[rt-ac86u] very easy to brick

Fitz Mutch · Mar 4, 2018

Been flashing my own custom firmware to the RT-AC86U without issue for quite some time now. Then one day it just got bricked, after completing another flash. Maybe it is the flash memory has failed? I noticed there is two different firmwares that get built, so there's a choice of which one to use: "_cferom_ubi.w" and "_ubi.w". Does the "_cferom_ubi.w" firmware mean that it re-writes the bootloader every time?

The serial console reports the following message, at power on:

Code:

----
BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
FAIL

RMerlin · Mar 4, 2018

I don't know if the cferom image also overwrites the whole bootloader or only provides with default settings. Asus didn't give me any additional details about the difference, so I always used cferom to match what their own firmware release do. If it does overwrite the whole bootloader as well, then it's a rather risky procedure indeed.

Fitz Mutch · Mar 4, 2018

It could also be bad flash memory too.

MXIC S170709
MX30LF2G18AC-TI
8C526600B1

The serial console isn't specific, or maybe it is? The source code is all assembly language. I found where it prints the word "NAND", but there is no more source code beyond that point. I couldn't find where it prints "IMG?" and "FAIL".
https://github.com/RMerl/asuswrt-me...bcm63xx_rom/src/bcm63xx_impl3_ddr_init.S#L383

RMerlin · Mar 4, 2018

Fitz Mutch said:
It could also be bad flash memory too.

I guess that's possible. I'm not familiar enough with the RT-AC86U's boot process, it's quite different from previous models.

Vexira · Mar 4, 2018

If the flash memory is dud does that mean you would have to replace it, as in De solder and the old one re solder a new chip.

Fitz Mutch · Mar 4, 2018

Vexira said:
If the flash memory is dud does that mean you would have to replace it, as in De solder and the old one re solder a new chip.

I think you'd have to replace the bad flash NAND chip with a clone of a good one from another RT-AC86U. I don't know any other way to put a CFE bootloader on a new flash NAND chip.

I'm definitely going to de-solder the bad flash NAND chip because it probably still has bits of my data, like private keys, etc. I was able to disassemble the router without voiding the warranty.

Fitz Mutch · Mar 4, 2018

After de-soldering the flash NAND chip from the RT-AC86U circuit board, the error codes did not change. So it's either a bad flash chip or the failure is occurring before it accesses the flash chip.

Serial console output, at power on:

Code:

----
BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
FAIL

Fitz Mutch · Mar 23, 2018

I think the 1st level bootloader is in ROM chip and is referred to as BTRM, and the 2nd level bootloader is what we've known as the "CFE bootloader" and it is stored within the flash NAND chip. Apparently, it is the 2nd level bootloader that recently went missing on my RT-AC86U router. The cause is still unknown.

Here's what the console boot looks like on a good router. The BTRM begins the 1st level bootloader within the ROM chip. And the HELO begins the 2nd level bootloader within the flash NAND chip.

Code:

----
BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
IMGL
UHD?
UHDP
RLO?
RLOP
UBI?
UBIP
PASS
----
HELO
5.0202HNDrc7-1.0.38-161.122
CPU0
L1CD
MMUI
MMU>
CODE
ZBBS
MAIN
NVRAM memcfg 0x1427
MCB chksum 0xa89ec7d9, config 0x1427

MemsysInit lpf0_generic_aarch64 1.3.0.1 20150910
DDR3
900017E8 80018000 8001A000 00000000 00000000 0050371A
MCB rev=0x00040301 Ref ID=0x0371A Sub Bld=0x005
Dram Timing 11-11-11

DDR3-1600 CL11 total 512MB 1 16bits part[s] %1 SSC

Add/Ctl Alignment
no adjustment

ZQ Cal LP PHY
 R in Ohm
 P: Finger=0x2D0 Term=0x78 Drv=0x2D
 N: Finger=0x2D0 Term=0x78 Drv=0x2D

PLL Ref(Hz)=0x02FAF080 UI STEPS=0x038
 DDR CLK(MHz)=0x31B WL CLK dly(ps)=0x0C8 bitT(ps)=0x274 VDLsize(fs)=0x2BCE CLK_V                                                                  DL=0x01A

