Archer A7 V5 (EU) Bricked (Possibly Corrupt Partitions)

So, that means I can safely touch

mtd write /tmp/mtd1.u-boot.bin /dev/mtd1
mtd write /tmp/mtd2.firmware.bin /dev/mtd2
mtd write /tmp/mtd5.rootfs_data.bin /dev/mtd5
mtd write /tmp/mtd7.config.bin /dev/mtd7
mtd write /tmp/mtd8.partition-table.bin /dev/mtd8

but not mtd0.factory-uboot.bin , mtd6.info.bin and mtd9.art.bin

I dont know :-8 I flashed 2 C7-s of different versions without anything memorable.

Tried:

mtd write /tmp/mtd0.factory-uboot.bin /dev/mtd0
mtd write /tmp/mtd1.u-boot.bin /dev/mtd1
mtd write /tmp/mtd2.firmware.bin /dev/mtd2
mtd write /tmp/mtd5.rootfs_data.bin /dev/mtd5
mtd write /tmp/mtd7.config.bin /dev/mtd7
mtd write /tmp/mtd8.partition-table.bin /dev/mtd8
reboot

Output is same:

U-Boot 1.1.4-gbec22107-dirty (Nov 18 2020 - 18:01:26)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 408k for U-Boot at: 87f98000
Reserving 16448k for malloc() at: 86f88000
Reserving 44 Bytes for Board Info at: 86f87fd4
Reserving 36 Bytes for Global Data at: 86f87fb0
Reserving 128k for boot params() at: 86f67fb0
Stack Pointer at: 86f67f98
Now running in RAM - U-Boot at: 87f98000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x40802100
[NM_Error](nm_api_checkInteger) 00331: factory boot check integer flag is not 1.

Hit any key to stop autoboot:  0
Trying eth0
eth0 link down
FAIL
Trying eth0
dup 1 speed 1000
HTTP server is starting at IP: 192.168.0.1
HTTP server is ready!

UPDATE:

Writing from /tmp/mtd3.kernel.bin to /dev/mtd3 ...  [e]Failed to erase block
Writing from /tmp/mtd4.rootfs.bin to /dev/mtd4 ...  [e]Failed to erase block

Google led me here about boot flags:

You did the breaking it part, now get to unbraking part :wink:
(mercusys is a subsidiary of tplink)

Thanks for the detailed tutorial. I followed it step by step....until I reached:

If you end up with

No filesystem could mount root, tried:  squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)

You need to perform Begin Fix steps all over again, as something didn’t work as intended there.

Again I begin with same procedure but always getting:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,3)
Please note that error is (31,3) instead of (31,2).

UPDATE:
I guess I should try for all the 3 OEM firmwares available for tp-link router then report back.
Same for all tp-link firmwares available.....trying DD-WRT.....

Strangely openwrt initrafms to dd-wrt is not working but converting dd-wrt to sysupgrade and booting to memory does allow access to dd-wrt firmware page at 192.168.1.1

Check if DD-WRT has instructions to revert to OEM.

Indeed, but this did not work ....I have tried it using TFTP method as mentioned.

Update:
dd-wrt upgrade to oem sysupgrade failed.
Tried old oem firmware available on dd-wrt page (which is the oldest available) but error is same.

I have exhausted all types of tries based on the tutorial including dd-wrt....any third party firmware (e.g. dd-wrt) which can be useful in such situation.......or is known for good erases.

I guess enough tries....my new boot log looks good for some testing...... and will purchase new router ...any recommendations under 80$ so it is easier for installing & troubleshooting openwrt.

Plus, please suggest any HACK to avoid halting auto boot to type boot (via serial console every time)....though the router is on UPS.
New Log:

U-Boot 1.1.4-gbec22107-dirty (Nov 18 2020 - 18:01:26)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 408k for U-Boot at: 87f98000
Reserving 16448k for malloc() at: 86f88000
Reserving 44 Bytes for Board Info at: 86f87fd4
Reserving 36 Bytes for Global Data at: 86f87fb0
Reserving 128k for boot params() at: 86f67fb0
Stack Pointer at: 86f67f98
Now running in RAM - U-Boot at: 87f98000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x40802100
[NM_Error](nm_api_checkInteger) 00331: factory boot check integer flag is not 1.

