Strong 1200 / MTC WR1201 bricked - TFTP or serial recovery?

Helo,

I have a Strong device bricked also. As far as I read it couldn't triggered whitout serial attached mode.

Thank you very much for any answer about it.

I'm going to test serial recovery tonight or tommorow. I'll let you know how it went and what steps i did.

Hey, so I managed to successfully use serial recovery and upload current stable (19.07.7). The hardest part was to find the correct serial console data speed (baudrate) wich on this board's uboot is 57600. I am using Windows 10, KiTTY, TFTPD64. Here is my guide:

  1. soldered pins to serial
  2. pinout is as @mk24 stated above: from top to bottom GND GND RX TX 3.3 3.3 (actually there are only 4 holes but 6 contacts on the back)
  3. I used USB-TTL dongle PL2303HX as shown on photo (VCC not connected!, drivers for windows: http://www.ifamilysoftware.com/news37.html)
  4. in Putty I set speed 57600, data bits 8, stop bits 1, parity none, flowcontrol none (of course the same has to be set in usb device driver option)
  5. when prompted, I pressed "1" to use option 1: Load system code to SDRAM via TFTP.
  6. set IP on PC to static 192.168.1.25, subnet 255.255.255.0 (or you can set 192.168.1.150 which is default IP set in bootloader - see below), conencted PC and router with LAN (I used LAN port 1 on router)
  7. on PC I started TFTPD64 (server), the firmware was put in the same directory as the app
  8. Input device IP (192.168.1.1) ==:192.168.1.1 (Router)
    Input server IP (192.168.1.150) ==:192.168.1.25 (PC)
    Input Linux Kernel filename () ==:openwrt.bin (I used initramfs)
  9. after the firmware was flashed and device booted successfully, I then upgraded via LuCI to squashfs-sysupgrade and that's it!
2 Likes

and the serial console output:

===================================================================
                MT7621   stage1 code Mar 12 2015 14:43:30 (ASIC)
                CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x31100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-800Mhz ===
PLL3 FB_DL: 0x8, 1/0 = 571/453 21000000
PLL2 FB_DL: 0x12, 1/0 = 579/445 49000000
PLL4 FB_DL: 0x1a, 1/0 = 576/448 69000000
do DDR setting..[01F40000]
Apply DDR3 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1    1
000F:|    0    0    0    0    0    0    0    1    1    1    1    1    1    1    1    1
0010:|    1    1    1    1    1    1    1    1    1    1    1    1    1    1    0    0
0011:|    1    1    1    1    1    1    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
DRAMC_DQSCTL1[0e0]=14000000
DRAMC_DQSGCTL[124]=80000000
rank 0 coarse = 16
rank 0 fine = 56
B:|    0    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0
opt_dle value:10
DRAMC_DDR2CTL[07c]=C287222D
DRAMC_PADCTL4[0e4]=000022B3
DRAMC_DQIDLY1[210]=0F0E0B0D
DRAMC_DQIDLY2[214]=090E0C0F
DRAMC_DQIDLY3[218]=0F0D0F0B
DRAMC_DQIDLY4[21c]=0F0B0F0D
DRAMC_R0DELDLY[018]=00002E2F
==================================================================
                RX      DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    11 9 11 13 13 10 13 9 8 12
10 |    11 13 11 15 11 12
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =47 DQS1 = 46
==================================================================
bit     DQS0     bit      DQS1
0  (1~90)45  8  (1~85)43
1  (1~90)45  9  (1~86)43
2  (1~88)44  10  (1~88)44
3  (1~90)45  11  (1~85)43
4  (1~90)45  12  (1~87)44
5  (1~90)45  13  (1~88)44
6  (1~91)46  14  (1~91)46
7  (1~93)47  15  (1~86)43
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    13 11 14 15 15 12 14 9 11 15
10 |    13 15 13 15 11 15
==================================================================
==================================================================
     TX  perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2
DQ loop=15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done
                CPU=500000000 HZ BUS=166666666 HZ
===================================================================


U-Boot 1.1.3 (Aug 12 2015 - 14:27:48)

Board: Ralink APSoC DRAM:  128 MB
relocate_code Pointer at: 87fb8000

Config XHCI 40M PLL
******************************
Software System Reset Occurred
******************************
flash manufacture id: c2, device id 20 18
find flash: MX25L12805D
*** Warning - bad CRC, using default environment

============================================
Ralink UBoot Version: 4.3.0.0
--------------------------------------------
ASIC MT7621A SingleCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:Aug 12 2015  Time:14:27:48
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN LLLLW

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 1
                                                                                                                                         0


1: System Load Linux to SDRAM via TFTP.
 Please Input new ones /or Ctrl-C to discard
        Input device IP (192.168.1.1) ==:192.168.1.1
        Input server IP (192.168.1.150) ==:192.168.1.25
        Input Linux Kernel filename () ==:openwrt.bin

 netboot_common, argc= 3

 NetTxPacket = 0x87FE4D40

 KSEG1ADDR(NetTxPacket) = 0xA7FE4D40

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
TFTP from server 192.168.1.25; our IP address is 192.168.1.1
Filename 'openwrt.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (d8:cb:8a:f0:d0:87)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ############################################
done
Bytes transferred = 3552646 (363586 hex)
NetBootFileXferSize= 00363586
Erasing SPI Flash...
.
Writing to SPI Flash...
.
done
Automatic boot of image at addr 0x80A00000 ...
## Booting image at 80a00000 ...
   Image Name:   WR1201_8_128
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3552582 Bytes =  3.4 MB
   Load Address: 80001000
   Entry Point:  80001000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 128

Starting kernel ...
1 Like

Good work, congratulations! And thank you for your detailed information!

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.