Smartens, I too bricked a TP-Link WR710N when doing an upgrade! How? The jury is still out.
I could not reach the router over the LAN by any means. Although there might be a TFTP link buried in the bootloader [192.168.1.0/1/100/254], nothing would communicate with the bootloader. I Sharked the port and concluded the LAN module was up but the TCP stack was missing. Someone mentioned there is a restore feature on the TP-Link CD - which might be worth exploring - but I suspected that's just for when the config gets user mangled.
Anyway... here's how I unbricked my TP-Link WR710N... it's the short version.
Before anyone struggles to flip off the grey sidewall, here are some important things to note about the WR710N
- Bad news, there is mains electricty on the inside. A real danger zone.
- Good news, the WR710N can be powered with an external 5 volt supply without the risk of pluging your fingers into the mains.
- Bad news, the serial RX and TX pads are on the back of the PCB. Removing the PCB out is a real pain in the Even after breaking the LED's plastic lightpipe, you'll wonder how they got it assembled at the factory? It's a very tight fit. Note to TP-Link, mod the PCB so TP-IN and TP-OUT are topside!
- Good news, once out of the case, the PCB pads are large enough to touch with probes, so no soldering is required. Yah.
- Bad news, unbricking requires a 3.3 volt compliant USB to serial lead, which people might not have in their tech.
- Good news, most PL2303 leads have an integral 5 Volt power lead which powers the WR710N direct.
Connecting up, the 5 volt lead of the PL2303 clips to the proud pin that's inline with R210 and next to D206. This is the power bus. The earth is strapped to the USB shell. I rigged a connector to touch the TP-IN(rx) and TP-OUT(tx) pins. Console connection is the usual 115200-8-N-1. I'd upload a photo if that's possible?
With everything connected and working, the WR710N's boot log had this ominous message repeating over-and-over-and-over-and-over...
squashfs: SQUASHFS error: unable to read id index table
jffs2: Flash size not aligned to erasesize, reducing to 6720KiB
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x6873 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0d04 instead
This means the memory blocks are 'out of alignment'. In other words, it's bricked real good. Hence, no TCP stack. Solution? The only way is reflashing with the full Lede factory firmware.
The unbrick requires loading with the WR710N with the factory .bin file using a remote TFTP server. I used the TFTP Server on another Lede box.
This is the memory map of the WR710N version 2.1 that I was working to:
81000000 - DRAM base
9f000000-9f01ffff u-boot 020000 mtd0
9f020000-9f12c4cf kernel 10c4d0 mtd1
9f12c4d0-9f7effff rootfs 6c3b30 mtd2
9f360000-9f7effff rootfs_data 490000 mtd3
9f7f0000-9f7fffff art 010000 mtd4
9f020000-9f7effff firmware 7d0000 mtd5
From my notes, the recovery process was thus...
Connect the ethernet cable to eth0 (LAN I think)
Setup a TFTP server
If needed re-aim the WR710N at the TFTP server. Console >
setenv serverip 192.168.x.x
TFTP the Factory .bin file into the start of DRAM. Console >
tftpboot 0x81000000 lede-17.01.2-ar71xx-generic-tl-wr710n-v2.1-squashfs-factory.bin
Erase the flash memory between UBOOT and ART. Console >
erase 0x9f020000 +0x7C0000
Copy the .bin file from DRAM into KERNEL ( keeps UBOOT and ART ) Console >
cp.b 0x81000000 0x9f020000 0x7C0000
Boot at start of KERNEL. Console >
Now if all that works and the system is stable, reasemble the parts being sure the side panel is glued back firm as you don't want bare mains parts showing. not ever. Then plug the WR710N back into the mains.
For those playing at home, the bootloader printenv was
I hope that was of help to you, or someone else in the Lede community.
Remember, we choose to do it the hard way, because we can...