Huawei B5328 ( GCT GDM7243 )

Hello i need somehelp for porting or adding openwrt or lede to this device so far i still did not find any official firmware for it it's a 4G LTE router it's stuck on a non working state but telnet is enabled in this mode , i followed the adding device guide and collected all hardware info

here's the details .

dmesg : 
Booting Linux on physical CPU 0x0
Initializing cgroup subsys cpu
Initializing cgroup subsys cpuacct
Linux version 3.10.0-uc0 (kfan@primeott0) (gcc version 4.7.3 (Buildroot 2013.08.1) ) #1 Wed Aug 24 09:38:10 CST 2016
CPU: ARMv7 Processor [410fc074] revision 4 (ARMv7), cr=12c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine: GCT GDM7243
Boot device: nand
boot mem size: 80MB
READ ONLY FILESYSTEM
FW Checksum: disable
Active linux : linux
Active rootfs: rootfs
Active tk    : unknown
Memory policy: ECC disabled, Data cache writeback
CPU: GDM7243Q R0B [0x72430100]
ARM:
  CR: 12c53c7d
  ACR: 00006040
CPU: xtal 19.200 MHz, pll 832.000 MHz arm 832.000 MHz, clk(1x) 104.000 MHz
On node 0 totalpages: 20480
free_area_init_node: node 0, pgdat d04b0fb4, node_mem_map d0523000
  Normal zone: 160 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 20480 pages, LIFO batch:3
CPU: All CPU(s) started in SVC mode.
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 20320
Kernel command line: console=/dev/null,921600 boot=nand mem=80M ubi.mtd=10,2048 root=ubi0:rootfs ro rootfstype=ubifs mtdparts=gdm7243:512k(u-boot),512k(env),1m(rev0),1m(ltenv),1m(wmnv),1m(cmnnv),1m(cmnnv2),4m(rev1),4m(linux),4m(linux2),30m(rootfs),30m(rootfs2),5m(tk),5m(tk2),512k(customize),2560k(log),32m(update) bl_ver=0.46e checksum=disable active=linux,rootfs,unknown grf=gdm7243q
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 80MB = 80MB total
Memory: 75872k/75872k available, 6048k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xd5800000 - 0xff000000   ( 664 MB)
    lowmem  : 0xd0000000 - 0xd5000000   (  80 MB)
    modules : 0xcf000000 - 0xd0000000   (  16 MB)
      .text : 0xd0008000 - 0xd03f2094   (4009 kB)
      .init : 0xd03f3000 - 0xd041190c   ( 123 kB)
      .data : 0xd0412000 - 0xd04b1680   ( 638 kB)
       .bss : 0xd04b4000 - 0xd0522aa8   ( 443 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:64
gdm_set_mode
 CLOCK_EVT_MODE_SHUTDOWN
gdm_set_mode
 CLOCK_EVT_MODE_PERIODIC
sched_clock: 32 bits at 32kHz, resolution 30517ns, wraps every 131071999ms
RTC: secondary(external) 32.768KHz osc
RTC Interrupt Enabled!
rtc_boot_base=00017356
Calibrating delay loop... 1652.73 BogoMIPS (lpj=826368)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0xd0303e90 - 0xd0303ee8
SYS_STA: 0x0(POR)
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Build Info:
  date: 2016/08/24-09:37:07
  svnr: 
  pkgv: 0.54.3.10.2
  appv: 0.54.3.10.2
Config Info:
  PRODUCT: 7243q_lte_standalone
  PLATFORM_STANDALONE
  HZ=1000
  NET_NATQ2
  NET_VLANQ
  RTC_TIMER
  PM_IDLE
  PM_IDLE_DFRD_TIMER
DDR: id=8(Winbond) rev=0,0
GDM HL IF(v0.5) initialized
bio: create slab <bio-0> at 0
Switching to clocksource rtccs
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
lock_reg:
  active=fc0000c0
  free  =fc0000c4
gipc-protocol(d5804010): va=d5804010, pa=d4880010 ver=0103
ipc init ch=0
ipc ch[0]:CTRL, irb: va=d5804690-d5804cd0 pa=d4880690-d4880cd0
ipc ch[0]:CTRL, irb_work: va=d5804ce0-d5804f80 pa=d4880ce0-d4880f80
  irb nr: tx=16(2080bytes) rx=64(2080bytes)
   irb tx: va=d5804690-d58047d0 pa=d4880690-d48807d0
   irb rx: va=d58047d8-d5804cd8 pa=d48807d8-d4880cd8
  m-ch_enabled=0x1
ipc init ch=28
ipc ch[28]:DBG, irb: va=d5804fa0-d58059c8 pa=d4880fa0-d48819c8
ipc ch[28]:DBG, irb_work: va=d58059d8-d5805e08 pa=d48819d8-d4881e08
  irb nr: tx=2(2080bytes) rx=128(2080bytes)
   irb tx: va=d5804fa0-d5804fc8 pa=d4880fa0-d4880fc8
   irb rx: va=d5804fd0-d58059d0 pa=d4880fd0-d48819d0
  m-ch_enabled=0x10000001
IPCIF(v0.2) initialized
IPC Ver: 0.3
  IPC_IF_RX_LIMIT=100
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
msgmni has been set to 148
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Initialize gdm-i2c
Probe gdm-i2c
CPU: gdm-i2c requesting port GPG[7-8]
Attempting to program mux gpg[8:7] for gdm-i2c.-1
Attempting to program mux gpg[8:7] for gdm-i2c.-1
i2c bus frequency set to 400 KHz
i2c-0: GDM I2C adapter
PMIC Register [0x00~0x0f]
d4827e58: 10 03 00 f0 7e 0f 00 0b 13 5d 35 45 45 4c 00 00
PMIC SWREGADJ1=0xb
ECOSWREG: 0f->ff
PMIC GMT-G5851(id:12) probed!
gdm-uart.0: ttyS0 at I/O 0xfc007500 (irq = 2) is a gdm-uart
gdm-uart.1: ttyS1 at I/O 0xfc007540 (irq = 21) is a gdm-uart
gdm-uart.2: ttyS2 at I/O 0xfc007580 (irq = 33) is a gdm-uart
gdm-uart.3: ttyS3 at I/O 0xfc007600 (irq = 12) is a gdm-uart
[USIM] : GDM USIM device driver (1.0)
Serial flash ID[00000000] 
Serial flash driver MAJOR[140]
start : c4000000, regs : d6000000, area : d4a80440, size : 16777216
brd: module loaded
GDM7243 NAND Driver, GCT Semiconductor, Ltd.
Built-in Ecc Nand
pagesize : 2K
address cycle : 4
NAND device: Manufacturer ID: 0x98, Chip ID: 0xa1 (Toshiba NAND 128MiB 1,8V 8-bit), 128MiB, page size: 2048, OOB size: 64
Bad block table found at page 65472, version 0x01
Bad block table found at page 65408, version 0x01
nand_read_bbt: bad block at 0x000004fa0000
nand_read_bbt: bad block at 0x000006000000
17 cmdlinepart partitions found on MTD device gdm7243
17 cmdlinepart partitions found on MTD device gdm7243
Creating 17 MTD partitions on "gdm7243":
0x000000000000-0x000000080000 : "u-boot"
0x000000080000-0x000000100000 : "env"
0x000000100000-0x000000200000 : "rev0"
0x000000200000-0x000000300000 : "ltenv"
0x000000300000-0x000000400000 : "wmnv"
0x000000400000-0x000000500000 : "cmnnv"
0x000000500000-0x000000600000 : "cmnnv2"
0x000000600000-0x000000a00000 : "rev1"
0x000000a00000-0x000000e00000 : "linux"
0x000000e00000-0x000001200000 : "linux2"
0x000001200000-0x000003000000 : "rootfs"
0x000003000000-0x000004e00000 : "rootfs2"
0x000004e00000-0x000005300000 : "tk"
0x000005300000-0x000005800000 : "tk2"
0x000005800000-0x000005880000 : "customize"
0x000005880000-0x000005b00000 : "log"
0x000005b00000-0x000007b00000 : "update"
---------------------
hdr chksum  : 0xbb1b0876
magic       : 0xcafebabe
timstamp    : 0x00000002
data chksum : 0xbda7f3dd
data size   : 0x0001ffdc
---------------------
---------------------
hdr chksum  : 0xa6160741
magic       : 0xcafebabe
timstamp    : 0x00000003
data chksum : 0xf314f304
data size   : 0x0001ffdc
---------------------
CPU: gdm-rgmii requesting port GPE[0-10]
Attempting to program mux gpe[10:0] for gdm-rgmii.-1
Attempting to program mux gpe[10:0] for gdm-rgmii.-1
CPU: gdm-rgmii requesting port GPE[12-15]
Attempting to program mux gpe[15:0] for gdm-rgmii.-1
Attempting to program mux gpe[15:0] for gdm-rgmii.-1
PHYCR1: 0x211c
MII_LCR: 00006251->00006e51
PHYCR2: 0x842
gdm-rgmii at 0xec0c0000 irq=15 (00:0a:3b:f0:01:30) with Realtek RTL8211 PHY(at 00)
gdm-ether ver 1.4
unable to find transceiver of type USB2 PHY
unable to find transceiver of type USB3 PHY
dwc3 dwc3: no usb2 phy configured
platform dwc3: Driver dwc3 requests probe deferral
gdm_phy3_probe
gdm_phy2_probe
mousedev: PS/2 mouse device common for all mice
SDHCI:sdhci_init called
CPU: reset-lte requesting port GPD[1-1]
Attempting to program mux gpd[7:0] for gdm-gpio.-1
Attempting to program mux gpd[7:0] for gdm-gpio.-1
CPU: reset-lte requesting port GPD[12-12]
Attempting to program mux gpd[17:12] for gdm-gpio.-1
Attempting to program mux gpd[17:12] for gdm-gpio.-1
[MAIN CLOCK]: gdm-sdhost - 200Mhz
PAD_GPC_CTRL_0: 39393939
SDHCI:SDHOST VERSION= 1002
SDH Clock  freq = 200MHz, Timeout Clock freq = 1KHz
SDHCI:clock (min=97751 max=200000000) 
SDHCI_CAN_VDD_330
SDHCI_CAN_VDD_300
SDHCI_CAN_VDD_180
gdm-sdhost request port
CPU: gdm-sdhost requesting port GPC[0-3]
Attempting to program mux gpc[3:0] for gdm-sdhost.-1
  Programming gpc[3:0]: fc000508 (mask=00000003) to 0001fffd for gdm-sdhost.-1
CPU: gdm-sdhost requesting port GPC[8-11]
Attempting to program mux gpc[9:8] for gdm-sdhost.-1
  Programming gpc[9:8]: fc000508 (mask=00000030) to 0001ffdd for gdm-sdhost.-1
Attempting to program mux gpc[10] for gdm-sdhost.-1
  Programming gpc[10]: fc000508 (mask=000000c0) to 0001ff5d for gdm-sdhost.-1
Attempting to program mux gpc[11] for gdm-sdhost.-1
  Programming gpc[11]: fc000508 (mask=00000300) to 0001fd5d for gdm-sdhost.-1
SDHCI: sdhci_reset: mask : 1  

