Unbrick TP-Link RE200v3

I was tried to install Openwrt without success and now my extender are bricked.
All led's are flashing for a 1~2 sec.

I opened the extender and connected the serial port through the USB - TTL FT232RL interface
but strange characters appear in PuTTY

screenshot

Ok.
It was a wrong baudrate. I chaged to 57600 and now i have the following message in PuTTY:

U-Boot 1.1.3 (Jul 31 2019 - 10:43:13)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
Use New Uboot
Use New Uboot patch lock_dcache addiu $12, 0x1000
******************************
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Jul 31 2019  Time:10:43:13
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
default: 3

You choosed 3
                                                                                                                                         0

3: System Boot system code via Flash.
gpioMode1 Reg: 0x571504c4
gpioMode2 Reg: 0x5550555
tplink_turn_off_led
## Booting image at bc020000 ...
text base: ffffffff
entry point: ffffffff
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
cid reg:00010102, cid:1[04010C0D][04010C0C]
DDR Calibration DQS reg = 00008687

DDR Calibration MEMCTRL reg = 0E120003

I would try to choose 1 and load an initramfs image via tftp. If that works, you should be able to sysupgrade from there.

I can not choose an option because Putty doesn't send characters to u-boot. Nothing happens when I press key 2, 3, etc...

Try a different terminal then - cutecom on Linux is working fine. I think that HTerm gets the job done if you are on Windows. Plus the timing is crucial, at least what I remember from the v1.

1 Like

OK. I will try tomorrow and i will write the result...
Thank you for your help!

It's working with your solution to boot temporarily.
Successfully boot openwrt-21.02.5-ramips-mt76x8-tplink_re200-v3-initramfs-kernel.bin with TFPT method but after reboot it didn't boot initramfs.
How to flash permanently the initramfs image?

Copy the sysupgrade image (NOT initramfs) via scp to the RE200 and run sysupgrade. This writes the image to the flash.

Ok. I have successfully flash based on this tutorial but there is no 5GHz wlan. I want to go back to stock firmware with this command:
root@OpenWrt:/tmp# sysupgrade -v -n /tmp/oem-sysupgrade.bin -F
but i have this error:

root@OpenWrt:/tmp# sysupgrade -v -n /tmp/oem-sysupgrade.bin -F
Thu Oct 13 20:44:12 UTC 2022 upgrade: Image metadata not present
Thu Oct 13 20:44:12 UTC 2022 upgrade: Use sysupgrade -F to override this check when downgrading or flashing to vendor firmware
Image check failed.

I have prepared the image with:
./tplink-safeloader -z re200v3_eu-up-ver1-1-0-P1\[20190731-rel41250\].bin -o oem-sysupgrade.bin

What's wrong with 5GHz?

Thank you for your patience.

Idk, I don't have a v3.
Change the order of the switches and use -F first - does that work?

I'ts working with this command:
sysupgrade -F /tmp/oem-sysupgrade.bin

Now i have this loop message:

[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 21MT7628-->84] smartip: lisTX_BCN DESC a1c9b000 size = 320
MT7628--> full!
         RX[0] DESC a1c9f000 size = 4096
MT7628-->RX[1] DESC a1ca2000 size = 1024
MT7628-->RT_CfgSetMacAddress : invalid mac setting
MT7628-->AndesSendCmdMsg: Could not send in band command due to diable fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
MT7628-->Smart Carrier Sense = 0
MT7628-->RTMPSetSingleSKUParameters - the country region is 5.
MT7628-->RTMPSetSingleSKUParameters - country code is .
MT7628-->RTMPSetSingleSKUParameters - the country DFSType is 1.
MT7628-->Loading SKU file: /etc_ro/Wireless/RT2860/SingleSKU_2G_FCC.dat
MT7628-->load fw image from fw_header_image
MT7628-->AndesMTLoadFwMethod1(2182)::pChipCap->fw_len(64736)
MT7628-->FW Version:1MT7628-->
MT7628-->FW Build Date:20170411104110MT7628-->
MT7628-->CmdReStartDLRsp: WiFI FW Download Success
MT7628-->CmdAddressLenReq:(ret = 0)
MT7628-->CmdFwStartReq: override = 1, address = 1048576
MT7628-->CmdStartDLRsp: WiFI FW Download Success
MT7628-->MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
efuse_probe: efuse = 10000002
MT7628-->RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
MT7628-->RtmpEepromGetDefault::e2p_dafault=2
MT7628-->RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
MT7628-->NVM is FLASH mode
MT7628-->1. Phy Mode = 14
MT7628-->Country Region from e2p = ffff
tssi_1_target_pwr_g_band = 34
MT7628-->2. Phy Mode = 14
MT7628-->3. Phy Mode = 14
MT7628-->NICInitPwrPinCfg(11): Not support for HIF_MT yet!
MT7628-->NICInitializeAsic(651): Not support rtmp_mac_sys_reset () for HIF_MT yet!
MT7628-->MtAsicInitMac()-->
MT7628-->mt7628_init_mac_cr()-->
MT7628-->MtAsicSetMacMaxLen(1276): Set the Max RxPktLen=1024!
MT7628-->AntCfgInit(2974): Not support for HIF_MT yet!
MT7628-->MCS Set = ff ff 00 00 01
MT7628-->MtAsicSetChBusyStat(861): Not support for HIF_MT yet!
MT7628-->[DEBUG]zhulin:MacByte = 2
MT7628-->[DEBUG]zhulin:Value = 4c0f0f0f
MT7628-->[DEBUG]zhulin:BssidNum = 2
MT7628-->[DEBUG]zhulin:Value = 4c0f0f0f
MT7628-->[DEBUG]zhulin:MacMask = ef
MT7628-->[DEBUG]zhulin:idx = 0, MAC = 00:0c:43:e1:76:c0
MT7628-->[PMF]ap_pmf_init:: apidx=0, MFPC=0, MFPR=0, SHA256=0
mtk_band_steering_netlink_init 245 band steering netlink init ok
MT7628-->[DEBUG]zhulin:MacByte = 2
MT7628-->[DEBUG]zhulin:Value = 4c0f0f0f
MT7628-->[DEBUG]zhulin:BssidNum = 2
MT7628-->[DEBUG]zhulin:Value = 4c0f0f0f
MT7628-->[DEBUG]zhulin:MacMask = ef
MT7628-->[DEBUG]zhulin:idx = 1, MAC = 02:0c:43:f1:76:c0
MT7628-->[PMF]ap_pmf_init:: apidx=1, MFPC=0, MFPR=0, SHA256=0
mtk_band_steering_netlink_init 245 band steering netlink init ok
MT7628-->MtAsicSetRalinkBurstMode(3060): Not support for HIF_MT yet!
MT7628-->MtAsicSetPiggyBack(796): Not support for HIF_MT yet!
MT7628-->MtAsicSetTxPreamble(3039): Not support for HIF_MT yet!
MT7628-->MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
MT7628-->Main bssid = 00:0c:43:e1:76:c0
MT7628--><=== APStartUp, clear ApCliAutoConnectRunning
<==== rt28xx_init, Status=0
MT7628-->@@@ ed_monitor_exit : ===>
MT7628-->@@@ ed_monitor_exit : <===
MT7628-->mt7628_set_ed_cca: TURN OFF EDCCA  mac 0x10618 = 0xd7083f0f, EDCCA_Status=0
MT7628-->WiFi Startup Cost (ra0): 1.064s
error mode : -1[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
MT7628-->ApSiteSurvey: BssTableInit!!!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
MT7628-->ibus_set_msg 2184] smartip: listen_event full!
         SYNC - End of SCAN, restore to 40MHz channel 4, Total BSS[07]
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
[smartip_receive_event 64] smartipd received action: 2
[smartip_ibus_set_msg 2184] smartip: listen_event full!
MT7628-->SYNC - End of SCAN, restore to 40MHz channel 4, Total BSS[08]
...

I want to flash a full dump of EEPROM (W25Q64JV) but i don't have a BACKUP image of EEPROM for re200 v3.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.