1. setup TFTP server with pc at IP:192.168.1.100, use lan cable from tftp server to router's wan (or lan ports is ok?)
2. Once log into TPL and get ap135>
3. set ipaddr 192.168.1.1
4. set serverip 192.168.1.100
5. tftp 0x80060000 openwrt-r38298-tl-wdr7500-v2-squashfs-factory.bin (Can I use this flash from 130820 to the OpenDRT? or flash to any other firmware with boot loader? or must without boot loader?)
6. erase 0x9f020000 +0x7c0000 (are these starting and size address correct? as the squashes firmware without boot loaders may size difference?)
7. cp.b 8x80060000 0x9f020000 0x7c0000
8. boot.m 0x9f020000
1. Both ok, u-boot automatically choose one of them depends on link status.
2. On message "autobooting in 1 second" type tpl to enter u-boot command console.
3. Not necessary, default ip of u-boot is 192.168.1.111
4. Not necessary, default ip of tftp-server is 192.168.1.100
5. Command for loading image to memory is correct. You can flash any firmware here, even ARCHERC7_v1_130729_up.bin. Only requirement is that image does NOT contain bootloader (8126464 bytes)
6. Command for erasing flash is correct one.
7. Command for copying image from memory to flash must be cp.b 0x80060000 0x9f020000 0x7c0000
8. Command for booting is bootm 0x9f020000
If everything going ok, I can log into router by 192.168.1.1 with Openwrt
Yep, all openwrt/wdr7500's default ip is 192.168.1.1 and archer c7's is 192.168.0.1
Then I can use mtd from openwrt to flash with ARCHERC7_v1_130729_up.bin to English C7 firmware or other firmware without boot loader ?
Yep, or you can flash any firmware you want directly from bootloader without any transition steps as mentioned above. Actually bootloader commands above doing absolutely the same stuff as "mtd -r write image.bin firmware " command does.
later on i must flash firmware from A7 130729 to otherw without boot loader? or using the above UART to others?
Basic rules for flashing are:
1) On oem firmware with webinterface you can flash any firmware, doesn't matter with bootloader it or not. But hardware model from current firmware must be equal to the hardware model in header of uploading one. Obviously, if image contains bootloader it will be updated as well. Firmwares like 130820 is a special case.
I just advise not update bootloader when it isn't necessary. But actually you can update it
2) On openwrt with luci webinterace you can flash firmware ONLY without bootloader and it must be equal to current hardware model.
3) With bootloader commands above or on openwrt with "mtd -r write image.bin firmware" command you can flash any firmware, but ONLY without bootloader. As there are no checks, you can mistakenly write firmware with bootloader, if that happens you still can recover it with UART.
If you want to update bootloader then you can also do it from bootloader itself (issuing different commands and images of course) or on openwrt with "mtd -r write mtd0.bin u-boot" command(on openwrt u-boot partition is readonly by default, so you need a special firmware for this command to work). Image file must contain only bootloader and be 131072 bytes of length. It can be previously backuped mtd0 partition or extracted one from "_up_boot" oem firmwares that have size of 8258048 bytes and where it resides between two tp-link headers (from 512 to 131584).
If you want to flash extracted one (or perhabs mtd0 backup not from your device) then you need also to add some values at the end of bootloader (lets call it nvram section):
1) Offset 0x0001fc00: 6 bytes of you MAC-address
2) Offset 0x0001fd00: 4 bytes of hardware model and 4 bytes of hardware version. Archer C7 v1 model id is 0x7500001 and TL-WDR7500v2's is 0x75000002. Both have hardware revision 0x00000001 (sic!).
3) Offset 0x0001fe00: 8 bytes of your pincode, it will be used as default one for wps pincode and password for wifi.
Example for wdr7500v2 with mac BC:D1:77:FD:2D:40 and pincode 23434523:
0001fc00 bc d1 77 fd 2d 40 ff ff ff ff ff ff ff ff ff ff |..w.-@..........|
0001fd00 75 00 00 02 00 00 00 01 ff ff ff ff ff ff ff ff |u...............|
0001fe00 32 33 34 33 34 35 32 33 ff ff ff ff ff ff ff ff |23434523........|
Can I use UART to flash stock firmware with boot loader like 130126 to overwrite and erase the public and private key?
This protection is firmware related only, at least for now. So when you flash any another firmware you are done. All oem bootloaders for ArcherC7 or WDR7500 known to me are unlocked and you can flash any of them at any time and flash any firmware from them also. But that can be changed in future, who knows.
PS. Bootloader from last Archer C7 firmware (130729) have additional recovery method. To activate just hold reset button and power on router, after some seconds it automatically start downloading file named ArcherC7v1_tp_recovery.bin from tftp-server on ip 192.168.1.66 from ip address 192.168.1.86. ArcherC7v1_tp_recovery.bin must be any archerc7 firmware without bootloader, for example this one or this one.