Ok, so some progress on my branded F3.
I set root password in console, and i got access to LUCI in webbrowser btw.
Although it now is completely dead, after i couldnt get SCP/SSH access to upload ubi file and decided to restart it.
ROM VER: 1.1.4
CFG 04
UART
**************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************
U-Boot 2014.01-openwrt2 (Nov 15 2014 - 14:06:52) P-2812HNU-Fx
Board: ZyXEL P-2812HNU-Fx
SoC: Lantiq VRX288 v1.2
CPU: 125 MHz
IO: 125 MHz
BUS: 125 MHz
BOOT: UART
DRAM: 256 MiB
Flash: 8 MiB
NAND: 128 MiB
Using default environment
In: serial
Out: serial
Err: serial
Net: ltq-eth
P-2812HNU-Fx # tftp 0x80800000 openwrt-lantiq-xrx200-P2812HNUF3-uImage
ltq_phy: addr 0, link 1, speed 1000, duplex 1
ltq_phy: addr 1, link 0, speed 10, duplex 0
ltq_phy: addr 17, link 0, speed 100, duplex 0
ltq_phy: addr 19, link 0, speed 100, duplex 0
ltq_phy: addr 5, link 0, speed 10, duplex 0
Using ltq-eth device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-lantiq-xrx200-P2812HNUF3-uImage'.
Load address: 0x80800000
Loading: #################################################################
#####################################
2.1 MiB/s
done
Bytes transferred = 1493451 (16c9cb hex)
P-2812HNU-Fx # nand erase.chip
NAND erase.chip: device 0 whole chip
Skipping bad block at 0x02da0000
Skipping bad block at 0x03600000
Skipping bad block at 0x05160000
Skipping bad block at 0x05a80000
Skipping bad block at 0x06f20000
Skipping bad block at 0x07340000
Erasing at 0x7fe0000 -- 100% complete.
OK
P-2812HNU-Fx # nand write 0x80800000 0x60000 0x200000
NAND write: device 0 offset 0x60000, size 0x200000
2097152 bytes written: OK
P-2812HNU-Fx # tftpboot 0x80800000 openwrt-lantiq-xrx200-P2812HNUF3-uImage-initramfs
ltq_phy: addr 0, link 1, speed 1000, duplex 1
ltq_phy: addr 1, link 0, speed 10, duplex 0
ltq_phy: addr 17, link 0, speed 100, duplex 0
ltq_phy: addr 19, link 0, speed 100, duplex 0
ltq_phy: addr 5, link 0, speed 10, duplex 0
Using ltq-eth device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-lantiq-xrx200-P2812HNUF3-uImage-initramfs'.
Load address: 0x80800000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#####################################
2.2 MiB/s
done
Bytes transferred = 4348072 (4258a8 hex)
P-2812HNU-Fx # bootm 0x80800000
## Booting kernel from Legacy Image at 80800000 ...
Image Name: MIPS OpenWrt Linux-3.14.25
Created: 2014-11-30 16:59:59 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 4348008 Bytes = 4.1 MiB
Load Address: 80002000
Entry Point: 80002000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 3.14.25 (sylwek@WRT) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r43437) ) #8 Sun Nov 30 17:59:39 CET 2014
[ 0.000000] SoC: VR9 rev 1.2
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019556 (MIPS 34Kc)
[ 0.000000] MIPS: machine is P2812HNUF3 - ZyXEL P-2812HNU-F3
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x00000000-0x07ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00000000-0x07ffffff]
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512
[ 0.000000] Kernel command line: console=ttyLTQ0,115200 init=/etc/preinit
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Writing ErrCtl register=00030aa0
[ 0.000000] Readback ErrCtl register=00030aa0
[ 0.000000] Memory: 122500K/131072K available (3181K kernel code, 152K rwdata, 900K rodata, 2916K init, 201K bss, 8572K reserved)
[ 0.000000] NR_IRQS:256
[ 0.000000] CPU Clock: 125MHz
[ 0.004000] Calibrating delay loop... 4.76 BogoMIPS (lpj=9536)
[ 0.068000] pid_max: default: 32768 minimum: 301
