Re: Orbi RBR50 seems stuck in boot loop

tgenty · ‎2020-06-01

Hi,

After my orbi performance dropped, I restarted the router hopping it will fix it. However it doesnt fully restart now. The power led is solid green and the ring is solid white for like 20 seconds then shutdowns for 8 seconds and comes back white for 20 secs and keeps looping, like it keeps rebooting itself

I tried different power outlets and my satelitte AC adapter, no effect.

I tried to hard reset, still the same.

I tried to flash a firmware with tftp, it remains the same. I tried the lastest firmware and some older ones with no success.

I run into the same kind of issue a few months back but I fixed it with the firmware flash with tftp. This time I can't get it restarting. Any suggestion?

Thanks,

FURRYe38 · ‎2020-06-01

So it won't come to ready even after the TFTP and the RBR disconnected from the ISP modem/ONT?

tgenty · ‎2020-06-01

That's right. Only the laptop is connected with a cable .

FURRYe38 · ‎2020-06-01

And pressing the reset button for 15 seconds doesn't stop this?

Try this method of TFTP as last resort:

https://kb.netgear.com/000059634/How-to-upload-firmware-to-a-NETGEAR-router-using-Windows-TFTP
Need to press the reset button for 30 seconds then release, then it send to PUT the command and upload the FW.
I had a problem on a Windows 10 PC where this didn't work to use TFTP, so I switched to a WIndows 7 PC and the TFTP worked.

IF this doesn't stop the problem, then I presume the RBR is bad and needs to be replaced.

tgenty · ‎2020-06-01

I've already tried the tftp method described in the link. I tried the NG tftp app too and the tftp transfer (put) seems to work just fine. Also, I've have already used the method successfully in the past, so I guess I'm doing it correctly.
The router for 1 year old in april, so not under warranty any more. I should have returned it the first time I had to use the tftp method to recover a failure. It's a shame for an equipment that expensive...

Thanks for your suggestions anyway.

FURRYe38 · ‎2020-06-01

At least you tried.

Good Luck.

tgenty · ‎2020-06-02

So I guess that expensive router will go to the trash after only one year of service.

And over the top, I discovered that there is no support from Netgear. I guess I know what brand to avoid for my next wifi mesh system

tgenty · ‎2020-07-22

Well I can't just give up on it yet.

So I've opened the router, found the serial pin on the motherboard and bought a USB-serial cable. Now I can access to the bootloader console but I lack knowledge on this.

I managed to confirmed that firmware upload with tftp works well. However everytime it boots, it ends up with a "data abord" followed by a reset.
Here are the logs of the tftp upload, firmware V2.5.1.32 (I've removed most of the dot while receiving the firmware for clarity)

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -    129185 - bootable_media_detect_success, Start
B -    129199 - elf_loader_entry, Start
B -    131586 - auth_hash_seg_entry, Start
B -    133734 - auth_hash_seg_exit, Start
B -    169767 - elf_segs_hash_verify_entry, Start
B -    283099 - PBL, End
B -    283124 - SBL1, Start
B -    371628 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    373192 - boot_flash_init, Start
D -       593 - boot_flash_init, Delta
B -    380023 - boot_config_data_table_init, Start
D -     74730 - boot_config_data_table_init, Delta - (419 Bytes)
B -    460626 - clock_init, Start
D -      7523 - clock_init, Delta
B -    471575 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    475057 - sbl1_ddr_set_params, Start
B -    480042 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    484532 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13144 - sbl1_ddr_set_params, Delta
B -    497800 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    568859 - sbl1_wait_for_ddr_training, Start
D -        28 - sbl1_wait_for_ddr_training, Delta
B -    585341 - Image Load, Start
D -    785135 - QSEE Image Loaded, Delta - (262104 Bytes)
B -   1370979 - Image Load, Start
D -       888 - SEC Image Loaded, Delta - (0 Bytes)
B -   1380825 - Image Load, Start
D -   1185462 - APPSBL Image Loaded, Delta - (413427 Bytes)
B -   2566718 - QSEE Execution, Start
D -        58 - QSEE Execution, Delta
B -   2572986 - SBL1, End
D -   2291853 - SBL1, Delta
S - Flash Throughput, 342 KB/s  (675950 Bytes,  1976018 us)
S - DDR Frequency, 672 MHz


