OpenWrt installation on Nighthawk X6S AC4000 R8000P

Decided to order a PL2303HX after all and give serial console a try. Any quick guides/pointers for when I have serial console access on how I can obtain said logs (and also to push the OpenWRT .bin file)?

I disconnected all cables, only the router and the computer are connected via LAN

I've taken my Router apart and found that it has the 4x Serial Port pins, which is awesome. My USB to TTL hasn't arrived yet, but once it does I need to figure out which of the plugs is GND, Tx and Rx. Anyone able to give me pointers on how I can figure out which of those is which?

See https://openwrt.org/docs/techref/hardware/port.serial#finding_serial_console

1 Like

Alright so, I got Serial Console access and tried flashing the .bin file from the R8000P (renamed to .chk) to the R7900P, but it does not boot correctly. Is there a way I can turn the .bin into a proper .chk file?

EDIT: Well never mind that, the .bin file works, the .chk file doesn't. Is there anywhere that I can find the original firmware as a .bin file? Also, I am now getting the Router to boot, kind of, but it shuts down with the following log message:

Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host/tftp (f/h/c)  : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Boot image (0=latest, 1=previous) : 0
Default host ramdisk file name    :
Default ramdisk store address     :
Default DTB file name             :
Board Id                          : R8000P
Number of MAC Addresses (1-64)    : 11
Base MAC Address                  : 3c:37:86:d2:e2:16
PSI Size (1-128) KBytes           : 48
Enable Backup PSI [0|1]           : 0
System Log Size (0-256) KBytes    : 0
Auxillary File System Size Percent: 0
flow memory allocation (MB)       : 14
buffer memory allocation (MB)     : 16
DHD 0 memory allocation (MB)      : 0
DHD 1 memory allocation (MB)      : 0
DHD 2 memory allocation (MB)      : 0
WLan Feature                      : 0x00
Partition 1 Size (MB)             : 4M
Partition 2 Size (MB)             : 1M
Partition 3 Size (MB)             : 4M
Partition 4 Size (MB) (Data)      : 40M
Partition 5 Size (MB)                   : 4M
Partition 6 Size (MB)                   : 1M
Partition 7 Size (MB)                   : 4M

Initalizing switch low level hardware.
Software Resetting Switch ... Done.
Waiting MAC port Rx/Tx to be enabled by hardware ...Done
Disable Switch All MAC port Rx/Tx
Enable Switch MAC Port Rx/Tx, set PBVLAN to FAN out, set switch to NO-STP.
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down:^0                                                                                    ^CcBooting from latest image (address 0x00100000, flash offset 0x00100000) ...                                    ^CDecompression LZMA Image OK!
Entry at 0x0000000000080000
Closing network.
Restore Switch's MAC port Rx/Tx, PBVLAN back.
Disabling Switch ports.                                                                                          ^CFlushing Receive Buffers...
36 buffers found
Closing DMA Channels
Starting program at 0x0000000000080000
/memory = 0x20000000
WARNING: Node's property /reserved-memory/dt_reserved_buffer is not defined
WARNING: Node's property /reserved-memory/dt_reserved_flow is not defined
failed to set number of cpus to dtb
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x420f1000]
[    0.000000] Linux version 5.10.138 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19685-512e76967f) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Sat Sep 3 02:55:34 2022
[    0.000000] Machine model: Netgear R8000P
[    0.000000] earlycon: bcm63xx_uart0 at MMIO 0x00000000ff800640 (options '')
[    0.000000] printk: bootconsole [bcm63xx_uart0] enabled
[    0.000000] [Firmware Bug]: Kernel image misaligned at boot, please fix your bootloader!
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000000000000-0x000000001fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node^C 0: [mem 0x0000000000000000-0x000000001fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000001fffffff]
[    0.000000] percpu: Embedded 19 pages/cpu s39064 r8192 d30568 u77824
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 129024
[    0.000000] Kernel command line: earlycon=bcm63xx_uart,0xff800640 console=ttyS0,115200
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 504792K/524288K available (6334K kernel code, 768K rwdata, 880K rodata, 896K init, 265K bss, 19496K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GIC: Using split EOI/Deactivate mode
[    0.000000] arch_timer: cp15 timer(s) running at 50.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb8812736b, max_idle_ns: 440795202655 ns
[    0.000003] sched_clock: 56 bits at 50MHz, resolution 20ns, wraps every 4398046511100ns
[    0.008341] Calibrating delay loop (skipped), value calculated using timer frequency.. 100.00 BogoMIPS (lpj=500000)
[    0.019024] pid_max: default: 32768 minimum: 301
[    0.023836] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.031302] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.040211] rcu: Hierarchical SRCU implementation.
[    0.045160] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.053069] smp: Bringing up secondary CPUs ...
[    0.057880] Detected VIPT I-cache on CPU1
[    0.057917] CPU1: Booted secondary processor 0x0000000001 [0x420f1000]
[    0.057964] smp: Brought up 1 node, 2 CPUs
[    0.072943] SMP: Total of 2 processors activated.
[    0.077780] CPU features: detected: 32-bit EL0 Support
[    0.083071] CPU features: detected: CRC32 instructions
[    0.088371] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.096959] CPU: All CPU(s) started at EL2
[    0.101172] alternatives: patching kernel code
[    0.107384] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.117441] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.124483] pinctrl core: initialized pinctrl subsystem
[    0.130265] NET: Registered protocol family 16
[    0.134952] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.142162] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.150129] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.158472] ASID allocator initialised with 65536 entries
[    0.171435] cryptd: max_cpu_qlen set to 1000
[    0.177094] clocksource: Switched to clocksource arch_sys_counter
[    0.183740] NET: Registered protocol family 2
[    0.188237] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.195937] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.204481] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.212466] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[    0.219832] TCP: Hash tables configured (established 4096 bind 4096)
[    0.226377] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.233052] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.240288] NET: Registered protocol family 1
[    0.246693] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.254948] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.260891] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.271275] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
nPuTTY▒r▒▒ʲ▒▒] printk: console [ttyS0] enabled0xff800640 (irq = 22, base_baud = 1562500) is a bcm63xx_uart
[    0.289600] printk: console [ttyS0] enabled
[    0.298133] printk: bootconsole [bcm63xx_uart0] disabled
[    0.298133] printk: bootconsole [bcm63xx_uart0] disabled
[    0.309832] Could not find a valid ONFI parameter page, trying bit-wise majority to recover it
[    0.318679] ONFI parameter recovery failed, aborting
[    0.323752] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xf1
[    0.330290] nand: Macronix NAND 128MiB 3,3V 8-bit
[    0.335112] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    0.342926] bcm63138_nand ff801800.nand-controller: detected 128MiB total, 128KiB blocks, 2KiB pages, 16B OOB, 8-bit, BCH-4
[    0.354386] Block protection check failed
[    0.359032] Bad block table found at page 65472, version 0x01
[    0.365337] Bad block table found at page 65408, version 0x01
[    0.371656] nand_read_bbt: bad block at 0x000006a40000
[    0.376892] 2 fixed-partitions partitions found on MTD device brcmnand.0
[    0.383772] Creating 2 MTD partitions on "brcmnand.0":
[    0.389060] 0x000000000000-0x000000100000 : "cferom"
[    0.394423] 0x000000100000-0x000004500000 : "firmware"                                                   ^C[    0.735922] unimac-mdio 800c05c0.mdio: Broadcom UniMAC MDIO bus
[    0.743400] brcm-sf2 80080000.ethernet-switch: found switch: BCM4908, rev 0
[    0.751886] bcm7038-wdt ff800428.watchdog: Registered BCM7038 Watchdog
[    0.759404] NET: Registered protocol family 10
[    0.764485] Segment Routing with IPv6
[    0.768213] NET: Registered protocol family 17
[    0.772761] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    0.786150] 8021q: 802.1Q VLAN Support v1.8
[    0.791499] brcmstb-usb-phy 8000c200.usb-phy: Clock not found in Device Tree
[    0.798772] brcmstb-usb-phy 8000c200.usb-phy: USB3.0 clock not found in Device Tree
[    0.806580] brcmstb-usb-phy 8000c200.usb-phy: Suspend Clock not found in Device Tree
[    0.814560] brcmstb-usb-phy 8000c200.usb-phy: IRQ wake not found
[    0.820740] brcmstb-usb-phy 8000c200.usb-phy: IRQ wakeup not found
[    0.827101] brcmstb-usb-phy 8000c200.usb-phy: Wake interrupt missing, system wake not supported
[    0.837533] brcm-sf2 80080000.ethernet-switch: found switch: BCM4908, rev 0
[    0.873217] brcm-sf2 80080000.ethernet-switch lan4 (uninitialized): PHY [800c05c0.mdio--1:08] driver [Generic PHY] (irq=POLL)
[    0.891146] brcm-sf2 80080000.ethernet-switch lan3 (uninitialized): PHY [800c05c0.mdio--1:09] driver [Generic PHY] (irq=POLL)
[    0.909131] brcm-sf2 80080000.ethernet-switch lan2 (uninitialized): PHY [800c05c0.mdio--1:0a] driver [Generic PHY] (irq=POLL)
[    0.927105] brcm-sf2 80080000.ethernet-switch lan1 (uninitialized): PHY [800c05c0.mdio--1:0b] driver [Generic PHY] (irq=POLL)
[    0.945150] brcm-sf2 80080000.ethernet-switch wan (uninitialized): PHY [800c05c0.mdio--1:0c] driver [Generic PHY] (irq=POLL)
[    0.957078] brcm-sf2 80080000.ethernet-switch: configuring for fixed/internal link mode
[    0.965270] brcm-sf2 80080000.ethernet-switch: Link is Up - 1Gbps/Full - flow control off
[    0.965306] eth0: mtu greater than device maximum
[    0.978521] bcm4908_enet 80002000.ethernet eth0: error -22 setting MTU to include DSA overhead
[    0.987395] DSA: tree 0 setup
[    0.991432] brcm-sf2 80080000.ethernet-switch: Starfighter 2 top: 4.07, core: 5.00, IRQs: 20, 21
[    1.000982] /dev/root: Can't open blockdev
[    1.005114] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    1.012826] Please append a correct "root=" boot option; here are the available partitions:
[    1.021442] 1f00            1024 mtdblock0
[    1.021443]  (driver?)
[    1.028146] 1f01           69632 mtdblock1
[    1.028148]  (driver?)
[    1.034860] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    1.043375] SMP: stopping secondary CPUs
[    1.047406] Kernel Offset: disabled
[    1.050988] CPU features: 0x0000002,00002000
[    1.055376] Memory Limit: none
[    1.058517] Rebooting in 1 seconds..         

Well great, bricked cuz no one is giving any information on these forums on anything really. Is there a way I can access JTAG to flash CFE back? And where can I get the CFE for the R8000P?

There’s no root partition defined in your kernel command.

Boot an initramfs, make sure it works and then sysupgrade to install.

Check the uboot config to make sure a root partition is being passed to the kernel.

Also, if you’re getting this far cfe is running, why do you want to reflash it?

Finally, are you really sure these devices are identical? With the same partition table? Pretty unique for a netgear device to only have 2 partitions on the flash, they’re usually dual image devices at least, plus art and config partitions.

Well I am having a much bigger issue now, which is that it only comes this far when I boot it (this is the serial console output):

----
BTRM
V1.6
CPU0
L1CD
MMUI
MMU7
DATA
ZBBS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
IMGL
UHD?
UHDP
RLO?
RLOP
UBI?
UBIP
PASS
----
HELO
L1CD
MMUI
MMU8
CODE
ZBBS
MAIN
NAND
IMg?
FAIL

Any advice?

And yes they are identical, they share the same PCB board ID even. They truly are identical, and no one has been able to identify any actual differences yet on software level. If you need reference I'll gladly provide it, but yeah, they are truly identical, only that two features are disabled/removed on a hardware level, but apparently so insignificant that they even share the same PCB ID.

Sadly that does look like a dead bootloader now.

Also, even the same board can have differences per implementation. Looking that the dts's for each device there are differences between the r7900 and r8000, though I believe they relate to the leds only.

https://forum.archive.openwrt.org/viewtopic.php?id=64056&p=1

You should have a lot more partitions on the nand though, factory has;

dev:    size   erasesize  name
mtd0: 00080000 00020000 "boot"
mtd1: 00180000 00020000 "nvram"
mtd2: 02400000 00020000 "linux"
mtd3: 02211298 00020000 "rootfs"
mtd4: 00080000 00020000 "board_data"
mtd5: 00100000 00020000 "POT1"
mtd6: 00100000 00020000 "POT2"
mtd7: 002c0000 00020000 "T_Meter1"
mtd8: 002c0000 00020000 "T_Meter2"
mtd9: 00080000 00020000 "ML1"
mtd10: 00080000 00020000 "ML2"
mtd11: 00080000 00020000 "ML3"
mtd12: 00080000 00020000 "ML4"
mtd13: 00080000 00020000 "ML5"
mtd14: 00080000 00020000 "ML6"
mtd15: 00080000 00020000 "ML7"
mtd16: 00080000 00020000 "QoSRule"
mtd17: 04900000 00020000 "brcmnand"
mtd18: 00500000 00020000 "OpenVPN"

That thread has r7900 partition dumps attached - could help you reflash CFE.

Bro, brobrobro I truly appreciate your help and I'm sure you could help me get this fixed, but check the model number. R7900P and R8000P, with a P. The R7900P and R8000P are identical and closer to one another than R7900 to R7900P.

Here, for reference:

Ok, well you will need to source a copy of the 7900P cfe to recover the device and have a way to flash it, such as removing the nand or by jtag

Well and that's where I'm stuck. Can't find any CFE for R7900P or R8000P, NETGEAR support are being dicks and only give me pointless, canned replies, and for JTAG I have no idea where the pinouts are.... Yea...

Brother, I ordered a serial console access cable.... will there be any problems with the firmware? I read that Wifi will not work on openwrt-22.03.0 due to some closed source drivers
P.S. original firmware SUCKS

Wait, since you do that, could you do me a huge favour and backup your original firmware and CFE before you install OpenWRT? You would need a backup for us both, so once you have it, let me know and I'll help you with setup over Discord. I have figured out which pin is VCC, GND, TX and RX, in addition on how exactly to set it up so.

Of course, as soon as I get the cable to connect, I will make a backup and write to you on DISCORD) My discord Muramasa#8254

Ok so all I need now is to find a way to flash CFE once I soon will get the backup from someone. JTAG is difficult because I don't know the JTAG layout or which cable to buy, and no one seems to know or be able to help. Flashing the NAND chip feels honestly even worse because I can't even begin to find out where it is and how to flash it.

Anyone wanna help?

https://forum.openwrt.org/t/openwrt-22-03-0-netgear-r8000p-wifi-not-working/

Broadcom devices are really not popular here, due to broadcoms terrible open source stance, you may have more luck on the netgear forum

So... I am going to assume that I can't just upload the firmware? There would have to be some actual hacking of machines.

How is it possible that there is a stable version of OpenWrt for the Netgear R8000P and no installation method is known?!

https://firmware-selector.openwrt.org/?version=23.05.2&target=bcm4908%2Fgeneric&id=netgear_r8000p

Install instructions are linked in the second post.