I may have asked too many questions together, so I'll pick on just 1 now. I'm about to connect to the UART on my ER605. I wanted to clarify before I commit to soldering.
The Wiki mentions:
Attention Beside soldering a header, the to small connections labeled R2 and R5 below the TX and RX holes need to be connected.
This is also mentioned in this post that R2 and R5 need to be shorted.
I looked closely and I can see there is already a track from each of these to R2 and R5. I have also tested with a multimeter and verified connection.
Here is a close-up where I've also drawn arrows from R2 and R5 to where I think is meant as well as circling the TX and RX sockets and the link where they are current connected to R2 and R5.
Or does it mean that I need to solder a small wire to bridge the connections as drawn in red in this picture:
You need to bridge the two pads as shown in your second picture in red.
Got it, thanks, will do.
Continuing the discussion from Looking for info and possibility of (future) support of TP-Link Omada er605 Router:
I see that the ER605 has success, I currently have both a ER8411 and ER707-M2 which I can SSL into and DEBUG gets me rooted in BusyBox\OpenWRT
I've played around with the 8411, Powering up holding reset and don't see any TFTP activity (nothing in wireshark) Not sure if the USB would load a initramfs?
Interesting fact, you can use the console port on the 8411 for ENABLE fine, DEBUG and the MAC+pass MD5 trick works, but once in DEBUG you can't type. You receive the OpenWRT banner and displays ""/bin/ash: can't access tty; job control turned off""
I don't think their kernel supports RS232 for DEBUG, but enabling remote support and SSL work.
I'm apprehensive to load the ER605 image in it without a bit more guidance... Not sure if the processor is the same? I see mention of it being a Octeon TX2?
Should I try the Generic Octeon image and what's the safest way to load?
Any thoughts or Interests?
Kind Regards,
Mike
Hello!
I have a TP-Link Omada ER605 which I bought for company use, and it ended up not working for our scenario. I'd like to test OpenWRT on it, and I can volunteer to try out and test different things.
I'll try to flash it tonight, but I'd like instructions on how to revert to factory default, should we need to RMA this router.
Hi phrfpeixoto,
Were you able to flash OpenWRT on the ER605 v2 and revert it back to stock firmware? I'd love some input on that subject too.
I was able to perform a full MTD Backup and flash OpenWRT following chill1Penguin's amazing git, but I still cannot revert back to original firmware.
If anyone on this thread was able to roll back I would appreciate some guidance.
Thanks in advance!
Hello!
I did flash it, but honestly, I haven't had the time to deploy it as my main router just yet.
As such, I didn't see the need to try and revert it, but I did keep the backup just in case. The oddity for me is that the default process for taking the backup was not really working for me. I had to get creative to access the binary files.
I had a similar experience. If you don't mind, may I ask you some questions about your backup?
Does your MTD3 look "healthy" inspecting it on a hex viewer? I suspect mine is corrupt.
For reference, my MTD3 filesize is 130.809.856 bytes long for V2.0.1 firmware, I believe that doesn't go along with what other users have reported previously..
If checking this is cumbersome for you please feel free to disregard this message.
Thanks for your time!
Hi @Gam_e_oveR I'm curious about why do you want to come back to stock firmware.
Is there any function not working fine in OpenWRT?
Thanks,
I honestly don't recall how I did it.
As far as I can remember the backup procedure was generating 0-byte files, I had to generate each backup file manually, and compress them together as per the backup script logic.
I can send you my backup, if it helps...
Hi Klingon
Not at all, OpenWRT runs circles around the original firmware, but this unit has to come back to stock after I'm done with it, as not everyone that will be using it is familiar with the OpenWRT interface. Also, it's been a really interesting experience trying to "go back", so it's a learning exercise in itself I guess.
My main problem right now is my MTD3 backup seems to be larger than my available cache on initramfs, so re-flashing operations via ubiformat fail to fetch the full file when using:
wget -O- http://[url to mtd3.img on a local http server] | ubiformat /dev/mtd3 -S [size of the image in bytes] -y -f -
So i don't know if this is expected, or I have a corrupt backup. Did you encounter some of this issues yourself? I completely understand reverting to stock firmware is not usually the point here, if my messages are out of place please fell free to say so.
Thanks!
Hi phrfpeixoto,
That would be really helpful. I only need the MTD3 (firmware) file to compare it to mine. As far as I know there's no unit-specific info in there (serials or mac addresses). If you're comfortable providing it maybe I can give it a try!
$ stat mtd3_firmware.backup
16777234 56695497 -rwxrwxrwx 1 peixoto staff 0 130809856 "Nov 6 14:17:55 2024" "Jan 1 04:13:26 2018" "Nov 6 14:17:55 2024" "Jan 1 04:13:26 2018" 4096 255488 0 mtd3_firmware.backup
I'll send you a link in a private message.
EDIT: There's not private message feature available. How do you want the link?
I see your backup is exactly the same size as mine, that's super helpful already.
If there's no PM feature then I don't want to make you expose any links openly, I'll move forward assuming my backup is correct based on the info you provided.
Thanks a lot!
You should be able to write private messages from https://forum.openwrt.org/u/phrfpeixoto/messages
Finally, I was successful in going back to stock firmware.
As others have mentioned, the only way I could go back was using the UART and the MTD3 backup saved using @chill1Penguin script before migrating to OpenWRT on this unit. I'll post a super basic but detailed step by step for anyone interested in returning to stock firmware via UART using Windows tools.
Before starting, you'll need some things:
- Physically connect ER605 UART interface
- Connect a cheap USB to TTL to the ER605 UART interface
- Install a serial terminal and connect at 115200 baud
- Install a TFTP server and host your MTD3 backup there
If this setup is trivial to you ignore the following 1-4 instructions, if not continue reading:
///////////////////////////////////////////DETAILS/////////////////////////////////////////////////////
- Open the unit and solder a jumper over R2 and R5 pads, as @r5e mentioned in this post:
- Connect a USB to TTL adapter to your PC and install it's drivers (cheap ones from Amazon will do, mine uses CH341A chipset). It'll show up as a COM port (in this case COM3).
Locate header J1 on the ER605's PCB, and using the previous picture as guide (counting from RIGHT to LEFT as shown in the picture) connect pad 1 to RXD, pad 2 to TXD and pad 3 to GND on the USB to TTL adapter. Leave pad 4 (leftmost in the quoted picture) disconnected.
- Install Teraterm on your PC and run it.
New connection > Serial > Port: COM3 (make sure to select the correct COM port you just installed). Click "OK"
Go to Setup > Serial port... and change Speed to 115200. Click "New Setting"
You are ready to use ER605's UART, but before powering on the unit we need to set up a TFTP server to send our MTD3 backup to the unit
- Download Open TFTP Server and install it on your PC.
Connect LAN5 on the ER605 to your ethernet adapter, and change your IP address to 192.168.0.146
Copy your MTD3 backup to Open TFTP Server's root directory (in this case i named it mtd3.img) and run RunStandAloneMT.bat
///////////////////////////////////////////DETAILS/////////////////////////////////////////////////////
Go to Teraterm session and power up the ER605. Wait until you see U-Boot's boot selection menu:
*** U-Boot Boot Menu ***
1. Startup system (Default)
2. Upgrade firmware
3. Upgrade bootloader
4. Upgrade bootloader (advanced mode)
5. Load image
0. U-Boot console
Press UP/DOWN to move, ENTER to select
Select option 2. Upgrade Firmware (Alternatively you can boot to U-Boot console > run enphy > mtkupgrade fw)
Follow the on screen instructions, in my case:
*** Upgrading Firmware ***
Available load methods:
0 - TFTP client (Default)
1 - Xmodem
2 - Ymodem
3 - Kermit
4 - S-Record
Select (enter for default): 0
Input U-Boot's IP address: 192.168.0.10
Input TFTP server's IP address: 192.168.0.146
Input IP netmask: 255.255.255.0
Input file name: mtd3.img
Hit enter and you'll start to download your MTD3 backup to RAM (specifically to 0x80010000 address). The screen will show #### during the transfer, do not interrupt the process. After it finishes it sholud show:
done
Bytes transferred = 130809856 (7cc0000 hex)
*** Loaded 130809856 (0x7cc0000) bytes at 0x80010000 ***
*** Flash erasure [140000-7dfffff] failed! ***
As you see, in my case the Flash memory erasing and writing that should occur after this fails for no aparent reason, so we'll continue manually.
run the command mtdparts and take note of the size and offset for the firmware partition:
=> mtdparts
device nand0 <nand0>, # parts = 5
#: name size offset mask_flags
0: u-boot 0x00080000 0x00000000 0
1: u-boot-env 0x00080000 0x00080000 0
2: factory 0x00040000 0x00100000 0
3: firmware 0x07cc0000 0x00140000 0
4: panic-oops 0x00200000 0x07e00000 0
active partition: nand0,0 - (u-boot) 0x00080000 @ 0x00000000
defaults:
mtdids : nand0=nand0
mtdparts: mtdparts=nand0:512k(u-boot),512k(u-boot-env),256k(factory),127744k(firmware),2048k(panic-oops)
From this we get that the starting address for the firmware partition on the NAND Flash is 0x00140000, and is (as expected) 0x07cc0000 bytes long.
To erase the flash run the command nand erase (offset - size):
nand erase 0x00140000 0x07cc0000
Finally, to write our MTD3 backup from RAM to Flash we'll use the command nand write (RAM start address - offset - size):
nand write 0x80010000 0x00140000 0x07cc0000
This process will take some minutes, do not interrupt it. You may get the occasional "skipping bad block at 0x########". This is expected, just wait until operation finishes.
Restart your router and you should boot original firmware.
Just to be sure, after I had access to the TP-Link GUI I reflashed the firmware going to:
System tools > Management > Firmware Upgrade
Browse to original firmware version > Upgrade
Thanks to @chill1Penguin @r5e @phrfpeixoto and everyone who offered some help on this topic!
This is brilliant @Gam_e_oveR and your clear listing of the steps and proof that it is possible should give those who have not done this before the confidence to have go.
A shame soldering pins to the board and serial access is still the only way, but for now at least it's proven.
Is there a way to do this with linux ?
Hi @micky1067
Absolutely, you could use this guide as a reference for setting up the TFTP server, and use something like screen for the serial console (or any other that you're familiar with)
sudo screen /dev/(YouSerialDevice) 115200
I like to make a backup first. I have a connection with my serial console. I become a problem with ssh. The Error all the time exited: No matching algo hostkey