Cpe510(eu) v1.1 not working

driversat · July 29, 2021, 9:41pm

hi guys,
so i have this tplink dead after flashing openwrt 19.07.07 and forcing it to revert back to stock firmware.
now every stock firm loaded by tftp is said incorrect file !!!
the only way to bring it to life is to load vmlinuz by tftp, i tried and compiled some files (took about 2hours) but kernel image lacks Openwrt as output:

TP-LINK SafeLoader (Build time: Jun 12 2015 - 09:49:53)
CPU: 560MHz AHB: 225MHz DDR: 64MB
Performing LED check..  PASS
Press CTRL+B to enter SafeLoader: 1
Flash Manufacturer: Unknown(0xc8)
Flash Device ID: Unknown(0x4017)
Data flash init failed.
open user-config failed.
open user-config failed.


TFTP server address is 192.168.0.100; our address is 192.168.0.254
Get filename 'recovery.bin'.

Retry count exceeded; starting again
enet1 port3 up

TFTP server address is 192.168.0.100; our address is 192.168.0.254
Get filename 'recovery.bin'.
#################################################################
#################################################################
#######################
Done.
Bytes transferred = 7803962, 1181 Kbytes/sec
Incorrect File.
Writting error.
##Warning: File is unidentiable. Try downloading
enet0 port4 up

TFTP server address is 192.168.0.100; our address is 192.168.0.254
Get filename 'vmlinuz'.

Retry count exceeded; starting again

TFTP server address is 192.168.0.100; our address is 192.168.0.254
Get filename 'vmlinuz'.
#################################################################
#################################
Done.
Bytes transferred = 4988400, 1182 Kbytes/sec
Allocated memory for elf segment ok: addr: 0x80060000, size 0x16dc
Loading .text @ 0x80060000 (5852 bytes)

Starting kernel



OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Looking for OpenWrt image... not found!

System halted!

please if anyone can provide a correct kernel or indications to build one.
thanks

frollic · July 30, 2021, 7:01am

vmlinuz is only the kernel part. you need a openwrt squashfs root partition too.

what's the goal here ? to get openwrt back, or stock FW ?

driversat · July 30, 2021, 7:39am

hi,
whenever i rename stock firm to recovery.bin and send it via tftp it gets refused ‹incorrect file›...
i just wanna get this router back working either by stock or openwrt.
the only way is by loading kernel vmlinuz (RAM firm) first then sysupgrade.

frollic · July 30, 2021, 7:41am

in that case you need to provide the initramfs image, not the kernel.

TP-Link can be picky about the FW content, and refuse images not containing the correct "magic number" in the file, or require stripping (applies for stock FW).

driversat · July 30, 2021, 7:53am

ok thanks,
but compiling openwrt didn't provide initramfs image, how to build it then?

frollic · July 30, 2021, 7:57am

pretty sure it's an option in menuconfig ....

driversat · July 30, 2021, 2:05pm

hi boss,
well i managed to compile an initramfs file renamed vmlinuz and put in tftp directory.
the problem is that something's missing:

TFTP server address is 192.168.0.100; our address is 192.168.0.254
Get filename 'vmlinuz'.
#################################################################
#
Done.
Bytes transferred = 3359916, 1090 Kbytes/sec
Allocated memory for elf segment ok: addr: 0x80060000, size 0x35e1d8
Skipping non LOAD program header (type 0x4)
Loading .text @ 0x80060000 (2426324 bytes)
Loading __ex_table @ 0x802b05e0 (5520 bytes)
Loading .rodata @ 0x802b2000 (401168 bytes)
Loading .pci_fixup @ 0x80313f10 (64 bytes)
Loading __ksymtab @ 0x80313f50 (21792 bytes)
Loading __ksymtab_gpl @ 0x80319470 (9240 bytes)
Loading __ksymtab_strings @ 0x8031b888 (67832 bytes)
Loading __param @ 0x8032c180 (544 bytes)
Clearing __modver @ 0x8032c3a0 (3168 bytes)
Loading .data @ 0x8032d000 (125876 bytes)
Loading .init.text @ 0x8034c000 (163800 bytes)
Loading .init.data @ 0x80373fd8 (63436 bytes)
Loading .mips.machines.init @ 0x803837a4 (2368 bytes)
Clearing .bss @ 0x80390000 (188888 bytes)

Starting kernel

[    0.000000] Linux version 3.10.49 (freifunkleipzig@freifunkvm) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r43862) ) #22 Mon Feb 2 02:58:24 CET 2015
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0001974c (MIPS 74Kc)
[    0.000000] SoC: Atheros AR9344 rev 2
[    0.000000] Clocks: CPU:560.000MHz, DDR:450.000MHz, AHB:225.000MHz, Ref:40.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 61076k/65536k available (2369k kernel code, 4460k reserved, 621k data, 272k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 512
[    0.080000] NET: Registered protocol family 16
[    0.090000] MIPS: machine is Generic AR71XX/AR724X/AR913X based board
[    0.100000] bio: create slab <bio-0> at 0
[    0.110000] Switching to clocksource MIPS
[    0.120000] NET: Registered protocol family 2
[    0.120000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.120000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.130000] TCP: Hash tables configured (established 512 bind 512)
[    0.130000] TCP: reno registered
[    0.140000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.140000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.150000] NET: Registered protocol family 1
[    0.170000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.180000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.190000] msgmni has been set to 119
[    0.200000] io scheduler noop registered
[    0.200000] io scheduler deadline registered (default)
[    0.210000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.240000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A

all leds are lit, device and console frozen

frollic · July 30, 2021, 2:22pm

Doesn't look like the image you just created .... ---^

you can't autoboot an initramfs sent over TFTP.

need to load it, then start it manually using with bootm, if I remember correctly.

driversat · July 30, 2021, 2:30pm

thank you @frolic for your help
maybe you are talking about Uboot. this unit (cpe510v1.1) uses SafeLoader boot.
and i was able to autoboot an initramfs image downloaded elsewhere but at the end of boot keps restarting.

frollic · July 30, 2021, 2:35pm

yeah, bootm's uboot ....

what happens if you try to boot the openwrt initramfs ?

driversat · July 30, 2021, 2:40pm

driversat:

Starting kernel

[    0.000000] Linux version 3.10.49 (freifunkleipzig@freifunkvm) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 r43862) ) #22 Mon Feb 2 02:58:24 CET 2015
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 0001974c (MIPS 74Kc)
[    0.000000] SoC: Atheros AR9344 rev 2
[    0.000000] Clocks: CPU:560.000MHz, DDR:450.000MHz, AHB:225.000MHz, Ref:40.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 61076k/65536k available (2369k kernel code, 4460k reserved, 621k data, 272k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.070000] Mount-cache hash table entries: 512
[    0.080000] NET: Registered protocol family 16
[    0.090000] MIPS: machine is Generic AR71XX/AR724X/AR913X based board
[    0.100000] bio: create slab <bio-0> at 0
[    0.110000] Switching to clocksource MIPS
[    0.120000] NET: Registered protocol family 2
[    0.120000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    0.120000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    0.130000] TCP: Hash tables configured (established 512 bind 512)
[    0.130000] TCP: reno registered
[    0.140000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.140000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.150000] NET: Registered protocol family 1
[    0.170000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.180000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.190000] msgmni has been set to 119
[    0.200000] io scheduler noop registered
[    0.200000] io scheduler deadline registered (default)
[    0.210000] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.240000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A

i had to rename it vmlinuz in order to tftp to load it

frollic · July 30, 2021, 2:41pm

that's however still not the home made openwrt image, unless you didn't clone the official repo.

driversat · July 30, 2021, 2:43pm

i did this:
git clone "https://github.com/openwrt/openwrt.git" first then selected my target in menuconfig

frollic · July 30, 2021, 2:44pm

that looks correct, but in that case it isn't booting the initramfs after all.

driversat · July 30, 2021, 2:45pm

is that for snapshot?
i wonder if it's possible to clone an older version like BB or CC or Lede...and how

frollic · July 30, 2021, 2:48pm

try https://github.com/openwrt/openwrt/releases can't verify it myself, corp firewall/proxy will try to DL and verify the file 1st

driversat · July 31, 2021, 12:38pm

hi again boss,
well i tried many files but none of them worked.
i feel deceived

bobafetthotmail · August 1, 2021, 4:01pm

Older versions are part of the same source.
download sources again in a new folder
git clone "https://github.com/openwrt/openwrt.git"

git checkout TAB-Key TAB-key
will show the list of available old version branches.

FETCH_HEAD             origin/openwrt-21.02   v18.06.0-rc1           v19.07.0-rc2 
HEAD                   reboot                 v18.06.0-rc2           v19.07.1 
lede-17.01             v17.01.0               v18.06.1               v19.07.2 
master                 v17.01.0-rc1           v18.06.2               v19.07.3 
openwrt-18.06          v17.01.0-rc2           v18.06.3               v19.07.4 
openwrt-19.07          v17.01.1               v18.06.4               v19.07.5 
openwrt-21.02          v17.01.2               v18.06.5               v19.07.6 
ORIG_HEAD              v17.01.3               v18.06.6               v19.07.7 
origin/HEAD            v17.01.4               v18.06.7               v21.02.0-rc1 
origin/lede-17.01      v17.01.5               v18.06.8               v21.02.0-rc2 
origin/master          v17.01.6               v18.06.9               v21.02.0-rc3 
origin/openwrt-18.06   v17.01.7               v19.07.0               
origin/openwrt-19.07   v18.06.0               v19.07.0-rc1

select an old version with ONE of the following commands


git checkout openwrt-21.02

git checkout openwrt-19.07

git checkout openwrt-18.06

git checkout lede-17.01

If you need to try another old version, download sources again and use a different command to switch that to the old version you want.

In older releases this device is in ar71xx target, so if you do not find it in ath79 (or if there is no ath79 target at all), check in that target too.

This is the commit that added support to that device v1 https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=47ab1cbf23aef658f46bd86af88edb4e3f665639

it was done in 2014 so you should find this device in all the listed old versions.

driversat · August 3, 2021, 9:55am

hi mates,
tried compiling many versions but something's missing:

TFTP server address is 192.168.0.100; our address is 192.168.0.254
Get filename 'vmlinuz'.
#################################################################
####################
Done.
Bytes transferred = 4324880, 1745 Kbytes/sec
Allocated memory for elf segment ok: addr: 0x80060000, size 0x4500d0
Skipping non LOAD program header (type 0x4)
Loading .text @ 0x80060000 (3099820 bytes)
Loading __ex_table @ 0x80354cb0 (6120 bytes)
Loading .rodata @ 0x80357000 (649016 bytes)
Loading .pci_fixup @ 0x803f5738 (1008 bytes)
Loading __ksymtab @ 0x803f5b28 (23544 bytes)
Loading __ksymtab_gpl @ 0x803fb720 (13392 bytes)
Loading __ksymtab_strings @ 0x803feb70 (83565 bytes)
Loading __param @ 0x804131e0 (780 bytes)
Clearing __modver @ 0x804134ec (2836 bytes)
Loading .data @ 0x80414000 (147764 bytes)
Loading .data..page_aligned @ 0x80439000 (8192 bytes)
Loading .init.text @ 0x8043b000 (191980 bytes)
Loading .init.data @ 0x80469df0 (80924 bytes)
Loading .mips.machines.init @ 0x8047da0c (4096 bytes)
Clearing .bss @ 0x80480000 (196816 bytes)

Starting kernel

[    0.000000] Linux version 4.4.194 (hamid@hamid-ASUS) (gcc version 5.4.0 (LEDE GCC 5.4.0 r4046-beaa2ecc10) ) #0 Tue Nov 19 05:51:15 2019
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
[    0.000000] SoC: Atheros AR9344 rev 2
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] No valid device tree found, continuing without
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  y
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 60108K/65536K available (3026K kernel code, 158K rwdata, 756K rodata, 276K init, 192K bss, 5428K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:560.000MHz, DDR:450.000MHz, AHB:225.000MHz, Ref:40.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6825930166 ns
[    0.000010] sched_clock: 32 bits at 280MHz, resolution 3ns, wraps every 7669584382ns
[    0.009052] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
[    0.082155] pid_max: default: 32768 minimum: 301
[    0.087654] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.095347] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.106659] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.118141] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.126034] NET: Registered protocol family 16
[    0.132850] MIPS: machine is Generic AR71XX/AR724X/AR913X based board
[    0.155649] clocksource: Switched to clocksource MIPS
[    0.163071] NET: Registered protocol family 2
[    0.169032] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.177196] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.184585] TCP: Hash tables configured (established 1024 bind 1024)
[    0.192081] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.198913] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.206538] NET: Registered protocol family 1
[    0.219040] Crashlog allocated RAM at address 0x3f00000
[    0.242595] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.249445] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.263982] io scheduler noop registered
[    0.268604] io scheduler deadline registered (default)
[    0.274804] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.282711] console [ttyS0] disabled
[    0.306961] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 2500000) is a 16550A

then reboots

frollic · August 3, 2021, 1:17pm

now it's booting a 4.4 kernel, but is it an initramfs, it seems kind of small ... ?