You are here

TPLink CPE210 will not program

27 posts / 0 new
Last post
TPLink CPE210 will not program

I recently purchased a new TPlink CPE210 and can not successfully install the AREDN software.  I have done numerous Ubiquiti devices without issue.  I first tried the preferred method, and it seemed to program, but it finally got into a loop where the ethernet port would enable and disable and I was unable to acquire an IP address.  So I tried the alternate method which uses the Tiny PXE Sever, which seemed to work but ended with same result.   I thought I had bricked the device, so I downloaded the TPLink factory image from TPLink, and used the Tiny PXE server to program it.  Now I can log in using the standard IP address and access the PharOS web interface just like it was from the factory.  I have tried to program the the last official release as well as daily builds with no luck.  I have tried these processes at least 4 times and have been able to recover the factory software everytime, so I am assuming the programming is working.

I have verified my hardware is V2.
I have the correct software downloaded
I have been able to recover the factory software over and over, but cannot get AREDN software to work.  

Before I spend any more time on this, has anyone programmed a CPE210 recently?
The model number is on the unit is CPE210(US) V2.8  The PharOS software says the model is a CPE210 V2.

I have a CPE220 coming and I would like to make sure it will work. 
Any ideas?
Glenn WA3LAB


AE6XE's picture
I have a cpe210v2 donated and
I have a cpe210v2 donated and thanks to WB8LEA for support.  It had a very old image on it.  I just now did a sysupgrade to the 1190 current nightly build image.  All went well and it it is live.

Thank you for your response. 

Thank you for your response.  Could there be an issue with me uploading the factory version?

AE6XE's picture
Sometimes it can be tricky
Sometimes it can be tricky with timing.  Also, I generally use a dumb switch between the computer and the node.  This way the tftpd/dhcp/bootp server and the computer always see the ethernet link up.  If it's down/up during the process, can be problematic.    Then the tplink is powered on and ensure success in talking with the computer.    Once I see the recovery.bin is sent, then I stop the tftpd server and wait 3 or 4 minutes before touching anything, and watch the lights to see a typical AREDN boot sequence.  

I am curious as to the
I am curious as to the hardware version of your CPE210?  Mine says Model CPE210(US) Ver:2.8 .  I monitored the ethernet port during the program cycle and I see all the blocks transfer and acknowledged, and then the unit goes into the loop dispaying all LEDs and then turning off all LEDs and enabling port for 3 seconds, then repeats.  I found some references to some this type of behavior on the AREDN Facebook pages dated October 18, 2019.  I have re-programmed the device with TPLinks factory software(PharOS?)  and 45 seconds after the last packet the port comes alive and I am able to log into PharOS.  I am fairly confident the unit is being programmed, however there may be an incompatibility with Ver 2.8 hardware.  The mystery remains as to why your unit programmed, unless it is an older hardware revision?
      If there is any way I can gather any information to help find the issue, please let me know.  You helped me connect a serial port to my damaged Nanostaion, and I was able to repair the unit.  As always, thank you for you time and help.
Glenn WA3LAB
AE6XE's picture
Glenn,   This could be the

Glenn,   This could be the issue, should have caught that before.   My device on the label is "CPE210(US) Ver:2.0".   Can you boot your device with any firmware and telnet/ssh into the node, and do the following command? 

dd if=/dev/mtd2 bs=1 skip=4360 count=64 2>/dev/null | head -n 1

The output would look something like this (the prompt will show at the end, no linefeed):

What does it return?   There are hardcoded strings built into the firmware  images that have to be compatible with the device's vendor flash settings, or the bootloader won't write it to flash.  The current strings in the code to create the firmware images:
        /** Firmware layout for the CPE210/220 */
                .id     = "CPE210",
                .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
                .support_list =
                .support_trail = '\xff',
                .soft_ver = NULL,

It's likely this string on your device in the vendor flash partition is different.   Let me know what that is to push into the code.  Hopefully, there aren't any other hardware changes, if so there will be more changes to get everything working.


Sorry got sidetracked.  I had

Sorry got sidetracked.  I had to go into the PharOS management to enable SSH login, then I was able to login.  I used the password and username I had setup in PharOS.  I entered the command
 dd if=/dev/mtd2 bs=1 skip=4360 count=64 2>/dev/null | head -n 1
It responded with:
-sh: Cannot create dev/null : Permission denied
-sh: dd not found
-sh: head not found
I noticed you were logged as root.  My linux is very rusty(mostly raspberry Pi stuff).  Is that the problem?

AE6XE's picture

cat /dev/mtd2 | strings

or if that doesn't work, just do

cat /dev/mtd2

Then, scroll back through all the output, until you can see the string we are looking for.

the input file /dev/mtd2
the input file /dev/mtd2 doesn't exist.  I went to the directory and found mtd0 and mtdblock0, mtdblock1, etc up to mtdblock6.
I used cat mtdblock2 | grep CPE210 and found the string as 
CPE210(TP-LINK | US | N300-2 | 55530000):2.0
So it is the same string as you have, but in a different file.
Glenn WA3LAB
AE6XE's picture
Glenn,  are there spaces in
Glenn,  are there spaces in the string you found?  This would case it to not match up.    If this string exactly matches the code snippet string, then this issue does not explain the symptoms.  We'd revert back to loading the image to find the break down. (Did you try to upload in Pharos OS?  Been a while, use the factory aredn image and rename to recovery.bin, then upload in the Pharos UI, trying to recall.)
Unfortunately the string is

Unfortunately the string is exactly like the code snippet...No spaces.  I have tried programming through PharOS. Same result.  I just received a CPE220 V3 and it programmed first time through PharOS.  Other than the power setting (limits to 25dbm), it seems to work fine.

There is a chance its a V3.1

There is a chance its a V3.1 device. See if you can find the strings below or something similar

I did a search through all

I did a search through all the files in the dev directory that are called mtdblock0 through mtd0block6 for the string CPE210 and here are the results.  I don't really know what I'm looking for, but here it is.

$ cat mtdblock0 | grep CPE210
$ cat mtdblock1 | grep CPE210
$ cat mtdblock2 | grep CPE210
$ cat mtdblock3 | grep CPE210
$ cat mtdblock4 | grep CPE210
$ cat mtdblock5 | grep CPE210
$ cat mtdblock6 | grep CPE210

Glenn WA3LAB

Please test using the stock

Please test using the stock Openwrt binary for the device on the ath79 branch located here
Let me know if it will boot with it.

I downloaded  tplink_cpe210
I downloaded  tplink_cpe210-v2-squashfs-factory.bin  and programed it from the  PharOS system console, and it appears to boot OK.  Switched from static to DHCP on the pc and got an IP address of  Looks good so far.
That is good as it indicates

That is good as it indicates that your device is supported.
To connect with it you will need to ssh to
I suggest using scp to copy the aredn sysupgrade image for the device  to /tmp on the device and then install the image using
sysupgrade -v -n -F /tmp/imagename

Let me know it that works.

That broke it. I did a
That broke it. I did a ​sysupgrade to the 1190 current nightly build image and for a second it looked like a normal program cycle, but then it went into the cycling mode as before.  I left it sit for about 10 minutes and then cycled power just in case, but no success.  So I reloaded the openWRT image for now.
AE6XE's picture
From the Openwrt image, do a
From the Openwrt image, do a "dmesg" and attach/paste back here.   While the vendor image may work on both, there may be some hardware differences between 2.0 and 2.8.  We can compare this information between our devices to see what we find.

root@OpenWrt:~# dmesg
root@OpenWrt:~# dmesg
[    0.000000] Linux version 4.19.82 (builder@buildhost) (gcc version 8.3.0 (OpenWrt GCC 8.3.0 r11487-dfd8c45a98)) #0 Tue Nov 12 15:43:14 2019
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is TP-Link CPE210 v2
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000]   Normal zone: 144 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] random: get_random_bytes called from start_kernel+0x98/0x4b0 with crng_init=0
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 57252K/65536K available (4507K kernel code, 184K rwdata, 1056K rodata, 1220K init, 213K bss, 8284K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 650.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000010] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008280] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.074874] pid_max: default: 32768 minimum: 301
[    0.080029] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.087005] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.100192] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.110656] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.117289] pinctrl core: initialized pinctrl subsystem
[    0.126279] NET: Registered protocol family 16
[    0.168452] clocksource: Switched to clocksource MIPS
[    0.175366] NET: Registered protocol family 2
[    0.181179] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes)
[    0.189406] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.196765] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.203508] TCP: Hash tables configured (established 1024 bind 1024)
[    0.210427] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.216610] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.223771] NET: Registered protocol family 1
[    0.228408] PCI: CLS 0 bytes, default 32
[    0.232759] Crashlog allocated RAM at address 0x3f00000
[    0.240316] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.255484] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.261711] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.289526] io scheduler noop registered
[    0.293667] io scheduler deadline registered (default)
[    0.302379] pinctrl-single 1804002c.pinmux: 576 pins, size 72
[    0.309771] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.319524] console [ttyS0] disabled
[    0.323333] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.332523] console [ttyS0] enabled
[    0.340095] bootconsole [early0] disabled
[    0.362372] m25p80 spi0.0: en25qh64 (8192 Kbytes)
[    0.367306] 6 fixed-partitions partitions found on MTD device spi0.0
[    0.373963] Creating 6 MTD partitions on "spi0.0":
[    0.378951] 0x000000000000-0x000000020000 : "u-boot"
[    0.385221] 0x000000020000-0x000000030000 : "partition-table"
[    0.392257] 0x000000030000-0x000000040000 : "info"
[    0.398203] 0x000000040000-0x0000007c0000 : "firmware"
[    0.410358] 2 tplink-fw partitions found on MTD device firmware
[    0.416488] Creating 2 MTD partitions on "firmware":
[    0.421718] 0x000000000000-0x0000001ce828 : "kernel"
[    0.427959] 0x0000001d0000-0x000000780000 : "rootfs"
[    0.434124] mtd: device 5 (rootfs) set to be root filesystem
[    0.442160] 1 squashfs-split partitions found on MTD device rootfs
[    0.448653] 0x0000003d0000-0x000000780000 : "rootfs_data"
[    0.455328] 0x0000007c0000-0x0000007f0000 : "config"
[    0.461591] 0x0000007f0000-0x000000800000 : "art"
[    0.468997] libphy: Fixed MDIO Bus: probed
[    0.808925] libphy: ag71xx_mdio: probed
[    0.814382] libphy: ar8xxx-mdio: probed
[    0.825088] switch0: Atheros AR8229 rev. 1 switch registered on mdio-bus.0
[    1.220793] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:1f:04 [uid=004dd042, driver=Generic PHY]
[    1.231491] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    1.241264] NET: Registered protocol family 10
[    1.253586] Segment Routing with IPv6
[    1.257508] NET: Registered protocol family 17
[    1.262311] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.275730] 8021q: 802.1Q VLAN Support v1.8
[    1.282388] hctosys: unable to open rtc device (rtc0)
[    1.297132] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    1.314976] Freeing unused kernel memory: 1220K
[    1.319706] This architecture does not have kernel memory protection.
[    1.326355] Run /sbin/init as init process
[    2.416636] init: Console is alive
[    2.420642] init: - watchdog -
[    2.508632] random: fast init done
[    3.604573] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.782958] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.801180] init: - preinit -
[    5.114131] random: jshn: uninitialized urandom read (4 bytes read)
[    5.217959] random: jshn: uninitialized urandom read (4 bytes read)
[    5.316585] random: jshn: uninitialized urandom read (4 bytes read)
[    5.689743] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    7.781372] eth0: link up (100Mbps/Full duplex)
[    7.786180] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    8.937741] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    8.976049] urandom-seed: Seed file not found (/etc/urandom.seed)
[    9.161412] eth0: link down
[    9.180599] procd: - early -
[    9.183721] procd: - watchdog -
[    9.853599] procd: - watchdog -
[    9.857301] procd: - ubus -
[    9.890484] urandom_read: 5 callbacks suppressed
[    9.890494] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.911327] random: ubusd: uninitialized urandom read (4 bytes read)
[    9.919604] procd: - init -
[   10.777606] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.842840] Loading modules backported from Linux version v5.4-rc2-0-gda0c9ea146cb
[   10.850761] Backport generated by backports.git v5.4-rc2-1-0-g5a0c323a
[   10.944177] xt_time: kernel timezone is -0000
[   11.212539] PPP generic driver version 2.4.2
[   11.230034] NET: Registered protocol family 24
[   11.395373] ath: EEPROM regdomain: 0x0
[   11.395385] ath: EEPROM indicates default country code should be used
[   11.395388] ath: doing EEPROM country->regdmn map search
[   11.395406] ath: country maps to regdmn code: 0x3a
[   11.395412] ath: Country alpha2 being used: US
[   11.395415] ath: Regpair used: 0x3a
[   11.410457] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   11.412536] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=12
[   11.509027] kmodloader: done loading kernel modules from /etc/modules.d/*
[   11.528281] urngd: v1.0.1 started.
[   11.898814] random: crng init done
[   30.789358] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   30.796492] jffs2_build_filesystem(): unlocking the mtd device...
[   30.796497] done.
[   30.804941] jffs2_build_filesystem(): erasing all blocks after the end marker...
[   34.563004] br-lan: port 1(eth0) entered blocking state
[   34.576230] br-lan: port 1(eth0) entered disabled state
[   34.582093] device eth0 entered promiscuous mode
[   34.667027] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   36.661456] eth0: link up (100Mbps/Full duplex)
[   36.666207] br-lan: port 1(eth0) entered blocking state
[   36.671673] br-lan: port 1(eth0) entered forwarding state
[   36.709234] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   48.152180] done.
[   48.154226] jffs2: notice: (1188) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xre              f (0 dead, 0 orphan) found.
[   48.342991] overlayfs: upper fs does not support tmpfile.
Try the following the images
I hope I did this correctly.
I hope I did this correctly.
I used Tiny PXE server to flash each version, and I used the FACTORY version, NOT the upgrade.
1. openWrt  18.06.5  Goes into loop, no access
2. openWrt  19.07.0  Boots, DHCP active, can login via SSH
3. AREDN 3.19  Goes into loop, no access
AE6XE's picture
Your dmesg shows the flash
Your dmesg shows the flash chip is "​en25qh64".   My device shows the flash chip is "gd25qh64".  I have found this new flash chip definition is added in openwrt 19.07 branch, but does not exist in the 18.06.x branch the AREDN nightly build is currently based on.  We are currently upgrading to this  openwrt 19.07 branch and will inherit the needed update.   

Here is a bleeding edge AREDN image to test, link below.  If this solves the issue, then we are days away from getting this in the nightly build.

Note, installing packages is not available on these image, would be available when in the nightly build.


CPE 210 v 2.8 issue
Was this issue resolved? I recently purchased a CPE210 v 2.8 and i cannot get the initial firmware to load. I have tried both versions as listed. The web updtae and the pxe method to no avail. Any suggestions? Thank you. Barney

I took a little extra time to complete the configuration to make sure everything else is good.  So far so good.  I attached a picture
Thanks Joe and KK4ZUZ, I don't even know your name.  I'll be watching for the new nightly build to check it out.  Thanks again.
Glenn WA3LAB


Image Attachments: 
Great. I am glad its working

Great. I am glad its working for you :)
As Joe said it will be fully supported once we change to 19.07 build of openwrt which is currently undergoing testing.

Andrew (KK4ZUZ)

K6AH's picture
KK4ZUZ is Andrew
KK4ZUZ is Andrew, the development team's TP-Link all star!
KA7HAK's picture
Thanks It's working here as well
I too have been struggling with the '2.8' CPE210 recently purchased from Amazon. Just downloaded the image and loaded it on via tftp (aredn-ae6xe-19.07-1272c57-r10675-5e1864da33-cpe210-v2-factory).  Thanks everyone and Glen/Orv for the heads up.


Theme by Danetsoft and Danang Probo Sayekti inspired by Maksimer