It is Wednesday my dudes! Hello!
I’ve had this rather old router lying around doing nothing — TEW-691GR — and I thought maybe it’s the perfect specimen to try my newbie OpenWrt skills on.
The firmware selector told me that release 23.05.5 is compatible, so I downloaded that. The wiki page did not contain any custom instructions on how to do the preliminary flashing, so I went the generic way: logged into the stock web UI and uploaded openwrt-23.05.5-ramips-rt3883-trendnet_tew-691gr-squashfs-factory.bin on the firmware update page.
The upload process went OK (or so it seemed), the router rebooted itself... and has been stuck in the reboot loop ever since.
Thank the balls the router has TTL-UART (3.3V, 57600 8-N-1). The photo on the wiki page contains the pinout. I’ve obtained the boot log, which contains the following (infinitely repeated) info:
Boot log
Board: Ralink APSoC DRAM: 64 MB
relocate_code Pointer at: 83fac000
Set info->start[0]=BC000000
flash_protect ON: from 0xBC000000 to 0xBC01F2EB
flash_protect ON: from 0xBC030000 to 0xBC030FFF
*** Warning - bad CRC, using default environment
============================================
Ralink UBoot Version: 3.4.0.0
--------------------------------------------
ASIC 3883_MP (MAC to VITESSE Mode)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: NOR Flash
Date:Sep 29 2010 Time:10:49:55
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 480 MHZ ####
SDRAM bus set to 32 bit
SDRAM size =64 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFT
4 3 2 1 0
3: System Boot system code via Flash.
## Booting image at bc050000 ...
Image Name: MIPS OpenWrt Linux-
Created: 2024-09-23 12:34:46 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1837916 Bytes = 1.8 MB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64
Starting kernel ...
[ 0.000000] Linux version 5.15.167 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24106-10cc5fcd00) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Mon Sep 23 12:34:46 2024
[ 0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[ 0.000000] MIPS: machine is TRENDnet TEW-691GR
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16256
[ 0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 57648K/65536K available (4534K kernel code, 581K rwdata, 700K rodata, 1216K init, 206K bss, 7888K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 256
[ 0.000000] CPU Clock: 480MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7963585194 ns
[ 0.000003] sched_clock: 32 bits at 240MHz, resolution 4ns, wraps every 8947848189ns
[ 0.015597] Calibrating delay loop... 239.61 BogoMIPS (lpj=1198080)
[ 0.097846] pid_max: default: 32768 minimum: 301
[ 0.108021] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.122476] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.147269] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.166796] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.180333] pinctrl core: initialized pinctrl subsystem
[ 0.192883] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.205542] thermal_sys: Registered thermal governor 'step_wise'
[ 0.223843] rt2880_gpio 10000600.gpio: registering 24 gpios
[ 0.246836] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[ 0.259728] rt2880_gpio 10000638.gpio: registering 16 gpios
[ 0.274403] clocksource: Switched to clocksource MIPS
[ 0.286764] NET: Registered PF_INET protocol family
[ 0.296741] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.312560] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.329369] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.344685] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.359924] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.373937] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.386809] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.399835] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.414145] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.425425] PCI: CLS 0 bytes, default 32
[ 0.433462] rt-timer 10000100.timer: maximum frequency is 4882Hz
[ 0.451621] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[ 0.470877] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.482439] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.503927] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 0.521756] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.539040] printk: console [ttyS0] disabled
[ 0.547620] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[ 0.567302] printk: console [ttyS0] enabled
[ 0.567302] printk: console [ttyS0] enabled
[ 0.583857] printk: bootconsole [early0] disabled
[ 0.583857] printk: bootconsole [early0] disabled
[ 0.604861] physmap-flash 1c000000.flash: physmap platform flash device: [mem 0x1c000000-0x1c7fffff]
[ 0.623240] 1c000000.flash: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022a7
[ 0.643618] Amd/Fujitsu Extended Query Table at 0x0040
[ 0.653911] Amd/Fujitsu Extended Query version 1.1.
[ 0.664000] 1c000000.flash: Swapping erase regions for top-boot CFI table.
[ 0.677719] number of CFI chips: 1
[ 0.708567] 4 fixed-partitions partitions found on MTD device 1c000000.flash
[ 0.723919] Creating 4 MTD partitions on "1c000000.flash":
[ 0.735056] 0x000000000000-0x000000030000 : "u-boot"
[ 0.750003] 0x000000030000-0x000000040000 : "u-boot-env"
[ 0.762393] 0x000000040000-0x000000050000 : "factory"
[ 0.776894] 0x000000050000-0x000000800000 : "firmware"
[ 0.787275] mtd: partition "firmware" extends beyond the end of device "1c000000.flash" -- size truncated to 0x3b0000
[ 0.811486] 2 uimage-fw partitions found on MTD device firmware
[ 0.823396] Creating 2 MTD partitions on "firmware":
[ 0.833408] 0x000000000000-0x0000001c0b9c : "kernel"
[ 0.843340] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[ 0.862637] 0x0000001c0b9c-0x0000003b0000 : "rootfs"
[ 0.872664] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[ 0.892623] mtd: setting mtd5 (rootfs) as root device
[ 0.902825] mtdsplit: squashfs has invalid size in "rootfs"
[ 0.939153] switch0: Atheros AR8316 rev. 1 switch registered on mdio-bus
[ 0.952938] ar8316: Using port 4 as switch port
[ 1.002723] mtk_soc_eth 10100000.ethernet: connected port 0 to PHY at mdio-bus:00 [uid=004dd041, driver=Atheros AR8216/AR8236/AR8316]
[ 1.027728] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[ 1.045556] rt2880_wdt 10000120.watchdog: Initialized
[ 1.058027] NET: Registered PF_INET6 protocol family
[ 1.077573] Segment Routing with IPv6
[ 1.085182] In-situ OAM (IOAM) with IPv6
[ 1.093252] NET: Registered PF_PACKET protocol family
[ 1.103476] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 1.129784] 8021q: 802.1Q VLAN Support v1.8
[ 1.141031] clk: Disabling unused clocks
[ 1.150886] Flash size not aligned to erasesize, reducing to 1920KiB
[ 1.163906] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x7368 instead
[ 1.182937] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x052a instead
[ 1.201886] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0x6066 instead
[ 1.220807] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0x000f instead
[ 1.239723] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000014: 0x0004 instead
[ 1.258673] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x02c0 instead
[ 1.277601] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000001c: 0x0004 instead
[ 1.296524] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000020: 0x09fb instead
[ 1.315450] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000028: 0x8914 instead
[ 1.334369] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000030: 0x890c instead
[ 1.353296] jffs2: Further such events for this erase block will not be printed
[ 1.368165] jffs2: Empty flash at 0x00000038 ends at 0x00000040
[ 1.390165] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x2393 instead
...(a hundred more messages like this)...
[ 4.991952] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00110020: 0x55dc instead
[ 5.010876] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00110024: 0xf8fe instead
[ 5.029794] jffs2: Further such events for this erase block will not be printed
[ 5.046146] jffs2: Old JFFS2 bitmask found at 0x00112bcc
[ 5.056742] jffs2: You cannot use older JFFS2 filesystems with newer kernels
[ 5.073740] jffs2: Old JFFS2 bitmask found at 0x001174c4
[ 5.084339] jffs2: You cannot use older JFFS2 filesystems with newer kernels
[ 5.103590] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00120000: 0x538b instead
[ 5.122519] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00120004: 0x6655 instead
...
[ 7.653166] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x001d0024: 0x10ec instead
[ 7.672082] jffs2: Further such events for this erase block will not be printed
[ 7.697103] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes
[ 7.713932] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 30
[ 7.726029] VFS: Cannot open root device "(null)" or unknown-block(31,5): error -5
[ 7.741155] Please append a correct "root=" boot option; here are the available partitions:
[ 7.757826] 1f00 192 mtdblock0
[ 7.757846] (driver?)
[ 7.770877] 1f01 64 mtdblock1
[ 7.770893] (driver?)
[ 7.783920] 1f02 64 mtdblock2
[ 7.783937] (driver?)
[ 7.796976] 1f03 3776 mtdblock3
[ 7.796993] (driver?)
[ 7.810018] 1f04 1794 mtdblock4
[ 7.810035] (driver?)
[ 7.823060] 1f05 1981 mtdblock5
[ 7.823076] (driver?)
[ 7.836112] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,5)
[ 7.852761] Rebooting in 1 seconds..
It seems to me that flash memory is faulty, but I might be wrong. U-Boot is working, but not much else. Can somebody knowledgeable tell me what’s happening please?
And one more thing — from what I’ve gathered online, it seems that TEW-691GR is not a good candidate to be converted to OpenWrt, so it would be wise just go back to the stock firmware and forget the whole thing. Can anybody provide the necessary steps?
Thank you.