Re: [LEDE-DEV] Archer c7 corrupted firmware bootloop - tftp aborting - serial not working

[Russell Senior]

> "Alberto" == Alberto Bursi  writes:

Alberto> On 06/04/2017 02:54 PM, QWeRKUS qwErkus wrote:
>> Thank you for your reply. JTAG seems even trickier than serial. So
>> far all my attempts to scan for a valid JTAG chain end up with:
>> 
>> Error: JTAG scan chain interrogation failed: all zeroes
>> 
>> There a just too many variables to check for a newbie like myself, so
>> I guess I'll go with the spi programmer. Turns out this is another
>> thing the pi can do (via flashrom) so no need for new hardware. Are
>> you sure you need to desolder the chip though ? Shouldn't this be
>> working with a 8 pin SOIC clamp and and external 3.3V power source (I
>> have an old ATX PSU doing the job) ?
>> 
>> 
Alberto> It should, but in some cases it does not (depends from how the
Alberto> board was designed) and in those situations you need to
Alberto> desolder the chip. I got most of these "cases where it does not
Alberto> work" in PC and laptop boards though.

If the CPU is trying to access the SPI bus at the same time, it can be
problematic.  On a TP Link WDR3600 board, I had to figure out how to
hold the CPU in reset.  You might be able to do that from the JTAG nSRST
pin.  Make sure it's connected.  On the WDR3600 board, there was a shunt
resistor missing.

  http://www.jtagtest.com/pinouts/ejtag

Tie nSRST to ground with a jumper wire or similar, attach your SOIC
clip, and run flashrom.


-- 
Russell Senior, President
russ...@personaltelco.net

___
Lede-dev mailing list
Lede-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/lede-dev

Re: [LEDE-DEV] Archer c7 corrupted firmware bootloop - tftp aborting - serial not working

[Alberto Bursi]

On 06/04/2017 02:54 PM, QWeRKUS qwErkus wrote:
> Thank you for your reply. JTAG seems even trickier than serial. So far
> all my attempts to scan for a valid JTAG chain end up with:
>
> Error: JTAG scan chain interrogation failed: all zeroes
>
> There a just too many variables to check for a newbie like myself, so
> I guess I'll go with the spi programmer. Turns out this is another
> thing the pi can do (via flashrom) so no need for new hardware. Are
> you sure you need to desolder the chip though ? Shouldn't this be
> working with a 8 pin SOIC clamp and and external 3.3V power source (I
> have an old ATX PSU doing the job) ?
>
>
It should, but in some cases it does not (depends from how the board was 
designed) and in those situations you need to desolder the chip. I got 
most of these "cases where it does not work" in PC and laptop boards though.

-Alberto
___
Lede-dev mailing list
Lede-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/lede-dev

Re: [LEDE-DEV] Archer c7 corrupted firmware bootloop - tftp aborting - serial not working

[QWeRKUS qwErkus]

Thank you for your reply. JTAG seems even trickier than serial. So far
all my attempts to scan for a valid JTAG chain end up with:

Error: JTAG scan chain interrogation failed: all zeroes

There a just too many variables to check for a newbie like myself, so
I guess I'll go with the spi programmer. Turns out this is another
thing the pi can do (via flashrom) so no need for new hardware. Are
you sure you need to desolder the chip though ? Shouldn't this be
working with a 8 pin SOIC clamp and and external 3.3V power source (I
have an old ATX PSU doing the job) ?

many thanks for your help,

qwerkus

On Sun, Jun 4, 2017 at 1:19 PM, Russell Senior
 wrote:
>> "QWeRKUS" == QWeRKUS qwErkus  writes:
>
> QWeRKUS> Thank you for your replies. Turns out the problem was the
> QWeRKUS> ground connection, and serial nowworks with
> QWeRKUS> pl2303. Unfortunately I mixed up 2 addresses when flashing the
> QWeRKUS> new firmware, and erased from 0x9f00 on instead of
> QWeRKUS> 0x9f02. As a result, my boot loader is corrupt. Now I'm
> QWeRKUS> trying some last resort salvage over JTAG, using an rpi with
> QWeRKUS> openocd as JTAG dongle. Assuming I manage to compile openocd
> QWeRKUS> with ath79 support (which currently fails), can I use the
> QWeRKUS> u-boot from pepe2k to restore my uboot ? I yes, how does it
> QWeRKUS> work: just copying the bin to flash from 0x9f00 onwards ?
>
> Another approach is to write the flash with an external programmer.  You
> might need to desolder the flash chip, if you can't figure out how to
> hold the CPU in reset.  It looks like the c7 has a regular SPI flash
> chip.  It is probably just an 8-pin part, and not too hard to desolder,
> if you need to.  Solder wick is handy for cleaning up the pads after you
> remove it.
>
> I have recently used a bus pirate or a teensy 3.1 with the flashrom
> program to read/write spi flash.  Likely to be Way easier that trying to
> figure out JTAG.  Make *very* sure you have a (or several) complete
> backup of the flash part before writing over it.
>
>
> --
> Russell Senior, President
> russ...@personaltelco.net

___
Lede-dev mailing list
Lede-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/lede-dev

Re: [LEDE-DEV] Archer c7 corrupted firmware bootloop - tftp aborting - serial not working

[Russell Senior]

> "QWeRKUS" == QWeRKUS qwErkus  writes:

QWeRKUS> Thank you for your replies. Turns out the problem was the
QWeRKUS> ground connection, and serial nowworks with
QWeRKUS> pl2303. Unfortunately I mixed up 2 addresses when flashing the
QWeRKUS> new firmware, and erased from 0x9f00 on instead of
QWeRKUS> 0x9f02. As a result, my boot loader is corrupt. Now I'm
QWeRKUS> trying some last resort salvage over JTAG, using an rpi with
QWeRKUS> openocd as JTAG dongle. Assuming I manage to compile openocd
QWeRKUS> with ath79 support (which currently fails), can I use the
QWeRKUS> u-boot from pepe2k to restore my uboot ? I yes, how does it
QWeRKUS> work: just copying the bin to flash from 0x9f00 onwards ?

Another approach is to write the flash with an external programmer.  You
might need to desolder the flash chip, if you can't figure out how to
hold the CPU in reset.  It looks like the c7 has a regular SPI flash
chip.  It is probably just an 8-pin part, and not too hard to desolder,
if you need to.  Solder wick is handy for cleaning up the pads after you
remove it.  

I have recently used a bus pirate or a teensy 3.1 with the flashrom
program to read/write spi flash.  Likely to be Way easier that trying to
figure out JTAG.  Make *very* sure you have a (or several) complete
backup of the flash part before writing over it.


-- 
Russell Senior, President
russ...@personaltelco.net

___
Lede-dev mailing list
Lede-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/lede-dev

Re: [LEDE-DEV] Archer c7 corrupted firmware bootloop - tftp aborting - serial not working

[QWeRKUS qwErkus]

Thank you for your replies. Turns out the problem was the ground
connection, and serial nowworks with pl2303. Unfortunately I mixed up
2 addresses when flashing the new firmware, and erased from 0x9f00
on instead of 0x9f02. As a result, my boot loader is corrupt. Now
I'm trying some last resort salvage over JTAG, using an rpi with
openocd as JTAG dongle. Assuming I manage to compile openocd with
ath79 support (which currently fails), can I use the u-boot from
pepe2k to restore my uboot ? I yes, how does it work: just copying the
bin to flash from 0x9f00 onwards ?

Many thanks for your help, qwerkus

On Thu, Jun 1, 2017 at 11:52 AM, Tom Psyborg  wrote:
> you should've flashed https://github.com/pepe2k/u-boot_mod as soon as you
> switched from stock to openwrt. uart is not that reliable. i've made similar
> mistake while testing TL-MR22U and got brick because of too little RAM. i
> had to open device and mess with flash chip.
>
> On 1 June 2017 at 11:33, Russell Senior  wrote:
>>
>> > "QWeRKUS" == QWeRKUS qwErkus  writes:
>>
>> QWeRKUS> Hello, Something went wrong with my last flash of an archer c7
>> QWeRKUS> v2, and now the device refuses to boot. I'm trying to unbrick
>> QWeRKUS> it without success since.
>>
>> QWeRKUS> 2. I tried to get a serial access to the device, unfortunately
>> QWeRKUS> all I get is gibberish. Tried 115200 and 9600 baudrates, 8 bit,
>> QWeRKUS> no parity, 1 stop bit, no flow control with either CP2102 or
>> QWeRKUS> PL2303 usb uart dongles.  Also, I can't boot the device with
>> QWeRKUS> the ground wire from either uart plugged in. Lights turns on,
>> QWeRKUS> and just freeze.
>>
>> QWeRKUS> Wasted tons of hours on this, and would really be thankful for
>> QWeRKUS> any advice/pointers.
>>
>> Sounds like you are connecting your serial wrong.
>>
>>
>> --
>> Russell Senior, President
>> russ...@personaltelco.net
>>
>> ___
>> Lede-dev mailing list
>> Lede-dev@lists.infradead.org
>> http://lists.infradead.org/mailman/listinfo/lede-dev
>
>

___
Lede-dev mailing list
Lede-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/lede-dev

Re: [LEDE-DEV] Archer c7 corrupted firmware bootloop - tftp aborting - serial not working

[Russell Senior]

> "QWeRKUS" == QWeRKUS qwErkus  writes:

QWeRKUS> Hello, Something went wrong with my last flash of an archer c7
QWeRKUS> v2, and now the device refuses to boot. I'm trying to unbrick
QWeRKUS> it without success since.

QWeRKUS> 2. I tried to get a serial access to the device, unfortunately
QWeRKUS> all I get is gibberish. Tried 115200 and 9600 baudrates, 8 bit,
QWeRKUS> no parity, 1 stop bit, no flow control with either CP2102 or
QWeRKUS> PL2303 usb uart dongles.  Also, I can't boot the device with
QWeRKUS> the ground wire from either uart plugged in. Lights turns on,
QWeRKUS> and just freeze.

QWeRKUS> Wasted tons of hours on this, and would really be thankful for
QWeRKUS> any advice/pointers.

Sounds like you are connecting your serial wrong.


-- 
Russell Senior, President
russ...@personaltelco.net

___
Lede-dev mailing list
Lede-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/lede-dev

Re: [LEDE-DEV] Archer c7 corrupted firmware bootloop - tftp aborting - serial not working

[Kevin Darbyshire-Bryant]

On 01/06/17 09:27, QWeRKUS qwErkus wrote:

Hello,

Something went wrong with my last flash of an archer c7 v2, and now
the device refuses to boot. I'm trying to unbrick it without success
since.



Wasted tons of hours on this, and would really be thankful for any
advice/pointers.


Advice that I posted to IRC apparently 30 mins after you'd left:

I've found the Archer C7's ground pin on the serial header a right 
bastard to solder in the past - TX & RX ok.  It gives the same symptoms 
as incorrect baud rate.  Baud rate is 115200, 8, n


Once serial is good '16MB serial recovery' from 
https://wiki.openwrt.org/toh/tp-link/archer-c5-c7-wdr7500 should help.
which is basically 'tftp file into RAM, erase flash after bootloader, 
copy RAM into flash (after bootloader)



Kevin

___
Lede-dev mailing list
Lede-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/lede-dev

[LEDE-DEV] Archer c7 corrupted firmware bootloop - tftp aborting - serial not working

[QWeRKUS qwErkus]

Hello,

Something went wrong with my last flash of an archer c7 v2, and now
the device refuses to boot. I'm trying to unbrick it without success
since.

1. TFTP seems to work, and I can send a recovery bin. I used a
stripped firmware from here
http://www.friedzombie.com/tplink-stripped-firmware/ - which used to
work great.
Unfortunately the router drops the connection after 30seconds without
installing the new firmware. The openwrt wiki mentions the possibility
of a header incompatibility when the flashing is corrupted, causing
the TFTP recovery service to reject the new firmware. The whole thing
is rather cryptic to me, and any help would be greatly appreciated.

2. I tried to get a serial access to the device, unfortunately all I
get is gibberish. Tried 115200 and 9600 baudrates, 8 bit, no parity, 1
stop bit, no flow control with either CP2102 or PL2303 usb uart
dongles.
Also, I can't boot the device with the ground wire from either uart
plugged in. Lights turns on, and just freeze.

Wasted tons of hours on this, and would really be thankful for any
advice/pointers.

best regards,

Felix

___
Lede-dev mailing list
Lede-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/lede-dev