[rt-ac86u] very easy to brick

[vaboro]

These are the commands available on

Sorry for bringing this up after 5 years, but i have some devices around with bad NAND blocks... I changed the NAND chip on them: i wrote the original NAND content back to the new and good NAND, but the flasher also copies the bad block flags on to the new NAND. I also tried the "n e" command, in order to force a new NAND bad block check. It is asked me the same questions, but it only gives two characters to enter the Board Id, while my original Board ID is like this: 94906AX92U.
Anyone was able to run the "n e" (nvram erase) with success? How?
Or any other "hidden" command that forces the bad block re-check?

Here are the commands availabe in CFE on one of my devices:

Spoiler: CFE commands

CFE> help
Available commands:


otpcfg              Reading/fusing potp/sotp bits
x                   Change extra partitions size
find                Find string in NAND
comp                Compare NAND blocks
fb                  Find NAND bad blocks
dn                  Dump NAND contents along with spare area
phy                 Set memory or registers.
meminfo             Display CFE System Memory
kernp               Updates extra bootloader parameter for kernel. To end input enter // consecutively at any time then press <enter>
sm                  Set memory or registers.
db                  Dump bytes.
dh                  Dump half-words.
dw                  Dump words.
w                   Write the whole image start from beginning of the flash
e                   Erase NAND flash
wp                  Write pmc (previously loaded through JTAG to flash block 0.
ws                  Write whole image (priviously loaded by kermit or JTAG) to flash .
ldt                 load device tree blob from tftp server.
go                  goto and execute from specefic address.
loadb               load binary via network or kermit protocol.
r                   Run program from flash image or from host depending on [f/h/c] flags
p                   Print boot line and board parameter info
c                   Change booline parameters
i                   Erase persistent storage data
avs                 Change AVS config
ddr                 Change board DDR config
a                   Change board AFE ID
b                   Change board parameters
reset               Reset the board
reboot             
pmdio               Pseudo MDIO access for external switches.
spi                 Legacy SPI access of external switch.
pmc                 pmc cmd
closeavs            pmc close avs cmd
cpufreq             set CPU frequency
force               override chipid check for images.
help                Obtain help for CFE commands


For more information about a command, enter 'help command-name'

Here is what happens when the command 'b' is entered:

Spoiler: CFE 'b' command

CFE> b
Press:  <enter> to use current value


        '-' to go previous parameter


        '.' to clear the current value


        'x' to exit this command


94908AC5300R               ------ 03
94906REF                   ------ 07
GT-AC2900                  ------ 08
Board Id                          :  7  8

As it can be seen CFE offers to enter a code from the list corresponding to board id.

 

[McKey]

These are the commands available on

Here are the commands availabe in CFE on one of my devices:

Spoiler: CFE commands

CFE> help
Available commands:


otpcfg              Reading/fusing potp/sotp bits
x                   Change extra partitions size
find                Find string in NAND
comp                Compare NAND blocks
fb                  Find NAND bad blocks
dn                  Dump NAND contents along with spare area
phy                 Set memory or registers.
meminfo             Display CFE System Memory
kernp               Updates extra bootloader parameter for kernel. To end input enter // consecutively at any time then press <enter>
sm                  Set memory or registers.
db                  Dump bytes.
dh                  Dump half-words.
dw                  Dump words.
w                   Write the whole image start from beginning of the flash
e                   Erase NAND flash
wp                  Write pmc (previously loaded through JTAG to flash block 0.
ws                  Write whole image (priviously loaded by kermit or JTAG) to flash .
ldt                 load device tree blob from tftp server.
go                  goto and execute from specefic address.
loadb               load binary via network or kermit protocol.
r                   Run program from flash image or from host depending on [f/h/c] flags
p                   Print boot line and board parameter info
c                   Change booline parameters
i                   Erase persistent storage data
avs                 Change AVS config
ddr                 Change board DDR config
a                   Change board AFE ID
b                   Change board parameters
reset               Reset the board
reboot           
pmdio               Pseudo MDIO access for external switches.
spi                 Legacy SPI access of external switch.
pmc                 pmc cmd
closeavs            pmc close avs cmd
cpufreq             set CPU frequency
force               override chipid check for images.
help                Obtain help for CFE commands


For more information about a command, enter 'help command-name'

Here is what happens when the command 'b' is entered:

Spoiler: CFE 'b' command

CFE> b
Press:  <enter> to use current value


        '-' to go previous parameter


        '.' to clear the current value


        'x' to exit this command


94908AC5300R               ------ 03
94906REF                   ------ 07
GT-AC2900                  ------ 08
Board Id                          :  7  8

As it can be seen CFE offers to enter a code from the list corresponding to board id.

Thank you, but this is just the commands what the help command shows to us, tought that there are more options. From the the NAND dumps i saw the strings what could be written by the commands, where it mentions options for more and different NAND operations, so there must be a way.
About the "n e" and "b" command, you gave me an idea. "n e" wont show me these kind of options, but may i can find similar board id strings in the NAND dump!

 

[vaboro]

Thank you, but this is just the commands what the help command shows to us, tought that there are more options. From the the NAND dumps i saw the strings what could be written by the commands, where it mentions options for more and different NAND operations, so there must be a way.
About the "n e" and "b" command, you gave me an idea. "n e" wont show me these kind of options, but may i can find similar board id strings in the NAND dump!

Maybe it's "ne" not "n e" because "e" erases the NAND, and the are no spaces in CFE commands shown by "help". Anyways, the trial and error might be the best approach for you to find a way to recheck the NAND for bad blocks from CFE, imho.