Accidentally flashed RT-AX86U firmware on RT-AC86U and now unable to flash back the correct firmware

[UzEE]

There's your problem then...

Rescue mode does not do any validation because it's intended for all sort of cases where flashing may otherwise fail (for instance, due to invalid nvram values that would cause any validation process to flash).

If the regular webui fails, then hnd-write will also fail. It does the same model + CRC validation checks as the webui.

The only way to recover is either by reflashing in Rescue Mode, either using Asus' tool, the recovery webui, or a TFTP client. Personally, the only way I always had 100% success recovering from a bad firmware was using a TFTP client. Asus's recovery tool often fails mid-upload for some reason, and the webui does not seem to be present on all models.

This is where I'm stuck right now. The router does not go into Rescue Mode anymore.

It always just boots up normally, and I'm not aware of any other method of putting it into Rescue Mode apart from holding the Reset button and plugging in the power. Could it be that flashing the wrong firmware has somehow remapped the function of buttons / LEDs?

For example, the power LED never turns on now, no matter what. In fact the only LED that lights up is the leftmost one (LAN4 I believe). The LED toggle button on the back also doesn't do anything anymore.

And yes, the regular Web UI now does give a validation error if I try to flash the correct AC86U firmware since it now likely expects AX86U firmware images.

 

[RMerlin]

In theory flashing the wrong firmware should not affect the boot loader, however it's impossible to tell for sure without being connected to the serial console to see the actual output.

One thing to try: over ssh run the following command:

nvram erase

Then turn off the router. Press the reset button, then it back on while keeping the reset button pressed, until the power LED starts blinking (can typically take about 10-15 seconds with some models, I don't remember for this specific model).

If it still fails, try with the WPS button instead, just in case Asus would have swapped them for this particular model.

 

[UzEE]

In theory flashing the wrong firmware should not affect the boot loader, however it's impossible to tell for sure without being connected to the serial console to see the actual output.

One thing to try: over ssh run the following command:

nvram erase

Then turn off the router. Press the reset button, then it back on while keeping the reset button pressed, until the power LED starts blinking (can typically take about 10-15 seconds with some models, I don't remember for this specific model).

If it still fails, try with the WPS button instead, just in case Asus would have swapped them for this particular model.

I've tried nvram erase a couple of times already. It just prints the following error:

wlcsm_nvram_commit:628 could not open nvram file

Also tried holding the reset button for over a minute, but it still doesn't boot into Rescue Mode. Before flashing the firmware, it would almost always instantly boot into Rescue Mode whenever pressing the reset button while turning on. Same with the WPS button. It seemingly doesn't do anything anymore.

I've ordered a USB to UART TTL cable so I can try opening up the router and connecting to the serial port directly. Is there anything specific I should do or try if I'm able to successfully connect via the serial interface?

 

[RMerlin]

Is there anything specific I should do or try if I'm able to successfully connect via the serial interface?

No other idea at this time, sorry.

 

[andyross]

At what point do you think it's a lost cause and time to just replace it? Consider it lesson learned on using a non-standard way to update.

 

[UzEE]

At what point do you think it's a lost cause and time to just replace it? Consider it lesson learned on using a non-standard way to update.

I'm more than happy to replace it, but there aren't any replacements available in my country at the moment. I've actually been looking to upgrade for a couple of months now but ASUS routers aren't being imported anymore by the distributors and importing one myself involves lots of red tape because of regulations around wireless components.

Besides, the router does work, it's just the wireless radios that aren't working and it's not persisting settings after a reboot. So far, every other feature I've tried seems to work on this, so it's not a complete brick. That's why I'm hopeful it can still be recovered.

 

[RMerlin]

At what point do you think it's a lost cause and time to just replace it? Consider it lesson learned on using a non-standard way to update.

A 5$ TTL serial adaptor is certainly worth a try.

 

[dosborne]

If it still fails, try with the WPS button instead, just in case Asus would have swapped them for this particular model.

@UzEE did you try as merlin suggested above?

 

[vaboro]

This is where I'm stuck right now. The router does not go into Rescue Mode anymore.

Have you tried holding WPS button and powering the device on?
AC86U should go into interactive CFE mode and the http server should become available on 192.168.1.1 provided you configured the LAN card correctly on your PC or Mac.

