Actiontec F2250

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

The Actiontec F2250 is a DSL modem that was distributed by Frontier Communications. It features a dual-core Broadcom MIPS CPU, 128 MB of RAM, 128 MB of NAND flash, 802.11n at 2.4 GHz, and 4 ethernet ports.

Actiontec F2250

Work in progress.

Actiontec GPL source

The GPL sources are pretty straightforward to build; just ensure that you have 32-bit libs installed and everything should go smoothly. It's recommended to build the GPL sources in a VM or a chroot because they will chmod -R 777 your /opt, which will break a lot of programs that install to /opt.

Official firmware images

These files are not referenced by Actiontec or Frontier. They were found by searching the stock firmware for URLs.

CPU Ram Flash Network WLAN USB Serial JTag
BCM63168D0 @ 400 MHz 128 MiB 128 MiB 4x 10/100 b/g/n 1x 2.0 Yes ?

The root password in the stock firmware remains unknown, but there is still an easy method to get a root shell. Hook up to the UART, wait for the router to finish booting, then press Ctrl-\. This will kill the login process and drop you straight into a root shell. Big thank you to whoever filed this CVE.

The Actiontec F2250 has a bunch of GPIOs. The reset and WPS buttons are hooked up to GPIOs, and so are all the LEDs except the ones that indicate ethernet activity. All GPIOs in this device are active low.

GPIO Description pinctrl address
460 Reset button 32
461 WPS button 33
463 LED Power Red 35
464 LED Wi-Fi Green 36
467 LED Wi-Fi Red 39
468 LED DSL1 Green 40
471 LED WPS Green 43
472 LED WPS Red 44
474 LED DSL2 Green 46
477 LED DSL2 Red 49
480 LED Internet Red 0
481 LED Internet Blue 1
488 LED DSL1 Red 8
489 LED USB Green 9
500 LED Power Green 10
Architecture MIPS
Vendor Broadcom
Bootloader CFE
System-On-Chip BCM63168UKFEBG
CPU/Speed 400 MHz
Flash-Chip ESMT F59L1G81A or SK Hynix H27U1G8F2B
Flash size 128 MiB
RAM 128 MiB
Switch BCM53125
USB 1x 2.0
Serial Yes

0x000000000000-0x000000020000 : “nvram”
0x000000020000-0x000000040000 : “tag_update”
0x000000040000-0x000003d80000 : “rootfs_update”
0x000003d80000-0x000003da0000 : “tag”
0x000003da0000-0x000007ae0000 : “rootfs”
0x000007b00000-0x000007f00000 : “data”

Insert photo of front of the casing

Insert photo of back of the casing

Insert photo of backside label

Insert photo of PCB

Use a case opening tool or a guitar pick to undo the snaps that hold on the transparent faceplate with the LED labels. This faceplate must be removed first, because it obscures some screws that must be removed. Then, remove all screws from the underside of the device, and the top half of the case should separate from the bottom easily.

port.serial general information about the serial port, serial port cable, etc.

How to connect to the serial port:

Labeled Serial Port

Serial connection parameters
for Actiontec F2250
115200, 8N1

HELO CPUI L1CI HELO CPUI L1CI DRAM ---- PHYS STRF 400H PHYE DDR2 SIZ4 SIZ3 SIZ2 DINT USYN LSYN MFAS LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN FPS0 BT64 0002 BT65 0493 NAN3 RFS2 NAN5 CFE version 1.0.38-114.185 for BCM963268 (32bit,SP,BE) Build Date: Tue May 9 15:41:37 PDT 2017 (dqi@dqi-ThinkPad-T430) Copyright (C) 2000-2011 Broadcom Corporation. NAND flash device: name ESMT F59L1G81A, id 0x92f1 block 128KB size 131072KB External switch id = 53125 Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 boot load image is: 48 Board IP address : 192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Boot image (0=latest, 1=previous) : 0 Board Id (0-38) : F2250 Number of MAC Addresses (1-32) : 8 Base MAC Address : 10:9f:a9:0f:7a:68 PSI Size (1-64) KBytes : 64 Enable Backup PSI [0|1] : 1 System Log Size (0-256) KBytes : 64 Main Thread Number [0|1] : 0 Board Serial Number : CVYA4070804278 Factory FW Version : F2250-36.128L.02 WPS PIN : 14108709 WPA KEY : eqdb8ynghic32e This is one CFE built for FRONTIER 2250 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 110 Booting from latest image (0xbbd80000) ... Decompression OK! Entry at 0x80336930 Closing network. Disabling Switch ports. Flushing Receive Buffers... 16 buffers found. Closing DMA Channels. Starting program at 0x80336930 Linux version 2.6.30 (dqi@dqi-ThinkPad-T430) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 SMP PREEMPT Tue May 9 15:45:36 PDT 2017 BCM Flash API. Flash device is not found. F2250 prom init DSL SDRAM reserved: 0x180000 Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00007e80 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00007e80 On node 0 totalpages: 32384 free_area_init_node: node 0, pgdat 80429fa0, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 221 pages used for memmap Normal zone: 28067 pages, LIFO batch:7 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32131 Kernel command line: root=mtd:rootfs ro rootfstype=jffs2 console=ttyS0,115200 wait instruction: enabled Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes PID hash table entries: 512 (order: 9, 2048 bytes) Calibrating delay loop... Mount-cache hash table entries: 512 Broadcom Logger v0.1 May 9 2017 15:42:19 Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes Total Flash size: 0K with -1 sectors Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00009a75-00009a70=5<300) registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 SCSI subsystem initialized pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10005fff] pci 0000:00:00.0: supports D1 D2 pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff] pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff] PCI: Setting latency timer of device 0000:01:00.0 to 64 skbFreeTask created successfully BLOG v3.0 Initialized BLOG Rule v1.0 Initialized Broadcom IQoS v0.1 May 9 2017 15:45:03 initialized Broadcom GBPM v0.1 May 9 2017 15:45:03 initialized PCI: Setting latency timer of device 0000:01:00.0 to 64 Driver 'sd' needs updating - please use bus_type methods bcm963xx_mtd driver v2.0 ##init_brcm_physmap exit -->brcmnand_scan: CS=0, numchips=1, csi=0 NAND_CS_NAND_XOR=00000000 Disabling XOR on CS#0 brcmnand_scan: Calling brcmnand_probe for CS=0 B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0 brcmnand_read_id: CS0: dev_id=92f18095 After: NandSelect=40000001, nandConfig=15142200 Block size=00020000, erase shift=17 timing1 not adjusted: 6574845b timing2 not adjusted: 00001e96 brcmnand_adjust_acccontrol: gAccControl[CS=0]=00000000, ACC=f7ff1010 brcmnand_scan: Done brcmnand_probe brcmnand_scan: B4 nand_select = 40000001 brcmnand_scan: After nand_select = 40000001 100 CS=0, chip->ctrl->CS[0]=0 ECC level 15, threshold at 