SHMOO 28nm
8001A000 80018800 00000000 00020000 00000000

Shmoo WL

One UI Steps : 0x43

auto-clk result = 00B (filter=0C steps)
initial CLK shift = 01A
final CLK shift   = 00B

   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 S-------------X+++++++++++++++++++++++++++++++++++++++++++++++++++-
01 S---------------X++++++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD En
FORCED WR ODT = 0x18001800
 DQSN DRIVE PAD CONTROL (from) (to)
 B0 00031A10 00079A10
 B1 00031A10 00079A10
B0 RISE UI=1 VDL=16 PICK UI=2 VDL=16
B1 RISE UI=1 VDL=0C PICK UI=2 VDL=0C
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 --S-------------------X++++++++++++++++++++++++++++++++++++++++++++
01 --S---------X++++++++++++++++++++++++++++++++++++++++++++++++++++++

Shmoo RD DQ NP
DQS :
B0 VDL=3A ok
B1 VDL=38 ok
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
01 --------++++++++++++++++++++++++X+++++++++++++++++++++++++---------
02 ---++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
03 ---------+++++++++++++++++++++++++X+++++++++++++++++++++++++-------
04 ---+++++++++++++++++++++++++X++++++++++++++++++++++++++------------
05 -------++++++++++++++++++++++++X++++++++++++++++++++++++-----------
06 -+++++++++++++++++++++++++X+++++++++++++++++++++++++---------------
07 --------++++++++++++++++++++++++X+++++++++++++++++++++++++---------
08 -----++++++++++++++++++++++++X++++++++++++++++++++++++-------------
09 --+++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
10 ----++++++++++++++++++++++++X++++++++++++++++++++++++--------------
11 -++++++++++++++++++++++++X+++++++++++++++++++++++++----------------
12 -----+++++++++++++++++++++++++X+++++++++++++++++++++++++-----------
13 ---+++++++++++++++++++++++X++++++++++++++++++++++++----------------
14 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
15 ----+++++++++++++++++++++++++X++++++++++++++++++++++++++-----------

Shmoo RD DQ P
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
01 -------+++++++++++++++++++++++++X+++++++++++++++++++++++++---------
02 --+++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
03 ---------+++++++++++++++++++++++++X+++++++++++++++++++++++++-------
04 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
05 --------+++++++++++++++++++++++X++++++++++++++++++++++++-----------
06 -+++++++++++++++++++++++++X+++++++++++++++++++++++++---------------
07 --------++++++++++++++++++++++++X+++++++++++++++++++++++++---------
08 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
09 -+++++++++++++++++++++++++X++++++++++++++++++++++++++--------------
10 ----++++++++++++++++++++++++X++++++++++++++++++++++++--------------
11 +++++++++++++++++++++++++X+++++++++++++++++++++++++----------------
12 ----+++++++++++++++++++++++++X+++++++++++++++++++++++++------------
13 --++++++++++++++++++++++++X++++++++++++++++++++++++----------------
14 --+++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
15 ----+++++++++++++++++++++++++X++++++++++++++++++++++++++-----------

Shmoo RD DQ N
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 ---++++++++++++++++++++++++++X++++++++++++++++++++++++++-----------
01 --------+++++++++++++++++++++++++X+++++++++++++++++++++++++--------
02 --++++++++++++++++++++++++++X++++++++++++++++++++++++++------------
03 --------++++++++++++++++++++++++++X+++++++++++++++++++++++++++-----
04 ---++++++++++++++++++++++++++X+++++++++++++++++++++++++++----------
05 -------+++++++++++++++++++++++++X+++++++++++++++++++++++++---------
06 -++++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
07 --------++++++++++++++++++++++++++X++++++++++++++++++++++++++------
08 ----++++++++++++++++++++++++++X++++++++++++++++++++++++++----------
09 --++++++++++++++++++++++++++X++++++++++++++++++++++++++------------
10 ----+++++++++++++++++++++++++X+++++++++++++++++++++++++------------
11 -++++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
12 -----+++++++++++++++++++++++++X++++++++++++++++++++++++++----------
13 --+++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
14 ---++++++++++++++++++++++++++X++++++++++++++++++++++++++-----------
15 ----+++++++++++++++++++++++++++X+++++++++++++++++++++++++++--------

