Flashing Comfast CF-E380AC v2 - broke during flash

Hi all, first time poster but a huge fan of LEDE.

I bought a Comfast CF-E380AC v2 and used the default firmware / web interface to flash the unit with: lede-17.01.3-ar71xx-generic-cf-e380ac-v2-squashfs-sysupgrade.bin

When the AP rebooted, it went into a loop of a white light followed by a red flash, over and over. (video seen here: https://youtu.be/DeA12F75poc )

My setup is as follows:

Computer <-> LAN port on POE injector (computer set to static IP, 192.168.10.10, 255.255.255.0)
AP LAN Port <-> POE port on POE injector

If I hold the reset button for ~10 seconds the lights go off on the AP momentarily and then it resumes with the white/red loop.

Is there a way to recover from this and get LEDE installed successfully? I can't find any information online on how to recover from here.

Thank you in advance!

Try the solutions in this article...

Thanks for the link jwoods!

I tried the process as indicated by jaysonpriest but it didn't work for me. Perhaps because I have v2 of the AP? Here is the thread I submitted on Tom's Hardware:

Thanks for the response Jayson. I tried doing this process with the CF-E380AC v2 and I could not get it to work. By holding down the reset button the white light does flash. Also, when I let go the light went dark as you indicated. However, I am unable to ping the unit or access the website at either 192.168.1.1 or 192.168.10.1 (I tried both settings, setting my IP address to 192.168.1.20 or 192.168.10.20, subnet 255.255.255.0 and gateway 192.168.1.1 or 192.168.10.1)

Running arp -a doesn't show the AP's MAC address - before I tried installing LEDE (lede-17.01.3-ar71xx-generic-cf-e380ac-v2-squashfs-sysupgrade.bin) it did show the correct MAC Address of the Access Point.

Here is a video of me attempting the solution: https://www.youtube.com/watch?v=j3cS2upAf9M (hopefully it is oriented correctly by the time you see this)

Here is the video of what the AP does if I just plug it in without holding the reset button: https://youtu.be/DeA12F75poc

Could there be different instructions since it is v2?

Thank you in advance!

I would try flashing the router with the stock OEM firmware, using TFTP.

Firmware...

http://en.comfast.com.cn/download/FirmwareUpgrade/item-288.html

TFTP tutorials...

http://bit.ly/2yNN9ej

If you can get back to where you were, you might try flashing LEDE using TFTP, rather than the web GUI.

Make sure you are connected to the router using an ethernet cable.

I received my USB TTL device so I can finally do some debugging.

I could not get the LEDE or original firmware to work via TFTP.

I was able to flash both firmwares using TFTP, but the AP goes into a reboot loop with both. I have included the boot log (captured via TTL) for both the Comfast software as well as the LEDE software. Here is a video of the flashing process (with LEDE)

Any ideas of next steps I could take? Thank you!

Here is the boot log for the original Comfast software (that jwoods linked to):

U-Boot 1.1.4-g9e952007-dirty (Dec 20 2015 - 08:47:17)

ap143 - Honey Bee 2.0

DRAM:  128 MB
Flash: 16 MB

eth0 link down
FAIL
enet1 port0 up
dup 1 speed 1000
Using eth1 device
host 192.168.1.10 is alive
eth0 link down
FAIL
Using eth1 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'firmware_auto.bin'.
Load address: 0x80800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #############################################
done
Bytes transferred = 6881284 (690004 hex)
Erasing flash...
First 0x2 last 0x6b sector size 0x10000                                                                                                                                                                                                   107
Erased 106 sectors
Copy to Flash... write addr: 9f020000
done
Hit any key to stop autoboot:  0
## Booting image at 9f020000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.44
   Created:      2017-02-27   2:58:18 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1060790 Bytes =  1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f020040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 3.10.44 (jiangyaohui@oracle.tecmint.com) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 unknown) ) #3 Mon Feb 27 10:57:02 CST 2017
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9531 ver 2 rev 0
[    0.000000] Clocks: CPU:650.000MHz, DDR:393.041MHz, AHB:216.666MHz, Ref:25.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line:  board=COMFAST-CF-E380AC console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(art)ro,1536k(kernel),14464k(rootfs),64k(nvram)ro,16000k@0x50000(firmware) rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 126256k/131072k available (2279k kernel code, 4816k reserved, 594k data, 196k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.050000] pid_max: default: 32768 minimum: 301
[    0.050000] Mount-cache hash table entries: 512
[    0.060000] NET: Registered protocol family 16
[    0.070000] MIPS: machine is COMFAST CF-E380AC
[    0.300000] registering PCI controller with io_map_base unset
[    0.310000] bio: create slab <bio-0> at 0
[    0.320000] PCI host bridge to bus 0000:00
[    0.320000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.330000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.330000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.340000] pci 0000:00:00.0: invalid calibration data
[    0.340000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    0.350000] pci 0000:00:00.0: using irq 40 for pin 1
[    0.350000] Switching to clocksource MIPS
[    0.360000] NET: Registered protocol family 2
[    0.360000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    0.360000] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.370000] TCP: Hash tables configured (established 1024 bind 1024)
[    0.370000] TCP: reno registered
[    0.380000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.380000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.390000] NET: Registered protocol family 1
[    0.410000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.410000] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.430000] msgmni has been set to 246
[    0.430000] io scheduler noop registered
[    0.430000] io scheduler deadline registered (default)
[    0.440000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
��r�������serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.470000] console [ttyS0] enabled, bootconsole disabled
[    0.470000] console [ttyS0] enabled, bootconsole disabled
[    0.480000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[    0.490000] m25p80 spi0.0: found w25q128, expected m25p80
[    0.500000] m25p80 spi0.0: w25q128 (16384 Kbytes)
[    0.500000] 6 cmdlinepart partitions found on MTD device spi0.0
[    0.510000] Creating 6 MTD partitions on "spi0.0":
[    0.520000] 0x000000000000-0x000000040000 : "u-boot"
[    0.520000] 0x000000040000-0x000000050000 : "art"
[    0.530000] 0x000000050000-0x0000001d0000 : "kernel"
[    0.540000] 0x0000001d0000-0x000000ff0000 : "rootfs"
[    0.540000] mtd: device 3 (rootfs) set to be root filesystem
[    0.550000] mtdsplit: no squashfs found in "rootfs"
[    0.550000] mtdsplit: no squashfs found in "spi0.0"
[    0.560000] 0x000000ff0000-0x000001000000 : "nvram"
[    0.570000] 0x000000050000-0x000000ff0000 : "firmware"
[    0.600000] libphy: ag71xx_mdio: probed
[    0.600000] eth0: Atheros AG71xx at 0xb9000000, irq 4
[    1.160000] ag71xx ag71xx.0: invalid speed specified
[    1.160000] ag71xx: probe of ag71xx.0 failed with error -22
[    1.170000] TCP: cubic registered
[    1.170000] NET: Registered protocol family 17
[    1.180000] Bridge firewalling registered
[    1.180000] 8021q: 802.1Q VLAN Support v1.8
[    1.190000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x9adf instead
[    1.200000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x6e74 instead
[    1.210000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0x4d01 instead
[    1.220000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000000c: 0x6ab8 instead
[    1.230000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0x5f3f instead
[    1.240000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000014: 0x70ed instead
[    1.250000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x1eab instead
[    1.260000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000001c: 0x7de8 instead
[    1.270000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000020: 0xda58 instead
[    1.280000] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000024: 0x5ca6 instead

Here is the boot log from LEDE:

## Booting image at 9f020000 ...
   Image Name:   MIPS LEDE Linux-4.4.89
   Created:      2017-10-03  11:03:27 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1258046 Bytes =  1.2 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f020040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 4.4.89 (buildbot@builds-02.infra.lede-project.org) (gcc version 5.4.0 (LEDE GCC 5.4.0 r3101-bce140e) ) #0 Sat Sep 30 13:27:29 2017
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] No valid device tree found, continuing without
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line:  board=CF-E380AC-V2 mtdparts=spi0.0:256k(u-boot)ro,64k(art)ro,16000k(firmware),64k(art-backup)ro console=ttyS0,115200 rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 125328K/131072K available (3076K kernel code, 160K rwdata, 412K rodata, 312K init, 205K bss, 5744K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:650.000MHz, DDR:393.139MHz, AHB:216.666MHz, Ref:25.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000009] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008253] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.071113] pid_max: default: 32768 minimum: 301
[    0.076131] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.083112] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.093532] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.103943] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.111776] NET: Registered protocol family 16
[    0.118073] MIPS: machine is COMFAST CF-E380AC v2
[    0.348862] registering PCI controller with io_map_base unset
[    0.355124] Can't analyze schedule() prologue at 800670fc
[    0.371551] PCI host bridge to bus 0000:00
[    0.375895] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.383192] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.389061] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.396228] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.404655] pci 0000:00:00.0: invalid calibration data
[    0.410512] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    0.418242] pci 0000:00:00.0: using irq 40 for pin 1
[    0.424373] clocksource: Switched to clocksource MIPS
[    0.430941] NET: Registered protocol family 2
[    0.436697] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.444063] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.450850] TCP: Hash tables configured (established 1024 bind 1024)
[    0.457680] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.463861] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.470842] NET: Registered protocol family 1
[    0.480693] Crashlog allocated RAM at address 0x3f00000
[    0.502750] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.508979] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.522183] io scheduler noop registered
[    0.526389] io scheduler deadline registered (default)
[    0.532069] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.541777] console [ttyS0] disabled
[    0.565727] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[    0.574838] console [ttyS0] enabled
[    0.574838] console [ttyS0] enabled
[    0.582382] bootconsole [early0] disabled
[    0.582382] bootconsole [early0] disabled
[    0.596791] m25p80 spi0.0: found w25q128, expected m25p80
[    0.602393] m25p80 spi0.0: w25q128 (16384 Kbytes)
[    0.607358] 4 cmdlinepart partitions found on MTD device spi0.0
[    0.613466] Creating 4 MTD partitions on "spi0.0":
[    0.618432] 0x000000000000-0x000000040000 : "u-boot"
[    0.626189] 0x000000040000-0x000000050000 : "art"
[    0.632896] 0x000000050000-0x000000ff0000 : "firmware"
[    0.673330] 0x000000ff0000-0x000001000000 : "art-backup"
[    0.704269] libphy: ag71xx_mdio: probed

Banging my head against the desk

I was trying to use the incorrect firmware. My unit is a CF-E355AC v2, not the E380AC.

jwoods - thank thank you very much for your help here. I have now learned about u boot, TTL and much more. I very much appreciate your contributions!