RBR50 Bricked

  • ATTENTION! As of November 1, 2020, you are not able to reply to threads 6 months after the thread is opened if there are more than 500 posts in the thread.
    Threads will not be locked, so posts may still be edited by their authors.
    Just start a new thread on the topic to post if you get an error message when trying to reply to a thread.

Jamie0691

New Around Here
Hi all, posted this on Reddit but didn't get much of a response, hoping someone can help on here.

I bought a RBR50 off eBay, which I knew was not working fully, have managed to get a serial convertor for it and trying to get it working again (I thought someone had tried to convert it and bricked it), I believe it is a RBR50v1 as it has the USB port on the back.

When it turns on, 9 times out of 10 the power LED will stay solid with no light coming on the ring at the top. When it boots like this, the output on the console will hang and it will show the following

Code:
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00110
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -    105069 - bootable_media_detect_success, Start
B -    105083 - elf_loader_entry, Start
B -    111041 - auth_hash_seg_entry, Start
B -    113186 - auth_hash_seg_exit, Start
B -    175977 - elf_segs_hash_verify_entry, Start
B -    290084 - PBL, End
B -    290108 - SBL1, Start
B -    382135 - pm_device_init, Start
D -         9 - pm_device_init, Delta
B -    383643 - boot_flash_init, Start
D -     42142 - boot_flash_init, Delta
B -    430135 - boot_config_data_table_init, Start
D -     10092 - boot_config_data_table_init, Delta - (419 Bytes)
B -    442830 - clock_init, Start
D -      7547 - clock_init, Delta
B -    453815 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    457221 - sbl1_ddr_set_params, Start
B -    462315 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    466699 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13172 - sbl1_ddr_set_params, Delta
B -    479995 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    551380 - sbl1_wait_for_ddr_training, Start
D -        28 - sbl1_wait_for_ddr_training, Delta
B -    567557 - Image Load, Start
D -    129744 - QSEE Image Loaded, Delta - (262104 Bytes)
B -    697729 - Image Load, Start
D -       898 - SEC Image Loaded, Delta - (0 Bytes)
B -    707579 - Image Load, Start
D -    157324 - APPSBL Image Loaded, Delta - (416039 Bytes)
B -    865329 - QSEE Execution, Start
D -        60 - QSEE Execution, Delta
B -    871522 - SBL1, End
D -    583527 - SBL1, Delta
S - Flash Throughput, 2260 KB/s  (678738 Bytes,  300231 us)
S - DDR Frequency, 672 MHz

I then need to hold the reset button in when its powered on, sometimes when its powered off and hope that it then boots, when it does boot (solid green power light, ring light at top flashing white) I get the following (This was after attempting to push a Netgear FW to it using TFTP)

Code:
U-Boot 2012.07 [Barrier Breaker unknown,unknown] (Jan 04 2017 - 13:54:09)

U-boot dni1 V1.4 for DNI HW ID: 29765352; NOR flash 32MB; EMMC flash 4000MB; RAM 512MB
smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  ID = 0
Vendor = 0
Device = 0
Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC:   qca_mmc: 0
*** Warning - bad CRC, using default environment

PCI0 Link Intialized
In:    serial
Out:   serial
Err:   serial
Valid chip addresses: 27 48
machid: 8010001
flash_type: 1
Net:   MAC0 addr:78:d2:94:b9:fa:9f
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot:  0
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 up Speed :1000 Full duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex

 Client starts...[Listening] for ADVERTISE...TTT
Retry count exceeded; boot the image as usual

 nmrp server is stopped or failed !
Read BootPart from BOARD DATA...
mmc_read will run command: mmc read 0x871cfca8 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
boot partition : 1
BootPart = 1
Loading DNI firmware for checking...
MMC read: dev # 0, block # 17954, count 1 ... 1 blocks read: OK

** rootfs address : 0x8433ffc0 **

## Checking Image at 84000000 ...
   FIT image found
   FIT description: ARM OpenWrt FIT (Flattened Image Tree)
    Image 0 ([email protected])
     Description:  ARM OpenWrt Linux-3.14.77
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x840000e4
     Data Size:    3056350 Bytes = 2.9 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   6c526cda
     Hash algo:    sha1
     Hash value:   859d1e24b8930ea0400799e997d56a3d301738c8
    Image 1 ([email protected])
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x842ea504
     Data Size:    39067 Bytes = 38.2 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   2fbe7ae7
     Hash algo:    sha1
     Hash value:   10a7fad2926d324e8b06b192c3531c391f78a6ed
    Image 2 ([email protected])
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x842f3eac
     Data Size:    38617 Bytes = 37.7 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   c0098bb9
     Hash algo:    sha1
     Hash value:   baf8b2904ec24c626934dabf5d6815eadedadc29
    Image 3 ([email protected])
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x842fd694
     Data Size:    42101 Bytes = 41.1 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   0109faf0
     Hash algo:    sha1
     Hash value:   34ee6bdafd6315d361d6aa99b5ad45a9944b32dd
    Image 4 ([email protected])
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x84307c18
     Data Size:    34248 Bytes = 33.4 KiB
     Architecture: ARM
    Image 5 ([email protected])
     Description:  ARM OpenWrt qcom-ipq40xx-ap.doxx device tree blob
     Type:         Unknown Image
     Compression:  Unknown Compression
     Data Start:   unavailable
     Data Size:    unavailable
## Checking hash(es) for FIT Image at 84000000 ...
   Hash(es) for Image 0 ([email protected]): crc32 error!
Bad hash value for '[email protected]' hash node in '[email protected]' image node
Bad hash in FIT image!
linux checksum error
mmc_read will run command: mmc read 0x871cfb08 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
Burn BOOT PARTITION DATA (= 110102) into ART block
mmc_read will run command: mmc read 0x871cfb08 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
mmc_sect_erase will run command: mmc erase 0x2a22 0x100

MMC erase: dev # 0, block # 10786, count 256 ... 256 blocks erase: OK
mmc_write will run command: mmc write 0x871cfb08 0x2a22 0x100

MMC write: dev # 0, block # 10786, count 256 ... 256 blocks write: OK
Done.

## Checking Image at 8433ffc0 ...
   Legacy image found
   Image Name:   ARM OpenWrt Linux-3.14.77
   Image Type:   ARM Linux Kernel Image (lzma compressed)
   Data Size:    41945088 Bytes = 40 MiB
   Load Address: 40908000
   Entry Point:  40908000
   Verifying Checksum ...    Bad Data CRC
rootfs checksum error
mmc_read will run command: mmc read 0x871cfb08 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
Burn BOOT PARTITION DATA (= 110102) into ART block
mmc_read will run command: mmc read 0x871cfb08 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
mmc_sect_erase will run command: mmc erase 0x2a22 0x100

MMC erase: dev # 0, block # 10786, count 256 ... 256 blocks erase: OK
mmc_write will run command: mmc write 0x871cfb08 0x2a22 0x100

MMC write: dev # 0, block # 10786, count 256 ... 256 blocks write: OK
Done.
mmc_read will run command: mmc read 0x871cfca8 0x2a22 0x100

MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
boot partition : 1

MMC read: dev # 0, block # 17954, count 7680 ... 7680 blocks read: OK
## Booting kernel from FIT Image at 84000000 ...
   Using '[email protected]' configuration
   Trying '[email protected]' kernel subimage
     Description:  ARM OpenWrt Linux-3.14.77
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x840000e4
     Data Size:    3056350 Bytes = 2.9 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   6c526cda
     Hash algo:    sha1
     Hash value:   859d1e24b8930ea0400799e997d56a3d301738c8
   Verifying Hash Integrity ... crc32 error!
Bad hash value for '[email protected]' hash node in '[email protected]' image node
Bad Data Hash
ERROR: can't get kernel image!

Does this sound like something which could be fixed by writting a new firmware across, be it Netgear or Voxel? Or is this more of a hardware issue? I have been outputting the puTTy log, so have all previous logs to look at if needed from various FW attempts etc, note that when the push of the firmware happens, it doesn't actually reboot itself, I need to reboot it manually as described above and hope it works.
 

poncho17

New Around Here
hey jamie,
yeah, that's an easy fix.

get to this part:

Code:
U-Boot 2012.07 [Barrier Breaker unknown,unknown] (Jan 04 2017 - 13:54:09)

U-boot dni1 V1.4 for DNI HW ID: 29765352; NOR flash 32MB; EMMC flash 4000MB; RAM 512MB
smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  ID = 0
Vendor = 0
Device = 0
Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC:   qca_mmc: 0
*** Warning - bad CRC, using default environment

PCI0 Link Intialized
In:    serial
Out:   serial
Err:   serial
Valid chip addresses: 27 48
machid: 8010001
flash_type: 1
Net:   MAC0 addr:78:d2:94:b9:fa:9f
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot:  0

and it starts a 5 or 10 second countdown before it proceeds to the next part (that's why it says "hit any key to stop autoboot: 0"). so hit any key before it reaches 0 and stop the autoboot.
you'll get a bunch of options, but you only need to view/change 2.

Code:
board_model_id_show

that'll say probably RBS50
so change it back to RBR50 like this:

Code:
board_model_id_set RBR50

and then check

Code:
board_data_show

and it'll throw some numbers... 1202 or 1102 or something like that. i've seen some that throw me 120202

change it to 1201, and if it still doesn't work, 1101.

Code:
board_data_set 1201

restart and that should make it boot up.
 

Jamie0691

New Around Here
Hi, thanks for the reply. I thought the same, about someone trying to convert it to a RBS, however when checking the board ID and board model, they both looked correct. The only odd thing was the board_data was set as 110101, no matter if I manually set it to 1101? Would this stop it booting at all, as it doesn't always boot into the uBoot menu, it will just have a black screen when connected via serial.
 

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top