RT-N66U will not enter recovery mode

[mich]

I have a RT-N66U here that is currently not working, possibly due to a failed firmware upgrade. When I switch it on, the power LED lights up and stays on. All other LEDs flash once every 3-4 seconds. When I start up holding the reset button, the router does not enter recovery mode (the LEDs behave exactly like described before). I can enter NVRAM clear mode by starting up with the WPS button pressed though (power LED blinks quickly, all others stay off). I also tried entering recovery mode after NVRAM clear mode by holding down Reset when releasing the WPS button, but to no avail. I have not been able to ping the RT-N66U at any of these stages.

My impression so far (please correct me if I'm wrong) is that the router is stuck in a reboot loop and will not enter recovery mode simply because there is too little time in between reboots. As far as I understand the threads I have read on similar problems here, my next step should be to open up the case and connect via a serial cable, and somehow get into the CFE prompt. I have already ordered a CP2102-based serial adapter, putty is installed on my PC, but it's still a little unclear to me what to do once I get the CFE prompt. Could someone point me into the right direction here please?

 

[john9527]

You may want to try this procedure. It works for the TM-1900 and at least one AC87U user running ASUS code that couldn't get into recovery mode.

http://www.snbforums.com/threads/ac...-accept-378-56-or-anything.32857/#post-264728

 

[mich]

*How to enter in RESCUE mode:
Power off the router: Hold RESET button and power on router,keep holding RESET til led begin flashing slowy, release RESET button and you are now in rescue mode

That is exactly what I tried first.

When I start up holding the reset button, the router does not enter recovery mode (the LEDs behave exactly like described before).

 

[mich]

You may want to try this procedure. It works for the TM-1900 and at least one AC87U user running ASUS code that couldn't get into recovery mode.

http://www.snbforums.com/threads/ac...-accept-378-56-or-anything.32857/#post-264728

As I said, I can't even ping the router, so http access is out of the question.

Could anybody give me some pointers that are not based on the recovery mode working or any kind of ethernet access to the router, because neither of those is the case for me.

 

[john9527]

That procedure looks for a window where the Ethernet port may be temporarily available to break into the CFE mini-webserver...but you are free to wait for the serial adapter instead. There are many posts on how to use the serial adapter if you do a search.

 

[mich]

That procedure looks for a window where the Ethernet port may be temporarily available to break into the CFE mini-webserver...but you are free to wait for the serial adapter instead. There are many posts on how to use the serial adapter if you do a search.

I tried that about 20 times, but the reboot occurs too quickly. the ethernet port is never available.

You said : "I tried holding down Reset when releasing the WPS button to enter in recovery mode". There is no need of WPS button to do this

Its just Hold on RESET button when power on the router, keep RESET press until LED start flashing slowy( 5 -10 sec approx)
https://www.asus.com/support/faq/1000814/

Then start the Restoration tool , you dont need to enter GUI to do this, and reflash with want you want

As I said, I tried the procedure you described, with just the Reset button multiple times, and it did not work. Then I tried the other procedure, WPS then reset, as described by Merlin in this post: [RT-AC56U] Reboot cycle after update to original firmware 374.291. That did not help either.

Now I have my serial cable. I installed the driver, opened the RT-N66U, connected the cable, and configured Putty to communicate with the RT-N66U. I can now see the reboot loop happening:

Decompressing...done


CFE version 5.100.138.20 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 五  1月 24 17:20:49 CST 2014 (yau@wireless-pub2)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.100.138.20
CPU type 0x19749: 600MHz
Tot mem: 131072 KBytes

CFE mem:    0x80700000 - 0x808358A0 (1267872)
Data:       0x8072F6B0 - 0x80732910 (12896)
BSS:        0x80732910 - 0x807338A0 (3984)
Heap:       0x807338A0 - 0x808338A0 (1048576)
Stack:      0x808338A0 - 0x808358A0 (8192)
Text:       0x80700000 - 0x8072F6B0 (194224)

Committing NVRAM...done
Waiting for reset button release...don
Decompressing...done


