Opened 6 years ago

Last modified 3 years ago

#10436 new defect

TP-Link TL-WR941ND V3 - Backfire 10.03.1-RC6 - No Failsafe Mode

Reported by: torresweb Owned by: developers
Priority: highest Milestone: Chaos Calmer 15.05
Component: packages Version: Backfire 10.03.1 RC6
Keywords: Cc:


I have both tp-link 841v5 and 941v3. The 841v5 failsafe boot mode work like a charme but in 941v3 it doesnt work (at least no with


Attachments (1)

backfire-wr941nd-failsafe-fix.patch (1.4 KB) - added by Giedrius Liubavičius <giedrius+wrt@…> 6 years ago.
Failsafe network fix

Download all attachments as: .zip

Change History (21)

comment:1 follow-up: Changed 6 years ago by caog

see #10430, same on wr703n

comment:2 in reply to: ↑ 1 Changed 6 years ago by anonymous

Replying to caog:

see #10430, same on wr703n

Possibly the same. I note that this is on backfire, other problem is on trunk and latest snapshot.

comment:3 Changed 6 years ago by P.Titera@…

Same here. I've semibricked my new router. But (as I noted here #10456) I've noticed one strange thing. I see some traffic in tcpdump when router is starting. I see this 'broken packet'.

[root@www ~]# tcpdump -s0 -XX -e -n -i eth0 net
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
01:11:31.458615 f4:ec:38:c7:dd:40 > Broadcast, ethertype IPv4 (0x0800), length 1039: truncated-ip - 4 bytes missing! > UDP, length 1001
        0x0000:  ffff ffff ffff f4ec 38c7 dd40 0800 4500  ........8..@..E.
        0x0010:  0405 0000 4000 4011 b297 c0a8 0101 c0a8  ....@.@.........
        0x0020:  01ff cd2a 1337 03f1 09d4 dead 506c 6561  ...*.7......Plea
        0x0030:  7365 2070 7265 7373 2062 7574 746f 6e20
        0x0040:  6e6f 7720 746f 2065 6e74 6572 2066 6169
        0x0050:  6c73 6166 6500 0000 0000 0000 0000 0000  lsafe...........
        0x0060:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0070:  0000 0000 0000 0000 0000 0000 0000 0000  ................

        0x03e0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x03f0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0400:  00         

This packet is 8 bytes longer than it should be but 4 bytes of it are missing. Can it be that hardware is not yet fully initialized in the time failsafe is entered?


comment:4 Changed 6 years ago by P.Titera@…

So the problem is still present even in r30177. Router seems to enter failsafe mode (LED blinks) but nothing answers (tried both ports WAN and LAN1). Pity is that I've semi-bricked (again) the same router I had problems 4 months ago. I even see same behavior (that strangely formated packet, with incorrect checksum).

Is there anything I can provide to help resolve this problem?


comment:5 Changed 6 years ago by P.Titera@…

By the way. I've noticed this #8970 it would explain my problems with this router. Eth0 is behind some switch and hardware is realy not fully initialized in failsafe. Would it be possible to modify configuration for this router to have failsafe on port eth1 (WAN) this post should be accessible all the time.


comment:6 Changed 6 years ago by Giedrius Liubavičius <giedrius+wrt@…>


On TL-WR941ND v3 eth0 is a dummy device.
Failsafe sets IP only on eth0, and not on LAN1 LAN2 LAN3 LAN4.
LAN ports ARE initialised, but not configured!
The strange thing is - tcpdump on eth0 shows ALL the traffic from PC and
ARP requests sent for MAC of PCs' IP, but on the PC side - no traffic at all.

My gues -failsafe message gets sent before Marvell 88E6060 is initialised fully
Anyhow - the problem is in the hardware. This is /lib/preinit/ fault.

P.S. fixing this bug on my devices, will post patch later if still needed.

Changed 6 years ago by Giedrius Liubavičius <giedrius+wrt@…>

Failsafe network fix

comment:7 Changed 6 years ago by Giedrius Liubavičius <giedrius+wrt@…>

Try this patch (tested on git 0ecfeb5)
Typo in my previous post: the problem is not in the hardware

The only way to fix your firmware, if you have no access without failsafe - SERIAL

comment:8 Changed 6 years ago by Petr Titera <P.Titera@…>

I can confirm that this patch does allow me to telnet 941 in failsafe mode. Sorry the test took so long.


comment:9 Changed 5 years ago by vadim@…

Does this patch integreted to Attitude Adjustment 12.09 rc1? I can't connect to my bricked router...

comment:10 Changed 5 years ago by bircoph <bircoph@…>

I have the same issue with TP-Link TL-WR941ND with the latest openwrt trunk.
Finally connected to the router via serial interface (ttl2usb adaptor + some soldering), in failsafe mode only eth0 device is available, ports are not ready.
More details and logs are here:

I'll try to build my own firmware using buildroot. Heh, what a pain..

comment:11 Changed 5 years ago by bircoph <bircoph@…>

Patch works well with trunk rev 35416.
Waiting in upstream.

comment:12 Changed 5 years ago by regsd@…

It seems like there is still an issue here.
I have TP-LInk TL-WR941ND v3.6. Flashed it with 03-Apr-2013 08:15 3932160

By default the router boots in a weird mode (symptoms similar to those described in this ticket): SYS light is flashing very quickly (like you would expect in a failsafe mode), but I still can't even ping the router.

BUT, interestingly, when the reset button is pressed and held for maybe half a minute while the router is booting, then it boots in normal mode and works normally.

Tried to reflash the router several times with Same result.

comment:13 Changed 5 years ago by anonymous

Not sure why previous poster is writing he used v2 firmware on a v3 device, but I can confirm most reported findings in this thread for a v3 device:

  • With AA, when going into failsafe, the UDP message "press now" is send, but not the follow up UDP message "into failsafe" and the device is not reachable by
  • When using serial, it shows it did go into failsafe, the IP is correctly set, but it simply does not respond to it. So indeed likely a switch config issue between eth0 and lan1234 as suggested above.
  • At BB (Barrier bleeding edge, correct v3 image) it always goes into failsafe, the serial console claiming the wps button was pressed. For me, pressing reset did not bypass this, maybe I did not hold it long enough.
  • Using TFTP I was able to go back to Backfire, where the router is useable again.

comment:14 Changed 5 years ago by regsd@…

I am the author of comment 12. The links I posted are incorrect, I actually used v3 firmaware on a v3 device. I still have them in my Downloads folder. It's just when I was writing the post I copied the wrong links.

comment:15 Changed 4 years ago by vadim@…

Could someone change the version in this ticket to AA? Maybe some of developers will see it?

comment:16 Changed 4 years ago by anonymous

I am a newbie and I have bricked my TP-Link TL-WR941ND. Failsafe doesn't work. Is Serian the only available option?

comment:17 Changed 4 years ago by anonymous

I am a newbie and I have bricked my TP-Link TL-WR941ND. Failsafe doesn't work. Is Serial connection the only available option?

comment:18 Changed 4 years ago by bircoph@…

Your box is no longer network accessible. You may use either serial line or JTAG interface, though one needs special equipment for the last one.

comment:19 follow-up: Changed 4 years ago by jow

  • Milestone changed from Backfire 10.03.2 to Chaos Calmer (trunk)

Milestone Backfire 10.03.2 deleted

comment:20 in reply to: ↑ 19 Changed 3 years ago by anonymous

Any progress? in CC-Rc3 failsave still broken.

Add Comment

Modify Ticket

as new .

E-mail address and user name can be saved in the Preferences.

Note: See TracTickets for help on using tickets.