Flash Chip on Asus RT-AC51U

gioreva · April 7, 2020, 10:02am

Hi

I have Asus RT-AC51U Router, with Mediateck Ralink MT7620N
I bought this to use as a development board.

The flash chip is KH25L12835FMI-10G 128Mb 16pin 2.7/3.6V
I have removed it and read and saved original flash content.
I tried to delete it but do not clear, I assume is protected.
Then I took a WindBond W25Q128JV 128Mb 8pin 2.7/3.8V

I have build OpenWrt using RT-AC51U preset.
Burned openwrt-ramips-mt7620-asus_rt-ac51u-squashfs-sysupgrade.bin

But not boot.

Digital Signal on chip flash run constantly, as if the CPU does not find the right boot.

Tips?

123serge123 · April 7, 2020, 11:31am

I don't understand did you restore (copy from original flash chip) "uboot", "config" and "factory" partitions?
Just for info see this topic

gioreva · April 7, 2020, 12:03pm

No, only this file.
But there are uboot on this file

 binwalk openwrt-ramips-mt7620-asus_rt-ac51u-squashfs-sysupgrade.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x389AB373, created: 2020-04-06 10:39:00, image size: 1674429 bytes, Data Address: 0x80000000, Entry Point: 0x80000000, data CRC: 0x729A8D8B, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "MIPS OpenWrt Linux-4.14.172"
64            0x40            LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 5294696 bytes
1674493       0x198CFD        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 2266062 bytes, 868 inodes, blocksize: 262144 bytes, created: 2020-04-06 10:39:00

123serge123 · April 7, 2020, 12:26pm

No, it's only header for uboot loader to parse firmware unpacking/loading/starting.
Flash layout is:

3*64k - uboot - bootloader itself
1*64k - config - bootloader and vendor firmware config data
1*64k - factory - wifi calibration data
Rest of flash is firmware.
So you need copy first 5*64k from original flash image and append firmware file. Then flash it back to chip.

gioreva · April 7, 2020, 12:47pm

But I do not want ASUS code in my hardware.

123serge123 · April 7, 2020, 1:07pm

You can append any firmware - openwrt, asus, padavan

gioreva · April 7, 2020, 1:31pm

I lost the original firmware ASUS
Saved File is corrupted.
Flash chip is
Vue 0 from start to 0x2BF2AB
Code until 0xE153B0
0xFF until end 0xFFFFFF

What can I do ?

123serge123 · April 7, 2020, 1:36pm

I've posted link to topic.

gioreva · April 7, 2020, 3:49pm

Sorry but I do not understand.
I do not know how to build uboot.
I heve burn this .bin on the flash, but TFTP do not start, if i push reset at power on.

https://github.com/joneswu456/rt-n56u/blob/master/uboot/rt-n11p_n14u_ac51u_ac52u_ac54u_ac1200hp/uboot_n14u.bin

gioreva · April 7, 2020, 3:51pm

Also burning this bin, SPI activity loop forever.

123serge123 · April 8, 2020, 3:26am

As I understand you burn only uboot. In this case asus/padavan uboot can't find valid firmware and start recovery mode. Asus recovery mode is specific. It start tftp server and wait client to load firmware. See/use Firmware Restoration or use tftp client. But pay attention that without restoring "factory" partition wifi will fail.
And why don't you use fulldump images from posted archive?
BTW do you have USB-to-TTL serial adapter? it's a "must have" thing for developers

gioreva · April 8, 2020, 2:00pm

Forget that I have an ASUS router.
Let's say I have a evaluating board Mediatek with Chip MT7620

I have bournet this uboot link
Automatic TFTP would not start, or did not understand IP servers, and file name.
Using the keyboard, Option 2, I told IP servers and files, so I loaded with OpenWRT success.
I will try to rebuild uboot in the future for this problem, partly because he starts to 115200, then later changed to 57600

Wel Starting from consolle, I usually edit the file /etc/config/wireless, to enable the WiFi, but that file does not exist now.

I have build image, using preset, RT-AC51U,and after added Luci.
What is "Wifi 2.4G/5G default calibration data" and what are they for ?

123serge123 · April 8, 2020, 3:36pm

Than forget of asus rt-ac51u openwrt image and start from openwrt wiki documentaion for developers

It's a fork of the same padavan project

Data for correct initialization of wifi devices. Without that data driver loading failed (see output of dmesg command). And as result there is no autodetected /etc/config/wireless config file.

gioreva · April 8, 2020, 3:51pm

[ 13.840035] mt76x0e 0000:01:00.0: ASIC revision: 76100002
[ 13.887393] mt76x0e 0000:01:00.0: Firmware Version: 0.1.00
There are custom firmware on the ASUS CPU ?
If I buy new CPU is different then This ?

[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Memory: 58360K/65536K available (3920K kernel code, 191K rwdata, 896K rodata, 1192K init, 212K bss, 7176K reserved, 0K cma-reserved)
[ 0.753988] Creating 4 MTD partitions on "spi0.0":
[ 0.763561] 0x000000000000-0x000000030000 : "u-boot"
[ 0.774541] 0x000000030000-0x000000040000 : "u-boot-env"
[ 0.786076] 0x000000040000-0x000000050000 : "factory"
[ 0.797109] 0x000000050000-0x000001000000 : "firmware"
[ 0.811479] 2 uimage-fw partitions found on MTD device firmware
[ 0.823344] Creating 2 MTD partitions on "firmware":
[ 0.833256] 0x000000000000-0x000000198cfd : "kernel"
[ 0.844153] 0x000000198cfd-0x000000fb0000 : "rootfs"
[ 0.854971] mtd: device 5 (rootfs) set to be root filesystem
[ 0.868015] 1 squashfs-split partitions found on MTD device rootfs
[ 0.880409] 0x000000422000-0x000000fb0000 : "rootfs_data"

[ 13.906417] urngd: jent-rng init failed, err: 2
[ 13.991603] mt76x0e 0000:01:00.0: EEPROM data check failed: ffff
[ 14.015846] mt76x0e 0000:01:00.0: driver does not support default EEPROM
[ 14.029340] mt76x0e: probe of 0000:01:00.0 failed with error -22
[ 14.063688] rt2800_wmac 10180000.wmac: loaded eeprom from mtd device "factory"

This error ?

This router has welded RT7610 5Ghz Chip
I want use removable USB stick with same RT7610
If work also other USB AC 5GHZ stick.

In reference to this, what does put the "calibration data"?

123serge123 · April 8, 2020, 4:11pm

Yes.
To put calibration data use this way

gioreva · April 8, 2020, 4:13pm

There are custom firmware on the ASUS CPU ?
If I buy new CPU is different then This ?

If i use other type of USB WiFi Stick, need always calibration ?
What is calibration data ?

123serge123 · April 8, 2020, 4:27pm

See /lib/firmware path. The firmware is the same for each type of chip.
USB stick and PCIE card usually have EEPROM chip on board with calibration data.
At least calibration data contain frequency and power calibration, MAC address and so on. Too many info for short message. You can see source of driver for details.

gioreva · April 22, 2020, 9:16am

Hi Serge.

I'm not as good as springtales
I can not figure out how to put that map in the flash
Now I programmed uboot and more or less it works.
Do I have to join uboot with DD?
The thing that seems strange to me is that there are no partition.

binwalk MT7620_AP_2T2R-4L_internal_LNA_internal_PA_V15.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

binwalk MT7610E-V10-FEM.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

And the MAC ?
It should not be written into the radio chip ?
In mac is the name of the chip manufacturer.

123serge123 · April 23, 2020, 2:59pm

Simply flash any full flash dump from

And what do you expect to find? It's only default calibration data.

gioreva · April 23, 2020, 3:18pm

Maybe this time I understood.

Each .bin file include Uboot, Wifi 2.4G + 5G default calibration + Firmware.
But i have to customize Uboot.
Then how can I join Uboot + Wifi 2.4G + 5G default calibration ?