TL-WPA8630P V2 Boot loop after sysupgrade

Hello,

I have a problem with my adapter which is in a continuous reboot process.
I have read the forums and tried to recover it with Tftp, but is not seen since it is rebooting to fast.
Then I have acquired an usb to serial and connected to it (log provided below), but in this case I can't type or do anything.

---- The log on serial ----

Terminal log file
Date: 12.02.2021 - 15:46:58
-----------------------------------------------
à

U-Boot 1.1.4 (Oct 18 2017 - 09:53:45)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 134k for U-Boot at: 87fdc000
Reserving 192k for malloc() at: 87fac000
Reserving 44 Bytes for Board Info at: 87fabfd4
Reserving 36 Bytes for Global Data at: 87fabfb0
Reserving 128k for boot params() at: 87f8bfb0
Stack Pointer at: 87f8bf98
Now running in RAM - U-Boot at: 87fdc000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200 
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x60c02100
Autobooting in 1 seconds
*NOTE-2021.02.12@15:47:03 - LogNote
## Booting image at 9f040000 ...
---- fileTag = 9f040000
	 text base = ffffffff
	 entry point = ffffffff
	 hdr->ih_load = 00000000
	 hdr->ih_ep = 00000000
   Uncompressing Kernel Image at ffffffff ... Stream with EOS marker is not supportedLZMA ERROR 1 - must RESET board to recover

---- End of serial log ----
This sequence is repeating there as much I am connected to it.

I have seen somewhere to press escape when device boots to interrupt autoboot - didn't worked.

It looks like whatever I do, is not working except that now I can see what is wrong but don't manage to recover it. :frowning:

I have said to try the possibilities until to post this message.

I hope maybe I will get it fixed with some help and guidance from your side.

Thank you in advance,
George

Hi,

At this point, it should drop to a console prompt if you type something. The serial connection might not be receiving your keystrokes. I found the early boot serial connection to be flaky for some reason, maybe because it needs a pull-up resistor on one of the pins.

Maybe @andyboeh or @petersnows know how to reliably use the serial to enter tftp commands?

What image were you running before the sysupgrade, and what image did you sysupgrade to?

If the worst comes to worst, you can recover the flash using a dump from someone else and a SOIC-8 clip + flash programmer (or Raspberry Pi). However tftp will be easier if you go carefully (and take care not to overwrite the bootloader!)

1 Like

Hello @jwmullally and thank you for your answer.

The story started in October, last year when being sick of the device dropping the connection on me on both lan and wi-fi and then I have decided to have another system on it to avoid that as I have read in tp-link forum (didn't manage to find it again to post the link here) that is an issue as most all of their devices have an DHCP service which conflict with the main router. I also have an AV600 kit with the same problem with the DHCP thing...

The steps I've took:

  1. from this [OpenWrt Wiki] TP-Link TL-WPA8630P v2 link (at that time) I took s1 (step1) as in picture
  2. I have tried to access its web interface to do the settings and.... Well :slight_smile: I have discovered that there is none so I have searched and followed some other points in order to install lucy which failed on me because it was complaining of no space on device... So I have seen somewhere (don't remember were exactly) that I will need to do the sysupgrade as well and that is at sX in the picture, because I don't remember what other thing were in the middle trying to get lucy :slight_smile: so since then... My device is in this state, but I don't want to give up on it. And also I am not blaming anyone else except me for this. I want this to be clarified. I surely did something wrong that lead me here :slight_smile:

Now the steps I took to connect with the serial are from here [OpenWrt Wiki] TP-Link TL-WPA8630P v2 #Serial! and also studied the pictures of the device pcb before doing it just to be sure that the pinouts are as provided and I have seen the quote that maybe a pull-up resistor is needed for this - at this point I have looked on what that means but not very sure where do I have to connect it :slight_smile: I am still trying to figure that out.

My usb to serial has the following pinouts"

  1. 5Vcc
  2. Gnd
  3. Rx
  4. Tx
  5. 3Vcc

Now the pull-up resistor should be between some pin (rx/tx) to Vcc(5/3) not sure which one on which so I am a little bit confused about it :slight_smile: and I am still looking for the right points to avoid burning something.

I have connetcted :slight_smile:

Everything is ok without the resistor. What was missing was the fact that we need to type tpl command in the fisrt second when it boots up.

I did it fisrt with Br@y Terminal and use macro if you are not fast :slight_smile:


...then I have successfully did it in Putty as well.

Now as I have the IP:192.168.1.10 as can be seen in the termanl log, I have started to use TFTP but it looks like is stuck at block #0

I have setenv ipaddr to 192.168.1.20 setenv ipaddr 192.168.1.20 for the device and my computer IP I have set it to the log server ip 192.168.1.10... and in the tftp app logs there is still nothing. I probably miss something :expressionless:

New reboot, new log

U-Boot 1.1.4 (Oct 18 2017 - 09:53:45)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 134k for U-Boot at: 87fdc000
Reserving 192k for malloc() at: 87fac000
Reserving 44 Bytes for Board Info at: 87fabfd4
Reserving 36 Bytes for Global Data at: 87fabfb0
Reserving 128k for boot params() at: 87f8bfb0
Stack Pointer at: 87f8bf98
Now running in RAM - U-Boot at: 87fdc000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200 
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x60c02100
Autobooting in 1 seconds
dragonfly> printenv

bootargs=console=ttyS0,115200 root=31:03 rootfstype=squashfs init=/sbin/init board=AP152 mtdparts=spi0.0:128k(factory-uboot),128k(u-boot),1024k(uImage),6784k(rootfs),64k(mib0),64k(ART)
bootcmd=bootm 0x9f010000
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.1
serverip=192.168.1.10
dir=
lu=tftp 0x80060000 ${dir}tuboot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}ap152${bc}-${squashfs}&&erase 0x9f110000 +0x6d0000&&cp.b $fileaddr 0x9f110000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f010000 +$filesize&&cp.b $fileaddr 0x9f010000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Now the ip is 192.168.1.1 and it looks like it is its default one. I am still trying to understand...

Are you sure the firewall isn't up?

Hi @frollic

Yes, it is openwrt on it. But that was not there before. What firewall?
...I mean the ipaddr

I though I read the post wrong - you weren't successfull.
Nothing in the TFTP log usually means the FW is up, and the TFTP server unreachable.

192.168.1.1 is the default ip of openwrt.

I am not. Yet. Now am I trying to send the image over..
I have succeeded to send someting but not with tftp32, but putty and I've got logs in the tftd32 :slight_smile:

Connection received from 192.168.1.20 on port 3244 [13/02 20:40:32.844]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:40:32.844]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:40:32.849]
Connection received from 192.168.1.20 on port 3785 [13/02 20:40:43.869]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:40:43.869]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:40:43.869]
Connection received from 192.168.1.20 on port 3610 [13/02 20:40:54.901]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:40:54.901]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:40:54.901]
Connection received from 192.168.1.20 on port 3609 [13/02 20:41:05.919]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:41:05.919]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:41:05.919]
Connection received from 192.168.1.20 on port 2705 [13/02 20:41:16.948]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:41:16.948]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:41:16.948]
Connection received from 192.168.1.20 on port 2423 [13/02 20:41:27.969]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:41:27.969]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:41:27.969]
Connection received from 192.168.1.20 on port 2280 [13/02 20:41:38.989]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:41:38.989]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:41:38.989]
Connection received from 192.168.1.20 on port 1571 [13/02 20:41:50.014]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:41:50.014]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:41:50.014]
Connection received from 192.168.1.20 on port 2399 [13/02 20:42:01.029]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:42:01.039]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:42:01.039]
Connection received from 192.168.1.20 on port 1297 [13/02 20:42:12.059]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:42:12.059]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:42:12.059]
Connection received from 192.168.1.20 on port 2474 [13/02 20:42:23.084]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:42:23.084]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:42:23.084]
Connection received from 192.168.1.20 on port 4079 [13/02 20:42:34.099]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:42:34.099]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:42:34.099]
Connection received from 192.168.1.20 on port 2185 [13/02 20:42:45.129]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:42:45.129]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:42:45.129]
Connection received from 192.168.1.20 on port 3623 [13/02 20:42:56.149]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:42:56.149]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:42:56.149]
Connection received from 192.168.1.20 on port 1441 [13/02 20:43:07.169]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:43:07.169]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:43:07.169]
Connection received from 192.168.1.20 on port 3027 [13/02 20:43:18.197]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:43:18.197]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:43:18.197]
Connection received from 192.168.1.20 on port 1377 [13/02 20:43:29.219]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:43:29.219]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:43:29.219]
Connection received from 192.168.1.20 on port 3602 [13/02 20:43:40.239]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:43:40.239]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:43:40.239]
Connection received from 192.168.1.20 on port 2424 [13/02 20:43:51.259]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:43:51.259]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:43:51.259]
Connection received from 192.168.1.20 on port 1152 [13/02 20:44:02.289]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:44:02.289]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:44:02.289]
Connection received from 192.168.1.20 on port 2968 [13/02 20:44:13.309]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:44:13.309]
File <1401A8C0.img> : error 2 in system call CreateFile The system cannot find the file specified. [13/02 20:44:13.309]
Connection received from 192.168.1.20 on port 3610 [13/02 20:44:24.340]
Read request for file <1401A8C0.img>. Mode octet [13/02 20:44:24.340]
OACK: <timeout=5,> [13/02 20:44:24.340]
Using local port 60193 [13/02 20:44:24.340]
<1401A8C0.img>: sent 12888 blks, 6598367 bytes in 2 s. 0 blk resent [13/02 20:44:26.649]
Connection received from 192.168.1.20 on port 3330 [13/02 21:22:00.975]
Read request for file <1401A8C0.img>. Mode octet [13/02 21:22:00.975]
OACK: <timeout=5,> [13/02 21:22:00.975]
Using local port 50535 [13/02 21:22:00.975]
<1401A8C0.img>: sent 12888 blks, 6598367 bytes in 3 s. 0 blk resent [13/02 21:22:03.746]
Connection received from 192.168.1.20 on port 2823 [13/02 21:26:36.730]
Read request for file <1401A8C0.img>. Mode octet [13/02 21:26:36.730]
OACK: <timeout=5,> [13/02 21:26:36.730]
Using local port 59531 [13/02 21:26:36.730]
Connection received from 192.168.1.20 on port 2823 [13/02 21:26:41.730]
Read request for file <1401A8C0.img>. Mode octet [13/02 21:26:41.730]
OACK: <timeout=5,> [13/02 21:26:41.730]
Using local port 59532 [13/02 21:26:41.730]
<1401A8C0.img>: sent 12888 blks, 6598367 bytes in 3 s. 0 blk resent [13/02 21:26:44.349]
TIMEOUT waiting for Ack block #0  [13/02 21:27:01.781]

and log in putty

U-Boot 1.1.4 (Oct 18 2017 - 09:53:45)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 134k for U-Boot at: 87fdc000
Reserving 192k for malloc() at: 87fac000
Reserving 44 Bytes for Board Info at: 87fabfd4
Reserving 36 Bytes for Global Data at: 87fabfb0
Reserving 128k for boot params() at: 87f8bfb0
Stack Pointer at: 87f8bf98
Now running in RAM - U-Boot at: 87fdc000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x60c02100
Autobooting in 1 seconds
dragonfly>
dragonfly> pintenv
Unknown command 'pintenv' - try 'help'
dragonfly> printenv
Unknown command 'printenv' - try 'help'
dragonfly> printenv
bootargs=console=ttyS0,115200 root=31:03 rootfstype=squashfs init=/sbin/init board=AP152 mtdparts=spi0.0:128k(factory-uboot),128k(u-boot),1024k(uImage),6784k(rootfs),64k(mib0),64k(ART)
bootcmd=bootm 0x9f010000
bootdelay=1
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.1
serverip=192.168.1.10
dir=
lu=tftp 0x80060000 ${dir}tuboot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}ap152${bc}-${squashfs}&&erase 0x9f110000 +0x6d0000&&cp.b $fileaddr 0x9f110000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f010000 +$filesize&&cp.b $fileaddr 0x9f010000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

....but whe I am trying to use only tftd32 is not working. Have no idea why.

And what does the 1401A8C0.img contain?

I think that was the original one strored at 0x81000000 - I have juts typed tftpboot and it started searching for it

Yes, but what's the content?

I don't know. I there a way to see it? I don't have that file on my system/computer.

I read it as it got read /sent.

<1401A8C0.img>: sent 12888 blks

Anyway, it seems it's the file(name) it's requesting.

Aaaa :slight_smile: I have seen that the device is looking for that file and I have took the original firmware, rename it as it was asked and no luck. Unfortunately.

Now I am trying to do tftpboot 0x81000000 firm.bin which is the original one. It is sent to the device but I can't figure out what do I have to erase... as for example here erase 0xbf020000 +0x7c0000(this is from other device).

Now I was looking on the documented partitions here [OpenWrt Wiki] TP-Link TL-WPA8630P v2 and I am puzzled

I did something but...

U-Boot 1.1.4 (Oct 18 2017 - 09:53:45)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 134k for U-Boot at: 87fdc000
Reserving 192k for malloc() at: 87fac000
Reserving 44 Bytes for Board Info at: 87fabfd4
Reserving 36 Bytes for Global Data at: 87fabfb0
Reserving 128k for boot params() at: 87f8bfb0
Stack Pointer at: 87f8bf98
Now running in RAM - U-Boot at: 87fdc000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x60c02100
Autobooting in 1 seconds
dragonfly> tftpboot 0x81000000 firm.bin
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'firm.bin'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
.......
         #################################################################
         #################################################################
         ######################################################
done
Bytes transferred = 6598367 (64aedf hex)
dragonfly> erase 0xbf020000 +0x7c0000
Error: end address (0xbf7dffff) not in flash!
Bad address format
dragonfly> erase 0x9f040000 +0x64B000
Erasing flash...
First 0x4 last 0x68 sector size 0x10000                                                                                                                   104
Erased 101 sectors
dragonfly> cp.b 0x81000000 0x9f040000  0x64B000
Zero length ???
dragonfly> cp.b 0x81000000 0x9f040000 0x64B000
Unknown command 'cp.b' - try 'help'
dragonfly> cp.b 0x81000000 0x9f040000 0x64B000
Unknown command 'cp.b' - try 'help'
dragonfly> cp.b 0x81000000 0x9f040000 0x64B000
Copy to Flash... write addr: 9f040000
done

dragonfly> bootm 0x9f040000
## Booting image at 9f040000 ...
---- fileTag = 9f040000
         text base = ffffffff
         entry point = ffffffff
         hdr->ih_load = 00000000
         hdr->ih_ep = 00000000
   Uncompressing Kernel Image at ffffffff ... Stream with EOS marker is not supportedLZMA ERROR 1 - must RESET board to recover
▒

U-Boot 1.1.4 (Oct 18 2017 - 09:53:28)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 403k for U-Boot at: 87f98000
Reserving 192k for malloc() at: 87f68000
Reserving 44 Bytes for Board Info at: 87f67fd4
Reserving 36 Bytes for Global Data at: 87f67fb0
Reserving 128k for boot params() at: 87f47fb0
Stack Pointer at: 87f47f98
Now running in RAM - U-Boot at: 87f98000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x60c02100
Autobooting in 1 seconds
Trying eth0
eth0 link down
FAIL
Trying eth0
dup 1 speed 1000
HTTP server is starting at IP: 192.168.0.254
HTTP server is ready!


on cmd...
Ping statistics for 192.168.1.20:
    Packets: Sent = 1410, Received = 12, Lost = 1398 (99% loss),
Control-C
^C
C:\Users\GxGL>ping 192.168.0.254 -t

Pinging 192.168.0.254 with 32 bytes of data:
Reply from 192.168.0.254: bytes=32 time<1ms TTL=128
Reply from 192.168.0.254: bytes=32 time<1ms TTL=128
....
Reply from 192.168.0.254: bytes=32 time=6ms TTL=128

on putty...

Request for: /
Request for: /favicon.ico
## Error: request file name not suport!

After clicking upgrade...

Expecting 6598609 bytes in body request message
Found boundary value: "------WebKitFormBoundaryCuj7ejmYHjlpR7jX"
Data will be downloaded at 0x80060000 in RAM
Upgrade type: firmware
Upload file size: 6598367 bytes
Loading: #######################################
         #######################################
         #######################################
.......
         #######################################
         #####

[NM_Debug](firmwareValidCheck) 01303: md5 error.
[NM_Debug](divideUpLoadFile) 01328: firmwareValid error

[NM_Debug](nm_lib_readPtnTable) 00691: NM_PTN_TABLE_BASE = 0x620000
[NM_Debug](nm_lib_readPtnFromNvram) 00519: partition_used_len = -407813932, requried len = 8192
[NM_Debug](nm_lib_readPtnTable) 00699: Reading Partition Table from NVRAM ... OK

[NM_Error](nm_lib_parsePtnIndexFile) 00590: invalid partition-index-file para id.
[NM_Error](nm_lib_readPtnTable) 00704: Parsing Partition Table ... FAILED

[NM_Error](nm_tpFirmwareCheck) 01101: Init failed.
## Error: HTTP upgrade file check failed!

Trying eth0
HTTP server is starting at IP: 192.168.0.254
HTTP server is ready!

Err I have entered wrong size of flash :slight_smile: accordingly after the firmware file size so now it errors.

Need to redo the steps with 8M storage as required lenght will be 0x800000..

but wrong again it worked with 0x7a1200 and still wrong!

Somehow in my head is a mess which partition is which and the size as well.
That being said :slight_smile: ...I didn't find 9f040000 in the partition docs but my bootloader is starting it so it must be the flash, and the size of the flash should be 8Mb (8192).
Please correct me if I am wrong. I am sure I am, but can't see were and what I did wrong :slight_smile:

The last command that I have tried is

tftpboot 0x81000000 firm.bin && erase 0x9f040000 +7c0000 && cp.b 0x81000000 0x9f040000 0x7c0000 && bootm 0x9f040000

or one by one

tftpboot 0x81000000 firm.bin
erase 0x9f040000 +7c0000
cp.b 0x81000000 0x9f040000 0x7c0000
bootm 0x9f040000

Maybe the nvram should be erased aswell but tried erase nvram and didn't worked.

Ah brilliant. If you are able to get the recovery http server, you should be able to upload the stock TP-Link firmware (.bin file from TP-Link firmware .zip), and that should get the device back working.

The http server might also be startable using the command "httpd" according to the u-boot sources in the TP-Link GPL code. You can try "setenv ipaddr 192.168.1.20" to set the IP.

I would avoid any u-boot flash erase guesswork if possible unless your 100% sure. Others tried it and wiped their bootloader, forcing them to SPI flash instead.
E.g.

Hi @jwmullally,

Besides that I have reached the point where I can upload the original image to the device through http, that fails on me at 40% and in the console displays

[NM_Debug] messages...

...as in the last log of my previous post.

I have tried to tftpboot with original firmware and also with openwrt factory one, then tried the web, and failed. I have tried both of them on both of them, first on the stock tried to upload the stock by the web and the the owrt factory and same after sent the owrt factory. Didn't worked as previous.

I don't know yet what I am doing wrong.

I think I see it :slight_smile:

...that should be the +filesize.

According to this post

Bytes transferred = 8126464 (7c0000 hex)
dragonfly> erase 0x9f010000 +7c0000
Erasing flash...

...so the file size should be the hex of the uploaded(transferred) file.

I will try it with this.

...and no! Failed again, same message. :expressionless: