Porting Firmware to TP-Link Archer C20 v5

jtommasi72 · January 27, 2020, 2:51pm

C20W-v5 (the W model is for WISPs) has a similar partition table than C20-v4 (see text below extracted from serial console when device is booting)

Creating 7 MTD partitions on "raspi":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x000000180000 : "kernel"
0x000000180000-0x0000007c0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
0x0000007c0000-0x0000007d0000 : "config"
0x0000007d0000-0x0000007e0000 : "romfile"
0x0000007e0000-0x0000007f0000 : "ispconfig"
0x0000007f0000-0x000000800000 : "radio"

I tried the tp_recovery.bin from C20-v4 by tftp method and it worked !! So C20W-v5 and C20-v4 are compatible.

ptlink · January 31, 2020, 6:23pm

My experience with C20 v5:

TFTP flash worked, with this tp_recovery.bin: https://github.com/Linaro1985/openwrt/releases/download/191121/TPLinkArcherC20V5.zip
"sysupgrade" images from https://github.com/Linaro1985/openwrt/releases/download/191219/openwrt-ramips-mt76x8-tplink_archer-c20-v5-squashfs-sysupgrade.bin.zip cannot be flashed, you will get an error "The uploaded image file does not contain a supported format. Make sure that you choose the generic image format for your platform."
Following this comment: https://github.com/openwrt/openwrt/pull/2623

Download a TP-Link image from their Website and a OpenWRT sysupgrade
image for the device and build yourself a factory image like following:

TP-Link image: tpl.bin
OpenWRT sysupgrade image: owrt.bin

    dd if=tpl.bin of=boot.bin bs=131584 count=1
    cat owrt.bin >> boot.bin

I made an image that I was able to flash from Openwrt, but that resulted in bootlop:

## Booting image at bc050000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover

ptlink · February 1, 2020, 12:36pm

I found the merge request and it contains slightly different instructions:
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=86e7353bff2a5de257de8ec62e782f016eed143c

dd if=/dev/zero of=tp_recovery.bin bs=196608 count=1
dd if=tpl.bin of=tmp.bin bs=131584 count=1
dd if=tmp.bin of=boot.bin bs=512 skip=1
cat boot.bin >> tp_recovery.bin
cat owrt.bin >> tp_recovery.bin

Using this way I compiled sysupgrade firmware from Openwrt repo, created the recovery firmware from it, flashed using TFTP, and now I'm able to update through the Luci. All good!

Fusseldieb · February 17, 2020, 5:39pm

Using the instructions in this link I successfully "made"/trimmed the firmware and it booted OpenWRT just fine. Everything seems to work.

Create Factory image

As all installation methods require a U-Boot to be integrated into the
Image (and we do not ship one with the image) we are not able to create
an image in the OpenWRT build-process.

Download a TP-Link image from their Website and a OpenWRT sysupgrade
image for the device and build yourself a factory image like following:

TP-Link image: tpl.bin
OpenWRT sysupgrade image: owrt.bin

dd if=tpl.bin of=boot.bin bs=131584 count=1
cat owrt.bin >> boot.bin

Installing via Web-UI

Upload the boot.bin via TP-Links firmware upgrade tool in the
web-interface.

TinBoyko · February 24, 2020, 4:36pm

Hi all! I bricked my router with wrong firmware via tftp, no reaction on power on. Seems bootloader was overwritten. Does anybody have a dump for ch341a programmer?

David.S.Mckellen · March 4, 2020, 11:49am

Hi there
I made factory image for my Archer C20 V5 US and everything is okay
just upload tp_recovery.bin via TFTP and blah blah blah
I also took a screenshot and upload it with files
here you are

David.S.Mckellen · March 4, 2020, 1:05pm

Hi Linaro
what about Stable Release builds 19.07.1 instead Snapshot builds for Archer C20 V5?!when does it release?
thanks

Linaro · March 5, 2020, 10:12am

Hi. I think when from the master branch will begin to make the next release or somebody make backport to 19.07 branch.

