Hey all, have been following this thread for a couple of weeks now. I was able to build an image successfully (greater than 4MB too) but not able to flash via WebUI. I made the mistake of upgrading stock/original firmware from the one shipped, which was dated back in 2015, same version as joaopaulo.mello has on this second unit.

I have the EU unit, V1 same as joaopaulo.mello, however, all 3 firmwares on TP-Link site will error an OpenWRT image. I also attempted to build their sources, successful in that, but the same Checksum Error flashing through WebUI. Currently running the 1.0.0 Build 20160727 Rel. 63203 firmware.

Does anyone know if this new u-boot in the 2016 firmwares will lock out (go brick) with an OpenWRT image if I go Serial/TFTP?

It's my guess that the newer firmwares have bundled some lock out, as on the UK site they state;

The EU firmware was specialized for CE certification and can’t be downgraded to other version, please click here for choosing your region and selecting the most suitable firmware version to upgrade.

This is a binwalk from their sources firmware; re450_eu-flash-ver1-0-0-P1[20161003-rel79314].bin

14608         0x3910          U-Boot version string, "U-Boot 1.1.4 (Oct  3 2016 - 21:43:37)"
15952         0x3E50          uImage header, header size: 64 bytes, header CRC: 0x38455E33, created: Mon Oct  3 21:43:39 2016, image size: 38353 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0x27EAADED, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
16016         0x3E90          LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 100972 bytes
131072        0x20000         TP-Link firmware header, firmware version: 0.0.0, image version: "ver. 1.0", product ID: 0x0, product version: 0, kernel load address: 0x80002000, kernel entry point: 0x801930C0, kernel offset: 512, kernel length: 771359, rootfs offset: 0, rootfs length: 0, bootloader offset: 0, bootloader length: 0
131584        0x20200         LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2207564 bytes
917504        0xE0000         Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 3218894 bytes,  562 inodes, blocksize: 1048576 bytes, created: Mon Oct  3 22:01:44 2016

Which is the flash image, the upgrade image; re450_eu-up-ver1-0-0-P1\[20161003-rel79314\].bin

22820         0x5924          U-Boot version string, "U-Boot 1.1.4 (Oct  3 2016 - 21:43:37)"
24164         0x5E64          uImage header, header size: 64 bytes, header CRC: 0x38455E33, created: Mon Oct  3 21:43:39 2016, image size: 38353 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0x27EAADED, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
24228         0x5EA4          LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 100972 bytes
62582         0xF476          TP-Link firmware header, firmware version: 0.0.0, image version: "ver. 1.0", product ID: 0x0, product version: 0, kernel load address: 0x80002000, kernel entry point: 0x801930C0, kernel offset: 512, kernel length: 771359, rootfs offset: 0, rootfs length: 0, bootloader offset: 0, bootloader length: 0
63094         0xF676          LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2207564 bytes
834454        0xCBB96         Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 3218894 bytes,  562 inodes, blocksize: 1048576 bytes, created: Mon Oct  3 22:01:44 2016

(Last edited by grodders on 31 Oct 2016, 16:58)

1) I have booted OpenWRT with EU firmware from May 30th using UART/TFTP, but I have not flashed it yet. I only made a build with initramfs and booted that. Worked absolutely fine.

2) If somebody is interested, I re-based the patches from mailing list on top of recent LEDE version, see my github for patches: github.com/dasty/lede-source/commits/TP-RE450 with initramfs this works well (including 4.4 kernel), but have not tried to flash it yet (only tested using initramfs). Please be aware the branch is still work in progress.

3) I have also managed to get quite an old firmware re450_eu-up-ver1-0-0-P1[20150611-rel60542].bin, which is even older than the one joaopaulo.mello used. If interested here is its binwalk:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
22820         0x5924          U-Boot version string, "U-Boot 1.1.4-gedb11d65-dirty (Jun 11 2015 - 16:40:54)"
22884         0x5964          CRC32 polynomial table, big endian
24180         0x5E74          uImage header, header size: 64 bytes, header CRC: 0xBF80DE71, created: 2015-06-11 08:40:54, image size: 39492 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0xDF8B1D0C, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
24244         0x5EB4          LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 105244 bytes
63737         0xF8F9          TP-Link firmware header, firmware version: 0.0.0, image version: "", product ID: 0x0, product version: 0, kernel load address: 0x0, kernel entry point: 0x80002000, kernel offset: 0, kernel length: 512, rootfs offset: 771467, rootfs length: 0, bootloader offset: 0, bootloader length: 0
64249         0xFAF9          LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2207564 bytes
835717        0xCC085         Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 3231393 bytes, 563 inodes, blocksize: 1048576 bytes, created: 2015-06-11 08:48:59

(Last edited by radekdostal on 31 Oct 2016, 18:48)

Is openwrt running stable and smoothly on your RE450s?  Any issues?

Just patched and compiled git checkout c3161b06c706b65d66d6ae443d4549fc942ebc97 from Jan 7 without problems.  Would be ready to flash...

