Вы должны войти, чтобы отправлять комментарии на этот сайт — пожалуйста, либо войдите, либо — если вы еще не зарегистрированы — щелкните
здесь, чтобы зарегистрироваться
nik.s
25 июл : 17:58
не исчезает уведомление об освобожденной памяти .реалми с30
rash_b
21 дек : 18:06
sadik5572, все архивы без паролей
sadik5572
20 дек : 20:03
загрузка не идет пароль спрашивает
sadik5572
20 дек : 20:02
Прошивка Huawei E3372s-153 21.286.03.01.209 Megafon
sadik5572
20 дек : 20:02
подскажите пароль от архива дашборад
sadik5572
20 дек : 20:01
Добрый вечер
antenna161
16 ноя : 19:00
Добрый вечер! Не подскажите как дружить модем zte mf192 с андроидом
rash_b
09 ноя : 06:25
Sergavens, ввести тот же код.
Sergavens
07 ноя : 22:17
8810ft обновляется прошивка, слетает разлочка. Есть решение?
Katsu
26 окт : 09:46
Можете помочь разлочить под все симки роутер huawei e5576-320?
I have already provided the unlocking solution of the Huawei B593u 4G CPE router. In various countries, customized firmware B593 routers have been released and do not allow to unlock them. This article is dedicated to those persons who are facing problems in unlocking their B593u devices.
Requirements of flashing the firmware of Huawei B593u 4G CPE router
1. Download unlocked firmware of Huawei B593u-12.
2. Download Huawei B593u Firmware Upgrade Tool
3. Download Huawei B593 Configuration File to Create Profile
4. Download and install WinRAR 3.80 or a later version in the default installation path C:\Program Files\WinRAR.
How to Flash the Firmware of Huawei B593u 4G CPE Router Free?
1. Connect the B593u to the PC and assign the static IP address to the PC network port connected to the HUB to 192.168.1.5.
2. Open the downloaded Huawei B593 multicast upgrade software. Click on refresh to refresh the network card list and select the network card whose IP address is 192.168.1.5.
3. Click Open, and then a dialog box for selecting the upgrade file is displayed. Select the upgrade package cpe.tar.bz2, and then click Open.
4. If you have an upgrade package as B593.trx, then in Policy, choose a router, click Open, and select the file.
5. Below the File Path box, if the version number is displayed as the error information such as Error file version… or Analyse time-out…, it indicates that the upgrade package is incorrect.
6. Click Start to start sending multicast packets.
7. After the successful upgrade is complete; all the five signal indicators will be ON on the router.
8. Now, Click Stop to stop sending multicast packets.
9. Close the multicast tool.
10. Power off the HUB and enjoy the B593 CPE router.
If your B593 4G CPE router does not allow the change or create the new APN, then
1. Open 192.168.254.254 and login as a user (password @l03e1t3).
2. Go to the System tab.
3. Find Upload Configuration File and choose file jhosherxx.conf from PC you have already downloaded.
4. After uploading message will popup, click ok and wait until the device reboots.
Now, you can easily create the profile in your B593 router.
HUAWEI B593 4G LTE Router Installation—Quick guide to get online with 4G router
1) You should start by inserting the SIM card and then plug the power adapter to the B593 4G router. SIM card must be inserted on the right side when looking at the front of the router. You can see how the SIM card slot in the LTE CPE B593. Power plug must be inserted behind the router.
2) Now you need to connect the router to your computer via wireless network (WiFi). You will find the router’s name and network code on the sticker behind the router.
WLAN – Name (SSID) is the router’s name and WLAN – Key (WPA/WPA2) is the router’s wireless network password. When you first connect the router via WiFi, it would be necessary to enter the WLAN key and get connected.
If you experience problems connecting to the router with the information on the back of the router, this information may be changed. Press reset on the side of the router with a ball pen for about 20 seconds and try again.
3) Once connected, open your Internet browser (eg Internet Explorer, Chrome or Safari) and in the address bar, type the router’s address http://192.168.1.1 (or Homerouter.cpe). It’s the device website on the label.
The default language is English, but you can choose your preferred language. Username is admin and password admin in lowercase. You can also find both the router’s address and password on the sticker behind the router.
4) The router will ask you to change the password when you login. You can ignore it. Your router is already secured with the unique network code that you entered earlier in order to connect to the router.
5) Now select Setup Wizard in the left menu.
You must validate your PIN to the SIM card. You will find PIN 1 on the frame, you took the SIM card out of the scrape area. Then click Validate. Tick the Enable next to Save my PIN and press Next.
Please note that the router stores the PIN code for the SIM card. Put a new SIM card in the router at a time; enter the PIN code for the new SIM card in the same way.
But if you use unlocked B593 Router, it’s unnecessary to do this. 4GLTEMALL.com is selling the unlocked B593 Router.
6) You do not need to change anything in the next section called Internet.
Network mode is by default to Auto and Connection Mode to Always On. Please note that “LTE Only” means “4G Only” and “WCDMA only” means “3G only” in Network mode. You can try to isolate the signal to one of them if you wish. If you set it in Auto as recommended, the router will always try to use 4G as a primary connection. Press Next.
7) You do not need to change anything in the next section called WLAN .
If you want to call your router something other than WLAN1-xxxx , it’s SSID , you need to change. We do not recommend that you do, and then you will always be able to find the router’s name on the back of the router if you do not change it. Press Next.
We do not recommend that you change the following in the next point WLAN Security. Network code field is WPA with pre-shared key. This code is already unique and you should only use it once when you connect to the router for the first time on your computer or your mobile. You will also be able to find the network code on the back of the router if you ever need it again later.
If you want to change it anyway, you must enter a code on minimum 8 characters and press Next. Otherwise, press the Next without changing the information below.
9) Now press Submit and your router will reboot and you will be on the internet.
10) Repeat point 2 for all devices to connect with the Internet.
Color Codes
Color Coding Mode on the front of the router
The purple color means that the router lacks the PIN. The blue color means that you are on 4G. The green color means that you are on 3G.
Firmware upgrade — Quick Guide for upgrade
1) Download the latest HUAWEI B593u–12 firmware upgrade> (. zip 26 Mb)
2) Save the file to your desktop and unzip the file when you are finished.
3) Open your browser and log into your router via 192.168.1.1
Username: admin
Password: admin (lower case)
4) Select System > Upgrade > select tar. (The file you just extracted from the zip. file)> press Upgrade, then wait for few minutes, the system will auto upgrade the firmware of the HUAWEI B593u-12.
These steps are also usable for HUAWEI B593s-22 and HUAWEI B593 other models, but the firmware varies.
If you want to know more Huawei Router CPEs, click here: https://www.4gltemall.com/4g-wireless-router/huawei-4g-lte-wifi-router.html
The Huawei B593u-12 is a router with an integrated LTE modem. It is also sold as branded versions by telco providers, e.g. as Telekom Speedport LTE II and as Vodafone B2000.
Devices with Broadcom WiFi chipsets have limited OpenWrt supportability (due to limited FLOSS driver availability for Broadcom chips). Consider this when choosing a device to buy, or when deciding to flash OpenWrt on your device because it is listed as supported.
See Broadcom WiFi for details.
Supported since 84576368689cef5491a34eb76ae2a1dfd2a0a3ba
LTE, NAND and USB are working. NAND gets detected as a “USB Mass Storage device”, and from factory it is formatted ext3.
You can flash the router through CPE or through the web page from the factory image. However, when OpenWrt boots it does not manage to write to the flash.
LAN and switch were working with target profile brcmsmac in Kernel 4.9. With Kernel 4.14 and subsequent versions, a bug prevents the switch from coming up. The last commit before removal of Kernel 4.9 support in brcm47xx is b7dd438f66253cc49fa8b0b3434d5ef50fffbb7c.
WLAN is not working due to missing drivers.
| Huawei B593u-12 | |
|---|---|
| Instruction set | MIPS |
| Vendor | Broadcom |
| bootloader | cfe |
| Board ID | Boardtype “0x053d”, Boardnum “1234”, Boardrev “0x1301” |
| System-On-Chip | Broadcom BCM5357 |
| CPU/Speed | MIPS 74Kc V4.9 / CPU type 0x19749 / 500MHz |
| SPI flash | 16 MiB M25FL128 NOR serial flash |
| NAND flash | 256MiB NAND flash |
| RAM | 128 MiB |
| Wireless | BCM5358U 802.11b/g/n (SoC) |
| Antenna | 2x external connector |
| Ethernet | 4x 10/100 Mbps |
| USB | 2x USB 2.0 |
| LTE | Qualcomm MDM9200, Band 1/3/7/8/20 (FDD 800/900/1800/2100/2600MHz) |
| Power adapter | 12V DC 2A / HW-120200E1W |
Outside
Inside
Serial Pins
Using the script on add.new.device only manages to bring up one LED.
| LED Color | LED Name | GPIO | Polarity |
|---|---|---|---|
| Blue | Power | Always on (?) | |
| Blue | WLAN | 5 | Active low |
| Blue | WPS | ? | ? |
| Blue | MODE | ? | ? |
| Blue | SIM Signal | Potentially hardwired to LTE module (?) |
| Button Name | GPIO | Polarity |
|---|---|---|
| WLAN | 25 | Active low |
| WPS | 26 | Active low |
| Reset | 27 | Active low |
The flash layout from the factory firmware is:
| Huawei B593u-12 Flash Layout | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Layer0 | raw NOR flash memory chip (M25FL128 serial flash (size: 16.384KiB, blocksize: 0x40000 (256KiB), blocks: 64) | |||||||||
| Layer1 | Bootloader 256KiB | mtd2: rootfs 10.240KiB | Subject image 3.750KiB | Current Config 256KiB | Factory Config 256KiB | Temporary Config 512KiB | Fixed Config 256KiB | Log Config 256KiB | mtd1: auxfs TR-069 certificate 256KiB | mtd0: nvram 256KiB |
From the factory image, “B593.trx” gets flashed into mtd2: roots. The rescue image “B593-small.trx” gets flashed into the Subject image. Current and Factory Config store the configuration as plain text XML (with the initial 4 Bytes being the length of the configuration). The remaining partitions (except mtd0: nvram) are mostly filled with “FF”, so it is unclear if they are empty, or if the dump didn’t succeed.
