I would like to be able to read/write the whole firmware image at the router flash chip
directly - using SOIC-8 test clip with CH341A USB programmer and flashrom software
- all without desoldering a flash chip ( in-system programming https://www.flashrom.org/ISP )

Problem: when I connect a SOIC-8 test clip to the flash chip at router's board
there is one LED which is always ON and seven LEDs which are blinking:
per each 1 second of time they are 0.3 seconds OFF and 0.7 seconds ON

Then, I am able to detect the router's flash chip only at 30% of cases and
when its detected and starts reading it - per each 0x1E000 of data (30*0x1000)
there is about 30% correct data (9*0x1000) then 70% of zeros (21*0x1000)
^^^ 30% / 70% , seems to correlate with LEDs blinking pattern !

Maybe while LEDs are ON they are eating extra power which was intended for the flash chip,
so I'm going to short circuit these 7 LEDs with "red" temporary bridges - like at the picture below

Please tell: is it a good idea to shorten the LEDs or it could break something?
And what circuit elements are making those LEDs to blink at this pattern?

(Last edited by mward15 on 27 Jan 2018, 23:10)

The LED is a symptom, not the cause. If you connect the SPI-flasher, you also partially power the SOC - but the supplied power is a) not enough to really power the SOC, b) causes the SOC and your flasher to fight over the same ressource, the SPI flash.

Flashing in-circuit is possible, but only if you manage to keep the SOC in reset during the flash - that requires you to find out how to accomplish that; in practice it's usually simpler to desolder the flash.

Thank you very much for your reply! I found the SOC's datasheet (QCA9531/QCA9533 picture below contains all the available info about RESET_L pin) -  and sadly RESET_L is "hidden at the 2nd row", I can't touch it with multimeter and so can't check if any of the router's test points are connected to RESET_L or its simply "floating"

Still trying to avoid the soldering... Alternative way of restoring the U-Boot could have been the JTAG flashing, but for this particular router - TP-LINK WR841ND v9 - there is no known JTAG pinout for its' 12 hole header! Can't find any leaked datasheets for this board either. One of these holes (bottom right corner) is surely VCC but I don't know how to discover the rest of JTAG pinout. Maybe you know a way?

(Last edited by mward15 on 30 Jan 2018, 18:35)

Could be this one: https://wiki.openwrt.org/doc/hardware/p … in_header1

Linksys 12 hole layout doesn't have VCC hole (the only hole I'm sure about) - seems to be a mismatch. How the people are determining JTAG pinout for the first time? So far I've found JTAG Finder and Jtagulator hardware adapters, but they aren't open source and cost 4x more than this router