TP-Link Archer C7 (US) V4 AC1750 bricked after trying JFFS2. Any way to recover it?

amg1127 · June 18, 2025, 7:56am

Hi there,

I have a Archer C7 (US) V4 AC1750 that I bricked after attempting to enable JFFS2 in DD-WRT firmware settings. Currently, I am able to boot an OpenWRT firmware in failsafe mode; however, I couldn't figure out where to go from the point I am. Please, may I have some assistance with bringing the router to life, if possible?

Thanks.

How have I bricked the router

The router was purchased used from a marketplace website some days ago. It was running a stock TP-Link firmware and, apparently, was working fine. However, I wanted to install an alternative firmware to enable features that the stock firmware doesn't provide. Specifically, I wanted to configure ethernet firewalling (ebtables / nftables) and configure a guest WiFi network behind my main wired network that would be only capable to forward packets to a known MAC address belonging to my gateway. Unfortunately, I didn't take note of the version of the stock firmware that was running.

Then, I followed documented installation steps to install the 06-09-2025-r61711 revision of tplink-archer-c7-v4 DD-WRT firmware. The flashing process completed successfully and I managed to setup an administrative password and browse to DD-WRT configuration pages.

I reached an article telling me that I should enable JFFS in order to store a custom initialization script of mine to configure ebtables, so I tried to use DD-WRT configuration pages and ticked a Enable JFFS2 checkbox that I found. My router bricked after I rebooted it from the web interface.

How is the router now

After bricking the router, I started to browse pages describing recovery procedures, both on DD-WRT and OpenWRT websites. At the end, I purchased a Duinotech Arduino Compatible USB to Serial Adaptor and connected my laptop computer to the serial console of the router (note: similarly to TP-Link Archer C7 V5, the RX pin had to be manually connected to the connector).

By following the TP-Link Archer C6 v2 - Recover via serial and tftp (working uboot) article, I have managed to flash my router with OpenWRT 24.10.0 and boot into failsafe mode; however, I could not progress to a full OpenWRT boot.

setenv serverip 192.168.0.66
tftpboot 0x80060000 openwrt-24.10.0-ath79-generic-tplink_archer-c7-v4-initramfs-kernel.bin
erase 0x9f040000 +644a5c
cp.b 0x80060000 0x9f040000 0x644a5c
bootm 0x9f040000

If I simply turn on my router, the http://192.168.0.1/ address presents a website with these error messages:

System error. The router cannot start up normally.
Please upgrade your router. You can download the firmware file from www.tp-link.com.

Also, the router's serial console presents the below boot messages:

U-Boot 1.1.4 (Aug 10 2017 - 18:22:29)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 395k for U-Boot at: 87f9c000
Reserving 16448k for malloc() at: 86f8c000
Reserving 44 Bytes for Board Info at: 86f8bfd4
Reserving 36 Bytes for Global Data at: 86f8bfb0
Reserving 128k for boot params() at: 86f6bfb0
Stack Pointer at: 86f6bf98
Now running in RAM - U-Boot at: 87f9c000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x4b962100
[NM_Error](nm_lib_parsePtnIndexFile) 00589: invalid partition-index-file para id.

[NM_Error](nm_lib_readPtnTable) 00703: Parsing Partition Table ... FAILED



[NM_Error](nm_api_checkInteger) 00345: factory boot check integer partition init fail.

Hit any key to stop autoboot:  1  0
Trying eth0
eth0 link down
FAIL
Trying eth0
dup 1 speed 1000
HTTP server is starting at IP: 192.168.0.1
HTTP server is ready!

Request for: /
Request for: /favicon.ico
## Error: request file name not suport!
Request for: /favicon.ico
## Error: request file name not suport!
Request for: /favicon.ico
## Error: request file name not suport!
Request for: /favicon.ico
## Error: request file name not suport!
Request for: /favicon.ico
## Error: request file name not suport!
Request for: /favicon.ico
## Error: request file name not suport!
Request for: /favicon.ico
## Error: request file name not suport!
Request for: /favicon.ico
## Error: request file name not suport!
Request for: /favicon.ico
## Error: request file name not suport!
Request for: /favicon.ico
## Error: request file name not suport!

