The TP-Link RE200 is a wall-pluggable dual-band wireless range extender (802.11b/g/n and 802.11a/n/ac) based on the MediaTek SoCs with an Ethernet port. The RE200v1 is based on a MT7620A SoC, while the RE200v2 and RE200v3 are based on a MT7628A SoC.
It is possible to install OpenWrt via the TP-Link web interface, but you need to prepare the image first.
Automatic image preparation
A GUI tool for creating a web-flashable image based on an original TP-Link firmware image and an OpenWrt image is available at https://www.aboehler.at/doku/doku.php/projects:re200. Follow the instructions there or in the software. The software basically automates the below steps.
Manual image preparation
You need an original firmware, the -factory.bin image as well as a tool to fix the image checksum. The below steps worked for me (Warning: The firmware upgrade overwrites the boot loader and there is no recovery mode present!):
Then, the Header MD5sum1 needs to be fixed. You can use mktplinkfw -i stock_upgrade.bin to find out the correct MD5 sum and a hex editor to change the bytes of the header sum. The web interface now happily accepts the image.
Web Interface Method (v2)
Simply install the -factory.bin image via the stock web interface. This procedure does not overwrite U-Boot, hence you have higher chances of being able to recover from a bad flash.
Serial (v1 and v2)
You need to configure a TFTP server at 192.168.0.10 and put the -factory.bin image as “test.bin”. Then, interrupt the boot loader by pressing '2', accept the defaults and OpenWrt will be installed to flash.
Back to Stock (v1)
Download an OEM firmware from TP-Link and prepare it as follows (we need to strip the first 0x200 bytes TP-Link header and the next 0x20000 bytes U-Boot):
Transfer the resulting file to /tmp on the device, then run sysupgrade /tmp/sysupgrade.bin -F on the device. -F is necessary because the firmware does not have the upgrade metadata appended.
Attention: After the first reboot, you must flash an OEM firmware upgrade from the web interface. If you fail to do so, your device will not boot afterwards and you have to flash via Serial Console to recover your device!
The case is welded together and you can't open it easily. I used a swivel vise to crack open the case. If done carefully, it only leaves a few small marks. I super-glued mine back together after porting OpenWrt.
Serial port: TTL voltage, 57600 bps, 8N1.
Interrupting U-Boot depends on your terminal: for interrupting U-Boot, you must not send a line feed!
U-Boot 1.1.3 (Aug 19 2014 - 17:43:44)
Board: Ralink APSoC DRAM: 64 MB
relocate_code Pointer at: 83fb4000
enable ephy clock...done. rf reg 29 = 5
spi device id: 1c 30 17 1c 30 (30171c30)
find flash: EN25Q64
Ralink UBoot Version: 220.127.116.11
This UBoot has been rewritten by TPLINK *_*
ASIC 7620_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Aug 19 2014 Time:17:43:44
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 580 MHZ ####
estimate memory size =64 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
6: Load ART data then write to Flash via TFTP.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
You choosed 4
raspi_read: from:20028 len:6
4: System Enter Boot Command Line Interface.
U-Boot 1.1.3 (Aug 19 2014 - 17:43:44)
MT7620 # ?
? - alias for 'help'
bootm - boot application image from memory
cp - memory copy(add cp.b by HouXB)
erase - erase SPI FLASH memory
go - start application at address 'addr'
help - print online help
loadb - load binary file over serial line (kermit mode)
md - memory display
mdio - Ralink PHY register R/W command !!
mm - memory modify (auto-incrementing)
nm - memory modify (constant address)
printenv- print environment variables
reset - Perform RESET of the CPU
rf - read/write rf register
saveenv - save environment variables to persistent storage
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
version - print monitor version
MT7620 # printenv
Environment size: 152/4092 bytes
toh/tp-link/re200.txt · Last modified: 2020/01/28 18:07 by andyboeh