SDHCI:gdm_sdhci_set_ios: clock= 0Hz powermode= 1 Bus Width =0, vdd=21

ios->timing = [gdm-sdhost][0][21][00][full speed][xbit][on] 
MMC_SIGNAL_VOLTAGE_330 success
SDHCI:gdm_sdhci_set_ios: clock= 400000Hz powermode= 2 Bus Width =0, vdd=21

[SET_CLOCK!!!]host->max_clk/div = 400000 , div = 500 , clock = 400000 
[SET_CLOCK!!!]host->max_clk/div = 400000 , div = 500 , clock = 400000 
ios->timing = [gdm-sdhost][400000][21][00][full speed][xbit][on] 
SDHCI:mmc0: at ec0b0000 irq 16 SDMA
natq ver: 0.5.6
Netfilter messages via NETLINK v0.30.
ipip: IPv4 over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team 2
Type=Linux 2
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
=====##### Init mac filter log work_queue #####=====
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 4
wfds_ms=10
aom memcpy(f4000000, d04b2000, 6496): d=38402de9 s=d3010ef1
aom memcpy done
GDM PM Inited: SYS_GLB_CTRL=0147c244(wfds=9979us)
GDM PM enabled(SYS_GLB_CTRL:0147c244)
MTD Crash partition /dev/mtd7
ipc mux irb nr(0->128) bsize(0->4128)
ipc init ch=16
ipc ch[16]:MUX, irb: va=d5806010-d5806a38 pa=d4882010-d4882a38
ipc ch[16]:MUX, irb_work: va=d5806a48-d5806e78 pa=d4882a48-d4882e78
  irb nr: tx=2(4128bytes) rx=128(4128bytes)
   irb tx: va=d5806010-d5806038 pa=d4882010-d4882038
   irb rx: va=d5806040-d5806a40 pa=d4882040-d4882a40
  m-ch_enabled=0x10010001
dwc init suspendable:
  GUSB2PHYCFG: 40002408->40002448
  GUSB3PIPECTL: 010c0002->010e0002
CPU: gdm-gpio requesting port GPD[8-8]
Attempting to program mux gpd[8:8] for gdm-gpio.-1
Attempting to program mux gpd[8:8] for gdm-gpio.-1
udc: connect PHY_STATUS=00063000
dwc3 usb probed!
UBI: attaching mtd10 to ubi0
UBI: scanning is finished
UBI: attached mtd10 (name "rootfs", size 30 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 240, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 6/1, WL threshold: 4096, image sequence number: 96424231
UBI: available PEBs: 0, total reserved PEBs: 240, PEBs reserved for bad PEB handling: 20
em_mode=0x00000800:
b[0]=REBOOT_ON_LINUX_CRASH(off)
b[1]=REBOOT_ON_APP_CRASH(off)
b[8]=REBOOT_ON_MODEM_CRASH(off)
b[9]=REBOOT_ON_MODEM_WDT(off)
b[10]=RELOAD_ON_MODEM_CRASH(off)
b[11]=RELOAD_ON_MODEM_WDT(ON)
Warning: unable to open an initial console.
UBI: background thread "ubi_bgt0d" started, PID 872
UBIFS: recovery needed
UBIFS: recovery deferred
UBIFS: mounted UBI device 0, volume 0, name "rootfs", R/O mode
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 26157056 bytes (24 MiB, 206 LEBs), journal size 6729728 bytes (6 MiB, 53 LEBs)
UBIFS: reserved for root: 0 bytes (0 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID E1A0A867-5C44-4CB6-99CD-D557B13D24F2, small LPT model
VFS: Mounted root (ubifs filesystem) readonly on device 0:10.
Freeing unused kernel memory: 120K (d03f3000 - d0411000)
SDHCI:ERROR-Reset the Controller cmd_err(-110)

SDHCI: sdhci_reset: mask : 2  

SDHCI: sdhci_reset: mask : 4  

SDHCI:ERROR-Reset the Controller cmd_err(-110)

SDHCI: sdhci_reset: mask : 2  

SDHCI: sdhci_reset: mask : 4  

SDHCI:gdm_sdhci_set_ios: clock= 400000Hz powermode= 2 Bus Width =0, vdd=21

[SET_CLOCK!!!]host->max_clk/div = 400000 , div = 500 , clock = 400000 
ios->timing = [gdm-sdhost][400000][21][00][full speed][xbit][on] 
SDHCI:gdm_sdhci_set_ios: clock= 400000Hz powermode= 2 Bus Width =0, vdd=21

[SET_CLOCK!!!]host->max_clk/div = 400000 , div = 500 , clock = 400000 
ios->timing = [gdm-sdhost][400000][21][00][full speed][xbit][on] 
SDHCI:ERROR-Reset the Controller cmd_err(-110)

SDHCI: sdhci_reset: mask : 2  

<4>mmc0: card claims to support voltages below the defined range. These will be ignored.
SDHCI: sdhci_reset: mask : 4  

SDHCI:gdm_sdhci_set_ios: clock= 400000Hz powermode= 2 Bus Width =0, vdd=7

[SET_CLOCK!!!]host->max_clk/div = 400000 , div = 500 , clock = 400000 
ios->timing = [gdm-sdhost][400000][7][00][full speed][xbit][on] 
[SDIO] <Realtek> sdio_read_cccr cccr_vsn(SDIO_CCCR_CCCR) = 0x0002 
[SDIO] Realtek RTL8192E WLAN controller.
[SDIO] <Realtek> sdio_read_cccr cccr_vsn(SDIO_CCCR_CCCR) = 0x0002 
SDHCI:gdm_sdhci_set_ios: clock= 400000Hz powermode= 2 Bus Width =0, vdd=7

[SET_CLOCK!!!]host->max_clk/div = 400000 , div = 500 , clock = 400000 
ios->timing = [gdm-sdhost][400000][7][00][full speed][xbit][on] 
SDHCI:gdm_sdhci_set_ios: clock= 50000000Hz powermode= 2 Bus Width =0, vdd=7

[SET_CLOCK!!!]host->max_clk/div = 50000000 , div = 4 , clock = 50000000 
[SET_CLOCK!!!]host->max_clk/div = 50000000 , div = 4 , clock = 50000000 
ios->timing = [gdm-sdhost][50000000][7][00][full speed][xbit][on] 
SDHCI:gdm_sdhci_set_ios: clock= 50000000Hz powermode= 2 Bus Width =2, vdd=7

