Huawei B593u-12

The Huawei B593u-12 is a router with an integrated LTE modem. It is also sold as branded versions by telco providers, e.g. as Telekom Speedport LTE II and as Vodafone B2000.

Supported since 84576368689cef5491a34eb76ae2a1dfd2a0a3ba

LTE, NAND and USB are working. NAND gets detected as a “USB Mass Storage device”, and from factory it is formatted ext3.

You can flash the router through CPE or through the web page from the factory image. However, when OpenWrt boots it does not manage to write to the flash.

LAN and switch were working with target profile brcmsmac in Kernel 4.9. With Kernel 4.14 and subsequent versions, a bug prevents the switch from coming up. The last commit before removal of Kernel 4.9 support in brcm47xx is b7dd438f66253cc49fa8b0b3434d5ef50fffbb7c.

WLAN is not working due to missing drivers.

Using the script on add.new.device only manages to bring up one LED.

The flash layout from the factory firmware is:

From the factory image, “B593.trx” gets flashed into mtd2: roots. The rescue image “B593-small.trx” gets flashed into the Subject image. Current and Factory Config store the configuration as plain text XML (with the initial 4 Bytes being the length of the configuration). The remaining partitions (except mtd0: nvram) are mostly filled with “FF”, so it is unclear if they are empty, or if the dump didn't succeed.

The flash layout that OpenWrt recognizes is:

Please note that OEM image uses blocksize of 256KiB (0x40000), and standard OpenWRT uses blocksize of 64KB (0x10000). I also tested a blocksize of 4KB (0x1000), as some routers use this. But neither of the 3 blocksizes solved the problem of writing to flash with OpenWRT. Using a block size of 4k produces the least number of error messages in the log -- so this might be the right one.

An additional 256 Bytes header after the TRX header is used in the factory firmware, and data shows up in CFE before boot. Neither the website nor CFE check for the validity of the additional header, so it is safe to just add 256 Bytes padding between the standard TRX header and the actual data. The “Huawei B593 multicast upgrade software” does check the header, so you can only flash proper firmwares with it.

  0                   1                   2                   3   
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 
 +================ 28 Bytes standard TRX v1 header ==============+
 |                  4 Bytes magic number ('HDR0')                |
 +---------------------------------------------------------------+
 |               4 Bytes length (header size + data)             |
 +---------------------------------------------------------------+
 |                   4 Bytes (32-bit) CRC value                  |
 +-------------------------------+-------------------------------+
 |      2 Bytes TRX flags        |      2 Bytes TRX version      |
 +-------------------------------+-------------------------------+
 |            4 Bytes partition offset[0] = lzma-loader          |
 +---------------------------------------------------------------+
 |            4 Bytes partition offset[1] = Linux Kernel         |
 +---------------------------------------------------------------+
 |            4 Bytes partition offset[2] = rootfs               |
 +=================== 256 Bytes CFE Header ======================+
 |                16 Bytes CFE "product_name"                    |
 |            (in factory firmware this is 'B593-U12')           |
 +---------------------------------------------------------------+
 |                 32 Bytes CFE "plt_version"                    |
 |        (in factory firmware this is 'V100R003C03B008')        |
 +---------------------------------------------------------------+
 |                  32 Bytes CFE "sw_version"                    |
 |       (in factory firmware this is 'V100R001C748SP107')       |
 +---------------------------------------------------------------+
 |                  32 Bytes CFE "hw_version"                    |
 |             (in factory firmware this is 'Ver.B')             |
 +---------------------------------------------------------------+
 |                 32 Bytes CFE "modem_version"                  |
 |        (in factory firmware this is '11.533.03.03.748')       |
 +---------------------------------------------------------------+
 |                      112 Bytes padding                        |
 +---------------------------------------------------------------+

This is the output for firmware V100R001C748SP107 from Telekom.

# cat /proc/version

Linux version 2.6.21.5 (LTECPE@lmt) (gcc version 4.2.3) #1 Wed Oct 22 22:46:57 CST 2014

# cat /proc/cpuinfo

system type             : CHIP95358
processor               : 0
cpu model               : MIPS 74K V4.9
BogoMIPS                : 248.32
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : no
hardware watchpoint     : yes
ASEs implemented        : mips16 dsp
VCED exceptions         : not available
VCEI exceptions         : not available

unaligned exceptions            : 23878

# cat /proc/cmdline

root=31:2 ro noinitrd console=ttyS0,115200

# cat /proc/meminfo

MemTotal:       126080 kB
MemFree:         96804 kB
Buffers:          2976 kB
Cached:          12800 kB
SwapCached:          0 kB
Active:           6564 kB
Inactive:        12460 kB
SwapTotal:           0 kB
SwapFree:            0 kB
Dirty:              20 kB
Writeback:           0 kB
AnonPages:        3272 kB
Mapped:           2500 kB
Slab:             4112 kB
SReclaimable:      892 kB
SUnreclaim:       3220 kB
PageTables:        436 kB
NFS_Unstable:        0 kB
Bounce:              0 kB
CommitLimit:     63040 kB
Committed_AS:     6052 kB
VmallocTotal:  1032148 kB
VmallocUsed:      3448 kB
VmallocChunk:  1027212 kB

# cat /proc/devices

Character devices:
  1 mem
  2 pty
  3 ttyp
  4 ttyS
  5 /dev/tty
  5 /dev/console
 10 misc
 13 input
 21 sg
 89 i2c
 90 mtd
180 usb
188 ttyUSB
189 usb_device
209 endpoint
242 fcache
248 bhal
249 commondrv
250 i2c_pca
251 usb_endpoint
252 usbmon
253 nvram
254 gpio

Block devices:
  8 sd
 31 mtdblock
 65 sd
 66 sd
 67 sd
 68 sd
 69 sd
 70 sd
 71 sd
128 sd
129 sd
130 sd
131 sd
132 sd
133 sd
134 sd
135 sd

# cat /proc/bus/pci/devices
0000    14e40800        8               18000000                       0                       0                       0                       0                       0                       0                    1000                    1000                    0                       0                       0                       0                     800
0008    14e44347        3               18001000                       0                       0                       0                       0                       0                       0                    1000                    1000                    0                       0                       0                       0                     800        wl
0010    14e44715        4               18002000                       0                       0                       0                       0                       0                       0                    1000                    1000                    0                       0                       0                       0                     800        et
0020    14e4471a        5               18009000                       0                       0                       0                       0                       0                       0                    1000                       0                    0                       0                       0                       0                     800        ohci_hcd
0021    14e4471a        5               18004000                       0                       0                       0                       0                       0                       0                    1000                       0                    0                       0                       0                       0                     800        ehci_hcd
0028    14e4082e        d               18005000                       0                       0                       0                       0                       0                       0                    1000                    1000                    0                       0                       0                       0                     800
0030    14e44711        e               18006000                       0                       0                       0                       0                       0                       0                    1000                    1000                    0                       0                       0                       0                     800
0038    14e4080e        8               18007000                       0                       0                       0                       0                       0                       0                    1000                    1000                    0                       0                       0                       0                     800

# cat /proc/interrupts
           CPU0
  3:       4435            MIPS  wl0
  4:          0            MIPS  eth0
  5:       7615            MIPS  ehci_hcd:usb1, ohci_hcd:usb2
  7:      99808            MIPS  timer
  8:       1421            IRQ2  serial
ERR:          0

