Help with bricked tp-link wr840nv5

For Developers
1

Hi all,
I flashed my tp-link wr840nv5 with OpenWrt, and it work fine, then I decided to restore it with tp-link stock firmware, and everything broke.

i tried this tutorial (https://youtu.be/RtqVKNfuxWM) with no success & this in my original post (Help me i bricked my tp wr840nv5)

yesterday i got cross this topic (Support for TP-LINK TL-WR802N V4) & i followed it with no success

MT7628 # tftpboot 0x80C71B00

 netboot_common, argc= 2

 NetTxPacket = 0x83FE77C0

 KSEG1ADDR(NetTxPacket) = 0xA3FE77C0

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
*** Warning: no boot file name; using 'test.bin'
TFTP from server 192.168.0.225; our IP address is 192.168.0.2
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80c71b00
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (5c:f9:dd:66:37:ff)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############################################Got ARP REQUEST, return our I                                                                                      P
#####################
         #################################################################
         #################################################################
         #################################################################
         ###
done
Bytes transferred = 3342508 (3300ac hex)
NetBootFileXferSize= 003300ac
MT7628 # md 0x80C71B00
80c71b00: 00000003 2e726576 302e3220 ffffff00    ....ver. 2.0....
80c71b10: ffffffff ffffffff ffffffff ffffffff    ................
80c71b20: ffffffff ffffffff ffffffff ffffffff    ................
80c71b30: ffffffff 05004008 01000000 05000000    .....@..........
80c71b40: 034d5da0 4e171c5d 21a2577b 046dbe4b    .]M.]..N{W.!K.m.
80c71b50: 00000000 ffffffff ffffffff ffffffff    ................
80c71b60: ffffffff ffffffff 80000000 80000000    ................
80c71b70: 00003c00 00020000 94c11400 00001400    .<..............
80c71b80: eafb1d00 00000000 00000000 0001aa55    ............U...
80c71b90: 000000a5 ffffffff ffffffff ffffffff    ................
80c71ba0: ffffffff ffffffff ffffffff ffffffff    ................
80c71bb0: ffffffff ffffffff ffffffff ffffffff    ................
80c71bc0: ffffffff ffffffff ffffffff ffffffff    ................
80c71bd0: ffffffff ffffffff ffffffff ffffffff    ................
80c71be0: ffffffff ffffffff ffffffff ffffffff    ................
80c71bf0: ffffffff ffffffff ffffffff ffffffff    ................
MT7628 # bootm 0x80C71B00
do_bootm:argc=2, addr=0x80c71b00
## Booting image at 80c71b00 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 4.9.58 (robimarko@Builder) (gcc version 6.3.0 (LEDE G                                                                                      CC 6.3.0 r5245-6cbfcea) ) #0 Sat Nov 4 11:07:01 2017
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is TP-Link TL-WR840N v5
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages                                                                                      : 16256
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000001
[    0.000000] Readback ErrCtl register=00000001
[    0.000000] Memory: 60444K/65536K available (3114K kernel code, 158K rwdata, 75                                                                                      2K rodata, 192K init, 209K bss, 5092K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource_probe: no matching clocksources found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idl                                                                                      e_ns: 6590553264 ns
[    0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115                                                                                      902ns
[    0.007528] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.070046] pid_max: default: 32768 minimum: 301
[    0.074603] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.080938] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.093216] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_                                                                                      idle_ns: 19112604462750000 ns
[    0.102705] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.108622] pinctrl core: initialized pinctrl subsystem
[    0.114255] NET: Registered protocol family 16
[    0.137985] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.143608] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.149210] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.158203] clocksource: Switched to clocksource MIPS
[    0.164193] NET: Registered protocol family 2
[    0.169239] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.175928] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.182113] TCP: Hash tables configured (established 1024 bind 1024)
[    0.188312] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.193906] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.200236] NET: Registered protocol family 1
[    0.207299] Crashlog allocated RAM at address 0x3f00000
[    0.213674] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.227364] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.232983] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY)                                                                                       (c) 2001-2006 Red Hat, Inc.
[    0.251152] io scheduler noop registered
[    0.254884] io scheduler deadline registered (default)
[    0.260598] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.267749] console [ttyS0] disabled
[    0.271234] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud =                                                                                       2500000) is a 16550A
[    0.279953] console [ttyS0] enabled
[    0.279953] console [ttyS0] enabled
[    0.286947] bootconsole [early0] disabled
[    0.286947] bootconsole [early0] disabled
[    0.296113] spi-mt7621 10000b00.spi: sys_freq: 193333333
[    0.306708] m25p80 spi32766.0: using chunked io (size=32)
[    0.312261] m25p80 spi32766.0: gd25q32 (4096 Kbytes)
[    0.317323] 4 ofpart partitions found on MTD device spi32766.0
[    0.323250] Creating 4 MTD partitions on "spi32766.0":
[    0.328484] 0x000000000000-0x000000020000 : "boot"
[    0.334974] 0x000000020000-0x0000003e0000 : "firmware"
[    0.366111] 0x0000003e0000-0x0000003f0000 : "config"
[    0.372690] 0x0000003f0000-0x000000400000 : "factory"
[    0.380185] libphy: Fixed MDIO Bus: probed
[    0.393233] rt3050-esw 10110000.esw: link changed 0x00
[    0.400931] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb010                                                                                      0000, irq 5
[    0.410805] NET: Registered protocol family 10
[    0.418279] NET: Registered protocol family 17
[    0.422854] 8021q: 802.1Q VLAN Support v1.8
[    0.429776] VFS: Cannot open root device "(null)" or unknown-block(0,0): error                                                                                       -6
[    0.437372] Please append a correct "root=" boot option; here are the available                                                                                       partitions:
[    0.445906] 1f00             128 mtdblock0 [    0.449976]  (driver?)
[    0.452373] 1f01            3840 mtdblock1 [    0.456429]  (driver?)
[    0.458836] 1f02              64 mtdblock2 [    0.462893]  (driver?)
[    0.465287] 1f03              64 mtdblock3 [    0.469356]  (driver?)
[    0.471751] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown                                                                                      -block(0,0)
[    0.480993] Rebooting in 1 seconds..
[04030C0E][04030C0C]
DDR Calibration DQS reg = 00008788