[SET_CLOCK!!!]host->max_clk/div = 50000000 , div = 4 , clock = 50000000 
ios->timing = [gdm-sdhost][50000000][7][02][full speed][4bit][on] 
mmc0: new high speed SDIO card at address 0001
devpts: called with bogus options
jffs2: jffs2_scan_inode_node(): CRC failed on node at 0x001017dc: Read 0xffffffff, calculated 0xda4916ff
CLK_80M: set 80MHz(0x1).
CPU: pwr-hold requesting port GPE[11-11]
Attempting to program mux gpe[11] for gdm-gpio.-1
Attempting to program mux gpe[11] for gdm-gpio.-1
boot param: product_id=0x0005, operator_id=0x000a, boot_mode=0, gipc_phy_base=0xd4880010, mem_base=0xd0000000, mem_size=0x5000000
---------------------
hdr chksum  : 0xbb1b0876
magic       : 0xcafebabe
timstamp    : 0x00000002
data chksum : 0xbda7f3dd
data size   : 0x0001ffdc
---------------------
---------------------
hdr chksum  : 0xa6160741
magic       : 0xcafebabe
timstamp    : 0x00000003
data chksum : 0xf314f304
data size   : 0x0001ffdc
---------------------
modem map info:
  [0] pa(d5100000)->va(d8000000)
decompress gz(1f 8b) at 0xd5100000... (3013178bytes)
decompress done(7096096bytes)
VLANQ register lte0pdn0 tag=100 en=0
VLANQ register lte0pdn1 tag=101 en=0
VLANQ register lte0pdn2 tag=102 en=0
VLANQ register lte0pdn3 tag=103 en=0
ipc init ch=1
ipc ch[1]:LTE-SDU, irb: va=d5814010-d581e010 pa=d4890010-d489a010
ipc ch[1]:LTE-SDU, irb_work: va=d580c010-d5810030 pa=d4888010-d488c030
  irb nr: tx=1024(1568bytes) rx=1024(1568bytes)
   irb tx: va=d5814010-d5819010 pa=d4890010-d4895010
   irb rx: va=d5819018-d581e018 pa=d4895018-d489a018
  m-ch_enabled=0x10010003
netif set local ip: 192.168.1.1
device eth0 entered promiscuous mode
Rx delay(0xfc000450): 0x00802300 
tc->desc=d58a8000 desc_phys=d43e8000
gdm_eth_open (eth0): initializing DMA
 - Tx descriptor [0xd43e8000-0xd43edfff] (nr=1024)
 - Rx descriptor [0xd43ee000-0xd43ef7ff] (nr=256)
expansion(200, 7c00, 0)
eth0: link up, 1000Mbps, full-duplex (3140, 79ad, cde1)
Realtek WLAN driver - version 1.7 (2015-02-13)
Adaptivity function - version 8.0
 wlan_index:0  1, 10,0x8179024c,0x0,0
rtw_drv_init: sdio_func_id is "mmc0:0001:1"
=====>>INSIDE rtl8192cd_init_one <<=====
InitPON OK
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
[RTL8192ES] Efuse data : [ee51ff0334]
CPU: C:13:I requesting port GPC[13-13]
Attempting to program mux gpc[15:13] for gdm-gpio.-1
Attempting to program mux gpc[15:13] for gdm-gpio.-1
CPU: gdm-gpio releasing port GPC[13-13]
CPU: C:12:I requesting port GPC[12-12]
Attempting to program mux gpc[12] for gdm-gpio.-1
Attempting to program mux gpc[12] for gdm-gpio.-1
CPU: gdm-gpio releasing port GPC[12-12]
CPU: G:6:I requesting port GPG[6-6]
Attempting to program mux gpg[6] for gdm-gpio.-1
Attempting to program mux gpg[6] for gdm-gpio.-1
CPU: gdm-gpio releasing port GPG[6-6]
eth0 set host mac: d0:50:99:62:4d:45
br0: port 1(eth0) entered forwarding state
br0: port 1(eth0) entered forwarding state
[W] priv->droplog_flag=0
Freeing descriptors: virtual=d58a8000, physical=d43e8000
NIF: int del(eth0)
  del nif dl nr=0 pos(a=0 w=0 r=0)
NIF: int del(eth0)
  del dl natt nr: 3
  del dl nr=0 tot_nr=0
br0: port 1(eth0) entered disabled state
device eth0 left promiscuous mode
br0: port 1(eth0) entered disabled state
device eth0 entered promiscuous mode
Rx delay(0xfc000450): 0x00802300 
tc->desc=d5d99000 desc_phys=d43e8000
gdm_eth_open (eth0): initializing DMA
 - Tx descriptor [0xd43e8000-0xd43edfff] (nr=1024)
 - Rx descriptor [0xd43ee000-0xd43ef7ff] (nr=256)
expansion(200, 7c00, 0)
eth0: link up, 1000Mbps, full-duplex (3140, 79ad, cde1)
tx packets: driver=6, mmc=1
head=1, tail=0, hw=1
device wlan0 entered promiscuous mode
association client number clear: assoc_num=0
InitPON OK
InitMAC OK


