Netgear R7800 exploration (IPQ8065, QCA9984)

@hnyman i'm doing some test with my r7800... I'm trying to use the ramfs image

I selected it with menuconfig but i can't find a way to make it working...
I tried use the tftpboot feature of uboot but with the command go 0x4200000 the router crash and reboot

Can you tell me how to do this?

Sorry, I have never used the ramfs image.

But it was recently mentioned in

And it referenced to R7800 initramfs instructions at

But I have not tested that.


the ram boot address is device dependent. i.e. it is different on my r7500v2 (44000000) compared to the r7800 (50000000 in @quarky's instructions)

as described in step 8 of my instructions for the r7500v2 here, try
and look for the "bootcmd" environment variable. Using the loadaddr environment variable "0x42000000" did not work for me either (I think this is the nand address to load an image from).

so you are telling me tftpboot load the image not in ram but in the nand o.O... good work netgear REALLY.

(Anyway just as a info... i'm working on updating the cpufreq patch that is 6 years old... from 2014... latest revision, 12 got included in mainline kernel and applies correctly... the last 2 patch got dropped for some reason and we actually don't have cpufreq with opp on ipq8064 platform... I have updated the driver and the dtsi but I need to find the reason the driver stalls on driver load)

(this will remove like 14 patch and mark them as backported as they are applied upstream, making the switch to 5.4 easier)

i wish i had serial :(. i think @anon50098793 was working on being able to boot off a USB image (without serial) at one point, but he needed testers with serial.

1 Like

it would help alot if anyone can paste a full printenv / fw_printenv in this thread ( one for each device type )

( minus anything erroneous like macs or misc fields )

static commands to "usbload" on your systems too it would also help...

uload=0x50000000 #< safe address to load a uEnv.txt non-oem
sload=0x49000000 #< safe address to load scripts non-oem

oembootcmd=setenv syno_extra_args syno_rescue=1; run syno_bootargs; ext2load mmc 0:3 $kload zImage;ext2load mmc 0:3 $rload rd.bin;bootipq

wrtgo=usb start; ext2load usb 0:1 $kload kernel; run wrtbootarg; bootm $kload

A serial USB cost like 12 euros

Anyway I will post here my changes but still no success... All works good on the router but for some reason it doesn't register the opp (so no cpufreq)

Any idea?

serial console requires hardware mods to the R7800 though doesn't it?

No, it does not.

The serial headers pin is already flashed... You just need to open it

Just open the cover and attach the serial cable to pins, like I describe in the message 2 of this thread...

yeah, i don't want to pry it open :).

Opening five screws is no "hardware mod"...


If someone wants to help

This is the repo... All done except... it doesn't work (ah ah ah)
OPP for some reason doesn't register named operating point...

I have little time this 2 week so if anyone wants to take a look i would really appreciate it.

I'm using kernel 4.19 with my R7800 for 3 weeks now and it's rock solid. Actually, it seems more stable than previous versions.

I've got users reporting reproducible crashes on 18.06.5 builds when doing 1 of 2 things:

  1. use anydesk( to remote control PCs. after enable the option "Search local network for other anydesk clients" and then use it to connect to another PC within local network, router reboot.
  2. when use Edge to browse this website:,
    and then click any link of "get deal" or "show coupon code", router reboot

Anyone else seeing this? 2 users exact same problem and 100% reproducible apparently.
These are very strange crash conditions...

PS. Not a spam post. Links are explanatory, not advertisement.

First guess here is the jumboframe bug, which possibly goes away with kernel 4.19

No idea about the other cause.

1 Like

I think I've seen my wifi go down during usage of NoMachine.

1 Like

Good news i actually made the upstream patch work...
ipq806x now set cpufreq based on opp table

This is result with new cpufreq implementation + fixed l2 cache scaling

root@No-Lag-Router:~# ./mbw 32
Long uses 4 bytes. Allocating 2*8388608 elements = 67108864 bytes of memory.
Using 262144 bytes as blocks for memcpy block copy test.
Getting down to business... Doing 10 runs per test.
0       Method: MEMCPY  Elapsed: 0.04349        MiB: 32.00000   Copy: 735.801 MiB/s
1       Method: MEMCPY  Elapsed: 0.04416        MiB: 32.00000   Copy: 724.588 MiB/s
2       Method: MEMCPY  Elapsed: 0.04369        MiB: 32.00000   Copy: 732.500 MiB/s
3       Method: MEMCPY  Elapsed: 0.04289        MiB: 32.00000   Copy: 746.129 MiB/s
4       Method: MEMCPY  Elapsed: 0.07459        MiB: 32.00000   Copy: 429.023 MiB/s
5       Method: MEMCPY  Elapsed: 0.04818        MiB: 32.00000   Copy: 664.162 MiB/s
6       Method: MEMCPY  Elapsed: 0.04235        MiB: 32.00000   Copy: 755.537 MiB/s
7       Method: MEMCPY  Elapsed: 0.04283        MiB: 32.00000   Copy: 747.122 MiB/s
8       Method: MEMCPY  Elapsed: 0.04273        MiB: 32.00000   Copy: 748.818 MiB/s
9       Method: MEMCPY  Elapsed: 0.04242        MiB: 32.00000   Copy: 754.361 MiB/s
AVG     Method: MEMCPY  Elapsed: 0.04673        MiB: 32.00000   Copy: 684.734 MiB/s
0       Method: DUMB    Elapsed: 0.20119        MiB: 32.00000   Copy: 159.053 MiB/s
1       Method: DUMB    Elapsed: 0.18564        MiB: 32.00000   Copy: 172.379 MiB/s
2       Method: DUMB    Elapsed: 0.20574        MiB: 32.00000   Copy: 155.537 MiB/s
3       Method: DUMB    Elapsed: 0.20623        MiB: 32.00000   Copy: 155.167 MiB/s
4       Method: DUMB    Elapsed: 0.20143        MiB: 32.00000   Copy: 158.866 MiB/s
5       Method: DUMB    Elapsed: 0.18646        MiB: 32.00000   Copy: 171.615 MiB/s
6       Method: DUMB    Elapsed: 0.18629        MiB: 32.00000   Copy: 171.773 MiB/s
7       Method: DUMB    Elapsed: 0.18545        MiB: 32.00000   Copy: 172.557 MiB/s
8       Method: DUMB    Elapsed: 0.18772        MiB: 32.00000   Copy: 170.468 MiB/s
9       Method: DUMB    Elapsed: 0.22590        MiB: 32.00000   Copy: 141.658 MiB/s
AVG     Method: DUMB    Elapsed: 0.19720        MiB: 32.00000   Copy: 162.269 MiB/s
0       Method: MCBLOCK Elapsed: 0.04279        MiB: 32.00000   Copy: 747.891 MiB/s
1       Method: MCBLOCK Elapsed: 0.07292        MiB: 32.00000   Copy: 438.813 MiB/s
2       Method: MCBLOCK Elapsed: 0.04952        MiB: 32.00000   Copy: 646.138 MiB/s
3       Method: MCBLOCK Elapsed: 0.04250        MiB: 32.00000   Copy: 752.994 MiB/s
4       Method: MCBLOCK Elapsed: 0.04339        MiB: 32.00000   Copy: 737.514 MiB/s
5       Method: MCBLOCK Elapsed: 0.04398        MiB: 32.00000   Copy: 727.570 MiB/s
6       Method: MCBLOCK Elapsed: 0.04353        MiB: 32.00000   Copy: 735.210 MiB/s
7       Method: MCBLOCK Elapsed: 0.04596        MiB: 32.00000   Copy: 696.273 MiB/s
8       Method: MCBLOCK Elapsed: 0.04529        MiB: 32.00000   Copy: 706.511 MiB/s
9       Method: MCBLOCK Elapsed: 0.04478        MiB: 32.00000   Copy: 714.525 MiB/s
AVG     Method: MCBLOCK Elapsed: 0.04747        MiB: 32.00000   Copy: 674.158 MiB/s

Here the repo

Here difference

Here the patchset if someone wants to try (this is applied on kernel 4.19)


Your approach there with "compatible" seems to revert the opposite action in the 4.19 kernel bump thread ???
practically reverts