1 bits reqEccLevel=0, eccLevel=15 190 eccLevel=15, chip->ecclevel=15, acc=f7ff1010 brcmnand_scan 10 200 CS=0, chip->ctrl->CS[0]=0 200 chip->ecclevel=15, acc=f7ff1010 brcmnand_scan 220 brcmnand_scan 230 brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000 brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=15, isMLC=0, chip->cellinfo=0 ECC layout=brcmnand_oob_bch4_4k 300 CS=0, chip->ctrl->CS[0]=0 500 chip=87a44190, CS=0, chip->ctrl->CS[0]=0 -->brcmnand_default_bbt brcmnand_default_bbt: bbt_td = bbt_main_descr Bad block table Bbt0 not found for chip on CS0 Bad block table 1tbB not found for chip on CS0 -->brcmnand_isbad_raw(offs=7fe0000 Bad block table written to 0x07fe0000, version 0x01 -->brcmnand_isbad_raw(offs=7fc0000 Bad block table written to 0x07fc0000, version 0x01 brcmnand_scan 99 Creating 6 MTD partitions on "brcmnand.0": 0x000003da0000-0x000007ae0000 : "rootfs" 0x000000040000-0x000003d80000 : "rootfs_update" 0x000007b00000-0x000007f00000 : "data" 0x000000000000-0x000000020000 : "nvram" 0x000003d80000-0x000003da0000 : "tag" 0x000000020000-0x000000040000 : "tag_update" PCI: Enabling device 0000:00:0a.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:0a.0 to 64 ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM PCI: Enabling device 0000:00:09.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:00:09.0 to 64 brcmboard: brcm_board_init entry SES: Button Interrupt 0x1 is enabled sesBtn_mapIntr: is_sesBtn_irq_shared=0, sesBtn_irq=1 SES: LED GPIO 0x802b is enabled PCIe: No device found - Powering down brcm_board_init: isShared=0, rstToDflt_irq=0 Total # RxBds=1448 bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized bcmPktDma_init: Broadcom Packet DMA Library initialized bcmxtmrt: Broadcom BCM3168D0 ATM/PTM Network Device v0.5 May 9 2017 15:44:44 IPSEC SPU: SUCCEEDED GACT probability NOT on Mirror/redirect action on u32 classifier input device check on Actions configured VFS: Mounted root (jffs2 filesystem) readonly on device 31:0. init started: BusyBox v1.17.2 (2017-05-09 15:50:22 PDT) starting pid 228, tty '': '/etc/init.d/rcS' Empty flash at 0x002647c4 ends at 0x00264800 Empty flash at 0x00294d04 ends at 0x00295000 starting pid 234, tty '': '-/bin/sh' BusyBox v1.17.2 (2017-05-09 15:50:22 PDT) built-in shell (ash) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... bcm96368wdt: module license 'unspecified' taints kernel. Disabling lock debugging due to kernel taint brcmchipinfo: brcm_chipinfo_init entry Broadcom Ingress QoS Module Char Driver v0.1 May 9 2017 15:43:03 Registered<243> Broadcom Ingress QoS ver 0.1 initialized BPM: tot_mem_size=134217728B (128MB), buf_mem_size=20132655B (19MB), num of buffers=9460, buf size=2128 Broadcom BPM Module Char Driver v0.1 May 9 2017 15:42:57 Registered<244> [NTC bpm] bpm_set_status: BPM status : enabled  NBUFF v1.0 Initialized Initialized fcache state Broadcom Packet Flow Cache Char Driver v2.2 May 9 2017 15:43:04 Registered<242> Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Broadcom Packet Flow Cache learning via BLOG enabled. Constructed Broadcom Packet Flow Cache v2.2 May 9 2017 15:43:04 chipId 0x631680D0 Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 May 9 2017 15:42:58 Registered <241> Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000 FAP Soft Reset Done 4ke Reset Done FAP Debug values at 0xa5f1e100 0xa5f9e100 Allocated FAP0 GSO Buffers (0xA5F2F188) : 1048576 bytes @ 0xA5800000 Allocated FAP1 GSO Buffers (0xA5FAF188) : 1048576 bytes @ 0xA5900000 Allocated FAP0 TM SDRAM Queue Storage (a5f2f18c) : 341376 bytes @ a5a00000 Allocated FAP1 TM SDRAM Queue Storage (a5faf18c) : 341376 bytes @ a5a80000 [NTC fapProto] fapReset : Reset FAP Protocol layer [FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3968>, free <2688>, total<8192> [FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3968>, free <2688>, total<8192> [FAP0] PSM : addr<0x80002000>, used <23452>, free <1124>, total <24576> [FAP1] PSM : addr<0x80002000>, used <23452>, free <1124>, total <24576> [FAP0] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948 [FAP1] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948 [FAP0] GSO Buffer set to 0xA5800000 [FAP1] GSO Buffer set to 0xA5900000 [FAP0] FAP BPM Initialized. [FAP1] FAP BPM Initialized. fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes bcmPktDma_bind: FAP Driver binding successfull [FAP0] FAP TM: ON [FAP1] FAP TM: ON bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM63168D0 Ethernet Network Device v0.1 May 9 2017 15:44:37 Broadcom GMAC Char Driver v0.1 May 9 2017 15:44:42 Registered<249> Broadcom GMAC Driver v0.1 May 9 2017 15:44:42 Initialized fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000 ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650 fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000 ETH Init: Ch:1 - 200 tx BDs at 0xb0820650 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184 ETH Init: Ch:0 - 600 rx BDs at 0xb0821910 fapDrv_psmAlloc: wastage 8 bytes fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184 ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910 dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered ewan0: MAC Address: 10:9F:A9:0F:7A:68 eth2: MAC Address: 10:9F:A9:0F:7A:68 eth1: MAC Address: 10:9F:A9:0F:7A:68 eth0: MAC Address: 10:9F:A9:0F:7A:68 JFFS2 notice: (231) check_node_data: wrong data CRC in data node at 0x00263f48: read 0x7d82be45, calculated 0x1f14931d. Broadcom BCM3168D0 USB Network Device v0.4a May 9 2017 15:43:10 usb0: MAC Address: 10 9F A9 0F 7A 6B usb0: Host MAC Address: 10 9F A9 0F 7A 6C USBD Initialization done status 0 hub 1-0:1.0: over-current change on port 2 USB Link DOWN. --SMP support wl: dsl_tx_pkt_flush_len=338 wl: high_wmark_tot=6149 PCI: Setting latency timer of device 0000:00:00.0 to 64 wl: passivemode=1 wl: napimode=0 wl0: allocskbmode=1 currallocskbsz=512 Neither SPROM nor OTP has valid image wl:srom/otp not programmed, using main memory mapped srom info(wombo board) wl:loading /etc/wlan/bcm6362_map.bin srom rev:8 wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=16 wl0: Broadcom BCM435f 802.11 Wireless Controller 6.30.102.7.cpeF2250-36.128L09.0 dgasp: kerSysRegisterDyingGaspHandler: wl0 registered p8021ag: p8021ag_init entry -/bin/sh: cmf: not found =====FRONTIER Release Version F2250-36.128L.09/F2250-36.128L.09 (build timestamp 170509_1546) ===== smd:error:23.243:initDls:434:Get Board ID F2250 rm: can't remove '/var/dbus/messagebus.pid': No such file or directory ###Tag1 signature(Actiontec),version(F2250-36.128L.02),version2(F2250-36.128L.02),imageSequence(64) ###Tag2 signature(Actiontec),version(F2250-36.128L.09),version2(F2250-36.128L.09),imageSequence(65) ssk:error:40.391:AEI_rut_addRemoteRemoteGUIRules:2582:ifcName=(null) ssk:error:40.391:AEI_rut_addRemoteRemoteGUIRules:2595:gwIfName=ppp0 ssk:error:40.401:AEI_rut_addRemoteRemoteGUIRules:2615:wanIpadd= allowedlist=(null) ssk:error:40.401:AEI_rut_addRemoteRemoteGUIRules:2617:wanIpadd= ssk:error:40.401:rcl_httpdCfgObject:387: !!! RemoteGui has been disabled!!! iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables v1.4.0: Unknown arg `--to-ports' Try `iptables -h' or 'iptables --help' for more information. iptables: Bad rule (does a matching rule exist in that chain?) Device "br0" does not exist. ssk:error:41.555:rutSys_createHostsFile:1016:fail to get link_local_address of LAN Intf 'br0' Host MIPS Clock divider pwrsaving is enabled DDR Self Refresh pwrsaving is enabled no exist file [/var/autoreservation] error num [2],reason [No such file or directory] ssk:error:42.076:insertModuleByIndex:454:Failed