R7800 with corrupted firmware image and faulty LAN. Gosh

[hnyman]

@bright_plastik

but it still complains about this:

@bright_plastik

mtdparts variable not set, see 'help mtdparts'
no partitions defined

That looks normal with r7800

See a normal serial boot log from year 2017...

https://gist.github.com/hnyman/8a68f6280ef5d267bba2ee80601fe8f0

[bright_plastik]

@hnyman

That looks normal with r7800

Ah. Yes indeed. It is identical. So absence of mtd parts in uboot is not a problem. Once kernel loads it should be able to locate the partitions. Mine does not.
@sumo a mtdparts log is not required, as the uboot log posted by @hnyman is equal to mine. Thanks anyway. I revert to your method now.
The test procedure goes like this now:

• Already flashed latest OEM firmware from Netgear. Version 1.0.2.90

• Will flash Openwrt "factory" firmware Version 19.07.9 on top of OEM, so we have same level of USB boot uImage you gave me (that is the only thing that works )

• Try and see if it loads (but think not)

• will do a simple sysupgrade and see what happens

• report back to you...

[anon50098793]

@bright_plastik

should be able to locate the partitions. Mine does not.

i dont see evidence of this...

edit my bad just saw this now..

@bright_plastik

[   16.407482] 8 fixed-partitions partitions found on MTD device qcom_nand.0
[   16.414846] Creating 8 MTD partitions on "qcom_nand.0":
[   16.421636] 0x000000000000-0x000000c80000 : "qcadata"
[   21.422804] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!
[   21.422836] qcom-nandc 1ac00000.nand-controller: failed to copy last codeword
[   26.422797] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!

@bright_plastik

Try and see if it loads (but think not)

you NEED a custom image with firewall disabled / ssh / http on wan (well wan port in lan brige is better) in case it is just your lan that's fried... (well you technically can load that from usb now )

edit: by the looks of things you CAN tftp images now... and as you mentioned sysupgrading... I think i'm lost with where you are at...

[sumo]

@bright_plastik

   Image Name:   Linux-3.4.103

I really do not understand why you keep going back and forth to some random image(s). I won't be able to help you with any of this.

@bright_plastik

I think manually setting the mtd partitions might even solve the problem!

No, I think that error is/was always there on that ancient vendor U-Boot.

@frollic

@sumo had 7800, he should be able to post his printenv.

Yep, sorry, had to dig it out of the e-waste junkyard again. Here you go:

U-Boot 2012.07 [local,local] (Sep 03 2015 - 17:33:28)

U-boot 2012.07 dni1 V0.4 for DNI HW ID: 29764958 NOR flash 0MB; NAND flash 128MB; RAM 512MB; 1st Radio 4x4; 2nd Radio 4x4; Cascade
smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  SF: Unsupported manufacturer 00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
128 MiB
MMC:
*** Warning - bad CRC, using default environment

PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
 131072 bytes read: OK
MMC Device 0 not found
cdp: get part failed for 0:HLOS
Net:   MAC1 addr:b0:7f:b9:3e:41:36
athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init  done
MAC2 addr:b0:7f:b9:3e:41:35
eth0, eth1
Hit any key to stop autoboot:  0
(IPQ) # pri
baudrate=115200
bootargs=console=ttyHSL1,115200n8
bootcmd=sleep 2;   nmrp;  if loadn_dniimg 0 0x1480000 0x44000000 && chk_dniimg 0x44000000; then bootipq2; else fw_recovery; fi
bootdelay=2
eth1addr=b0:7f:b9:3e:41:35
ethact=eth0
ethaddr=b0:7f:b9:3e:41:36
ipaddr=192.168.1.1
loadaddr=0x42000000
machid=136c
modelid=R7800
serverip=192.168.1.10
stderr=serial
stdin=serial
stdout=serial
updateloader=ipq_nand linux && nand erase 0x01180000 0x00080000 && imgaddr=0x42000000 && source $imgaddr:script

Environment size: 527/262140 bytes
(IPQ) #

[bright_plastik]

@sumo

you keep going back and forth to some random image(s)

The one you are seeing now is the latest OEM firmware, as it made sense to me what hnyman said: if NAND is scrambled, an OEM image might set up the scrambled partitions with its padding.

I will flash 19.07.9 factory on top of the OEM, and follow your indications now.
Will report back.

@anon50098793

I think i'm lost with where you are at...

@anon50098793 , ATM two things are kind of working:

1. nmrp flash method, using the comfy command available in UBoot. I found out it searches thoroughly, till it finds my pc connected on the WAN port instead of one of LAN (they're all dead). I am now accustomed with this method.

2. @sumo method is working as well. I can load the system from USB, and from there I can launch a sysupgrade, but I'm less familiar with it, as the number of commands before issuing the sysupgrade one are quite a lot, and the whole procedure relays on the presence of internet connection, which is flacky because of faulty ports.