U-Boot 2012.07 [Barrier Breaker unknown,unknown] (Jul 29 2016 - 22:37:42)

U-boot dni1 V1.1 for DNI HW ID: 29765352; NOR flash 32MB; EMMC flash 4000MB; RAM 512MB
smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC:   qca_mmc: 0
PCI0 Link Intialized
In:    serial
Out:   serial
Err:   serial
machid: 8010001
flash_type: 1
Net:   MAC0 addr:b0:b9:8a:61:af:26
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot:  0
(IPQ40xx) # fw_recovery
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :100 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex

The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1 ...

Rcv:
        .................................................................
        .................................................................
        ......................................................
         32 MB reveived
        ..............................................................
Done!
Bytes transferred = 43518081 (2980881 hex)
mmc_read will run command: mmc read 0x871cfd78 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
HW ID on board: 29765352+0+4000+512+2x2+2x2+4x4
HW ID on image: 29765352+0+4000+512+2x2+2x2+4x4
Firmware Image HW ID matched Board HW ID

mmc_read will run command: mmc read 0x871cfd90 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
MODEL ID on board: RBR50
MODEL ID on image: RBR50
Firmware Image MODEL ID matched Board model ID

mmc_read will run command: mmc read 0x871cfd90 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
MODEL ID on board: RBR50
MODEL ID on image: RBR50
Firmware Image MODEL ID matched Board model ID

mmc erase 0x4622 0x14c05

MMC erase: dev # 0, block # 17954, count 84997 ... 84997 blocks erase: OK
Alive-timer 57
NmrpAliveTimerBase 15
Copy image to Flash... mmc write 0x84000080 0x4622 0x14c05

MMC write: dev # 0, block # 17954, count 84997 ... 84997 blocks write: OK
boot_partition_set 1
mmc_read will run command: mmc read 0x871cfb50 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
Burn BOOT PARTITION DATA (= 110101) into ART block
mmc_read will run command: mmc read 0x871cfb50 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
mmc_sect_erase will run command: mmc erase 0x2a22 0x100

MMC erase: dev # 0, block # 10786, count 256 ... 256 blocks erase: OK
mmc_write will run command: mmc write 0x871cfb50 0x2a22 0x100

MMC write: dev # 0, block # 10786, count 256 ... 256 blocks write: OK
Done.
Alive-timer 22
Done
Rebooting...
resetting ...
Valid chip addresses: 27 48

and the log of the restart (I've removed lots of MMC read log lines for clarity)

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -     17387 - bootable_media_detect_success, Start
B -     17401 - elf_loader_entry, Start
B -     19819 - auth_hash_seg_entry, Start
B -     21967 - auth_hash_seg_exit, Start
B -     56125 - elf_segs_hash_verify_entry, Start
B -    169316 - PBL, End
B -    169341 - SBL1, Start
B -    257848 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    259418 - boot_flash_init, Start
D -       594 - boot_flash_init, Delta
B -    266256 - boot_config_data_table_init, Start
D -     73578 - boot_config_data_table_init, Delta - (419 Bytes)
B -    345709 - clock_init, Start
D -      7518 - clock_init, Delta
B -    356654 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    360134 - sbl1_ddr_set_params, Start
B -    365119 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    369609 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13143 - sbl1_ddr_set_params, Delta
B -    382875 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    453700 - sbl1_wait_for_ddr_training, Start
D -        28 - sbl1_wait_for_ddr_training, Delta
B -    469956 - Image Load, Start
D -    785174 - QSEE Image Loaded, Delta - (262104 Bytes)
B -   1255632 - Image Load, Start
D -       886 - SEC Image Loaded, Delta - (0 Bytes)
B -   1265457 - Image Load, Start
D -   1185486 - APPSBL Image Loaded, Delta - (413427 Bytes)
B -   2451373 - QSEE Execution, Start
D -        58 - QSEE Execution, Delta
B -   2457640 - SBL1, End
D -   2290290 - SBL1, Delta
S - Flash Throughput, 342 KB/s  (675950 Bytes,  1976099 us)
S - DDR Frequency, 672 MHz


