We already have the proper toolchain sources, and kernel patches to compile OpenWRT for RTL8196C's; and nearly all Realtek SoC's, for that matter.

EDIT: As I'm out of devices with RTL8196c processors; I'm no longer actively working on this. However, anyone that is/will be working on them in the future, I seguest taking a peek at http://theigb.com/sapido/  Specifically grabbing openrsdk and taking a peek at the "backup" folder. Yes, the files in there are real.

V/r,
Conjur

Hi friends, first I´d like to thank you all and congratulate too since this discussion is definitely productive and is leading us all to more knowledge.
I´m writing also to ask to the gurus here.
I have a device just like Alex UK (pg 1, last comment) posted and of course it is bricked! I am having problems to upload a new firmware, simply I cannot upload through TFTP, TELNET since I´m not able to ping on 192.168.1.6. I already did all connections (JTAG and Ethernet) and  I know I reach the prompt <Realtek> and with "ipconfig" I checked it is 192.168.1.6, but I cannot go anywhere from that. I have my computer in the same network 192.168.1.xxx but ping does not respond, so any try through IP/Ethernet gives me nothing. I simply don´t know if there is a way to upload through JTAG (serial comm).

I have the device´s firmware but I can´t upload.

Is there a way to upload through JTAG cable? (Inf: I´m using FTDI232R TTL device).

Any reply will be deeply appreciated!!!

It seems the cheap no-brand WiFi repeaters

Edimax BR-6258N and BR-6428N and BR-6228Ns use Realtek RTL8196C/RTL8188CE.
BR-6228Ns has 4MB flash/16MB RAM. JP1 has 4 pads [+3.3v][RX GND TX] 57600 baud 8N1.

Press WPS/Reset button on power up or press ESC and you get <RealTek> prompt
Press and hold Reset button for 15s to recover using tftp.

<RealTek> ipconfig
Target Address=192.168.1.6

4.MXIC SPI (4 MByte)!
spi_flash.c: Set SPI clock < 40MHZ for low-speed SPI Flash
spi_flash.c: Set No dummy cycle

---RealTek(RTL8196C)at 2010.08.19-10:49+0800 version v1.1c [16bit](390MHz)
no rootfs signature at 000A0000!
Set 8196C PHY Patch OK

---Ethernet init Okay!
<RealTek> help
----------------- COMMAND MODE HELP ------------------
HELP (?)                                    : Print this help message
D <Address> <Len>
DB <Address> <Len>
DW <Address> <Len>
EW <Address> <Value1> <Value2>...
EB <Address> <Value1> <Value2>...
CMP: CMP <dst><src><length>
IPCONFIG:<TargetAddress>
AUTOBURN: 0/1
LOADADDR: <Load Address>
J: Jump to <TargetAddress>
FLW <dst_ROM_offset><src_RAM_addr><length_Byte> <SPI cnt#>: Write offset-data to SPI from RAM
PHYR: PHYR <PHYID><reg>
PHYW: PHYW <PHYID><reg><data>

ÿ4.MXIC SPI (4 MByte)!
spi_flash.c: Set SPI clock < 40MHZ for low-speed SPI Flash
spi_flash.c: Set No dummy cycle

---RealTek(RTL8196C)at 2010.08.19-10:49+0800 version v1.1c [16bit](390MHz)
no rootfs signature at 000A0000!
Jump to image start=0x80500000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
early printk enabled 
Determined physical RAM map:
 memory: 01000000 @ 00000000 (usable)
On node 0 totalpages: 4096
zone(0): 4096 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/mtdblock1 console=0 single
Calibrating delay loop... 389.12 BogoMIPS
Memory: 10752k/16384k available (2014k kernel code, 5632k reserved, 204k data, 56k init, 0k highmem)
Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)
Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
check_wait... unavailable.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Serial driver version 6.02 (2003-03-12) with no serial options enabled
ttyS00 at 0x2000 (irq = 5) is a rtl_uart1
state->flags=00000000
block: 64 slots per queue, batch=16
PPP generic driver version 2.4.1
MPPE/MPPC encryption/compression module registered
SPI INIT
flash device: 0x200000 at 0xbd000000
probe realtek
get SPI CS0
maker:c2  type:20  sector_cnt:64
get SPI CS1
maker:0  type:0  sector_cnt:0

MXIC matched!!get SPI chip driver!
Physically mapped flash: Found an alies 0x400000 for the chip at 0x0, mxic device detect.
probe ends
probe realtek2
Creating 2 MTD partitions on "Physically mapped flash":
0x00000000-0x00400000 : "flash 4M"
0x000b0000-0x00400000 : "root fs"
RTL8192C/RTL8188C driver version 1.4 (2011-02-09)
=====>>INSIDE rtl8192cd_init_one <<=====
vendor_deivce_id=819110ec
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
=====>>INSIDE rtl8192cd_init_one <<=====
=====>>EXIT rtl8192cd_init_one <<=====
Realtek 865x Ethernet driver v0.6 (Mar 26, 2008)
eth0: RTL865x-NIC at 0xbb804000, 00:00:00:00:00:11, IRQ 2
eth1: RTL865x-NIC at 0xbb804000, 00:00:00:00:00:22, IRQ 2
eth2: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:02, IRQ 2
eth3: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:03, IRQ 2
eth4: RTL865x-NIC at 0xbb804000, 00:e0:4c:f0:00:04, IRQ 2
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 1024 bind 2048)
Linux IP multicast router 0.06 plus PIM-SM
ip_conntrack version 2.1 (512 buckets, 4096 max) - 312 bytes per conntrack
PPTP netfilter connection tracking: registered
PPTP netfilter NAT helper: registered
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 56k freed
mount /proc file system ok!
mount /var  file system ok!
init started: BusyBox v1.11.1 (2011-11-03 16:35:04 CST)
starting pid 9, tty '': '-/bin/sh'


BusyBox v1.11.1 (2011-11-03 16:35:04 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

Thu Nov  3 16:32:46 UTC 2011
kill: you need to specify whom to kill
  Set 8196C PHY Patch OK
Close Wan Interface!!
No dnrd daemon found.  Exiting.
No dnrd daemon found.  Exiting.
Notice: caching turned off
cat: can't open '/tmp/wanStatus': No such file or directory
iptables: No chain/target/match by that name
Initialize WLAN interface
write_proc: file: 80f01f20, buffer: 0
, count: 2, data: 00000000
write_wlan_led_proc: file: 80cc5580, buffer: 2
, count: 2, data: 00000000
set TX Power: 0
write_proc: file: 80cc59e0, buffer: 0
, count: 2, data: 00000000
write_wlan_led_proc: file: 80f01f90, buffer: 2
, count: 2, data: 00000000
Setup BRIDGE interface
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
bridge br0 doesn't exist; can't delete it
Setup bridge...
device eth0 entered promiscuous mode
device wlan0 entered promiscuous mode
device wlan0-vxd entered promiscuous mode
br0: port 3(wlan0-vxd) entering listening state
br0: port 2(wlan0) entering listening state
br0: port 3(wlan0-vxd) entering learning state
br0: port 3(wlan0-vxd) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth0) entering listening state
br0: port 2(wlan0) entering learning state
br0: port 2(wlan0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth0) entering learning state
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
Setup WAN interface
kill: you need to specify whom to kill
Close Wan Interface!!

device eth1 is not a slave of br0
device eth0 is already a member of a bridge; can't enslave it to bridge br0.
write_wlan_led_proc: file: 80cc53c0, buffer: 2
011-11-03 16:32:58]: start Dynamic IP
! $IP_ADDR --proto tcp --dport 80 -j DNAT --to $IP_ADDR:8000
, count: 2, data: 00000000
**********************************************************************
*                          Enable WSC_UPnP                           *
**********************************************************************
**********************************************************************
*                            Enable LLTD                             *
**********************************************************************
**********************************************************************
*                       Enable GPIO Interrupt                        *
**********************************************************************
ERROR: Couldn't kill dnrd: No such process
udhcpc (v1.11.1) started
into eth1.deconfig
No dnrd daemon found.  Exiting.
Notice: caching turned off
cat: can't open '/tmp/wanStatus': No such file or directory
killall: radiusd: no process killed
RADIUS server disable !!
write_proc: file: 80cc5190, buffer: 0
, count: 2, data: 00000000
br0: port 1(eth0) entering disabled state
device eth0 left promiscuous mode
device eth0 entered promiscuous mode
br0: port 1(eth0) entering listening state
br0: port 1(eth0) entering learning state
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
**********************************************************************
*                       FREE Page,Dentries and Inodes Cache          *
**********************************************************************
MemFree:          4896 kB
Cached:           1556 kB
kill: you need to specify whom to kill
kill: you need to specify whom to kill
kill: you need to specify whom to kill
iptables: No chain/target/match by that name
Notice: caching turned off

Zyxel NBG-416N uses RTL8196C/RTL8188RE and I saw a Recovery Kit exists that has a root.bin and linux.bin that you use with the TFTP recovery mode.

Edimax has linux source code at http://www.edimax.com/images/Image/Open … 110916.zip.

RTL8192C/RTL8188C driver version 1.4 (2010-08-11)