Topic: CPE210 v1.1 recovery

Hi,

I recently bought this router and tried to flash several images in several ways: lede, stock and openwrt, via web UI and via tftp and providing the image as recovery.bin. The router complains "Incorrect file". Since it seems that I haven't any other options I decide to run the router with its stock image. Before I installed the router on the roof, I made some hardware modifications, so now I can remotely perform a factory reset and its serial console is available via a serial device server. I mention that, because it means that the device is absolutely beyond warranty with all that soldering!

This morning I give it another try and for any reason I was able to first install the current stock image to the router and then install a self built openwrt image both flashed via the routers web UI. I did not really care about the image I flashed and how it was build. And because their was no web UI anymore (I checked port 80 with netstat) I used the serial console to flash an image which I previosly copied with scp to that device. Since it is a sunny day and things works like a charm, I skipped thinking and performed sysupdate -F lede-something.bin.
Now when I boot the router, it outputs:

    TP-LINK SafeLoader (Build time: Jun 12 2015 - 09:49:53)
    CPU: 560MHz AHB: 225MHz DDR: 64MB
    Performing LED check..  PASS
    Press CTRL+B to enter SafeLoader: 1
    Flash Manufacturer: Unknown(0xc8)
    Flash Device ID: Unknown(0x4017)
    Data flash init failed.
    open user-config failed.
    open user-config failed.

    enet0 port4 up

    TFTP server address is 192.168.0.100; our address is 192.168.0.254
    Get filename 'recovery.bin'.

    Retry count exceeded; starting again
    enet1 port3 up

    TFTP server address is 192.168.0.100; our address is 192.168.0.254
    Get filename 'recovery.bin'.
    #################################################################
    ################################
    Done.
    Bytes transferred = 4936747, 928 Kbytes/sec
    Incorrect File.
    Writting error.
    ##Warning: File is unidentiable. Try downloading

    TFTP server address is 192.168.0.100; our address is 192.168.0.254
    Get filename 'vmlinuz'.

    Retry count exceeded; starting again

    TFTP server address is 192.168.0.100; our address is 192.168.0.254
    Get filename 'vmlinuz'.
    #################################################################
    ########
    Done.
    Bytes transferred = 3732560, 927 Kbytes/sec
    Skipping non LOAD program header (type 0x70000003)
    Allocated memory for elf segment ok: addr: 0x806b3050, size 0x88df94
    Loading .text @ 0x806b3050 (128 bytes)
    Loading .text.error @ 0x806b30d0 (8 bytes)
    Loading .text.malloc @ 0x806b30d8 (104 bytes)
    Loading .text.xz_crc32 @ 0x806b3140 (68 bytes)
    Loading .text.dec_vli @ 0x806b3184 (260 bytes)
    Loading .text.index_update @ 0x806b3288 (96 bytes)
    Loading .text.crc32_validate @ 0x806b32e8 (108 bytes)
    Loading .text.lzma_len @ 0x806b3354 (588 bytes)
    Loading .text.fill_temp @ 0x806b35a0 (156 bytes)
    Loading .text.free.isra.0 @ 0x806b363c (44 bytes)
    Loading .text.xz_dec_end @ 0x806b3668 (80 bytes)
    Loading .text.dict_repeat.part.1 @ 0x806b36b8 (152 bytes)
    Loading .text.xz_dec_reset @ 0x806b3750 (76 bytes)
    Loading .text.lzma_main @ 0x806b379c (2944 bytes)
    Loading .text.__stack_chk_guard_setup @ 0x806b431c (20 bytes)
    Loading .text.__stack_chk_fail @ 0x806b4330 (8 bytes)
    Loading .text.decompress_kernel @ 0x806b4338 (4688 bytes)
    Loading .text.memcpy @ 0x806b5588 (44 bytes)
    Loading .text.memset @ 0x806b55b4 (40 bytes)
    Loading .text.memmove @ 0x806b55dc (72 bytes)
    Loading .text.__ashldi3 @ 0x806b5624 (72 bytes)
    Loading .text.startup.main @ 0x806b566c (8 bytes)
    Loading .MIPS.abiflags @ 0x806b5678 (24 bytes)
    Loading .rodata.str1.4 @ 0x806b5690 (8 bytes)
    Loading .rodata.decompress_kernel @ 0x806b5698 (108 bytes)
    Loading ___ksymtab+__ashldi3 @ 0x806b5704 (8 bytes)
    Loading __ksymtab_strings+__ashldi3 @ 0x806b570c (10 bytes)
    Loading .data @ 0x806b5720 (3708080 bytes)
    Clearing .bss @ 0x80b3ebd0 (4202496 bytes)
    Clearing .bss.__stack_chk_guard @ 0x80f40bd0 (4 bytes)
    Clearing .bss.xz_crc32_table @ 0x80f40bd4 (1024 bytes)
    Clearing .bss.malloc_count @ 0x80f40fd4 (4 bytes)
    Clearing .bss.malloc_ptr @ 0x80f40fd8 (4 bytes)
    Clearing .bss.free_mem_end_ptr @ 0x80f40fdc (4 bytes)
    Clearing .bss.free_mem_ptr @ 0x80f40fe0 (4 bytes)

    Starting kernel

    [    0.000000] Linux version 4.4.14 (hinerk@v22016124142142173.bestsrv.de) (gcc version 5.3.0 (OpenWrt GCC 5.3.0 50104) ) #4 Thu Mar 16 14:53:16 UTC 2017
    [    0.000000] bootconsole [early0] enabled
    [    0.000000] CPU0 revision is: 0001974c (MIPS 74Kc)
    [    0.000000] SoC: Atheros AR9344 rev 2
    [    0.000000] Determined physical RAM map:
    [    0.000000]  memory: 04000000 @ 00000000 (usable)
    [    0.000000] Initrd not found or empty - disabling initrd
    [    0.000000] No valid device tree found, continuing without
    [    0.000000] Zone ranges:
    [    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
    [    0.000000] Movable zone start for each node
    [    0.000000] Early memory node ranges
    [    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
    [    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
    [    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
    [    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
    [    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
    [    0.000000] Kernel command line:  rootfstype=squashfs,jffs2 noinitrd
    [    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
    [    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
    [    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
    [    0.000000] Writing ErrCtl register=00000000
    [    0.000000] Readback ErrCtl register=00000000
    [    0.000000] Memory: 57796K/65536K available (2989K kernel code, 175K rwdata, 756K rodata, 2600K init, 200K bss, 7740K reserved, 0K cma-reserved)
    [    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
    [    0.000000] NR_IRQS:51
    [    0.000000] Clocks: CPU:560.000MHz, DDR:450.000MHz, AHB:225.000MHz, Ref:40.000MHz
    [    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6825930166 ns
    [    0.000009] sched_clock: 32 bits at 280MHz, resolution 3ns, wraps every 7669584382ns
    [    0.009052] Calibrating delay loop... 278.93 BogoMIPS (lpj=1394688)
    [    0.082153] pid_max: default: 32768 minimum: 301
    [    0.087654] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
    [    0.095347] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
    [    0.106460] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
    [    0.118691] NET: Registered protocol family 16
    [    0.125443] MIPS: machine is Generic AR71XX/AR724X/AR913X based board
    [    0.146123] clocksource: Switched to clocksource MIPS
    [    0.153533] NET: Registered protocol family 2
    [    0.159529] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
    [    0.167693] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
    [    0.175085] TCP: Hash tables configured (established 1024 bind 1024)
    [    0.182584] UDP hash table entries: 256 (order: 0, 4096 bytes)
    [    0.189419] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
    [    0.197032] NET: Registered protocol family 1
    [    3.221593] futex hash table entries: 256 (order: -1, 3072 bytes)
    [    3.243811] squashfs: version 4.0 (2009/01/31) Phillip Lougher
    [    3.250660] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
    [    3.264985] io scheduler noop registered
    [    3.269609] io scheduler deadline registered (default)
    [    3.275812] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
    [    3.283725] console [ttyS0] disabled
    [    3.307987] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 2500000) is a 16550A

