Help on restoring original RE200 V5 bootloader (U-Boot)

Hi, I accidentally bricked my RE200 V5 trying to update it (wrongly selected Load Boot Loader code then write to Flash via TFTP).

I'm looking into updating its flash memory using a Raspberry Pi Pico and the procedure described here, but I can't seem to find the original bootloader image.

The firmware available in the TP-Link website comes without the bootloader, judging by the filename (re200v5-up-noboot-02000005-ver1-0-23-P1[20230418-rel60395].bin.

Is there anywhere else I could find the U-Boot bootloader for this device? These are the boot logs from before it was bricked, in case it helps:

Original boot logs
U-Boot 1.1.3 (Aug 21 2020 - 11:04:07)

Board: Ralink APSoC DRAM:  16 MB
relocate_code Pointer at: 80fc4000
Software System Reset Occurred
flash manufacture id: 1c, device id 70 16
Warning: un-recognized chip ID, please update bootloader!
*** Warning - bad CRC, using default environment

icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
RESET MT7628 PHY!!!!!!
Please choose the operation or press ctrl + c to stop auto boot: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
   
3: System Boot system code via Flash.
## Booting image at bc00d000 ...
addr:0xbc00d000
vxWorks Image.
imgFileEnc=0xbc00d080, offset=0x80, len=0x17601f
excNormVecSize=60 excTlbVecSize=16 excXtlbVecSize=16 excCacheVecSize=56 set SR reg=10000000arch timer init start timer_rate=290000000
arch timer init end
RALINK_GPIOMODE = 54154404 
RALINK_GPIOMODE = 54144404 
***** Xtal 40MHz *****
start PCIe register access
RALINK_RSTCTRL = 2400000
RALINK_CLKCFG1 = fdbfffc0

*************** MT7628 PCIe RC mode *************
PCIE0 no card, disable it(RST&CLK)
enter sysGpioInit
[FLASH] flash manufacture id: 1c, device id 70 16
[FLASH] find flash: EN25QH32B (1024 Equal Sectors with 4KB byte each - 4MB).
initcall level=0
initcall level=1
initcall level=2
ctrlAddEventCallbackExt():register app<systool>.
[apps_wlanAppRegister:339] l_wlanapplist_register
[apps_wlanAppRegister:344] not null
ctrlAddEventCallbackExt():register app<wlan>.
[apps_wlanAppRegister:339] l_wlanapplist_register
[apps_wlanAppRegister:354] add wlan app 
[apps_wlanAppRegister:339] l_wlanapplist_register
[apps_wlanAppRegister:354] add wlan app 
[apps_wlanAppRegister:339] l_wlanapplist_register
[apps_wlanAppRegister:354] add wlan app 
[apps_wlanAppRegister:339] l_wlanapplist_register
[apps_wlanAppRegister:354] add wlan app 
ctrlAddEventCallbackExt():register app<aps>.
ctrlAddEventCallbackExt():register app<main>.
ctrlAddEventCallbackExt():register app<advanced>.
initcall level=3
initcall level=4
initcall level=5
initcall level=6
initcall level=7
original memoryPool->objectSize 64
realObjectSize 68
new memoryPool->objectSize 64
original memoryPool->objectSize 68
realObjectSize 72
new memoryPool->objectSize 68
original memoryPool->objectSize 132
realObjectSize 136
new memoryPool->objectSize 132
original memoryPool->objectSize 260
realObjectSize 264
new memoryPool->objectSize 260
original memoryPool->objectSize 516
realObjectSize 520
new memoryPool->objectSize 516
original memoryPool->objectSize 1028
realObjectSize 1032
new memoryPool->objectSize 1028
original memoryPool->objectSize 2052
realObjectSize 2056
new memoryPool->objectSize 2052
original memoryPool->objectSize 4100
realObjectSize 4104
new memoryPool->objectSize 4100
original memoryPool->objectSize 64
realObjectSize 68
new memoryPool->objectSize 64
original memoryPool->objectSize 24
realObjectSize 28
new memoryPool->objectSize 24
original memoryPool->objectSize 48
realObjectSize 52
new memoryPool->objectSize 48
original memoryPool->objectSize 100
realObjectSize 104
new memoryPool->objectSize 100
original memoryPool->objectSize 176
realObjectSize 180
new memoryPool->objectSize 176
original memoryPool->objectSize 296
realObjectSize 300
new memoryPool->objectSize 296
original memoryPool->objectSize 668
realObjectSize 672
new memoryPool->objectSize 668
original memoryPool->objectSize 1148
realObjectSize 1152
new memoryPool->objectSize 1148
cache align size 32
original memoryPool->objectSize 64
realObjectSize 68
new memoryPool->objectSize 64
original memoryPool->objectSize 1724
realObjectSize 1728
new memoryPool->objectSize 1724
Attaching interface lo0... done

 Waitting for RX_DMA_BUSY status Start... done


Tx_Ring addr: 0xa0b43b20!!!

Rx_Ring addr: 0xa0b44900!!!



                                      Version2.0
                            Software Platform for TPOS/1.0.0
              Copyright(C) 2001-2011 by TP-LINK TECHNOLOGIES CO., LTD.
                      Creation date: Feb 20 2023, 10:01:09
# minifs.fileCount=419
minifs.nameTableSize=8128
minifs.fileIndex=bc185fe0
minifs.ballCount=35
minifs.fileIndex initialized
minifs.ballIndex initialized
minifs.ballData=BC188240
minifs.ballData offset=0010CB4F
modelDesc len is 0x580c, descLen 0x580c, fileLen 0x21083
calcTotalSize 0x18dac4
[main]_loadMcbDescFile():Total mem size=1628868, addr=0x80b7fdec.

port 4 link down
loadAppDesc():load app<main>.
loadAppDesc():load app<systool>.
loadAppDesc():load app<wlan>.
loadAppDesc():load app<advanced>.
loadAppDesc():load app<aps>.
[main]ctrlAppReset():App main reset.

Reset Timezone to BR
[main]ctrlAppReset():App systool reset.

[main]ctrlAppReset():App wlan reset.

[main]ctrlAppReset():App advanced reset.

[main]ctrlAppReset():App aps reset.

malloc 19164 for config reading and decryption
Decompress config 0x4280
reset button checking...
add eth0 into lan
add eth1 into lan
add eth2 into lan
add eth3 into lan
add ra0 into lan
add ra1 into lan
add ra2 into lan
add rai0 into lan
add rai1 into lan
add rai2 into lan
add apcli0 into lan
add apclii0 into lan
Set eth0 mac address to 3C-52-A1-96-B3-50
[main]ctrlAppInit():App main init.

TimeZone=GMT+-3
Setting TimeZone to: TIMEZONE=GMT-3::180:000000:000000
setting System Time
[sntp] Current DST Start From 2106-03-27 01:00.00
[sntp] Current DST End By 2106-10-30 01:00.00
[sntp] Current DST Start From 2023-03-26 01:00.00
[sntp] Current DST End By 2023-10-29 01:00.00
[main]ctrlAppInit():App systool init.

[main]ctrlAppInit():App wlan init.

[main]ctrlAppInit():App advanced init.

[main]ctrlAppInit():App aps init.

--------------------------------->response 00000000
[cloud][DHCPS](dhcpsStart, 1892)Dhcps start
10|0|115:cloud_brd_run| - [SMARTIP](smartipDisconnectClient, 90)disconnect clients

[main]iwprivParser,128=>-1
[cloud]
dev: <rai> does not exists!
Interface doesn't accept private ioctl...
cset (8BEB): errno = 0x13
loud-sdk version: 1.3.9-rc03, build_time:20190322_112545
[SMARTIP](smartipNotify, 752)get notify: SMARTIP_EVENT_DHCPC

[domainStart] domainSerialIPv6 = -35393395
tdp mesh loop start
[SMARTIP](smartipHandleDhcpc, 387)dhcpc data changed, detect_res 0 -> 0
[tdpmesh]role = slave
**************************************************
[TDPMESH-ERR]tdpdOneMeshLoop() 4246 ============================>>>start as slave
********************config dump*******************
[mt7613b]get end "rai0" failed!
--------------------------------------------------
[main]generate DSA ...
ctrlAppStart():App main start work.
sef domain                      : n-deventry-gw.tplinkcloud.com

Setting TimeZone to: TIMEZONE=GMT-3::180:000000:000000
setting System Time
[sntp] Current DST Start From 2023-03-26 01:00.00
[sntp] Current DST End By 2023-10-29 01:00.00
[sntp] Current DST Start From 2023-03-26 01:00.00
[sntp] Current DST End By 2023-10-29 01:00.00
[main]ctrlAppStart():App systool start work.

[mt7613b]First phase! the return iniString=0:1:5:0:256:16:0:rai!
[mt7613b]input 0:1:5:0:256:16:0:rai
[mt7613b]The initString info:
[mt7613b]	phyNum=1!
[mt7613b]	devNum=0!
[mt7613b]	infType=5!
[mt7613b]	irqNum=0!
[mt7613b]	devType=256!
[mt7613b]	privSize=16!
[mt7613b]	csrAddr=0x0!
[mt7613b]	devName=rai!
Not found any PCI-E devices!
[mt7613b]csr_addr = 0x0x0
[mt7613b]../src/os/tpos/pci_main_end.c:RtmpVxPciEndLoad:127 assert failed
[mt7613b]

=== pAd = 0x80d490f8, size = 1311256 ===

[mt7613b]<-- RTMPAllocAdapterBlock, Status=0
[mt7613b]pAd->PciHif.CSRBaseAddress =0x0, csr_addr=0x0!
[mt7613b]device_id =0x7663
[mt7613b]mt_pci_chip_cfg(): HWVer = 0x40a021, FWVer = 0x409821, pAd->ChipID = 0x94560006
[mt7613b]<-- RTMPAllocTxRxRingMemory, Status=0
[mt7613b][mt7613b][onemesh] pAd->mesh_enable = FALSE, pAd->is_conn_specific_bssid = FALSE
_getE2pTxRxStream() hwCfg = 0x9, rxStream = 1, txStream = 1 
[mt7613b]E2pAccessMode=2
[mt7613b]CountryCode=DE 
[mt7613b][TxPower] BAND0: 100
[mt7613b][PowerUpenable] BAND0: 0
[mt7613b][SKUenable] BAND0: 1
[mt7613b][PERCENTAGEenable] BAND0: 1
[mt7613b][BFBACKOFFenable] BAND0: 0
[mt7613b]profile: FragThreshold[0]=2346
[mt7613b]APEdca0
[mt7613b]APEdca1
[mt7613b]APEdca2
[mt7613b]APEdca3
[mt7613b]APSDCapable[0]=1
[mt7613b]APSDCapable[1]=1
[mt7613b]default ApCliAPSDCapable[0]=1
[mt7613b]DfsZeroWaitCacTime=255/255
[mt7613b]RTMPSetProfileParameters(): ACSCheckTime[0]=0 seconds
[mt7613b]RTMPSetProfileParameters(): SE_OFF=1
[mt7613b]BandIdx = 0, tpcDutyInitFlag=1
[mt7613b]BandIdx = 0, tpcnitFlag=1
[mt7613b]BandIdx = 0, tpcDuty=100-75-60-50
[mt7613b]BandIdx = 0, thermalHighEn=1
[mt7613b]BandIdx = 0, thermalHighCritera=124
[mt7613b]BandIdx = 0, thermalLowEn=1
[mt7613b]BandIdx = 0, thermalLowCritera=119
[mt7613b]BandIdx = 0, thermalRecheckTime=30
[mt7613b]BandIdx = 0, thermalRFOffEn=0
[mt7613b]BandIdx = 0, thermalRFOffCriteria=125
[mt7613b]BandIdx = 0, thermalUcType=1
0mt7613b]AppClEiMsWDfS==0
 [xmt8760135b]5raei:f act 0CS R &ad(drp 0Ex0s
f[m-t7>61e3bs]ofs_RwleangInsit) 4=4202 xpA8d=00x5805d4e90ff8eMS8TA _Irniet g(1s) =--0->x A8pC0li5
umveaiflaebl8eN
! EdexvIcnietSptrt =i0:o4:n0: 10C24o:1n6:t0:eapxclti
10 mtv76e13cb]Ninupumt =0:00:x4:20:
R1D6:u0:mappcl i
Themtg76s13:b]
inpitEStsrifng- i>nfpo:a
0[mat7m6113b=]	0phxyN0um0=00!
 [0mt076d130b]
Nupm=E0!sev
0[mt-76>13pb]a	irnfaTympe2=4=!
 [xmt0760130b]0	i0rq0Nu0m=00!

