Porting Firmware to TP-Link Archer C20 v5

Then my understanding seems to be correct. I intended to use these commands at the bootloader stage.

The story is that "tpl" does not interrupt the bootup. So the TTL Serial communication interface is suspected. But I later found out that it responded after the linux booted up. Does this mean that the Serial interface is setup correctly?

continue to starting system.                                                  0

Or this count down at the bootloader stage is too quick for any input?

Never mind my last reply. It seems working now.

After I transferred and ran the initramfs.bin, this came up.

MT7628 # bootm 0x80060000
do_bootm:argc=2, addr=0x80060000
## Booting image at 80060000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04010C0E][04010D09]
DDR Calibration DQS reg = 00008987

Is there any wrong when I am compiling this image file? Same error happens when I am loading it with the official bin file.

edit: I found an initramfs for the v4 "openwrt-ramips-mt76x8-tplink_c20-v4-initramfs-kernel.bin" and still the same error.

It's usually a fairly narrow window during which you can interrupt the bootloader (in the general range of one second).

try

bootz

so the correct uboot break sequence for the device is?

I just typed "4"

switch BootType:

4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Dec 13 2018 - 09:07:16)
MT7628 #

bootz is not recognized.

MT7628 # help
?       - alias for 'help'
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
erase   - erase SPI FLASH memory
go      - start application at address 'addr'
help    - print online help
start www server for firmware recovery
loadb   - load binary file over serial line (kermit mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
nm      - memory modify (constant address)
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
rf      - read/write rf register
saveenv - save environment variables to persistent storage
setenv  - set environment variables
spi     - spi command
tftpboot- boot image via network using TFTP protocol
version - print monitor version
MT7628 #

I tried "tftpboot", but it seems that it only did what "tftp" does, loading the file to an address and then stopped there.

Does it have anything to do with the options when I config the .bin with "make menuconfig"?

1 Like

Could be simalar issue

1 Like

Thanks for the replay.

I checked all the .bin I have with me and all seems to be V2 header?
Capture

I will try to compile again with a similar line in your link:

KERNEL_INITRAMFS := kernel-bin | patch-cmdline | lzma | tplink-v3-header
define Device/tplink_c20-v4
  $(Device/tplink)
  DTS := ArcherC20v4
  IMAGE_SIZE := 7808k
  DEVICE_TITLE := TP-Link ArcherC20 v4
  TPLINK_FLASHLAYOUT := 8Mmtk
  TPLINK_HWID := 0xc200004
  TPLINK_HWREV := 0x1
  TPLINK_HWREVADD := 0x4
  TPLINK_HVERSION := 3
  DEVICE_PACKAGES := kmod-mt76x0e
endef
TARGET_DEVICES += tplink_c20-v4

The codes already in the file is like this.

I am adding one more section to it:

define Device/tplink_c20-v5
  $(Device/tplink)
  DTS := ArcherC20v4
  IMAGE_SIZE := 7808k
  DEVICE_TITLE := TP-Link ArcherC20 v5
  TPLINK_FLASHLAYOUT := 8Mmtk
  TPLINK_HWID := 0xc200005
  TPLINK_HWREV := 0x1
  TPLINK_HWREVADD := 0x5
  TPLINK_HVERSION := 3
  KERNEL := kernel-bin | patch-cmdline | lzma
  KERNEL_INITRAMFS := kernel-bin | patch-cmdline | lzma | tplink-v3-header
  DEVICE_PACKAGES := kmod-mt76x0e
endef
TARGET_DEVICES += tplink_c20-v5

But this gives an error at compile.

Makefile:165: *** Missing Build/tplink-v3-header.  Stop.

Any one know where I can get this compiled?

