Bricked Archer C7 v2, Stuck on "Starting kernel ..." NOT LOOPING

Long time user, first post. I finally bricked one I can't recover with what I know and can do.

It all started when an Open-WRT new version was being loaded. It quit responding but I could get it to take the TFTP reload from pressing reset while powering on. However, it would never load enough to SSH or load the web interface.

After about a day of dinking with it, I finally took it apart and dug out my USB UART and soldered pins to it. I can get in and break with "tpl" just fine most times but that's where I diverge from what other people are able to accomplish.

Mine will hang at "Starting kernel ..." and go no further.

I've tried TFTPing several different versions, including stock firmware to no avail.

I've even loaded an image of factory upgrade Open-WRT into RAM and booted that. No go.

Here's the boot log from the latest attempt. The image I loaded to memory and tried to boot got a kernel panic and the next boot hung again at "Starting kernel ..."

I've searched and I'm probably missing something but a lot of links to files are dead now.

Thanks for any help you can offer. While I'm fairly technical, I'm not a linux guru but I can be trained.

Router boot log

ap135> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),8256k(mib0),64k(ART)
bootcmd=bootm 0x9f020000
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}ap135${bc}-jffs2&&erase 0x9f050000 +0x630000&&cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize&&cp.b $fileaddr 0x9f680000 $filesize

Environment size: 722/65532 bytes
ap135> bootm 0x82000000

Booting image at 82000000 ...

Uncompressing Kernel Image ... OK

Starting kernel ...

[ 0.000000] Linux version 4.14.180 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11063-85e04e9f46)) #0 Sat May 16 18:32:20 2020
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[ 0.000000] MIPS: machine is TP-Link Archer C7 v2
[ 0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] random: get_random_bytes called from 0x804ff740 with crng_init=0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32512
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 123300K/131072K available (4030K kernel code, 162K rwdata, 532K rodata, 1220K init, 212K bss, 7772K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] CPU clock: 720.000 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns
[ 0.000008] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns
[ 0.008295] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[ 0.074984] pid_max: default: 32768 minimum: 301
[ 0.080061] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.087095] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.098236] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.108735] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.115286] pinctrl core: initialized pinctrl subsystem
[ 0.122706] NET: Registered protocol family 16
[ 0.130433] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[ 0.136967] MEM 0x0000000012000000..0x0000000013ffffff
[ 0.142523] IO 0x0000000000000001..0x0000000000000001
[ 0.162074] PCI host bridge to bus 0000:00
[ 0.166437] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[ 0.173783] pci_bus 0000:00: root bus resource [io 0x0001]
[ 0.179711] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.186938] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.195771] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[ 0.203588] pci 0000:00:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[ 0.213653] clocksource: Switched to clocksource MIPS
[ 0.219844] NET: Registered protocol family 2
[ 0.225231] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.232653] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.239460] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.246336] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.252559] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.259463] NET: Registered protocol family 1
[ 0.266509] Crashlog allocated RAM at address 0x3f00000
[ 0.273086] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[ 0.284108] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.290310] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.308411] io scheduler noop registered
[ 0.312587] io scheduler deadline registered (default)
[ 0.318369] ar7200-usb-phy 18030000.usb-phy0: phy reset is missing
[ 0.325033] ar7200-usb-phy 18030010.usb-phy1: phy reset is missing
[ 0.333212] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[ 0.341143] gpio-export gpio-export: 2 gpio(s) exported
[ 0.347451] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.356183] console [ttyS0] disabled
[ 0.360011] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[ 0.369226] console [ttyS0] enabled
[ 0.369226] console [ttyS0] enabled
[ 0.376657] bootconsole [early0] disabled
[ 0.376657] bootconsole [early0] disabled
[ 0.394511] m25p80 spi0.0: gd25q128 (16384 Kbytes)
[ 0.399410] 3 fixed-partitions partitions found on MTD device spi0.0
[ 0.405872] Creating 3 MTD partitions on "spi0.0":
[ 0.410739] 0x000000000000-0x000000020000 : "u-boot"
[ 0.416453] 0x000000020000-0x000000ff0000 : "firmware"
[ 0.422602] 0x000000ff0000-0x000001000000 : "art"
[ 0.428964] libphy: Fixed MDIO Bus: probed
[ 0.775359] libphy: ag71xx_mdio: probed
[ 0.781881] switch0: Atheros AR8327 rev. 4 switch registered on mdio-bus.0
[ 1.432964] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:00 [uid=004dd034, driver=Atheros AR8216/AR8236/AR8316]
[ 1.444334] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii
[ 1.785234] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[ 1.794853] eth1: Atheros AG71xx at 0xba000000, irq 5, mode: sgmii
[ 1.803250] NET: Registered protocol family 10
[ 1.812293] Segment Routing with IPv6
[ 1.816136] NET: Registered protocol family 17
[ 1.820678] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 1.833834] 8021q: 802.1Q VLAN Support v1.8
[ 1.840277] hctosys: unable to open rtc device (rtc0)
[ 1.846239] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[ 1.853871] Please append a correct "root=" boot option; here are the available partitions:
[ 1.862343] 1f00 128 mtdblock0
[ 1.862347] (driver?)
[ 1.868992] 1f01 16192 mtdblock1
[ 1.868995] (driver?)
[ 1.875640] 1f02 64 mtdblock2
[ 1.875643] (driver?)
[ 1.882269] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 1.891327] Rebooting in 1 seconds..

