Posted: Tue Aug 22, 2017 17:10 Post subject: Bricked R7000
My R7000 will not start up. Somewhat new to this, but I have attached my usb-ttl cable. When I turn power on, the serial console shows decompressing is done, but then nothing else happens. Power led light is dim, wifi button is bright white. Am I bricked permanently?
Posted: Tue Aug 22, 2017 19:59 Post subject: Re: Bricked R7000
Jsaff wrote:
My R7000 will not start up. [...] When I turn power on, the serial console shows decompressing is done, but then nothing else happens. Power led light is dim, wifi button is bright white. Am I bricked permanently?
What did you do to get to this state? I'd expect you can still break CFE and flash firmware. Try searching: r7000 AND decompress* _________________ #NAT/SFE/CTF: limited speed w/ DD#Repeater issues#DD-WRT info: FAQ, Builds, Types, Modes, Changes, Demo#
OPNsense x64 5050e ITX|DD: DIR-810L, 2*EA6900@1GHz, R6300v1, RT-N66U@663, WNDR4000@533, E1500@353,
WRT54G{Lv1.1,Sv6}@250|FreshTomato: F7D8302@532|OpenWRT: F9K1119v1, RT-ACRH13, R6220, WNDR3700v4
Pricked permanently. I've had a few like that. Keep the antenna, psu and get another router. _________________ I am far from a guru, I'm barely a novice.
Last edited by Malachi on Tue Aug 22, 2017 20:31; edited 1 time in total
Posted: Wed Aug 23, 2017 19:58 Post subject: Bricked R7000
Do I need a JTag cable to restore CFE? I think someone has already restored the CFE on a R7000 before. Anyone know how it's done? I'm really a novice, but interested in learning.
I think, I have done this USB TTL thing like 20 times, and every-time it succeeds without any problems whatsoever.
If you use windows, enable TFTP Client on your windows machine.
Open the putty terminal, power on your router and repetadly hit CTRL+C on your keyboard and then the prompt will look like this CFR>
after that open up cmd, cd into the directory where you have your .chk file (original netgear fw) and TFTP it.
check out these three links, they have pictures and complete instructions, I don't think R7000 is brickable .
Posted: Thu Aug 24, 2017 11:37 Post subject: Bricked R7000
Your right. I've already attached my serial cable, but not getting past decompressing. I've been trying for some time to find or verify the IP address without any luck. Using Putty thus far. I'm taking this as a personal challenge, is there no other way to restore CFE bin file or am I truly bricked?
Posted: Fri Aug 25, 2017 2:56 Post subject: Re: Bricked R7000
Jsaff wrote:
My R7000 will not start up. Somewhat new to this, but I have attached my usb-ttl cable. When I turn power on, the serial console shows decompressing is done, but then nothing else happens. Power led light is dim, wifi button is bright white. Am I bricked permanently?
not really but doable.how ever with little work. Soc 47x able to read cfe nand chip without sdram. look like you config sdram wrong and lockup. look at datashhet it is second row on right of memory chip(reset). then check a ic power up 1.5v for sdram with control by cpu.
second option unbrick as a custom programmer. look a resistor on the left of the top cpu (right of top cornner red), there is a resistor connect vcc(boot from nand)<dont remember>, now remover and install serial nor chip with boot cfe. now router able to boot from spi chip(normal >2mb). good luck now you have zommbie router. return to original state if you want.
Posted: Fri Aug 25, 2017 11:41 Post subject: Bricked R7000
I'm really a novice, but if you are willing to do a lot of hand holding, I'll try. If you are, be prepared to be flooded with questions, but I think refreshing me in step by step simple terms would be helpful.
I tried to restore stock firmware from AsusWrt-Merlin 384.
After flashing R7000_380.70_0.trx and r7000EU-stockcfe1.0.0.0.bin, my R7000 will not start up.
It stucked in CFE and no response when pressing ctrl+c
Is serial boot the only way to unbrick?
Posted: Sun Dec 27, 2020 7:08 Post subject: R7000 with bad NAND flash ?
I have been trying to revive an R7000 unit and get the following via serial CFE:
pflash: found no supported devices
bcmsflash: found no supported devices
No NAND flash type found
nflash: found no supported devices
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
No NAND flash type found
early_nvram_get: Failed reading nvram var gpio0
No NAND flash type found
early_nvram_get: Failed reading nvram var gpio1
No NAND flash type found
early_nvram_get: Failed reading nvram var gpio2
No NAND flash type found
early_nvram_get: Failed reading nvram var gpio3
issues this twice for all the gpio up to gpio31
ip6tnl0: Disabled Privacy Extensions
NET: Registered protocol family 17
No NAND flash type found
early_nvram_get: Failed reading nvram var qos_enable
No NAND flash type found
early_nvram_get: Failed reading nvram var wla_repeater
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012
No NAND flash type found
brcmnand: found no supported devices
VFS: Cannot open root device "mtdblock3" or unknown-block(0,0)
Please append a correct "root=" boot option; here are the available partitions:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
Once this happens the CPU stops.Please append a correct "root=" boot option; here are the available partitions:
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[<c00451f8>] (unwind_backtrace+0x0/0xe4) from [<c0359dac>] (panic+0x68/0x188)
[<c0359dac>] (panic+0x68/0x188) from [<c0009214>] (mount_block_root+0x238/0x288)
[<c0009214>] (mount_block_root+0x238/0x288) from [<c0009510>] (prepare_namespace+0x160/0x1c0)
[<c0009510>] (prepare_namespace+0x160/0x1c0) from [<c0008e88>] (kernel_init+0x1c8/0x218)
[<c0008e88>] (kernel_init+0x1c8/0x218) from [<c003fb58>] (kernel_thread_exit+0x0/0x8)
CPU0: stopping
That's all! I suspect a bad Winbond 1GB NVRAM.
Opinions?
Oh and if I try to TFTP it will READ the firmware but it never says PROGRAMMING.
C:\TFTP>tftp -i 192.168.1.1 put c:\tftp\firmware.chk
Transfer successful: 25759744 bytes in 18 second(s), 1431096 bytes/s
CFE for Foxconn Router R7000 version: v1.0.27
Build Date: Mon Jun 25 13:41:53 CST 2018
Init Arena
Init Devs.
Boot up from NAND flash...
Bootcode Boot partition size = 524288(0x80000)
DDR Clock: 800 MHz
Info: DDR frequency set from clkfreq=1000,*800*
et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.15.1 (r407936)
et1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.15.1 (r407936)
CPU type 0x0: 1000MHz
Tot mem: 262144 KBytes
first sign of failure appears to be this: (bolded below for NAND). Since it clearly says we are booting from NAND. Unless I am reading this incorrectly?
Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
Loading: ..... 4778464 bytes read
Entry at 0x00008000
Closing network.
Starting program at 0x00008000
console [ttyS0] enabled, bootconsole disabled
serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
brd: module loaded
loop: module loaded
pflash: found no supported devices
bcmsflash: found no supported devices
No NAND flash type found
nflash: found no supported devices
PPP generic driver version 2.4.2
NET: Registered protocol family 24
PPPoL2TP kernel driver, V0.17
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
No NAND flash type found
early_nvram_get: Failed reading nvram var gpio0
No NAND flash type found
From the PIC of the cpu and chips under the shield I think the Winbond NVRAM (in red box) is the fault. This is a NAND flahs device. I this a reasonable assessment? Or did I miss something else in the CFE/boot that should be set?