First try to support CPE210 v2 - will not boot

im getting giberish on my serial... any advice for a novice?

Have you connected ground?
And which baud rate are you using

problem was with me powering the device with the serial. it would reset the usb adapter due to too much power. i connected only gnd and rx usb to tx on the CPE. it worked fine.

-<-( ------

U-Boot 1.1.4-g7613bad0-dirty (Jul 20 2017 - 17:08:57)

ap143-2.0 - Honey Bee 2.0

DRAM:  64 MB
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: ba:be:fa:ce:08:41
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
Honey Bee ---->  MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: ba:be:fa:ce:08:41
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x50a1a100
is button pressed? 0
Autobooting in 1 seconds
## Booting image at 9f040000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

Booting QCA953x
Linux version 2.6.31 (root@ubuntu) (gcc version 4.3.3 (GCC) ) #1 PREEMPT Thu Dec                                                                                         28 19:47:02 CST 2017
flash_size passed from bootloader = 8
CPU revision is: 00019374 (MIPS 24Kc)
ath_sys_frequency: cpu apb ddr apb cpu 650 ddr 392 ahb 216
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:04 rootfstype=squashfs init=/i                                                                                        nit mtdparts=ath-nor0:128k(u-boot),64k(pation-table),64k(product-info),1536k(ker                                                                                        nel),6144k(rootfs),192k(config),64k(ART) mem=64M
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 61388k/65536k available (1832k kernel code, 4076k reserved, 473k data, 1                                                                                        12k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 432.12 BogoMIPS (lpj=864256)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
net_link: create socket ok.
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/O].
msgmni has been set to 120
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
7 cmdlinepart partitions found on MTD device ath-nor0
Creating 7 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000030000 : "pation-table"
0x000000030000-0x000000040000 : "product-info"
0x000000040000-0x0000001c0000 : "kernel"
0x0000001c0000-0x0000007c0000 : "rootfs"
0x0000007c0000-0x0000007f0000 : "config"
0x0000007f0000-0x000000800000 : "ART"
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
athwdt_timer_init: Starting WDT.
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 112k freed
init started:  BusyBox v1.01 (2017.12.28-11:47+0000) multi-call binary
This Board use 2.6.31
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (1024 buckets, 30720 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
iptable_raw: version magic '2.6.31-gbb45668-dirty preempt mod_unload MIPS32_R2 3                                                                                        2BIT ' should be '2.6.31 preempt mod_unload MIPS32_R2 32BIT '
insmod: cannot insert `/lib/modules/2.6.31/kernel/iptable_raw.ko': Invalid modul                                                                                        e format (-1): Exec format error

Register vlan_manage hooks success.
PPPoL2TP kernel driver, V1.0
PPTP driver version 0.8.3
WARN: TDB not supported!
WARN: TDB not supported!

 (none) mips #1 PREEMPT Thu Dec 28 19:47:02 CST 2017 (none)
(none) login: httpMudCreate: MUD 0x6613b0 was created
[info @ initModelParameters:205] init profile...

qca95xx_GMAC: Length per segment 1536
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps  CHECK DMA STATUS
mac:0 Registering S27....
qca95xx_GMAC: RX TASKLET - Pkts per Intr:18
qca95xx_GMAC: Mac address for unit 0:bfff0000
qca95xx_GMAC: ff:ff:ff:ff:ff:ff
qca95xx_GMAC: Max segments per packet :   1
qca95xx_GMAC: Max tx descriptor count :   128
qca95xx_GMAC: Max rx descriptor count :   128
qca95xx_GMAC: Mac capability flags    :   3581
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps  CHECK DMA STATUS
mac:1 Registering S27....
qca95xx_GMAC: RX TASKLET - Pkts per Intr:18
qca95xx_GMAC: Mac address for unit 1:bfff0006
qca95xx_GMAC: ff:ff:ff:ff:ff:ff
qca95xx_GMAC: Max segments per packet :   1
qca95xx_GMAC: Max tx descriptor count :   128
qca95xx_GMAC: Max rx descriptor count :   128
qca95xx_GMAC: Mac capability flags    :   3D81
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
athr_gmac_ring_alloc Allocated 2048 at 0x83a6a800
athr_gmac_ring_alloc Allocated 2048 at 0x83a6a000
HONEYBEE ----> S27 PHY MDIO
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
athr_gmac_ring_alloc Allocated 2048 at 0x83b0e800
athr_gmac_ring_alloc Allocated 2048 at 0x83b0e000
HONEYBEE ----> S27 PHY MDIO
ATHRS27: resetting s27
ATHRS27: s27 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...

I was hoping that it would be simple as adding the new version to safeloader util,but upon looking at firmware images it apears to have completely different safeloader partition layout.
That said, without one in my hands its not good to guess.

@robimarko where did you found differences in partition layout? I can't see any:

v3:
partition fs-uboot base 0x00000 size 0x20000
partition partition-table base 0x20000 size 0x02000
partition default-mac base 0x30000 size 0x00020
partition product-info base 0x31100 size 0x00100
partition device-info base 0x31400 size 0x00400
partition signature base 0x32000 size 0x00400
partition device-id base 0x33000 size 0x00100
partition os-image base 0x40000 size 0x170000
partition soft-version base 0x1b0000 size 0x00100
partition support-list base 0x1b1000 size 0x01000
partition file-system base 0x1c0000 size 0x600000
partition user-config base 0x7c0000 size 0x10000
partition default-config base 0x7d0000 size 0x10000
partition log base 0x7e0000 size 0x10000
partition radio base 0x7f0000 size 0x10000

v2:
partition fs-uboot base 0x00000 size 0x20000
partition partition-table base 0x20000 size 0x02000
partition default-mac base 0x30000 size 0x00020
partition product-info base 0x31100 size 0x00100
partition device-info base 0x31400 size 0x00400
partition signature base 0x32000 size 0x00400
partition device-id base 0x33000 size 0x00100
partition os-image base 0x40000 size 0x170000
partition soft-version base 0x1b0000 size 0x00100
partition support-list base 0x1b1000 size 0x01000
partition file-system base 0x1c0000 size 0x600000
partition user-config base 0x7c0000 size 0x10000
partition default-config base 0x7d0000 size 0x10000
partition log base 0x7e0000 size 0x10000
partition radio base 0x7f0000 size 0x10000

Are you sure?
Looking at the firmware images from TP Link bases and sizes were not the same.
It could be that we were looking at different images

For shure. https://static.tp-link.com/2017/201712/20171201/CPE210(UN)_v3.0_20170828.zip and https://static.tp-link.com/TP_Pharos_V2.0_170908_CPE210_v2.0.zip

Just checked it out and you were right.
So,its just a matter of adding IDs to safeloader.

Then we can add a profile for v3 or reuse the v2 profile

@likvidshit Can you make a dump of product-info partition?

Been busy.

@likvidshit This branch should work, also switched to the dynamic partition for the safeloader so kernel and rootfs dont have to be hardcoded.
Here are images for testing.
https://drive.google.com/drive/folders/1vds7-gIU-ybbnRmtuEkeqHs8kNe-BBXN?usp=sharing

been drinking, its saturday :smiley:
what do you need? how do i aquire a dump of product-info partition??

il test this factory img first from the web interface of the original PHAROS webui after that i flash this other one(sysupgrade)?

Simply flash the factory image from web ui

factory flash done... openwrt is working. ill flash the sysupgrade and then test the wifi... reporting in a bit :+1:

sysupgrade firmware did not work... it is not booting

awaiting instructions...

Whats bootlog saying?

cant get it. i lent my TTL adapter to a friend. it just keeps rebooting over and over. ill try to debrick it via https://wiki.openwrt.org/toh/tp-link/tl-cpe210#debricking and try flashing again...
Update... the recovery instructions are correct and work on WIN7 no hustle...

Well,its really weird that sysupgrade bricks it.
Can you flash OpenWrt again to check if MACs are the same as in stock and also if WLAN works.
Also,can you then get me dmesg output

login as: root
root@192.168.1.1's password:


BusyBox v1.29.2 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r7822-6dac878c63
 -----------------------------------------------------
root@OpenWrt:~# desg
-ash: desg: not found
root@OpenWrt:~# dmesg
[    0.000000] Linux version 4.9.119 (robimarko@localhost.localdomain) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7822-6dac878c63) ) #0 Sat Aug 11 15:36:56 2018
[    0.000000] MyLoader: sysp=8760e2d5, boardp=87358a9d, parts=1d2c1034
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000] free_area_init_node: node 0, pgdat 8049c334, node_mem_map 81000020
[    0.000000]   Normal zone: 128 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line:  board=CPE210V3 mtdparts=spi0.0:128k(u-boot)ro,64k(partition-table)ro,64k(product-info)ro,7680k(firmware),192k(config)ro,64k(ART)ro console=ttyS0,115200 rootfstype=squashfs noinitrd
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 59640K/65536K available (3362K kernel code, 165K rwdata, 812K rodata, 324K init, 213K bss, 5896K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:650.000MHz, DDR:393.090MHz, AHB:216.666MHz, Ref:25.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000010] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008274] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.071121] pid_max: default: 32768 minimum: 301
[    0.076118] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.083092] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.094049] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.104495] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.111654] NET: Registered protocol family 16
[    0.118193] MIPS: machine is TP-LINK CPE210 v3
[    0.376122] clocksource: Switched to clocksource MIPS
[    0.382790] NET: Registered protocol family 2
[    0.388345] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.395719] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.402512] TCP: Hash tables configured (established 1024 bind 1024)
[    0.409354] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.415530] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.422540] NET: Registered protocol family 1
[    0.427221] PCI: CLS 0 bytes, default 32
[    0.433015] Crashlog allocated RAM at address 0x3f00000
[    0.440163] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.454200] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.460409] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.482757] io scheduler noop registered
[    0.486974] io scheduler deadline registered (default)
[    0.492754] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.499982] console [ttyS0] disabled
[    0.523933] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[    0.533047] console [ttyS0] enabled
[    0.540605] bootconsole [early0] disabled
[    0.553809] m25p80 spi0.0: found gd25q64, expected m25p80
[    0.561948] m25p80 spi0.0: gd25q64 (8192 Kbytes)
[    0.566835] 6 cmdlinepart partitions found on MTD device spi0.0
[    0.572947] Creating 6 MTD partitions on "spi0.0":
[    0.577928] 0x000000000000-0x000000020000 : "u-boot"
[    0.585602] 0x000000020000-0x000000030000 : "partition-table"
[    0.594154] 0x000000030000-0x000000040000 : "product-info"
[    0.602437] 0x000000040000-0x0000007c0000 : "firmware"
[    0.626724] 2 tplink-fw partitions found on MTD device firmware
[    0.632871] 0x000000040000-0x0000001a9647 : "kernel"
[    0.639757] 0x0000001b0000-0x0000007c0000 : "rootfs"
[    0.647070] mtd: device 5 (rootfs) set to be root filesystem
[    0.652970] 1 squashfs-split partitions found on MTD device rootfs
[    0.659448] 0x0000003e0000-0x0000007c0000 : "rootfs_data"
[    0.667848] 0x0000007c0000-0x0000007f0000 : "config"
[    0.675541] 0x0000007f0000-0x000000800000 : "ART"
[    0.684300] libphy: Fixed MDIO Bus: probed
[    0.716181] libphy: ag71xx_mdio: probed
[    1.349087] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[    1.359379] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    1.367500] NET: Registered protocol family 10
[    1.376694] NET: Registered protocol family 17
[    1.381474] 8021q: 802.1Q VLAN Support v1.8
[    1.394194] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    1.404332] Freeing unused kernel memory: 324K
[    1.408967] This architecture does not have kernel memory protection.
[    2.096919] init: Console is alive
[    2.100745] init: - watchdog -
[    2.476134] random: fast init done
[    3.024221] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.077622] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.095988] init: - preinit -
[    3.746982] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    5.859812] eth0: link up (100Mbps/Full duplex)
[    5.864557] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    7.034203] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    7.070799] urandom-seed: Seed file not found (/etc/urandom.seed)
[    7.240233] eth0: link down
[    7.257798] procd: - early -
[    7.260915] procd: - watchdog -
[    7.885152] procd: - watchdog -
[    7.888825] procd: - ubus -
[    7.996992] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.047665] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.054800] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.062399] procd: - init -
[    8.385179] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.397284] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    8.417318] Loading modules backported from Linux version wt-2017-11-01-0-gfe248fc2c180
[    8.425601] Backport generated by backports.git v4.14-rc2-1-31-g86cf0e5d
[    8.436413] ip_tables: (C) 2000-2006 Netfilter Core Team
[    8.452278] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[    8.526604] xt_time: kernel timezone is -0000
[    8.608651] PPP generic driver version 2.4.2
[    8.616363] NET: Registered protocol family 24
[    8.675807] ath: EEPROM regdomain: 0x0
[    8.675820] ath: EEPROM indicates default country code should be used
[    8.675824] ath: doing EEPROM country->regdmn map search
[    8.675843] ath: country maps to regdmn code: 0x3a
[    8.675849] ath: Country alpha2 being used: US
[    8.675852] ath: Regpair used: 0x3a
[    8.688192] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[    8.693607] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=47
[    8.781908] kmodloader: done loading kernel modules from /etc/modules.d/*
[   10.071924] urandom_read: 5 callbacks suppressed
[   10.071934] random: jshn: uninitialized urandom read (4 bytes read)
[   10.155209] random: jshn: uninitialized urandom read (4 bytes read)
[   22.651013] br-lan: port 1(eth0) entered blocking state
[   22.656520] br-lan: port 1(eth0) entered disabled state
[   22.662393] device eth0 entered promiscuous mode
[   22.729843] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   22.745085] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   22.804119] jffs2_build_filesystem(): unlocking the mtd device...
[   22.856198] done.
[   22.858219] jffs2_build_filesystem(): erasing all blocks after the end marker...
[   24.739824] eth0: link up (100Mbps/Full duplex)
[   24.744587] br-lan: port 1(eth0) entered blocking state
[   24.750046] br-lan: port 1(eth0) entered forwarding state
[   24.821022] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   34.246253] done.
[   34.248302] jffs2: notice: (1119) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  120.906183] random: crng init done
root@OpenWrt:~#

this is dmesg of factoryfirmware.