Help unbricking TP-Link RE200

Hello everyone,

yesterday i tried to flash my TP-Link RE200 v1.1 with the steps mentioned under https://openwrt.org/toh/tp-link/re200#web_interface_method_v1. I used the openwrt-imagetool to combine the bootloader from the latest stock image (re200v1_eu_3_14_2_up_boot(171206).bin) with the latest stable OpenWRT image for the device (openwrt-23.05.3-ramips-mt7620-tplink_re200-v1-squashfs-factory.bin). Unfortunately, after flashing the image over the web-interface of the stock firmware, the device was bricked. The power LED is steady green.

I was able to open the device and attach serial console. This is the output from the boot process after flashing:

U-Boot 1.1.3 (Dec  6 2017 - 09:04:51)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb4000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
spi_wait_nsec: 29 
spi device id: c2 20 17 c2 20 (2017c220)
find flash: MX25L6405D
============================================ 
Ralink UBoot Version: 4.1.0.0
This UBoot has been rewritten by TPLINK *_*
-------------------------------------------- 
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Dec  6 2017  Time:09:04:51
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 580 MHZ #### 
 estimate memory size =64 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   6: Load ART data then write to Flash via TFTP.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 
 0 
   
3: System Boot system code via Flash.
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8000c310) ...
## Giving linux memsize in MB, 64

Starting kernel ...

The device hangs indefinitely at the message Starting kernel.... My guess is that maybe something is wrong with the kernel load address or kernel entry point.

I was then able to start the OpenWRT initramfs-kernel image over TFTP:

[...]

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   6: Load ART data then write to Flash via TFTP.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 

You choosed 1

 0 
raspi_read: from:20028 len:6 

   
1: System Load Linux to SDRAM via TFTP. 
 Please Input new ones /or Ctrl-C to discard
	Input device IP (192.168.0.254) ==:192.168.0.254
	Input server IP (192.168.0.10) ==:192.168.0.10
	Input Linux Kernel filename () ==:test.bin

