OpenWrt Forum Archive

Topic: de-bricking Tp-Link td-w8970 with flashrom and soic clip

The content of this topic has been archived on 23 Mar 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I accidentally brick my dsl modem, (if deleting all the flash trying stupid things is an accident)  . Using jtag is slow and i not so good soldering, So i try using a soic clip and flashrom (from linux pc)

As programer i use buspirate, however its easy to use othe tings, like a raspberry, or even computer motherboard.  only need point flashrom to the programer.

First make a flahsh copy

 tp# flashrom -p buspirate_spi:dev=/dev/ttyUSB0,pullups=on,spispeed=1M -r tplink.bin 

I have old backup with atheros caldata (art) but you can extract from extracted tplink.bin

 dd if=tplink.bin of=caldata.bin bs=1 skip=8323072

the numbers are total flash 8 MiB converted to decimal bit 8388608
Art partition last 64 kib in dec 65536
dd takes a file, ignores first 8323072 bit and writes the rest 65536 to caldata.bin . i am really bad changing those numbers, i use a calculator and change from hex to dec.

With clear copy of a working flash you can use any hexeditor and change de last 64 kib with your caldata, or flash direcly and write from openwrt command line, i use old working copy, so i flash it (as root)

 # flashrom -p buspirate_spi:dev=/dev/ttyUSB0,pullups=on,spispeed=1M -w tplinkgood.bin 

Several coments, flashrom tries to write at maximun speed, (8M for my flash) and fails, Im unsure why, maybe something in circuit cant work at this speed, or the use of large wires broke com, i dont know.

Slowering spispeed parameter works for me.  I only conect 6 pins (the soic have 8)  take a look to this spi programing post  when im writing flash one of the led is on. however, everithing goes ok. maybe in other devices desoldering is a must, but give a try to a clip programing, is easy and fast.

Hi !

Sorry for revamping this old topic, however I have bricked my w8970 today, and I was investigating ways of restoring it via JTAG.

Is it possible to only flash uboot with this method and then reflash other partitions via tftpboot ?
The flashrom layout map is the same of the one posted in the wiki ?

bosconovic wrote:

Hi !

Sorry for revamping this old topic, however I have bricked my w8970 today, and I was investigating ways of restoring it via JTAG.

Is it possible to only flash uboot with this method and then reflash other partitions via tftpboot ?
The flashrom layout map is the same of the one posted in the wiki ?

yes it's possible, you have to flash only Uboot part and put "FF" without last part of caldata.

I have a clip and programmer do you have the pinouts required i have tried myself however i get all lights showing when detecting the chip. Would be handy if there was a pin out. Thanks in advance.

I have two W8980's with uboot busted lol

The discussion might have continued from here.