I have @hnyman build r6420 running on my Netgear XR500. Before the firmware can be flashed, it is necessary to modify two U-Boot variables: board_model_id and board_hw_id.
First, remove the four rubber feet and use a Torx T-9 screwdriver tip to remove the four screws. Separate the two case halves.
Connect a 3.3 VDC USB/TTL Serial adapter to the Serial port header J1 on the system PCB.
J1 Pinout:
pin 1 ... 3.3 VDC (generally not used for most adapters)
pin 2 ... RX (receive)
pin 3 ... TX (transmit)
pin 4 ... GND (ground)
On the PC run a terminal emulation program capable of serial communications such as PuTTY and set the parameters as follows:
Serial line device: /dev/ttyUSB0 for Ubuntu linux. For Windows and possibly other flavors of linux you'll have to figure it out.
Line speed (baud rate) 115200
Data bits: 8
Stop bits: 1
Parity: None
Flow control: None
While the terminal program is running, press and hold the CTRL c keys and power cycle the router. Release the keys when the U-Boot command line prompt appears:
(IPQ) # <INTERRUPT>
(IPQ) # <INTERRUPT>
(IPQ) # <INTERRUPT>
(IPQ) # <INTERRUPT>
(IPQ) #Display the current values of the two vars:
(IPQ) # board_model_id_show
131072 bytes read: OK
board_model_id : XR500
(IPQ) # board_hw_id_show
131072 bytes read: OK
board_hw_id : 29764958+0+256+512+4x4+4x4+cascade
Modify the two vars as follows:
(IPQ) # board_model_id_set R7800
Burn board_model_id (= R7800) into ART block
131072 bytes read: OK
Erasing: off 1200000, size 20000
Erasing at 0x1200000 -- 100% complete. Cleanmarker written at 0x1200000.
OK
Writing: from RAM addr 5fe86df4, to NAND off 1200000, size 20000
131072 bytes written: OK
Active-timer expires
Done.
(IPQ) # board_hw_id_set 29764958+0+128+512+4x4+4x4+cascade
Burn board_hw_id (= 29764958+0+128+512+4x4+4x4+cascade) into ART block
131072 bytes read: OK
Erasing: off 1200000, size 20000
Erasing at 0x1200000 -- 100% complete. Cleanmarker written at 0x1200000.
OK
Writing: from RAM addr 5fe86de4, to NAND off 1200000, size 20000
131072 bytes written: OK
Active-timer expires
Done.
Next prepare to load R7800 firmware (I used R7800-master-r6420-4e8f1e9f4c-20180310-1406-sqfs-factory.img) from a PC TFTP Client (set static IP address 192.168.1.2 over an ethernet cable) by using the built-in TFTP server in U-Boot:
(IPQ) # fw_recovery
The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1 ...
The TFTP Server will patiently wait for you to setup TFTP on your PC.
Once the file has successfully transfered, the router should automatically boot.
Although the kernel senses the 256 MiB Macronix MX30UF2G18AC flash memory chip, it will use only the first 128MiB.
- Magnetron1.1