on command . ssk:error:42.076:insertModulesWithDep:349:insmod xt_multiport.ko FAILED in insertModuleByIndex() Netfilter messages via NETLINK v0.30. ifconfig: ioctl 0x8913 failed: No such device WLmngr Daemon is running optarg=0 shmId=0 killall: wlevt: no process killed wlevt is ready for new msg... SIOCSHPNAADMSTATE failed: No such device(19) *** dslThread dslPid=914 BcmAdsl_Initialize=0xC0293430, g_pFnNotifyCallback=0xC02DBC34 AdslCoreLoadImage: Bonding PHY lmemhdr[2]=0x10080000, pAdslLMem[2]=0x10080000 pSdramPHY=0xA7FFFFF8, 0x80800040 0x684 *** XfaceOffset: 0x65790 => 0x65790 *** *** PhySdramSize got adjusted: 0xF9F4C => 0x17F490 *** AdslCoreSharedMemInit: shareMemSize=2896(2896) *** XdslCoreHwReset6306 *** **** SetupReferenceClockTo6306 **** *** XdslCoreHwReset6306 *** AdslCoreHwReset: pLocSbSta=85598000 bkupThreshold=3072 AdslCoreHwReset: AdslOemDataAddr = 0xA7F63200 ***BcmDiagsMgrRegisterClient: 0 *** dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered sh: cmf: not found fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22be0 bytes remaining 584 XTM Init: Ch:0 - 200 rx BDs at 0xb0a22be0 fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a23220 bytes remaining 456 XTM Init: Ch:1 - 16 rx BDs at 0xb0a23220 bcmxtmrt: PTM/ATM Bonding Mode configured in system bcmxtmcfg: gulBondDslMonitorValid = 1 *** dslThread dslPid=914 BcmAdsl_Initialize=0xC0293430, g_pFnNotifyCallback=0xC02DBC34 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered *** XdslCoreHwReset6306 *** iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) sh: syntax error: unexpected word (expecting ")") sh: syntax error: unexpected "(" remove file [/var/url_block_enable] error num [2],reason [No such file or directory] ssk:error:47.572:rcl_wanOpt60Object:373:++++++++newObj->WANOption60=CTL nf_conntrack version 0.5.0 (1024 buckets, 8192 max) ssk:error:48.766:ssk_init:1362:dbus-daemon is ready now. WPS Device PIN = 14108709 < SES_LED_OFF > killall: hspotap: no process killed wlctl: Radio Off Setting SSID: "Frontier_4278" Setting SSID: "Guest_4278" Setting SSID: "Frontier_4278-2" Setting SSID: "Guest_4278" Setting SSID: "wl0_Guest4" wlctl: Unsupported ifconfig: br1: error fetching interface information: Device not found ifconfig: br2: error fetching interface information: Device not found ifconfig: br3: error fetching interface information: Device not found smd:error:51.485:initDls:434:Get Board ID F2250 PMD: Module entry! PMD: couldn't get any msg! PMD: couldn't get any msg! Broadcom Packet Flow Cache learning via BLOG enabled. status=00 Note: Loading 6300 MDK (default) driver for 63168 chip Note: Forcing 53115 driver for 53125 Switch MDK: num_switches = 2 Switch MDK: unit = 0; phy_pbmp = 0x0; config_pbmp = 0x40 Switch MDK link poll thread: unit=1; phypbmp=0xf iptables v1.4.0: Couldn't find target `urlfilter' Try `iptables -h' or 'iptables --help' for more information. iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) captiveEnable=0,webActiveLogEnable=0,webSiteBlockEnable=0 iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) iptables: Bad rule (does a matching rule exist in that chain?) eth0 (switch port: 3) Link UP 100 mbps full duplex ERROR rtd.c:159 fail to recv msg from msg bus! ERROR rtd.c:159 fail to recv msg from msg bus! WARNING tr69_rut_route.c:98 Both PPPConn and IPConn are Disable! WARNING tr69_rut_route.c:98 Both PPPConn and IPConn are Disable! ERROR tr69_func_aei_firewall_rules.c:69 gwifname is null ERROR tr69_rut_wan6.c:2176 NOT found wan connection! ERROR tr69_rut_wan6.c:2176 NOT found wan connection! ERROR tr69_rut_wan6.c:2176 NOT found wan connection! ERROR tr69_rut_wan6.c:2176 NOT found wan connection! ERROR tr69_rut_wan6.c:2176 NOT found wan connection! ERROR tr69_rut_wan6.c:2176 NOT found wan connection!