Because the boot interrups in previous trials with non successfully fetching a vmlinuz image via tftp, I provide this image, I took from my build experiment. Obviously something is booting but serial console disappears and a tcpdump doesn't give me any clue how I could access the router. I rebuild the image with appending 'ttyS1::respawn:/bin/ash -c /bin/login' to any inittab I found in the build environment, but I guess this will have no influence to the vmlinuz file.
Does someone have any suggestions, what I could try to bring the device in a bit more useful state? Thank you!

PS: I can skip the boot by pressing ctrl+B, which makes the router prompting for a password, I tried admin, 5up and a bunch of others but it doesn't seem to login to anything.

Re: CPE210 v1.1 recovery

Does the image you are booting have the initramfs attached, or is it just a bare kernel?

It looks like the serial console is being disabled during boot.  Have you used a kernel command line to enable the serial console, or compiled the kernel such that it always uses ttyS0?

Re: CPE210 v1.1 recovery

I thought I can see the first part of the bootlog, because the kernel starts with boot console enabled. And in the moment init continues booting the console becomes disabled because of inittab? I don't know the necessary kernel parameter to enforce serial console. Please tell me ... ok 1µs of googling and I will try console=ttyS0.

... enabling serial console did the job. Router boots, it seems that it loads my initramfs. I left some clandestine messages in /init. (By the way: I am not experienced with building images. All I do is try and error. So recommendations are appreciated. )

I can log into openwrt via ttyS0. ifconfig shows only localhost and only if I use the -a option - is this healthy? I would expect something like mtdblock in /dev but there is nothing which looks like flash memory.

Currently the router runs the initramfs and the kernel I provide. I am able to alter the kernel parameter via the kernel config. I want to flash a serious image to the routers storage, so first it might be a good idea to make the router recognize its memory. Secondly I appreciate a network connection, which will makes it a lot easier to provide the new image. I will rebuild the image from scratch to get rid of the several changes I made to the config.

Thank you Malvineous for making me rethink the serial situation

Re: CPE210 v1.1 recovery

No worries, it confused me until I realised that there are potentially three different methods for displaying boot messages - the earliest "decompressing the kernel" messages can be displayed by using an API provided by the bootloader, then the "early printk" services take over and display the first of the kernel messages, then at the point you've seen above enough of the kernel has started that it switches to the full serial console, if it has been told there is one with the command like parameter.  (Then as you have mentioned, after the kernel brings up init, it hands this serial console over to getty or similar as specified in the inittab file.)

It sounds like you might be building a generic image, lacking the drivers needed for your specific hardware.  Are you trying to add support to OpenWRT for a new device, or is there some reason why you don't want to use the precompiled image for your hardware?

If you are simply trying to recover the router from the accidental sysupdate, maybe you could bundle the files you need into the initramfs file so they are available on the router when you boot it, then through the serial console you can attempt a reflash.  You will of course need to figure out which mtdblock driver your hardware uses and build that into the kernel, otherwise it won't be able to access the flash.

If your device is supported by OpenWRT then you should be able to find the build config somewhere with all the correct drivers enabled.  Sorry I'm not familiar enough with the project to know where however, I have just done some hardware experimenting before, just like you are doing now :-)

Re: CPE210 v1.1 recovery

I actually want to debrick the device. I try to use the recommended recovery method from the wiki: renaming the stock image to recovery.bin and use tftp to provide it to the router. But the router won't accept this image. I tried both stock images I found, 1.0.0 and 1.3.3. Router says:

TFTP server address is 192.168.0.100; our address is 192.168.0.254
Get filename 'recovery.bin'.
#################################################################
###############################
Done.
Bytes transferred = 4869486, 960 Kbytes/sec
Incorrect File.
Writting error.
##Warning: File is unidentiable. Try downloading

TFTP server address is 192.168.0.100; our address is 192.168.0.254
Get filename 'vmlinuz'.