The flash layout that OpenWrt recognizes is:
| Huawei B593u-12 Flash Layout | ||||||
|---|---|---|---|---|---|---|
| Layer0 | raw NOR flash memory chip (M25FL128 serial flash (size: 16.384KiB, blocksize: 0x10000 (64KiB), blocks: 256) | |||||
| Layer1 | mtd0 boot 256KiB | mtd1 firmware 10.240KiB | mtd5 failsafe 5.824KiB | mtd6 nvram 64KiB | ||
| Layer2 | mtd2 loader 256Bytes | mtd3 linux 1.730,7KiB | mtd4 rootfs 8.509KiB |
Please note that OEM image uses blocksize of 256KiB (0x40000), and standard OpenWRT uses blocksize of 64KB (0x10000). I also tested a blocksize of 4KB (0x1000), as some routers use this. But neither of the 3 blocksizes solved the problem of writing to flash with OpenWRT. Using a block size of 4k produces the least number of error messages in the log — so this might be the right one.
An additional 256 Bytes header after the TRX header is used in the factory firmware, and data shows up in CFE before boot. Neither the website nor CFE check for the validity of the additional header, so it is safe to just add 256 Bytes padding between the standard TRX header and the actual data. The “Huawei B593 multicast upgrade software” does check the header, so you can only flash proper firmwares with it.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+================ 28 Bytes standard TRX v1 header ==============+
| 4 Bytes magic number ('HDR0') |
+---------------------------------------------------------------+
| 4 Bytes length (header size + data) |
+---------------------------------------------------------------+
| 4 Bytes (32-bit) CRC value |
+-------------------------------+-------------------------------+
| 2 Bytes TRX flags | 2 Bytes TRX version |
+-------------------------------+-------------------------------+
| 4 Bytes partition offset[0] = lzma-loader |
+---------------------------------------------------------------+
| 4 Bytes partition offset[1] = Linux Kernel |
+---------------------------------------------------------------+
| 4 Bytes partition offset[2] = rootfs |
+=================== 256 Bytes CFE Header ======================+
| 16 Bytes CFE "product_name" |
| (in factory firmware this is 'B593-U12') |
+---------------------------------------------------------------+
| 32 Bytes CFE "plt_version" |
| (in factory firmware this is 'V100R003C03B008') |
+---------------------------------------------------------------+
| 32 Bytes CFE "sw_version" |
| (in factory firmware this is 'V100R001C748SP107') |
+---------------------------------------------------------------+
| 32 Bytes CFE "hw_version" |
| (in factory firmware this is 'Ver.B') |
+---------------------------------------------------------------+
| 32 Bytes CFE "modem_version" |
| (in factory firmware this is '11.533.03.03.748') |
+---------------------------------------------------------------+
| 112 Bytes padding |
+---------------------------------------------------------------+
This is the output for firmware V100R001C748SP107 from Telekom.
# cat /proc/version Linux version 2.6.21.5 (LTECPE@lmt) (gcc version 4.2.3) #1 Wed Oct 22 22:46:57 CST 2014
# cat /proc/cpuinfo system type : CHIP95358 processor : 0 cpu model : MIPS 74K V4.9 BogoMIPS : 248.32 wait instruction : no microsecond timers : yes tlb_entries : 64 extra interrupt vector : no hardware watchpoint : yes ASEs implemented : mips16 dsp VCED exceptions : not available VCEI exceptions : not available unaligned exceptions : 23878
# cat /proc/cmdline root=31:2 ro noinitrd console=ttyS0,115200
# cat /proc/meminfo MemTotal: 126080 kB MemFree: 96804 kB Buffers: 2976 kB Cached: 12800 kB SwapCached: 0 kB Active: 6564 kB Inactive: 12460 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 20 kB Writeback: 0 kB AnonPages: 3272 kB Mapped: 2500 kB Slab: 4112 kB SReclaimable: 892 kB SUnreclaim: 3220 kB PageTables: 436 kB NFS_Unstable: 0 kB Bounce: 0 kB CommitLimit: 63040 kB Committed_AS: 6052 kB VmallocTotal: 1032148 kB VmallocUsed: 3448 kB VmallocChunk: 1027212 kB
# cat /proc/devices Character devices: 1 mem 2 pty 3 ttyp 4 ttyS 5 /dev/tty 5 /dev/console 10 misc 13 input 21 sg 89 i2c 90 mtd 180 usb 188 ttyUSB 189 usb_device 209 endpoint 242 fcache 248 bhal 249 commondrv 250 i2c_pca 251 usb_endpoint 252 usbmon 253 nvram 254 gpio Block devices: 8 sd 31 mtdblock 65 sd 66 sd 67 sd 68 sd 69 sd 70 sd 71 sd 128 sd 129 sd 130 sd 131 sd 132 sd 133 sd 134 sd 135 sd
# cat /proc/bus/pci/devices 0000 14e40800 8 18000000 0 0 0 0 0 0 1000 1000 0 0 0 0 800 0008 14e44347 3 18001000 0 0 0 0 0 0 1000 1000 0 0 0 0 800 wl 0010 14e44715 4 18002000 0 0 0 0 0 0 1000 1000 0 0 0 0 800 et 0020 14e4471a 5 18009000 0 0 0 0 0 0 1000 0 0 0 0 0 800 ohci_hcd 0021 14e4471a 5 18004000 0 0 0 0 0 0 1000 0 0 0 0 0 800 ehci_hcd 0028 14e4082e d 18005000 0 0 0 0 0 0 1000 1000 0 0 0 0 800 0030 14e44711 e 18006000 0 0 0 0 0 0 1000 1000 0 0 0 0 800 0038 14e4080e 8 18007000 0 0 0 0 0 0 1000 1000 0 0 0 0 800
# cat /proc/interrupts
CPU0
3: 4435 MIPS wl0
4: 0 MIPS eth0
5: 7615 MIPS ehci_hcd:usb1, ohci_hcd:usb2
7: 99808 MIPS timer
8: 1421 IRQ2 serial
ERR: 0
# ifconfig -a
br0 Link encap:Ethernet HWaddr F8:01:13:C2:19:73
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:402 errors:0 dropped:0 overruns:0 frame:0
TX packets:195 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:39609 (38.6 KiB) TX bytes:14080 (13.7 KiB)
br1 Link encap:Ethernet HWaddr 00:00:00:00:00:00
inet addr:191.255.255.1 Bcast:191.255.255.3 Mask:255.255.255.252
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:90 (90.0 B)
eth0 Link encap:Ethernet HWaddr F8:01:13:C2:19:73
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:432 errors:0 dropped:0 overruns:0 frame:0
TX packets:193 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:55147 (53.8 KiB) TX bytes:16004 (15.6 KiB)
Interrupt:4 Base address:0x2000
eth0.1 Link encap:Ethernet HWaddr F8:01:13:C2:19:73
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth0.2 Link encap:Ethernet HWaddr F8:01:13:C2:19:73
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth0.3 Link encap:Ethernet HWaddr F8:01:13:C2:19:73
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth0.4 Link encap:Ethernet HWaddr F8:01:13:C2:19:73
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth0.5 Link encap:Ethernet HWaddr F8:01:13:C2:19:73
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:432 errors:0 dropped:0 overruns:0 frame:0
TX packets:193 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:49099 (47.9 KiB) TX bytes:16776 (16.3 KiB)
hed0 Link encap:Ethernet HWaddr 00:1E:10:1F:06:03
inet addr:10.29.113.14 Bcast:10.255.255.255 Mask:255.0.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:23 errors:0 dropped:0 overruns:0 frame:0
TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2614 (2.5 KiB) TX bytes:2062 (2.0 KiB)
hed1 Link encap:Ethernet HWaddr 00:1E:10:1F:06:05
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
ifb0 Link encap:Ethernet HWaddr 32:0A:9F:FA:03:D5
BROADCAST NOARP MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
ifb1 Link encap:Ethernet HWaddr D2:68:14:A3:22:D4
BROADCAST NOARP MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:32
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:13 errors:0 dropped:0 overruns:0 frame:0
TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:951 (951.0 B) TX bytes:951 (951.0 B)
sit0 Link encap:UNSPEC HWaddr 00-00-00-00-0A-0A-00-00-00-00-00-00-00-00-00-00
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
wl0 Link encap:Ethernet HWaddr F8:01:13:C2:19:74
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:2 dropped:0 overruns:0 frame:59928
TX packets:0 errors:1 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Interrupt:3 Base address:0x1000
wl0.1 Link encap:Ethernet HWaddr F8:01:13:C2:19:75
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:2 dropped:0 overruns:0 frame:59928
TX packets:0 errors:1 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.f80113c21973 no eth0.2
eth0.3
eth0.4
eth0.5
wl0
br1 8000.000000000000 no
The factoy image doesn’t recognize all of the flash in Linux. However, the proprietary tool “flashtest” gives insights into the flash, and allows dumping it, e.g. you can dump all of the flash with command “flashtest export 000000 16777216”. Here is a comparison of what “flashtest”, “dmsg” and “/proc/mtd” provide.
