Asus router RT-AX92U full nand dump needed

[smoovie2003]

Hello everyone,

I am experiencing some problems with my Asus RT-AX92U router which is a boot loop state, with only power on (blinking every 15 secs) and 5GH1 led lit.

I can flash it by Asus rescue but after reboot it comes back the same, 5GHZ1 led is on and power on led flashes every 15 seconds or so.
I have used a TTL Serial interface to get the logs and get a great load of "Uncorrectable ECC Error: intr 0x70, addr=0x00010000, blk=0," so I think something is wrong with the data either in CRE or the other partitions. I could try to flash the Macronix MX30LF2G18AC NAND using external programmer, but I need to find a good donor for the full dump.

Im posting a part of the log:

BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
IMGL
UHD?
UHDP
RLO?
RLOP
UBI?
UBIP
PASS
----
HELO
.-1.0.38-163.181

CPU0
L1CD
MMUI
MMUA
CODE
ZBBS
MAIN
Boot Strap Register: 0x6fc43
...

noticed some Uncorrectable ECC Error:


CFE version 1.0.38-163.181 for BCM94908 (64bit,SP,LE)
Copyright (C) 2000-2015 Broadcom Corporation.

Boot Strap Register: 0x6fc43
Chip ID: BCM4906_A0, Broadcom B53 Quad Core: 1800MHz
Total Memory: 536870912 bytes (512MB)
NAND ECC BCH-8, page size 0x800 bytes, spare size used 108 bytes
NAND flash device: , id 0xc2da block 128KB size 262144KB
Uncorrectable ECC Error: intr 0x70, addr=0x00010000, blk=0,
Uncorrectable ECC Error: intr 0x70, addr=0x00010800, blk=0,
CPU1
ERROR: could not append enough serial LEDs
pmc_initMC using DQM mode
pmc_patch_4908:7 0 fe0459 33a033b

board info:


Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host/tftp (f/h/c) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Boot image (0=latest, 1=previous) : 0
Default host ramdisk file name :
Default ramdisk store address :
Default DTB file name :
Board Id : 94906AX92U
Number of MAC Addresses (1-64) : 11
Base MAC Address : 00:00:00:00:00:00 (I removed the mac address from the log)
PSI Size (1-512) KBytes : 48
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
flow memory allocation (MB) : 43
buffer memory allocation (MB) : 16
DHD 0 memory allocation (MB) : 0
DHD 1 memory allocation (MB) : 0
DHD 2 memory allocation (MB) : 0
WLan Feature : 0x00
Partition 1 Size (MB) : 8M
Partition 2 Size (MB) : 64M
Partition 3 Size (MB) : 0M
Partition 4 Size (MB) (Data) : 8M

and then I get a full list of nand errors such as:


nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xda
nand: Macronix MX30LF2G18AC
nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
bcm63xx_nand ff801800.nand: Adjust timing_1 to 0x65324458 timing_2 to 0x80040e54
bcm63xx_nand ff801800.nand: detected 256MiB total, 128KiB blocks, 2KiB pages, 27B OOB, 8-bit, BCH-8
bcm63xx_nand ff801800.nand: uncorrectable error at 0xffe0400
Bad block table found at page 131008, version 0x01
bcm63xx_nand ff801800.nand: uncorrectable error at 0xffe0400
bcm63xx_nand ff801800.nand: uncorrectable error at 0xffc0400
Bad block table found at page 130944, version 0x01
bcm63xx_nand ff801800.nand: uncorrectable error at 0xffe0400
nand_bbt: ECC error in BBT at 0x00000ffe0005
bcm63xx_nand ff801800.nand: uncorrectable error at 0xffc0400
nand_bbt: ECC error in BBT at 0x00000ffc0005
Scanning device for bad blocks
bcm63xx_nand ff801800.nand: uncorrectable error at 0x400
bcm63xx_nand ff801800.nand: uncorrectable error at 0xc00
bcm63xx_nand ff801800.nand: uncorrectable error at 0x20400
bcm63xx_nand ff801800.nand: uncorrectable error at 0x20c00
bcm63xx_nand ff801800.nand: uncorrectable error at 0x40400
bcm63xx_nand ff801800.nand: uncorrectable error at 0x40c00
bcm63xx_nand ff801800.nand: uncorrectable error at 0x60400
bcm63xx_nand ff801800.nand: uncorrectable error at 0x60c00
bcm63xx_nand ff801800.nand: uncorrectable error at 0x80400
bcm63xx_nand ff801800.nand: uncorrectable error at 0x80c00
bcm63xx_nand ff801800.nand: uncorrectable error at 0xa0400

Can anyone please help with a full Macronix MX30LF2G18AC NAND dump so I can try to flash it using programmer?

Thank you in advance.

 

[bbunge]

Have you done a hard factory reset?

[Wireless Router] When Standard Reset Isn’t Working: Hard Factory Reset - Models list | Official Support | ASUS Global

 

[smoovie2003]

That was the first thing I did.

 

[OzarkEdge]

That was the first thing I did.

Yeah, if ECC errors refers to "embedded ECC" or error correction code, a reset won't fix those. I'd assume either a hard fault or some much too scrambled memory contents. Us mere mortals would be off to buy a new router.

OE

 

[smoovie2003]

Yeah, if ECC errors refers to "embedded ECC" or error correction code, a reset won't fix those. I'd assume either a hard fault or some much too scrambled memory contents. Us mere mortals would be off to buy a new router.

OE

Can't argue with that, but Im keen on fixing it. Got the tools, just need the dump.

 

[OzarkEdge]

Got the tools, just need the dump.

From a soul mate... good luck!

OE

 

[McKey]

Can't argue with that, but Im keen on fixing it. Got the tools, just need the dump.

Any luck with the AX92U since your last post?
I have the exact same problem and messages trough the serial. The 92U wasnt able to refresh its firmware or switch its working mode (for example:from router to aimesh node) So i decided to use the "Firmware Restoration" tool from Asus. Now im in the same bootloop where you are.
And as i see on ebay, there are a lot of AX92U with the same problem (they are selling it in 10-20pcs lots as booting but not working).
So if there is a way to copy the nand, that would open a new market...

Regards, M

 

[McKey]

Ordered an Xgecu to get out more info from the AX92U, and possibly to upload to a new MXIC flash.
So, im waiting too for a hero (with or without a cape) to share an image!

 

[McKey]

I just rescued two AX92Us with the same problem. My method was:
1. I ordered the xGecu T48. Plus the TSOP 48 socket (30+ bucks for only a d@ng socket!)
2. Ordered 10pc of flash chips, the same as the original (Macronix, labeled as:MXIC MX30LF2G189C)
3. Desoldered the original Macronix MX30LF2G189C from the AX92U (use lots of Amtech flux!)
4. Readed out and saved the flash. In the xGPro, under the Device>Check NAND blocks, there is the tool to check for physical errors.
5. Flash chips are arrived, after checking them with the above mentioned tool, i noticed thet half of them are were garbage, with 1...4...25 bad blocks... And i pulled them out from the factory plastic tray...
6. I flashed a new and 0 bad block flash chip with the orriginal flash dump.
7. Soldered it back, without hot air, only applying heat to the legs with the solder iron, to protect the flash chip (used even more Amtech flux, than on the desoldering. It really helps to get rid of the bridgings!)
8. Turned it on, as i expected, it had error messages on the UART (original flash was saved from the point where the rescue failed due to the bad, unwritable flash chip itself)
9. Started in rescue mode and applied the latest FW. Succeded.
10. Turned on, big smile on my face since. Repeated it on a second 92U.

 

[McKey]

Ok, my method has a flaw. When i check a brand new chip from the factory, lets say it has 1 bad block, checked by the xgpro programmer. As soon as i write the original firmware to it from the original chip, it shows exactly the same amount of bad blocks as it was on the original chip (17 bad blocks in my case). Both the programmer and after soldering, in the CLI, using the fb command finds the same amount of bad blocks.
Anyone knows how to force for rechecking the bad blocks?
Im afraid that the real bad blocks will be not counted and there are good blocks that are marked as bad. This could go terribly (already found signs of it)
@telalpal You have to know about this befor you do the same.

 

[McKey]

I found this in the asuswrt code (it uses this to check for bad blocks)

/* Check if the block is good or bad. If bad returns 1, if good returns 0 */
static int nand_is_blk_bad(PCFE_NAND_CHIP pchip, unsigned short blockNum)
{
#ifdef CONFIG_BRCM_IKOS
    /* spare area not supported in sim/emu environment */
    return 0; // good block
#else
#if defined(CFG_RAMAPP)
    unsigned char *spare;
#else
    /* CFE ROM does not have real heap. KMALLOC simply use mem_heapstart memory.
     * as caller of this function already use mem_heapstart, we can't use heap again
     * must switch to stack. KFREE is a nop for CFE ROM */
    unsigned char spare[SPARE_MAX_SIZE];

And also this is in the AX92U dumpfile (strings used in the CLI):

Now think carefully.  Do you really,
really want to mark block 0x%x bad?       Marking block 0x%x bad
wrong number of arguments, need to provide block start and optionally block end to erase
Forceably Erase FLASH block? (which includes clearing the bad block marker)

So there must be a way to correct the bad block flags after a chip change. I just cant find the way for the how.