Garbled first part of UART boot output

I have TP-Link TL-WR740N v4.23 (https://openwrt.org/toh/tp-link/tl-wr740n).

I soldered everything as pointed on https://openwrt.org/toh/tp-link/tl-wr740n#uart_on_v423 and connected router to my raspberry pi 4B.

I was getting garbled output on my stock firmware. I tried everything: changing baud rates, resoldering, tried programs like screen, minicom, tried enabling utf-8, but nothing worked - I was still getting garbled output.

Friend suggested me that i should flash openwrt, and then try UART on openwrt because it sets standard 115200 baud rate. So I flashed openwrt factory and sysupgrade. Now, for the first 10 seconds of booting I get garbled output and after that it gets completely normal. Following screenshot shows my problem.

After that I get completely normal behavior.

Ok, what’s your question?

If you want to access uboot, it appears the connection settings are not what the uboot is expecting. If you have uboot tools installed you can use fw_printenv to see what the uboot console settings are

2 Likes

Sorry, this is my first time using OpenWRT.

I just built in https://openwrt.org/packages/pkgdata/uboot-envtools but can not find correct settings for fw_env.config. I grepped for CONFIG_ENV_OFFSET, CONFIG_ENV_SIZE, and CONFIG_ENV_SECT_SIZE in source as suggested in https://openwrt.org/docs/techref/bootloader/uboot.config but could not find anything.

Some information:

root@OpenWrt:~# fw_printenv
Warning: Bad CRC, using default environment
bootcmd=bootp; setenv bootargs root=/dev/nfs nfsroot=${serverip}:${rootpath} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off; bootm
bootdelay=5
baudrate=115200
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00020000 00010000 "u-boot"
mtd1: 0014de50 00010000 "kernel"
mtd2: 002821b0 00010000 "rootfs"
mtd3: 00060000 00010000 "rootfs_data"
mtd4: 00010000 00010000 "art"
mtd5: 003d0000 00010000 "firmware"
root@OpenWrt:~# cat /etc/fw_env.config
# MTD device name   Device offset   Env. size   Flash sector size
/dev/mtd0           0x10000         0x10000     0x10000
root@OpenWrt:~# cat /proc/cpuinfo
system type             : Atheros AR9330 rev 1
machine                 : TP-LINK TL-WR741ND v4
processor               : 0
cpu model               : MIPS 24Kc V7.4
BogoMIPS                : 265.42
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 16
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

I found some .h file for my CPU (Atheros AR9330) regarding U-Boot (https://github.com/pepe2k/u-boot_mod/blob/master/u-boot/include/configs/ap121.h), but could not get anything useful for my router.

I tried all possible values for fw_env.config and it still does not work. If you have any suggestions that I could try I would be grateful. Thanks in advance.

Well that's annoying, the fw_env.config should be set correctly. Does the file exist in the factory firmware?

What serial parameters are you using? 115200 n8?

1 Like

I just downloaded stock firmware from tp-link website and extracted it.


There is no fw_env.config as you can see from image.

This file did not exist before, I created it and tried guessing those values myself.

Yeah, baud rate after uboot is 115200. I was connecting serial with
minicom -b 115200 -o -D /dev/serial0 or screen /dev/serial0 115200.

Thanks, in Minicom you can set the parity bits and flow control. Try changing settings and seeing if uboot responds better. No flow control may work better.

Likely the linux Kernel won't care either way.

1 Like

I tried setting 115200 7E1 as serial parameters and it worked. The only problem is that in 7E1 my input does not work correctly but i can switch to 8N1 and it will work. Thank you for help.

One more thing: I am still curious if i could get correct fw_env.config now when I can see uboot output?

1 Like

I successfully entered some kind of shell when i quickly entered "tpl" while still in uboot. Unfortunately it seems like this shell only gets my input correctly if I am in 8N1 mode but it only displays information in 7E1/7N1 mode. Things like CTRL+L work for screen clearing, and I can see that it outputs more garbage if I type commands like printenv. I tried almost all modes but can not find one where I can both receive and send data correctly.

Is there a way to send data in 8N1 and receive it in 7N1?

easy, using 2 serial to USB adaptors, and open 2 terminal windows for each.

One monitoring Tx wire of uart, the other sends your cmd to uart Rx wire.

2 Likes

fwiw, I've added a link to your post from the wiki page covering this garbled characters issue.
https://openwrt.org/toh/tp-link/tl-wr740n#uart_on_v423

1 Like

It seems like my assumptions were correct. I was indeed receiving data in 7E1 and my input was accepted in 8N1. I set up 2 UARTs: one with TX wire and other with RX wire, and now I can access uboot shell. Thanks to everyone who joined to help me.

Just one more thing: Now that I can access uboot shell what parameters should I pass to fw_env.config? Can I obtain that information now?

1 Like

I am trying to de-brick a 740N v4.21. I soldered on the wires (and checked the connection with a multimeter from the other side of the PCB) including the extra wire from the header to the CPU (I can't double-check this one but it seems fine optically).
With 115200 8N1 I see things like this:

β–’Iβ–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’Eβ–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’9β–’β–’β–’β–’)5'β–’β–’β–’Iβ–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’Eβ–’%7β–’β–’Rβ–’β–’β–’β–’β–’β–’β–’Eβ–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’β–’9β–’β–’β–’β–’β–’β–’β–’β–’β–’7β–’β–’

With 15200 7E1 it looks like this:

%!75oMEekR{{{[6{66v,6V}+:t)6lk]/5}q?=?;
?!#?75-95?%--ekR{{{[6{vV,v,YTe-?e!#57?/=/3?3-'5

But the real problem is that I can break the bootloop by sending the tpl command (I tried sending it right after applying power and during the bootloop), neither in 8N1, nor in 7E1 mode.

I tried powering it on with the Reset button pressed. If I release Reset shortly after applying power then I get the same bootlop I get without touching the Reset button. If I hold Reset for until the LEDs stop flashing there is zero text in the terminal (garbage or otherwise) and it does not respond to commands (no echo, no response, nothing).

I think I just "soft-bricked" it because the bootloop started after I flashed my custom OpenWRT build (the build config resulted in a working 23.05.0-rc3 build but not after I compiled the 23.05.2 sources).