[Solved] Bricked my netgear ex3800


#1

Hi,
unfortunatly i bricked my ex3800. The device doenst respond to ping. I cannot find a tftp (server) method. I have already tried the tftp client method, but the device seems to be in a boot loop. LAN connections drops every few seconds.
Any hint for me ?


#2

After furhter investigation i find out the follwing:
Power LED is lighting solid amber, which means the device is booting.
The TFTP Client cant work, because extender is in boot loop.
The ex3800 does not offer tftp server functionallity.
In the point of my view, the only possible way is unbricking with a serial connection.
I have read, that a can break the bootloop by entering "f" in serial connection.
But after then ?


#3
  • Did you make a configuration change that rendered your device un-accessible?
  • Did you have a bad firmware flash?
  • Why do you otherwise believe you bricked your router?

#4
  • No configuration change, today i tried to flash the router with the actual snapshot release. After reboot the device, i got a boot loop.
  • Firmware was build with the https://chef.libremesh.org/ builder
  • in my opinion the router is in a boot loop. I use a fixed IP on my laptop connected via cable to the router, every few seconds the interface goes down..
    The power led is lighting solid amper, which means the router is booting.
    Also ping is not possible, no telnet, ssh ...

EDIT:
I also tried to update my ARCHER C7 V2, same result, boot loop. A was able to rescue my Archer with TFTP Server method. It seems, that i have chooosen the wrong day for build a snapshot ...


#5

So this isn't OpenWrt related?

Perhaps you should report your issue here: https://github.com/libremesh/lime-packages/issues/new


#6

No it is openwrt related, you can choose between libremesh and openwrt. In the past time i have already used it with success ...

EDIT:
This is the result from the image builder i used in december ..
Firmware Version:
OpenWrt SNAPSHOT r8984-6ba58b7 / LuCI Master (git-19.005.67891-360a5a2)


#7

Then please create an image using the OpenWrt builder, or flash a pre-compiled release image from downloads.openwrt.org - and let us know your results.

Do you have a serial cable?


#8

Thats my plan, but in order to flash the device with a "official openwrt" build i need access to the device. I am not able to access the router via cable at least. That's the cause, why a i am saying, the device is bricked.

Yes i have a serial cable ..
I dont know the commands which i should use, after i established the serial connetion..


#9

What do you see when you connect it and hit 'f'?


#10

I have to do it, the i can report the results here.
OK, i will open the router now..


#11

To be clear:

  • You have a 3.3 Volt TTL cable
  • Do not connect VCC (+)
  • Connect TX-to-RX, RX-to-TX and GRD-to-GRD

You may not see the option to hit F, we need to know what you actually see.


#12

This is what i get:

enable ephy clock...done. rf reg 29 = 5

SSC disabled.

******************************

Software System Reset Occurred

******************************

spi_wait_nsec: 29 

spi device id: c2 20 17 c2 20 (2017c220)

find flash: MX25L6405D

flash info: size=0x800000, sector_size=0x10000, n_sectors=0x80

*** Warning - bad CRC, using default environment


============================================ 

Ralink UBoot Version: 4.2.1.0

EX3700 UBoot Version: v1.0.3

-------------------------------------------- 

ASIC 7620_MP (Port5<->None)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Nov 19 2014  Time:22:45:38

============================================ 

icache: sets:512, ways:4, linesz:32 ,total:65536

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 580 MHZ #### 

 estimate memory size =64 Mbytes


Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   7: Load Boot Loader code then write to Flash via Serial. 

   9: Load Boot Loader code then write to Flash via TFTP. 

 2  1  0 

   

3: System Boot system code via Flash.



 NetTxPacket = 0x83FE4CC0 


 KSEG1ADDR(NetTxPacket) = 0xA3FE4CC0 


 NetLoop,call eth_halt ! 


 NetLoop,call eth_init ! 

Trying Eth0 (10/100-M)


 Waitting for RX_DMA_BUSY status Start... done



 ETH_STATE_ACTIVE!! 

LAN MAC: CC:40:D0:19:DF:4C


[Listening] for ADVERTISE...

T3T3T3

Retry count exceeded; boot the image as usual

## Booting image at bc050000 ...

   Image Name:   MIPS OpenWrt Linux-4.14.98

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    1661358 Bytes =  1.6 MB

   Load Address: 80000000

   Entry Point:  80000000

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 80000000) ...

## Giving linux memsize in MB, 64


Starting kernel ...


[    0.000000] Linux version 4.14.98 (buildbot@6167ddb9a6c5) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r9293-e3311cb)) #0 Sat Feb 9 20:07:16 2019
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7620A ver:2 eco:6
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019650 (MIPS 24KEc)
[    0.000000] MIPS: machine is Netgear EX3700/EX3800
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x47c with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS0,57600 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0003efc0
[    0.000000] Readback ErrCtl register=0003efc0
[    0.000000] Memory: 59532K/65536K available (3873K kernel code, 182K rwdata, 900K rodata, 156K init, 214K bss, 6004K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksource: systick: mask: 0xffff max_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.000000] systick: running - mult: 214748, shift: 32
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000012] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.015480] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.087720] pid_max: default: 32768 minimum: 301
[    0.097131] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.110157] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.130477] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.149961] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.162133] pinctrl core: initialized pinctrl subsystem
[    0.173748] NET: Registered protocol family 16
[    0.443994] PCI host bridge /pcie@10140000 ranges:
[    0.453397]  MEM 0x0000000020000000..0x000000002fffffff
[    0.463770]   IO 0x0000000010160000..0x000000001016ffff
[    0.491446] rt2880_gpio 10000600.gpio: registering 24 gpios
[    0.502482] rt2880_gpio 10000600.gpio: registering 24 irq handlers
[    0.515057] rt2880_gpio 10000660.gpio: registering 32 gpios
[    0.526055] rt2880_gpio 10000660.gpio: registering 32 irq handlers
[    0.539169] PCI host bridge to bus 0000:00
[    0.547167] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.560886] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    0.572615] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.586113] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.603064] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.616123] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.629932] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    0.643434] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    0.657798] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.671307] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    0.685852] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    0.700198] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.710053] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    0.723565] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    0.742364] clocksource: Switched to clocksource systick
[    0.754030] NET: Registered protocol family 2
[    0.763590] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.777376] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.789962] TCP: Hash tables configured (established 1024 bind 1024)
[    0.802739] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.814259] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.826944] NET: Registered protocol family 1
[    0.838305] rt-timer 10000100.timer: maximum frequency is 1220Hz
[    0.851041] Crashlog allocated RAM at address 0x3f00000
[    0.863319] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[    0.882001] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.893502] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.923290] io scheduler noop registered
[    0.930933] io scheduler deadline registered (default)
[    0.942103] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.957645] console [ttyS0] disabled
[    0.964704] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 20, base_baud = 2500000) is a Palmchip BK-3103
[    0.984369] console [ttyS0] enabled
[    0.984369] console [ttyS0] enabled
[    0.998188] bootconsole [early0] disabled
[    0.998188] bootconsole [early0] disabled
[    1.014738] cacheinfo: Failed to find cpu0 device node
[    1.025019] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    1.044417] spi spi0.0: force spi mode3
[    1.052906] m25p80 spi0.0: mx25l6405d (8192 Kbytes)
[    1.062732] 6 fixed-partitions partitions found on MTD device spi0.0
[    1.075398] Creating 6 MTD partitions on "spi0.0":
[    1.084962] 0x000000000000-0x000000030000 : "u-boot"
[    1.095844] 0x000000030000-0x000000040000 : "config"
[    1.106683] 0x000000040000-0x000000050000 : "factory"
[    1.117696] 0x000000050000-0x0000007e0000 : "firmware"
[    1.131758] 2 uimage-fw partitions found on MTD device firmware
[    1.143631] Creating 2 MTD partitions on "firmware":
[    1.153542] 0x000000000000-0x0000001959ee : "kernel"
[    1.164356] 0x0000001959ee-0x000000790000 : "rootfs"
[    1.175128] mtd: device 5 (rootfs) set to be root filesystem
[    1.188053] 1 squashfs-split partitions found on MTD device rootfs
[    1.200443] 0x0000002b1000-0x000000790000 : "rootfs_data"
[    1.212129] 0x0000007e0000-0x0000007f0000 : "board_data"
[    1.223679] 0x0000007f0000-0x000000800000 : "nvram"
[    1.235157] libphy: Fixed MDIO Bus: probed
[    1.253235] gsw: setting port4 to ephy mode
[    1.261823] mtk_soc_eth 10100000.ethernet: loaded mt7620 driver
[    1.274334] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.291355] rt2880_wdt 10000120.watchdog: Initialized
[    1.302924] NET: Registered protocol family 10
[    1.315772] Segment Routing with IPv6
[    1.323260] NET: Registered protocol family 17
[    1.332157] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.358005] 8021q: 802.1Q VLAN Support v1.8
[    1.383932] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    1.398882] Freeing unused kernel memory: 156K
[    1.407769] This architecture does not have kernel memory protection.
[    1.447118] Kernel panic - not syncing: No working init found.  Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
[    1.476645] Rebooting in 1 seconds..



EX3700 UBoot v1.0.3


U-Boot 1.1.3 (Nov 19 2014 - 22:45:38)


Board: Ralink APSoC DRAM:  64 MB

RT2880_GPIOMODE_REG:0x1A311C

RT2880_GPIOMODE_REG:0x1A351C

Stack Pointer at: 83f52f98

relocate_code Pointer at: 83fb4000

enable ephy clock...done. rf reg 29 = 5

SSC disabled.

******************************

Software System Reset Occurred

******************************

spi_wait_nsec: 29 

spi device id: c2 20 17 c2 20 (2017c220)

find flash: MX25L6405D

flash info: size=0x800000, sector_size=0x10000, n_sectors=0x80

*** Warning - bad CRC, using default environment


============================================ 

Ralink UBoot Version: 4.2.1.0

EX3700 UBoot Version: v1.0.3

-------------------------------------------- 

ASIC 7620_MP (Port5<->None)

DRAM component: 512 Mbits DDR, width 16

DRAM bus: 16 bit

Total memory: 64 MBytes

Flash component: SPI Flash

Date:Nov 19 2014  Time:22:45:38

============================================ 

icache: sets:512, ways:4, linesz:32 ,total:65536

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 580 MHZ #### 

 estimate memory size =64 Mbytes


Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   7: Load Boot Loader code then write to Flash via Serial. 

   9: Load Boot Loader code then write to Flash via TFTP. 

 2  1  0 

   

3: System Boot system code via Flash.





#13

OK, you didn't get "f"...this is because OpenWrt still has to fully exist...

It seems you're going to have to TFTP boot or flash this

I suggest trying to boot it first.


#14

I was able to restore my ex3800 using option 2 "Load system code then write to Flash via TFTP". Now my router is working again. The question is, why it could happen ?
I think the cause for rebooting was this message:

Kernel panic - not syncing: No working init found.  Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance.
[    1.476645] Rebooting in 1 seconds..

Have i done a mistake ?
I think the snapshot i used was flawed.
That is the cause why stables are build ?!

regards Klaus


#15

@Rampler If your problem is solved, please consider marking this topic as [Solved]. (Click the pencil behind the topic...)