Cudy WR1300 bricked

Hi all , after an unsuccessfull attempt to flash OpenWrt on a WR1300 , i rolled back to the original firmware by following the manufacturer advices : https://www.cudytech.com/newsinfo/547425.html. Seems to me that everything was ok , TFTFD sent the recovery FW , and after internal flash , rebbot of the router , well , nothing ...
Now when i power on , only the power led is on , and i can see kind of traffic on the lan port led where i'm plugged . No "SYS","USB","WPS" leds , no wifi leds. I can't launch the recovery anymore , it does not trig the TFTFD server at all . I then tried to solder the UART directly on the board as mentionned in the developper thread for this device and i have no traces at boot , with or without the reset switch while power on . Do you think my device is totally bricked ? Is there some command i could try to send thru serial console to see if something is alive inside ?
Thanks in advance for your advices .
Regards

From the developer thread it doesn't look like you need to use commands to get uart output.

The recovery image from the manufacturer link contains "U-Boot 1.1.3 (Jun 23 2020 - 01:19:42)" (from others uart logs it looks like the only U-Boot in circulation for your device) so hopefully U-Boot is still intact which could mean your uart setup isn't working yet.

You could try plugging only the tx and gnd cables from the router to the ttl rx and gnd and use 115200 8n1 to try get serial console output?

Hello , i've double check and redo the UART soldering , but no way , the monitor stays blank , no single line , no sign of life , whatever the baudrate i've tried ( by default , 115200 8N1 ).

Hello.

By the end of 2021 Cudy have changed the SPI flash chip inside the WR1300 from w25q128 to XMC-XM25QH128C. The issue was that XMC flash was not supported by u-boot nor kernel available in the openwrt and recovery images available in Cudy's website until January 2022. For about 2-4 week Cudy's people removed those imagen from the website (hyperlink changed to blank). About mid Feb they uploaded a new openwrt and recovery images (both them are exactly the same).

Current openwrt firmware available (at least until today) to download from Cudy have been updated with support for the new FLASH chip but the make some mistake and system doesn't boot as kernel cannot decompress the rootfs. However it's possible to recover as the u-boot image works well and the recovery flash is flashed well. You can try as much as you want... the serial console will show up all the booting process including kernel messages.

Said that, I should tell you, @snakesrules941, that your Cudy's has the u-boot partition blanked as I could check it by manually reading the chip. That happens when you try to recover twice using that old recovery.img. You have two ways to recover from that: 1) return the device as broken, it's fair since it's a Cudy's mistake. 2) manually flash uboot again.

For your information these are the logs from different boots and failures:

Boot log for image WR1300-OpenWRT19.07-0716.bin (see bootlog.OpenWRT19.07-0716.txt)
This image used to work on older hardware without flash chip xm25qh128c

Status: failure to detect SPI Flash chip

Kernel: Linux version 4.14.180 (abu@openwrt) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11063-85e04e9f46)) #0 SMP Sat May 16 18:32:20 2020

Message:
[ 2.491208] m25p80 spi0.0: unrecognized JEDEC id bytes: 20, 40, 18
[ 2.497429] m25p80: probe of spi0.0 failed with error -2

If some have fallen in this situation an try to recover with the latest image, the will, however if someone uses the old recovery image, the flash u-boot image is cleared and flash chip must be reflashed manually.

Boot log for image openwrt-ramips-mt7621-cudy_wr1300-squashfs-flash.bin (see bootlog.openwrt-ramips-mt7621-cudy_wr1300-squashfs-flash.log)

Status: failure to read rootfs after it's mounted, squashfs xz decompression issue

Kernel: Linux version 5.4.119 (abu@openwrt) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r0+16090-bbbc01ede5)) #0 SMP Mon Jul 26 06:13:43 2021

Message:
[ 0.603792] spi-nor spi0.0: XM25QH128C (16384 Kbytes) ---> Flash detected
[ 0.608947] 7 fixed-partitions partitions found on MTD device spi0.0
...
[ 1.499737] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
...
[ 1.522106] Run /sbin/init as init process
....
[ 1.535053] SQUASHFS error: xz decompression failed, data probably corrupt
[ 1.541927] SQUASHFS error: squashfs_read_data failed to read block 0xc185fa
[ 1.548972] SQUASHFS error: Unable to read metadata cache entry [c185fa]
[ 1.555664] SQUASHFS error: Unable to read directory block [c185fa:1348]
[ 1.562434] Starting init: /sbin/init exists but couldn't execute it (error -5)

All logs and matched imgs available here.

I have posted all this info to Cudy, they are aware and I expect them to share a fixed openwrt image soon (my guess).

For those who want to recover their devices, you can flash the chip using latest flashrom which supports XMC, some arduino (I used an adafruit feather wiced) and a serprog arduino firmware. I've adapted this particular one to run on my feather with a hat I already use for programming other arduinos using ArduinoISP. I have used the same device as TTL to USB-serial converter to read the serial console.

It's enough to lift the Vcc pin and solder MISO/MOSI/CLK/CS/GND/VCC to your programmer. Seems that WP and HOLD pins are tided to something right. You may also desolder the whole chip.

Make a backup: flashrom -p serprog:dev=/dev/ttyACM0,spispeed=1k -VVVV --chip=XM25QH128C --read broken.img
Create a simple layout: echo "00000000:0002ffff uboot" >cudy.layout
Write u-boot: flashrom -p serprog:dev=/dev/ttyACM0,spispeed=50M --chip=XM25QH128C -V --write recovery.img -l cudy.layout -i uboot
Recovery image starts with raw u-boot image, chan be flashed directly.

I think that the oficial/latest OpenWRT kernel currently does not support the new flash chip, therefore it's not possible to flash it nowadays without compiling it yourself.

A picture after recovery process was finished:

Hope It helps.
Best regards!

3 Likes

Thanks for this very clear and detailed discussion. Unfotunatly , i've returned the WR1300.
In others words , better stay away from this device for the moment .

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.