1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Shibby's R7000 firmware on an R7300

Discussion in 'Tomato Firmware' started by CodeOptimist, May 27, 2016.

  1. CodeOptimist

    CodeOptimist New Member Member

    Various posts indicated there might be some hope for this:

    http://www.snbforums.com/threads/netgear-nighthawk-ac1900-dst-router-r7300.26603/
    http://www.myopenrouter.com/forum/which-build-r-7000
    http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1012031

    Hardware is allegedly near-identical, same chips and such. One even said that R7000 was silkscreened into the circuit board. Well, this is false. It says U12H338T00, the board id for the R7300, and unfortunately Shibby's R7000 files did not work on it.

    [​IMG]

    It went through a series of boot loops before settling down, but no response to ping or web access.
    Holding down the 'reset' button and forcing it to load defaults would actually make it respond to ping for a second or two during each boot loop, but then this would cease without holding the button down again.

    I connected a USB to TTL interface (I used an Arduino Uno, worked great) and was able to monitor the resets.
    I was actually able to access the tomato console and browse the folder structure. Maybe there is a log file I could dump that would be of use to someone?

    I was also able to flash the full R7000 AIO Shibby formware rather than the staging firmware to see if that would be any different, but it wasn't. I simply used:

    flash -noheader : flash1.trx from CFE and sent it via tftp (make sure you specify binary mode).

    I flashed it in the first place through the Netgear interface by enabling telnet (was easy as pie) and changing the board id with nvram set board_id=U12H270T00_NETGEAR followed by nvram commit.

    Since this is nvram it can get reset btw, I actually used the burnboardid command from the Netgear console to make it more permanent just in case this was the problem, but it wasn't. Just FYI for anyone using this command, note that it makes restoring the original Netgear firmware a bit trickier because the .chk file header won't match, you'll need to use the flash -noheader command and that means stripping off the chk header from the trx file with a hex editor, although that is pretty simple. Once back on the Netgear stock firmware, re-enable telnet and run burnboardid again with the original.

    I'll probably be returning this router in the next week or so (disclosing that I opened it of course) unless someone wants to assist. I can provide tomato logs as well as CFE logs when it boot loops.
     
    Last edited: May 29, 2016
  2. AndreDVJ

    AndreDVJ Addicted to LI Member

    Your device probably kernel panic'ked with Tomato. Can you share output? Here's an example of my recent debrick. I tried to replace wireless driver (wl) knowing that I could potentially brick my router and it did:
    Code:
    =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2016.05.14 16:11:10 =~=~=~=~=~=~=~=~=~=~=~=
    Digital core power voltage set to 1.0V
    Decompressing...done
    Digital core power voltage set to 1.0V
    
    SHMOO VER 1.13
    
    PKID07DC06011801080000000000001A103F01000000
    
    S300001CF
    00001370
    
    
    RDLYW0 00000004
    
    RDENW0 00000034
    
    RDQSW0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 ------++++++++++++++++++++++X++++++++++++++++++++++-------------
    01 ----------+++++++++++++++++++++++X++++++++++++++++++++++--------
    02 -------+++++++++++++++++++++++X++++++++++++++++++++++-----------
    03 ------+++++++++++++++++++++++X++++++++++++++++++++++------------
    04 ----++++++++++++++++++++++X++++++++++++++++++++++---------------
    05 ------++++++++++++++++++++++++X++++++++++++++++++++++++---------
    06 ------+++++++++++++++++++++X+++++++++++++++++++++---------------
    07 ---------+++++++++++++++++++++++X+++++++++++++++++++++++--------
    08 ------++++++++++++++++++++++X+++++++++++++++++++++--------------
    09 -------------+++++++++++++++++++++++X+++++++++++++++++++++++----
    10 ------+++++++++++++++++++++++X++++++++++++++++++++++------------
    11 -----------++++++++++++++++++++++++X+++++++++++++++++++++++-----
    12 ------++++++++++++++++++++++X++++++++++++++++++++++-------------
    13 ------------+++++++++++++++++++++X+++++++++++++++++++++---------
    14 ------++++++++++++++++++++++++X+++++++++++++++++++++++----------
    15 -----------+++++++++++++++++++++++X++++++++++++++++++++++-------
    
    
    P   W0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 +++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
    01 -+++++++++++++++++++++++++++X+++++++++++++++++++++++++++--------
    02 ++++++++++++++++++++++++++X++++++++++++++++++++++++++-----------
    03 ++++++++++++++++++++++++++X+++++++++++++++++++++++++------------
    04 ++++++++++++++++++++++++X+++++++++++++++++++++++----------------
    05 +++++++++++++++++++++++++++X+++++++++++++++++++++++++++---------
    06 ++++++++++++++++++++++++X++++++++++++++++++++++++---------------
    07 --+++++++++++++++++++++++++++X++++++++++++++++++++++++++--------
    08 +++++++++++++++++++++++++X++++++++++++++++++++++++--------------
    09 ------+++++++++++++++++++++++++++++X++++++++++++++++++++++++++--
    10 ++++++++++++++++++++++++++X+++++++++++++++++++++++++------------
    11 ----+++++++++++++++++++++++++++X+++++++++++++++++++++++++++-----
    12 ++++++++++++++++++++++++++X+++++++++++++++++++++++++------------
    13 ---++++++++++++++++++++++++++X++++++++++++++++++++++++++--------
    14 +++++++++++++++++++++++++++X+++++++++++++++++++++++++++---------
    15 ---+++++++++++++++++++++++++++X+++++++++++++++++++++++++++------
    
    
    N   W0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 -------+++++++++++++++++++++++X++++++++++++++++++++++-----------
    01 ----------++++++++++++++++++++++++X+++++++++++++++++++++++------
    02 -------++++++++++++++++++++++++X+++++++++++++++++++++++---------
    03 ------+++++++++++++++++++++++X++++++++++++++++++++++------------
    04 ----++++++++++++++++++++++X++++++++++++++++++++++---------------
    05 ------+++++++++++++++++++++++++X++++++++++++++++++++++++--------
    06 -----++++++++++++++++++++++X+++++++++++++++++++++---------------
    07 ----------+++++++++++++++++++++++++X++++++++++++++++++++++++----
    08 ------++++++++++++++++++++++X++++++++++++++++++++++-------------
    09 -------------+++++++++++++++++++++++X+++++++++++++++++++++++----
    10 ------+++++++++++++++++++++++X+++++++++++++++++++++++-----------
    11 ------------+++++++++++++++++++++++X+++++++++++++++++++++++-----
    12 ------+++++++++++++++++++++++X++++++++++++++++++++++------------
    13 ------------+++++++++++++++++++++X+++++++++++++++++++++---------
    14 ------++++++++++++++++++++++++X+++++++++++++++++++++++----------
    15 ------------++++++++++++++++++++++X++++++++++++++++++++++-------
    
