NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.

Forum Discussion

tgenty's avatar
tgenty
Star
Jun 01, 2020

Orbi RBR50 seems stuck in boot loop

Hi,   After my orbi performance dropped, I restarted the router hopping it will fix it. However it doesnt fully restart now. The power led is solid green and the ring is solid white for like 20 sec...
tgenty's avatar
tgenty
Star
Jul 22, 2020

Well I can't just give up on it yet.

So I've opened the router, found the serial pin on the motherboard and bought a USB-serial cable. Now I can access to the bootloader console but I lack knowledge on this.

I managed to confirmed that firmware upload with tftp works well. However everytime it boots, it ends up with a "data abord" followed by a reset.
Here are the logs of the tftp upload, firmware V2.5.1.32 (I've removed most of the dot while receiving the firmware for clarity)

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -    129185 - bootable_media_detect_success, Start
B -    129199 - elf_loader_entry, Start
B -    131586 - auth_hash_seg_entry, Start
B -    133734 - auth_hash_seg_exit, Start
B -    169767 - elf_segs_hash_verify_entry, Start
B -    283099 - PBL, End
B -    283124 - SBL1, Start
B -    371628 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    373192 - boot_flash_init, Start
D -       593 - boot_flash_init, Delta
B -    380023 - boot_config_data_table_init, Start
D -     74730 - boot_config_data_table_init, Delta - (419 Bytes)
B -    460626 - clock_init, Start
D -      7523 - clock_init, Delta
B -    471575 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    475057 - sbl1_ddr_set_params, Start
B -    480042 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    484532 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13144 - sbl1_ddr_set_params, Delta
B -    497800 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    568859 - sbl1_wait_for_ddr_training, Start
D -        28 - sbl1_wait_for_ddr_training, Delta
B -    585341 - Image Load, Start
D -    785135 - QSEE Image Loaded, Delta - (262104 Bytes)
B -   1370979 - Image Load, Start
D -       888 - SEC Image Loaded, Delta - (0 Bytes)
B -   1380825 - Image Load, Start
D -   1185462 - APPSBL Image Loaded, Delta - (413427 Bytes)
B -   2566718 - QSEE Execution, Start
D -        58 - QSEE Execution, Delta
B -   2572986 - SBL1, End
D -   2291853 - SBL1, Delta
S - Flash Throughput, 342 KB/s  (675950 Bytes,  1976018 us)
S - DDR Frequency, 672 MHz


U-Boot 2012.07 [Barrier Breaker unknown,unknown] (Jul 29 2016 - 22:37:42)

U-boot dni1 V1.1 for DNI HW ID: 29765352; NOR flash 32MB; EMMC flash 4000MB; RAM 512MB
smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC:   qca_mmc: 0
PCI0 Link Intialized
In:    serial
Out:   serial
Err:   serial
machid: 8010001
flash_type: 1
Net:   MAC0 addr:b0:b9:8a:61:af:26
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot:  0
(IPQ40xx) # fw_recovery
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :100 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex

The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1 ...

Rcv:
        .................................................................
        .................................................................
        ......................................................
         32 MB reveived
        ..............................................................
Done!
Bytes transferred = 43518081 (2980881 hex)
mmc_read will run command: mmc read 0x871cfd78 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
HW ID on board: 29765352+0+4000+512+2x2+2x2+4x4
HW ID on image: 29765352+0+4000+512+2x2+2x2+4x4
Firmware Image HW ID matched Board HW ID

mmc_read will run command: mmc read 0x871cfd90 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
MODEL ID on board: RBR50
MODEL ID on image: RBR50
Firmware Image MODEL ID matched Board model ID

mmc_read will run command: mmc read 0x871cfd90 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
MODEL ID on board: RBR50
MODEL ID on image: RBR50
Firmware Image MODEL ID matched Board model ID

mmc erase 0x4622 0x14c05

MMC erase: dev # 0, block # 17954, count 84997 ... 84997 blocks erase: OK
Alive-timer 57
NmrpAliveTimerBase 15
Copy image to Flash... mmc write 0x84000080 0x4622 0x14c05

MMC write: dev # 0, block # 17954, count 84997 ... 84997 blocks write: OK
boot_partition_set 1
mmc_read will run command: mmc read 0x871cfb50 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
Burn BOOT PARTITION DATA (= 110101) into ART block
mmc_read will run command: mmc read 0x871cfb50 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
mmc_sect_erase will run command: mmc erase 0x2a22 0x100

MMC erase: dev # 0, block # 10786, count 256 ... 256 blocks erase: OK
mmc_write will run command: mmc write 0x871cfb50 0x2a22 0x100

MMC write: dev # 0, block # 10786, count 256 ... 256 blocks write: OK
Done.
Alive-timer 22
Done
Rebooting...
resetting ...
Valid chip addresses: 27 48

and the log of the restart (I've removed lots of MMC read log lines for clarity)

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -     17387 - bootable_media_detect_success, Start
B -     17401 - elf_loader_entry, Start
B -     19819 - auth_hash_seg_entry, Start
B -     21967 - auth_hash_seg_exit, Start
B -     56125 - elf_segs_hash_verify_entry, Start
B -    169316 - PBL, End
B -    169341 - SBL1, Start
B -    257848 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    259418 - boot_flash_init, Start
D -       594 - boot_flash_init, Delta
B -    266256 - boot_config_data_table_init, Start
D -     73578 - boot_config_data_table_init, Delta - (419 Bytes)
B -    345709 - clock_init, Start
D -      7518 - clock_init, Delta
B -    356654 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    360134 - sbl1_ddr_set_params, Start
B -    365119 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    369609 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13143 - sbl1_ddr_set_params, Delta
B -    382875 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    453700 - sbl1_wait_for_ddr_training, Start
D -        28 - sbl1_wait_for_ddr_training, Delta
B -    469956 - Image Load, Start
D -    785174 - QSEE Image Loaded, Delta - (262104 Bytes)
B -   1255632 - Image Load, Start
D -       886 - SEC Image Loaded, Delta - (0 Bytes)
B -   1265457 - Image Load, Start
D -   1185486 - APPSBL Image Loaded, Delta - (413427 Bytes)
B -   2451373 - QSEE Execution, Start
D -        58 - QSEE Execution, Delta
B -   2457640 - SBL1, End
D -   2290290 - SBL1, Delta
S - Flash Throughput, 342 KB/s  (675950 Bytes,  1976099 us)
S - DDR Frequency, 672 MHz


U-Boot 2012.07 [Barrier Breaker unknown,unknown] (Jul 29 2016 - 22:37:42)

U-boot dni1 V1.1 for DNI HW ID: 29765352; NOR flash 32MB; EMMC flash 4000MB; RAM 512MB
smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC:   qca_mmc: 0
PCI0 Link Intialized
In:    serial
Out:   serial
Err:   serial
machid: 8010001
flash_type: 1
Net:   MAC0 addr:b0:b9:8a:61:af:26
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot:  0
Valid chip addresses: 27 48
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :100 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex

 Client starts...[Listening] for ADVERTISE...TTT
Retry count exceeded; boot the image as usual

 nmrp server is stopped or failed !
Read BootPart from BOARD DATA...
mmc_read will run command: mmc read 0x871cfca8 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
boot partition : 1
BootPart = 1
Loading DNI firmware for checking...

MMC read: dev # 0, block # 17954, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 18210, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 18466, count 256 ... 256 blocks read: OK
( ... )
MMC read: dev # 0, block # 102690, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 102946, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 17954, count 1 ... 1 blocks read: OK

** rootfs address : 0x843bffc0 **

## Checking Image at 84000000 ...
   FIT image found
   FIT description: ARM OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel@1)
     Description:  ARM OpenWrt Linux-3.14.77
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x840000e4
     Data Size:    3524167 Bytes = 3.4 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   4b698f35
     Hash algo:    sha1
     Hash value:   439cf7c76bf93d7dd525f87978dbfb0a718c7bf7
    Image 1 (fdt@1)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8435c86c
     Data Size:    39067 Bytes = 38.2 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   2fbe7ae7
     Hash algo:    sha1
     Hash value:   10a7fad2926d324e8b06b192c3531c391f78a6ed
    Image 2 (fdt@2)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x84366214
     Data Size:    38617 Bytes = 37.7 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   c0098bb9
     Hash algo:    sha1
     Hash value:   baf8b2904ec24c626934dabf5d6815eadedadc29
    Image 3 (fdt@3)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8436f9fc
     Data Size:    42101 Bytes = 41.1 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   0109faf0
     Hash algo:    sha1
     Hash value:   34ee6bdafd6315d361d6aa99b5ad45a9944b32dd
    Image 4 (fdt@4)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x84379f80
     Data Size:    34248 Bytes = 33.4 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   0fa6ee98
     Hash algo:    sha1
     Hash value:   dcec33a744cfed6a21c9a9be313791f98b1081ff
    Image 5 (fdt@5)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x84382654
     Data Size:    34407 Bytes = 33.6 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   96f6beb1
     Hash algo:    sha1
     Hash value:   3a938e8901b816f4fa7d73aacbc3e2b54422c5d0
    Image 6 (fdt@6)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8438adc8
     Data Size:    34547 Bytes = 33.7 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   ce835bd9
     Hash algo:    sha1
     Hash value:   f48535f83fe16c4d3471b18ddab6dfa5d1a633e7
    Image 7 (fdt@7)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x843935c8
     Data Size:    38588 Bytes = 37.7 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   bb010bc8
     Hash algo:    sha1
     Hash value:   a52a0530438afae1fe5fed13cb380503d0ee576b
    Image 8 (fdt@8)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8439cd90
     Data Size:    38467 Bytes = 37.6 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   311234ec
     Hash algo:    sha1
     Hash value:   c7be34f25ccb51f0d0eaa6985af77d30b872eaef
    Image 9 (fdt@9)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x843a64e0
     Data Size:    38165 Bytes = 37.3 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   f91b53ee
     Hash algo:    sha1
     Hash value:   7f783a91e42dc651bb82f01479f5207640db0d53
    Default Configuration: 'config@1'
    Configuration 0 (config@1)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@1
    Configuration 1 (config@2)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@2
    Configuration 2 (config@3)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@3
    Configuration 3 (config@4)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@4
    Configuration 4 (config@5)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@5
    Configuration 5 (config@6)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@6
    Configuration 6 (config@7)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@7
    Configuration 7 (config@8)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@8
    Configuration 8 (config@9)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@9
## Checking hash(es) for FIT Image at 84000000 ...
   Hash(es) for Image 0 (kernel@1): crc32+ sha1+
   Hash(es) for Image 1 (fdt@1): crc32+ sha1+
   Hash(es) for Image 2 (fdt@2): crc32+ sha1+
   Hash(es) for Image 3 (fdt@3): crc32+ sha1+
   Hash(es) for Image 4 (fdt@4): crc32+ sha1+
   Hash(es) for Image 5 (fdt@5): crc32+ sha1+
   Hash(es) for Image 6 (fdt@6): crc32+ sha1+
   Hash(es) for Image 7 (fdt@7): crc32+ sha1+
   Hash(es) for Image 8 (fdt@8): crc32+ sha1+
   Hash(es) for Image 9 (fdt@9): crc32+ sha1+

## Checking Image at 843bffc0 ...
   Legacy image found
   Image Name:   ARM OpenWrt Linux-3.14.77
   Image Type:   ARM Linux Kernel Image (lzma compressed)
   Data Size:    39585792 Bytes = 37.8 MiB
   Load Address: 40908000
   Entry Point:  40908000
   Verifying Checksum ... OK
mmc_read will run command: mmc read 0x871cfca8 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
boot partition : 1

MMC read: dev # 0, block # 17954, count 7680 ... 7680 blocks read: OK
data abort
pc : [<87303568>]          lr : [<87304250>]
sp : 871efd60  ip : 871f0ad3     fp : 87303557
r10: 00000000  r9 : 00000002     r8 : 871eff60
r7 : 871f0ab8  r6 : 87360cec     r5 : 871f0ab8  r4 : 8735e6a4
r3 : ffffffff  r2 : 00000158     r1 : 00000000  r0 : 87360cec
Flags: nZCv  IRQs off  FIQs off  Mode SVC_32
Resetting CPU ...

resetting ...
Valid chip addresses: 27 68

Here is the printenv command:

(IPQ40xx) # printenv
baudrate=115200
bootcmd=reset_i2c; mii write 0x0 0x0 0x0800; sleep 1; nmrp; bootdni; bootm 0x84000000
bootdelay=2
delenv=mmc erase 0x1622 0x200
ethact=eth0
flash_type=1
ipaddr=192.168.1.1
loadaddr=0x84000000
machid=8010001
serverip=192.168.1.10
stderr=serial
stdin=serial
stdout=serial

Environment size: 313/262140 bytes

I executed the bootcmd manually and I've confirmed that the "data abord" is issued by the "bootm 0x84000000".

 

Any help would be appreciated. 

Rufus1010's avatar
Rufus1010
Aspirant
Jan 17, 2022

Hello, how did you get connected to the router via the terminal and the USB / pins ??

via windows ?? or MAC ?? 

as i have the same problem and bought the serial to USB but cannot get any contact via TeraTerm a windows terminal program i installed.

any help is much appriciated here.

  • pbarham's avatar
    pbarham
    Apprentice
    Jan 17, 2022
    Rufus1010 wrote:

    Hello, how did you get connected to the router via the terminal and the USB / pins ??

    via windows ?? or MAC ?? 

    as i have the same problem and bought the serial to USB but cannot get any contact via TeraTerm a windows terminal program i installed.

    any help is much appriciated here.

    I was using a Macbook Air

    It was a long time ago now, but I think I followed the instructions on this page: https://pbxbook.com/other/mac-tty.html 

    For the physical serial port connection I used this https://www.snbforums.com/attachments/orbi-serial-port-pdf.23898/

     

    If you're not seeing any console output then I'd recommend double checking which header pins on the motherboard you connected the serial line to.  The instructions are very easy to get wrong because there are some other pins close by and the orientation of the motherboard is unclear.   I got mine back to front the first time I tried this!  

     

  • elzilcho's avatar
    elzilcho
    Aspirant
    May 14, 2022

    do you have a list of commands or instructions on how to do this on windows 10? I have an orbi rbr50 that just has a white solid light and will not do anything. I bought the serial to usb adapter and have a terminal open just dont know what to do next. 

  • iScream's avatar
    iScream
    Aspirant
    May 14, 2022
    I gave up. I threw the damn thing to the trash and switched to Linksys. Never using another Netgear device again.
  • elzilcho's avatar
    elzilcho
    Aspirant
    May 14, 2022

    i bought a new orbi. Just wanted to learn how to do something new and see what could be done.