华为EchoLife HG556a
自从R35011版本就已获得支持
该HG556A是一个由沃达丰为其客户定制的ADSL无线路由器。
这是一个好主意来备份cal_data面积闪存芯片。在WLAN校准数据是具体 的设备。如果你不小心Flash，就很难恢复，它不能被闪回厂商的固件恢复。
支持的版本
| 主板型号 |
WIFI芯片 |
VDF版本* |
序列号（第5位） |
OpenWrt的文件（≥CC） |
Flash芯片erasesize ** |
cal_data补偿 |
支持 |
笔记 |
| HG55VDFA VER.C |
Atheros的AR9223 |
HG556 A VDFA |
30462，30605，30608 |
A |
0x10000处 |
0xf7e000 |
是的 |
ADSL不支持
不支持的VoIP |
| HG556 B VDFA |
30562，30692，30693，31300，30634 |
B |
0x20000的 |
0xefe000 |
| HG56BZRB VER.A |
雷凌RT3062F |
HG556 Ç VDFA |
30695，30694，31301，31507，30555，31525，31935，31901，31902 |
Ç |
0x20000的 |
0xeffe00 |
是的 |
*）您可以检查版本从OEM的固件执行命令：hwversion show
**）您可以检查（在OpenWrt的）命令闪存芯片erasesize：cat /proc/mtd
地址0x20000 = 128 Kib
为0x10000 = 64 KIB
选择正确的OpenWrt固件文件的重要参数是闪存芯片erasesize和cal_data失调
硬件亮点
| 系统芯片 |
内存 |
闪光 |
网络 |
USB |
串行 |
JTAG |
| 博通6358 |
64MiB |
16MiB |
4×1 |
是的 |
是的 |
是的 |
安装
→ obtain.firmware
2.
→ 安装的OpenWrt
Flash布局
请查看文章Flash.Layout。它包含一个例子，一对解释。
| 分 |
名字 |
文件系统 |
描述 |
| mtd0 |
CFE |
N / A |
引导程序 |
| N / A |
N / A |
N / A |
固件标签 |
| mtd1 |
核心 |
RAM可执行 |
核心 |
| mtd2 |
根文件系统 |
的squashfs |
Root |
| mtd3 |
rootfs_data |
JFFS2 |
配置，安装新的软件包 |
| mtd4 |
cal_data |
N / A |
wifi的校准数据 |
| mtd5 |
NVRAM |
N / A |
OEM配置数据 |
| mtd6 |
Linux的 |
N / A |
OpenWrt的升级 |
OEM安装方便
本节讨论如何从刚打开的设备上安装的OpenWrt。
获取固件
安装
有了这个程序，你将能Flash固件通过CFE Web界面
1.设置一个静态IP您的计算机上，使用192.168.1.35（或任何匹配），以及以 太网电缆连接到路由器。
2.拔掉路由器的电源线
3.按住按钮RESTART，不释放它呢！
4.插上电源线
5.等待10秒钟,释放RESTART按钮
6.浏览器访问http://192.168.1.1
7.选择下载好的.bin固件
8.按下更新软件启动固件更新过程
9.等待它重新启动
10.telnet到192.168.1.1并设置root密码，或浏览http://192.168.1.1如果安装luci的。
OEM安装使用TFTP方法
连接串行电缆TTL将命令发送到CFE通过TFTP加载固件。
开始在你的PC TFTP服务器。在复制的OpenWrt-HW556-的squashfs-cfe.bin固件到服务器。
在您的PC 192.168.1.35（或任何兼容）设置IP和以太网电缆连接到路由器。
这是通过TFTP闪烁的会话：
CFE> f 192.168.1.35:openwrt-HW556-squashfs-cfe.bin
Loading 192.168.1.35:openwrt-HW556-squashfs-cfe.bin …
Finished loading 2883588 bytes
Flashing root file system and kernel at 0xbe020000:
~~~~~~~Flag: 3
baseAddr 0xbe000000
kernelAddr 0xbe020100
rootfsAddr 0xbe020100
tagFs 0x80800000 . . . . . . . . . . . . . . . . . . . . . . .
Backup flag .
~~~~~~~Flag: 1 .
*** Image flash done *** !
Resetting board…
升级OpenWrt
→ generic.sysupgrade
如果您已经安装了OpenWrt的，喜欢刷写的如升级到一个新的版本的OpenWrt你可以使用MTD命令行工具升级。您将固件映像到的ramdisk（/ tmp目录），你开始Flash之前是很重要的。
LUCI Web界面升级过程
1.浏览到http://192.168.1.1/cgi-bin/luci/mini/system/upgrade/ luci的升级网址
2.为系统升级到Luci上传镜像文件
3.等待重启
终端升级过程
通过SSH对192.168.1.1以root身份登录
使用下面的命令来升级。
cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-HW556-squashfs-cfe.bin
sysupgrade /tmp/openwrt-HW556-squashfs-cfe.bin
如果sysupgrade不支持此路由器，请使用以下命令。
cd /tmp/
wget http://downloads.openwrt.org/snapshots/trunk/brcm63xx/openwrt-HW556-squashfs-cfe.bin
mtd write /tmp/openwrt-HW556-squashfs-cfe.bin linux && reboot
CFE升级过程
这是一个干净，安全的升级，采用了booloader Web界面。只需使用OEM安装程序。
清理旧垃圾
如果升级的OpenWrt后，你得到的消息：
JFFS2：胆小拒不清除的文件系统块，没有有效的JFFS2节点
你不能保存更改。或者你不确定，如果旧数据是搞乱你的新固件。进入OpenWrt的故障保护，如果需要的模式。然后执行以下命令：
MTD擦除-r rootfs_data
原来的固件
这些都是在OEM的固件默认密码
| Firware |
用户 |
密码 |
| 新固件 |
advanced |
advanced |
| 所有 |
emtest |
zbbtest |
| 西班牙语版本 |
admin |
VF-EShg556 |
| 爱尔兰版本 |
admin |
VF-IRhg556 |
| 猕猴桃版本 |
admin |
VF-NZhg556 |
如果你想恢复到OEM的固件，一旦你安装的OpenWrt，你可以使用的OpenWrt Luci Web界面为它Flash作为一个普通的固件。
这很奇怪，但有时OEM的固件无法通过CFE正确Flash。貌似只有OEM的固件与CFE包含在头被CFE正确Flash。
基本配置
→ 基本配置闪烁后，继续与此有关。
设置您的Internet连接，配置无线，配置USB端口等
默认一些固件版本不包括无线驱动程序。安装这些驱动程序先给OpenWrt的互联网接入（见switch_ports_for_vlans），并执行：
如果你的路由器有一个Atheros的无线网络芯片：
- opkg update
- opkg install kmod-ath9k
或者，如果你的路由器版本有Ralink的WiFi芯片
- opkg update
- opkg install kmod-rt2800-pci
您可能还需要安装USB驱动程序
- opkg install kmod-usb-ohci kmod-usb2
如果您使用的是trunk版本，你可能需要安装luci的：
- opkg install luci
- /etc/init.d/uhttpd enable
特殊设置
接口
默认网络配置是：
| 接口名称 |
描述 |
默认配置 |
| BR-LAN |
LAN和WiFi |
192.168.1.1/24 |
| eth0 |
Lan（1至4） |
birdged |
| wlan0 |
WiFi |
birdged（禁用） |
交换机端口（对VLAN）
这是一个例子来配置交换机：数字0-2将LAN，标记为单位端口1-3，3号（LAN4）将是互联网（WAN），五是路由器本身的内部连接。不要被愚弄了：vlan0 = eth0.0，VLAN1 = eth0.1等。
| 端口标签 |
交换机端口 |
模式 |
| LAN1 |
0 |
Lan |
| LAN2 |
1 |
Lan |
| LAN3 |
2 |
Lan |
| LAN4 |
3 |
Internet（WAN） |
| N / A |
5t |
To CPU |
# path: /etc/config/network
# LAN4 = WAN
config interface loopback
option ifname lo
option proto static
option ipaddr 127.0.0.1
option netmask 255.0.0.0
config interface lan
option type bridge
option ifname eth0.1
option proto static
option ipaddr 192.168.1.1
option netmask 255.255.255.0
config interface wan
option ifname eth0.2
option proto dhcp
config switch eth0
option enable 1
option reset 1
option enable_vlan 1
config switch_vlan
option device eth0
option vlan 1
option ports “0 1 2 5t”
config switch_vlan
option device eth0
option vlan 2 option ports “3 5t”
主要核心
该BCM6358片上系统有两个CPU内核。不幸的是Linux内核只能管理一个核心。所述TLB的两个芯之间共享的，并且没有代码来处理这个问题。
由于默认情况下，第二个核心是主要的。由于BCM6358的内核具有不同的特点，在第一个双ICACHE，我们可能想用它作为主要的一个→ 更多ICACHE =更好的性能。用于使用core0问题是初始化，这个任务是由引导程序，而不是的OpenWrt制成。
我们可以手动十六进制编辑引导程序，迫使第一个核心的初始化为主线。或者只是使用此实用程序中的OpenWrt：
tp0set_1.0-1_brcm63xx.ipk
（貌似这个安装包仅与Barrier Breaker or earlier versions of OpenWrt兼容）。测试了十几次成功。
只要安装它，并执行：
tp0set 0
然后重新启动路由器。
这是安装和执行的会话tp0set
root@OpenWrt:/tmp# opkg install tp0set_1.0-1_brcm63xx.ipk
Installing tp0set (1.0-1) to root…
Configuring tp0set.
root@OpenWrt:/tmp# tp0set 0
setting TP0 main core
MTD Type: 3
MTD total size: 20000 bytes
MTD erase size: 20000 bytes
Eraseing Block 0
Writting to /dev/mtd0…
Done!!