RD DQS adjustments :
BL0: Start: 0x38 Final: 0x3A
BL1: Start: 0x38 Final: 0x38

Shmoo WR DQ
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 --++++++++++++++++++++++++X+++++++++++++++++++++++++---------------
01 -----++++++++++++++++++++++++X+++++++++++++++++++++++++------------
02 -++++++++++++++++++++++++X+++++++++++++++++++++++++----------------
03 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++---------
04 --++++++++++++++++++++++++++X++++++++++++++++++++++++++------------
05 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++---------
06 -++++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
07 ------++++++++++++++++++++++++++X++++++++++++++++++++++++++--------
08 ------+++++++++++++++++++++++X++++++++++++++++++++++++-------------
09 -----++++++++++++++++++++++++X+++++++++++++++++++++++++------------
10 ------++++++++++++++++++++++++X++++++++++++++++++++++++------------
11 --+++++++++++++++++++++++++X+++++++++++++++++++++++++--------------
12 ------+++++++++++++++++++++++++X+++++++++++++++++++++++++----------
13 ---+++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
14 ----+++++++++++++++++++++++++X++++++++++++++++++++++++++-----------
15 ------+++++++++++++++++++++++++X++++++++++++++++++++++++++---------

Shmoo WR DM
WR DM
   0000000000111111111122222222223333333333444444444455555555556666666
   0123456789012345678901234567890123456789012345678901234567890123456
00 ------++++++++++++++++++++++++++X++++++++++++++++++++++++++--------
01 -++++++++++++++++++++++++++X++++++++++++++++++++++++++-------------
DDR test done successfully
FPS0
----
PAR0
nand_flash_read_buf(): Attempt to read bad nand block 171
nand_flash_read_buf(): Attempt to read bad nand block 171
UBI#
FFFF
NAN9
----
PAR1
J003
JFFS
BT03
0768
----
TRY1
NAN3
JFS2
RFS2
JFFS
JFS2
NAN5


Base: 5.2_02HNDrc7
CFE version 1.0.38-161.122 for BCM94908 (64bit,SP,LE)
Build Date: Thu Mar 30 10:35:41 CST 2017 (defjovi@ubuntu-eva01)
Copyright (C) 2000-2015 Broadcom Corporation.

Boot Strap Register:  0x6fc42
Chip ID: BCM4906_A0, Broadcom B53 Quad Core: 1800MHz
Total Memory: 536870912 bytes (512MB)
Status wait timeout: nandsts=0x50000000 mask=0x40000000, count=0
NAND ECC BCH-4, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: , id 0xc2da block 128KB size 262144KB
pmc_init:PMC using DQM mode

pmc_init slow 95, fast 70
pmc_init:7 0 ffb5043a 34d034a
Skip Rescue Mode

Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host/tftp (f/h/c)  : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Boot image (0=latest, 1=previous) : 0
Default host ramdisk file name    :
Default ramdisk store address     :
Default DTB file name             :
Board Id                          : 94906REF
Number of MAC Addresses (1-64)    : 10
Base MAC Address                  : 2C:FD:A1:xx:xx:xx
PSI Size (1-128) KBytes           : 128
Enable Backup PSI [0|1]           : 0
System Log Size (0-256) KBytes    : 0
Auxillary File System Size Percent: 0
flow memory allocation (MB)       : 14
buffer memory allocation (MB)     : 32
DHD 0 memory allocation (MB)      : 0
DHD 1 memory allocation (MB)      : 14
DHD 2 memory allocation (MB)      : 0
WLan Feature                      : 0x00
Partition 1 Size (MB)             : 8M
Partition 2 Size (MB)             : 48M
Partition 3 Size (MB)             : 0M
Partition 4 Size (MB) (Data)      : 8M

..
..
..

CrashXRu · Oct 6, 2018

cferom located in the firmware bootfs mtd6
is a data loader that reads some settings from a protected area

Code:

 cat /proc/mtd
dev:    size   erasesize  name
mtd0: 05aa0000 00020000 "rootfs"
mtd1: 05ac0000 00020000 "rootfs_update"
mtd2: 00800000 00020000 "data"
mtd3: 00100000 00020000 "nvram"
mtd4: 05f00000 00020000 "image"
mtd5: 05f00000 00020000 "image_update"
mtd6: 00460000 00020000 "bootfs"
mtd7: 00440000 00020000 "bootfs_update"
mtd8: 03000000 00020000 "misc2"
mtd9: 00800000 00020000 "misc1"
mtd10: 0557e000 0001f000 "rootfs_ubifs"

Code:

 mtdinfo s -a
Count of MTD devices:           11
Present MTD devices:            mtd0, mtd1, mtd2, mtd3, mtd4, mtd5, mtd6, mtd7, mtd8, mtd9, mtd10
Sysfs interface supported:      yes

mtd0
Name:                           rootfs
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          725 (95027200 bytes, 90.6 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:0
Bad blocks are allowed:         true
Device is writable:             true

mtd1
Name:                           rootfs_update
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          726 (95158272 bytes, 90.8 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:2
Bad blocks are allowed:         true
Device is writable:             true

mtd2
Name:                           data
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          64 (8388608 bytes, 8.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:4
Bad blocks are allowed:         true
Device is writable:             true

mtd3
Name:                           nvram
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          8 (1048576 bytes, 1024.0 KiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:6
Bad blocks are allowed:         true
Device is writable:             true

mtd4
Name:                           image
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          760 (99614720 bytes, 95.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:8
Bad blocks are allowed:         true
Device is writable:             true

mtd5
Name:                           image_update
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          760 (99614720 bytes, 95.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:10
Bad blocks are allowed:         true
Device is writable:             true

mtd6
Name:                           bootfs
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          35 (4587520 bytes, 4.4 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:12
Bad blocks are allowed:         true
Device is writable:             true

mtd7
Name:                           bootfs_update
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          34 (4456448 bytes, 4.2 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:14
Bad blocks are allowed:         true
Device is writable:             true

mtd8
Name:                           misc2
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          384 (50331648 bytes, 48.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:16
Bad blocks are allowed:         true
Device is writable:             true

mtd9
Name:                           misc1
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          64 (8388608 bytes, 8.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:18
Bad blocks are allowed:         true
Device is writable:             true

mtd10
Name:                           rootfs_ubifs
Type:                           ubi
Eraseblock size:                126976 bytes, 124.0 KiB
Amount of eraseblocks:          706 (89645056 bytes, 85.5 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:20
Bad blocks are allowed:         false
Device is writable:             true

CrashXRu · Oct 6, 2018

Fitz Mutch said:
I think the 1st level bootloader is in ROM chip and is referred to as BTRM, and the 2nd level bootloader is what we've known as the "CFE bootloader" and it is stored within the flash NAND chip. Apparently, it is the 2nd level bootloader that recently went missing on my RT-AC86U router. The cause is still unknown.

Here's what the console boot looks like on a good router. The BTRM begins the 1st level bootloader within the ROM chip. And the HELO begins the 2nd level bootloader within the flash NAND chip.

Check EXTCSD on NAND (MMC)
erase rootfs_update / data / nvram / image_update / bootfs_update
write work dump bootfs / misc1 / misc2 / rootfs_ubifs
after
if the router is in recovery mode, the CFE console will open
there you will need to check what errors are associated with loading CFE CFG

I wonder why Merlin did not say that in this device 2 firmware are in the router
- the first old worker
- the second new (update) on which the router can work
If the new one does not load, the router will automatically start the old one.

the cafe is also duplicated 2 times bootfs and bootfs_update
loader kat to be in each of the specified places and is called
cferom.000 / cferom.003 / cferom.004 / .... cferom.xxx

cferom does not contain settings, it only starts the protected protocol and copies them, so the router starts up at lightning speed

chick0n · May 10, 2019

Hi

I Re Initialized the NAND on my rt-ac86u "by Mistake" from the Serial Console, because im an idiot. Now NAND is completely empty....:

Code:

BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
FAIL

Is there any possibility to unbrick?

Flash NAND with Programmer?