CFE version 5.100.138.20 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 五  1月 24 17:20:49 CST 2014 (yau@wireless-pub2)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.100.138.20
CPU type 0x19749: 600MHz
Tot mem: 131072 KBytes

CFE mem:    0x80700000 - 0x808358A0 (1267872)
Data:       0x8072F6B0 - 0x80732910 (12896)
BSS:        0x80732910 - 0x807338A0 (3984)
Heap:       0x807338A0 - 0x808338A0 (1048576)
Stack:      0x808338A0 - 0x808358A0 (8192)
Text:       0x80700000 - 0x8072F6B0 (194224)

Invalid switch: -auto
Null Rescue Flag.
Boot program checksum is invalid
Hello!! Enter Rescue Mode: (Check error)

Reading :: TFTP Server.
Failed.: Error
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: .. 5192 bytes read
Entry at 0x80001000
Starting program at 0x80001000
Linux version 2.6.22.19 (root@tomato) (gcc version 4.2.4) #3 Fri Oct 9 18:01:58 CEST 2015
CPU revision is: 00019749
Determined physical RAM map:
 memory: 07fff000 @ 00000000 (usable)
 memory: 08000000 @ 87fff000 (usable)
Zone PFN ranges:
  Normal          0 ->   131072
  HighMem    131072 ->   589823
early_node_map[2] active PFN ranges
    0:        0 ->    32767
    0:   557055 ->   589823
Built 1 zonelists.  Total pages: 65535
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 512 (order: 9, 2048 bytes)
CPU: BCM5300 rev 1 pkg 0 at 600 MHz
Using 300.000 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 255300k/131068k available (33k kernel code, 6544k reserved, 2949k data, 128k init, 131072k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI: Initializing host
PCI: Reset RC
PCI: Initializing host
PCI: Reset RC
PCI: Fixing up bus 0
PCI/PCIe coreunit 0 is set to bus 1.
PCI: Fixing up bridge
PCI: Fixing up bridge
PCI: Enabling device 0000:01:00.1 (0004 -> 0006)
PCI: Fixing up bus 1
PCI/PCIe coreunit 1 is set to bus 2.
PCI: Fixing up bridge
PCI: Fixing up bridge
PCI: Enabling device 0000:02:00.1 (0004 -> 0006)
PCI: Fixing up bus 2
NET: Registered protocol family 2
Time: MIPS clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
highmem bounce pool size: 64 pages
squashfs: version 3.0 (2006/03/15) Phillip Lougher
io scheduler noop registered (default)
HDLC line discipline: version $Revision: 4.8 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0xb8000300 (irq = 8) is a 16550A
serial8250: ttyS1 at MMIO 0xb8000400 (irq = 8) is a 16550A
PPP generic driver version 2.4.2
MPPE/MPPC encryption/compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.18.3
PPTP driver version 0.8.5
Physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
Enabling Spansion 65nm mode, writesize = 512 bytes
Physically mapped flash: CFI does not contain boot bank location. Assuming top.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Flash device: 0x2000000 at 0x1c000000
Creating 5 MTD partitions on "Physically mapped flash":
0x00000000-0x00040000 : "pmon"
0x00040000-0x01fe0000 : "linux"
0x0013a000-0x01460000 : "rootfs"
0x01460000-0x01fe0000 : "jffs2"
0x01fe0000-0x02000000 : "nvram"
Found an  serial flash with 0 0KB blocks; total size 0MB
sflash: found no supported devices
_nvram_init: allocat header: 2280980480, size= 65536
usbcore: registered new interface driver hiddev
usbcore: registered new interface driver usbhid
drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver
u32 classifier
    OLD policer on
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (2048 buckets, 16384 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
ipt_account 0.1.21 : Piotr Gasidlo <quaker@barbara.eu.org>, http://www.barbara.eu.org/~quaker/ipt_account/
net/ipv4/netfilter/tomato_ct.c [Oct  9 2015 18:01:57]
NET: Registered protocol family 1
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
SQUASHFS error: lzma returned unexpected result 0x1
SQUASHFS error: Unable to read cache block [130feb3:ebc]
SQUASHFS error: Unable to read inode [130feb3:ebc]
List of all partitions:
1f00        256 mtdblock0 (driver?)
1f01      32384 mtdblock1 (driver?)
1f02      19608 mtdblock2 (driver?)
1f03      11776 mtdblock3 (driver?)
1f04        128 mtdblock4 (driver?)
No filesystem could mount root, tried:  squashfs
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,2)
Rebooting in 3 seconds..Please stand by while rebooting the system...

