User Tools

Site Tools


toh:huawei:hg622

Huawei EchoLife HG622

The HG622 is an adsl wifi router mainly distributed by Jazztel to their customers.

The HG622 is currently not officially supported!.

Hardware Highlights

SoC Ram Flash Network USB Serial JTag
Broadcom 6368 32MiB 16MiB 4x Yes Yes Yes

Notes

To build firmware images for this router use this repository:

git clone git://github.com/openwrt-es/openwrt.git -b bb-14.07-rc3

Board has a custom CFE ( Board name: 96368MVWG_hg622 ).

Installation

Available firmwares:

Version firmware link notes
Barrier Breaker 14.07 TODO FIXME ADSL, VoIP/FXS not supported

Flash Layout

Please check out the article Flash.Layout. It contains an example and a couple of explanations.

partition name filesystem function
mtd0 CFE n/a bootloader
mtd1 kernel RAM executable kernel
mtd2 rootfs squashfs root
mtd3 rootfs_data jffs2 configuration, install new packages
mtd4 cal_data n/a wifi calibration data RT3062F eeprom is at 0x0FA0000 offset.
mtd5 nvram n/a OEM configuration data
mtd6 linux n/a OpenWrt upgrade

OEM installation using the TFTP method

Connect the serial TTL cable to send commands to CFE for loading the firmware via tftp.

Router IPs address is 192.168.1.1

PC: 192.168.1.100

Filename at TFTP server: bcm963xx_fs_kernel

CFE command to flash: f

Hardware

Info

Instruction set: MIPS
Vendor: Broadcom
Bootloader: CFE
Board ID: 96368MVWG_hg622
System-On-Chip: Broadcom BCM6368
CPU/Speed BMIPS4350 v3.1 dual core / 400 MHz
Flash-Chip: MX29GL128EHT2I-90G / 128KB block size x 128 blocks
Flash size 16 MiB
RAM 32 MiB / DDR-400
Wireless Ralink RT3062 802.11b/g/n (onboard)
Antenna 2x PCB
Ethernet: Broadcom integrated, fast ethernet
USB 1 x USB2.0
ADSL Modem: Yes, NOT SUPPORTED
Power adapter ?
Serial: Yes
JTAG: Yes

PCB pictures

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

J4
TX
GND
VCC
nc
RX

Serial works at 3.3V 115200N1, see pin assignments above

Speed (baud)     - 115200
Data bits        - 8
Stop bits        - 1
Parity           - None
Flow control     - None

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

J5
TDI
TMS
TDO
TRST
TCK

URJTAG

Using the urJtag with an FT2232H you can read the flash chip.

urjtag command file used:

cable FT2232H vid=xxx pid=xxx
endian big
detect

register BR 1
register DIR 32
register EJIMPCODE 32
register EJADDRESS 32
register EJDATA 32
register EJCONTROL 32
register EJALL 96

instruction length 5
instruction BYPASS 11111 BR
instruction IDCODE 00001 DIR
instruction EJTAG_IMPCODE 00011 EJIMPCODE
instruction EJTAG_ADDRESS 01000 EJADDRESS
instruction EJTAG_DATA 01001 EJDATA
instruction EJTAG_CONTROL 01010 EJCONTROL
instruction EJTAG_ALL 01011 EJALL

instruction IDCODE
shift ir
shift dr
dr

initbus ejtag

detectflash 0x38000000

readmem 0x38000000 0x020000 hg622-CFE.bin

You can use a different JTAG cable, only the first line will be different

JTAG adapter command
Altera USB Blaster adapter
cable usbblaster
WIGGLER parallel port adapter
cable wiggler ppdev /dev/parport0
DLC5 parallel port adapter
cable dlc5 ppdev /dev/parport0

ZJTAG

and using zjtag(version 1.5)

  • to detect flash chip:
    zjtag -probeonly /window:18000000 /nompi
  • to backup all flash:
    zjtag -backup:custom /window:18000000 /start:18000000 /length:1000000 /nompi

OpenWRT bootlog

[ 0.000000] Linux version 3.8.11 (ebensan@ubuntu) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2012.12 r36529) ) #2 SMP Fri Aug 16 08:27:31 WEST 2013 [ 0.000000] Detected Broadcom 0x6368 CPU revision b2 [ 0.000000] CPU frequency is 400 MHz [ 0.000000] 32MB of RAM installed [ 0.000000] registering 38 GPIOs [ 0.000000] board_bcm963xx: Boot address 0xb8000000 [ 0.000000] board_bcm963xx: CFE version: 1.0.37-102.6 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 0002a031 (Broadcom BMIPS4350) [ 0.000000] board_bcm963xx: board name: 96368MVWG_hg622 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x01ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x01ffffff] [ 0.000000] On node 0 totalpages: 8192 [ 0.000000] free_area_init_node: node 0, pgdat 8030aa40, node_mem_map 81000000 [ 0.000000] Normal zone: 64 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 8128 pages, LIFO batch:0 [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] PERCPU: Embedded 7 pages/cpu @81043000 s6144 r8192 d14336 u32768 [ 0.000000] pcpu-alloc: s6144 r8192 d14336 u32768 alloc=8*4096 [ 0.000000] pcpu-alloc: [0] 0 [0] 1 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] __ex_table already sorted, skipping sort [ 0.000000] Memory: 28756k/32768k available (2504k kernel code, 4012k reserved, 619k data, 200k init, 0k highmem) [ 0.000000] Hierarchical RCU implementation. [ 0.000000] NR_IRQS:128 [ 0.028000] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648) [ 0.032000] pid_max: default: 32768 minimum: 301 [ 0.036000] Mount-cache hash table entries: 512 [ 0.044000] SMP: Booting CPU1... [ 0.048000] CPU revision is: 0002a031 (Broadcom BMIPS4350) [ 0.048000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.048000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.076000] SMP: CPU1 is running [ 0.076000] Brought up 2 CPUs [ 0.108000] NET: Registered protocol family 16 [ 0.116000] registering PCI controller with io_map_base unset [ 0.132000] bio: create slab at 0 [ 0.136000] PCI host bridge to bus 0000:00 [ 0.140000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff] [ 0.144000] pci_bus 0000:00: root bus resource [io 0x8000000-0x800ffff] [ 0.148000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.152000] pci 0000:00:01.0: [1814:3592] type 00 class 0x028000 [ 0.152000] pci 0000:00:01.0: reg 10: [mem 0xffff0000-0xffffffff] [ 0.164000] pci 0000:00:01.0: PME# supported from D0 D3hot D3cold [ 0.164000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 0.164000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x3000ffff] [ 0.168000] Switching to clocksource MIPS [ 0.180000] NET: Registered protocol family 2 [ 0.184000] TCP established hash table entries: 512 (order: 0, 4096 bytes) [ 0.192000] TCP bind hash table entries: 512 (order: 0, 4096 bytes) [ 0.200000] TCP: Hash tables configured (established 512 bind 512) [ 0.208000] TCP: reno registered [ 0.208000] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 0.216000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 0.224000] NET: Registered protocol family 1 [ 0.228000] PCI: CLS 0 bytes, default 16 [ 0.228000] audit: initializing netlink socket (disabled) [ 0.236000] type=2000 audit(0.232:1): initialized [ 0.240000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.248000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.256000] msgmni has been set to 56 [ 0.264000] io scheduler noop registered [ 0.268000] io scheduler deadline registered (default) [ 0.272000] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 10) is a bcm63xx_uart [ 0.280000] console [ttyS0] enabled, bootconsole disabled [ 0.292000] bcm63xx-rng bcm63xx-rng: registered RNG driver [ 0.300000] physmap platform flash device: 08000000 at 18000000 [ 0.308000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x00227e [ 0.320000] physmap-flash.0: Found an alias at 0x1000000 for the chip at 0x0 [ 0.320000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.324000] Amd/Fujitsu Extended Query version 1.3. [ 0.328000] number of CFI chips: 1 [ 0.332000] bcm63xxpart: CFE boot tag found with version 6 and board type 96368MVWG_hg622 [ 0.340000] bcm63xxpart: Partition 0 is CFE offset 0 and length 20000 [ 0.348000] bcm63xxpart: Partition 1 is kernel offset 20100 and length 11ff00 [ 0.356000] bcm63xxpart: Partition 2 is rootfs offset 140000 and length e60000 [ 0.364000] bcm63xxpart: Partition 3 is cal_data offset fa0000 and length 20000 [ 0.372000] bcm63xxpart: Partition 4 is nvram offset fe0000 and length 20000 [ 0.376000] bcm63xxpart: Partition 5 is linux offset 20000 and length f80000 [ 0.384000] bcm63xxpart: Spare partition is offset 310004 and length c8fffc [ 0.392000] 