# flashtest info | dmesg | cat /proc/mtd flash block size : 0x40000 (256k Bytes) | | dev: size erasesize name flash block num : 0x40 (64 Blocks) | | flash total size : 0x1000000 (16M Bytes) | | flash partation info : | | --------------------------------------------- | | Name Address Usage | | --------------------------------------------- | | Boot 0x0---0x40000 Bootloader | | Image 0x40000---0xA40000 Main image | 0x001a1558-0x00a40000 : "rootfs" | mtd2: 0089eaa8 00040000 "rootfs" Image 0xA40000---0xE00000 Subject image | | Curcfg 0xE00000---0xE40000 Curcent config | | Faccfg 0xE40000---0xE80000 Factury config | | Tmpcfg 0xE80000---0xF00000 Temp config | | Fixcfg 0xF00000---0xF40000 Fixed config | | Logcfg 0xF40000---0xF80000 Log config | | TR069 0xF80000---0xFC0000 TR069 cert | 0x00f80000-0x01000000 : "auxfs" | mtd1: 00080000 00040000 "auxfs" Nvram 0xFC0000---0xFFFFFF Nvram | 0x00fc0000-0x01000000 : "nvram" | mtd0: 00040000 00040000 "nvram"
# dmesg
<5>[4294667.296000] Linux version 2.6.21.5 (LTECPE@lmt) (gcc version 4.2.3) #1 Wed Oct 22 22:46:57 CST 2014
<4>[4294667.296000] Sflash type : 0x100 ; Sflash devid : 0x17 ; Sflash manuid : 0x1
<4>[4294667.296000] Found a 16MB SPANSION serial flash
<4>[4294667.296000] CHIP95358 prom init
<4>[4294667.296000] CPU revision is: 00019749
<4>[4294667.296000] Determined physical RAM map:
<4>[4294667.296000] memory: 07fff000 @ 00000000 (usable)
<7>[4294667.296000] On node 0 totalpages: 32767
<7>[4294667.296000] DMA zone: 32 pages used for memmap
<7>[4294667.296000] DMA zone: 0 pages reserved
<7>[4294667.296000] DMA zone: 4064 pages, LIFO batch:0
<7>[4294667.296000] Normal zone: 223 pages used for memmap
<7>[4294667.296000] Normal zone: 28448 pages, LIFO batch:7
<4>[4294667.296000] Built 1 zonelists. Total pages: 32512
<5>[4294667.296000] Kernel command line: root=31:2 ro noinitrd console=ttyS0,115200
<4>[4294667.296000] brcm mips: enabling icache and dcache…
<4>[4294667.296000] Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
<4>[4294667.296000] Primary data cache 32kB, 4-way, linesize 32 bytes.
<6>[4294667.296000] Synthesized TLB refill handler (20 instructions).
<6>[4294667.296000] Synthesized TLB load handler fastpath (32 instructions).
<6>[4294667.296000] Synthesized TLB store handler fastpath (32 instructions).
<6>[4294667.296000] Synthesized TLB modify handler fastpath (31 instructions).
<4>[4294667.296000] PID hash table entries: 512 (order: 9, 2048 bytes)
<4>[4294667.296000] CPU: BCM5357 rev 2 at 500 MHz
<4>[4294667.296000] Using 250.000 MHz high precision timer.
<4>[4294667.297000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
<4>[4294667.297000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
<4>[4294667.297000] Allocating memory for DSP module core and initialization code
<4>[4294667.298000] Allocated DSP module memory — CORE=0x0 SIZE=0, INIT=0x0 SIZE=0
<6>[4294667.314000] Memory: 125808k/131068k available (2777k kernel code, 5112k reserved, 810k data, 124k init, 0k highmem)
<4>[4294667.314000] KLOB Pool 1 Initialized: 1048576 bytes <0x80c00000 … 0x80d00000>
<7>[4294667.315000] Calibrating delay loop… 248.32 BogoMIPS (lpj=124160)
<4>[4294667.333000] Mount-cache hash table entries: 512
<6>[4294667.335000] NET: Registered protocol family 16
<5>[4294667.345000] SCSI subsystem initialized
<6>[4294667.346000] usbcore: registered new interface driver usbfs
<6>[4294667.346000] usbcore: registered new interface driver hub
<6>[4294667.347000] usbcore: registered new device driver usb
<4>[4294667.348000] PCI: no core
<4>[4294667.349000] PCI: Fixing up bus 0
<4>[4294667.352000] BLOG v2.1 Initialized
<6>[4294667.353000] Time: MIPS clocksource has been installed.
<6>[4294667.355000] usbcore: registered new interface driver huawei_ether
<6>[4294667.355000] NET: Registered protocol family 2
<4>[4294667.366000] IP route cache hash table entries: 128 (order: -3, 512 bytes)
<4>[4294667.366000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
<4>[4294667.366000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
<6>[4294667.367000] TCP: Hash tables configured (established 4096 bind 4096)
<6>[4294667.367000] TCP reno registered
<6>[4294667.371000] squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
<4>[4294667.371000] squashfs: LZMA suppport for slax.org by jro
<4>[4294667.371000] fuse init (API version 7.8)
<6>[4294667.372000] io scheduler noop registered (default)
<6>[4294667.742000] Serial: 8250/16550 driver $Revision: 1.3 $ 4 ports, IRQ sharing disabled
<4>[4294667.742000] netlog start
<6>[4294667.742000] serial8250: ttyS0 at MMIO 0x0 (irq = is a 16550A
<5>[4294667.751000] sflash: squash filesystem with lzma found at block 1669
<5>[4294667.752000] Creating 3 MTD partitions on «sflash»:
<5>[4294667.753000] 0x00fc0000-0x01000000 : «nvram»
<5>[4294667.754000] 0x00f80000-0x01000000 : «auxfs»
<5>[4294667.755000] 0x001a1558-0x00a40000 : «rootfs»
<7>[4294667.784000] PCI: Setting latency timer of device 0000:00:04.1 to 64
<6>[4294667.785000] ehci_hcd 0000:00:04.1: EHCI Host Controller
<6>[4294667.786000] ehci_hcd 0000:00:04.1: new USB bus registered, assigned bus number 1
<6>[4294667.808000] ehci_hcd 0000:00:04.1: irq 5, io mem 0x18004000
<6>[4294667.809000] ehci_hcd 0000:00:04.1: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
<6>[4294667.810000] usb usb1: configuration #1 chosen from 1 choice
<6>[4294667.811000] hub 1-0:1.0: USB hub found
<6>[4294667.812000] hub 1-0:1.0: 2 ports detected
<4>[4294668.314000]
<4>[4294668.314000] ==find the root hub=
<7>[4294668.315000] ohci_hcd: 2006 August 04 USB 1.1 ‘Open’ Host Controller (OHCI) Driver
<7>[4294668.316000] PCI: Setting latency timer of device 0000:00:04.0 to 64
<6>[4294668.317000] ohci_hcd 0000:00:04.0: OHCI Host Controller
<6>[4294668.318000] ohci_hcd 0000:00:04.0: new USB bus registered, assigned bus number 2
<6>[4294668.319000] ohci_hcd 0000:00:04.0: irq 5, io mem 0x18009000
<6>[4294668.375000] usb usb2: configuration #1 chosen from 1 choice
<6>[4294668.376000] hub 2-0:1.0: USB hub found
<6>[4294668.377000] hub 2-0:1.0: 2 ports detected
<6>[4294668.572000] usb 1-1: new high speed USB device using ehci_hcd and address 2
<6>[4294668.738000] usb 1-1: configuration #1 chosen from 1 choice
<6>[4294668.739000] hub 1-1:1.0: USB hub found
<6>[4294668.740000] hub 1-1:1.0: 4 ports detected
<4>[4294669.243000]
<4>[4294669.243000] ==find the root hub=
<4>[4294669.244000]
<4>[4294669.244000] ==find the root hub=
<6>[4294669.451000] usb 1-1.1: new high speed USB device using ehci_hcd and address 3
<6>[4294669.569000] usb 1-1.1: configuration #1 chosen from 1 choice
<4>[4294669.570000]
<4>[4294669.570000] ==find hw card===
<6>[4294669.573000] usbcore: registered new interface driver usblp
<6>[4294669.574000] drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
<6>[4294669.575000] Initializing USB Mass Storage driver…
<7>[4294669.576000] usb_stor_huawei_scsi_init —————————————————>
<6>[4294669.577000] scsi0 : SCSI emulation for USB Mass Storage devices
<6>[4294669.578000] usbcore: registered new interface driver usb-storage
<6>[4294669.579000] USB Mass Storage support registered.
<7>[4294669.580000] usb-storage: device found at 3
<7>[4294669.581000] usb-storage: waiting for device to settle before scanning
<6>[4294669.582000] usbcore: registered new interface driver usbhid
<6>[4294669.583000] drivers/usb/input/hid-core.c: v2.6:USB HID core driver
<6>[4294669.584000] usbcore: registered new interface driver catc
<6>[4294669.585000] drivers/usb/net/catc.c: v2.8 CATC EL1210A NetMate USB Ethernet driver
<6>[4294669.586000] usbcore: registered new interface driver asix
<6>[4294669.587000] usbcore: registered new interface driver usbserial
<6>[4294669.588000] drivers/usb/serial/usb-serial.c: USB Serial support registered for generic
<6>[4294669.589000] usbcore: registered new interface driver usbserial_generic
<6>[4294669.590000] drivers/usb/serial/usb-serial.c: USB Serial Driver core
<6>[4294669.591000] drivers/usb/serial/usb-serial.c: USB Serial support registered for option1
<6>[4294669.592000] usbcore: registered new interface driver option
<6>[4294669.593000] drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1
<6>[4294669.594000] drivers/usb/serial/usb-serial.c: USB Serial support registered for pl2303
<6>[4294669.595000] usbcore: registered new interface driver pl2303
<6>[4294669.596000] drivers/usb/serial/pl2303.c: Prolific PL2303 USB to serial adaptor driver
<6>[4294669.597000] mice: PS/2 mouse device common for all mice
<6>[4294669.598000] i2c /dev entries driver
<6>[4294669.599000] I2C-47XXBIT driver
<6>[4294669.600000] usb 1-1.1: USB disconnect, address 3
<4>[4294669.601000]
<4>[4294669.601000] ==file:drivers/usb/core/hub.c,line:1207,func:isHWDataCardByUDev=udev->macfacuture=Huawei Technologies,udev->product=HUAWEI Mobile==
<4>[4294669.602000]
<4>[4294669.602000] ===idvendor=0x12d1,idproduct=5381,class=0,subclass=0==
<4>[4294669.603000]
<4>[4294669.603000] hw datacard disconnect.