root@OpenWrt:/tmp#
这就是你会在dmesg的看到：
之前：[0.000000]初级指令高速缓存16KB，VIPT，2路，LINESIZE 16字节。
后：[0.000000]初级指令高速缓冲存储器的32kB，VIPT，2路，LINESIZE 16字节。
有人报告了这一变化+ 15~20％的额外性能。
这是源代码tp0set
#include <stdio.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <mtd/mtd-user.h>
#include <string.h>
#define DATA_OFFSET 20
#define RAWBYTES_LEN 4
int main(int argc, char *argv[])
{ mtd_info_t mtd_info; // the MTD structure
erase_info_t ei; // the erase block structure
int m;
unsigned int rawBytes; //the bytes we want to write
if (argc != 2) {
printf(“Usage: tp0set [0/1]\n”);
return 1;
}
m = atoi(argv[1]); //convert argument to integer
if( m == 1) {
rawBytes = 0x10000000;
printf(“setting TP1 main core\n”);
}
else if ( m == 0 ) {
rawBytes = 0x00000000;
printf(“setting TP0 main core\n”);
}
else {
printf(“only 0 or 1 allowed\n”);
return 1;
}
unsigned char read_buf[0x20000] = {0x00};
// empty array for reading
int fd = open(“/dev/mtd0”, O_RDWR);
// open the mtd device for reading and
// writing. Note you want mtd0 not mtdblock0
// also you probably need to open permissions
// to the dev (sudo chmod 777 /dev/mtd0)
ioctl(fd, MEMGETINFO, &mtd_info); // get the device info
// dump it for a sanity check, should match what’s in /proc/mtd
printf(“MTD Type: %x\nMTD total size: %x bytes\nMTD erase size: %x bytes\n”,
mtd_info.type, mtd_info.size, mtd_info.erasesize);
lseek(fd, 0, SEEK_SET); // go to the first block
read(fd, read_buf, sizeof(read_buf)); // read and store CFE in read_buf
memcpy(read_buf + DATA_OFFSET, (unsigned char*)&rawBytes, RAWBYTES_LEN); //write some bytes to CFE
ei.length = mtd_info.erasesize; //set the erase block size
for(ei.start = 0; ei.start < mtd_info.size; ei.start += ei.length)
{
ioctl(fd, MEMUNLOCK, &ei);
printf(“Eraseing Block %#x\n”, ei.start); // show the blocks erasing
// warning, this might print a lot!
ioctl(fd, MEMERASE, &ei);
}
printf(“Writting to /dev/mtd0…\n”); //
lseek(fd, 0, SEEK_SET); // go back to first block’s start
write(fd, read_buf, sizeof(read_buf)); // write our modified CFE
close(fd);
printf(“Done!!\n”);
return 0;}
变化永远生存，不管我们安装一个新的固件，甚至完全消除以前的固件，因为此设置存储在CFE本身。
注：不能使用第一个作为核心与OEM的固件主线程，它会initializating VoIP硬件的东西时，会引起硬件故障。
故障保护模式
→ generic.failsafe
OpenWrt的故障保护：电源在路由器上，反复按按钮RESTART进入故障安全模式（电源指示灯开始闪烁非常快）
CFE故障保护：这是进入的引导程序的命令行。使用串行电缆，按任意键，同时加载CFE。
按钮
→ hardware.button
该HG556a有四个按钮。
| 按钮标签 |
事件（OEM） |
GPIO |
OpenWrt的名字 |
OpenWrt的代码 |
| ？ |
诊断 |
8 |
help |
KEY_HELP |
| （（I）） |
无线开/关 |
9 |
WLAN |
KEY_WLAN |
| 重新开始 |
重启 |
10 |
重新开始 |
KEY_RESTART |
| RESET |
重置 |
11 |
重置 |
KEY_CONFIG |
发光二极管
→ 系统配置：LED灯
| HG55VDFA VER.C |
| 标签 |
描述 |
GPIO |
|
信息 |
0 |
|
HSPA |
1 |
|
无线上网 |
N / A |
|
DSL |
2 |
|
动力 |
3 |
| N / A |
所有 |
6 |
| LAN1 |
|
|
12 |
|
|
13 |
| LAN2 |
|
|
15 |
|
|
22 |
| LAN3 |
|
|
23 |
|
|
26 |
| LAN4 |
|
|
27 |
|
|
28 |
| HG56BZRB VER.A |
| 标签 |
描述 |
GPIO |
|
信息 |
12 |
|
HSPA |
15 |
|
无线上网 |
N / A |
|
DSL |
2 |
|
动力 |
3 |
| LAN1 |
|
|
0 |
|
|
13 |
| LAN2 |
|
|
1 |
|
|
22 |
| LAN3 |
|
|
23 |
|
|
26 |
| LAN4 |
|
|
27 |
|
|
28 |
硬件
信息
|
HG556a A，B（HG55VDFA VER.C） |
HG556a C（HG56BZRB VER.A） |
| 指令集： |
MIPS |
| 供应商： |
博通 |
| 引导程序： |
CFE |
| 主板ID： |
HW556 |
| 系统级芯片： |
BCM6358KFBG |
| CPU @Frq |
BMIPS4350 V1.0 @ 300兆赫 BMIPS双核 |
| 闪存芯片： |
旺宏MX29GL128EH
旺宏MX29LV128DB
Spansion公司S29GL128P10 |
MX29GL128EHT2I-90G |
| Flash大小： |
16 MIB |
| 内存： |
HY5DU121622DTP-J / DDR-333 |
？ |
| RAM大小： |
64 MIB |
| 无线： |
Atheros的AR9223支持802.11b / g / n的（板载） |
雷凌RT3062F支持802.11b / g / n的（板载） |
| 天线： |
2倍，板载，不可拆卸 |
| 开关： |
博通 BCM5325E瓦特/ VLAN支持使用swconfig |
| 互联网： |
ADSL2 +，不支持的OpenWrt |
| 网络电话： |
卓联Le88266DLC，不支持的OpenWrt |
| USB： |
1×2.0的SoC→2×2.0 SMSC HUB USB2502-AEZG |
1×2.0的SoC→2×2.0 Genesys的HUB GL850G |
| + 1X 2.0的SoC |
+ 1X 2.0的SoC |
| 电源适配器： |
12V DC 2A / APS24W-12V2A-EU |
| 系列： |
是的 |
| JTAG： |
是的 |
|
照片
前部和所述壳体的背面的照片：
打开机箱
注意：这会导致保修失效！
若要取下盖子：
|
在路由器的背部取下螺丝标签下隐藏着 |
|
删除路由器的脚 |
|
仔细分离的壳体的两个部分 |
PCB照片
| HG55VDFA VER.C |
HG56BZRB VER.A |
| 顶视图 |
顶视图 |
|
|
| 仰视图 |
仰视图 |
|
|
串行
→ port.serial有关串行端口，串行端口电缆等一般信息
如何连接到这个特定设备的串行端口：
|
使用串行TTL适配器与HG556a连接您的PC。仅连接TX，RX和GND。 |
设置：
波特率：115200
数据位：8
奇偶校验：无
停止位：1
PCB与标记的照片
随着Cutecom（或其它串行控制台软件），开的/ dev / ttyUSB0（你必须有正确的权限）。
JTAG
→ port.jtag有关JTAG端口的一般信息，JTAG电缆等
10针接头标记J400（见背板图片下方）。使用AVR JTAG布局。认可TJTAG版本3.0.1博通CPU
PCB与标记的照片（VER.C）
有迹象表明，支持BCM6358通过JTAG电缆闪烁几个实用程序。在我们的例子中，我们将使用zJTAG（版本1.8）与WIGGLER缓冲光缆。另外，也可以使用一个DLC5缓冲电缆，但不超过15厘米
一个命令来检查我们的CPU是被认证的：
- ./zjtag -probeonly /window:1e000000 /nompi /BE /wiggler
引导程序的备份会话：
- # ./zjtag -backup:custom /window:1e000000 /start:1e000000 /length:20000 /nompi /wiggler /BE ============================================== zJTAG EJTAG Debrick Utility v1.8 RC3 ============================================== cable=wiggler, cabletype=3 Detected IR chain length = 32 There are 1 device(s) in the JTAG chain IDCODE for device 1 is 0x0635817F (IR length:1) Probing bus … Done Defined IR Length is 5 bits CPU assumed running under BIG endian CPU Chip ID: 00000110001101011000000101111111 (0x0635817F) *** Found a Broadcom manufactured BCM6358 REV 01 CPU *** – EJTAG IMPCODE ……. : 00000000100000011000100100000100 (0x00818904) – EJTAG Version ……. : 1 or 2.0 – EJTAG DMA Support … : Yes – EJTAG Implementation flags: R4k MIPS16 MIPS32 Issuing Processor / Peripheral Reset … Done Enabling Memory Writes … Done Halting Processor … … Done Clearing Watchdog … Done Loading CPU Configuration Code … Skipped Probing Flash at Address: 0x1E000000 … Detected Chip ID (VenID:DevID = C27E : 2101) *** Found a CFI Compatiable Flash Chip from Macronix – Flash Chip Window Start …. : 1E000000 – Flash Chip Window Length … : 01000000 – Selected Area Start …….. : 1E000000 – Selected Area Length ……. : 00020000 *** You Selected to Backup the CUSTOM.BIN *** ========================= Backup Routine Started ========================= Saving CUSTOM.BIN.SAVED_20150207_145734 to Disk… Done (CUSTOM.BIN.SAVED_20150207_145734 saved to Disk OK) bytes written: 131072 ========================= Backup Routine Complete ========================= elapsed time: 35 seconds *** REQUESTED OPERATION IS COMPLETE ***
恢复CFE的会话
- # ./zjtag -flash:custom /window:1e000000 /start:1e000000 /length:20000 /wiggler /BE ============================================== zJTAG EJTAG Debrick Utility v1.8 RC3 ============================================== cable=wiggler, cabletype=3 Detected IR chain length = 32 There are 1 device(s) in the JTAG chain IDCODE for device 1 is 0x0635817F (IR length:1) Probing bus … Done Defined IR Length is 5 bits CPU assumed running under BIG endian CPU Chip ID: 00000110001101011000000101111111 (0x0635817F) *** Found a Broadcom manufactured BCM6358 REV 01 CPU *** – EJTAG IMPCODE ……. : 00000000100000011000100100000100 (0x00818904) – EJTAG Version ……. : 1 or 2.0 – EJTAG DMA Support … : Yes – EJTAG Implementation flags: R4k MIPS16 MIPS32 Issuing Processor / Peripheral Reset … Done Enabling Memory Writes … Done Halting Processor … … Done Clearing Watchdog … Done Loading CPU Configuration Code … Skipped Detecting Flash Base Address… Read MPI register value : 1E00000C MPI register show Flash Access Base Addr : 1E000000 Probing Flash at Address: 0x1E000000 … Detected Chip ID (VenID:DevID = C27E : 2101) *** Found a CFI Compatiable Flash Chip from Macronix – Flash Chip Window Start …. : 1E000000 – Flash Chip Window Length … : 01000000 – Selected Area Start …….. : 1E000000 – Selected Area Length ……. : 00020000 *** You Selected to Flash the CUSTOM.BIN *** ========================= Flashing Routine Started ========================= Total Blocks to Erase: 1 Erasing block: 1 (addr = 1E000000)…Done Loading CUSTOM.BIN to Flash Memory… Done (CUSTOM.BIN loaded into Flash Memory OK) ========================= Flashing Routine Complete ========================= elapsed time: 174 seconds *** REQUESTED OPERATION IS COMPLETE ***
备份整个闪存：./zjtag -backup:custom /window:1e000000 /start:1e000000 /length:1000000 /wiggler /BE
备份校准数据：./zjtag -backup:custom /window:1e000000 /start:1EEFE000 /length:2000 /wiggler /BE
或对于闪存芯片MX29LV128DB：
./zjtag -backup:custom /window:1e000000 /start:1EF7E000 /length:2000 /wiggler /BE
