Alright so, I got Serial Console access and tried flashing the .bin file from the R8000P (renamed to .chk) to the R7900P, but it does not boot correctly. Is there a way I can turn the .bin into a proper .chk file?
EDIT: Well never mind that, the .bin file works, the .chk file doesn't. Is there anywhere that I can find the original firmware as a .bin file? Also, I am now getting the Router to boot, kind of, but it shuts down with the following log message:
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host/tftp (f/h/c) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Boot image (0=latest, 1=previous) : 0
Default host ramdisk file name :
Default ramdisk store address :
Default DTB file name :
Board Id : R8000P
Number of MAC Addresses (1-64) : 11
Base MAC Address : 3c:37:86:d2:e2:16
PSI Size (1-128) KBytes : 48
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
flow memory allocation (MB) : 14
buffer memory allocation (MB) : 16
DHD 0 memory allocation (MB) : 0
DHD 1 memory allocation (MB) : 0
DHD 2 memory allocation (MB) : 0
WLan Feature : 0x00
Partition 1 Size (MB) : 4M
Partition 2 Size (MB) : 1M
Partition 3 Size (MB) : 4M
Partition 4 Size (MB) (Data) : 40M
Partition 5 Size (MB) : 4M
Partition 6 Size (MB) : 1M
Partition 7 Size (MB) : 4M
Initalizing switch low level hardware.
Software Resetting Switch ... Done.
Waiting MAC port Rx/Tx to be enabled by hardware ...Done
Disable Switch All MAC port Rx/Tx
Enable Switch MAC Port Rx/Tx, set PBVLAN to FAN out, set switch to NO-STP.
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down:^0 ^CcBooting from latest image (address 0x00100000, flash offset 0x00100000) ... ^CDecompression LZMA Image OK!
Entry at 0x0000000000080000
Closing network.
Restore Switch's MAC port Rx/Tx, PBVLAN back.
Disabling Switch ports. ^CFlushing Receive Buffers...
36 buffers found
Closing DMA Channels
Starting program at 0x0000000000080000
/memory = 0x20000000
WARNING: Node's property /reserved-memory/dt_reserved_buffer is not defined
WARNING: Node's property /reserved-memory/dt_reserved_flow is not defined
failed to set number of cpus to dtb
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x420f1000]
[ 0.000000] Linux version 5.10.138 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19685-512e76967f) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 SMP Sat Sep 3 02:55:34 2022
[ 0.000000] Machine model: Netgear R8000P
[ 0.000000] earlycon: bcm63xx_uart0 at MMIO 0x00000000ff800640 (options '')
[ 0.000000] printk: bootconsole [bcm63xx_uart0] enabled
[ 0.000000] [Firmware Bug]: Kernel image misaligned at boot, please fix your bootloader!
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x0000000000000000-0x000000001fffffff]
[ 0.000000] DMA32 empty
[ 0.000000] Normal empty
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node^C 0: [mem 0x0000000000000000-0x000000001fffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000001fffffff]
[ 0.000000] percpu: Embedded 19 pages/cpu s39064 r8192 d30568 u77824
[ 0.000000] Detected VIPT I-cache on CPU0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 129024
[ 0.000000] Kernel command line: earlycon=bcm63xx_uart,0xff800640 console=ttyS0,115200
[ 0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 504792K/524288K available (6334K kernel code, 768K rwdata, 880K rodata, 896K init, 265K bss, 19496K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] rcu: Hierarchical RCU implementation.
[ 0.000000] rcu: RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[ 0.000000] Tracing variant of Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[ 0.000000] GIC: Using split EOI/Deactivate mode
[ 0.000000] arch_timer: cp15 timer(s) running at 50.00MHz (phys).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb8812736b, max_idle_ns: 440795202655 ns
[ 0.000003] sched_clock: 56 bits at 50MHz, resolution 20ns, wraps every 4398046511100ns
[ 0.008341] Calibrating delay loop (skipped), value calculated using timer frequency.. 100.00 BogoMIPS (lpj=500000)
[ 0.019024] pid_max: default: 32768 minimum: 301
[ 0.023836] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.031302] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[ 0.040211] rcu: Hierarchical SRCU implementation.
[ 0.045160] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[ 0.053069] smp: Bringing up secondary CPUs ...
[ 0.057880] Detected VIPT I-cache on CPU1
[ 0.057917] CPU1: Booted secondary processor 0x0000000001 [0x420f1000]
[ 0.057964] smp: Brought up 1 node, 2 CPUs
[ 0.072943] SMP: Total of 2 processors activated.
[ 0.077780] CPU features: detected: 32-bit EL0 Support
[ 0.083071] CPU features: detected: CRC32 instructions
[ 0.088371] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[ 0.096959] CPU: All CPU(s) started at EL2
[ 0.101172] alternatives: patching kernel code
[ 0.107384] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.117441] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[ 0.124483] pinctrl core: initialized pinctrl subsystem
[ 0.130265] NET: Registered protocol family 16
[ 0.134952] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[ 0.142162] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[ 0.150129] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[ 0.158472] ASID allocator initialised with 65536 entries
[ 0.171435] cryptd: max_cpu_qlen set to 1000
[ 0.177094] clocksource: Switched to clocksource arch_sys_counter
[ 0.183740] NET: Registered protocol family 2
[ 0.188237] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[ 0.195937] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.204481] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.212466] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[ 0.219832] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.226377] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.233052] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.240288] NET: Registered protocol family 1
[ 0.246693] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[ 0.254948] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.260891] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.271275] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
nPuTTY▒r▒▒ʲ▒▒] printk: console [ttyS0] enabled0xff800640 (irq = 22, base_baud = 1562500) is a bcm63xx_uart
[ 0.289600] printk: console [ttyS0] enabled
[ 0.298133] printk: bootconsole [bcm63xx_uart0] disabled
[ 0.298133] printk: bootconsole [bcm63xx_uart0] disabled
[ 0.309832] Could not find a valid ONFI parameter page, trying bit-wise majority to recover it
[ 0.318679] ONFI parameter recovery failed, aborting
[ 0.323752] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xf1
[ 0.330290] nand: Macronix NAND 128MiB 3,3V 8-bit
[ 0.335112] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[ 0.342926] bcm63138_nand ff801800.nand-controller: detected 128MiB total, 128KiB blocks, 2KiB pages, 16B OOB, 8-bit, BCH-4
[ 0.354386] Block protection check failed
[ 0.359032] Bad block table found at page 65472, version 0x01
[ 0.365337] Bad block table found at page 65408, version 0x01
[ 0.371656] nand_read_bbt: bad block at 0x000006a40000
[ 0.376892] 2 fixed-partitions partitions found on MTD device brcmnand.0
[ 0.383772] Creating 2 MTD partitions on "brcmnand.0":
[ 0.389060] 0x000000000000-0x000000100000 : "cferom"
[ 0.394423] 0x000000100000-0x000004500000 : "firmware" ^C[ 0.735922] unimac-mdio 800c05c0.mdio: Broadcom UniMAC MDIO bus
[ 0.743400] brcm-sf2 80080000.ethernet-switch: found switch: BCM4908, rev 0
[ 0.751886] bcm7038-wdt ff800428.watchdog: Registered BCM7038 Watchdog
[ 0.759404] NET: Registered protocol family 10
[ 0.764485] Segment Routing with IPv6
[ 0.768213] NET: Registered protocol family 17
[ 0.772761] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 0.786150] 8021q: 802.1Q VLAN Support v1.8
[ 0.791499] brcmstb-usb-phy 8000c200.usb-phy: Clock not found in Device Tree
[ 0.798772] brcmstb-usb-phy 8000c200.usb-phy: USB3.0 clock not found in Device Tree
[ 0.806580] brcmstb-usb-phy 8000c200.usb-phy: Suspend Clock not found in Device Tree
[ 0.814560] brcmstb-usb-phy 8000c200.usb-phy: IRQ wake not found
[ 0.820740] brcmstb-usb-phy 8000c200.usb-phy: IRQ wakeup not found
[ 0.827101] brcmstb-usb-phy 8000c200.usb-phy: Wake interrupt missing, system wake not supported
[ 0.837533] brcm-sf2 80080000.ethernet-switch: found switch: BCM4908, rev 0
[ 0.873217] brcm-sf2 80080000.ethernet-switch lan4 (uninitialized): PHY [800c05c0.mdio--1:08] driver [Generic PHY] (irq=POLL)
[ 0.891146] brcm-sf2 80080000.ethernet-switch lan3 (uninitialized): PHY [800c05c0.mdio--1:09] driver [Generic PHY] (irq=POLL)
[ 0.909131] brcm-sf2 80080000.ethernet-switch lan2 (uninitialized): PHY [800c05c0.mdio--1:0a] driver [Generic PHY] (irq=POLL)
[ 0.927105] brcm-sf2 80080000.ethernet-switch lan1 (uninitialized): PHY [800c05c0.mdio--1:0b] driver [Generic PHY] (irq=POLL)
[ 0.945150] brcm-sf2 80080000.ethernet-switch wan (uninitialized): PHY [800c05c0.mdio--1:0c] driver [Generic PHY] (irq=POLL)
[ 0.957078] brcm-sf2 80080000.ethernet-switch: configuring for fixed/internal link mode
[ 0.965270] brcm-sf2 80080000.ethernet-switch: Link is Up - 1Gbps/Full - flow control off
[ 0.965306] eth0: mtu greater than device maximum
[ 0.978521] bcm4908_enet 80002000.ethernet eth0: error -22 setting MTU to include DSA overhead
[ 0.987395] DSA: tree 0 setup
[ 0.991432] brcm-sf2 80080000.ethernet-switch: Starfighter 2 top: 4.07, core: 5.00, IRQs: 20, 21
[ 1.000982] /dev/root: Can't open blockdev
[ 1.005114] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[ 1.012826] Please append a correct "root=" boot option; here are the available partitions:
[ 1.021442] 1f00 1024 mtdblock0
[ 1.021443] (driver?)
[ 1.028146] 1f01 69632 mtdblock1
[ 1.028148] (driver?)
[ 1.034860] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 1.043375] SMP: stopping secondary CPUs
[ 1.047406] Kernel Offset: disabled
[ 1.050988] CPU features: 0x0000002,00002000
[ 1.055376] Memory Limit: none
[ 1.058517] Rebooting in 1 seconds..
Well great, bricked cuz no one is giving any information on these forums on anything really. Is there a way I can access JTAG to flash CFE back? And where can I get the CFE for the R8000P?