6 bcm63xxpart partitions found on MTD device physmap-flash.0 [ 0.400000] Creating 6 MTD partitions on "physmap-flash.0": [ 0.404000] 0x000000000000-0x000000020000 : "CFE" [ 0.412000] 0x000000020100-0x000000140000 : "kernel" [ 0.416000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.432000] 0x000000140000-0x000000fa0000 : "rootfs" [ 0.440000] mtd: partition "rootfs" set to be root filesystem [ 0.444000] mtd: partition "rootfs_data" created automatically, ofs=320000, len=C80000 [ 0.452000] 0x000000320000-0x000000fa0000 : "rootfs_data" [ 0.460000] 0x000000fa0000-0x000000fc0000 : "cal_data" [ 0.468000] 0x000000fe0000-0x000001000000 : "nvram" [ 0.476000] 0x000000020000-0x000000fa0000 : "linux" [ 0.484000] bcm63xx-spi bcm63xx-spi: at 0xb0000800 (irq 9, FIFOs size 542) [ 0.532000] b53_common: found switch: BCM63xx, rev 0 [ 0.536000] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.548000] TCP: cubic registered [ 0.552000] NET: Registered protocol family 17 [ 0.556000] 8021q: 802.1Q VLAN Support v1.8 [ 0.568000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.576000] Freeing unused kernel memory: 200k freed [ 2.508000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex [ 2.740000] Button Hotplug driver version 0.4.1 [ 2.764000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled.0/input/input0 [ 6.252000] jffs2: notice: (365) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 15 of xref (0 dead, 10 orphan) found. [ 7.428000] compat-drivers backport release: compat-drivers-2013-03-28-5 [ 7.432000] Backport based on wireless-testing.git master-2013-04-16 [ 7.440000] compat.git: wireless-testing.git [ 7.488000] cfg80211: Calling CRDA to update world regulatory domain [ 7.492000] cfg80211: World regulatory domain updated: [ 7.500000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 7.508000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 7.516000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 7.524000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 7.532000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 7.540000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 7.856000] NET: Registered protocol family 10 [ 8.176000] SCSI subsystem initialized [ 8.336000] usbcore: registered new interface driver usbfs [ 8.344000] usbcore: registered new interface driver hub [ 8.348000] usbcore: registered new device driver usb [ 8.848000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002) [ 8.852000] rt2800pci 0000:00:01.0: setting latency timer to 64 [ 8.856000] phy0 -> rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'rt2x00.eeprom'. [ 8.868000] phy0 -> rt2x00_set_rt: Info - RT chipset 3572, rev 0223 detected [ 8.876000] phy0 -> rt2x00_set_rf: Info - RF chipset 0008 detected [ 8.884000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 9.452000] PPP generic driver version 2.4.2 [ 9.732000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 10.008000] NET: Registered protocol family 24 [ 10.168000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 10.192000] ehci-platform: EHCI generic platform driver [ 10.304000] ehci-platform ehci-platform: EHCI Host Controller [ 10.308000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 [ 10.316000] ehci-platform ehci-platform: irq 15, io mem 0xb0001500 [ 10.336000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 10.344000] hub 1-0:1.0: USB hub found [ 10.348000] hub 1-0:1.0: 2 ports detected [ 10.472000] nf_conntrack version 0.5.0 (452 buckets, 1808 max) [ 11.416000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 11.760000] Initializing USB Mass Storage driver... [ 11.768000] usbcore: registered new interface driver usb-storage [ 11.772000] USB Mass Storage support registered. [ 14.664000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex [ 15.756000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex [ 15.768000] device eth0.1 entered promiscuous mode [ 15.772000] device eth0 entered promiscuous mode [ 15.780000] br-lan: port 1(eth0.1) entered forwarding state [ 15.788000] br-lan: port 1(eth0.1) entered forwarding state [ 16.752000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready [ 17.792000] br-lan: port 1(eth0.1) entered forwarding state [ 20.872000] phy0 -> rt2x00lib_request_firmware: Info - Loading firmware file 'rt2860.bin'. [ 20.988000] phy0 -> rt2x00lib_request_firmware: Info - Firmware detected - version: 0.34. [ 21.100000] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 23.784000] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead. [ 23.976000] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready

Tags

toh/huawei/hg622.txt · Last modified: 2015/02/02 12:22 by danitool