TP-Link Re450 brick after trying to return the original firmware

Hello,
I use re450 as AP
i installed lede for security in wifi.
After installing Lede, I realized that I only had 64 MB ram, after installation, AP was often restarted.
I tried to return the original firmware, but I got this:

U-Boot 1.1.4 (Jan 11 2017 - 18:09:36)

ap135 - Scorpion 1.0

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 133k for U-Boot at: 83fdc000
Reserving 192k for malloc() at: 83fac000
Reserving 44 Bytes for Board Info at: 83fabfd4
Reserving 36 Bytes for Global Data at: 83fabfb0
Reserving 128k for boot params() at: 83f8bfb0
Stack Pointer at: 83f8bf98
Now running in RAM - U-Boot at: 83fdc000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0x6
No valid address in Flash. Using fixed address
Scorpion  ----> AR8033 PHY *
AR8033 PHY init 
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x18116290 to 0x50a0214f
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Stream with EOS marker is not supportedLZMA ERROR 1 - must RESET board to recover

then restarts again

Can you fix "AP" it and how?
I apologize for my bad English.

Did You try my "back_to_stock" firmware?

You can write this file to spi flash chip using Uboot commands:
( You must copy this file to root directory on your tftp server (use tftpd32)

tftp 0x81000000 re450_back_to_stock.bin
erase 0x9f020000 +$filesize
cp.b $fileaddr 0x9f020000 $filesize
reset
2 Likes

Translate into the language of your choice...

https://translate.google.com/

Thanks for the help.
I fixed my AP RE450.
A small addition to the documentation.
To get into CLI mode I did the following:
When I wrote the "Autobooting message in 1 seconds" I entered "tpl".
After that:
Scorpion> setenv serverip 192.168.0.12; setenv ipaddr 192.168.0.8
(192.168.0.12 - my tftp server, 192.168.0.8 - ip address of my AP)
Then I used the commands above.

10x guys

2 Likes

Is there a how to documentation to spi flash chip? I also want to flash my RE450 V2 to stock version, my RE450 isn't bricked, but WLAN 5GHZ doesn't work properly with Openwrt. Is there a easy way to go back to stock? I have read that RE450 don't have recovery mode. So you don't have the access to TFTP. Is that right?

I still have access to Luci.

1 Like

A properly stripped stock firmware can be flashed through LuCI like a sysupgrade. Though it is possible to do that yourself, some third parties are preparing such firmware like the Polish user above.

The option of ath10k-smallbuffers makes ath10k work OK with 64 MB RAM. It should be the default driver in recent releases.

1 Like

The stripped stock firmware the polish guys provide is compatible with RE450 V2?

Do your provided re450_back_to_stock.zip (3,8 MB) compatible with RE450 V2? Can I flash it with Luci?

1 Like

That I don't know. I can't vouch for them.

Generally the process for stripping firmware is to download the firmware for your model / version and region from TP-Link, use binwalk to find where in the bin file the main kernel begins, and then use dd to remove everything before that.

Thanks you, I will try it.

Below is binwalk --signature output of the firmware? Must I cut the firmware from 24824 or 61246 ?

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
23476         0x5BB4          U-Boot version string, "U-Boot 1.1.4 (Dec 20 2017 - 20:17:05)"
23524         0x5BE4          CRC32 polynomial table, big endian
24824         0x60F8          uImage header, header size: 64 bytes, header CRC: 0xF8FB28B0, created: 2017-12-20 12:17:06, image size: 36357 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0x94E7906, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
24888         0x6138          LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 96256 bytes
61246         0xEF3E          TP-Link firmware header, firmware version: 0.0.0, image version: "", product ID: 0x0, product version: 0, kernel load address: 0x0, kernel entry point: 0x80002000, kernel offset: 0, kernel length: 512, rootfs offset: 770002, rootfs length: 0, bootloader offset: 0, bootloader length: 0
61758         0xF13E          LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2207224 bytes
831761        0xCB111         Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 4312771 bytes, 695 inodes, blocksize: 1048576 bytes, created: 2017-12-20 12:26:50

@Heinz I tried the exact steps mentioned above with your backtostock firmware, but still seeing the same error. Can you help me please

RE450 UKv1 , but it only has 64MB RAM

## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Too big uncompressed streamLZMA ERROR 1 - must          RESET board to recover

U-Boot 1.1.4 (Dec 15 2017 - 15:14:35)

ap135 - Scorpion 1.0

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 134k for U-Boot at: 83fdc000
Reserving 192k for malloc() at: 83fac000
Reserving 44 Bytes for Board Info at: 83fabfd4
Reserving 36 Bytes for Global Data at: 83fabfb0
Reserving 128k for boot params() at: 83f8bfb0
Stack Pointer at: 83f8bf98
Now running in RAM - U-Boot at: 83fdc000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0x1
No valid address in Flash. Using fixed address
Scorpion  ----> AR8033 PHY *
AR8033 PHY init
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x18116290 to 0x50a0214f
Autobooting in 1 seconds
scorpion>
Unknown command 'tpl' - try 'help'
scorpion>
scorpion> tftpboot 0x81000000 re450bs.bin
Trying eth0
Checking Link: Up
Checking Duplex: Full
Checking Speed 1000BaseT
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 're450bs.bin'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
done
Bytes transferred = 3992944 (3ced70 hex)
scorpion> erase 0x9f020000 +$filesize
Erase Flash from 0x9f020000 to 0x9f3effff in Bank # 1
First 0x2 last 0x3e sector size 0x10000                                       62
Erased 61 sectors
scorpion> cp.b $fileaddr 0x9f020000 $filesize
Copy to Flash... write addr: 9f020000
done
scorpion> reset

U-Boot 1.1.4 (Dec 15 2017 - 15:14:35)

ap135 - Scorpion 1.0

DRAM:  64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 134k for U-Boot at: 83fdc000
Reserving 192k for malloc() at: 83fac000
Reserving 44 Bytes for Board Info at: 83fabfd4
Reserving 36 Bytes for Global Data at: 83fabfb0
Reserving 128k for boot params() at: 83f8bfb0
Stack Pointer at: 83f8bf98
Now running in RAM - U-Boot at: 83fdc000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0x1
No valid address in Flash. Using fixed address
Scorpion  ----> AR8033 PHY *
AR8033 PHY init
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x18116290 to 0x50a0214f
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Too big uncompressed streamLZMA ERROR 1 - must          RESET board to recover


The original guide starts at a different address

scorpion> tftp 0x80060000 re450bs.bin&&erase 0x9f020000 +$filesize&&cp.b $fileaddr 0x9f020000 $filesize

1 Like

Yes, but that is for the 128MB model, mine is 64MB similar to this post.
Anyways, I did try this one on my first try, it still failed with the same error.
scorpion> tftp 0x80060000 re450bs.bin&&erase 0x9f020000 +$filesize&&cp.b $fileaddr 0x9f020000 $filesize