# ifconfig -a

br0       Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:402 errors:0 dropped:0 overruns:0 frame:0
          TX packets:195 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:39609 (38.6 KiB)  TX bytes:14080 (13.7 KiB)

br1       Link encap:Ethernet  HWaddr 00:00:00:00:00:00
          inet addr:191.255.255.1  Bcast:191.255.255.3  Mask:255.255.255.252
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:90 (90.0 B)

eth0      Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:432 errors:0 dropped:0 overruns:0 frame:0
          TX packets:193 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:55147 (53.8 KiB)  TX bytes:16004 (15.6 KiB)
          Interrupt:4 Base address:0x2000

eth0.1    Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth0.2    Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)


eth0.3    Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)


eth0.4    Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)


eth0.5    Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:432 errors:0 dropped:0 overruns:0 frame:0
          TX packets:193 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:49099 (47.9 KiB)  TX bytes:16776 (16.3 KiB)


hed0      Link encap:Ethernet  HWaddr 00:1E:10:1F:06:03
          inet addr:10.29.113.14  Bcast:10.255.255.255  Mask:255.0.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:23 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2614 (2.5 KiB)  TX bytes:2062 (2.0 KiB)

hed1      Link encap:Ethernet  HWaddr 00:1E:10:1F:06:05
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifb0      Link encap:Ethernet  HWaddr 32:0A:9F:FA:03:D5
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifb1      Link encap:Ethernet  HWaddr D2:68:14:A3:22:D4
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:13 errors:0 dropped:0 overruns:0 frame:0
          TX packets:13 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:951 (951.0 B)  TX bytes:951 (951.0 B)

sit0      Link encap:UNSPEC  HWaddr 00-00-00-00-0A-0A-00-00-00-00-00-00-00-00-00-00
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wl0       Link encap:Ethernet  HWaddr F8:01:13:C2:19:74
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:2 dropped:0 overruns:0 frame:59928
          TX packets:0 errors:1 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:3 Base address:0x1000

wl0.1     Link encap:Ethernet  HWaddr F8:01:13:C2:19:75
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:2 dropped:0 overruns:0 frame:59928
          TX packets:0 errors:1 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

# brctl show

bridge name     bridge id               STP enabled     interfaces
br0             8000.f80113c21973       no              eth0.2
                                                        eth0.3
                                                        eth0.4
                                                        eth0.5
                                                        wl0
br1             8000.000000000000       no

The factoy image doesn't recognize all of the flash in Linux. However, the proprietary tool “flashtest” gives insights into the flash, and allows dumping it, e.g. you can dump all of the flash with command “flashtest export 000000 16777216”. Here is a comparison of what “flashtest”, “dmsg” and “/proc/mtd” provide.

# flashtest info                                 | dmesg                            | cat /proc/mtd
 flash  block  size  :  0x40000 (256k Bytes)     |                                  | dev:    size   erasesize  name
  flash  block  num   :  0x40 (64 Blocks)        |                                  | 
  flash  total  size  :  0x1000000 (16M Bytes)   |                                  | 
  flash  partation  info :                       |                                  | 
  ---------------------------------------------  |                                  | 
  Name         Address           Usage           |                                  | 
 ---------------------------------------------   |                                  | 
  Boot         0x0---0x40000   Bootloader        |                                  | 
  Image    0x40000---0xA40000  Main  image       | 0x001a1558-0x00a40000 : "rootfs" | mtd2: 0089eaa8 00040000 "rootfs"
  Image   0xA40000---0xE00000  Subject  image    |                                  | 
  Curcfg  0xE00000---0xE40000  Curcent  config   |                                  | 
  Faccfg  0xE40000---0xE80000  Factury  config   |                                  | 
  Tmpcfg  0xE80000---0xF00000  Temp  config      |                                  | 
  Fixcfg  0xF00000---0xF40000  Fixed  config     |                                  | 
  Logcfg  0xF40000---0xF80000  Log  config       |                                  | 
  TR069   0xF80000---0xFC0000  TR069  cert       | 0x00f80000-0x01000000 : "auxfs"  | mtd1: 00080000 00040000 "auxfs"
  Nvram   0xFC0000---0xFFFFFF  Nvram             | 0x00fc0000-0x01000000 : "nvram"  | mtd0: 00040000 00040000 "nvram"

Many firmware versions allow enabling Telnet, and thus opening a shell with root access.

For firmware versions V100R001C748SP106 and V100R001C748SP107, you can modify the original firmware before flashing it to disable the firewall rules that block the Telnet Server. There is link a the end to of the page to the source of this information.

Step 1: Install the required tools on your computer

sudo apt-get update
sudo apt-get -y install git build-essential zlib1g-dev liblzma-dev python-magic zip unzip

mkdir -p ~/fmk
cd ~/fmk
git clone https://code.google.com/p/firmware-mod-kit/
cd firmware-mod-kit/src
./configure
make

Step 2: Download and unpack the firmware

mkdir -p ~/fmk/107
cd ~/fmk/107
# Download Firmware_Speedport_LTE_II_B593u-12_V100R001C748SP107.zip -- unfortunately, Telekom doesn't host this file anymore
unzip Firmware_Speedport_LTE_II_B593u-12_V100R001C748SP107.zip
tar xvf V100R001C748SP107.tar.bz2 

Step 3: Unpack, modify firmware to allow inbound telnet from LAN, then repack firmware

# Extract the trx file
~/fmk/firmware-mod-kit/extract-firmware.sh B593.trx 

# Make a backup of the file we are going to patch
cp -a fmk/rootfs/bin/cms fmk

# Allow inbound telnet from LAN, make sure your replacement string is exactly same length as the original!
sed fmk/rootfs/bin/cms -i \
    -e's|iptables -A INPUT_SERVICE -p tcp  --dport 23 -j DROP 2>/dev/null|iptables -I INPUT -s 192.168.1.0/24 -j ACCEPT ##################|g'

# Check that original and modified binaries are same size but have different timestamps
ls -l fmk/cms fmk/rootfs/bin/cms

# Remove some unnecessary files to shrink squashfs image and keep fmk happy
rm -f fmk/rootfs/sbin/mkntfs

# Update version string in headers so device already running SP107 will accept our customized version
sed -i.bak fmk/image_parts/header.img \
    -e's|V100R001C748SP107\x00\x00\x00|V100R001C748SP107hax|g'

# Rebuild the trx file
~/fmk/firmware-mod-kit/build-firmware.sh

# Create the new firmware archive
mv fmk/new-firmware.bin B593.trx
chmod 0644 B593.trx modem.bin help.tar.bz2 B593-small.trx
tar --owner=LTECPE --group=LTECPE -cvjf V100R001C748SP107_TELNET.tar.bz2 B593.trx modem.bin help.tar.bz2 B593-small.trx

# Clean up
sudo rm -rf fmk

After upgrading your router with the new firmware it should be reacheable over telnet. Telnet takes some time to start, so if the connection is refused try a few moments later. You can login as “admin” with password “HW4GCPE”. This takes you the ATP prompt, where you can type the undocumented command “shell” to open the root shell. Documented commands are: cls, debug, help, save, ?, exit.

The router is generally available over SSH, but the password is not in the firmware file (i.e. it cannot be extracted via fmk). But you can find the plaintext SSH password in /var/sshusers.cfg if you have serial or Telnet access.

The pins to the TTL serial console are shown in the pictures at the begining of this article. The settings are 115200 8N1. With the factory settings, the console is disabled for both CFE boot loader as well as for Linux. So you need to enable it in the NVRAM. The easyest way of changing the NVRAM is through Telnet root access, as described above.

The following commands enable the console for CFE and Linux, and enable a 10 second delay and additional recovery options during boot:

nvram set console_disable=0
nvram set boot_wait=on
nvram set wait_time=10
nvram commit

If you don't have root access, you can put your device into recovery mode:

• Press and hold down all three buttons on the side (WLAN, RESET, WPS)
• Turn power on and keep pressing all buttons
• All LEDs will turn on
• Release buttons when all LEDs except POWER turn off

If your cabling is correct, you will see the Linux boot log messages, and the WPS LED will start blinking. In the root shell you can update the NVRAM as described above. The login for the serial console is the same as for Telnet, i.e. “admin” and “HW4GCPE”.

