Sagem F@ST2304

Status: Not supported, WIP

The Sagem 2304N Router is provided along with the Sky Broadband packages. This router is geared with the wireless N technology. It has four available Ethernet ports which can each deliver up to 100 Mbps.

SoC Ram Flash Network USB Serial JTag
BCM6328 64MiB 8MiB 4 x 1 mod Yes ?

Manufacturer's site: (add URL)

Forum old (archived):

Please check out the article flash.layout. It contains an example and a couple of explanations.

Get the firmware

WIP for Wireless drivers,

LEDE Snapshot r2979 2017 WIP for Wireless, LAN Ok
Trunk/Snapshot 2017 Possible OpenWrt Development Snapshot builds?
Trunk/Snapshot 2017 Possible LEDE Development Snapshot builds?

Set a static PC in your computer compatible with, for example

  1. Unplug the power source
  2. Press the RESET button at the router, don't release it yet!
  3. Plug the power source
  4. Wait some seconds
  5. Release the RESET button
  6. Send the new firmware and wait some minutes until the firmware upgrade finish.


If you want to install a firmware using TFTP, follow these steps (as an alternative to the above install process.

  • Connect a serial TTL cable to send commands to CFE via serial console software, for loading the firmware via TFTP.
  • Start a TFTP server in your PC. Copy the firmware.bin file to the TFTP server's directory.
  • Set the IP at your pc to (or any compatible), and connect the ethernet cable to the router.

This is a session of flashing via TFTP:

CFE> f
Loading ...
Finished loading 2686980 bytes

Flashing root file system and kernel at 0xbfc10000: ..........................................

*** Image flash done *** !
Resetting board...\0xff


If you have already installed OpenWrt and like to reflash for e.g. upgrading to a new OpenWrt version you can upgrade using the mtd command line tool. It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing.

LuCI Web Upgrade Process

Terminal Upgrade Process

  • Login as root via SSH on
  • Use the following commands to upgrade.
cd /tmp/
wget http://
sysupgrade /tmp/
  • If sysupgrade does not support this router, use the following commands.
cd /tmp/
wget http://
mtd write /tmp/ linux && reboot

Basic configuration After flashing, proceed with this.
Set up your Internet connection, configure wireless, configure USB port, etc.

The default network configuration is:

Interface Name Description Default configuration
br-lan LAN & WiFi
vlan0 (eth0.0) LAN ports (1 to 4) None
vlan1 (eth0.1) WAN port DHCP
wl0 WiFi Disabled

Numbers 0-3 are Ports 1-4 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 5 is the internal connection to the router itself. Don't be fooled: Port 1 on the unit is number 3 when configuring VLANs. vlan0 = eth0.0, vlan1 = eth0.1 and so on.

Port Switch port
LAN 1 3
LAN 2 2
LAN 3 1
LAN 4 0

hardware.button on howto use and configure the hardware button(s).

Name GPIO Polarity
Reset 23 Active low
8 Power Green 0
9 Power Orange 0
3 Diag Green 0
11 Diag Orange 0
4 WLAN Green 0
5 Internet Orange 0
6 Internet Green 0
7 Internet Red 0

The LAN leds only turn on when wire is plugged in to respective port.

17 LAN1 Green 0
17 LAN1 Orange 1
18 LAN2 Green 0
18 LAN2 Orange 1
19 LAN3 Green 0
19 LAN3 Orange 1
20 LAN4 Green 0
20 LAN4 Orange 1
Instruction set: MIPS
Vendor: Broadcom
bootloader: cfe
Board ID: F@ST2304
System-On-Chip: Broadcom BCM6328
CPU @Frq BMIPS4350 V7.5 @320 MHz
Flash-Chip: Macronix MX25L6445E (SPI)
Flash size 8MiB
RAM-Chip ESMT M14D5121632A-2.5B / DDR2-800
RAM size 64 MiB
Wireless BCM4313 802.11b/g/n (onboard)
Ethernet: Internal BRCM6328 Switch
USB possible with mod
Serial: Yes

Model Number


Photo of front of the casing


Photo of back of the casing

Note: This will void your warranty!

  • To remove the cover do a/b/c

Main PCB

port.serial general information about the serial port, serial port cable, etc.

How to connect to the Serial Port of this specific device:

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device:

Photo of PCB with markings

Currently none.

Currently none.

