Topic: Cisco VEN401 - supported and working, OpenWrt Barrier Breaker 14.07

9 Dec 2014, 00:06

Hi all,
Cisco VEN401 is a 5GHz-only AP based on Broadcom BRCM4717. The chipset itself supports also 2.4GHz band but it's somehow disabled at chip level on this AP. The device features 1x100M port as wired uplink and works perfectly with OpenWrt Barrier Breaker 14.07 .
The most straightforward way to use this device is to configure it as dumb AP, ie. a plain L2 bridge between the wired and the wireless domain. Nevertheless once Openwrt is onboard you can basically play any tricks with it (ex. you can configure nat between wireless and wired, dhcp, firewalling, etc.)

Quick installation:
Download this image, a recompiled Barrier Breaker 14.07 with few customizations to make it work out of the box on this AP http://tastiere.altervista.org/openwrt- … uashfs.trx and flash it through http://<VEN401_IP_ADDRESS>/firmware.asp.
The image contains the proper settings in order for the AP to:

start dhcp client on wired interface to obtain the AP management IP address (yes, you haveto connect it to a dhcp-enabled network)
load the wl driver (I didn't succeed in making b43 work on this device)
bridge wired and wireless interface
broadcast an OpenWrt SSID

here are the customized configuration settings of this image:

/etc/config/network

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option type 'bridge'
        option proto 'dhcp'
        option delegate '0'
        option stp '1'
        option _orig_ifname 'eth0 wl0 wl0'
        option _orig_bridge 'true'
        option ifname 'eth0'

/etc/config/wireless

config wifi-device 'wl0'
        option type 'broadcom'
        option txantenna '3'
        option rxantenna '3'
        option txpower '24'
        option hwmode '11bg'
        option channel 'auto'

config wifi-iface
        option device 'wl0'
        option encryption 'none'
        option mode 'ap'
        option ssid 'OpenWrt'
        option network 'lan'

Once flashing and boot is completed, check on your dhcp server which address has the VEN401 acquired and point to it - telnet/ssh or LuCI.

hope this is useful for someone,

cheers
g.

11 Dec 2014, 19:30

Thank you for your work! I have one of these boxes and it's been fairly worthless. I looked into flashing it a couple years ago and nothing, but it nice having OpenWrt on it. And it was nice having it work right after the flash.

13 Dec 2014, 05:49

Didn't work for me. Flashed per the instructions and it is bricked. Glad I din't pay for it, though I would have liked to use it as an additional AP. Anyone know how to fix a bricked VEN401?

13 Dec 2014, 15:03

when you say bricked I guess:
- you don't see any new leases in your wired dhcp server once the AP boots
- you don't see any OpenWrt SSID on your wifi clients.

That is strange.. I tried the above procedures on 3 different ap's with different original FW and it worked straight away.
Your device is not lost. Before getting to a working config i bricked it several times and managed to revive it every time.
Serial port is not mandatory to perform this task, but really helps. Are you familiar with that?

cheers
g.

(Last edited by sturia on 13 Dec 2014, 15:44)

21 Feb 2015, 04:29

I tried the "flash" and when it was done, the power light just stays red, but the wired ethernet connection shows a link and activity and the serial connection does not work (used 2 different level converters. Any one have an idea.

Thanks,

Paul

21 Feb 2015, 21:45

i flashed the openwrt image using the firmware upgrade page, and using the flash command on a serial console after interrupting the boot process.

in both circumstances: the image flashes correctly, and then boots.

the device apparently is looking for an ip address from dhcp.

if you reboot, the device picks up its default address of 192.168.1.1 and has ttl=100 response to ping, but never starts the openwrt image.

on the serial console, the image decompresses and loads, but the cfe won;t start it, with this error:

Loading: raw_fileop_uninit: warning: refcnt not zero

this post might give some relevant info:
https://lists.openwrt.org/pipermail/ope … 15846.html

22 Feb 2015, 01:36

I got it back to the stock firmware and then tried again (had two bad 232 level converters). It has a red power light and the network light acts like it has a connection but does not get a ip from the router (checked the lease table). This is what i get on the serial console when it reboots and starts to load.

