Unbrick WR710N

Hi everyone,
I bricked my WR710N by doing a sysupgrade. I've done it through ssh and closed the lid of my laptop before the process ended :expressionless:.

Now the LED of the router blinks for a short while and tries to establish a connection to my lan port.

I already looked up the unbricking guide for my model (https://wiki.openwrt.org/toh/tp-link/tl-wr710n#unbrick_tl-wr710n) but it says to connect to the device via serial interface which would require soldering.

I was wondering if I can circumvent the process of soldering. The LEDE docs (https://lede-project.org/docs/user-guide/tftpserver) states that the LEDE firmware has a built-in “TFTP recovery mode”.

My question is if I can set up a tftp server, put the lede-17.01.4-ar71xx-generic-tl-wr710n-v1-squashfs-factory.bin in it and let the bootloader download the image so it can flash it?

Depending on how bricked it is, you might try using LEDE Failsafe Mode...

https://lede-project.org/docs/user-guide/failsafe_and_factory_reset

Thanks for the hint but unfortunately the fail safe mode isn't accessible. I sniffed with Wireshark the connection but there are no packets incoming. I guess I can't avoid the soldering.

Smartens, I too bricked a TP-Link WR710N when doing an upgrade! How? The jury is still out.

I could not reach the router over the LAN by any means. Although there might be a TFTP link buried in the bootloader [192.168.1.0/1/100/254], nothing would communicate with the bootloader. I Sharked the port and concluded the LAN module was up but the TCP stack was missing. Someone mentioned there is a restore feature on the TP-Link CD - which might be worth exploring - but I suspected that's just for when the config gets user mangled.

Anyway... here's how I unbricked my TP-Link WR710N... it's the short version.:grimacing:


Before anyone struggles to flip off the grey sidewall, here are some important things to note about the WR710N

  • Bad news, there is mains electricty on the inside. A real danger zone.
  • Good news, the WR710N can be powered with an external 5 volt supply without the risk of pluging your fingers into the mains.
  • Bad news, the serial RX and TX pads are on the back of the PCB. Removing the PCB out is a real pain in the :rage: Even after breaking the LED's plastic lightpipe, you'll wonder how they got it assembled at the factory? It's a very tight fit. Note to TP-Link, mod the PCB so TP-IN and TP-OUT are topside!
  • Good news, once out of the case, the PCB pads are large enough to touch with probes, so no soldering is required. Yah.
  • Bad news, unbricking requires a 3.3 volt compliant USB to serial lead, which people might not have in their tech.
  • Good news, most PL2303 leads have an integral 5 Volt power lead which powers the WR710N direct.

Connecting up, the 5 volt lead of the PL2303 clips to the proud pin that's inline with R210 and next to D206. This is the power bus. The earth is strapped to the USB shell. I rigged a connector to touch the TP-IN(rx) and TP-OUT(tx) pins. Console connection is the usual 115200-8-N-1. I'd upload a photo if that's possible?

With everything connected and working, the WR710N's boot log had this ominous message repeating over-and-over-and-over-and-over...

squashfs: SQUASHFS error: unable to read id index table
jffs2: Flash size not aligned to erasesize, reducing to 6720KiB
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x6873 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0d04 instead
...

This means the memory blocks are 'out of alignment'. In other words, it's bricked real good. Hence, no TCP stack. Solution? The only way is reflashing with the full Lede factory firmware.

The unbrick requires loading with the WR710N with the factory .bin file using a remote TFTP server. I used the TFTP Server on another Lede box.

This is the memory map of the WR710N version 2.1 that I was working to:

Dram:
81000000 - DRAM base
Flash:
9f000000-9f01ffff u-boot 020000 mtd0
9f020000-9f12c4cf kernel 10c4d0 mtd1
9f12c4d0-9f7effff rootfs 6c3b30 mtd2
9f360000-9f7effff rootfs_data 490000 mtd3
9f7f0000-9f7fffff art 010000 mtd4
9f020000-9f7effff firmware 7d0000 mtd5

From my notes, the recovery process was thus...

Connect the ethernet cable to eth0 (LAN I think)
Setup a TFTP server
If needed re-aim the WR710N at the TFTP server. Console >
setenv serverip 192.168.x.x

TFTP the Factory .bin file into the start of DRAM. Console >
tftpboot 0x81000000 lede-17.01.2-ar71xx-generic-tl-wr710n-v2.1-squashfs-factory.bin

Erase the flash memory between UBOOT and ART. Console >
erase 0x9f020000 +0x7C0000

Copy the .bin file from DRAM into KERNEL ( keeps UBOOT and ART ) Console >
cp.b 0x81000000 0x9f020000 0x7C0000

Boot at start of KERNEL. Console >
bootm 9f020000

Pray...


Now if all that works and the system is stable, reasemble the parts being sure the side panel is glued back firm as you don't want bare mains parts showing. not ever. Then plug the WR710N back into the mains.


For those playing at home, the bootloader printenv was

bootargs=
console=ttyS0,115200
root=31:02
rootfstype=squashfs
init=/sbin/init
mtdparts=ar7240-nor0:128k(u-boot),1024k(kernel),6912(rootfs),64k(config),64k(ART)
bootcmd=bootm 0x9f020000
bootdelay=1
baudrate=115200
ethaddr=0xba:0xbe:0xfa:0xce:0x07:0x41
ipaddr=192.168.1.111
serverip=192.168.1.100
stdin=serial
stdout=serial
stderr=serial
ethact=eth0


I hope that was of help to you, or someone else in the Lede community.

Remember, we choose to do it the hard way, because we can...

:jack_o_lantern: Andy B

2 Likes

@ledeuino Thanks for your in depth description :slight_smile:.

The problem is that I don't have any equipment and no experience in soldering/working with PCBs etc.

I searched for an UART USB adapter in ebay and found this but I'm not sure wether the chipset is the right one?

You said the PCB pads are big enough so I think I will try to connect to the board with these pins.

The question remains: How will I get the pins in a fixed position while I am typing the commands :sweat_smile:? I guess I will need an assistant for this project whose holding the pins at the right position :grin:.

Do you think this will work?

I've just taken a look at the specs for those CP2102s and this should be okay. I can recommend the PL2303HX variant as these chips have a good reputation working with other routers and Pis. And the driver works with WIndows.

Anyway, here's a picture of my TL-WR710N Version 2.1 in intensive care.

Two important things to note...

  • This is NOT connected to the mains. Instead power is supplied from the USB dongle through the red clip. You cannot back power through the USB port as Vbus controller U6 is in the way. Earth is clipped to the USB case.
  • The TX and RX contacts are lashed to the board. I did not want to solder because I wanted to see if this technique works. And it did. Keep everything, including the board and case tight in position on the desk.

TPL-WR710N_Patched

And here's a close up. I'll call it a FANG CONNECTOR Spooky :jack_o_lantern:
TPL-WR710N_Patched2

Andy B

1 Like

Thanks again @ledeuino for the pictures :+1:.

After some research, I've found out that there is a driver module for 210x chipsets in Linux and I will be using Linux anyway so I ordered it.

When I'm lucky I will receive the things in two weeks. I will report back whether I succeeded or destroyed the circuit board :stuck_out_tongue_winking_eye:.

Just for interest, a Lede loaded router with a USB connector can use a USB2Serial adapter by installing package kmod-usb-serial plus the one for the adapter; in your case that's kmod-usb-serial-cp210x

There are lots of serial converters supported. Check out:

opkg list kmod-usb-serial*

Sorry for the grave digging on this thread.

Back last year when you first posted this, I had written this post just a month later:

I am now up to six failed devices in total. There seems to be something wrong with the way the rootfs partition is being written, but I don't know what it is, and it's an intermittent kind of failure.

I am writing this today because I recently got back to soldering in console cables for four of them and recovering them via TFTP. I now have five of them here in my office and I'm going to see if I can set up a script and have them sysupgrade over and over to replicate the failure.

Abit late have you thought of using pepe2k's uboot fail-safe on TL-WR710N V1 (europe)

Thanks for your suggestion! I was already planning on looking it up anyway, so I went ahead and built pepe2k's uboot for this device and installed it. It works great and gives me some additional functionality that I didn't have before. This will save me from needing to install a console for the rest of my devices, should they also fail.

I wrote a script to automatically install the new uboot to my fleet of devices, so I am going to do that tomorrow.

Unfortunately this is something which is only effective proactively. Most people will need this too late.

A post was split to a new topic: TL-WR710N with ROOter: wifi password

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.