Thanks

Tojo17 · May 10, 2019

CrashXRu said:

cferom located in the firmware bootfs mtd6
is a data loader that reads some settings from a protected area

Code:

 cat /proc/mtd
dev:    size   erasesize  name
mtd0: 05aa0000 00020000 "rootfs"
mtd1: 05ac0000 00020000 "rootfs_update"
mtd2: 00800000 00020000 "data"
mtd3: 00100000 00020000 "nvram"
mtd4: 05f00000 00020000 "image"
mtd5: 05f00000 00020000 "image_update"
mtd6: 00460000 00020000 "bootfs"
mtd7: 00440000 00020000 "bootfs_update"
mtd8: 03000000 00020000 "misc2"
mtd9: 00800000 00020000 "misc1"
mtd10: 0557e000 0001f000 "rootfs_ubifs"

Code:

 mtdinfo s -a
Count of MTD devices:           11
Present MTD devices:            mtd0, mtd1, mtd2, mtd3, mtd4, mtd5, mtd6, mtd7, mtd8, mtd9, mtd10
Sysfs interface supported:      yes

mtd0
Name:                           rootfs
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          725 (95027200 bytes, 90.6 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:0
Bad blocks are allowed:         true
Device is writable:             true

mtd1
Name:                           rootfs_update
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          726 (95158272 bytes, 90.8 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:2
Bad blocks are allowed:         true
Device is writable:             true

mtd2
Name:                           data
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          64 (8388608 bytes, 8.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:4
Bad blocks are allowed:         true
Device is writable:             true

mtd3
Name:                           nvram
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          8 (1048576 bytes, 1024.0 KiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:6
Bad blocks are allowed:         true
Device is writable:             true

mtd4
Name:                           image
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          760 (99614720 bytes, 95.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:8
Bad blocks are allowed:         true
Device is writable:             true

mtd5
Name:                           image_update
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          760 (99614720 bytes, 95.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:10
Bad blocks are allowed:         true
Device is writable:             true

mtd6
Name:                           bootfs
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          35 (4587520 bytes, 4.4 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:12
Bad blocks are allowed:         true
Device is writable:             true

mtd7
Name:                           bootfs_update
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          34 (4456448 bytes, 4.2 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:14
Bad blocks are allowed:         true
Device is writable:             true

mtd8
Name:                           misc2
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          384 (50331648 bytes, 48.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:16
Bad blocks are allowed:         true
Device is writable:             true

mtd9
Name:                           misc1
Type:                           nand
Eraseblock size:                131072 bytes, 128.0 KiB
Amount of eraseblocks:          64 (8388608 bytes, 8.0 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
OOB size:                       64 bytes
Character device major/minor:   90:18
Bad blocks are allowed:         true
Device is writable:             true

mtd10
Name:                           rootfs_ubifs
Type:                           ubi
Eraseblock size:                126976 bytes, 124.0 KiB
Amount of eraseblocks:          706 (89645056 bytes, 85.5 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size:                  2048 bytes
Character device major/minor:   90:20
Bad blocks are allowed:         false
Device is writable:             true

Just read your post, could you please tell me how did you unlock the AC86U region? Is it related to the hidden config loaded by cferom in mtd6?
Thanks!

chick0n · Jun 1, 2019

Ok...I made Full NAND-Dump of working RT-AC86U with FlashcatUSB.

PM me if you are Interested.

CrashXRu · Jun 8, 2019

Tojo17 said:
Just read your post, could you please tell me how did you unlock the AC86U region? Is it related to the hidden config loaded by cferom in mtd6?
Thanks!

unlocking is performed using the official capabilities of the router
decoding change and saving changes

immediately after the change of region, you lose the warranty on the device
even if you change the region, you can see it, all operations with system memory are recorded (yes, it can be recreated, but it is a difficult and time-consuming process)

Grisu · Jun 8, 2019

CrashXRu said:
immediately after the change of region, you lose the warranty on the device

good to know but not a great deal for those who bought a used unit without or very short warrenty or like me bought outside and Asus refused RMA.

chick0n · Jun 8, 2019

Ok...I unbricked my RT-AC86U now. But 5GHz Wifi is still completely dead, has no MAC-Address.

Any Ideas?

RMerlin · Jun 9, 2019

chick0n said:
Ok...I unbricked my RT-AC86U now. But 5GHz Wifi is still completely dead, has no MAC-Address.

Any Ideas?

Check the output on the serial port during boot, look for any error related to initializing the wifi radio.

chick0n · Jun 9, 2019

wl: wl driver adapter not found

hmm...

RMerlin · Jun 9, 2019

I only see eth5 coming up, no eth6. If the radio isn't disabled then it's most likely defective.

If you haven't tried it yet, try an electrical reset.

1) Turn off the router
2) unplug the power
3) Turn it on for 5 secs, then turn it back off
4) Plug the power back
5) Turn it on

chick0n · Jun 10, 2019

I Reflowed the 5ghz chip (BCM4366) with hot-air station. Now it gets detected, but crashes shortly afterwards.....

What a piece of crap router.....

Code:

DUMP CONSOLE: 026738.691 wl1: Broadcom BCM43664 802.11 Wireless Controller 10.10.122.20 (r683106)
DUMP CONSOLE: 026738.691 SPLITRX_MODE_2 enabled : tcmsegsize 160
DUMP CONSOLE: 026738.691 TCAM: 512 used: 256 exceed:0
DUMP CONSOLE: 026738.691 reclaim section 1: Returned 180604 bytes to the heap
DUMP CONSOLE: 026738.692 ThreadX v5.6 initialized
DUMP CONSOLE:
DUMP CONSOLE: 026738.807 wl1: wlc_enable_probe_req: state down, deferring setting of host flags
DUMP CONSOLE: 026738.807 wl1: wlc_enable_probe_req: state down, deferring setting of host flags
DUMP CONSOLE: 026740.732 wl1: wl_open
DUMP CONSOLE: 026740.736 reclaim section ucodes: Returned 108592 bytes to the heap
DUMP CONSOLE: 026740.736 wlc_ucode_download: wl1: Loading non-MU ucode
DUMP CONSOLE: 026740.751 wl1: CORE INIT : nfifo 32 mu_tx_enab 0
DUMP CONSOLE: 026740.751
DUMP CONSOLE: FWID 01-47e84b5b
DUMP CONSOLE: flags 330005
DUMP CONSOLE: 026740.751
DUMP CONSOLE: TRAP 4(2ab390): pc 7ae2, lr 20ea1f, sp 2ab3e8, cpsr 20000193, spsr 20000033
DUMP CONSOLE: 026740.751   dfsr 5, dfar bf02f220
DUMP CONSOLE: 026740.751   r0 43b0cc, r1 0, r2 47, r3 bf02f204, r4 43b0cc, r5 0, r6 2ab428
DUMP CONSOLE: 026740.751   r7 0, r8 1, r9 7f, r10 10, r11 10, r12 2ab3b8
DUMP CONSOLE: 026740.751
DUMP CONSOLE:    sp+0 0041453c 00000008 002ab428 00000001
DUMP CONSOLE: 026740.751   sp+10 002ab41c 0020f6b5 0000000f 002ab41c
DUMP CONSOLE:
DUMP CONSOLE: 026740.751 sp+14 0020f6b5
DUMP CONSOLE: 026740.751 sp+64 00246c5b
DUMP CONSOLE: 026740.752 sp+74 0006efb5
DUMP CONSOLE: 026740.752 sp+78 00009f6d
DUMP CONSOLE: 026740.752 sp+a4 00246da1
DUMP CONSOLE: 026740.752 sp+c4 0023484b
DUMP CONSOLE: 026740.752 sp+ec 00232e0b
DUMP CONSOLE: 026740.752 sp+11c 00235593
DUMP CONSOLE: 026740.752 sp+134 0022ea8d
DUMP CONSOLE: 026740.752 sp+144 00021f7d
DUMP CONSOLE: 026740.752 sp+14c 0002a689
DUMP CONSOLE: 026740.752 sp+164 0001e88d
DUMP CONSOLE: 026740.752 sp+184 000a318d
DUMP CONSOLE: 026740.752 sp+1a4 00004a8b
DUMP CONSOLE: 026740.752 sp+1ac 00098a89
DUMP CONSOLE: 026740.752 sp+1c4 0020c7d5
dhdpcie_checkdied: msgtrace address : 0x00000000
console address  : 0x0043FCF0
Assrt not built in dongle

TRAP type 0x4 @ epc 0x7ae2, cpsr 0x20000193, spsr 0x20000033, sp 0x2ab3e8, lp 0x20ea1f, rpc 0x7ae2
Trap offset 0x2ab390, r0 0x43b0cc, r1 0x0, r2 0x47, r3 0xbf02f204, r4 0x43b0cc, r5 0x0, r6 0x2ab428, r7 0x0