[hnyman]

@bright_plastik

made sense to me what hnyman said: if NAND is scrambled, an OEM image might set up the scrambled partitions with its padding.

I was actually talking about the OpenWrt factory image...
(Not sysupgrade, but the factory image that is meant for initial install from OEM)
That might initialize the UBI part that is after kernel and contains rootfs.

But looking at all the logs and your attempts, I think that your device is pretty much a lost cause.

[bright_plastik]

@hnyman

I was actually talking about the OpenWrt factory image...
(Not sysupgrade, but the factory image that is meant for initial install from OEM)
That might initialize the UBI part that is after kernel and contains rootfs.

this is the serial log just after flashing owrt factory image version 19.07.9

(IPQ) # nmrp
Mac2 unit failed

 Client starts...[Listening] for ADVERTISE...
NMRP CONFIGING
Recv FW-UP option

No ST-UP option

NMRP WAITING FOR UPLOAD FIRMWARE or STRING TABLES!
Mac2 unit failed
Listening on Port : 69, IP Address: 10.164.183.252 ...

waiting nmrp server to upload firmware!
TMac2 unit failed
Listening on Port : 69, IP Address: 10.164.183.252 ...
TMac2 unit failed
Listening on Port : 69, IP Address: 10.164.183.252 ...
TMac2 unit failed
Listening on Port : 69, IP Address: 10.164.183.252 ...
TMac2 unit failed
Listening on Port : 69, IP Address: 10.164.183.252 ...

 retry tftp_upload count exceeded;
T
Rcv:
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        .................................................................
        ..............
Done!
Bytes transferred = 8388737 (800081 hex)
TFTP upload done
Ignore Magic number checking when upgrade via NMRP,Magic number is 27051956!
 131072 bytes read: OK
HW ID on board: 29764958+0+128+512+4x4+4x4+cascade
HW ID on image: 29764958+0+128+512+4x4+4x4+cascade
Firmware Image HW ID matched Board HW ID

Erasing: off 1480000, size 20000
Erasing at 0x1480000 -- 100% complete. Cleanmarker written at 0x1480000.
OK
Writing: from RAM addr 42000080, to NAND off 1480000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 14a0000, size 20000
Erasing at 0x14a0000 -- 100% complete. Cleanmarker written at 0x14a0000.
OK
Writing: from RAM addr 42020080, to NAND off 14a0000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 14c0000, size 20000
Erasing at 0x14c0000 -- 100% complete. Cleanmarker written at 0x14c0000.
OK
Writing: from RAM addr 42040080, to NAND off 14c0000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 14e0000, size 20000
Erasing at 0x14e0000 -- 100% complete. Cleanmarker written at 0x14e0000.
OK
Writing: from RAM addr 42060080, to NAND off 14e0000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 1500000, size 20000
Erasing at 0x1500000 -- 100% complete. Cleanmarker written at 0x1500000.
OK
Writing: from RAM addr 42080080, to NAND off 1500000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 1520000, size 20000
Erasing at 0x1520000 -- 100% complete. Cleanmarker written at 0x1520000.
OK
Writing: from RAM addr 420a0080, to NAND off 1520000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 1540000, size 20000
Erasing at 0x1540000 -- 100% complete. Cleanmarker written at 0x1540000.
OK
Writing: from RAM addr 420c0080, to NAND off 1540000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 1560000, size 20000
Erasing at 0x1560000 -- 100% complete. Cleanmarker written at 0x1560000.
OK
Writing: from RAM addr 420e0080, to NAND off 1560000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 1580000, size 20000
Erasing at 0x1580000 -- 100% complete. Cleanmarker written at 0x1580000.
OK
Writing: from RAM addr 42100080, to NAND off 1580000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 15a0000, size 20000
Erasing at 0x15a0000 -- 100% complete. Cleanmarker written at 0x15a0000.
OK
Writing: from RAM addr 42120080, to NAND off 15a0000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 15c0000, size 20000
Erasing at 0x15c0000 -- 100% complete. Cleanmarker written at 0x15c0000.
OK
Writing: from RAM addr 42140080, to NAND off 15c0000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 15e0000, size 20000
Erasing at 0x15e0000 -- 100% complete. Cleanmarker written at 0x15e0000.
OK
Writing: from RAM addr 42160080, to NAND off 15e0000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 1600000, size 20000
Erasing at 0x1600000 -- 100% complete. Cleanmarker written at 0x1600000.
OK
Writing: from RAM addr 42180080, to NAND off 1600000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 1620000, size 20000
Erasing at 0x1620000 -- 100% complete. Cleanmarker written at 0x1620000.
OK
Writing: from RAM addr 421a0080, to NAND off 1620000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 1640000, size 20000
Erasing at 0x1640000 -- 100% complete. Cleanmarker written at 0x1640000.
OK
Writing: from RAM addr 421c0080, to NAND off 1640000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 1660000, size 20000
Erasing at 0x1660000 -- 100% complete. Cleanmarker written at 0x1660000.
OK
Writing: from RAM addr 421e0080, to NAND off 1660000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 1680000, size 20000
Erasing at 0x1680000 -- 100% complete. Cleanmarker written at 0x1680000.
OK
Writing: from RAM addr 42200080, to NAND off 1680000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 16a0000, size 20000
Erasing at 0x16a0000 -- 100% complete. Cleanmarker written at 0x16a0000.
OK
Writing: from RAM addr 42220080, to NAND off 16a0000, size 20000
 131072 bytes written: OK
Alive-timer 15
Erasing: off 16c0000, size 20000
Erasing at 0x16c0000 -- 100% complete. Cleanmarker written at 0x16c0000.
OK
Writing: from RAM addr 42240080, to NAND off 16c0000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 16e0000, size 20000
Erasing at 0x16e0000 -- 100% complete. Cleanmarker written at 0x16e0000.
OK
Writing: from RAM addr 42260080, to NAND off 16e0000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1700000, size 20000
Erasing at 0x1700000 -- 100% complete. Cleanmarker written at 0x1700000.
OK
Writing: from RAM addr 42280080, to NAND off 1700000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1720000, size 20000
Erasing at 0x1720000 -- 100% complete. Cleanmarker written at 0x1720000.
OK
Writing: from RAM addr 422a0080, to NAND off 1720000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1740000, size 20000
Erasing at 0x1740000 -- 100% complete. Cleanmarker written at 0x1740000.
OK
Writing: from RAM addr 422c0080, to NAND off 1740000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1760000, size 20000
Erasing at 0x1760000 -- 100% complete. Cleanmarker written at 0x1760000.
OK
Writing: from RAM addr 422e0080, to NAND off 1760000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1780000, size 20000
Erasing at 0x1780000 -- 100% complete. Cleanmarker written at 0x1780000.
OK
Writing: from RAM addr 42300080, to NAND off 1780000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 17a0000, size 20000
Erasing at 0x17a0000 -- 100% complete. Cleanmarker written at 0x17a0000.
OK
Writing: from RAM addr 42320080, to NAND off 17a0000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 17c0000, size 20000
Erasing at 0x17c0000 -- 100% complete. Cleanmarker written at 0x17c0000.
OK
Writing: from RAM addr 42340080, to NAND off 17c0000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 17e0000, size 20000
Erasing at 0x17e0000 -- 100% complete. Cleanmarker written at 0x17e0000.
OK
Writing: from RAM addr 42360080, to NAND off 17e0000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1800000, size 20000
Erasing at 0x1800000 -- 100% complete. Cleanmarker written at 0x1800000.
OK
Writing: from RAM addr 42380080, to NAND off 1800000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1820000, size 20000
Erasing at 0x1820000 -- 100% complete. Cleanmarker written at 0x1820000.
OK
Writing: from RAM addr 423a0080, to NAND off 1820000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1840000, size 20000
Erasing at 0x1840000 -- 100% complete. Cleanmarker written at 0x1840000.
OK
Writing: from RAM addr 423c0080, to NAND off 1840000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1860000, size 20000
Erasing at 0x1860000 -- 100% complete. Cleanmarker written at 0x1860000.
OK
Writing: from RAM addr 423e0080, to NAND off 1860000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1880000, size 20000
Erasing at 0x1880000 -- 100% complete. Cleanmarker written at 0x1880000.
OK
Writing: from RAM addr 42400080, to NAND off 1880000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 18a0000, size 20000
Erasing at 0x18a0000 -- 100% complete. Cleanmarker written at 0x18a0000.
OK
Writing: from RAM addr 42420080, to NAND off 18a0000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 18c0000, size 20000
Erasing at 0x18c0000 -- 100% complete. Cleanmarker written at 0x18c0000.
OK
Writing: from RAM addr 42440080, to NAND off 18c0000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 18e0000, size 20000
Erasing at 0x18e0000 -- 100% complete. Cleanmarker written at 0x18e0000.
OK
Writing: from RAM addr 42460080, to NAND off 18e0000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1900000, size 20000
Erasing at 0x1900000 -- 100% complete. Cleanmarker written at 0x1900000.
OK
Writing: from RAM addr 42480080, to NAND off 1900000, size 20000
 131072 bytes written: OK
Alive-timer 16
Erasing: off 1920000, size 20000
Erasing at 0x1920000 -- 100% complete. Cleanmarker written at 0x1920000.
OK
Writing: from RAM addr 424a0080, to NAND off 1920000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1940000, size 20000
Erasing at 0x1940000 -- 100% complete. Cleanmarker written at 0x1940000.
OK
Writing: from RAM addr 424c0080, to NAND off 1940000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1960000, size 20000
Erasing at 0x1960000 -- 100% complete. Cleanmarker written at 0x1960000.
OK
Writing: from RAM addr 424e0080, to NAND off 1960000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1980000, size 20000
Erasing at 0x1980000 -- 100% complete. Cleanmarker written at 0x1980000.
OK
Writing: from RAM addr 42500080, to NAND off 1980000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 19a0000, size 20000
Erasing at 0x19a0000 -- 100% complete. Cleanmarker written at 0x19a0000.
OK
Writing: from RAM addr 42520080, to NAND off 19a0000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 19c0000, size 20000
Erasing at 0x19c0000 -- 100% complete. Cleanmarker written at 0x19c0000.
OK
Writing: from RAM addr 42540080, to NAND off 19c0000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 19e0000, size 20000
Erasing at 0x19e0000 -- 100% complete. Cleanmarker written at 0x19e0000.
OK
Writing: from RAM addr 42560080, to NAND off 19e0000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1a00000, size 20000
Erasing at 0x1a00000 -- 100% complete. Cleanmarker written at 0x1a00000.
OK
Writing: from RAM addr 42580080, to NAND off 1a00000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1a20000, size 20000
Erasing at 0x1a20000 -- 100% complete. Cleanmarker written at 0x1a20000.
OK
Writing: from RAM addr 425a0080, to NAND off 1a20000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1a40000, size 20000
Erasing at 0x1a40000 -- 100% complete. Cleanmarker written at 0x1a40000.
OK
Writing: from RAM addr 425c0080, to NAND off 1a40000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1a60000, size 20000
Erasing at 0x1a60000 -- 100% complete. Cleanmarker written at 0x1a60000.
OK
Writing: from RAM addr 425e0080, to NAND off 1a60000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1a80000, size 20000
Erasing at 0x1a80000 -- 100% complete. Cleanmarker written at 0x1a80000.
OK
Writing: from RAM addr 42600080, to NAND off 1a80000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1aa0000, size 20000
Erasing at 0x1aa0000 -- 100% complete. Cleanmarker written at 0x1aa0000.
OK
Writing: from RAM addr 42620080, to NAND off 1aa0000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1ac0000, size 20000
Erasing at 0x1ac0000 -- 100% complete. Cleanmarker written at 0x1ac0000.
OK
Writing: from RAM addr 42640080, to NAND off 1ac0000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1ae0000, size 20000
Erasing at 0x1ae0000 -- 100% complete. Cleanmarker written at 0x1ae0000.
OK
Writing: from RAM addr 42660080, to NAND off 1ae0000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1b00000, size 20000
Erasing at 0x1b00000 -- 100% complete. Cleanmarker written at 0x1b00000.
OK
Writing: from RAM addr 42680080, to NAND off 1b00000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1b20000, size 20000
Erasing at 0x1b20000 -- 100% complete. Cleanmarker written at 0x1b20000.
OK
Writing: from RAM addr 426a0080, to NAND off 1b20000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1b40000, size 20000
Erasing at 0x1b40000 -- 100% complete. Cleanmarker written at 0x1b40000.
OK
Writing: from RAM addr 426c0080, to NAND off 1b40000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1b60000, size 20000
Erasing at 0x1b60000 -- 100% complete. Cleanmarker written at 0x1b60000.
OK
Writing: from RAM addr 426e0080, to NAND off 1b60000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1b80000, size 20000
Erasing at 0x1b80000 -- 100% complete. Cleanmarker written at 0x1b80000.
OK
Writing: from RAM addr 42700080, to NAND off 1b80000, size 20000
 131072 bytes written: OK
Alive-timer 17
Erasing: off 1ba0000, size 20000
Erasing at 0x1ba0000 -- 100% complete. Cleanmarker written at 0x1ba0000.
OK
Writing: from RAM addr 42720080, to NAND off 1ba0000, size 20000
 131072 bytes written: OK
Alive-timer 18
Erasing: off 1bc0000, size 20000
Erasing at 0x1bc0000 -- 100% complete. Cleanmarker written at 0x1bc0000.
OK
Writing: from RAM addr 42740080, to NAND off 1bc0000, size 20000
 131072 bytes written: OK
Alive-timer 18
Erasing: off 1be0000, size 20000
Erasing at 0x1be0000 -- 100% complete. Cleanmarker written at 0x1be0000.
OK
Writing: from RAM addr 42760080, to NAND off 1be0000, size 20000
 131072 bytes written: OK
Alive-timer 18
Erasing: off 1c00000, size 20000
Erasing at 0x1c00000 -- 100% complete. Cleanmarker written at 0x1c00000.
OK
Writing: from RAM addr 42780080, to NAND off 1c00000, size 20000
 131072 bytes written: OK
Alive-timer 18
Erasing: off 1c20000, size 20000
Erasing at 0x1c20000 -- 100% complete. Cleanmarker written at 0x1c20000.
OK
Writing: from RAM addr 427a0080, to NAND off 1c20000, size 20000
 131072 bytes written: OK
Alive-timer 18
Erasing: off 1c40000, size 20000
Erasing at 0x1c40000 -- 100% complete. Cleanmarker written at 0x1c40000.
OK
Writing: from RAM addr 427c0080, to NAND off 1c40000, size 20000
 131072 bytes written: OK
Alive-timer 18
Erasing: off 1c60000, size 20000
Erasing at 0x1c60000 -- 100% complete. Cleanmarker written at 0x1c60000.
OK
Writing: from RAM addr 427e0080, to NAND off 1c60000, size 20000
 131072 bytes written: OK
Alive-timer 18
Erasing: off 1c80000, size 20000
Erasing at 0x1c80000 -- 100% complete. Cleanmarker written at 0x1c80000.
OK
Writing: from RAM addr 42800080, to NAND off 1c80000, size 20000
 131072 bytes written: OK
Alive-timer 18
 131072 bytes read: OK
Original board MODEL ID: R7800
New MODEL ID from image: R7800
Updating MODEL ID
 131072 bytes read: OK
Erasing: off 1200000, size 20000
Erasing at 0x1200000 -- 100% complete. Cleanmarker written at 0x1200000.
OK
Writing: from RAM addr 5fe87ac4, to NAND off 1200000, size 20000
 131072 bytes written: OK
Alive-timer 18
done

NMRP Send Closing REQ

NMRP CLOSEDRestore to factory default
Erasing at 0x7e60000 -- 100% complete. Cleanmarker written at 0x7e60000.
nand erase OK

press ctrl+C to continue.....


U-Boot 2012.07 [local,local] (Sep 03 2015 - 17:33:28)

U-boot 2012.07 dni1 V0.4 for DNI HW ID: 29764958 NOR flash 0MB; NAND flash 128MB; RAM 512MB; 1st Radio 4x4; 2nd Radio 4x4; Cascade
smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  SF: Unsupported manufacturer 00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
128 MiB
MMC:
*** Warning - bad CRC, using default environment

PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
 131072 bytes read: OK
MMC Device 0 not found
cdp: get part failed for 0:HLOS
Net:   MAC1 addr:b0:39:56:97:cb:c4
athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init  done
MAC2 addr:b0:39:56:97:cb:c3
eth0, eth1
Hit any key to stop autoboot:  0
Mac2 unit failed

 Client starts...[Listening] for ADVERTISE...TTT
Retry count exceeded; boot the image as usual

 nmrp server is stopped or failed !

Loading from device 0: nand0 (offset 0x1480000)

** check kernel image **
   Verifying Checksum ... OK

** check rootfs image **
   Verifying Checksum ... OK
MMC Device 0 not found

Loading from nand0, offset 0x1480000
   Image Name:   ARM OpenWrt Linux-4.14.267
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2207891 Bytes = 2.1 MiB
   Load Address: 42208000
   Entry Point:  42208000
Automatic boot of image at addr 0x44000000 ...
   Image Name:   ARM OpenWrt Linux-4.14.267
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2207891 Bytes = 2.1 MiB
   Load Address: 42208000
   Entry Point:  42208000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
mtdparts variable not set, see 'help mtdparts'
no partitions defined

defaults:
mtdids  : nand0=msm_nand
mtdparts: none
info: "mtdparts" not set
Using machid 0x136c from environment

