NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Orbi RBR50 seems stuck in boot loop
Hi, After my orbi performance dropped, I restarted the router hopping it will fix it. However it doesnt fully restart now. The power led is solid green and the ring is solid white for like 20 sec...
So I guess that expensive router will go to the trash after only one year of service.
And over the top, I discovered that there is no support from Netgear. I guess I know what brand to avoid for my next wifi mesh system
Well I can't just give up on it yet.
So I've opened the router, found the serial pin on the motherboard and bought a USB-serial cable. Now I can access to the bootloader console but I lack knowledge on this.
I managed to confirmed that firmware upload with tftp works well. However everytime it boots, it ends up with a "data abord" followed by a reset.
Here are the logs of the tftp upload, firmware V2.5.1.32 (I've removed most of the dot while receiving the firmware for clarity)
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1339 - bootable_media_detect_entry, Start
B - 129185 - bootable_media_detect_success, Start
B - 129199 - elf_loader_entry, Start
B - 131586 - auth_hash_seg_entry, Start
B - 133734 - auth_hash_seg_exit, Start
B - 169767 - elf_segs_hash_verify_entry, Start
B - 283099 - PBL, End
B - 283124 - SBL1, Start
B - 371628 - pm_device_init, Start
D - 6 - pm_device_init, Delta
B - 373192 - boot_flash_init, Start
D - 593 - boot_flash_init, Delta
B - 380023 - boot_config_data_table_init, Start
D - 74730 - boot_config_data_table_init, Delta - (419 Bytes)
B - 460626 - clock_init, Start
D - 7523 - clock_init, Delta
B - 471575 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B - 475057 - sbl1_ddr_set_params, Start
B - 480042 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 484532 - Pre_DDR_clock_init, Start
D - 5 - Pre_DDR_clock_init, Delta
D - 13144 - sbl1_ddr_set_params, Delta
B - 497800 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 568859 - sbl1_wait_for_ddr_training, Start
D - 28 - sbl1_wait_for_ddr_training, Delta
B - 585341 - Image Load, Start
D - 785135 - QSEE Image Loaded, Delta - (262104 Bytes)
B - 1370979 - Image Load, Start
D - 888 - SEC Image Loaded, Delta - (0 Bytes)
B - 1380825 - Image Load, Start
D - 1185462 - APPSBL Image Loaded, Delta - (413427 Bytes)
B - 2566718 - QSEE Execution, Start
D - 58 - QSEE Execution, Delta
B - 2572986 - SBL1, End
D - 2291853 - SBL1, Delta
S - Flash Throughput, 342 KB/s (675950 Bytes, 1976018 us)
S - DDR Frequency, 672 MHz
U-Boot 2012.07 [Barrier Breaker unknown,unknown] (Jul 29 2016 - 22:37:42)
U-boot dni1 V1.1 for DNI HW ID: 29765352; NOR flash 32MB; EMMC flash 4000MB; RAM 512MB
smem ram ptable found: ver: 1 len: 3
DRAM: 512 MiB
machid : 0x8010001
NAND: Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC: qca_mmc: 0
PCI0 Link Intialized
In: serial
Out: serial
Err: serial
machid: 8010001
flash_type: 1
Net: MAC0 addr:b0:b9:8a:61:af:26
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot: 0
(IPQ40xx) # fw_recovery
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :100 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1 ...
Rcv:
.................................................................
.................................................................
......................................................
32 MB reveived
..............................................................
Done!
Bytes transferred = 43518081 (2980881 hex)
mmc_read will run command: mmc read 0x871cfd78 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
HW ID on board: 29765352+0+4000+512+2x2+2x2+4x4
HW ID on image: 29765352+0+4000+512+2x2+2x2+4x4
Firmware Image HW ID matched Board HW ID
mmc_read will run command: mmc read 0x871cfd90 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
MODEL ID on board: RBR50
MODEL ID on image: RBR50
Firmware Image MODEL ID matched Board model ID
mmc_read will run command: mmc read 0x871cfd90 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
MODEL ID on board: RBR50
MODEL ID on image: RBR50
Firmware Image MODEL ID matched Board model ID
mmc erase 0x4622 0x14c05
MMC erase: dev # 0, block # 17954, count 84997 ... 84997 blocks erase: OK
Alive-timer 57
NmrpAliveTimerBase 15
Copy image to Flash... mmc write 0x84000080 0x4622 0x14c05
MMC write: dev # 0, block # 17954, count 84997 ... 84997 blocks write: OK
boot_partition_set 1
mmc_read will run command: mmc read 0x871cfb50 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
Burn BOOT PARTITION DATA (= 110101) into ART block
mmc_read will run command: mmc read 0x871cfb50 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
mmc_sect_erase will run command: mmc erase 0x2a22 0x100
MMC erase: dev # 0, block # 10786, count 256 ... 256 blocks erase: OK
mmc_write will run command: mmc write 0x871cfb50 0x2a22 0x100
MMC write: dev # 0, block # 10786, count 256 ... 256 blocks write: OK
Done.
Alive-timer 22
Done
Rebooting...
resetting ...
Valid chip addresses: 27 48and the log of the restart (I've removed lots of MMC read log lines for clarity)
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1339 - bootable_media_detect_entry, Start
B - 17387 - bootable_media_detect_success, Start
B - 17401 - elf_loader_entry, Start
B - 19819 - auth_hash_seg_entry, Start
B - 21967 - auth_hash_seg_exit, Start
B - 56125 - elf_segs_hash_verify_entry, Start
B - 169316 - PBL, End
B - 169341 - SBL1, Start
B - 257848 - pm_device_init, Start
D - 6 - pm_device_init, Delta
B - 259418 - boot_flash_init, Start
D - 594 - boot_flash_init, Delta
B - 266256 - boot_config_data_table_init, Start
D - 73578 - boot_config_data_table_init, Delta - (419 Bytes)
B - 345709 - clock_init, Start
D - 7518 - clock_init, Delta
B - 356654 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B - 360134 - sbl1_ddr_set_params, Start
B - 365119 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 369609 - Pre_DDR_clock_init, Start
D - 5 - Pre_DDR_clock_init, Delta
D - 13143 - sbl1_ddr_set_params, Delta
B - 382875 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 453700 - sbl1_wait_for_ddr_training, Start
D - 28 - sbl1_wait_for_ddr_training, Delta
B - 469956 - Image Load, Start
D - 785174 - QSEE Image Loaded, Delta - (262104 Bytes)
B - 1255632 - Image Load, Start
D - 886 - SEC Image Loaded, Delta - (0 Bytes)
B - 1265457 - Image Load, Start
D - 1185486 - APPSBL Image Loaded, Delta - (413427 Bytes)
B - 2451373 - QSEE Execution, Start
D - 58 - QSEE Execution, Delta
B - 2457640 - SBL1, End
D - 2290290 - SBL1, Delta
S - Flash Throughput, 342 KB/s (675950 Bytes, 1976099 us)
S - DDR Frequency, 672 MHz
U-Boot 2012.07 [Barrier Breaker unknown,unknown] (Jul 29 2016 - 22:37:42)
U-boot dni1 V1.1 for DNI HW ID: 29765352; NOR flash 32MB; EMMC flash 4000MB; RAM 512MB
smem ram ptable found: ver: 1 len: 3
DRAM: 512 MiB
machid : 0x8010001
NAND: Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC: qca_mmc: 0
PCI0 Link Intialized
In: serial
Out: serial
Err: serial
machid: 8010001
flash_type: 1
Net: MAC0 addr:b0:b9:8a:61:af:26
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot: 0
Valid chip addresses: 27 48
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :100 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
Client starts...[Listening] for ADVERTISE...TTT
Retry count exceeded; boot the image as usual
nmrp server is stopped or failed !
Read BootPart from BOARD DATA...
mmc_read will run command: mmc read 0x871cfca8 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
boot partition : 1
BootPart = 1
Loading DNI firmware for checking...
MMC read: dev # 0, block # 17954, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 18210, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 18466, count 256 ... 256 blocks read: OK
( ... )
MMC read: dev # 0, block # 102690, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 102946, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 17954, count 1 ... 1 blocks read: OK
** rootfs address : 0x843bffc0 **
## Checking Image at 84000000 ...
FIT image found
FIT description: ARM OpenWrt FIT (Flattened Image Tree)
Image 0 (kernel@1)
Description: ARM OpenWrt Linux-3.14.77
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x840000e4
Data Size: 3524167 Bytes = 3.4 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
Hash algo: crc32
Hash value: 4b698f35
Hash algo: sha1
Hash value: 439cf7c76bf93d7dd525f87978dbfb0a718c7bf7
Image 1 (fdt@1)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8435c86c
Data Size: 39067 Bytes = 38.2 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 2fbe7ae7
Hash algo: sha1
Hash value: 10a7fad2926d324e8b06b192c3531c391f78a6ed
Image 2 (fdt@2)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84366214
Data Size: 38617 Bytes = 37.7 KiB
Architecture: ARM
Hash algo: crc32
Hash value: c0098bb9
Hash algo: sha1
Hash value: baf8b2904ec24c626934dabf5d6815eadedadc29
Image 3 (fdt@3)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8436f9fc
Data Size: 42101 Bytes = 41.1 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 0109faf0
Hash algo: sha1
Hash value: 34ee6bdafd6315d361d6aa99b5ad45a9944b32dd
Image 4 (fdt@4)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84379f80
Data Size: 34248 Bytes = 33.4 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 0fa6ee98
Hash algo: sha1
Hash value: dcec33a744cfed6a21c9a9be313791f98b1081ff
Image 5 (fdt@5)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84382654
Data Size: 34407 Bytes = 33.6 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 96f6beb1
Hash algo: sha1
Hash value: 3a938e8901b816f4fa7d73aacbc3e2b54422c5d0
Image 6 (fdt@6)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8438adc8
Data Size: 34547 Bytes = 33.7 KiB
Architecture: ARM
Hash algo: crc32
Hash value: ce835bd9
Hash algo: sha1
Hash value: f48535f83fe16c4d3471b18ddab6dfa5d1a633e7
Image 7 (fdt@7)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x843935c8
Data Size: 38588 Bytes = 37.7 KiB
Architecture: ARM
Hash algo: crc32
Hash value: bb010bc8
Hash algo: sha1
Hash value: a52a0530438afae1fe5fed13cb380503d0ee576b
Image 8 (fdt@8)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8439cd90
Data Size: 38467 Bytes = 37.6 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 311234ec
Hash algo: sha1
Hash value: c7be34f25ccb51f0d0eaa6985af77d30b872eaef
Image 9 (fdt@9)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x843a64e0
Data Size: 38165 Bytes = 37.3 KiB
Architecture: ARM
Hash algo: crc32
Hash value: f91b53ee
Hash algo: sha1
Hash value: 7f783a91e42dc651bb82f01479f5207640db0d53
Default Configuration: 'config@1'
Configuration 0 (config@1)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@1
Configuration 1 (config@2)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@2
Configuration 2 (config@3)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@3
Configuration 3 (config@4)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@4
Configuration 4 (config@5)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@5
Configuration 5 (config@6)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@6
Configuration 6 (config@7)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@7
Configuration 7 (config@8)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@8
Configuration 8 (config@9)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@9
## Checking hash(es) for FIT Image at 84000000 ...
Hash(es) for Image 0 (kernel@1): crc32+ sha1+
Hash(es) for Image 1 (fdt@1): crc32+ sha1+
Hash(es) for Image 2 (fdt@2): crc32+ sha1+
Hash(es) for Image 3 (fdt@3): crc32+ sha1+
Hash(es) for Image 4 (fdt@4): crc32+ sha1+
Hash(es) for Image 5 (fdt@5): crc32+ sha1+
Hash(es) for Image 6 (fdt@6): crc32+ sha1+
Hash(es) for Image 7 (fdt@7): crc32+ sha1+
Hash(es) for Image 8 (fdt@8): crc32+ sha1+
Hash(es) for Image 9 (fdt@9): crc32+ sha1+
## Checking Image at 843bffc0 ...
Legacy image found
Image Name: ARM OpenWrt Linux-3.14.77
Image Type: ARM Linux Kernel Image (lzma compressed)
Data Size: 39585792 Bytes = 37.8 MiB
Load Address: 40908000
Entry Point: 40908000
Verifying Checksum ... OK
mmc_read will run command: mmc read 0x871cfca8 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
boot partition : 1
MMC read: dev # 0, block # 17954, count 7680 ... 7680 blocks read: OK
data abort
pc : [<87303568>] lr : [<87304250>]
sp : 871efd60 ip : 871f0ad3 fp : 87303557
r10: 00000000 r9 : 00000002 r8 : 871eff60
r7 : 871f0ab8 r6 : 87360cec r5 : 871f0ab8 r4 : 8735e6a4
r3 : ffffffff r2 : 00000158 r1 : 00000000 r0 : 87360cec
Flags: nZCv IRQs off FIQs off Mode SVC_32
Resetting CPU ...
resetting ...
Valid chip addresses: 27 68Here is the printenv command:
(IPQ40xx) # printenv baudrate=115200 bootcmd=reset_i2c; mii write 0x0 0x0 0x0800; sleep 1; nmrp; bootdni; bootm 0x84000000 bootdelay=2 delenv=mmc erase 0x1622 0x200 ethact=eth0 flash_type=1 ipaddr=192.168.1.1 loadaddr=0x84000000 machid=8010001 serverip=192.168.1.10 stderr=serial stdin=serial stdout=serial Environment size: 313/262140 bytes
I executed the bootcmd manually and I've confirmed that the "data abord" is issued by the "bootm 0x84000000".
Any help would be appreciated.
This isn't good:
"NAND: Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found"No sure if this is a hard or software failure. Not sure if this can be fixed and the user level or not. Something to ask a NG forum moderator about.
SInce Orbi base code is based on Caos Calmer, a derivative of DD-WRT, someting you might post about in one of there forums as well. Seen others work down at that level on there FW.
BTW, how did you open the RBR outter case?
I think the NAND error is normal because the orbi doesnt have NAND flash but 4Gb eMMC.
The "data abord" happens whatever version of the firmware I flash so I though the issue might be with the eMMC and the data gets corrupted, but the function to check the DNI image seems to be just fine.
Anyway I'll look at DD-WRT if I can get some help with that, thanks
To open the outter case, you have to remove the sticker at the back, around the ethernet port etc. Then remove the screws that were hidden behind and slide the 2 parts apart (top to bottom). Removing the rubbers at the bottom might help ;)
Strange thing, I tried to start a new topic (twice) with the u-boot issue but it seems it is not visible in the forum. I can see it in my subscriptions but I can't find it with a search and if open the URL to the post when I'm not connected I get a page not found error. If I click on it from my subscription, the reply buttons are disabled. Odd isn't it?
Thanks for the info.
Good Luck.
Any chance you could share info on the serial console mod?
I have an RBR50 with damaged firmware and I'm trying to find a way to force it into the TFTP recovery process. Maybe this would help?
UPDATE: Google to the rescue:
https://www.snbforums.com/attachments/orbi-serial-port-pdf.23898/
http://en.techinfodepot.shoutwiki.com/wiki/Netgear_Orbi_Router_(RBR50)
Just curious, did you ever solve? I have the exact same issue.
I can start nmrp to advertise and laptop shows file is trying to load after starting nmrp on console, then console says nmrp server stopped or failed. Laptop then times out. They are communicating, but can't get an image to upload.
brichter1978 wrote:Just curious, did you ever solve? I have the exact same issue.
I can start nmrp to advertise and laptop shows file is trying to load after starting nmrp on console, then console says nmrp server stopped or failed. Laptop then times out. They are communicating, but can't get an image to upload.
I solved *my* bricked RBR50 using the serial console.... there's a separate thread about it.
https://community.netgear.com/t5/Orbi/Is-my-13-month-old-RBR50-bricked/m-p/2009904
I'd be interested to see how you did it with the console because I've never fixed mine. But when I hit your link I get an 'invalid parameter' error
--- updated ---
I found your thread with the search engine. Unfortunatly I don't have the same issue that you did, the model Id matches between my board and the firmware and the firmware can be flashed. It just doesn't boot correctly...
Well I fixed mine after 10 hours or so.
I ended up booting unit and pressing space from console to stop boot. Manually set IP to 192.168.1.250.
Had ethernet cable with laptop IP at 192.168.1.5 plugged in direct.
Ran this command on laptop and noticed any time I had this command on the router would be pingable. Chnage both -t ans -T to 90000 to give me more time as pingable.
nmrpflash -v -i net19 -f c:\NG\firmware.img -t 10000 -T 10000 -A 192.168.1.5 -a 192.168.1.250
While router was pingable I ran the TFTP and flashed latest RBS40 FW.
Used TFTPd64, also worked with TFTP2.
Then noticed to error below as mentioned in post on link below. Used manual commands and that allowed a good flash. Reboot took FOREVER, but you could see all the action happening on the console. Plugged into my router and within 2-3 minutes it was in the web GUI. No reprogramming or syncing.
HW ID on board:
HW ID on image: 29765515+0+4096+512+2x2+2x2+2x2
Firmware Image HW ID do not match Board HW ID
Board HW ID mismatch,it is forbidden to be written to flash!!After this I did a set on Mac and then did a Saveenv to memory.
Here is link that was broken posted by other. This link helped me resolve.
https://community.netgear.com/t5/Orbi/Is-my-13-month-old-RBR50-bricked/m-p/2009904
SOLVED RBS40
tgenty wrote:I'd be interested to see how you did it with the console because I've never fixed mine. But when I hit your link I get an 'invalid parameter' error
--- updated ---
I found your thread with the search engine. Unfortunatly I don't have the same issue that you did, the model Id matches between my board and the firmware and the firmware can be flashed. It just doesn't boot correctly...
Sorry... looks like the editor messed up the link in the IURL somehow. If you cut and paste the displated text it works, but if you click on the link it has some bogus extra characters on the end.
If you have the router in the uboot console then there are a bunch of commands for testing various bits of hardware. And you can see much more of the logging when the system is booting, so perhaps you may see a relevant error message. But if the firrmware image looks to be correct then I dojn't know what else to suggest.
Just add HTTPS://
community.netgear.com/t5/Orbi/Is-my-13-month-old-RBR50-bricked/m-p/2009904
Hoping this helps. Also note the ans was a typo in NMRP command above.
Came here and created account just to say thank you! Reset button would just not work to upload the firmare that was botched by the automatic update process. But, serial port trick, following your instructions, unbricked the satelite and saved hundreds of dollars in the process.
Some minor details: While I was able to successfully login using serial port, I couldn't figure how to assign a static IP and tftp server would not start without it. Luckily a quick reboot and interrupting boot process, enabled IP address assignment somehow and TFTP server started like a charm and then followed your steps for HW and Model id configuration, save state was not needed in either case.
Thank you again.
This is the last netgear product I'll purchase.
Hello, how did you get connected to the router via the terminal and the USB / pins ??
via windows ?? or MAC ??
as i have the same problem and bought the serial to USB but cannot get any contact via TeraTerm a windows terminal program i installed.
any help is much appriciated here.
Rufus1010 wrote:Hello, how did you get connected to the router via the terminal and the USB / pins ??
via windows ?? or MAC ??
as i have the same problem and bought the serial to USB but cannot get any contact via TeraTerm a windows terminal program i installed.
any help is much appriciated here.
I was using a Macbook Air
It was a long time ago now, but I think I followed the instructions on this page: https://pbxbook.com/other/mac-tty.html
For the physical serial port connection I used this https://www.snbforums.com/attachments/orbi-serial-port-pdf.23898/
If you're not seeing any console output then I'd recommend double checking which header pins on the motherboard you connected the serial line to. The instructions are very easy to get wrong because there are some other pins close by and the orientation of the motherboard is unclear. I got mine back to front the first time I tried this!
do you have a list of commands or instructions on how to do this on windows 10? I have an orbi rbr50 that just has a white solid light and will not do anything. I bought the serial to usb adapter and have a terminal open just dont know what to do next.
- I gave up. I threw the damn thing to the trash and switched to Linksys. Never using another Netgear device again.
i bought a new orbi. Just wanted to learn how to do something new and see what could be done.
- I purchased the serial cable as well and am able to plug into the Orbi via serial cable.
How did you get access to the console? Did you use Terminal or command prompt? Curious what commands you used.
Thnx!! You guys really need to look up a guide for serial flashing. You don't just buy a usb-ttl serial cable and then figure out what to do. dd-wrt and openwrt usually have guides for when these things happen because they happen very frequently in the firmware flashing arena.
basically,
#1 install the right drivers for the usb-ttl, usually a "prolific pl2303" chip, so you want those drivers. newer drivers 2018+ will read cheap ones as fakes, but older drivers like older than 2017 should recognize it right. then set the rate to 115200 in device manager instead of the regular 9600
#2 download an interfacer like putty so you can interact with the serial console. both the serial and ethernet cable must be plugged in, so there are 2 cables interacting with the orbi. make sure you don't plug into the 3.3v on the serial or else you get the magic smoke. set the ip on network settings to 192.168.1.1 on gateway, 255.255.255.0 on subnet, 192.168.1.10 as the adapter's/yours. on putty, find the serial setting and turn the flow control to off and rate to 115200, and whatever com it says (copy the settings from device manager), then in the connection type click serial, host as 192.168.1.1 on port 69 (because netgear does port 69 on orbis for whatever reason)
#3 click open to show the interface and then power on the orbi. if nothing shows up, you prob need to switch tx and rx pins. you likely need a multimeter to know 1. which is ground first before 2. knowing what hot/3.3v is so you don't plug anything into that one. if you do it correctly, it should shove a whole lot of info on the console. to stop it all push ctrl c or any other button I think. type in "help" to show all the options, but you very likely only need "fw_recovery" and a tftp program to send firmware into it. If none of that works and the u-boot is corrupted, then all this effort was wasted and you likely need another rbr50/rbr40 with a good uboot to extract from and reflash. Unfortunately netgear does not provide bootloader download, nor does anyone else on the internet. At least, not yet.
That's probably most of it and you can probably find other missing info from the other serial unbricking guides. If you bought one off ebay just to try it, you're really gambling. Just like my dumb dumb butt. So far, I have had a 70% success rate with the other 30% being bad uboot.
Excellent post!
Where I get stuck is in the serial interface the boot loader will ask to press any key. Have tried several emulators, both on windows and OSX, can never press a key. Using N81 No flow at the proper speed. Feel like because I get to the prompt I can probably interrupt is if I could just press a key!!
Any ideas?
-So Close
I assume if you have a bad uboot there is no reviving and it looks something like this...
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00110
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Reset status Config, 0x00000033
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1339 - bootable_media_detect_entry, Start
B - 85322 - bootable_media_detect_success, Start
B - 85336 - elf_loader_entry, Start
B - 189543 - auth_hash_seg_entry, Start
B - 191694 - auth_hash_seg_exit, Start
B - 363688 - elf_segs_hash_verify_entry, Start
B - 478097 - PBL, End
B - 478121 - SBL1, Start
B - 570161 - pm_device_init, Start
D - 9 - pm_device_init, Delta
B - 571663 - boot_flash_init, Start
D - 669980 - boot_flash_init, Delta
B - 1245990 - boot_config_data_table_init, Start
D - 104462 - boot_config_data_table_init, Delta - (419 Bytes)
B - 1353044 - clock_init, Start
D - 7544 - clock_init, Delta
B - 1364019 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B - 1367425 - sbl1_ddr_set_params, Start
B - 1372517 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 1376900 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13171 - sbl1_ddr_set_params, Delta
B - 1390196 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 1461441 - sbl1_wait_for_ddr_training, Start
D - 27 - sbl1_wait_for_ddr_training, Delta
B - 1477620 - Image Load, Start
D - 912517 - QSEE Image Loaded, Delta - (262104 Bytes)
B - 2390564 - Image Load, Start
D - 899 - SEC Image Loaded, Delta - (0 Bytes)
B - 2400397 - Image Load, Start
D - 185410 - APPSBL Image Loaded, Delta - (414279 Bytes)
B - 2586233 - QSEE Execution, Start
D - 60 - QSEE Execution, Delta
B - 2592430 - SBL1, End
D - 2116421 - SBL1, Delta
S - Flash Throughput, 549 KB/s (676978 Bytes, 1231023 us)
S - DDR Frequency, 672 MHz
B - 2605318 - Boot error ocuured!. Error code: 3027Thanks