At least for me it is. Buuuut I'm using only as a AP, not routing. The router it's a OpenWRT eletrikR4in running in a Supermicro atom server.
I'm still struggling with buildroot to generate a 8MB root partition, I'm stuck with 4MB and I'm afraid to break something messing the things up, still waiting for someone with a hint on how to solve this.
About stability: First unit is running with heavy traffic for one month now without any problems, no reboots, no crashes.

Hi @radekdostal
I try to building firmware from your github and make two patches:
one important: fix build sysupgrade image: ftp://tplink-forum.pl/temp/sysupgrade.patch
second: Renaming LED accordance with the standard: ftp://tplink-forum.pl/temp/ledfix.patch

Flash firmware from webgui works OK ( have old UN wersion)
Sysupgrade LEDE - OK
and create back_to_stock.bin firmware to back to my old version ( i dont know if this work if You have EU firmware) - OK

Hi. i just recently bought an RE450 UE-version, currently  running 1.0.0 Build 20160727 Rel. 63203

Does anyone be so kind to share me a firmware to a stable OpenWRT ?
I kind of need the RE450 to work as AP mode with multiple VLAN, multi-SSID and mixed WPA-PSK + enterprise Authentication.

thanks in advance.

thx guys, with all your patches i built an image and flashed it via webui (i have the EU-version), and everything just worked OOTB

any plans to upstream it? (to LEDE, i'd suggest)

(Last edited by nortii on 9 Nov 2016, 18:55)

One question, did you end up with a 8 MB root partition?

Thank you very much for these patches, they seem to make sense and I am including them into my github branch as a fixups with credit given in the commit message. Unfortunately, the factory image is still not compatible with newer firmware (20160530) I have on my device. I get following messages in the console, when trying to flash it:

[device_error: sysmgr_cfg_checkSupportList:950]00000000 NOT Match.


Firmware not supports, check failed.

[NM_Error](nm_checkUpdateContent) 00809: hardware version not support

[NM_Error](nm_buildUpgradeStruct) 00912: checkUpdateContent failed.


[utilities_error: swCheckFirm:292]build upgrade struct failed!

[Error]wrpSockGetReponseNew():  797 @ wmnetTcpRead recv header error[4]!
[Error]wrpDoSockCmdNew(): 1480 @ wrpSockGetReponse failed
[WRP][_wrpOpDo:75]Fail to do sock!
[Error]wrpSockGetReponseNew():  797 @ wmnetTcpRead recv header error[4]!
[Error]wrpDoSockCmdNew(): 1480 @ wrpSockGetReponse failed
[WRP][_wrpOpDo:75]Fail to do sock!
[Error]wrpSockGetReponseNew():  797 @ wmnetTcpRead recv header error[4]!
[Error]wrpDoSockCmdNew(): 1480 @ wrpSockGetReponse failed
[WRP][_wrpOpDo:75]Fail to do sock!

sorry, this does not exist yet. I can only post version for 2015 builds.

you are welcome, I would like to sort out an issue with flashing to newer firmware version, before sending it upstream, but if I do not have enough time I will send it to upstream (LEDE) as is.

BTW: do you remember which version of firmware you had originally when you did upgrade over webui?

(Last edited by radekdostal on 10 Nov 2016, 11:41)

Hi Everybody,

I believe I may have figured out an issue with flashing to newer firmware versions such as (1.0.0 Build 20160727 Rel. 63203.) This seem to made the trick:

diff --git a/tools/firmware-utils/src/tplink-safeloader.c b/tools/firmware-utils/src/tplink-safeloader.c
index bd70f73..843b0c1 100644
--- a/tools/firmware-utils/src/tplink-safeloader.c
+++ b/tools/firmware-utils/src/tplink-safeloader.c
@@ -247,7 +247,14 @@ static const char eap120_support_list[] =
 */
 static const char re450_support_list[] =
        "SupportList:\r\n"
-       "{product_name:RE450,product_ver:1.0.0,special_id:00000000}\r\n";
+       "{product_name:RE450,product_ver:1.0.0,special_id:00000000}\r\n"
+       "{product_name:RE450,product_ver:1.0.0,special_id:55530000}\r\n"
+       "{product_name:RE450,product_ver:1.0.0,special_id:45550000}\r\n"
+       "{product_name:RE450,product_ver:1.0.0,special_id:4A500000}\r\n"
+       "{product_name:RE450,product_ver:1.0.0,special_id:43410000}\r\n"
+       "{product_name:RE450,product_ver:1.0.0,special_id:41550000}\r\n"
+       "{product_name:RE450,product_ver:1.0.0,special_id:4B520000}\r\n"
+       "{product_name:RE450,product_ver:1.0.0,special_id:55534100}\r\n";
 
 #define error(_ret, _errno, _str, ...)                         \
        do {

Everything is now pushed to github. I will give it a bit more testing before sending it upstream. If anybody is interested in giving me some "tested-by" statements that would be more than appreciated.

I also pushed out the binaries, for those who just want to give it a try: https://github.com/dasty/lede-source/re … 0-20161110. - NO WARRANTY!

