Asus RT-AC5300 bricked. What to do?

[zidler]

Hi guys,
I tried to flash my Asus RT-AC5300 with Merlin RT-AC3100_380.63_2.trx firmware.

This is the "screen /dev/tty.usbserial 115200" output:

Digital core power voltage set to 1.05V

SHMOO VER 1.13

PKID07DC06011801080000000000001A103F01000000

S300001EB
000014C0


RDLYW0 00000004

RDENW0 00000039

RDQSW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ------+++++++++++++++++++++++++X+++++++++++++++++++++++++-------

.....

WRDQW0

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 +++++++++++++++++++++++X++++++++++++++++++++++-----------++++++-

....


WRDMW0 00000023
WRDMW0 00000021


ADDR

    0000000000111111111122222222223333333333444444444455555555556666
    0123456789012345678901234567890123456789012345678901234567890123
 00 ++++++++++++++++++++S++++++++++X++++++++++++++++++++++++++++++++

Decompressing...done


CFE version 7.14.131.1608 (r589038) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Thu Oct 22 17:53:52 CST 2015 (chengche@ubuntu)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 800 MHz
Info: DDR frequency set from clkfreq=1400,*800*
CPU type 0x0: 1400MHz
Tot mem: 524288 KBytes

CFE mem:    0x00F00000 - 0x017A7AE8 (9075432)
Data:       0x00F500A8 - 0x00F505E8 (1344)
BSS:        0x00F505F8 - 0x00FA5AE8 (349424)
Heap:       0x00FA5AE8 - 0x017A5AE8 (8388608)
Stack:      0x017A5AE8 - 0x017A7AE8 (8192)
Text:       0x00F00000 - 0x00F46540 (288064)

Null Rescue Flag.
Hello!! Enter Rescue Mode: (by Force)

Reading ::
TFTP Server.
Failed.: Error
Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: .... 4367776 bytes read
Entry at 0x00008000
Starting program at 0x00008000
console [ttyS0] enabled, bootconsole disabled
serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
brd: module loaded
loop: module loaded
pflash: found no supported devices
bcmsflash: found no supported devices
Boot partition size = 524288(0x80000)
lookup_nflash_rootfs_offset: offset = 0x200000
nflash: squash filesystem with lzma found at block 29
Creating 4 MTD partitions on "nflash":
0x000000000000-0x000000080000 : "boot"
0x000000080000-0x000000200000 : "nvram"
0x000000200000-0x000004000000 : "linux"
0x0000003b61d4-0x000004000000 : "rootfs"
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
=== PPTP init ===
Mirror/redirect action on
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (8047 buckets, 32188 max)
ctnetlink v0.93: registering with nfnetlink.
xt_time: kernel timezone is -0000
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Registering the dns_resolver key type
Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012
NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
Spare area=64 eccbytes 56, ecc bytes located at:
 2 3 4 5 6 7 8 9 10 11 12 13 14 15 18 19 20 21 22 23 24 25 26 27 28 29 30 31 34 35 36 37 38 39 40 41 42 43 44 45 46 47 50 51 52 53 54 55 56 57 58 59 60 61 62 63
Available 7 bytes at (off,len):
(1,1) (16,2) (32,2) (48,2) (0,0) (0,0) (0,0) (0,0)
Scanning device for bad blocks
Options: NO_AUTOINCR,NO_READRDY,BBT_SCAN2NDPAGE,
Creating 1 MTD partitions on "brcmnand":
0x000004000000-0x000008000000 : "brcmnand"
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
devtmpfs: mounted
Freeing init memory: 288K
## mknod /dev/null: File exists
## mknod /dev/console: File exists
1: set_action 0


Hit ENTER for console...

firmware version: 3.0.0.4.380.63_2
_ifconfig: name=lo flags=1043 IFUP addr=127.0.0.1 netmask=255.0.0.0
route_manip: cmd=ADD name=lo addr=127.0.0.0 netmask=255.0.0.0 gateway=0.0.0.0 metric=0
[1 preinit:init_nvram +9] init_nvram for model(48)
num_of_mssid_support(0x0093): [mssid] support [3] mssid


gmac3_override_nvram

ctf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
et_module_init: passivemode set to 0x0
et_module_init: txworkq set to 0x0
et_module_init: et_txq_thresh set to 0xce4
et_module_init: et_rxlazy_timeout set to 0x3e8
et_module_init: et_rxlazy_framecnt set to 0x20
et_module_init: et_rxlazy_dyn_thresh set to 0
fwd0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.131.4402 (r628786)
fwd1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.131.4402 (r628786)
illegal, cannot enable LACP
config_location(0x003b): [tcode] location is []
config_location(0x003d): [tcode] no location setting, using default location
config_location(0x0053): [tcode] config location: [0:ccode]=[Q2], [0:regrev]=[992]
config_location(0x005d): [tcode] set_wl_country, 0, [Q2], [992]
config_location(0x0073): [tcode] config location 5G: [1:ccode]=[Q2], [1:regrev]=[992]
config_location(0x007e): [tcode] set_wl_country, 1, [Q2], [992]
set_wltxpower(0x023b): unit: 0, txpower: 100
set_wltxpower(0x023b): unit: 1, txpower: 100
hotplug net INTERFACE=fwd1 ACTION=add
hotplug net INTERFACE=fwd0 ACTION=add
hotplug net INTERFACE=dpsta ACTION=add
PCI_PROBE:  bus 3, slot 0,vendor 14E4, device 4365(good PCI location)
PCI: Enabling device 0001:03:00.0 (0140 -> 0142)
dhd_attach(): thread:dhd_watchdog_thread:17e started
ring_info_raw: 56
dc 53 3f 00 ac 64 3f 00 c0 66 3f 00 d4 68 3f 00
...
CUR_ETHERADDR : 6
9c 5c 8e 4b 7f 90
Dongle Host Driver, version 1.369.1 (r628771)
Compiled in drivers/net/wireless/bcmdhd on May 30 2016 at 14:06:44
Register interface [eth0]  MAC: 9c:5c:8e:4b:7f:90

PCI_PROBE:  bus 4, slot 0,vendor 14E4, device 4365(good PCI location)
PCI: Enabling device 0001:04:00.0 (0140 -> 0142)
hotplug net INTERFACE=eth0 ACTION=add
dhd_attach(): thread:dhd_watchdog_thread:182 started
ring_info_raw: 56
dc 53 3f 00 ac 64 3f 00 c0 66 3f 00 d4 68 3f 00
...
CUR_ETHERADDR : 6
9c 5c 8e 4b 7f 94
Dongle Host Driver, version 1.369.1 (r628771)
Compiled in drivers/net/wireless/bcmdhd on May 30 2016 at 14:06:44
Register interface [eth1]  MAC: 9c:5c:8e:4b:7f:94

PCI_PROBE:  bus 1, slot 0,vendor 14E4, device 4365(good PCI location)
PCI: Enabling device 0002:01:00.0 (0140 -> 0142)
hotplug net INTERFACE=eth1 ACTION=add
dhd_attach(): thread:dhd_watchdog_thread:186 started
Unable to handle kernel paging request at virtual address 60310ef4
pgd = 9dd08000
[60310ef4] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT SMP
last sysfs file: /sys/class/nvram/nvram/dev
module:  dhd     7f037000        2898245
module:  dpsta   7f031000        2744
module:  igs     7f029000        11935
module:  emf     7f01e000        21433
module:  et      7f00a000        52543
module:  ctf     7f000000        19511
Modules linked in: dhd(+) dpsta(P) igs(P) emf(P) et(P) ctf(P)
CPU: 1    Tainted: P             (2.6.36.4brcmarm #2)
PC is at _find_first_bit_le+0xc/0x2c
LR is at gic_set_cpu+0x3c/0xb4
pc : [<801767e4>]    lr : [<8005ba94>]    psr: 00000093
sp : 9dca7d48  ip : 80428a68  fp : 00000000
r10: 00000003  r9 : 7f254968  r8 : a0000013
r7 : 00000008  r6 : f0101000  r5 : 00000000  r4 : 000000a9
r3 : 8043341c  r2 : 00000000  r1 : 00000002  r0 : 60310ef4
Flags: nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c53c7d  Table: 5dd0804a  DAC: 00000015
Process insmod (pid: 380, stack limit = 0x9dca6270)
Stack: (0x9dca7d48 to 0x9dca8000)
7d40:                   80415580 804155bc 60310ef4 000000a9 a0000013 800a950c
7d60: 80428a50 80428a20 9a0c0000 9fbdf280 9a0c0000 80215d20 00001894 9fbd0144
...
[<801767e4>] (PC is at _find_first_bit_le+0xc/0x2c)
Code: eafffff0 e3310000 0a000006 e3a02000 (e7d031a2)
---[ end trace 01fd088b423c40f8 ]---
Kernel panic - not syncing: Fatal exception
[<8005701c>] (unwind_backtrace+0x0/0xf8) from [<8030c6d4>] (panic+0x7c/0x1a8)
[<8030c6d4>] (panic+0x7c/0x1a8) from [<800546f0>] (die+0x1a4/0x1dc)
[<800546f0>] (die+0x1a4/0x1dc) from [<800584b4>] (__do_kernel_fault+0x6c/0x8c)
[<800584b4>] (__do_kernel_fault+0x6c/0x8c) from [<80058624>] (do_page_fault+0x150/0x1ec)
[<80058624>] (do_page_fault+0x150/0x1ec) from [<800503a4>] (do_DataAbort+0x30/0x9c)
[<800503a4>] (do_DataAbort+0x30/0x9c) from [<803d07cc>] (__dabt_svc+0x4c/0x60)
Exception stack(0x9dca7d00 to 0x9dca7d48)
7d00: 60310ef4 00000002 00000000 8043341c 000000a9 00000000 f0101000 00000008
7d20: a0000013 7f254968 00000003 00000000 80428a68 9dca7d48 8005ba94 801767e4
7d40: 00000093 ffffffff
[<803d07cc>] (__dabt_svc+0x4c/0x60) from [<801767e4>] (_find_first_bit_le+0xc/0x2c)
CPU0: stopping
Rebooting in 3 seconds..[<8005701c>] (unwind_backtrace+0x0/0xf8) from [<80050334>] (do_IPI+0x114/0x154)
[<80050334>] (do_IPI+0x114/0x154) from [<803d0840>] (__irq_svc+0x60/0x138)
Exception stack(0x8040ff78 to 0x8040ffc0)
ff60:                                                       00000002 9fa4b900
ff80: 8040ffc0 00000000 8040e000 804330a8 8041ab80 8041ab78 40000000 413fc090
ffa0: 0000001f 00000000 00000000 8040ffc0 80051be4 80051be8 60000013 ffffffff
[<803d0840>] (__irq_svc+0x60/0x138) from [<80051be8>] (default_idle+0x24/0x28)
[<80051be8>] (default_idle+0x24/0x28) from [<80051d88>] (cpu_idle+0x70/0xa4)
[<80051d88>] (cpu_idle+0x70/0xa4) from [<80009134>] (start_kernel+0x3e8/0x450)
[<80009134>] (start_kernel+0x3e8/0x450) from [<40008224>] (0x40008224)
Digital core power voltage set to 1.05V


Decompressing...done
.......

Ctrl+C doesn't work. Reset button doesn't work. Now the router is in a dead loop. What options do I have?
I am ready to solder stuff if it's necessary. Thanx for your help in advance!

 

[hggomes]

Enter in Recovery Mode and upload latest ASUS FW and see how it goes compared to RMerlin FW.

 

[zidler]

Enter in Recovery Mode and upload latest ASUS FW and see how it goes compared to RMerlin FW.

As I wrote, the reset button doesn't respond. Can't enter in Recovery Mode. =(

 

[hggomes]

That's because you have serial connection attached, disconnect it and power it off.

1. Press RESET without releasing it.
2. Power ON your router and wait until you see POWER LED blinking.
3. You are on Recovery Mode.

 

[hggomes]

I remember a case similar to yours and the only way was shorting the serial connector, let me check if i can find it.

 

[zidler]

I remember a case similar to yours and the only way was shorting the serial connector, let me check if i can find it.

Oh shi...! I pressed both WPS and reset button before turning it on and nvram was cleared! =)

Digital core power voltage set to 1.05V
Decompressing...done


CFE version 7.14.131.1608 (r589038) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Thu Oct 22 17:53:52 CST 2015 (chengche@ubuntu)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 400 MHz
Info: DDR frequency set from clkfreq=1400,*800*
Warning: invalid DDR setting of 800 MHz ignored. DDR frequency will be set to 400 MHz.
et1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.131.1608 (r589038)
CPU type 0x0: 1000MHz
Tot mem: 524288 KBytes

CFE mem:    0x00F00000 - 0x017A7AE8 (9075432)
Data:       0x00F500A8 - 0x00F505E8 (1344)
BSS:        0x00F505F8 - 0x00FA5AE8 (349424)
Heap:       0x00FA5AE8 - 0x017A5AE8 (8388608)
Stack:      0x017A5AE8 - 0x017A7AE8 (8192)
Text:       0x00F00000 - 0x00F46540 (288064)

Committing NVRAM...done
Waiting for wps button release.....

I am in the recovery mode. Doing the whole thing from the beginning.

 

[hggomes]

 

[zidler]

I am still looking forward to seeing the case you mentioned.

 

[Pierino]

I remember a case similar to yours and the only way was shorting the serial connector, let me check if i can find it.

Same here. I have one that I can't stop the cfe.

 

[hggomes]

So maybe it was you then the guy who report it.

 

[hggomes]

OK, it was not you, apologize.

http://www.snbforums.com/threads/rt-ac68u-will-only-boot-with-jtag-cable-attached.34994/

 

[Pierino]

I can't stop the cfe. No matter how much I hit control+c.

 

[Bartman]

This recovered my 5300:

Swears like a sad person but this actually worked for me.

Regards

 

[999lex]

Hey. Tell me please where to get the working firmware for Asus RT-AC5300.
The problem is that the first 5g network is a clone of the second, but the second is not possible to connect.
I tried here these firmware from the recovery mode.
all merlin
all from the official site Asus
RT-AC5300_9.0.0.4_380_1680-g515d897
RT-AC5300_9.0.0.4_380_2310-g29dc229
FW_RT-AC5300_30043802571

size: 68245 bytes (62827 left)
0:ccode=E0
0:regrev=946
1:ccode=E0
1:regrev=946
2:ccode=E0
2:regrev=946
wl0_country_code=E0
wl0_country_rev=946
wl0_reg_mode=off
wl1_country_code=E0
wl1_country_rev=946
wl1_reg_mode=h
wl2_country_code=E0
wl2_country_rev=946
wl2_reg_mode=h

 

[Marcus_AB]

Oh shi...! I pressed both WPS and reset button before turning it on and nvram was cleared! =)

Digital core power voltage set to 1.05V
Decompressing...done


CFE version 7.14.131.1608 (r589038) based on BBP 1.0.37 for BCM947XX (32bit,SP,)
Build Date: Thu Oct 22 17:53:52 CST 2015 (chengche@ubuntu)
Copyright (C) 2000-2008 Broadcom Corporation.

Init Arena
Init Devs.
Boot partition size = 262144(0x40000)
DDR Clock: 400 MHz
Info: DDR frequency set from clkfreq=1400,*800*
Warning: invalid DDR setting of 800 MHz ignored. DDR frequency will be set to 400 MHz.
et1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.131.1608 (r589038)
CPU type 0x0: 1000MHz
Tot mem: 524288 KBytes

CFE mem:    0x00F00000 - 0x017A7AE8 (9075432)
Data:       0x00F500A8 - 0x00F505E8 (1344)
BSS:        0x00F505F8 - 0x00FA5AE8 (349424)
Heap:       0x00FA5AE8 - 0x017A5AE8 (8388608)
Stack:      0x017A5AE8 - 0x017A7AE8 (8192)
Text:       0x00F00000 - 0x00F46540 (288064)

Committing NVRAM...done
Waiting for wps button release.....

I am in the recovery mode. Doing the whole thing from the beginning.

Thank you so much my bricked router is now working thanks to you (press wps and reset then power on) I even phoned Asus after trying recovery mode and there answer was its dead, probably a spike hit the Ethernet port. after doing the above the power light flashes fast then let go of reset and wps and it booted back in to life. Thank you again

 

[COBOL-Coder]

Love a good ending… ツ