Huawei EchoLife HG622
The HG622 is an ADSL wifi router mainly distributed by Jazztel to their customers.
Supported Versions
Hardware Highlights
Installation
OEM installation using the TFTP method
For installing the OpenWrt firmware you will need to use the CFE serial console:
It's recommendable to install an old OpenWrt version to avoid running out of memory. But don't install any version between 17.01.5 and 18.06.3 (both included), they likely erase the wifi caldata partition. Version 17.01.4 should run fine:
See instructions below how to backup and restore the cal_data partition.
- Connect a serial TTL cable to send commands to CFE via serial console software, for loading the firmware via TFTP.
- Start a TFTP server in your PC. Copy the firmware.bin file to the TFTP server's directory.
- Set the IP at your PC to 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
- Press the reset button (very important), and power ON the router while continue pressing the reset button till you see the CFE command line interpreter. It seems that if the reset button is not pressed, the integrated TFTP client does not activate.
- Execute the command:
f 192.168.1.35:firmware.bin
This is a session of flashing via TFTP:
CFE> f 192.168.1.35:firmware.bin Loading 192.168.1.35:firmware.bin ... Finished loading 2686980 bytes Flashing root file system and kernel at 0xb8020000: ............................................ . *** Image flash done *** ! Resetting board...\0xff
You may have to try several times, because the time window the TFTP client has to connect to the TFTP server is very short.
CFE upgrade
If you want to have a web server for easy flashing you can upgrade the bootloader with a new modded one.
CFE_HG622-dummy_firmware.bin (dummy firmware, only CFE and void firmware)
Use the same procedure, as described above. This is a session of upgrading the bootloader
CFE version 1.0.37-102.6 for BCM96368 (32bit,SP,BE) Build Date: Sun Jul 24 16:58:20 CST 2011 (wangxinfeng@build.huawei.com) Copyright (C) 2000-2008 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201, size 16384KB CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz CPU running TP0 Total memory: 33554432 bytes (32MB) Boot Address 0xb8000000 Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 3 Boot image (0=latest, 1=previous) : 0 Board Id (0-5) : 96368MVWG_hg622 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:e0:fc:09:09:09 PSI Size (1-64) KBytes : 64 Main Thread Number [0|1] : 0 *** Press any key to stop auto run (3 seconds) *** Auto run second count down: 1 web info: Waiting for connection on socket 0. CFE> CFE> f 192.168.1.100:CFW_HG622-dummy_firmware.bin Loading 192.168.1.100:CFE_HG622-dummy_firmware.bin ... Finished loading 87360 bytes Flashing CFE: .. readNvramData() CRC ERROR !!!!!! writeNvramData write ..... Flashing root file system and kernel at 0xb8020000: .. Clear Flags ok! . *** Image flash done *** ! CFE timeout,reboot Resetting board... CFE version 2.0.3 for BCM63XX (32bit,SP,BE) Build Date: Tue Dec 15 18:07:41 CET 2015 (dani@tool) Copyright (C) 2000-2009 Broadcom Corporation. Parallel flash device: name AM29LV320MT, id 0x2201 size 16384KB Total Flash size: 16384K with 128 sectors Chip ID: BCM6368B2, MIPS: 400MHz Main Thread: TP0 Total Memory: 33554432 bytes (32MB) Boot Address: 0xb8000000 *** Upgrading NVRAM (version 5 to version 6) *** Board IP address : 192.168.1.1:ffffff00 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 3 Board Id (0-15) : 96368MVWG_hg622 Number of MAC Addresses (1-32) : 11 Base MAC Address : 00:e0:fc:09:09:09 PSI Size (1-64) KBytes : 64 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 0 Voice Board Configuration (0-19) : *** Press any key to stop auto run (3 seconds) *** Auto run second count down: 0 Booting from only image (0xb8020000) ... Code Address: 0x00000000, Entry Address: 0x00000000 Failed to decompress image. Corrupted image? web info: Waiting for connection on socket 0. web info: Waiting for connection on socket 1. web info: Waiting for connection on socket 2. web info: Waiting for connection on socket 0. web info: Waiting for connection on socket 1. web info: Waiting for connection on socket 3. web warning: Unexpected TCP disconnect. web warning: Unexpected TCP disconnect. web warning: Unexpected TCP disconnect. web info: Waiting for connection on socket 0. web info: Upload 4587524 bytes, Broadcom image format. CFE>
After CFE upgrade you will have a web server at http://192.168.1.1/
for upgrading new firmwares. No need anymore the serial console, just press the reset button when powering on the router and wait for accessing the CFE webserver flashing interface.
Flash Layout
Please check out the article flash.layout. It contains an example and a couple of explanations.
partition | name | filesystem | function |
---|---|---|---|
mtd0 | CFE | n/a | bootloader |
mtd1 | kernel | RAM executable | kernel |
mtd2 | rootfs | squashfs | root |
mtd3 | rootfs_data | jffs2 | configuration, install new packages |
mtd4 | cal_data | n/a | wifi calibration data RT3062F eeprom is at 0x0FA0000 offset. |
mtd5 | nvram | n/a | OEM configuration data |
mtd6 | linux | n/a | OpenWrt upgrade |
Hardware
Info
Instruction set | MIPS |
---|---|
Vendor | Broadcom |
bootloader | cfe |
Board ID | 96368MVWG_hg622 |
System-On-Chip | Broadcom BCM6368 |
CPU/Speed | BMIPS4350 v3.1 dual core / 400 MHz |
Flash-Chip | MX29GL128EHT2I-90G / 128KB block size x 128 blocks |
Flash size | 16 MiB |
RAM | 32 MiB / DDR-400 |
Wireless | Ralink RT3062 802.11b/g/n (onboard) |
Antenna | 2x PCB |
Ethernet | Broadcom integrated, fast ethernet |
USB | 1 x USB2.0 |
ADSL Modem | Yes, NOT SUPPORTED |
Power adapter | ? |
Serial | Yes |
JTAG | Yes |
PCB pictures
Serial
→ port.serial general information about the serial port, serial port cable, etc.
How to connect to the Serial Port of this specific device:
J4 |
---|
TX |
GND |
VCC |
nc |
RX |
Serial works at 3.3V 115200N1, see pin assignments above
Speed (baud) - 115200 Data bits - 8 Stop bits - 1 Parity - None Flow control - None |
JTAG
→ port.jtag general information about the JTAG port, JTAG cable, etc.
How to connect to the JTAG Port of this specific device:
URJTAG
Using the urJtag with an FT2232H you can read the flash chip.
urjtag command file used:
cable FT2232H vid=xxx pid=xxx endian big detect register BR 1 register DIR 32 register EJIMPCODE 32 register EJADDRESS 32 register EJDATA 32 register EJCONTROL 32 register EJALL 96 instruction length 5 instruction BYPASS 11111 BR instruction IDCODE 00001 DIR instruction EJTAG_IMPCODE 00011 EJIMPCODE instruction EJTAG_ADDRESS 01000 EJADDRESS instruction EJTAG_DATA 01001 EJDATA instruction EJTAG_CONTROL 01010 EJCONTROL instruction EJTAG_ALL 01011 EJALL instruction IDCODE shift ir shift dr dr initbus ejtag detectflash 0x38000000 readmem 0x38000000 0x020000 hg622-CFE.bin
You can use a different JTAG cable, only the first line will be different
JTAG adapter | command |
---|---|
Altera USB Blaster adapter | cable usbblaster |
WIGGLER parallel port adapter | cable wiggler ppdev /dev/parport0 |
DLC5 parallel port adapter | cable dlc5 ppdev /dev/parport0 |
ZJTAG
and using zjtag(version 1.5)
- to detect flash chip:
zjtag -probeonly /window:18000000 /nompi
- to backup all flash:
zjtag -backup:custom /window:18000000 /start:18000000 /length:1000000 /nompi
GPIOs
LEDs
Read: System configuration: Leds to configure the leds
GPIO | symbol | Active |
---|---|---|
2 | adsl | Low |
5 | inet | Low |
11 | usb | Low |
22 | power | Low |
6 (PINMUX_EPHY0_ACT_LED) | lan1 | Low |
7 (PINMUX_EPHY1_ACT_LED) | lan2 | Low |
8 (PINMUX_EPHY2_ACT_LED) | lan3 | Low |
9 (PINMUX_EPHY3_ACT_LED) | lan4 | Low |
Buttons
→ hardware.button on howto use and configure the hardware button(s).
GPIO | Event | Active |
---|---|---|
34 | Reset | Low |
Backup and restore Wifi calibration data
In theory each wifi chip (it doesn't matter if they are exactly the same model) has its own wifi calibration data. In this router the data is stored in an area of the flash chip. This area is the cal_data partiton in OpenWrt firmwares.
- Without the cal_data, wifi will not work
- The WLAN calibration data is specific for your device, i.e. cal_data from another device will most likely not work
- If you wipe it accidentially it will be difficult to restore
- It cannot be restored by flashing back a vendor firmware
→ It's a good idea to backup this partition before flashing OpenWrt.
Backup cal_data partition
A serial to TTL converter is needed to access the router's CFE console, once connected, we turn on the router and we have three seconds to press the space bar to stop the boot and access the CFE command line. The command line will only be available for a few seconds, the router restarts automatically if we do not enter commands or take a long time to write them, so we have to be very quick to execute the commands. It is best to write the commands that we will use in a text editor, copy them and then simply paste them on the command line by pressing the right mouse button. Do not use ctrl + v.
What we need is to save the information that contains the partition cal_data, but the command “save” is not available, so we will have to use the command “dm” (dump). In this router the cal_data partition has a size of 20000 starting at the pointer B8FA0000 and the command to use would be like this:
dm B8FA0000 20000
But there are only valid data from 0 to 200, so we would use this one:
dm B8FA0000 200
With the execution of this command we will obtain a console dump. The content of the cal_data partition is something like this:
b8fa0000: 62 30 01 00 ac e8 7b 30 ef b4 62 30 14 18 01 80 b0....{0..b0.... b8fa0010: 00 00 62 30 14 18 00 00 01 00 6a ff 0c 00 ff ff ..b0......j..... b8fa0020: ff ff ff ff b0 92 ff ff ff ff ff ff ff ff ff ff ................ b8fa0030: ff ff ff ff 22 08 24 00 ff ff 2d 01 ff ff d9 fa ....".$...-..... b8fa0040: cc 88 ff ff 0d ff 00 00 03 00 00 00 00 00 ff ff ................ b8fa0050: ff ff 11 11 10 10 0f 0f 0e 0e 0d 0d 0c 0c 0c 0c ................ b8fa0060: 09 09 08 08 07 07 07 07 08 08 08 08 08 08 ff ff ................ b8fa0070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0090: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa00a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa00b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa00c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa00d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff 55 55 ..............UU b8fa00e0: 88 88 77 77 66 66 66 66 66 66 66 66 66 66 66 66 ..wwffffffffffff b8fa00f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0110: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0120: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0130: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0140: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0150: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0160: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0170: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa0190: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa01a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa01b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa01c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa01d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa01e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ b8fa01f0: ff ff ff ff ff ff ff ff ff ff ff ff ff 06 86 93 ................
We select the text in the console, copy it and paste it in a text editor, then open a hex editor and copy and paste only the hexadecimal part of each of the lines, until we have in the hex editor the same as in the dump. It just takes a little patience. Do it so because when you paste the text of the console in the hex editor, you also copy the memory pointers and the ascii part, so the final result is not valid. Now we just need to save the file, for example cal_data_hg622.bin. There is an easy way below.
Now we install OpenWrt, and once installed, we copy the file with the calibration data to the router. To do so we use WinSCP, we will copy the file cal_data_hg622.bin to the folder “/etc” in the router and we will have it available to restore the calibration data.
The problem is that the partitions are protected and can not be modified, to do so we will have to install the kmod-mtd-rw module, which allows us to modify the partitions if we execute the command insmod mtd-rw i_want_a_brick=1
.
If you lost your calibration data, here is the cal_data partition for this model: cal_data_hg622.rar
Restore cal_data partition
If you have already lost the calibration data, download cal_data_hg622.rar and follow these instructions:
First of all, transfer the cal_data_hg622.bin file into your router with WinSCP to “/etc” folder.
The router has to have access to the internet, then we access the router by SSH and execute
opkg update opkg install kmod-mtd-rw
With this we install the necessary module to unprotect the partitions, then execute
insmod mtd-rw i_want_a_brick=1
We can now modify the data of the partition cal_data.
Optional: If you have installed the snapshot version, it will be useful to have Luci
opkg install luci
Then we check the partition mtd(x) that contains the calibration data by executing:
root@OpenWrt:~#cat /proc/mtd dev: size erasesize name mtd0: 00020000 00020000 "CFE" mtd1: 00f80000 00020000 "linux" mtd2: 001a56a8 00020000 "kernel" mtd3: 00dda858 00020000 "rootfs" mtd4: 00bc0000 00020000 "rootfs_data" mtd5: 00020000 00020000 "cal_data" mtd6: 00020000 00020000 "nvram"
And finally
dd if=/etc/cal_data_hg622.bin of=/dev/mtd5 *File names are case sensitive
- Restart OpenWrt and check if wifi works.
- Other considerations:
The MAC is in the first line, in this example it is “ac e8 7b 30 ef b4”, but it is not the same as in the sticker, the last two characters are different “ac e8 7b 30 ef ac”. Anyway if we start the router before making the modifications connected by serial port, we can find the line “Main bssid = ac: e8: 7b: 30: ef: b4”, which as we see informs us of the MAC that appears in the calibration data. Now we just have to edit the file with hex editor and put the MAC of our router, and then follow the whole procedure.
If you accidentially erased your cal_data partition and you didn't make your own backup, you can use the above data to fill the erased partition (note the MAC address is specific for each calibration data). Or try this:
- Generate a bin file with the cal_data. You don't need to do this step if you already have your own backup. Make it at your PC with a linux distro:
echo '62300100ACE87B30EFB4623014180180000062301418000001006AFF0C00FFFFFFFFFFFFB092FFFFFFFFFFFFFFFFFFFFFFFFFFFF22082400FFFF2D01FFFFD9FACC88FFFF0DFF0000030000000000FFFFFFFF111110100F0F0E0E0D0D0C0C0C0C0909080807070707080808080808FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF555588887777666666666666666666666666FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF068693' | xxd -r -p > cal_data_hg622.bin
- Also, if you don't have a linux distro, copy the next content in a hex editor:
62300100ACE87B30EFB4623014180180000062301418000001006AFF0C00FFFFFFFFFFFFB092FFFFFFFFFFFFFFFFFFFFFFFFFFFF22082400FFFF2D01FFFFD9FACC88FFFF0DFF0000030000000000FFFFFFFF111110100F0F0E0E0D0D0C0C0C0C0909080807070707080808080808FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF555588887777666666666666666666666666FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF068693
- Now transfer the cal_data_hg622.bin file into your router and flash the cal_data partition
mtd write /etc/cal_data_hg622.bin cal_data
or
dd if=/etc/cal_data_hg622.bin of=/dev/mtd5 *File names are case sensitive
- Restart OpenWrt and check if wifi works.
Basic internet configuration
You can set a basic internet configuration with uci commands. Assuming your main router (gateway) has the IP 192.168.1.1 (the most common). Follow these steps.
- Connect only the ethernet cable from the HG622 to your computer, and telnet it or ssh.
- Execute these commands
uci set network.lan.ipaddr=192.168.1.254 uci set network.lan.netmask=255.255.255.0 uci set network.lan.gateway=192.168.1.1 uci set network.lan.dns='8.8.8.8 192.168.1.1' uci commit network
- You may also need to disable the dhcp server
/etc/init.d/dnsmasq disable
- Reboot the HG622 and connect the ethernet cable to the main router (gateway).
- Now the HG622 IP is 192.168.1.254, telnet or ssh it.
- Ping any internet address, or install a package
opkg update opkg install luci
Bootloader mods
bootloader | download link | description |
---|---|---|
CFE | CFE-HG622-CUSTOM.bin | moded bootloader: web interface added, reset button detect for stopping the bootloader, no double image, no rootfs CRC check |
OpenWrt bootlog
[ 0.000000] Linux version 3.8.11 (ebensan@ubuntu) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2012.12 r36529) ) #2 SMP Fri Aug 16 08:27:31 WEST 2013 [ 0.000000] Detected Broadcom 0x6368 CPU revision b2 [ 0.000000] CPU frequency is 400 MHz [ 0.000000] 32MB of RAM installed [ 0.000000] registering 38 GPIOs [ 0.000000] board_bcm963xx: Boot address 0xb8000000 [ 0.000000] board_bcm963xx: CFE version: 1.0.37-102.6 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 0002a031 (Broadcom BMIPS4350) [ 0.000000] board_bcm963xx: board name: 96368MVWG_hg622 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 02000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x00000000-0x01ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x01ffffff] [ 0.000000] On node 0 totalpages: 8192 [ 0.000000] free_area_init_node: node 0, pgdat 8030aa40, node_mem_map 81000000 [ 0.000000] Normal zone: 64 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 8128 pages, LIFO batch:0 [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] PERCPU: Embedded 7 pages/cpu @81043000 s6144 r8192 d14336 u32768 [ 0.000000] pcpu-alloc: s6144 r8192 d14336 u32768 alloc=8*4096 [ 0.000000] pcpu-alloc: [0] 0 [0] 1 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 [ 0.000000] Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs,jffs2 noinitrd console=ttyS0,115200 [ 0.000000] PID hash table entries: 128 (order: -3, 512 bytes) [ 0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) [ 0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.000000] __ex_table already sorted, skipping sort [ 0.000000] Memory: 28756k/32768k available (2504k kernel code, 4012k reserved, 619k data, 200k init, 0k highmem) [ 0.000000] Hierarchical RCU implementation. [ 0.000000] NR_IRQS:128 [ 0.028000] Calibrating delay loop... 397.82 BogoMIPS (lpj=795648) [ 0.032000] pid_max: default: 32768 minimum: 301 [ 0.036000] Mount-cache hash table entries: 512 [ 0.044000] SMP: Booting CPU1... [ 0.048000] CPU revision is: 0002a031 (Broadcom BMIPS4350) [ 0.048000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.048000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.076000] SMP: CPU1 is running [ 0.076000] Brought up 2 CPUs [ 0.108000] NET: Registered protocol family 16 [ 0.116000] registering PCI controller with io_map_base unset [ 0.132000] bio: create slab <bio-0> at 0 [ 0.136000] PCI host bridge to bus 0000:00 [ 0.140000] pci_bus 0000:00: root bus resource [mem 0x30000000-0x37ffffff] [ 0.144000] pci_bus 0000:00: root bus resource [io 0x8000000-0x800ffff] [ 0.148000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 0.152000] pci 0000:00:01.0: [1814:3592] type 00 class 0x028000 [ 0.152000] pci 0000:00:01.0: reg 10: [mem 0xffff0000-0xffffffff] [ 0.164000] pci 0000:00:01.0: PME# supported from D0 D3hot D3cold [ 0.164000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 [ 0.164000] pci 0000:00:01.0: BAR 0: assigned [mem 0x30000000-0x3000ffff] [ 0.168000] Switching to clocksource MIPS [ 0.180000] NET: Registered protocol family 2 [ 0.184000] TCP established hash table entries: 512 (order: 0, 4096 bytes) [ 0.192000] TCP bind hash table entries: 512 (order: 0, 4096 bytes) [ 0.200000] TCP: Hash tables configured (established 512 bind 512) [ 0.208000] TCP: reno registered [ 0.208000] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 0.216000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 0.224000] NET: Registered protocol family 1 [ 0.228000] PCI: CLS 0 bytes, default 16 [ 0.228000] audit: initializing netlink socket (disabled) [ 0.236000] type=2000 audit(0.232:1): initialized [ 0.240000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.248000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.256000] msgmni has been set to 56 [ 0.264000] io scheduler noop registered [ 0.268000] io scheduler deadline registered (default) [ 0.272000] bcm63xx_uart.0: ttyS0 at MMIO 0xb0000100 (irq = 10) is a bcm63xx_uart [ 0.280000] console [ttyS0] enabled, bootconsole disabled [ 0.292000] bcm63xx-rng bcm63xx-rng: registered RNG driver [ 0.300000] physmap platform flash device: 08000000 at 18000000 [ 0.308000] physmap-flash.0: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x00227e [ 0.320000] physmap-flash.0: Found an alias at 0x1000000 for the chip at 0x0 [ 0.320000] Amd/Fujitsu Extended Query Table at 0x0040 [ 0.324000] Amd/Fujitsu Extended Query version 1.3. [ 0.328000] number of CFI chips: 1 [ 0.332000] bcm63xxpart: CFE boot tag found with version 6 and board type 96368MVWG_hg622 [ 0.340000] bcm63xxpart: Partition 0 is CFE offset 0 and length 20000 [ 0.348000] bcm63xxpart: Partition 1 is kernel offset 20100 and length 11ff00 [ 0.356000] bcm63xxpart: Partition 2 is rootfs offset 140000 and length e60000 [ 0.364000] bcm63xxpart: Partition 3 is cal_data offset fa0000 and length 20000 [ 0.372000] bcm63xxpart: Partition 4 is nvram offset fe0000 and length 20000 [ 0.376000] bcm63xxpart: Partition 5 is linux offset 20000 and length f80000 [ 0.384000] bcm63xxpart: Spare partition is offset 310004 and length c8fffc [ 0.392000] 6 bcm63xxpart partitions found on MTD device physmap-flash.0 [ 0.400000] Creating 6 MTD partitions on "physmap-flash.0": [ 0.404000] 0x000000000000-0x000000020000 : "CFE" [ 0.412000] 0x000000020100-0x000000140000 : "kernel" [ 0.416000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only [ 0.432000] 0x000000140000-0x000000fa0000 : "rootfs" [ 0.440000] mtd: partition "rootfs" set to be root filesystem [ 0.444000] mtd: partition "rootfs_data" created