Decompressing...done

CFE version 5.11.128.6 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Wed Sep 7 00:26:21 CST 2011 (root@FC8_Dumas3)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 131072(0x20000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.11.128.6
CPU type 0x19740: 354MHz
Tot mem: 65536 KBytes

CFE mem: 0x80700000 - 0x807A2F70 (667504)
Data: 0x807356F0 - 0x807384C0 (11728)
BSS: 0x807384C0 - 0x8073CF70 (19120)
Heap: 0x8073CF70 - 0x807A0F70 (409600)
Stack: 0x807A0F70 - 0x807A2F70 (8192)
Text: 0x80700000 - 0x807356E8 (218856)

Device eth0: hwaddr BC-C8-10-BF-A3-5B, ipaddr 192.168.2.35, mask 255.255.255.0
gateway not set, nameserver not set
Open the flash0.os to check CRC...Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
Open the flash0.os2 to check CRC...Got the Linux image 1

Loader:raw Filesys:raw Dev:flash0.os2 File: Options:(null)
Loading: .. 3712 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000

and this is where it stops and just sits there. i let it sit for 30 min and still nothing. i just wonder if i got a bad down load.

73's

Paul

22 Feb 2015, 01:48

I have not tried to do the upgrade by the serial console because I was not able to figure out what "flashdevice" to use. Is it flash0 or flash1? when you watch the console after you do the update from the web page, it shows Linux 2 so I am not sure what partition to use. I just do not flash routers or AP of this type that often (last time was about 2 years ago).

Is there a wiki on how to do a serial upgrade?

73's Paul

22 Feb 2015, 03:37

So has anyone besides OP got OpenWRT working on Cisco VEN401?

22 Feb 2015, 05:40

stangri wrote:

So has anyone besides OP got OpenWRT working on Cisco VEN401?

I tried this today & it bricked my VEN401 as well.
I have the date code 10/12 HW VERSION V04 model of the VEN401-AT.
I get the never-ending flashing red power light. I don't see any IP / lease in the 192.168.1.254 router DHCP table.

How can I flash it back to the previous stock firmware? At least that was working.

(Last edited by aslezak on 23 Feb 2015, 03:55)

22 Feb 2015, 13:09

kc8elq wrote:

I have not tried to do the upgrade by the serial console because I was not able to figure out what "flashdevice" to use. Is it flash0 or flash1? when you watch the console after you do the update from the web page, it shows Linux 2 so I am not sure what partition to use. I just do not flash routers or AP of this type that often (last time was about 2 years ago).
Is there a wiki on how to do a serial upgrade?
73's Paul

flash0 is the firmware. flash1 is sometimes the cfe. dont use that one!!
see http://wiki.openwrt.org/doc/techref/bootloader/cfe

you should be able to ping your router with an ethernet cable connected to your computer with a static ip.
i got ping response ttl=100 at 192.168.1.1

the serial flash command is:

flash -noheader : flash0.trx

then from your computer command shell, you can tftp the firmware:
(i renamed it openwrt.bin to save character typing)
tftp -i 192.168.1.1 put openwrt.bin

wath the serial console. if the router does not restart after flashing, issue a 'go' command

this gets openwrt going on my device, but it does not restart at reboot because of the problem that i described above.

(Last edited by ghoffman on 22 Feb 2015, 14:19)

22 Feb 2015, 17:26

aslezak wrote:

Correction the power light just flashes red forever. I tried holding down the reset button for 30 seconds to 1 minute+, keeping it held while unplugged for 10 seconds, plugging back in then keeping it depressed another 10 seconds, never stops flashing after a few seconds into boot.
Any advice on how to revert to previous firmware, or get the router to respond on 192.168.1.1 ? I have tried static arp mappings but no luck.

Status update: I thought to use a crossover cable instead of a direct Ethernet cable from the bricked VEN401 to my laptop. Well I don't have a crossover cable so I connected both to the same Ethernet switch, configured a static IP on the laptop (192.168.1.10 .. one that was unused on the subnet), & did a static arp mapping to the MAC of the VEN401 (from a cmd.exe window: arp -s 192.168.1.9 MAC). The MAC is actually 1 less than the one listed on the bottom of the device as the one listed is for the wireless connection (mine ended in -E2 so I used -E1 for the arp mapping). In addition to the holding down the reset button for >30 seconds, which may have enabled the emergency flash webpage, I could now connect to the VEN401 both via ping & the emergency flash webpage. From there I clicked "reset to NVRAM defaults" & then "reboot". After the device came back up, I reloaded the OpenWrt firmware from this same webpage & after a reboot, the power light on the VEN401 is solid red!

**EDIT: THIS DID NOT SURVIVE A REBOOT & THE OPENWRT SSID WAS NEVER VISIBLE**

(Last edited by aslezak on 22 Feb 2015, 21:37)

22 Feb 2015, 19:00

@alsezak: let me know if your openwrt config survives a power cycle!
thanks

22 Feb 2015, 21:06

ghoffman wrote:

@alsezak: let me know if your openwrt config survives a power cycle!
thanks

It did NOT survive a reboot - the router went back to the infinitely flashing red power button. Also, before the reboot I did not see any OpenWRT SSID. Therefore I have determined that using this modified Barrier Breaker 14.07 firmware does not work. I also tried the stock Barrier Breaker trx file & that had the same result.
I flashed back to the original firmware which mrinaldi was nice enough to upload to DropBox (see post #7 at the following discussion link: https://forum.openwrt.org/viewtopic.php?id=53423)

For those who want to use the router with the stock firmware, the default SSID will not allow you to authenticate with WPA/WPA2. It will work with no security (full speed) & WEP (54mbps), but not WPA nor WPA2 - it must have some way to detect an AT&T video receiver. The key is to go into the Wireless / Multiple SSID setting. Enable a secondary SSID with WPA2 security, set whatever key you like. Once you have joined this new SSID with your laptop/desktop, you can go back to the same Wireless setting page & disable the original SSID. I have tried to do the same with the Wi-Fi Protected Setup setting, but even after disabling the original SSID & enabling WPS only on the secondary SSID, it still isn't working. Not a big deal but worth mentioning.

UPDATE: /bin/wps_monitor has some logic to check for allowed equipment. After trying the WPS button with a non-AT&T device, "Wrong Client Device !!!" is printed on the console. I tried doing strace from the console but could only see configuration details being read from nvram. There is mention of the WFADevice.xml but again this is not on the filesystem. I tried using a wps_monitor from one of the ASUS open source projects but did not succeed it getting that to stay running.

(Last edited by aslezak on 23 Feb 2015, 04:05)

23 Feb 2015, 00:20

I got it to take openwrt, but it will not survive a power cycle or reboot. On the bottom I have HW Version V03.1 and Date Code 05/12. With the stock firmware (1.24.32.63DS-AT-NODFS) I can get into the "Hidden" pages and the firmware.asp page shows this:

Boot Loader Version: CFE 5.11.128.6
OS Version: Linux 5.24.32.13
WL Driver Version: DUCATI 5.11.128.6

This is the output I get from the serial console when I power cycle the unit:

Decompressing...done

CFE version 5.11.128.6 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Wed Sep 7 00:26:21 CST 2011 (root@FC8_Dumas3)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 131072(0x20000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.11.128.6
CPU type 0x19740: 354MHz
Tot mem: 65536 KBytes

CFE mem: 0x80700000 - 0x807A2F70 (667504)
Data: 0x807356F0 - 0x807384C0 (11728)
BSS: 0x807384C0 - 0x8073CF70 (19120)
Heap: 0x8073CF70 - 0x807A0F70 (409600)
Stack: 0x807A0F70 - 0x807A2F70 (8192)
Text: 0x80700000 - 0x807356E8 (218856)

Device eth0: hwaddr BC-C8-10-BF-A3-5B, ipaddr 192.168.2.35, mask 255.255.255.0
gateway not set, nameserver not set
Open the flash0.os to check CRC...Loader:raw Filesys:tftp Dev:eth0 File:: Optio)
Loading: Failed.
Could not load :: Timeout occured
Open the flash0.os to check CRC...Got the Linux image 0
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: raw_fileop_uninit: warning: refcnt not zero
Entry at 0x00000000
CFE>

I even used the nvram commit command before I power cycled the unit.

I also found out that the flash location names on my unit are called flash0.os and flash0.os2

73's

Paul

30 Mar 2015, 03:59

OpenWRT isn't working, I wish they would update the subject line.

So I have access point mode working with the default firmware.
Client (station) mode is now working as well!

wl ap 0 #set device to Station mode
wl wet 1 #enable wireless Ethernet mode (bridge Ethernet w/wireless)
wl set_pmk "mywpa2passphrase"
wl sup_wpa 1 #enable built in WPA supplicant
wl wsec 4 #set to AES mode

wl scan
#give it a few seconds to gather the site survey results
wl scanresults

wl join "Existing_5GHzAccessPoint" amode wpa2psk
wl status #will show authenticated to existing AP

You should now be able to ping your gateway (192.168.1.254 if UVerse) & Internet sites, both from the device & from an Ethernet cable from your laptop into the VEN401!

(Last edited by aslezak on 4 Apr 2015, 03:39)

6 Apr 2015, 02:52

So I played around & could not get the above procedure to automatically start the wireless client on reboot. I tried almost everything to no avail. The init scripts on this device are inside the rc binary. Much of the nvram configuration is done via the httpd binary, including all the cgi scripts. There is no real way to modify the startup or any of the scripts on this device, so unless you can track down the exact nvram settings that the rc/wl are looking for, you will not succeed in getting the client to auto connect on reboot.

A better way to use the VEN401 as a wireless client is to use the WPS button on your access point. I've found that if you make the connection this way, the setup will be saved & the VEN401 will auto-reconnect when it is rebooted.

Your VEN401 will get an IP address from DHCP (assuming it's plugged into your existing network via Ethernet)
Find the VEN401 IP address from your UVerse gateway IP Allocation page..
on my NVG589 it's http://192.168.1.254/cgi-bin/ipalloc.ha

In the below URLs, replace 192.168.1.xxx with your VEN401 IP address

http://192.168.1.xxx/Factorydefaults.asp
Restore Default Settings

http://192.168.1.xxx/radio.asp
Change from
Mode: Access Point
to
Mode: Wireless Ethernet
Apply

reboot the VEN401 if the VEN401 does not reboot automatically

http://192.168.1.xxx/Wireless_WPS_Client.asp
Select your existing AP in the "WPS AP List"

Press the WPS button on your existing access point .. in my case it is a VEN501 (5GHz)
On the webpage click the button under option 1
"1. If your AP device has a Wi-Fi Protected Setup button, press that button and then click the button on the
right <button>"

You will get a status update page .. configuration changes saved. Click ok.
It will return to the WPS setup page.
The "WPS Current Status:" should change to Enrolling, then eventually, Succeeded.

Once this is done you should have Internet access through your VEN401!
You will have to unplug the Ethenet to the VEN401 & plug the VEN401 into whatever device needs internet access, e.g. your Dish network / Sling receiver.

28 Apr 2015, 22:46

Apparently the behavior of this unit is not particularly consistent.. but on my side I still confirm it works. I don't know how many versions of VEN401 are out there, but I have 3 of them and they all work with the image linked in the first post.
The board of my VEN401s is this:

I recently recompiled a new master image for this unit working as pure AP, taking away some stuff I didn't need (like v6 stuff, ppp/atm) and adding some other features like lldp. Opkg is still available to custmize it further.
Here is the link:
Openwrt Barrier Breaker for VEN401

here is the list of included and removed (-) packages:

cmdftp opkg luci iwinfo bmon nano ddns-scripts wireless-tools ethtool netcat lldpd iperf ssmtp -odhcp6c -odhcpd -ppp -ppp-mod-pppoe -ppp -ppp-mod-pppoa -ppp-mod-pppoe -kmod-pppoa -atm-tools -linux-atm -br2684ctl -ip6tables

here is the default interface configuration:

config interface 'loopback'
        option ifname 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config interface 'lan'
        option type 'bridge'
        option proto 'dhcp'
        option delegate '0'
        option stp '1'
        option ifname 'eth0'

and here is the boot sequence and ifconfig output:

Decompressing...done
Decompressing...done


CFE version 5.10.128.13 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: Fri Jan 22 01:01:45 PST 2010 (hwnbuild@lc-sj1-2224)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 131072(0x20000)
Found a 8MB ST compatible serial flash
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.10.128.13
CPU type 0x19740: 354MHz
Tot mem: 65536 KBytes

CFE mem:    0x80700000 - 0x8079D720 (644896)
Data:       0x807339E0 - 0x807367A0 (11712)
BSS:        0x807367A0 - 0x80737720 (3968)
Heap:       0x80737720 - 0x8079B720 (409600)
Stack:      0x8079B720 - 0x8079D720 (8192)
Text:       0x80700000 - 0x807339D8 (211416)

Device eth0:  hwaddr 00-25-2E-xx-xx-xx, ipaddr 192.168.1.10, mask 255.255.255.0
        gateway not set, nameserver not set
Loader:raw Filesys:tftp Dev:eth0 File:: Options:(null)
Loading: Failed.
Could not load :: Timeout occured
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 3712 bytes read
Entry at 0x80001000
Closing network.
Starting program at 0x80001000
[    0.000000] Linux version 3.10.49 (bb@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r42625) ) #3 Wed Oct 1 14:56:26 CEST 2014
[    0.000000] CPU revision is: 00019740 (MIPS 74Kc)
[    0.000000] bcm47xx: using bcma bus
[    0.000000] bcma: bus0: Found chip with id 0x4716, rev 0x01 and package 0x09
[    0.000000] bcma: bus0: Core 0 found: ChipCommon (manuf 0x4BF, id 0x800, rev 0x1F, class 0x0)
[    0.000000] bcma: bus0: Core 3 found: MIPS 74K (manuf 0x4A7, id 0x82C, rev 0x01, class 0x0)
[    0.000000] bcma: bus0: Found M25P64 serial flash (size: 8192KiB, blocksize: 0x10000, blocks: 128)
[    0.000000] bcma: bus0: Early bus registered
[    0.000000] MIPS: machine is Unknown Board
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  noinitrd console=ttyS0,115200
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 61532k/65536k available (2373k kernel code, 4004k reserved, 588k data, 168k init, 0k highmem)
[    0.000000] NR_IRQS:128
[    0.000000] Setting up vectored interrupts
[    0.070000] Calibrating delay loop... 176.53 BogoMIPS (lpj=882688)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 512
[    0.070000] NET: Registered protocol family 16
[    0.100000] bio: create slab <bio-0> at 0
[    0.100000] Switching to clocksource MIPS
[    0.110000] NET: Registered protocol family 2
[    0.110000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.110000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.110000] TCP: Hash tables configured (established 512 bind 512)
[    0.110000] TCP: reno registered
[    0.110000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.110000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.110000] NET: Registered protocol family 1
[    0.110000] bcma: bus0: Core 1 found: IEEE 802.11 (manuf 0x4BF, id 0x812, rev 0x11, class 0x0)
[    0.110000] bcma: bus0: Core 2 found: GBit MAC (manuf 0x4BF, id 0x82D, rev 0x00, class 0x0)
[    0.110000] bcma: bus0: Core 4 found: USB 2.0 Host (manuf 0x4BF, id 0x819, rev 0x04, class 0x0)
[    0.110000] bcma: bus0: Core 5 found: PCIe (manuf 0x4BF, id 0x820, rev 0x0E, class 0x0)
[    0.110000] bcma: bus0: Core 6 found: DDR1/DDR2 Memory Controller (manuf 0x4BF, id 0x82E, rev 0x01, class 0x0)
[    0.110000] bcma: bus0: Core 7 found: Internal Memory (manuf 0x4BF, id 0x80E, rev 0x07, class 0x0)
[    0.110000] bcma: bus0: Core 8 found: I2S (manuf 0x4BF, id 0x834, rev 0x00, class 0x0)
[    0.130000] can not parse nvram name sb/1/ag0(null) with value 4.5 got -22
[    0.130000] can not parse nvram name sb/1/ag1(null) with value 4.5 got -22
[    0.130000] alpha2 is too long ALL
[    0.180000] can not parse nvram name sb/1/ag2(null) with value 4.5 got -22
[    0.380000] bcma: bus0: PCIEcore in host mode found
[    0.380000] bcma: bus0: This PCIE core is disabled and not working
[    0.380000] bcma: bus0: Bus registered
[    0.390000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.390000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.390000] msgmni has been set to 120
[    0.390000] io scheduler noop registered
[    0.390000] io scheduler deadline registered (default)
[    0.390000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.420000] serial8250.0: ttyS0 at MMIO 0xb8000300 (irq = 2) is a U6_16550A
[    0.820000] console [ttyS0] enabled
[    0.970000] 6 bcm47xxpart partitions found on MTD device bcm47xxsflash
[    0.970000] Creating 6 MTD partitions on "bcm47xxsflash":
[    0.980000] 0x000000000000-0x000000020000 : "boot"
[    0.990000] 0x000000020000-0x0000007f0000 : "firmware"
[    1.000000] 0x00000002001c-0x00000002090c : "loader"
[    1.010000] 0x00000002090c-0x00000012d000 : "linux"
[    1.010000] mtd: partition "linux" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    1.030000] 0x00000012d000-0x0000007f0000 : "rootfs"
[    1.030000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    1.050000] mtd: device 4 (rootfs) set to be root filesystem
[    1.050000] mtd: partition "rootfs_data" created automatically, ofs=0x400000, len=0x3f0000
[    1.060000] 0x000000400000-0x0000007f0000 : "rootfs_data"
[    1.070000] 0x0000007f0000-0x000000800000 : "nvram"
[    1.090000] bgmac bcma0:1: Found PHY addr: 0
[    1.100000] ------------[ cut here ]------------
[    1.100000] WARNING: at drivers/net/phy/b53/b53_mdio.c:69 b53_mdio_op+0xc0/0xec()
[    1.110000] Modules linked in:
[    1.110000] CPU: 0 PID: 1 Comm: swapper Not tainted 3.10.49 #3
[    1.120000] Stack : 00000000 00000000 00000000 00000000 803469c6 00000032 83821b00 80330000
      802919f8 802d6d13 00000001 80335ea0 83821b00 80330000 00000000 c0000000
      802a829c 802328e4 00000003 8019d520 802a80bc 80330000 802930d4 83823984
      00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
      00000000 00000000 00000000 00000000 00000000 00000000 00000000 83823910
      ...
[    1.160000] Call Trace:
[    1.160000] [<801d8d90>] show_stack+0x48/0x70
[    1.160000] [<802422c0>] warn_slowpath_common+0x78/0xa8
[    1.170000] [<80242378>] warn_slowpath_null+0x18/0x24
[    1.170000] [<80061e68>] b53_mdio_op+0xc0/0xec
[    1.180000] [<80062108>] b53_mdio_read8+0x2c/0x64
[    1.180000] [<80062ea0>] b53_switch_detect+0x40/0x23c
[    1.190000] [<8006263c>] b53_phy_probe+0x64/0xac
[    1.190000] [<80193e40>] phy_probe+0x7c/0xb0
[    1.200000] [<800d2cb0>] driver_probe_device+0xc8/0x21c
[    1.200000] [<8008d2bc>] bus_for_each_drv+0x9c/0xac
[    1.210000] [<800b5a14>] device_attach+0x78/0x9c
[    1.210000] [<8008d368>] bus_probe_device+0x3c/0xcc
[    1.220000] [<800b57b4>] device_add+0x444/0x578
[    1.220000] [<80193008>] phy_device_register+0x3c/0x90
[    1.230000] [<8015368c>] mdiobus_scan+0xb8/0xf0
[    1.230000] [<801534f8>] mdiobus_register+0x10c/0x1b8
[    1.240000] [<80073ed8>] bgmac_probe+0x628/0x868
[    1.240000] [<800d2cb0>] driver_probe_device+0xc8/0x21c
[    1.250000] [<80030994>] __driver_attach+0x7c/0xb4
[    1.250000] [<8008d210>] bus_for_each_dev+0x98/0xa8
[    1.260000] [<8008ced8>] bus_add_driver+0x108/0x24c
[    1.260000] [<800d2ed8>] driver_register+0xbc/0x16c
[    1.270000] [<802f692c>] bgmac_init+0x1c/0x44
[    1.270000] [<800c8160>] do_one_initcall+0xf0/0x198
[    1.280000] [<802e6a80>] kernel_init_freeable+0x150/0x208
[    1.280000] [<800057b0>] kernel_init+0x10/0x10c
[    1.290000] [<80001478>] ret_from_kernel_thread+0x14/0x1c
[    1.290000] 
[    1.300000] ---[ end trace 20e3cd45cdeec113 ]---
[    1.300000] Broadcom B53 (1): probe of bgmac-0-0:00 failed with error -5
[    1.310000] libphy: bgmac mii bus: probed
[    1.320000] bgmac: Broadcom 47xx GBit MAC driver loaded
[    1.320000] bcm47xx-wdt bcm47xx-wdt.0: BCM47xx Watchdog Timer enabled (30 seconds)
[    1.330000] TCP: cubic registered
[    1.340000] NET: Registered protocol family 17
[    1.340000] Bridge firewalling registered
[    1.340000] 8021q: 802.1Q VLAN Support v1.8
[    1.370000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    1.370000] Freeing unused kernel memory: 168K (802e6000 - 80310000)
procd: Console is alive
procd: - watchdog -
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
jffs2 is ready
jffs2 is ready
[    8.640000] jffs2: notice: (221) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 9 of xref (0 dead, 2 orphan) found.
switching to overlay
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[   13.250000] wl: module license 'unspecified' taints kernel.
[   13.250000] Disabling lock debugging due to kernel taint
[   13.430000] wl0: Broadcom BCM432a 802.11 Wireless Controller 5.10.56.27
[   13.440000] SSB/BCMA glue driver successfully attached
[   13.460000] nf_conntrack version 0.5.0 (964 buckets, 3856 max)
[   13.590000] xt_time: kernel timezone is -0000
[   13.610000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   20.710000] device eth0 entered promiscuous mode
[   20.740000] br-lan: port 1(eth0) entered listening state
[   20.740000] br-lan: port 1(eth0) entered listening state
[   22.740000] br-lan: port 1(eth0) entered learning state
[   23.330000] device wl0 entered promiscuous mode
[   23.340000] br-lan: port 2(wl0) entered listening state
[   23.340000] br-lan: port 2(wl0) entered listening state
[   24.380000] br-lan: port 1(eth0) received tcn bpdu
[   24.390000] br-lan: topology change detected, propagating
[   24.740000] br-lan: topology change detected, propagating
[   24.740000] br-lan: port 1(eth0) entered forwarding state
[   25.340000] br-lan: port 2(wl0) entered learning state
[   27.340000] br-lan: topology change detected, propagating
[   27.340000] br-lan: port 2(wl0) entered forwarding state
procd: - init complete -



BusyBox v1.22.1 (2014-09-21 02:32:34 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 BARRIER BREAKER (14.07, r42625)
 -----------------------------------------------------
  * 1/2 oz Galliano         Pour all ingredients into
  * 4 oz cold Coffee        an irish coffee mug filled
  * 1 1/2 oz Dark Rum       with crushed ice. Stir.
  * 2 tsp. Creme de Cacao
 -----------------------------------------------------
root@OpenWrt:/# ifco
root@OpenWrt:/# ifconfig [J
br-lan    Link encap:Ethernet  HWaddr 00:25:2E:xx:xx:xx  
          inet addr:192.168.1.20  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:33 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:5408 (5.2 KiB)  TX bytes:2864 (2.7 KiB)

eth0      Link encap:Ethernet  HWaddr 00:25:2E:xx:xx:xx  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:10 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:4 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:28 errors:0 dropped:0 overruns:0 frame:0
          TX packets:28 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4382 (4.2 KiB)  TX bytes:4382 (4.2 KiB)

wl0       Link encap:Ethernet  HWaddr 00:25:2E:F0:F6:14  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:11 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:748 (748.0 B)
          Interrupt:3 Base address:0x1000

12 Jul 2015, 15:57

after a lot of trial and error, i have not been successful getting opnewrt to run in client bridge mode. however, i was able to do this was a dd-wrt build - also after a lot of trial and error.
the cfe on this device is very forgiving luckily.

see http://www.dd-wrt.com/phpBB2/viewtopic. … 590#974590