +.
 +
 +Backup flag . 
 +
 + ​~~~~~~~Flag:​ 1 
 +.
 +*** Image flash done *** !
 +Resetting board...
 +
 +</​code>​
 +
 +
 +<WRAP center round info 60%>
 +Firmwares > 8MB size return an error about CRC check:​\\ ​
 +''​ Finished loading 8388608 bytes
 + ​Illegal image ! Image crc failed.''​\\
 +CFE web interface should be used in this case.
 +</​WRAP>​
 +
 +==== Upgrading OpenWrt ====
 +->  [[doc:​howto:​generic.sysupgrade]]
 +
 +If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.
 +
 +=== LuCI Web Upgrade Process ===
 +
 +  * Browse to http://​192.168.1.1/​cgi-bin/​luci/​mini/​system/​upgrade/​ LuCI Upgrade URL
 +  * Upload image file for sysupgrade to LuCI
 +  * Wait for reboot
 +
 +=== Terminal Upgrade Process ===
 +
 +  * Login as root via SSH on 192.168.1.1
 +  * Use the following commands to upgrade\\<​code>​
 +cd /tmp/
 +wget http://​downloads.openwrt.org/​snapshots/​trunk/​brcm63xx/​openwrt-HW556-squashfs-cfe.bin
 +sysupgrade /​tmp/​openwrt-HW556-squashfs-cfe.bin</​code>​
 +
 +  * If sysupgrade does not support this router, use the following commands\\ <​code>​
 +cd /tmp/
 +wget http://​downloads.openwrt.org/​snapshots/​trunk/​brcm63xx/​openwrt-HW556-squashfs-cfe.bin
 +mtd write /​tmp/​openwrt-HW556-squashfs-cfe.bin linux && reboot</​code>​
 +
 +=== CFE Upgrade Process ===
 +This is a clean and safe upgrade, using the booloader web interface. Just use the [[#​oem_easy_installation|OEM installation]] procedure.
 +
 +=== Cleaning old garbage ===
 +<WRAP left round important>​
 +If after upgrading OpenWrt you get the message: <​code>​jffs2:​ Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes </​code>​ And you can't save changes. Or you are unsure if old data is messing your new firmware. Enter OpenWrt [[#​failsafe_mode|failsafe]] mode if needed. Then execute this command:\\ <​code>​mtd erase -r rootfs_data</​code>​
 +</​WRAP>​
 +
 +==== Original firmware ====
 +These are the default administrator passwords in the OEM firmware
 +^ Firmware ​          ^ user       ^ password ​    ^
 +| new firmwares ​     | advanced ​  | advanced ​    |
 +| all                | emtest ​    | zbbtest ​     |
 +| spanish versions ​  | admin      | VF-EShg556 ​  |
 +| irish versions ​    | admin      | VF-IRhg556 ​  |
 +| kiwi versions ​     | admin      | VF-NZhg556 ​  |
 +
 +If you want back to the OEM firmware, once you installed OpenWrt, you can use the OpenWrt Luci web interface for flashing it as a regular firmware.
 +
 +===== Basic configuration =====
 +-> [[doc:​howto:​basic.config|Basic configuration]] After flashing, proceed with this.\\
 +Set up your Internet connection, configure wireless, configure USB port, etc.
 +
 +As default some firmware versions doesn'​t include wireless drivers. For installing these drivers first give OpenWrt internet access (see [[#​Basic_internet_configuration]] or [[#​switch_ports_for_vlans]]) and execute:
 +  * if your router has an Atheros wifi chip: <​code>​opkg update
 +opkg install kmod-ath9k</​code>​
 +  * or, if your router version has a Ralink wifi chip <​code>​opkg update
 +opkg install kmod-rt2800-pci</​code>​
 +  * you may also want to install USB drivers<​code>​opkg install kmod-usb-ohci kmod-usb2</​code>​
 +  * If you are using a trunk version, you may want to install luci: <​code>​opkg install luci
 +/​etc/​init.d/​uhttpd enable</​code>​
 + 
 +===== Specific Configuration =====
 +==== Interfaces ====
 +
 +The default network configuration is:
 +^ Interface Name   ^ Description ​         ^ Default configuration ​  ^
 +| br-lan ​          | LAN & WiFi           | 192.168.1.1/​24 ​         |
 +| eth0             | LAN ports (1 to 4)   | bridged ​                |
 +| wlan0            | WiFi                 | bridged (disabled) ​     |
 +
 +==== Basic internet configuration ====
 +You can set a basic internet configuration with uci commands. Assuming your main router (gateway) has the IP 192.168.1.1 (the most common). Follow these steps.
 +
 +  - Connect only the ethernet cable from the HG556a to your computer, and telnet it or ssh.
 +  - Execute these commands <​code>​uci set network.lan.ipaddr=192.168.1.254
 +uci set network.lan.netmask=255.255.255.0
 +uci set network.lan.gateway=192.168.1.1
 +uci set network.lan.dns='​8.8.8.8 192.168.1.1'​
 +uci commit network</​code>​
 +  - You may also need to disable the dhcp server <​code>/​etc/​init.d/​dnsmasq disable</​code>​
 +  - Reboot the HG556a and connect the ethernet cable to the main router (gateway).
 +  - Now the HG556a IP is 192.168.254,​ telnet or ssh it.
 +  - Ping any internet address, or install a package <​code>​opkg update
 +opkg install luci</​code>​
 +
 +==== Switch Ports (for VLANs) ====
 +This is an example to configure the switch: numbers 0-2 will be lan, labeled as Ports 1-3 on the unit, number 3 (LAN4) will be the Internet (WAN), 5 is the internal connection to the router itself. Don't be fooled: vlan0 = eth0.0, vlan1 = eth0.1 and so on.
 +^ Port label   ^ Switch port   ^ Mode             ^
 +|     ​LAN1 ​    ​| ​      ​0 ​      | lan              |
 +|     ​LAN2 ​    ​| ​      ​1 ​      | lan              |
 +|     ​LAN3 ​    ​| ​      ​2 ​      | lan              |
 +|     ​LAN4 ​    ​| ​      ​3 ​      | Internet (WAN)   |
 +|     ​n/​a ​     |      5t       | to CPU           |
 +
 +<code make># path: /​etc/​config/​network
 +# LAN4 = WAN
 +
 +config interface loopback
 +        option ifname ​  lo
 +        option proto    static
 +        option ipaddr ​  ​127.0.0.1
 +        option netmask ​ 255.0.0.0
 +
 +config interface lan
 +        option type     ​bridge
 +        option ifname ​  ​eth0.1
 +        option proto    static
 +        option ipaddr ​  ​192.168.1.1
 +        option netmask ​ 255.255.255.0
 +
 +config interface wan
 +        option ifname eth0.2
 +        option proto dhcp 
 +
 +config switch eth0
 + option enable 1
 + option reset 1
 + option enable_vlan 1
 +
 +config switch_vlan
 + option device eth0
 + option vlan 1
 + option ports "0 1 2 5t"
 +
 +config switch_vlan
 + option device eth0
 + option vlan 2
 + option ports "3 5t"
 +</​code>​
 +
 +==== Main Core ====
 +The BCM6358 SoC has two CPU cores. Unfortunately Linux kernel can only manage one core. The TLB is shared ​ between the two cores, and there isn't code to deal with this problem.
 +
 +As default the second core is the main. Since the cores in BCM6358 have different features, with double icache in the first one, we may want to use it as the main one -> **more icache = better performance**. The problem for using the core0 is the initialization,​ this task is made by the bootloader, not OpenWrt.
 +
 +We can manually hex-edit the bootloader to force initialization of the first core as the Main thread. Or just use this utility in OpenWrt:
 +<WRAP center round download 60%>
 +[[https://​drive.google.com/​uc?​export=download&​id=0B-EMoBe-_OdBREU4TTc2MWZZQVk|tp0set_1.0-1_brcm63xx.ipk]]\\
 +(looks like the binary is only compatible with Barrier Breaker or earlier versions of OpenWrt). Tested dozen times with success.
 +</​WRAP>​
 +
 +Just install it and execute: <​code>​tp0set 0</​code>​ then reboot the router.
 +
 +This is a session of installing and executing **tp0set**
 +<​code>​
 +root@OpenWrt:/​tmp#​ opkg install tp0set_1.0-1_brcm63xx.ipk ​
 +Installing tp0set (1.0-1) to root...
 +Configuring tp0set.
 +root@OpenWrt:/​tmp#​ tp0set 0
 +setting TP0 main core
 +MTD Type: 3
 +MTD total size: 20000 bytes
 +MTD erase size: 20000 bytes
 +Eraseing Block 0
 +Writting to /​dev/​mtd0...
 +Done!!
 +root@OpenWrt:/​tmp#​
 +</​code>​
 +
 +This is what you will see in dmesg:
 +  * Before: ''​[ ​   0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.''​
 +  * After: ''​[ ​   0.000000] Primary instruction cache 32kB, VIPT, 2-way, linesize 16 bytes.''​
 +
 +<wrap hi>Some people reported +15∼20% extra performance with this change.</​wrap>​
 +
 +And this is the source code of //tp0set//
 +<code C>#​include <​stdio.h>​
 +#include <​fcntl.h>​
 +#include <​sys/​ioctl.h>​
 +#include <​mtd/​mtd-user.h>​
 +#include <​string.h>​
 +
 +#define DATA_OFFSET 20
 +#define RAWBYTES_LEN 4
 +
 +int main(int argc, char *argv[])
 +{
 +    mtd_info_t mtd_info; ​          // the MTD structure
 +    erase_info_t ei;               // the erase block structure
 +    int m;
 +    unsigned int rawBytes; //the bytes we want to write
 +    ​
 +    if (argc != 2) {
 +            printf("​Usage:​ tp0set [0/​1]\n"​);​
 +            return 1;
 +    }
 +    ​
 +    m = atoi(argv[1]);​ //convert argument to integer
 +    if( m == 1) {
 +        rawBytes = 0x10000000;
 + printf("​setting TP1 main core\n"​); ​        
 +    }
 +    else if ( m == 0 ) {
 +        rawBytes = 0x00000000;
 + printf("​setting TP0 main core\n"​); ​        
 +    }
 +    else {
 +      ​printf("​only 0 or 1 allowed\n"​);​
 +      ​return 1;
 +    }
 +    ​
 +    unsigned char read_buf[0x20000] = {0x00}; ​   // empty array for reading ​
 +
 +    int fd = open("/​dev/​mtd0",​ O_RDWR); // open the mtd device for reading and 
 +                                        // writing. Note you want mtd0 not mtdblock0
 +                                        // also you probably need to open permissions
 +                                        // to the dev (sudo chmod 777 /dev/mtd0)
 +
 +    ioctl(fd, MEMGETINFO, &​mtd_info); ​  // get the device info
 +
 +    // dump it for a sanity check, should match what's in /proc/mtd
 +    printf("​MTD Type: %x\nMTD total size: %x bytes\nMTD erase size: %x bytes\n",​
 +         ​mtd_info.type,​ mtd_info.size,​ mtd_info.erasesize);​
 +
 +    lseek(fd, 0, SEEK_SET); ​              // go to the first block
 +    read(fd, read_buf, sizeof(read_buf));​ // read and store CFE in read_buf
 +    memcpy(read_buf + DATA_OFFSET,​ (unsigned char*)&​rawBytes,​ RAWBYTES_LEN);​ //write some bytes to CFE
 +    ​
 +    ei.length = mtd_info.erasesize; ​  //set the erase block size
 +    for(ei.start = 0; ei.start < mtd_info.size;​ ei.start += ei.length)
 +    {
 +        ioctl(fd, MEMUNLOCK, &ei);
 +         ​printf("​Eraseing Block %#​x\n",​ ei.start); // show the blocks erasing
 +                                                  // warning, this might print a lot!
 +        ioctl(fd, MEMERASE, &ei);
 +    }
 +
 +    printf("​Writting to /​dev/​mtd0...\n"​);​ // 
 +    lseek(fd, 0, SEEK_SET); ​       // go back to first block'​s start
 +    write(fd, read_buf, ​ sizeof(read_buf));​ // write our modified CFE
 +
 +    close(fd);
 +
 +    printf("​Done!!\n"​);​
 +    ​
 +    return 0;
 +
 +</​code>​
 +<WRAP center round download 60%>
 +Source code, only for compiling in the OpenWrt buildroot:
 +
 +{{:​media:​huawei:​tp0set.tar.gz|}}
 +</​WRAP>​
 +
 +
 +The changes survives forever, no matter if we install a new firmware, even erasing totally the previous firmware, since this setting is stored in CFE itself.
 +
 +**Note**: You can't use the first core as the Main thread with the OEM firmware, it will cause hardware failure when initializating VoIP hardware stuff.
 +
 +==== Failsafe mode ====
 +-> [[doc:​howto:​generic.failsafe]]
 +
 +**Openwrt failsafe:** Power on the router, press the button //RESTART// repeatedly to enter failsafe mode (the power led starts blinking very fast)
 +
 +**CFE failsafe:** This is for entering in the bootloader command line. Use a [[#​serial|serial]] cable and press any key while loading CFE.
 +
 +===== Hardware =====
 +==== Info ====
 +| ^ HG556a A, B (HG55VDFA VER.C) ^ HG556a C (HG56BZRB VER.A) ^
 +| **[[wp>​Instruction set]]:** | [[wp>​MIPS architecture|MIPS]] ||
 +| **Vendor:​** ​         | [[wp>​Broadcom]] ||
 +| **[[doc:​techref:​Bootloader]]:​** ​    | [[doc:​techref:​bootloader:​CFE|CFE]] ||
 +| **Board Id:**  | HW556 ||
 +| **[[doc:​hardware:​soc|System-On-Chip]]:​** ​ | BCM6358KFBG ||
 +| **[[doc:​hardware:​cpu|CPU]] @Frq** ​       | BMIPS4350 V1.0 @300 Mhz  [[doc:​hardware:​soc:​soc.broadcom.bcm63xx:​smp|BMIPS Dual Core]] ||
 +| **Flash-Chip:​** ​     | Macronix MX29GL128EH \\ Macronix MX29LV128DB \\ Spansion S29GL128P10 | MX29GL128EHT2I-90G |
 +| **Flash size:​** ​     | 16 MiB ||
 +| **RAM:​** ​            | [[http://​www.hynix.com/​datasheet/​pdf/​dram/​HY5DU124(8,​16)22D(L)TP(Rev0.1).pdf|HY5DU121622DTP-J]] / DDR-333 ​ | ? |
 +| **RAM size:​** ​       | 64 MiB   ||
 +| **Wireless:​** ​       | Atheros AR9223 802.11b/g/n (onboard) | Ralink RT3062F 802.11b/g/n (onboard) |
 +| **Antenna:​**  ​      | 2x, onboard, non detachable ||
 +| **[[doc:​hardware:​Switch]]:​** ​       | Broadcom ​ {{:​media:​datasheets:​bcm5325_pinout.png?​linkonly|BCM5325E}} w/ vlan support [[doc:​uci:​network#​swconfig]] ||
 +| **Internet:​** ​       | ADSL2+, not supported in OpenWrt ||
 +| **VoIP:​** ​           | Zarlink Le88266DLC -> drivers https://​github.com/​pgid69/​bcm63xx-phone ||
 +| **USB:​** ​            | 1x2.0 SoC -> 2x2.0 SMSC HUB [[http://​www.smsc.com/​index.php?​tid=295&​pid=19|USB2502-AEZG]] | 1x2.0 SoC -> 2x2.0 Genesys HUB [[http://​www.genesyslogic.com/​en/​product_view.php?​show=21|GL850G]] |
 +| ::: | + 1x 2.0 SoC | + 1x 2.0 SoC |
 +| **Power adapter:**                        | 12V DC 2A / APS24W-12V2A-EU ​  ||
 +| **[[doc:​hardware:​port.serial|Serial]]:​** ​  | [[#​Serial|Yes]] ​              ||
 +| **[[doc:​hardware:​port.jtag|JTAG]]:​** ​      | [[#​JTAG|Yes]] ​                ||
 +
 +==== Photos ====
 +
 +Photo of front and back of the casing:\\
 +{{media:​huawei:​hg556:​hg556a_front.jpg?​300x300|HG556a front}}{{media:​huawei:​hg556:​hg556a_back.jpg?​300x300|HG556a back}}
 +
 +==== Opening the case ====
 +**Note:** This will void your warranty!
 +
 +  * To remove the cover:
 +
 +| {{media:​huawei:​hg556:​hg556a_rcase0.jpg?​200x150|}} | remove the screw hidden under the label at the back of the router |
 +| {{media:​huawei:​hg556:​hg556a_rcase1.jpg?​200x150|}} | remove the router'​s foot |
 +| {{media:​huawei:​hg556:​hg556a_rcase2.jpg?​200x150|}} | carefully separate both parts of the casing |
 +
 +=== Photo of PCB ===
 +
 +**HG556a A, B** (HG55VDFA VER.C)\\
 +{{media:​huawei:​hg556:​hg556a_board_a.jpg?​0x300|}} {{media:​huawei:​hg556:​hg556a_board-b.jpg?​0x300|}}
 +
 +
 +**HG556a C** (HG56BZRB VER.A)\\
 +{{media:​huawei:​hg556:​hg556a_board_ralink.jpg?​0x300|}} {{media:​huawei:​hg556:​hg556a_board_ralink_b.jpg?​0x300|}}
 +==== Serial ====
 +-> [[doc:​hardware:​port.serial]] general information about the serial port, serial port cable, etc.
 +
 +**Photo of PCB with markings**\\
 +
 +//Versions A,B//\\
 +{{media:​huawei:​hg556:​hg556a_serial_ttl.jpg?​400x200|}}\\ ​
 +This board version also has a second serial UART1 port available at GPIO29 (TXD1, see [[hg556a#​other|other GPIOs]]), RXD1 is unknown or not available.
 +
 +//Version C//\\
 +{{media:​huawei:​hg556:​hg556a_serial-ralink.jpg?​direct&​400x200|}}
 +
 +Use a [[doc:​hardware:​port.serial.cables|serial TTL]] adapter to connect your PC with HG556a. With an USB adapter connect only TX, RX and GND.
 +With [[http://​cutecom.sourceforge.net/​|Cutecom]] (or other serial console software), open ''/​dev/​ttyUSB0''​ (you must have right permissions).
 +
 +**Settings:​**
 +  * Baudrate: 115200
 +  * Data bits: 8
 +  * Parity: None
 +  * Stop bits: 1
 +
 +
 +==== JTAG ====
 +-> [[doc:​hardware:​port.jtag]] general information about the JTAG port, JTAG cable, etc.
 +
 +**Photo of PCB with markings:**
 +
 +//Versions A, B//\\
 +{{media:​huawei:​hg556:​hg556ac_jtag_j400.jpg?​400x250|}}\\
 +10 pin header marked J400 (see back of board picture). Uses [[http://​www.jtagtest.com/​pinouts/​avr|AVR JTAG]] layout. Broadcom CPU recognised by TJTAG version 3.0.1
 +
 +//Version C//\\
 +{{:​media:​huawei:​hg556:​hg556a_c-jtag.jpg?​400x250|}}\\
 +These pins are also accesible on the other side of the board: {{:​media:​huawei:​hg556:​hg556a_c-jtag2.jpg?​linkonly|}}
 +
 +
 +
 +There are several utilities that support BCM6358 for flashing via JTAG cable. In our examples we will use **zJTAG** (ver 1.8) with a **WIGGLER** buffered cable. It is also possible to use a **DLC5** unbuffered cable, but not longer than 15 cm.
 +
 +
 +  * A command to check if our CPU is recognized:​\\ <code bash>​./​zjtag -probeonly /​window:​1e000000 /nompi /BE /​wiggler</​code>​
 +  * A session of bootloader backup: <WRAP bootlog>
 +<​nowiki>#​ ./zjtag -backup:​custom /​window:​1e000000 /​start:​1e000000 /​length:​20000 /nompi /wiggler /BE
 +                                                                                                                                            ​
 +        ============================================== ​                                                                                     ​
 +               zJTAG EJTAG Debrick Utility v1.8 RC3                                                                                         
 +        ============================================== ​                                                                                     ​
 +                                                                                                                                            ​
 +cable=wiggler,​ cabletype=3 ​                                                                                                                 ​
 +                                                                                                                                            ​
 +Detected IR chain length = 32                                                                                                               
 +                                                                                                                                            ​
 +There are 1 device(s) in the JTAG chain                                                                                                     
 + ​IDCODE for device 1 is 0x0635817F (IR length:​1) ​                                                                                           ​
 +                                                                                                                                            ​
 +Probing bus ... Done                                                                                                                        ​
 +                                                                                                                                            ​
 +Defined IR Length is 5 bits                                                                                                                 
 +                                                                                                                                            ​
 +CPU assumed running under BIG endian ​                                                                                                       ​
 +                                                                                                                                            ​
 +CPU Chip ID: 00000110001101011000000101111111 (0x0635817F) ​                                                                                 ​
 +*** Found a Broadcom manufactured BCM6358 REV 01 CPU ***                                                                                    ​
 +                                                                                                                                            ​
 +    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (0x00818904) ​                                                                
 +    - EJTAG Version ....... : 1 or 2.0                                                                                                      ​
 +    - EJTAG DMA Support ... : Yes                                                                                                           
 +    - EJTAG Implementation flags: R4k MIPS16 MIPS32 ​                                                                                        
 +                                                                                                                                            ​
 +Issuing Processor / Peripheral Reset ... Done                                                                                               
 +Enabling Memory Writes ... Done                                                                                                             
 +Halting Processor ... <​Processor did NOT enter Debug Mode!> ... Done                                                                        ​
 +Clearing Watchdog ... Done                                                                                                                  ​
 +Loading CPU Configuration Code ... Skipped ​                                                                                                 ​
 +
 +Probing Flash at Address: 0x1E000000 ...
 +Detected Chip ID (VenID:​DevID = C27E : 2101)
 +*** Found a CFI Compatiable Flash Chip from Macronix
 +
 +    - Flash Chip Window Start .... : 1E000000
 +    - Flash Chip Window Length ... : 01000000
 +    - Selected Area Start ........ : 1E000000
 +    - Selected Area Length ....... : 00020000
 +
 +*** You Selected to Backup the CUSTOM.BIN ***
 +
 +=========================
 +Backup Routine Started
 +=========================
 +
 +Saving CUSTOM.BIN.SAVED_20150207_145734 to Disk...
 +Done  (CUSTOM.BIN.SAVED_20150207_145734 saved to Disk OK)
 +
 +bytes written: 131072
 +=========================
 +Backup Routine Complete
 +=========================
 +elapsed time: 35 seconds
 +
 +
 + *** REQUESTED OPERATION IS COMPLETE ***</​nowiki>​
 +</​WRAP>​
 +
 +
 +  * A session of restoring CFE <WRAP bootlog>
 +<​nowiki>#​ ./zjtag -flash:​custom /​window:​1e000000 /​start:​1e000000 /​length:​20000 /wiggler /BE
 +
 +        ==============================================
 +               zJTAG EJTAG Debrick Utility v1.8 RC3
 +        ==============================================
 +
 +cable=wiggler,​ cabletype=3
 +
 +Detected IR chain length = 32
 +
 +There are 1 device(s) in the JTAG chain
 + ​IDCODE for device 1 is 0x0635817F (IR length:1)
 +
 +Probing bus ... Done
 +
 +Defined IR Length is 5 bits
 +
 +CPU assumed running under BIG endian
 +
 +CPU Chip ID: 00000110001101011000000101111111 (0x0635817F)
 +*** Found a Broadcom manufactured BCM6358 REV 01 CPU ***
 +
 +    - EJTAG IMPCODE ....... : 00000000100000011000100100000100 (0x00818904)
 +    - EJTAG Version ....... : 1 or 2.0
 +    - EJTAG DMA Support ... : Yes
 +    - EJTAG Implementation flags: R4k MIPS16 MIPS32
 +
 +Issuing Processor / Peripheral Reset ... Done
 +Enabling Memory Writes ... Done
 +Halting Processor ... <​Processor Entered Debug Mode!> ... Done
 +Clearing Watchdog ... Done
 +Loading CPU Configuration Code ... Skipped
 +Detecting Flash Base Address...
 +Read MPI register value : 1E00000C
 +MPI register show Flash Access Base Addr : 1E000000
 +
 +Probing Flash at Address: 0x1E000000 ...
 +Detected Chip ID (VenID:​DevID = C27E : 2101)
 +*** Found a CFI Compatiable Flash Chip from Macronix
 +
 +    - Flash Chip Window Start .... : 1E000000
 +    - Flash Chip Window Length ... : 01000000
 +    - Selected Area Start ........ : 1E000000
 +    - Selected Area Length ....... : 00020000
 +
 +*** You Selected to Flash the CUSTOM.BIN ***
 +
 +=========================
 +Flashing Routine Started
 +=========================
 +Total Blocks to Erase: 1
 +
 +Erasing block: 1 (addr = 1E000000)...Done
 +
 +Loading CUSTOM.BIN to Flash Memory...
 +Done  (CUSTOM.BIN loaded into Flash Memory OK)
 +
 +=========================
 +Flashing Routine Complete
 +=========================
 +elapsed time: 174 seconds
 +
 +
 + *** REQUESTED OPERATION IS COMPLETE ***</​nowiki>​
 +</​WRAP>​\\
 +  * Backup the whole flash: ''​./​zjtag -backup:​custom /​window:​1e000000 /​start:​1e000000 /​length:​1000000 /wiggler /​BE''​
 +  * Backup the calibration data: ''​./​zjtag -backup:​custom /​window:​1e000000 /​start:​1EEFE000 /​length:​2000 /wiggler /​BE''​\\ or for the flash chip MX29LV128DB: ​ ''​./​zjtag -backup:​custom /​window:​1e000000 /​start:​1EF7E000 /​length:​2000 /wiggler /​BE''​
 +
 +It's also possible to use **UrJTAG**. It's faster compared with HairyDairymaid based software. Sometimes it fails to enter debug mode, but after several attempts, once entered debug mode, it works totally ok. Probably deleting the bootloader before using UrJTAG would help to enter debug mode. Using the nTRST pin would also help to enter debug mode.
 +  * The following is a session of flashing the bootloader using UrJTAG, it only took one minute included the verification:<​WRAP bootlog>
 +<​nowiki>​
 +# jtag       
 +
 +UrJTAG 0.10 #2051
 +Copyright (C) 2002, 2003 ETC s.r.o.
 +Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors
 +
 +UrJTAG is free software, covered by the GNU General Public License, and you are
 +welcome to change it and/or distribute copies of it under certain conditions.
 +There is absolutely no warranty for UrJTAG.
 +
 +warning: UrJTAG may damage your hardware!
 +Type "​quit"​ to exit, "​help"​ for help.
 +
 +jtag> cable wiggler ppdev /​dev/​parport0
 +Initializing ppdev port /​dev/​parport0
 +jtag> detect ​          
 +IR length: 5
 +Chain length: 1
 +Device Id: 00000110001101011000000101111111 (0x0635817F)
 +  Manufacturer:​ Broadcom (0x17F)
 +  Part(0): ​     BCM6358 (0x6358)
 +  Stepping: ​    V1
 +  Filename: ​    /​usr/​share/​urjtag/​broadcom/​bcm6358/​bcm6358
 +jtag> endian big 
 +jtag> initbus ejtag_dma
 +ImpCode=00000110001101011000000101111111
 +EJTAG version: <= 2.0
 +EJTAG Implementation flags: R4k ASID_6 MIPS16 DMA MIPS64
 +Clear memory protection bit in DCR
 +Clear Watchdog
 +Potential flash base address: [0x0], [0x1e00000c]
 +Processor successfully switched in debug mode.
 +jtag> detectflash 0x1e000000
 +Query identification string:
 +        Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/​Fujitsu Standard Command Set)
 +        Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null)
 +Query system interface information:​
 +        Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV
 +        Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV
 +        Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV
 +        Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV
 +        Typical timeout per single byte/word program: 8 us
 +        Typical timeout for maximum-size multi-byte program: 64 us
 +        Typical timeout per individual block erase: 512 ms
 +        Typical timeout for full chip erase: 524288 ms
 +        Maximum timeout for byte/word program: 64 us
 +        Maximum timeout for multi-byte program: 2048 us
 +        Maximum timeout per individual block erase: 4096 ms
 +        Maximum timeout for chip erase: 2097152 ms
 +Device geometry definition:
 +        Device Size: 16777216 B (16384 KiB, 16 MiB)
 +        Flash Device Interface Code description:​ 0x0002 (x8/x16)
 +        Maximum number of bytes in multi-byte program: 64
 +        Number of Erase Block Regions within device: 1
 +        Erase Block Region Information:​
 +                Region 0:
 +                        Erase Block Size: 131072 B (128 KiB)
 +                        Number of Erase Blocks: 128
 +Primary Vendor-Specific Extended Query:
 +        Major version number: 1
 +        Minor version number: 3
 +        Address Sensitive Unlock: Required
 +        Process Technology: Bad value
 +        Erase Suspend: Read/write
 +        Sector Protect: 1 sectors per group
 +        Sector Temporary Unprotect: Supported
 +        Sector Protect/​Unprotect Scheme: Bad value
 +        Simultaneous Operation: Not supported
 +        Burst Mode Type: Supported
 +        Page Mode Type: 8 word Page
 +        ACC (Acceleration) Supply Minimum: 9500 mV
 +        ACC (Acceleration) Supply Maximum: 10500 mV
 +        Top/Bottom Sector Flag: Uniform top boot device
 +        Program Suspend: Not supported
 +jtag> flashmem 0x1e000000 cfe6358-nvr.bin
 +Chip: AMD Flash
 +        Manufacturer:​ Macronix
 +        Chip: Unknown (ID 0x227e)
 +        Protected: 0000
 +program:
 +flash_unlock_block 0x1E000000 IGNORE
 +
 +block 0 unlocked
 +flash_erase_block 0x1E000000
 +flash_erase_block 0x1E000000 DONE
 +erasing block 0: 0
 +addr: 0x1E00F6EA
 +verify:
 +addr: 0x1E00F6EA
 +Done.
 +jtag></​nowiki>​
 +</​WRAP>​\\
 +
 +
 +==== GPIOs ====
 +
 +=== Buttons ===
 +->​[[doc:​howto:​hardware.button]]
 +
 +The HG556a has four buttons:
 +
 +^ BUTTON label             ^ Event (OEM)   ^ Openwrt name   ^ Openwrt code   ^ GPIO (A, B)  ^ GPIO (C) ^
 +| ?                        | diagnostic ​   |    **help** ​   | KEY_HELP ​      ​| ​  ​8 ​   |  36  |
 +| {{media:​huawei:​led-wifi_red.png?​18&​nolink}} | wifi on/off |    **wlan** ​   | KEY_WLAN |   ​9 ​   |   ​9 ​   |
 +| RESTART ​                 | reboot ​       |  **restart** ​  | KEY_RESTART ​   |   ​10 ​  ​| ​  ​10 ​  |
 +| RESET                    | reset         ​| ​  ​**reset** ​   | KEY_CONFIG ​    ​| ​  ​11 ​  ​| ​  ​11 ​  |
 +
 +=== Leds ===
 +->​[[doc:​uci:​system#​leds|System configuration:​ Leds]]
 +
 +^ Label                                                     ^^ description ^  GPIO (A, B)  ^  GPIO (C)  ^
 +|  {{media:​huawei:​led-message_red.png?​22&​nolink}} ​     || message ​    ​| ​ 0   ​| ​ 12  |
 +|   ​{{media:​huawei:​led-hspa_red.png?​22&​nolink}} ​       || hspa        |  1   ​| ​ 15  |
 +|   ​{{media:​huawei:​led-wifi_red.png?​22&​nolink}} ​       || wifi        |  n/a  |  n/a  |
 +|    {{media:​huawei:​led-dsl_red.png?​22&​nolink}} ​       || dsl         ​| ​ 2   ​| ​ 2  |
 +|   ​{{media:​huawei:​led-power_red.png?​22&​nolink}} ​      || power       ​| ​ 3   ​| ​ 3  |
 +|                          n/a                              || all         ​| ​ 6   ​| ​ n/a  |
 +| LAN1 | {{media:​huawei:​led-dot_green.png?​22&​nolink}} ​  ​| ​            ​| ​ 12  |  0   |
 +| :::  | {{media:​huawei:​led-dot_red.png?​22&​nolink}} ​    ​| ​            ​| ​ 13  |  13  |
 +| LAN2 | {{media:​huawei:​led-dot_green.png?​22&​nolink}} ​  ​| ​            ​| ​ 15  |  1   |
 +| :::  | {{media:​huawei:​led-dot_red.png?​22&​nolink}} ​    ​| ​            ​| ​ 22  |  22  |
 +| LAN3 | {{media:​huawei:​led-dot_green.png?​22&​nolink}} ​  ​| ​            ​| ​ 23  |  23  |
 +| :::  | {{media:​huawei:​led-dot_red.png?​22&​nolink}} ​    ​| ​            ​| ​ 26  |  26  |
 +| LAN4 | {{media:​huawei:​led-dot_green.png?​22&​nolink}} ​  ​| ​            ​| ​ 27  |  27  |
 +| :::  | {{media:​huawei:​led-dot_red.png?​22&​nolink}} ​    ​| ​            ​| ​ 28  |  28  |
 +
 +=== Other ===
 +
 +^ PCB markings^ location ​ ^  GPIO (A,B)  ^
 +| {{:​media:​huawei:​hg556:​hg556a_ab-gpios-extra.jpg?​linkonly|}} | R427 |  4  |
 +| ::: | R446 |  5   |
 +| ::: | R906 |  25  |
 +| ::: | R602 |  29  |
 +| ::: | VIA-R415 |  30  |
 +| {{:​media:​huawei:​hg556:​hg556a_spi_le88266.jpg?​linkonly|}} | Le88266 |  24  |
 +| ::: | ::: |  32  |
 +GPIOs 25 and 29 are unused. GPIO29 can be converted to TXD1, for a second serial UART port after kernel patching -> http://​pastebin.com/​qcjGAfJZ. GPIOs 4 and 5 are used by the bootloader to get the board model. ​
 +For the GPIO30, we can safely cut the trace that goes to the memory flash chip.
 +
 +^ location ^  GPIO (C)  ^
 +| R446/R440 |  4   |
 +| R476/​R441 ​ |  5   ​| ​  
 +| U400     ​| ​ 6   |
 +| R450     ​| ​ 7   |
 +| R906/​R923/​U900 |  25  |
 +| R415     ​| ​ 30  |
 +| Le88266DLC/​R433 ​  ​| ​ 32  | 
 +| R429/R939 |  34   |
 +| R946/R430 |  37   |
 +
 +==== SPI ====
 +**[[wp>​Serial_Peripheral_Interface_Bus|Serial Peripheral Interface]]** ​
 +
 +The BCM6358 SoC has a [[doc/​hardware/​soc/​soc.broadcom.bcm63xx#​spi|SPI]] controller. The HG556a SPI pins are exposed on the board, at the place for a **Si3050** chip which isn't soldered. We can use this SPI interface for connecting our own SPI stuff, but we need to build the kernel with the drivers and proper platform data code for registering the SPI device. This is the pinout:
 +
 +{{media:​huawei:​hg556:​hg556a_spi.jpg?​500x300|}}
 +
 +This SPI interface is also connected to the **Le88266** VoiP chip, but using the Slave Select 2 (GPIO32): {{media:​huawei:​hg556:​hg556a_spi_le88266.jpg?​linkonly|}} {{:​media:​datasheets:​le88286-pinout.png?​linkonly|}}
 +
 +Code example for **spidev** kernel module board support, the added code is highlighted in green:
 +
 +<​HTML>​
 +<pre class="​code"​ style="​font:​11px/​12px monospace">​
 +<font color="​green">​static struct spi_board_info hw556_spi_info[] = {
 + {
 + .bus_num = 0,
 + .chip_select = 1,
 + .mode = 0,
 + .max_speed_hz = 781000,
 + .modalias = "​spidev",​
 + },
 +};</​font>​
 +
 +static struct board_info __initdata board_HW556_B = {
 + .name = "​HW556_B",​
 + .expected_cpu_id = 0x6358,
 +
 + .has_uart0 = 1,
 + .has_pci = 1,
 + .has_ohci0 = 1,
 + .has_ehci0 = 1,
 + .num_usbh_ports = 2,
 +
 + .has_caldata = 1,
 + .caldata = {
 + {
 + .vendor = PCI_VENDOR_ID_ATHEROS,​
 + .caldata_offset = 0xefe000,
 + .slot = 1,
 + .endian_check = 1,
 + .led_pin = 2,
 + },
 + },
 +
 + .has_enet1 = 1,
 + .enet1 = {
 + .has_phy = 1,
 + .phy_id = 0,
 + .force_speed_100 = 1,
 + .force_duplex_full = 1,
 + },
 +<font color="​green">​
 + .spis = hw556_spi_info,​
 + .num_spis = ARRAY_SIZE(hw556_spi_info),</​font>​
 +};
 +</​pre>​
 +</​HTML>​
 +
 +The SPI controller is able to work with these speeds (kHz): 20000, 12500, 6250, 3125, 1563, 781(default),​ 391
 +
 +  * Demo video connecting a SPI display, (781 kHz):\\ {{youtube>​3BNs52wyl1s?​large}}\\ using 20 MHz:\\ {{youtube>​9LltQ8kO2b0?​large}}
 +
 +Unfortunatelly the [[http://​lxr.free-electrons.com/​source/​drivers/​spi/​spi-bcm63xx.c|bcm63xx SPI driver]] is a bit broken. Some stuff might not work.
 +==== VoIP ====
 +The HG556a has two FXS ports for connecting a phone, allowing to use VoIP features. The board has **Le88266** VoiP chip, connected via SPI interface and using the Slave Select 2 (GPIO32), the RESET# pin is connected to the GPIO24.
 +
 +{{media:​huawei:​hg556:​hg556a_spi_le88266.jpg?​500x300|}} {{:​media:​datasheets:​le88286-pinout.png?​direct&​350x300|}}
 +
 +Not officially supported, but some drivers are available (not tested):
 +
 +[[https://​github.com/​pgid69/​bcm63xx-phone]]
 +
 +==== Relays ====
 +The board is equiped with two AXICOM IM02N relays. One of them is controlled via GPIO14.
 +
 +{{media:​huawei:​hg556:​hg556a_relays-top.jpg?​300x200|}}
 +
 +| AXICOM IM02N ||
 +| {{:​media:​huawei:​relay-axicom-im02n.png?​250|}} |''​Vdc<​sub>​nom</​sub>​ = 4.5 V 
 +Vdc<​sub>​min</​sub>​ = 3.38 V
 +Vdc<​sub>​max</​sub>​ = 10.8 V
 +
 +Coil power =140 mW
 +Coil resistance = 145 ohm
 +
 +Switching power 60 W / 62.5 VA
 +Switching voltage 220 VDC / 250VAC
 +Switching current 2 A
 +
 +Non-latching,​ Monostable''​ |
 +
 +On the bottom side we can see clearer how these relays are wired
 +
 +{{media:​huawei:​hg556:​hg556a_relays-bottom2.jpg?​300x200|}}
 +
 +===== Debricking =====
 +-> [[doc:​howto:​generic.debrick]]
 +
 +===== CFE Bootloader =====
 +  - you could read about [[doc:​techref:​bootloader]] in general
 +
 +With a serial console we can get some interesting info
 +
 +About the version and build:
 +
 +| <​code>​ CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE)
 +Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)</​code>​ |
 +
 +And about the possible boards compatible with this CFE:
 +| <​code>​CFE> ​
 +b
 +Press: ​ <​enter>​ to use current value
 +
 +        '​-'​ to go previous parameter
 +
 +        '​.'​ to clear the current value
 +
 +        '​x'​ to exit this command
 +
 +Board Id Name (0-11) ​
 +HW6358GW_A ​      ​------- ​ 0
 +HW6358GW_B ​      ​------- ​ 1
 +HW550            ------- ​ 2
 +HW550_FXO ​       ------- ​ 3
 +HW553            ------- ​ 4
 +HW556            ------- ​ 5
 +HW556aV2 ​        ​------- ​ 6
 +96358VW2 ​        ​------- ​ 7
 +96358VW-16 ​      ​------- ​ 8
 +96358GW ​         ------- ​ 9
 +96358GW-16 ​      ​------- 10
 +96358M ​          ​------- 11       : ​ 5  </​code>​ |
 +
 +<WRAP round important>​
 +**Borked Board ID:​**\\ ​
 +If you play with the CFE settings you may end with messed Board ID which OpenWrt doesn'​t recognize, spite CFE itself is able to read it correctly
 +</​WRAP>​
 +
 +<WRAP bootlog>
 +<​nowiki>​CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE)
 +Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)
 +Copyright (C) 2006 Huawei Technologies Co. Ltd.
 +
 +
 +Boot Address 0xbe000000
 +
 +Initializing Arena.
 +Initializing Devices.
 +
 +@w45260: Flash Manufacture id :c2
 +
 +@w45260Flash Device id :2201
 +
 +@w45260flipCFIGeometry:​1
 +Parallel flash device: name , id 0x2201, size 16384KB
 +*** GetHG556aBoardVersion = <0> ***
 +
 +CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
 +Total memory: 67108864 bytes (64MB)
 +
 +Total memory used by CFE:  0x80401000 - 0x8052A510 (1217808)
 +Initialized Data:          0x8041F3C0 - 0x80421B60 (10144)
 +BSS Area:                  0x80421B60 - 0x80428510 (27056)
 +Local Heap:                0x80428510 - 0x80528510 (1048576)
 +Stack Area:                0x80528510 - 0x8052A510 (8192)
 +Text (code) segment: ​      ​0x80401000 - 0x8041F3B4 (123828)
 +Boot area (physical): ​     0x0052B000 - 0x0056B000
 +Relocation Factor: ​        ​I:​00000000 - D:00000000
 +
 +*** GetHG556aBoardVersion = <0> ***
 +
 +Board IP address ​                 : 192.168.1.1  ​
 +Host IP address ​                  : 192.168.1.100  ​
 +Gateway IP address ​               :   
 +Run from flash/host (f/h)         : f  ​
 +Default host run file name        : vmlinux  ​
 +Default host flash file name      : bcm963xx_fs_kernel  ​
 +Boot delay (0-9 seconds) ​         : 1  ​
 +Board Id Name                     : HW556  ​
 +Psi size in KB                    : 64
 +Number of MAC Addresses (1-32) ​   : 14  ​
 +Base MAC Address ​                 : 64:​16:​f0:​dd:​f1:​fa  ​
 +Ethernet PHY Type                 : Internal
 +Memory size in MB                 : 64
 +CMT Thread Number ​                : 1
 +
 +*** Press any key to stop auto run (1 seconds) ***
 +Auto run second count down: 1\0x081\0x080
 +boot kernel from be020100
 +Code Address: 0x80010000, Entry Address: 0x80010000
 +Decompression OK!
 +Entry at 0x80010000
 +Closing network.
 +Starting program at 0x80010000
 +[    0.000000] Linux version 3.3.8 (dani@tool) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #2 Mon Feb 9 16:10:39 CET 2015
 +[    0.000000] Detected Broadcom 0x6358 CPU revision a1
 +[    0.000000] CPU frequency is 300 MHz
 +[    0.000000] 64MB of RAM installed
 +[    0.000000] registering 40 GPIOs
 +[    0.000000] gpiochip_add:​ registered GPIOs 0 to 39 on device: bcm63xx-gpio
 +[    0.000000] board_bcm963xx:​ Resetting USB PLL... ​ done
 +[    0.000000] board_bcm963xx:​ Boot address 0xbe000000
 +[    0.000000] board_bcm963xx:​ CFE version: 100.48.56-49.46
 +[    0.000000] board_bcm963xx:​ unknown bcm963xx board: HW556_CW_B
 +[    0.000000] bootconsole [early0] enabled
 +[    0.000000] CPU revision is: 0002a010 (Broadcom BMIPS4350)
 +[    0.000000] Kernel panic - not syncing: unable to detect bcm963xx board</​nowiki>​
 +</​WRAP>​\\
 +
 +To solve it, enter in the CFE command line and first change the board ID to **96358GW**,​ then reboot and change it again to **HW556**.
 +
 +see -> https://​dev.openwrt.org/​ticket/​14063
 +
 +===== Hardware mods =====
 + -> as a beginner, you really should inform yourself about [[doc:​hardware:​soldering]] in general and then obtain some practical experience!
 +
 +==== External antenna mod ====
 +
 +On the HG55VDFA VER.C board there are two antennas. One is an [[http://​www.airgain.com/​pdfs/​Profile30.pdf|Airgain A2430GN ]]antenna (6dbi peak gain), the other is a crappy PCB antenna commonly used by manufacturers to save costs.
 +
 +{{media:​huawei:​hg556:​hg556a_antennas-ver.c.jpg?​direct&​400x240|}}
 +
 +For this mod the PCB antenna is invalidated by cutting the signal trace on the board. Then just solder the pigtail cable with the signal wire before the cut, and the shield to any point near the small connector, or on the connector itself.
 +
 +{{media:​huawei:​hg556:​hg556a_antenna-modd.jpg?​direct&​400x240|}} ​
 +
 +==== Buzzer mod ====
 +
 +In this mod we will add an active buzzer (DC buzzer) to the router. We will use this simple circuit
 +
 +{{:​media:​doc:​howtos:​buzzer-mod-low.png?​direct&​200|}}
 +
 +The buzzer will be soldered to a LED on the board, this way we can control both at the same time.
 +
 +Components:
 +  * Active buzzer, AKA DC buzzer.
 +  * 1 kohm resistor
 +  * 1 PNP transistor (2N3906 or other)
 +
 +Solder the components on the board following the previous schematic:
 +
 +{{:​media:​doc:​howtos:​buzzer-mod-low-board.jpg?​direct&​300|}}
 +
 +Now configure the LED where the buzzer was soldered. Or use /​sys/​class/​leds interface.
 +
 +Example:
 +
 +Install the morse led trigger:\\
 +''​opkg update
 +opkg install kmod-ledtrig-morse''​
 +
 +Send an SOS to the world
 +<code bash>​echo morse > /​sys/​class/​leds/​HW556:​green:​lan4/​trigger
 +echo "​SOS"​ > /​sys/​class/​leds/​HW556:​green:​lan4/​message</​code>​
 +
 +more details at [[doc/​howto/​buzzer-mod]]
 +
 +===== Firmware mods =====
 +==== Backports ====
 +  * Backfire backport (**10.03.1**). Only HG55VDFA VER.C boards:\\ [[https://​docs.google.com/​uc?​export=download&​id=0B-EMoBe-_OdBSGRHSjlDb3pjOWM|hg556a_ath_backport_10.03.1.zip]]
 +
 +  * Attitude Adjustment backport (**12.09**):​\\ [[https://​docs.google.com/​uc?​export=download&​id=0B-EMoBe-_OdBdU5VTHc5Q2o2aEU|hg556a_backport_12.09.zip]]
 +
 +
 +===== BOOTLOGS =====
 +==== OEM bootlog ====
 +
 +<WRAP bootlog>
 +<​nowiki>​CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE)
 +Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)
 +Copyright (C) 2006 Huawei Technologies Co. Ltd.
 +
 +
 +Boot Address 0xbe000000
 +
 +Initializing Arena.
 +Initializing Devices.
 +
 +@w45260: Flash Manufacture id :c2
 +@w45260Flash Device id :2201
 +@w45260flipCFIGeometry:​1
 +
 +Parallel flash device: name , id 0x2201, size 16384KB
 +*** GetHG556aBoardVersion = <0> ***
 +
 +CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
 +Total memory: 67108864 bytes (64MB)
 +
 +Total memory used by CFE:  0x80401000 - 0x8052A510 (1217808)
 +Initialized Data:          0x8041F3C0 - 0x80421B60 (10144)
 +BSS Area:                  0x80421B60 - 0x80428510 (27056)
 +Local Heap:                0x80428510 - 0x80528510 (1048576)
 +Stack Area:                0x80528510 - 0x8052A510 (8192)
 +Text (code) segment: ​      ​0x80401000 - 0x8041F3B4 (123828)
 +Boot area (physical): ​     0x0052B000 - 0x0056B000
 +Relocation Factor: ​        ​I:​00000000 - D:00000000
 +
 +*** GetHG556aBoardVersion = <0> ***
 +
 +Board IP address ​                 : 192.168.1.1  ​
 +Host IP address ​                  : 192.168.1.100  ​
 +Gateway IP address ​               :   
 +Run from flash/host (f/h)         : f  ​
 +Default host run file name        : vmlinux  ​
 +Default host flash file name      : bcm963xx_fs_kernel  ​
 +Boot delay (0-9 seconds) ​         : 1  ​
 +Board Id Name                     : HW556  ​
 +Psi size in KB                    : 64
 +Number of MAC Addresses (1-32) ​   : 14  ​
 +Base MAC Address ​                 : 5c:​4c:​a9:​6e:​4a:​a2  ​
 +Ethernet PHY Type                 : Internal
 +Memory size in MB                 : 64
 +CMT Thread Number ​                : 1
 +
 +*** Press any key to stop auto run (1 seconds) ***
 +Auto run second count down: 110
 +boot kernel from be9b2100
 +Code Address: 0x80010000, Entry Address: 0x8022a018
 +Decompression OK!
 +Entry at 0x8022a018
 +Closing network.
 +Starting program at 0x8022a018
 +Linux version 2.6.8.1 (root@IBM_x346) (gcc version 3.4.2) #2 Wed Jun 9 14:58:23 CST 2010
 +
 +
 +@w45260: Flash Manufacture id :c2
 +@w45260Flash Device id :2201
 +@w45260flipCFIGeometry:​1
 +
 +Parallel flash device: name , id 0x2201, size 16384KB
 +Total Flash size: 16384K with 128 sectors
 +
 +
 +Board id is set HW556, ucHardwareType 0
 +
 +fInfo.flash_wlanparam_start_blk = 119
 +fInfo.flash_wlanparam_number_blk = 1
 +fInfo.flash_wlanparam_length = 0x2000
 +fInfo.flash_wlanparam_blk_offset = 0x1e000
 +
 +
 +HW556 prom init
 +CPU revision is: 0002a010
 +Determined physical RAM map:
 + ​memory:​ 03f91920 @ 00000000 (usable)
 +On node 0 totalpages: 16273
 +  DMA zone: 16273 pages, LIFO batch:3
 +  Normal zone: 0 pages, LIFO batch:1
 +  HighMem zone: 0 pages, LIFO batch:1
 +Built 1 zonelists
 +Kernel command line: root=31:0 ro noinitrd
 +brcm mips: enabling icache and dcache...
 +Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes.
 +Primary data cache 16kB 2-way, linesize 16 bytes.
 +PID hash table entries: 256 (order 8: 2048 bytes)
 +Using 150.000 MHz high precision timer.
 +Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
 +Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
 +
 +Allocating memory for DSP module core and initialization code
 +Allocated DSP module memory - CORE=0x81099cc0 SIZE=732896,​ INIT=0x0 SIZE=0
 +
 +Memory: 61212k/​65092k available (1828k kernel code, 3816k reserved, 319k data, 76k init, 0k highmem)
 +Calibrating delay loop... 299.00 BogoMIPS
 +Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
 +Checking for '​wait'​ instruction... ​ unavailable.
 +softirq policy:0
 +softirq nice:0, prio:120
 +NET: Registered protocol family 16
 +Can't analyze prologue code at 801d7a94
 +SCSI subsystem initialized
 +usbcore: registered new driver usbfs
 +usbcore: registered new driver hub
 +NTFS driver 2.1.15 [Flags: R/O].
 +Initializing Cryptographic API
 +PPP generic driver version 2.4.2
 +NET: Registered protocol family 24
 +Using noop io scheduler
 +bcm963xx_mtd driver v1.0
 +
 +PCI: Enabling device 0000:​00:​0a.0 (0000 -> 0002)
 +ehci_hcd 0000:​00:​0a.0:​ EHCI Host Controller
 +PCI: Setting latency timer of device 0000:​00:​0a.0 to 64
 +ehci_hcd 0000:​00:​0a.0:​ irq 18, pci mem c0000300
 +ehci_hcd 0000:​00:​0a.0:​ new USB bus registered, assigned bus number 1
 +PCI: cache line size of 32 is not supported by device 0000:​00:​0a.0
 +ehci_hcd 0000:​00:​0a.0:​ USB f.f enabled, EHCI 1.00, driver 2004-May-10
 +hub 1-0:1.0: USB hub found
 +hub 1-0:1.0: 2 ports detected
 +ohci_hcd: 2004 Feb 02 USB 1.1 '​Open'​ Host Controller (OHCI) Driver (PCI)
 +ohci_hcd: block sizes: ed 64 td 64
 +PCI: Enabling device 0000:​00:​09.0 (0000 -> 0002)
 +ohci_hcd 0000:​00:​09.0:​ OHCI Host Controller
 +PCI: Setting latency timer of device 0000:​00:​09.0 to 64
 +ohci_hcd 0000:​00:​09.0:​ irq 13, pci mem c0002400
 +ohci_hcd 0000:​00:​09.0:​ new USB bus registered, assigned bus number 2
 +hub 2-0:1.0: USB hub found
 +hub 2-0:1.0: 2 ports detected
 +usbcore: registered new driver usblp
 +drivers/​usb/​class/​usblp.c:​ v0.13: USB Printer Device Class driver
 +Initializing USB Mass Storage driver...
 +usbcore: registered new driver usb-storage
 +USB Mass Storage support registered.
 +drivers/​usb/​serial/​usb-serial.c:​ USB Serial support registered for Generic
 +usbcore: registered new driver usbserial_generic
 +usbcore: registered new driver usbserial
 +drivers/​usb/​serial/​usb-serial.c:​ USB Serial Driver core v2.0
 +brcmboard: brcm_board_init entry
 +
 +SES: Button GPIO 0x8009 is enabled
 +SES: LED GPIO 0x8009 is enabled
 +@@Board@@ GetHarewareType = 0x0
 +bcm963xx_serial driver v2.0
 +u32 classifier
 +NET: Registered protocol family 2
 +IP: routing cache hash table of 512 buckets, 4Kbytes
 +TCP: Hash tables configured (established 4096 bind 8192)
 +Initializing IPsec netlink socket
 +NET: Registered protocol family 1
 +NET: Registered protocol family 17
 +NET: Registered protocol family 15
 +Ebtables v2.0 registered
 +NET: Registered protocol family 8
 +NET: Registered protocol family 20
 +802.1Q VLAN Support v1.8 Ben Greear <​greearb@candelatech.com>​
 +All bugs added by David S. Miller <​davem@redhat.com>​
 +cfi_flash_sched_init!!!
 +VFS: Mounted root (squashfs filesystem) readonly.
 +Freeing unused kernel memory: 76k freed
 +usb 1-1: new high speed USB device using address 2
 +hub 1-1:1.0: USB hub found
 +hub 1-1:1.0: 2 ports detected
 +
 +init started: ​ BusyBox v1.00 (2010.06.09-07:​05+0000) multi-call binary
 +Algorithmics/​MIPS FPU Emulator v1.5
 +
 +BusyBox v1.00 (2010.06.09-07:​05+0000) Built-in shell (msh)
 +Enter '​help'​ for a list of built-in commands.
 +
 +Loading drivers and kernel modules... ​
 +fuse init (API version 7.8)
 +fuse distribution version: 2.7.3
 +atmapi: module license '​Proprietary'​ taints kernel.
 +blaadd: blaa_detect entry
 +adsl: adsl_init entry
 +Broadcom BCMPROCFS v1.0 initialized
 +Broadcom BCM6358A1 Ethernet Network Device v0.3 Jul 14 2010 19:38:55
 +Config Ethernet Switch Through MDIO Pseudo PHY Interface
 +dgasp: kerSysRegisterDyingGaspHandler:​ eth0 registered ​
 +
 +eth0: MAC Address: 5C:​4C:​A9:​6E:​4A:​A2
 +
 +DSP Driver: DSP init stub
 +
 +Endpoint: endpoint_init entry
 +BOS: Enter bosInit ​
 +Enter bosAppInit ​
 +Exit bosAppInit ​
 +BOS: Exit bosInit ​
 +Endpoint: GetHarewareType <0>
 +Endpoint: endpoint_init COMPLETED
 +drivers/​usb/​serial/​usb-serial.c:​ USB Serial support registered for option1
 +usbcore: registered new driver option
 +drivers/​usb/​serial/​option.c:​ USB Driver for GSM modems: v0.7.1
 +147
 +eth0 Link UP.
 +
 +ip is  192.168.0.1mask is  255.255.255.0,​ ipbegin is  192.168.0.192,​ ipend is  192.168.0.254
 +===7163=attrvalue is 2 set to 104
 +===7163=attrvalue is 2 set to 104
 +xmlGetDhcpHostNameNode(appName dhcphostname,​ objName Entry, attrName option12, attrValue Huawei-HG556a
 +==MTU:​psixml.cpp:​xmlStartPppObjNode:​14260:​Mtu is 1492==
 +xmlEndIgmpProxyNode(calling cfm to get appName igmpproxy, objName proxy_node)
 +==MTU:​psixml.cpp:​xmlStartPppObjNode:​14260:​Mtu is 1492==
 +==IpExt:​psixml.cpp:​xmlGetPppAttr:​14204:​mac is ==
 +value  is  0
 +BcmDb_setSecEnblCfg :fw_enable 0, inflt 0, outflt 0, macflt 0, macmngr 0, nat_enable 1
 +===7163=attrvalue is 2 set to 104
 +===7163=attrvalue is 2 set to 104
 +xmlGetDhcpHostNameNode(appName dhcphostname,​ objName Entry, attrName option12, attrValue Huawei-HG556a
 +==MTU:​psixml.cpp:​xmlStartPppObjNode:​14260:​Mtu is 1492==
 +xmlEndIgmpProxyNode(calling cfm to get appName igmpproxy, objName proxy_node)
 +==MTU:​psixml.cpp:​xmlStartPppObjNode:​14260:​Mtu is 1492==
 +==IpExt:​psixml.cpp:​xmlGetPppAttr:​14204:​mac is ==
 +value  is  0
 +BcmAdsl_Initialize=0xC0066438,​ g_pFnNotifyCallback=0xC007F3F4
 +AnnexCParam=0x7FFF7EA8 AnnexAParam=0x00003987 adsl2=0x00000003
 +pSdramPHY=0xA3FFFFF8,​ 0x150EA5 0xDEADBEEF
 +AdslCoreHwReset:​ AdslOemDataAddr = 0xA3FFBB64
 +AnnexCParam=0x7FFF7EA8 AnnexAParam=0x00003987 adsl2=0x00000003
 +dgasp: kerSysRegisterDyingGaspHandler:​ dsl0 registered ​
 +atmapi: prioritize receive packets
 +ip_tables: (C) 2000-2002 Netfilter core team
 +ip_conntrack version 2.1 (508 buckets, 0 max) - 368 bytes per conntrack
 +ip_conntrack_pptp version 2.1 loaded
 +ip_nat_pptp version 2.0 loaded
 +
 +==> ​  ​Bcm963xx Software Version: V100R001C10B050SP01 ​  <​==
 +
 +device eth0 entered promiscuous mode
 +br0: port 1(eth0) entering learning state
 +br0: topology change detected, propagating
 +br0: port 1(eth0) entering forwarding state
 +*******go there ,the pOption66 is *******:
 +*******go there the pOption67 is ********:
 +*******go there the pOption160 is *******:
 +getopt returned char k
 +setIndexName3
 +pvc2684d: Interface "​nas_0_44"​ created sucessfully
 +setIndexName3
 +pvc2684d: Communicating over ATM 0.0.44, encapsulation:​ LLC
 +setIndexName3
 +pvc2684d: Interface "​ipa_0_34"​ created sucessfully
 +setIndexName3
 +pvc2684d: Communicating over ATM 0.0.34, encapsulation:​ LLC
 +
 +Open file fail in Function: BcmNtwk_initWandevice eth0 left promiscuous mode
 +br0: port 1(eth0) entering disabled state
 +device eth0 entered promiscuous mode
 +br0: port 1(eth0) entering learning state
 +br0: topology change detected, propagating
 +br0: port 1(eth0) entering forwarding state
 +in bcmmac_init
 +acbuf is null
 +init syslog is end
 +
 +Sean@WLAN CHIP Vendor=<​Atheros>,​ ProductId=<​0xff1d>​
 +ath_hal: 0.9.14.25 (<​7>​AR5212<​7>,​ AR5416<​7>,​ RF5111<​7>,​ RF5112<​7>,​ RF2413<​7>,​ RF5413<​7>,​ DEBUG<​7>​)
 +ath_dfs: Version 2.0.0
 +Copyright (c) 2005-2006 Atheros Communications,​ Inc. All Rights Reserved
 +wlan: 0.8.4.2 (Atheros/​multi-bss)
 +ath_rate_atheros:​ Version 2.0.1
 +Copyright (c) 2001-2004 Atheros Communications,​ Inc, All Rights Reserved
 +ath_pci: 0.9.4.5 (Atheros/​multi-bss)
 +ath_pci: CR-LSDK-1.3.1.71
 +
 +PCI: Enabling device 0000:​00:​01.0 (0000 -> 0002)
 +
 +Chan  Freq  RegPwr ​ HT   CTL CTL_U CTL_L DFS
 +   ​1 ​ 2412n     ​20 ​ HT20  1    0    1     N
 +   ​1 ​ 2412n     ​20 ​ HT40  1    0    1     N
 +   ​2 ​ 2417n     ​20 ​ HT40  1    0    1     N
 +   ​3 ​ 2422n     ​20 ​ HT40  1    1    1     N
 +   ​4 ​ 2427n     ​20 ​ HT40  1    1    1     N
 +   ​5 ​ 2432n     ​20 ​ HT40  1    1    1     N
 +   ​6 ​ 2437n     ​20 ​ HT40  1    1    1     N
 +   ​7 ​ 2442n     ​20 ​ HT40  1    1    1     N
 +   ​8 ​ 2447n     ​20 ​ HT40  1    1    1     N
 +   ​9 ​ 2452n     ​20 ​ HT40  1    1    1     N
 +  10  2457n     ​20 ​ HT40  1    1    1     N
 +  11  2462n     ​20 ​ HT40  1    1    1     N
 +  12  2467n     ​20 ​ HT40  1    1    0     N
 +  13  2472n     ​20 ​ HT40  1    1    0     N
 +dfs_init_radar_filters:​ dfs->​dfs_rinfo.rn_numradars:​ 0
 +DFS min filter rssiThresh = 21
 +DFS max pulse dur = 131 ticks
 +wifi0: 11ng rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
 +wifi0: 11ng MCS:  0,​1,​2,​3,​4,​5,​6,​7,​8,​9,​10,​11,​12,​13,​14,​15
 +wifi0: mac 47.2 phy 13.0<​7>​ radio 12.0<​7>​
 +wifi0: Use hw queue 1 for WME_AC_BE traffic
 +wifi0: Use hw queue 0 for WME_AC_BK traffic
 +wifi0: Use hw queue 2 for WME_AC_VI traffic
 +wifi0: Use hw queue 3 for WME_AC_VO traffic
 +wifi0: Use hw queue 8 for CAB traffic
 +wifi0: Use hw queue 9 for beacons
 +wifi0: Use hw queue 7 for UAPSD
 +wifi0: Atheros 5416 Owl emulation: mem=0x10000000,​ irq=39 hw_base=0xb0000000
 +wlan: mac acl policy registered
 +
 +WlanSetupAll start
 +killall: hostapd: no process killed
 +SIOCGIFFLAGS:​ No such device
 +wlanconfig: ioctl: No such device
 +wlNBwCap[1]wlNCtrlsb[-1]
 +Set WLAN Radio = 1
 +==DEBUG==Atheros_SetupOneVAP,​4427==bWpaPskMode:​1,​m_wlMssidVar[AthIndex].wlWep:​disabled.
 +2xMaxPowerLevel:​ 30 (LEG)
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath0
 +Setting Max Stations:33
 +2xMaxPowerLevel:​ 28 (LEG)
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_newstate:​ Resetting VAP dfswait_run
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2412, Flags 10080, PF 0
 +device ath0 entered promiscuous mode
 +br0: port 2(ath0) entering learning state
 +br0: topology change detected, propagating
 +br0: port 2(ath0) entering forwarding state
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2412, Flags 30080, PF 0
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2417, Flags 30082, PF 0
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2422, Flags 30082, PF 0
 +br0: port 2(ath0) entering disabled state
 +Send SIG(1) to pid 402 on eth down
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_newstate:​ Resetting VAP dfswait_run
 +br0: port 2(ath0) entering learning state
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2412, Flags 10080, PF 0
 +br0: topology change detected, propagating
 +br0: port 2(ath0) entering forwarding state
 +
 +E+E+E+E+E+hostapd is running.
 +2xMaxPowerLevel:​ 28 (LEG)
 +
 +ath_chan_set:​ Changing to channel 2412, Flags 30080, PF 0
 +
 +register normal.
 +SIP: can't Retrieve psi object 11 in app Voice when DialPlan table size loading, errno 3
 +SIP: can't Retrieve psi object 13 in app Voice when CallForward table size loading, errno 3
 +2xMaxPowerLevel:​ 28 (LEG)
 +
 +ath_chan_set:​ Changing to channel 2417, Flags 30082, PF 0
 +iptables: Bad rule (does a matching rule exist in that chain?)
 +iptables: Bad rule (does a matching rule exist in that chain?)
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2422, Flags 30082, PF 0
 +original call init_spanish_mib
 +iptables: Bad rule (does a matching rule exist in that chain?)
 +iptables: Bad rule (does a matching rule exist in that chain?)
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2427, Flags 30082, PF 0
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2432, Flags 30082, PF 0
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2437, Flags 30082, PF 0
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2442, Flags 30082, PF 0
 +BOS: Enter bosInit ​
 +bosTimerInit
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2447, Flags 30082, PF 0
 +Enter bosAppInit ​
 +Exit bosAppInit ​
 +BOS: Exit bosInit ​
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2452, Flags 30082, PF 0
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2457, Flags 30082, PF 0
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2462, Flags 30082, PF 0
 +[DMM]:​Endpoit(3) receives an error digitmap string!, file = Dmm.c, line = 2371
 +
 + UNSPT
 +
 +
 +^
 +
 +2xMaxPowerLevel:​ 28 (LEG)
 +ath_chan_set:​ Changing to channel 2467, Flags 30082, PF 0
 +
 +SipMsgThread MsgThread pid=605
 +------------------------------------------------------------
 + at 946684845.994999 ​    *** Received signal 18 on thread with PID 601
 +------------------------------------------------------------
 +------------------------------------------------------------
 + at 946684846.059999 ​    *** Received signal 18 on thread with PID 601
 +------------------------------------------------------------
 +------------------------------------------------------------
 + at 946684846.124999 ​    *** Received signal 18 on thread with PID 601
 +------------------------------------------------------------
 +2xMaxPowerLevel:​ 28 (LEG)
 +
 +ath_chan_set:​ Changing to channel 2472, Flags 30082, PF 0
 +
 +------------------------------------------------------------
 + at 946684846.199999 ​    *** Received signal 18 on thread with PID 601
 +------------------------------------------------------------
 +Process[voice] set voip status to [1]Process[voice] set voip status to [0]<​7>​ath_newstate:​ Resetting VAP dfswait_run
 +
 +2xMaxPowerLevel:​ 28 (LEG)
 +
 +ath_chan_set:​ Changing to channel 2412, Flags 10080, PF 0
 +
 +kernel::​endpoint_open
 +
 +kernel::​endpoint_open COMPLETED
 +
 +PstnInit Success!Created queue HDSP 
 +00:00:46 CALLCLIENT: Initializing endpoints callSipClientMain
 +voipqosapi: sendto returned -1
 +sipConfig: sipzParamp=0x7fff7150 sipzParamp->​regname= line 59 file  hsip.c
 +sipConfig: sipzParamp=0x7fff7150line 69 file  hsip.c
 +sipConfig: &​mgscb=0x1000e9f0line 82 file  hsip.c
 +00:00:46 CALLCLIENT: Initializing endpoints
 +00:00:46 Endpoint will be initialized for country ESP (country code = 17)
 +
 +00:00:46 Endpoint Event task started with pid 628...