Press CTRL+C during initial seconds of boot to get into CFE console and load your own firmware.

While in recovery mode, you can also send commands to CFE through the web interface. For instance, to call “show clocks” enter into the webbroser http://192.168.1.1/do.htm?cmd=show+clocks. The ouput will only be shown on TTL, but you can use this to update NVRAM or boor an ELF image.

Command in CFE are:

et                  Broadcom Ethernet utility.
show clocks         Show current values of the clocks.
nvram               NVRAM utility.
reboot              Reboot.
flash               Update a flash memory device
batch               Load a batch file into memory and execute it
go                  Verify and boot OS image.
boot                Load an executable file into memory and execute it
load                Load an executable file into memory without executing it
save                Save a region of memory to a remote file via TFTP
ping                Ping a remote IP host.
arp                 Display or modify the ARP Table
ifconfig            Configure the Ethernet interface
help                Obtain help for CFE commands

You need to build your own image:

git clone https://git.openwrt.org/openwrt/openwrt.git
cd openwrt

// In case you want working Ethernet
git checkout b7dd438f66253cc49fa8b0b3434d5ef50fffbb7c
// Change "KERNEL_PATCHVER" to 4.9
vi target/linux/brcm47xx/Makefile

// The image Makefiles need to be adapted regarding two issues:
//   The lzma-loader crashes, maybe due to a watchdog reset during kernel decompress? But KERNEL_NAME = vmlinux-nodictionary.lzma without a loader will work.
//   You need an additional 256Bytes header after the TRX header, see above.

// At first boot, OpenWrt will try to fix the CRC in the TRX. This corrupts the flash due to additional header. So please comment it out
vi target/linux/brcm47xx/base-files/etc/uci-defaults/09_fix_crc

./scripts/feeds update -a
./scripts/feeds install -a

make menuconfig
make

In menuconfig, make sure to select

• Target System: Broadcom BCM47xx/53xx (MIPS)
• Sub-Target: MIPS 74k
• Target Profile: Broadcom SOC with BCM43xx Wifi (brcmsmac). BCM43xx Wifi (b43) also works.
• Target Images: Add “ramdisk” —> Compression —> XZ
• Global Build Setting: To reduce the size, strip unnecessary exports and functions, remove IPV6, crypto packages and signature checking
• Kernel Devices:
  • Network Devices: add bgmac
  • USB
    • Add usb2
    • For LTE support add usb-net-cdc-ether, kmod-usb-net-cdc-mbim, usb-net-huawei-cdc-ncm, usb-net-qmi-wwan, usb-serial, usb-serial-option, usb-serial-pl2303
    • For NAND support add usb-storage and usb-storage-uas (and fs-ext4 from Filesystems)
  • Other: Even though this router has a PCA9555 GPIO controler which is supported by kmod-gpio-pca953x, adding this kmod doesn't seem to have any impact, and there are do changes in “dmesg” or “cat /sys/kernel/debug/gpio”
• Remove anything else that is not needed if you image is too large, e.g. in Base: ca-bundle, dropbear, opkg, otrx, openwrt-keyring, ppp, usign
• The ramdisk will not include any modules, so add everything you need into the kernel

You will find “vmlinux-initramfs.elf” in “openwrt\build_dir\target-mipsel_74kc_musl\linux-bcm47xx_mips74k”. Please note that the file needs to be less than around 6.850KB (tests show that 6.852KB will be too large to boot, but 6.847KB will work).

Connect your computer to the LAN of the router. You should get an IP via DHCP, else pick an IP, e.g. 192.168.1.2. Start a TFTP Server on your computer. (dont forget to turn off the firewall). On the CFE console type

boot -elf -tftp 192.168.1.2:vmlinux-initramfs.elf

# cat /proc/version
Linux version 5.4.70 (user@computername) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r14660-5423d9d27e)) #0 Fri Oct 9 22:20:19 2020

# cat /proc/cpuinfo
system type             : Broadcom BCM5357
machine                 : Unknown Board
processor               : 0
cpu model               : MIPS 74Kc V4.9
BogoMIPS                : 249.34
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp dsp2
Options implemented     : tlb 4kex 4k_cache prefetch mcheck ejtag llsc dc_aliases userlocal vint perf_cntr_intr_bit perf
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

# cat /proc/meminfo
MemTotal:         124744 kB
MemFree:          107504 kB
MemAvailable:      83248 kB
Buffers:               0 kB
Cached:             9624 kB
SwapCached:            0 kB
Active:             7412 kB
Inactive:           2636 kB
Active(anon):       7412 kB
Inactive(anon):     2636 kB
Active(file):          0 kB
Inactive(file):        0 kB
Unevictable:           0 kB
Mlocked:               0 kB
HighTotal:             0 kB
HighFree:              0 kB
LowTotal:         124744 kB
LowFree:          107504 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:           432 kB
Mapped:             1364 kB
Shmem:              9624 kB
KReclaimable:        640 kB
Slab:               4032 kB
SReclaimable:        640 kB
SUnreclaim:         3392 kB
KernelStack:         240 kB
PageTables:           92 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       62372 kB
Committed_AS:      11004 kB
VmallocTotal:    1040376 kB
VmallocUsed:         292 kB
VmallocChunk:          0 kB
Percpu:               32 kB

# cat /proc/devices
Character devices:
  1 mem
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
 10 misc
 89 i2c
 90 mtd
128 ptm
136 pts
153 spi
180 usb
188 ttyUSB
189 usb_device
252 rpmb
253 watchdog
254 gpiochip

Block devices:
  8 sd
 31 mtdblock
 65 sd
 66 sd
 67 sd
 68 sd
 69 sd
 70 sd
 71 sd
128 sd
129 sd
130 sd
131 sd
132 sd
133 sd
134 sd
135 sd
179 mmc
259 blkext

# ls /sys/devices/platform/
Fixed MDIO bus.0  bcma_sflash.0     serial8250        uevent
bcm47xx-wdt.0     regulatory.0      serial8250.0

# cat /sys/class/mtd/mtd*/offset
0
262144
28
284
1772544
10747904
16711680

# ls /sys/class/net/
eth0   lo     wwan0  wwan1

# swconfig dev switch0 show
Global attributes:
        enable_vlan: 1
        ports: 0x003f
Port 0:
        pvid: 0
        link: port:0 link:down
Port 1:
        pvid: 0
        link: port:1 link:down
Port 2:
        pvid: 0
        link: port:2 link:down
Port 3:
        pvid: 0
        link: port:3 link:down
Port 4:
        pvid: 0
        link: port:4 link:down
Port 5:
        pvid: 0
        link: port:5 link:up speed:100baseT full-duplex

# cat /sys/kernel/debug/gpio
gpiochip0: GPIOs 0-31, parent: no-bus/bcm47xx_soc, bcma_gpio:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "boot"
mtd1: 00a00000 00010000 "firmware"
mtd2: 00000100 00000100 "loader"
mtd3: 001b0ae4 00010000 "linux"
mtd4: 0084f400 00010000 "rootfs"
mtd5: 005b0000 00010000 "failsafe"
mtd6: 00010000 00010000 "nvram"

# ifconfig -a
br-lan    Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth0      Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:337 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:113504 (110.8 KiB)
          Interrupt:4

eth0.1    Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth0.2    Link encap:Ethernet  HWaddr F8:01:13:C2:19:73
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:250 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:85500 (83.4 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:148 errors:0 dropped:0 overruns:0 frame:0
          TX packets:148 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:10944 (10.6 KiB)  TX bytes:10944 (10.6 KiB)

wwan0     Link encap:Ethernet  HWaddr AA:5E:4B:BF:47:B0
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wwan1     Link encap:Ethernet  HWaddr 0E:FB:02:B2:36:31
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

If you end up corrupting your flash and your router cannot boot (e.g. with the error “Invalid boot block on disk”), then the router will expose the “Broadcom - CFE miniWeb Server” on http://192.168.1.1, in which you can upload B593.trx from the factory firmware file, e.g. V100R001C748SP107.tar.bz2.

