TRENDnet TEW-712BR

• TEW-712BR OEM website

• H/W:1.0R

# cat /proc/mtd dev: size erasesize name mtd0: 00010000 00010000 “u-boot” mtd1: 00010000 00010000 “art” mtd2: 00010000 00010000 “mac” mtd3: 00010000 00010000 “nvram” mtd4: 00030000 00010000 “language” mtd5: 000e0000 00010000 “kernel” mtd6: 002b0000 00010000 “rootfs” mtd7: 000b0000 00010000 “rootfs_data” mtd8: 00390000 00010000 “firmware”

# cat /proc/cpuinfo system type : Atheros AR9330 rev 1 machine : TRENDnet TEW-712BR processor : 0 cpu model : MIPS 24Kc V7.4 BogoMIPS : 265.42 wait instruction : yes microsecond timers : yes tlb_entries : 16 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0000, 0x0ff8, 0x0ff8, 0x0ff8] ASEs implemented : mips16 shadow register sets : 1 kscratch registers : 0 core : 0 VCED exceptions : not available VCEI exceptions : not available

Bootloader output: U-Boot 1.1.4 (Mar 2 2012 - 15:15:23) AP121-2MB (ar9330) U-boot DRAM: 32 MB Top of RAM usable for U-Boot at: 82000000 Reserving 161k for U-Boot at: 81fd4000 Reserving 192k for malloc() at: 81fa4000 Reserving 44 Bytes for Board Info at: 81fa3fd4 Reserving 36 Bytes for Global Data at: 81fa3fb0 Reserving 128k for boot params() at: 81f83fb0 Stack Pointer at: 81f83f98 Now running in RAM - U-Boot at: 81fd4000 ============================================ Date:Mar 2 2012 Time:15:15:23 Cameo Version: v1.00 Build:08 Module Name: Treadnet TEW-712BR ============================================ id read 0x100000ff flash size 4194304, sector count = 64 Flash: 4 MB Using default environment In: serial Out: serial Err: serial Net: ag7240_enet_initialize... : cfg1 0x5 cfg2 0x7114 eth0: XXXXXXXXXXXXXXX eth0 up : cfg1 0xf cfg2 0x7214 eth1: XXXXXXXXXXXXXXX athrs26_reg_init_lan ATHRS26: resetting s26 ATHRS26: s26 reset done eth1 up eth0, eth1 Hit any key to stop autoboot: 0 ar7240> help fake - fake ? - alias for 'help' boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootm - boot application image from memory cp - memory copy erase - erase FLASH memory eth_soft_led - start the ethernet software led control help - print online help httpboot- entering the backup mode. md - memory display mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables progmac - Set ethernet MAC addresses reset - Perform RESET of the CPU run - run commands in an environment variable setenv - set environment variables tftpboot- boot image via network using TFTP protocol version - print monitor version ar7240> printenv bootargs=console=ttyS0,115200 root=31:06 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:64k(u-boot),64k(ART),64k(mac),64k(nvram),192k(language),896k(uImage),2752k(rootfs) bootcmd=bootm 0x9f070000 bootdelay=2 baudrate=115200 ethaddr=XXXXXXXXXXXXXXXXXXXX ipaddr=192.168.10.1 serverip=192.168.10.100 stdin=serial stdout=serial stderr=serial ethact=eth0

UART pinout:

• USB To RS232 TTL PL2303HX Converter Module 3.3V, or similar serial/tty converter
• Solder and soldering iron
• Large paper clip or header pins from an old circuit board
• LAN cable
• Computer with USB interface (the procedure given here assumes Ubuntu/Debian OS)

• Router: Solder header pins to the TX, RX and GND sockets shown above. I used the straight sections of a large paper clip as pins.
• Computer: Install the required software: $ sudo apt-get install tftp tftpd xinetd cutecom gedit

Router- Connect the converter module wires from the TX on the router to the RX on the converter, RX to TX and GND to GND (the power will come from the router, so we do not connect that). Connect the adapter to an open USB port.

Computer- To find the adpater, run the command:

  $ dmesg | grep tty

You should see something like the following, showing which USB it is associated with:

[    0.000000] console [tty0] enabled
[    0.362312] serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A
[    0.383277] 00:09: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A
[ 5024.119425] usb 2-10: pl2303 converter now attached to ttyUSB0

Connect a LAN cable between a LAN port on the router and an Ethernet port on the computer. Set the interface on the computer for static with an IP address 192.168.10.100 with a mask of 255.255.255.0 and a gateway of 192.168.10.1.

Now is a good time to prepare the tftp server to server the firmare file. Issue the command:

   $ sudo gedit /etc/xinetd.d/tftp

Paste the following in the editor window and save the file:

      
      service tftp
      {
      protocol        = udp
      port            = 69
      socket_type     = dgram
      wait            = yes
      user            = nobody
      server          = /usr/sbin/in.tftpd
      server_args     = /tftpboot
      disable         = no
      }

Now we need to create the directory that will serve the firmware and make it writable. In the example below, replace “ubuntu” with the user that is logged in:

  $ sudo mkdir /tftpboot
  $ sudo chown ubuntu /tftpboot

Create a .trx file of the factory firmware by downloading the firmware from the Trendnet site and placing it into your OpenWrt build directory. Then run the build root script: “dd bs=84 skip=1 if=t.bin of=t.trx” replacing “t” with the name of the factory firmware file. I have uploaded an example .trx here

Copy the .trx file to the /tftpboot directory.

Restart xinetd:

  $ sudo /etc/init.d/xinetd restart

Start cutecom. I start it from the command line with sudo to make sure I have access to the USB service. Confirm the following settings: device = /dev/ttyUSB0 (or whichever USB your device is on), baud = 115200, data bits = 8, stop bits = 1, parity = none, handshake = hardware. Open for reading, and writing and apply settings when opening should all be checked.

Press the “open device” button and turn on the router. There is a 2 second delay before it boots the firmware. If you type ctrl+c, it will interrupt the boot cycle and bring you to the “ar7240>” command prompt. Now we can run ping to see if the router sees our server.

ar7240> ping 192.168.10.100

dup 1 speed 1000
Using eth1 device
checksum bad
host 192.168.10.100 is alive

Next we transfer the firmware from the server to the router's RAM:

 ar7240> tftpboot 0x80000000 TEW712BR_FW100B12.trx

 Using eth1 device
 TFTP from server 192.168.10.100; our IP address is 192.168.10.1
 Filename 'TEW712BR_FW100B12.trx'.
 Load address: 0x80000000
 Loading: *\0x08checksum bad
 #################################################################
 \0x09 #################################################################
 \0x09 #################################################################
 \0x09 #################################################################
 \0x09 #################################################################
 \0x09 #################################################################
 \0x09 #################################################################
 \0x09 #################################################################
 \0x09 #################################################################
 \0x09 ########################################################
 done
 Bytes transferred = 3276804 (320004 hex)
 ar7240> 

Now we erase the targeted area of ROM

 ar7240> erase 0x9f070000 +0x390000

Copy to ROM:

 ar7240> cp.b 0x80000000 0x9f070000 0x390000

Reboot the router:

 ar7240> bootm 0x9f070000

In a minute or two, you should be able to access the router via the factory web ui at http://192.168.10.1

How to add tags