R7800 stuck in boot loop

Installing and Using OpenWrt
1

So my r7800 seems stuck in a boot loop
I've installed OpenWRT and DDWRT a number of times without problems but this time I did a dumb dumb thing. I believe I force flashed the factory.img instead of the sysupgrade. (Kong's latest)

I now am left with a device which when I try to enter the recovery mode I never get to the point of a flashing white light.

I turn off the power, push and hold the reset button with a pin
Turn on the power and try to wait till power led starts flashing white (after it first flashes orange for a while) the same power led turns solid white for a few seconds followed by all Ethernet port leds b lighting up then the process starts again.. :frowning:

Have I busted it ?

2

access via serial port would probably be a good start.

3

Usually, not even required for debricking but yeah, with serial one would definitely see what exactly is going on :smirk: :

4

Ok thank you both. I'll report back in next few days.

5

Not sure if it's me or the router but I have connected my serial usb adaptor as per the instructions in the links above but when I open a serial connection in putty, I get a prompt but no output ! I have so far powered up the router AND again tried the reset button but neither display any output in putty. I only have gnd, Rx, and tx connected. Should I be connecting the 3.3v too ?

6

3.3V mustn't be connected, but you can try to switch rx/ tx around.

7

Thank you..that worked

8

Serial Output.. This means nothing to me folks, hope someone is prepared to have a glance on my behalf , and tell me if I have a way out of this or is it foooooooked.. Thank you

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2021.03.03 09:00:09 =~=~=~=~=~=~=~=~=~=~=~=


U-Boot 2012.07 [local,local] (Sep 03 2015 - 17:33:28)

U-boot 2012.07 dni1 V0.4 for DNI HW ID: 29764958 NOR flash 0MB; NAND flash 128MB; RAM 512MB; 1st Radio 4x4; 2nd Radio 4x4; Cascade
smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  SF: Unsupported manufacturer 00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
128 MiB
MMC:   
*** Warning - bad CRC, using default environment

PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
 131072 bytes read: OK
MMC Device 0 not found
cdp: get part failed for 0:HLOS
Net:   MAC1 addr:9c:3d:cf:e0:6c:e7
athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init  done
MAC2 addr:9c:3d:cf:e0:6c:e6
eth0, eth1
Hit any key to stop autoboot:  2  1  0 
Mac2 unit failed
Mac1 unit failed

 nmrp server is stopped or failed !

Loading from device 0: nand0 (offset 0x1480000)

** check kernel image **
   Verifying Checksum ... OK

** check rootfs image **
   Verifying Checksum ... OK
MMC Device 0 not found

Loading from nand0, offset 0x1480000
   Image Name:   ARM KONG Linux-5.4.85
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2831339 Bytes = 2.7 MiB
   Load Address: 42208000
   Entry Point:  42208000
Automatic boot of image at addr 0x44000000 ...
   Image Name:   ARM KONG Linux-5.4.85
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2831339 Bytes = 2.7 MiB
   Load Address: 42208000
   Entry Point:  42208000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
mtdparts variable not set, see 'help mtdparts'
no partitions defined

