Hi there,
after updating to the latest version of openwrt, my router no longer boots.
U-Boot hangs and remains in recovery. To start I have to enter „bootm 0x9f03000“ every time because mtd7ˋtplinkˋ is deleted or invalid.
I think mtd8 art is corrupted too.
Could a user kindly help me and make the files available for download?
Thanks for your help!
So ....
If you type in bootm .... the router actually starts, and works as it should ?
In that case perhaps you should modify the U-boot boot param variable ?
you could also check if the original tp-link image comes with those mtds
You could use the binwalk tool.
Thank you very much. Bootm just starts openwrt. The original firmware stops with "bad magic number" after i installed this with tftp.
How do I have to extract the mtds with this tool?
Or is it enough to write "U-Boot" and recover the factory firmware?
Ok,
so if I understand you correctly openwrt boots, but complains, while the stock FW doesn't boot at all ?
and you want to have stock FW ? or doesn't it matter, as long as it works ?
At the moment the router only boots manually with bootm 0x9f030000
If I have to go back to the facktory fw ... ok, the main thing is he boots
tplink and art are not involved with this low-level booting, so don't just overwrite your art with someone else's (it's irrecoverable, but isn't responsible for boot failures, just if wireless works - or not). You need to find your bug elsewhere.
Mtd7 tplink is definitely broken and empty..I can't go to the factory FW.
Mtd8 art probably too, I can't activate 5GHz. But this can also have other causes.
It appears this model, as was TP-Link's style at the time, has two bootloaders. The first bootloader at 0x00000 boots the second bootloader at 0x20000. That secondary bootloader then boots the kernel at 0x30000.
So if the second bootloader is corrupted, the first one will crash with bad magic at 0x20000.
The two bootloaders can probably be extracted from a factory firmware .bin, if that file has "boot" in the name.
The unit's factory sticker MAC address is stored in the first bootloader partition after the end of the bootloader code. The "Tplink" partition probably isn't used for anything by OpenWrt.
partition@0 {
label = "factory-boot";
reg = <0x000000 0x01fb00>;
read-only;
};
mac: partition@1fb00 {
label = "mac";
reg = <0x01fb00 0x000500>;
read-only;
};
partition@20000 {
label = "u-boot";
reg = <0x020000 0x010000>;
read-only;
};
partition@30000 {
compatible = "denx,uimage";
label = "firmware";
reg = <0x030000 0x7a0000>;
};
The first Mtd0 U-BOOT is 128 KB and the second is Mtd2 U-BOOT (Dragonfly) from my backup is 66 KB and the one I extract from FW is 93 KB ?!
Can I simply copy the file with cp.b 0x020000 or write SSH to the Mtd2?
The image of the second bootloader must be 64 KiB (65536 bytes) or smaller since there is only one block of flash for it.
The safest way to write it is to boot up OpenWrt and use kmod-mtd-rw to unlock the flash then use mtd write.
64 KB ... then I have to work again with binwalk on the FW.
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
21812 0x5534 U-Boot version string, "U-Boot
1.1.4-gfbf1eef2-dirty (Jan 4 2019 - 10:18:02)"
21876 0x5574 CRC32 polynomial table, big endian
23172 0x5A84 uImage header, header size: 64 bytes, header CRC:
0x65E58EC0, created: 2019-01-04 02:18:03, image
size: 39358 bytes, Data Address: 0x80010000,
Entry Point: 0x80010000, data CRC: 0x19902BE9,
OS: Linux, CPU: MIPS, image type: Firmware
Image, compression type: lzma, image name:
"u-boot image"
23236 0x5AC4 LZMA compressed data, properties: 0x5D,
dictionary size: 8388608 bytes, uncompressed
size: 92980 bytes
62595 0xF483 uImage header, header size: 64 bytes, header CRC:
0x4DD5BB6D, created: 2019-01-10 06:16:49, image
size: 1023437 bytes, Data Address: 0x80060000,
Entry Point: 0x80060000, data CRC: 0x9C984B6F,
OS: Linux, CPU: MIPS, image type: Multi-File
Image, compression type: lzma, image name: "MIPS
OpenWrt Linux-3.3.8"
62667 0xF4CB LZMA compressed data, properties: 0x6D,
dictionary size: 8388608 bytes, uncompressed
size: 2956948 bytes
1086097 0x109291 Squashfs filesystem, little endian, version 4.0,
compression:xz, size: 6877380 bytes, 1555
inodes, blocksize: 262144 bytes, created:
2019-01-15 06:43:39
7963735 0x798457 XML document, version: "1.0"
7974270 0x79AD7E gzip compressed data, from Unix, last modified:
2019-01-15 07:53:59
andy@ubuntu:~/Downloads/C60$ dd if=C60.bin of=u-boot.bin.lzma bs=1 skip=23236 count=39358
39358+0 Datensätze ein
39358+0 Datensätze aus
39358 Bytes (39 kB, 38 KiB) kopiert, 0,121148 s, 325 kB/s
andy@ubuntu:~/Downloads/C60$ unlzma u-boot.bin.lzma
Where is my mistake....93KB? When booting, U-Boot detects an error in the partition table.
Do I have to flash U-Boot as lzma? With or without 64KB header?
So you want to extract from 0x5a84 to 0xf482, and place the start of that blob in flash at 0x20000.
Do not uncompress the LZMA; that happens at run-time.
Very good! So far....
The image is now correct. bootm 0x20000 Name U-Boot image, checksum OK, wrong Image for bootm...
The boot process still stops with partition not ok after the first u-boot 
Kernel from 0xf483 to 0x109290 .... Flash 0x30000 ?
Now I've tried everything possible....I think. The first loader always stucks at: parsing partition table .... error 603 invalid partition-index-file para-id. Could it be that Openwrt JFFS2 caused the problem?
How can I write the * .bin directly into the flash to correct the partitions?