User Tools

Site Tools


toh:huawei:hg622

Huawei EchoLife HG622

The HG622 is an adsl wifi router mainly distributed by Jazztel to their customers.

Supported since r48305 (Designated Driver). Internal xDSL modem NOT supported.

Hardware Highlights

SoC Ram Flash Network USB Serial JTag
Broadcom 6368 32MiB 16MiB 4x Yes Yes Yes

Installation

A serial (UART) adapter is required to install OpenWrt

Available firmwares:

Version link notes
trunk https://downloads.openwrt.org/snapshots/trunk/brcm63xx/smp/openwrt-brcm63xx-smp-HG622-squashfs-cfe.bin xDSL, VoIP/FXS not supported
Barrier Breaker 14.07 git clone git://github.com/openwrt-es/openwrt.git -b bb-14.07-rc3 xDSL, VoIP/FXS not supported

OEM installation using the TFTP method

For installing the Openwrt firmware you will need to use the CFE serial console:

  • Connect a serial TTL cable to send commands to CFE via serial console software, for loading the firmware via TFTP.
  • Start a TFTP server in your PC. Copy the firmware.bin file to the TFTP server's directory.
  • Set the IP at your pc to 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
  • Power ON the router, press any key in the serial console to break into the CFE command line interpreter.
  • Execute the command: f 192.168.1.35:firmware.bin

This is a session of flashing via TFTP:

CFE> f 192.168.1.35:firmware.bin
Loading 192.168.1.35:firmware.bin ...
Finished loading 2686980 bytes

Flashing root file system and kernel at 0xb8020000: ............................................

.
*** Image flash done *** !
Resetting board...\0xff

CFE upgrade

If you want to have a web server for easy flashing you can upgrade the bootloader with a new modded one

CFE_HG622-dummy_firmware.bin (dummy firmware, only CFE and void firmware)

Use the same procedure, as described above. This is a session of upgrading the bootloader

CFE version 1.0.37-102.6 for BCM96368 (32bit,SP,BE) Build Date: Sun Jul 24 16:58:20 CST 2011 (wangxinfeng@build.huawei.com) Copyright (C) 2000-2008 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201, size 16384KB CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz CPU running TP0 Total memory: 33554432 bytes (32MB) Boot Address 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 3 Boot image (0=latest, 1=previous) : 0 Board Id (0-5) : 96368MVWG_hg622 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:e0:fc:09:09:09 PSI Size (1-64) KBytes : 64 Main Thread Number [0|1] : 0 *** Press any key to stop auto run (3 seconds) *** Auto run second count down: 1 web info: Waiting for connection on socket 0. CFE> CFE> f 192.168.1.100:CFW_HG622-dummy_firmware.bin Loading 192.168.1.100:CFE_HG622-dummy_firmware.bin ... Finished loading 87360 bytes Flashing CFE: .. readNvramData() CRC ERROR !!!!!! writeNvramData write ..... Flashing root file system and kernel at 0xb8020000: .. Clear Flags ok! . *** Image flash done *** ! CFE timeout,reboot Resetting board... CFE version 2.0.3 for BCM63XX (32bit,SP,BE) Build Date: Tue Dec 15 18:07:41 CET 2015 (dani@tool) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201 size 16384KB Total Flash size: 16384K with 128 sectors Chip ID: BCM6368B2, MIPS: 400MHz Main Thread: TP0 Total Memory: 33554432 bytes (32MB) Boot Address: 0xb8000000 *** Upgrading NVRAM (version 5 to version 6) *** Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 3 Board Id (0-15) : 96368MVWG_hg622 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:e0:fc:09:09:09 PSI Size (1-64) KBytes : 64 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 0 Voice Board Configuration (0-19) : *** Press any key to stop auto run (3 seconds) *** Auto run second count down: 0 Booting from only image (0xb8020000) ... Code Address: 0x00000000, Entry Address: 0x00000000 Failed to decompress image. Corrupted image? web info: Waiting for connection on socket 0. web info: Waiting for connection on socket 1. web info: Waiting for connection on socket 2. web info: Waiting for connection on socket 0. web info: Waiting for connection on socket 1. web info: Waiting for connection on socket 3. web warning: Unexpected TCP disconnect. web warning: Unexpected TCP disconnect. web warning: Unexpected TCP disconnect. web info: Waiting for connection on socket 0. web info: Upload 4587524 bytes, Broadcom image format. CFE>


After CFE upgrade you will have a web server at http://192.168.1.1/ for upgrading new firmwares. No need anymore the serial console, just press the reset button when powering on the router and wait for accesing the CFE webserver flashing interface.

Flash Layout

Please check out the article Flash.Layout. It contains an example and a couple of explanations.

partition name filesystem function
mtd0 CFE n/a bootloader
mtd1 kernel RAM executable kernel
mtd2 rootfs squashfs root
mtd3 rootfs_data jffs2 configuration, install new packages
mtd4 cal_data n/a wifi calibration data RT3062F eeprom is at 0x0FA0000 offset.
mtd5 nvram n/a OEM configuration data
mtd6 linux n/a OpenWrt upgrade

Hardware

Info

Instruction set: MIPS
Vendor: Broadcom
Bootloader: CFE
Board ID: 96368MVWG_hg622
System-On-Chip: Broadcom BCM6368
CPU/Speed BMIPS4350 v3.1 dual core / 400 MHz
Flash-Chip: MX29GL128EHT2I-90G / 128KB block size x 128 blocks
Flash size 16 MiB
RAM 32 MiB / DDR-400
Wireless Ralink RT3062 802.11b/g/n (onboard)
Antenna 2x PCB
Ethernet: Broadcom integrated, fast ethernet
USB 1 x USB2.0
ADSL Modem: Yes, NOT SUPPORTED
Power adapter ?
Serial: Yes
JTAG: Yes

PCB pictures

Serial

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

J4
TX
GND
VCC
nc
RX

Serial works at 3.3V 115200N1, see pin assignments above

Speed (baud)     - 115200
Data bits        - 8
Stop bits        - 1
Parity           - None
Flow control     - None

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

J5
TDI
TMS
TDO
TRST
TCK

URJTAG

Using the urJtag with an FT2232H you can read the flash chip.

urjtag command file used:

cable FT2232H vid=xxx pid=xxx
endian big
detect

register BR 1
register DIR 32
register EJIMPCODE 32
register EJADDRESS 32
register EJDATA 32
register EJCONTROL 32
register EJALL 96

instruction length 5
instruction BYPASS 11111 BR
instruction IDCODE 00001 DIR
instruction EJTAG_IMPCODE 00011 EJIMPCODE
instruction EJTAG_ADDRESS 01000 EJADDRESS
instruction EJTAG_DATA 01001 EJDATA
instruction EJTAG_CONTROL 01010 EJCONTROL
instruction EJTAG_ALL 01011 EJALL

instruction IDCODE
shift ir
shift dr
dr

initbus ejtag

detectflash 0x38000000

readmem 0x38000000 0x020000 hg622-CFE.bin

You can use a different JTAG cable, only the first line will be different

JTAG adapter command
Altera USB Blaster adapter
cable usbblaster
WIGGLER parallel port adapter
cable wiggler ppdev /dev/parport0
DLC5 parallel port adapter
cable dlc5 ppdev /dev/parport0

ZJTAG

and using zjtag(version 1.5)

  • to detect flash chip:
    zjtag -probeonly /window:18000000 /nompi
  • to backup all flash:
    zjtag -backup:custom /window:18000000 /start:18000000 /length:1000000 /nompi

GPIOs

LEDs

Read: System configuration: Leds to configure the leds

GPIO symbol Active
2 adsl Low
5 inet Low
11 usb Low
22 power Low
6 (PINMUX_EPHY0_ACT_LED) lan1 Low
7 (PINMUX_EPHY1_ACT_LED) lan2 Low
8 (PINMUX_EPHY2_ACT_LED) lan3 Low
9 (PINMUX_EPHY3_ACT_LED) lan4 Low

Buttons

hardware.button on howto use and configure the hardware button(s).

GPIO Event Active
34 Reset Low

Bootloader mods

bootloader download link description
CFE CFE-HG622-CUSTOM.bin moded bootloader: web interface added, reset button detect for stopping the bootloader, no double image, no rootfs CRC check

OpenWRT bootlog

[ 0.000000] Linux version 3.8.11 (ebensan@ubuntu) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2012.12 r36529) ) #2 SMP Fri Aug 16 08:27:31 WEST 2013 [ 0.000000] Detected Broadcom 0x6368 CPU revision b2 [ 0.000000] CPU frequency is 400 MHz [ 0.000000] 32MB of RAM installed [ 0.000000] registering 38 GPIOs [ 0.000000] board_bcm963xx: Boot address 0xb8000000 [ 0.000000] board_bcm963xx: CFE version: 1.0.37-102.6 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 0002a031 (Broadcom BMIPS4350) [ 0.000000] board_bcm963xx: board name: 96368MVWG_hg622 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x01ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x01ffffff] [ 0.000000] On node 0 totalpages: 8192 [ 0.000000] free_area_init_node: node 0, pgdat 8030aa40, node_mem_map 81000000 [ 0.000000] Normal zone: 64 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 8128 pages, LIFO batch:0 [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] PERCPU: Embedded 7 pages/cpu @81043000 s6144 r8192 d14336 u32768 [ 0.000000] pcpu-alloc: s6144 r8192 d14336 u32768 alloc=8*4096 [ 0.000000] pcpu-alloc: [0] 0 [0] 1 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] __ex_table already sorted, skipping sort [ 0.000000] Memory: 28756k/32768k available (2504k kernel code, 4012k reserved, 619k data, 200k init, 0k highmem) [ 0.000000] Hierarchical RCU implementation. [ 0.000000] NR_IRQS:128 [ 0.028000] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648) [ 0.032000] pid_max: default: 32768 minimum: 301 [ 0.036000] Mount-cache hash table entries: 512 [ 0.044000] SMP: Booting CPU1... [ 0.048000] CPU revision is: 0002a031 (Broadcom BMIPS4350) [ 0.048000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.048000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.076000] SMP: CPU1 is running [ 0.076000] Brought up 2 CPUs [ 0.108000] NET: Registered protocol family 16 [ 0.116000] registering PCI controller with io_map_base unset [ 0.132000] bio: create slab <bio-0> at 0 [ 0.136000] PCI host bridge to bus 0000:00 [ 0.140000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff] [ 0.144000] pci_bus 0000:00: root bus resource [io 0x8000000-0x800ffff] [ 0.148000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.152000] pci 0000:00:01.0: [1814:3592] type 00 class 0x028000 [ 0.152000] pci 0000:00:01.0: reg 10: [mem 0xffff0000-0xffffffff] [ 0.164000] pci 0000:00:01.0: PME# supported from D0 D3hot D3cold [ 0.164000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 0.164000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x3000ffff] [ 0.168000] Switching to clocksource MIPS [ 0.180000] NET: Registered protocol family 2 [ 0.184000] TCP established hash table entries: 512 (order: 0, 4096 bytes) [ 0.192000] TCP bind hash table entries: 512 (order: 0, 4096 bytes) [ 0.200000] TCP: Hash tables configured (established 512 bind 512) [ 0.208000] TCP: reno registered [ 0.208000] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 0.216000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 0.224000] NET: Registered protocol family 1 [ 0.228000] PCI: CLS 0 bytes, default 16 [ 0.228000] audit: initializing netlink socket (disabled) [ 0.236000] type=2000 audit(0.232:1): initialized [ 0.240000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.248000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.256000] msgmni has been set to 56 [ 0.264000] io scheduler noop registered [ 0.268000] io scheduler deadline registered (default) [ 0.272000] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 10) is a bcm63xx_uart [ 0.280000] console [ttyS0] enabled, bootconsole disabled [ 0.292000] bcm63xx-rng bcm63xx-rng: registered RNG driver [ 0.300000] physmap platform flash device: 08000000 at 18000000 [ 0.308000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x00227e [ 0.320000] physmap-flash.0: Found an alias at 0x1000000 for the chip at 0x0 [ 0.320000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.324000] Amd/Fujitsu Extended Query version 1.3. [ 0.328000] number of CFI chips: 1 [ 0.332000] bcm63xxpart: CFE boot tag found with version 6 and board type 96368MVWG_hg622 [ 0.340000] bcm63xxpart: Partition 0 is CFE offset 0 and length 20000 [ 0.348000] bcm63xxpart: Partition 1 is kernel offset 20100 and length 11ff00 [ 0.356000] bcm63xxpart: Partition 2 is rootfs offset 140000 and length e60000 [ 0.364000] bcm63xxpart: Partition 3 is cal_data offset fa0000 and length 20000 [ 0.372000] bcm63xxpart: Partition 4 is nvram offset fe0000 and length 20000 [ 0.376000] bcm63xxpart: Partition 5 is linux offset 20000 and length f80000 [ 0.384000] bcm63xxpart: Spare partition is offset 310004 and length c8fffc [ 0.392000] 6 bcm63xxpart partitions found on MTD device physmap-flash.0 [ 0.400000] Creating 6 MTD partitions on "physmap-flash.0": [ 0.404000] 0x000000000000-0x000000020000 : "CFE" [ 0.412000] 0x000000020100-0x000000140000 : "kernel" [ 0.416000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.432000] 0x000000140000-0x000000fa0000 : "rootfs" [ 0.440000] mtd: partition "rootfs" set to be root filesystem [ 0.444000] mtd: partition "rootfs_data" created automatically, ofs=320000, len=C80000 [ 0.452000] 0x000000320000-0x000000fa0000 : "rootfs_data" [ 0.460000] 0x000000fa0000-0x000000fc0000 : "cal_data" [ 0.468000] 0x000000fe0000-0x000001000000 : "nvram" [ 0.476000] 0x000000020000-0x000000fa0000 : "linux" [ 0.484000] bcm63xx-spi bcm63xx-spi: at 0xb0000800 (irq 9, FIFOs size 542) [ 0.532000] b53_common: found switch: BCM63xx, rev 0 [ 0.536000] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.548000] TCP: cubic registered [ 0.552000] NET: Registered protocol family 17 [ 0.556000] 8021q: 802.1Q VLAN Support v1.8 [ 0.568000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.576000] Freeing unused kernel memory: 200k freed [ 2.508000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex [ 2.740000] Button Hotplug driver version 0.4.1 [ 2.764000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled.0/input/input0 [ 6.252000] jffs2: notice: (365) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 15 of xref (0 dead, 10 orphan) found. [ 7.428000] compat-drivers backport release: compat-drivers-2013-03-28-5 [ 7.432000] Backport based on wireless-testing.git master-2013-04-16 [ 7.440000] compat.git: wireless-testing.git [ 7.488000] cfg80211: Calling CRDA to update world regulatory domain [ 7.492000] cfg80211: World regulatory domain updated: [ 7.500000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 7.508000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 7.516000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 7.524000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 7.532000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 7.540000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 7.856000] NET: Registered protocol family 10 [ 8.176000] SCSI subsystem initialized [ 8.336000] usbcore: registered new interface driver usbfs [ 8.344000] usbcore: registered new interface driver hub [ 8.348000] usbcore: registered new device driver usb [ 8.848000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002) [ 8.852000] rt2800pci 0000:00:01.0: setting latency timer to 64 [ 8.856000] phy0 -> rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'rt2x00.eeprom'. [ 8.868000] phy0 -> rt2x00_set_rt: Info - RT chipset 3572, rev 0223 detected [ 8.876000] phy0 -> rt2x00_set_rf: Info - RF chipset 0008 detected [ 8.884000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 9.452000] PPP generic driver version 2.4.2 [ 9.732000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 10.008000] NET: Registered protocol family 24 [ 10.168000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 10.192000] ehci-platform: EHCI generic platform driver [ 10.304000] ehci-platform ehci-platform: EHCI Host Controller [ 10.308000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 [ 10.316000] ehci-platform ehci-platform: irq 15, io mem 0xb0001500 [ 10.336000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 10.344000] hub 1-0:1.0: USB hub found [ 10.348000] hub 1-0:1.0: 2 ports detected [ 10.472000] nf_conntrack version 0.5.0 (452 buckets, 1808 max) [ 11.416000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 11.760000] Initializing USB Mass Storage driver... [ 11.768000] usbcore: registered new interface driver usb-storage [ 11.772000] USB Mass Storage support registered. [ 14.664000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex [ 15.756000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex [ 15.768000] device eth0.1 entered promiscuous mode [ 15.772000] device eth0 entered promiscuous mode [ 15.780000] br-lan: port 1(eth0.1) entered forwarding state [ 15.788000] br-lan: port 1(eth0.1) entered forwarding state [ 16.752000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready [ 17.792000] br-lan: port 1(eth0.1) entered forwarding state [ 20.872000] phy0 -> rt2x00lib_request_firmware: Info - Loading firmware file 'rt2860.bin'. [ 20.988000] phy0 -> rt2x00lib_request_firmware: Info - Firmware detected - version: 0.34. [ 21.100000] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 23.784000] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead. [ 23.976000] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready


Tags

toh/huawei/hg622.txt · Last modified: 2016/01/28 15:24 by danitool