Archer C20 v5 cannot be fully bricked up due to a factory bootloader (there two bootloaders on the device) that never overwrites.

David.S.Mckellen · March 6, 2020, 5:22am

Thank you brother

cosmowave · March 7, 2020, 5:08am

Hey, did the v5 support 5Ghz? I see v4 doesn't support it.

David.S.Mckellen · March 7, 2020, 6:10am

Hi
Yes it is and works flawlessly, but I'm waiting for stable version 19.07.1 at first I upgraded to SNAPSHOT and it took spaces but it was okay

David.S.Mckellen · March 7, 2020, 6:34am

Because files at number 1 are for 18.06.5 and sysupgrade image at number 2 is for SNAPSHOT and you can't upload it

David.S.Mckellen · March 7, 2020, 8:22am

TP-Link Archer C20 V5 (US) Stripped Firmware for friends who would revert to TP-Link from OpenWRT

Here you are

JorgeMFerreira · March 7, 2020, 10:22am

Hello
The OpenWRT boots and i can install (opkg) the luci interface and so... can program everything but i reboot the router it looses all configuration and revert back to OpenWRT defaults - even the packages are lost.

From fresh TFTP install:

dmesg shows this line about the flash file partition error:

root@OpenWrt:~# dmesg 
[    0.000000] Linux version 4.14.171 (builder@buildhost) (gcc version 8.3.0 (OpenWrt GCC 8.3.0 r12386-1c880f2324)) #0 Sat Feb 29 13:14:08 2020
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is TP-Link Archer C20 v5
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000] free_area_init_node: node 0, pgdat 80528ff0, node_mem_map 81000040
[    0.000000]   Normal zone: 144 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] random: get_random_bytes called from start_kernel+0x98/0x4a8 with crng_init=0
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0007dbef
[    0.000000] Readback ErrCtl register=0007dbef
[    0.000000] Memory: 58044K/65536K available (4145K kernel code, 199K rwdata, 944K rodata, 1232K init, 212K bss, 7492K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 580MHz
[    0.000000] timer_probe: no matching timers found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.007549] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.073497] pid_max: default: 32768 minimum: 301
[    0.078201] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.084552] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.097424] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.106927] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.112914] pinctrl core: initialized pinctrl subsystem
[    0.120676] NET: Registered protocol family 16
[    0.233374] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
[    0.388657] PCI host bridge /pcie@10140000 ranges:
[    0.393240]  MEM 0x0000000020000000..0x000000002fffffff
[    0.398258]   IO 0x0000000010160000..0x000000001016ffff
[    0.421355] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.426993] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.432515] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.438831] PCI host bridge to bus 0000:00
[    0.442740] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.449420] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.455077] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.461642] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.469313] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400
[    0.469353] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    0.469368] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    0.469443] pci 0000:00:00.0: supports D1
[    0.469453] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.469706] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    0.477611] pci 0000:01:00.0: [14c3:7650] type 00 class 0x028000
[    0.477665] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff]
[    0.477812] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.478048] pci 0000:01:00.1: [14c3:8650] type 00 class 0x0d1100
[    0.478093] pci 0000:01:00.1: reg 0x10: [mem 0x00000000-0x000fffff]
[    0.478226] pci 0000:01:00.1: supports D1
[    0.478236] pci 0000:01:00.1: PME# supported from D0 D1 D3hot D3cold
[    0.478424] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    0.478441] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    0.478490] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.484819] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.491594] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[    0.498093] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.504669] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
[    0.511200] pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
[    0.517767] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.522538] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff]
[    0.534515] clocksource: Switched to clocksource MIPS
[    0.540557] NET: Registered protocol family 2
[    0.545714] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.552402] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.558596] TCP: Hash tables configured (established 1024 bind 1024)
[    0.564855] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.570454] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.576835] NET: Registered protocol family 1
[    0.581055] PCI: CLS 0 bytes, default 32
[    0.584739] Crashlog allocated RAM at address 0x3f00000
[    0.591486] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.604282] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.609914] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.631957] io scheduler noop registered