它也可以使用UrJTAG。这是更快HairyDairymaid基于软件相比。有时，它不能进入调试模式，但多次尝试后，一旦进入调试模式下，它的工作原理完全正常。可能删除的bootloader使用UrJTAG将有助于进入调试模式之前。使用nTRST引脚也有助于进入调试模式。
下面是使用闪烁的UrJTAG引导程序的会议，只用了1分钟包括验证：
# jtag UrJTAG 0.10 #2051 Copyright (C) 2002, 2003 ETC s.r.o. Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors UrJTAG is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. There is absolutely no warranty for UrJTAG. warning: UrJTAG may damage your hardware! Type “quit” to exit, “help” for help. jtag> cable wiggler ppdev /dev/parport0 Initializing ppdev port /dev/parport0 jtag> detect IR length: 5 Chain length: 1 Device Id: 00000110001101011000000101111111 (0x0635817F) Manufacturer: Broadcom (0x17F) Part(0): BCM6358 (0x6358) Stepping: V1 Filename: /usr/share/urjtag/broadcom/bcm6358/bcm6358 jtag> endian big jtag> initbus ejtag_dma ImpCode=00000110001101011000000101111111 EJTAG version: <= 2.0 EJTAG Implementation flags: R4k ASID_6 MIPS16 DMA MIPS64 Clear memory protection bit in DCR Clear Watchdog Potential flash base address: [0x0], [0x1e00000c] Processor successfully switched in debug mode. jtag> detectflash 0x1e000000 Query identification string: Primary Algorithm Command Set and Control Interface ID Code: 0x0002 (AMD/Fujitsu Standard Command Set) Alternate Algorithm Command Set and Control Interface ID Code: 0x0000 (null) Query system interface information: Vcc Logic Supply Minimum Write/Erase or Write voltage: 2700 mV Vcc Logic Supply Maximum Write/Erase or Write voltage: 3600 mV Vpp [Programming] Supply Minimum Write/Erase voltage: 0 mV Vpp [Programming] Supply Maximum Write/Erase voltage: 0 mV Typical timeout per single byte/word program: 8 us Typical timeout for maximum-size multi-byte program: 64 us Typical timeout per individual block erase: 512 ms Typical timeout for full chip erase: 524288 ms Maximum timeout for byte/word program: 64 us Maximum timeout for multi-byte program: 2048 us Maximum timeout per individual block erase: 4096 ms Maximum timeout for chip erase: 2097152 ms Device geometry definition: Device Size: 16777216 B (16384 KiB, 16 MiB) Flash Device Interface Code description: 0x0002 (x8/x16) Maximum number of bytes in multi-byte program: 64 Number of Erase Block Regions within device: 1 Erase Block Region Information: Region 0: Erase Block Size: 131072 B (128 KiB) Number of Erase Blocks: 128 Primary Vendor-Specific Extended Query: Major version number: 1 Minor version number: 3 Address Sensitive Unlock: Required Process Technology: Bad value Erase Suspend: Read/write Sector Protect: 1 sectors per group Sector Temporary Unprotect: Supported Sector Protect/Unprotect Scheme: Bad value Simultaneous Operation: Not supported Burst Mode Type: Supported Page Mode Type: 8 word Page ACC (Acceleration) Supply Minimum: 9500 mV ACC (Acceleration) Supply Maximum: 10500 mV Top/Bottom Sector Flag: Uniform top boot device Program Suspend: Not supported jtag> flashmem 0x1e000000 cfe6358-nvr.bin Chip: AMD Flash Manufacturer: Macronix Chip: Unknown (ID 0x227e) Protected: 0000 program: flash_unlock_block 0x1E000000 IGNORE block 0 unlocked flash_erase_block 0x1E000000 flash_erase_block 0x1E000000 DONE erasing block 0: 0 addr: 0x1E00F6EA verify: addr: 0x1E00F6EA Done. jtag>
SPI
SPI
串行外设接口
该BCM6358的SoC具有的SPI控制器。在HG556a SPI接口暴露在黑板上，在一个地方Si3050芯片，没有焊接。我们可以利用这个SPI接口，用于连接我们自己的SPI的东西，但我们需要建立一个能与驱动程序和适当的平台数据代码注册SPI器件的内核。这是引脚：
这种SPI接口也连接到Le88266的VoIP芯片，但使用从选择2（GPIO32）：
内核代码示例spidev内核模块，添加的代码以绿色突出显示：
static struct spi_board_info hw556_spi_info[] = {
{
.bus_num = 0,
.chip_select = 1,
.mode = 0,
.max_speed_hz = 781000,
.modalias = “spidev”,
},
};
static struct board_info __initdata board_HW556 = {
.name = “HW556”,
.expected_cpu_id = 0x6358,
.has_uart0 = 1,
.has_pci = 1,
.has_ohci0 = 1,
.has_ehci0 = 1,
.num_usbh_ports = 2,
.has_caldata = 1,
.caldata = {
{
.caldata_offset = 0xe00000,
},
},
.has_enet1 = 1,
.enet1 = {
.has_phy = 1,
.phy_id = 0,
.force_speed_100 = 1,
.force_duplex_full = 1,
},
.leds = {
{
.name = “HW556:red:message”,
.gpio = 0,
.active_low = 1,
},
{
.name = “HW556:red:hspa”,
.gpio = 1,
.active_low = 1,
},
{
.name = “HW556:red:dsl”,
.gpio = 2,
.active_low = 1,
},
{
.name = “HW556:red:power”,
.gpio = 3,
.active_low = 1,
.default_trigger = “default-on”,
},
{
.name = “HW556:red:all”,
.gpio = 6,
.active_low = 1,
.default_trigger = “default-on”,
},
},
.buttons = {
{
.desc = “help”,
.gpio = 8,
.active_low = 1,
.type = EV_KEY,
.code = KEY_HELP,
.debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL,
},
{
.desc = “wlan”,
.gpio = 9,
.active_low = 1,
.type = EV_KEY,
.code = KEY_WLAN,
.debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL,
},
{
.desc = “restart”,
.gpio = 10,
.active_low = 1,
.type = EV_KEY,
.code = KEY_RESTART,
.debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL,
},
{
.desc = “reset”,
.gpio = 11,
.active_low = 1,
.type = EV_KEY,
.code = KEY_CONFIG,
.debounce_interval = BCM963XX_KEYS_DEBOUNCE_INTERVAL,
},
},
.spis = hw556_spi_info,
.num_spis = ARRAY_SIZE(hw556_spi_info),
};
SPI控制器能够与这些速度（kHz）的工作：20000，12500，6250，3125，1563，781（默认值），391
演示视频连接SPI显示，（781千赫）：
使用20 MHz的：
Debricking
→ generic.debrick
CFE的Bootloader
你能读到的bootloader一般
通过一个串行控制台，我们可以得到一些有趣的信息
关于版本和构建：
| CFE版本cfe.d081.5003的BCM96358（32位，SP，BE）建立时间：星期三11月11日2009年10点36分35秒CST（Lihua_68693） |
而关于这个CFE兼容的电路板可能：
| CFE> B新闻：<输入>使用电流值 “ – ”去前面的参数 ‘。’ 清除当前值 “X”退出此命令主板ID名称（0-11） HW6358GW_A ——- 0HW6358GW_B ——- 1HW550 ——- 2HW550_FXO ——- 3HW553 ——- 4HW556 ——- 5HW556aV2 ——- 696358VW2 ——- 796358VW-16 ——- 896358GW ——- 996358GW-16 ——- 1096358M ——- 11：5 |
受损害主板ID：
如果你与你可能会搞砸主板ID其中的OpenWrt不承认，尽管CFE结束CFE设置发挥自身能够正确读取
CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE) Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) Copyright (C) 2006 Huawei Technologies Co. Ltd. Boot Address 0xbe000000 Initializing Arena. Initializing Devices. @w45260: Flash Manufacture id :c2 @w45260Flash Device id :2201 @w45260flipCFIGeometry:1 Parallel flash device: name , id 0x2201, size 16384KB *** GetHG556aBoardVersion = <0> *** CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz Total memory: 67108864 bytes (64MB) Total memory used by CFE: 0x80401000 – 0x8052A510 (1217808) Initialized Data: 0x8041F3C0 – 0x80421B60 (10144) BSS Area: 0x80421B60 – 0x80428510 (27056) Local Heap: 0x80428510 – 0x80528510 (1048576) Stack Area: 0x80528510 – 0x8052A510 (8192) Text (code) segment: 0x80401000 – 0x8041F3B4 (123828) Boot area (physical): 0x0052B000 – 0x0056B000 Relocation Factor: I:00000000 – D:00000000 *** GetHG556aBoardVersion = <0> *** Board IP address : 192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : HW556 Psi size in KB : 64 Number of MAC Addresses (1-32) : 14 Base MAC Address : 64:16:f0:dd:f1:fa Ethernet PHY Type : Internal Memory size in MB : 64 CMT Thread Number : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 1\0x081\0x080 boot kernel from be020100 Code Address: 0x80010000, Entry Address: 0x80010000 Decompression OK! Entry at 0x80010000 Closing network. Starting program at 0x80010000 [ 0.000000] Linux version 3.3.8 (dani@tool) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #2 Mon Feb 9 16:10:39 CET 2015 [ 0.000000] Detected Broadcom 0x6358 CPU revision a1 [ 0.000000] CPU frequency is 300 MHz [ 0.000000] 64MB of RAM installed [ 0.000000] registering 40 GPIOs [ 0.000000] gpiochip_add: registered GPIOs 0 to 39 on device: bcm63xx-gpio [ 0.000000] board_bcm963xx: Resetting USB PLL… done [ 0.000000] board_bcm963xx: Boot address 0xbe000000 [ 0.000000] board_bcm963xx: CFE version: 100.48.56-49.46 [ 0.000000] board_bcm963xx: unknown bcm963xx board: HW556_CW_B [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 0002a010 (Broadcom BMIPS4350) [ 0.000000] Kernel panic – not syncing: unable to detect bcm963xx board 为了解决这个问题，请在CFE命令行和第一改变电路板ID为96358GW，然后重新启动并再次将其更改为HW556。
见→ https://dev.openwrt.org/ticket/14063
硬件MODS
→作为初学者，你真的应该了解一下焊接一般，然后获得一些实践经验！
无MODS呢。
MODS的固件
反向移植
事与愿违反向移植（10.03.1）。只有HG55VDFA VER.C板：hg556a_ath_backport_10.03.1.zip
调整心态反向移植（12.09）：hg556a_backport_12.09.zip
BOOTLOGS
OEM BOOTLOG：
CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE) Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) Copyright (C) 2006 Huawei Technologies Co. Ltd. Boot Address 0xbe000000 Initializing Arena. Initializing Devices. @w45260: Flash Manufacture id :c2 @w45260Flash Device id :2201 @w45260flipCFIGeometry:1 Parallel flash device: name , id 0x2201, size 16384KB *** GetHG556aBoardVersion = <0> *** CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz Total memory: 67108864 bytes (64MB) Total memory used by CFE: 0x80401000 – 0x8052A510 (1217808) Initialized Data: 0x8041F3C0 – 0x80421B60 (10144) BSS Area: 0x80421B60 – 0x80428510 (27056) Local Heap: 0x80428510 – 0x80528510 (1048576) Stack Area: 0x80528510 – 0x8052A510 (8192) Text (code) segment: 0x80401000 – 0x8041F3B4 (123828) Boot area (physical): 0x0052B000 – 0x0056B000 Relocation Factor: I:00000000 – D:00000000 *** GetHG556aBoardVersion = <0> *** Board IP address : 192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : HW556 Psi size in KB : 64 Number of MAC Addresses (1-32) : 14 Base MAC Address : 5c:4c:a9:6e:4a:a2 Ethernet PHY Type : Internal Memory size in MB : 64 CMT Thread Number : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 110 boot kernel from be9b2100 Code Address: 0x80010000, Entry Address: 0x8022a018 Decompression OK! Entry at 0x8022a018 Closing network. Starting program at 0x8022a018 Linux version 2.6.8.1 (root@IBM_x346) (gcc version 3.4.2) #2 Wed Jun 9 14:58:23 CST 2010 @w45260: Flash Manufacture id :c2 @w45260Flash Device id :2201 @w45260flipCFIGeometry:1 Parallel flash device: name , id 0x2201, size 16384KB Total Flash size: 16384K with 128 sectors Board id is set HW556, ucHardwareType 0 fInfo.flash_wlanparam_start_blk = 119 fInfo.flash_wlanparam_number_blk = 1 fInfo.flash_wlanparam_length = 0x2000 fInfo.flash_wlanparam_blk_offset = 0x1e000 HW556 prom init CPU revision is: 0002a010 Determined physical RAM map: memory: 03f91920 @ 00000000 (usable) On node 0 totalpages: 16273 DMA zone: 16273 pages, LIFO batch:3 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: root=31:0 ro noinitrd brcm mips: enabling icache and dcache… Primary instruction cache 16kB, physically tagged, 2-way, linesize 16 bytes. Primary data cache 16kB 2-way, linesize 16 bytes. PID hash table entries: 256 (order 8: 2048 bytes) Using 150.000 MHz high precision timer. Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Allocating memory for DSP module core and initialization code Allocated DSP module memory – CORE=0x81099cc0 SIZE=732896, INIT=0x0 SIZE=0 Memory: 61212k/65092k available (1828k kernel code, 3816k reserved, 319k data, 76k init, 0k highmem) Calibrating delay loop… 299.00 BogoMIPS Mount-cache hash table entries: 512 (order: 0, 4096 bytes) Checking for ‘wait’ instruction… unavailable. softirq policy:0 softirq nice:0, prio:120 NET: Registered protocol family 16 Can’t analyze prologue code at 801d7a94 SCSI subsystem initialized usbcore: registered new driver usbfs usbcore: registered new driver hub NTFS driver 2.1.15 [Flags: R/O]. Initializing Cryptographic API PPP generic driver version 2.4.2 NET: Registered protocol family 24 Using noop io scheduler bcm963xx_mtd driver v1.0 PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) ehci_hcd 0000:00:0a.0: EHCI Host Controller PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0: irq 18, pci mem c0000300 ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1 PCI: cache line size of 32 is not supported by device 0000:00:0a.0 ehci_hcd 0000:00:0a.0: USB f.f enabled, EHCI 1.00, driver 2004-May-10 hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected ohci_hcd: 2004 Feb 02 USB 1.1 ‘Open’ Host Controller (OHCI) Driver (PCI) ohci_hcd: block sizes: ed 64 td 64 PCI: Enabling device 0000:00:09.0 (0000 -> 0002) ohci_hcd 0000:00:09.0: OHCI Host Controller PCI: Setting latency timer of device 0000:00:09.0 to 64 ohci_hcd 0000:00:09.0: irq 13, pci mem c0002400 ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2 hub 2-0:1.0: USB hub found hub 2-0:1.0: 2 ports detected usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Initializing USB Mass Storage driver… usbcore: registered new driver usb-storage USB Mass Storage support registered. drivers/usb/serial/usb-serial.c: USB Serial support registered for Generic usbcore: registered new driver usbserial_generic usbcore: registered new driver usbserial drivers/usb/serial/usb-serial.c: USB Serial Driver core v2.0 brcmboard: brcm_board_init entry SES: Button GPIO 0x8009 is enabled SES: LED GPIO 0x8009 is enabled @@Board@@ GetHarewareType = 0x0 bcm963xx_serial driver v2.0 u32 classifier NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP: Hash tables configured (established 4096 bind 8192) Initializing IPsec netlink socket NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 15 Ebtables v2.0 registered NET: Registered protocol family 8 NET: Registered protocol family 20 802.1Q VLAN Support v1.8 Ben Greear All bugs added by David S. Miller cfi_flash_sched_init!!! VFS: Mounted root (squashfs filesystem) readonly. Freeing unused kernel memory: 76k freed usb 1-1: new high speed USB device using address 2 hub 1-1:1.0: USB hub found hub 1-1:1.0: 2 ports detected init started: BusyBox v1.00 (2010.06.09-07:05+0000) multi-call binary Algorithmics/MIPS FPU Emulator v1.5 BusyBox v1.00 (2010.06.09-07:05+0000) Built-in shell (msh) Enter ‘help’ for a list of built-in commands. Loading drivers and kernel modules… fuse init (API version 7.8) fuse distribution version: 2.7.3 atmapi: module license ‘Proprietary’ taints kernel. blaadd: blaa_detect entry adsl: adsl_init entry Broadcom BCMPROCFS v1.0 initialized Broadcom BCM6358A1 Ethernet Network Device v0.3 Jul 14 2010 19:38:55 Config Ethernet Switch Through MDIO Pseudo PHY Interface dgasp: kerSysRegisterDyingGaspHandler: eth0 registered eth0: MAC Address: 5C:4C:A9:6E:4A:A2 DSP Driver: DSP init stub Endpoint: endpoint_init entry BOS: Enter bosInit Enter bosAppInit Exit bosAppInit BOS: Exit bosInit Endpoint: GetHarewareType <0> Endpoint: endpoint_init COMPLETED drivers/usb/serial/usb-serial.c: USB Serial support registered for option1 usbcore: registered new driver option drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1 147 eth0 Link UP. ip is 192.168.0.1mask is 255.255.255.0, ipbegin is 192.168.0.192, ipend is 192.168.0.254 ===7163=attrvalue is 2 set to 104 ===7163=attrvalue is 2 set to 104 xmlGetDhcpHostNameNode(appName dhcphostname, objName Entry, attrName option12, attrValue Huawei-HG556a ==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492== xmlEndIgmpProxyNode(calling cfm to get appName igmpproxy, objName proxy_node) ==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492== ==IpExt:psixml.cpp:xmlGetPppAttr:14204:mac is == value is 0 BcmDb_setSecEnblCfg :fw_enable 0, inflt 0, outflt 0, macflt 0, macmngr 0, nat_enable 1 ===7163=attrvalue is 2 set to 104 ===7163=attrvalue is 2 set to 104 xmlGetDhcpHostNameNode(appName dhcphostname, objName Entry, attrName option12, attrValue Huawei-HG556a ==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492== xmlEndIgmpProxyNode(calling cfm to get appName igmpproxy, objName proxy_node) ==MTU:psixml.cpp:xmlStartPppObjNode:14260:Mtu is 1492== ==IpExt:psixml.cpp:xmlGetPppAttr:14204:mac is == value is 0 BcmAdsl_Initialize=0xC0066438, g_pFnNotifyCallback=0xC007F3F4 AnnexCParam=0x7FFF7EA8 AnnexAParam=0x00003987 adsl2=0x00000003 pSdramPHY=0xA3FFFFF8, 0x150EA5 0xDEADBEEF AdslCoreHwReset: AdslOemDataAddr = 0xA3FFBB64 AnnexCParam=0x7FFF7EA8 AnnexAParam=0x00003987 adsl2=0x00000003 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered atmapi: prioritize receive packets ip_tables: (C) 2000-2002 Netfilter core team ip_conntrack version 2.1 (508 buckets, 0 max) – 368 bytes per conntrack ip_conntrack_pptp version 2.1 loaded ip_nat_pptp version 2.0 loaded ==> Bcm963xx Software Version: V100R001C10B050SP01 <== device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state *******go there ,the pOption66 is *******: *******go there the pOption67 is ********: *******go there