[ 0.080000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.084000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.216000] pinctrl core: initialized pinctrl subsystem
[ 0.228000] NET: Registered protocol family 16
[ 0.576000] pinctrl-xway 1e100b10.pinmux: Init done
[ 0.620000] dma-xway 1e104100.dma: Init done - hw rev: 7, ports: 7, channels: 28
[ 0.776000] dcdc-xrx200 1f106a00.dcdc: Core Voltage : 1016 mV
[ 0.824000] arch/mips/pci/ifxmips_pcie_vr9.h:pcie_device_rst_assert[185]
[ 0.936000] arch/mips/pci/ifxmips_pcie_vr9.h:pcie_device_rst_deassert[193]
[ 1.296000] bio: create slab <bio-0> at 0
[ 1.348000] gpio-stp-xway 1e100bb0.stp: Init done
[ 1.424000] usbcore: registered new interface driver usbfs
[ 1.436000] usbcore: registered new interface driver hub
[ 1.448000] usbcore: registered new device driver usb
[ 1.476000] PCI host bridge to bus 0000:00
[ 1.480000] pci_bus 0000:00: root bus resource [mem 0x1c000000-0x1cffffff]
[ 1.484000] pci_bus 0000:00: root bus resource [io 0x1d800000-0x1d8fffff]
[ 1.488000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 1.492000] ifx_pcie_rc_class_early_fixup: fixed pcie host bridge to pci-pci bridge
[ 1.568000] pci 0000:00:00.0: BAR 8: assigned [mem 0x1c000000-0x1c0fffff]
[ 1.572000] pci 0000:01:00.0: BAR 0: assigned [mem 0x1c000000-0x1c00ffff]
[ 1.576000] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 1.580000] pci 0000:00:00.0: bridge window [mem 0x1c000000-0x1c0fffff]
[ 1.584000] ifx_pcie_bios_map_irq port 0 dev 0000:00:00.0 slot 0 pin 1
[ 1.588000] ifx_pcie_bios_map_irq dev 0000:00:00.0 irq 144 assigned
[ 1.592000] ifx_pcie_bios_map_irq port 0 dev 0000:01:00.0 slot 0 pin 1
[ 1.596000] ifx_pcie_bios_map_irq dev 0000:01:00.0 irq 144 assigned
[ 1.648000] Switched to clocksource MIPS
[ 1.804000] NET: Registered protocol family 2
[ 1.904000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 1.916000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 1.924000] TCP: Hash tables configured (established 1024 bind 1024)
[ 1.936000] TCP: reno registered
[ 1.940000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 1.948000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 1.976000] NET: Registered protocol family 1
[ 33.044000] random: nonblocking pool is initialized
[ 409.452000] gptu: totally 6 16-bit timers/counters
[ 409.472000] gptu: misc_register on minor 63
[ 409.476000] gptu: succeeded to request irq 126
[ 409.484000] gptu: succeeded to request irq 127
[ 409.488000] gptu: succeeded to request irq 128
[ 409.496000] gptu: succeeded to request irq 129
[ 409.500000] gptu: succeeded to request irq 130
[ 409.508000] gptu: succeeded to request irq 131
[ 409.596000] phy-xrx200 gphy-xrx200.5: failed to load firmware filename
[ 409.604000] phy-xrx200: probe of gphy-xrx200.5 failed with error -22
[ 409.696000] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 409.720000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 409.728000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 409.768000] msgmni has been set to 239
[ 409.792000] io scheduler noop registered
[ 409.796000] io scheduler deadline registered (default)
[ 409.848000] 1e100c00.serial: ttyLTQ0 at MMIO 0x1e100c00 (irq = 112, base_baud = 0) is a lantiq,asc
[ 409.860000] console [ttyLTQ0] enabled
[ 409.860000] console [ttyLTQ0] enabled
[ 409.868000] bootconsole [early0] disabled
[ 409.868000] bootconsole [early0] disabled
[ 409.960000] lantiq nor flash device: 00800000 at 10000000
[ 409.968000] ltq_nor: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022cb
[ 409.980000] Amd/Fujitsu Extended Query Table at 0x0040
[ 409.984000] Amd/Fujitsu Extended Query version 1.1.