 netboot_common, argc= 3 

 NetTxPacket = 0x83FE5B00 

 KSEG1ADDR(NetTxPacket) = 0xA3FE5B00 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!! 
TFTP from server 192.168.0.10; our IP address is 192.168.0.254
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: Got ARP REPLY, set server/gtwy eth addr (9c:eb:e8:0b:eb:65)
Got it
#################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #
done
Bytes transferred = 5659984 (565d50 hex)
NetBootFileXferSize= 00565d50
Automatic boot of image at addr 0x80A00000 ...
## Booting image at 80a00000 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 5.15.150 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23809-234f1a2efa) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Fri Mar 22 22:09:42 2024
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is TP-Link RE200 v1
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,57600n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=0007e00a
[    0.000000] Readback ErrCtl register=0007e00a
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 52868K/65536K available (5931K kernel code, 609K rwdata, 740K rodata, 4424K init, 225K bss, 12668K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000003] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015574] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087787] pid_max: default: 32768 minimum: 301
[    0.098123] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.112548] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.137807] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.157316] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.171017] pinctrl core: initialized pinctrl subsystem
[    0.183153] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.195537] thermal_sys: Registered thermal governor 'step_wise'
[    0.688943] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.711905] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.724643] rt2880_gpio 10000638.gpio: registering 16 gpios
[    0.735667] rt2880_gpio 10000638.gpio: registering 16 irq handlers
[    0.748310] rt2880_gpio 10000660.gpio: registering 32 gpios
[    0.759336] rt2880_gpio 10000660.gpio: registering 32 irq handlers
[    0.772001] rt2880_gpio 10000688.gpio: registering 1 gpios
[    0.782856] rt2880_gpio 10000688.gpio: registering 1 irq handlers
[    0.797045] PCI host bridge to bus 0000:00
[    0.805115] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.818729] pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
[    0.832402] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.848206] pci 0000:00:00.0: [1814:0801] type 01 class 0x060400
[    0.860108] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    0.872560] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    0.885103] pci 0000:00:00.0: supports D1
[    0.892970] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.906809] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.922904] pci 0000:01:00.0: [14c3:7650] type 00 class 0x028000
[    0.934778] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff]
[    0.947341] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.959714] pci 0000:01:00.1: [14c3:8650] type 00 class 0x0d1100
[    0.971593] pci 0000:01:00.1: reg 0x10: [mem 0x00000000-0x000fffff]
[    0.984146] pci 0000:01:00.1: supports D1
[    0.991957] pci 0000:01:00.1: PME# supported from D0 D1 D3hot D3cold
[    1.006942] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    1.020000] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    1.033160] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    1.046282] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    1.060128] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    1.073628] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    1.087136] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
[    1.100634] pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
[    1.114133] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.123984] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    1.138168] clocksource: Switched to clocksource systick
[    1.150488] NET: Registered PF_INET protocol family
[    1.160389] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    1.175867] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    1.192635] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    1.207958] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    1.223196] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    1.237218] TCP: Hash tables configured (established 1024 bind 1024)
[    1.250086] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    1.263017] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    1.277285] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    1.288572] PCI: CLS 0 bytes, default 32
[    1.296454] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    2.042027] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    2.062223] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.073751] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.094886] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    2.112725] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    2.128919] printk: console [ttyS0] disabled
[    2.137371] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    2.157108] printk: console [ttyS0] enabled
[    2.157108] printk: console [ttyS0] enabled
[    2.173642] printk: bootconsole [early0] disabled
[    2.173642] printk: bootconsole [early0] disabled
[    2.202374] spi spi0.0: force spi mode3
[    2.210942] spi-nor spi0.0: mx25l6405d (8192 Kbytes)
[    2.220981] 4 fixed-partitions partitions found on MTD device spi0.0
[    2.233701] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.248326] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.263709] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.278396] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    2.293227] Creating 4 MTD partitions on "spi0.0":
[    2.302828] 0x000000000000-0x000000020000 : "u-boot"
[    2.315151] 0x000000020000-0x0000007e0000 : "firmware"
[    2.327264] 2 tplink-fw partitions found on MTD device firmware
[    2.339155] Creating 2 MTD partitions on "firmware":
[    2.349057] 0x000000000000-0x000000230a7f : "kernel"
[    2.358957] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[    2.377063] 0x000000230a80-0x0000007c0000 : "rootfs"
[    2.387054] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[    2.406718] mtd: setting mtd3 (rootfs) as root device
[    2.417101] 1 squashfs-split partitions found on MTD device rootfs
[    2.429469] 0x0000005b0000-0x0000007c0000 : "rootfs_data"
[    2.441693] 0x0000007e0000-0x0000007f0000 : "config"
[    2.453356] 0x0000007f0000-0x000000800000 : "radio"
[    2.482142] gsw: setting port4 to ephy mode
[    2.498369] mtk_soc_eth 10100000.ethernet: mdio-bus disabled
[    2.509946] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    2.522643] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    2.540075] rt2880_wdt 10000120.watchdog: Initialized
[    2.552267] NET: Registered PF_INET6 protocol family
[    3.174165] Segment Routing with IPv6
[    3.181685] In-situ OAM (IOAM) with IPv6
[    3.189679] NET: Registered PF_PACKET protocol family
[    3.199885] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    3.226034] 8021q: 802.1Q VLAN Support v1.8
[    4.071391] mtk_soc_eth 10100000.ethernet eth0: port 0 link up (100Mbps/Full duplex)
[    8.833701] Freeing unused kernel image (initmem) memory: 4424K
[    8.845555] This architecture does not have kernel memory protection.
[    8.858406] Run /init as init process
[    9.649604] init: Console is alive
[    9.657057] init: - watchdog -
[    9.693355] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    9.725101] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    9.744333] init: - preinit -
[   10.095907] random: jshn: uninitialized urandom read (4 bytes read)
[   10.229564] random: jshn: uninitialized urandom read (4 bytes read)
[   10.305284] random: jshn: uninitialized urandom read (4 bytes read)
[   10.687427] 8021q: adding VLAN 0 to HW filter on device eth0
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   11.595846] procd: - early -
[   11.602010] procd: - watchdog -
[   11.946004] procd: - watchdog -
[   11.953068] procd: - ubus -
[   11.970217] random: ubusd: uninitialized urandom read (4 bytes read)
[   11.994188] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.007564] random: ubusd: uninitialized urandom read (4 bytes read)
[   12.025166] procd: - init -
Please press Enter to activate this console.
[   12.869471] kmodloader: loading kernel modules from /etc/modules.d/*
[   13.449909] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b
[   13.464943] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36
[   13.777299] PPP generic driver version 2.4.2
[   13.805112] NET: Registered PF_PPPOX protocol family
[   13.886913] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "radio"
[   13.901083] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 6352, rev 0500 detected
[   13.944052] ieee80211 phy0: rt2x00_set_rf: Info - RF chipset 7620 detected
[   14.014440] kmodloader: done loading kernel modules from /etc/modules.d/*
[   15.381383] random: jshn: uninitialized urandom read (4 bytes read)
[   15.657971] random: jshn: uninitialized urandom read (4 bytes read)
[   15.851514] random: jshn: uninitialized urandom read (4 bytes read)
[   16.442901] random: jshn: uninitialized urandom read (4 bytes read)
[   32.334008] random: crng init done
[   32.340813] random: 97 urandom warning(s) missed due to ratelimiting
[  140.099079] 8021q: adding VLAN 0 to HW filter on device eth0
[  140.164754] br-lan: port 1(eth0) entered blocking state
[  140.175273] br-lan: port 1(eth0) entered disabled state
[  140.186130] device eth0 entered promiscuous mode
[  140.334171] br-lan: port 1(eth0) entered blocking state
[  140.344649] br-lan: port 1(eth0) entered forwarding state
[  141.124023] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[  171.206543] urngd: v1.0.2 started.



BusyBox v1.36.1 (2024-03-22 22:09:42 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 23.05.3, r23809-234f1a2efa
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

My initial plan was to do a sysupgrade from here but now i'm concerned that if the sysupgrade image for this device (openwrt-23.05.3-ramips-mt7620-tplink_re200-v1-squashfs-sysupgrade.bin) doesn't include a bootloader (as far as i know) and the original bootloader gets overwritten by the sysupgrade the device could be completely dead...

So what would be the correct steps to proceed from here and get OpenWRT working on this device? Any hints in the right direction would be highly appreciated.

It is written all over wiki page in which context you need to add factory bootloader to openwrt image and in which cases you need to remove it from factory image and how.
It takes >10min to flash OpenWRT 23.05.3.

@cboone,
V1.1 is not listed, can you do a free -h and a df -h in the ssh shell?
V1.1 is not listed here:

Can you confirm the version please

Thanks for the reply! Yes the device is Version V1.1, at least according to the sticker on the back of the device. I have flashed the stock firmware for Version V1 on the device before and it works without problems, so i suspect the devices are very similar, if not identical, hardware-vise.

Output of free -h and df -h:

root@OpenWrt:/# free -h
              total        used        free      shared  buff/cache   available
Mem:          57292       15020       24420       16652       17852       12732
Swap:             0           0           0

root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
tmpfs                    28.0M     16.2M     11.8M  58% /
tmpfs                    28.0M     60.0K     27.9M   0% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev