Dynalink DL-WRX36 Askey RT5010W IPQ8072A technical discussion

This NAND requires a different option in the devicetree:
nand-ecc-strength = <8>;

Please refer to this PR. Hopefully this will solve your issue.

Yeah, per datasheet minimal ECC strength is 8 bits for this NAND, weird that kernel does not warn about this as it usually does

You may be able to retrieve the OEM device tree from /sys/firmware/devicetree/, it will differ from the one needed for OpenWrt, but it can clear up some questions.

If there is root acess to the stock FW then you can simply dump the flash and extract the DTB, it should probably be enough to get OpenWrt running

1 Like

By the way the OEM dts for the EAP102 has ECC strength set to 4 bits, but I could only get it to work setting to 8.

Gost6 already dumped the flash, but we were unable to extract that. It is something wrong with the squashfs

./unsquashfs 0.squashfs
Read on filesystem failed because EOF
read_block: failed to read block @0x80040000
read_id_table: failed to read id table block
FATAL ERROR: File system corruption detected

binwalk hasn't worked either.

Do you get shell access via serial console on the OEM firmware?

I don't have that device, but if I remember correctly, gost6 wrote, serial log stops after starting the kernel. So i assume Dynalink deactivated serial somehow.
You can see this in the first post.

Ahh, now I remember.
It looks like the FW is encrypted or uses custom squashfs

@slh they seriously had the balls to answer like this when requesting the GPL dump

Thank you for contacting Dynalink Customer Support.

Dear Robert,

Regarding your inquiry:

I'm afraid we cannot offer this sort of thing.

We appreciate the opportunity to assist you. If you have any further questions, please reply to this email directly without changing the Subject of this email.

Warm Wishes,

Christian

Your Dynalink Customer Support Team

I had a stern reply that its I wasnt really giving them a choice.
If that fails, Il reach out to Askey instead

And they decided to ignore it:

Thank you for contacting Dynalink Customer Support.

Dear Robert,

Regarding your inquiry:

We will not be fulfilling this request.

Interestingly, there is the PSU schematic on the internet

Ouch, that is an interesting strategy from them...

Anyway, contacted Askey so we will see.
I doubt they don't know what they are required by GPL.

My board should arrive tomorrow, so we will see what can be done.

1 Like

@Gost6 UART is on the J1004 connector?
If so, then I need to figure something out to actually use it.

Yes, it's in J1004, the connector size I'm using is a 4-pin 2.0 mm JST PH.

Thanks, I gotta dig out a connector like this or try using logic analyzer probes.
Nowhere to get it locally or without 20EUR of shipping cost.

These kind of connectors are commonly used on corded mouses, if you have one that you no longer use, it can be removed, they usually have 6 pins but the extra pin can easily be cut off.

Hm, I used to have one for spare parts.
Will have a look

Finally got around to soldering the UART adaptor, so they are being d*cks and have disabled UART in the stock FW completely.

Ok, managed to pull the DTS using OpenWrt initramfs:

It looks like there are 3 different revision of the Askey board, Dynalink one is: Askey RT5010W-D350/REV0

BTW, stock FW is just the traditional QSDK SquashFS inside of UBI and that's it, its not encrypted or anything so it can easily be unpacked.
They are changing various PHY registers as well as PHY LED config using shell scripts, looks to be built on SFP11.2 QSDK release so semi recent.

rt5010w-rev2 | rt5010w-rev3 | rt5010w-d347-rev0 | rt5010w-d350-rev0 | rt5011w-rev0)
			## PURDA-672
			## QCA8075 setting
			## Askey, Harry Chen, 2020/02/25 , modify LED behavior for QCA8075 (LAN)
			ssdk_sh debug phy set 0x0 0xd 0x7
			ssdk_sh debug phy set 0x0 0xe 0x8076
			ssdk_sh debug phy set 0x0 0xd 0x4007
			ssdk_sh debug phy set 0x0 0xe 0x0640

			ssdk_sh debug phy set 0x1 0xd 0x7
			ssdk_sh debug phy set 0x1 0xe 0x8076
			ssdk_sh debug phy set 0x1 0xd 0x4007
			ssdk_sh debug phy set 0x1 0xe 0x0640

			ssdk_sh debug phy set 0x2 0xd 0x7
			ssdk_sh debug phy set 0x2 0xe 0x8076
			ssdk_sh debug phy set 0x2 0xd 0x4007
			ssdk_sh debug phy set 0x2 0xe 0x0640

			ssdk_sh debug phy set 0x3 0xd 0x7
			ssdk_sh debug phy set 0x3 0xe 0x8076
			ssdk_sh debug phy set 0x3 0xd 0x4007
			ssdk_sh debug phy set 0x3 0xe 0x0640

			ssdk_sh debug phy set 0x4 0xd 0x7
			ssdk_sh debug phy set 0x4 0xe 0x8076
			ssdk_sh debug phy set 0x4 0xd 0x4007
			ssdk_sh debug phy set 0x4 0xe 0x0640

			## QCA8081 setting
			## Askey, Harry Chen, 2020/02/25, modify LED behavior for QCA-8081 (WAN)
			ssdk_sh debug phy set 0x1c 0x40078078 0x8600
		;;
4 Likes

Came across this thread while looking for some info on other askey routers. If the stock fw allows it, can you send a backup of the config? If it's anything like RT4230W I might be able to enable telnet or ssh by modifying it. No guarantees tho.