Spoiler: AC86U interative CFE mode on boot

----
BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
IMGL
UHD?
UHDP
RLO?
RLOP
UBI?
UBIP
PASS
----
HELO
.-1.0.38-161.122

CPU0
L1CD
MMUI
MMU>
CODE
ZBBS
MAIN
NVRAM memcfg 0x1527
MCB chksum 0xa8b35841, config 0x1527

MemsysInit lpf0_generic_aarch64 1.3.0.1 20150910
DDR3
90001328 80018000 8001A000 00000000 00000000 0060371A
MCB rev=0x00040301 Ref ID=0x0371A Sub Bld=0x006
Dram Timing 11-11-11

DDR3-1600 CL11 total 1024MB 1 16bits part[s] %1 SSC

Add/Ctl Alignment
no adjustment

ZQ Cal LP PHY
R in Ohm
P: Finger=0x2D0 Term=0x78 Drv=0x2A
N: Finger=0x2D0 Term=0x78 Drv=0x2A

PLL Ref(Hz)=0x02FAF080 UI STEPS=0x038
DDR CLK(MHz)=0x31B WL CLK dly(ps)=0x0C8 bitT(ps)=0x274 VDLsize(fs)=0x2BCE CLK_VDL=0x01A

SHMOO 28nm
8001A000 80018800 00000000 00020000 00000000

Shmoo WL

One UI Steps : 0x43

auto-clk result = 00B (filter=0C steps)
initial CLK shift = 01A
final CLK shift   = 00B

   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 S-----------------X++++++++++++++++++++++++++++++++++++++++++++++++
01 S-------------------X++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD En
FORCED WR ODT = 0x18001800
DQSN DRIVE PAD CONTROL (from) (to)
B0 00031A31 00079A31
B1 00031A31 00079A31
B0 RISE UI=1 VDL=18 PICK UI=2 VDL=18
B1 RISE UI=1 VDL=0D PICK UI=2 VDL=0D
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 --S---------------------X++++++++++++++++++++++++++++++++++++++++++
01 --S----------X+++++++++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD DQ NP
DQS :
B0 VDL=38 ok
B1 VDL=38 ok
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
01 ------++++++++++++++++++++++++X++++++++++++++++++++++++------------
02 ---++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
...

15 ----++++++++++++++++++++++++X+++++++++++++++++++++++++-------------

Shmoo RD DQ P
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 --++++++++++++++++++++++++++X++++++++++++++++++++++++++------------
01 -----++++++++++++++++++++++++X+++++++++++++++++++++++++------------
...

15 ---++++++++++++++++++++++++++X+++++++++++++++++++++++++++----------

Shmoo RD DQ N
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 ---++++++++++++++++++++++++++X++++++++++++++++++++++++++-----------
01 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++---------
...

15 ---+++++++++++++++++++++++++X++++++++++++++++++++++++++------------

RD DQS adjustments :
BL0: Start: 0x38 Final: 0x38
BL1: Start: 0x38 Final: 0x38

Shmoo WR DQ
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 --+++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
01 -----+++++++++++++++++++++++++X+++++++++++++++++++++++++-----------
...

15 ----++++++++++++++++++++++++++X+++++++++++++++++++++++++++---------

Shmoo WR DM
WR DM
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 ------++++++++++++++++++++++++++X+++++++++++++++++++++++++++-------
01 -++++++++++++++++++++++++++X+++++++++++++++++++++++++++------------
DDR test done successfully

FPS0
----
PAR0
J004
JFFS
BT04
0008
----
PAR1
J003
JFFS
BT03
0768
----
TRY0
NAN3
JFS2
RFS1
JFFS
JFS2
NAN5


CFE version 1.0.38-161.122 for BCM94908 (64bit,SP,LE)
Build Date: Wed Nov 25 14:33:00 CST 2020 (defjovi@ubuntu-4JB1262-ext)
Copyright (C) 2000-2015 Broadcom Corporation.

Boot Strap Register:  0x6fc42
Chip ID: BCM4906_A0, Broadcom B53 Quad Core: 1800MHz
Total Memory: 1073741824 bytes (1024MB)
Status wait timeout: nandsts=0x50000000 mask=0x40000000, count=0
NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: , id 0xc2da block 128KB size 262144KB
pmc_init:PMC using DQM mode
pmc_init:AVS disabled
Skip Rescue Mode

wps button pressed...
wps button pressed...
wps button pressed...
wps button pressed...
wps button pressed...
wps button pressed...
You could release wps button now

Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host/tftp (f/h/c)  : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 3
Boot image (0=latest, 1=previous) : 0
Default host ramdisk file name    :
Default ramdisk store address     :
Default DTB file name             :
Board Id                          : GT-AC2900
Number of MAC Addresses (1-64)    : 11
Base MAC Address                  : 25:40:ff:2f:26:a4
PSI Size (1-128) KBytes           : 48
Enable Backup PSI [0|1]           : 0
System Log Size (0-256) KBytes    : 0
Auxillary File System Size Percent: 0
flow memory allocation (MB)       : 14
buffer memory allocation (MB)     : 16
DHD 0 memory allocation (MB)      : 0
DHD 1 memory allocation (MB)      : 0
DHD 2 memory allocation (MB)      : 0
WLan Feature                      : 0x00
Partition 1 Size (MB)             : 8M
Partition 2 Size (MB)             : 48M
Partition 3 Size (MB)             : 0M
Partition 4 Size (MB) (Data)      : 8M

Initalizing switch low level hardware.
pmc_switch_power_up: Rgmii Tx clock zone1 enable 1 zone2 enable 1.
Software Resetting Switch ... Done.
Waiting MAC port Rx/Tx to be enabled by hardware ...Done
Disable Switch All MAC port Rx/Tx
Enable Switch MAC Port Rx/Tx, set PBVLAN to FAN out, set switch to NO-STP.
CFE>
web info: Waiting for connection on socket 0.

In fact AC86U will be bricked when you mess up the boot loader in mtd3 or CFE in mtd6 both jffs2.

Spoiler: AC86U MTD partitions

Creating 11 MTD partitions on "brcmnand.0":
0x000000000000-0x000000100000 : "nvram" mtd3

0x000000100000-0x000000560000 : "bootfs" mtd6
0x000000560000-0x000006000000 : "rootfs" mtd0
0x000000100000-0x000006000000 : "image" mtd4

0x000006000000-0x000006440000 : "bootfs_update" mtd7
0x000006440000-0x00000bf00000 : "rootfs_update" mtd1
0x000006000000-0x00000bf00000 : "image_update" mtd5

0x00000bf00000-0x00000c700000 : "misc1" mtd10
0x00000c700000-0x00000f600000 : "misc2" mtd9
0x00000f600000-0x00000f700000 : "misc3" mtd8
0x00000f700000-0x00000ff00000 : "data" mtd2

Until you messed up with these, the router can, in theory, be recovered to any firmware you wish. However, during flashing mtd6 is overwritten. But I doubt AX86U's CFE is very much different from AC86U's CFE.

 

[vaboro]

Also tried holding the reset button for over a minute, but it still doesn't boot into Rescue Mode.

In fact, it most probably does but you just can't see it unless you're connected to console:

Spoiler: AC86U rescue mode on boot

----
BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
IMGL
UHD?
UHDP
RLO?
RLOP
UBI?
UBIP
PASS
----
HELO
.-1.0.38-161.122

CPU0
L1CD
MMUI
MMU>
CODE
ZBBS
MAIN
NVRAM memcfg 0x1527
MCB chksum 0xa8b35841, config 0x1527

MemsysInit lpf0_generic_aarch64 1.3.0.1 20150910
DDR3
90001328 80018000 8001A000 00000000 00000000 0060371A
MCB rev=0x00040301 Ref ID=0x0371A Sub Bld=0x006
Dram Timing 11-11-11

DDR3-1600 CL11 total 1024MB 1 16bits part[s] %1 SSC

Add/Ctl Alignment
no adjustment

ZQ Cal LP PHY
R in Ohm
P: Finger=0x2D0 Term=0x78 Drv=0x2A
N: Finger=0x2D0 Term=0x78 Drv=0x2A

PLL Ref(Hz)=0x02FAF080 UI STEPS=0x03B
DDR CLK(MHz)=0x31B WL CLK dly(ps)=0x0C8 bitT(ps)=0x274 VDLsize(fs)=0x2994 CLK_VDL=0x01B

SHMOO 28nm
8001A000 80018800 00000000 00020000 00000000

Shmoo WL

One UI Steps : 0x46

auto-clk result = 00B (filter=0C steps)
initial CLK shift = 01B
final CLK shift   = 00B

   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 S-------------------X+++++++++++++++++++++++++++++++++++++++++++++++++
01 S-------------------X+++++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD En
FORCED WR ODT = 0x18001800
DQSN DRIVE PAD CONTROL (from) (to)
B0 00031A31 00079A31
B1 00031A31 00079A31
B0 RISE UI=1 VDL=17 PICK UI=2 VDL=17
B1 RISE UI=1 VDL=14 PICK UI=2 VDL=14
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 --S--------------------X++++++++++++++++++++++++++++++++++++++++++++++
01 --S-----------------X+++++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD DQ NP
DQS :
B0 VDL=3D ok
B1 VDL=3B ok
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 ---++++++++++++++++++++++++++X++++++++++++++++++++++++++--------------
01 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++------------
...
15 -------++++++++++++++++++++++++X+++++++++++++++++++++++++-------------

Shmoo RD DQ P
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 ---++++++++++++++++++++++++++X++++++++++++++++++++++++++--------------
01 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++------------
...
15 -----+++++++++++++++++++++++++X++++++++++++++++++++++++++-------------

Shmoo RD DQ N
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 ---++++++++++++++++++++++++++X+++++++++++++++++++++++++++-------------
01 ------+++++++++++++++++++++++++++X+++++++++++++++++++++++++++---------
...
15 -------++++++++++++++++++++++++++X++++++++++++++++++++++++++----------

RD DQS adjustments :
BL0: Start: 0x3B Final: 0x3D
BL1: Start: 0x3B Final: 0x3B

Shmoo WR DQ
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 -++++++++++++++++++++++++++X++++++++++++++++++++++++++----------------
01 -----++++++++++++++++++++++++++X++++++++++++++++++++++++++------------
...
15 ---++++++++++++++++++++++++++X+++++++++++++++++++++++++++-------------

Shmoo WR DM
WR DM
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 -------+++++++++++++++++++++++++++X++++++++++++++++++++++++++++-------
01 --+++++++++++++++++++++++++++X++++++++++++++++++++++++++++------------
DDR test done successfully

FPS0
----
PAR0
J018
JFFS
BT18
0008
----
PAR1
J017
JFFS
BT17
0768
----
TRY0
NAN3
JFS2
RFS1
JFFS
JFS2
NAN5


CFE version 1.0.38-161.122 for BCM94908 (64bit,SP,LE)
Build Date: Wed Nov 25 14:33:00 CST 2020 (defjovi@ubuntu-4JB1262-ext)
Copyright (C) 2000-2015 Broadcom Corporation.

Boot Strap Register:  0x6fc42
Chip ID: BCM4906_A0, Broadcom B53 Quad Core: 1800MHz
Total Memory: 1073741824 bytes (1024MB)
Status wait timeout: nandsts=0x50000000 mask=0x40000000, count=0
NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: , id 0xc2da block 128KB size 262144KB
pmc_init:PMC using DQM mode
pmc_init:AVS disabled
nand_flash_read_buf(): Attempt to read bad nand block 1992
nand_flash_read_buf(): Attempt to read bad nand block 1992
nand_flash_read_buf(): Attempt to read bad nand block 1992

Enter Rescue Mode (by Force) ...

Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :  
Run from flash/host/tftp (f/h/c)  : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 3
Boot image (0=latest, 1=previous) : 0
Default host ramdisk file name    :  
Default ramdisk store address     :  
Default DTB file name             :  
Board Id                          : 94906REF
Number of MAC Addresses (1-64)    : 10
Base MAC Address                  : 25:40:ff:2f:26:a4
PSI Size (1-128) KBytes           : 128
Enable Backup PSI [0|1]           : 0
System Log Size (0-256) KBytes    : 0
Auxillary File System Size Percent: 0
flow memory allocation (MB)       : 14
buffer memory allocation (MB)     : 32
DHD 0 memory allocation (MB)      : 0
DHD 1 memory allocation (MB)      : 14
DHD 2 memory allocation (MB)      : 0
WLan Feature                      : 0x00
Partition 1 Size (MB)             : 8M
Partition 2 Size (MB)             : 48M
Partition 3 Size (MB)             : 0M
Partition 4 Size (MB) (Data)      : 8M

Initalizing switch low level hardware.
pmc_switch_power_up: Rgmii Tx clock zone1 enable 1 zone2 enable 1.
Software Resetting Switch ... Done.
Waiting MAC port Rx/Tx to be enabled by hardware ...Done
Disable Switch All MAC port Rx/Tx
Enable Switch MAC Port Rx/Tx, set PBVLAN to FAN out, set switch to NO-STP.
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry

You have to correctly configure the LAN card and tftp server on your PC or Mac and the router will be flashed automatically.

 

[UzEE]

In fact, it most probably does but you just can't see it unless you're connected to console:

Spoiler: AC86U rescue mode on boot

----
BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
IMGL
UHD?
UHDP
RLO?
RLOP
UBI?
UBIP
PASS
----
HELO
.-1.0.38-161.122

CPU0
L1CD
MMUI
MMU>
CODE
ZBBS
MAIN
NVRAM memcfg 0x1527
MCB chksum 0xa8b35841, config 0x1527

MemsysInit lpf0_generic_aarch64 1.3.0.1 20150910
DDR3
90001328 80018000 8001A000 00000000 00000000 0060371A
MCB rev=0x00040301 Ref ID=0x0371A Sub Bld=0x006
Dram Timing 11-11-11

DDR3-1600 CL11 total 1024MB 1 16bits part[s] %1 SSC

Add/Ctl Alignment
no adjustment

ZQ Cal LP PHY
R in Ohm
P: Finger=0x2D0 Term=0x78 Drv=0x2A
N: Finger=0x2D0 Term=0x78 Drv=0x2A

PLL Ref(Hz)=0x02FAF080 UI STEPS=0x03B
DDR CLK(MHz)=0x31B WL CLK dly(ps)=0x0C8 bitT(ps)=0x274 VDLsize(fs)=0x2994 CLK_VDL=0x01B

SHMOO 28nm
8001A000 80018800 00000000 00020000 00000000

Shmoo WL

One UI Steps : 0x46

auto-clk result = 00B (filter=0C steps)
initial CLK shift = 01B
final CLK shift   = 00B

   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 S-------------------X+++++++++++++++++++++++++++++++++++++++++++++++++
01 S-------------------X+++++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD En
FORCED WR ODT = 0x18001800
DQSN DRIVE PAD CONTROL (from) (to)
B0 00031A31 00079A31
B1 00031A31 00079A31
B0 RISE UI=1 VDL=17 PICK UI=2 VDL=17
B1 RISE UI=1 VDL=14 PICK UI=2 VDL=14
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 --S--------------------X++++++++++++++++++++++++++++++++++++++++++++++
01 --S-----------------X+++++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD DQ NP
DQS :
B0 VDL=3D ok
B1 VDL=3B ok
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 ---++++++++++++++++++++++++++X++++++++++++++++++++++++++--------------
01 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++------------
...
15 -------++++++++++++++++++++++++X+++++++++++++++++++++++++-------------

Shmoo RD DQ P
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 ---++++++++++++++++++++++++++X++++++++++++++++++++++++++--------------
01 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++------------
...
15 -----+++++++++++++++++++++++++X++++++++++++++++++++++++++-------------

Shmoo RD DQ N
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 ---++++++++++++++++++++++++++X+++++++++++++++++++++++++++-------------
01 ------+++++++++++++++++++++++++++X+++++++++++++++++++++++++++---------
...
15 -------++++++++++++++++++++++++++X++++++++++++++++++++++++++----------

RD DQS adjustments :
BL0: Start: 0x3B Final: 0x3D
BL1: Start: 0x3B Final: 0x3B

Shmoo WR DQ
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 -++++++++++++++++++++++++++X++++++++++++++++++++++++++----------------
01 -----++++++++++++++++++++++++++X++++++++++++++++++++++++++------------
...
15 ---++++++++++++++++++++++++++X+++++++++++++++++++++++++++-------------

Shmoo WR DM
WR DM
   0000000000111111111122222222223333333333444444444455555555556666666666
   0123456789012345678901234567890123456789012345678901234567890123456789
00 -------+++++++++++++++++++++++++++X++++++++++++++++++++++++++++-------
01 --+++++++++++++++++++++++++++X++++++++++++++++++++++++++++------------
DDR test done successfully

FPS0
----
PAR0
J018
JFFS
BT18
0008
----
PAR1
J017
JFFS
BT17
0768
----
TRY0
NAN3
JFS2
RFS1
JFFS
JFS2
NAN5


CFE version 1.0.38-161.122 for BCM94908 (64bit,SP,LE)
Build Date: Wed Nov 25 14:33:00 CST 2020 (defjovi@ubuntu-4JB1262-ext)
Copyright (C) 2000-2015 Broadcom Corporation.