The firmware recovery webpage doesn't work, though. The recovery process started from the website aborts when the upload reaches 40% or so.

Firmware recovery via TFTP also aborts when the upload reaches 40% or so:

U-Boot 1.1.4 (Aug 10 2017 - 18:22:29)

ap152 - Dragonfly 1.0

DRAM:  128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 395k for U-Boot at: 87f9c000
Reserving 16448k for malloc() at: 86f8c000
Reserving 44 Bytes for Board Info at: 86f8bfd4
Reserving 36 Bytes for Global Data at: 86f8bfb0
Reserving 128k for boot params() at: 86f6bfb0
Stack Pointer at: 86f6bf98
Now running in RAM - U-Boot at: 87f9c000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
athr_mgmt_init ::done
Dragonfly  ----> S17 PHY *
athrs17_reg_init: complete
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x80000000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x4b962100
run command setenv serverip 192.168.0.66;setenv ipaddr 192.168.0.86
run command tftp 0x80060000 ArcherC7v4_tp_recovery.bin
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.86
Filename 'ArcherC7v4_tp_recovery.bin'.
Load address: 0x80060000
Loading: *#################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 ##########################################Tftp server tranfer fail!
tftpboot firmware failed, now start normally.
[NM_Error](nm_lib_parsePtnIndexFile) 00589: invalid partition-index-file para id.

[NM_Error](nm_lib_readPtnTable) 00703: Parsing Partition Table ... FAILED



[NM_Error](nm_api_checkInteger) 00345: factory boot check integer partition init fail.

Hit any key to stop autoboot:  1  0
Trying eth0
HTTP server is starting at IP: 192.168.0.1
HTTP server is ready!


Web failsafe mode aborted!

ath> tftpboot 0x8006               setenv serverip 192.168.0.66

ath> tftpboot 0x80060000 ArcherC7v4_tp_recovery.bin

Trying eth0
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.1
Filename 'ArcherC7v4_tp_recovery.bin'.
Load address: 0x80060000
Loading: *#################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #################################################################
 #############################################Tftp server tranfer fail!
ath>

If I interrupt the normal boot process of the router and manually boot the firmware written at address 0x9f040000, I am able to boot OpenWrt 18.06.1, r7258-5eb055306f in safe mode, as well as OpenWrt 24.10.0, r28427-6df0e3d02a in safe mode. However, OpenWRT booted in normal mode produces kernel panics and automatic reboots. In safe mode, the sysupgrade command seems to flash the router properly; however, the flashed firmware doesn't boot fully.

brada4 · June 18, 2025, 8:27am

run firstboot ; reboot
then wait a minute or two after boot for jffs to format.
Then show the output of ubus call system board and mount -v

can you remove spree of essentially duplicate posts.

It is only interesting if a prroblem pops up in 23/24/snapshot with maximum dive back as one working version.

amg1127 · June 18, 2025, 9:04am

Thanks, Brada.
I have removed the posts with detailed boot messages.

If I boot OpenWrt in safe mode, run firstboot ; reboot and let OpenWrt boot in normal mode, I get a kernel panic and the router restarts.

If I run firstboot ; reboot and boot OpenWrt in safe mode, nothing seems to happen. The output of the requested commands are presented below.

root@OpenWrt-failsafe:/# ubus call system board
Failed to connect to ubus

root@OpenWrt-failsafe:/# mount -v
/dev/root on / type squashfs (ro,relatime,errors=continue)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate)
tmpfs on /dev type tmpfs (rw,nosuid,noexec,relatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,mode=600,ptmxmode=000)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)

frollic · June 18, 2025, 9:07am

have you tried flashing an image from tp-link ?

brada4 · June 18, 2025, 9:22am

Get a fresh OpenWrt sysupgrade file , scp-upload it to /tmp

(not initramfs you already got on your disk)

then sysupgrade (it is a command, it has a help text) not keeping settings. Boot messages should mention something about jfffs being initialised and then say "pres a key to enter this console" - ok press that key repeat mount and ubus attempt.

amg1127 · June 18, 2025, 9:38am

I have tried to flash Archer C7(US)_V4_211231 image from here: https://www.tp-link.com/au/support/download/archer-c7/v4/#Firmware

If I flash the router with the firmware from tp-link and this OpenWrt command line: sysupgrade -F -n /tmp/c7v4_us-up-ver1-0-9-P1[20211231-rel65285].bin, the router doesn't boot at all.

eth0: 00:03:7f:09:0b:ad
eth0 up
eth0
Setting 0x181162c0 to 0x4b962100
[NM_Error](nm_lib_parsePtnIndexFile) 00589: invalid partition-index-file para id.
[NM_Error](nm_lib_readPtnTable) 00703: Parsing Partition Table ... FAILED

[NM_Error](nm_api_checkInteger) 00345: factory boot check integer partition init fail.
Hit any key to stop autoboot:  0

ath> bootm 0x9f040000
## Booting image at 9f040000 ...
Bad Magic Number
ath>

If I flash the router via TFTP, the same Bad Magic Number message pops up.

ath> tftpboot 0x80060000 c7v4_us-up-ver1-0-9-P1[20211231-rel65285].bin
Trying eth0
Using eth0 device
TFTP from server 192.168.0.66; our IP address is 192.168.0.1
Filename 'c7v4_us-up-ver1-0-9-P1[20211231-rel65285].bin'.
Load address: 0x80060000
Loading: #################################################################
         ############################################################
done
Bytes transferred = 15283001 (e93339 hex)
ath> erase 0x9f040000 +e93339
Erasing flash...
First 0x4 last 0xed sector size 0x10000                                                                                                                                                    237
Erased 234 sectors
ath> cp.b 0x80060000 0x9f040000 0xe93339
Copy to Flash... write addr: 9f040000
done
ath> bootm 0x9f040000
## Booting image at 9f040000 ...
Bad Magic Number

frollic · June 18, 2025, 9:40am

bad magic would indicate it's a firmware for a diff device/region.

amg1127 · June 18, 2025, 9:47am

Right; I will try loading stock firmware from different regions. Interestingly, the label under the device does say that it is a V4 device and US region.

amg1127 · June 18, 2025, 10:00am

From your link, I downloaded OpenWrt 24.10.1, r28597-0425664679. Initially, I flashed my router with openwrt-24.10.1-ath79-generic-tplink_archer-c7-v4-initramfs-kernel.bin, then booted OpenWrt in safe mode and ran sysupgrade -n openwrt-24.10.1-ath79-generic-tplink_archer-c7-v4-squashfs-sysupgrade.bin. Unfortunately, I still get a kernel panic while booting in normal mode.

Please press Enter to activate this console.
[   19.078183] kmodloader: loading kernel modules from /etc/modules.d/*
[   20.146225] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
[   20.154019] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
[   20.905552] urngd: v1.0.2 started.
[   21.161750] PPP generic driver version 2.4.2
[   21.184901] NET: Registered PF_PPPOX protocol family
[   21.287277] ath10k 6.10 driver, optimized for CT firmware, probing pci device: 0x3c.
[   21.344710] ath10k_pci 0000:00:00.0: enabling device (0000 -> 0002)
[   21.353464] ath10k_pci 0000:00:00.0: pci irq legacy oper_irq_mode 1 irq_mode 0 reset_mode 0
[   25.285229] ath10k_pci 0000:00:00.0: qca988x hw2.0 target 0x4100016c chip_id 0x043202ff sub 0000:0000
[   25.294810] ath10k_pci 0000:00:00.0: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   25.305268] ath10k_pci 0000:00:00.0: firmware ver 10.1-ct-8x-__fW-022-ecad3248 api 2 features wmi-10.x,has-wmi-mgmt-tx,mfp,txstatus-noack,wmi-10.x-CT,ratemask-CT,txrate-CT,get-temp-CT,tx-rc-CT,cust-stats-CT,retry-gt2-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT crc32 3e4cf97f
[   26.192163] ath10k_pci 0000:00:00.0: board_file api 1 bmi_id N/A crc32 bebc7c08
[   28.193794] ath10k_pci 0000:00:00.0: failed to receive control response completion, polling..
[   29.233818] ath10k_pci 0000:00:00.0: ctl_resp never came in (-145)
[   29.240232] ath10k_pci 0000:00:00.0: failed to connect to HTC: -145
[   29.377780] ------------[ cut here ]------------
[   29.382569] WARNING: CPU: 0 PID: 123 at kernel/workqueue.c:3426 0x8009c69c
[   29.389707] Modules linked in: ath10k_pci(O+) ath10k_core(O) ath(O) pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211(O) lzo cfg80211(O) slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 lzo_rle lzo_decompress lzo_compress libcrc32c hwmon crc_ccitt compat(O) ledtrig_usbport sha512_generic seqiv sha3_generic jitterentropy_rng drbg hmac geniv rng cmac crypto_acompress fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug(O) phy_ar7200_usb phy_ar7100_usb usbcore nls_base usb_common crc32c_generic
[   29.460023] CPU: 0 PID: 123 Comm: kworker/u2:3 Tainted: G           O       6.6.86 #0
[   29.468118] Workqueue: ath10k_wq 0x82a20420 [ath10k_core@1b713053+0x56000]
[   29.475230] Stack : 00000000 80758360 81b59c4c 000303a1 00000000 00000000 00000000 00000000
[   29.483884]         00000000 00000000 00000000 00000000 00000000 00000001 81b59c08 746e43cb
[   29.492530]         81b59ca0 00000000 00000000 81b59b30 00000038 80701d84 00000000 ffffffea
[   29.501186]         000000aa 81b59b3c 000000aa 807f9720 8071a9b8 81b59be8 00000000 8009c69c
[   29.509842]         00000009 000303a1 81a1fa50 61c88647 00000018 803d100c 00000000 809b0000
[   29.518496]         ...
[   29.521023] Call Trace:
[   29.521160] [<80701d84>] 0x80701d84
[   29.527338] [<8009c69c>] 0x8009c69c
[   29.530944] [<803d100c>] 0x803d100c
[   29.534604] [<800661e8>] 0x800661e8
[   29.538211] [<800661f0>] 0x800661f0
[   29.541812] [<806d8750>] 0x806d8750
[   29.545415] [<800849b0>] 0x800849b0
[   29.549016] [<8009c69c>] 0x8009c69c
[   29.552617] [<80084a40>] 0x80084a40
[   29.556220] [<801dcb3c>] 0x801dcb3c
[   29.559851] [<8009c69c>] 0x8009c69c
[   29.563449] [<801da9f8>] 0x801da9f8
[   29.567052] [<8049b74c>] 0x8049b74c
[   29.570654] [<801ef340>] 0x801ef340
[   29.574315] [<8009c7f0>] 0x8009c7f0
[   29.577951] [<801dcb3c>] 0x801dcb3c
[   29.581676] [<82a23658>] 0x82a23658 [ath10k_core@1b713053+0x56000]
[   29.588239] [<82a2e784>] 0x82a2e784 [ath10k_core@1b713053+0x56000]
[   29.594778] [<82a1e880>] 0x82a1e880 [ath10k_core@1b713053+0x56000]
[   29.601162] [<8050a6fc>] 0x8050a6fc
[   29.604972] [<82a20b0c>] 0x82a20b0c [ath10k_core@1b713053+0x56000]
[   29.611477] [<8009ed9c>] 0x8009ed9c
[   29.615195] [<8009f35c>] 0x8009f35c
[   29.618795] [<8009efc4>] 0x8009efc4
[   29.622397] [<800a661c>] 0x800a661c
[   29.626000] [<8009efc4>] 0x8009efc4
[   29.629601] [<800a661c>] 0x800a661c
[   29.633204] [<800a6718>] 0x800a6718
[   29.636806] [<800a661c>] 0x800a661c
[   29.640407] [<800a661c>] 0x800a661c
[   29.644010] [<800619f8>] 0x800619f8
[   29.647621]
[   29.649203] ---[ end trace 0000000000000000 ]---
[   29.653986] ------------[ cut here ]------------
[   29.658748] WARNING: CPU: 0 PID: 123 at kernel/workqueue.c:3426 0x8009c69c
[   29.665865] Modules linked in: ath10k_pci(O+) ath10k_core(O) ath(O) pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211(O) lzo cfg80211(O) slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 lzo_rle lzo_decompress lzo_compress libcrc32c hwmon crc_ccitt compat(O) ledtrig_usbport sha512_generic seqiv sha3_generic jitterentropy_rng drbg hmac geniv rng cmac crypto_acompress fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug(O) phy_ar7200_usb phy_ar7100_usb usbcore nls_base usb_common crc32c_generic
[   29.736163] CPU: 0 PID: 123 Comm: kworker/u2:3 Tainted: G        W  O       6.6.86 #0
[   29.744256] Workqueue: ath10k_wq 0x82a20420 [ath10k_core@1b713053+0x56000]
[   29.751368] Stack : 00000000 80758360 81b59c4c 000303a1 00000000 00000000 00000000 00000000
[   29.760023]         00000000 00000000 00000000 00000000 00000000 00000001 81b59c08 746e43cb
[   29.768678]         81b59ca0 00000000 00000000 81b59b30 00000038 80701d84 00000000 ffffffea
[   29.777334]         000000d7 81b59b3c 000000d7 807f9720 8071a9b8 81b59be8 00000000 8009c69c
[   29.785988]         00000009 000303a1 81a1fa50 61c88647 00000018 803d100c 00000000 809b0000
[   29.794644]         ...
[   29.797170] Call Trace:
[   29.797302] [<80701d84>] 0x80701d84
[   29.803486] [<8009c69c>] 0x8009c69c
[   29.807091] [<803d100c>] 0x803d100c
[   29.810751] [<800661e8>] 0x800661e8
[   29.814358] [<800661f0>] 0x800661f0
[   29.817959] [<806d8750>] 0x806d8750
[   29.821562] [<800849b0>] 0x800849b0
[   29.825163] [<8009c69c>] 0x8009c69c
[   29.828764] [<80084a40>] 0x80084a40
[   29.832367] [<801dcb3c>] 0x801dcb3c
[   29.835999] [<8009c69c>] 0x8009c69c
[   29.839597] [<801da9f8>] 0x801da9f8
[   29.843199] [<8049b74c>] 0x8049b74c
[   29.846801] [<801ef340>] 0x801ef340
[   29.850462] [<8009c7f0>] 0x8009c7f0
[   29.854098] [<801dcb3c>] 0x801dcb3c
[   29.857814] [<82a23664>] 0x82a23664 [ath10k_core@1b713053+0x56000]
[   29.864376] [<82a2e784>] 0x82a2e784 [ath10k_core@1b713053+0x56000]
[   29.870907] [<82a1e880>] 0x82a1e880 [ath10k_core@1b713053+0x56000]
[   29.877291] [<8050a6fc>] 0x8050a6fc
[   29.881100] [<82a20b0c>] 0x82a20b0c [ath10k_core@1b713053+0x56000]
[   29.887606] [<8009ed9c>] 0x8009ed9c
[   29.891326] [<8009f35c>] 0x8009f35c
[   29.894924] [<8009efc4>] 0x8009efc4
[   29.898527] [<800a661c>] 0x800a661c
[   29.902130] [<8009efc4>] 0x8009efc4
[   29.905731] [<800a661c>] 0x800a661c
[   29.909333] [<800a6718>] 0x800a6718
[   29.912934] [<800a661c>] 0x800a661c
[   29.916537] [<800a661c>] 0x800a661c
[   29.920139] [<800619f8>] 0x800619f8
[   29.923750]
[   29.925329] ---[ end trace 0000000000000000 ]---
[   29.930135] ath10k_pci 0000:00:00.0: could not init core (-145)
[   29.941284] ath10k_pci 0000:00:00.0: could not probe fw (-145)
[   29.996371] Data bus error, epc == 8034ada8, ra == 82ae2794
[   30.002154] Oops[#1]:
[   30.004500] CPU: 0 PID: 821 Comm: kmodloader Tainted: G        W  O       6.6.86 #0
[   30.012409] $ 0   : 00000000 00000001 deadc0de 00000200
[   30.017820] $ 4   : b81143fc 000143fc 82ca1d44 00000004
[   30.023232] $ 8   : 00000000 80701dbc ffffffff ffffffff
[   30.028644] $12   : ffffffff 00000040 00000002 ffffffff
[   30.034055] $16   : 828f0080 00000018 81c09b7c 81c09b80
[   30.039467] $20   : 81c09f7b 80000003 00010000 00014000
[   30.044879] $24   : 00000000 00000000
[   30.050291] $28   : 81c08000 81c09b00 00031018 82ae2794
[   30.055702] Hi    : 00004b5c
[   30.058678] Lo    : 4e910000
[   30.061651] epc   : 8034ada8 0x8034ada8
[   30.065612] ra    : 82ae2794 0x82ae2794 [ath9k_hw@ee6f3cb3+0x28000]
[   30.072099] Status: 1100dc03 KERNEL EXL IE
[   30.076428] Cause : 4080801c (ExcCode 07)
[   30.080567] PrId  : 00019750 (MIPS 74Kc)
[   30.084617] Modules linked in: ath9k(O+) ath9k_common(O) pppoe ppp_async nft_fib_inet nf_flow_table_inet ath9k_hw(O) ath10k_pci(O) ath10k_core(O) ath(O) pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211(O) lzo cfg80211(O) slhc nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 lzo_rle lzo_decompress lzo_compress libcrc32c hwmon crc_ccitt compat(O) ledtrig_usbport sha512_generic seqiv sha3_generic jitterentropy_rng drbg hmac geniv rng cmac crypto_acompress fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug(O) phy_ar7200_usb phy_ar7100_usb usbcore nls_base usb_common crc32c_generic
[   30.162551] Process kmodloader (pid: 821, threadinfo=ce2339b8, task=6256cd23, tls=77e93df4)
[   30.171179] Stack : 828f0a58 00000220 00010001 828f0080 81c09be4 00000000 00000220 000003ff
[   30.179834]         81bcf800 00010001 828f0080 81c09be4 82ae0000 82ce8968 99999999 82ae391c
[   30.188489]         00000440 81c09bb4 81bcf800 828f0080 00020000 00007000 ffffffe0 828f00a8
[   30.197145]         828f0080 828f0618 81c09bac 00000100 80487e20 82cea360 000186a0 ffffffff
[   30.205801]         828f0080 00008000 01000100 00010001 828f00a8 81c09be4 00000000 82ce8968
[   30.214455]         ...
[   30.216982] Call Trace:
[   30.217201] [<82ae0000>] 0x82ae0000 [ath9k_hw@ee6f3cb3+0x28000]
[   30.225849] [<82ae391c>] 0x82ae391c [ath9k_hw@ee6f3cb3+0x28000]
[   30.232207] [<80487e20>] 0x80487e20
[   30.235917] [<82ad5044>] 0x82ad5044 [ath9k_hw@ee6f3cb3+0x28000]
[   30.242170] [<82ac6e78>] 0x82ac6e78 [ath9k_hw@ee6f3cb3+0x28000]
[   30.248321] [<803eb6d4>] 0x803eb6d4
[   30.251961] [<80487068>] 0x80487068
[   30.255700] [<800a0000>] 0x800a0000
[   30.259401] [<82ca29d4>] 0x82ca29d4 [ath9k@a05ca239+0x16000]
[   30.265251] [<82ca4a7c>] 0x82ca4a7c [ath9k@a05ca239+0x16000]
[   30.271102] [<800c906c>] 0x800c906c
[   30.274807] [<82cb06b4>] 0x82cb06b4 [ath9k@a05ca239+0x16000]
[   30.280653] [<8029727c>] 0x8029727c
[   30.284388] [<80299a98>] 0x80299a98
[   30.287991] [<803eb110>] 0x803eb110
[   30.291693] [<8029af8c>] 0x8029af8c
[   30.295297] [<803e950c>] 0x803e950c
[   30.298897] [<803e69cc>] 0x803e69cc
[   30.302498] [<80478274>] 0x80478274
[   30.306100] [<8029ad84>] 0x8029ad84
[   30.309702] [<806dd178>] 0x806dd178
[   30.313303] [<803e6e8c>] 0x803e6e8c
[   30.316939] [<803e95b4>] 0x803e95b4
[   30.320578] [<803e711c>] 0x803e711c
[   30.324180] [<803e4244>] 0x803e4244
[   30.327784] [<803e706c>] 0x803e706c
[   30.331384] [<803e4430>] 0x803e4430
[   30.334986] [<806dd4cc>] 0x806dd4cc
[   30.338588] [<801b2ec4>] 0x801b2ec4
[   30.342226] [<803e5b3c>] 0x803e5b3c
[   30.345829] [<803e4a8c>] 0x803e4a8c
[   30.349430] [<803e5d4c>] 0x803e5d4c
[   30.353033] [<803e7e0c>] 0x803e7e0c
[   30.356634] [<82cbe000>] 0x82cbe000 [ath9k@a05ca239+0x16000]
[   30.362485] [<82cbe018>] 0x82cbe018 [ath9k@a05ca239+0x16000]
[   30.368337] [<8006056c>] 0x8006056c
[   30.372008] [<801b2ec4>] 0x801b2ec4
[   30.375646] [<800d68c8>] 0x800d68c8
[   30.379250] [<800d89e8>] 0x800d89e8
[   30.382890] [<8006d420>] 0x8006d420
[   30.386532]
[   30.388065] Code: 0000000f  8c820000  0000000f <03e00008> 00000000  0000000f  8c820000  0000000f  7c0210a0
[   30.398162]
[   30.399767] ---[ end trace 0000000000000000 ]---
[   30.404545] Kernel panic - not syncing: Fatal exception
[   30.409940] Rebooting in 1 seconds..

brada4 · June 18, 2025, 10:06am

Ok, boot that to failsafe (press f and enter when asked)
compose new sysupgrade image with other ath10k driver - press arrow left from "customize packages' and remove -ct in 2 places where i typed ZZZ

kmod-ath10kZZZ ath10k-firmware-qca988xZZZ luci

i just built it so your download will be instant.

IF it fixes boot issue , code change is totally required via PR or GH issue.

frollic · June 18, 2025, 10:15am

perhaps go back to 23.05.5 ? since there are known issues with ath10k in 24.10 ...
remove one source of error, or remove the wireless drivers from the image completely ...

brada4 · June 18, 2025, 10:20am

Thats following customisation in firmware-selector but removing kmod-ath10k* for good

mk24 · June 18, 2025, 12:26pm

OpenWrt does not modify the boot partition table or the boot scripts. Whatever ddwrt did to those is not going to be repaired by merely installing OpenWrt.

brada4 · June 18, 2025, 12:57pm

ddwrt revert to oem procedure involves old ar71x openwrt as interim step.
try that exact version, then revert to OEM and reset configuration in OEM fw.
then (optionally but highly recommended) install openwrt using web method.

amg1127 · June 21, 2025, 4:28am

Hi all,
Apologies for the delay.

I ran tests with OpenWrt firmwares, as suggested.

If I get from https://firmware-selector.openwrt.org/ a customized OpenWrt 24.10.1 firmware that includes kmod-ath10k ath10k-firmware-qca988x and excludes kmod-ath10k-ct ath10k-firmware-qca988x-ct, the build produces a kernel panic if booted in normal mode, and is operational in failsafe mode.

The downgrade to 23.05.5 produces similar results. Both the standard image and the customization that includes kmod-ath10k ath10k-firmware-qca988x and excludes kmod-ath10k-ct ath10k-firmware-qca988x-ct present kernel panic when booted in normal mode and an operational shell in failsafe mode.

If I get from https://firmware-selector.openwrt.org/ a customized OpenWrt 24.10.1 firmware that excludes kmod-ath10k kmod-ath10k-ct ath10k-firmware-qca988x ath10k-firmware-qca988x-ct, then I am able to boot OpenWrt firmware in full mode. The web interface doesn't present wireless NICs, as expected.

Still, I am required to interrupt the normal boot process and manually run bootm 0x9f040000 command on the serial console in order to boot OpenWrt. I reckon that the device's bootloader is corrupted, is it correct?

I am now able to run firstboot ; reboot on my device, as well as ubus call system board and mount -v. I am able to observe a mounted JFFS2 filesystem.

root@OpenWrt:~# cat /proc/mounts
/dev/root /rom squashfs ro,relatime,errors=continue 0 0
proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
cgroup2 /sys/fs/cgroup cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate 0 0
tmpfs /tmp tmpfs rw,nosuid,nodev,noatime 0 0
/dev/mtdblock5 /overlay jffs2 rw,noatime 0 0
overlayfs:/overlay / overlay rw,noatime,lowerdir=/,upperdir=/overlay/upper,workdir=/overlay/work,uuid=on 0 0
tmpfs /dev tmpfs rw,nosuid,noexec,noatime,size=512k,mode=755 0 0
devpts /dev/pts devpts rw,nosuid,noexec,noatime,mode=600,ptmxmode=000 0 0
debugfs /sys/kernel/debug debugfs rw,nosuid,nodev,noexec,noatime 0 0
bpffs /sys/fs/bpf bpf rw,nosuid,nodev,noexec,noatime,mode=700 0 0

root@OpenWrt:~# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 3.3M      3.3M         0 100% /rom
tmpfs                    59.2M    192.0K     59.0M   0% /tmp
/dev/mtdblock5            9.1M    416.0K      8.7M   4% /overlay
overlayfs:/overlay        9.1M    416.0K      8.7M   4% /
tmpfs                   512.0K         0    512.0K   0% /dev

root@OpenWrt:~# mount -v
/dev/root on /rom type squashfs (ro,relatime,errors=continue)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
/dev/mtdblock5 on /overlay type jffs2 (rw,noatime)
overlayfs:/overlay on / type overlay (rw,noatime,lowerdir=/,upperdir=/overlay/upper,workdir=/overlay/work,uuid=on)
tmpfs on /dev type tmpfs (rw,nosuid,noexec,noatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,noatime,mode=600,ptmxmode=000)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,noatime)
bpffs on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,noatime,mode=700)

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.6.86",
        "hostname": "OpenWrt",
        "system": "Qualcomm Atheros QCA956X ver 1 rev 0",
        "model": "TP-Link Archer C7 v4",
        "board_name": "tplink,archer-c7-v4",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.1",
                "revision": "r28597-0425664679",
                "target": "ath79/generic",
                "description": "OpenWrt 24.10.1 r28597-0425664679",
                "builddate": "1744562312"
        }
}

Please, could you suggest the interim ar71x openwrt firmware I should flash my device with, in order to revert to OEM? I am keen to switching to OpenWrt once I get the router working.

brada4 · June 21, 2025, 4:39am

Did you fully return to OEM and reset its config after DDWRT?

amg1127 · June 21, 2025, 4:56am

No, I haven't fully returned to OEM yet. I am trying to find the correct OEM firmware to use and the correct procedure to follow.

Frollic suggested that a Bad Magic Number message may be caused by the usage of an incorrect region. So far, apart from US, I have only found EU region of TP-Link AC1750 v4 firmware.

brada4 · June 21, 2025, 5:01am

This is not ddwrt support. They have easy to follow guide to return to OEM via old OpenWrt. Dont be lured to upgrade/substitute it half-way.

slh · June 21, 2025, 5:37am

In case you haven't done so yet, now is the last chance to take backups of all partitions, do it. If you're lucky you may not need them, but if you aren't, you really need them.