Startup log of the Swisscom Internet-Box Light

gistfile1.txt

D%G----
BTL1
V1.1
CPUI
L1CI
PMCI
PMCS
AFEL
PWRZ
MEML
PMCD
CPUI
L1CI
ZBSS
CODE
DATA
L12F
MAIN
OTP?
MFGZ
OTPP
USBT
SNAN
PASS
----
HELO
CPUI
L1CI
4.1602-1.0.38-116.118
PMCI
PMCM
DRAM
----
PHYS
PHYE
DDR1
400H
SIZ4
SIZ3
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
FPS0
BT04
0025
BT03
0464
NAN3
RFS1
NAN5


Base: 4.16_02A
Starlink Bootloader Version 00.03.07
CFE version 1.0.38-116.140 for BCM963381 (32bit,SP,BE)
Build Date: Wed Jul  1 18:47:07 CST 2015 (root@ubuntu)
Copyright (C) 2000-2013 Broadcom Corporation.

Chip ID: BCM63381B0, MIPS: 600MHz, DDR: 400MHz, Bus: 300MHz
Main Thread: TP0
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000

SPI NAND flash device: GigaDevice GD5F1GQ4UB, id 0xc8d1 block 128KB size 131072KB
pmc_init:PMC using DQM mode
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host/tftp (f/h/c)  : f  
Default host run file name        : vmlinux  
Default host flash file name      : Starlink_FW.img  
Boot delay (0-9 seconds)          : 1  
Boot image (0=latest, 1=previous) : 0  
Default host ramdisk file name    :   
Default ramdisk store address     :   
Board Id (0-8)                    : RTV1900VW  
Number of MAC Addresses (1-32)    : 10  
Base MAC Address                  : d8:fb:5e:07:b4:27  
PSI Size (1-64) KBytes            : 64  
Enable Backup PSI [0|1]           : 0  
System Log Size (0-256) KBytes    : 0  
Auxillary File System Size Percent: 0  
Main Thread Number [0|1]          : 0  
WLan Feature                      : 0x00  
Voice Board Configuration (0-1)   : SI32176_DCX81  

