Bricked Asus RT-AC58U

Installing and Using OpenWrt
1

Hello fellow openwrt users,

Yesterday I upgraded my asus rt-ac58u (which already had 18.06) to the latest openwrt snapshot.
After upgrading the router turns on with the power led steady and after about 30 sec just reboots and does it again.
I was able to press the reset button for 10 sec which puts the router into recovery mode and from (no ssh/telnet) and ran the asus firmware recovery tool with ac58u firmware. the process completes successfully but the result is still the same - router is bricked: it turns on and loops endlessly.

Please help!

2

There are some instructions for debricking and returning to factory.

3

Thanks, but I don't have any ssh access to the router. I can only get the router to a state where it's slowly flashes the power led, it gets an ip address and I can ping it but there is no port open and the only thing it responds to is the Asus firmware restore tool

4

Serial port console output?

6

serial output shows kernel panic:

Error relocating /usr/lib/libjson-c.so.4: __aeabi_l2d: symbol not found
Error relocating /usr/lib/libjson-c.so.4: __aeabi_d2lz: symbol not found
[    6.253259] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00                                                  007f00
[    6.253259]
[    6.253376] CPU0: stopping
[    6.261519] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.75 #0
[    6.264023] Hardware name: Generic DT based system
[    6.270209] Function entered at [<c030e15c>] from [<c030aa08>]
[    6.274795] Function entered at [<c030aa08>] from [<c07380f8>]
[    6.280610] Function entered at [<c07380f8>] from [<c030d42c>]
[    6.286424] Function entered at [<c030d42c>] from [<c052e3dc>]
[    6.292240] Function entered at [<c052e3dc>] from [<c0301a0c>]
[    6.298056] Exception stack(0xc0a01f28 to 0xc0a01f70)
[    6.303892] 1f20:                   00000000 0003b07c c7c952c4 c03137e0 c0a00                                                  000 c0a04c6c
[    6.309022] 1f40: 00000000 c0a04cac c0939da8 00000000 00000000 c0a01f80 c0a0d                                                  040 c0a01f78
[    6.317166] 1f60: c0308218 c030821c 60000013 ffffffff
[    6.325315] Function entered at [<c0301a0c>] from [<c030821c>]
[    6.330346] Function entered at [<c030821c>] from [<c03414cc>]
[    6.336078] Function entered at [<c03414cc>] from [<c0341830>]
[    6.341889] Function entered at [<c0341830>] from [<c0900cb4>]
[    6.347717] CPU3: stopping
[    6.353530] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 4.19.75 #0
[    6.356210] Hardware name: Generic DT based system
[    6.362386] Function entered at [<c030e15c>] from [<c030aa08>]
[    6.366979] Function entered at [<c030aa08>] from [<c07380f8>]
[    6.372796] Function entered at [<c07380f8>] from [<c030d42c>]
[    6.378610] Function entered at [<c030d42c>] from [<c052e3dc>]
[    6.384425] Function entered at [<c052e3dc>] from [<c0301a0c>]
[    6.390241] Exception stack(0xc7863f60 to 0xc7863fa8)
[    6.396081] 3f60: 00000000 000371a8 c7cc22c4 c03137e0 c7862000 c0a04c6c 00000                                                  003 c0a04cac
[    6.401211] 3f80: c0939da8 00000000 00000000 c7863fb8 c0a0d040 c7863fb0 c0308                                                  218 c030821c
[    6.409347] 3fa0: 60000013 ffffffff
[    6.417497] Function entered at [<c0301a0c>] from [<c030821c>]
[    6.420798] Function entered at [<c030821c>] from [<c03414cc>]
[    6.426701] Function entered at [<c03414cc>] from [<c0341830>]
[    6.432517] Function entered at [<c0341830>] from [<803023ac>]
[    6.438338] CPU1: stopping
[    6.444154] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.19.75 #0
[    6.446833] Hardware name: Generic DT based system
[    6.453007] Function entered at [<c030e15c>] from [<c030aa08>]
[    6.457604] Function entered at [<c030aa08>] from [<c07380f8>]
[    6.463418] Function entered at [<c07380f8>] from [<c030d42c>]
[    6.469236] Function entered at [<c030d42c>] from [<c052e3dc>]
[    6.475050] Function entered at [<c052e3dc>] from [<c0301a0c>]
[    6.480865] Exception stack(0xc785ff60 to 0xc785ffa8)
[    6.486707] ff60: 00000000 00015028 c7ca42c4 c03137e0 c785e000 c0a04c6c 00000                                                  001 c0a04cac
[    6.491833] ff80: c0939da8 00000000 00000000 c785ffb8 c0a0d040 c785ffb0 c0308                                                  218 c030821c
[    6.499972] ffa0: 60000013 ffffffff
[    6.508121] Function entered at [<c0301a0c>] from [<c030821c>]
[    6.511421] Function entered at [<c030821c>] from [<c03414cc>]
[    6.517327] Function entered at [<c03414cc>] from [<c0341830>]
[    6.523140] Function entered at [<c0341830>] from [<803023ac>]
[    6.528978] Rebooting in 1 seconds..