[    0.635749] io scheduler deadline registered (default)
[    0.641529] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.650311] console [ttyS0] disabled
[    0.653749] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[    0.662530] console [ttyS0] enabled
[    0.669526] bootconsole [early0] disabled
[    0.678972] spi-mt7621 10000b00.spi: sys_freq: 193333333
[    0.701288] m25p80 spi0.0: s25fl064k (8192 Kbytes)
[    0.706256] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.712694] Creating 7 MTD partitions on "spi0.0":
[    0.717579] 0x000000000000-0x000000030000 : "factory-uboot"
[    0.724167] 0x000000030000-0x000000050000 : "boot"
[    0.729912] 0x000000050000-0x0000007c0000 : "firmware"
[    0.738762] 2 tplink-fw partitions found on MTD device firmware
[    0.744838] Creating 2 MTD partitions on "firmware":
[    0.749884] 0x000000000000-0x0000001ae85a : "kernel"
[    0.755819] 0x0000001ae85c-0x000000770000 : "rootfs"
[    0.761592] mtd: device 4 (rootfs) set to be root filesystem
[    0.769038] 1 squashfs-split partitions found on MTD device rootfs
[    0.775369] Creating 1 MTD partitions on "rootfs":
[    0.780238] 0x0000002117a4-0x0000005c17a4 : "rootfs_data"
[    0.786630] 0x0000007c0000-0x0000007d0000 : "config"
[    0.792471] 0x0000007d0000-0x0000007e0000 : "rom"
[    0.798143] 0x0000007e0000-0x0000007f0000 : "romfile"
[    0.804066] 0x0000007f0000-0x000000800000 : "radio"
[    0.810555] libphy: Fixed MDIO Bus: probed
[    0.828801] rt3050-esw 10110000.esw: link changed 0x00
[    0.835662] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    0.845693] NET: Registered protocol family 10
[    0.854462] Segment Routing with IPv6
[    0.858364] NET: Registered protocol family 17
[    0.862941] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    0.876107] 8021q: 802.1Q VLAN Support v1.8
[    0.890398] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    0.904327] Freeing unused kernel memory: 1232K
[    0.908961] This architecture does not have kernel memory protection.
[    1.871100] init: Console is alive
[    1.874909] init: - watchdog -
[    2.300899] random: fast init done
[    2.898497] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.070862] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.088809] init: - preinit -
[    4.594054] rt3050-esw 10110000.esw: link changed 0x00
[    4.769932] random: procd: uninitialized urandom read (4 bytes read)
[    7.557738] rt3050-esw 10110000.esw: link changed 0x02
[    8.926532] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    8.966171] urandom-seed: Seed file not found (/etc/urandom.seed)
[    9.082995] procd: - early -
[    9.086921] procd: - watchdog -
[    9.695690] procd: - watchdog -
[    9.699253] procd: - ubus -
[    9.792721] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.872026] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.879074] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.886527] procd: - init -
[   10.663934] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.717659] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   10.743024] Loading modules backported from Linux version v5.4-rc8-0-gaf42d3466bdc
[   10.750777] Backport generated by backports.git v5.4-rc8-1-0-g368e8c51
[   10.777385] ip_tables: (C) 2000-2006 Netfilter Core Team
[   10.803597] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[   10.933475] xt_time: kernel timezone is -0000
[   11.063748] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[   11.181858] urngd: v1.0.2 started.
[   11.393239] random: crng init done
[   11.396722] random: 6 urandom warning(s) missed due to ratelimiting
[   12.106830] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[   12.112849] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[   12.154528] mt76_wmac 10300000.wmac: firmware init done
[   12.327695] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   12.447544] PPP generic driver version 2.4.2
[   12.465541] NET: Registered protocol family 24
[   12.475341] mt76x0e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[   12.481825] mt76x0e 0000:01:00.0: ASIC revision: 76100002
[   12.747872] mt76x0e 0000:01:00.0: Firmware Version: 0.1.00
[   12.995557] mt76x0e 0000:01:00.0: EEPROM ver:02 fae:00
[   13.004410] ieee80211 phy1: Selected rate control algorithm 'minstrel_ht'
[   13.036867] kmodloader: done loading kernel modules from /etc/modules.d/*
[   26.831715] rt3050-esw 10110000.esw: link changed 0x00
[   28.735733] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   28.742729] jffs2_build_filesystem(): unlocking the mtd device... 
[   28.752393] done.
[   28.760687] jffs2_build_filesystem(): erasing all blocks after the end marker... 
**[   28.760726] jffs2: Erase at 0x003a0000 failed immediately: errno -22**
[   29.808745] rt3050-esw 10110000.esw: link changed 0x02
[   32.529223] br-lan: port 1(eth0.1) entered blocking state
[   32.534959] br-lan: port 1(eth0.1) entered disabled state
[   32.540779] device eth0.1 entered promiscuous mode
[   32.545701] device eth0 entered promiscuous mode
[   32.596350] br-lan: port 1(eth0.1) entered blocking state
[   32.601842] br-lan: port 1(eth0.1) entered forwarding state
[   32.607768] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   33.565271] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   58.838273] done.
[   58.840274] jffs2: notice: (1243) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   59.009236] overlayfs: upper fs does not support tmpfile.

Partition table:

root@OpenWrt:~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00030000 00010000 "factory-uboot"
mtd1: 00020000 00010000 "boot"
mtd2: 00770000 00010000 "firmware"
mtd3: 001ae85a 00010000 "kernel"
mtd4: 005c17a4 00010000 "rootfs"
mtd5: 003b0000 00010000 "rootfs_data"
mtd6: 00010000 00010000 "config"
mtd7: 00010000 00010000 "rom"
mtd8: 00010000 00010000 "romfile"
mtd9: 00010000 00010000 "radio"

Partition sizes from filesystem view:

root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 2.3M      2.3M         0 100% /rom
tmpfs                    28.9M     56.0K     28.9M   0% /tmp
tmpfs                    28.9M     36.0K     28.9M   0% /tmp/root
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/mtdblock5            3.7M    344.0K      3.4M   9% /overlay
overlayfs:/overlay        3.7M    344.0K      3.4M   9% /

Installing luci:

root@OpenWrt:~# echo "nameserver 192.168.4.254" > /etc/resolv.conf 
root@OpenWrt:~# route add default gw 192.168.1.2
root@OpenWrt:~# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=53 time=25.023 ms
^C
--- 8.8.8.8 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 25.023/25.023/25.023 ms
root@OpenWrt:~# opkg update
Downloading http://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_core
Downloading http://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/packages/Packages.sig
Signature check passed.
Downloading http://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/kmods/4.14.171-1-9ff4c1c1afefd357c85030a1c0e00f92/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_kmods
Downloading http://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/kmods/4.14.171-1-9ff4c1c1afefd357c85030a1c0e00f92/Packages.sig
Signature check passed.
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/Packages.sig
Signature check passed.
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_luci
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/Packages.sig
Signature check passed.
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_packages
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/packages/Packages.sig
Signature check passed.
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/routing/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_routing
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/routing/Packages.sig
Signature check passed.
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/telephony/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_telephony
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/telephony/Packages.sig
Signature check passed.
root@OpenWrt:~# opkg install luci
Installing luci (git-20.064.26720-acef567-1) to root...
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/luci_git-20.064.26720-acef567-1_all.ipk
(.....)
Downloading http://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/kmods/4.14.171-1-9ff4c1c1afefd357c85030a1c0e00f92/kmod-ledtrig-heartbeat_4.14.171-1_mipsel_24kc.ipk
Installing kmod-ledtrig-netdev (4.14.171-1) to root...
Downloading http://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/kmods/4.14.171-1-9ff4c1c1afefd357c85030a1c0e00f92/kmod-ledtrig-netdev_4.14.171-1_mipsel_24kc.ipk
Installing kmod-ledtrig-timer (4.14.171-1) to root...
Downloading http://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/kmods/4.14.171-1-9ff4c1c1afefd357c85030a1c0e00f92/kmod-ledtrig-timer_4.14.171-1_mipsel_24kc.ipk
Installing luci-mod-system (git-20.064.26720-acef567-1) to root...
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/luci/luci-mod-system_git-20.064.26720-acef567-1_all.ipk