Decompressing...done


CFE version 5.100.138.20 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 五  1月 24 17:20:49 CST 2014 (yau@wireless-pub2)
Copyright (C) 2000-2008 Broadcom Corporation.

...and here it starts over again.

I can also enter the CFE prompt - I just don't know how to fix the errors I am seeing. So far, I have cleared the NVRAM:

CFE> nvram erase
*** command status = 0

I doubt that is going to fix anything though.

Can anybody help me interpret the output, please?

 

[mich]

Ok, it seems I have managed to fix the router. Had to manually set the IP Address before I could connect via TFTP:

CFE>  ifconfig -addr=192.168.1.1 -mask=255.255.255.0 -hwaddr=1c:b7:2c:01:02:03 eth0
Device eth0:  hwaddr 1C-B7-2C-01-02-03, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway not set, nameserver not set
*** command status = 0

After that, the router was finally pingable.

So I fired up tftpd64, uploaded Merlin 61.0, and waited... I don't know how long exactly it took because when it was not done after 30 minutes, I just let it sit there for another hour. Anyway, eventually, I saw this:

CFE> flash -noheader : flash1.trx
Reading :: TFTP Server.
TFTP_BLKLEN!!
Done. 24309760 bytes read
Download of 0x172f000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...
copysize=24309760, amtcopy=24309760
done. 24309760 bytes written

At this point, the router did not accept any more input from Putty, so I just power cycled it - and voila, it booted into Merlin without problems.

 

[zuiksoft]

I followed a similar procedure to recover firmware. I also had to set the Gateway. Connecting serial cable and using putty I could get to the CFE> prompt hitting CTL-C quickly on power up. I then did the following.

Setup TFTPD32 on laptop configured to IP 192.168.1.2. Got to the CFE> prompt:

CFE> ifconfig -addr=192.168.1.1 -gw=192.168.1.1 -mask=255.255.255.0 eth0
Device eth0:  hwaddr 30-85-A9-6C-0A-09, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway 192.168.1.1, nameserver not set
*** command status = 0

From laptop I could now ping 192.168.1.1.
I started the tftp server on the laptop and used flash command in CFE. This was the previous firmware in the router.

CFE> flash -noheader 192.168.1.2:RT-N66U_380.58_0.trx flash1.trx
Reading 192.168.1.2:RT-N66U_380.58_0.trx: TFTP Client.
TFTP_BLKLEN!!
Done. 22745088 bytes read
Download of 0x15b1000 bytes completed
Write kernel and filesystem binary to FLASH
Programming...
copysize=22745088, amtcopy=22745088
done. 22745088 bytes written

This took a while during programming. Then the router rebooted but I get the same errors as before, so I'm stuck. I believe the parameters are corrupt, such as eth0, but resetting NVRAM did not help. Any ideas on how to procede?

▒Decompressing...done!!
tmp_ret= 0


CFE version 5.100.127 based on BBP 1.0.37 for BCM947XX (32bit,SP,LE)
Build Date: 五 12月  9 10:10:49 CST 2011 (boyau@localhost.localdomain)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 5.100.127
CPU type 0x19749: 600MHz
Tot mem: 131072 KBytes

CFE mem:    0x80700000 - 0x8079D320 (643872)
Data:       0x807330F0 - 0x807363B0 (12992)
BSS:        0x807363B0 - 0x80737320 (3952)
Heap:       0x80737320 - 0x8079B320 (409600)
Stack:      0x8079B320 - 0x8079D320 (8192)
Text:       0x80700000 - 0x807330E8 (209128)

