Well, that was easy

I think ethernet switch and wireless aren't supported by opensource drivers so even with OpenWrt booting on Huawei B593u-12 it's not much use. USB connected LTE module is not detected, my guess is that some GPIO needs to be toggled to enable it. PCA9555 GPIO expander would need some work too. Also 256MB NAND-flash is missing, only 16MB SPI flash is found.


CFE version 5.60.120.9  based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Tue Mar 20 05:49:24 HKT 2012 (wzq@cpe)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
Sflash type : 0x100 ; Sflash devid : 0x17 ; Sflash manuid : 0x1
Found a 16MB SPANSION serial flash
pca9555 init data 0x00
Found pca9555
pca9555 0x02 hw_verion 0x01
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.60.120.9 
CPU type 0x19749: 500MHz
Tot mem: 131072 KBytes

CFE mem:    0x80700000 - 0x8079CA90 (641680)
Data:       0x80732950 - 0x80735AB0 (12640)
BSS:        0x80735AB0 - 0x80736A90 (4064)
Heap:       0x80736A90 - 0x8079AA90 (409600)
Stack:      0x8079AA90 - 0x8079CA90 (8192)
Text:       0x80700000 - 0x80732950 (207184)

Device eth0:  hwaddr E8-CD-2D-72-15-CF, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
gpio 26 value 0x1
gpio 25 value 0x1
cur_part is 0
product_name : B593-U12
plt_version : V100R003C03B008
sw_version : V100R001C00SP999
hw_version : Ver.B
modem_version : 11.999.00.00.00
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
boot_part now 0
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3712 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
[    0.000000] Linux version 3.14.16 (bobbuilder@openb593) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r42110) ) #3 Tue Aug 12 01:25:33 EEST 2014
[    0.000000] CPU0 revision is: 00019749 (MIPS 74Kc)
[    0.000000] bcm47xx: using bcma bus
[    0.000000] bcma: bus0: Found chip with id 0x5357, rev 0x02 and package 0x09
[    0.000000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x26, class 0x0)
[    0.000000] bcma: bus0: Core 3 found: MIPS 74K (manuf 0x4A7, id 0x82C, rev 0x04, class 0x0)
[    0.000000] bcma: bus0: Found M25FL128 serial flash (size: 16384KiB, blocksize: 0x10000, blocks: 256)
[    0.000000] bcma: bus0: Early bus registered
[    0.000000] MIPS: machine is Unknown Board
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 07fff000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07ffefff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffefff]
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32511
[    0.000000] Kernel command line:  noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 126468K/131068K available (2393K kernel code, 108K rwdata, 476K rodata, 144K init, 248K bss, 4600K reserved, 0K highmem)
[    0.000000] NR_IRQS:128
[    0.000000] Setting up vectored interrupts
[    0.060000] Calibrating delay loop... 249.44 BogoMIPS (lpj=1247232)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.070000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.070000] NET: Registered protocol family 16
[    0.090000] bio: create slab <bio-0> at 0
[    0.090000] Switched to clocksource MIPS
[    0.100000] NET: Registered protocol family 2
[    0.100000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.100000] TCP: reno registered
[    0.100000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.100000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.100000] NET: Registered protocol family 1
[    0.100000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x1C, class 0x0)
[    0.100000] bcma: bus0: Core 2 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x03, class 0x0)
[    0.100000] bcma: bus0: Core 4 found: USB 2.0 Host (manuf 0x4BF, id 0x819, rev 0x05, class 0x0)
[    0.100000] bcma: bus0: Core 5 found: DDR1/DDR2 Memory Controller (manuf 0x4BF, id 0x82E, rev 0x02, class 0x0)
[    0.100000] bcma: bus0: Core 6 found: I2S (manuf 0x4BF, id 0x834, rev 0x02, class 0x0)
[    0.100000] bcma: bus0: Core 7 found: Internal Memory (manuf 0x4BF, id 0x80E, rev 0x0B, class 0x0)
[    0.110000] can not parse nvram name sb/1/rxpo2g(null) with value 0xff got -34
[    0.110000] can not parse nvram name sb/1/ag2(null) with value 0xff got -34
[    0.110000] can not parse nvram name sb/1/ag3(null) with value 0xff got -34
[    0.160000] bcma: bus0: Bus registered
[    0.160000] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.160000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.170000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.170000] msgmni has been set to 247
[    0.170000] io scheduler noop registered
[    0.170000] io scheduler deadline registered (default)
[    0.170000] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
[    0.190000] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2, base_baud = 1250000) is a U6_16550A
[    0.580000] console [ttyS0] enabled
[    0.720000] 9 bcm47xxpart partitions found on MTD device bcm47xxsflash
[    0.720000] Creating 9 MTD partitions on "bcm47xxsflash":
[    0.730000] 0x000000000000-0x000000040000 : "boot"
[    0.740000] 0x000000040000-0x00000004001c : "firmware"
[    0.740000] 0x00000004001c-0x0000000409e0 : "loader"
[    0.750000] 0x0000000409e0-0x00000014c800 : "linux"
[    0.760000] mtd: partition "linux" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.770000] 0x00000014c800-0x000000a40000 : "rootfs"
[    0.780000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.790000] mtd: device 4 (rootfs) set to be root filesystem
[    0.800000] mtd: partition "rootfs_data" created automatically, ofs=0x490000, len=0x5b0000
[    0.810000] 0x000000490000-0x000000a40000 : "rootfs_data"
[    0.820000] 0x000000a40000-0x000000ff0000 : "firmware"
[    0.820000] 0x000000a4011c-0x000000ba14e8 : "linux"
[    0.830000] mtd: partition "linux" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.840000] 0x000000ba14e8-0x000000ff0000 : "rootfs"
[    0.850000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only