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.14.267 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11405-2a3558b0de)) #0 SMP Wed Feb 16 20:47:59 2022
[    0.000000] CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5787d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] OF: fdt: Machine model: Netgear Nighthawk X4S R7800
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] random: get_random_bytes called from 0xc09008e0 with crng_init=0
[    0.000000] percpu: Embedded 15 pages/cpu s29388 r8192 d23860 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 121920
[    0.000000] Kernel command line:
[    0.000000] Bootloader command line (ignored): console=ttyHSL1,115200n8
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Memory: 477376K/491520K available (4994K kernel code, 160K rwdata, 756K rodata, 1024K init, 235K bss, 14144K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xde800000 - 0xff800000   ( 528 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xde000000   ( 480 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0208000 - 0xc07e0820   (5987 kB)
[    0.000000]       .init : 0xc0900000 - 0xc0a00000   (1024 kB)
[    0.000000]       .data : 0xc0a00000 - 0xc0a28240   ( 161 kB)
[    0.000000]        .bss : 0xc0a2a000 - 0xc0a64e10   ( 236 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] clocksource: dg_timer: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 305801671480 ns
[    0.000007] sched_clock: 32 bits at 6MHz, resolution 160ns, wraps every 343597383600ns
[    0.000021] Switching to timer-based delay loop, resolution 160ns
[    0.000235] Calibrating delay loop (skipped), value calculated using timer frequency.. 12.50 BogoMIPS (lpj=62500)
[    0.000260] pid_max: default: 32768 minimum: 301
[    0.000379] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000397] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000972] CPU: Testing write buffer coherency: ok
[    0.001722] Setting up static identity map for 0x42300000 - 0x42300060
[    0.001879] Hierarchical SRCU implementation.
[    0.002604] smp: Bringing up secondary CPUs ...
[    0.004431] smp: Brought up 1 node, 2 CPUs
[    0.004450] SMP: Total of 2 processors activated (25.00 BogoMIPS).
[    0.004461] CPU: All CPU(s) started in SVC mode.
[    0.013665] VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
[    0.013826] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.013851] futex hash table entries: 512 (order: 3, 32768 bytes)
[    0.013945] pinctrl core: initialized pinctrl subsystem
[    0.014894] NET: Registered protocol family 16
[    0.015146] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.016381] cpuidle: using governor ladder
[    0.016447] cpuidle: using governor menu
[    0.038622] msm_bus_fabric_init_driver
[    0.039977] usbcore: registered new interface driver usbfs
[    0.040049] usbcore: registered new interface driver hub
[    0.040120] usbcore: registered new device driver usb
[    0.040176] pps_core: LinuxPPS API ver. 1 registered
[    0.040190] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.040221] PTP clock support registered
[    0.041946] clocksource: Switched to clocksource dg_timer
[    0.044929] NET: Registered protocol family 2
[    0.045088] IP idents hash table entries: 8192 (order: 4, 65536 bytes)
[    0.045782] TCP established hash table entries: 4096 (order: 2, 16384 bytes)
[    0.045823] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[    0.045877] TCP: Hash tables configured (established 4096 bind 4096)
[    0.045969] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.045996] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.046149] NET: Registered protocol family 1
[    0.047306] No memory allocated for crashlog
[    0.047601] workingset: timestamp_bits=30 max_order=17 bucket_order=0
[    0.051992] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.052011] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.058816] io scheduler noop registered
[    0.058835] io scheduler deadline registered (default)
[    0.060457] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda not found, using dummy regulator
[    0.060564] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_phy not found, using dummy regulator
[    0.060662] qcom-pcie 1b500000.pci: 1b500000.pci supply vdda_refclk not found, using dummy regulator
[    0.061439] OF: PCI: host bridge /soc/pci@1b500000 ranges:
[    0.061481] OF: PCI:    IO 0x0fe00000..0x0fefffff -> 0x0fe00000
[    0.061508] OF: PCI:   MEM 0x08000000..0x0fdfffff -> 0x08000000
[    0.169621] qcom-pcie 1b500000.pci: link up
[    0.169790] qcom-pcie 1b500000.pci: PCI host bridge to bus 0000:00
[    0.169815] pci_bus 0000:00: root bus resource [bus 00-ff]
[    0.169836] pci_bus 0000:00: root bus resource [io  0x0000-0xfffff] (bus address [0xfe00000-0xfefffff])
[    0.169854] pci_bus 0000:00: root bus resource [mem 0x08000000-0x0fdfffff]
[    0.170367] PCI: bus0: Fast back to back transfers disabled
[    0.172680] PCI: bus1: Fast back to back transfers disabled
[    0.172781] pci 0000:00:00.0: BAR 8: assigned [mem 0x08000000-0x081fffff]
[    0.172806] pci 0000:01:00.0: BAR 0: assigned [mem 0x08000000-0x081fffff 64bit]
[    0.172935] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    0.172960] pci 0000:00:00.0:   bridge window [mem 0x08000000-0x081fffff]
[    0.173487] pcieport 0000:00:00.0: AER enabled with IRQ 35
[    0.174011] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda not found, using dummy regulator
[    0.174122] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_phy not found, using dummy regulator
[    0.174213] qcom-pcie 1b700000.pci: 1b700000.pci supply vdda_refclk not found, using dummy regulator
[    0.174971] OF: PCI: host bridge /soc/pci@1b700000 ranges:
[    0.175010] OF: PCI:    IO 0x31e00000..0x31efffff -> 0x31e00000
[    0.175033] OF: PCI:   MEM 0x2e000000..0x31dfffff -> 0x2e000000
[    0.284829] qcom-pcie 1b700000.pci: link up
[    0.284967] qcom-pcie 1b700000.pci: PCI host bridge to bus 0001:00
[    0.284986] pci_bus 0001:00: root bus resource [bus 00-ff]
[    0.285002] pci_bus 0001:00: root bus resource [mem 0x2e000000-0x31dfffff]
[    0.285460] PCI: bus0: Fast back to back transfers disabled
[    0.287794] PCI: bus1: Fast back to back transfers disabled
[    0.287883] pci 0001:00:00.0: BAR 8: assigned [mem 0x2e000000-0x2e1fffff]
[    0.287906] pci 0001:01:00.0: BAR 0: assigned [mem 0x2e000000-0x2e1fffff 64bit]
[    0.288038] pci 0001:00:00.0: PCI bridge to [bus 01-ff]
[    0.288058] pci 0001:00:00.0:   bridge window [mem 0x2e000000-0x2e1fffff]
[    0.288537] pcieport 0001:00:00.0: AER enabled with IRQ 68
[    0.290878] L2 @ QSB rate. Forcing new rate.
[    0.291097] L2 @ 384000 KHz
[    0.291275] CPU0 @ 800000 KHz
[    0.291288] CPU1 @ QSB rate. Forcing new rate.
[    0.291416] CPU1 @ 384000 KHz
[    0.295324] gsbi 16300000.gsbi: GSBI port protocol: 6 crci: 0
[    0.297277] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.299665] msm_serial 16340000.serial: msm_serial: detected port #0
[    0.299770] msm_serial 16340000.serial: uartclk = 7372800
[    0.299857] 16340000.serial: ttyMSM0 at MMIO 0x16340000 (irq = 101, base_baud = 460800) is a MSM
[    0.299898] msm_serial: console setup on port #0
[    1.026235] console [ttyMSM0] enabled
[    1.030923] msm_serial: driver initialized
[    1.039269] loop: module loaded
[    6.032298] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!
[    6.032335] qcom-nandc 1ac00000.nand: failure submitting descs for command 236
[    6.037465] nand: Could not find valid ONFI parameter page; aborting
[   11.042284] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!
[   11.042317] qcom-nandc 1ac00000.nand: failure submitting descs for command 144
[   11.047365] nand: device found, Manufacturer ID: 0x01, Chip ID: 0xa1
[   11.054470] nand: AMD/Spansion NAND 128MiB 1,8V 8-bit
[   11.060898] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[   11.066032] 8 fixed-partitions partitions found on MTD device qcom_nand.0
[   11.073399] Creating 8 MTD partitions on "qcom_nand.0":
[   11.080174] 0x000000000000-0x000000c80000 : "qcadata"
[   16.082296] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!
[   16.082330] qcom-nandc 1ac00000.nand: failed to copy last codeword
[   21.082290] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!
[   21.082322] qcom-nandc 1ac00000.nand: failed to copy last codeword
[   26.082282] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!
[   26.082314] qcom-nandc 1ac00000.nand: failed to copy last codeword
[   31.082275] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!
[   31.082307] qcom-nandc 1ac00000.nand: failed to copy last codeword
[   36.082300] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!
[   36.082331] qcom-nandc 1ac00000.nand: failed to copy last codeword

Apart from the codeword error, the other strange message IMHO is this:

[    6.032298] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!
[    6.032335] qcom-nandc 1ac00000.nand: failure submitting descs for command 236
[    6.037465] nand: Could not find valid ONFI parameter page; aborting
[   11.042284] adm-dma-engine 18300000.dma: dma_sync_wait: timeout!
[   11.042317] qcom-nandc 1ac00000.nand: failure submitting descs for command 144

@sumo , should I run the board from USB as you taught me and flash latest sysupgrade image?

[sumo]

@bright_plastik

@sumo , should I run the board from USB as you taught me and flash latest sysupgrade image?

Question is whether or not that boots without any NAND failures. As long as the kernel has such low-level issues I don't believe you will get any much further. I might be able to send you a replacement NAND part. However, the tricky part will be how to get that sufficiently initialized so it will boot off of it again once soldered in.

[bright_plastik]

@sumo

it will boot off of it again

Do you think I can boot off a small usb drive setting it as default storage, instead of using the nand?
I'd be a happy man, if the WAN port could be turned into a LAN. Could still use this expensive device as personal cloud system, perhaps.

[sumo]

@bright_plastik

Do you think I can boot off a small usb drive setting it as default storage, instead of using the nand?

If by booting one means really the very first code the SoC is executing e.g. after it's on-chip boot ROM, then I doubt that can be changed. Likely U-Boot will always need to reside in NAND. Whether that vendor U-Boot allows setting a custom auto boot command is another question.

[bright_plastik]

The uboot loads everytime without any problem, apparently.
All considered, I would only need a way to shift all the owrt installation on a USB drive, like you showed me how, adding an automation to do it automagically.

1. the Netgear UBoot has quite a lot of options, mostly unknown to me, but possibly useful. Being guided, I can fidget with them.

2. UBoot resides in a chip that can be flashed as well with an improved version, isn't it? Has anyone ever made improvements on the R7800 UBoot?

[sumo]

@bright_plastik

UBoot resides in a chip that can be flashed as well with an improved version, isn't it?

I believe the R7800 has only one nonvolatile storage device being that very same NAND.

As for U-Boot, there is at least no mainline ipq806x U-Boot as of yet but googling you might find various more or less crappy vendor versions which have been extended/used for various occasions. Given no easy low-level recovery mechanism exists (besides maybe JTAG) playing with that is not that easy.

[bright_plastik]

@sumo

playing with that is not that easy

I'm aware none of these hassles I'm bothering you with are "easy"
I'll resign (re-sigh ) myself to buying another router and tweak it, but meanwhile I'm actively considering how to avoid considering this unfortunate box as a whole e-waste. The full speed USB 3.0 ports, the esata port, the dual core at 1.7Ghz...you know, it's not a flimsy hardware, afterall.

[skyblaster]

With the exception of OpenWrt not being able to find rootfs on ubiblock0_0, it looks like you were proceeding quite well up until the forced sysupgrade of OEM firmware in post #64

In posts #45 & 51, @sumo had the same problem of not being able to start the kernel that you do with the OEM kernel in post #74. Did you adjust the loadaddr accordingly?

Purely a guess based on "printenv", but it looks like it might be 0x42000000 instead of 0x44000000

I would focus on getting OEM firmware working first, then if successful, invoke a factory reset (it looks like nmrp might do that for you) before moving back to your OpenWrt uImage. Of course, you'll then want to ether TFTP a factory squashfs OpenWrt image or try a sysupgrade image.

[bright_plastik]

Hello @skyblaster. Thank you for your interest in the topic, really.
in addition to the multiple problems of this device, I'm wondering if this is not my case, too (taken from owrt wiki page) :

There are some models, which have broken NANDs. when flashing the Kernel, some (mostly one) blocks are skipped. As a result, the start of the root-partition (called “ubi” in this model) comes later.

Result: Bootloop of the device

What you can do is here, edit the file target/linux/ipq806x/files-x.x/arch/arm/boot/dts/qcom-ipq8065-r7800.dts and put the startAddress for “ubi” up. (&nand_controller –> nand@0 –> partitions –> ubi@1880000), currently(04.2020) at line 360 )

Edit the two numbers showing 1880000 to 18A0000. (skip 2 blocks)

Then compile the image using make.

I'm considering this because all images I flashed have problems finding the UBI partition. It's the only common behaviour I see.
Unfortunately I'm not accustomed with the imagebuild environment, but I can have a try.
Do you think building an image with the offset is worth the effort?

[sumo]

@bright_plastik

Do you think building an image with the offset is worth the effort?

Hm, interesting indeed. I'm currently skiing but I could probably get a build going for you in the evening so you could at least try whether it helps.

[hnyman]

@bright_plastik

Do you think building an image with the offset is worth the effort?

Not likely.

If there would be a bad block in the kernel area, it would be shown in the boot log and typically the device goes into a boot loop.

Loading from device 0: nand0 (offset 0x1480000)
Skipping bad block 0x014a0000

See examples in

R7800 -> Flashing openwrt causes bootloop (bad block in kernel area)

Hi guys Taken over here from Hynmans custom build thread. I tried to flash various openwrt versions to my new R7800 router. They all end in a bootloop. No matter what I flash, how I flash )web or tftp) it, I end up in this boot loop if its not the stock or Voxel's firmware. Comments from Hynman: Mac2 unit failed Mac1 unit failed ... Skipping bad block 0x014a0000 ... Skipping bad block 0x014a0000 ... [ 2.473589] UBI error: no valid UBI magic found inside mt⸮ [ 2.479930] VFS: Cannot ope…

Netgear R7800 -- cannot install OpenWrt, reboots (bad block in flash)

I have second hand Netgear R7800. It worked/works very well with stock firmware, no noticed issues. Then I tried to install Openwrt on it. It installed but it is constantly rebooting in loop. I can go back to original firmware and it is OK. But when I install Openwrt again it starts rebooting in loops. The log is below -- could you help/suggest next steps in diagnosing this one? Do you see anything suspicious from the log? U-Boot 2012.07 [local,local] (Sep 03 2015 - 17:33:28) U-boot 2012.07 dn…

[bright_plastik]

@sumo

I'm currently skiing but

May God blast me immediately if I keep on disturbing your life.
Enjoy your free, quality time. Let's procrastinate to a moment you are totally bored, and see.
As @hnyman noted, from the log messages the error is not skipping something but more of the nand controller is dumb
This is not encouraging. Another hint of deep fault.

@tmomas, thank you for the proper quoting...it's much more readable now!

[skyblaster]

Also from that wiki page:

Master, 19.07 and 18.06 have since Q2/2018 a larger kernel partition, so that kernel 4.14+ and flow offloading is possible. Additionally master, 19.07 and 18.06 currently use 70 MB larger area on flash, so installing more packages is possible. That change was made for master and 18.06 branches in June 2018.

Due to that, you will need TFTP flash once to upgrade/downgrade from the older builds (17.01.x or 18.06.0-rc1 or earlier). Sysupgrade works normally after you have upgraded to 18.06.0 or newer.

Have you tried flashing any 17.01.x images.....for science? The UBI layout was different back then.

ubi@1680000 {
	label = "ubi";
	reg = <0x1680000 0x1E00000>;
};

[sumo]

@bright_plastik

As @hnyman noted, from the log messages the error is not skipping something but more of the nand controller is dumb

Yeah, that's true. Rather points to a low-level issue. So question remains whether on NAND or SoC side.

Given me having the infrastructure to low-level access NAND flash using a 360-clip I might try whether that works on the R7800. Then I could send you a pre-programmed replacement part. As for those NAND parts I should have some such laying around somewhere. Anyway, I won't get to any of this until later next week.