Because after trying to download recovery.bin, the router is requesting vmlinuz I tried several vmlinuz. Including building a new one.

I tried to feed the stock image to the router as vmlinuz too, but it didn't worked.

I built an image which boots and which provides a decent linux system but as you mentioned: no flash and no ethernet. I figured out that the size of the image should not raise above 5.5 MB otherwise the router dumps lot of extraordinary utf-8 and refuse booting.

In menuconfig, I select the CPE2150 /510 etc. as subtarget
in kernel_menuconfig I select CPE510. The resulting image has the name of the router. I don't now how generic it is.

Is there anywhere a configuration file, which I can use?

Re: CPE210 v1.1 recovery

I think the menuconfig options just set the architecture and show/hide certain drivers.  You still have to know which drivers to go and enable once they become visible in the menu system.  For example if you choose a device that has no USB ports, all the USB options will be hidden.  But if you choose a device that does support USB it will let you see all the USB options in the menu, but you still have to know which USB chip is in use and enable the driver for it, otherwise you'll still get a kernel without USB support.  So in your case you likely have the driver for the flash and Ethernet available, but those drivers must be configured as disabled.

Is there an OpenWRT wiki page for your device?  I'm not sure how OpenWRT build all their trunk images but they must have a collection of configuration options somewhere.

If you can't find the right config, can you find a pre-built OpenWRT image for your device?  Maybe you can extract the kernel (and initramfs) from it, then boot that, as it should have the correct drivers built in already.  If it works, it might be just enough to reflash the device with the sysupgrade file, to get OpenWRT running on it properly.

Re: CPE210 v1.1 recovery

Hi,
I am having a similar problem. This thread: viewtopic.php?id=68979 (CPE210(EU) V1.1 bricked failsave doesnt work) - sorry cannot post a link - describes it better (I cannot do anything from the serial console - pressing CTRL+B has no effect, nothing is displayed after this prompt). I also tried feeding it vmlinuz to no success. Please, keep posting your progress here, and if you manage to build a .bin that actually works for you, I would really like to try it with my device, as well - so can you please upload it somewhere.

Re: CPE210 v1.1 recovery

I have the same problem. Was to go back to the original firmware and use "mtd command" and there is no way to make it work. Who is responsible has a week and I have not yet paid and lost time. The documentation is disordered and outdated for example recovery with an arduino is incomplete and outdated. For me the router is no longer useful. Thank you

Re: CPE210 v1.1 recovery

Its been a while ...

Maybe someone can provide the /proc/config.gz file from its working device? I built a lot of kernels which I can boot on my router but I didn't figure out which are the necessary modules. There is a feature for kernel config which is called make randomconfig ... I am pretty sure, I didn't offer much more intelligence in my attemps. ;-)

Re: CPE210 v1.1 recovery

You are aware there is a prebuilt image for your router yes?

https://downloads.openwrt.org/snapshots … x/generic/

Re: CPE210 v1.1 recovery

Yes but they are not working. I recently provided a *-factory.bin as vmlinuz which results in this kernel panic:

TFTP server address is 192.168.0.100; our address is 192.168.0.254
Get filename 'vmlinuz'.
#################################################################
################################
Done.
Bytes transferred = 4928535, 251 Kbytes/sec
Allocated memory for elf segment ok: addr: 0x80260000, size 0x4cddc0
Loading .text @ 0x80261030 (4848 bytes)
Loading .rodata.str1.4 @ 0x80262320 (212 bytes)
Loading .data @ 0x80262400 (825765 bytes)
Clearing .bss @ 0x8032bdb0 (4202512 bytes)

Starting kernel

Booting Atheros AR934x
Linux version 2.6.31 (jenkins@sohoiapbuild) (gcc version 4.3.3 (GCC) ) #1 PREEMPT Tue Jul 5 10:43:05 CST 2016
flash_size passed from bootloader = 0
CPU revision is: 0001974c (MIPS 74Kc)
ath_sys_frequency: cpu srif ddr srif cpu 560 ddr 450 ahb 225
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:04 rootfstype=squashfs init=/init mtdparts=ath-nor0:128k(u-boot),64k(pation-table),64k(product-info),1536k(kernel),6144k(rootfs),192k(config),64k(ART) mem=64M
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 62388k/65536k available (1836k kernel code, 3080k reserved, 476k data, 116k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 279.55 BogoMIPS (lpj=559104)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
net_link: create socket ok.
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/O].
msgmni has been set to 121
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
7 cmdlinepart partitions found on MTD device ath-nor0
Creating 7 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000030000 : "pation-table"
0x000000030000-0x000000040000 : "product-info"
0x000000040000-0x0000001c0000 : "kernel"
0x0000001c0000-0x0000007c0000 : "rootfs"
0x0000007c0000-0x0000007f0000 : "config"
0x0000007f0000-0x000000800000 : "ART"
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
athwdt_timer_init: Starting WDT.
ath_otp_init: Registering OTP success
ath_clksw_init: Registering Clock Switch Interface success
List of all partitions:
1f00             128 mtdblock0 (driver?)
1f01              64 mtdblock1 (driver?)
1f02              64 mtdblock2 (driver?)
1f03            1536 mtdblock3 (driver?)
1f04            6144 mtdblock4 (driver?)
1f05             192 mtdblock5 (driver?)
1f06              64 mtdblock6 (driver?)
No filesystem could mount root, tried:  squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)

Stop feeding the WatchDog (uptime = 0.44, nowtime = 00:00:00).
Dump Current Call Trace:
[<801c9fe0>] dump_stack+0x8/0x34
[<800062a0>] tpwdt_panic_event+0xf8/0x118
[<80043bb0>] notifier_call_chain+0x50/0xac
[<80044230>] __atomic_notifier_call_chain+0x24/0x60
[<80044280>] atomic_notifier_call_chain+0x14/0x20
[<801ca08c>] panic+0x80/0x13c
[<80245e30>] mount_block_root+0x2c4/0x2fc
[<802460a4>] prepare_namespace+0x1c0/0x1f4
[<80245388>] kernel_init+0x11c/0x13c
[<800094a4>] kernel_thread_helper+0x10/0x18

Kernel panic event watchdog notification done.

together with this message from the boot I think the flash passed out

TP-LINK SafeLoader (Build time: Jun 12 2015 - 09:49:53)
CPU: 560MHz AHB: 225MHz DDR: 64MB
Performing LED check..  PASS
Press CTRL+B to enter SafeLoader: 1
Flash Manufacturer: Unknown(0xc8)
Flash Device ID: Unknown(0x4017)
Data flash init failed.
open user-config failed.
open user-config failed.

Re: CPE210 v1.1 recovery

overheating maybe?

Re: CPE210 v1.1 recovery

That kernel panic says that it can't find what device the root filesystem is supposed to be on.  There are a number of possible causes for this type of problem, here are some:

  • Module for the filesystem is not available to the kernel

  • Incorrect root= option passed to kernel

  • Wrong or missing mtdblock driver (probably not this in your case as it can see the mtd partition table so the mtd driver is ok)

  • Filesystem not actually flashed to mtdblock device (or in incorrect format) and no root= option given to tell the kernel to look elsewhere

  • Missing initfs packaged up with kernel (which can function as a rudimentary root filesystem)

I'm guessing here but it looks like you extracted the vmlinuz from the -factory.bin file, but ignored the root filesystem also inside the -factory.bin file, then booted the vmlinuz and got a kernel panic when it couldn't find the root filesystem?  It looks like the kernel is working fine, you just have to figure out some way of supplying it with the root filesystem.

Re: CPE210 v1.1 recovery

If the flash is not defective, it is definitively not in expected shape, since I tried to flash lede onto the router, which then failed and rendered the router to its current state. When it is booting, the router reject every image I serve. But then it ask for vmlinuz. I figured out, I can serve the -factory.bin as vmlinuz which the router accepts but the result is this kernel panic.