[ 409.992000] number of CFI chips: 1
[ 409.996000] 3 ofpart partitions found on MTD device ltq_nor
[ 410.000000] Creating 3 MTD partitions on "ltq_nor":
[ 410.008000] 0x000000000000-0x000000050000 : "uboot"
[ 410.092000] 0x000000050000-0x000000060000 : "uboot-env"
[ 410.176000] 0x000000060000-0x000000800000 : "unused"
[ 410.288000] nand: device found, Manufacturer ID: 0xec, Chip ID: 0xf1
[ 410.288000] nand: Samsung NAND 128MiB 3,3V 8-bit
[ 410.288000] nand: 128MiB, SLC, page size: 2048, OOB size: 64
[ 410.304000] Scanning device for bad blocks
[ 410.552000] Bad eraseblock 365 at 0x000002da0000
[ 410.600000] Bad eraseblock 432 at 0x000003600000
[ 410.748000] Bad eraseblock 651 at 0x000005160000
[ 410.800000] Bad eraseblock 724 at 0x000005a80000
[ 410.916000] Bad eraseblock 889 at 0x000006f20000
[ 410.940000] Bad eraseblock 922 at 0x000007340000
[ 411.012000] 4 ofpart partitions found on MTD device 14000000.nand-parts
[ 411.020000] Creating 4 MTD partitions on "14000000.nand-parts":
[ 411.028000] 0x000000000000-0x000000040000 : "unused"
[ 411.116000] 0x000000040000-0x000000060000 : "unused"
[ 411.200000] 0x000000060000-0x000000260000 : "kernel"
[ 411.288000] 0x000000260000-0x000008000000 : "ubi"
[ 411.732000] libphy: lantiq,xrx200-mdio: probed
[ 411.880000] net-xrx200: invalid MAC, using random
[ 411.952000] eth0: attached PHY [Lantiq XWAY PEF7071] (phy_addr=0:00, irq=-1)
[ 412.024000] eth0: attached PHY [Lantiq XWAY PEF7071] (phy_addr=0:01, irq=-1)
[ 412.096000] eth0: attached PHY [Lantiq XWAY VR9 GPHY 11G v1.4] (phy_addr=0:11, irq=-1)
[ 412.168000] eth0: attached PHY [Lantiq XWAY VR9 GPHY 11G v1.4] (phy_addr=0:13, irq=-1)
[ 412.240000] eth0: attached PHY [Lantiq XWAY PEF7071] (phy_addr=0:05, irq=-1)
[ 412.316000] wdt 1f8803f0.watchdog: Init done
[ 412.544000] TCP: cubic registered
[ 412.548000] NET: Registered protocol family 17
[ 412.556000] 8021q: 802.1Q VLAN Support v1.8
[ 412.704000] UBI: auto-attach mtd6
[ 412.704000] UBI: attaching mtd6 to ubi0
[ 413.756000] UBI: scanning is finished
[ 413.760000] UBI: empty MTD device detected
[ 414.020000] UBI: attached mtd6 (name "ubi", size 125 MiB) to ubi0
[ 414.028000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes
[ 414.032000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 512
[ 414.040000] UBI: VID header offset: 512 (aligned 512), data offset: 2048
[ 414.048000] UBI: good PEBs: 999, bad PEBs: 6, corrupted PEBs: 0
[ 414.056000] UBI: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 414.060000] UBI: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2713530904
[ 414.072000] UBI: available PEBs: 981, total reserved PEBs: 18, PEBs reserved for bad PEB handling: 14
[ 414.376000] Freeing unused kernel memory: 2916K (80427000 - 80700000)
[ 414.388000] UBI: background thread "ubi_bgt0d" started, PID 246
[ 415.108000] eth0: port 0 got link
procd: Console is alive
procd: - watchdog -
[ 420.972000] SCSI subsystem initialized
[ 421.568000] IFXUSB: ifxusb_hcd: version 3.2 B110801
[ 421.624000] Chip Version :000b BurstSize=4
[ 422.316000] IFXUSB: USB core #0 soft-reset
[ 422.664000] IFXUSB: USB core #0 soft-reset
[ 422.668000] ifxusb_hcd ifxusb_hcd: IFX USB Controller
[ 422.676000] ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 1
[ 422.688000] ifxusb_hcd ifxusb_hcd: irq 62, io mem 0xbe101000
[ 422.692000] IFXUSB: Init: Power Port (0)
[ 422.844000] hub 1-0:1.0: USB hub found
[ 422.856000] hub 1-0:1.0: 1 port detected
[ 423.464000] IFXUSB: USB core #1 soft-reset
[ 423.812000] IFXUSB: USB core #1 soft-reset
[ 423.816000] ifxusb_hcd ifxusb_hcd: IFX USB Controller
[ 423.824000] ifxusb_hcd ifxusb_hcd: new USB bus registered, assigned bus number 2
[ 423.832000] ifxusb_hcd ifxusb_hcd: irq 91, io mem 0xbe106000
[ 423.840000] IFXUSB: Init: Power Port (0)
[ 423.944000] hub 2-0:1.0: USB hub found
[ 423.956000] hub 2-0:1.0: 1 port detected
[ 423.996000] ifxusb_hcd ifxusb_hcd: requested GPIO 233
[ 424.364000] usbcore: registered new interface driver usb-storage
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
BusyBox v1.22.1 (2014-11-30 16:08:41 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
CHAOS CALMER (Bleeding Edge, r43437)
-----------------------------------------------------
* 1 1/2 oz Gin Shake with a glassful
* 1/4 oz Triple Sec of broken ice and pour
* 3/4 oz Lime Juice unstrained into a goblet.
* 1 1/2 oz Orange Juice
* 1 tsp. Grenadine Syrup
-----------------------------------------------------
root@(none):/# [ 476.292000] IFXOS, Version 1.5.14 (c) Copyright 2009, Lantiq Deutschland GmbH
[ 477.108000] NET: Registered protocol family 10
[ 477.376000] NET: Registered protocol family 8
[ 477.380000] NET: Registered protocol family 20
[ 477.652000] PPP generic driver version 2.4.2
[ 477.956000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 478.564000] MEI CPE Driver, Version 1.2.0
[ 478.568000] (c) Copyright 2009, Infineon Technologies AG
### MEI CPE - MEI CPE - MEI CPE - MEI CPE ###
Lantiq CPE API Driver version: DSL CPE API V4.11.4
[ 478.928000]
[ 478.928000] Predefined debug level: 2
[ 479.128000] Loading modules backported from Linux version master-2014-11-04-0-gf3660a2
[ 479.136000] Backport generated by backports.git backports-20141023-2-g4ff890b
[ 479.324000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 479.648000] Infineon Technologies DEU driver version 2.0.0
[ 479.684000] IFX DEU DES initialized (multiblock).
[ 479.716000] IFX DEU AES initialized (multiblock).
[ 479.732000] IFX DEU ARC4 initialized (multiblock).
[ 479.744000] IFX DEU SHA1 initialized.
[ 479.752000] IFX DEU MD5 initialized.
[ 479.764000] IFX DEU SHA1_HMAC initialized.
[ 479.772000] IFX DEU MD5_HMAC initialized.
[ 480.180000] nf_conntrack version 0.5.0 (1959 buckets, 7836 max)
[ 480.912000] NET: Registered protocol family 24
[ 481.020000] usbcore: registered new interface driver ums-alauda
[ 481.120000] usbcore: registered new interface driver ums-cypress
[ 481.228000] usbcore: registered new interface driver ums-datafab
[ 481.324000] usbcore: registered new interface driver ums-freecom
[ 481.436000] usbcore: registered new interface driver ums-isd200
[ 481.552000] usbcore: registered new interface driver ums-jumpshot
[ 481.644000] usbcore: registered new interface driver ums-karma
[ 481.776000] usbcore: registered new interface driver ums-sddr09
[ 481.888000] usbcore: registered new interface driver ums-sddr55
[ 482.020000] usbcore: registered new interface driver ums-usbat
[ 482.104000] usbcore: registered new interface driver usblp
[ 483.176000] xt_time: kernel timezone is -0000
[ 486.416000] cfg80211: Calling CRDA to update world regulatory domain
[ 486.440000] cfg80211: World regulatory domain updated:
[ 486.448000] cfg80211: DFS Master region: unset
[ 486.452000] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[ 486.460000] cfg80211: (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[ 486.472000] cfg80211: (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[ 486.480000] cfg80211: (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[ 486.488000] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[ 486.500000] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[ 486.508000] cfg80211: (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[ 486.520000] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[ 486.528000] cfg80211: (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[ 489.068000] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[ 489.076000] PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
[ 489.088000] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 3071, rev 021c detected
[ 489.100000] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 0008 detected
[ 794.536000] device eth0.1 entered promiscuous mode
[ 794.544000] device eth0 entered promiscuous mode
[ 794.656000] br-lan: port 1(eth0.1) entered forwarding state
[ 794.664000] br-lan: port 1(eth0.1) entered forwarding state
[ 796.668000] br-lan: port 1(eth0.1) entered forwarding state