the pOption160 is *******: getopt returned char k setIndexName3 pvc2684d: Interface “nas_0_44” created sucessfully setIndexName3 pvc2684d: Communicating over ATM 0.0.44, encapsulation: LLC setIndexName3 pvc2684d: Interface “ipa_0_34” created sucessfully setIndexName3 pvc2684d: Communicating over ATM 0.0.34, encapsulation: LLC Open file fail in Function: BcmNtwk_initWandevice eth0 left promiscuous mode br0: port 1(eth0) entering disabled state device eth0 entered promiscuous mode br0: port 1(eth0) entering learning state br0: topology change detected, propagating br0: port 1(eth0) entering forwarding state in bcmmac_init acbuf is null init syslog is end Sean@WLAN CHIP Vendor=, ProductId=<0xff1d> ath_hal: 0.9.14.25 (<7>AR5212<7>, AR5416<7>, RF5111<7>, RF5112<7>, RF2413<7>, RF5413<7>, DEBUG<7>) ath_dfs: Version 2.0.0 Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved wlan: 0.8.4.2 (Atheros/multi-bss) ath_rate_atheros: Version 2.0.1 Copyright (c) 2001-2004 Atheros Communications, Inc, All Rights Reserved ath_pci: 0.9.4.5 (Atheros/multi-bss) ath_pci: CR-LSDK-1.3.1.71 PCI: Enabling device 0000:00:01.0 (0000 -> 0002) Chan Freq RegPwr HT CTL CTL_U CTL_L DFS 1 2412n 20 HT20 1 0 1 N 1 2412n 20 HT40 1 0 1 N 2 2417n 20 HT40 1 0 1 N 3 2422n 20 HT40 1 1 1 N 4 2427n 20 HT40 1 1 1 N 5 2432n 20 HT40 1 1 1 N 6 2437n 20 HT40 1 1 1 N 7 2442n 20 HT40 1 1 1 N 8 2447n 20 HT40 1 1 1 N 9 2452n 20 HT40 1 1 1 N 10 2457n 20 HT40 1 1 1 N 11 2462n 20 HT40 1 1 1 N 12 2467n 20 HT40 1 1 0 N 13 2472n 20 HT40 1 1 0 N dfs_init_radar_filters: dfs->dfs_rinfo.rn_numradars: 0 DFS min filter rssiThresh = 21 DFS max pulse dur = 131 ticks wifi0: 11ng rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps wifi0: 11ng MCS: 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 wifi0: mac 47.2 phy 13.0<7> radio 12.0<7> wifi0: Use hw queue 1 for WME_AC_BE traffic wifi0: Use hw queue 0 for WME_AC_BK traffic wifi0: Use hw queue 2 for WME_AC_VI traffic wifi0: Use hw queue 3 for WME_AC_VO traffic wifi0: Use hw queue 8 for CAB traffic wifi0: Use hw queue 9 for beacons wifi0: Use hw queue 7 for UAPSD wifi0: Atheros 5416 Owl emulation: mem=0x10000000, irq=39 hw_base=0xb0000000 wlan: mac acl policy registered WlanSetupAll start killall: hostapd: no process killed SIOCGIFFLAGS: No such device wlanconfig: ioctl: No such device wlNBwCap[1]wlNCtrlsb[-1] Set WLAN Radio = 1 ==DEBUG==Atheros_SetupOneVAP,4427==bWpaPskMode:1,m_wlMssidVar[AthIndex].wlWep:disabled. 2xMaxPowerLevel: 30 (LEG) 2xMaxPowerLevel: 28 (LEG) ath0 Setting Max Stations:33 2xMaxPowerLevel: 28 (LEG) 2xMaxPowerLevel: 28 (LEG) ath_newstate: Resetting VAP dfswait_run 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 10080, PF 0 device ath0 entered promiscuous mode br0: port 2(ath0) entering learning state br0: topology change detected, propagating br0: port 2(ath0) entering forwarding state 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 30080, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2417, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2422, Flags 30082, PF 0 br0: port 2(ath0) entering disabled state Send SIG(1) to pid 402 on eth down 2xMaxPowerLevel: 28 (LEG) ath_newstate: Resetting VAP dfswait_run br0: port 2(ath0) entering learning state 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 10080, PF 0 br0: topology change detected, propagating br0: port 2(ath0) entering forwarding state E+E+E+E+E+hostapd is running. 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 30080, PF 0 register normal. SIP: can’t Retrieve psi object 11 in app Voice when DialPlan table size loading, errno 3 SIP: can’t Retrieve psi object 13 in app Voice when CallForward table size loading, errno 3 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2417, Flags 30082, PF 0 iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2422, Flags 30082, PF 0 original call init_spanish_mib iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2427, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2432, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2437, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2442, Flags 30082, PF 0 BOS: Enter bosInit bosTimerInit 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2447, Flags 30082, PF 0 Enter bosAppInit Exit bosAppInit BOS: Exit bosInit 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2452, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2457, Flags 30082, PF 0 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2462, Flags 30082, PF 0 [DMM]:Endpoit(3) receives an error digitmap string!, file = Dmm.c, line = 2371 UNSPT ^ 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2467, Flags 30082, PF 0 SipMsgThread MsgThread pid=605 ———————————————————— at 946684845.994999 *** Received signal 18 on thread with PID 601 ———————————————————— ———————————————————— at 946684846.059999 *** Received signal 18 on thread with PID 601 ———————————————————— ———————————————————— at 946684846.124999 *** Received signal 18 on thread with PID 601 ———————————————————— 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2472, Flags 30082, PF 0 ———————————————————— at 946684846.199999 *** Received signal 18 on thread with PID 601 ———————————————————— Process[voice] set voip status to [1]Process[voice] set voip status to [0]<7>ath_newstate: Resetting VAP dfswait_run 2xMaxPowerLevel: 28 (LEG) ath_chan_set: Changing to channel 2412, Flags 10080, PF 0 kernel::endpoint_open kernel::endpoint_open COMPLETED PstnInit Success!Created queue HDSP 00:00:46 CALLCLIENT: Initializing endpoints callSipClientMain voipqosapi: sendto returned -1 sipConfig: sipzParamp=0x7fff7150 sipzParamp->regname= line 59 file hsip.c sipConfig: sipzParamp=0x7fff7150line 69 file hsip.c sipConfig: &mgscb=0x1000e9f0line 82 file hsip.c 00:00:46 CALLCLIENT: Initializing endpoints 00:00:46 Endpoint will be initialized for country ESP (country code = 17) 00:00:46 Endpoint Event task started with pid 628… 00:00:46 Endpoint Packet task started with pid 629 … Enter bosStartApp bosAppRootTask() – Is it morning already? Spawning app task (epoch #0)… bosAppRootTask() – Is it morning already? Spawning app task (epoch #0)… Enter TaskCreate aoAP TaskCreate – spawn new task aoAP Exit TaskCreate AppResetDetectionEnable() – Enabled reset detection. Exit bosStartApp PLL init completed. PLL registers set to: PCM->pcm_pll_ctrl1 = 0x00020001 PCM->pcm_pll_ctrl2 = 0x0008492B PCM->pcm_pll_ctrl3 = 0x00001E1C Set up PCM registers Channel 0 assigned to timeslot 0 Channel 1 assigned to timeslot 8 Channel 2 assigned to timeslot 1 Channel 3 assigned to timeslot 9 Channel 4 assigned to timeslot 2 Tx Desc (0xA29DE000): chan 0, buf 0, sts 0xe000, len 1280, bufp 0x29f4000 Tx Desc (0xA29DE008): chan 0, buf 1, sts 0x7000, len 1280, bufp 0x29f4510 Rx Desc (0xA28FF000): chan 0, buf 0, sts 0x8000, len 1280, bufp 0x36b7000 Rx Desc (0xA28FF008): chan 0, buf 1, sts 0x9000, len 1280, bufp 0x36b7510 initIudma: chan 0, descBase 0xa28ff000, descBaseIudma 0x28ff000 initIudma: chan 1, descBase 0xa29de000, descBaseIudma 0x29de000 PCM ENABLE INFO: DMA0 IRQ STATUS 0x00000000 PCM ENABLE INFO: DMA0 IRQ MASK 0x00000005 PCM ENABLE INFO: DMA1 IRQ STATUS 0x00000000 PCM ENABLE INFO: DMA1 IRQ MASK 0x00000005 PCM ENABLE INFO: PCM IRQ MASK 0x00000003 PCM ENABLE INFO: PCM IRQ PENDING 0x00000007 Enter TaskCreate CMT_EXCEPTION_IST TaskCreate – spawn new task CMT_EXCEPTION_IST Exit TaskCreate regStatus (reg 12 sel 0) = 0x10008501 regStatus (reg 12 sel 7) = 0x00000101 regCause (reg 13 sel 0) = 0x00000000 regCause (reg 13 sel 7) = 0x00808000 regCMT (reg 22 sel 0) = 0xe30e1006 regCMT (reg 22 sel 1) = 0xe8008003 Kicking off secondary thread processor at entry point 0x81099D00… Secondary thread processor entry point at 0x81099d00 Thread processor handshake. Secondary app initialized properly. Enter TaskCreate HTSK TaskCreate – spawn new task HTSK Exit TaskCreate SUCCESS: Took semaphore SUCCESS: Gave semaphore INFO: MSPI POLLING MODE INFO: IRQ MASK 0xa0020424 INFO: IRQ STATUS 0x400000 INFO: BLOCK ENABLES 0x3e0320 MSPI INITIALIZED HG55VDFA DoControlRelayStatus: disconnect PSTN relay #########slicLe88221CalDcDc=CH[0] Read data from Rev ID register: 0x04, 0xB3 @@@@@@@@@@@@SWcal=[0x1] ####normalChan0Cal: 0x08 normalChan1Cal: 0x08 DAA rstGpioPin=25, rlyGpioPin=14 DAA DBG: DAA read failed!!! DAA DBG: ISOCAP lock count = 0 Si3050 SLAC Initialised, Line side device = Si: 3010 (0xf) System dev rev: 0xf, Line dev rev: 0xf Line dev status: FDT:0x1, LCS: 0x1f DAA initialized with country code 17 Detect FXO Chip Failed… Skip daa6358Si3050SetFlyMode due to Not Si3050 Detected. DAA Device Init completed…[19:38:34] Initialized DAA driver functions at location 0xc0205968 boardHalInit6358: Initialization complete. boardHalInit completed Enter TaskCreate HRTBEAT TaskCreate – spawn new task HRTBEAT Exit TaskCreate HEARTBEAT: Initialized! g_iRtcpInterval = 3000 bosMsgQCreate: Created message queue VRGEVQ at address 0x6000c Enter TaskCreate VRGEVPR TaskCreate – spawn new task VRGEVPR Exit TaskCreate Enter TaskCreate HCAS TaskCreate – spawn new task HCAS Exit TaskCreate Enter TaskCreate DMAW TaskCreate – spawn new task DMAW Exit TaskCreate *** gStartRxDesc[0] = 0xA28FF000 *** gBufferSizeBytes = 1280 *** gStartTxDesc[0] = 0xA29DE000 hal6358PcmInit 263 nextTxDesc = 0xA29DE000 hal6358PcmInit 263 nextTxDesc = 0xA29DE008 hal6358PcmInit 267 Ownership for TX desc not set. Use this buffer. PERF->IrqMask = 0xA0020424 PERF->IrqMask1 = 0x00800000 Default value for provItemId ‘226’ did not exist ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x50) of type: 0x0 ENDPT: Setting T.38 error correction mode for vhd 80 to 0x104 ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x51) of type: 0x0 ENDPT: Setting T.38 error correction mode for vhd 81 to 0x104 ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x52) of type: 0x0 ENDPT: Setting T.38 error correction mode for vhd 82 to 0x104 ENDPT: hdspVhdOpen Secondary Connection VHD success. DSP 0, VHD (0x53) of type: 0x0 ENDPT: Setting T.38 error correction mode for vhd 83 to 0x104 bosMsgQCreate: Created message queue PSTN_CTL_EVQ at address 0x6800d Enter TaskCreate PSTN TaskCreate – spawn new task PSTN Exit TaskCreate pstnCtlInit successful dgasp: kerSysRegisterDyingGaspHandler: endpoint registered @@DoVrgEndptInit reInjecitonMode=<0x0>. 00:00:50 Enter vrgEndptCasTimeParamControl… minHookFlash = 80, maxHookFlash = 250. ENDPT: EPTYPE_FXS ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x54) of type: 0x7 Default value for provItemId ’74’ did not exist Default value for provItemId ’75’ did not exist minHookFlash = 80. maxHookFlash = 250. Default value for provItemId ‘217’ did not exist Default value for provItemId ’41’ did not exist Default value for provItemId ’66’ did not exist Default value for provItemId ’58’ did not exist Default value for provItemId ‘219’ did not exist ENDPT: Initialization completed successfully for endpt 0 00:00:50 SIGNAL: endpt 0, cnx -1, evt 111 (TxGain), value 0 00:00:50 SIGNAL: endpt 0, cnx -1, evt 112 (RxGain), value 0 ENDPT: EPTYPE_FXS ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x55) of type: 0x7 Default value for provItemId ’74’ did not exist Default value for provItemId ’75’ did not exist minHookFlash = 80. maxHookFlash = 250. Default value for provItemId ‘217’ did not exist Default value for provItemId ’41’ did not exist Default value for provItemId ’66’ did not exist Default value for provItemId ’58’ did not exist Default value for provItemId ‘219’ did not exist ENDPT: Initialization completed successfully for endpt 1 00:00:51 SIGNAL: endpt 1, cnx -1, evt 111 (TxGain), value 0 00:00:51 SIGNAL: endpt 1, cnx -1, evt 112 (RxGain), value 0 ENDPT: EPTYPE_PSTN ENDPT: hdspVhdOpen PSTN VHD success. DSP 0, VHD (0x56) of type: 0x6 ENDPT: hdspVhdOpen Line VHD success. DSP 0, VHD (0x57) of type: 0x7 Default value for provItemId ’74’ did not exist Default value for provItemId ’75’ did not exist minHookFlash = 80. maxHookFlash = 250. Default value for provItemId ‘217’ did not exist DAA driver * for chan 2 is c0244f90 Default value for provItemId ’58’ did not exist Default value for provItemId ‘219’ did not exist DAA driver * for chan 2 is c0244f90 DAA driver * for chan 2 is c0244f90 DAA: Skip cmd[1] due to on the fly <0>,<0>… ENDPT: Initialization completed successfully for endpt 2 00:00:51 RTP read thread started with pid 639 00:00:51 RTP read thread started with pid 640 00:00:51 RTP read thread started with pid 641 00:00:51 RTP read thread started with pid 642 00:00:51 RTCP thread started with pid 643 00:00:51 rtpInit: RTCP task created, taskId = 14351 00:00:51 ccPstnInit: Init PSTN module with dial-plan = 00:00:51 gwPstnSignal: signal-67, action-0x1, value–1 ENDPT: Enable PSTN EC. ENDPT: ECAN Enabled for endpt 2 00:00:51 gwPstnSignal (call setup): value = 00:00:51 gwPstnSignal: signal-63, action-0x554890, value–1 vrgEndptSignal (EPSIG_PSTNCALLSETUP) 00:00:51 gwPstnSignal: signal-66, action-0x1, value–1 CMTD_CTL: Using default settings CMTD_CTL: setFilterCoeff: filtSize79 Seized PSTN line 2 ConnectSB: connecting line2 and line0 DAA: Skip cmd[2] due to on the fly <0>,<0>… 00:00:51 gwPstnSignal: signal-68, action-0x1, value–1 ENDPT: Disable PSTN EC. ENDPT: ECAN disabled for endpt 2 00:00:51 gwPstnSignal: signal-65, action-0x1, value–1 Released PSTN line 2 DisconnectSB: disconnecting line0 and line2 DAA: Skip cmd[0] due to on the fly <0>,<0>… 00:00:51 CALLCLIENT: Initialization complete callSipClientMain 00:00:51 ccPublishSipEventCB: event 0 PSTN_CTL: cmtdCtlConfigFilter success vhd=0x56 Enter TaskCreate TM56 TaskCreate – spawn new task TM56 Exit TaskCreate PSTN_CTL: timerTaskMain timer task started, timeout = 5000 Get Resource file size = [779725] @@@@Voice@@@FXO Chip Dectected result = <0>. 00:00:53 ====== HSPA voice Read Thread start ====== ======start No voice process 10 times===== mkdir: Cannot create directory `/var/mnt/USBDisk_1/twonkymedia.db’: No such file or directory DLNA:syscall.c:startDlna:5682:twonkymedia.db can’t be created![10] initDeviceAssociation(entry): BcmCfm_ManageableDeviceTbl 0 initDeviceAssociation(): fopen /var/udhcpd/manageable.device failed): return error kill: Could not kill pid ‘65535’: No such process Scratch pad is not initialized. Enter TaskEnterShutdown (task=TM56) Exit TaskEnterShutdown (task=TM56) Enter bosTaskDestoryR, taskId = 82a38928 PSTN_CTL: cmtdCtlDisable success vhd=0x56 PstnEventCallback: PSTN_CTL_EVT_CPTONE_TIMEOUT No scratch pad found. Initialize scratch pad… telnet function started! ==DHCPD:files.c:write_dnsconf:498:== ==DHCPD:files.c:write_dnsconf:523:BUF[address=/#/192.168.0.1 ]== Can’t get dns’s pid URL Filer: open rule file failed! ==DNS:option.c:read_opts:2064:conffile is /var/dnsmasq.conf== ==DNS:option.c:one_file:1870file is /var/dnsmasq.conf:== ==DNS:option.c:one_opt:968:arg is /#/192.168.0.1== BcmWL_createAutoCfgSwTsk Called… BcmWL_createAutoCfgSwTsk Success[1026]… Sean@WLAN CHIP Vendor=, ProductId=<0xff1d> ==HTTPD:httpd.c:webmain:2996:ATHEROS:VHG== ==MTU:ifcuiweb.cpp:BcmWeb_getWanConInfo:1350:1492,1492,== NTWK_INTF wanObjIndex=2, attachToIndex=1 IFC_ATM_VCC =255/65535 NTWK_INTF wanObjIndex=3, attachToIndex=2 IFC_ATM_VCC =0/44 NTWK_INTF wanObjIndex=4, attachToIndex=3 IFC_ATM_VCC =0/34 Flash Write confliction, wait… Flash Write confliction, wait… Line:150=====start up mac=5c:4c:a9:6e:4a:a2 Line:153=====syspwd=VF-EShg556 Flash Write confliction, wait… Flash Write confliction, wait… NTWK_INTF wanObjIndex=5, attachToIndex=4 IFC_ATM_VCC =0/33 Flash Write confliction, wait… Flash Write confliction, wait… language option, user:es_ES admin:en_US IFC_ATM_VCC =255/65535 IFC_ATM_VCC =0/44 IFC_ATM_VCC =0/34 IFC_ATM_VCC =0/33 SSDP server socket OK! Found INET Found INET Device=br0 nmbd: not found Init port is 80 bcmIsDataPvc: ppp_255_65535_1 data ifc Cwmp initing… paraattribute name is HG553VF bcmIsDataPvc: nas_0_44 data ifc(Data) PPP@WLAN CHIP Vendor=, ProductId=<0xff1d> Voice channel Query [CwmpReadLoadInfoFromFlash,230]=======acTmp:每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每每======== [CwmpReadLoadInfoFromFlash,245]=======pulErrCode:0,pcCmdkey:======== ==DEBUG==BcmSipRegisterQuery 7426==stsOld:0,stsHspa:0,iHspaDomain:0,usVoiceChannel:1,iSipChannel:0,iVoiceRegister:0,glbAdslRegState:0,glbHspaRegState:0 sDeviceCount is 0 sSimExist is -1 Voice channel Query ==DEBUG==BcmSipRegisterQuery 7426==stsOld:0,stsHspa:0,iHspaDomain:0,usVoiceChannel:1,iSipChannel:0,iVoiceRegister:0,glbAdslRegState:0,glbHspaRegState:0 sDeviceCount is 0 sSimExist is -1 sigWanDownProcess cDataMode is 0 AdslCoreEcUpdTmr: timeMs=1800225 ecUpdMask=0x40000