************* Initialize MAC/PHY parameter *************
[MAC_REG_8192Emp]
[PHY_REG_8192Emp]
[PHY_REG_PG_8192Emp]
[AGC_TAB_8192ES]
[RadioA_8192ES]
[RadioB_8192ES]
InitDownload FW OK 
[TxPowerTrack_AP]
8192E LCK done!!
acli: start_ss_t ss_req:0 scanning:0 is_root:1  
write RF 0 offset 0x55 val [0x00000],  read back [0x00000]
write RF 1 offset 0x55 val [0x00000],  read back [0x00000]
br0: port 2(wlan0) entered forwarding state
br0: port 2(wlan0) entered forwarding state
br0: port 1(eth0) entered forwarding state
br0: port 1(eth0) entered forwarding state
[W] priv->droplog_flag=0
lcq_netdev_notifier: 0
lcq_enabled=1
running netif_q_thread!
nf_conntrack version 0.5.0 (1187 buckets, 4748 max)
eth phy reset done!
eth0: link down.
br0: port 1(eth0) entered disabled state
eth0: Setting MAC address to 00:06:f4:fe:d3:a0
CPU: D:0:I requesting port GPD[0-0]
Attempting to program mux gpd[7:0] for gdm-gpio.-1
Attempting to program mux gpd[7:0] for gdm-gpio.-1
CPU: gdm-gpio releasing port GPD[0-0]
CPU: gpio-irq requesting port GPD[0-0]
Attempting to program mux gpd[7:0] for gdm-gpio.-1
Attempting to program mux gpd[7:0] for gdm-gpio.-1
[bmon] Wait hibernation
CPU: gpio-irq requesting port GPD[7-7]
Attempting to program mux gpd[7:0] for gdm-gpio.-1
Attempting to program mux gpd[7:0] for gdm-gpio.-1
[lted] bentry delayed copy: b336(1)
gif_to_ipc: delayed req 3335(2044)
gif_to_ipc: delayed req 3335(2044)
gif_to_ipc: delayed req 3335(2044)
gif_to_ipc: delayed req 3335(2044)
gif_to_ipc: delayed req 3335(2044)
gif_to_ipc: delayed req 3335(2044)
gif_to_ipc: delayed req 3335(2044)
gif_to_ipc: delayed req 3335(2044)
gif_to_ipc: delayed req 3335(2044)
gif_to_ipc: delayed req 3335(2044)
lted: pm_no_sleepable=1
lted: pm_no_sleepable=0
CPU: gdm-uart requesting port GPG[11-12]
Attempting to program mux gpg[12:11] for gdm-uart.1
  Programming gpg[12:11]: fc000518 (mask=00006000) to 07e783fc for gdm-uart.1
uart port[1] fc=0 cr=0000002b
gdm_mux_init
g_mass_storage gadget: Mass Storage Function, version: 2009/09/11
g_mass_storage gadget: Number of LUNs=1
 lun0: LUN: removable file: (no medium)
g_mass_storage gadget: Mass Storage Gadget, version: 2009/09/11
g_mass_storage gadget: userspace failed to provide iSerialNumber
g_mass_storage gadget: g_mass_storage ready
IPV6Q LOG(00000004):
ipv6q_enabled=0
NET EMUL LOG(00000000): NULL
net_emul_mask=00000000
CPU: gdm-uart requesting port GPG[9-10]
Attempting to program mux gpg[10:9] for gdm-uart.0
Attempting to program mux gpg[10:9] for gdm-uart.0
uart port[0] fc=0 cr=0000002b
expansion(200, 7c00, 0)
eth0: link up, 1000Mbps, full-duplex (1040, 79ad, cde1)
br0: port 1(eth0) entered forwarding state
br0: port 1(eth0) entered forwarding state
UBIFS: completing deferred recovery
UBIFS: deferred recovery completed
UBIFS: background thread "ubifs_bgt0_0" started, PID 1597
cat /proc/cmdline

console=/dev/null,921600 boot=nand mem=80M ubi.mtd=10,2048 root=ubi0:rootfs ro rootfstype=ubifs mtdparts=gdm7243:512k(u-boot),512k(env),1m(rev0),1m(ltenv),1m(wmnv),1m(cmnnv),1m(cmnnv2),4m(rev1),4m(linux),4m(linux2),30m(rootfs),30m(rootfs2),5m(tk),5m(tk2),512k(customize),2560k(log),32m(update) bl_ver=0.46e checksum=disable active=linux,rootfs,unknown grf=gdm7243q



**cat /proc/cpuinfo**

processor	: 0
model name	: ARMv7 Processor rev 4 (v7b)
BogoMIPS	: 1652.73
Features	: swp half fastmult vfp edsp neon vfpv3 tls vfpv4 idiva 
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x0
CPU part	: 0xc07
CPU revision	: 4

Hardware	: GCT GDM7243
Revision	: 0000
Serial		: 0000000000000000


**cat /proc/meminfo**

MemTotal:          75992 kB
MemFree:           46812 kB
Buffers:               0 kB
Cached:            11800 kB
SwapCached:            0 kB
Active:             7652 kB
Inactive:           7776 kB
Active(anon):       3628 kB
Inactive(anon):        0 kB
Active(file):       4024 kB
Inactive(file):     7776 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 8 kB
Writeback:             0 kB
AnonPages:          3648 kB
Mapped:             3772 kB
Shmem:                 0 kB
Slab:               4864 kB
SReclaimable:        408 kB
SUnreclaim:         4456 kB
KernelStack:         592 kB
PageTables:          388 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       37996 kB
Committed_AS:     194900 kB
VmallocTotal:     679936 kB
VmallocUsed:       28860 kB
VmallocChunk:     344060 kB


**cat /proc/devices**
Character devices:
  1 mem
  2 pty
  3 ttyp
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
 10 misc
 13 input
 90 mtd
126 gpiodev
128 ptm
136 pts
140 sflash
230 ghif
231 glif
232 usim
240 rif
245 rif
246 gdmkern
247 crash
250 ttyGS
254 ubi0

Block devices:
  1 ramdisk
259 blkext
 31 mtdblock
179 mmc


**ls /sys/devices/platform**

alarmtimer
dwc2
dwc3
gdm-audio
gdm-gpio
gdm-i2c
gdm-i2s
gdm-lte
gdm-lte-ipc
gdm-modem
gdm-pcm
gdm-phy2
gdm-phy3
gdm-pmic
gdm-rgmii
gdm-rtc
gdm-sdhost
gdm-sflash
gdm-spi
gdm-timer.0
gdm-uart.0
gdm-uart.1
gdm-uart.2
gdm-uart.3
gdm7243-nand
leds-gpio
power
uevent
vincent8-gpio


**cat /proc/mtd**

dev:    size   erasesize  name
mtd0: 00080000 00020000 "u-boot"
mtd1: 00080000 00020000 "env"
mtd2: 00100000 00020000 "rev0"
mtd3: 00100000 00020000 "ltenv"
mtd4: 00100000 00020000 "wmnv"
mtd5: 00100000 00020000 "cmnnv"
mtd6: 00100000 00020000 "cmnnv2"
mtd7: 00400000 00020000 "rev1"
mtd8: 00400000 00020000 "linux"
mtd9: 00400000 00020000 "linux2"
mtd10: 01e00000 00020000 "rootfs"
mtd11: 01e00000 00020000 "rootfs2"
mtd12: 00500000 00020000 "tk"
mtd13: 00500000 00020000 "tk2"
mtd14: 00080000 00020000 "customize"
mtd15: 00280000 00020000 "log"
mtd16: 02000000 00020000 "update"


**cat /sys/class/mtd/mtd*/offset** 
did not work


**ifconfig -a**

br0       Link encap:Ethernet  HWaddr 00:01:73:01:FF:10  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::6815:faff:fef6:e368/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:593 errors:0 dropped:0 overruns:0 frame:0
          TX packets:304 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:35922 (35.0 KiB)  TX bytes:44806 (43.7 KiB)

eth0      Link encap:Ethernet  HWaddr 00:06:F4:FE:D3:A0  
          inet6 addr: fe80::20a:3bff:fef0:130/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:638 errors:0 dropped:0 overruns:0 frame:0
          TX packets:305 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:52096 (50.8 KiB)  TX bytes:45282 (44.2 KiB)
          Interrupt:15 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lte0pdn0  Link encap:Ethernet  HWaddr 00:06:F4:FE:D3:A2  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lte0pdn1  Link encap:Ethernet  HWaddr 00:06:F4:FE:D3:A3  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lte0pdn2  Link encap:Ethernet  HWaddr 00:06:F4:FE:D3:A4  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lte0pdn3  Link encap:Ethernet  HWaddr 00:06:F4:FE:D3:A5  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lte0pdn4  Link encap:Ethernet  HWaddr 00:06:F4:FE:D3:A6  
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

sit0      Link encap:IPv6-in-IPv4  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tunl0     Link encap:UNSPEC  HWaddr 00-00-00-00-30-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:0  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan0     Link encap:Ethernet  HWaddr 00:01:73:01:FF:10  
          inet6 addr: fe80::201:73ff:fe01:ff10/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Base address:0x24c 

wlan0-vxd Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Base address:0x24c 


**ls /sys/class/net**

br0
eth0
lo
lte0pdn0
lte0pdn1
lte0pdn2
lte0pdn3
lte0pdn4
sit0
tunl0
wlan0
wlan0-vxd

**brctl show**

bridge name	bridge id		STP enabled	interfaces
br0		8000.00017301ff10	no		eth0
							wlan0

What SoC is used in it?
Also,pictures of PCB as well as RAM and flash details

it's based on GCT GDM7243Q

also it's using a toshiba nand 128 mb

i can't add more pictures the forum does not allow me add dots (.) in the links
[fixed by admin]

I am affraid that there is no support in kernel for this SoC and no datasheet

is'nt there a way to dump and reflash the entire firmware it's using uboot as bootloader .
also the linux kernel already supports gdm7243

If firmware on the device is corrupted,how can you then flash that dump?
gdm7243 has a staging driver for LTE modem but not it as SoC

what do you mean by SoC
i got a nand dump from a working device i made a nand dump of each partition of the working device.i can provide the dump if it helps in any way.

thanks

SoC is System on a Chip.
Basically CPU+various memory controllers+USB and networking PHYs

If you got a NAND dump then you most likely can flash it if bootloader is working.
Also,it would be smart to only flash kernel and rootfs as other data is most likely fine and you dont want to loose calibration

The bootloader is working fine on those type of devices the bootloader is uboot the only problem of those devices is that they loose network ( sim 4G network ) not lan network also the wireless is no more accepting password it's getting somehow to default factory wireless config. as i observed the telnet is enabled when somehow some partitions are getting corrupted maybe nvram or some other partition also the webui is changed to some other default manufacturer webui also the password for it no more working i got accidently a working device with telnet enabled that i got the chance to take full dump of the partitions. the other problem is that the uboot is somehow locked you can't interrupt since the bootdelay is equal to 0
i think the uboot must be patched to enable interrupt to be able to flash another device through bootloader .
here i posted in the openwrt forum last time information about the serial output of the device.
https://forum.openwrt.org/viewtopic.php?id=73386&p=1#p372802
any help is appreciated
here i provide the nand dump of the device .

1 Like

the only chips available on the boards are Realtek RTL8192ES
and Realtek 8211FD i think those are related the wireless or lan chips
and there is a chip marked i think is the toshiba chip
1627KLE
ZX0734 China
TC58BYS0S3H

This device is weird

Looking at the datasheet of this SoC at


This is a cost effective LTE wifi solution

You need really the gpl sources for this device.
According of the log and the datasheet you have :

dual armv7 core, one core for linux and one core is used as baseband processor. For the latter one you need a binary blob.

Devices on the SoC (from the log), so you need driver sources for this
gdm-i2c
gdm-uart, maybe you can use "generic" uart here
gdm-nand
gdm-rgmii, gigabit ethernet
gdm-pinmux controler
gdm.gpio
gdm-sdio, for RTL8192ES
gdm-pm, power management
usb2 and usb3 look like Synopsys DesignWare IPs
I'm curently missing the driver for IRQ and clocksource.

Maybe if you have luck, the other IPs may based on Synopsys Ips, but I don't count on that.

Maybe there is more, look at

cat /proc/iomem 
cat /proc/interrupts

here's the output of the two commads

> 
cat /proc/interrupts

           CPU0       
  2:          0  gdm-level  serial0_rx
  3:          0  gdm-level  serial0_tx
 10:          0  gdm-level  gpio0-irq, gpio0-irq
 11:        274  gdm-level  usim
 15:        576  gdm-level  eth0
 16:      72444  gdm-level  sdhci:slot0
 18:     246432  gdm-level  timer
 21:          0  gdm-level  serial1_rx
 22:          0  gdm-level  serial1_tx
 28:          0  gdm-level  rtctmr
 29:          0  gdm-level  gpio1-irq, gpio1-irq
 31:        722  gdm-level  ipcif
 49:          4  gdm-level  dwc3
Err:          0

**cat /proc/iomem**

00000000-00000000 : gdm-pmic
c4000000-c4ffffff : gdm-sflash
  c4000000-c4ffffff : gdm-sflash
d0000000-d4ffffff : System RAM
  d0008000-d03f2093 : Kernel code
  d0412000-d0522aa7 : Kernel data
ec000000-ec3fffff : CMEM
  ec040000-ec0400ff : gdm7243-nand
    ec040000-ec0400ff : gdm7243-nand
  ec0b0000-ec0b10ff : gdm-sdhost
  ec0c0000-ec0c1fff : gdm-rgmii
  ec100000-ec1fffff : dwc3
    ec10c100-ec1fffff : dwc3
  ec200000-ec2fffff : dwc2
fc000000-fc1fffff : CMEM
  fc000590-fc0005a3 : gdm-phy2
    fc000590-fc0005a3 : gdm-phy3
  fc000600-fc000617 : gdm-rtc
  fc006c40-fc006d3f : gdm-timer.0
  fc007400-fc00743f : gdm-pcm
  fc007440-fc0074ff : gdm-i2s
  fc007500-fc00753f : gdm-uart.0
  fc007540-fc00757f : gdm-uart.1
  fc007580-fc0075bf : gdm-uart.2
  fc007600-fc00765f : gdm-uart.3
  fc007780-fc0077ff : gdm-i2c
    fc007780-fc0077ff : gdm-i2c
  fc00c000-fc00c031 : gdm-spi
fe000000-fe1fffff : CMEM
  fe000000-fe0fffff : gdm-lte

well i found another similar device having the same soc
called SerComm Ninja LTE mini PCIe Module
LC4R

here https://fccid.io/P27LC4RT/User-Manual/Users-Manual-pdf-3081110.pdf
the user manual of the related device

for the source codes there's only some modules available in the linux kernel repo

https://android.googlesource.com/kernel/msm/+/android-7.1.0_r0.2/drivers/staging/gdm724x

And this device uses the OTG feature og the dwc2 usb controller, to use this on the PCEe module.All the hardware of the SoC is hidden behind the USB device.
The linux kernel driver is for the USB device on the SoC, which runs
own firmware

Maybe you get the gpl sources from Huawei

.
But you see

Well,its not like they have a choice not to provide GPL sources.
Without those I doubt you will get anywhere

thanks for your replies
well the only problem for this device is the unavailability of the firmware that's why i am looking for an alternative better than throw the device lol.
it's the latest technology of 4G LTE FDD Mimo 4x4 etc of stuff.
if there was a support for openwrt or lede then at least you can use the device as a wireless repeater or better.