defaults:
mtdids  : nand0=msm_nand
mtdparts: none
info: "mtdparts" not set
Using machid 0x136c from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.4.85 (bluebat@helios) (gcc version 9.3.0 (OpenWrt GCC 9.3.0 r15399-7ff21185bc)) #0 SMP Sat Jan 2 14:41:34 2021
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5787d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] OF: fdt: Machine model: Netgear Nighthawk X4S R7800
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] percpu: Embedded 15 pages/cpu s30540 r8192 d22708 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 121920
[    0.000000] Kernel command line: 
[    0.000000] Bootloader command line (ignored): console=ttyHSL1,115200n8
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 475320K/491520K available (6016K kernel code, 172K rwdata, 1536K rodata, 1024K init, 237K bss, 16200K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] random: get_random_bytes called from start_kernel+0x338/0x4c4 with crng_init=0
[    0.000000] clocksource: dg_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 305801671480 ns
[    0.000006] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 343597383600ns
[    0.000020] Switching to timer-based delay loop, resolution 160ns
[    0.000311] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=62500)
[    0.000332] pid_max: default: 32768 minimum: 301
[    0.000480] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.000498] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.001232] CPU: Testing write buffer coherency: ok
[    0.002249] Setting up static identity map for 0x42300000 - 0x42300060
[    0.002408] rcu: Hierarchical SRCU implementation.
[    0.002843] smp: Bringing up secondary CPUs ...
[    0.004674] smp: Brought up 1 node, 2 CPUs
[    0.004690] SMP: Total of 2 processors activated (25.00 BogoMIPS).
[    0.004700] CPU: All CPU(s) started in SVC mode.
[    0.015803] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    0.015950] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.015976] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.016083] pinctrl core: initialized pinctrl subsystem
[    0.017166] NET: Registered protocol family 16
[    0.017447] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.018825] cpuidle: using governor ladder
[    0.018885] cpuidle: using governor menu
[    0.019092] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[    0.019107] hw-breakpoint: maximum watchpoint size is 8 bytes.
[    0.053986] usbcore: registered new interface driver usbfs
[    0.054066] usbcore: registered new interface driver hub
[    0.054149] usbcore: registered new device driver usb
[    0.054210] pps_core: LinuxPPS API ver. 1 registered
[    0.054222] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.054262] PTP clock support registered
[    0.055168] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    0.056368] clocksource: Switched to clocksource dg_timer
[    0.057162] thermal_sys: Registered thermal governor 'step_wise'
[    0.059576] NET: Registered protocol family 2
[    0.060315] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.060347] TCP established hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.060389] TCP bind hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.060442] TCP: Hash tables configured (established 4096 bind 4096)
[    0.060538] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.060566] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.060796] NET: Registered protocol family 1
[    0.060845] PCI: CLS 0 bytes, default 64
[    0.061628] hw perfevents: enabled with armv7_krait PMU driver, 5 counters available
[    0.063275] workingset: timestamp_bits=30 max_order=17 bucket_order=0
[    0.068983] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.068998] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.109266] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda not found, using dummy regulator
[    0.109396] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_phy not found, using dummy regulator
[    0.109521] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_refclk not found, using dummy regulator
[    0.109789] qcom-pcie 1b500000.pci: host bridge /soc/pci@1b500000 ranges:
[    0.109861] qcom-pcie 1b500000.pci:    IO 0x0fe00000..0x0fefffff -> 0x0fe00000
[    0.109897] qcom-pcie 1b500000.pci:   MEM 0x08000000..0x0fdfffff -> 0x08000000
[    0.332062] qcom-pcie 1b500000.pci: Link up
[    0.332224] qcom-pcie 1b500000.pci: PCI host bridge to bus 0000:00
[    0.332246] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.332265] pci_bus 0000:00: root bus resource [io  0x0000-0xfffff] (bus address [0xfe00000-0xfefffff])
[    0.332282] pci_bus 0000:00: root bus resource [mem 0x08000000-0x0fdfffff]
[    0.332345] pci 0000:00:00.0: [17cb:0101] type 01 class 0xff0000
[    0.332519] pci 0000:00:00.0: supports D1
[    0.332536] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.336940] PCI: bus0: Fast back to back transfers disabled
[    0.337292] pci 0000:01:00.0: [168c:0046] type 00 class 0x028000
[    0.337646] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.338794] pci 0000:01:00.0: PME# supported from D0 D3hot D3cold
[    0.343318] PCI: bus1: Fast back to back transfers disabled
[    0.343402] pci 0000:00:00.0: BAR 8: assigned [mem 0x08000000-0x081fffff]
[    0.343426] pci 0000:01:00.0: BAR 0: assigned [mem 0x08000000-0x081fffff 64bit]
[    0.343555] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.343577] pci 0000:00:00.0:   bridge window [mem 0x08000000-0x081fffff]
[    0.344311] pcieport 0000:00:00.0: AER: enabled with IRQ 40
[    0.344905] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda not found, using dummy regulator
[    0.345030] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_phy not found, using dummy regulator
[    0.345138] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_refclk not found, using dummy regulator
[    0.345405] qcom-pcie 1b700000.pci: host bridge /soc/pci@1b700000 ranges:
[    0.345467] qcom-pcie 1b700000.pci:    IO 0x31e00000..0x31efffff -> 0x31e00000
[    0.345500] qcom-pcie 1b700000.pci:   MEM 0x2e000000..0x31dfffff -> 0x2e000000
[    0.573764] qcom-pcie 1b700000.pci: Link up
[    0.573915] qcom-pcie 1b700000.pci: PCI host bridge to bus 0001:00
[    0.573937] pci_bus 0001:00: root bus resource [bus 00-ff]
[    0.573953] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff]
[    0.574010] pci 0001:00:00.0: [17cb:0101] type 01 class 0xff0000
[    0.574162] pci 0001:00:00.0: supports D1
[    0.574177] pci 0001:00:00.0: PME# supported from D0 D1 D3hot
[    0.578544] PCI: bus0: Fast back to back transfers disabled
[    0.578896] pci 0001:01:00.0: [168c:0046] type 00 class 0x028000
[    0.579272] pci 0001:01:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.580506] pci 0001:01:00.0: PME# supported from D0 D3hot D3cold
[    0.580808] pci 0001:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s x1 link at 0001:00:00.0 (capable of 4.000 Gb/s with 5 GT/s x1 link)
[    0.585094] PCI: bus1: Fast back to back transfers disabled
[    0.585167] pci 0001:00:00.0: BAR 8: assigned [mem 0x2e000000-0x2e1fffff]
[    0.585191] pci 0001:01:00.0: BAR 0: assigned [mem 0x2e000000-0x2e1fffff 64bit]
[    0.585323] pci 0001:00:00.0: PCI bridge to [bus 01-ff]
[    0.585343] pci 0001:00:00.0:   bridge window [mem 0x2e000000-0x2e1fffff]
[    0.586185] pcieport 0001:00:00.0: AER: enabled with IRQ 42
[    0.588988] L2 @ QSB rate. Forcing new rate.
[    0.589215] L2 @ 384000 KHz
[    0.589402] CPU0 @ 800000 KHz
[    0.589414] CPU1 @ QSB rate. Forcing new rate.
[    0.589549] CPU1 @ 384000 KHz
[    0.593337] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0
[    0.595638] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.598246] msm_serial 16340000.serial: msm_serial: detected port #0
[    0.598308] msm_serial 16340000.serial: uartclk = 7372800
[    0.598385] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 43, base_baud = 460800) is a MSM
[    0.598422] msm_serial: console setup on port #0
[    1.395597] printk: console [ttyMSM0] enabled
[    1.400740] msm_serial: driver initialized
[    1.409560] loop: module loaded
[    1.411145] nand: device found, Manufacturer ID: 0x01, Chip ID: 0xa1
[    1.411723] nand: AMD/Spansion S34MS01G2
[    1.418432] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.422335] 8 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.429710] Creating 8 MTD partitions on "qcom_nand.0":
[    1.436469] 0x000000000000-0x000000c80000 : "qcadata"
[    1.446786] random: fast init done
[    1.462733] 0x000000c80000-0x000001180000 : "APPSBL"
[    1.471795] 0x000001180000-0x000001200000 : "APPSBLENV"
[    1.473467] 0x000001200000-0x000001340000 : "art"
[    1.478790] 0x000001340000-0x000001480000 : "artbak"
[    1.483549] 0x000001480000-0x000001880000 : "kernel"
[    1.493129] 0x000001880000-0x000007900000 : "ubi"
[    1.649991] 0x000007900000-0x000008000000 : "reserve"
[    1.663896] libphy: ipq8064_mdio_bus: probed
[    1.679179] switch0: Atheros AR8337 rev. 2 switch registered on 37000000.mdio-mii
[    2.522956] ar8327: qca,phy-rgmii-en is not specified
[    2.523544] libphy: Fixed MDIO Bus: probed
[    2.527631] i2c /dev entries driver
[    2.533452] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    2.534485] cpuidle: enable-method property 'qcom,kpss-acc-v1' found operations
[    2.542389] sdhci: Secure Digital Host Controller Interface driver
[    2.549033] sdhci: Copyright(c) Pierre Ossman
[    2.555200] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.562055] NET: Registered protocol family 10
[    2.566577] Segment Routing with IPv6
[    2.569783] NET: Registered protocol family 17
[    2.573433] Bridge firewalling registered
[    2.577976] 8021q: 802.1Q VLAN Support v1.8
[    2.581804] Registering SWP/SWPB emulation handler
[    2.610559] qcom_rpm 108000.rpm: RPM firmware 3.0.16777364
[    2.624113] s1a: Bringing 0uV into 1050000-1050000uV
[    2.624384] s1a: supplied by regulator-dummy
[    2.628390] s1b: Bringing 0uV into 1050000-1050000uV
[    2.632603] s1b: supplied by regulator-dummy
[    2.637550] s2a: Bringing 0uV into 775000-775000uV
[    2.641799] s2a: supplied by regulator-dummy
[    2.646334] s2b: Bringing 0uV into 775000-775000uV
[    2.650906] s2b: supplied by regulator-dummy
[    2.665087] UBI: auto-attach mtd6
[    2.665112] ubi0: attaching mtd6
[    2.877067] random: crng init done
[    4.037392] ubi0: scanning is finished
[    4.049156] ubi0: attached mtd6 (name "ubi", size 96 MiB)
[    4.049181] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    4.053527] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    4.060416] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    4.067234] ubi0: good PEBs: 772, bad PEBs: 0, corrupted PEBs: 0
[    4.073926] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[    4.080261] ubi0: max/mean erase counter: 5/2, WL threshold: 4096, image sequence number: 748796315
[    4.087302] ubi0: available PEBs: 748, total reserved PEBs: 24, PEBs reserved for bad PEB handling: 20
[    4.096184] hctosys: unable to open rtc device (rtc0)
[    4.096²[    4.112784] /dev/root: Can't open blockdev
[    4.112805] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    4.115761] Please append a correct "root=" boot option; here are the available partitions:
[    4.123417] 1f00           12800 mtdblock0 
[    4.123419]  (driver?)
[    4.135639] 1f01            5120 mtdblock1 
[    4.135642]  (driver?)
[    4.142150] 1f02             512 mtdblock2 
[    4.142153]  (driver?)
[    4.148705] 1f03            1280 mtdblock3 
[    4.148708]  (driver?)
[    4.155169] 1f04            1280 mtdblock4 
[    4.155172]  (driver?)
[    4.161681] 1f05            4096 mtdblock5 
[    4.161684]  (driver?)
[    4.168266] 1f06           98816 mtdblock6 
[    4.168268]  (driver?)
[    4.174701] 1f07            7168 mtdblock7 
[    4.174704]  (driver?)
[    4.181210] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    4.183663] CPU1: stopping
[    4.191903] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.4.85 #0
[    4.194586] Hardware name: Generic DT based system
[    4.200438] [<c030fd0c>] (unwind_backtrace) from [<c030bcd4>] (show_stack+0x14/0x20)
[    4.205290] [<c030bcd4>] (show_stack) from [<c08c25a0>] (dump_stack+0x90/0xa4)
[    4.213185] [<c08c25a0>] (dump_stack) from [<c030ef44>] (handle_IPI+0x184/0x1b8)
[    4.220216] [<c030ef44>] (handle_IPI) from [<c05af734>] (gic_handle_irq+0xb4/0xb8)
[    4.227766] [<c05af734>] (gic_handle_irq) from [<c0301a8c>] (__irq_svc+0x6c/0x90)
[    4.235132] Exception stack(0xdd46bf10 to 0xdd46bf58)
[    4.242697] bf00:                                     00000000 00000000 1ced4000 dda16c40
[    4.247748] bf20: dd7dac00 00000000 dda15ff0 00000000 00000000 f95d7420 f8fa6b00 dd46bfb8
[    4.255901] bf40: 00049980 dd46bf60 c07009fc c0700a00 80000013 ffffffff
[    4.264064] [<c0301a8c>] (__irq_svc) from [<c0700a00>] (cpuidle_enter_state+0x98/0x4c8)
[    4.270483] [<c0700a00>] (cpuidle_enter_state) from [<c0700e80>] (cpuidle_enter+0x3c/0x5c)
[    4.278468] [<c0700e80>] (cpuidle_enter) from [<c034bf18>] (do_idle+0x1d0/0x250)
[    4.286792] [<c034bf18>] (do_idle) from [<c034c240>] (cpu_startup_entry+0x1c/0x20)
[    4.294343] [<c034c240>] (cpu_startup_entry) from [<4230248c>] (0x4230248c)
[    4.301715] Rebooting in 1 seconds..
9

if you can interact with the console, stop the automaic boot, and do a printenv (?), to see all the u-boot params.

on stock FW root=/dev/mtdblock6, according to the boot log in the wiki.

10

It appears I can interact. I got this

(IPQ) # printenv

baudrate=115200
bootargs=console=ttyHSL1,115200n8
bootcmd=sleep 2;   nmrp;  if loadn_dniimg 0 0x1480000 0x44000000 && chk_dniimg 0x44000000; then bootipq2; else fw_recovery; fi
bootdelay=2
eth1addr=9c:3d:cf:e0:6c:e6
ethact=eth0
ethaddr=9c:3d:cf:e0:6c:e7
ipaddr=192.168.1.1
loadaddr=0x42000000
machid=136c
modelid=R7800
serverip=192.168.1.10
stderr=serial
stdin=serial
stdout=serial
updateloader=ipq_nand linux && nand erase 0x01180000 0x00080000 && imgaddr=0x42000000 && source $imgaddr:script

Environment size: 527/262140 bytes
(IPQ) #
11

The good news, the bootloader seems to be intact (I'm not sure about the validity of the bootloader environment/ printenv, as I don't own this device myself) and you should be able to tftpboot an initramfs image or write a new image via tftp.

12

you could try to add root=/dev/mtdblock6 to the bootargs variable.

bootargs=console=ttyHSL1,115200n8 root=/dev/mtdblock6

13

so im looking at the available commands now, specifically im thinking I would use the fw_recovery with a default netgear OEM image. Do you think thats right ? Thank you again for your replies, I appreciate it....really do and i totally understand if things go tits up its not your fault..

14

@frollic thanks but I have no idea how to set that :frowning:

15

I would try to find documented r7800 printenv output on the web first, to compare it with what you have. And then test an OpenWrt initramfs (tftpboot) image - just loading to RAM, not touching the flash.

16

there's a setenv command in uboot, AND a help command :slight_smile:

don't forget to saveenv, or the change(s) won't survive a reboot

the commands are taken from memory, and might not be 100% correct.

make a c&p of the current env, before you start playing around with it.

17

Thank you...Ill try

18

Thank you...reading time for me

19

Thank you both..I managed to tftp the netgear oem image over which then allowed me to use the recovery procedure correctly. Without your help it was heading for the trash.
Thanks again

1 Like
20

You managed to download the broken openwrt build, it was up only for a few hours until somone reported boot failure on all openwrt trunk builds for ipq. The commit that was supposed to add support for a new unit was broken and quickly rolled back und new builds uploaded.

2 Likes