HELO CPUI L1CI HELO CPUI L1CI DRAM ---- PHYS STRF 400H PHYE DDR2 SIZ4 SIZ3 SIZ2 DINT USYN LSYN MFAS LMBE RACE PASS ---- ZBSS CODE DATA L12F MAIN FPS0 BT64 0002 BT65 0493 NAN3 RFS2 NAN5 CFE version 1.0.38-114.185 for BCM963268 (32bit,SP,BE) Build Date: Tue May 9 15:41:37 PDT 2017 (dqi@dqi-ThinkPad-T430) Copyright (C) 2000-2011 Broadcom Corporation. NAND flash device: name ESMT F59L1G81A, id 0x92f1 block 128KB size 131072KB External switch id = 53125 Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz Main Thread: TP0 Memory Test Passed Total Memory: 134217728 bytes (128MB) Boot Address: 0xb8000000 boot load image is: 48 Board IP address : 192.168.1.1 Host IP address : 192.168.1.100 Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Boot image (0=latest, 1=previous) : 0 Board Id (0-38) : F2250 Number of MAC Addresses (1-32) : 8 Base MAC Address : 10:9f:a9:0f:7a:68 PSI Size (1-64) KBytes : 64 Enable Backup PSI [0|1] : 1 System Log Size (0-256) KBytes : 64 Main Thread Number [0|1] : 0 Board Serial Number : CVYA4070804278 Factory FW Version : F2250-36.128L.02 WPS PIN : 14108709 WPA KEY : eqdb8ynghic32e This is one CFE built for FRONTIER 2250 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 111 CFE> web info: Waiting for connection on socket 0. CFE> ^C CFE> r 192.168.1.100:/openwrt-bcm63xx-smp-actiontec_f2250-initramfs.elf 0x80a00000/4601294 Entry at 0x80a00000 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. Starting program at 0x80a00000 OpenWrt kernel loader for BCM63XX Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org> Copyright (C) 2014 Jonas Gorski <jogo@openwrt.org> Copyright (C) 2020 Alvaro Fernandez Rojas <noltari@gmail.com> Decompressing kernel... done! blasting from 0x80010000 to 0x00ebde01 (0x80010000 - 0x80ecde10) Starting kernel at 80010000... [ 0.000000] Linux version 5.4.174 (bkallus@pistachio) (gcc version 11.2.0 (OpenWrt GCC 11.2.0 r18673+4-b21bc3479d)) #0 SMP Sun Jan 30 04:05:14 2022 [ 0.000000] Detected Broadcom 0x63268 CPU revision d0 [ 0.000000] CPU frequency is 400 MHz [ 0.000000] 128MB of RAM installed [ 0.000000] board_bcm963xx: Boot address 0xb8000000 [ 0.000000] board_bcm963xx: CFE version: 1.0.38-114.185 [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0002a080 (Broadcom BMIPS4350) [ 0.000000] board: board name: F2250 [ 0.000000] MIPS: machine is Actiontec F2250 [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 0.000000] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] percpu: Embedded 14 pages/cpu s26896 r8192 d22256 u57344 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480 [ 0.000000] Kernel command line: console=ttyS0,115200 [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 113344K/131072K available (5982K kernel code, 223K rwdata, 1232K rodata, 8680K init, 207K bss, 17728K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1 [ 0.000000] rcu: Hierarchical RCU implementation. [ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies. [ 0.000000] NR_IRQS: 256 [ 0.000000] random: get_random_bytes called from start_kernel+0x35c/0x58c with crng_init=0 [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 9556302233 ns [ 0.000013] sched_clock: 32 bits at 200MHz, resolution 5ns, wraps every 10737418237ns [ 0.008145] Calibrating delay loop... 398.13 BogoMIPS (lpj=1990656) [ 0.074571] pid_max: default: 32768 minimum: 301 [ 0.079656] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.087156] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.099840] rcu: Hierarchical SRCU implementation. [ 0.105980] smp: Bringing up secondary CPUs ... [ 0.112000] SMP: Booting CPU1... [ 9.188860] Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes. [ 9.188877] Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes [ 9.189148] CPU1 revision is: 0002a080 (Broadcom BMIPS4350) [ 0.175454] Synchronize counters for CPU 1: [ 0.175475] SMP: CPU1 is running [ 0.175494] done. [ 0.205993] smp: Brought up 1 node, 2 CPUs [ 0.220176] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.230322] futex hash table entries: 512 (order: 3, 32768 bytes, linear) [ 0.237481] pinctrl core: initialized pinctrl subsystem [ 0.244378] NET: Registered protocol family 16 [ 0.254203] unsupported NAND flash detected [ 0.309830] clocksource: Switched to clocksource MIPS [ 0.318821] NET: Registered protocol family 2 [ 0.323823] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear) [ 0.332519] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear) [ 0.341236] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.349154] TCP bind hash table entries: 1024 (order: 1, 8192 bytes, linear) [ 0.356438] TCP: Hash tables configured (established 1024 bind 1024) [ 0.363399] UDP hash table entries: 256 (order: 1, 8192 bytes, linear) [ 0.370216] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear) [ 0.377853] NET: Registered protocol family 1 [ 0.382330] PCI: CLS 0 bytes, default 16 [ 0.667854] workingset: timestamp_bits=14 max_order=15 bucket_order=1 [ 0.695206] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.701258] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.722118] bcm63268-pinctrl 100000c0.pin-controller: registered at mmio (ptrval) [ 0.730740] 10000180.serial: ttyS0 at MMIO 0x10000180 (irq = 13, base_baud = 1562500) is a bcm63xx_uart [ 0.740476] printk: console [ttyS0] enabled [ 0.740476] printk: console [ttyS0] enabled [ 0.749046] printk: bootconsole [early0] disabled [ 0.749046] printk: bootconsole [early0] disabled [ 0.765971] bcm63xx-spi 10000800.spi: at [mem 0x10000800-0x10000f0b flags 0x200] (irq 88, FIFOs size 542) [ 0.780946] bcm63xx-wdt bcm63xx-wdt: started, timer margin: 30 sec [ 0.789091] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) [ 0.796233] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) [ 0.803700] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) [ 0.810851] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) [ 0.818003] leds-gpio leds-gpio.0: Skipping unavailable LED gpio 0 ((null)) [ 0.828510] NET: Registered protocol family 10 [ 0.835549] Segment Routing with IPv6 [ 0.839554] NET: Registered protocol family 17 [ 0.844148] 8021q: 802.1Q VLAN Support v1.8 [ 0.959613] Freeing unused kernel memory: 8680K [ 0.964213] This architecture does not have kernel memory protection. [ 0.970886] Run /init as init process [ 1.017570] random: fast init done [ 1.620880] init: Console is alive [ 1.625100] init: - watchdog - [ 1.663785] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 1.702539] usbcore: registered new interface driver usbfs [ 1.708343] usbcore: registered new interface driver hub [ 1.713920] usbcore: registered new device driver usb [ 1.732557] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 1.742341] ehci-fsl: Freescale EHCI Host controller driver [ 1.751462] ehci-platform: EHCI generic platform driver [ 1.877620] ehci-platform ehci-platform: EHCI Host Controller [ 1.883521] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1 [ 1.892040] ehci-platform ehci-platform: irq 18, io mem 0xb0002500 [ 1.937598] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00, overcurrent ignored [ 1.947368] hub 1-0:1.0: USB hub found [ 1.951894] hub 1-0:1.0: 1 port detected [ 1.968150] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 1.976984] ohci-platform: OHCI generic platform driver [ 1.982646] ohci-platform ohci-platform: Generic Platform OHCI controller [ 1.989660] ohci-platform ohci-platform: new USB bus registered, assigned bus number 2 [ 1.997957] ohci-platform ohci-platform: irq 17, io mem 0xb0002600 [ 2.073130] hub 2-0:1.0: USB hub found [ 2.077703] hub 2-0:1.0: 1 port detected [ 2.085030] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 2.103467] init: - preinit - [ 2.548874] random: jshn: uninitialized urandom read (4 bytes read) [ 2.633083] random: jshn: uninitialized urandom read (4 bytes read) [ 2.704947] random: jshn: uninitialized urandom read (4 bytes read) Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 7.149261] procd: - early - [ 7.152692] procd: - watchdog - [ 7.742976] procd: - watchdog - [ 7.748717] procd: - ubus - [ 7.768184] urandom_read: 3 callbacks suppressed [ 7.768197] random: ubusd: uninitialized urandom read (4 bytes read) [ 7.803490] random: ubusd: uninitialized urandom read (4 bytes read) [ 7.810715] random: ubusd: uninitialized urandom read (4 bytes read) [ 7.821807] procd: - init - Please press Enter to activate this console. [ 8.782949] kmodloader: loading kernel modules from /etc/modules.d/* [ 9.034253] PPP generic driver version 2.4.2 [ 9.044664] NET: Registered protocol family 24 [ 9.071309] kmodloader: done loading kernel modules from /etc/modules.d/* [ 9.190830] urngd: v1.0.2 started. [ 9.535315] crng init done [ 9.538117] random: 1 urandom warning(s) missed due to ratelimiting BusyBox v1.35.0 (2022-01-30 04:05:14 UTC) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r18673+4-b21bc3479d ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:/#


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2022/01/30 21:12
  • by kenballus