(Last edited by radekdostal on 10 Nov 2016, 21:47)

I'd love to, but please bear with me. i am very very new to OpenWRT.
Looking at your github, which of the 3 files should i begin with ?
my device currently running 1.0.0 Build 20160727 Rel. 63203

thanks.

you need the one which has factory in its name, but if you are a newbe, I am not sure it is best for you to start with a device, which is not yet officially supported. This is still work in progress with very limited testing and no WARRANTY.

@radekdostal try fix conflicted files on Your PR:
target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt

I just did that (again) - seems like that conflicts are appearing faster than maintainers picking the merge requests.

If anybody wants to also test the lastest version, I uploaded the binaries to https://github.com/dasty/lede-source/re … 0-20161123

(Last edited by radekdostal on 23 Nov 2016, 20:13)

Today I bought the RE450 (EU) and have found this forum post. I'm testing the newest build from you and actually it's working pretty well. Do you plan regular releases?

I hope I will not have to make regular releases. If my code makes it upstream, it will be than released by LEDE directly.

Good to know. I tested the throughout of your release and just getting 94MBit. I tried to go back to the original firmware with mtd write and it seems i bricked my device. On the serial i get the following. Have you tried to go back to original software yet? How can i fix this:

U-Boot 1.1.4 (Dec  3 2015 - 14:05:31)

ap135 - Scorpion 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 133k for U-Boot at: 87fdc000
Reserving 192k for malloc() at: 87fac000
Reserving 44 Bytes for Board Info at: 87fabfd4
Reserving 36 Bytes for Global Data at: 87fabfb0
Reserving 128k for boot params() at: 87f8bfb0
Stack Pointer at: 87f8bf98
Now running in RAM - U-Boot at: 87fdc000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
No valid address in Flash. Using fixed address
Scorpion  ----> AR8033 PHY *
AR8033 PHY init
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x18116290 to 0x58b0214f
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Stream with EOS marker is not supportedLZMA ERROR 1 - must RESET board to recover

1) I have not tried going back to the original firmware.

2) Please be aware, that original firmware and LEDE firmware have different partition layout - LEDE kernel is much bigger than original one. On the other hand as kernel partition is bigger, if you used the LEDE partition layout when flashing it back it should get stuck at corrupted rootfs and not so early.

3) As you have serial available I would recommend booting initramfs over TFTP with hacked in original partition layout "mtdparts=spi0.0:128k(u-boot),768k(kernel),5248k(rootfs),1984k(config),64k(art)" and than flashing back kernel, rootfs and config. I make a backup of RE450_V1_160530 if you need one.

Best greetings from Vienna,
Radek

I diffed the TP-RE450 and master branches of radekdostals git to look through the modifications. Then applied this patch to the up-to-date LEDE git. Compiled including luci, and flashed two brand-new TP-RE450 without any problems. Running 7 and 15 days now. Connects at Tx rate up to 1300.
One minor bug I came across: ntpd requires numeric IP addresses.
A cron job turns the leds off at night :-)

Thanks Radek,

that would be very helpful. Nevertheless it seem that I have bricked my device - I tried to recover it with your latest release too, but no go. I think your way could be the key - can you guide me:

scorpion> setenv ipaddr 192.168.2.6
scorpion> setenv serverip 192.168.2.103
scorpion> tftpboot 0x81000000 lede-re450.bin
Trying eth0
Checking Link: Up
Checking Duplex: Full
Checking Speed 1000BaseT
Using eth0 device
TFTP from server 192.168.2.103; our IP address is 192.168.2.6
Filename 'lede-re450.bin'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###############################################
done
Bytes transferred = 3564540 (3663fc hex)
scorpion> erase 0x9f020000 +3663fc
Erase Flash from 0x9f020000 to 0x9f38ffff in Bank # 1
First 0x2 last 0x38 sector size 0x10000
  56
Erased 55 sectors
scorpion> cp.b 0x81000000 0x9f020000 0x3663fc
Copy to Flash... write addr: 9f020000
done
scorpion> bootm 9f020000
Unknown command 'bootm' - try 'help'
scorpion> bootm 9f020000
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... Stream with EOS marker is not supportedLZMA ERROR 1 - must RESET board to recover

1) Download https://github.com/dasty/lede-source/re … kernel.bin and put it to your tftp boot directory

2) Than in your u-boot just execute

tftp 0x87000000 lede-ar71xx-generic-re450-initramfs-kernel.bin
bootm 0x87000000

3) this should boot things directly from tftp without touching flash.

=== additionally couple of questions ===

Q1: what is lede-re450.bin ?

Q2: In which mode you operated your TPLINK when you measured that 94mbps throughput? I noticed that you had relatively old version of u-boot flashed and at that time AP mode maybe was not yet supported by TP-LINK. All my test I have done were in AP mode not in the repeater mode.

(Last edited by radekdostal on 26 Nov 2016, 19:03)

@brandst check my file: ftp://tplink-forum.pl/temp/re450_back_to_stock.bin

or use LEDE sysupgrade image.

Works - but I cannot login - did you change the default admin password?

No. Try reset firmware to default or use Your old login and password, because lede not erase settings from factory firmware.

I just did that - had forgotten it :-) Thanks for all your help.