cisco ven401 working!

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
Author Message
ghoffman
DD-WRT User


Joined: 03 Jan 2010
Posts: 450

PostPosted: Sun Jul 12, 2015 14:54    Post subject: cisco ven401 working! Reply with quote
hello -
i have gotten dd-wrt k26 64k nvram build (kong mod 22000M) working on the cisco ven401 A/N access point. this device was supplied by at&t as 5ghz access for uverse. there are some unusual things about the radio, which is only 5g. i have been trying to recommmission it as a wireless media bridge for a smart tv, and fnally found a build that works.

it has a relatively bullet-proof cfe and it is easy to upload various firmwares by tftp as soon as you get a ttl=100 prompt over the single lan port. it has 8mb rom, 64mb ram, and a bcm4717 SOC. it has only a 5g radio. hardware details are here
https://wikidevi.com/wiki/Cisco_VEN401

edit: the most recent k26/nvram 64k r27506 build works also, with alittle work. the cfe only takes raw images with HDR0 as the first bytes. so you have to strip off the first 32 bytes of nv64 files to get the hdr0 format. i save these as .trx to maybe keep things straight for my own good.
Sponsor
TurboTechie
DD-WRT Novice


Joined: 29 Jul 2015
Posts: 7

PostPosted: Wed Jul 29, 2015 20:07    Post subject: Cisco VEN401 Reply with quote
I managed to finally get DD WRT loaded onto this device after having to restore it from serial. However DD WRT does not survive a reboot and once the AP boots up it never gets past the CFE again. When it was loaded I still was not able to connect via ethernet to the web interface and the power LED remained solid. I have tried several different builds with the same result the AP wont survive the reboot. Have you had any success with this up to this point. If so what exactly have you done and used. I have tried the 22000 King Kong Build and it doesn't work either. Also was not able to determine any SSID's being broadcast from the device as well.
ghoffman
DD-WRT User


Joined: 03 Jan 2010
Posts: 450

PostPosted: Wed Jul 29, 2015 21:28    Post subject: Reply with quote
what i did, as in my post above:
1. strip off the header off the dd-wrt 64k nvram 3.x image (as mentioned, i used kong's 22000M and the recent BS r27506 build) so the file begins with HDR0.
2. flash from the cfe bootloader just after powerup, over the ethernet cable. the AP cfe is at 192.168.1.1 like most broadcom units. the ttl=100 prompt is available for a few seconds.
3. let the thing fully flash and reboot.
4. hold doen the reset button and do another power cycle
5 log into dd-wrt at 192.168.1.1

i had to 'assign wan port to lan' and disable wan access to get the wireless and ethernet ports on the same bridge.

i can't explain your reboot issues, although i had that issue when i was trying openwrt. i did erase the nvram mtd partition going from openwrt to dd-wrt; maybe try that is you are still unsuccessful.

let me know.
TurboTechie
DD-WRT Novice


Joined: 29 Jul 2015
Posts: 7

PostPosted: Wed Jul 29, 2015 22:16    Post subject: VEN 401 Reply with quote
What do you mean by stripping off the first 32 bytes? Do I need to use a hex editor and just delete the bytes? Not sure I quite understand this.
Malachi
DD-WRT Guru


Joined: 17 Jul 2012
Posts: 7075
Location: Columbus, Ohio

PostPosted: Wed Jul 29, 2015 22:18    Post subject: Reply with quote
That's what he means.
_________________
I am far from a guru, I'm barely a novice.
ghoffman
DD-WRT User


Joined: 03 Jan 2010
Posts: 450

PostPosted: Thu Jul 30, 2015 0:08    Post subject: Reply with quote
the r27506 build with 32 bytes stripped off is in this dropbox folder:
https://www.dropbox.com/sh/oi548ygz5oikv0e/AAAXg51Mzu6KqKSQHlNRftiPa?dl=0
the .trx extension distinguishes it from the .bin from which it was derived.
try to flash
please report back
TurboTechie
DD-WRT Novice


Joined: 29 Jul 2015
Posts: 7

PostPosted: Thu Jul 30, 2015 5:03    Post subject: Reply with quote
Thank you. I am going to give it a try here in a little bit. I have like 10 of the VEN401's that I have a buyer for but doesn't want them with the AT&T firmware as supposedly AT&T has a backdoor in it for their system.

Do you know if anything has been done on the Motorola Arris VAP2500's? I have 12 of those as well.

I can get about 5 of these things a week for free but quit getting them as they were useless hopefully till now.

I will let you know as soon as I can get the r27506 build on it and see if it works.

Once again thanks.
TurboTechie
DD-WRT Novice


Joined: 29 Jul 2015
Posts: 7

PostPosted: Thu Jul 30, 2015 23:11    Post subject: VEN401 Reply with quote
Alright. Finally got the firmware on the dang Cisco. I am able to login to the web interface. However reading the serial console I get the following

get_wl_instance doesnt return the right value
No such device
connect: Network unreachable
Gethostbyname: Resource temporarily unavailable

Not only that but the wireless radio is showing as being disabled.
TurboTechie
DD-WRT Novice


Joined: 29 Jul 2015
Posts: 7

PostPosted: Sun Aug 02, 2015 0:39    Post subject: Cisco VEN401 Reply with quote
After experimenting further with this build I have determined that the wireless driver is not operating with the Cisco VEN401. Everything runs fine except the wireless does not show up as a device.

ifconfig
br0 Link encap:Ethernet HWaddr A4:A2:4A:9C:D4:1C
inet addr:192.168.1.21 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3888 errors:0 dropped:209 overruns:0 frame:0
TX packets:3890 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:359894 (351.4 KiB) TX bytes:3453949 (3.2 MiB)

br0:0 Link encap:Ethernet HWaddr A4:A2:4A:9C:D4:1C
inet addr:169.254.255.1 Bcast:169.254.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

eth0 Link encap:Ethernet HWaddr A4:A2:4A:9C:D4:1C
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:38103 errors:0 dropped:0 overruns:0 frame:0
TX packets:22580 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:4309649 (4.1 MiB) TX bytes:21950930 (20.9 MiB)
Interrupt:4 Base address:0x2000

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MULTICAST MTU:65536 Metric:1
RX packets:2040 errors:0 dropped:0 overruns:0 frame:0
TX packets:2040 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:118320 (115.5 KiB) TX bytes:118320 (115.5 KiB)

I see the bridge, ethernet and loopback but no wireless wl or seperate ethernet is listed or installed.
ghoffman
DD-WRT User


Joined: 03 Jan 2010
Posts: 450

PostPosted: Sun Aug 02, 2015 10:36    Post subject: Reply with quote
mayby reset dd-wrt config, and/or erase nvram and let the cfe rebuild it?

interface wl0 is eth1 on my device.
interface eth0 is the ethernet port
i have only used the thing as an AP or ethernet bridge, so i have bridged them together. you have to 'assign Wan port to switch' on the first setup page, and disable WAN access. i have not tried using this device as a one-port router to see how the switch is actually configured.

my ifconfig and dmesg output follows for comparison.

Code:
==========================================================

     ___  ___     _      _____  ______       ____  ___
    / _ \/ _ \___| | /| / / _ \/_  __/ _  __|_  / / _ \
   / // / // /___/ |/ |/ / , _/ / /   | |/ //_ <_/ // /
  /____/____/    |__/|__/_/|_| /_/    |___/____(_)___/

                       DD-WRT v3.0
                   http://www.dd-wrt.com

==========================================================


BusyBox v1.23.2 (2015-07-09 08:04:58 CEST) built-in shell (ash)

root@hoffman205:~# ifconfig
br0       Link encap:Ethernet  HWaddr 00:23:BE:5C:00:02
          inet addr:192.168.1.205  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:606903 errors:0 dropped:17 overruns:0 frame:0
          TX packets:21716 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:71722253 (68.3 MiB)  TX bytes:19473503 (18.5 MiB)

br0:0     Link encap:Ethernet  HWaddr 00:23:BE:5C:00:02
          inet addr:169.254.255.1  Bcast:169.254.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0      Link encap:Ethernet  HWaddr BC:C8:10:D1:38:A0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8834851 errors:0 dropped:0 overruns:0 frame:0
          TX packets:22242967 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:642016566 (612.2 MiB)  TX bytes:2920204993 (2.7 GiB)
          Interrupt:4 Base address:0x2000

eth1      Link encap:Ethernet  HWaddr 00:23:BE:5C:00:02
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:22267034 errors:0 dropped:0 overruns:0 frame:3014654
          TX packets:8854885 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2922204535 (2.7 GiB)  TX bytes:696906028 (664.6 MiB)
          Interrupt:3 Base address:0x1000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING MULTICAST  MTU:65536  Metric:1
          RX packets:381 errors:0 dropped:0 overruns:0 frame:0
          TX packets:381 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:18528 (18.0 KiB)  TX bytes:18528 (18.0 KiB)


root@hoffman205:~# dmesg
Linux version 3.10.83 (root@dd-wrt) (gcc version 5.1.0 (OpenWrt GCC 5.1.0 r45933) ) #8927 Thu Jul 9 08:05:39 CEST 2015
CPU revision is: 00019740 (MIPS 74Kc)
Found an ST compatible serial flash with 128 64KB blocks; total size 8MB
found nvram at 7E0000
something wrong here. do not remap
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone ranges:
  Normal   [mem 0x00000000-0x03ffffff]
  HighMem  empty
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x03ffffff]
On node 0 totalpages: 16384
free_area_init_node: node 0, pgdat 805b7bf0, node_mem_map 81000000
  Normal zone: 128 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 16384 pages, LIFO batch:3
Primary instruction cache 32kB, 4-way, VIPT, I-cache aliases, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=1f02 rootfstype=squashfs noinitrd init=/bin/sh
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 57848k/65536k available (4654k kernel code, 7688k reserved, 1607k data, 324k init, 0k highmem)
NR_IRQS:128
CPU: BCM4716 rev 1 at 354 MHz
bcm947xx_clockevent_set_mode: 1
bcm947xx_clockevent_set_mode: 3
console [ttyS0] enabled
Calibrating delay loop... 176.53 BogoMIPS (lpj=882688)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
PCI: Using membase 8000000
PCI: Disabled
PCI: no core
PCI: scanning bus 0
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [io  0x0000-0xffff]
pci_bus 0000:00: root bus resource [mem 0x00000000-0xffffffff]
pci_bus 0000:00: root bus resource [bus 00-ff]
pci 0000:00:00.0: [14e4:0800] type 00 class 0x050100
pci 0000:00:00.0: reg 10: [mem 0x18000000-0x18000fff]
pci 0000:00:00.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:01.0: [14e4:432a] type 00 class 0x028000
pci 0000:00:01.0: reg 10: [mem 0x18001000-0x18001fff]
pci 0000:00:01.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:02.0: [14e4:4715] type 00 class 0x020000
pci 0000:00:02.0: reg 10: [mem 0x18002000-0x18002fff]
pci 0000:00:02.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:04.0: [14e4:471a] type 00 class 0x0c0310
pci 0000:00:04.0: reg 10: [mem 0x18009000-0x18009fff]
pci 0000:00:04.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:04.1: [14e4:471a] type 00 class 0x0c0320
pci 0000:00:04.1: reg 10: [mem 0x18004000-0x18004fff]
pci 0000:00:04.1: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:06.0: [14e4:082e] type 00 class 0x050000
pci 0000:00:06.0: reg 10: [mem 0x18006000-0x18006fff]
pci 0000:00:06.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:07.0: [14e4:080e] type 00 class 0x050000
pci 0000:00:07.0: reg 10: [mem 0x18007000-0x18007fff]
pci 0000:00:07.0: reg 30: [mem 0x00000000-0x000007ff pref]
pci 0000:00:08.0: [14e4:4711] type 00 class 0x040100
pci 0000:00:08.0: reg 10: [mem 0x18008000-0x18008fff]
pci 0000:00:08.0: reg 30: [mem 0x00000000-0x000007ff pref]
PCI: Fixing up bus 0
Switching to clocksource MIPS
NET: Registered protocol family 2
TCP established hash table entries: 512 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 512 bind 512)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
PCI: CLS 0 bytes, default 32
squashfs: version 3.0 (2006/03/15) Phillip Lougher
msgmni has been set to 112
io scheduler noop registered (default)
HDLC line discipline maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 8) is a U6_16550A
brd: module loaded
pflash: found no supported devices
try to find cfe size up to 8388608
bootloader size: 196608
nvram size: 65536
bcmsflash: Filesystem type: squashfs, size=0x5a646c
partition size = 2287615
Creating 5 MTD partitions on "bcmsflash":
0x000000000000-0x000000030000 : "cfe"
0x000000030000-0x0000007f0000 : "linux"
0x00000021e800-0x0000007d0000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs" set to be root filesystem
0x0000007f0000-0x000000800000 : "nvram"
0x0000007d0000-0x0000007f0000 : "ddwrt"
brcmnand: found no supported devices
nflash: found no supported devices
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
et_module_init: passivemode set to 0x0
et_module_init: txworkq set to 0x0
et_module_init: et_txq_thresh set to 0x400
et_module_init: et_rxlazy_timeout set to 0x3e8
et_module_init: et_rxlazy_framecnt set to 0x20
et 0000:00:02.0: setting latency timer to 64
eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.89.21 (r524987)
PPP generic driver version 2.4.2
PPP BSD Compression module registered
PPP Deflate Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
wl 0000:00:01.0: setting latency timer to 64
Broadcom Watchdog Timer: 0.07 initialized.
u32 classifier
    Performance counters on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (903 buckets, 3612 max)
nf_conntrack_rtsp v0.6.21 loading
xt_time: kernel timezone is -0000
ip_set: protocol 6
gre: GRE over IPv4 demultiplexor driver
nf_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: bic registered
TCP: cubic registered
TCP: westwood registered
TCP: highspeed registered
TCP: hybla registered
TCP: htcp registered
TCP: vegas registered
TCP: veno registered
TCP: scalable registered
TCP: lp registered
TCP: yeah registered
TCP: illinois registered
NET: Registered protocol family 17
Bridge firewalling registered
8021q: 802.1Q VLAN Support v1.8
startup nvram driver
found nvram
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 324K (8061f000 - 80670000)
roboswitch: Probing device 'eth0'
roboswitch: timeout in robo_reg on page 2 and reg 48 with op 2.
roboswitch: trying a 5ffff! at eth0
roboswitch: timeout in robo_reg on page 0 and reg 11 with op 2.
roboswitch: found a 5ffff! at eth0
device br0 entered promiscuous mode
device eth0 entered promiscuous mode
br0: port 1(eth0) entered forwarding state
br0: port 1(eth0) entered forwarding state
device eth1 entered promiscuous mode
br0: port 2(eth1) entered forwarding state
br0: port 2(eth1) entered forwarding state
device br0 left promiscuous mode
device br0 entered promiscuous mode
device br0 left promiscuous mode
br0: port 1(eth0) entered forwarding state
br0: port 2(eth1) entered forwarding state
nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.
Joe Sixpack
DD-WRT Novice


Joined: 14 May 2015
Posts: 36

PostPosted: Sun Aug 30, 2015 2:28    Post subject: Reply with quote
Having the same problem of no wifi.

Status says radio is turned off, could not figure out how to turn it on.

Model: 401-VEN-AT
I have H/W.Ver: v04
Date code: 07-12

Dunno if this helps but before I tried to flash the stock firmware had a 2nd set of hidden broadcom admin pages.. and this is what is said:

Boot Loader Version: CFE 5.11.128.6
OS Version: Linux 5.24.32.13
WL Driver Version: DUCATI 5.11.128.6



I tried hex modified / tftp flashed:
http://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2015/07-09-2015-r27506/broadcom_K3X/dd-wrt.v24-27506_NEWD-2_K3.x_mega-nv64k.bin

and

http://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2015/07-09-2015-r27506/broadcom_K26/dd-wrt.v24-27506_NEWD-2_K2.6_mega-nv64k.bin


Both of these firmwares booted ok for me, minus the wifi problem.

Tried doing hard reset, tried loading default settings.

no joy.

any ideas?
ghoffman
DD-WRT User


Joined: 03 Jan 2010
Posts: 450

PostPosted: Mon Aug 31, 2015 1:09    Post subject: Reply with quote
@joe -
i think there is more than one version of this router. i ordered 4 off ebay, and got stuck with the same problem you describe on one of them. i'm investigating further and will post an update

try going back to stock and see if wireless works on that. then maybe DONT erase nvram when going to dd-wrt.
finally - you have to check 'bridge wan to lan' on the first setup page to get both interfaces on br0


i'll post more after i do some experiments here
Joe Sixpack
DD-WRT Novice


Joined: 14 May 2015
Posts: 36

PostPosted: Mon Aug 31, 2015 18:48    Post subject: Reply with quote
Well when I flashed from stock the wifi did not work right off the git.

It looks to me like it's not even setting up the wifi interface so Im thinking it's some sort of driver issue.

DD-wrt also reports it as a Linksys WRT54G/GL/GS
which is way off.
IIRC those was "G" 2.4ghz routers.

maybe it's a internal configuration problem.

Do you have a link to stock firmware? I don't even have one to go back to.. I rescued this one from the trash and it was fairly useless with it's original firmware.. at least the AT&T modified one.. maybe cisco makes a clean base stock?

I just wanted it to add 5ghz to my network but I seen it trying to fetch a lot of crap off the net so stock was untrustworthy.
ghoffman
DD-WRT User


Joined: 03 Jan 2010
Posts: 450

PostPosted: Mon Aug 31, 2015 22:34    Post subject: Reply with quote
stock firmware communicates with at&t for updates, status, etc. i don't think it's malicious.
mine is also identified as a wrt54g/gl/gs but that does not seem a big deal to me. i think that is the default for devices not matching known device id's.
i looked for vanilla firmware from cisco but could not find any.
i got factory firmware from : http://driversdownload19.blogspot.com/2007/02/cisco-ven401-at.html
TurboTechie
DD-WRT Novice


Joined: 29 Jul 2015
Posts: 7

PostPosted: Mon Oct 12, 2015 6:53    Post subject: Cisco VEN401 Reply with quote
I finally managed to get a running firmware with wireless working. But it is a pain in the ass to configure. I found someone mention the hardware was very similar if not identical to that of the WRT160n and so I tried that firmware and sure enough it booted right up survives a reboot and reset. However it says the wireless is up and running I do not have any devices that are 5Ghz to test it out. I am running v24 SP2 of the WRT 160n Firmware
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum