Hi. I bought second hand TP-Link Archer C60 V1 that seemed bricked but afterr connecting to serial console I found that the booloader probably has similar problem like version V3 in link (tftp method fails because of wrong name)
I tried three firmwares: two stock ArcherC60v1_eu-up-ver1-0-1-P1[20160712-rel64863].bin and openwrt-19.07.7-ath79-generic-tplink_archer-c60-v1-squashfs-factory.bin
Unfortunately folks in C60 V3 topic did not disclose how exactly they repaired (version string and checksum) the firmware.
Here is serial console log for OpenWRT firmware session:
U-Boot 1.1.4 (Aug 5 2016 - 09:02:26)
ap151 - Dragonfly 1.0
DRAM: 64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 338k for U-Boot at: 83fa8000
Reserving 32832k for malloc() at: 81f98000
Reserving 44 Bytes for Board Info at: 81f97fd4
Reserving 36 Bytes for Global Data at: 81f97fb0
Reserving 128k for boot params() at: 81f77fb0
Stack Pointer at: 81f77f98
Now running in RAM - U-Boot at: 83fa8000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash: 8 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Dragonfly----> S27 PHY *
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :50
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :50
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :50
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :50
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x82
Trying eth0
eth0 link down
FAIL
Trying eth1
enet1 port3 up
dup 1 speed 1000
Using eth1 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Filename 'tp_recovery.bin'.
Load address: 0x80800000
Loading: *T #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###############
done
Bytes transferred = 8061579 (7b028b hex)
Firmware recovery: FLASH_SIZE = 8 filesize = 0x7b028b.
Reading Partition Table from NVRAM ... OK
Parsing Partition Table ... OK
File Length:8061579
[NM_Error](nm_api_readPtnFromNvram) 00133: partition name not found.
[Error]sysmgr_cfg_getProductInfoFromNvram(): 694 @ ucm_nvram_proInfoRead() failed.
[Error]sysmgr_cfg_checkSupportList(): 870 @ Archer C60 NOT Match.
[Error]sysmgr_cfg_checkSupportList(): 870 @ Archer C60 NOT Match.
Firmwave not supports, check failed.
[NM_Error](nm_checkUpdateContent) 00743: the firmware is not for this model
[NM_Error](nm_buildUpgradeStruct) 00834: checkUpdateContent failed.
Firmware Invalid!
U-Boot 1.1.4 (Aug 5 2016 - 09:02:26)
ap151 - Dragonfly 1.0
DRAM: 64 MB
Top of RAM usable for U-Boot at: 84000000
Reserving 338k for U-Boot at: 83fa8000
Reserving 32832k for malloc() at: 81f98000
Reserving 44 Bytes for Board Info at: 81f97fd4
Reserving 36 Bytes for Global Data at: 81f97fb0
Reserving 128k for boot params() at: 81f77fb0
Stack Pointer at: 81f77f98
Now running in RAM - U-Boot at: 83fa8000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash: 8 MB
Using default environment
Doesn't work. If I tftp it and then reset, it gives me a lot of errors and won't boot. More specifically:
Reading Partition Table from NVRAM ... OK
Parsing Partition Table ... OK
[NM_Error](nm_api_readPtnFromNvram) 00137: partition name not found.
[NM_Error](nm_api_checkInteger) 00369: factory boot check integer read flag partition fail.
Autobooting in 1 seconds
Trying eth0
eth0 link down
FAIL
Trying eth1
eth1 link down
FAIL
Trying eth0
eth0 link down
FAIL
Trying eth1
enet1 port3 up
dup 1 speed 1000
HTTP server is starting at IP: 192.168.0.1
HTTP server is ready!
Inside the HTTP server I can't flash any firmware because it mismatches the version with some table (@ Archer C60 NOT Match.), idk why.
If I try over TFTP and load the factory image, this happens:
fw type name : Cloud.
Firmware process common.
Image verify OK!
Firmware file Verify ok!
[NM_Error](nm_api_readPtnFromNvram) 00137: partition name not found.
[Error]sysmgr_cfg_getProductInfoFromNvram(): 756 @ ucm_nvram_proInfoRead() failed.
[Error]sysmgr_cfg_checkSupportList(): 932 @ Archer C60 NOT Match.
[Error]sysmgr_cfg_checkSupportList(): 932 @ Archer C60 NOT Match.
Firmwave not supports, check failed.
[NM_Error](nm_checkUpdateContent) 01172: the firmware is not for this model
[NM_Error](nm_buildUpgradeStruct) 01274: checkUpdateContent failed.
## Error: HTTP upgrade file check failed!
Installation via UART/Uboot (see GIT commit). See also Opening the Case and Serial section below for serial connection and parameters.
Connect LAN cable.
Interrupt boot during Autoboot delay. You only have 1 second to type “tpl” to get Ath> prompt. Reboot router until you get Ath> Uboot prompt.
Setup TFTP server on IP address 192.168.0.10 and store OpenWRT system upgrade image (sysupgrade.bin) for Archer C60v2 into root directory.
As per commit message:
Note: Replace $filesize below with value in hex reported after tftp command completes below. Uboot should replace the variable automatically, but it didn't seem to.
Obtain an initramfs build for the model and version. These are found in the snapshot directory.
TFTP the initramfs build to somewhere in RAM (0x81000000 for this system)
bootm 0x81000000 to launch the initramfs build directly in RAM. The router is now running a full OpenWrt, but from RAM. This is only for recovery purposes since it can't save any files permanently, and won't boot again after the power is cut off.
scp a sysupgrade build to /tmp in OpenWrt.
use sysupgrade -n to flash this file. OpenWrt will take care of placing it at the right flash address and not damaging other data in flash.
But it would be nice if we had correct firmware for C60 V1 for tftp method as is the case for C60 V3 (link in first post).
At the moment you can access the device via web browser. Follow the instructions on this link. I would suggest you to start with the oldest, not the latest factory image, that you can find. You can monitor the file upload via the serial console. If the router rejects the factory firmware, you have probably overwritten some important service data in the flash memory.
Flash the device one more time with the correct OpenWrt sysupgrade file over the serial port. When you're done, don’t type reset, but bootm 0x9f300000 to see if the device will start normally. This is not a solution, but it could be some kind of start.
Load address: 0x80060000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
################################################################
done
Bytes transferred = 4653360 (470130 hex)
ath> erase 0x9f300000 +0x470130
Erasing flash...
First 0x30 last 0x77 sector size 0x10000 119
Erased 72 sectors
ath> cp.b 0x80060000 0x9f300000 0x470130
Copy to Flash... write addr: 9f300000
done
ath> bootm 0x9f30000
## Booting image at 09f30000 ...
Bad Magic Number
ath> bootm 0x9f300000
## Booting image at 9f300000 ...
Image Name: MIPS OpenWrt Linux-4.14.221
Created: 2021-02-15 15:22:37 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1599236 Bytes = 1.5 MB
Load Address: 80060000
Entry Point: 80060000
Verifying Checksum at 0x9f300040 ...OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 67108864
Starting kernel ...
[ 0.000000] Linux version 4.14.221 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11306-c4a6851c72)) #0 Mon Feb 15 15:22:37 2021
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[ 0.000000] MIPS: machine is TP-Link Archer C60 v2
[ 0.000000] SoC: Qualcomm Atheros QCA956X ver 1 rev 0
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] random: get_random_bytes called from 0x80501740 with crng_init=0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16256
[ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 58328K/65536K available (4037K kernel code, 163K rwdata, 532K rodata, 1212K init, 212K bss, 7208K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] CPU clock: 775.000 MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4932285024 ns
[ 0.000007] sched_clock: 32 bits at 387MHz, resolution 2ns, wraps every 5541893118ns
[ 0.008236] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[ 0.074781] pid_max: default: 32768 minimum: 301
[ 0.079800] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.086785] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.097666] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.108058] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.114545] pinctrl core: initialized pinctrl subsystem
[ 0.122067] NET: Registered protocol family 16
[ 0.129654] PCI host bridge /ahb/pcie-controller@18250000 ranges:
[ 0.136130] MEM 0x0000000012000000..0x0000000013ffffff
[ 0.141634] IO 0x0000000000000000..0x0000000000000000
[ 0.161180] PCI host bridge to bus 0000:00
[ 0.165505] pci_bus 0000:00: root bus resource [mem 0x12000000-0x13ffffff]
[ 0.172788] pci_bus 0000:00: root bus resource [io 0x0000]
[ 0.178659] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[ 0.185822] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.194563] pci 0000:00:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[ 0.204828] clocksource: Switched to clocksource MIPS
[ 0.211032] NET: Registered protocol family 2
[ 0.216397] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.223751] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.230503] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.237331] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.243503] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.250364] NET: Registered protocol family 1
[ 0.257535] Crashlog allocated RAM at address 0x3f00000
[ 0.264175] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[ 0.275233] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.281374] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.299886] io scheduler noop registered
[ 0.304022] io scheduler deadline registered (default)
[ 0.311106] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[ 0.319380] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.328148] console [ttyS0] disabled
[ 0.331944] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[ 0.341076] console [ttyS0] enabled
[ 0.341076] console [ttyS0] enabled
[ 0.348641] bootconsole [early0] disabled
[ 0.348641] bootconsole [early0] disabled
[ 0.366545] m25p80 spi0.0: gd25q64 (8192 Kbytes)
[ 0.371365] 6 fixed-partitions partitions found on MTD device spi0.0
[ 0.377952] Creating 6 MTD partitions on "spi0.0":
[ 0.382908] 0x000000000000-0x00000001fb00 : "factory-boot"
[ 0.389269] 0x00000001fb00-0x000000020000 : "mac"
[ 0.394756] 0x000000020000-0x000000030000 : "u-boot"
[ 0.400586] 0x000000030000-0x0000007d0000 : "firmware"
[ 0.409414] 2 uimage-fw partitions found on MTD device firmware
[ 0.415574] Creating 2 MTD partitions on "firmware":
[ 0.420715] 0x000000000000-0x000000186744 : "kernel"
[ 0.426475] 0x000000186744-0x0000007a0000 : "rootfs"
[ 0.432212] mtd: device 5 (rootfs) set to be root filesystem
[ 0.438143] 1 squashfs-split partitions found on MTD device rootfs
[ 0.444532] 0x000000470000-0x0000007a0000 : "rootfs_data"
[ 0.450744] 0x0000007d0000-0x0000007f0000 : "tplink"
[ 0.456574] 0x0000007f0000-0x000000800000 : "art"
[ 0.463010] libphy: Fixed MDIO Bus: probed
[ 0.805926] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[ 1.485181] libphy: ag71xx_mdio: probed
[ 1.489843] libphy: ar8xxx-mdio: probed
[ 1.497778] switch0: Atheros AR8229 rev. 1 switch registered on mdio-bus.0
[ 1.570227] ag71xx 1a000000.eth: connected to PHY at fixed-0:00 [uid=00000000, driver=Generic PHY]
[ 1.580043] eth0: Atheros AG71xx at 0xba000000, irq 5, mode: gmii
[ 1.588653] NET: Registered protocol family 10
[ 1.598127] Segment Routing with IPv6
[ 1.601987] NET: Registered protocol family 17
[ 1.606667] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 1.620065] 8021q: 802.1Q VLAN Support v1.8
[ 1.970511] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:1f:04 [uid=004dd042, driver=Generic PHY]
[ 1.981102] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[ 1.987914] hctosys: unable to open rtc device (rtc0)
[ 1.995581] squashfs: SQUASHFS error: unable to read id index table
[ 2.002330] jffs2: Flash size not aligned to erasesize, reducing to 6208KiB
[ 2.009808] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x6873 instead
[ 2.019619] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x6f04 instead
[ 2.029423] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0xbd91 instead
[ 2.039228] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0x1300 instead
...
...
...
[ 13.905301] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00510010: 0x9b24 instead
[ 13.915103] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00510014: 0x481c instead
[ 13.924905] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00510018: 0x1967 instead
[ 13.934691] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0051001c: 0x42aa instead
[ 13.944493] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00510020: 0x941a instead
[ 13.954294] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00510024: 0x1b7c instead
[ 13.964094] jffs2: Further such events for this erase block will not be printed
[ 13.987680] jffs2: Old JFFS2 bitmask found at 0x00516524
[ 13.993162] jffs2: You cannot use older JFFS2 filesystems with newer kernels
[ 14.021484] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00520000: 0x60e0 ...
...
...
[ 14.508989] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00550018: 0xaf44 instead
[ 14.518792] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0055001c: 0x17af instead
[ 14.528595] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00550020: 0xa3f0 instead
[ 14.538395] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00550024: 0xbce4 instead
[ 14.548195] jffs2: Further such events for this erase block will not be printed
[ 14.562483] jffs2: Old JFFS2 bitmask found at 0x0055210c
[ 14.567979] jffs2: You cannot use older JFFS2 filesystems with newer kernels
[ 14.605577] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00560000: 0x6d30 instead
...
...
...
[ 15.469398] jffs2: Further such events for this erase block will not be printed
[ 15.498704] jffs2: Empty flash at 0x005b2e6c ends at 0x005b98bc
[ 15.519275] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00600000: 0xa4ef instead
[ 15.529082] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00600018: 0x602a instead
[ 15.538879] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0060001c: 0x602a instead
[ 15.548681] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00600020: 0x602a instead
[ 15.558485] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00600038: 0x675d instead
[ 15.589787] jffs2: Empty flash at 0x0060393c ends at 0x006098bc
[ 15.595919] jffs2: CLEANMARKER node found at 0x006098bc, not first node in block (0x00600000)
[ 15.618461] jffs2: notice: (1) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[ 15.634339] VFS: Mounted root (jffs2 filesystem) readonly on device 31:5.
[ 15.647939] Freeing unused kernel memory: 1212K
[ 15.652616] This architecture does not have kernel memory protection.
[ 15.659346] Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
[ 15.678990] Rebooting in 1 seconds..
However, flashing and booting from RAM works, as seen here (also my post): Archer C60 V2 Softbricked - #8 by Fusseldieb
V1 and V2 are probably a little different with memory addresses.
I can get it to boot successfully and even set up wifi and stuff, however, it's all from RAM. Something is still messed up.
I even tried doing a sysupgrade via LuCI, but as soon as I rebooted, the same error appeared again (It goes into HTTP recovery).