Re200v1 revert to OEM failed

Hello,

I have a TP-Link RE200 V1 extender on which I installed the
OpenWRT firmware. That worked perfectly. Now I wanted to restore
the extender to its original state and install the original
firmware. I made a mistake.

After that, unfortunately, nothing worked anymore. When I turn
on the repeater, all the LEDs blink. So I opened the device and
connected it to my notebook via the serial port (PL2302 adapter).

I now have the following menu to choose from.

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
6: Load ART data then write to Flash via TFTP.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.

TFTP isn't working. I also couldn't get it to work using
menu item "7 via Serial".

Any suggestion is greatly appreciated.
Thank you in advance.

To be clear, you were attempting to restore stock/OEM firmware when a "mistake" occurred, correct?

  • How did you attempt to restore?
  • What "mistake" occurred?
  • Were you following these instructions?
  • If not, what instructions did you use?

How did you do that?

What makes you think you damaged bootloader when you are presented with actual bootloader menu?

  • via the OpenWrt web interface under Firmware Update.

  • I read these instructions, but the problem is that
    TFTP no longer works.

  • Google AI

  • when transferring a file via serial interface,
    the transfer aborts before the file is completely transferred.

I don't know if the bootloader is damaged.

:broccoli:what file under which of 8 options?

:broccoli:how do you know if you never tried?

:broccoli:last time i checked they did not tak€ warranty returns.

:broccoli:i dont see any previous mention of that

Please show help from option 4 in bootloader menu

Post TFTP transfer session attempt from serial.

Don't use AI, it's f-ing stupid.

3 Likes

The "back to stock" instructions on the device page are done through OpenWrt on the device. So first you need to get OpenWrt up again. The simplest way to do that is to tftp the initramfs build of OpenWrt to RAM and boot it. This gives you a one-time instance of OpenWrt which can be used to flash either stock or a permanent install of OpenWrt.

Option 1 may work to load the initramfs. Or you can use option 4 and the tftpboot and bootm commands.
tftpboot 82000000 filename
It should make a connection to your TFTP server and show several lines of # marks as the file transfers.
bootm 82000000
OpenWrt should boot. Then you can continue by entering OpenWrt CLI commands over the serial port.

3 Likes

Just a note if using windows don't forget to disable your firewall
to make sure TFTP will work

2 Likes
I use Linux.

I selected option 2 in the boot menu and confirmed 
the IP addresses. Unfortunately, I cannot ping the 
IP addresses. Therefore, I would like to try it
via the serial interface.

Where can I find out which memory addresses are 
correct for the "Boot Loader" and for 
"System Load Linux"?

There are several image files for the TP-Link RE200 V1.
tplink_re200-v1-initramfs-kernel.bin
tplink_re200-v1-squashfs-factory.bin
tplink_re200-v1-squashfs-sysupgrade.bin


or on the following page.
https://openwrt.org/toh/tp-link/re200?s[]=tp&s[]=link&s[]=re200
re200v1_tftp.bin
stock_upgrade.bin


Which one do I need to use?

The bootloader does not answer pings. It has a very limited network stack which is only intended for TFTP.

TFTP is about 1000 times faster than Kermit so you should use it. If you have another OpenWrt router it is simple to configure it to be a TFTP server.

Addresses 80xxxxxx are in RAM and bcxxxxxx are in flash. Do not write directly to flash. Load and boot the initramfs image then use it to install the sysupgrade image.

2 Likes

Thank you. It worked now.

1 Like

I thought it would work.
When I scan the WLAN network,
I get the following error message.

[ 262.780415] mt76x0e 0000:01:00.0: Error: RF read 0:31 failed:-145!!
[ 262.792922] mt76x0e 0000:01:00.0: Error: RF read 0:30 failed:-145!!
[ 262.805429] mt76x0e 0000:01:00.0: Error: RF read 0:30 failed:-145!!
[ 262.817932] mt76x0e 0000:01:00.0: Error: RF read 0:30 failed:-145!!
[ 262.830439] mt76x0e 0000:01:00.0: Error: RF read 0:30 failed:-145!!
[ 262.842945] mt76x0e 0000:01:00.0: Error: RF read 0:28 failed:-145!!
[ 262.855461] mt76x0e 0000:01:00.0: Error: RF read 0:28 failed:-145!!
[ 262.867971] mt76x0e 0000:01:00.0: Error: RF read 0:28 failed:-145!!
[ 262.880478] mt76x0e 0000:01:00.0: Error: RF read 0:28 failed:-145!!
[ 262.892986] mt76x0e 0000:01:00.0: Error: RF read 0:24 failed:-145!!

seems calibration data partition (last 64kB of flash) is erased/corrupted.
you certainly lose 5GHz for that, maybe even 2.4, it is not recoverable as it is set in factory do record variance in components used in production.

Can I check somewhere in the /sys directory what kind of flash chip is installed?
If so, where?

cat /sys/class/mtd/*/type

also in dmesg

Thanks to all.

Can I desolder or replace the flash chip and then flash it via TFTP? Is that possible?

no, you need at least uboot + env to be able to TFTP boot an initramfs, then write the rest from there.

Is it possible with a flash chip programmer like the following?
https://www.fruugo.de/fur-t48-tl866ii-usb-universal-programmer-mit-42-adaptern-unterstutzung-17386-ic-spi-flash-nand-eeprom-mc/p-406896033-862566624?ac=bing&msclkid=d8f684a9997f1f2c537aed25ce649748&utm_source=bing&utm_medium=cpc&utm_campaign=Catch%20All%20PMax%20Cross_AT&utm_term=2323405508873118&utm_content=Catch%20All%20PMax%20Cross%20AT

you're willing to spend 130€ on a broken device you can buy new for 20€ ?

plus https://openwrt.org/supported_devices/864_warning.

put it in the e-waste recycle bin and move on.

In addition you need a fixed temperature heat gun (another 50+ bucks) and a micro-soldering station (50 for multi-tip iron, maybe 50 for desk carpet), I promise youll mess up first few times.

Your problem is un-restorable last flash block. If you had 5 devices in series you could "donor" other's cal data and boot loader.