[    0.870000] 0x000000ff0000-0x000001000000 : "nvram"
[    0.880000] bgmac bcma0:1: Found PHY addr: 30 (NOREGS)
[    0.890000] bgmac bcma0:1: Support for Roboswitch not implemented
[    0.900000] libphy: bgmac mii bus: probed
[    0.980000] b53_common: found switch: BCM5325, rev 4
[    0.990000] bgmac: Broadcom 47xx GBit MAC driver loaded
[    1.000000] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds)
[    1.010000] TCP: cubic registered
[    1.010000] NET: Registered protocol family 17
[    1.020000] 8021q: 802.1Q VLAN Support v1.8
[    1.030000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    1.040000] Freeing unused kernel memory: 144K (802ec000 - 80310000)
procd: Console is alive
procd: - watchdog -
[    5.170000] usbcore: registered new interface driver usbfs
[    5.180000] usbcore: registered new interface driver hub
[    5.180000] usbcore: registered new device driver usb
[    5.200000] SCSI subsystem initialized
[    5.220000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    5.230000] ehci-platform: EHCI generic platform driver
[    5.230000] ehci-platform ehci-platform.0: EHCI Host Controller
[    5.240000] ehci-platform ehci-platform.0: new USB bus registered, assigned bus number 1
[    5.250000] ehci-platform ehci-platform.0: irq 5, io mem 0x18004000
[    5.270000] ehci-platform ehci-platform.0: USB 2.0 started, EHCI 1.00
[    5.270000] hub 1-0:1.0: USB hub found
[    5.280000] hub 1-0:1.0: 2 ports detected
procd: - preinit -
[    5.870000] usb 1-1: new high-speed USB device number 2 using ehci-platform
[    5.920000] random: mktemp urandom read with 59 bits of entropy available
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.020000] hub 1-1:1.0: USB hub found
[    6.020000] hub 1-1:1.0: 4 ports detected
[    6.310000] usb 1-1.1: new high-speed USB device number 3 using ehci-platform
f
- failsafe -


BusyBox v1.22.1 (2014-08-10 22:19:11 EEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

ash: can't access tty; job control turned off
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 CHAOS CALMER (Bleeding Edge, r42110)
 -----------------------------------------------------
  * 1 1/2 oz Gin            Shake with a glassful
  * 1/4 oz Triple Sec       of broken ice and pour
  * 3/4 oz Lime Juice       unstrained into a goblet.
  * 1 1/2 oz Orange Juice
  * 1 tsp. Grenadine Syrup
 -----------------------------------------------------
root@(none):/# 
root@(none):/# uname -a
Linux (none) 3.14.16 #3 Tue Aug 12 01:25:33 EEST 2014 mips GNU/Linux
root@(none):/# cat /proroot@(none):/# cat /proc/cpuiroot@(none):/# cat /proc/cpuinfo 
system type             : Broadcom BCM5357
machine                 : Unknown Board

processor               : 0
cpu model               : MIPS 74Kc V4.9
BogoMIPS                : 249.44
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp dsp2
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

root@(none):/# cat /proroot@(none):/# cat /proc/mtroot@(none):/# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00010000 "boot"
mtd1: 0000001c 0000001c "firmware"
mtd2: 000009c4 000009c4 "loader"
mtd3: 0010be20 00010000 "linux"
mtd4: 008f3800 00010000 "rootfs"
mtd5: 005b0000 00010000 "rootfs_data"
mtd6: 005b0000 00010000 "firmware"
mtd7: 001613cc 00010000 "linux"
mtd8: 0044eb18 00010000 "rootfs"
mtd9: 00010000 00010000 "nvram"
root@(none):/# free
             total         used         free       shared      buffers
Mem:        126612        12928       113684            0         1900
-/+ buffers:              11028       115584
Swap:            0            0            0
root@(none):/# modprobe b43
[   26.940000] Loading modules backported from Linux version master-2014-05-22-0-gf2032ea
[   26.940000] Backport generated by backports.git backports-20140320-37-g5c33da0
[   26.970000] cfg80211: Calling CRDA to update world regulatory domain
[   26.990000] cfg80211: World regulatory domain updated:
[   26.990000] cfg80211:  DFS Master region: unset
[   26.990000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   27.000000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   27.010000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   27.020000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   27.030000] cfg80211:   (5170000 KHz - 5250000 KHz @ 160000 KHz), (N/A, 2000 mBm), (N/A)
[   27.040000] cfg80211:   (5250000 KHz - 5330000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   27.050000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   27.050000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   27.060000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   27.120000] b43-phy0: Broadcom 5357 WLAN found (core revision 28)
[   27.130000] b43-phy0: Found PHY: Analog 9, Type 4 (N), Revision 9
[   27.130000] b43-phy0 ERROR: FOUND UNSUPPORTED RADIO (Manuf 0x17F, ID 0x2057, Revision 5, Version 2)
[   27.140000] b43: probe of bcma0:0 failed with error -122
[   27.150000] Broadcom 43xx driver loaded [ Features: NL ]

root@(none):/# 

Comments

  1. Hi, I own an old Huawei B593u-12, and I managed to gain Telnet access using FMK as you described. It seems to me that in the mean time OpenWRT might support the switch and wireless (BCM4347), so it would be intersting to give it another shot. Do you have any instructions on how to compile OpenWRT for this router, and how to upload it?

    ReplyDelete
    Replies
    1. Hi, I can now also boot OpenWrt, with similar results as you. I documented everything here: https://openwrt.org/toh/huawei/b593u-12

      Delete

Post a Comment

Got something to say?!