HELO CPUI L1CI DRAM ---- PHYS ZQDN PHYE DINT LSYN USYN MSYN LMBE PASS ---- ZBSS CODE DATA L12F MAIN CFE version for BCM96328 (32bit,SP,BE) Build Date: Tue Mar 8 14:24:11 CST 2011 (zoucb@SZ01007.DONGGUAN.CN) Copyright (C) 2005-2010 SAGEM Corporation. HS Serial flash device: name MX25L64, id 0xc217 size 8192KB Total Flash size: 8192K with 128 sectors Chip ID: BCM6328B0, MIPS: 320MHz, DDR: 320MHz, Bus: 160MHz Main Thread: TP0 Memory Test Passed Total Memory: 67108864 bytes (64MB) Boot Address: 0xb8000000 Board IP address : Host IP address : Gateway IP address : Run from flash/host (f/h) : f Default host run file name : vmlinux Default host flash file name : bcm963xx_fs_kernel Boot delay (0-9 seconds) : 1 Board Id (0-4) : F@ST2304 Number of MAC Addresses (1-32) : 11 Base MAC Address : 7c:03:4c:7b:45:9d PSI Size (1-64) KBytes : 40 Enable Backup PSI [0|1] : 0 System Log Size (0-256) KBytes : 0 Main Thread Number [0|1] : 0 *** Press any key to stop auto run (1 seconds) *** Auto run second count down: 110 Booting from only image (0xb8010000) ... Code Address: 0x80010000, Entry Address: 0x80014230 Decompression OK! Entry at 0x80014230 Closing network. Disabling Switch ports. Flushing Receive Buffers... 0 buffers found. Closing DMA Channels. Starting program at 0x80014230 Linux version 2.6.30 (cookiechen@SZ01007.DONGGUAN.CN) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 Tue Aug 2 16:07:49 CST 2011 HS Serial flash device: name MX25L64, id 0xc217 size 8192KB F@ST2304 prom init CPU revision is: 0002a075 (Broadcom4350) Determined physical RAM map: memory: 03f00000 @ 00000000 (usable) Zone PFN ranges: DMA 0x00000000 -> 0x00001000 Normal 0x00001000 -> 0x00003f00 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00003f00 On node 0 totalpages: 16128 free_area_init_node: node 0, pgdat 80270750, node_mem_map 81000000 DMA zone: 32 pages used for memmap DMA zone: 0 pages reserved DMA zone: 4064 pages, LIFO batch:0 Normal zone: 94 pages used for memmap Normal zone: 11938 pages, LIFO batch:1 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16002 Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200 wait instruction: enabled Primary instruction cache 32kB, VIPT, 4-way, linesize 16 bytes. Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes RCU-based detection of stalled CPUs is enabled. NR_IRQS:128 PID hash table entries: 256 (order: 8, 1024 bytes) console [ttyS0] enabled Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Memory: 61096k/64512k available (2025k kernel code, 3396k reserved, 412k data, 112k init, 0k highmem) Calibrating delay loop... 319.48 BogoMIPS (lpj=159744) Mount-cache hash table entries: 512 net_namespace: 812 bytes NET: Registered protocol family 16 Total Flash size: 8192K with 2048 sectors registering PCI controller with io_map_base unset registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 pci 0000:01:00.0: PME# supported from D0 D3hot pci 0000:01:00.0: PME# disabled pci 0000:02:00.0: reg 10 64bit mmio: [0x000000-0x003fff] pci 0000:02:00.0: supports D1 D2 pci 0000:01:00.0: PCI bridge, secondary bus 0000:02 pci 0000:01:00.0: IO window: disabled pci 0000:01:00.0: MEM window: 0x10f00000-0x10ffffff pci 0000:01:00.0: PREFETCH window: disabled PCI: Enabling device 0000:01:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:01:00.0 to 64 BLOG v2.1 Initialized NET: Registered protocol family 8 NET: Registered protocol family 20 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 squashfs: version 4.0 (2009/01/31) Phillip Lougher squashfs: version 4.0 with LZMA457 ported by BRCM msgmni has been set to 119 io scheduler noop registered (default) pcieport-driver 0000:01:00.0: device [14e4:6328] has invalid IRQ; check vendor BIOS PCI: Setting latency timer of device 0000:01:00.0 to 64 PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered NET: Registered protocol family 24 bcm963xx_mtd driver v1.0 File system address: 0xb8010100 brcmboard: brcm_board_init entry kerSysScreenPciDevices: 0x14e4:0x6328:(slot 0) detected kerSysScreenPciDevices: 0x14e4:0x4313:(slot 0) detected SES: Button Interrupt 0x1 is enabled Serial: BCM63XX driver $Revision: 3.00 $ ttyS0 at MMIO 0xb0000100 (irq = 36) is a BCM63XX ttyS1 at MMIO 0xb0000120 (irq = 36) is a BCM63XX bcmxtmrt: Broadcom BCM6328B0 ATM/PTM Network Device v0.3 Aug 2 2011 16:05:06 Broadcom Logger v0.1 Aug 2 2011 16:03:19 TCP cubic registered Initializing XFRM netlink socket NET: Registered protocol family 17 NET: Registered protocol family 15 Initializing MCPD Module Ebtables v2.0 registered ebt_time registered ebt_ftos registered ebt_wmm_mark registered 802.1Q VLAN Support v1.8 Ben Greear <> All bugs added by David S. Miller <> VFS: Mounted root (squashfs filesystem) readonly on device 31:0. Freeing unused kernel memory: 112k freed init started: BusyBox v1.00 (2011.08.02-08:10+0000) multi-call binary mount: Mounting none on /proc/bus/usb failed: No su BusyBox v1.00 (2011.08.02-08:10+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands. Loading drivers and kernel modules... pktflow: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint Broadcom Packet Flow Cache Char Driver v2.1 Mar 18 2010 21:39:51 Registered<242> NBUFF v1.0 Initialized Broadcom Packet Flow Cache learning via BLOG enabled. Created Proc FS /procfs/fcache Broadcom Packet Flow Cache registered with netdev chain Constructed Broadcom Packet Flow Cache v2.1 Mar 18 2010 21:39:50 bcmxtmcfg: bcmxtmcfg_init entry adsl: adsl_init entry Broadcom BCM6328B0 Ethernet Network Device v0.1 Aug 2 2011 16:03:28 dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered eth0: MAC Address: 7C:03:4C:7B:45:9D eth1: MAC Address: 7C:03:4C:7B:45:9D eth2: MAC Address: 7C:03:4C:7B:45:9D eth3: MAC Address: 7C:03:4C:7B:45:9D PCI: Enabling device 0000:02:00.0 (0000 -> 0002) PCI: Setting latency timer of device 0000:02:00.0 to 64 otp_read_pci: bad crc wl:not strapped or invalid data wl:srom not detected,using main memory mapped srom info(wombo board) wl:loading /etc/wlan/bcm4313_map.bin wl0: Broadcom BCM4313 802.11 Wireless Controller dgasp: kerSysRegisterDyingGaspHandler: wl0 registered Broadcom 802.1Q VLAN Interface, v0.1 ===== Release Version 5.23.1 (build timestamp 110802_1824) ===== Got primary config file from flash (len=34362), validating.... ip_tables: (C) 2000-2006 Netfilter Core Team nf_conntrack version 0.5.0 (1008 buckets, 4032 max) device eth0 entered promiscuous mode device eth1 entered promiscuous mode device eth2 entered promiscuous mode device eth3 entered promiscuous mode device wl0 entered promiscuous mode br0: port 5(wl0) entering forwarding state WLmngr Daemon is running optarg=0 shmId=0 BcmAdsl_Initialize=0xC00B6100, g_pFnNotifyCallback=0xC00DC7D4 wlevt_init@107: opened loopback socket 4 wlevt is ready for new msg... pSdramPHY=0xA3FFFFF8, 0x1A6CB 0x5EADBEEF AdslCoreSharedMemInit: shareMemAvailable=491424 AdslCoreHwReset: AdslOemDataAddr = 0xA3F69564 dgasp: kerSysRegisterDyingGaspHandler: dsl0 registered Netfilter messages via NETLINK v0.30. monitor task is initialized pid= 190 rupgrade:error:13.405:ruReadMessageFromSmd:22:got SYSTEM_BOOT msg rupgrade:error:13.406:ruUpdateWaitHour:1074:update wait hour: 0 rupgrade:error:14.071:ruGetConfig:174:The remote server is 31 rupgrade:error:14.072:ruGetConfig:198:The post server is device wl0 left promiscuous mode br0: port 5(wl0) entering disabled state device wl0 entered promiscuous mode br0: port 5(wl0) entering forwarding state wl0.1 (): not using net_device_ops yet wl0.2 (): not using net_device_ops yet wl0.3 (): not using net_device_ops yet br0: port 5(wl0) entering disabled state There is no Predefined DevicePin in CFE WPS Device PIN = 21464065 Setting SSID: "SKYB459D" Setting SSID: "wl0_Guest1" Setting SSID: "wl0_Guest2" Setting SSID: "wl0_Guest3" wlmngr_wlIfcDown: reset wifi_up_time wlmngr_wlIfcDown: reset wifi_up_time wlmngr_wlIfcDown: reset wifi_up_time wlmngr_wlIfcDown: reset wifi_up_time wlctl: Unsupported chanspec 0x2b06 selected device wl0 left promiscuous mode br0: port 5(wl0) entering disabled state device wl0 entered promiscuous mode br0: port 5(wl0) entering forwarding state Reaped 762 UPnP daemon is ready to run wlmngr_wlIfcUp: wifi_up_time=22 BCM96328 Broadband Router Login: admin Password: sky


This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2022/02/23 15:30
  • by danitool