Netgear R7800 exploration (IPQ8065, QCA9984)

R7800 has an easy-to-use TFTP recovery mode in the bootloader, similar as e.g. WNDR3700.

@dissent1 gave me the info, which was really useful as I managed to brick the router a few minutes ago when testing thermal drivers. I recovered from a boot loop with this process. Works like a charm.

Prerequisites for TFTP recovery

  • A TFTP client for your computer. There are both command-line tools and GUI versions available.
    • (I use currently tftpd64 GUI tool from jounin. tftp2 tool (from dd-wrt) used to work earlier, but for some reason does not work with the current master images.)
  • Your computer must have an IP address from the 192.168.1.x network, as the router' bootloader's TFTP recovery mode defaults to 192.168.1.1. You might need to manually config the address, as some operating systems change the IP rather quickly to a link-local 196.254.x.x address if there is no DHCP server. Verify that your PC still has 192.168.1.x before trying to TFTP.
  • A new firmware to flash in. Either an original Netgear firmware or an Openwrt "factory.img" firmware. "Sysupgrade" version will not work.
  • Access to router's reset button (on the back panel)

Recovery process

  1. Turn off the power, push and hold the reset button with a pin
  2. Turn on the power and wait till power led starts flashing white (after it first flashes orange for a while)
  3. Release the pin and use tftp in binary mode to send the factory img to the router. The power led will stop flashing if you succeeded in transferring the image, and the router reboots rather quickly with the new firmware.

Note that this recovery mode is in the bootloader (u-boot?), so it works before the actual firmware gets started.

Quite similar process as e.g. WNDR3700, which is documented in the Openwrt wiki: https://wiki.openwrt.org/toh/netgear/wndr3700#recovery_flash_in_failsafe_mode

6 Likes