Hey all!
Please help me with the following problem: Some time ago we purchased 9 TP-Link Archer C20< W > v5 routers and, as discussed here (Porting Firmware to TP-Link Archer C20 v5 - #61 by jtommasi72), we installed the OpenWrt firmware for TP-Link Archer C20 V4 on these devices. Everything worked perfectly on all routers, however, when trying to update the OpenWrt version, we noticed that 2 of these routers simply do not accept firmware upgrades and this goes for both OpenWrt and TP-Link firmware. Another detail is that they also do not accept reset to the factory default, although configuration changes work normally. In short, it is like these devices was stuck in read only mode for resets and upgrades.
We tried the updates by the following methods:
- WEB;
- CLI – with commands
sysupgrade -v -n -F /tmp/tp_recovery.bin
mtd -r write /tmp/firmware_image.bin firmware
- TFTP
- Serial/TFTP – with command:
tftp 0x80060000 tp_recovery.bin; erase tplink 0x20000 0x7a0000; cp.b 0x80080000 0x20000 0x7a0000
Below are some of the logs of the attempted procedures...
Serial log on normal boot.
[05040B0E][05040B0F][89890000][23233636][00232335]
DU Setting Cal Done
U-Boot 1.1.3 (Sep 8 2020 - 11:43:06)
Board: Ralink APSoC DRAM: 64 MB
relocate_code Pointer at: 83fb8000
gpiomode1 55054404.
gpiomode2 05540554.
gpiomode2 05550555.
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Sep 8 2020 Time:11:43:06
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 580 MHZ ####
estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
continue to starting system.
0
disable switch phyport...
3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000
## Booting image at bc020000 ...
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64
Starting kernel ...
[ 0.000000] Linux version 5.4.154 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16325-88151b8303)) #0 Sun Oct 24 09:01:35 2021
[ 0.000000] Board has DDR2
[ 0.000000] Analog PMU set to hw control
[ 0.000000] Digital PMU set to hw control
[ 0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[ 0.000000] MIPS: machine is TP-Link Archer C20 v4
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16240
[ 0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[ 0.000000] Writing ErrCtl register=0007e006
[ 0.000000] Readback ErrCtl register=0007e006
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 57444K/65536K available (5088K kernel code, 204K rwdata, 636K rodata, 1228K init, 205K bss, 8092K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 256
[ 0.000000] intc: using register map from devicetree
[ 0.000000] random: get_random_bytes called from 0x805cda28 with crng_init=0
[ 0.000000] CPU Clock: 580MHz
[ 0.000000] timer_probe: no matching timers found
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[ 0.000009] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[ 0.007570] Calibrating delay loop... 385.02 BogoMIPS (lpj=770048)
[ 0.045454] pid_max: default: 32768 minimum: 301
[ 0.050093] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.057113] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.070499] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.079926] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.086572] pinctrl core: initialized pinctrl subsystem
[ 0.094546] NET: Registered protocol family 16
[ 0.203375] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
[ 0.358475] PCI host bridge /pcie@10140000 ranges:
[ 0.363052] MEM 0x0000000020000000..0x000000002fffffff
[ 0.368082] IO 0x0000000010160000..0x000000001016ffff
[ 0.395476] PCI host bridge to bus 0000:00
[ 0.399457] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[ 0.406056] pci_bus 0000:00: root bus resource [io 0x10160000-0x1016ffff]
[ 0.412680] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.419229] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.426927] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400
[ 0.432712] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[ 0.438732] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[ 0.444852] pci 0000:00:00.0: supports D1
[ 0.448657] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[ 0.455806] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[ 0.463722] pci 0000:01:00.0: [14c3:7650] type 00 class 0x028000
[ 0.469545] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff]
[ 0.475689] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[ 0.481802] pci 0000:01:00.1: [14c3:8650] type 00 class 0x0d1100
[ 0.487620] pci 0000:01:00.1: reg 0x10: [mem 0x00000000-0x000fffff]
[ 0.493756] pci 0000:01:00.1: supports D1
[ 0.497561] pci 0000:01:00.1: PME# supported from D0 D1 D3hot D3cold
[ 0.505278] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[ 0.511650] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[ 0.518037] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[ 0.524387] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[ 0.531107] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x201fffff]
[ 0.537659] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[ 0.544220] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
[ 0.550768] pci 0000:01:00.1: BAR 0: assigned [mem 0x20100000-0x201fffff]
[ 0.557318] pci 0000:00:00.0: PCI bridge to [bus 01]
[ 0.562105] pci 0000:00:00.0: bridge window [mem 0x20000000-0x201fffff]
[ 0.568773] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[ 0.583011] clocksource: Switched to clocksource MIPS
[ 0.588998] thermal_sys: Registered thermal governor 'step_wise'
[ 0.589417] NET: Registered protocol family 2
[ 0.599549] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.607425] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.615534] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.622904] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.629699] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.635982] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.642310] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.649349] NET: Registered protocol family 1
[ 0.653623] PCI: CLS 0 bytes, default 32
[ 0.662367] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[ 0.676726] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.682361] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.707926] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 0.718351] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 0.724060] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 0.729694] mt7621_gpio 10000600.gpio: registering 32 gpios
[ 0.735392] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.744318] printk: console [ttyS0] disabled
[ 0.748515] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[ 0.757240] printk: console [ttyS0] enabled
[ 0.757240] printk: console [ttyS0] enabled
[ 0.765652] printk: bootconsole [early0] disabled
[ 0.765652] printk: bootconsole [early0] disabled
[ 0.776533] spi-mt7621 10000b00.spi: sys_freq: 193333333
[ 0.800704] spi-nor spi0.0: s25fl064k (8192 Kbytes)
[ 0.805738] 4 fixed-partitions partitions found on MTD device spi0.0
[ 0.812189] Creating 4 MTD partitions on "spi0.0":
[ 0.817063] 0x000000000000-0x000000020000 : "boot"
[ 0.823136] 0x000000020000-0x0000007c0000 : "firmware"
[ 0.832019] 2 tplink-fw partitions found on MTD device firmware
[ 0.838096] Creating 2 MTD partitions on "firmware":
[ 0.843154] 0x000000000000-0x0000001e821a : "kernel"
[ 0.849313] 0x0000001e821c-0x0000007a0000 : "rootfs"
[ 0.855512] mtd: device 3 (rootfs) set to be root filesystem
[ 0.863492] 1 squashfs-split partitions found on MTD device rootfs
[ 0.869858] 0x0000004e0000-0x0000007a0000 : "rootfs_data"
[ 0.876433] 0x0000007c0000-0x0000007d0000 : "config"
[ 0.882657] 0x0000007d0000-0x000000800000 : "factory"
[ 0.889647] libphy: Fixed MDIO Bus: probed
[ 0.907138] rt3050-esw 10110000.esw: link changed 0x00
[ 0.914363] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[ 0.924849] NET: Registered protocol family 10
[ 0.934028] Segment Routing with IPv6
[ 0.937966] NET: Registered protocol family 17
[ 0.942573] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 0.955727] 8021q: 802.1Q VLAN Support v1.8
[ 0.971457] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[ 0.985556] Freeing unused kernel memory: 1228K
[ 0.990179] This architecture does not have kernel memory protection.
[ 0.996713] Run /sbin/init as init process
[ 1.207015] random: fast init done
[ 1.845878] init: Console is alive
[ 1.849764] init: - watchdog -
[ 2.630873] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 2.788732] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 2.806662] init: - preinit -
[ 4.531379] random: jshn: uninitialized urandom read (4 bytes read)
[ 4.623593] random: jshn: uninitialized urandom read (4 bytes read)
[ 4.851269] random: jshn: uninitialized urandom read (4 bytes read)
[ 5.432413] rt3050-esw 10110000.esw: link changed 0x00
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug[ 5.623350] urandom_read: 2 callbacks suppressed
level
[ 5.623359] random: procd: uninitialized urandom read (4 bytes read)
[ 8.937023] rt3050-esw 10110000.esw: link changed 0x02
[ 10.447427] jffs2: notice: (456) jffs2_build_xattr_subsystem: complete building xattr subsystem, 2766 of xdatum (8 unchecked, 2758 orphan) and 2767 of xref (2758 dead, 0 orphan) found.
[ 10.466287] mount_root: switching to jffs2 overlay
[ 10.600730] overlayfs: upper fs does not support tmpfile.
[ 10.614062] urandom-seed: Seeding with /etc/urandom.seed
[ 10.761824] procd: - early -
[ 10.765064] procd: - watchdog -
[ 11.365554] procd: - watchdog -
[ 11.370645] procd: - ubus -
[ 11.455193] random: ubusd: uninitialized urandom read (4 bytes read)
[ 11.463729] random: ubusd: uninitialized urandom read (4 bytes read)
[ 11.470858] random: ubusd: uninitialized urandom read (4 bytes read)
[ 11.479927] procd: - init -
Please press Enter to activate this console.
[ 12.359918] kmodloader: loading kernel modules from /etc/modules.d/*
[ 12.507863] Loading modules backported from Linux version v5.10.68-0-g4d8524048a35
[ 12.515628] Backport generated by backports.git v5.10.68-1-0-ga4f9ba32
[ 12.635974] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[ 12.818847] urngd: v1.0.2 started.
[ 13.009852] random: crng init done
[ 13.013347] random: 1 urandom warning(s) missed due to ratelimiting
[ 13.681207] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[ 13.687300] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[ 13.727028] mt76_wmac 10300000.wmac: firmware init done
[ 13.982953] mt76x0e 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
[ 13.989568] mt76x0e 0000:01:00.0: ASIC revision: 76100002
[ 14.271637] mt76x0e 0000:01:00.0: Firmware Version: 0.1.00
[ 14.508049] mt76x0e 0000:01:00.0: EEPROM ver:02 fae:00
[ 14.539284] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 20.820429] rt3050-esw 10110000.esw: link changed 0x00
[ 24.321966] rt3050-esw 10110000.esw: link changed 0x02
[ 27.720348] br-lan: port 1(eth0.33) entered blocking state
[ 27.726016] br-lan: port 1(eth0.33) entered disabled state
[ 27.731974] device eth0.33 entered promiscuous mode
[ 27.736980] device eth0 entered promiscuous mode
[ 27.765300] br-lan: port 1(eth0.33) entered blocking state
[ 27.770949] br-lan: port 1(eth0.33) entered forwarding state
[ 27.881697] br-vlan51: port 1(eth0.51) entered blocking state
[ 27.887633] br-vlan51: port 1(eth0.51) entered disabled state
[ 27.893851] device eth0.51 entered promiscuous mode
[ 28.005468] br-vlan51: port 1(eth0.51) entered blocking state
[ 28.011376] br-vlan51: port 1(eth0.51) entered forwarding state
[ 28.094097] br-vlan52: port 1(eth0.52) entered blocking state
[ 28.100032] br-vlan52: port 1(eth0.52) entered disabled state
[ 28.122707] device eth0.52 entered promiscuous mode
[ 28.159251] br-vlan52: port 1(eth0.52) entered blocking state
[ 28.165127] br-vlan52: port 1(eth0.52) entered forwarding state
[ 28.273949] br-vlan53: port 1(eth0.53) entered blocking state
[ 28.279886] br-vlan53: port 1(eth0.53) entered disabled state
[ 28.314775] device eth0.53 entered promiscuous mode
[ 28.333334] br-vlan53: port 1(eth0.53) entered blocking state
[ 28.339250] br-vlan53: port 1(eth0.53) entered forwarding state
[ 28.410011] br-vlan54: port 1(eth0.54) entered blocking state
[ 28.415946] br-vlan54: port 1(eth0.54) entered disabled state
[ 28.422184] device eth0.54 entered promiscuous mode
[ 28.469040] br-vlan54: port 1(eth0.54) entered blocking state
[ 28.474951] br-vlan54: port 1(eth0.54) entered forwarding state
[ 28.541654] br-vlan55: port 1(eth0.55) entered blocking state
[ 28.547590] br-vlan55: port 1(eth0.55) entered disabled state
[ 28.553826] device eth0.55 entered promiscuous mode
[ 28.600379] br-vlan55: port 1(eth0.55) entered blocking state
[ 28.606288] br-vlan55: port 1(eth0.55) entered forwarding state
[ 28.719543] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[ 32.081833] br-vlan51: port 2(wlan0) entered blocking state
[ 32.087598] br-vlan51: port 2(wlan0) entered disabled state
[ 32.093648] device wlan0 entered promiscuous mode
[ 33.386509] br-vlan51: port 3(wlan1) entered blocking state
[ 33.392255] br-vlan51: port 3(wlan1) entered disabled state
[ 33.398336] device wlan1 entered promiscuous mode
[ 39.746850] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 39.753581] br-vlan51: port 2(wlan0) entered blocking state
[ 39.759293] br-vlan51: port 2(wlan0) entered forwarding state
[ 39.773581] br-vlan52: port 2(wlan0-1) entered blocking state
[ 39.779505] br-vlan52: port 2(wlan0-1) entered disabled state
[ 39.785762] device wlan0-1 entered promiscuous mode
[ 39.796869] br-vlan52: port 2(wlan0-1) entered blocking state
[ 39.802781] br-vlan52: port 2(wlan0-1) entered forwarding state
[ 39.833388] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0-1: link becomes ready
[ 39.858911] br-vlan53: port 2(wlan0-2) entered blocking state
[ 39.864831] br-vlan53: port 2(wlan0-2) entered disabled state
[ 39.871238] device wlan0-2 entered promiscuous mode
[ 39.879148] br-vlan53: port 2(wlan0-2) entered blocking state
[ 39.885025] br-vlan53: port 2(wlan0-2) entered forwarding state
[ 39.937821] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0-2: link becomes ready
[ 39.959615] br-vlan55: port 2(wlan0-3) entered blocking state
[ 39.965524] br-vlan55: port 2(wlan0-3) entered disabled state
[ 39.971755] device wlan0-3 entered promiscuous mode
[ 40.007832] br-vlan55: port 2(wlan0-3) entered blocking state
[ 40.013731] br-vlan55: port 2(wlan0-3) entered forwarding state
[ 40.038522] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0-3: link becomes ready
[ 50.236014] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 50.242755] br-vlan51: port 3(wlan1) entered blocking state
[ 50.248467] br-vlan51: port 3(wlan1) entered forwarding state
[ 50.265112] br-vlan52: port 3(wlan1-1) entered blocking state
[ 50.271059] br-vlan52: port 3(wlan1-1) entered disabled state
[ 50.277310] device wlan1-1 entered promiscuous mode
[ 50.284929] br-vlan52: port 3(wlan1-1) entered blocking state
[ 50.290860] br-vlan52: port 3(wlan1-1) entered forwarding state
[ 50.321535] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1-1: link becomes ready
[ 50.346815] br-vlan53: port 3(wlan1-2) entered blocking state
[ 50.352737] br-vlan53: port 3(wlan1-2) entered disabled state
[ 50.359179] device wlan1-2 entered promiscuous mode
[ 50.409804] br-vlan53: port 3(wlan1-2) entered blocking state
[ 50.415715] br-vlan53: port 3(wlan1-2) entered forwarding state
[ 50.445694] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1-2: link becomes ready
[ 50.469437] br-vlan55: port 3(wlan1-3) entered blocking state
[ 50.475383] br-vlan55: port 3(wlan1-3) entered disabled state
[ 50.481632] device wlan1-3 entered promiscuous mode
[ 50.488940] br-vlan55: port 3(wlan1-3) entered blocking state
[ 50.494869] br-vlan55: port 3(wlan1-3) entered forwarding state
[ 50.520181] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1-3: link becomes ready