OpenWrt的BOOTLOG：
CFE version cfe.d081.5003 for BCM96358 (32bit,SP,BE) Build Date: Wed Nov 11 10:36:35 CST 2009 (Lihua_68693) Copyright (C) 2006 Huawei Technologies Co. Ltd. Boot Address 0xbe000000 Initializing Arena. Initializing Devices. @w45260: Flash Manufacture id :c2 @w45260Flash Device id :2201 @w45260flipCFIGeometry:1 Parallel flash device: name , id 0x2201, size 16384KB *** GetHG556aBoardVersion = <0> *** CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz Total memory: 67108864 bytes (64MB) Total memory used by CFE: 0x80401000 – 0x8052A510 (1217808) Initialized Data: 0x8041F3C0 – 0x80421B60 (10144) BSS Area: 0x80421B60 – 0x80428510 (27056) Local Heap: 0x80428510 – 0x80528510 (1048576) Stack Area: 0x80528510 – 0x8052A510 (8192) Text (code) segment: 0x80401000 – 0x8041F3B4 (123828) Boot area (physical): 0x0052B000 – 0x0056B000 Relocation Factor: I:00000000 – D:00000000 *** GetHG556aBoardVersion = <0> *** Board IP address : 192.168.1.1 Host IP address : 192.168.1.35 Gateway IP address : Run from flash/host (f/h) : h Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id Name : HW556 Psi size in KB : 64 Number of MAC Addresses (1-32) : 14 Base MAC Address : 5c:4c:a9:6e:4a:a2 Ethernet PHY Type : Internal Memory size in MB : 64 CMT Thread Number : 1 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 110 0x80010000/2739096 0x802acb98/159768 Entry at 0x8021e9f0 Closing network. Starting program at 0x8021e9f0 [ 0.000000] Linux version 2.6.39.4 (dani@tool) (gcc version 4.5.4 20110808 (prerelease) (Linaro GCC 4.5-2011.08) ) #22 Sat Dec 31 02:13:30 CET 2011 [ 0.000000] Detected Broadcom 0x6358 CPU revision a1 [ 0.000000] CPU frequency is 300 MHz [ 0.000000] 64MB of RAM installed [ 0.000000] registering 40 GPIOs [ 0.000000] board_bcm963xx: Boot address 0xbe000000 [ 0.000000] board_bcm963xx: CFE version: 100.48.56-49.46 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 0002a010 (Broadcom BMIPS4350) [ 0.000000] board_bcm963xx: board name: HW556 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 04000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty – disabling initrd [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00004000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] early_node_map[1] active PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00004000 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes) [ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Primary instruction cache 16kB, VIPT, 2-way, linesize 16 bytes. [ 0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Memory: 62016k/65536k available (2144k kernel code, 3520k reserved, 369k data, 160k init, 0k highmem) [ 0.000000] NR_IRQS:128 [ 0.000000] Calibrating delay loop… 299.26 BogoMIPS (lpj=598528) [ 0.036000] pid_max: default: 32768 minimum: 301 [ 0.040000] Mount-cache hash table entries: 512 [ 0.052000] NET: Registered protocol family 16 [ 0.068000] changed ath9k regdomain to 0xff [ 0.072000] registering PCI controller with io_map_base unset [ 0.084000] bio: create slab at 0 [ 0.092000] pci 0000:00:01.0: fixup device configuration [ 0.096000] pci-ath9k-fixup: Writing 0x0029168c to register 0x6000 [ 0.100000] pci-ath9k-fixup: Writing 0x02800001 to register 0x6008 [ 0.104000] pci-ath9k-fixup: Writing 0x2091168c to register 0x602c [ 0.108000] pci-ath9k-fixup: Writing 0x002a168c to register 0x5000 [ 0.112000] pci-ath9k-fixup: Writing 0x02800001 to register 0x5008 [ 0.116000] pci-ath9k-fixup: Writing 0x2091168c to register 0x502c [ 0.120000] pci-ath9k-fixup: Writing 0x05040cc0 to register 0x5064 [ 0.124000] pci-ath9k-fixup: Writing 0x00033811 to register 0x506c [ 0.128000] pci-ath9k-fixup: Writing 0x0040073b to register 0x4004 [ 0.132000] pci-ath9k-fixup: Writing 0x00000003 to register 0x4074 [ 0.136000] pci-ath9k-fixup: Writing 0x01c20000 to register 0x4000 [ 0.140000] pci-ath9k-fixup: Writing 0x00000044 to register 0x6034 [ 0.144000] pci-ath9k-fixup: Device vendor 0x168c, id 0x0029 [ 0.164000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x3000ffff] [ 0.168000] pci 0000:00:01.0: BAR 0: set to [mem 0x30000000-0x3000ffff] (PCI address [0x30000000-0x3000ffff]) [ 0.172000] Switching to clocksource MIPS [ 0.184000] NET: Registered protocol family 2 [ 0.188000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.196000] TCP established hash table entries: 2048 (order: 2, 16384 bytes) [ 0.204000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes) [ 0.212000] TCP: Hash tables configured (established 2048 bind 2048) [ 0.216000] TCP reno registered [ 0.220000] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.228000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.236000] NET: Registered protocol family 1 [ 0.240000] audit: initializing netlink socket (disabled) [ 0.248000] type=2000 audit(0.248:1): initialized [ 0.256000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.260000] JFFS2 version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.272000] msgmni has been set to 121 [ 0.276000] io scheduler noop registered [ 0.280000] io scheduler deadline registered (default) [ 0.288000] bcm63xx_uart.0: ttyS0 at MMIO 0xfffe0100 (irq = 10) is a bcm63xx_uart [ 0.296000] console [ttyS0] enabled, bootconsole disabled [ 0.296000] console [ttyS0] enabled, bootconsole disabled [ 0.312000] bcm963xx-flash bcm963xx-flash.0: 0x02000000 at 0x1e000000 [ 0.316000] bcm963xx: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x00227e [ 0.328000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.332000] Amd/Fujitsu Extended Query version 1.3. [ 0.340000] Using buffer write method [ 0.340000] Silicon revision: 10 [ 0.344000] Address sensitive unlock: Required [ 0.352000] Erase Suspend: Read/write [ 0.356000] Block protection: 1 sectors per group [ 0.360000] Temporary block unprotect: Not supported [ 0.364000] Block protect/unprotect scheme: 8 [ 0.368000] Number of simultaneous operations: 0 [ 0.376000] Burst mode: Not supported [ 0.376000] Page mode: 8 word page [ 0.380000] Vpp Supply Minimum Program/Erase Voltage: 9.5 V [ 0.388000] Vpp Supply Maximum Program/Erase Voltage: 10.5 V [ 0.392000] Top/Bottom Boot Block: Uniform, Top WP [ 0.400000] number of CFI chips: 1 [ 0.404000] bcm963xx_flash: Read Signature value of CFE1CFE1 [ 0.408000] bcm963xx-flash bcm963xx-flash.0: CFE bootloader detected [ 0.416000] bcm963xx_flash: CFE boot tag found with version 8 and board type HW556 [ 0.424000] bcm963xx_flash: Partition 0 is CFE offset 0 and length 20000 [ 0.428000] bcm963xx_flash: Partition 1 is kernel offset 20100 and length dff00 [ 0.436000] bcm963xx_flash: Partition 2 is rootfs offset 100000 and length d00000 [ 0.444000] bcm963xx_flash: Partition 3 is ath_data offset e00000 and length 1e0000 [ 0.452000] bcm963xx_flash: Partition 4 is nvram offset fe0000 and length 20000 [ 0.460000] bcm963xx_flash: Partition 5 is linux offset 20000 and length de0000 [ 0.468000] bcm963xx_flash: Spare partition is 340000 offset and length ac0000 [ 0.476000] Creating 6 MTD partitions on “bcm963xx”: [ 0.480000] 0x000000000000-0x000000020000 : “CFE” [ 0.488000] mtd: Giving out device 0 to CFE [ 0.492000] 0x000000020100-0x000000100000 : “kernel” [ 0.500000] mtd: partition “kernel” must either start or end on erase block boundary or be smaller than an erase block — forcing read-only [ 0.512000] mtd: Giving out device 1 to kernel [ 0.520000] 0x000000100000-0x000000e00000 : “rootfs” [ 0.528000] mtd: Giving out device 2 to rootfs [ 0.532000] mtd: partition “rootfs” set