Hit any key to stop autoboot:  0

ath>
ath> boot [I have to type this every time]
## Booting image at 9f040000 ...
   Image Name:   MIPS OpenWrt Linux-5.10.221
   Created:      2024-07-15  22:25:54 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    2269099 Bytes =  2.2 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f040040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 5.10.221 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r20341-591b7e93d3) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Mon Jul 15 22:25:54 2024
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is TP-Link Archer A7 v5
[    0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 121024K/131072K available (5913K kernel code, 605K rwdata, 752K rodata, 1232K init, 210K bss, 10048K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 775.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[    0.000008] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[    0.008285] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.074817] pid_max: default: 32768 minimum: 301
[    0.079813] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087527] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.097655] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.108328] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.118731] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.125998] pinctrl core: initialized pinctrl subsystem
[    0.135584] NET: Registered protocol family 16
[    0.141022] thermal_sys: Registered thermal governor 'step_wise'
[    0.191478] clocksource: Switched to clocksource MIPS
[    0.204323] NET: Registered protocol family 2
[    0.209125] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.217496] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.226418] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.234517] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.241963] TCP: Hash tables configured (established 1024 bind 1024)
[    0.248778] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.255714] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.263398] NET: Registered protocol family 1
[    0.268018] PCI: CLS 0 bytes, default 32
[    0.277974] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.288407] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.294616] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.306590] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.316974] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.323568] gpio-export gpio-export: 1 gpio(s) exported
[    0.329861] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.338694] printk: console [ttyS0] disabled
[    0.343314] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.352430] printk: console [ttyS0] enabled
[    0.352430] printk: console [ttyS0] enabled
[    0.361489] printk: bootconsole [early0] disabled
[    0.361489] printk: bootconsole [early0] disabled
[    0.387817] spi-nor spi0.0: w25q128 (16384 Kbytes)
[    0.392893] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.399498] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.406370] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.413633] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.420489] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.427932] Creating 7 MTD partitions on "spi0.0":
[    0.432950] 0x000000000000-0x000000020000 : "factory-uboot"
[    0.443503] 0x000000020000-0x000000040000 : "u-boot"
[    0.449571] 0x000000040000-0x000000f00000 : "firmware"
[    0.457468] 2 uimage-fw partitions found on MTD device firmware
[    0.463633] Creating 2 MTD partitions on "firmware":
[    0.468772] 0x000000000000-0x000000229feb : "kernel"
[    0.473919] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[    0.484079] 0x000000229feb-0x000000ec0000 : "rootfs"
[    0.489215] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[    0.499591] mtd: setting mtd4 (rootfs) as root device
[    0.505719] 1 squashfs-split partitions found on MTD device rootfs
[    0.512160] 0x000000630000-0x000000ec0000 : "rootfs_data"
[    0.518662] 0x000000f40000-0x000000f60000 : "info"
[    0.526095] 0x000000f60000-0x000000fb0000 : "config"
[    0.532206] 0x000000fc0000-0x000000fd0000 : "partition-table"
[    0.540459] 0x000000ff0000-0x000001000000 : "art"
[    1.265513] switch0: Atheros AR8337 rev. 2 switch registered on mdio.0
[    1.923018] ag71xx 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    1.934308] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: sgmii
[    1.941143] i2c /dev entries driver
[    1.947417] NET: Registered protocol family 10
[    1.962344] Segment Routing with IPv6
[    1.966244] NET: Registered protocol family 17
[    1.970909] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.984341] 8021q: 802.1Q VLAN Support v1.8
[    1.989683] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[    1.996051]  MEM 0x0000000012000000..0x0000000013ffffff
[    2.001450]   IO 0x0000000000000000..0x0000000000000000
[    2.007023] PCI host bridge to bus 0000:00
[    2.011267] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[    2.018398] pci_bus 0000:00: root bus resource [io  0x0000]
[    2.024167] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    2.031176] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    2.039408] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[    2.045658] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    2.052719] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    2.059713] pci 0000:00:00.0: supports D1 D2
[    2.065087] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    2.071971] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    2.079535] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    2.089342] clk: Disabling unused clocks
[    2.103930] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    2.117976] Freeing unused kernel memory: 1232K
[    2.122681] This architecture does not have kernel memory protection.
[    2.129342] Run /sbin/init as init process
[    2.858577] init: Console is alive
[    2.862613] init: - watchdog -
[    4.237286] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.291762] usbcore: registered new interface driver usbfs
[    4.297488] usbcore: registered new interface driver hub
[    4.303108] usbcore: registered new device driver usb
[    4.315329] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    4.325008] fsl-ehci: Freescale EHCI Host controller driver
[    4.332935] ehci-platform: EHCI generic platform driver
[    4.338662] ehci-platform 1b000000.usb: EHCI Host Controller
[    4.344597] ehci-platform 1b000000.usb: new USB bus registered, assigned bus number 1
[    4.352836] ehci-platform 1b000000.usb: irq 13, io mem 0x1b000000
[    4.381516] ehci-platform 1b000000.usb: USB 2.0 started, EHCI 1.00
[    4.388731] hub 1-0:1.0: USB hub found
[    4.393420] hub 1-0:1.0: 1 port detected
[    4.400754] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.418703] init: - preinit -
[    6.376268] random: jshn: uninitialized urandom read (4 bytes read)
[    6.860388] random: jshn: uninitialized urandom read (4 bytes read)
[    7.104611] random: jshn: uninitialized urandom read (4 bytes read)
[    7.392625] random: jshn: uninitialized urandom read (4 bytes read)
[    7.569311] random: jshn: uninitialized urandom read (4 bytes read)
[    8.758918] Atheros AR8216/AR8236/AR8316 mdio.0:00: Port 3 is up
[    8.778335] eth0: link up (1000Mbps/Full duplex)
[    8.792213] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    8.799090] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
Press the [f] ke[    8.836184] random: procd: uninitialized urandom read (4 bytes read)
y and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   13.216486] jffs2: notice: (546) jffs2_build_xattr_subsystem: complete building xattr subsystem, 11 of xdatum (0 unchecked, 3 orphan) and 14 of xref (3 dead, 0 orphan) found.
[   13.235098] mount_root: switching to jffs2 overlay
[   13.243748] overlayfs: upper fs does not support tmpfile.
[   13.256144] urandom-seed: Seeding with /etc/urandom.seed
[   13.405382] eth0: link down
[   13.427749] procd: - early -
[   13.431039] procd: - watchdog -
[   14.167370] procd: - watchdog -
[   14.203108] procd: - ubus -
[   14.309552] random: ubusd: uninitialized urandom read (4 bytes read)
[   14.318721] random: ubusd: uninitialized urandom read (4 bytes read)
[   14.333504] random: ubusd: uninitialized urandom read (4 bytes read)
[   14.343724] procd: - init -
Please press Enter to activate this console.
[   15.616989] random: jshn: uninitialized urandom read (4 bytes read)
[   15.726610] kmodloader: loading kernel modules from /etc/modules.d/*
[   16.262036] Loading modules backported from Linux version v5.15.162-0-gf45bea23c39cb
[   16.270040] Backport generated by backports.git v5.15.162-1-0-g9fa1c65c
[   16.937263] PPP generic driver version 2.4.2
[   16.952518] NET: Registered protocol family 24
[   17.017705] ath10k 5.15 driver, optimized for CT firmware, probing pci device: 0x3c.
[   17.042695] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[   17.051423] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   18.052602] urngd: v1.0.2 started.
[   19.781827] random: crng init done
[   19.785353] random: 24 urandom warning(s) missed due to ratelimiting
[   22.086142] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043202ff sub 0000:0000
[   22.095735] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   22.107683] ath10k_pci 0000:00:00.0: firmware ver 10.1-ct-8x-__fW-022-ecad3248 api 2 features wmi-10.x,has-wmi-mgmt-tx,mfp,txstatus-noack,wmi-10.x-CT,ratemask-CT,txrate-CT,get-temp-CT,tx-rc-CT,cust-stats-CT,retry-gt2-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT crc32 3e4cf97f
[   22.223365] ath10k_pci 0000:00:00.0: Loading BDF type 0
[   23.122253] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[   24.134607] ath10k_pci 0000:00:00.0: 10.1 wmi init: vdevs: 16  peers: 127  tid: 256
[   24.151397] ath10k_pci 0000:00:00.0: wmi print 'P 128 V 8 T 410'
[   24.157893] ath10k_pci 0000:00:00.0: wmi print 'msdu-desc: 1424  sw-crypt: 0 ct-sta: 0'
[   24.166203] ath10k_pci 0000:00:00.0: wmi print 'alloc rem: 24984 iram: 38672'
[   24.216302] ath10k_pci 0000:00:00.0: htt-ver 2.1 wmi-op 2 htt-op 2 cal file max-sta 128 raw 0 hwcrypto 1
[   24.229238] ath10k_pci 0000:00:00.0: NOTE:  Firmware DBGLOG output disabled in debug_mask: 0x10000000
[   24.481939] ieee80211 phy1: Atheros AR9561 Rev:0 mem=0xca04ceec, irq=2
[   24.522036] kmodloader: done loading kernel modules from /etc/modules.d/*
[   43.871055] eth0: link up (1000Mbps/Full duplex)
[   43.892057] br-lan: port 1(eth0.1) entered blocking state
[   43.897648] br-lan: port 1(eth0.1) entered disabled state
[   43.903558] device eth0.1 entered promiscuous mode
[   43.908512] device eth0 entered promiscuous mode
[   43.916937] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   43.945807] br-lan: port 1(eth0.1) entered blocking state
[   43.951400] br-lan: port 1(eth0.1) entered forwarding state
[   44.901827] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

filogic is fastest, qualcomm needs proprietary drivers to be as fast, 7621 needs lots of compromise
Cudy ??3000? would be 40-50$ if available in your place.

mtd write /tmp/mtd0.factory-uboot.bin /dev/mtd0
mtd write /tmp/mtd1.u-boot.bin /dev/mtd1
Will change the router's MAC address?

Plus, please suggest any HACK to avoid halting auto boot to type boot (via serial console every time).

printenv (has something about autoboot time
setenv ....
saveenv

Thanks to you all ....specially @pavelgl for providing the backup.
mtd write /tmp/mtd6.info.bin /dev/mtd6
PLUS

made it boot-able...now at least I can try OEM firmware as mentioned in the above link.
I guess I also need to check MAC address....although learnt a lot but I hope my old router will survive so much flashing......
Thanks @brada4

1 Like

Unfortunately, the MAC address is stored right in the info partition.

It can be corrected with a HEX editor, but I don't think it's worth the effort.

Hmm...I see, I could not pin-point it nor could Chatgpt.

If you are absolutely sure it's not going to conflict with your device or cause any other privacy/tos/etc. related issues then I can change it to my MAC and write the bin file again.
OR
Flashing the router again with tp-link stock firmware will revert it to the factory default....I guess? But I have already written mtd0.factory-uboot.bin and mtd1.u-boot.bin

The MAC address is device specific. It is hardcoded by the manufacturer into a read-only part of the flash memory, so it cannot be changed by reflashing the device in the usual way.

In theory, MAC addresses should be unique, but I've seen many exceptions.

Duplicate MAC addresses can only cause problems if the devices are in the same L2 segment and I have no privacy concerns.

1 Like

Hmmm....you are 100% correct ...no change in MAC even after flashing and upgrading to the latest stock firmware.

Also, I can see that you have selected most stable version of Openwrt that works wonder with the router with recommended tweaks.
Thanks to you all from bottom of my heart!

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.