Linux (at address 8000c150) ... ( < loaded into 8000000 )

aka

MT7628 # bootm 0x80060000 < = too high for uboot?

http://hobby.sli.pl/router/mr200v2-router.txt
https://wikidevi.com/wiki/TP-LINK_Archer_MR200
https://openwrt.org/toh/tp-link/archer-mr200

https://www.google.com.au/search?q="Transferring+control+to+Linux+(at+address+8000c150)+..."&oq="Transferring+control+to+Linux+(at+address+8000c150)+..."

that does not help.

seems like a bin file issue to me. maybe the uboot of this v5 will do some sort of checking preventing this kind of files to bootup? the previously mentioned v3-header issue seems a good way to start, but I cannot find this v3-header support at compiling the binary.

from this page, it seems it is using v3 header.
https://github.com/xdarklight/mktplinkfw3

but the header part of my own bin is also 0x03000000?

please compare the Kernel Entry Point in the Original Header with the values inside the Openwrt Image Header. I have to set this values manual at a Archer D7 V1.

Example for Archer D7 ( using the same header )

IMAGE/sysupgrade.bin := tplink-v2-image -s -a 0x400 -L 0x80060000 -E 0x80060000 | \
        append-metadata | check-size $$$$(IMAGE_SIZE)

In the original firmware
Kernal load add : 0x80000000
Kernal entry point: 0x80001C50

the file i compiled
Kernal load add : 0x80000000
Kernal entry point: 0x80000000

Do I need to manually edit this value and not changing anything else in the bin file?

you use in the device description
TPLINK_FLASHLAYOUT := 8Mmtk

inside the mktplinkfw2.c this layout is defined as

static struct flash_layout layouts[] = {
....
{
		.id		= "8Mmtk",
		.fw_max_len	= 0x7a0000,
		.kernel_la	= 0x80000000,
		.kernel_ep	= 0x80000000,
		.rootfs_ofs	= 0x140000,
	},

you have to create a new profile with a kernel_ep = 0x80001C50
inside this structure

and verifiy inside the kernel uImage what kernel entry point is really used, then use this entry point in the new profile

Thanks for the instruction.

But how exactly do I

and verifiy inside the kernel uImage what kernel entry point is really used,

Where do I find this uImage and what to look for to find out the entry point?

The kernel uimage is at the same directory your own build image is located, somthing like bin/target/...

e.g. at my Archer-D7

bin/targets/ar71xx/generic/openwrt-ar71xx-generic-uImage-lzma.bin

at my build system ( Debian 9 ) the "file" command is enough to get the information

file bin/targets/ar71xx/generic/openwrt-ar71xx-generic-uImage-lzma.bin
Output:
bin/targets/ar71xx/generic/openwrt-ar71xx-generic-uImage-lzma.bin: u-boot legacy uImage, MIPS OpenWrt Linux-4.9.170, Linux/MIPS, OS Kernel Image (lzma), 1401519 bytes, Wed Apr 24 08:47:44 2019, Load Address: 0x80060000, Entry Point: 0x80060000, Header CRC: 0xD54A2755, Data CRC: 0xD73AA0A5

Mine is only generating an initramfs-kernal.bin. How do I specifically generate a uImage type of binary? I cannot seem to find any options for it in menuconfig.

Strange thing. Other way: Build with "make V=s" and have a look at the kernel build task. At the end the kernel loading and entry address will also shown

ls -l build_dir/target-*/linux-*/ | grep '^-' | grep -v dtb
for f in $(find build_dir/target-*/linux-*/ -maxdepth 1 -type f | grep -v dtb); do
	echo ""; echo "################$f"; echo ""; file $f; echo ""; echo ""
done

Use mkimage to add headers if you want them.

they are all vmlinux from that dtb line.

I chose ramdisk in target image of menuconfig, any other options i need to check for this uimage? is it needed for booting up the ramdisk image?

i am kind of confused here. if the device does not boot from these images i compiled, does it imply anything?

and what is the target here by booting up this ramdisk? so that i can get more information about this device and build a final version to write it to flash?

either

a)
a ramdisk is loaded from usb / tftp
a kernel+.rd is loaded from tftp / usb

or

b)
an image is written to your flash in full or in parts, that is almost if not more difficult than (a) and is 97% odds on to brick your device.... and if it doesn't you'll likely need it to fix your device.... unless your a kermit master....... even still your back at (b)

more info? not always.... often an oem bootlog and shell access is enough to get info. but it won't help you when things go wrong.

try squashfs + tar.gz as well. ( then make > check for uImage.bin in bin/targ......... )