to be root filesystem [ 0.540000] mtd: partition “rootfs_data” created automatically, ofs=340000, len=AC0000 [ 0.548000] 0x000000340000-0x000000e00000 : “rootfs_data” [ 0.556000] mtd: Giving out device 3 to rootfs_data [ 0.564000] 0x000000e00000-0x000000fe0000 : “ath_data” [ 0.568000] mtd: Giving out device 4 to ath_data [ 0.576000] 0x000000fe0000-0x000001000000 : “nvram” [ 0.584000] mtd: Giving out device 5 to nvram [ 0.588000] 0x000000020000-0x000000e00000 : “linux” [ 0.596000] mtd: Giving out device 6 to linux [ 0.608000] bcm63xx-wdt bcm63xx-wdt.0: started, timer margin: 30 sec [ 0.624000] TCP westwood registered [ 0.624000] NET: Registered protocol family 17 [ 0.632000] 802.1Q VLAN Support v1.8 Ben Greear [ 0.636000] All bugs added by David S. Miller [ 0.648000] mtdblock_open [ 0.652000] ok ^@[ 0.660000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.668000] Freeing unused kernel memory: 160k freed awk: /proc/cpuinfo: No such file or directory [ 3.508000] roboswitch: Probing device eth0: found a 5325! It’s a 5350. [ 4.576000] There is already a switch registered on the device ‘eth0’ – preinit – Press the [f] key and hit [enter] to enter failsafe mode – regular preinit – [ 9.076000] mtdblock_open [ 9.080000] ok [ 9.088000] mtdblock_release [ 9.092000] ok [ 9.172000] MTDSB: lookup_bdev() returned 0 [ 9.176000] MTDSB: New superblock for device 3 (“rootfs_data”) [ 9.224000] JFFS2 notice: (317) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 5 of xref (0 dead, 2 orphan) found. [ 9.256000] MTD_open [ 9.256000] MTD_ioctl [ 9.260000] MTD_ioctl [ 9.260000] MTD_close switching to jffs2 – init – ^@ Please press Enter to activate this console. [ 12.756000] Compat-wireless backport release: compat-wireless-2011-11-29 [ 12.760000] Backport based on wireless-testing.git master-2011-12-01 [ 12.984000] cfg80211: Calling CRDA to update world regulatory domain [ 13.812000] cfg80211: World regulatory domain updated: [ 13.816000] cfg80211: (start_freq – end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 13.824000] cfg80211: (2402000 KHz – 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 13.832000] cfg80211: (2457000 KHz – 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 13.844000] cfg80211: (2474000 KHz – 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 13.852000] cfg80211: (5170000 KHz – 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 13.860000] cfg80211: (5735000 KHz – 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 14.532000] SCSI subsystem initialized [ 14.632000] There is already a switch registered on the device ‘eth0’ [ 15.028000] usbcore: registered new interface driver usbfs [ 15.036000] usbcore: registered new interface driver hub [ 15.048000] usbcore: registered new device driver usb [ 16.632000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002) [ 16.640000] board_bcm963xx: Setting device platform data [ 16.652000] ath: eeprom contains invalid mac address: ff:ff:ff:ff:ff:ff [ 16.660000] ath: random mac address will be used: 66:94:cc:56:b8:3c [ 16.680000] ieee80211 phy0: Atheros AR9280 Rev:2 mem=0xc02e0000, irq=39 [ 16.692000] cfg80211: Calling CRDA for country: JP [ 16.852000] cfg80211: Regulatory domain changed to country: JP [ 16.860000] cfg80211: (start_freq – end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 16.868000] cfg80211: (2402000 KHz – 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm) [ 16.876000] cfg80211: (2457000 KHz – 2482000 KHz @ 20000 KHz), (N/A, 2000 mBm) [ 16.884000] cfg80211: (2474000 KHz – 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm) [ 16.892000] cfg80211: (4910000 KHz – 4930000 KHz @ 10000 KHz), (N/A, 2300 mBm) [ 16.900000] cfg80211: (4910000 KHz – 4990000 KHz @ 40000 KHz), (N/A, 2300 mBm) [ 16.908000] cfg80211: (4930000 KHz – 4950000 KHz @ 10000 KHz), (N/A, 2300 mBm) [ 16.916000] cfg80211: (5030000 KHz – 5045000 KHz @ 10000 KHz), (N/A, 2300 mBm) [ 16.924000] cfg80211: (5030000 KHz – 5090000 KHz @ 40000 KHz), (N/A, 2300 mBm) [ 16.932000] cfg80211: (5050000 KHz – 5060000 KHz @ 10000 KHz), (N/A, 2300 mBm) [ 16.940000] cfg80211: (5170000 KHz – 5250000 KHz @ 40000 KHz), (N/A, 2000 mBm) [ 16.948000] cfg80211: (5250000 KHz – 5330000 KHz @ 40000 KHz), (N/A, 2000 mBm) [ 16.956000] cfg80211: (5490000 KHz – 5710000 KHz @ 40000 KHz), (N/A, 2300 mBm) [ 16.996000] Button Hotplug driver version 0.4.1 [ 17.972000] NTFS driver 2.1.30 [Flags: R/O MODULE]. [ 18.520000] PPP generic driver version 2.4.2 [ 18.752000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 19.076000] NET: Registered protocol family 24 [ 19.324000] ehci_hcd: USB 2.0 ‘Enhanced’ Host Controller (EHCI) Driver [ 19.328000] bcm63xx_ehci bcm63xx_ehci.0: BCM63XX integrated EHCI controller [ 19.336000] bcm63xx_ehci bcm63xx_ehci.0: new USB bus registered, assigned bus number 1 [ 19.368000] bcm63xx_ehci bcm63xx_ehci.0: irq 18, io mem 0xfffe1300 [ 19.384000] bcm63xx_ehci bcm63xx_ehci.0: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 19.392000] hub 1-0:1.0: USB hub found [ 19.396000] hub 1-0:1.0: 2 ports detected [ 19.712000] nf_conntrack version 0.5.0 (971 buckets, 3884 max) [ 19.832000] usb 1-1: new high speed USB device number 2 using bcm63xx_ehci [ 20.220000] hub 1-1:1.0: USB hub found [ 20.232000] hub 1-1:1.0: 2 ports detected [ 20.636000] ohci_hcd: USB 1.1 ‘Open’ Host Controller (OHCI) Driver [ 20.640000] bcm63xx_ohci bcm63xx_ohci.0: BCM63XX integrated OHCI controller [ 20.648000] bcm63xx_ohci bcm63xx_ohci.0: new USB bus registered, assigned bus number 2 [ 20.656000] bcm63xx_ohci bcm63xx_ohci.0: irq 13, io mem 0xfffe1400 [ 20.724000] hub 2-0:1.0: USB hub found [ 20.728000] hub 2-0:1.0: 1 port detected [ 21.008000] Initializing USB Mass Storage driver… [ 21.016000] usbcore: registered new interface driver usb-storage [ 21.020000] USB Mass Storage support registered. [ 21.232000] input: gpio-buttons as /devices/platform/gpio-buttons.0/input/input0 [ 23.260000] eth0: link forced UP – 100/full – flow control off/off [ 23.692000] device eth0 entered promiscuous mode [ 23.780000] br-lan: port 1(eth0) entering forwarding state [ 23.788000] br-lan: port 1(eth0) entering forwarding state [ 27.972000] device wlan0 entered promiscuous mode [ 27.980000] br-lan: port 2(wlan0) entering forwarding state [ 27.984000] br-lan: port 2(wlan0) entering forwarding state [ 30.392000] device wlan0 left promiscuous mode [ 30.396000] br-lan: port 2(wlan0) entering forwarding state [ 30.688000] device wlan0 entered promiscuous mode [ 30.692000] br-lan: port 2(wlan0) entering forwarding state [ 30.696000] br-lan: port 2(wlan0) entering forwarding state BusyBox v1.19.3 (2011-12-25 13:56:35 CET) built-in shell (ash) Enter ‘help’ for a list of built-in commands. _______ ________ __ | |.—–.—–.—–.| | | |.—-.| |_ | – || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ATTITUDE ADJUSTMENT (bleeding edge, r29606) ———- * 1/4 oz Vodka Pour all ingredients into mixing * 1/4 oz Gin tin with ice, strain into glass. * 1/4 oz Amaretto * 1/4 oz Triple sec * 1/4 oz Peach schnapps * 1/4 oz Sour mix * 1 splash Cranberry juice —————————————————– root@OpenWrt:/#
笔记
cal_data
在这个表中，我们可以看到闪存芯片不同的几何形状：
| 几何 |
S29GL128P10 |
MX29GL128EH |
MX29LV128DB |
| 引导块 |
统一，顶WP |
统一，顶WP |
底部启动 |
| 区域 |
1 |
1 |
1 |
2 |
| 行业 |
1 – 128 |
1 – 128 |
1 – 8 |
9 – 263 |
| erasesize |
0x20000的 |
0x20000的 |
为0x2000 |
0x10000处 |
了WIFI校准数据的位置（开始于0xA55A）上显示引导。。所述fInfo *值出现要被嵌入在内核
启动日志报告：
MX29GL128EH | S29GL128P10
…总的Flash大小：16384K有128个扇区板ID设置HW556，ucHardwareType 0fInfo.flash_wlanparam_start_blk = 119fInfo.flash_wlanparam_number_blk = 1fInfo.flash_wlanparam_length =为0x2000fInfo.flash_wlanparam_blk_offset = 0x1e000
根据上表中的几何形状，让我们计算偏移：
119 *地址0x20000 + 0x1e000 = 0xEFE000
如果我们使整个闪存进行备份，通过JTAG我们可以看到它的正是位于偏移0xEFE000
MX29LV128DB
…总的Flash大小：16384K 263行业板ID设置HW556，ucHardwareType 0fInfo.flash_wlanparam_start_blk = 254fInfo.flash_wlanparam_number_blk = 1fInfo.flash_wlanparam_length =为0x2000fInfo.flash_wlanparam_blk_offset = 0xe000
根据上表中的几何形状，让我们计算偏移再次：
8 *为0x2000 +（254-8）* 0x10000的+ 0xe000 = 0xF7E000
西窗浪人