    
    WRDQW0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 +++++++++++++++++++++++X+++++++++++++++++++++++------++++++++++-
    01 ++++++++++++++++++++++++X++++++++++++++++++++++++-------+++++++-
    02 ++++++++++++++++++++++++X+++++++++++++++++++++++-----++++++++++-
    03 +++++++++++++++++++++++X++++++++++++++++++++++--------+++++++++-
    04 +++++++++++++++++++++X+++++++++++++++++++++-----------+++++++++-
    05 +++++++++++++++++++++++X+++++++++++++++++++++++------++++++++++-
    06 ++++++++++++++++++++++X+++++++++++++++++++++---------++++++++++-
    07 ++++++++++++++++++++++++X++++++++++++++++++++++++------++++++++-
    08 +++++++++++++++++++++++X++++++++++++++++++++++--------+++++++++-
    09 -++++++++++++++++++++++++X+++++++++++++++++++++++----------++++-
    10 +++++++++++++++++++++++X+++++++++++++++++++++++--------++++++++-
    11 --+++++++++++++++++++++++X+++++++++++++++++++++++-----------+++-
    12 ++++++++++++++++++++++++X+++++++++++++++++++++++------+++++++++-
    13 --+++++++++++++++++++++++X+++++++++++++++++++++++-----------+++-
    14 ++++++++++++++++++++++++X+++++++++++++++++++++++--------+++++++-
    15 --+++++++++++++++++++++++X+++++++++++++++++++++++-----------+++-
    
    
    WRDMW0 00000023
    WRDMW0 00000024
    
    
    ADDR
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 +++++++++++++++++++S+++++++++++X++++++++++++++++++++++++++++++++
    
    Decompressing...done
    
    
    CFE for Foxconn Router R7000 version: v1.0.22
    Build Date: Wed Mar 19 11:14:20 CST 2014
    Init Arena
    Init Devs.
    Boot up from NAND flash...
    Bootcode Boot partition size = 524288(0x80000)
    DDR Clock: 800 MHz
    Info: DDR frequency set from clkfreq=1000,*800*
    et0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.15.1 (r407936)
    et1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.15.1 (r407936)
    CPU type 0x0: 1000MHz
    Tot mem: 262144 KBytes
    
    Device eth0:  hwaddr XX-XX-XX-XX-XX-XX, ipaddr 192.168.1.1, mask 255.255.255.0
            gateway not set, nameserver not set
    Loader:raw Filesys:tftp Dev:eth0 File:192.168.1.2:vmlinuz Options:(null)
    Loading: Failed.
    Could not load 192.168.1.2:vmlinuz: Timeout occured
    Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
    Loading: .... 4144640 bytes read
    Entry at 0x00008000
    Closing network.
    Starting program at 0x00008000
    console [ttyS0] enabled, bootconsole disabled
    serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
    brd: module loaded
    loop: module loaded
    pflash: found no supported devices
    bcmsflash: found no supported devices
    Boot partition size = 524288(0x80000)
    lookup_nflash_rootfs_offset: offset = 0x200000
    nflash: squash filesystem with lzma found at block 29
    Creating 5 MTD partitions on "nflash":
    0x000000000000-0x000000080000 : "boot"
    0x000000080000-0x000000200000 : "nvram"
    0x000000200000-0x000002200000 : "linux"
    0x0000003a6d80-0x000002000000 : "rootfs"
    0x000002200000-0x000002240000 : "board_data"
    PPP generic driver version 2.4.2
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    PPTP driver version 0.8.5
    === PPTP init ===
    Mirror/redirect action on
    u32 classifier
        Actions configured
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (3990 buckets, 15960 max)
    xt_time: kernel timezone is -0000
    ip_tables: (C) 2000-2006 Netfilter Core Team
    TCP cubic registered
    NET: Registered protocol family 10
    ip6_tables: (C) 2000-2006 Netfilter Core Team
    NET: Registered protocol family 17
    L2TP core driver, V2.0
    PPPoL2TP kernel driver, V2.0
    802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
    All bugs added by David S. Miller <davem@redhat.com>
    Registering the dns_resolver key type
    Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012
    NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
    Spare area=64 eccbytes 56, ecc bytes located at:
    2 3 4 5 6 7 8 9 10 11 12 13 14 15 18 19 20 21 22 23 24 25 26 27 28 29 30 31 34 35 36 37 38 39 40 41 42 43 44 45 46 47 50 51 52 53 54 55 56 57 58 59 60 61 62 63
    Available 7 bytes at (off,len):
    (1,1) (16,2) (32,2) (48,2) (0,0) (0,0) (0,0) (0,0)
    Scanning device for bad blocks
    Options: NO_AUTOINCR,NO_READRDY,BBT_SCAN2NDPAGE,
    Creating 2 MTD partitions on "brcmnand":
    0x000002000000-0x000008000000 : "brcmnand"
    0x000004000000-0x000008000000 : "jffs2"
    VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
    devtmpfs: mounted
    Freeing init memory: 216K
    
    
    Hit ENTER for console...
    
    emf: module license 'Proprietary' taints kernel.
    Disabling lock debugging due to kernel taint
    et_module_init: passivemode set to 0x0
    et_module_init: txworkq set to 0x0
    et_module_init: et_txq_thresh set to 0x0
    eth0: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 6.37.14.86 (r456083)
    wl_module_init: passivemode set to 0x0
    Unable to handle kernel NULL pointer dereference at virtual address 00000000
    pgd = cf04c000
    [00000000] *pgd=9f060031, *pte=00000000, *ppte=00000000
    Internal error: Oops: 17 [#1] PREEMPT SMP
    last sysfs file: /sys/kernel/uevent_seqnum
    module:  wl     bf027000     4156493
    module:  et     bf011000     61325
    module:  igs     bf009000     11887
    module:  emf     bf000000     14973
    Modules linked in: wl(P+) et(P) igs(P) emf(P)
    CPU: 1    Tainted: P             (2.6.36.4brcmarm #1)
    PC is at bcm_strtoul+0xc/0x150
    LR is at init_module+0xe0/0x244 [wl]
    pc : [<c01cbe00>]    lr : [<bf3f50e0>]    psr: 60000013
    sp : cf043d70  ip : c02f7850  fp : 00000000
    r10: cf043d88  r9 : c04002fa  r8 : 00000000
    r7 : cf043e88  r6 : cf043d88  r5 : 00000001  r4 : c04002fe
    r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : 00000000
    Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
    Control: 10c53c7d  Table: 9f04c04a  DAC: 00000015
    Process modprobe (pid: 722, stack limit = 0xcf042270)
    Stack: (0xcf043d70 to 0xcf044000)
    3d60:                                     c04002fe 00000001 cf043d88 cf043e88
    3d80: 00000000 cf043d88 31687465 68746500 00000032 00000000 00000000 00000000
    3da0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    3dc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    3de0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    3e00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    3e20: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    3e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    3e60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
    3e80: 00000000 00000000 5f306c77 00736769 bf3d59e8 c03fc000 cf042000 00000000
    3ea0: bf3f5000 00000030 bf3d59e8 c03fc000 cf042000 00000000 bf3f5000 00000030
    3ec0: 00000780 c003e5bc 00000000 c00b9e54 00000440 cf0611e0 00000000 bf3d59e8
    3ee0: bf3d59a0 bf3d59e8 bf3d59a0 cfa97f28 cfa97c00 00000000 00000780 c008fef0
    3f00: bf3d59ac 406a0000 c008e914 bf3d5ad4 c0427ee0 cf042000 d0e0856c 000a35c8
    3f20: cf9de788 d0a61000 0043ffa4 d0e14044 d0e13e2b d0e268b4 ce474000 003aeedc
    3f40: 003baf3c 00000000 00000000 0000002e 0000002f 00000025 00000029 0000001f
    3f60: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 c03a93ec
    3f80: 00000003 000a3798 40260008 000a35c8 00000080 c003ec68 cf042000 00000000
    3fa0: bea61c6c c003eac0 000a3798 40260008 40260008 0043ffa4 000a35c8 00000000
    3fc0: 000a3798 40260008 000a35c8 00000080 00000001 000a2f80 000a4618 bea61c6c
    3fe0: 402021f4 bea61c18 00013a8c 40202204 20000010 40260008 e285ef41 e585600c
    [<c01cbe00>] (PC is at bcm_strtoul+0xc/0x150)
    [<c01cbe00>] (bcm_strtoul+0xc/0x150) from [<bf3f50e0>] (init_module+0xe0/0x244 [wl])
    [<bf3f50e0>] (init_module+0xe0/0x244 [wl]) from [<c003e5bc>] (do_one_initcall+0x30/0x19c)
    [<c003e5bc>] (do_one_initcall+0x30/0x19c) from [<c008fef0>] (sys_init_module+0x11c/0x1bac)
    [<c008fef0>] (sys_init_module+0x11c/0x1bac) from [<c003eac0>] (ret_fast_syscall+0x0/0x30)
    Code: e12fff1e e92d05f0 e1a03000 e59fc13c (e5d00000)
    ---[ end trace ef896ec6d5e94cc3 ]---
    Kernel panic - not syncing: Fatal exception
    [<c0044ff8>] (unwind_backtrace+0x0/0xf8) from [<c02de65c>] (panic+0x74/0x1a0)
    [<c02de65c>] (panic+0x74/0x1a0) from [<c00426f0>] (die+0x1a4/0x1dc)
    [<c00426f0>] (die+0x1a4/0x1dc) from [<c0046154>] (__do_kernel_fault+0x64/0x84)
    [<c0046154>] (__do_kernel_fault+0x64/0x84) from [<c00462c4>] (do_page_fault+0x150/0x1ec)
    [<c00462c4>] (do_page_fault+0x150/0x1ec) from [<c003e3a4>] (do_DataAbort+0x30/0x9c)
    [<c003e3a4>] (do_DataAbort+0x30/0x9c) from [<c039ca6c>] (__dabt_svc+0x4c/0x60)
    Exception stack(0xcf043d28 to 0xcf043d70)
    3d20:                   00000000 00000000 00000000 00000000 c04002fe 00000001
    3d40: cf043d88 cf043e88 00000000 c04002fa cf043d88 00000000 c02f7850 cf043d70
    3d60: bf3f50e0 c01cbe00 60000013 ffffffff
    [<c039ca6c>] (__dabt_svc+0x4c/0x60) from [<c01cbe00>] (bcm_strtoul+0xc/0x150)
    [<c01cbe00>] (bcm_strtoul+0xc/0x150) from [<bf3f50e0>] (init_module+0xe0/0x244 [wl])
    [<bf3f50e0>] (init_module+0xe0/0x244 [wl]) from [<c003e5bc>] (do_one_initcall+0x30/0x19c)
    [<c003e5bc>] (do_one_initcall+0x30/0x19c) from [<c008fef0>] (sys_init_module+0x11c/0x1bac)
    [<c008fef0>] (sys_init_module+0x11c/0x1bac) from [<c003eac0>] (ret_fast_syscall+0x0/0x30)
    CPU0: stopping
    [<c0044ff8>] (unwind_backtrace+0x0/0xf8) from [<c003e334>] (do_IPI+0x114/0x154)
    [<c003e334>] (do_IPI+0x114/0x154) from [<c039cac8>] (__irq_svc+0x48/0xe8)
    Exception stack(0xc03d9f78 to 0xc03d9fc0)
    9f60:                                                       00000000 cf960300
    9f80: c03d9fc0 00000000 c03d8000 c03fc0a8 c03e4b80 c03e4b78 000267c0 413fc090
    9fa0: 0000001f 00000000 00000000 c03d9fc0 c003fbe4 c003fbe8 60000013 ffffffff
    [<c039cac8>] (__irq_svc+0x48/0xe8) from [<c003fbe8>] (default_idle+0x24/0x28)
    [<c003fbe8>] (default_idle+0x24/0x28) from [<c003fd88>] (cpu_idle+0x70/0xa4)
    [<c003fd88>] (cpu_idle+0x70/0xa4) from [<c0008ca0>] (start_kernel+0x338/0x394)
    [<c0008ca0>] (start_kernel+0x338/0x394) from [<00008084>] (0x8084)
    Rebooting in 3 seconds..
    Well since you know how to enable telnet backdoor with OFW, please share output of command nvram show in a text file. Replace with XX and YY's anything that uniquelly identifies your router's hardware.

    I think it's very possible to have Tomato on R7300 if the hardware is similar to R7000, however I believe there are a bunch of device-specific strings. A dump of nvram is the very start. However, someone in order to try to port Tomato, must have the hardware at hands.

    Kernel version too:
    Code:
    # uname -a
    Linux R7000 2.6.36.4brcmarm+ #30 SMP PREEMPT Tue May 3 21:15:45 CST 2016 armv7l unknown
    
    Edit: By the way, the board_id value is for R7000 is U12H270T00_NETGEAR. I think you missed three characters. You can try again if you like.
     
    Last edited: May 27, 2016
    CodeOptimist likes this.
  3. CodeOptimist

    CodeOptimist New Member Member

    Just a typo, I used T00. (Edit: Just fixed it in original post.) I'll absolutely post a nvram show dump, the kernel panic, and kernel version ASAP. Thanks for your interest!

    Headed out, will hopefully get this tonight, if not then definitely tomorrow.
     
    Last edited: May 29, 2016
  4. tvlz

    tvlz LI Guru Member

    You should check shibby arm-repo to see how he added the r7000 and do the same to add the r7300
     
    CodeOptimist likes this.
  5. CodeOptimist

    CodeOptimist New Member Member

    Excellent suggestion tvlz, I will be looking at it.

    Kernel version:

    Code:
    # uname -a
    Linux R7300 2.6.36.4brcmarm+ #30 SMP PREEMPT Thu Nov 19 10:47:15 CST 2015 armv7l unknown
    nvram show dump attached. I changed the default passphrases to "redacted" and anonymized all the MAC addresses.
    (Edit: Sorry, the previous attachment wasn't truly a blank state, this replacement one is fresh after a restore to factory defaults.)

    (I tried to put it in this post in a code block as well but it was too long apparently.)

    I also sorted it for better readability and comparisons, hope that is all right. If you have a factory dump of an R7000's you could send that my way as well and I could take a look with Beyond Compare.

    Kernel panic log is in my next post but it's awaiting moderation. :(
     

    Attached Files:

    Last edited: May 29, 2016
  6. CodeOptimist

    CodeOptimist New Member Member

    Here's the kernel panic log, this just repeats with every boot loop more or less (apparently with a bad block check between). Same text attached as file.

    Code:
    Digital core power voltage set to 1.0V
    Decompressing...done
    Digital core power voltage set to 1.0V
    
    SHMOO VER 1.13
    
    PKID07DC06011801080000000000001A103F01000000
    
    S300001CF
    00001380
    
    
    RDLYW0 00000004
    
    RDENW0 00000033
    
    RDQSW0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 -----++++++++++++++++++++++++++X+++++++++++++++++++++++++-------
    01 ----------+++++++++++++++++++++++++X++++++++++++++++++++++++----
    02 ------+++++++++++++++++++++++++X+++++++++++++++++++++++++-------
    03 ----+++++++++++++++++++++++++X+++++++++++++++++++++++++---------
    04 --+++++++++++++++++++++++++X++++++++++++++++++++++++------------
    05 ------+++++++++++++++++++++++++X+++++++++++++++++++++++++-------
    06 -+-+++++++++++++++++++++++X+++++++++++++++++++++++--------------
    07 --------+++++++++++++++++++++++++X+++++++++++++++++++++++++-----
    08 ---------++++++++++++++++++++++X+++++++++++++++++++++-----------
    09 ---------------++++++++++++++++++++++++X++++++++++++++++++++++++
    10 ------------++++++++++++++++++++++X+++++++++++++++++++++--------
    11 ----------------++++++++++++++++++++++X++++++++++++++++++++++---
    12 ---------++++++++++++++++++++++++X+++++++++++++++++++++++-------
    13 ---------------++++++++++++++++++++++++X++++++++++++++++++++++--
    14 ----------++++++++++++++++++++++++X++++++++++++++++++++++++-----
    15 ----------------++++++++++++++++++++++X++++++++++++++++++++++---
    
    
    P   W0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 -----++++++++++++++++++++++++++X+++++++++++++++++++++++++-------
    01 --------++++++++++++++++++++++++++X+++++++++++++++++++++++++----
    02 ----+++++++++++++++++++++++++++X++++++++++++++++++++++++++------
    03 ----+++++++++++++++++++++++++X+++++++++++++++++++++++++---------
    04 ++++++++++++++++++++++++++X+++++++++++++++++++++++++------------
    05 ------+++++++++++++++++++++++++X+++++++++++++++++++++++++-------
    06 -++++++++++++++++++++++++++X+++++++++++++++++++++++++-----------
    07 ------++++++++++++++++++++++++++X++++++++++++++++++++++++++-----
    08 --+++++++++++++++++++++++++X+++++++++++++++++++++++++-----------
    09 ---------+++++++++++++++++++++++++++X+++++++++++++++++++++++++++
    10 ----++++++++++++++++++++++++++X+++++++++++++++++++++++++--------
    11 ---------++++++++++++++++++++++++++X+++++++++++++++++++++++++---
    12 ----++++++++++++++++++++++++++X++++++++++++++++++++++++++-------
    13 ----------+++++++++++++++++++++++++++X++++++++++++++++++++++++--
    14 -----+++++++++++++++++++++++++++X++++++++++++++++++++++++++-----
    15 ----------+++++++++++++++++++++++++X+++++++++++++++++++++++++---
    
    
    N   W0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 -----++++++++++++++++++++++++++X+++++++++++++++++++++++++-------
    01 ----------+++++++++++++++++++++++++X+++++++++++++++++++++++++---
    02 ------+++++++++++++++++++++++++X+++++++++++++++++++++++++-------
    03 -----+++++++++++++++++++++++++X++++++++++++++++++++++++---------
    04 ---++++++++++++++++++++++++X++++++++++++++++++++++++------------
    05 --------++++++++++++++++++++++++X+++++++++++++++++++++++--------
    06 ---+++++++++++++++++++++++X+++++++++++++++++++++++--------------
    07 --------++++++++++++++++++++++++++X+++++++++++++++++++++++++----
    08 --------++++++++++++++++++++++++X++++++++++++++++++++++++-------
    09 --------------+++++++++++++++++++++++++X++++++++++++++++++++++++
    10 -----------+++++++++++++++++++++++X+++++++++++++++++++++++------
    11 ---------------++++++++++++++++++++++++X+++++++++++++++++++++++-
    12 --------+++++++++++++++++++++++++X++++++++++++++++++++++++------
    13 --------------+++++++++++++++++++++++++X+++++++++++++++++++++++-
    14 ----------++++++++++++++++++++++++X++++++++++++++++++++++++-----
    15 -----------------+++++++++++++++++++++++X++++++++++++++++++++++-
    
    
    WRDQW0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 +++++++++++++++++++++++X+++++++++++++++++++++++-------+++++++++-
    01 ++++++++++++++++++++++++X++++++++++++++++++++++++-------+++++++-
    02 +++++++++++++++++++++++X+++++++++++++++++++++++-------+++++++++-
    03 +++++++++++++++++++++++X+++++++++++++++++++++++------++++++++++-
    04 +++++++++++++++++++++X+++++++++++++++++++++-----------+++++++++-
    05 ++++++++++++++++++++++++X+++++++++++++++++++++++------+++++++++-
    06 ++++++++++++++++++++++X+++++++++++++++++++++----------+++++++++-
    07 ++++++++++++++++++++++++X+++++++++++++++++++++++-------++++++++-
    08 ++++++++++++++++++++++X++++++++++++++++++++++----------++++++++-
    09 --+++++++++++++++++++++++X+++++++++++++++++++++++------------++-
    10 ++++++++++++++++++++++++X++++++++++++++++++++++++--------++++++-
    11 ---+++++++++++++++++++++++X++++++++++++++++++++++------------++-
    12 +++++++++++++++++++++++X+++++++++++++++++++++++-------+++++++++-
    13 --+++++++++++++++++++++++X+++++++++++++++++++++++------------++-
    14 ++++++++++++++++++++++++X+++++++++++++++++++++++--------+++++++-
    15 ---+++++++++++++++++++++++X++++++++++++++++++++++------------++-
    
    
    WRDMW0 00000023
    WRDMW0 00000024
    
    
    ADDR
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 +++++++++++++++++++S+++++++++++X++++++++++++++++++++++++++++++++
    
    Decompressing...done
    
    
    CFE for Foxconn Router R7300 version: v1.0.3
    Build Date: Mon Jul  6 09:51:22 CST 2015
    Init Arena
    Init Devs.
    Boot up from NAND flash...
    Bootcode Boot partition size = 524288(0x80000)
    DDR Clock: 800 MHz
    Info: DDR frequency set from clkfreq=1000,*800*
    et1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.89.2602 (r534851)
    CPU type 0x0: 1000MHz
    Tot mem: 262144 KBytes
    
    Device eth0:  hwaddr D1-8E-CE-F4-9E-62, ipaddr 192.168.1.1, mask 255.255.255.0
            gateway not set, nameserver not set
    Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
    Loading: .... 4111168 bytes read
    Entry at 0x00008000
    Closing network.
    Starting program at 0x00008000
    console [ttyS0] enabled, bootconsole disabled
    serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
    brd: module loaded
    loop: module loaded
    pflash: found no supported devices
    bcmsflash: found no supported devices
    Boot partition size = 524288(0x80000)
    lookup_nflash_rootfs_offset: offset = 0x200000
    nflash: squash filesystem with lzma found at block 29
    Creating 4 MTD partitions on "nflash":
    0x000000000000-0x000000080000 : "boot"
    0x000000080000-0x000000200000 : "nvram"
    0x000000200000-0x000002000000 : "linux"
    0x0000003a5818-0x000002000000 : "rootfs"
    PPP generic driver version 2.4.2
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    PPTP driver version 0.8.5
    === PPTP init ===
    u32 classifier
        Actions configured
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (3991 buckets, 15964 max)
    xt_time: kernel timezone is -0000
    ip_tables: (C) 2000-2006 Netfilter Core Team
    TCP cubic registered
    NET: Registered protocol family 10
    ip6_tables: (C) 2000-2006 Netfilter Core Team
    NET: Registered protocol family 17
    L2TP core driver, V2.0
    PPPoL2TP kernel driver, V2.0
    802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
    All bugs added by David S. Miller <davem@redhat.com>
    Registering the dns_resolver key type
    Unable to handle kernel paging request at virtual address ffffffff
    pgd = c0004000
    [ffffffff] *pgd=9fffc021, *pte=00000000, *ppte=00000000
    Internal error: Oops: 1 [#1] PREEMPT SMP
    last sysfs file:
    Modules linked in:
    CPU: 1    Not tainted  (2.6.36.4brcmarm #4)
    PC is at __kmalloc+0x70/0x104
    LR is at __kmalloc+0x1c/0x104
    pc : [<c00c384c>]    lr : [<c00c37f8>]    psr: a0000093
    sp : cf825ed8  ip : c822585c  fp : 00000000
    r10: cfa30d86  r9 : c03ddb1c  r8 : ffffffff
    r7 : c004d14c  r6 : 00000020  r5 : a0000013  r4 : c03da3bc
    r3 : c003b85c  r2 : 081ea000  r1 : 00000000  r0 : c03da3bc
    Flags: NzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
    Control: 10c53c7f  Table: 0000404a  DAC: 00000017
    Process swapper (pid: 1, stack limit = 0xcf824270)
    Stack: (0xcf825ed8 to 0xcf826000)
    5ec0:                                                       c822585c c01c0d20
    5ee0: 00000000 cfa30d86 c0417f78 cfa30d7a cfa30d7a c004d14c 9e106207 00000000
    5f00: c04180d8 00000060 c03ddbac c004f360 00000064 cf825f34 cfa30000 cfa30d86
    5f20: cfa30d85 00000000 0000003d c004f460 c0424bc0 58587830 58585858 cf005858
    5f40: cfa30000 00000000 cfa30000 c042b27c c03f6000 c0424bc0 c03f4508 c004f764
    5f60: c0417f78 c03ddb1c c0364d7c c004db64 c03ddb40 cf8eb420 00000000 c0024184
    5f80: 00000000 1f030000 c0026e58 c03f4000 cf824000 00000000 c004d9b0 00000000
    5fa0: 00000000 c003d5bc 00000000 c0100000 00000002 c03dfa18 00000100 c02de628
    5fc0: 00000002 c0026e58 c0026e8c c02de628 00000002 c041fee4 00000000 c0008e50
    5fe0: 00000000 c0008cfc c003eb8c 00000013 00000000 c003eb8c 00000000 00000000
    [<c00c384c>] (PC is at __kmalloc+0x70/0x104)
    [<c00c384c>] (__kmalloc+0x70/0x104) from [<c004d14c>] (_nvram_realloc+0xd8/0x10c)
    [<c004d14c>] (_nvram_realloc+0xd8/0x10c) from [<c004f360>] (_nvram_set+0xa4/0x114)
    [<c004f360>] (_nvram_set+0xa4/0x114) from [<c004f460>] (nvram_rehash+0x90/0x1c4)
    [<c004f460>] (nvram_rehash+0x90/0x1c4) from [<c004f764>] (_nvram_init+0x68/0x80)
    [<c004f764>] (_nvram_init+0x68/0x80) from [<c004db64>] (dev_nvram_init+0x1b4/0x504)
    [<c004db64>] (dev_nvram_init+0x1b4/0x504) from [<c003d5bc>] (do_one_initcall+0x30/0x19c)
    [<c003d5bc>] (do_one_initcall+0x30/0x19c) from [<c0008e50>] (kernel_init+0x154/0x218)
    [<c0008e50>] (kernel_init+0x154/0x218) from [<c003eb8c>] (kernel_thread_exit+0x0/0x8)
    Code: e083c002 e3580000 0a00001c e5941010 (e7981001)
    ---[ end trace a1cbc404c80834f0 ]---
    Kernel panic - not syncing: Fatal exception
    [<c0044024>] (unwind_backtrace+0x0/0xf8) from [<c02d9c64>] (panic+0x74/0x1a0)
    [<c02d9c64>] (panic+0x74/0x1a0) from [<c004171c>] (die+0x1a4/0x1dc)
    [<c004171c>] (die+0x1a4/0x1dc) from [<c0045174>] (__do_kernel_fault+0x64/0x84)
    [<c0045174>] (__do_kernel_fault+0x64/0x84) from [<c0047038>] (do_alignment+0x14c/0x714)
    [<c0047038>] (do_alignment+0x14c/0x714) from [<c003d3a4>] (do_DataAbort+0x30/0x9c)
    [<c003d3a4>] (do_DataAbort+0x30/0x9c) from [<c0395b8c>] (__dabt_svc+0x4c/0x60)
    Exception stack(0xcf825e90 to 0xcf825ed8)
    5e80:                                     c03da3bc 00000000 081ea000 c003b85c
    5ea0: c03da3bc a0000013 00000020 c004d14c ffffffff c03ddb1c cfa30d86 00000000
    5ec0: c822585c cf825ed8 c00c37f8 c00c384c a0000093 ffffffff
    [<c0395b8c>] (__dabt_svc+0x4c/0x60) from [<c00c384c>] (__kmalloc+0x70/0x104)
    [<c00c384c>] (__kmalloc+0x70/0x104) from [<c004d14c>] (_nvram_realloc+0xd8/0x10c)
    [<c004d14c>] (_nvram_realloc+0xd8/0x10c) from [<c004f360>] (_nvram_set+0xa4/0x114)
    [<c004f360>] (_nvram_set+0xa4/0x114) from [<c004f460>] (nvram_rehash+0x90/0x1c4)
    [<c004f460>] (nvram_rehash+0x90/0x1c4) from [<c004f764>] (_nvram_init+0x68/0x80)
    [<c004f764>] (_nvram_init+0x68/0x80) from [<c004db64>] (dev_nvram_init+0x1b4/0x504)
    [<c004db64>] (dev_nvram_init+0x1b4/0x504) from [<c003d5bc>] (do_one_initcall+0x30/0x19c)
    [<c003d5bc>] (do_one_initcall+0x30/0x19c) from [<c0008e50>] (kernel_init+0x154/0x218)
    [<c0008e50>] (kernel_init+0x154/0x218) from [<c003eb8c>] (kernel_thread_exit+0x0/0x8)
    CPU0: stopping
    Rebooting in 3 seconds..
    [<c0044024>] (unwind_backtrace+0x0/0xf8) from [<c003d334>] (do_IPI+0x114/0x154)
    [<c003d334>] (do_IPI+0x114/0x154) from [<c0395be8>] (__irq_svc+0x48/0xe8)
    Exception stack(0xc03d1f78 to 0xc03d1fc0)
    1f60:                                                       00000003 cf822400
    1f80: c03d1fc0 00000000 c03d0000 c03f40a8 c03dcb80 c03dcb78 00026640 413fc090
    1fa0: 0000001f 00000000 00000000 c03d1fc0 c003ebe4 c003ebe8 60000013 ffffffff
    [<c0395be8>] (__irq_svc+0x48/0xe8) from [<c003ebe8>] (default_idle+0x24/0x28)
    [<c003ebe8>] (default_idle+0x24/0x28) from [<c003ed88>] (cpu_idle+0x70/0xa4)
    [<c003ed88>] (cpu_idle+0x70/0xa4) from [<c0008ca0>] (start_kernel+0x338/0x394)
    [<c0008ca0>] (start_kernel+0x338/0x394) from [<00008084>] (0x8084)
     

    Attached Files:

  7. AndreDVJ

    AndreDVJ Addicted to LI Member

    R7000 factory NVRAM dump from latest Genie (V1.0.5.64) is attached. HW addresses cleaned up. I didn't sort anything though...

    About your dump, I don't see "board_data" MTD partition being created. At least on my R7000 it is created.

    If you can compile Tomato by yourself, you need to craft something specifically for R7300 and see if it works.

    Also, I believe you need a file (ambitCfg_WW_R7300.h) from the sources. They're located at R7300-V1.0.0.32_1.0.6_src/project/acos/include/ inside the tarball.

    EDIT: Another file is needed as well (compatible_r7300.txt), from R7300-V1.0.0.32_1.0.6_src/src/router/arm-uclibc/
     

    Attached Files:

    Last edited: May 29, 2016
    CodeOptimist likes this.
  8. CodeOptimist

    CodeOptimist New Member Member

    Hi all. AndreDVJ made some awesome progress but unfortunately it still kernel panics:

    Code:
    =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2016.05.29 18:16:55 =~=~=~=~=~=~=~=~=~=~=~=
    
    Digital core power voltage set to 1.0V
    Decompressing...done
    Digital core power voltage set to 1.0V
    
    SHMOO VER 1.13
    
    PKID07DC06011801080000000000001A103F01000000
    
    S300001DF
    000013C0
    
    
    RDLYW0 00000004
    
    RDENW0 00000035
    
    RDQSW0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 ---++++++++++++++++++++++++++X+++++++++++++++++++++++++---------
    01 ----------++++++++++++++++++++++++X++++++++++++++++++++++++-----
    02 ----+++++++++++++++++++++++++X+++++++++++++++++++++++++---------
    03 ---+++++++++++++++++++++++++X++++++++++++++++++++++++-----------
    04 -++++++++++++++++++++++++X++++++++++++++++++++++++--------------
    05 -----+++++++++++++++++++++++++X++++++++++++++++++++++++---------
    06 ++++++++++++++++++++++++X+++++++++++++++++++++++----------------
    07 -------+++++++++++++++++++++++++X++++++++++++++++++++++++-------
    08 -------++++++++++++++++++++++X++++++++++++++++++++++------------
    09 --------------+++++++++++++++++++++++++X++++++++++++++++++++++--
    10 ---------++++++++++++++++++++++X++++++++++++++++++++++----------
    11 ---------------++++++++++++++++++++++X+++++++++++++++++++++-----
    12 --------++++++++++++++++++++++++X+++++++++++++++++++++++--------
    13 --------------+++++++++++++++++++++++X++++++++++++++++++++++----
    14 --------++++++++++++++++++++++++X++++++++++++++++++++++++-------
    15 ---------------++++++++++++++++++++++X+++++++++++++++++++++-----
    
    
    PW0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 -+++++++++++++++++++++++++++X++++++++++++++++++++++++++---------
    01 -----+++++++++++++++++++++++++++X++++++++++++++++++++++++++-----
    02 --+++++++++++++++++++++++++++X++++++++++++++++++++++++++--------
    03 -++++++++++++++++++++++++++X+++++++++++++++++++++++++-----------
    04 +++++++++++++++++++++++++X++++++++++++++++++++++++--------------
    05 --+++++++++++++++++++++++++++X++++++++++++++++++++++++++--------
    06 +++++++++++++++++++++++++X+++++++++++++++++++++++++-------------
    07 ---+++++++++++++++++++++++++++X++++++++++++++++++++++++++-------
    08 ++++++++++++++++++++++++++X+++++++++++++++++++++++++------------
    09 ------+++++++++++++++++++++++++++++X++++++++++++++++++++++++++--
    10 -++++++++++++++++++++++++++X++++++++++++++++++++++++++----------
    11 ------++++++++++++++++++++++++++X++++++++++++++++++++++++++-----
    12 -+++++++++++++++++++++++++++X+++++++++++++++++++++++++++--------
    13 ------+++++++++++++++++++++++++++X++++++++++++++++++++++++++----
    14 ++++++++++++++++++++++++++++X+++++++++++++++++++++++++++--------
    15 -------++++++++++++++++++++++++++X+++++++++++++++++++++++++-----
    
    
    NW0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 ----++++++++++++++++++++++++++X+++++++++++++++++++++++++--------
    01 ----------++++++++++++++++++++++++X++++++++++++++++++++++++-----
    02 ----+++++++++++++++++++++++++X+++++++++++++++++++++++++---------
    03 ----++++++++++++++++++++++++X++++++++++++++++++++++++-----------
    04 -++++++++++++++++++++++++X++++++++++++++++++++++++--------------
    05 ------++++++++++++++++++++++++X++++++++++++++++++++++++---------
    06 -+++++++++++++++++++++++X+++++++++++++++++++++++----------------
    07 -------+++++++++++++++++++++++++X+++++++++++++++++++++++++------
    08 -------++++++++++++++++++++++++X+++++++++++++++++++++++---------
    09 --------------+++++++++++++++++++++++++X++++++++++++++++++++++--
    10 ---------+++++++++++++++++++++++X+++++++++++++++++++++++--------
    11 ---------------+++++++++++++++++++++++X++++++++++++++++++++++---
    12 -------++++++++++++++++++++++++X++++++++++++++++++++++++--------
    13 -------------++++++++++++++++++++++++X+++++++++++++++++++++++---
    14 ---------++++++++++++++++++++++++X+++++++++++++++++++++++-------
    15 ---------------+++++++++++++++++++++++X++++++++++++++++++++++---
    
    
    WRDQW0
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 ++++++++++++++++++++++++X+++++++++++++++++++++++-------++++++++-
    01 +++++++++++++++++++++++++X++++++++++++++++++++++++-------++++++-
    02 ++++++++++++++++++++++++X+++++++++++++++++++++++------+++++++++-
    03 +++++++++++++++++++++++X+++++++++++++++++++++++-------+++++++++-
    04 +++++++++++++++++++++X+++++++++++++++++++++------------++++++++-
    05 ++++++++++++++++++++++++X++++++++++++++++++++++++-----+++++++++-
    06 ++++++++++++++++++++++X+++++++++++++++++++++----------+++++++++-
    07 ++++++++++++++++++++++++X+++++++++++++++++++++++--------+++++++-
    08 +++++++++++++++++++++++X++++++++++++++++++++++--------+++++++++-
    09 --++++++++++++++++++++++++X+++++++++++++++++++++++-----------++-
    10 ++++++++++++++++++++++++X++++++++++++++++++++++++--------++++++-
    11 ---+++++++++++++++++++++++X+++++++++++++++++++++++------------+-
    12 ++++++++++++++++++++++++X++++++++++++++++++++++++-----+++++++++-
    13 --+++++++++++++++++++++++X+++++++++++++++++++++++------------++-
    14 ++++++++++++++++++++++++X++++++++++++++++++++++++--------++++++-
    15 ---+++++++++++++++++++++++X+++++++++++++++++++++++------------+-
    
    
    WRDMW0 00000023
    WRDMW0 00000024
    
    
    ADDR
    
        0000000000111111111122222222223333333333444444444455555555556666
        0123456789012345678901234567890123456789012345678901234567890123
    00 +++++++++++++++++++S+++++++++++X++++++++++++++++++++++++++++++++
    
    Decompressing...done
    
    
    CFE for Foxconn Router R7300 version: v1.0.3
    Build Date: Mon Jul  6 09:51:22 CST 2015
    Init Arena
    Init Devs.
    Boot up from NAND flash...
    Bootcode Boot partition size = 524288(0x80000)
    DDR Clock: 800 MHz
    Info: DDR frequency set from clkfreq=1000,*800*
    et1: Broadcom BCM47XX 10/100/1000 Mbps Ethernet Controller 7.14.89.2602 (r534851)
    CPU type 0x0: 1000MHz
    Tot mem: 262144 KBytes
    
    Device eth0:  hwaddr XX-XX-XX-XX-XX-XX, ipaddr 192.168.1.1, mask 255.255.255.0
            gateway not set, nameserver not set
    Checking crc...Loader:raw Filesys:raw Dev:nflash0.os File: Options:(null)
    Loading: .... 4078464 bytes read
    Entry at 0x00008000
    Closing network.
    Starting program at 0x00008000
    console [ttyS0] enabled, bootconsole disabled
    serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117) is a 16550
    brd: module loaded
    loop: module loaded
    pflash: found no supported devices
    bcmsflash: found no supported devices
    Boot partition size = 524288(0x80000)
    lookup_nflash_rootfs_offset: offset = 0x200000
    nflash: squash filesystem with lzma found at block 29
    Creating 5 MTD partitions on "nflash":
    0x000000000000-0x000000080000 : "boot"
    0x000000080000-0x000000200000 : "nvram"
    0x000000200000-0x000002200000 : "linux"
    0x0000003a0de0-0x000002000000 : "rootfs"
    0x000002200000-0x000002240000 : "board_data"
    PPP generic driver version 2.4.2
    PPP MPPE Compression module registered
    NET: Registered protocol family 24
    PPTP driver version 0.8.5
    === PPTP init ===
    Mirror/redirect action on
    u32 classifier
        Actions configured
    Netfilter messages via NETLINK v0.30.
    nf_conntrack version 0.5.0 (3991 buckets, 15964 max)
    xt_time: kernel timezone is -0000
    ip_tables: (C) 2000-2006 Netfilter Core Team
    TCP cubic registered
    NET: Registered protocol family 10
    ip6_tables: (C) 2000-2006 Netfilter Core Team
    NET: Registered protocol family 17
    L2TP core driver, V2.0
    PPPoL2TP kernel driver, V2.0
    802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
    All bugs added by David S. Miller <davem@redhat.com>
    Registering the dns_resolver key type
    Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2012
    NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
    Spare area=64 eccbytes 56, ecc bytes located at:
    2 3 4 5 6 7 8 9 10 11 12 13 14 15 18 19 20 21 22 23 24 25 26 27 28 29 30 31 34 35 36 37 38 39 40 41 42 43 44 45 46 47 50 51 52 53 54 55 56 57 58 59 60 61 62 63
    Available 7 bytes at (off,len):
    (1,1) (16,2) (32,2) (48,2) (0,0) (0,0) (0,0) (0,0)
    Scanning device for bad blocks
    Options: NO_AUTOINCR,NO_READRDY,BBT_SCAN2NDPAGE,
    Creating 2 MTD partitions on "brcmnand":
    0x000002600000-0x000007b00000 : "brcmnand"
    Unable to handle kernel paging request at virtual address ffffffff
    pgd = c0004000
    [ffffffff] *pgd=9fffc021, *pte=00000000, *ppte=00000000
    Internal error: Oops: 1 [#1] PREEMPT SMP
    last sysfs file:
    Modules linked in:
    CPU: 1    Not tainted  (2.6.36.4brcmarm #1)
    PC is at __kmalloc_track_caller+0x70/0x108
    LR is at __kmalloc_track_caller+0x1c/0x108
    pc : [<c037de90>]    lr : [<c037de3c>]    psr: a0000093
    sp : cf825e30  ip : c822585c  fp : 00000001
    r10: 0000a1ff  r9 : 00000008  r8 : ffffffff
    r7 : c01169dc  r6 : 000000d0  r5 : a0000013  r4 : c03d23bc
    r3 : c003b85c  r2 : 081ea000  r1 : 00000000  r0 : c03d23bc
    Flags: NzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
    Control: 10c53c7f  Table: 0000404a  DAC: 00000017
    Process swapper (pid: 1, stack limit = 0xcf824270)
    Stack: (0xcf825e30 to 0xcf826000)
    5e20:                                     cf825e84 c041e5e4 00000006 c01169dc
    5e40: cf825ed8 000000d0 cf8130c0 c00a9104 00000000 cf825ed8 cfa17ae0 00000008
    5e60: cf825ed8 c01169dc 00000000 0000000a ffffffff cf825ed8 cfa17ae0 cfa17ae0
    5e80: cfa648a0 cf8130c0 c03e1f20 00000001 00000001 c0117738 00000000 cfa17ae0
    5ea0: cf825ed8 cf804700 c03e1f20 000001a0 cfa17ad8 00000000 cfa17ae0 cf825ed8
    5ec0: cf804700 c03e1f20 000001a0 c018e9f8 00000021 c037ddfc 313a3039 c0150030
    5ee0: cf825f08 cfa17ad8 cfa17ad8 c03ddf78 cfa17ad8 cfa17a00 00000400 c041fe50
    5f00: c03e1f20 000001a0 00000001 c01983dc 00000001 054e0000 00000000 00000005
    5f20: 05500000 00000000 cfa17a00 c0199cbc 07b00000 00000000 c03704f0 00004101
    5f40: 00000000 00000000 00000001 00000002 00000020 00000000 c041ffe8 c03e1f10
    5f60: c041fe48 0000000e 00000001 00000004 00000001 c001d348 c0420128 c0420128
    5f80: 0000010d c0026d30 c03ec000 cf824000 00000000 c001cca8 00000000 00000000
    5fa0: 00000000 c003d5bc 00000000 c0100000 00000002 c03d7a18 00000100 c02d6768
    5fc0: 00000002 c0026d30 c0026d40 c02d6768 00000002 c0417ee4 00000000 c0008e50
    5fe0: 00000000 c0008cfc c003eb8c 00000013 00000000 c003eb8c 00000000 00000000
    [<c037de90>] (PC is at __kmalloc_track_caller+0x70/0x108)
    [<c037de90>] (__kmalloc_track_caller+0x70/0x108) from [<c00a9104>] (kstrdup+0x30/0x4c)
    [<c00a9104>] (kstrdup+0x30/0x4c) from [<c01169dc>] (sysfs_new_dirent+0xd4/0xf4)
    [<c01169dc>] (sysfs_new_dirent+0xd4/0xf4) from [<c0117738>] (sysfs_do_create_link+0x78/0x22c)
    [<c0117738>] (sysfs_do_create_link+0x78/0x22c) from [<c018e9f8>] (device_add+0x2b0/0x5b0)
    [<c018e9f8>] (device_add+0x2b0/0x5b0) from [<c01983dc>] (add_mtd_device+0x134/0x290)
    [<c01983dc>] (add_mtd_device+0x134/0x290) from [<c0199cbc>] (add_mtd_partitions+0x4d8/0x77c)
    [<c0199cbc>] (add_mtd_partitions+0x4d8/0x77c) from [<c001d348>] (brcmnand_mtd_init+0x6a0/0x7d0)
    [<c001d348>] (brcmnand_mtd_init+0x6a0/0x7d0) from [<c003d5bc>] (do_one_initcall+0x30/0x19c)
    [<c003d5bc>] (do_one_initcall+0x30/0x19c) from [<c0008e50>] (kernel_init+0x154/0x218)
    [<c0008e50>] (kernel_init+0x154/0x218) from [<c003eb8c>] (kernel_thread_exit+0x0/0x8)
    Code: e083c002 e3580000 0a00001d e5941010 (e7981001)
    ---[ end trace 272c2b665f0347d3 ]---
    Kernel panic - not syncing: Fatal exception
    [<c0043ff8>] (unwind_backtrace+0x0/0xf8) from [<c02d1e4c>] (panic+0x74/0x1a0)
    [<c02d1e4c>] (panic+0x74/0x1a0) from [<c00416f0>] (die+0x1a4/0x1dc)
    [<c00416f0>] (die+0x1a4/0x1dc) from [<c0045154>] (__do_kernel_fault+0x64/0x84)
    [<c0045154>] (__do_kernel_fault+0x64/0x84) from [<c0047018>] (do_alignment+0x14c/0x714)
    [<c0047018>] (do_alignment+0x14c/0x714) from [<c003d3a4>] (do_DataAbort+0x30/0x9c)
    [<c003d3a4>] (do_DataAbort+0x30/0x9c) from [<c038c50c>] (__dabt_svc+0x4c/0x60)
    Exception stack(0xcf825de8 to 0xcf825e30)
    5de0:                   c03d23bc 00000000 081ea000 c003b85c c03d23bc a0000013
    5e00: 000000d0 c01169dc ffffffff 00000008 0000a1ff 00000001 c822585c cf825e30
    5e20: c037de3c c037de90 a0000093 ffffffff
    [<c038c50c>] (__dabt_svc+0x4c/0x60) from [<c037de90>] (__kmalloc_track_caller+0x70/0x108)
    [<c037de90>] (__kmalloc_track_caller+0x70/0x108) from [<c00a9104>] (kstrdup+0x30/0x4c)
    [<c00a9104>] (kstrdup+0x30/0x4c) from [<c01169dc>] (sysfs_new_dirent+0xd4/0xf4)
    [<c01169dc>] (sysfs_new_dirent+0xd4/0xf4) from [<c0117738>] (sysfs_do_create_link+0x78/0x22c)
    [<c0117738>] (sysfs_do_create_link+0x78/0x22c) from [<c018e9f8>] (device_add+0x2b0/0x5b0)
    [<c018e9f8>] (device_add+0x2b0/0x5b0) from [<c01983dc>] (add_mtd_device+0x134/0x290)
    [<c01983dc>] (add_mtd_device+0x134/0x290) from [<c0199cbc>] (add_mtd_partitions+0x4d8/0x77c)
    [<c0199cbc>] (add_mtd_partitions+0x4d8/0x77c) from [<c001d348>] (brcmnand_mtd_init+0x6a0/0x7d0)
    [<c001d348>] (brcmnand_mtd_init+0x6a0/0x7d0) from [<c003d5bc>] (do_one_initcall+0x30/0x19c)
    [<c003d5bc>] (do_one_initcall+0x30/0x19c) from [<c0008e50>] (kernel_init+0x154/0x218)
    [<c0008e50>] (kernel_init+0x154/0x218) from [<c003eb8c>] (kernel_thread_exit+0x0/0x8)
    CPU0: stopping
    [<c0043ff8>] (unwind_backtrace+0x0/0xf8) from [<c003d334>] (do_IPI+0x114/0x154)
    [<c003d334>] (do_IPI+0x114/0x154) from [<c038c568>] (__irq_svc+0x48/0xe8)
    Exception stack(0xc03c9f78 to 0xc03c9fc0)
    9f60:                                                       00000003 cf9d1b00
    9f80: c03c9fc0 00000000 c03c8000 c03ec0a8 c03d4b80 c03d4b78 000264f4 413fc090
    9fa0: 0000001f 00000000 00000000 c03c9fc0 c003ebe4 c003ebe8 60000013 ffffffff
    [<c038c568>] (__irq_svc+0x48/0xe8) from [<c003ebe8>] (default_idle+0x24/0x28)
    [<c003ebe8>] (default_idle+0x24/0x28) from [<c003ed88>] (cpu_idle+0x70/0xa4)
    [<c003ed88>] (cpu_idle+0x70/0xa4) from [<c0008ca0>] (start_kernel+0x338/0x394)
    [<c0008ca0>] (start_kernel+0x338/0x394) from [<00008084>] (0x8084)
    Rebooting in 3 seconds..
    I cleaned up the nvram dumps above a bit, and sorted them both. They're attached. Not sure they will be of help to anyone. I was going to post an actual nicely organized diff but lack of sorted key/value pair (e.g. INI and some other formats) comparison rules in popular comparison programs drove me too insane.

    I may be done for now, just too many other projects for the time being for me to dive into this. Tempted to return this router but I might hold on to it in case there is hope in the future. If anyone would like me to guinea pig test a Tomato firmware for the R7300 though, hit me up, I'll give you near-immediate feedback on whether it works. :)

    Also here's some better instructions for debricking:

     

    Attached Files:

  9. Owen Ahmed

    Owen Ahmed New Member Member

    Any update on R7300 firmware?
     
  10. AndreDVJ

    AndreDVJ Addicted to LI Member

    Zero progress, and very unlikely we're gonna see a working firmware for R7300.
     
  11. remlei

    remlei Networkin' Nut Member

    well its a xDSL router so its highly unlikely to get supported.
     
  12. SudoBash

    SudoBash New Member Member

    Surely you all noticed it is crashing when CPU0 tries to cast to an invalid pointer while trying to creating two MTD partitions, probably because they need to be at a different address on r7300:

    Creating 2 MTD partitions on "brcmnand":
    0x000002600000-0x000007b00000 : "brcmnand"
    Unable to handle kernel paging request at virtual address ffffffff
    pgd = c0004000
    [ffffffff] *pgd=9fffc021, *pte=00000000, *ppte=00000000
     
    Last edited: Dec 28, 2017

Share This Page