U-Boot 1.1.4 (Apr 24 2015 - 13:53:04)

ap135 - Scorpion 1.0DRAM:
Scorpion 1.0
ath_ddr_initial_config(178): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x4, 0x1e)
Tap values = (0x11, 0x11, 0x11, 0x11)
128 MB
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

*** Warning *** : PCIe WLAN Module not found !!!
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0x1
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ----> S17 PHY *
Vlan config...
TEST: FINAL REG VAL after TX Calibration - 0x46000000
TEST: FINAL XMII VAL after RX Calibration - 0x56000000
TEST: FINAL ETH_CFG VAL after RX Calibration - 0x00028001
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7335
eth0: ba:be:fa:ce:08:41
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: ba:be:fa:ce:08:41
eth1 up
eth0, eth1
Setting 0x18116290 to 0x58b1214f
Autobooting in 1 seconds

Booting image at 9f020000 ...

Uncompressing Kernel Image ... OK

Starting kernel ...

So after running printenv, you need to take the server IP it returned, which is and plug that in to your desktop TFTP app (I used TFTPD64), subnet mask of

Set up your wired NIC to the same IP and subnet mask,

You need to rename the firmware image to 6F01A8C0.img. I put it in the same folder as the TFTPD64 app.

Once that's setup, run tftpboot.

When that completes, run erase 0x9f020000 +f80000

When that completes, run cp.b 0x81000000 0x9f020000 0xf80000

And finally, run reset

Reset your NIC to automatically get the IP and DNS.

Open your browser and try for stock firmware, or for OpenWRT.

I've actually tried that with several different firmwares. I'm an old 20-year Cisco guy so I have multiple IPs on my PC and it works from either address range. It would TFTP the file, either the 6F01A8C0.img or the ArcherC7v2_tp_recovery.bin depending on the way I went about it, being serial or power/reset combo.

All of them end in the same way, hung at "Starting kernel ..." which leaves me unable to use ssh or web interface. My only option is to power cycle and watch it on serial hang again or "tpl" break and try a different image/bin. To date, I've tried a few open WRT, 2 different TP-Link and even a DD-WRT that is named ArcherC7v2_webrevert but no luck so far.

I feel like I'm just not getting the right image to get it working. This line seems to strand me:

  • Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

Some images returned this message:

  • Too big uncompressed streamLZMA ERROR 1 - must RESET board to recover

There were some other threads about the smaller zombie files but the zombie site is history. Searches for them all end in disappointment.

The value for root= in bootargs seems weird.

Try root=/dev/mtdblock1

Means that you are missing the initramfs for that kernel.

Well, I finally stumbled upon someone that had archived the zombie files sometime after midnight. I got one of them to load successfully. I am back to the stock firmware to make sure all was well with the world before I try again.

My main goal was to get mesh working but that has been a challenge. But, that's another thread.

When you have serial, the most bombproof way to debrick is to manually TFTP the initramfs build to RAM and boot it from RAM. Initramfs builds are not in the release directories for all devices, you may need to use the snapshot build.

Once the intramfs is running OpenWrt (from RAM), use it to sysupgrade flash a sysupgrade build. This should then reboot from flash and is ready for use.

I got it back to Open-WRT from the stock firmware.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.