<6>[4294669.605000] PCA9555 driver
<4>[4294669.610000]
<4>[4294669.610000] ==file:drivers/usb/core/hub.c,line:1207,func:isHWDataCardByUDev=udev->macfacuture=Huawei Technologies,udev->product=HUAWEI Mobile==
<4>[4294669.611000]
<4>[4294669.611000] ===idvendor=0x12d1,idproduct=5381,class=0,subclass=0==
<7>[4294669.612000] PCI: Setting latency timer of device 0000:00:02.0 to 64
<4>[4294669.623000]
<4>[4294669.623000] eth0 MAC ADDRESS: F8:01:13:C2:19:73
<4>[4294669.625000] eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.120.9
<4>[4294670.871000] eth0.1: MAC Address: F8:01:13:C2:19:73
<4>[4294670.873000] eth0.2: MAC Address: F8:01:13:C2:19:73
<4>[4294670.875000] eth0.3: MAC Address: F8:01:13:C2:19:73
<4>[4294670.877000] eth0.4: MAC Address: F8:01:13:C2:19:73
<4>[4294670.879000] eth0.5: MAC Address: F8:01:13:C2:19:73
<4>[4294670.892000] MoniterInit entry
<4>[4294670.893000] bhal: bhalInit entry
<4>[4294670.995000] KLOB extended to 2 pools
<4>[4294670.996000] Mirror/redirect action on
<4>[4294670.997000] u32 classifier
<4>[4294670.998000] Performance counters on
<4>[4294670.999000] Actions configured
<4>[4294671.000000] Netfilter messages via NETLINK v0.30.
<4>[4294671.001000] nf_conntrack version 0.5.0 (1023 buckets, 8184 max)
<4>[4294671.002000] KLOB extended to 3 pools
<4>[4294671.003000] nf_conntrack_rtsp v0.6.21 loading
<4>[4294671.004000] nf_nat_rtsp v0.6.21 loading
<4>[4294671.005000] ip_tables: (C) 2000-2006 Netfilter Core Team
<6>[4294671.006000] TCP cubic registered
<6>[4294671.007000] NET: Registered protocol family 1
<6>[4294671.008000] NET: Registered protocol family 10
<6>[4294671.009000] lo: Disabled Privacy Extensions
<4>[4294671.016000] KLOB extended to 4 pools
<6>[4294671.017000] IPv6 over IPv4 tunneling driver
<3>[4294671.018000] hub 1-1:1.0: hub_port_status failed (err = -71)
<3>[4294671.019000] hub 1-1:1.0: connect-debounce failed, port 1 disabled
<6>[4294671.020000] sit0: Disabled Privacy Extensions
<6>[4294671.021000] NET: Registered protocol family 17
<6>[4294671.022000] NET: Registered protocol family 15
<5>[4294671.023000] Bridge firewalling registered
<5>[4294671.024000] Bridge LAN vlan registered
<5>[4294671.025000] Ebtables v2.0 registered
<6>[4294671.026000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
<6>[4294671.027000] All bugs added by David S. Miller <davem@redhat.com>
<3>[4294671.028000] hub 1-1:1.0: cannot disable port 1 (err = -71)
<4>[4294671.029000]
<4>[4294671.029000] ==find the root hub=
<6>[4294671.030000] usb 1-1: USB disconnect, address 2
<4>[4294671.031000]
<4>[4294671.031000] =can not read device descriptor=
<4>[4294671.038000] VFS: Mounted root (squashfs filesystem) readonly.
<6>[4294671.039000] Freeing unused kernel memory: 124k freed
<4>[4294671.047000] KLOB extended to 5 pools
<6>[4294671.555000] usb 1-1: new high speed USB device using ehci_hcd and address 4
<6>[4294671.803000] usb 1-1: configuration #1 chosen from 1 choice
<6>[4294671.821000] hub 1-1:1.0: USB hub found
<6>[4294671.822000] hub 1-1:1.0: 4 ports detected
<4>[4294671.824000] KLOB extended to 6 pools
<6>[4294672.558000] usb 1-1.4: new high speed USB device using ehci_hcd and address 5
<6>[4294672.675000] usb 1-1.4: configuration #1 chosen from 1 choice
<6>[4294672.676000] scsi1 : SCSI emulation for USB Mass Storage devices
<7>[4294672.677000] usb-storage: device found at 5
<7>[4294672.678000] usb-storage: waiting for device to settle before scanning
<4>[4294673.122000] pktflow: module license ‘Proprietary’ taints kernel.
<4>[4294673.134000] Broadcom Packet Flow Cache Char Driver v2.1 Jan 18 2011 20:29:01 Registered<242>
<4>[4294673.135000] NBUFF v1.0 Initialized
<4>[4294673.136000] Broadcom Packet Flow Cache learning via BLOG enabled.
<4>[4294673.137000] Created Proc FS /procfs/fcache
<4>[4294673.138000] Broadcom Packet Flow Cache registered with netdev chain
<4>[4294673.139000] Constructed Broadcom Packet Flow Cache v2.1 Jan 18 2011 20:28:59
<4>[4294674.258000] wl_module_init: dhssivemode set to 0x0
<7>[4294674.259000] PCI: Setting latency timer of device 0000:00:01.0 to 64
<4>[4294674.265000] wl0: Broadcom BCM4347 802.11 Wireless Controller 5.60.120.27 @VERSION_TYPE@ (WLTEST)
<4>[4294675.044000] KLOB extended to 7 pools
<4>[4294675.045000] Endpoint: endpoint_init entry
<4>[4294675.046000] Endpoint: endpoint_init COMPLETED
<4>[4294677.312000] set 0
<4>[4294677.626000] ATP_FLASH_WriteFlashArea longlonglong++++++++++++++++++++++++++++++++5
<5>[4294678.772000] scsi 1:0:0:0: Direct-Access usb-disc 0002 PQ: 0 ANSI: 0
<4>[4294678.773000]
<4>[4294678.773000] ==sdev->type=0,sdev->vendor=usb-disc 0002Á^Ú¬÷;¬÷;Ð,sdev->model= 0002Á^Ú¬÷;¬÷;Ð======
<5>[4294678.777000] SCSI device nflasha: 512000 512-byte hdwr sectors (262 MB)
<5>[4294678.778000] nflasha: Write Protect is off
<7>[4294678.779000] nflasha: Mode Sense: 33 00 00 00
<3>[4294678.780000] nflasha: assuming drive cache: write through
<5>[4294678.784000] SCSI device nflasha: 512000 512-byte hdwr sectors (262 MB)
<5>[4294678.785000] nflasha: Write Protect is off
<7>[4294678.786000] nflasha: Mode Sense: 33 00 00 00
<3>[4294678.787000] nflasha: assuming drive cache: write through
<6>[4294678.788000] nflasha: unknown partition table
<5>[4294679.013000] sd 1:0:0:0: Attached scsi removable disk nflasha
<5>[4294679.014000] sd 1:0:0:0: Attached scsi generic sg0 type 0
<4>[4294679.015000]
<4>[4294679.015000] and sdev->vendor is usb-disc 0002Á^Ú¬÷;¬÷;Ð
<7>[4294679.018000] usb-storage: device scan complete
<4>[4294679.025000] ATP_FLASH_WriteFlashArea longlonglong++++++++++++++++++++++++++++++++7
<6>[4294680.865000] usb 1-1.1: new high speed USB device using ehci_hcd and address 6
<6>[4294681.035000] usb 1-1.1: configuration #1 chosen from 1 choice
<4>[4294681.039000]
<4>[4294681.039000] ==find hw card===
<4>[4294681.041000]
<4>[4294681.041000] This is hw device.id->idProduct=0x1506
<4>[4294681.042000]
<4>[4294681.042000] find the match device.pid=0x1506
<6>[4294681.043000] option 1-1.1:1.0: option1 converter detected
<6>[4294681.045000] usb 1-1.1: option1 converter now attached to ttyUSB0
<4>[4294681.047000]
<4>[4294681.047000] This is hw device.id->idProduct=0x1506
<4>[4294681.048000]
<4>[4294681.048000] find the match device.pid=0x1506
<6>[4294681.049000] option 1-1.1:1.1: option1 converter detected
<6>[4294681.051000] usb 1-1.1: option1 converter now attached to ttyUSB1
<4>[4294681.053000]
<4>[4294681.053000] This is hw device.id->idProduct=0x1506
<4>[4294681.054000]
<4>[4294681.054000] find the match device.pid=0x1506
<6>[4294681.055000] option 1-1.1:1.2: option1 converter detected
<6>[4294681.057000] usb 1-1.1: option1 converter now attached to ttyUSB2
<4>[4294681.058000] KLOB extended to 8 pools
<4>[4294681.059000] usb_ether probe driver !
<4>[4294681.059000] ^^^^^^ dev:6 interface:3
<4>[4294681.061000] +++++++++++++++++++++++++++ pktflow channel 13
<4>[4294681.064000] usb_ether probe driver !
<4>[4294681.064000] ^^^^^^ dev:6 interface:5
<4>[4294681.066000] +++++++++++++++++++++++++++ pktflow channel 15
<4>[4294681.343000] ATP_FLASH_WriteFlashArea longlonglong++++++++++++++++++++++++++++++++5
<4>[4294682.747000] ATP_FLASH_WriteFlashArea longlonglong++++++++++++++++++++++++++++++++7
<6>[4294685.308000] device eth0.2 entered promiscuous mode
<6>[4294685.321000] device eth0.3 entered promiscuous mode
<6>[4294685.333000] device eth0.4 entered promiscuous mode
<6>[4294685.345000] device eth0.5 entered promiscuous mode
<4>[4294685.643000] ATP_FLASH_WriteFlashArea longlonglong++++++++++++++++++++++++++++++++5
<4>[4294687.037000] ATP_FLASH_WriteFlashArea longlonglong++++++++++++++++++++++++++++++++7
<3>[4294691.065000] hw_send_qmi_request: 1 Get response failed
<4>[4294691.072000] ATP_FLASH_WriteFlashArea longlonglong++++++++++++++++++++++++++++++++5
<3>[4294692.225000] hw_send_qmi_request: get the conn status req=22 resp
<3>[4294692.226000] hw_cdc_check_status_work: carrier off
<3>[4294692.245000] hw_send_qmi_request: get the conn status req=22 resp
<3>[4294692.246000] hw_cdc_check_status_work: carrier off
<3>[4294692.248000] hw_send_qmi_request: 0 Get response failed
<3>[4294692.450000] hed0: hw_cdc_ioctl: The ndis port is busy.
