Help Unbricking Unielec MT7621-06

For Developers
1

Hi,
The router is Unielec MT7621-06 Ram 512mb rom 64mb. It had openWRT installed before. After firmware flash failure the router seems to be bricked. But there still are some signs of life. I can access serial console, it boots up but hungs when tring to boot from flash and stops at "Starting kernel ...".
I have already tried to Load system code then write to Flash via TFTP. I can set up IPs and enter the file name but it never starts to download the binary file from my computer. Tried 2 different tftp software but no luck, It says about 10 times that checksum is bad and then after timeout it starts all over in a loop.
I also note that I think someone have tried to flash an ASUS rt-n56u firmware because on serial boot you can see "Image Name: RT-N56U".
Maybe someone can suggest anything to unbrick it? I have tried upload with TFTP and openWRT binaries (kernel and sysupgrade). Do I need some kind of unbrick build flash? Also add serial console log here.

Cheers.

===================================================================
                MT7621   stage1 code 13:14:00 (ASIC)
                CPU=50000000 HZ BUS=16666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x21100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1066Mhz ===
PLL4 FB_DL: 0xb, 1/0 = 513/511 2D000000
PLL3 FB_DL: 0x11, 1/0 = 514/510 45000000
PLL2 FB_DL: 0x16, 1/0 = 513/511 59000000
do DDR setting..[00320000]
Apply DDR3 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000E:|    0    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1
000F:|    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0
0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0
0011:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
rank 0 coarse = 15
rank 0 fine = 80
B:|    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0
opt_dle value:9
DRAMC_R0DELDLY[018]=00002120
==================================================================
                RX      DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    11 10 12 12 11 10 12 8 6 10
10 |    10 12 10 13 9 12
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =32 DQS1 = 33
==================================================================
bit     DQS0     bit      DQS1
0  (1~62)31  8  (1~60)30
1  (1~62)31  9  (2~61)31
2  (1~62)31  10  (1~65)33
3  (1~63)32  11  (1~61)31
4  (1~62)31  12  (2~64)33
5  (1~62)31  13  (1~62)31
6  (1~62)31  14  (1~65)33
7  (1~62)31  15  (2~62)32
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    12 11 13 12 12 11 13 9 9 12
10 |    10 14 10 15 9 13
==================================================================
==================================================================
     TX  perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2
DQ loop=15, cmp_err_1 = ffff0082
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1
DQ loop=14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=14,  finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done
                CPU=50000000 HZ BUS=16666666 HZ
===================================================================
***** led set *****


U-Boot 1.1.3 (Dec 24 2014 - 22:25:27)

Board: Ralink APSoC DRAM:  512 MB
relocate_code Pointer at: 9bfb8000

Config XHCI 40M PLL
flash manufacture id: c2, device id 20 1a
find flash: MX66L51235F
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 4.2.1.0
--------------------------------------------
ASIC 7621_MP (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:Dec 24 2014  Time:22:25:27
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =512 Mbytes
#Reset_MT7530

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.                     0

3: System Boot system code via Flash.
## Booting image at bfc50000 ...
   Image Name:          RT-N56U
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    7793310 Bytes =  7.4 MB
   Load Address: 80000000
   Entry Point:  802be0d0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 802be0d0) ...
## Giving linux memsize in MB, 512

Starting kernel ...
2

Did you see https://openwrt.org/toh/unielec/u7621-06#flash_via_tftpd ?
If that does not work I would try loading kernel image using "1: Load system code to SDRAM via TFTP."

3

Have seen this link and already tried to load system code to SDRAM via TFTP and also tried Load system code then write to Flash via TFTP.
Loading from TFTP keeps loop loading forever. From computer in TFTP app I see no connections. Ethernet activity i see about 70bytes after every 10 seconds moving from router to PC. Seems something is corrupted and ethernet ports does not work.
Serial log:

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 1
                                                                              0


1: System Load Linux to SDRAM via TFTP.
 Please Input new ones /or Ctrl-C to discard
        Input device IP (10.10.10.123) ==:10.10.10.123
        Input server IP (10.10.10.3) ==:10.10.10.3
        Input Linux Kernel filename () ==:root_uImage.bin

 netboot_common, argc= 3

 NetTxPacket = 0x9BFE4E00

 KSEG1ADDR(NetTxPacket) = 0xBBFE4E00

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'root_uImage.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (f0:de:f1:d2:78:bc)
Got it
T T T T T T T T T T
Retry count exceeded; starting again
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'root_uImage.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: Got ARP REPLY, set server/gtwy eth addr (f0:de:f1:d2:78:bc)
Got it
T T T T T T T T T T checksum bad
checksum bad
checksum bad
checksum bad
checksum bad

Retry count exceeded; starting again
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'root_uImage.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: Got ARP REPLY, set server/gtwy eth addr (f0:de:f1:d2:78:bc)
Got it
T T T T T T T T T T
Retry count exceeded; starting again
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'root_uImage.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: Got ARP REPLY, set server/gtwy eth addr (f0:de:f1:d2:78:bc)
Got it
T T T T T T T T T T
Retry count exceeded; starting again
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'root_uImage.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: Got ARP REPLY, set server/gtwy eth addr (f0:de:f1:d2:78:bc)
Got it
T T T T T T T T T T
Retry count exceeded; starting again
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'root_uImage.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: Got ARP REPLY, set server/gtwy eth addr (f0:de:f1:d2:78:bc)
Got it
T T T T T T
4

Hi

maybe the wireshark running on PC could reveal what is going on ?
and please, disable all firewall on PC

5

Temporary disable firewall (as already advised) and make sure the server is listening on the correct interface/address. The popular tftp64 app listens on loopback by default.

6

In PC there was some kind of additional firewall software what caused problems. Software uninstalled and problem solved.
Thanks to everyone who thought along