Porting Firmware to TP-Link Archer C20 v5

In the original firmware
Kernal load add : 0x80000000
Kernal entry point: 0x80001C50

the file i compiled
Kernal load add : 0x80000000
Kernal entry point: 0x80000000

Do I need to manually edit this value and not changing anything else in the bin file?

you use in the device description
TPLINK_FLASHLAYOUT := 8Mmtk

inside the mktplinkfw2.c this layout is defined as

static struct flash_layout layouts[] = {
....
{
		.id		= "8Mmtk",
		.fw_max_len	= 0x7a0000,
		.kernel_la	= 0x80000000,
		.kernel_ep	= 0x80000000,
		.rootfs_ofs	= 0x140000,
	},

you have to create a new profile with a kernel_ep = 0x80001C50
inside this structure

and verifiy inside the kernel uImage what kernel entry point is really used, then use this entry point in the new profile

Thanks for the instruction.

But how exactly do I

and verifiy inside the kernel uImage what kernel entry point is really used,

Where do I find this uImage and what to look for to find out the entry point?

The kernel uimage is at the same directory your own build image is located, somthing like bin/target/...

e.g. at my Archer-D7

bin/targets/ar71xx/generic/openwrt-ar71xx-generic-uImage-lzma.bin

at my build system ( Debian 9 ) the "file" command is enough to get the information

file bin/targets/ar71xx/generic/openwrt-ar71xx-generic-uImage-lzma.bin
Output:
bin/targets/ar71xx/generic/openwrt-ar71xx-generic-uImage-lzma.bin: u-boot legacy uImage, MIPS OpenWrt Linux-4.9.170, Linux/MIPS, OS Kernel Image (lzma), 1401519 bytes, Wed Apr 24 08:47:44 2019, Load Address: 0x80060000, Entry Point: 0x80060000, Header CRC: 0xD54A2755, Data CRC: 0xD73AA0A5

Mine is only generating an initramfs-kernal.bin. How do I specifically generate a uImage type of binary? I cannot seem to find any options for it in menuconfig.

Strange thing. Other way: Build with "make V=s" and have a look at the kernel build task. At the end the kernel loading and entry address will also shown

ls -l build_dir/target-*/linux-*/ | grep '^-' | grep -v dtb
for f in $(find build_dir/target-*/linux-*/ -maxdepth 1 -type f | grep -v dtb); do
	echo ""; echo "################$f"; echo ""; file $f; echo ""; echo ""
done

Use mkimage to add headers if you want them.

they are all vmlinux from that dtb line.

I chose ramdisk in target image of menuconfig, any other options i need to check for this uimage? is it needed for booting up the ramdisk image?

i am kind of confused here. if the device does not boot from these images i compiled, does it imply anything?

and what is the target here by booting up this ramdisk? so that i can get more information about this device and build a final version to write it to flash?

either

a)
a ramdisk is loaded from usb / tftp
a kernel+.rd is loaded from tftp / usb

or

b)
an image is written to your flash in full or in parts, that is almost if not more difficult than (a) and is 97% odds on to brick your device.... and if it doesn't you'll likely need it to fix your device.... unless your a kermit master....... even still your back at (b)

more info? not always.... often an oem bootlog and shell access is enough to get info. but it won't help you when things go wrong.

try squashfs + tar.gz as well. ( then make > check for uImage.bin in bin/targ......... )

So it means that I should be exploring the correct settings and options I should use in the finalize image through booting up this ramdisk and checking all the functionalities.

U-Boot 1.1.3 (Dec 13 2018 - 09:07:16)
MT7628 # tftp 0x80000000 ref-lzma-e.bin

 netboot_common, argc= 3

 NetTxPacket = 0x83FE4480

 KSEG1ADDR(NetTxPacket) = 0xA3FE4480

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
TFTP from server 192.168.0.225; our IP address is 192.168.0.2
Filename 'ref-lzma-e.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80000000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (60:a4:4c:4f:a0:5e)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################checksum bad
################################################
         #################################################################
         #################################################################
         ##########################################checksum bad
#######################
         #################################################################
         #################################################################
         ###################################################
done
Bytes transferred = 3585061 (36b425 hex)
NetBootFileXferSize= 0036b425
MT7628 # bootm 0x80000000
do_bootm:argc=2, addr=0x80000000
## Booting image at 80000000 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

I get one uncompressed, but it stuck at starting kernal. onyl the lan led corresponding to the tftp server is flashing.

1 Like

NIce! It progress! What was the fix?

Did you try again ( tftp to 0x8000000 ) but with;

bootm 0x80001C50

?

Next time you build.

make ....... | grep mkimage > mkimage.log

You can run that manually....

Well try and get the offset in the header properly.

I have been tweaking with the .mk file inside the image folder.

KERNEL_INITRAMFS := $(KERNEL_DTB) | lzma | tplink-v2-header -e

wit this line, i can get the device to uncompress, but it stuck at "starting kernal" forever.

There is nothing came out to the mkimage log file.
And I searched the /target/linux/ramips/image/Makefile, there is nothing mentioning mkimage inside.

Is there anything wrong with the source codes I have? I used

git clone https://git.openwrt.org/openwrt/openwrt.git

to get the whole folder.

I did some search around and found that there is a dts file for every device profile. It should be related to the dtb inside a kernal and the to the partitioning of the device.

I don't currently have a dts for this device. Does it matter for the initramfs image I am building? How am I gonna write a new dts for this device?

somewhere in the full output you'll see the command used..... try grep 800000

make V=s

the dts is in Makefile ( or thereabouts - cat target/linux/ramips/dts/ ) for whatever device you've been basing your build on. That is kind of the point of the initramfs.

Find a similar device. Boot it's initramfs to test and modify the dts.

What device have you been selecting?

Good call on the output hang.... took me a while when I hit that!

Try changing this to ttyS1
cat target/linux/ramips/dts/ArcherC20v4.dts | grep tty
cat target/linux/ramips/dts/TPLINK-8M.dtsi | grep tty

I'm not sure yet which one your using...

I have been using the dts from the v4. What if the dts does not match with the v5? Will it cause a similar error, not booting up the kernal?

There is also another possible cause for my symptom. The image I built does not have a serial output configured, so after leaving the uboot, no more message received.

1 Like

https://openwrt.org/docs/guide-developer/adding_new_device

is this page a good guide to follow for my case here?

Has anyone already solved the problem with MT7610e driver? - It still has only very weak transmit power in new images on diffrent devices. - I found a lot of solutions, but noone implemented it into kmod-mt76x0e or kmod-mt76 packages...

If you do a make kernel_menuconfig.... enable ATAG from command line and command line mangle. ( search the forum for more pointers - may need to remove chosen line from DTS ).... You can specify in uboot different serial options quickly to test. The "addtty" bootparameter may come in handy too.

Pretty sure so long as the dts ( or bootcmd if you've enabled that ) is setup with the right tty... you should not have to mess too much with the build system internals.... with the exception of alternate chipset. And in that case there might be deeper dts mods needed re: mdio/gpio settings etc.

So you have to check the OEM bootlog / ToH / wikidev / board itself to look for hints about the actual chips you board has.... i think there would be pointers already in this thread about that. You can also just try hooking into the webgui... this would be another way to verify that it is the console only with no output.... did you try that?

Is there any progress ? I like to build an working img for the V5..