OpenWrt Forum Archive

Topic: Debricking through JTAG hardware

The content of this topic has been archived on 2 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Good time of a day!

Please, help me choose suitable hardware to connect to JTAG of my router. What I found near me:
1. AVR JTAG ICE
http://www.ebay.com/itm/AVR-JTAG-USB-em … 0908327724
2. J-Link V8

Can I use any of these things to connect my router to USB and to reflash firmware?

Thanks in advance!

One more question about my Trendnet TEW-691GR router: what do you think, is it looks like JTAG port?
Common view
Components side
Back side

(Last edited by anton.v.timin on 22 Jan 2015, 13:09)

I've looked a little better: two pairs of central pins are going staight to RT3883F

It looks like place for double USB A socket...

So, maybe this is it?

Last hope

This one is probably UART.

Is it possible, that this PCB does not have JTAG pins?

anton.v.timin wrote:

Is it possible, that this PCB does not have JTAG pins?

Yes.

May it be possible to flash using the UART (serial) pins ?

If you can read in Russian, I can send you a link I found about this type of experience ))

Here are the messages from UART from my router:



U-Boot 1.1.3 (Mar 25 2010 - 17:40:19)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fac000
flash_protect ON: from 0xBC000000 to 0xBC01F2EB
flash_protect ON: from 0xBC030000 to 0xBC030FFF
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 3.4.0.0
--------------------------------------------
ASIC 3883_MP (MAC to VITESSE Mode)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: NOR Flash
Date:Mar 25 2010  Time:17:40:19
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

##### The CPU freq = 480 MHZ ####

SDRAM bus set to 32 bit
SDRAM size =64 Mbytes

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                                                                                                                                                                                  0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   MIPS OpenWrt Linux-
   Created:      2014-10-01  14:54:45 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1109440 Bytes =  1.1 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 3.10.49 (bb@builder1) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r42625) ) #3 Wed Oct 1 16:54:20 CEST 2014
[    0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0001974c (MIPS 74Kc)
[    0.000000] MIPS: machine is TRENDnet TEW-691GR
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 61512k/65536k available (2394k kernel code, 4024k reserved, 621k data, 184k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] CPU Clock: 480MHz
[    0.000000] Calibrating delay loop... 239.61 BogoMIPS (lpj=1198080)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 512
[    0.080000] pinctrl core: initialized pinctrl subsystem
[    0.090000] NET: Registered protocol family 16
[    0.120000] bio: create slab <bio-0> at 0
[    0.130000] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.140000] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.150000] rt2880_gpio 10000638.gpio: registering 16 gpios
[    0.160000] Switching to clocksource MIPS
[    0.170000] NET: Registered protocol family 2
[    0.180000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.190000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.200000] TCP: Hash tables configured (established 512 bind 512)
[    0.220000] TCP: reno registered
[    0.220000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.240000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.250000] NET: Registered protocol family 1
[    0.260000] rt-timer 10000100.timer: maximum frequncy is 9765Hz
[    0.290000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.300000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.320000] msgmni has been set to 120
[    0.330000] io scheduler noop registered
[    0.340000] io scheduler deadline registered (default)
[    0.350000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.370000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20) is a 16550A
[    0.380000] console [ttyS0] enabled, bootconsole disabled
[    0.380000] console [ttyS0] enabled, bootconsole disabled
[    0.410000] 1c000000.nor-flash: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022cb
[    0.430000] Amd/Fujitsu Extended Query Table at 0x0040
[    0.440000]   Amd/Fujitsu Extended Query version 1.1.
[    0.450000] number of CFI chips: 1
[    0.460000] 4 ofpart partitions found on MTD device 1c000000.nor-flash
[    0.470000] Creating 4 MTD partitions on "1c000000.nor-flash":
[    0.480000] 0x000000000000-0x000000030000 : "u-boot"
[    0.490000] 0x000000030000-0x000000040000 : "u-boot-env"
[    0.510000] 0x000000040000-0x000000050000 : "factory"
[    0.520000] 0x000000050000-0x000000800000 : "firmware"
[    0.530000] 0x00000015ee00-0x000000800000 : "rootfs"
[    0.540000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.570000] mtd: device 4 (rootfs) set to be root filesystem
[    0.580000] mtd: partition "rootfs_data" created automatically, ofs=0x380000, len=0x480000
[    0.590000] 0x000000380000-0x000000800000 : "rootfs_data"
[    0.610000] libphy: mdio: probed
[    0.640000] switch0: Atheros AR8316 rev. 1 switch registered on mdio-bus
[    0.650000] ralink_soc_eth 10100000.ethernet: incorrect phy-mode -22
[    0.670000] eth0: done loading
[    0.680000] rt3xxx-usbphy usbphy.3: loaded
[    0.690000] rt2880_wdt 10000120.watchdog: Initialized
[    0.700000] TCP: cubic registered
[    0.700000] NET: Registered protocol family 17
[    0.710000] Bridge firewalling registered
[    0.720000] 8021q: 802.1Q VLAN Support v1.8
[    0.730000] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    0.750000] Freeing unused kernel memory: 184K (802f2000 - 80320000)
procd: Console is alive
procd: - watchdog -
[    2.520000] usbcore: registered new interface driver usbfs
[    2.540000] usbcore: registered new interface driver hub
[    2.550000] usbcore: registered new device driver usb
[    2.560000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.580000] ehci-platform: EHCI generic platform driver
[    2.590000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    2.610000] leds-gpio gpio-leds.5: pins are not configured from the driver
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
jffs2 is ready
jffs2 is ready
[    6.340000] jffs2: notice: (295) jffs2_build_xattr_subsystem: complete building xattr subsystem, 7 of xdatum (1 unchecked, 6 orphan) and 77 of xref (0 dead, 68 orphan) found.
switching to overlay
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[    8.100000] NET: Registered protocol family 10
[    8.120000] nf_conntrack version 0.5.0 (964 buckets, 3856 max)
[    8.140000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    8.160000] Loading modules backported from Linux version master-2014-05-22-0-gf2032ea
[    8.180000] Backport generated by backports.git backports-20140320-37-g5c33da0
[    8.200000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    8.260000] xt_time: kernel timezone is -0000
[    8.300000] cfg80211: Calling CRDA to update world regulatory domain
[    8.320000] cfg80211: World regulatory domain updated:
[    8.330000] cfg80211:  DFS Master region: unset
[    8.330000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[    8.350000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    8.370000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[    8.390000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[    8.400000] cfg80211:   (5170000 KHz - 5250000 KHz @ 160000 KHz), (N/A, 2000 mBm), (N/A)
[    8.420000] cfg80211:   (5250000 KHz - 5330000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[    8.430000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[    8.450000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[    8.470000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[    8.540000] PPP generic driver version 2.4.2
[    8.550000] NET: Registered protocol family 24
[    8.600000] rt2800_wmac 10180000.wmac: failed to load eeprom property
[    8.610000] ieee80211 phy0: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
procd: Could not[    8.670000] ieee80211 phy0: rt2x00lib_request_eeprom_file: Error - Failed to request EEPROM.
find firmware /[    8.690000] rt2800_wmac: probe of 10180000.wmac failed with error -2
lib/firmware/soc_wmac.eeprom
procd: - init complete -
[   15.970000] device eth0.1 entered promiscuous mode
[   15.980000] device eth0 entered promiscuous mode
[   16.000000] br-lan: port 1(eth0.1) entered forwarding state
[   16.010000] br-lan: port 1(eth0.1) entered forwarding state
[   18.010000] br-lan: port 1(eth0.1) entered forwarding state

It seems that the tfp boot / flash options are available.