maybe its from one of the ASLR/PIE kernel compilation options i have chosen.

for some reason console does not respond to input so i cant choose recovery during boot...

8

OK, i can now upload files to the router through tftp rescue mode but flashing always fails (the router does not accept any input so it defaults to option 3 tftp to flash and I can't choose something else - any hack possible?)

when i try using the asus original firmware file i get an error about size mismatch (probably because the different layout of the partitions) while any openwrt file generated seems to work - it says done, X bytes written but again i get the same kernel running with same error like it was not flashed.

this is the log from trying to flash trx image for example:

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2019.10.04 00:01:26 =~=~=~=~=~=~=~=~=~=~=~=

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1338 - bootable_media_detect_entry, Start
B -      1678 - bootable_media_detect_success, Start
B -      1692 - elf_loader_entry, Start
B -      5068 - auth_hash_seg_entry, Start
B -      7212 - auth_hash_seg_exit, Start
B -    572130 - elf_segs_hash_verify_entry, Start
B -    687551 - PBL, End
B -    687575 - SBL1, Start
B -    775924 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    777436 - boot_flash_init, Start
D -     54271 - boot_flash_init, Delta
B -    835894 - boot_config_data_table_init, Start
D -      3847 - boot_config_data_table_init, Delta - (419 Bytes)
B -    843118 - clock_init, Start
D -      7550 - clock_init, Delta
B -    855190 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
B -    858680 - sbl1_ddr_set_params, Start
B -    863667 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    868160 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13148 - sbl1_ddr_set_params, Delta
B -    881862 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    952371 - sbl1_wait_for_ddr_training, Start
D -        29 - sbl1_wait_for_ddr_training, Delta
B -    967600 - Image Load, Start
D -    134996 - QSEE Image Loaded, Delta - (262104 Bytes)
B -   1103093 - Image Load, Start
D -      1446 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1113470 - Image Load, Start
D -    223560 - APPSBL Image Loaded, Delta - (457299 Bytes)
B -   1337453 - QSEE Execution, Start
D -        58 - QSEE Execution, Delta
B -   1343630 - SBL1, End
D -    658165 - SBL1, Delta
S - Flash Throughput, 2005 KB/s  (721870 Bytes,  359866 us)
S - DDR Frequency, 537 MHz


U-Boot 2012.07-05763-g80e4eb4 [local,local] (Jul 06 2016 - 11:01:57)
RT-AC58U bootloader version: 1.0.0.3