<3>[4294692.451000] hw_send_qmi_request: get the conn status req=22 resp
<3>[4294692.452000] hw_cdc_check_status_work: carrier off
<4>[4294692.454000] ATP_FLASH_WriteFlashArea longlonglong++++++++++++++++++++++++++++++++7
<3>[4294693.991000] hed1: hw_cdc_ioctl: The ndis port is busy.
<3>[4294693.994000] hw_send_qmi_request: 0 Get response failed
<3>[4294694.197000] hw_send_qmi_request: get the conn status req=22 resp
<3>[4294694.198000] hw_cdc_check_status_work: carrier off
<3>[4294694.200000] hw_send_qmi_request: 0 Get response failed
<3>[4294694.213000] hw_send_qmi_request: get the conn status req=22 resp
<3>[4294694.214000] hw_cdc_check_status_work: carrier off
<3>[4294694.216000] hw_send_qmi_request: get the conn status req=22 resp
<3>[4294694.217000] hw_cdc_check_status_work: carrier off
<6>[4294695.738000] kjournald starting. Commit interval 5 seconds
<6>[4294695.740000] EXT3 FS on nflasha, internal journal
<6>[4294695.742000] EXT3-fs: mounted filesystem with ordered data mode.
<6>[4294696.991000] ADDRCONF(NETDEV_UP): hed0: link is not ready
<4>[4294697.094000]
<4>[4294697.094000] Apply 5358 flatness issue patch!
<4>[4294697.094000]
<4>[4294697.324000] ATP_FLASH_WriteFlashArea longlonglong++++++++++++++++++++++++++++++++5
<4>[4294698.698000] ATP_FLASH_WriteFlashArea longlonglong++++++++++++++++++++++++++++++++7
<6>[4294703.182000] device wl0 entered promiscuous mode
<6>[4294703.183000] br0: port 5(wl0) entering learning state
<6>[4294703.184000] br0: topology change detected, propagating
<6>[4294703.185000] br0: port 5(wl0) entering forwarding state
# nvram show
modem_upg=0
wl0.1_radius_port=1812
wps_event=a
opo=0x0
antswctl2g=0x1
rxchain=0x3
boardrev=0x1301
et0macaddr=F8:01:13:C2:19:73
wl0_akm=psk2
boot_wait=on
watchdog=0
maxp2ga0=0x4c
thome_version_update_flag=00000064
maxp2ga1=0x4c
wps_modelname=
qtdc1_ep=18
et0mdcport=0
wps_config_command=0
bxa2g=0x3
pmon_ver=CFE 5.60.120.9
vlan2ports=0 5
wps_config=client-pbc
wl0.1_key=1
wl0.1_hwaddr=F8:01:13:C2:19:75
wl0_ifname=wl0
ofdm2gpo=0x22222222
qtdc0_ep=4
wl0.1_wps_mode=disabled
wps_device_pin=xxx
wl0_mode=ap
mcs2gpo0=0x2222
mcs2gpo1=0x2222
mcs2gpo2=0x2222
wl_msglevel=0x1
triso2g=0x3
mcs2gpo3=0x2222
wlmngr=done
sromrev=8
mcs2gpo4=0x5555
mcs2gpo5=0x5555
mcs2gpo6=0x5555
boardtype=0x053d
mcs2gpo7=0x5555
aa2g=0x3
wps_uuid=0x000102030405060708090a0b0c0d0ebb
wl0.1_crypto=tkip+aes
lan_netmask=255.255.255.0
extpagain2g=0x2
wl0_ssid=xxx
tssipos2g=0x1
boardpwrctl=0x00000c00
bw40po=0x0
itt2ga0=0x20
itt2ga1=0x20
wl0_key1=1111111111111
wl0_key2=2222222222222
wl0_key3=3333333333333
wl0.1_preauth=0
wl0_key4=4444444444444
vlan2hwname=et0
qtdc_pid=48407
ag0=0x2
ag1=0x2
pa2gw2a0=0xFBDD
ag2=0xff
pa2gw2a1=0xFC50
mmiflag=-1
ag3=0xff
wl0_closed=0
xtalfreq=20000
console_disable=0
wl0_phytype=n
antswitch=0x0
boardflags2=0x1000
wps_proc_status=0
wps_sta_mac=E4:11:5B:88:A5:71
lan_hwaddr=F8:01:13:C2:19:73
wl0.1_auth_mode=none
wl0.1_akm=psk psk2
wl0.1_ifname=wl0.1
lan_wps_oob=disabled
wl0_wpa_psk=xxx
wait_time=10
wl_key1=1111111111111
ledbh0=0x0
lan_wps_reg=enabled
wl_key2=2222222222222
ledbh1=0x0
wl_key3=3333333333333
ledbh2=0x0
bwduppo=0x0
wl_key4=4444444444444
ledbh3=0xff
txchain=0x3
wl0_net_reauth=36000
wl0_bss_enabled=1
rssismc2g=0xf
wps_restart=0
rxpo2g=0xff
rssisav2g=0x7
wl_wps_reg=enabled
wps_mfstring=
lan_ifnames=eth0 eth0.5 eth0.2 eth0.3 eth0.4 wl0 wl0.1 wl0.2 wl0.3
wl0_auth=0
wl0_radius_port=1812
wl0_radius_ipaddr=0.0.0.0
leddc=0xffff
triso5g=0x3
wl0.2_ifname=wl0.2
pa2gw1a0=0x1354
wl0.1_mode=ap
pa2gw1a1=0x1283
clkfreq=500,200,100
lan_ipaddr=192.168.1.1
vlan1hwname=et0
wl_unit=0
wl0_wep=disabled
wps_sta_pin=00000000
sdram_config=0x144
vlan1ports=1 2 3 4 5*
wps_pinfail=0
wl0.1_radius_ipaddr=0.0.0.0
ccode=0
wl0.1_ssid=WLAN2-094542
router_upg=0
startup_times=179
wl0.1_radio=1
lan_ifname=br0
boardflags=0x710
rssismf2g=0xf
wandevs=vlan2
sdram_refresh=0x8040
wl0.1_key1=1111111111111
wl0.1_key2=2222222222222
wl0.1_key3=3333333333333
sdram_ncdl=0x00000000
wps_proc_mac=
wl0.1_key4=4444444444444
boot_part=0
option_upg=0
devid=0x4347
macaddr=F8:01:13:C2:19:74
pdetrange2g=0x2
wps_force_restart=Y
wl0.1_wps_config_state=1
wl0.3_ifname=wl0.3
wl_wep=disabled
et_swtype=1
qtdc_vid=2652
cck2gpo=0x0
wl0_wpa_gtk_rekey=0
wl0_key=1
regrev=0
friendly_name=802.11 Broadcom Reference
et0phyaddr=30
wps_aplockdown_cap=1
qtdc1_sz=10
wl_wps_config_state=1
wan_hostname=BRCM_ROUTER
landevs=vlan1 wl0
wl0_radio=1
wl0.1_wpa_psk=xxx
wps_mode=disabled
wps_currentband=
wl0_hwaddr=F8:01:13:C2:19:74
pa2gw0a0=0xFF99
pa2gw0a1=0xFFDC
wps_wer_mode=deny_pin
wl0_preauth=0
wl0.1_wpa_gtk_rekey=0
sdram_init=0x0419
stbcpo=0x2
qtdc0_sz=5
flow_count_data=0597C018,0000006B128FDE83,0000001485DBAA0D
wps_modelnum=123456
wps_method=1
wl0.1_net_reauth=36000
wl0_wps_config_state=1
tri2g=0xff
wl_key=1
gpio26=wps_button
wl0_channel=6
wps_device_name=
wl0.1_bss_enabled=0
cddpo=0x2
wl0_wps_mode=disabled
wps_config_method=0x80
wps_sta_devname=Deskjet 3050A All-in-One Printer<
default_apn_info=@@@@@,0
wl0.1_auth=0
wps_status=0
wl0.1_wep=disabled
wl0_auth_mode=none
wl0_crypto=aes
boardnum=1234
last_reboot_day=29
reboot_times=102
size: 3581 bytes (29187 left)
Many firmware versions allow enabling Telnet, and thus opening a shell with root access.
Telekom firmware
For firmware versions V100R001C748SP106 and V100R001C748SP107, you can modify the original firmware before flashing it to disable the firewall rules that block the Telnet Server. There is link a the end to of the page to the source of this information.