I am concerned by the error at the end of the boot log. According to previous posts, it seems to be a potentially minor problem with wifi driver configuration.

rt2800_wmac 10180000.wmac: failed to load eeprom property
[    8.610000] ieee80211 phy0: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
procd: Could not[    8.670000] ieee80211 phy0: rt2x00lib_request_eeprom_file: Error - Failed to request EEPROM.
find firmware /[    8.690000] rt2800_wmac: probe of 10180000.wmac failed with error -2


Is it possible that we lost data like mac adresses with the flash ?

I still do not understand why our router appears dead in the network.

(Last edited by erwan574 on 10 Feb 2015, 12:49)

You just will not believe me!!! :-D
I've reflashed it with the original firmware image from Trendnet site and a lot of time couldn't enter it's web interface... WRONG PASSWORD!
And after that I entered my lovely pass for routers and WOW - IT ENTERED!
This thing held my options all the time...
Maybe, it has some block of memory, that is read-only for OpenWrt... and general flashing with OpenWrt didn't gave us a good result because of that memory?!
But this is only my thoughts!
In an our I'll try to reflash OpenWrt

Hey, well-knowledged people!
What is an error here?
rt2800_wmac 10180000

Our router has RT3882 chipset... is it ok?

Tried to reflash with latest OpenWRT trunk... An error comes again! (((
Here are the messages:

U-Boot 1.1.3 (Mar 25 2010 - 17:40:19)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fac000
flash_protect ON: from 0xBC000000 to 0xBC01F2EB
flash_protect ON: from 0xBC030000 to 0xBC030FFF
============================================
Ralink UBoot Version: 3.4.0.0
--------------------------------------------
ASIC 3883_MP (MAC to VITESSE Mode)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: NOR Flash
Date:Mar 25 2010  Time:17:40:19
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

##### The CPU freq = 480 MHZ ####

SDRAM bus set to 32 bit
SDRAM size =64 Mbytes

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                                                        0

3: System Boot system code via Flash.
## Booting image at bc050000 ...
   Image Name:   MIPS OpenWrt Linux-
   Created:      2015-02-10   1:15:13 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1168215 Bytes =  1.1 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 3.14.32 (openwrt@gb-11) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r44362) ) #1 Tue Feb 10 01:14:12 UTC 2015
[    0.000000] SoC Type: Ralink RT3883 ver:1 eco:5
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[    0.000000] MIPS: machine is TRENDnet TEW-691GR
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 61316K/65536K available (2557K kernel code, 123K rwdata, 520K rodata, 184K init, 187K bss, 4220K reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] CPU Clock: 480MHz
[    0.000000] Calibrating delay loop... 239.61 BogoMIPS (lpj=1198080)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.080000] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.090000] pinctrl core: initialized pinctrl subsystem
[    0.100000] NET: Registered protocol family 16
[    0.130000] bio: create slab <bio-0> at 0
[    0.140000] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.150000] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.160000] rt2880_gpio 10000638.gpio: registering 16 gpios
[    0.170000] Switched to clocksource MIPS
[    0.180000] NET: Registered protocol family 2
[    0.190000] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.200000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.210000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.230000] TCP: reno registered
[    0.230000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.240000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.260000] NET: Registered protocol family 1
[    0.270000] rt-timer 10000100.timer: maximum frequency is 9765Hz
[    0.280000] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.310000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.330000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.350000] msgmni has been set to 119
[    0.360000] io scheduler noop registered
[    0.360000] io scheduler deadline registered (default)
[    0.370000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.400000] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a 16550A
[    0.410000] console [ttyS0] enabled
[    0.410000] console [ttyS0] enabled
[    0.430000] bootconsole [early0] disabled
[    0.430000] bootconsole [early0] disabled
[    0.450000] 1c000000.nor-flash: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022cb
[    0.470000] Amd/Fujitsu Extended Query Table at 0x0040
[    0.480000]   Amd/Fujitsu Extended Query version 1.1.
[    0.490000] number of CFI chips: 1
[    0.500000] 4 ofpart partitions found on MTD device 1c000000.nor-flash
[    0.510000] Creating 4 MTD partitions on "1c000000.nor-flash":
[    0.520000] 0x000000000000-0x000000030000 : "u-boot"
[    0.530000] 0x000000030000-0x000000040000 : "u-boot-env"
[    0.550000] 0x000000040000-0x000000050000 : "factory"
[    0.560000] 0x000000050000-0x000000800000 : "firmware"
[    0.570000] 2 uimage-fw partitions found on MTD device firmware
[    0.580000] 0x000000050000-0x00000016d397 : "kernel"
[    0.590000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.620000] 0x00000016d397-0x000000800000 : "rootfs"
[    0.630000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.660000] mtd: device 5 (rootfs) set to be root filesystem
[    0.670000] 1 squashfs-split partitions found on MTD device rootfs
[    0.680000] 0x000000340000-0x000000800000 : "rootfs_data"
[    0.700000] libphy: mdio: probed
[    0.710000] switch0: Atheros AR8316 rev. 1 switch registered on mdio-bus
[    0.720000] ralink_soc_eth 10100000.ethernet: incorrect phy-mode -22
[    0.730000] ar8316: unsupported mii mode: 1.
[    0.740000] ralink_soc_eth 10100000.ethernet eth0: ralink at 0xb0100000, irq 5
[    0.760000] rt3xxx-usbphy usbphy.3: loaded
[    0.770000] rt2880_wdt 10000120.watchdog: Initialized
[    0.780000] TCP: cubic registered
[    0.780000] NET: Registered protocol family 17
[    0.790000] Bridge firewalling registered
[    0.800000] 8021q: 802.1Q VLAN Support v1.8
[    0.820000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    0.830000] Freeing unused kernel memory: 184K (80322000 - 80350000)
procd: Console is alive
procd: - watchdog -
[    2.740000] usbcore: registered new interface driver usbfs
[    2.750000] usbcore: registered new interface driver hub
[    2.770000] usbcore: registered new device driver usb
[    2.780000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.800000] ehci-platform: EHCI generic platform driver
[    2.810000] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    2.820000] ohci-platform: OHCI generic platform driver
procd: - preinit -
[    4.250000] 8021q: adding VLAN 0 to HW filter on device eth0
[    4.300000] random: mktemp urandom read with 39 bits of entropy available
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
jffs2 is ready
No jffs2 marker was found
[    7.490000] jffs2: notice: (300) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 5 of xref (0 dead, 0 orphan) found.
switching to overlay
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[   10.090000] NET: Registered protocol family 10
[   10.100000] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   10.120000] Loading modules backported from Linux version master-2014-11-04-0-gf3660a2
[   10.140000] Backport generated by backports.git backports-20141023-2-g4ff890b
[   10.160000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   10.180000] nf_conntrack version 0.5.0 (960 buckets, 3840 max)
[   10.240000] xt_time: kernel timezone is -0000
[   10.280000] cfg80211: Calling CRDA to update world regulatory domain
[   10.300000] cfg80211: World regulatory domain updated:
[   10.310000] cfg80211:  DFS Master region: unset
[   10.310000] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[   10.330000] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   10.350000] cfg80211:   (2457000 KHz - 2482000 KHz @ 40000 KHz), (N/A, 2000 mBm), (N/A)
[   10.370000] cfg80211:   (2474000 KHz - 2494000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[   10.380000] cfg80211:   (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   10.400000] cfg80211:   (5250000 KHz - 5330000 KHz @ 80000 KHz, 160000 KHz AUTO), (N/A, 2000 mBm), (0 s)
[   10.420000] cfg80211:   (5490000 KHz - 5730000 KHz @ 160000 KHz), (N/A, 2000 mBm), (0 s)
[   10.430000] cfg80211:   (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[   10.450000] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 0 mBm), (N/A)
[   10.540000] PPP generic driver version 2.4.2
[   10.550000] NET: Registered protocol family 24
[   10.600000] rt2800_wmac 10180000.wmac: failed to load eeprom property
[   10.610000] ieee80211 phy0: rt2x00lib_request_eeprom_file: Info - Loading EEPROM data from 'soc_wmac.eeprom'.
[   10.630000] rt2800_wmac 10180000.wmac: Direct firmware load failed with error -2
[   10.640000] rt2800_wmac 10180000.wmac: Falling back to user helper
procd: Could not[   10.700000] ieee80211 phy0: rt2x00lib_request_eeprom_file: Error - Failed to request EEPROM.
find firmware /[   10.720000] rt2800_wmac: probe of 10180000.wmac failed with error -2
lib/firmware/soc_wmac.eeprom
procd: - init complete -
[   17.480000] 8021q: adding VLAN 0 to HW filter on device eth0
[   17.500000] CPU 0 Unable to handle kernel paging request at virtual address 0000002c, epc == 8017dfe4, ra == 8006b058
[   17.520000] Oops[#1]:
[   17.520000] CPU: 0 PID: 673 Comm: netifd Not tainted 3.14.32 #1
[   17.520000] task: 838c17e8 ti: 830fe000 task.ti: 830fe000
[   17.520000] $ 0   : 00000000 00000000 0000002c 000003e2
[   17.520000] $ 4   : 00000000 00000077 00000001 00000000
[   17.520000] $ 8   : 00000010 80008c00 831edb80 00000000
[   17.520000] $12   : 00000004 779753a0 00000000 00000000
[   17.520000] $16   : 00000000 83892000 83acc400 831ed800
[   17.520000] $20   : 00000001 00aa8538 00430000 8030eb78
[   17.520000] $24   : 00000000 800e722c
[   17.520000] $28   : 830fe000 830ffd20 0042dec4 8006b058
[   17.520000] Hi    : 00000000
[   17.520000] Lo    : cf14e000
[   17.520000] epc   : 8017dfe4 netif_carrier_on+0x14/0x74
[   17.520000]     Not tainted
[   17.520000] ra    : 8006b058 ar8xxx_phy_read_status+0x150/0x190
[   17.520000] Status: 1100a403 KERNEL EXL IE
[   17.520000] Cause : 00800008
[   17.520000] BadVA : 0000002c
[   17.520000] PrId  : 0001974c (MIPS 74Kc)
[   17.520000] Modules linked in: rt2800soc rt2800pci rt2800mmio rt2800lib pppoe ppp_async iptable_nat rt2x00soc rt2x00pci rt2x00mmio rt2x00lib pppox ppp_generic nf_nat_ipv4 nf_conntrack_ipv6 nf_conntrack_ipv4 mac80211 ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_id xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_CT slhc nf_nat_irc nf_nat_ftp nf_nat nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack_irc nf_conntrack_ftp nf_conntrack iptable_raw iptable_mangle iptable_filter ipt_REJECT ip_tables crc_itu_t crc_ccitt compat ip6t_REJECT ip6table_raw ip6table_mangle ip6table_filter ip6_tables x_tables ipv6 eeprom_93cx6 arc4 crypto_blkcipher leds_gpio ohci_platform ohci_hcd ehci_platform ehci_hcd gpio_button_hotplug usbcore nls_base usb_common
[   17.520000] Process netifd (pid: 673, threadinfo=830fe000, task=838c17e8, tls=77a3b750)
[   17.520000] Stack : 834d9770 83951a00 83892000 83acc400 83951a00 8006b058 7fe88f28 81086020
          00000000 00000000 01000101 00000001 000003e8 00000000 838b1000 830ffdb0
          83acc400 831ed800 00000001 00aa8538 00430000 8030eb78 0042dec4 800e7284
          00000000 83220025 83818bf0 834d9770 83818bf0 830df000 830df000 801b77f4
          83220000 830ffdf0 83802f00 00000000 00000001 00000000 00000000 00000000
          ...
[   17.520000] Call Trace:
[   17.520000] [<8017dfe4>] netif_carrier_on+0x14/0x74
[   17.520000] [<8006b058>] ar8xxx_phy_read_status+0x150/0x190
[   17.520000] [<800e7284>] fe_get_settings+0x58/0x78
[   17.520000] [<801b77f4>] port_cost+0x18/0x100
[   17.520000] [<80084d7c>] br_add_if+0x1ac/0x470
[   17.520000] [<800ba7bc>] dev_ifsioc+0x300/0x324
[   17.520000] [<800baec0>] dev_ioctl+0x5cc/0x6bc
[   17.520000] [<800d87ac>] do_vfs_ioctl+0x490/0x588
[   17.520000] [<800198f0>] SyS_ioctl+0x50/0x94
[   17.520000] [<8000683c>] handle_sys+0x11c/0x140
[   17.520000]
[   17.520000]
Code: afbf0014  00808021  2482002c <c0440000> 7c830080  7c041084  e0440000  1080fffb  00000000
[   18.050000] ---[ end trace 6c04ffd3d0976b32 ]---
[   46.870000] random: nonblocking pool is initialized

(Last edited by anton.v.timin on 10 Feb 2015, 14:34)

Please, anybody who knows the reason of this error and who can make a build... Make one for us! Maybe, the reason is that the needed package is not linked (as I see, the rt2x00lib_request_eeprom_file fucntion can not load some data from EEPROM)

Ok I understand that you confirm serial recovery to oem firmware worked for you.
Is it needed to cut the oem image or the full file is ok ?

I am still waiting to get my serial / usb adapter.

It seems we are not alone with this problem, I will try to update the wiki.

It seems that a similar issue happened to the owner of an Archer C5 router : See https://forum.openwrt.org/viewtopic.php … 53#p265053 .

But this is not the same hardware at all, maybe the source of the problem is similar and in openwrt configuration or boot code ??

You made a big deal - a warning to other users! )
Here is the info for your recovery:

UART pinout is (from square) - VCC, GND, TX, RX
The connection to the USB-TO-UART for TX&RX pins is straight forward.
VCC was not needed for my USB-TO-UART (based on PL-2303HX chip), but there was some problem with the driver for it in Windows 8.1, the resolution is described in a blog (in Russian), the link is
http://sska.su/posts/10
If you'll need it, I could explain.

The original firmware image is OK, the link is
http://downloads.trendnet.com/tew-691gr … 1.3.0).zip

Good luck!

Ok I received the USB UART adapter. I also got the driver issue as I used a windows 8 64 bits pc.

I recommend this page to get over this issue (the manufacturer voluntarily disabled chinese clones and older version of its hardware, and windows updates driver silently...)..

http://www.ifamilysoftware.com/news37.html


I used realterm and your instruction, but the display remains silent. I have an arrow in my board, is this the first "VCC" pin ?
Which baud rate did you use ?

I will try again on a linux pc on monday.

An additionnal problem is that the boot process of the router seems interrupted when everything is connected. Maybe there is an electrical problem and the bootloader recognize that some data has been sent. But I seen nothing on screen, i used putty and realterm.

Can you confirm also the exact model of the usb uart adapter that you used with the tew 691 gr ? thanks.

My adapter is "USB TO TTL - D-SUN", based on PL-2303HX, costed near 3$
I used baud rate 57600, 8 data bit, parity - none, stop bit - 1, flow control - none
It was not needed with my adapter to connect VCC (yes, it is the square pin with an arrow), only TX, RX & GND
Are you sure that you connected everything right? After I installed the right driver and COM port became alive, I connected Putty to this port and got all the data from bootloader.

The discussion might have continued from here.