TL-WR840N<W> V4 bricked - LZMA ERROR 1

Hi there,
I bought a used router and tried to reset it normally to later upload OpenWRT to it. To my surprise, it would'nt reset even when holding the RESET button 10-15 seconds. In summary, this router has a PRESET on it which doesn't let you fully reset it.

Well, let's try TFTP then! Uploaded the OpenWRT image for the WR840N V4, it bootlooped and now the only thing I'm getting is (over TTL serial):


U-Boot 1.1.3 (Nov 21 2017 - 10:55:36)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb4000
******************************
Software System Reset Occurred
******************************
gpiomode2 05540554.
gpiomode2 00000000.
gpiomode2 05550555.
flash manufacture id: c8, device id 40 17
find flash: GD25Q64B
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 21 2017  Time:10:55:36
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
continue to starting system.                                                                0
disable switch phyport...

3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04040C0D][04040C0C]
DDR Calibration DQS reg = 00008888

over and over...

I also tried stripping and reuploading on all sorts of locations, to no avail.

What should I do now to get it back running, preferably with OpenWRT :slight_smile:

Thanks in advance!

https://openwrt.org/toh/tp-link/tl-wr841n doesn't say anything about v4 support.

If we would assume it could work, there are older threads about this error, usually caused by wrong region or uboot parameters.

Thanks for the reply! Sorry, I mistakenly said 841N, but it's actually a TL-WR840N<W>

Afaik it's the same as the TL-WR840N, just with a "PRESET" firmware.

Yep, I read all of them, I googled almost every serial line and gathered what I could find. I tried all possible memory addresses that I could find, all parameters that they said, nothing. I tried stripping firmwares at various locations (literally did it by trial and error on what I found about similar devices), both stock and openwrt, to no avail.

did you try to install firmware?
https://openwrt.org/toh/tp-link/tl-wr840n_v4#installation

http://downloads.openwrt.org/releases/19.07.7/targets/ramips/mt76x8/openwrt-19.07.7-ramips-mt76x8-tl-wr840n-v4-squashfs-tftp-recovery.bin

Yes, this was the first attempt, didn't work.
This one initially bricked it, then I tried stock via TFTP: bootloop. Stipped, also nothing. Stripped openwrt, nothing.

I think the real magic here is to specify the correct memory locations to erase and upload what.
I haven't enough expertise in this ahahaha

did you use tftp-recovery.bin firmware?
http://downloads.openwrt.org/releases/19.07.7/targets/ramips/mt76x8/openwrt-19.07.7-ramips-mt76x8-tl-wr840n-v4-squashfs-tftp-recovery.bin

1 Like

Wow! That was quick.

Worked just like a charm. Thank you so much.

I was using the normal one to flash via tftp, this is probably why I bricked it in the first place, didn't know there was a separate one just for tftp.

Full log
U-Boot 1.1.3 (Nov 21 2017 - 10:55:36)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb4000
******************************
Software System Reset Occurred
******************************
gpiomode2 05540554.
gpiomode2 00000000.
gpiomode2 05550555.
flash manufacture id: c8, device id 40 17
find flash: GD25Q64B
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 21 2017  Time:10:55:36
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!..................................................
starting recovery...
TODO, Read MAC Address from Flash


 netboot_common, argc= 3

 NetTxPacket = 0x83FE3D80

 KSEG1ADDR(NetTxPacket) = 0xA3FE3D80

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
TFTP from server 192.168.0.66; our IP address is 192.168.0.2
Filename 'tp_recovery.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80060000
Loading: T T T T checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
T Got ARP REPLY, set server/gtwy eth addr (04:92:26:16:97:14)
Got it
################################################################checksum bad
#
         #################################################################
         #################################################################
         #################################################################
         ##########################################################checksum bad
##checksum bad
#####
         #######################################checksum bad
##########################
         #################################################################
         #################################################################
         #################################################################
         ###############################Got ARP REQUEST, return our IP
##################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############################
done
Bytes transferred = 8126464 (7c0000 hex)
NetBootFileXferSize= 007c0000

 Erase flash !!
From 0x20000 length 0x7A0000
..........................................................................................................................

 Copy 0x80080000 to 0x00020000, count 0x7A0000....
..........................................................................................................................
[04040C0D][04040C0B]
DDR Calibration DQS reg = 00008788


U-Boot 1.1.3 (Nov 21 2017 - 10:55:36)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb4000
******************************
Software System Reset Occurred
******************************
gpiomode2 05540554.
gpiomode2 00000000.
gpiomode2 05550555.
flash manufacture id: c8, device id 40 17
find flash: GD25Q64B
============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 21 2017  Time:10:55:36
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
continue to starting system.                                                  0
disable switch phyport...

3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...

[    0.000000] Linux version 4.14.221 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11306-c4a6851c72)) #0 Mon Feb 15 15:22:37 2021
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is TP-Link TL-WR840N v4
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from 0x80485740 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 58820K/65536K available (3930K kernel code, 185K rwdata, 504K rodata, 1196K init, 208K bss, 6716K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 580MHz
[    0.000000] timer_probe: no matching timers found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.007559] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.073516] pid_max: default: 32768 minimum: 301
[    0.078186] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.084542] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.096387] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.105883] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.111818] pinctrl core: initialized pinctrl subsystem
[    0.119352] NET: Registered protocol family 16
[    0.143459] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.149097] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.154588] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.164909] clocksource: Switched to clocksource MIPS
[    0.170887] NET: Registered protocol family 2
[    0.175999] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.182691] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.188881] TCP: Hash tables configured (established 1024 bind 1024)
[    0.195130] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.200730] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.207075] NET: Registered protocol family 1
[    0.214498] Crashlog allocated RAM at address 0x3f00000
[    0.221176] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.232950] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.238579] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.258322] io scheduler noop registered
[    0.262051] io scheduler deadline registered (default)
[    0.267926] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.276693] console [ttyS0] disabled
[    0.280130] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[    0.288910] console [ttyS0] enabled
[    0.288910] console [ttyS0] enabled
[    0.295909] bootconsole [early0] disabled
[    0.295909] bootconsole [early0] disabled
[    0.305389] spi-mt7621 10000b00.spi: sys_freq: 193333333
[    0.319536] m25p80 spi0.0: gd25q64 (8192 Kbytes)
[    0.324266] 4 fixed-partitions partitions found on MTD device spi0.0
[    0.330770] Creating 4 MTD partitions on "spi0.0":
[    0.335657] 0x000000000000-0x000000020000 : "boot"
[    0.341367] 0x000000020000-0x0000007c0000 : "firmware"
[    0.349420] 2 tplink-fw partitions found on MTD device firmware
[    0.355502] Creating 2 MTD partitions on "firmware":
[    0.360547] 0x000000000000-0x00000017f777 : "kernel"
[    0.366500] 0x00000017f778-0x0000007a0000 : "rootfs"
[    0.372231] mtd: device 3 (rootfs) set to be root filesystem
[    0.379518] 1 squashfs-split partitions found on MTD device rootfs
[    0.385881] 0x0000003d0000-0x0000007a0000 : "rootfs_data"
[    0.392211] 0x0000007c0000-0x0000007d0000 : "config"
[    0.398109] 0x0000007d0000-0x000000800000 : "factory"
[    0.404652] libphy: Fixed MDIO Bus: probed
[    0.420919] rt3050-esw 10110000.esw: link changed 0x00
[    0.427063] mtk_soc_eth 10100000.ethernet: generated random MAC address 52:6b:03:cf:18:36
[    0.436083] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    0.446175] NET: Registered protocol family 10
[    0.454775] Segment Routing with IPv6
[    0.458668] NET: Registered protocol family 17
[    0.463227] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    0.476398] 8021q: 802.1Q VLAN Support v1.8
[    0.490621] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[    0.504335] Freeing unused kernel memory: 1196K
[    0.508973] This architecture does not have kernel memory protection.
[    1.592228] init: Console is alive
[    1.596017] init: - watchdog -
[    2.214923] random: fast init done
[    2.609569] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.689377] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.707279] init: - preinit -
[    3.985444] rt3050-esw 10110000.esw: link changed 0x00
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    4.156163] random: procd: uninitialized urandom read (4 bytes read)
[    7.358913] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    7.391231] urandom-seed: Seed file not found (/etc/urandom.seed)
[    7.399861] rt3050-esw 10110000.esw: link changed 0x02
[    7.520486] procd: - early -
[    7.523535] procd: - watchdog -
[    8.177967] procd: - watchdog -
[    8.181509] procd: - ubus -
[    8.332482] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.408817] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.415873] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.423296] procd: - init -
Please press Enter to activate this console.
[    9.404416] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.567589] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    9.593003] Loading modules backported from Linux version v4.19.161-0-gdaefdc9eb24b
[    9.600854] Backport generated by backports.git v4.19.161-1-0-g4bb568fe
[    9.627331] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.652942] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[    9.766953] xt_time: kernel timezone is -0000
[    9.883206] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[    9.905977] mt76_wmac 10300000.wmac: Invalid MAC address, using random address 3e:7c:e7:c3:9e:73
[    9.933050] urngd: v1.0.2 started.
[   10.138890] random: crng init done
[   10.142345] random: 6 urandom warning(s) missed due to ratelimiting
[   10.937216] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[   10.943237] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[   10.984944] mt76_wmac 10300000.wmac: firmware init done
[   11.236682] PPP generic driver version 2.4.2
[   11.255799] NET: Registered protocol family 24
[   11.267186] kmodloader: done loading kernel modules from /etc/modules.d/*
[   32.221108] rt3050-esw 10110000.esw: link changed 0x00
[   35.784574] rt3050-esw 10110000.esw: link changed 0x02
[   37.432596] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   37.449463] jffs2_build_filesystem(): unlocking the mtd device...
[   37.455035] done.
[   37.463262] jffs2_build_filesystem(): erasing all blocks after the end marker...
[   37.901062] br-lan: port 1(eth0.1) entered blocking state
[   37.914216] br-lan: port 1(eth0.1) entered disabled state
[   37.920217] device eth0.1 entered promiscuous mode
[   37.925132] device eth0 entered promiscuous mode
[   37.992173] br-lan: port 1(eth0.1) entered blocking state
[   37.997730] br-lan: port 1(eth0.1) entered forwarding state
[   38.003596] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   38.905421] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   45.493491] done.
[   45.495525] jffs2: notice: (1161) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   45.706553] overlayfs: upper fs does not support tmpfile.
[   80.518661] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready


BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07.7, r11306-c4a6851c72
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#

Also, before I forget it, a little tip for future readers. If you have a 2.5GbE controller and tftp won't work at all for you (aka Serial just waits forever for tftp with "bad checksum" and then restarts the router), go into the Device Manager, click on the Ethernet controller, go to the Advanced tab and put "Speed & Duplex" to "10 Mbps Half Duplex" and it should work.
If this, however, still doesn't work, try setting the "EEE Max Support Speed" to "10Mbps Full Duplex", this should also do the trick.


Also, don't forget to put it back later, or else you'll have a slow Ethernet port and totally forget why :stuck_out_tongue:

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.