For some backstory, check out this post. To summarize, AT&T’s security cert expired. Without it, you cannot sync your modem. They could easily release the firmware update binary file to allow users to connect, but they won’t. (insert name calling here)

This policy motivated me to get my 2210 online at any cost. And now I’m documenting all my results so anybody else can also get their older 2210s online.

Getting into the 2210-02-1ATT

On older versions of the firmware, there was a simple way to activate telnet and access the rudimentary shell built into the Netopia SoC OS. AT&T disabled that on more recent versions, forcing me to look for a hardware-based method of access.

Top side of the 2210

First some specs:

Processor: Infineon PSB7100
Flash: 2MB (bottom left)
RAM:  8MB (left of the Infineon)

I was originally planning on having to dump either the flash or the memory, go through the dumps in a hex editor, and find either the certificates or the location of the config file (to activate Telnet). Luckily, it was much easier. The Infineon PSB7100 is based on an old TI AR-7 design architecture, which led me to my first clue: The TI AR-7 features a UART interface.

Under the Infineon to the left is jumper J1. Four pins, one is obviously grounded. Checking with a multimeter showed 3.3V on Pin 1, 3-3.3V on Pins 2 and 3, and 0V on Pin 4. Looks a lot like VDD, Rx, Tx, and Gnd! From the bottom side:

Bottom side of 2210 with UART interface labeled

The Serial Interface

The 2210 uses 3.3V CMOS serial. You’ll need some way of shifting this up to the +/-12V of RS-232 or a special USB to Serial board that expects 3.3V inputs, such as this one. I went with the level shifting route using a MAX3232.

Serial connections to 2210 – Not my finest soldering job

MAX3232 on breadboard

Circuit is straightforward – four 0.1µF caps in the locations specified in the datasheet, two data lines to the 2210, 3.3V VDD and GND coming from 2210. The RS-232 goes to a USB to Serial adapter using Pins 2, 3, and 5 (GND).

Through trial and error, the serial interface is 57600, 8, N, 1. I used HyperTerminal, but any serial terminal should work. You’ll be greeted with:

login:

Login using admin for the username and your modem’s access code (printed on a sticker on the bottom case) as the password:

login: admin
Password:

Terminal shell v1.0
Copyright ?2010 Motorola, Inc. All rights reserved.
Motorola Netopia Model 2210-02 DSL AnnexA Ethernet
Running Netopia SOC OS version 7.8.7 (build r9)
Multimode ADSL with PTM
(admin completed login: Full Read/Write access)

Netopia-2000/XXXXXXXXXXX>

We’re in!

Activating Telnet

Easiest part. Type these commands:

Netopia-2000/XXXXXXXXXXXXX> configure

Config Mode v1.3
Netopia-2000/XXXXXXXXXXXXXX (top)>> system
Netopia-2000/XXXXXXXXXXXXXX (top)>> server
Netopia-2000/XXXXXXXXXXXXXX (servers)>> set telnet-tcp 23
Netopia-2000/XXXXXXXXXXXXXX (servers)>> view

===============================================
 servers
 web-http 80
 telnet-tcp 23
Netopia-2000/XXXXXXXXXXXXXX (servers)>> save
WARNING: 'dhcp start/end-address [192.168.7.64, 192.168.7.64]' provide a maximum of 1 lease addresses
Configuration data saved.
Netopia-2000/XXXXXXXXXXXXXX (servers)>> exit 

Reboot the modem and you should be able to login via telnet at 192.168.7.254