Installing rpcd-mod-iwinfo (2020-01-05-efe51f41-2) to root...
Downloading http://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/rpcd-mod-iwinfo_2020-01-05-efe51f41-2_mipsel_24kc.ipk
Installing luci-mod-network (git-20.064.26720-acef567-1) to root...
(....)
Configuring luci-app-firewall.
Configuring luci-proto-ppp.
Configuring rpcd-mod-iwinfo.
Configuring luci-mod-network.
Configuring luci-mod-admin-full.
Configuring luci-proto-ipv6.
Configuring uhttpd.
Configuring rpcd-mod-rrdns.
Configuring luci.
root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 2.3M      2.3M         0 100% /rom
tmpfs                    28.9M    868.0K     28.1M   3% /tmp
tmpfs                    28.9M     36.0K     28.9M   0% /tmp/root
tmpfs                   512.0K         0    512.0K   0% /dev
/dev/mtdblock5            3.7M      1.0M      2.6M  28% /overlay
overlayfs:/overlay        3.7M      1.0M      2.6M  28% /

Processes running:

root@OpenWrt:~# ps 
  PID USER       VSZ STAT COMMAND
    1 root      1596 S    /sbin/procd
    2 root         0 SW   [kthreadd]
    3 root         0 IW   [kworker/0:0]
    4 root         0 IW<  [kworker/0:0H]
    6 root         0 IW<  [mm_percpu_wq]
    7 root         0 SW   [ksoftirqd/0]
    8 root         0 IW<  [netns]
    9 root         0 IW   [kworker/u2:1]
   91 root         0 SW   [oom_reaper]
   92 root         0 IW<  [writeback]
   94 root         0 SW   [kcompactd0]
   95 root         0 IW<  [crypto]
   97 root         0 IW<  [kblockd]
  123 root         0 IW<  [watchdogd]
  136 root         0 IW   [kworker/0:1]
  145 root         0 SW   [kswapd0]
  249 root         0 SW   [spi0]
  318 root         0 IW<  [ipv6_addrconf]
  326 root         0 IW<  [kworker/0:1H]
  329 root         0 SW   [irq/40-keys]
  330 root         0 SW   [irq/41-keys]
  477 root      1236 S    /sbin/ubusd
  478 root       920 S    /sbin/askfirst /usr/libexec/login.sh
  495 root      1024 S    /sbin/urngd
  549 root         0 IW   [kworker/u2:2]
  573 root         0 IW<  [cfg80211]
  700 root      1852 S    /usr/sbin/hostapd -s -n phy0 -g /var/run/hostapd-phy0/global
  701 root      1852 S    /usr/sbin/wpa_supplicant -s -n phy0 -g /var/run/wpa_supplicant-phy0/global
  702 root      1852 S    /usr/sbin/hostapd -s -n phy1 -g /var/run/hostapd-phy1/global
  703 root      1852 S    /usr/sbin/wpa_supplicant -s -n phy1 -g /var/run/wpa_supplicant-phy1/global
  970 root      1244 S    /sbin/logd -S 64
 1078 root      1104 S    /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p 22 -K 300 -T 3
 1149 root      1708 S    /sbin/netifd
 1183 root      1460 S    /usr/sbin/odhcpd
 1344 root      1208 S    udhcpc -p /var/run/udhcpc-eth0.2.pid -s /lib/netifd/dhcp.script -f -t 0 -i eth0.2 -x hostname:OpenWrt -C -R -O 121
 1345 root      1048 S    odhcp6c -s /lib/netifd/dhcpv6.script -P0 -t120 eth0.2
 1450 dnsmasq   1372 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
 1466 root         0 SWN  [jffs2_gcd_mtd5]
 1521 root      1212 S<   /usr/sbin/ntpd -n -N -S /usr/sbin/ntpd-hotplug -p 0.openwrt.pool.ntp.org -p 1.openwrt.pool.ntp.org -p 2.openwrt.pool.ntp.org -p 3.openwrt.poo
 1570 root      1172 S    /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p 22 -K 300 -T 3
 1571 root      1216 S    -ash
 2663 root      2068 S    /sbin/rpcd -s /var/run/ubus.sock -t 30
 3113 root      1336 S    /usr/sbin/uhttpd -f -h /www -r OpenWrt -x /cgi-bin -t 60 -T 30 -k 20 -A 1 -n 3 -N 100 -R -p 0.0.0.0:80 -p [::]:80
 3180 root      1208 R    ps

Now i will reboot the router... issuing reboot command.
At the first reboot time the uhttpd launches but if i issue reboot again it does not start at all and had gone from /etc/rc.d ....

root@OpenWrt:~# 
root@OpenWrt:~# reboot
root@OpenWrt:~# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.
[jorge@toshiba ~]$

Wait until powerled stop flashing and ethernet led lit up.

[jorge@toshiba ~]$ ssh 192.168.1.1 -lroot


BusyBox v1.31.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r12386-1c880f2324
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 2.3M      2.3M         0 100% /rom
tmpfs                    28.9M     56.0K     28.9M   0% /tmp
/dev/mtdblock5            3.7M   1016.0K      2.7M  27% /overlay
overlayfs:/overlay        3.7M   1016.0K      2.7M  27% /
tmpfs                   512.0K         0    512.0K   0% /dev

It seems that overlay contains the files... afterall 1016 (1M) is used...

The uhttpd is not launched...

root@OpenWrt:~# ps
 (...)
  847 root      1244 S    /sbin/logd -S 64
  951 root      1104 S    /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p 22 -K 300 -T 3
 1022 root      1708 S    /sbin/netifd
 1056 root      1460 S    /usr/sbin/odhcpd
 1264 root      1208 S    udhcpc -p /var/run/udhcpc-eth0.2.pid -s /lib/netifd/dhcp.script -f -t 0 -i eth0.2 -x hostname:OpenWrt -C -R -O 121
 1266 root      1048 S    odhcp6c -s /lib/netifd/dhcpv6.script -P0 -t120 eth0.2
 1274 root      1208 S<   /usr/sbin/ntpd -n -N -S /usr/sbin/ntpd-hotplug -p 0.openwrt.pool.ntp.org -p 1.openwrt.pool.ntp.org -p 2.openwrt.pool.ntp.org -p 3.openwrt.poo
 1369 root      1172 S    /usr/sbin/dropbear -F -P /var/run/dropbear.1.pid -p 22 -K 300 -T 3
 1388 root      1216 S    -ash
 1429 dnsmasq   1372 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
 1456 root      1208 R    ps

root@OpenWrt:~# ls /etc/rc.d/
K10gpio_switch   K89log           K90sysfixtime    S00urngd         S11sysctl        S19dropbear      S35odhcpd        S95done          S99bootcount
K50dropbear      K90boot          K90umount        S10boot          S12log           S19firewall      S50cron          S96led           S99urandom_seed
K85odhcpd        K90network       S00sysfixtime    S10system        S19dnsmasq       S20network       S94gpio_switch   S98sysntpd
root@OpenWrt:~# ls /etc/init.d/
boot          cron          done          firewall      led           network       rpcd          sysfixtime    system        uhttpd        urandom_seed
bootcount     dnsmasq       dropbear      gpio_switch   log           odhcpd        sysctl        sysntpd       ucitrack      umount        urngd
root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 2.3M      2.3M         0 100% /rom
tmpfs                    28.9M     56.0K     28.9M   0% /tmp
/dev/mtdblock5            3.7M      1.0M      2.7M  27% /overlay
overlayfs:/overlay        3.7M      1.0M      2.7M  27% /
tmpfs                   512.0K         0    512.0K   0% /dev

But i can launch it from console...

root@OpenWrt:~# /etc/init.d/uhttpd start
root@OpenWrt:~# ps
(...)
 1429 dnsmasq   1372 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
 1491 root      1336 S    /usr/sbin/uhttpd -f -h /www -r OpenWrt -x /cgi-bin -t 60 -T 30 -k 20 -A 1 -n 3 -N 100 -R -p 0.0.0.0:80 -p [::]:80
 1505 root      1208 R    ps
root@OpenWrt:~# ls /www/
cgi-bin      index.html   luci-static
root@OpenWrt:~# ls /www/luci-static/
bootstrap  resources
root@OpenWrt:~# ls /www/luci-static/bootstrap/
cascade.css  favicon.png
root@OpenWrt:~# ls /www/luci-static/resources/
bandwidth.svg    connections.svg  fs.js            luci.js          protocol         uci.js           view             xhr.js
cbi              firewall.js      icons            network.js       rpc.js           ui.js            wifirate.svg
cbi.js           form.js          load.svg         promis.min.js    tools            validation.js    wireless.svg
root@OpenWrt:~# ls /www/cgi-bin/
cgi-backup    cgi-download  cgi-exec      cgi-upload    luci

Opening 192.168.1.1 in browser i get:
/usr/lib/lua/luci/dispatcher.lua:389: /etc/config/luci seems to be corrupt, unable to find section 'main'

So there is something strange here...
Kernel complaints...

[   23.628974] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   24.597366] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   42.172377] jffs2: Erase at 0x003a0000 failed immediately: errno -22
[  372.662031] jffs2: notice: (1491) jffs2_get_inode_nodes: Node header CRC failed at 0x2ccbb8. {ffff,ffff,ffffffff,ffffffff}
[  372.673305] jffs2: warning: (1491) jffs2_do_read_inode_internal: no data nodes found for ino #141
[  372.682331] jffs2: notice: (1491) jffs2_do_read_inode_internal: but it has children so we fake some modes for it
[  401.766381] jffs2: notice: (1506) jffs2_get_inode_nodes: Node header CRC failed at 0x2ccc84. {ffff,ffff,ffffffff,ffffffff}
[  401.777662] jffs2: warning: (1506) jffs2_do_read_inode_internal: no data nodes found for ino #209
[  401.786653] jffs2: notice: (1506) jffs2_do_read_inode_internal: but it has children so we fake some modes for it
[  406.835277] jffs2: notice: (1507) jffs2_get_inode_nodes: Node header CRC failed at 0x2ccd50. {ffff,ffff,ffffffff,ffffffff}
[  406.846567] jffs2: warning: (1507) jffs2_do_read_inode_internal: no data nodes found for ino #210
[  406.855584] jffs2: notice: (1507) jffs2_do_read_inode_internal: but it has children so we fake some modes for it
[  406.866973] jffs2: notice: (1507) jffs2_get_inode_nodes: Node header CRC failed at 0x2c000c. {ffff,ffff,ffffffff,ffffffff}
[  415.071800] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2c9cd0. {ffff,ffff,ffffffff,ffffffff}
[  415.083150] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2c9c48. {ffff,ffff,ffffffff,ffffffff}
[  415.094775] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2c3830. {ffff,ffff,ffffffff,ffffffff}
[  415.106023] jffs2: warning: (1509) jffs2_do_read_inode_internal: no data nodes found for ino #291
[  415.115035] jffs2: notice: (1509) jffs2_do_read_inode_internal: but it has children so we fake some modes for it
[  415.130473] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2ce7d0. {ffff,ffff,ffffffff,ffffffff}
[  415.141811] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2ce148. {ffff,ffff,ffffffff,ffffffff}
[  415.153462] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2cda90. {ffff,ffff,ffffffff,ffffffff}
[  415.165513] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2cd334. {ffff,ffff,ffffffff,ffffffff}
[  415.177121] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2ccea4. {ffff,ffff,ffffffff,ffffffff}
[  415.188616] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2cce1c. {ffff,ffff,ffffffff,ffffffff}
[  415.199865] jffs2: warning: (1509) jffs2_do_read_inode_internal: no data nodes found for ino #262
[  415.208873] jffs2: notice: (1509) jffs2_do_read_inode_internal: but it has children so we fake some modes for it
[  415.222272] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2c2050. {ffff,ffff,ffffffff,ffffffff}
[  415.233824] jffs2: notice: (1509) jffs2_get_inode_nodes: Node header CRC failed at 0x2c1fc8. {ffff,ffff,ffffffff,ffffffff}
[  415.245071] jffs2: warning: (1509) jffs2_do_read_inode_internal: no data nodes found for ino #267
[  415.254080] jffs2: notice: (1509) jffs2_do_read_inode_internal: but it has children so we fake some modes for it
root@OpenWrt:~#

What can i do to help debug this issue ?

JorgeMFerreira · March 7, 2020, 10:31am

Hello David.
Can you, please, supply the UE version of Stripped Firmware for use with TFTP ?
I tryed to revert back from OpenWRT with the file that is provided by TP-Link and the router remains "dead". I can only flash OpenWRT in it.

David.S.Mckellen · March 7, 2020, 10:55am

Hi There
Did You mean (EU) Version?
first of all why don't you use OpenWRT 18.06.5 instead SNAPSHOT?! it works fine with my router(it's your router and your call)

Here you are

Let me know when you're successful

JorgeMFerreira · March 7, 2020, 11:11am

OpenWRT 18.06.5 throwns some errors in jffs2 overlay that i would help to debug... i will need to attach my raspberry-pi RS232 interface into this TPLINK board... soldering wires...
I will GIT and compile the last version (18.06.8) or the other branch (19.07.02) and try them.
But i need to know if the router works again with the TPLink firmware. I will now send your tp_recovery.bin to TFTP server and upload to router.

David.S.Mckellen · March 7, 2020, 11:17am

Yeah it does work with TP-Link Firmware and at first I tested it on my router,it was okay then returned to openwrt again

(I will GIT and compile the last version (18.06.8) or the other branch (19.07.02) and try them)
If it will okay with both 18.06.8 or 19.07.2 upload those image and let me know
I want to upgrade my router to one of them preferred 19.07.2
Thanks

JorgeMFerreira · March 7, 2020, 11:21am

The router wont boot to TPLink firmware - nor your tp_recovery.bin
It blinks one time (on power up) all leds and then only the lan port stays lit (with ethernet cable inserted). If i remove and reinsert ethernet cable the lan-port led will indicate this condition.
I can only TFTP the openwrt firmware in it, but has problems with overlay filesystem (i described in this thread above).
I will wireup the RS232 port to see what is going on. Have some experiences before to recovery some hardware via JTAG and RS232.... but this is new to me... not even the original TPLINK firmware wants to work!!!

David.S.Mckellen · March 7, 2020, 11:26am

I didn't use TFTP Server and upload the stripped firmware via Openwrt WebUI after 2mins restarted and everything was okay