U-Boot 1.1.3 (Dec 11 2017 - 16:09:07)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************
Software System Reset Occurred
******************************
flash manufacture id: c8, device id 40 16
find flash: GD25Q32B
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Dec 11 2017  Time:16:09:07
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!! 0
TODO, Read MAC Address from Flash

switch BootType:

4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Dec 11 2017 - 16:09:07)
MT7628 #

and goes again to bootloop and it not same as forum, is there any solution?

note: i used firmware form original tplink website & openwrt website (https://openwrt.org/toh/hwdata/tp-link/tp-link_tl-wr840n_v5)

2

Have you tried the guide? https://openwrt.org/docs/guide-user/troubleshooting/generic.debrick

I’ve personally used the tftp method to recover two devices I have successfully.

It the very unlikely event you’ve managed to corrupt the bootloader you’re only remaining options are to copy the boot loader from another working device if you have one, buy a known good one, or if someone else on here has the same model and can send you a copy of their boot loader.

Hth

3

to be honest with you i don’t understand can you explain in detail please

4

Is this your device?

If so it listed further details here:
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=d0ef27594a8d9156e6748e890229d2daa32465fd

Bit of bad news, it says this about tftp recovery:

TFTP recovery is broken since TP-Link reused bootloader code for v4 and that does not take into account only 4 MB of flash and bricks the device. So do not use TFTP Recovery or you will have to rewrite SPI flash.
They fixed it in later GPL code,but it is unknown which version of bootloader you have.

Ive never flashed a device before but based on what ive seen (full details in the wiki debrick link above) and from other users posts its a little bit of soldering and then setting up a serial connection to the device and then directly writing code onto the storage. There are other potential recovery methods available too if you have an arduino or raspberry pi.

With all that said, the v5 device only has 4MB of storage, so its not an ideal platform to begin with. If i were you id put maybe 3-4 hours into this, and after that just get another (more suitable) device and start a fresh. Feel free to post further updates on this thread and ill assist if i can .

5

I found a little fix. You must compile for version 4 and use its tftp reovery file.
Name it tp_recovery.bin. Yes it is 8MB no problem. Then use tftp recovery to flash
it. After that you will be able to login via ssh/telnet and you can flash again version 5.
Note that this will overwrite fatory partition and you will not have correct mac address.
You can fix this with reading it from other version 5. For example:
dd if=/dev/mtd4 of=/tmp/test.bin
Get the file and edit the mac address. Then upload and write it using the following.
mtd -r write test.bin factory.
You mtd4 partition may be locked so before that you may need to disable read-only flag in mt7628an_tplink_tl-wr840n-v5.dts file here:

                        factory: partition@3f0000 {
                                label = "factory";
                                reg = <0x3f0000 0x10000>;
//                              read-only;
                        };

Sorry if this sounds complicated but it helped me return my version5 to working state (openwrt) and good mac address and tx-power.