You can also access the miniWeb Server in the recovery mode, see above on how to enable that.

The router also saves a rescue image (from firmware file B593-small.trx) on flash. The easiest way of returning this and other parts of flash to the original state is flashing the bz2 file from the vendor trough the factory image. To do so, restore B593.trx as described above, log in via TTL or Telnet, connect a USB drive with the factory firmare, e.g. V100R001C748SP107.tar.bz2, and then run upg -f V100R001C748SP107.tar.bz2.

Be very carefull when flashing through CFE, as it is possible to overwrite the boot partition, bricking your router. Is seems that it is also possible overwrite Ethernet or Wifi firmwares, thus making the router loose all connecting in factory firmware. Unfortunately, the command “show devices” is not availble. The following partitions are confirmed to exist: flash0, flash0.boot, flash0.trx, flash0.trx1, flash0.os, flash0.os1, flash0.nvram, flash1.boot, flash1.para, flash1.trx, flash1.trx1, flash1.nvram.

If you router says “System abnormity. Please recover it.”, and after pressing “recover” you don't get back to a working state, than this means that you broke the recovery TRX files. You can upload a working “B593.trx” image using the “Huawei B593 multicast upgrade software”, using a fixed IP of 192.168.1.5 on your computer. It seem that you cannot flash OpenWRT images from “Huawei B593 multicast upgrade software”, you need to flash an original image first, and then upgrade from the web interface.

These are the patches I apply to build an image. Please note however that OpenWrt does not manage to write to the flash after boot.

Patch 1: Add router to Makefiles incl. image format

--- a/target/linux/bcm47xx/image/Makefile
+++ b/target/linux/bcm47xx/image/Makefile
@@ -89,6 +89,16 @@
 	mv $@.new $@
 endef
 
+define Build/huawei-b593u12-trx
+	$(STAGING_DIR_HOST)/bin/trx \
+		-m 33554432 \
+		-o $@.new \
+		-x 0x0100 \
+		-f $(IMAGE_KERNEL) \
+		$(call trxalign/$(FILESYSTEM),$@)
+	mv $@.new $@
+endef
+
 define Build/huawei-bin
 	dd if=/dev/zero of=$@.new bs=92 count=1
 	echo -ne 'HDR0\x08\x00\x00\x00' >> $@.new
--- a/target/linux/bcm47xx/image/mips74k.mk
+++ b/target/linux/bcm47xx/image/mips74k.mk
@@ -150,6 +150,16 @@
 endef
 TARGET_DEVICES += asus_rt-n66w
 
+define Device/huawei_b593u12
+  DEVICE_VENDOR := Huawei
+  DEVICE_MODEL := B593u-12
+  DEVICE_PACKAGES := kmod-b43 kmod-bgmac kmod-switch-bcm53xx kmod-switch-bcm53xx-mdio $(USB2_PACKAGES) kmod-usb-storage kmod-usb-storage-uas kmod-fs-ext4 kmod-usb-net-huawei-cdc-ncm kmod-usb-net-cdc-mbim kmod-usb-net-qmi-wwan kmod-usb-serial-option kmod-usb-serial-pl2303
+  KERNEL_NAME = vmlinux-nodictionary.lzma
+  IMAGES := trx
+  IMAGE/trx := append-rootfs | huawei-b593u12-trx
+endef
+TARGET_DEVICES += huawei_b593u12
+
 define Device/linksys_wrt160n-v3
   DEVICE_MODEL := WRT160N
   DEVICE_VARIANT := v3

Patch 2: Add support for board, buttons and LEDs. Name the file 832-huawei-b593u12_support.patch and put it in the patches folder, e.g. openwrt/target/linux/bcm47xx/patches-5.10

--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
@@ -53,6 +53,7 @@
 	BCM47XX_BOARD_DLINK_DIR130,
 	BCM47XX_BOARD_DLINK_DIR330,
 
+	BCM47XX_BOARD_HUAWEI_B593U12,
 	BCM47XX_BOARD_HUAWEI_E970,
 
 	BCM47XX_BOARD_LINKSYS_E900V1,
--- a/arch/mips/bcm47xx/board.c
+++ b/arch/mips/bcm47xx/board.c
@@ -192,6 +192,7 @@
 /* boardtype, boardnum, boardrev */
 static const
 struct bcm47xx_board_type_list3 bcm47xx_board_list_board[] __initconst = {
+	{{BCM47XX_BOARD_HUAWEI_B593U12, "Huawei B593u-12"}, "0x053d", "1234", "0x1301"},
 	{{BCM47XX_BOARD_HUAWEI_E970, "Huawei E970"}, "0x048e", "0x5347", "0x11"},
 	{{BCM47XX_BOARD_PHICOMM_M1, "Phicomm M1"}, "0x0590", "80", "0x1104"},
 	{{BCM47XX_BOARD_ZTE_H218N, "ZTE H218N"}, "0x053d", "1234", "0x1305"},
--- a/arch/mips/bcm47xx/buttons.c
+++ b/arch/mips/bcm47xx/buttons.c
@@ -124,6 +124,13 @@
 /* Huawei */
 
 static const struct gpio_keys_button
+bcm47xx_buttons_huawei_b593u12[] __initconst = {
+	BCM47XX_GPIO_KEY(25, KEY_WPS_BUTTON),
+	BCM47XX_GPIO_KEY(26, KEY_RESTART),
+	BCM47XX_GPIO_KEY(27, BTN_0), /* Router / AP mode swtich */
+};
+
+static const struct gpio_keys_button
 bcm47xx_buttons_huawei_e970[] __initconst = {
 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
 };
--- a/arch/mips/bcm47xx/leds.c
+++ b/arch/mips/bcm47xx/leds.c
@@ -223,6 +223,11 @@
 /* Huawei */
 
 static const struct gpio_led
+bcm47xx_leds_huawei_b593u12[] __initconst = {
+	BCM47XX_GPIO_LED(5, "blue", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
+};
+
+static const struct gpio_led
 bcm47xx_leds_huawei_e970[] __initconst = {
 	BCM47XX_GPIO_LED(0, "unk", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
 };

• Internal Photos from FCC: https://fccid.io/QISB593U-12/Internal-Photos/Internal-Photos-1715217.pdf
• Tech info: http://en.techinfodepot.shoutwiki.com/wiki/Huawei_B593u-12
• Overview of known firmare versions: https://docs.google.com/spreadsheets/d/1ZJsy0q-8tmR8m32d1bCHkSv1neGVtA5v5TU4qVczH0Q/edit
• Previous OpenWrt porting efforts: http://blog.asiantuntijakaveri.fi/2014/08/well-that-was-easy.html
• Source for serial console: http://blog.asiantuntijakaveri.fi/2014/08/serial-console-on-huawei-b593u.html
• Source for modifying firmware images: http://blog.asiantuntijakaveri.fi/2014/08/modifying-huawei-b593u-firmware-images.html
• Exploiting PING, TELNET and backdoors in older firmware versions:
  • https://blog.hqcodeshop.fi/archives/227-u-12-pre-SP100-exploits-in-a-single-tool.html
  • http://blog.asiantuntijakaveri.fi/2013/08/gaining-root-shell-on-huawei-b593-4g.html
  • http://blog.asiantuntijakaveri.fi/2014/08/huapwn-backdoor-on-your-huawei-b593u.html
• Data Sheet for PCA9555: https://www.nxp.com/docs/en/data-sheet/PCA9555.pdf

How to add tags