smem ram ptable found: ver: 1 len: 3
ASUS RT-AC58U gpio init : wps / reset pin
DRAM:  128 MiB
machid : 0x8010100
Maximum malloc length: 4096 KBytes
mem_malloc_start/brk/end: 0x86ef0000/86ef0000/87300000
Relocation offset: 0
NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:aa:21
SF: Detected W25N01GV with page size 2 KiB, total 128 MiB
SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
130 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
name         : offset   size    
0:SBL1       : 00000000 00040000
0:MIBIB      : 00040000 00020000
0:QSEE       : 00060000 00060000
0:CDT        : 000c0000 00010000
0:DDRPARAMS  : 000d0000 00010000
0:APPSBLENV  : 000e0000 00010000
0:APPSBL     : 000f0000 00080000
0:ART        : 00170000 00010000
machid: 8010100
Net:   MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Creating 1 MTD partitions on "nand1":
0x00000000-0x08000000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       12188
UBI: attached mtd2 to ubi0
UBI: MTD device name:            "mtd=0"
UBI: MTD device size:            128 MiB
UBI: number of good PEBs:        1024
UBI: number of bad PEBs:         0
UBI: number of corrupted PEBs:   0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     7
UBI: available PEBs:             10
UBI: total number of reserved PEBs: 1014
UBI: number of PEBs reserved for bad PEB handling: 10
UBI: max/mean erase counter: 209/12
UBI: image sequence number:  1117443911
UBI:   vol_id  reserved_pebs  alignment  data_pad  vol_type  usable_leb_size  used_ebs  used_bytes  last_eb_bytes  corrupted  upd_marker  name_len  name
UBI:        0              3          1         0   dynamic            1f000         3       5d000          1f000          0           0         5  nvram
UBI:        1              1          1         0   dynamic            1f000         1       1f000          1f000          0           0         7  Factory
UBI:        2              1          1         0   dynamic            1f000         1       1f000          1f000          0           0         8  Factory2
UBI:        3             11          1         0   dynamic            1f000        11      20f000          1f000          0           0         5  linux
UBI:        4            18d          1         0   dynamic            1f000       18d     3013000          1f000          0           0         6  linux2
UBI:        5             51          1         0   dynamic            1f000        51      9cf000          1f000          0           0         6  rootfs
UBI:        6            1f4          1         0   dynamic            1f000       1f4     3c8c000          1f000          0           0         b  rootfs_data
UBI: 7fffefff              2          1         0   dynamic            1f000         2       3e000              2          0           0         d  layout volume
UBI volume [linux] size 20f000 smaller than 3013000!
UBI error: do_ubi: available_pebs 10 < MIN_AVAILABLE_PEB 30

Latest UBI volumes layout.
UBI:   vol_id  reserved_pebs  alignment  data_pad  vol_type  usable_leb_size  used_ebs  used_bytes  last_eb_bytes  corrupted  upd_marker  name_len  name
UBI:        0              3          1         0   dynamic            1f000         3       5d000          1f000          0           0         5  nvram
UBI:        1              1          1         0   dynamic            1f000         1       1f000          1f000          0           0         7  Factory
UBI:        2              1          1         0   dynamic            1f000         1       1f000          1f000          0           0         8  Factory2
UBI:        3             11          1         0   dynamic            1f000        11      20f000          1f000          0           0         5  linux
UBI:        4            18d          1         0   dynamic            1f000       18d     3013000          1f000          0           0         6  linux2
UBI:        5             51          1         0   dynamic            1f000        51      9cf000          1f000          0           0         6  rootfs
UBI:        6            1f4          1         0   dynamic            1f000       1f4     3c8c000          1f000          0           0         b  rootfs_data
UBI: 7fffefff              2          1         0   dynamic            1f000         2       3e000              2          0           0         d  layout volume
Read 0x1f000 bytes from volume [Factory] offset 0x0 to 86ec0ce8
EEPROM set 0: OK (version 19)
Read 0x1f000 bytes from volume [Factory2] offset 0x0 to 86ec0ce8
EEPROM set 1: OK (version 19)
Read 0x1f000 bytes from volume [Factory] offset 0x0 to 86ef3480
Select EEPROM set 0 at offset 0x0.

Please choose the operation: 
   1: Load System code to SDRAM via TFTP.
   2: Load System code then write to Flash via TFTP.
   3: Boot System code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.
reset buootn pressed!

   3: Boot System code via Flash (default).

RT-AC58U bootloader version: 1.0.0.3
MAC Address: 10:7B:44:59:CA:80
reset buootn pressed!
 
## Enter Rescue Mode ##
preferred nic: eth0
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 up Speed :1000 Full duplex
eth0 PHY4 Down Speed :10 Half duplex
switch prereq:0
tftpd start

Our IP address is:(192.168.1.1)
Wait for TFTP request...
tftpd open
Got ARP REQUEST, return our IP
D D D D D D D D D D D D D D D D D D D D D Got ARP REQUEST, return our IP
D D D D D D D D D D D Got ARP REPLY, set eth addr (00:d8:61:58:84:40)
#
 First block received  
################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
####################################
done
RAMtoFLASH
Chk trx magic
Download of 0x6340e0 bytes completed
Check TRX and write it to FLASH 
Solve TRX, ptr=0x84000000
## Booting kernel from Legacy Image at 84000000 ...
   Image Name:   RT-AC58U
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    6504608 Bytes = 6.2 MiB
   Load Address: 80208000
   Entry Point:  80208000
   Verifying Checksum ... OK

 Erase kernel block !!
 From c009b000 To c06cf0e0 (6504672/h:6340e0)
size > volume size! Aborting!
ra_flash_erase_write: write volume [linux] fail. (r = 22)
Write 1st firmware fail. (r = 22)

0x6340a0 bytes written to volume linux2
done. 6504672 bytes written

SYSTEM RESET!!!

resetting ...

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1338 - bootable_media_detect_entry, Start
B -      1678 - bootable_media_detect_success, Start
B -      1692 - elf_loader_entry, Start
B -      5069 - auth_hash_seg_entry, Start
B -      7215 - auth_hash_seg_exit, Start
B -    572131 - elf_segs_hash_verify_entry, Start
B -    687446 - PBL, End
B -    687470 - SBL1, Start
B -    775807 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    777316 - boot_flash_init, Start
D -     54260 - boot_flash_init, Delta
B -    835766 - boot_config_data_table_init, Start
D -      3847 - boot_config_data_table_init, Delta - (419 Bytes)
B -    842990 - clock_init, Start
D -      7556 - clock_init, Delta
B -    855067 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
B -    858556 - sbl1_ddr_set_params, Start
B -    863543 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    868035 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13147 - sbl1_ddr_set_params, Delta
B -    881736 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    952130 - sbl1_wait_for_ddr_training, Start
D -        29 - sbl1_wait_for_ddr_training, Delta
B -    967428 - Image Load, Start
D -    134891 - QSEE Image Loaded, Delta - (262104 Bytes)
B -   1102816 - Image Load, Start
D -      1443 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1113180 - Image Load, Start
D -    223387 - APPSBL Image Loaded, Delta - (457299 Bytes)
B -   1336989 - QSEE Execution, Start
D -        59 - QSEE Execution, Delta
B -   1343165 - SBL1, End
D -    657805 - SBL1, Delta
S - Flash Throughput, 2007 KB/s  (721870 Bytes,  359590 us)
S - DDR Frequency, 537 MHz


U-Boot 2012.07-05763-g80e4eb4 [local,local] (Jul 06 2016 - 11:01:57)
RT-AC58U bootloader version: 1.0.0.3

smem ram ptable found: ver: 1 len: 3
ASUS RT-AC58U gpio init : wps / reset pin
DRAM:  128 MiB
machid : 0x8010100
Maximum malloc length: 4096 KBytes
mem_malloc_start/brk/end: 0x86ef0000/86ef0000/87300000
Relocation offset: 0
NAND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:aa:21
SF: Detected W25N01GV with page size 2 KiB, total 128 MiB
SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
130 MiB
*** Warning - bad CRC, using default environment

anyone? @zyxmon @chunkeey maybe?

9

so, good news:

turns out my PL2303 adapter was broken, i got a new one which allowed me to stop u-boot and upload initramfs image to sdram. from there i installed 18.06.4 and its working again!
now when i know how to debrick it i will try compiling 19.07 again, and hopefully wont get any kernel panics :slight_smile:

3 Likes
10

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.