Help Unbricking Archer A6 v2

Hello,

I find myself in need of assistance.

I've build an OpenWRT image from source and successfully flashed it through web GUI of an TP-Link Archer A6 v2. Problem is that I disabled building the bridge config utility and now the switch from the device is completely dead.

I've built again the image, together with bridge config utility and I tried to flash it using TFTP recovery mode, but it did not work.

Here's the logs outputted by the router:

U-Boot 1.1.4-g33593293-dirty (Jul  1 2020 - 18:11:57)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 399k for U-Boot at: 87f9c000
Reserving 8256k for malloc() at: 8778c000
Reserving 44 Bytes for Board Info at: 8778bfd4
Reserving 36 Bytes for Global Data at: 8778bfb0
Reserving 128k for boot params() at: 8776bfb0
Stack Pointer at: 8776bf98
Now running in RAM - U-Boot at: 87f9c000
Flash Manuf Id 0x1c, DeviceId0 0x70, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: <redacted>
eth0 up
eth0
Setting 0x181162c0 to 0x50a02100
---------in uboot mode , enable phy -----
run command setenv serverip 192.168.0.66;setenv ipaddr 192.168.0.86
run command tftp 0x80060000 ArcherC6v2_tp_recovery.bin
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Download Filename 'ArcherC6v2_tp_recovery.bin'.
Download to address: 0x80060000
Loading: ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ##################
done
Bytes transferred = 5421988 (52bba4 hex)
Firmware downloaded... filesize = 0x52bba4 fileaddr = 0x80060000.
Firmware Recovery file length : 5421988

Firmware process common.

[NM_Error](nm_tpFirmwareMd5Check) 00126: Check md5 error.


recovery failed.
now restart...▒

U-Boot 1.1.4-g33593293-dirty (Jul  1 2020 - 18:11:57)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 399k for U-Boot at: 87f9c000
Reserving 8256k for malloc() at: 8778c000
Reserving 44 Bytes for Board Info at: 8778bfd4
Reserving 36 Bytes for Global Data at: 8778bfb0
Reserving 128k for boot params() at: 8776bfb0
Stack Pointer at: 8776bf98
Now running in RAM - U-Boot at: 87f9c000
Flash Manuf Id 0x1c, DeviceId0 0x70, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: <redacted>
eth0 up
eth0
Setting 0x181162c0 to 0x50a02100
factory boot check integer ok.

Hit any key to stop autoboot:  0
## Booting image at 9f030000 ...
Bad Magic Number
▒--------in uboot mode , enable phy -----

Can anyone assist me further please?

Thanks in advance

TFTP flash the standard factory openwrt image ?

That's the next step I'll try

Your build is not bootable at all due to bad magic number- which means what was flashed is not recognized as a compressed kernel. That is a different problem than a missing library.

Hello,

Your build is not bootable at all due to bad magic number- which means what was flashed is not recognized as a compressed kernel. That is a different problem than a missing library.

I could have made a terrible mistake when configuring the custom build, except unticking the lib, that's true.

Now I'm coming back with a new set of logs. This time I tried flashing a standard OpenWRT 21.02.7 image, and it seems that the md5 checksum error is preventing the flash to begin.

Logs:

U-Boot 1.1.4-g33593293-dirty (Jul  1 2020 - 18:11:57)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 399k for U-Boot at: 87f9c000
Reserving 8256k for malloc() at: 8778c000
Reserving 44 Bytes for Board Info at: 8778bfd4
Reserving 36 Bytes for Global Data at: 8778bfb0
Reserving 128k for boot params() at: 8776bfb0
Stack Pointer at: 8776bf98
Now running in RAM - U-Boot at: 87f9c000
Flash Manuf Id 0x1c, DeviceId0 0x70, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: <redacted>
eth0 up
eth0
Setting 0x181162c0 to 0x50a02100
---------in uboot mode , enable phy -----
run command setenv serverip 192.168.0.66;setenv ipaddr 192.168.0.86
run command tftp 0x80060000 ArcherC6v2_tp_recovery.bin
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Download Filename 'ArcherC6v2_tp_recovery.bin'.
Download to address: 0x80060000
Loading: ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ###########################
done
Bytes transferred = 5553064 (54bba8 hex)
Firmware downloaded... filesize = 0x54bba8 fileaddr = 0x80060000.
Firmware Recovery file length : 5553064

Firmware process common.

[NM_Error](nm_tpFirmwareMd5Check) 00126: Check md5 error.


recovery failed.
now restart...

What else can be done?

standard as in DLed from downloads.openwrt.org, or standard by content, but created by you ?

Standard as is cloning the git, then adding the Archer A6 in supported versions in tplink-safeloader.c (as proposed in here), then just selecting the target and hitting make

I suppose this should create the same image as available on the downloads page, right?

in theory at least, why not use the one from https://openwrt.org/toh/hwdata/tp-link/tp-link_archer_a6_v2_us_tw ?

Same MD5 error:

Download Filename 'ArcherC6v2_tp_recovery.bin'.
Download to address: 0x80060000
Loading: ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         #
done
Bytes transferred = 6590795 (64914b hex)
Firmware downloaded... filesize = 0x64914b fileaddr = 0x80060000.
Firmware Recovery file length : 6590795

Firmware process common.

[NM_Error](nm_tpFirmwareMd5Check) 00126: Check md5 error.


recovery failed.
now restart...

One thing that I noticed is that even when using stock firmware I get the same MD5 checksum error when using TFTP recovery and I tried with 1.3.5, 1.3.6 and 1.3.7

So could it be a bug somewhere else?

Bump, any other ideas are welcome.

If I understand correctly your device is EU version. You can try this way to unbrick the router
Edit: correct link.

I didn't really understand what was going on there, because my cyrillic alphabet knowledge is somewhere under the sea level :joy: but what I could figure is that the firmware is dedicated to another device, so I would not try to put it on my router, as it would probably spontaneously ignite and get bricked for good.

Nevertheless, I read somewhere (don't remember where) that the only image working with TFTP recovery is the 1st ever stock release. Anything other than that will fail.

So my question is, does anyone have such an old firmware (2018 / 19) somewhere in their personal archive?

But you can prepare sysupgrade image from stock firmware of your device and install it from openwrt web-interface or from uboot command line as pointed here.

Tried that, now I'm stuck at a different error :unamused:

Logs:

ath> setenv serverip 192.168.0.66; setenv ipaddr 192.168.0.86; tftp 0x80060000 owrt.bin
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Download Filename 'owrt.bin'.
Download to address: 0x80060000
Loading: ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         #
done
Bytes transferred = 5178155 (4f032b hex)
ath> erase 0x9f030000 +0x4f032b
Erasing flash...
First 0x3 last 0x52 sector size 0x10000                                        82
Erased 80 sectors
ath> erase 0x9f030000 +0x4f032b
Erasing flash...
First 0x3 last 0x52 sector size 0x10000                                        82
Erased 80 sectors
ath> cp.b 0x80060000 0x9f030000 0x4f032b; bootm 0x9f030000
Copy to Flash... write addr: 9f030000
done
## Booting image at 9f030000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.238
   Created:      2023-04-17  13:15:36 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1930730 Bytes =  1.8 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f030040 ...Bad Data CRC

CRC check fail? Any ideas?

When using the bootloader to erase/write directly to flash (which is not recommended), use the sysupgrade image not factory. Sysupgrade bins are exact images of what should be in the flash, they have no header. This is what you want to write directly.

1 Like

I used sysupgrade images, from them I get the CRC thing. With factory (because of the header, I suppose) I get that previous Bad Magic Number error

First determine definitely which country version you have. It looks like at least from the standpoint of OpenWrt, there is a build for the US model and another one for everywhere else. According to the git commit, they are quite a bit different, including a different flash layout.

Then see if you can boot the initramfs image from RAM. Use that to install the sysupgrade.

100% EU version according to the label on the router.

Tried to boot the initramfs image. It seems that there's the same CRC error:

ath> setenv serverip 192.168.0.66; setenv ipaddr 192.168.0.86; tftp 0x80060000 irfs.bin; bootm 0x80060000
Trying eth0
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Download Filename 'irfs.bin'.
Download to address: 0x80060000
Loading: ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ################################
         ###
done
Bytes transferred = 5668530 (567eb2 hex)
## Booting image at 80060000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.238
   Created:      2023-04-17  13:15:36 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    5668466 Bytes =  5.4 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x80060040 ...Bad Data CRC
ath>

Do you want to recover stock firmware or to install openwrt?