Step 1: Install the required tools on your computer
sudo apt-get update sudo apt-get -y install git build-essential zlib1g-dev liblzma-dev python-magic zip unzip mkdir -p ~/fmk cd ~/fmk git clone https://code.google.com/p/firmware-mod-kit/ cd firmware-mod-kit/src ./configure make
Step 2: Download and unpack the firmware
mkdir -p ~/fmk/107 cd ~/fmk/107 # Download Firmware_Speedport_LTE_II_B593u-12_V100R001C748SP107.zip -- unfortunately, Telekom doesn't host this file anymore unzip Firmware_Speedport_LTE_II_B593u-12_V100R001C748SP107.zip tar xvf V100R001C748SP107.tar.bz2
Step 3: Unpack, modify firmware to allow inbound telnet from LAN, then repack firmware
# Extract the trx file
~/fmk/firmware-mod-kit/extract-firmware.sh B593.trx
# Make a backup of the file we are going to patch
cp -a fmk/rootfs/bin/cms fmk
# Allow inbound telnet from LAN, make sure your replacement string is exactly same length as the original!
sed fmk/rootfs/bin/cms -i \
-e's|iptables -A INPUT_SERVICE -p tcp --dport 23 -j DROP 2>/dev/null|iptables -I INPUT -s 192.168.1.0/24 -j ACCEPT ##################|g'
# Check that original and modified binaries are same size but have different timestamps
ls -l fmk/cms fmk/rootfs/bin/cms
# Remove some unnecessary files to shrink squashfs image and keep fmk happy
rm -f fmk/rootfs/sbin/mkntfs
# Update version string in headers so device already running SP107 will accept our customized version
sed -i.bak fmk/image_parts/header.img \
-e's|V100R001C748SP107\x00\x00\x00|V100R001C748SP107hax|g'
# Rebuild the trx file
~/fmk/firmware-mod-kit/build-firmware.sh
# Create the new firmware archive
mv fmk/new-firmware.bin B593.trx
chmod 0644 B593.trx modem.bin help.tar.bz2 B593-small.trx
tar --owner=LTECPE --group=LTECPE -cvjf V100R001C748SP107_TELNET.tar.bz2 B593.trx modem.bin help.tar.bz2 B593-small.trx
# Clean up
sudo rm -rf fmk
After upgrading your router with the new firmware it should be reacheable over telnet. Telnet takes some time to start, so if the connection is refused try a few moments later. You can login as “admin” with password “HW4GCPE”. This takes you the ATP prompt, where you can type the undocumented command “shell” to open the root shell. Documented commands are: cls, debug, help, save, ?, exit.
The router is generally available over SSH, but the password is not in the firmware file (i.e. it cannot be extracted via fmk). But you can find the plaintext SSH password in /var/sshusers.cfg if you have serial or Telnet access.
The pins to the TTL serial console are shown in the pictures at the begining of this article. The settings are 115200 8N1. With the factory settings, the console is disabled for both CFE boot loader as well as for Linux. So you need to enable it in the NVRAM. The easyest way of changing the NVRAM is through Telnet root access, as described above.
The following commands enable the console for CFE and Linux, and enable a 10 second delay and additional recovery options during boot:
nvram set console_disable=0 nvram set boot_wait=on nvram set wait_time=10 nvram commit
If you don’t have root access, you can put your device into recovery mode:
If your cabling is correct, you will see the Linux boot log messages, and the WPS LED will start blinking. In the root shell you can update the NVRAM as described above. The login for the serial console is the same as for Telnet, i.e. “admin” and “HW4GCPE”.
Press CTRL+C during initial seconds of boot to get into CFE console and load your own firmware.
While in recovery mode, you can also send commands to CFE through the web interface. For instance, to call “show clocks” enter into the webbroser http://192.168.1.1/do.htm?cmd=show+clocks. The ouput will only be shown on TTL, but you can use this to update NVRAM or boor an ELF image.
Command in CFE are:
et Broadcom Ethernet utility. show clocks Show current values of the clocks. nvram NVRAM utility. reboot Reboot. flash Update a flash memory device batch Load a batch file into memory and execute it go Verify and boot OS image. boot Load an executable file into memory and execute it load Load an executable file into memory without executing it save Save a region of memory to a remote file via TFTP ping Ping a remote IP host. arp Display or modify the ARP Table ifconfig Configure the Ethernet interface help Obtain help for CFE commands
You need to build your own image:
git clone https://git.openwrt.org/openwrt/openwrt.git cd openwrt // In case you want working Ethernet git checkout b7dd438f66253cc49fa8b0b3434d5ef50fffbb7c // Change "KERNEL_PATCHVER" to 4.9 vi target/linux/brcm47xx/Makefile // The image Makefiles need to be adapted regarding two issues: // The lzma-loader crashes, maybe due to a watchdog reset during kernel decompress? But KERNEL_NAME = vmlinux-nodictionary.lzma without a loader will work. // You need an additional 256Bytes header after the TRX header, see above. // At first boot, OpenWrt will try to fix the CRC in the TRX. This corrupts the flash due to additional header. So please comment it out vi target/linux/brcm47xx/base-files/etc/uci-defaults/09_fix_crc ./scripts/feeds update -a ./scripts/feeds install -a make menuconfig make
In menuconfig, make sure to select
You will find “vmlinux-initramfs.elf” in “openwrt\build_dir\target-mipsel_74kc_musl\linux-bcm47xx_mips74k”. Please note that the file needs to be less than around 6.850KB (tests show that 6.852KB will be too large to boot, but 6.847KB will work).
Connect your computer to the LAN of the router. You should get an IP via DHCP, else pick an IP, e.g. 192.168.1.2. Start a TFTP Server on your computer. (dont forget to turn off the firewall). On the CFE console type
boot -elf -tftp 192.168.1.2:vmlinux-initramfs.elf
A bad flash might reset your NVRAM and then you loose the console, so you need to redo the procedure above.
# cat /proc/version Linux version 5.4.70 (user@computername) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r14660-5423d9d27e)) #0 Fri Oct 9 22:20:19 2020
# cat /proc/cpuinfo system type : Broadcom BCM5357 machine : Unknown Board processor : 0 cpu model : MIPS 74Kc V4.9 BogoMIPS : 249.34 wait instruction : yes microsecond timers : yes tlb_entries : 64 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb] isa : mips1 mips2 mips32r1 mips32r2 ASEs implemented : mips16 dsp dsp2 Options implemented : tlb 4kex 4k_cache prefetch mcheck ejtag llsc dc_aliases userlocal vint perf_cntr_intr_bit perf shadow register sets : 1 kscratch registers : 0 package : 0 core : 0 VCED exceptions : not available VCEI exceptions : not available
# cat /proc/meminfo MemTotal: 124744 kB MemFree: 107504 kB MemAvailable: 83248 kB Buffers: 0 kB Cached: 9624 kB SwapCached: 0 kB Active: 7412 kB Inactive: 2636 kB Active(anon): 7412 kB Inactive(anon): 2636 kB Active(file): 0 kB Inactive(file): 0 kB Unevictable: 0 kB Mlocked: 0 kB HighTotal: 0 kB HighFree: 0 kB LowTotal: 124744 kB LowFree: 107504 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 432 kB Mapped: 1364 kB Shmem: 9624 kB KReclaimable: 640 kB Slab: 4032 kB SReclaimable: 640 kB SUnreclaim: 3392 kB KernelStack: 240 kB PageTables: 92 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 62372 kB Committed_AS: 11004 kB VmallocTotal: 1040376 kB VmallocUsed: 292 kB VmallocChunk: 0 kB Percpu: 32 kB
# cat /proc/devices Character devices: 1 mem 4 ttyS 5 /dev/tty 5 /dev/console 5 /dev/ptmx 10 misc 89 i2c 90 mtd 128 ptm 136 pts 153 spi 180 usb 188 ttyUSB 189 usb_device 252 rpmb 253 watchdog 254 gpiochip Block devices: 8 sd 31 mtdblock 65 sd 66 sd 67 sd 68 sd 69 sd 70 sd 71 sd 128 sd 129 sd 130 sd 131 sd 132 sd 133 sd 134 sd 135 sd 179 mmc 259 blkext
# ls /sys/devices/platform/ Fixed MDIO bus.0 bcma_sflash.0 serial8250 uevent bcm47xx-wdt.0 regulatory.0 serial8250.0
# cat /sys/class/mtd/mtd*/offset 0 262144 28 284 1772544 10747904 16711680
# ls /sys/class/net/ eth0 lo wwan0 wwan1
# swconfig dev switch0 show
Global attributes:
enable_vlan: 1
ports: 0x003f
Port 0:
pvid: 0
link: port:0 link:down
Port 1:
pvid: 0
link: port:1 link:down
Port 2:
pvid: 0
link: port:2 link:down
Port 3:
pvid: 0
link: port:3 link:down
Port 4:
pvid: 0
link: port:4 link:down
Port 5:
pvid: 0
link: port:5 link:up speed:100baseT full-duplex
# cat /sys/kernel/debug/gpio gpiochip0: GPIOs 0-31, parent: no-bus/bcm47xx_soc, bcma_gpio:
# cat /proc/mtd dev: size erasesize name mtd0: 00040000 00010000 "boot" mtd1: 00a00000 00010000 "firmware" mtd2: 00000100 00000100 "loader" mtd3: 001b0ae4 00010000 "linux" mtd4: 0084f400 00010000 "rootfs" mtd5: 005b0000 00010000 "failsafe" mtd6: 00010000 00010000 "nvram"
# ifconfig -a
br-lan Link encap:Ethernet HWaddr F8:01:13:C2:19:73
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth0 Link encap:Ethernet HWaddr F8:01:13:C2:19:73
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:337 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:113504 (110.8 KiB)
Interrupt:4
eth0.1 Link encap:Ethernet HWaddr F8:01:13:C2:19:73
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth0.2 Link encap:Ethernet HWaddr F8:01:13:C2:19:73
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:250 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:85500 (83.4 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:148 errors:0 dropped:0 overruns:0 frame:0
TX packets:148 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:10944 (10.6 KiB) TX bytes:10944 (10.6 KiB)
wwan0 Link encap:Ethernet HWaddr AA:5E:4B:BF:47:B0
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
wwan1 Link encap:Ethernet HWaddr 0E:FB:02:B2:36:31
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
CFE version 5.60.120.9 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Tue Mar 20 05:49:24 HKT 2012 (wzq@cpe)
Copyright (C) 2000-2008 Broadcom Corporation.
Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Sflash type : 0x100 ; Sflash devid : 0x17 ; Sflash manuid : 0x1
Found a 16MB SPANSION serial flash
pca9555 init data 0x00
Found pca9555
pca9555 0x02 hw_verion 0x01
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.120.9
CPU type 0x19749: 500MHz
Tot mem: 131072 KBytes
CFE mem: 0x80700000 — 0x8079CA90 (641680)
Data: 0x80732950 — 0x80735AB0 (12640)
BSS: 0x80735AB0 — 0x80736A90 (4064)
Heap: 0x80736A90 — 0x8079AA90 (409600)
Stack: 0x8079AA90 — 0x8079CA90 (8192)
Text: 0x80700000 — 0x80732950 (207184)
Device eth0: hwaddr 00-10-20-30-40-50, ipaddr 192.168.1.1, mask 255.255.255.0
gateway not set, nameserver not set
gpio 26 value 0x1
gpio 25 value 0x1
cur_part is 0
product_name : B593-U12
plt_version : V100R003C03B008
sw_version : OpenWrt
hw_version : Ver.B
modem_version : 11.533.03.03.748
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
boot_part now 0
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: …….. 4984596 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
[ 0.000000] Linux version 5.4.72 (username@computername) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r14749-472a06f707)) #0 Sat Oct 24 14:28:38 2020
[ 0.000000] CPU0 revision is: 00019749 (MIPS 74Kc)
[ 0.000000] bcm47xx: Using bcma bus
[ 0.000000] (NULL device *): bus0: Found chip with id 0x5357, rev 0x02 and package 0x09
[ 0.000000] Initrd not found or empty — disabling initrd
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] This processor doesn’t support highmem. -131068k highmem ignored
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffefff]
[ 0.000000] HighMem empty
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffefff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffefff]
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32479
[ 0.000000] Kernel command line: noinitrd console=ttyS0,115200
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 124540K/131068K available (3830K kernel code, 164K rwdata, 724K rodata, 200K init, 286K bss, 6528K reserved, 0K cma-reserved, 0K highmem)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 128
[ 0.000000] bcm47xx_soc: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x26, class 0x0)
[ 0.000000] bcm47xx_soc: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x1C, class 0x0)
[ 0.000000] bcm47xx_soc: bus0: Core 2 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x03, class 0x0)
[ 0.000000] bcm47xx_soc: bus0: Core 3 found: MIPS 74K (manuf 0x4A7, id 0x82C, rev 0x04, class 0x0)
[ 0.000000] bcm47xx_soc: bus0: Core 4 found: USB 2.0 Host (manuf 0x4BF, id 0x819, rev 0x05, class 0x0)
[ 0.000000] bcm47xx_soc: bus0: Core 5 found: DDR1/DDR2 Memory Controller (manuf 0x4BF, id 0x82E, rev 0x02, class 0x0)
[ 0.000000] bcm47xx_soc: bus0: Core 6 found: I2S (manuf 0x4BF, id 0x834, rev 0x02, class 0x0)
[ 0.000000] bcm47xx_soc: bus0: Core 7 found: Internal Memory (manuf 0x4BF, id 0x80E, rev 0x0B, class 0x0)
[ 0.000000] bcm47xx_soc: bus0: Found M25FL128 serial flash (size: 16384KiB, blocksize: 0x10000, blocks: 256)
[ 0.000000] bcm47xx_soc: bus0: Early bus registered
[ 0.000000] MIPS: machine is Huawei B593u-12
[ 0.000000] bcm47xx: Setting up vectored interrupts
[ 0.000000] random: get_random_bytes called from start_kernel+0x330/0x51c with crng_init=0
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041786 ns
[ 0.000014] sched_clock: 32 bits at 250MHz, resolution 4ns, wraps every 8589934590ns
[ 0.000087] Calibrating delay loop… 249.34 BogoMIPS (lpj=498688)
[ 0.032082] pid_max: default: 32768 minimum: 301
[ 0.032370] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.032405] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.037066] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.037114] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.038277] NET: Registered protocol family 16
[ 0.074461] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[ 0.078996] clocksource: Switched to clocksource MIPS
[ 0.081365] NET: Registered protocol family 2
[ 0.082681] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.082764] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.082805] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.082838] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.083158] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.083217] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.083716] NET: Registered protocol family 1
[ 0.083814] PCI: CLS 0 bytes, default 32
[ 0.113682] can not parse nvram name sb/1/ag2(null) with value 0xff got -34
[ 0.113858] can not parse nvram name sb/1/ag3(null) with value 0xff got -34
[ 0.119457] can not parse nvram name sb/1/rxpo2g(null) with value 0xff got -34
[ 0.146516] bcm47xx_soc: bus0: Bus registered
[ 0.153072] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 0.165476] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.165505] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.197548] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
[ 0.198467] printk: console [ttyS0] disabled
[ 0.218747] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2, base_baud = 1250000) is a U6_16550A
[ 0.692100] printk: console [ttyS0] enabled
[ 0.831716] 4 bcm47xxpart partitions found on MTD device bcm47xxsflash
[ 0.838406] Creating 4 MTD partitions on «bcm47xxsflash»:
[ 0.843977] 0x000000000000-0x000000040000 : «boot»
[ 0.855113] 0x000000040000-0x000000a40000 : «firmware»
[ 0.861951] 3 trx partitions found on MTD device firmware
[ 0.867547] Creating 3 MTD partitions on «firmware»:
[ 0.872664] 0x00000000001c-0x00000000011c : «loader»
[ 0.882577] 0x00000000011c-0x0000001b0c00 : «linux»
[ 0.890205] 0x0000001b0c00-0x000000a00000 : «rootfs»
[ 0.896882] mtd: device 4 (rootfs) set to be root filesystem
[ 0.905644] 0x000000a40000-0x000000ff0000 : «failsafe»
[ 0.913564] 0x000000ff0000-0x000001000000 : «nvram»
[ 0.926092] libphy: Fixed MDIO Bus: probed
[ 0.930581] bgmac_bcma bcma0:2: Found PHY addr: 30 (NOREGS)
[ 0.947773] b53_common: found switch: BCM5325, rev 4
[ 0.953046] libphy: bcma_mdio mii bus: probed
[ 0.957565] bgmac_bcma bcma0:2: Support for Roboswitch not implemented
[ 0.965902] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded
[ 0.972164] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds)
[ 0.980759] NET: Registered protocol family 17
[ 0.985543] 8021q: 802.1Q VLAN Support v1.8
[ 1.002241] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[ 1.010928] Freeing unused kernel memory: 200K
[ 1.015542] This architecture does not have kernel memory protection.
[ 1.022136] Run /sbin/init as init process
[ 1.291022] random: fast init done
[ 2.170162] init: Console is alive
[ 2.174206] init: — watchdog —
[ 4.227587] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 4.430824] usbcore: registered new interface driver usbfs
[ 4.436664] usbcore: registered new interface driver hub
[ 4.442354] usbcore: registered new device driver usb
[ 4.504472] ehci_hcd: USB 2.0 ‘Enhanced’ Host Controller (EHCI) Driver
[ 4.524723] SCSI subsystem initialized
[ 4.538008] ehci-fsl: Freescale EHCI Host controller driver
[ 4.546346] ehci-platform: EHCI generic platform driver
[ 4.551933] ehci-platform ehci-platform.0: EHCI Host Controller
[ 4.558108] ehci-platform ehci-platform.0: new USB bus registered, assigned bus number 1
[ 4.566580] ehci-platform ehci-platform.0: irq 5, io mem 0x18004000
[ 4.587055] ehci-platform ehci-platform.0: USB 2.0 started, EHCI 1.00
[ 4.595271] hub 1-0:1.0: USB hub found
[ 4.599918] hub 1-0:1.0: 2 ports detected
[ 4.613144] ohci_hcd: USB 1.1 ‘Open’ Host Controller (OHCI) Driver
[ 4.621648] ohci-platform: OHCI generic platform driver
[ 4.627226] ohci-platform ohci-platform.0: Generic Platform OHCI controller
[ 4.634447] ohci-platform ohci-platform.0: new USB bus registered, assigned bus number 2
[ 4.642910] ohci-platform ohci-platform.0: irq 5, io mem 0x18009000
[ 4.712791] hub 2-0:1.0: USB hub found
[ 4.717424] hub 2-0:1.0: 2 ports detected
[ 4.733703] usbcore: registered new interface driver usb-storage
[ 4.744312] usbcore: registered new interface driver uas
[ 4.750649] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 4.768757] init: — preinit —
[ 5.060027] usb 1-1: new high-speed USB device number 2 using ehci-platform
[ 5.582684] hub 1-1:1.0: USB hub found
[ 5.641180] hub 1-1:1.0: 4 ports detected
[ 5.663442] random: procd: uninitialized urandom read (4 bytes read)
[ 5.995127] usb 1-1.1: new high-speed USB device number 3 using ehci-platform
[ 6.365222] usb 1-1.4: new high-speed USB device number 4 using ehci-platform
[ 6.578914] usb-storage 1-1.4:1.0: USB Mass Storage device detected
[ 6.595455] scsi host0: usb-storage 1-1.4:1.0
[ 6.795331] random: jshn: uninitialized urandom read (4 bytes read)
[ 6.938910] random: jshn: uninitialized urandom read (4 bytes read)
[ 7.051589] random: jshn: uninitialized urandom read (4 bytes read)
[ 7.155499] b53_common: Failed to enable switch!
Failed to set attribute: Invalid input data or parameter
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 7.620288] scsi 0:0:0:0: Direct-Access usb-disc 0002 PQ: 0 ANSI: 0
[ 7.633569] sd 0:0:0:0: [sda] 512000 512-byte logical blocks: (262 MB/250 MiB)
[ 7.641907] sd 0:0:0:0: [sda] Write Protect is off
[ 7.647914] sd 0:0:0:0: [sda] Write cache: disabled, read cache: enabled, doesn’t support DPO or FUA
[ 7.774054] sd 0:0:0:0: [sda] Attached SCSI removable disk
[ 11.807605] mount_root: Could not open mtd device: /dev/mtd4
[ 11.813690] mount_root: reading rootfs failed
[ 11.818445] mount_root: mounting /dev/root
[ 11.826624] urandom-seed: Seed file not found (/etc/urandom.seed)
[ 11.981064] procd: — early —
[ 11.984328] procd: — watchdog —
[ 12.664260] procd: — watchdog —
[ 12.668274] procd: — ubus —
[ 12.741527] random: ubusd: uninitialized urandom read (4 bytes read)
[ 12.748974] random: ubusd: uninitialized urandom read (4 bytes read)
[ 12.756328] random: ubusd: uninitialized urandom read (4 bytes read)
[ 12.765375] procd: — init —
Please press Enter to activate this console.
[ 14.335993] urngd: v1.0.2 started.
[ 14.667827] random: crng init done
[ 14.671374] random: 3 urandom warning(s) missed due to ratelimiting
[ 14.743932] kmodloader: loading kernel modules from /etc/modules.d/*
[ 14.783368] i2c /dev entries driver
[ 14.821757] Loading modules backported from Linux version v5.8-0-gbcf876870b95
[ 14.829202] Backport generated by backports.git v5.8-1-0-g79400d9e
[ 14.907843] xt_time: kernel timezone is -0000
[ 15.207404] b43-phy0: Broadcom 5357 WLAN found (core revision 28)
[ 15.219116] b43-phy0: Found PHY: Analog 9, Type 4 (N), Revision 9
[ 15.225398] b43-phy0 ERROR: FOUND UNSUPPORTED RADIO (Manuf 0x17F, ID 0x2057, Revision 5, Version 2)
[ 15.234704] b43: probe of bcma0:1 failed with error -122
[ 15.240404] Broadcom 43xx driver loaded [ Features: NL ]
[ 15.278025] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 18.298994] Timeout waiting for flash to be ready!
[ 20.504624] usb 1-1.1: USB disconnect, device number 3
[ 25.791123] usb 1-1.1: new high-speed USB device number 5 using ehci-platform
[ 25.922841] usb-storage 1-1.1:1.0: USB Mass Storage device detected
[ 25.967639] scsi host1: usb-storage 1-1.1:1.0
[ 26.981088] scsi 1:0:0:0: CD-ROM HUAWEI Mass Storage 2.31 PQ: 0 ANSI: 0
BusyBox v1.31.1 () built-in shell (ash)
_______ ________ __
| |.——.——.——.| | | |.—-.| |_
| — || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
——————————————————
OpenWrt SNAPSHOT, r14749-472a06f707
——————————————————
=== WARNING! =====================================
There is no root password defined on this device!
Use the «passwd» command to set up a new password
in order to prevent unauthorized SSH logins.
—————————————————
root@(none):/#
If you end up corrupting your flash and your router cannot boot (e.g. with the error “Invalid boot block on disk”), then the router will expose the “Broadcom — CFE miniWeb Server” on http://192.168.1.1, in which you can upload B593.trx from the factory firmware file, e.g. V100R001C748SP107.tar.bz2.
You can also access the miniWeb Server in the recovery mode, see above on how to enable that.
The router also saves a rescue image (from firmware file B593-small.trx) on flash. The easiest way of returning this and other parts of flash to the original state is flashing the bz2 file from the vendor trough the factory image. To do so, restore B593.trx as described above, log in via TTL or Telnet, connect a USB drive with the factory firmare, e.g. V100R001C748SP107.tar.bz2, and then run upg -f V100R001C748SP107.tar.bz2.
Be very carefull when flashing through CFE, as it is possible to overwrite the boot partition, bricking your router. Is seems that it is also possible overwrite Ethernet or Wifi firmwares, thus making the router loose all connecting in factory firmware. Unfortunately, the command “show devices” is not availble. The following partitions are confirmed to exist: flash0, flash0.boot, flash0.trx, flash0.trx1, flash0.os, flash0.os1, flash0.nvram, flash1.boot, flash1.para, flash1.trx, flash1.trx1, flash1.nvram.
If you router says “System abnormity. Please recover it.”, and after pressing “recover” you don’t get back to a working state, than this means that you broke the recovery TRX files. You can upload a working “B593.trx” image using the “Huawei B593 multicast upgrade software”, using a fixed IP of 192.168.1.5 on your computer. It seem that you cannot flash OpenWRT images from “Huawei B593 multicast upgrade software”, you need to flash an original image first, and then upgrade from the web interface.
These are the patches I apply to build an image. Please note however that OpenWrt does not manage to write to the flash after boot.
Patch 1: Add router to Makefiles incl. image format
--- a/target/linux/bcm47xx/image/Makefile +++ b/target/linux/bcm47xx/image/Makefile @@ -89,6 +89,16 @@ mv $@.new $@ endef +define Build/huawei-b593u12-trx + $(STAGING_DIR_HOST)/bin/trx \ + -m 33554432 \ + -o $@.new \ + -x 0x0100 \ + -f $(IMAGE_KERNEL) \ + $(call trxalign/$(FILESYSTEM),$@) + mv $@.new $@ +endef + define Build/huawei-bin dd if=/dev/zero of=$@.new bs=92 count=1 echo -ne 'HDR0\x08\x00\x00\x00' >> $@.new --- a/target/linux/bcm47xx/image/mips74k.mk +++ b/target/linux/bcm47xx/image/mips74k.mk @@ -150,6 +150,16 @@ endef TARGET_DEVICES += asus_rt-n66w +define Device/huawei_b593u12 + DEVICE_VENDOR := Huawei + DEVICE_MODEL := B593u-12 + DEVICE_PACKAGES := kmod-b43 kmod-bgmac kmod-switch-bcm53xx kmod-switch-bcm53xx-mdio $(USB2_PACKAGES) kmod-usb-storage kmod-usb-storage-uas kmod-fs-ext4 kmod-usb-net-huawei-cdc-ncm kmod-usb-net-cdc-mbim kmod-usb-net-qmi-wwan kmod-usb-serial-option kmod-usb-serial-pl2303 + KERNEL_NAME = vmlinux-nodictionary.lzma + IMAGES := trx + IMAGE/trx := append-rootfs | huawei-b593u12-trx +endef +TARGET_DEVICES += huawei_b593u12 + define Device/linksys_wrt160n-v3 DEVICE_MODEL := WRT160N DEVICE_VARIANT := v3
Patch 2: Add support for board, buttons and LEDs. Name the file 832-huawei-b593u12_support.patch and put it in the patches folder, e.g. openwrt/target/linux/bcm47xx/patches-5.10
--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
@@ -53,6 +53,7 @@
BCM47XX_BOARD_DLINK_DIR130,
BCM47XX_BOARD_DLINK_DIR330,
+ BCM47XX_BOARD_HUAWEI_B593U12,
BCM47XX_BOARD_HUAWEI_E970,
BCM47XX_BOARD_LINKSYS_E900V1,
--- a/arch/mips/bcm47xx/board.c
+++ b/arch/mips/bcm47xx/board.c
@@ -192,6 +192,7 @@
/* boardtype, boardnum, boardrev */
static const
struct bcm47xx_board_type_list3 bcm47xx_board_list_board[] __initconst = {
+ {{BCM47XX_BOARD_HUAWEI_B593U12, "Huawei B593u-12"}, "0x053d", "1234", "0x1301"},
{{BCM47XX_BOARD_HUAWEI_E970, "Huawei E970"}, "0x048e", "0x5347", "0x11"},
{{BCM47XX_BOARD_PHICOMM_M1, "Phicomm M1"}, "0x0590", "80", "0x1104"},
{{BCM47XX_BOARD_ZTE_H218N, "ZTE H218N"}, "0x053d", "1234", "0x1305"},
--- a/arch/mips/bcm47xx/buttons.c
+++ b/arch/mips/bcm47xx/buttons.c
@@ -124,6 +124,13 @@
/* Huawei */
static const struct gpio_keys_button
+bcm47xx_buttons_huawei_b593u12[] __initconst = {
+ BCM47XX_GPIO_KEY(25, KEY_WPS_BUTTON),
+ BCM47XX_GPIO_KEY(26, KEY_RESTART),
+ BCM47XX_GPIO_KEY(27, BTN_0), /* Router / AP mode swtich */
+};
+
+static const struct gpio_keys_button
bcm47xx_buttons_huawei_e970[] __initconst = {
BCM47XX_GPIO_KEY(6, KEY_RESTART),
};
--- a/arch/mips/bcm47xx/leds.c
+++ b/arch/mips/bcm47xx/leds.c
@@ -223,6 +223,11 @@
/* Huawei */
static const struct gpio_led
+bcm47xx_leds_huawei_b593u12[] __initconst = {
+ BCM47XX_GPIO_LED(5, "blue", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
+};
+
+static const struct gpio_led
bcm47xx_leds_huawei_e970[] __initconst = {
BCM47XX_GPIO_LED(0, "unk", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
};
We have shared the official Huawei B593S-22 Stock ROM Firmware (Flash File) on this page. The Stock ROM comes in a zip package and contains USB Driver, Firmware, Flash Tool, and How-to Flash Manual.
Huawei B593S-22 Firmware (Flash File)
Huawei Stock ROM helps you upgrade or downgrade your Huawei device’s OS. It also allows you to fix the device if it has software-related issues, Bootloop, and IMEI-related issues.
File Name: Huawei_B593S-22_TCPU-V200R001B270D25SP03C182_05012TYT_MIRA.zip
File Size: 39 MB
Country: All
How to Flash (install): Use Miracle Box Software to Flash this firmware.
Get Link
How to flash or install Stock ROM
- Download and extract the Stock ROM package on the computer using the WinRar or Winzip Tool.
- After extracting the package, you will get the USB Driver, Firmware, Flash Tool, and How-to Flash Manual.
- Install the provided USB Driver on the computer.
- Download and install Miracle Box Tool.
- Open the Miracle Box Tool on the computer and Load the bin firmware.
- Connect your device to the computer.
- Click on the Start or Flash button to begin the flashing process.
Readme Once:
[*] Huawei Driver: If you are looking for the Official Driver for your Huawei device, then head over to the Huawei USB Driver Page.
[*] Backup: If you are going to flash the above firmware on your Huawei Device, then we recommend taking a backup of your data from the device, as flashing the ROM (firmware) will wipe the data from the device.
[*] Credits: The above firmware is officially released by Huawei Mobility LLC. We have scanned the firmware using the Malwarebytes Premium before sharing it online.