U-Boot 2012.07 [Barrier Breaker unknown,unknown] (Jul 29 2016 - 22:37:42)

U-boot dni1 V1.1 for DNI HW ID: 29765352; NOR flash 32MB; EMMC flash 4000MB; RAM 512MB
smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC:   qca_mmc: 0
PCI0 Link Intialized
In:    serial
Out:   serial
Err:   serial
machid: 8010001
flash_type: 1
Net:   MAC0 addr:b0:b9:8a:61:af:26
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot:  0
Valid chip addresses: 27 48
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :100 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex

 Client starts...[Listening] for ADVERTISE...TTT
Retry count exceeded; boot the image as usual

 nmrp server is stopped or failed !
Read BootPart from BOARD DATA...
mmc_read will run command: mmc read 0x871cfca8 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
boot partition : 1
BootPart = 1
Loading DNI firmware for checking...

MMC read: dev # 0, block # 17954, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 18210, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 18466, count 256 ... 256 blocks read: OK
( ... )
MMC read: dev # 0, block # 102690, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 102946, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 17954, count 1 ... 1 blocks read: OK

** rootfs address : 0x843bffc0 **

## Checking Image at 84000000 ...
   FIT image found
   FIT description: ARM OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel@1)
     Description:  ARM OpenWrt Linux-3.14.77
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x840000e4
     Data Size:    3524167 Bytes = 3.4 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   4b698f35
     Hash algo:    sha1
     Hash value:   439cf7c76bf93d7dd525f87978dbfb0a718c7bf7
    Image 1 (fdt@1)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8435c86c
     Data Size:    39067 Bytes = 38.2 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   2fbe7ae7
     Hash algo:    sha1
     Hash value:   10a7fad2926d324e8b06b192c3531c391f78a6ed
    Image 2 (fdt@2)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x84366214
     Data Size:    38617 Bytes = 37.7 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   c0098bb9
     Hash algo:    sha1
     Hash value:   baf8b2904ec24c626934dabf5d6815eadedadc29
    Image 3 (fdt@3)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8436f9fc
     Data Size:    42101 Bytes = 41.1 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   0109faf0
     Hash algo:    sha1
     Hash value:   34ee6bdafd6315d361d6aa99b5ad45a9944b32dd
    Image 4 (fdt@4)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x84379f80
     Data Size:    34248 Bytes = 33.4 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   0fa6ee98
     Hash algo:    sha1
     Hash value:   dcec33a744cfed6a21c9a9be313791f98b1081ff
    Image 5 (fdt@5)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x84382654
     Data Size:    34407 Bytes = 33.6 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   96f6beb1
     Hash algo:    sha1
     Hash value:   3a938e8901b816f4fa7d73aacbc3e2b54422c5d0
    Image 6 (fdt@6)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8438adc8
     Data Size:    34547 Bytes = 33.7 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   ce835bd9
     Hash algo:    sha1
     Hash value:   f48535f83fe16c4d3471b18ddab6dfa5d1a633e7
    Image 7 (fdt@7)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x843935c8
     Data Size:    38588 Bytes = 37.7 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   bb010bc8
     Hash algo:    sha1
     Hash value:   a52a0530438afae1fe5fed13cb380503d0ee576b
    Image 8 (fdt@8)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x8439cd90
     Data Size:    38467 Bytes = 37.6 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   311234ec
     Hash algo:    sha1
     Hash value:   c7be34f25ccb51f0d0eaa6985af77d30b872eaef
    Image 9 (fdt@9)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x843a64e0
     Data Size:    38165 Bytes = 37.3 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   f91b53ee
     Hash algo:    sha1
     Hash value:   7f783a91e42dc651bb82f01479f5207640db0d53
    Default Configuration: 'config@1'
    Configuration 0 (config@1)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@1
    Configuration 1 (config@2)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@2
    Configuration 2 (config@3)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@3
    Configuration 3 (config@4)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@4
    Configuration 4 (config@5)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@5
    Configuration 5 (config@6)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@6
    Configuration 6 (config@7)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@7
    Configuration 7 (config@8)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@8
    Configuration 8 (config@9)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@9
## Checking hash(es) for FIT Image at 84000000 ...
   Hash(es) for Image 0 (kernel@1): crc32+ sha1+
   Hash(es) for Image 1 (fdt@1): crc32+ sha1+
   Hash(es) for Image 2 (fdt@2): crc32+ sha1+
   Hash(es) for Image 3 (fdt@3): crc32+ sha1+
   Hash(es) for Image 4 (fdt@4): crc32+ sha1+
   Hash(es) for Image 5 (fdt@5): crc32+ sha1+
   Hash(es) for Image 6 (fdt@6): crc32+ sha1+
   Hash(es) for Image 7 (fdt@7): crc32+ sha1+
   Hash(es) for Image 8 (fdt@8): crc32+ sha1+
   Hash(es) for Image 9 (fdt@9): crc32+ sha1+

## Checking Image at 843bffc0 ...
   Legacy image found
   Image Name:   ARM OpenWrt Linux-3.14.77
   Image Type:   ARM Linux Kernel Image (lzma compressed)
   Data Size:    39585792 Bytes = 37.8 MiB
   Load Address: 40908000
   Entry Point:  40908000
   Verifying Checksum ... OK
mmc_read will run command: mmc read 0x871cfca8 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
boot partition : 1

MMC read: dev # 0, block # 17954, count 7680 ... 7680 blocks read: OK
data abort
pc : [<87303568>]          lr : [<87304250>]
sp : 871efd60  ip : 871f0ad3     fp : 87303557
r10: 00000000  r9 : 00000002     r8 : 871eff60
r7 : 871f0ab8  r6 : 87360cec     r5 : 871f0ab8  r4 : 8735e6a4
r3 : ffffffff  r2 : 00000158     r1 : 00000000  r0 : 87360cec
Flags: nZCv  IRQs off  FIQs off  Mode SVC_32
Resetting CPU ...

resetting ...
Valid chip addresses: 27 68

Here is the printenv command:

(IPQ40xx) # printenv
baudrate=115200
bootcmd=reset_i2c; mii write 0x0 0x0 0x0800; sleep 1; nmrp; bootdni; bootm 0x84000000
bootdelay=2
delenv=mmc erase 0x1622 0x200
ethact=eth0
flash_type=1
ipaddr=192.168.1.1
loadaddr=0x84000000
machid=8010001
serverip=192.168.1.10
stderr=serial
stdin=serial
stdout=serial

Environment size: 313/262140 bytes

I executed the bootcmd manually and I've confirmed that the "data abord" is issued by the "bootm 0x84000000".

Any help would be appreciated.

FURRYe38 · ‎2020-07-22

This isn't good:

"NAND: Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found"

No sure if this is a hard or software failure. Not sure if this can be fixed and the user level or not. Something to ask a NG forum moderator about.

SInce Orbi base code is based on Caos Calmer, a derivative of DD-WRT, someting you might post about in one of there forums as well. Seen others work down at that level on there FW.

BTW, how did you open the RBR outter case?

tgenty · ‎2020-07-22

I think the NAND error is normal because the orbi doesnt have NAND flash but 4Gb eMMC.

The "data abord" happens whatever version of the firmware I flash so I though the issue might be with the eMMC and the data gets corrupted, but the function to check the DNI image seems to be just fine.

Anyway I'll look at DD-WRT if I can get some help with that, thanks

To open the outter case, you have to remove the sticker at the back, around the ethernet port etc. Then remove the screws that were hidden behind and slide the 2 parts apart (top to bottom). Removing the rubbers at the bottom might help 😉

tgenty · ‎2020-07-22

Strange thing, I tried to start a new topic (twice) with the u-boot issue but it seems it is not visible in the forum. I can see it in my subscriptions but I can't find it with a search and if open the URL to the post when I'm not connected I get a page not found error. If I click on it from my subscription, the reply buttons are disabled. Odd isn't it?

FURRYe38 · ‎2020-07-22

Thanks for the info.

Good Luck.

pbarham · ‎2020-11-21

Any chance you could share info on the serial console mod?

I have an RBR50 with damaged firmware and I'm trying to find a way to force it into the TFTP recovery process. Maybe this would help?

UPDATE: Google to the rescue:

https://www.snbforums.com/attachments/orbi-serial-port-pdf.23898/

http://en.techinfodepot.shoutwiki.com/wiki/Netgear_Orbi_Router_(RBR50)

brichter1978 · ‎2021-01-25

Just curious, did you ever solve? I have the exact same issue.

I can start nmrp to advertise and laptop shows file is trying to load after starting nmrp on console, then console says nmrp server stopped or failed. Laptop then times out. They are communicating, but can't get an image to upload.

pbarham · ‎2021-01-25

@brichter1978 wrote:
Just curious, did you ever solve? I have the exact same issue.

I can start nmrp to advertise and laptop shows file is trying to load after starting nmrp on console, then console says nmrp server stopped or failed. Laptop then times out. They are communicating, but can't get an image to upload.

I solved *my* bricked RBR50 using the serial console.... there's a separate thread about it.

https://community.netgear.com/t5/Orbi/Is-my-13-month-old-RBR50-bricked/m-p/2009904

tgenty · ‎2021-01-26

I'd be interested to see how you did it with the console because I've never fixed mine. But when I hit your link I get an 'invalid parameter' error

--- updated ---

I found your thread with the search engine. Unfortunatly I don't have the same issue that you did, the model Id matches between my board and the firmware and the firmware can be flashed. It just doesn't boot correctly...

brichter1978 · ‎2021-01-26

Well I fixed mine after 10 hours or so.

I ended up booting unit and pressing space from console to stop boot. Manually set IP to 192.168.1.250.

Had ethernet cable with laptop IP at 192.168.1.5 plugged in direct.

Ran this command on laptop and noticed any time I had this command on the router would be pingable. Chnage both -t ans -T to 90000 to give me more time as pingable.

nmrpflash -v -i net19 -f c:\NG\firmware.img -t 10000 -T 10000 -A 192.168.1.5 -a 192.168.1.250

While router was pingable I ran the TFTP and flashed latest RBS40 FW.

Used TFTPd64, also worked with TFTP2.

Then noticed to error below as mentioned in post on link below. Used manual commands and that allowed a good flash. Reboot took FOREVER, but you could see all the action happening on the console. Plugged into my router and within 2-3 minutes it was in the web GUI. No reprogramming or syncing.

HW ID on board:
HW ID on image: 29765515+0+4096+512+2x2+2x2+2x2
Firmware Image HW ID do not match Board HW ID
Board HW ID mismatch,it is forbidden to be written to flash!!

After this I did a set on Mac and then did a Saveenv to memory.

Here is link that was broken posted by other. This link helped me resolve.

https://community.netgear.com/t5/Orbi/Is-my-13-month-old-RBR50-bricked/m-p/2009904

SOLVED RBS40

pbarham · ‎2021-01-26

@tgenty wrote:
I'd be interested to see how you did it with the console because I've never fixed mine. But when I hit your link I get an 'invalid parameter' error

--- updated ---
I found your thread with the search engine. Unfortunatly I don't have the same issue that you did, the model Id matches between my board and the firmware and the firmware can be flashed. It just doesn't boot correctly...

Sorry... looks like the editor messed up the link in the IURL somehow. If you cut and paste the displated text it works, but if you click on the link it has some bogus extra characters on the end.

If you have the router in the uboot console then there are a bunch of commands for testing various bits of hardware. And you can see much more of the logging when the system is booting, so perhaps you may see a relevant error message. But if the firrmware image looks to be correct then I dojn't know what else to suggest.

brichter1978 · ‎2021-01-26

Just add HTTPS://

community.netgear.com/t5/Orbi/Is-my-13-month-old-RBR50-bricked/m-p/2009904

Hoping this helps. Also note the ans was a typo in NMRP command above.

akinuslu · ‎2021-04-06

Came here and created account just to say thank you! Reset button would just not work to upload the firmare that was botched by the automatic update process. But, serial port trick, following your instructions, unbricked the satelite and saved hundreds of dollars in the process.

Some minor details: While I was able to successfully login using serial port, I couldn't figure how to assign a static IP and tftp server would not start without it. Luckily a quick reboot and interrupting boot process, enabled IP address assignment somehow and TFTP server started like a charm and then followed your steps for HW and Model id configuration, save state was not needed in either case.

Thank you again.

This is the last netgear product I'll purchase.

iScream · ‎2021-05-31

Same here, so frustrating!

FURRYe38 · ‎2021-05-31

Try this?

https://kb.netgear.com/000059634/How-to-upload-firmware-to-a-NETGEAR-router-using-Windows-TFTP
Need to press the reset button for 30 seconds then release, then it send to PUT the command and upload the FW.

IF this fails then the RBR needs to be replaced.

@iScream wrote:
Same here, so frustrating!

iScream · ‎2021-06-01

Will try, thank you!

nanojohn · ‎2021-10-22

I am having a similar issue, but when I connect to serial port via USB-TTL, I only get the below logs on repeat every 5-10 seconds. Is there anyway to interrupt this to force an interaction? I have tried spamming Ctrl+C and other keys without success:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1339 - bootable_media_detect_entry, Start
B - 17362 - bootable_media_detect_success, Start
B - 17376 - elf_loader_entry, Start
B - 19749 - auth_hash_seg_entry, Start
B - 21898 - auth_hash_seg_exit, Start
B - 56014 - elf_segs_hash_verify_entry, Start
B - 169204 - PBL, End
B - 169229 - SBL1, Start
B - 257720 - pm_device_init, Start
D - 6 - pm_device_init, Delta
B - 259290 - boot_flash_init, Start
D - 595 - boot_flash_init, Delta
B - 266127 - boot_config_data_table_init, Start
D - 74286 - boot_config_data_table_init, Delta - (419 Bytes)
B - 346290 - clock_init, Start
D - 7547 - clock_init, Delta
B - 357264 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B - 360744 - sbl1_ddr_set_params, Start
B - 365729 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 370220 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13144 - sbl1_ddr_set_params, Delta
B - 383487 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 454336 - sbl1_wait_for_ddr_training, Start
D - 28 - sbl1_wait_for_ddr_training, Delta
B - 470807 - Image Load, Start
D - 784969 - QSEE Image Loaded, Delta - (262104 Bytes)
B - 1256278 - Image Load, Start
D - 887 - SEC Image Loaded, Delta - (0 Bytes)
B - 1266103 - Image Load, Start
D - 1185435 - APPSBL Image Loaded, Delta - (413427 Bytes)
B - 2451968 - QSEE Execution, Start
D - 58 - QSEE Execution, Delta
B - 2458239 - SBL1, End
D - 2291000 - SBL1, Delta
S - Flash Throughput, 342 KB/s (675950 Bytes, 1975795 us)
S - DDR Frequency, 672 MHz

FURRYe38 · ‎2021-10-22

Might see if any thing here helps:

https://www.snbforums.com/threads/custom-firmware-build-for-orbi-rbk50-rbk53-rbr50-rbs50-v-9-2-5-1-1...
https://community.netgear.com/t5/Orbi/Is-my-13-month-old-RBR50-bricked/td-p/2009904/jump-to/first-un...