 +
 +00:00:46 Endpoint Packet task started with pid 629 ...
 +
 +Enter bosStartApp
 +
 +bosAppRootTask() - Is it morning already? Spawning app task (epoch #0)...
 +bosAppRootTask() - Is it morning already? Spawning app task (epoch #0)...
 +
 +
 +Enter TaskCreate aoAP
 +TaskCreate - spawn new task aoAP
 +Exit TaskCreate ​
 +AppResetDetectionEnable() - Enabled reset detection.
 +Exit bosStartApp
 +PLL init completed. PLL registers set to:
 +
 +PCM->​pcm_pll_ctrl1 ​      = 0x00020001 ​
 +PCM->​pcm_pll_ctrl2 ​      = 0x0008492B ​
 +PCM->​pcm_pll_ctrl3 ​      = 0x00001E1C ​
 +
 +Set up PCM registers
 +Channel 0 assigned to timeslot 0
 +Channel 1 assigned to timeslot 8
 +Channel 2 assigned to timeslot 1
 +Channel 3 assigned to timeslot 9
 +Channel 4 assigned to timeslot 2
 +
 +Tx Desc (0xA29DE000):​ chan 0, buf 0, sts 0xe000, len 1280, bufp 0x29f4000 ​
 +Tx Desc (0xA29DE008):​ chan 0, buf 1, sts 0x7000, len 1280, bufp 0x29f4510 ​
 +Rx Desc (0xA28FF000):​ chan 0, buf 0, sts 0x8000, len 1280, bufp 0x36b7000 ​
 +Rx Desc (0xA28FF008):​ chan 0, buf 1, sts 0x9000, len 1280, bufp 0x36b7510 ​
 +
 +initIudma: chan 0, descBase 0xa28ff000, descBaseIudma 0x28ff000
 +initIudma: chan 1, descBase 0xa29de000, descBaseIudma 0x29de000
 +
 +PCM ENABLE INFO: DMA0 IRQ STATUS ​ 0x00000000
 +PCM ENABLE INFO: DMA0 IRQ MASK    0x00000005
 +PCM ENABLE INFO: DMA1 IRQ STATUS ​ 0x00000000
 +PCM ENABLE INFO: DMA1 IRQ MASK    0x00000005
 +PCM ENABLE INFO: PCM  IRQ MASK    0x00000003
 +PCM ENABLE INFO: PCM  IRQ PENDING 0x00000007
 +
 +Enter TaskCreate CMT_EXCEPTION_IST
 +
 +TaskCreate - spawn new task CMT_EXCEPTION_IST
 +
 +Exit TaskCreate ​
 +
 +regStatus (reg 12 sel 0)    = 0x10008501 ​
 +regStatus (reg 12 sel 7)    = 0x00000101 ​
 +regCause ​ (reg 13 sel 0)    = 0x00000000 ​
 +regCause ​ (reg 13 sel 7)    = 0x00808000 ​
 +regCMT ​   (reg 22 sel 0)    = 0xe30e1006 ​
 +regCMT ​   (reg 22 sel 1)    = 0xe8008003 ​
 +
 +Kicking off secondary thread processor at entry point 0x81099D00...
 +Secondary thread processor entry point at 0x81099d00
 +Thread processor handshake. Secondary app initialized properly.
 +
 +Enter TaskCreate HTSK
 +
 +TaskCreate - spawn new task HTSK
 +Exit TaskCreate ​
 +
 +SUCCESS: Took semaphore
 +SUCCESS: Gave semaphore
 +
 +INFO: MSPI POLLING MODE
 +INFO: IRQ MASK 0xa0020424
 +INFO: IRQ STATUS 0x400000
 +INFO: BLOCK ENABLES 0x3e0320
 +
 +MSPI INITIALIZED
 +
 +HG55VDFA DoControlRelayStatus:​ disconnect PSTN relay
 +
 +#########​slicLe88221CalDcDc=CH[0]
 +
 +Read data from Rev ID register: 0x04, 0xB3
 +
 +@@@@@@@@@@@@SWcal=[0x1]
 +
 +####​normalChan0Cal:​ 0x08  normalChan1Cal:​ 0x08
 +
 +DAA rstGpioPin=25,​ rlyGpioPin=14
 +
 +     DAA DBG: DAA read failed!!! ​
 +
 + DAA DBG: ISOCAP lock count = 0 
 +
 +Si3050 SLAC Initialised,​ Line side device = Si: 3010 (0xf)
 +System dev rev: 0xf, Line dev rev: 0xf
 +Line dev status: FDT:0x1, LCS: 0x1f
 +DAA initialized with country code 17
 +Detect FXO Chip Failed...
 +Skip daa6358Si3050SetFlyMode due to Not Si3050 Detected.
 +DAA Device Init completed...[19:​38:​34]
 +Initialized DAA driver functions at location 0xc0205968
 +boardHalInit6358:​ Initialization complete.
 +boardHalInit completed
 +Enter TaskCreate HRTBEAT
 +TaskCreate - spawn new task HRTBEAT
 +Exit TaskCreate ​
 +HEARTBEAT: Initialized!
 +g_iRtcpInterval = 3000
 +bosMsgQCreate:​ Created message queue VRGEVQ at address 0x6000c ​
 +Enter TaskCreate VRGEVPR
 +TaskCreate - spawn new task VRGEVPR
 +Exit TaskCreate ​
 +Enter TaskCreate HCAS
 +TaskCreate - spawn new task HCAS
 +Exit TaskCreate ​
 +Enter TaskCreate DMAW
 +TaskCreate - spawn new task DMAW
 +Exit TaskCreate ​
 +*** gStartRxDesc[0] = 0xA28FF000 ​
 +*** gBufferSizeBytes = 1280 
 +*** gStartTxDesc[0] = 0xA29DE000 ​
 +hal6358PcmInit 263 nextTxDesc = 0xA29DE000 ​
 +hal6358PcmInit 263 nextTxDesc = 0xA29DE008 ​
 +hal6358PcmInit 267 Ownership for TX desc not set. Use this buffer. ​
 +PERF->​IrqMask ​  = 0xA0020424 ​
 +PERF->​IrqMask1 ​ = 0x00800000 ​
 +Default value for provItemId '​226'​ did not exist
 +
 +
 +ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x50) of type: 0x0
 +ENDPT: Setting T.38 error correction mode for vhd 80 to 0x104
 +ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x51) of type: 0x0
 +ENDPT: Setting T.38 error correction mode for vhd 81 to 0x104
 +ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x52) of type: 0x0
 +ENDPT: Setting T.38 error correction mode for vhd 82 to 0x104
 +ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x53) of type: 0x0
 +ENDPT: Setting T.38 error correction mode for vhd 83 to 0x104
 +
 +bosMsgQCreate:​ Created message queue PSTN_CTL_EVQ at address 0x6800d ​
 +
 +Enter TaskCreate PSTN
 +TaskCreate - spawn new task PSTN
 +Exit TaskCreate ​
 +
 +pstnCtlInit successful
 +
 +dgasp: kerSysRegisterDyingGaspHandler:​ endpoint registered ​
 +
 +@@DoVrgEndptInit reInjecitonMode=<​0x0>​.
 +
 +00:​00:​50 ​
 +Enter vrgEndptCasTimeParamControl... minHookFlash = 80, maxHookFlash = 250.
 +
 +ENDPT: EPTYPE_FXS
 +ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x54) of type: 0x7
 +
 +Default value for provItemId '​74'​ did not exist
 +Default value for provItemId '​75'​ did not exist
 +
 +
 +minHookFlash = 80.
 +maxHookFlash = 250.
 +
 +Default value for provItemId '​217'​ did not exist
 +Default value for provItemId '​41'​ did not exist
 +Default value for provItemId '​66'​ did not exist
 +Default value for provItemId '​58'​ did not exist
 +Default value for provItemId '​219'​ did not exist
 +
 +ENDPT: Initialization completed successfully for endpt 0
 +
 +00:00:50 SIGNAL: endpt 0, cnx -1, evt 111 (TxGain), value 0
 +00:00:50 SIGNAL: endpt 0, cnx -1, evt 112 (RxGain), value 0
 +ENDPT: EPTYPE_FXS
 +
 +ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x55) of type: 0x7
 +
 +Default value for provItemId '​74'​ did not exist
 +Default value for provItemId '​75'​ did not exist
 +
 +minHookFlash = 80.
 +maxHookFlash = 250.
 +
 +Default value for provItemId '​217'​ did not exist
 +Default value for provItemId '​41'​ did not exist
 +Default value for provItemId '​66'​ did not exist
 +Default value for provItemId '​58'​ did not exist
 +Default value for provItemId '​219'​ did not exist
 +
 +ENDPT: Initialization completed successfully for endpt 1
 +
 +
 +00:00:51 SIGNAL: endpt 1, cnx -1, evt 111 (TxGain), value 0
 +00:00:51 SIGNAL: endpt 1, cnx -1, evt 112 (RxGain), value 0
 +ENDPT: EPTYPE_PSTN
 +ENDPT: hdspVhdOpen PSTN VHD success. DSP 0, VHD (0x56) of type: 0x6
 +ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x57) of type: 0x7
 +
 +Default value for provItemId '​74'​ did not exist
 +Default value for provItemId '​75'​ did not exist
 +
 +minHookFlash = 80.
 +maxHookFlash = 250.
 +
 +Default value for provItemId '​217'​ did not exist
 +
 +DAA driver * for chan 2 is c0244f90
 +Default value for provItemId '​58'​ did not exist
 +Default value for provItemId '​219'​ did not exist
 +DAA driver * for chan 2 is c0244f90
 +DAA driver * for chan 2 is c0244f90
 +DAA: Skip cmd[1] due to on the fly <​0>,<​0>​...
 +ENDPT: Initialization completed successfully for endpt 2
 +
 +
 +00:​00:​51 ​ RTP read thread started with pid 639 
 +00:​00:​51 ​ RTP read thread started with pid 640 
 +00:​00:​51 ​ RTP read thread started with pid 641 
 +00:​00:​51 ​ RTP read thread started with pid 642 
 +00:​00:​51 ​ RTCP thread started with pid 643 
 +00:00:51 rtpInit: RTCP task created, taskId = 14351
 +00:00:51 ccPstnInit: Init PSTN module with dial-plan =  ​
 +00:00:51 gwPstnSignal:​ signal-67, action-0x1, value--1 ​
 +
 +ENDPT: Enable PSTN EC. 
 +ENDPT: ECAN Enabled for endpt 2
 +
 +00:00:51 gwPstnSignal (call setup): value =  ​
 +00:00:51 gwPstnSignal:​ signal-63, action-0x554890,​ value--1 ​
 +
 +vrgEndptSignal (EPSIG_PSTNCALLSETUP) ​
 +
 +00:00:51 gwPstnSignal:​ signal-66, action-0x1, value--1 ​
 +CMTD_CTL: Using default settings
 +
 +CMTD_CTL: setFilterCoeff:​ filtSize79
 +
 +
 +
 +Seized PSTN line 2
 +ConnectSB: connecting line2 and line0 
 +DAA: Skip cmd[2] due to on the fly <​0>,<​0>​...
 +00:00:51 gwPstnSignal:​ signal-68, action-0x1, value--1 ​
 +ENDPT: Disable PSTN EC. 
 +ENDPT: ECAN disabled for endpt 2
 +
 +00:00:51 gwPstnSignal:​ signal-65, action-0x1, value--1 ​
 +Released PSTN line 2
 +
 +DisconnectSB:​ disconnecting line0 and line2 
 +DAA: Skip cmd[0] due to on the fly <​0>,<​0>​...
 +00:00:51 CALLCLIENT: Initialization complete callSipClientMain
 +00:00:51 ccPublishSipEventCB:​ event 0 
 +PSTN_CTL: cmtdCtlConfigFilter success vhd=0x56
 +Enter TaskCreate TM56
 +TaskCreate - spawn new task TM56
 +Exit TaskCreate ​
 +PSTN_CTL: timerTaskMain timer task started, timeout = 5000
 +
 +Get Resource file size = [779725]
 +@@@@Voice@@@FXO Chip Dectected result = <0>.
 +00:​00:​53 ​
 + ​====== HSPA voice Read Thread start ====== ​
 +
 +======start No voice process 10 times=====
 +mkdir: Cannot create directory `/​var/​mnt/​USBDisk_1/​twonkymedia.db':​ No such file or directory
 +DLNA:​syscall.c:​startDlna:​5682:​twonkymedia.db can't be created![10]
 +initDeviceAssociation(entry):​ BcmCfm_ManageableDeviceTbl 0
 +initDeviceAssociation():​ fopen /​var/​udhcpd/​manageable.device failed): return error
 +kill: Could not kill pid '​65535':​ No such process
 +Scratch pad is not initialized.
 +
 +Enter TaskEnterShutdown (task=TM56) ​
 +Exit TaskEnterShutdown (task=TM56) ​
 +Enter bosTaskDestoryR,​ taskId = 82a38928
 +PSTN_CTL: cmtdCtlDisable success vhd=0x56
 +PstnEventCallback:​ PSTN_CTL_EVT_CPTONE_TIMEOUT
 +No scratch pad found. ​ Initialize scratch pad...
 +
 +telnet function started!
 +==DHCPD:​files.c:​write_dnsconf:​498:​==
 +==DHCPD:​files.c:​write_dnsconf:​523:​BUF[address=/#/​192.168.0.1
 +]==
 +Can't get dns's pid
 +URL Filer: open rule file failed!
 +==DNS:​option.c:​read_opts:​2064:​conffile is /​var/​dnsmasq.conf==
 +==DNS:​option.c:​one_file:​1870file is /​var/​dnsmasq.conf:​==
 +==DNS:​option.c:​one_opt:​968:​arg is /#/​192.168.0.1==
 +BcmWL_createAutoCfgSwTsk Called...
 +BcmWL_createAutoCfgSwTsk Success[1026]...
 +Sean@WLAN CHIP Vendor=<​Atheros>,​ ProductId=<​0xff1d>​
 +==HTTPD:​httpd.c:​webmain:​2996:​ATHEROS:​VHG==
 +==MTU:​ifcuiweb.cpp:​BcmWeb_getWanConInfo:​1350:​1492,​1492,​==
 +NTWK_INTF wanObjIndex=2,​ attachToIndex=1
 +IFC_ATM_VCC =255/65535
 +NTWK_INTF wanObjIndex=3,​ attachToIndex=2
 +IFC_ATM_VCC =0/44
 +NTWK_INTF wanObjIndex=4,​ attachToIndex=3
 +IFC_ATM_VCC =0/34
 +Flash Write confliction,​ wait...
 +
 +Flash Write confliction,​ wait...
 +
 +
 +<​TR064>​Line:​150=====start up mac=5c:​4c:​a9:​6e:​4a:​a2
 +
 +<​TR064>​Line:​153=====syspwd=VF-EShg556
 +Flash Write confliction,​ wait...
 +
 +Flash Write confliction,​ wait...
 +
 +NTWK_INTF wanObjIndex=5,​ attachToIndex=4
 +IFC_ATM_VCC =0/33
 +Flash Write confliction,​ wait...
 +
 +Flash Write confliction,​ wait...
 +
 +language option, user:es_ES admin:en_US
 +IFC_ATM_VCC =255/65535
 +IFC_ATM_VCC =0/44
 +IFC_ATM_VCC =0/34
 +IFC_ATM_VCC =0/33
 +SSDP server socket OK!
 +
 +Found INET
 +
 +Found INET
 +Device=br0
 +nmbd: not found
 +Init  port is  80
 +bcmIsDataPvc:​ ppp_255_65535_1 data ifc
 +
 +Cwmp initing...
 +paraattribute ​ name  is    HG553VF
 +bcmIsDataPvc:​ nas_0_44 data ifc(Data)
 +
 +PPP@WLAN CHIP Vendor=<​Atheros>,​ ProductId=<​0xff1d>​
 +Voice channel ​ Query
 +[CwmpReadLoadInfoFromFlash,​230]=======acTmp:​ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ========
 +[CwmpReadLoadInfoFromFlash,​245]=======pulErrCode:​0,​pcCmdkey:​========
 +==DEBUG==BcmSipRegisterQuery 7426==stsOld:​0,​stsHspa:​0,​iHspaDomain:​0,​usVoiceChannel:​1,​iSipChannel:​0,​iVoiceRegister:​0,​glbAdslRegState:​0,​glbHspaRegState:​0
 +sDeviceCount ​ is  0 sSimExist is  -1
 +Voice channel ​ Query
 +==DEBUG==BcmSipRegisterQuery 7426==stsOld:​0,​stsHspa:​0,​iHspaDomain:​0,​usVoiceChannel:​1,​iSipChannel:​0,​iVoiceRegister:​0,​glbAdslRegState:​0,​glbHspaRegState:​0
 +sDeviceCount ​ is  0 sSimExist is  -1
 +sigWanDownProcess
 +cDataMode ​  ​is ​ 0
 +AdslCoreEcUpdTmr:​ timeMs=1800225 ecUpdMask=0x40000</​nowiki>​
 +</​WRAP>​\\
 +
 +==== Openwrt bootlog ====
 +
 +<WRAP bootlog>
 +<​nowiki>​CFE version cfe.d081.5003 for BCM96358 (32bit,​SP,​BE)
 +Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693)
 +Copyright (C) 2006 Huawei Technologies Co. Ltd.
 +
 +
 +Boot Address 0xbe000000
 +
 +Initializing Arena.
 +Initializing Devices.
 +
 +@w45260: Flash Manufacture id :c2
 +
 +@w45260Flash Device id :2201
 +
 +@w45260flipCFIGeometry:​1
 +Parallel flash device: name , id 0x2201, size 16384KB
 +*** GetHG556aBoardVersion = <0> ***
 +
 +CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
 +Total memory: 67108864 bytes (64MB)
 +
 +Total memory used by CFE:  0x80401000 - 0x8052A510 (1217808)
 +Initialized Data:          0x8041F3C0 - 0x80421B60 (10144)
 +BSS Area:                  0x80421B60 - 0x80428510 (27056)
 +Local Heap:                0x80428510 - 0x80528510 (1048576)
 +Stack Area:                0x80528510 - 0x8052A510 (8192)
 +Text (code) segment: ​      ​0x80401000 - 0x8041F3B4 (123828)
 +Boot area (physical): ​     0x0052B000 - 0x0056B000
 +Relocation Factor: ​        ​I:​00000000 - D:00000000
 +
 +*** GetHG556aBoardVersion = <0> ***
 +
 +Board IP address ​                 : 192.168.1.1  ​
 +Host IP address ​                  : 192.168.1.35  ​
 +Gateway IP address ​               :   
 +Run from flash/host (f/h)         : h  ​
 +Default host run file name        : vmlinux  ​
 +Default host flash file name      : bcm963xx_fs_kernel  ​
 +Boot delay (0-9 seconds) ​         : 1  ​
 +Board Id Name                     : HW556  ​
 +Psi size in KB                    : 64
 +Number of MAC Addresses (1-32) ​   : 14  ​
 +Base MAC Address ​                 : 5c:​4c:​a9:​6e:​4a:​a2  ​
 +Ethernet PHY Type                 : Internal
 +Memory size in MB                 : 64
 +CMT Thread Number ​                : 1
 +
 +*** Press any key to stop auto run (1 seconds) ***
 +Auto run second count down: 110
 +0x80010000/​2739096 0x802acb98/​159768 Entry at 0x8021e9f0
 +Closing network.
 +Starting program at 0x8021e9f0
 +[    0.000000] Linux version 2.6.39.4 (dani@tool) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #22 Sat Dec 31 02:13:30 CET 2011
 +[    0.000000] Detected Broadcom 0x6358 CPU revision a1
 +[    0.000000] CPU frequency is 300 MHz
 +[    0.000000] 64MB of RAM installed
 +[    0.000000] registering 40 GPIOs
 +[    0.000000] board_bcm963xx:​ Boot address 0xbe000000
 +[    0.000000] board_bcm963xx:​ CFE version: 100.48.56-49.46
 +[    0.000000] bootconsole [early0] enabled
 +[    0.000000] CPU revision is: 0002a010 (Broadcom BMIPS4350)
 +[    0.000000] board_bcm963xx:​ board name: HW556
 +[    0.000000] Determined physical RAM map:
 +[    0.000000] ​ memory: 04000000 @ 00000000 (usable)
 +[    0.000000] Initrd not found or empty - disabling initrd
 +[    0.000000] Zone PFN ranges:
 +[    0.000000] ​  ​Normal ​  ​0x00000000 -> 0x00004000
 +[    0.000000] Movable zone start PFN for each node
 +[    0.000000] early_node_map[1] active PFN ranges
 +[    0.000000] ​    0: 0x00000000 -> 0x00004000
 +[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
 +[    0.000000] Kernel command line:  root=/​dev/​mtdblock2 rootfstype=squashfs,​jffs2 noinitrd console=ttyS0,​115200
 +[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
 +[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
 +[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
 +[    0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes.
 +[    0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes
 +[    0.000000] Memory: 62016k/​65536k available (2144k kernel code, 3520k reserved, 369k data, 160k init, 0k highmem)
 +[    0.000000] NR_IRQS:128
 +[    0.000000] Calibrating delay loop... 299.26 BogoMIPS (lpj=598528)
 +[    0.036000] pid_max: default: 32768 minimum: 301
 +[    0.040000] Mount-cache hash table entries: 512
 +[    0.052000] NET: Registered protocol family 16
 +[    0.068000] changed ath9k regdomain to 0xff
 +[    0.072000] registering PCI controller with io_map_base unset
 +[    0.084000] bio: create slab <​bio-0>​ at 0
 +[    0.092000] pci 0000:​00:​01.0:​ fixup device configuration
 +[    0.096000] pci-ath9k-fixup:​ Writing 0x0029168c to register 0x6000
 +[    0.100000] pci-ath9k-fixup:​ Writing 0x02800001 to register 0x6008
 +[    0.104000] pci-ath9k-fixup:​ Writing 0x2091168c to register 0x602c
 +[    0.108000] pci-ath9k-fixup:​ Writing 0x002a168c to register 0x5000
 +[    0.112000] pci-ath9k-fixup:​ Writing 0x02800001 to register 0x5008
 +[    0.116000] pci-ath9k-fixup:​ Writing 0x2091168c to register 0x502c
 +[    0.120000] pci-ath9k-fixup:​ Writing 0x05040cc0 to register 0x5064
 +[    0.124000] pci-ath9k-fixup:​ Writing 0x00033811 to register 0x506c
 +[    0.128000] pci-ath9k-fixup:​ Writing 0x0040073b to register 0x4004
 +[    0.132000] pci-ath9k-fixup:​ Writing 0x00000003 to register 0x4074
 +[    0.136000] pci-ath9k-fixup:​ Writing 0x01c20000 to register 0x4000
 +[    0.140000] pci-ath9k-fixup:​ Writing 0x00000044 to register 0x6034
 +[    0.144000] pci-ath9k-fixup:​ Device vendor 0x168c, id 0x0029
 +[    0.164000] pci 0000:​00:​01.0:​ BAR 0: assigned [mem 0x30000000-0x3000ffff]
 +[    0.168000] pci 0000:​00:​01.0:​ BAR 0: set to [mem 0x30000000-0x3000ffff] (PCI address [0x30000000-0x3000ffff])
 +[    0.172000] Switching to clocksource MIPS
 +[    0.184000] NET: Registered protocol family 2
 +[    0.188000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
 +[    0.196000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
 +[    0.204000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
 +[    0.212000] TCP: Hash tables configured (established 2048 bind 2048)
 +[    0.216000] TCP reno registered
 +[    0.220000] UDP hash table entries: 256 (order: 0, 4096 bytes)
 +[    0.228000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
 +[    0.236000] NET: Registered protocol family 1
 +[    0.240000] audit: initializing netlink socket (disabled)
 +[    0.248000] type=2000 audit(0.248:​1):​ initialized
 +[    0.256000] squashfs: version 4.0 (2009/​01/​31) Phillip Lougher
 +[    0.260000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
 +[    0.272000] msgmni has been set to 121
 +[    0.276000] io scheduler noop registered
 +[    0.280000] io scheduler deadline registered (default)
 +[    0.288000] bcm63xx_uart.0:​ ttyS0 at MMIO 0xfffe0100 (irq = 10) is a bcm63xx_uart
 +[    0.296000] console [ttyS0] enabled, bootconsole disabled
 +[    0.296000] console [ttyS0] enabled, bootconsole disabled
 +[    0.312000] bcm963xx-flash bcm963xx-flash.0:​ 0x02000000 at 0x1e000000
 +[    0.316000] bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x00227e
 +[    0.328000] Amd/Fujitsu Extended Query Table at 0x0040
 +[    0.332000] ​  ​Amd/​Fujitsu Extended Query version 1.3.
 +[    0.340000] Using buffer write method
 +[    0.340000] ​  ​Silicon revision: 10
 +[    0.344000] ​  ​Address sensitive unlock: Required
 +[    0.352000] ​  Erase Suspend: Read/write
 +[    0.356000] ​  Block protection: 1 sectors per group
 +[    0.360000] ​  ​Temporary block unprotect: Not supported
 +[    0.364000] ​  Block protect/​unprotect scheme: 8
 +[    0.368000] ​  ​Number of simultaneous operations: 0
 +[    0.376000] ​  Burst mode: Not supported
 +[    0.376000] ​  Page mode: 8 word page
 +[    0.380000] ​  Vpp Supply Minimum Program/​Erase Voltage: 9.5 V
 +[    0.388000] ​  Vpp Supply Maximum Program/​Erase Voltage: 10.5 V
 +[    0.392000] ​  ​Top/​Bottom Boot Block: Uniform, Top WP
 +[    0.400000] number of CFI chips: 1
 +[    0.404000] bcm963xx_flash:​ Read Signature value of CFE1CFE1
 +[    0.408000] bcm963xx-flash bcm963xx-flash.0:​ CFE bootloader detected
 +[    0.416000] bcm963xx_flash:​ CFE boot tag found with version 8 and board type HW556
 +[    0.424000] bcm963xx_flash:​ Partition 0 is CFE offset 0 and length 20000
 +[    0.428000] bcm963xx_flash:​ Partition 1 is kernel offset 20100 and length dff00
 +[    0.436000] bcm963xx_flash:​ Partition 2 is rootfs offset 100000 and length d00000
 +[    0.444000] bcm963xx_flash:​ Partition 3 is ath_data offset e00000 and length 1e0000
 +[    0.452000] bcm963xx_flash:​ Partition 4 is nvram offset fe0000 and length 20000
 +[    0.460000] bcm963xx_flash:​ Partition 5 is linux offset 20000 and length de0000
 +[    0.468000] bcm963xx_flash:​ Spare partition is 340000 offset and length ac0000
 +[    0.476000] Creating 6 MTD partitions on "​bcm963xx":​
 +[    0.480000] 0x000000000000-0x000000020000 : "​CFE"​
 +[    0.488000] mtd: Giving out device 0 to CFE
 +[    0.492000] 0x000000020100-0x000000100000 : "​kernel"​
 +[    0.500000] mtd: partition "​kernel"​ must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
 +[    0.512000] mtd: Giving out device 1 to kernel
 +[    0.520000] 0x000000100000-0x000000e00000 : "​rootfs"​
 +[    0.528000] mtd: Giving out device 2 to rootfs
 +[    0.532000] mtd: partition "​rootfs"​ set to be root filesystem
 +[    0.540000] mtd: partition "​rootfs_data"​ created automatically,​ ofs=340000, len=AC0000 ​
 +[    0.548000] 0x000000340000-0x000000e00000 : "​rootfs_data"​
 +[    0.556000] mtd: Giving out device 3 to rootfs_data
 +[    0.564000] 0x000000e00000-0x000000fe0000 : "​ath_data"​
 +[    0.568000] mtd: Giving out device 4 to ath_data
 +[    0.576000] 0x000000fe0000-0x000001000000 : "​nvram"​
 +[    0.584000] mtd: Giving out device 5 to nvram
 +[    0.588000] 0x000000020000-0x000000e00000 : "​linux"​
 +[    0.596000] mtd: Giving out device 6 to linux
 +[    0.608000] bcm63xx-wdt bcm63xx-wdt.0: ​ started, timer margin: 30 sec
 +[    0.624000] TCP westwood registered
 +[    0.624000] NET: Registered protocol family 17
 +[    0.632000] 802.1Q VLAN Support v1.8 Ben Greear <​greearb@candelatech.com>​
 +[    0.636000] All bugs added by David S. Miller <​davem@redhat.com>​
 +[    0.648000] mtdblock_open
 +[    0.652000] ok
 +^@[    0.660000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
 +[    0.668000] Freeing unused kernel memory: 160k freed
 +awk: /​proc/​cpuinfo:​ No such file or directory
 +[    3.508000] roboswitch: Probing device eth0: found a 5325! It's a 5350.
 +[    4.576000] There is already a switch registered on the device '​eth0'​
 +- preinit -
 +Press the [f] key and hit [enter] to enter failsafe mode
 +- regular preinit -
 +[    9.076000] mtdblock_open
 +[    9.080000] ok
 +[    9.088000] mtdblock_release
 +[    9.092000] ok
 +[    9.172000] MTDSB: lookup_bdev() returned 0
 +[    9.176000] MTDSB: New superblock for device 3 ("​rootfs_data"​)
 +[    9.224000] JFFS2 notice: (317) jffs2_build_xattr_subsystem:​ complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 5 of xref (0 dead, 2 orphan) found.
 +[    9.256000] MTD_open
 +[    9.256000] MTD_ioctl
 +[    9.260000] MTD_ioctl
 +[    9.260000] MTD_close
 +switching to jffs2
 +- init -
 +^@
 +Please press Enter to activate this console. [   ​12.756000] Compat-wireless backport release: compat-wireless-2011-11-29
 +[   ​12.760000] Backport based on wireless-testing.git master-2011-12-01
 +[   ​12.984000] cfg80211: Calling CRDA to update world regulatory domain
 +[   ​13.812000] cfg80211: World regulatory domain updated:
 +[   ​13.816000] cfg80211: ​    ​(start_freq - end_freq @ bandwidth), (max_antenna_gain,​ max_eirp)
 +[   ​13.824000] cfg80211: ​    ​(2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
 +[   ​13.832000] cfg80211: ​    ​(2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
 +[   ​13.844000] cfg80211: ​    ​(2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm)
 +[   ​13.852000] cfg80211: ​    ​(5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
 +[   ​13.860000] cfg80211: ​    ​(5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)
 +[   ​14.532000] SCSI subsystem initialized
 +[   ​14.632000] There is already a switch registered on the device '​eth0'​
 +[   ​15.028000] usbcore: registered new interface driver usbfs
 +[   ​15.036000] usbcore: registered new interface driver hub
 +[   ​15.048000] usbcore: registered new device driver usb
 +[   ​16.632000] PCI: Enabling device 0000:​00:​01.0 (0000 -> 0002)
 +[   ​16.640000] board_bcm963xx:​ Setting device platform data
 +[   ​16.652000] ath: eeprom contains invalid mac address: ff:​ff:​ff:​ff:​ff:​ff
 +[   ​16.660000] ath: random mac address will be used: 66:​94:​cc:​56:​b8:​3c
 +[   ​16.680000] ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xc02e0000,​ irq=39
 +[   ​16.692000] cfg80211: Calling CRDA for country: JP
 +[   ​16.852000] cfg80211: Regulatory domain changed to country: JP
 +[   ​16.860000] cfg80211: ​    ​(start_freq - end_freq @ bandwidth), (max_antenna_gain,​ max_eirp)
 +[   ​16.868000] cfg80211: ​    ​(2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm)
 +[   ​16.876000] cfg80211: ​    ​(2457000 KHz - 2482000 KHz @ 20000 KHz), (N/A, 2000 mBm)
 +[   ​16.884000] cfg80211: ​    ​(2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm)
 +[   ​16.892000] cfg80211: ​    ​(4910000 KHz - 4930000 KHz @ 10000 KHz), (N/A, 2300 mBm)
 +[   ​16.900000] cfg80211: ​    ​(4910000 KHz - 4990000 KHz @ 40000 KHz), (N/A, 2300 mBm)
 +[   ​16.908000] cfg80211: ​    ​(4930000 KHz - 4950000 KHz @ 10000 KHz), (N/A, 2300 mBm)
 +[   ​16.916000] cfg80211: ​    ​(5030000 KHz - 5045000 KHz @ 10000 KHz), (N/A, 2300 mBm)
 +[   ​16.924000] cfg80211: ​    ​(5030000 KHz - 5090000 KHz @ 40000 KHz), (N/A, 2300 mBm)
 +[   ​16.932000] cfg80211: ​    ​(5050000 KHz - 5060000 KHz @ 10000 KHz), (N/A, 2300 mBm)
 +[   ​16.940000] cfg80211: ​    ​(5170000 KHz - 5250000 KHz @ 40000 KHz), (N/A, 2000 mBm)
 +[   ​16.948000] cfg80211: ​    ​(5250000 KHz - 5330000 KHz @ 40000 KHz), (N/A, 2000 mBm)
 +[   ​16.956000] cfg80211: ​    ​(5490000 KHz - 5710000 KHz @ 40000 KHz), (N/A, 2300 mBm)
 +[   ​16.996000] Button Hotplug driver version 0.4.1
 +[   ​17.972000] NTFS driver 2.1.30 [Flags: R/O MODULE].
 +[   ​18.520000] PPP generic driver version 2.4.2
 +[   ​18.752000] ip_tables: (C) 2000-2006 Netfilter Core Team
 +[   ​19.076000] NET: Registered protocol family 24
 +[   ​19.324000] ehci_hcd: USB 2.0 '​Enhanced'​ Host Controller (EHCI) Driver
 +[   ​19.328000] bcm63xx_ehci bcm63xx_ehci.0:​ BCM63XX integrated EHCI controller
 +[   ​19.336000] bcm63xx_ehci bcm63xx_ehci.0:​ new USB bus registered, assigned bus number 1
 +[   ​19.368000] bcm63xx_ehci bcm63xx_ehci.0:​ irq 18, io mem 0xfffe1300
 +[   ​19.384000] bcm63xx_ehci bcm63xx_ehci.0:​ USB 2.0 started, EHCI 1.00, overcurrent ignored
 +[   ​19.392000] hub 1-0:1.0: USB hub found
 +[   ​19.396000] hub 1-0:1.0: 2 ports detected
 +[   ​19.712000] nf_conntrack version 0.5.0 (971 buckets, 3884 max)
 +[   ​19.832000] usb 1-1: new high speed USB device number 2 using bcm63xx_ehci
 +[   ​20.220000] hub 1-1:1.0: USB hub found
 +[   ​20.232000] hub 1-1:1.0: 2 ports detected
 +[   ​20.636000] ohci_hcd: USB 1.1 '​Open'​ Host Controller (OHCI) Driver
 +[   ​20.640000] bcm63xx_ohci bcm63xx_ohci.0:​ BCM63XX integrated OHCI controller
 +[   ​20.648000] bcm63xx_ohci bcm63xx_ohci.0:​ new USB bus registered, assigned bus number 2
 +[   ​20.656000] bcm63xx_ohci bcm63xx_ohci.0:​ irq 13, io mem 0xfffe1400
 +[   ​20.724000] hub 2-0:1.0: USB hub found
 +[   ​20.728000] hub 2-0:1.0: 1 port detected
 +[   ​21.008000] Initializing USB Mass Storage driver...
 +[   ​21.016000] usbcore: registered new interface driver usb-storage
 +[   ​21.020000] USB Mass Storage support registered.
 +[   ​21.232000] input: gpio-buttons as /​devices/​platform/​gpio-buttons.0/​input/​input0
 +[   ​23.260000] eth0: link forced UP - 100/full - flow control off/off
 +[   ​23.692000] device eth0 entered promiscuous mode
 +[   ​23.780000] br-lan: port 1(eth0) entering forwarding state
 +[   ​23.788000] br-lan: port 1(eth0) entering forwarding state
 +[   ​27.972000] device wlan0 entered promiscuous mode
 +[   ​27.980000] br-lan: port 2(wlan0) entering forwarding state
 +[   ​27.984000] br-lan: port 2(wlan0) entering forwarding state
 +[   ​30.392000] device wlan0 left promiscuous mode
 +[   ​30.396000] br-lan: port 2(wlan0) entering forwarding state
 +[   ​30.688000] device wlan0 entered promiscuous mode
 +[   ​30.692000] br-lan: port 2(wlan0) entering forwarding state
 +[   ​30.696000] br-lan: port 2(wlan0) entering forwarding state
 +BusyBox v1.19.3 (2011-12-25 13:56:35 CET) built-in shell (ash)
 +Enter '​help'​ for a list of built-in commands.
 +
 +  _______ ​                    ​________ ​       __
 + ​| ​      ​|.-----.-----.-----.| ​ |  |  |.----.| ​ |_
 + ​| ​  ​- ​  ​|| ​ _  |  -__|     ​|| ​ |  |  ||   ​_|| ​  _|
 + ​|_______|| ​  ​__|_____|__|__||________||__| ​ |____|
 +          |__| W I R E L E S S   F R E E D O M
 + ​ATTITUDE ADJUSTMENT (bleeding edge, r29606) ----------
 +  * 1/4 oz Vodka      Pour all ingredients into mixing
 +  * 1/4 oz Gin        tin with ice, strain into glass.
 +  * 1/4 oz Amaretto
 +  * 1/4 oz Triple sec
 +  * 1/4 oz Peach schnapps
 +  * 1/4 oz Sour mix
 +  * 1 splash Cranberry juice
 + ​-----------------------------------------------------
 +root@OpenWrt:/#</​nowiki>​
 +</​WRAP>​\\
 +
 +
 +===== Notes =====
 +
 +==== cal_data ====
 +In this table we can see the different geometry of flash chips:
 +^ GEOMETRY ^  S29GL128P10 / MX29GL128EH ​ ^  MX29LV128DB ​  ^^
 +^ Boot Block |  Uniform, Top WP  |  Bottom boot  || 
 +^ region |  0  |  0  |  1  | 
 +^ sectors |  0 - 127  |  0 - 7  |  8 - 262  |
 +^ erasesize |  0x20000 ​ |  0x2000 ​ |  0x10000 ​ |
 +
 +The WIFI calibration data location (starts with 0xA55A) is displayed on bootup. . The fInfo.* values appear to be embedded in the kernel :?:
 +
 +Boot log reports:
 +
 +----
 +
 +**MX29GL128EH | S29GL128P10**
 +  ...
 +  Total Flash size: 16384K with 128 sectors
 +  Board id is set HW556, ucHardwareType 0
 +  fInfo.flash_wlanparam_start_blk = 119
 +  fInfo.flash_wlanparam_number_blk = 1
 +  fInfo.flash_wlanparam_length = 0x2000
 +  fInfo.flash_wlanparam_blk_offset = 0x1e000
 +
 +Based on the geometry in the above table let's calculate the offset:
 +
 +**//​119*0x20000+0x1e000 = 0xEFE000//​**
 +
 +If we make a backup of whole flash via JTAG we see it's exactly located at the offset 0xEFE000
 +
 +----
 +**MX29LV128DB**
 +  ...
 +  Total Flash size: 16384K with 263 sectors
 +  Board id is set HW556, ucHardwareType 0
 +  fInfo.flash_wlanparam_start_blk = 254
 +  fInfo.flash_wlanparam_number_blk = 1
 +  fInfo.flash_wlanparam_length = 0x2000
 +  fInfo.flash_wlanparam_blk_offset = 0xe000
 +
 +Based on the geometry in the above table let's calculate the offset again:
 +
 +**//​8*0x2000+(254-8)*0x10000+0xe000 = 0xF7E000//​**
 +
 +===== Tags =====
 +[[meta:​tags|How to add tags]]
 +
 +{{tag>​bcm63xx bcm6358 FastEthernet 4Port hwVLAN 3USB 1WNIC ath9k 802.11bgn NonDetachableAntenna 2Ant 64RAM 16Flash MIPS MIPS32 4buttons JTAG Serial SPI}}