Boot Strap Register:  0x6fc42
Chip ID: BCM4906_A0, Broadcom B53 Quad Core: 1800MHz
Total Memory: 1073741824 bytes (1024MB)
Status wait timeout: nandsts=0x50000000 mask=0x40000000, count=0
NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: , id 0xc2da block 128KB size 262144KB
pmc_init:PMC using DQM mode
pmc_init:AVS disabled
nand_flash_read_buf(): Attempt to read bad nand block 1992
nand_flash_read_buf(): Attempt to read bad nand block 1992
nand_flash_read_buf(): Attempt to read bad nand block 1992

Enter Rescue Mode (by Force) ...

Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                : 
Run from flash/host/tftp (f/h/c)  : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 3
Boot image (0=latest, 1=previous) : 0
Default host ramdisk file name    : 
Default ramdisk store address     : 
Default DTB file name             : 
Board Id                          : 94906REF
Number of MAC Addresses (1-64)    : 10
Base MAC Address                  : 25:40:ff:2f:26:a4
PSI Size (1-128) KBytes           : 128
Enable Backup PSI [0|1]           : 0
System Log Size (0-256) KBytes    : 0
Auxillary File System Size Percent: 0
flow memory allocation (MB)       : 14
buffer memory allocation (MB)     : 32
DHD 0 memory allocation (MB)      : 0
DHD 1 memory allocation (MB)      : 14
DHD 2 memory allocation (MB)      : 0
WLan Feature                      : 0x00
Partition 1 Size (MB)             : 8M
Partition 2 Size (MB)             : 48M
Partition 3 Size (MB)             : 0M
Partition 4 Size (MB) (Data)      : 8M

Initalizing switch low level hardware.
pmc_switch_power_up: Rgmii Tx clock zone1 enable 1 zone2 enable 1.
Software Resetting Switch ... Done.
Waiting MAC port Rx/Tx to be enabled by hardware ...Done
Disable Switch All MAC port Rx/Tx
Enable Switch MAC Port Rx/Tx, set PBVLAN to FAN out, set switch to NO-STP.
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry
Loading failed.: CFE error -21
Loading 255.255.255.255:ASUSSPACELINK ...
TFTP Server
tftpd retry

You have to correctly configure the LAN card and tftp server on your PC or Mac and the router will be flashed automatically.

I just received the USB to serial cable so I haven't hooked it up yet, and will do over the weekend since I still need the router operational for work, so I can't experiment yet.

But holding the Reset (or WPS) button and powering on doesn't seemingly go into Rescue Mode because WRT / Merlin's Initial Setup wizard comes on when it's powered on. And since the LEDs don't work anymore, it's not possible to tell if it does initially boot into Rescue Mode and then automatically reboots again.

Hopefully, what's actually happening should clear up if I'm able to hook up to the console.

 

[vaboro]

But holding the Reset (or WPS) button and powering on doesn't seemingly go into Rescue Mode because WRT / Merlin's Initial Setup wizard comes on when it's powered on. And since the LEDs don't work anymore, it's not possible to tell if it does initially boot into Rescue Mode and then automatically reboots again.

The computer's LAN interface should be reconfigured correctly in order for http to work on 192.168.1.1; for tftp to work you have to configure tftp server on the computer in addition to correctly reconfiguring the LAN interface.

Hopefully, what's actually happening should clear up if I'm able to hook up to the console.

Your router seems to be fully recoverable and the UART card will sure clear many other things for you.

 

[UzEE]

I managed to recover the router using UART cable.

I disassembled the router, and connected the UART cable to the serial port, and (after lots of hair pulling trying to get the cable to work) managed to interrupt the boot sequence and keep the router on the CFE.

I was then able to upload the correct firmware using the CFE server web page on 192.168.1.1. Both the ASUS Firmware Restoration utility and TFTP did not work btw, and the reason I wasn't able to put the router into Rescue Mode using the Reset button was apparently because Reset and WPS buttons weren't registering presses in the wrong firmware.

Thankfully, I had a backup of my configuration and JFFS partition before the flash so I was able to restore everything back to it's original state, with the correct firmware.

One more thing:

It's interesting that certain AX86U features (like Alexa integration) that aren't hardware dependent can still technically work on an AC86U as well if they get ported, since I was able to use them while I had the AX86U firmware flashed. Maybe it's something for the community to explore and see if they can be ported.

Anyways, thank you everyone for the help.