CPU1: stopping
CPU: 1 PID: 0 Comm: swapper/1 Tainted: P                4.1.27 #2
Hardware name: Broadcom-v8A (DT)
Call trace:
[<ffffffc0000876d8>] dump_backtrace+0x0/0x150
[<ffffffc00008783c>] show_stack+0x14/0x20
[<ffffffc0004f9fa4>] dump_stack+0x90/0xb0
[<ffffffc00008e730>] handle_IPI+0x190/0x1a0
[<ffffffc000080c70>] gic_handle_irq+0x88/0x90
Exception stack(0xffffffc01e8c3dd0 to 0xffffffc01e8c3ef0)
3dc0:                                     620b3428 00000004 1ffe82f0 ffffffc0
3de0: 1e8c3f10 ffffffc0 0036837c ffffffc0 620b3428 00000004 4c000000 001a0193
3e00: 0004d097 00000000 14000000 00000000 00000c3e 00000000 00000018 00000000
3e20: 80000000 0019a147 6a9c309c 00000004 1e8b4620 ffffffc0 ffff922c 00000000
3e40: 00000000 00000000 00000040 00000000 00000000 00000000 ff91d664 00000000
3e60: f7512184 00000000 00000000 00000000 000f5b08 ffffffc0 00000000 00000000
3e80: 00000000 00000000 620b3428 00000004 1ffe82f0 ffffffc0 00000001 00000000
3ea0: 00000001 00000000 61c2909c 00000004 006c62e8 ffffffc0 007030a0 ffffffc0
3ec0: 00509000 ffffffc0 1e8c0000 ffffffc0 006c7000 ffffffc0 1e8c3f10 ffffffc0
3ee0: 00368374 ffffffc0 1e8c3f10 ffffffc0
[<ffffffc000083da8>] el1_irq+0x68/0xd8
[<ffffffc000368480>] cpuidle_enter+0x18/0x20
[<ffffffc0000c67a8>] cpu_startup_entry+0x1e8/0x250
[<ffffffc00008e1b4>] secondary_start_kernel+0x154/0ü----

Thread starter	Title	Forum	Replies	Date
A	Suspicious Outgoing traffic on RT-AC86U	ASUS AC Routers & Adapters (Wi-Fi 5)	52	Oct 19, 2024
B	My RT-AC86U reset to factory settings by itself on a reboot	ASUS AC Routers & Adapters (Wi-Fi 5)	6	Sep 27, 2024
T	Weird issue while applying firewall URL filter with my RT-AC86u router!	ASUS AC Routers & Adapters (Wi-Fi 5)	3	Sep 7, 2024
M	Extend coverage of my RT-AC86U	ASUS AC Routers & Adapters (Wi-Fi 5)	24	Sep 2, 2024
	Please check my settings ( AC86U )	ASUS AC Routers & Adapters (Wi-Fi 5)	4	Aug 14, 2024
A	RT-AC86U 5Ghz wifi control channels list missing channels	ASUS AC Routers & Adapters (Wi-Fi 5)	9	Aug 12, 2024
Z	Using AC86U for router functions, and newer TP link system for wifi?	ASUS AC Routers & Adapters (Wi-Fi 5)	3	Aug 9, 2024
	router.asus.com stopped working \| 4G-AC86U	ASUS AC Routers & Adapters (Wi-Fi 5)	6	Aug 8, 2024
C	Wireless stopped working on RT-AC86U Router	ASUS AC Routers & Adapters (Wi-Fi 5)	9	Jul 30, 2024
C	Connect Fibre and RT-AC86U Router - How to Connect?	ASUS AC Routers & Adapters (Wi-Fi 5)	8	Jul 20, 2024

[rt-ac86u] very easy to brick

Senior Member

Asuswrt-Merlin dev

Senior Member

Asuswrt-Merlin dev

Part of the Furniture

Senior Member

Senior Member

Senior Member

Regular Contributor

Regular Contributor

Occasional Visitor

New Around Here

Occasional Visitor

Regular Contributor

Part of the Furniture

Occasional Visitor

Asuswrt-Merlin dev

Occasional Visitor

Attachments

Asuswrt-Merlin dev

Occasional Visitor

Similar threads

Similar threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest