ASUS RT AX1800U
The ASUS Wireless AX1800 Duad Band WiFi 6 Router or RT-1800U has four antennas and looks a bit like a gaming spider.
- 12V/1.5A DC barrel jack with power switch
- Reset and WPS buttons
- 1x USB A
- 4x Ethernet (1x WAN, 3x LAN)
- 8 LEDs
- 4 WiFi antennas
- U9: Spansion S34ML01G200TF100, 128 MiB parallel flash
- U24: Nanya NT5CC128M16JR-EK, RAM
- U6: Mediatek MT7621A1, Ramips (Ralink MIPS) SoC
- U1309: Mediatek MT7905DAN
- U1308: Mediatek MT7975DN
The serial port (J2) is helpfully labeled. On my unit, the system boots into a U-Boot menu and then notices that the firmware is corrupted.
Boot log
===================================================================
MT7621 stage1 code Dec 16 2019 17:45:55 (ASIC)
CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11000000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL4 FB_DL: 0x14, 1/0 = 618/406 51000000
PLL2 FB_DL: 0x16, 1/0 = 661/363 59000000
PLL3 FB_DL: 0x16, 1/0 = 601/423 59000000
DDR patch working
do DDR setting..[01F40000]
Apply DDR3 Setting...(use default AC)
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1
000E:| 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1
000F:| 0 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0
0010:| 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0
0011:| 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
DRAMC_DQSCTL1[0e0]=13000000
DRAMC_DQSGCTL[124]=80000033
rank 0 coarse = 15
rank 0 fine = 72
B:| 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0
opt_dle value:8
DRAMC_DDR2CTL[07c]=C287220D
DRAMC_PADCTL4[0e4]=000022B3
DRAMC_DQIDLY1[210]=0B090809
DRAMC_DQIDLY2[214]=070B0909
DRAMC_DQIDLY3[218]=0A080604
DRAMC_DQIDLY4[21c]=08070906
DRAMC_R0DELDLY[018]=00001E1E
==================================================================
RX DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 9 8 8 11 8 9 9 7 3 5
10 | 7 9 6 8 6 8
--------------------------------------
==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =30 DQS1 = 30
==================================================================
bit DQS0 bit DQS1
0 (1~60)30 8 (1~58)29
1 (1~60)30 9 (1~58)29
2 (1~58)29 10 (1~58)29
3 (1~60)30 11 (1~58)29
4 (1~58)29 12 (1~60)30
5 (1~60)30 13 (1~58)29
6 (1~56)28 14 (1~58)29
7 (1~60)30 15 (1~60)30
==================================================================
3.dq delay value last
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 9 8 9 11 9 9 11 7 4 6
10 | 8 10 6 9 7 8
==================================================================
==================================================================
TX perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2
DQ loop=15, cmp_err_1 = ffff0182
DQ loop=14, cmp_err_1 = ffff0080
dqs_perbyte_dly.last_dqdly_pass[1]=14, finish count=1
DQ loop=13, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=13, finish count=2
byte:0, (DQS,DQ)=(9,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:89
[EMI] DRAMC calibration passed
===================================================================
MT7621 stage1 code done
CPU=500000000 HZ BUS=166666666 HZ
===================================================================
U-Boot SPL 2018.09 (Sep 08 2021 - 14:31:58 +0800)
Trying to boot from NAND
Initializing NMBM ...
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached
U-Boot 2018.09 (Sep 08 2021 - 14:31:58 +0800)
RT-AX53U bootloader version: 1.0.0.1
CPU: MediaTek MT7621AT ver 1, eco 3
Clocks: CPU: 880MHz, DDR: 600MHz (1200MT/s), Bus: 220MHz, XTAL: 40MHz
Model: MediaTek MT7621 reference board (NAND)
DRAM: 256 MiB
NAND: 128 MiB
Initializing NMBM ...
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached
Loading Environment from NMBM... *** Warning - bad CRC, using default environment
In: uartlite0@1e000c00
Out: uartlite0@1e000c00
Err: uartlite0@1e000c00
Net:
Warning: eth@1e100000 (eth0) using random MAC address - b2:2c:7c:04:74:43
eth0: eth@1e100000
gpio_init ......
Hit any key to stop autoboot: 0
*** U-Boot Boot Menu ***
1. Startup system (Default)
2. Upgrade firmware
3. Upgrade bootloader
4. Upgrade bootloader (advanced mode)
5. Load image
0. U-Boot console
Press UP/DOWN to move, ENTER to select
Reading from 0x1e0000, size 0x100000
Succeeded
RT-AX53U bootloader version: 1.0.0.1
Reading from 0x1e0000, size 0x100000
Succeeded
MAC Address: C8:7F:54:7D:58:38
Reading from 0x1e0000, size 0x40000
Succeeded
Check Factory's EEPROM successfully! (r = 17)
Reading from 0x2e0000, size 0x40000
Succeeded
Check Factory2's EEPROM successfully! (r = 17)
Reading from 0x3e0000, size 0x2000
Succeeded
Reading from 0x3e0000, size 0x26da30e
Succeeded
Image Name:
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 40739534 Bytes = 38.9 MiB
Load Address: 81001000
Entry Point: 81001000
Verifying Checksum ... Bad Data CRC
Bad TRX firmeare.
Reading from 0x35e0000, size 0x2000
Succeeded
Reading from 0x35e0000, size 0x26da30e
Succeeded
Image Name:
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 40739534 Bytes = 38.9 MiB
Load Address: 81001000
Entry Point: 81001000
Verifying Checksum ... Bad Data CRC
Bad TRX firmeare.
## Both firmware damaged ...
## Enter Rescue Mode ##
Using eth@1e100000 device
Listening for TFTP transfer on 192.168.1.1
Load address: 0x83000000
Loading: *T T T T T T T T T �
On a subsequent boot, it doesn't show any activity anymore.