Canyon CNP-WF514N3A

Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware
Goto page 1, 2, 3, 4  Next
Author Message
werk666
DD-WRT Novice


Joined: 24 Mar 2010
Posts: 8

PostPosted: Thu Dec 22, 2011 13:12    Post subject: Canyon CNP-WF514N3A Reply with quote
What the analog board inside? Maybe that same - Tp-link TL-WR1043ND? No search results.
Processor
CPU Atheros AR9132 + AR9103
Memory
Installed Buffer Memory Storage Capacity 32 MB
Installed Flash Memory Storage Capacity 8 MB
THX
Sponsor
Sash
DD-WRT Guru


Joined: 20 Sep 2006
Posts: 17619
Location: Hesse/Germany

PostPosted: Thu Dec 22, 2011 18:01    Post subject: Reply with quote
do
http://www.dd-wrt.com/site/support/router-detection

_________________
Forum Guidelines...How to get help
&
Forum Rules
&
RTFM/STFW
&
Throw some buzzwords into the WIKI search Exclamation
_________________
I'm NOT rude, just offer pure facts!
_________________
Atheros (TP-Link & Clones, etc ) debrick service in EU
_________________
Guide on HowTo be Safe, Secure and Protect Your Online Anonymity!
p1001
DD-WRT Novice


Joined: 02 Jan 2012
Posts: 22

PostPosted: Mon Jan 02, 2012 13:30    Post subject: Reply with quote
Okay, I also have this router and would really like the dd-wrt firmware so that I can use it with my 3g modem.

Below are the pictures of the board. Firstly, I would like to know if anyone has links to photos of the internals of other routers that use the same chipset, so that we can compare?





The outside looks like it could be the same as the TP-link WR1043nd.

http://www.tp-link.com/en/products/details/?model=TL-WR1043ND.

It also looks like there is a J-TAG connector on the board, though I am not sure...

Any help would be appreciated.
p1001
DD-WRT Novice


Joined: 02 Jan 2012
Posts: 22

PostPosted: Mon Jan 02, 2012 13:57    Post subject: Reply with quote
Okay, so the board looks exactly like the TP-LINK:

http://wiki.openwrt.org/toh/tp-link/tl-wr1043nd

I will start getting things together for the J-TAG cable, then try to backup the current flash.
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Mon Jan 02, 2012 15:29    Post subject: Reply with quote
p1001 wrote:
Okay, so the board looks exactly like the TP-LINK:

http://wiki.openwrt.org/toh/tp-link/tl-wr1043nd

I will start getting things together for the J-TAG cable, then try to backup the current flash.


It is a re-branded TL-WR1043 so it can get dd-wrt support.
Bootlog and a copy of stock firmware is needed, jtag may be difficult for you since there is afaik no public domain jtag firmware handling AR9132.
A serial (TTL 3.3V) console connection will work, you can dump the mtd partitions into a USB-mounted flash stick.

_________________
Kernel panic: Aiee, killing interrupt handler!
p1001
DD-WRT Novice


Joined: 02 Jan 2012
Posts: 22

PostPosted: Mon Jan 02, 2012 16:08    Post subject: Reply with quote
LOM wrote:

It is a re-branded TL-WR1043 so it can get dd-wrt support.
Bootlog and a copy of stock firmware is needed, jtag may be difficult for you since there is afaik no public domain jtag firmware handling AR9132.
A serial (TTL 3.3V) console connection will work, you can dump the mtd partitions into a USB-mounted flash stick.


Thank you very much, I will look into that.
p1001
DD-WRT Novice


Joined: 02 Jan 2012
Posts: 22

PostPosted: Mon Jan 02, 2012 19:01    Post subject: Reply with quote
Okay, so I've been unsuccessful in finding stock firmware. Seems that there is no firmware available from canyon-tech.com for this router.