Invalid switch: -auto
Null Rescue Flag.
Loader:raw Filesys:tftp Dev:(null) File:: Options:(null)
Loading: TFTP Server.
Failed.
Could not load :: Error
Loader:raw Filesys:raw Dev:flash0.os File: Options:(null)
Loading: ...... 3404640 bytes read
Entry at 0x80001000
Starting program at 0x80001000
start_kernel
Linux version 2.6.22.19 (root@asus) (gcc version 4.2.3) #1 Sun Mar 20 15:52:04 EDT 2016
CPU revision is: 00019749
early_nvram_get: Failed reading nvram var kernel_args
early_nvram_get: Failed reading nvram var gpio0

....

early_nvram_get: Failed reading nvram var gpio29
early_nvram_get: Failed reading nvram var gpio30
early_nvram_get: Failed reading nvram var gpio31
Determined physical RAM map:
 memory: 07fff000 @ 00000000 (usable)
 memory: 08000000 @ 87fff000 (usable)
Built 1 zonelists.  Total pages: 585216
Kernel command line: root=/dev/mtdblock2 noinitrd console=ttyS0,115200
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 2048 (order: 11, 8192 bytes)
CPU: BCM5300 rev 1 pkg 0 at 600 MHz
early_nvram_get: Failed reading nvram var watchdog
Using 300.000 MHz high precision timer.
console [ttyS0] enabled
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 238608k/131068k available (2609k kernel code, 22664k reserved, 518k data, 196k init, 131072k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
early_nvram_get: Failed reading nvram var boardflags

 

[zuiksoft]

Update: I am not sure flash1.trx was correct or not, as I was afraid flash0 may over-write the CFE? Read somewhere. However, getting into CFE with quickly hitting CTL-C and setting the eth0 correctly then allowed the mini-web interface to work.

CFE> ifconfig -addr=192.168.1.1 -mask=255.255.255.0 -hwaddr=30:85:A9:6C:0A:09 -gw=192.168.1.2 eth0
Device eth0:  hwaddr 30-85-A9-6C-0A-09, ipaddr 192.168.1.1, mask 255.255.255.0
        gateway 192.168.1.2, nameserver not set
*** command status = 0

Now from a browser at 192.168.1.1 allowed me to upload firmware. It takes a while at Programming....
Unfortunately the result is the same errors as before.

 

[zuiksoft]

I believe I have bricked the router, unless someone knows a fix. I started an upgrade to latest merlin version, but forgot to let it complete. According to this link reverting from 3.0.0.4.380_3000 and on is not possible. So it is stuck. The CFE bootloader is still 1.0.1.2. I can successfully upload using the CFE mini-browser using the ifconfig at the CFE prompt, but probably the CFE version is out of sync with the firmware version NVRAM locations. Just guessing.

 

[zuiksoft]

Update: I managed to get the router back with the following steps using CTL-C to get into CFE> prompt and uploading openwrt-15.05.1-brcm47xx-mips74k-asus-rt-n66u-squashfs.trx using tftpd32 on laptop.

ifconfig -addr=192.168.1.1 -mask=255.255.255.0 -gw=192.168.1.2 eth0
flash -noheader 192.168.1.2:openwrt-15.05.1-brcm47xx-mips74k-asus-rt-n66u-squashfs.trx flash1.trx

So apparently all the previous firmware I tried was not compatible with CFE 1.0.1.2. Not sure if using the mini-web interface was an issue. Also, not sure the S29GL256P10 flash chip is 64K capable? The marking implies 32KB. This was an early model B1 version, not B2.

 

[zuiksoft]

Update 2. Although I got OpenWrt to work, I still had corrupted CFE and could not use any asuswrt-merlin firmware. The OpenWrt radio barely works with very low signal levels, so was not an option and I needed to fix the CFE. I managed to fix the router, see this thread for the full details of the procedure I used. Note that the CFE Bootloader Update method will not work to recover the CFE if the CFE contains corrupted NVRAM values. Instead it requires manually merging in the MAC address rather than merging the existing CFE NVRAM parameters.