Can't reach u-boot on bricked Dynalink DL-WRX36

Installing and Using OpenWrt
1

Hi all, I come begging for advice.

So, my error in flashing this router with OpenWrt was that I missed step 5 of the install which is:

  1. Set U-boot env variable:
    fw_setenv mtdids 'nand0=nand0'

The router doesn't boot. All other install steps were carried out, besides this one.

My router is stuck showing a purple light and nothing else.

Now, the recovery of this would be easier if I could reach u-boot, but the last line of my PuTTy output is: "S - Core 0 Frequency, 1651 MHz". I read on Dynalink DL-WRX36 Askey RT5010W IPQ8072A technical discussion - #1146 by missingcharacter that I could "blindly" get round this, but having followed those steps, I am still stuck at "S - Core 0 Frequency, 1651 MHz". I believe my USB to TTL adapter is sufficient for this task.

I'm going to paste my entire serial output. Please forgive me as I do not know how to paste PuTTy output neatly on a forum, and this is my first time writing a question post.

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B -       203 - PBL, Start
B -      2740 - bootable_media_detect_entry, Start
B -      4181 - bootable_media_detect_success, Start
B -      4186 - elf_loader_entry, Start
B -      6853 - auth_hash_seg_entry, Start
B -     44730 - auth_hash_seg_exit, Start
B -    106734 - elf_segs_hash_verify_entry, Start
B -    169588 - PBL, End
B -    184006 - SBL1, Start
B -    236832 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B -    243420 - pm_device_init, Start
B -    367555 - PM_SET_VAL:Skip
D -    123616 - pm_device_init, Delta
B -    369995 - pm_driver_init, Start
D -      5368 - pm_driver_init, Delta
B -    376370 - clock_init, Start
D -      2135 - clock_init, Delta
B -    380304 - boot_flash_init, Start
D -     12688 - boot_flash_init, Delta
B -    396774 - boot_config_data_table_init, Start
D -      3080 - boot_config_data_table_init, Delta - (575 Bytes)
B -    404277 - Boot Setting :  0x00000618
B -    408212 - CDT version:2,Platform ID:8,Major ID:133,Minor ID:1,Subtype:5
B -    415318 - sbl1_ddr_set_params, Start
B -    419039 - CPR configuration: 0x30c
B -    422486 - cpr_init, Start
B -    425353 - Rail:0 Mode: 5 Voltage: 824000
B -    430477 - CL CPR settled at 776000mV
B -    433313 - Rail:1 Mode: 5 Voltage: 880000
B -    437583 - Rail:1 Mode: 7 Voltage: 920000
D -     16439 - cpr_init, Delta
B -    444385 - Pre_DDR_clock_init, Start
B -    448380 - Pre_DDR_clock_init, End
B -    451796 - DDR Type : PCDDR4
B -    458506 - do ddr sanity test, Start
D -      1067 - do ddr sanity test, Delta
B -    462227 - DDR: Start of HAL DDR Boot Training
B -    466955 - DDR: End of HAL DDR Boot Training
B -    472719 - DDR: Checksum to be stored on flash is -1517734999
B -    483150 - Image Load, Start
D -    505690 - QSEE Image Loaded, Delta - (1378368 Bytes)
B -    988932 - Image Load, Start
D -        61 - SEC Image Loaded, Delta - (0 Bytes)
B -    996587 - Image Load, Start
D -    293898 - DEVCFG Image Loaded, Delta - (32488 Bytes)
B -   1290577 - Image Load, Start
D -    305122 - RPM Image Loaded, Delta - (93060 Bytes)
B -   1595790 - Image Load, Start
D -    370026 - APPSBL Image Loaded, Delta - (537454 Bytes)
B -   1965938 - QSEE Execution, Start
D -        61 - QSEE Execution, Delta
B -   1971764 - USB D+ check, Start
D -         0 - USB D+ check, Delta
B -   1978138 - SBL1, End
D -   1796450 - SBL1, Delta
S - Flash Throughput, 6733 KB/s  (2042617 Bytes,  303347 us)
S - DDR Frequency, 600 MHz
S - Core 0 Frequency, 1651 MHz

I would kindly ask for any advice to get around this. I'm considering myself thankful for getting output from serial, but I don't know how to get to u-boot. I've tried everything. I will follow any instructions you give as everyone here seems smarter than I. Please save me and my router.

2

u-boot is there, Dynalink just made sure it doesn't output anything.

follow the instruction from the post you posted.

you could probably paste the setenv param you forgot to add, instead.

3

I have, multiple times. I don't see what I'm doing wrong though. I choose a random character to send to the router for 20 seconds after receiving the "S - Core 0 Frequency, 1651 MHz" line, and then send the 2 commands he said to send. But, upon rebooting I'm still stuck at the "S - Core 0 Frequency, 1651 MHz".

4

should probably have at least one [enter] after the chars you sent, or it becomes
lkjsfsdf...sdlsj34setenv console_unlock 1

start by shorting the Tx and Rx pins on your USB TTL, while disconnected from the WRX, check if you can see your own typing in Putty.

1 Like
5

I don't think that's possible with my current adapter lol. But send commands are represented by LED blinks on the adapter I have. If I can get round to trying this I will.

6

I do this, I make sure to give an Enter press before sending the important stuff. If it's guaranteed that I have u-boot running without displaying, and I repeat these steps successfully a few times to no avail, I can assume that the USB TTL isn't sending messages?

7

the command you forgot is for u-boot, if you didn't do anything else, u-boot should still be intact.

it's your USB TTL ...

8

Okay, I will order a new one and report back. Thank you for the advice.

1 Like
9

Okay, so I've tried the blind typing thing on 3 different USB TTLs now (I ordered 2 more just incase). All 3 are from different manufacturers. Still stuck at "S - Core 0 Frequency, 1651 MHz". If anyone is able to provide further assistance it would be massively appreciated.

Just to clarify, I boot the device up, I wait for "S - Core 0 Frequency, 1651 MHz" (final output line) to appear in PuTTy, and then I choose a button to press like "f" for example, continuously press it for 20 seconds, and then paste the two lines ("setenv console_unlock 1" followed by pressing Enter) followed by ("saveenv" again followed by pressing Enter).

Thanks in advance

10

Sorry just to ping, this hasn't worked on 3 different TTLs now. I wrote a longer reply, I'm just wondering if that's all I needed to do? At this point I'm willing to pay a little for a teamviewer session or something just to get it sorted. Any help is massively appreciated.

The serial port on the router, I don't need to add 3.3V right? It's just TX RX and GND.

Thanks

11

Is there any chance that me unplugging the antennas from the board has an affect on this? Right now I just have the motherboard of the router with only the LED plugged in, and that's it.

12

don't think so.

as for when to start pressing random chars, you can probably start doing it as soon as you see the boot sequence over serial.

and yes, GND Tx and Rx are the ones to connect.

@robimarko any ideas ?

13

If SBL just stops then its likelly corrupted, as even if there is no valid U-Boot (APPSBL) it would have printed that along with an error code

14

even though it looks like the no output boot loader setting ?

15

In that case no, you are just left with a blank screen.

But if U-Boot was broken it should still print the error code as SBL cannot be silenced AFAIK

16

How catastrophic of a mistake was it to miss instruction 5 from the install instructions? Given that that's all I've done wrong, is it recoverable? I have no way of testing whether my USB TTL is actually sending to the router since all my serial connectors are female I can't short them together, but I get RX and TX lights on the USB TTL when I press buttons in PuTTy. After I power on the router, I hold down a key for more than 20 seconds, then paste the setenv console_unlock 1 in to PuTTy followed by saveenv.

Thanks so much for your replies I appreciate you both trying to help me out.

17

@frollic Hi both, just an update, once I boot if I mash/hold the WPS button on the router, my USB TTL flashes almost solid green and PuTTy prints gibberish. This might be useless, but it's something coming out of the router for once, instead of nothing.

New (added gibberish) PuTTy output is included here.


Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B -       203 - PBL, Start
B -      2740 - bootable_media_detect_entry, Start
B -      4182 - bootable_media_detect_success, Start
B -      4186 - elf_loader_entry, Start
B -      6853 - auth_hash_seg_entry, Start
B -     44730 - auth_hash_seg_exit, Start
B -    106735 - elf_segs_hash_verify_entry, Start
B -    169590 - PBL, End
B -    184220 - SBL1, Start
B -    237107 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B -    243695 - pm_device_init, Start
B -    367921 - PM_SET_VAL:Skip
D -    123708 - pm_device_init, Delta
B -    370361 - pm_driver_init, Start
D -      5398 - pm_driver_init, Delta
B -    376736 - clock_init, Start
D -      2135 - clock_init, Delta
B -    380670 - boot_flash_init, Start
D -     12718 - boot_flash_init, Delta
B -    397140 - boot_config_data_table_init, Start
D -      3080 - boot_config_data_table_init, Delta - (575 Bytes)
B -    404643 - Boot Setting :  0x00000618
B -    408578 - CDT version:2,Platform ID:8,Major ID:133,Minor ID:1,Subtype:5
B -    415684 - sbl1_ddr_set_params, Start
B -    419405 - CPR configuration: 0x30c
B -    422882 - cpr_init, Start
B -    425749 - Rail:0 Mode: 5 Voltage: 824000
B -    430843 - CL CPR settled at 776000mV
B -    433679 - Rail:1 Mode: 5 Voltage: 880000
B -    437949 - Rail:1 Mode: 7 Voltage: 920000
D -     16439 - cpr_init, Delta
B -    444751 - Pre_DDR_clock_init, Start
B -    448777 - Pre_DDR_clock_init, End
B -    452162 - DDR Type : PCDDR4
B -    458903 - do ddr sanity test, Start
D -      1037 - do ddr sanity test, Delta
B -    462593 - DDR: Start of HAL DDR Boot Training
B -    467351 - DDR: End of HAL DDR Boot Training
B -    473116 - DDR: Checksum to be stored on flash is -1517734999
B -    483516 - Image Load, Start
D -    505721 - QSEE Image Loaded, Delta - (1378368 Bytes)
B -    989328 - Image Load, Start
D -        61 - SEC Image Loaded, Delta - (0 Bytes)
B -    997014 - Image Load, Start
D -    293868 - DEVCFG Image Loaded, Delta - (32488 Bytes)
B -   1290973 - Image Load, Start
D -    305122 - RPM Image Loaded, Delta - (93060 Bytes)
B -   1596187 - Image Load, Start
D -    370026 - APPSBL Image Loaded, Delta - (537454 Bytes)
B -   1966365 - QSEE Execution, Start
D -        61 - QSEE Execution, Delta
B -   1972160 - USB D+ check, Start
D -         0 - USB D+ check, Delta
B -   1978565 - SBL1, End
D -   1796633 - SBL1, Delta
S - Flash Throughput, 6730 KB/s  (2042617 Bytes,  303500 us)
S - DDR Frequency, 600 MHz
S - Core 0 Frequency, 1651 MHz
▒D▒▒▒▒▒▒▒n▒H▒D▒▒D▒▒▒~▒▒▒DH▒▒ H▒0▒▒▒▒▒n▒▒▒▒▒▒$▒▒▒▒▒▒▒▒▒▒▒H▒▒{▒▒▒▒2>"▒▒▒<@▒▒▒▒▒▒▒@▒▒▒▒x▒@▒x▒H▒▒▒▒x@▒▒▒>▒▒@x@8▒"▒▒▒▒▒@"▒▒▒▒▒▒@`▒"▒▒▒▒<▒▒▒▒▒>▒@▒▒▒▒▒▒2p▒@▒▒▒▒
▒▒▒▒▒▒▒▒▒▒"x▒@▒▒▒<@▒`▒@`▒▒▒▒▒▒▒▒▒▒▒@x▒~▒▒▒ ▒▒~▒@`▒▒▒▒▒@"▒▒▒▒@▒▒@▒▒ ▒▒▒▒
▒▒▒▒"▒▒▒▒▒▒@▒8▒▒▒@▒>▒@▒▒▒"~▒▒L▒▒▒"▒▒▒@"▒▒▒▒▒▒▒▒▒▒@`8▒▒<▒▒D▒z▒"▒`▒▒@ ▒@▒
▒▒@"x▒▒▒▒▒▒x▒▒▒t▒▒@"▒▒ "▒▒▒@~▒|▒~▒>▒▒8▒"▒▒▒▒@`▒▒>▒@▒▒ ▒▒▒▒@▒▒▒▒▒▒▒▒▒$▒>▒@ ▒8▒▒"▒▒<▒@ ▒▒▒▒▒▒▒▒▒▒@p▒~▒▒x▒@▒▒▒▒$▒8▒▒|x▒?▒▒▒▒@f>▒"▒▒▒▒▒▒▒▒▒▒H▒@d▒X▒▒▒▒"▒▒z▒▒▒▒▒▒▒H~▒

The gibberish continues indefinitely, I just cut it off here.

Many thanks

18

That looks like possible different baud rate to me

19

I agree, try changing the port speed, this will make the 1st part of the boot look like the currently unreadable 2nd part.

20

I can remember having garbled data once with serial console access when using Putty.
First make sure your settings are OK (e.g. baud rate etc.) and GND is connected.
If that does not help and you are using Putty make sure you use a version above 0.73 and check this setting:
Window > Translation > "Enable VT100 line drawing even in UTF-8 mode"