I did manage to get a bootlog:

Code:

 CNP-WF514N3A mips #1 Fri Sep 3 12:18:20 CST 2010 (none)
CNP-WF514N3A login:

U-Boot 1.1.4 (Sep  3 2010 - 12:22:02)

AP83 (ar9100) U-boot 0.0.11
DRAM: 
sri
32 MB
id read 0x100000ff
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
No valid address in Flash. Using fixed address
: cfg1 0xf cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Autobooting in 1 seconds## Booting image at bf020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.15--LSDK-6.1.1.40 gcc version 3.4.4 #1 Fri Sep 3 12:18:20 CST 2010
flash_size passed from bootloader = 8
CPU revision is: 00019374
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=31:2 rootfstype=squashfs init=/sbin/init
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 256 (order: 8, 4096 bytes)
Using 200.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 30148k/32768k available (1406k kernel code, 2604k reserved, 293k data, 112k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
Jumpstart button pressed.
SCSI subsystem initialized
AR7100 GPIOC major 0
squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
Initializing Cryptographic API
io scheduler noop registered
io scheduler deadline registered
Serial: 8250/16550 driver $Revision: #1 $ 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
RAMDISK driver initialized: 1 RAM disks of 8192K size 1024 blocksize
PPP generic driver version 2.4.2
PPPoX init, max protocols:3
NET: Registered protocol family 24
pppox protocol 0 register. max:3
cmdlinepart partition parsing not available
Searching for RedBoot partition table
5 RedBoot partitions found on MTD device ar7100-nor0
Creating 5 MTD partitions on "ar7100-nor0":
0x00000000-0x00020000 : "boot"
0x00020000-0x00120000 : "kernel"
0x00120000-0x007e0000 : "rootfs"
0x007e0000-0x007f0000 : "config"
0x007f0000-0x00800000 : "art"
->Oops: flash id 0x10216 .
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
ar7100wdt_init: Registering WDT success
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 112k freed
init started:  BusyBox v1.01 (2010.09.17-01:36+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5
This board use 2.6.15
ip_conntrack version 2.4 (256 buckets, 5120 max) - 244 bytes per conntrack
statistics: module license 'BSD' taints kernel.
insmod: cannot open module `/lib/modules/2.6.15/kernel/flashid.ko': No such file or directory
pppox protocol 1 register. max:3
PPPoL2TP kernel driver, V0.17. fixed many bug. drop rcv pkts and xmit pkts while no buffer, use pass time HZ/4.only drop ip pkt. no printk. xl2tpd 15 retries xmit. 08.20
PPTP driver version 0.8.3
pppox protocol 2 register. max:3
insmod: cannot open module `/lib/modules/2.6.15/kernel/harmony.ko': No such file or directory
Now flash open!
Now flash open!
AG7100: Length per segment 1536
AG7100: Max segments per packet 1
AG7100: Max tx descriptor count    40
AG7100: Max rx descriptor count    252
AG7100: fifo cfg 3 00780008

 (none) mips #1 Fri Sep 3 12:18:20 CST 2010 (none)
(none) login: rtl8368s_getAsicPHYRegs(0, 1, 22, &data) return is 0, data is 0x00001000
++ PVID: 0x00000001, bitmap: 0x00000021
++ PVID: 0x00000003, bitmap: 0x0000003e
++ PVID: 0x00000005, bitmap: 0x0000003e
++ PVID: 0x00000007, bitmap: 0x0000003e
++ PVID: 0x00000009, bitmap: 0x0000003e
vtable vid: 0x00000002, bitmap 0x00000022
vtable vid: 0x00000004, bitmap 0x00000024
vtable vid: 0x00000006, bitmap 0x00000026
vtable vid: 0x00000008, bitmap 0x00000028
vtable vid: 0x0000000a, bitmap 0x0000002a
vtable vid: 0x0000000c, bitmap 0x0000002c
vtable vid: 0x0000000e, bitmap 0x0000002e
vtable vid: 0x00000010, bitmap 0x00000030
vtable vid: 0x00000012, bitmap 0x00000032
vtable vid: 0x00000014, bitmap 0x00000034
vtable vid: 0x00000016, bitmap 0x00000036
vtable vid: 0x00000018, bitmap 0x00000038
vtable vid: 0x0000001a, bitmap 0x0000003a
vtable vid: 0x0000001c, bitmap 0x0000003c
vtable vid: 0x0000001e, bitmap 0x0000003e
AG7100: pll reg 0x18050014: 0x1a000000  Writing 4
SIOCETHTOOL
bridge: can't decode speed from eth0: 0
device eth0 entered promiscuous mode
Now flash open!
AG7100: pll reg 0x18050014: 0x1a000000  Writing 4
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
ip_conntrack_rtsp v0.01 loading
ip_nat_rtsp v0.01 loading
ath_hal: 0.9.17.1 (AR5416, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
wlan: 0.8.4.2 (Atheros/multi-bss)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 0.9.4.5 (Atheros/multi-bss)
Howl Revision ID 0xb9 <6>wifi0: Atheros AR9100 WiSoC: mem=0xb80c0000, irq=2
wlan_me: Version 0.1
Copyright (c) 2008 Atheros Communications, Inc. All Rights Reserved
wlan: mac acl policy registered

TP_Flags:6****
The selected channel is 1
Country ie is DE
Country ie is DE
maxrate = 300000
Country ie is DE
br0: port 1(eth0) entering disabled state
AG7100: pll reg 0x18050014: 0x1a000000  Writing 4
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
device ath0 entered promiscuous mode
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
br0: port 2(ath0) entering disabled state
Country ie is DE
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
br0: port 2(ath0) entering disabled state

TP_Flags:6****

TP_Flags:0****
Country ie is DE
br0: port 2(ath0) entering learning state
br0: topology change detected, propagating
br0: port 2(ath0) entering forwarding state
fuse init (API version 7.8)
fuse distribution version: 2.7.4
usbcore: registered new driver usbfs
usbcore: registered new driver hub
Port Status c000004
ar7100-ehci ar7100-ehci.0: ATH EHCI
ar7100-ehci ar7100-ehci.0: new USB bus registered, assigned bus number 1
ar7100-ehci ar7100-ehci.0: irq 3, io mem 0x1b000000
hcc_params addr 0xbb000108 val 0x6 hcs_params addr 0xbb000104 val 0x10011
ar7100-ehci ar7100-ehci.0: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
SIOCENABLEFWD
Inteference detected
rx_clear=100, rx_frame=0, tx_frame=0
ath_bstuck_tasklet... Calling ath_internal reset
erase 0xbf020000 +7c0000
Password:
Login incorrect
CNP-WF514N3A login:
CNP-WF514N3A login: admin
login: no valid shadow password

 CNP-WF514N3A mips #1 Fri Sep 3 12:18:20 CST 2010 (none)
CNP-WF514N3A login:



Seems that the bootloader is in the same position as the t-link firmware.

Problem is when I execute "erase 0xbf020000 +7c0000", I get prompted for a password, and "admin" does not work. Also, if I type "admin" as login, it gives the following:
"login: no valid shadow password"

Does anyone have any ideas? I will resort to google in the mean time.

TIA
p1001
DD-WRT Novice


Joined: 02 Jan 2012
Posts: 22

PostPosted: Mon Jan 02, 2012 19:13    Post subject: Reply with quote
Did some further tests - seems I cannot even "cat" without being asked for a password.

It also seems that login "root" exists, but I cannot guess the correct password.

(oh and I did do a factory reset before I started Smile )

EDIT:

Seems that the easiest would be to remove the flash chip and read its contents, and reprogram it with either the stock TP-Link firmware or with a DD-WRT image that has the bootloader and everything already.
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Tue Jan 03, 2012 11:22    Post subject: Reply with quote
The stock firmware is needed in able to do a factory-to-ddwrt file and if it isn't available from the seller then someone has to take it out of a router.
Programming the flash externally will of course solve your problems but no other user can benefit from it unless you read out the stock content of the flash before converting it to a 1043.

For the serial console login, try root/5up

_________________
Kernel panic: Aiee, killing interrupt handler!
p1001
DD-WRT Novice


Joined: 02 Jan 2012
Posts: 22

PostPosted: Tue Jan 03, 2012 13:01    Post subject: Reply with quote
I was planning on reading the stock firmware from the flash before reprogramming it, but if the login/password you provided works, I will first try it through the console.

Is there a way to save the stock firmware from the serial console? I mean, is there a way to save the entire flash contents from the console in one go? I am going to try a "cat /dev/mtd/0 > *outfile*" for all of the contents of /mtd/, but if I can do it all in one go, that might be beneficial.

Regards.
p1001
DD-WRT Novice


Joined: 02 Jan 2012
Posts: 22

PostPosted: Tue Jan 03, 2012 15:15    Post subject: Reply with quote
Okay, root/5up worked, but "erase" command is not found ,neither is any other I need to do the upgrade.

Going to download IMPACT to see if I can read the flash with my xilinx platform usb cable.
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Tue Jan 03, 2012 17:00    Post subject: Reply with quote
p1001 wrote:
Okay, root/5up worked, but "erase" command is not found ,neither is any other I need to do the upgrade.

Going to download IMPACT to see if I can read the flash with my xilinx platform usb cable.


Sigh..
Erasing is not the most important step right now, getting the stock software out of the router is.
Insert a USB flash stick and mount in the filesystem if it doesn't get auto mounted by stock firmware.
Copy the mtd partitions to the flash stick, either by cat or by dd.

_________________
Kernel panic: Aiee, killing interrupt handler!
p1001
DD-WRT Novice


Joined: 02 Jan 2012
Posts: 22

PostPosted: Tue Jan 03, 2012 18:03    Post subject: Reply with quote
LOM wrote:

Sigh..
Erasing is not the most important step right now, getting the stock software out of the router is.
Insert a USB flash stick and mount in the filesystem if it doesn't get auto mounted by stock firmware.
Copy the mtd partitions to the flash stick, either by cat or by dd.


Whoops, sorry I forgot to mention that I have already done that.

I got the following:
mtd0 128kb
mtdr0 128kb (contents same as above)
mtdblock0 128kb (contents same as above)
mtdblock1 1024kb
mtdblock2 6912kb
mtdblock3 64kb
mtdblock4 64kb

Cross referencing that with the bootlog gives:
mtdblock0 "boot"
mtdblock1 "kernel"
mtdblock2 "rootfs"
mtdblock3 "config"
mtdblock4 "art"

I did not have much success with the xilinx tools - I don't want to download the whole suite, bandwidth is too expensive here. I will get a copy tomorrow.

I will also get a DB25 plug to make a different programming cable in case. In the mean time, if you have any other suggestions on how to reflash this router, I am eagerly awaiting any advice.
p1001
DD-WRT Novice


Joined: 02 Jan 2012
Posts: 22

PostPosted: Tue Jan 03, 2012 18:09    Post subject: Reply with quote
Here are stock FW files. (If I shouldn't post them here, let me know and I will remove them)

As a side note - there are a couple of logins that don't have passwords and gives the same access - like "bin" and "adm" (as read from the passwd file)
LOM
DD-WRT Guru


Joined: 28 Dec 2008
Posts: 7647

PostPosted: Tue Jan 03, 2012 18:18    Post subject: Reply with quote
p1001 wrote:


I got the following:
mtd0 128kb
mtdr0 128kb (contents same as above)
mtdblock0 128kb (contents same as above)
mtdblock1 1024kb
mtdblock2 6912kb
mtdblock3 64kb
mtdblock4 64kb

Cross referencing that with the bootlog gives:
mtdblock0 "boot"
mtdblock1 "kernel"
mtdblock2 "rootfs"
mtdblock3 "config"
mtdblock4 "art"

I did not have much success with the xilinx tools - I don't want to download the whole suite, bandwidth is too expensive here. I will get a copy tomorrow.

I will also get a DB25 plug to make a different programming cable in case. In the mean time, if you have any other suggestions on how to reflash this router, I am eagerly awaiting any advice.


The ro mtd devices have the same contents as those without ro, the ro devices are the readonly versions.

Can you pack those files into an archive and upload to some free file hosts where I can pick them up?
I may be able, after having a look at them, to patch up one of Brainslayers factory-to-dd-wrt files for 1043 to work on this router.
In the meantime, don't erase the current stock firmware since you will need to have it on the router to verify that the patched file works.

I assume that stock firmware has a firmware update section in the gui..

_________________
Kernel panic: Aiee, killing interrupt handler!
Goto page 1, 2, 3, 4  Next Display posts from previous:    Page 1 of 4
Post new topic   Reply to topic    DD-WRT Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum