R7800 with corrupted firmware image and faulty LAN. Gosh

Installing and Using OpenWrt
1

Hello dear community members.
I made a big mistake. I bought a brocken R7800, with unresponsive LAN ports and working wifi.
I immediately realized the router has problems. The switch was behaving strangely. Things were a bit better without WAN cable inserted, but now it has escalated rapidly.

Actual condition:
The only working interface right now is the serial console.
I corrupted the firmware
Lan ports are faulty
There are possibly bad blocks in the nand memory.

Can someone tell me what are the commands to launch in the uboot console to flash a firmware through console?
TFTP is not working unfortunately. As the LAN ports are faulty, the router does not respond to my tftp client.

IMG_20220218_151547
IMG_20220218_1515471920×885 166 KB

I aknowledge my stupidity, but hope someone in this forum of smart people can lead me to the recovery of this router.

I will cross my fingers, provide info if asked and wait for your suggestions.

Sincerely,
Gabriel

2

what options have your uboot got ?

3

Hello frolic, thanks a lot for your interest.

You mean by tipping printenv ?

4

nah, just plain help output.

5 
U-Boot 2012.07 [local,local] (Sep 03 2015 - 17:33:28)

U-boot 2012.07 dni1 V0.4 for DNI HW ID: 29764958 NOR flash 0MB; NAND flash 128MB; RAM 512MB; 1st Radio 4x4; 2nd Radio 4x4; Cascade
smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  SF: Unsupported manufacturer 00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
128 MiB
MMC:
*** Warning - bad CRC, using default environment

PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
 131072 bytes read: OK
MMC Device 0 not found
cdp: get part failed for 0:HLOS
Net:   MAC1 addr:b0:39:56:97:cb:c4
athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init  done
MAC2 addr:b0:39:56:97:cb:c3
eth0, eth1
Hit any key to stop autoboot:  0
(IPQ) # help
?       - alias for 'help'
ar8xxx_dump- Dump ar8xxx registers
base    - print or set address offset
board_hw_id_set- Set board_hw_id
board_hw_id_show- Show board_hw_id
board_model_id_set- Set board_model_id
board_model_id_show- Show board_model_id
board_parameters_set- Set WPS PIN code, Serial number, SSID, Passphrase, MAC address
board_parameters_show- Show WPS PIN code, Serial number, SSID, Passphrase, MAC address.
board_passphrase_set- Set passphrase on board
board_passphrase_show- Show board_passphrase
board_ssid_set- Set ssid on board
board_ssid_show- Show board_ssid
bootipq - bootipq from flash device
bootipq2- bootipq2 from flash device
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bootz   - boot Linux zImage image from memory
button_test- Test buttons
chk_dniimg- check integrity of dni firmware image.
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
env     - environment handling commands
ethspeed- Force ethernet speed to 10/100/autoneg
exit    - exit script
false   - do nothing, unsuccessfully
fdt     - flattened device tree utility commands
fw_recovery- start tftp server to recovery dni firmware image.
go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
iminfo  - print header information for application image
imxtract- extract a part of a multi-image
ipq_nand- Switch between SBL and Linux kernel page layout.
ledctl  - Test LEDs
loadn_dniimg- load dni firmware image from NAND.
loop    - infinite loop on address range
macset  - Set ethernet MAC address
macshow - Show ethernet MAC addresses
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
nmrp    - start nmrp mechanism to upgrade firmware-image or string-table.
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
rnset   - set region number
rnshow  - Show Region Number on Board
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sleep   - delay execution for some time
smeminfo- print SMEM FLASH information
snset   - Set serial number
source  - run script from memory
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
true    - do nothing, successfully
ubi     - ubi commands
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
wpspinset- Set wpspin number
(IPQ) #
6

seems u-boot might have the usb functionality intact, you should try those ....

7

You have all my curiosity, but I'm not sure I understand what you mean.

I might be able to flash a rom (say, Voxel's e.g.) by plugging a thumb drive in the USB port?
What would be the command to launch?

8

well, if not flash - you said the NAND might be bad, then perhaps at least boot from it.

trial and error unfortnately, but you can always try help usbboot and help usb.

check out the links in How can I boot from usb and mount rootfiles on usb? to the doozan forum.

Doozan's a gold mine for u-boot stuff, but they also use newer versions of it, some
functionality they use/describe will not be available to you.

this might be useful Netgear R7800 exploration (IPQ8065, QCA9984) - #1651 by wulfy23
@anon50098793 do you still have those USB boot files ------^ available somewhere ?

9

This defenitely looks like a road to the solution, but I'm really not comfortable with myself deploying all these steps, as basically I have to run an image that I don't know how to make via USB storage, and then try to flash a new image on the nand using telnet or SSH, am I right?

Alternatively, does someone know if it is possible to flash the nand from serial connection?
I once did it, but on a different device with a useful script saved in the env...
It was as simple as run fl or someting similar...but here there is no flash script.

10

possibly and at the same time... a struggle to find...

afaik that was wayyy back probably pre 5.4-ish days... as nobody took me up on the offer... afaik most people didn't have (or know how to use) usb boot from their uboot...

depending on what the goal is... an initramfs would do the job... what the those images I made had build in were in-kernel usb drivers... so you can hop to or read/write to the usb drive easily...

not too difficult to make a new one up suppose, you can add all the usb packages into your initramfs anyway...

11

I wouldn't call it a solution, but at least a bridge head.
you have to be able to boot something, and take if from there.

pretty sure serial flashing will only work, if uboot is capable of receiving an image through serial port.

thank you for replying, @anon50098793, we need something that will boot from a USB flash drive, since the LAN ports appear to be dead.

We got serial access, so I guess any initramfs using the same SoC would do .... ?

1 Like
12

on my board the uboot has all the proper usb 'load' commands...

afaik on the netgear only 'usbboot' is available... so just spin up an initramfs, place it on a correct filesystem, then using uboot... try it me thinks...

if you get that working... you can put what you want to write in 'files' or add usb packages to your initramfs...

yeah, the initramfs does not 'need' usb support... it relies on uboot and just fires from ram... the 'kernel+usb' is just handy when you need another spot to save stuff (like if network is truly broken)

1 Like
13

Correct. Anything involving TFTP desappears in a deaf dark sea. Wifi interfaces were "kind of" working, before I bricked it. Now only TTL and other interfaces are usable.

14

thanks,

I don't suppose you've got any of those lying around, do you ?
would save OP a lot of time, and skip another steep up hill in the learning curve :wink:

2 Likes
15

I swear I'm trying to be with you, but I must admit I have waaaaaaaay less knowledge.
(besides having intentionally bought a faulty device, I must be quite stupid indeed...)

This is looking very promising, but very steep learning curve is needed, given that I barely know what is an initramfs! :sweat_smile:

16

2am here so my brain is a bit fried... lemme read through this tommorrow an i'll compile something for you if still needed or can't find my old image/s...

here is a huge current one for my board that I have laying around... might be enough for the op to play with loading commands...

2 Likes
17

Don't be to hard on yourself, buying stuff sold as faulty is a gamble, sometimes you
strike gold, sometimes you become an owner of a high tech paper weight.

I recently bought a router based on the pic below.

image
image579×522 72.9 KB

but it was what I was looking for - an used Archer C2600 :wink:

it's a gamble, sometimes it pays off, sometimes it doesn't.

(comparing the text on the pic with photos of the original packaging of the
C2600 convinced me)

Back to the topic, don't blindly run any of the commands from doozans, you
should use the information/instructions/posts as reference on how and what
can be done via the usb subsystem of uboot.

18

thanks wulfy23.

@bright_plastik grab the image, put it on a FAT32 formatted flash drive, and start playing around with the usb boot subsystem.
make sure you try both USB ports, if the flash drive isn't detected.

19

yeah... most uboot you want to see if there is a;

usb start

ext4load
fatload
ext2load

if they dont work then you are stuck with usbboot which I am not that familiar with but it looked very simple... similar to tftpboot... just not sure of filesystem...

1 Like
20

Whoohooo! This looks promising, doesn't it?

(IPQ) # usb help
USB is stopped. Please issue 'usb start' first.
(IPQ) # usb start
(Re)start USB...
USB0:   Register 2000240 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus 0 for devices... 1 USB Device(s) found
USB1:   Register 2000240 NbrPorts 2
Starting the controller
USB XHCI 1.00
scanning bus 1 for devices... 1 USB Device(s) found
       scanning usb for storage devices... 0 Storage Device(s) found

Looking forward for tomorrow @anon50098793 , hoping you can pass me an image to run on USB...but meanwhile, have a good rest.

edit:

(IPQ) # ext4load
Unknown command 'ext4load' - try 'help'
(IPQ) # fatload
Unknown command 'fatload' - try 'help'
(IPQ) # ext2load
Unknown command 'ext2load' - try 'help'
(IPQ) #
1 Like