Bricked TP-Link RE350, Could anyone help?
Эта ветка закрыта для дальнейших ответов. Вы можете создать новую тему, чтобы поделиться своими идеями или задать вопросы.
Bricked TP-Link RE350, Could anyone help?
Аппаратная версия устройства: ver 1.0
Провайдер: TP-Link
Тип подключения: Другой
Hi,
I used openwrt 19.07.05 version.
I didn't like it and decided to revert back to OEM firmware.
I examined the firmware file with binwalk.
I tried to strip firmware from Tp-link header (117633) wtih this command.
dd if=re350v1.bin of=kernel.bin bs=1 skip=117633
The openwrt kernel source code (tplink-safeloader.c) is below.
/** Firmware layout for the RE350 v1 */
1262 {
1263 .id = "RE350-V1",
1264 .vendor = "",
1265 .support_list =
1266 "SupportList:\n"
1267 "{product_name:RE350,product_ver:1.0.0,special_id:45550000}\n"
1268 "{product_name:RE350,product_ver:1.0.0,special_id:00000000}\n"
1269 "{product_name:RE350,product_ver:1.0.0,special_id:41550000}\n"
1270 "{product_name:RE350,product_ver:1.0.0,special_id:55530000}\n"
1271 "{product_name:RE350,product_ver:1.0.0,special_id:43410000}\n"
1272 "{product_name:RE350,product_ver:1.0.0,special_id:4b520000}\n"
1273 "{product_name:RE350,product_ver:1.0.0,special_id:4a500000}\n",
1274 .support_trail = '\x00',
1275 .soft_ver = NULL,
1276
1277 /** We're using a dynamic kernel/rootfs split here */
1278 .partitions = {
1279 {"fs-uboot", 0x00000, 0x20000},
1280 {"firmware", 0x20000, 0x5e0000},
1281 {"partition-table", 0x600000, 0x02000},
1282 {"default-mac", 0x610000, 0x00020},
1283 {"pin", 0x610100, 0x00020},
1284 {"product-info", 0x611100, 0x01000},
1285 {"soft-version", 0x620000, 0x01000},
1286 {"support-list", 0x621000, 0x01000},
1287 {"profile", 0x622000, 0x08000},
1288 {"user-config", 0x630000, 0x10000},
1289 {"default-config", 0x640000, 0x10000},
1290 {"radio", 0x7f0000, 0x10000},
1291 {NULL, 0, 0}
1292 },
1293
1294 .first_sysupgrade_partition = "os-image",
1295 .last_sysupgrade_partition = "file-system"
1296 },
The device is trying to boot but gives a kernel error as follows.
I could not find how to fix the problem here.
Log output is here from serial port.
TFTP from server 192.168.0.184; our IP address is 192.168.0.254
Filename 'kernel.bin'.
TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: T checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
T Got ARP REPLY, set server/gtwy eth addr (d8:9d:67:cf:ec:c5)
Got it
#################################################################
##################################checksum bad
checksum bad
###############################
#################################################################
##################checksum bad
###############################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###################
done
Bytes transferred = 5087112 (4d9f88 hex)
NetBootFileXferSize= 004d9f88
.............................................................................
.............................................................................
.
.
Done!
## Booting image at bfc20000 ...
text base: 80001000
entry point: 8000d1d0
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8000d1d0) ...
## Giving linux memsize in MB, 64
Starting kernel ...
LINUX started...
THIS IS ASIC
Linux version 2.6.36 (jenkins@Sohoiipf) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 SMP Thu May 16 11:59:49 CST 2019
The CPU feqenuce set to 880 MHz
GCMP present
CPU revision is: 0001992f (MIPS 1004Kc)
Software DMA cache coherency
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
Detected 3 available secondary CPU(s)
PERCPU: Embedded 7 pages/cpu @81083000 s6208 r8192 d14272 u65536
pcpu-alloc: s6208 r8192 d14272 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock3
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Writing ErrCtl register=00022621
Readback ErrCtl register=00022621
Memory: 61896k/65536k available (2062k kernel code, 3640k reserved, 448k data, 168k init, 0k highmem)
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.
NR_IRQS:128
Trying to install interrupt handler for IRQ24
Trying to install interrupt handler for IRQ25
Trying to install interrupt handler for IRQ22
Trying to install interrupt handler for IRQ9
Trying to install interrupt handler for IRQ10
Trying to install interrupt handler for IRQ11
Trying to install interrupt handler for IRQ12
Trying to install interrupt handler for IRQ13
Trying to install interrupt handler for IRQ14
Trying to install interrupt handler for IRQ16
Trying to install interrupt handler for IRQ17
Trying to install interrupt handler for IRQ18
Trying to install interrupt handler for IRQ19
Trying to install interrupt handler for IRQ20
Trying to install interrupt handler for IRQ21
Trying to install interrupt handler for IRQ23
Trying to install interrupt handler for IRQ26
Trying to install interrupt handler for IRQ27
Trying to install interrupt handler for IRQ28
Trying to install interrupt handler for IRQ15
Trying to install interrupt handler for IRQ8
Trying to install interrupt handler for IRQ29
Trying to install interrupt handler for IRQ30
Trying to install interrupt handler for IRQ31
console [ttyS1] enabled
Calibrating delay loop... 577.53 BogoMIPS (lpj=1155072)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
launch: starting cpu1
launch: cpu1 gone!
CPU revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
launch: starting cpu2
launch: cpu2 gone!
CPU revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
launch: starting cpu3
launch: cpu3 gone!
CPU revision is: 0001992f (MIPS 1004Kc)
Primary instruction cache 32kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
Brought up 4 CPUs
Synchronize counters across 4 CPUs: done.
NET: Registered protocol family 16
release PCIe RST: RALINK_RSTCTRL = 7000000
PCIE PHY initialize
***** Xtal 40MHz *****
start MT7621 PCIe register access
RALINK_RSTCTRL = 7000000
RALINK_CLKCFG1 = 77ffeff8
*************** MT7621 PCIe RC mode *************
PCIE2 no card, disable it(RST&CLK)
pcie_link status = 0x3
RALINK_RSTCTRL= 3000000
*** Configure Device number setting of Virtual PCI-PCI bridge ***
RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
PCIE0 enabled
PCIE1 enabled
interrupt enable status: 300000
Port 1 N_FTS = 1b105000
Port 0 N_FTS = 1b105000
config reg done
init_rt2880pci done
bio: create slab <bio-0> at 0
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
pci 0000:00:01.0: BAR 9: assigned [mem 0x60200000-0x602fffff pref]
pci 0000:00:00.0: BAR 1: assigned [mem 0x60300000-0x6030ffff]
pci 0000:00:00.0: BAR 1: set to [mem 0x60300000-0x6030ffff] (PCI address [0x60300000-0x6030ffff]
pci 0000:00:01.0: BAR 1: assigned [mem 0x60310000-0x6031ffff]
pci 0000:00:01.0: BAR 1: set to [mem 0x60310000-0x6031ffff] (PCI address [0x60310000-0x6031ffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff]
pci 0000:01:00.0: BAR 0: set to [mem 0x60000000-0x600fffff] (PCI address [0x60000000-0x600fffff]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0: bridge window [io disabled]
pci 0000:00:00.0: bridge window [mem 0x60000000-0x600fffff]
pci 0000:00:00.0: bridge window [mem pref disabled]
pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
pci 0000:02:00.0: BAR 0: set to [mem 0x60100000-0x601fffff 64bit] (PCI address [0x60100000-0x601fffff]
pci 0000:02:00.0: BAR 6: assigned [mem 0x60200000-0x6020ffff pref]
pci 0000:00:01.0: PCI bridge to [bus 02-02]
pci 0000:00:01.0: bridge window [io disabled]
pci 0000:00:01.0: bridge window [mem 0x60100000-0x601fffff]
pci 0000:00:01.0: bridge window [mem 0x60200000-0x602fffff pref]
PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
BAR0 at slot 0 = 0
bus=0x0, slot = 0x0
BAR0 at slot 1 = 0
bus=0x0, slot = 0x1
bus=0x1, slot = 0x0, irq=0x4
bus=0x2, slot = 0x1, irq=0x18
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
4 CPUs re-calibrate udelay(lpj = 1167360)
Load Ralink Timer0 Module
Load Ralink Timer1 Module
Load Ralink Timer2 Module
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 120
io scheduler noop registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
flash manufacture id: ef, device id 40 17
W25Q64BV(ef 40170000) (8192 Kbytes)
mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 5 MTD partitions on "raspi":
0x000000000000-0x000000800000 : "ALL"
0x000000000000-0x000000020000 : "fs-uboot"
0x000000020000-0x000000110000 : "os-image"
0x000000110000-0x000000600000 : "file-system"
0x0000007f0000-0x000000800000 : "radio"
rdm_major = 253
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <
All bugs added by David S. Miller <
List of all partitions:
1f00 8192 mtdblock0 (driver?)
1f01 128 mtdblock1 (driver?)
1f02 960 mtdblock2 (driver?)
1f03 5056 mtdblock3 (driver?)
1f04 64 mtdblock4 (driver?)
No filesystem could mount root, tried: squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,3)
How can I revert back to stock firmware?
I will go nuts.
please help.