m7p61E3bs]	fde-vT>yppe=a10r24a!
0[3mt=76013xb]0	p0ri0vS0iz0e=0160!
mt
r3pb]E	cssrfAd-dr>=0px0a!
0[amtm76413=b]0	dxev0Na0me0=a0pc0li0!
pA0tm
lipENEDDsevfLo-ad>_5_G(e):r drevnNaome==a0pcxli00!0
ism0t706103b0]R0eg
r pMSETAs IfF -(a>pcclia) u, spAed- >M=ST0ANxum8 =0 10
00008
pEsf->cntxt =0x803eb369
pEsf->fpcsr =0x803be910
pEsf->badva =0x00000009
Reg[SR]=0x1000f401
Reg[PC]=0x80057f20
Reg[LO]=0x00000000
Reg[HI]=0x00000000
gReg[0]=0x00000000
gReg[1]=0xffffffe0
gReg[2]=0x00000000
gReg[3]=0x00000000
gReg[4]=0x80d6ab34
gReg[5]=0x80d6ab34
gReg[6]=0x00000006
gReg[7]=0x8055f0e0
gReg[8]=0x80540000
gReg[9]=0x1000f400
gReg[10]=0x80530000
gReg[11]=0xffffffff
gReg[12]=0x00000020
gReg[13]=0x0000002b
gReg[14]=0x0000002a
gReg[15]=0x0000006c
gReg[16]=0x804eb4a0
gReg[17]=0x80d490f8
gReg[18]=0x80d6ab34
gReg[19]=0x80d7ed44
gReg[20]=0x00000000
gReg[21]=0x00000000
gReg[22]=0x80dbdcda
gReg[23]=0x00000400
gReg[24]=0x00000014
gReg[25]=0x00000000
gReg[26]=0x80b7ff78
gReg[27]=0x00000000
gReg[28]=0x804ec450
gReg[29]=0x8055f080
gReg[30]=0x00000000
gReg[31]=0x801b0f28
Reg[CAUSE]=0x80d7ed44
Reg[FPCSR]=0x80d7ed5e
Task[0](tRootTask) Suspend!
Erase sector 4K: 0x3fc000
Erase sector 4K: 0x3fd000

raspi_write(): to:3fc000 len:1014 

->[update_att_from_wdev+20]->[update_att_from_wdev+0]->[tposTaskEntry+5c]->[ctrlPowerOn+90]->[ctrlAppStart+48]->[wlanStartup+1e4]->[wlanStartupChip+90]->[os_wlal nit+11c]->[MSTA_Init[+3e44x]-c>[Hupodaotek_aLtto_fgroTm_awdsevk+2]0]:br ct
_w-ma>cs[ buripdgdenaamte e--_-sahotw t b_rifdgre oFDmB
rbwrcdtle svho+wp2or0t ]br-id>ge[naumep -d--ashtowe  _braidtget p_orft
 borcmtl_ awdddpoertv b+ri0dg]en-am>e [potrtpNaomes -T-aadds ak bErindgte rpoyrt+
lbrcct]l -de>lp[orct tbrridlgePnaomew peorrtNOamne +--9de0l ]a -br>id[gec ptorrt
 bArcptlp aSddtbra brritdg+en4am8e ]  -  >  [  w  l -a-cnraStet aa nrewt buripdg1e
 e4]->[wlanStartupChip+90]->[os_wlanInit+11c]->[MSTA_Init+344]->[update_att_from_wdev+20]
Erase sector 4K: 0x3fc000
Erase sector 4K: 0x3fd000

raspi_write(): to:3fc000 len:1014 
[DBG] sel_fine_tmp=00000003, sel_mst_fine=00000004,fg_dly_adj=00000007
[DBG] sel_fine_tmp=00000002, sel_mst_fine=00000004,fg_dly_adj=00000006

[04050C0A][04050C08][86870000][21224243][00212244]
DU Setting Cal Done

Only from fellow device owners, I'd guess.

Maybe one of the older OEM uploads contains it, if not you may have to resort to their GPL tarball and hope that it contains functional u-boot source.

1 Like

Thanks for the idea!

Apparently the v5 is not available in their GPL Code Center (https://www.tp-link.com/en/support/gpl-code/), I've sent them an e-mail requesting the files.

In the meantime I found out the RE305 v4 uses the same firmware, and has a download link in the GPL Code Center. I've compiled u-boot and flashed it, apparently it works (although using a different serial baud rate, of 57600), but it only outputs the following code and then freezes.

[0700060F][0700060F]
DDR Calibration DQS reg = 00006B6B


U-Boot 1.1.3 (Mar 27 2024 - 16:55:36)

Board: Ralink APSoC DRAM:  32 kB
relocate_code Pointer at: 7ffc0000

Probably some device-specific configuration now, but just to get some serial output again is very refreshing. I'll report back once they reply to my e-mail.

1 Like

Please realize that the RE200 v5 cannot run OpenWrt, it doesn't have enough resources.

I happen to own one that I don't use. I will check on the weekend if I've disassembled it or not.

2 Likes

Hello everyone, I'm still waiting for the TP-Link reply, initially they said this device is not based on any open-source system, which is why there is no GPL release for it.

I've asked about U-boot, which can be seen from the bootloader logs, and I'm still waiting on a reply.

In the meantime, I've managed to compile a 4MB OpenWRT image for this device by following this guide, is there any way I could flash it directly to the bootloader? Or do I need a bootloader first to install OpenWRT? I couldn't find any documentation on how to install directly into flash memory.

4.0M    bin/targets/ramips/mt76x8/openwrt-ramips-mt76x8-tplink_re200-v5-initramfs-kernel.bin

You need the boot loader.

1 Like