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Booting from latest image (address 0xb8320000, flash offset 0x00320000) ...
Decompression OK!
Entry at 0x8038c510
Starting program at 0x8038c510
Linux version 3.4.11-rt19 (jenkins@sahwbld04) (gcc version 4.6.2 (SoftAtHome 1.0.1) ) #1 SMP PREEMPT Wed Oct 11 18:59:08 CEST 2017
RTV1900VW prom init
CPU revision is: 0002a081 (Broadcom BMIPS4350)
DSL SDRAM reserved: 0x132000
RAMOOPS reserved: 0x8000
Determined physical RAM map:
 memory: 03ec6000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  DMA      0x00000000 -> 0x00001000
  Normal   0x00001000 -> 0x00003ec6
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000000 -> 0x00003ec6
On node 0 totalpages: 16070
free_area_init_node: node 0, pgdat 80462020, node_mem_map 81000000
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 94 pages used for memmap
  Normal zone: 11880 pages, LIFO batch:1
PERCPU: Embedded 7 pages/cpu @81083000 s5376 r8192 d15104 u32768
pcpu-alloc: s5376 r8192 d15104 u32768 alloc=8*4096
pcpu-alloc: [0] 0 [0] 1 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 15944
Kernel command line: ro noinitrd  irqaffinity=0
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Memory: 58688k/64280k available (3625k kernel code, 5592k reserved, 800k data, 232k init, 0k highmem)
Preemptible hierarchical RCU implementation.
NR_IRQS:128
console [ttyS0] enabled
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0
Calibrating delay loop... 598.01 BogoMIPS (lpj=299008)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
--Kernel Config--
  SMP=1
  PREEMPT=1
  DEBUG_SPINLOCK=0
  DEBUG_MUTEXES=0
Broadcom Logger v0.1 Oct 11 2017 18:56:28
CPU revision is: 0002a081 (Broadcom BMIPS4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Brought up 2 CPUs
NET: Registered protocol family 16
pmc_init:PMC using DQM mode
registering PCI controller with io_map_base unset
bcm63xx_pcie: setting resistor calibration value to 0x0
bcm63xx_pcie: applying serdes parameters
CONFIG_PCIE_SSC: Enabled SSC
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x10600000-0x106fffff]
pci_bus 0000:00: root bus resource [io  0x11700000-0x1170ffff]
pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310
pci 0000:00:09.0: reg 10: [mem 0x1000c400-0x1000c4ff]
pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320
pci 0000:00:0a.0: reg 10: [mem 0x1000c300-0x1000c3ff]
PCI host bridge to bus 0000:01
pci_bus 0000:01: root bus resource [mem 0xa0000000-0xbfffffff]
pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
pci 0000:01:00.0: [14e4:6338] type 01 class 0x060400
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PCI bridge to [bus 02-02]
bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated
skbFreeTask created successfully
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Oct 11 2017 18:59:01 initialized
Broadcom GBPM v0.1 Oct 11 2017 18:59:01 initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
NET: Registered protocol family 1
PCI: CLS 16 bytes, default 16
init_bcm_tstamp: unhandled mips_hpt_freq=300000000, adjust constants in bcm_tstamp.c
bcm_tstamp initialized, (hpt_freq=300000000 2us_div=300 2ns_mult=0 2ns_shift=0)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
msgmni has been set to 114
io scheduler noop registered (default)
ramoops: attached 0x8000@0x3ec6000 (2x0x4000)
brd: module loaded
loop: module loaded
SPI NAND Device Linux Registration
SPI NAND Linux Registration
SPI NAND device reset
Found SPI NAND device GigaDevice GD5F1GQ4UB
SPI NAND device GigaDevice GD5F1GQ4UB
   device id    = 0xc8d1
   page size    = 0x800
   block size   = 0x20000
   total blocks = 0x400
   total size   = 0x8000000
NAND device: Manufacturer ID: 0xc8, Chip ID: 0xd1 (Gigadevice NAND 128MiB 3,3V 8-bit)
NAND_ECC_NONE selected by board driver. This is not recommended!
***** Found UBIFS Marker at 0x0063ff00
***** Found UBIFS Marker at 0x03d1ff00
Creating 12 MTD partitions on "GigaDevice GD5F1GQ4UB":
0x000000640000-0x000003a00000 : "rootfs"
Bad Block 0x153 found (address 0x2a60000)
0x000003d20000-0x0000070e0000 : "rootfs_update"
Bad Block 0x300 found (address 0x6000000)
0x0000070e0000-0x000007500000 : "user"
0x000000000000-0x000000020000 : "nvram"
0x000000020000-0x0000000a0000 : "rip_ro"
0x0000000a0000-0x0000002a0000 : "boot_opt"
0x0000002a0000-0x000000320000 : "rip_rw"
0x000007500000-0x000007f00000 : "ext"
0x000000320000-0x000003a00000 : "image"
Bad Block 0x153 found (address 0x2a60000)
0x000003a00000-0x0000070e0000 : "image_update"
Bad Block 0x300 found (address 0x6000000)
0x000000320000-0x000000640000 : "bootfs"
0x000003a00000-0x000003d20000 : "bootfs_update"
UBI: attaching mtd0 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
Bad Block 0x153 found (address 0x2a60000)
UBI: max. sequence number:       2
UBI: attached mtd0 to ubi0
UBI: MTD device name:            "rootfs"
UBI: MTD device size:            51 MiB
UBI: number of good PEBs:        413
UBI: number of bad PEBs:         1
UBI: number of corrupted PEBs:   0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 413
UBI: number of PEBs reserved for bad PEB handling: 4
UBI: max/mean erase counter: 1/0
UBI: image sequence number:  0
UBI: background thread "ubi_bgt0d" started, PID 262
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <[email protected]>
PPP generic driver version 2.4.2
NET: Registered protocol family 24
hso: drivers/net/usb/hso.c: Option Wireless
usbcore: registered new interface driver hso
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver cdc_ncm
usbcore: registered new interface driver qmi_wwan
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
ehci_hcd 0000:00:0a.0: setting latency timer to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 113, io mem 0x1000c300
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ohci_hcd 0000:00:09.0: setting latency timer to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 112, io mem 0x1000c400
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver usblp
usbcore: registered new interface driver cdc_wdm
usbcore: registered new interface driver usbserial
usbcore: registered new interface driver usbserial_generic
USB Serial support registered for generic
usbserial: USB Serial Driver core
usbcore: registered new interface driver option
USB Serial support registered for GSM modem (1-port)
i2c /dev entries driver
SoftAtHome Button driver has been initialized
brcmboard: brcm_board_init entry
DYING GASP IRQ initialized 
Registered led device: led_0
Registered led device: led_1
Registered led device: led_2
Registered led device: led_3
Registered led device: led_4
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xb0000280 (irq = 8) is a BCM63XX
ttyS1 at MMIO 0xb00002a0 (irq = 9) is a BCM63XX
Total # RxBds=833
WARNING: # of RXBDs > (buffers*2/3)
WARNING: less buffers available for BPM
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized

u32 classifier
    input device check on
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (917 buckets, 3668 max)
ctnetlink v0.93: registering with nfnetlink.
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Initializing MCPD Module
Ebtables v2.0 registered
8021q: 802.1Q VLAN Support v1.8
UBIFS: mounted UBI device 0, volume 0, name "rootfs_ubifs"
UBIFS: mounted read-only
UBIFS: file system size:   50028544 bytes (48856 KiB, 47 MiB, 394 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: zlib
UBIFS: reserved for root:  0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) readonly on device 0:10.
Freeing unused kernel memory: 232k freed
init started: BusyBox v1.13.3 (2017-10-11 19:20:16 CEST)
starting pid 311, tty '': '/etc/init.d/sysinit'

SYSINIT

SoftAtHome HGW version: SCCHSS08.04.26#00
Compiled on sahwbld04.be.softathome.com, Wed, 11 Oct 2017 19:28:08 +0200
With toolchain gcc version: mips-unknown-linux-uclibc-gcc (SoftAtHome 1.0.1) 4.6.2

Mounting tmpfs filesystem (/tmp) ...



UBI: attaching mtd7 to ubi1
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       74
UBI: attached mtd7 to ubi1
UBI: MTD device name:            "ext"
UBI: MTD device size:            10 MiB
UBI: number of good PEBs:        80
UBI: number of bad PEBs:         0
UBI: number of corrupted PEBs:   0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 80
UBI: number of PEBs reserved for bad PEB handling: 2
UBI: max/mean erase counter: 3/1
UBI: image sequence number:  -298777425
UBI: background thread "ubi_bgt1d" started, PID 577
UBI device number 1, total 80 LEBs (10158080 bytes, 9.7 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
mount: mounting ubi0:ext on /ext failed: No such device
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 1, volume 0, name "ext"
UBIFS: file system size:   8253440 bytes (8060 KiB, 7 MiB, 65 LEBs)
UBIFS: journal size:       1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  389830 bytes (380 KiB)
panic_on_page_allocation_failure flag is not present in this kernel release...
wlctl: wl driver adapter not found
ifconfig: SIOCSIFHWADDR: No such device
wlctl: wl driver adapter not found
Note: Loading 6300 MDK (default) driver for 63381 chip 
Switch MDK: num_switches = 1
Switch MDK: unit = 0; phy_pbmp = 0x3; config_pbmp = 0x3 
Switch MDK link poll thread: unit=0; phypbmp=0x3 config_pbmp=0x3
 upgrade_lib_HardCo hco_upgrade_init 
/bin/wlctl: wl driver adapter not found
/bin/wlctl: wl driver adapter not found
 upgrade_lib_HardCo hco_upgrade_init 
wlctl: wl driver adapter not found

internetbox login: Loading gmap modules ...
Starting gmap module processes ...
gMap started.
Starting system message bus
Starting cwmpd
find: /usr/lib/debug/: No such file or directory
 upgrade_lib_HardCo hco_upgrade_init 
chown: unknown user/group figaro:pcb_users
Stopping system message bus

Hash of the root password (entry in shadow):

root:$6$CqTkaVBj$TB711.hqveZhaXHD3iQyt.4rds91G/Hb0y6YJUycoLFZMRv/cWQ2SOndd/CnTdwCaZCkDDRqnBGfOG9jYPOdv/:::::::

@rettichschnidi, I can confirm from a firmware analysis that the root password Hash in the same for the Internet-Box plus.

As well in the second firmware "Application" (Current application firmware for Internet-Box plus (November 2019)) There's the following user and hashed password (SHA256):

serial:$5$tWttWXTLD4q6NUg$fLdXm8JZSTWKYu/rdSli9FniIjgIMv94SHmrpY4ca03:::::::