Any change this will be supported using OpenWrt? My neighbor has this Netgear RBS50Y device, and it's flashing red no matter what combination of resetting I perform so 99.9% certain the stock Netgear firmware is corrupted. I can connect via serial to the RBS50Y, but it doesn't have a Ethernet connection so I'm not sure how to load something like OpenWrt or maybe even go back to the Netgear firmware using TFTP or nmrpflash since they both fail once they don't see an Ethernet connection. I know it's a long shot, but does anyone know how to load firmware on the RBS50Y using the common debricking methods if it doesn't have an Ethernet port? I thought I could get the wifi radio up, but I'm not sure how to do that using the U Boot menu. Any suggestions would be much appreciated. Below are the commands that are available to me.
(IPQ40xx) # help
? - alias for 'help'
base - print or set address offset
board_backhaul_passphrase_set- Set backhaul passphrase on board
board_backhaul_passphrase_show- Show board_backhaul_passphrase
board_backhaul_ssid_set- Set backhaul ssid on board
board_backhaul_ssid_show- Show board_backhaul_ssid
board_data_set- Set board data on board
board_data_show- Show board_data
board_firmware_corrupted_Ledloop- power LED red blink loop
board_hw_id_set- Set board_hw_id
board_hw_id_show- Show board_hw_id
board_model_id_set- Set board_model_id
board_model_id_show- Show board_model_id
board_parameters_set- Set WPS PIN code, Serial number, SSID, Passphrase, Board data, MAC address
board_parameters_show- Show WPS PIN code, Serial number, SSID, Passphrase, MAC address.
board_passphrase_set- Set passphrase on board
board_passphrase_show- Show board_passphrase
board_ssid_set- Set ssid on board
board_ssid_show- Show board_ssid
boot_partition_set- Set boot partition data on board
boot_partition_show- Show boot partition
bootcheck- boot check crashdump
bootipq - bootipq from flash device
bootm - boot application image from memory
bootp - boot image via network using BOOTP/TFTP protocol
button_test- Test buttons
chpart - change active partition
cmp - memory compare
cp - memory copy
crashdump_switch_set- set 1/0 to enable/disable crashdump_switch on board
crashdump_switch_show- Show current crashdump_switch
crc32 - checksum calculation
default_mode_flag_set- Set default mode_flag data on board
default_mode_flag_show- Show default_mode_flag
dhcp - boot image via network using DHCP/TFTP protocol
dnisetenvmem- set environment variable from memory
dumpipq_data- dumpipq_data crashdump collection from memory
dumpipq_flash_data- dumpipq_flash_data crashdump collection and storing in flash
echo - echo args to console
env - environment handling commands
exit - exit script
false - do nothing, unsuccessfully
fdt - flattened device tree utility commands
fuseipq - fuse QFPROM registers from memory
fw_recovery- start tftp server to recovery dni firmware image.
fw_recovery_extender- start tftp server to recovery dni firmware image.
fw_recovery_second- start tftp server to recovery dni firmware image.
go - start application at address 'addr'
help - print command description/usage
i2c - I2C sub-system
iminfo - print header information for application image
imxtract- extract a part of a multi-image
incenv - increment environment variable
led_i2c_reset- Reset all leds, please use ledctl to 'light' led.
led_i2c_reset_to_blink- Reset all leds, please use ledctl to 'blink' led.
ledctl - ledctl - on/off LEDs.
load_chk_dniimg- load & check integrity of dni firmware image.
loop - infinite loop on address range
macset - Set ethernet MAC address
macshow - Show ethernet MAC addresses
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
mode_flag_set- Set mode_flag data on board
mode_flag_show- Show mode_flag
mtdparts- define flash/nand partitions
mtest - simple RAM read/write test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nm - memory modify (constant address)
nmrp - start nmrp mechanism to upgrade firmware-image or string-table.
pci - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset - Perform RESET of the CPU
rnset - set region number
rnshow - Show Region Number on Board
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sf - SPI flash sub-system
showvar - print local hushshell variables
sleep - delay execution for some time
smeminfo- print SMEM FLASH information
snset - Set serial number
source - run script from memory
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
true - do nothing, successfully
uartrd - uartrd read from second UART
uartwr - uartwr to second UART
usb - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
wpspinset- Set wpspin number
Thanks, but received the message "No ethernet found" which I also receive when running fw_recovery, dhcp, nmrp. If I could somehow get the wifi radio up and running, and fake it being an ethernet device, maybe I could get the tftp or nmrp flashing to work?
Sure thing, and thanks again for your help. Looks like the kernel checksum is good, but then fails on the rootfs checksum error with a bad data crc a couple of times when running this command iminfo 0x8433FFC0 Tries twice I think if I'm reading it correctly. I see what I think are fdt partitions, but no mention of MTD. If this Netgear only had an ethernet port, I think this would be fairly straight forward!! Thanks again as I enjoy doing this.
U-Boot 2012.07-ga9f284f [Chaos Calmer 15.05.1,r35193] (Jul 24 2018 - 10:03:42)
orbi-outdoor uboot V2.3 for DNI HW ID: hw29765619p0p256p512p2x2p2x2p4x4 .
smem ram ptable found: ver: 1 len: 3
DRAM: 512 MiB
machid : 0x8010001
NAND: ID = 9590daef
Vendor = ef
Device = da
ONFI device found
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC: qca_mmc: 0
PCI0 Link Intialized
In: serial
Out: serial
Err: serial
Valid chip addresses: 23 27 48 4A
131072 bytes read: OK
machid: 8010001
flash_type: 2
Net: 131072 bytes read: OK
MAC0 addr:6c:cd:d6:9e:ae:a5
PHY ID1: 0xffff
PHY ID2: 0xffff
SW inits failed
Error in allocating Mem
Board Net Initialization Failed
No ethernet found.
131072 bytes read: OK
Hit any key to stop autoboot: 0
Loading DNI firmware for checking...
131072 bytes read: OK
131072 bytes read: OK
Loading firmware 2 ...
NAND read: device 0 offset 0x5200000, size 0x20000
131072 bytes read: OK
NAND read: device 0 offset 0x5200000, size 0x340000
3407872 bytes read: OK
dniimg_len is 29229056 (aligned to 29229056)
NAND read: device 0 offset 0x5200000, size 0x1be0000
Skipping bad block 0x05ac0000
29229056 bytes read: OK
if iminfo 0x84000000; then echo kernel checksum OK !;if iminfo 0x8433FFC0; then echo rootfs checksum OK !;;true;else echo rootfs checksum error !!!;;false;fi;else echo kernel checksum error !!!;;false;fi;
## Checking Image at 84000000 ...
FIT image found
FIT description: ARM OpenWrt FIT (Flattened Image Tree)
Image 0 (kernel@1)
Description: ARM OpenWrt Linux-3.14.77
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x840000e4
Data Size: 3061059 Bytes = 2.9 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
Hash algo: crc32
Hash value: 874d4537
Hash algo: sha1
Hash value: a71abd3c3b45a789a91bed285a9ab5a63fb1361a
Image 1 (fdt@1)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x842eb76c
Data Size: 37793 Bytes = 36.9 KiB
Architecture: ARM
Hash algo: crc32
Hash value: ffeefd16
Hash algo: sha1
Hash value: fc2854dfdedceb97100c60123a08f26956497cf0
Image 2 (fdt@2)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x842f4c20
Data Size: 41737 Bytes = 40.8 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 3503bd99
Hash algo: sha1
Hash value: a124e7fb92e6e7fbd59117e2ee2de160813436c6
Image 3 (fdt@3)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x842ff03c
Data Size: 40791 Bytes = 39.8 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 0a274b41
Hash algo: sha1
Hash value: 51f366de4ce582705f311a1c34306c1f1039c0b0
Image 4 (fdt@4)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x843090a4
Data Size: 34248 Bytes = 33.4 KiB
Architecture: ARM
Hash algo: crc32
Hash value: d333d92e
Hash algo: sha1
Hash value: fdb97cbcc2073052eed253692f6fc78f4705679d
Image 5 (fdt@5)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8431177c
Data Size: 34407 Bytes = 33.6 KiB
Architecture: ARM
Hash algo: crc32
Hash value: af4ec026
Hash algo: sha1
Hash value: 8448fa21ec740758ce3afbd78f07b70d34274c24
Image 6 (fdt@6)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84319ef4
Data Size: 34547 Bytes = 33.7 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 04b66389
Hash algo: sha1
Hash value: 3f56898ceeafd9647044e8fb7dc3c07697b42993
Image 7 (fdt@7)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x843226f8
Data Size: 37270 Bytes = 36.4 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 1d74815e
Hash algo: sha1
Hash value: b3c720bc5fbdba6e2ecfbabb98786328019fff94
Image 8 (fdt@8)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8432b9a0
Data Size: 37157 Bytes = 36.3 KiB
Architecture: ARM
Hash algo: crc32
Hash value: b8f16b78
Hash algo: sha1
Hash value: 53e302f04cdecf9cc2ee3451520701af71081cc3
Image 9 (fdt@9)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84334bd8
Data Size: 36855 Bytes = 36 KiB
Architecture: ARM
Hash algo: crc32
Hash value: f5620276
Hash algo: sha1
Hash value: 59f1b5305cd6a226dd5e397b5895fe855b785f17
Default Configuration: 'config@1'
Configuration 0 (config@1)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@1
Configuration 1 (config@2)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@2
Configuration 2 (config@3)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@3
Configuration 3 (config@4)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@4
Configuration 4 (config@5)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@5
Configuration 5 (config@6)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@6
Configuration 6 (config@7)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@7
Configuration 7 (config@8)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@8
Configuration 8 (config@9)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@9
## Checking hash(es) for FIT Image at 84000000 ...
Hash(es) for Image 0 (kernel@1): crc32+ sha1+
Hash(es) for Image 1 (fdt@1): crc32+ sha1+
Hash(es) for Image 2 (fdt@2): crc32+ sha1+
Hash(es) for Image 3 (fdt@3): crc32+ sha1+
Hash(es) for Image 4 (fdt@4): crc32+ sha1+
Hash(es) for Image 5 (fdt@5): crc32+ sha1+
Hash(es) for Image 6 (fdt@6): crc32+ sha1+
Hash(es) for Image 7 (fdt@7): crc32+ sha1+
Hash(es) for Image 8 (fdt@8): crc32+ sha1+
Hash(es) for Image 9 (fdt@9): crc32+ sha1+
kernel checksum OK !
## Checking Image at 8433ffc0 ...
Legacy image found
Image Name: ARM OpenWrt Linux-3.14.77
Image Type: ARM Linux Kernel Image (lzma compressed)
Data Size: 25821184 Bytes = 24.6 MiB
Load Address: 40908000
Entry Point: 40908000
Verifying Checksum ... Bad Data CRC
rootfs checksum error !!!
Loading firmware 1 ...
NAND read: device 0 offset 0x2000000, size 0x20000
131072 bytes read: OK
NAND read: device 0 offset 0x2000000, size 0x340000
3407872 bytes read: OK
dniimg_len is 29491200 (aligned to 29491200)
NAND read: device 0 offset 0x2000000, size 0x1c20000
Skipping bad block 0x02e00000
29491200 bytes read: OK
if iminfo 0x84000000; then echo kernel checksum OK !;if iminfo 0x8433FFC0; then echo rootfs checksum OK !;boot_partition_set 1;true;else echo rootfs checksum error !!!;setenv checkfail 1;fw_recovery;false;fi;else echo kernel checksum error !!!;setenv checkfail 1;fw_recovery;false;fi;
## Checking Image at 84000000 ...
FIT image found
FIT description: ARM OpenWrt FIT (Flattened Image Tree)
Image 0 (kernel@1)
Description: ARM OpenWrt Linux-3.14.77
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x840000e4
Data Size: 3061068 Bytes = 2.9 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
Hash algo: crc32
Hash value: a2fd248b
Hash algo: sha1
Hash value: d164fd8d34cd941afbb1808af5bb3be1870044e4
Image 1 (fdt@1)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x842eb774
Data Size: 37793 Bytes = 36.9 KiB
Architecture: ARM
Hash algo: crc32
Hash value: ffeefd16
Hash algo: sha1
Hash value: fc2854dfdedceb97100c60123a08f26956497cf0
Image 2 (fdt@2)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x842f4c28
Data Size: 41737 Bytes = 40.8 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 3503bd99
Hash algo: sha1
Hash value: a124e7fb92e6e7fbd59117e2ee2de160813436c6
Image 3 (fdt@3)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x842ff044
Data Size: 40791 Bytes = 39.8 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 0a274b41
Hash algo: sha1
Hash value: 51f366de4ce582705f311a1c34306c1f1039c0b0
Image 4 (fdt@4)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x843090ac
Data Size: 34248 Bytes = 33.4 KiB
Architecture: ARM
Hash algo: crc32
Hash value: d333d92e
Hash algo: sha1
Hash value: fdb97cbcc2073052eed253692f6fc78f4705679d
Image 5 (fdt@5)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84311784
Data Size: 34407 Bytes = 33.6 KiB
Architecture: ARM
Hash algo: crc32
Hash value: af4ec026
Hash algo: sha1
Hash value: 8448fa21ec740758ce3afbd78f07b70d34274c24
Image 6 (fdt@6)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84319efc
Data Size: 34547 Bytes = 33.7 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 04b66389
Hash algo: sha1
Hash value: 3f56898ceeafd9647044e8fb7dc3c07697b42993
Image 7 (fdt@7)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84322700
Data Size: 37270 Bytes = 36.4 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 1d74815e
Hash algo: sha1
Hash value: b3c720bc5fbdba6e2ecfbabb98786328019fff94
Image 8 (fdt@8)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8432b9a8
Data Size: 37157 Bytes = 36.3 KiB
Architecture: ARM
Hash algo: crc32
Hash value: b8f16b78
Hash algo: sha1
Hash value: 53e302f04cdecf9cc2ee3451520701af71081cc3
Image 9 (fdt@9)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx_cc device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84334be0
Data Size: 36855 Bytes = 36 KiB
Architecture: ARM
Hash algo: crc32
Hash value: f5620276
Hash algo: sha1
Hash value: 59f1b5305cd6a226dd5e397b5895fe855b785f17
Default Configuration: 'config@1'
Configuration 0 (config@1)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@1
Configuration 1 (config@2)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@2
Configuration 2 (config@3)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@3
Configuration 3 (config@4)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@4
Configuration 4 (config@5)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@5
Configuration 5 (config@6)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@6
Configuration 6 (config@7)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@7
Configuration 7 (config@8)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@8
Configuration 8 (config@9)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@9
## Checking hash(es) for FIT Image at 84000000 ...
Hash(es) for Image 0 (kernel@1): crc32+ sha1+
Hash(es) for Image 1 (fdt@1): crc32+ sha1+
Hash(es) for Image 2 (fdt@2): crc32+ sha1+
Hash(es) for Image 3 (fdt@3): crc32+ sha1+
Hash(es) for Image 4 (fdt@4): crc32+ sha1+
Hash(es) for Image 5 (fdt@5): crc32+ sha1+
Hash(es) for Image 6 (fdt@6): crc32+ sha1+
Hash(es) for Image 7 (fdt@7): crc32+ sha1+
Hash(es) for Image 8 (fdt@8): crc32+ sha1+
Hash(es) for Image 9 (fdt@9): crc32+ sha1+
kernel checksum OK !
## Checking Image at 8433ffc0 ...
Legacy image found
Image Name: ARM OpenWrt Linux-3.14.77
Image Type: ARM Linux Kernel Image (lzma compressed)
Data Size: 26083328 Bytes = 24.9 MiB
Load Address: 40908000
Entry Point: 40908000
Verifying Checksum ... Bad Data CRC
rootfs checksum error !!!
No ethernet found.
Firmware recovering from TFTP server is stopped or failed! :(
checkfail=1
(IPQ40xx) # o take control
I am sending you off to netgear forum, seems power was cut mid flash programming and only they can help with force erase and program of corrupt flash blocks (and explain why flash is written continuously under normal operation), e.g. on OpenWRT flash is written for like tenth of second if you change parameters and save changes, or for few seconds if you add new package, i.e in a totally predictable manner.
Other speculation is that it has simplistic power adapter and bricks by burning components from small power fluctuations, i.e it may be smoked by now, and in real setting able to operate behind UPS or like solar inverter.
Since you somehow booted initrd openwrt, its like 1/3 of way to support should you want to take on it and still have functioning device thanks to OEM
Thanks again for your help. I"m grasping at straws now since not sure how to load some firmware given my connection options. Netgear forum support has no clue and Netgear support charges to even talk to them. I'm just wanting a hint and they can't even provide that. I find it hard to believe that they would make a $500 device that has no way to recover it in case of firmware or file system corruption. Here is a pic of the front and back of the board. I only see one point that "might" be a connection point which I show in the 3rd picture other than the serial connection I already established.