automatically, ofs=320000, len=C80000 [ 0.452000] 0x000000320000-0x000000fa0000 : "rootfs_data" [ 0.460000] 0x000000fa0000-0x000000fc0000 : "cal_data" [ 0.468000] 0x000000fe0000-0x000001000000 : "nvram" [ 0.476000] 0x000000020000-0x000000fa0000 : "linux" [ 0.484000] bcm63xx-spi bcm63xx-spi: at 0xb0000800 (irq 9, FIFOs size 542) [ 0.532000] b53_common: found switch: BCM63xx, rev 0 [ 0.536000] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.548000] TCP: cubic registered [ 0.552000] NET: Registered protocol family 17 [ 0.556000] 8021q: 802.1Q VLAN Support v1.8 [ 0.568000] VFS: Mounted root (squashfs filesystem) readonly on device 31:2. [ 0.576000] Freeing unused kernel memory: 200k freed [ 2.508000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex [ 2.740000] Button Hotplug driver version 0.4.1 [ 2.764000] input: gpio-keys-polled as /devices/platform/gpio-keys-polled.0/input/input0 [ 6.252000] jffs2: notice: (365) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (1 unchecked, 0 orphan) and 15 of xref (0 dead, 10 orphan) found. [ 7.428000] compat-drivers backport release: compat-drivers-2013-03-28-5 [ 7.432000] Backport based on wireless-testing.git master-2013-04-16 [ 7.440000] compat.git: wireless-testing.git [ 7.488000] cfg80211: Calling CRDA to update world regulatory domain [ 7.492000] cfg80211: World regulatory domain updated: [ 7.500000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [ 7.508000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 7.516000] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 7.524000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (300 mBi, 2000 mBm) [ 7.532000] cfg80211: (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 7.540000] cfg80211: (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 2000 mBm) [ 7.856000] NET: Registered protocol family 10 [ 8.176000] SCSI subsystem initialized [ 8.336000] usbcore: registered new interface driver usbfs [ 8.344000] usbcore: registered new interface driver hub [ 8.348000] usbcore: registered new device driver usb [ 8.848000] PCI: Enabling device 0000:00:01.0 (0000 -> 0002) [ 8.852000] rt2800pci 0000:00:01.0: setting latency timer to 64 [ 8.856000] phy0 -> rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'rt2x00.eeprom'. [ 8.868000] phy0 -> rt2x00_set_rt: Info - RT chipset 3572, rev 0223 detected [ 8.876000] phy0 -> rt2x00_set_rf: Info - RF chipset 0008 detected [ 8.884000] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht' [ 9.452000] PPP generic driver version 2.4.2 [ 9.732000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 10.008000] NET: Registered protocol family 24 [ 10.168000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 10.192000] ehci-platform: EHCI generic platform driver [ 10.304000] ehci-platform ehci-platform: EHCI Host Controller [ 10.308000] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 [ 10.316000] ehci-platform ehci-platform: irq 15, io mem 0xb0001500 [ 10.336000] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 10.344000] hub 1-0:1.0: USB hub found [ 10.348000] hub 1-0:1.0: 2 ports detected [ 10.472000] nf_conntrack version 0.5.0 (452 buckets, 1808 max) [ 11.416000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 11.760000] Initializing USB Mass Storage driver... [ 11.768000] usbcore: registered new interface driver usb-storage [ 11.772000] USB Mass Storage support registered. [ 14.664000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex [ 15.756000] bcm63xx_enetsw bcm63xx_enetsw.0: link UP on port1, 100Mbps, full-duplex [ 15.768000] device eth0.1 entered promiscuous mode [ 15.772000] device eth0 entered promiscuous mode [ 15.780000] br-lan: port 1(eth0.1) entered forwarding state [ 15.788000] br-lan: port 1(eth0.1) entered forwarding state [ 16.752000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready [ 17.792000] br-lan: port 1(eth0.1) entered forwarding state [ 20.872000] phy0 -> rt2x00lib_request_firmware: Info - Loading firmware file 'rt2860.bin'. [ 20.988000] phy0 -> rt2x00lib_request_firmware: Info - Firmware detected - version: 0.34. [ 21.100000] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 23.784000] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead. [ 23.976000] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready