Hi,
Several weeks ago my orbi router went into a boot loop after a manual restart from the web administration UI. I tried severals things that didn't help recover but I can't just give up on it.
So I've opened the router, found the serial pin on the motherboard and bought a USB-serial cable. Now I can access to the bootloader console but I lack knowledge on this.
I havent installed openWRT on my orbi, which is not in the supported device I've found on the website anyway, but according to the logs, the orbi firmware is based on openWRT. So I decided to try to get some help here.
I managed to confirmed that firmware upload with tftp works well. However everytime it boots, it ends up with a "data abord" followed by a reset.
Here are the logs of the tftp upload, firmware V2.5.1.32 (I've removed most of the dot while receiving the firmware for clarity)
logs
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1339 - bootable_media_detect_entry, Start
B - 129185 - bootable_media_detect_success, Start
B - 129199 - elf_loader_entry, Start
B - 131586 - auth_hash_seg_entry, Start
B - 133734 - auth_hash_seg_exit, Start
B - 169767 - elf_segs_hash_verify_entry, Start
B - 283099 - PBL, End
B - 283124 - SBL1, Start
B - 371628 - pm_device_init, Start
D - 6 - pm_device_init, Delta
B - 373192 - boot_flash_init, Start
D - 593 - boot_flash_init, Delta
B - 380023 - boot_config_data_table_init, Start
D - 74730 - boot_config_data_table_init, Delta - (419 Bytes)
B - 460626 - clock_init, Start
D - 7523 - clock_init, Delta
B - 471575 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B - 475057 - sbl1_ddr_set_params, Start
B - 480042 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 484532 - Pre_DDR_clock_init, Start
D - 5 - Pre_DDR_clock_init, Delta
D - 13144 - sbl1_ddr_set_params, Delta
B - 497800 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 568859 - sbl1_wait_for_ddr_training, Start
D - 28 - sbl1_wait_for_ddr_training, Delta
B - 585341 - Image Load, Start
D - 785135 - QSEE Image Loaded, Delta - (262104 Bytes)
B - 1370979 - Image Load, Start
D - 888 - SEC Image Loaded, Delta - (0 Bytes)
B - 1380825 - Image Load, Start
D - 1185462 - APPSBL Image Loaded, Delta - (413427 Bytes)
B - 2566718 - QSEE Execution, Start
D - 58 - QSEE Execution, Delta
B - 2572986 - SBL1, End
D - 2291853 - SBL1, Delta
S - Flash Throughput, 342 KB/s (675950 Bytes, 1976018 us)
S - DDR Frequency, 672 MHz
U-Boot 2012.07 [Barrier Breaker unknown,unknown] (Jul 29 2016 - 22:37:42)
U-boot dni1 V1.1 for DNI HW ID: 29765352; NOR flash 32MB; EMMC flash 4000MB; RAM 512MB
smem ram ptable found: ver: 1 len: 3
DRAM: 512 MiB
machid : 0x8010001
NAND: Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC: qca_mmc: 0
PCI0 Link Intialized
In: serial
Out: serial
Err: serial
machid: 8010001
flash_type: 1
Net: MAC0 addr:b0:b9:8a:61:af:26
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot: 0
(IPQ40xx) # fw_recovery
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :100 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
The Router is in TFTP Server Firmware Recovery mode NOW!
Listening on Port : 69, IP Address: 192.168.1.1 ...
Rcv:
.................................................................
.................................................................
......................................................
32 MB reveived
..............................................................
Done!
Bytes transferred = 43518081 (2980881 hex)
mmc_read will run command: mmc read 0x871cfd78 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
HW ID on board: 29765352+0+4000+512+2x2+2x2+4x4
HW ID on image: 29765352+0+4000+512+2x2+2x2+4x4
Firmware Image HW ID matched Board HW ID
mmc_read will run command: mmc read 0x871cfd90 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
MODEL ID on board: RBR50
MODEL ID on image: RBR50
Firmware Image MODEL ID matched Board model ID
mmc_read will run command: mmc read 0x871cfd90 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
MODEL ID on board: RBR50
MODEL ID on image: RBR50
Firmware Image MODEL ID matched Board model ID
mmc erase 0x4622 0x14c05
MMC erase: dev # 0, block # 17954, count 84997 ... 84997 blocks erase: OK
Alive-timer 57
NmrpAliveTimerBase 15
Copy image to Flash... mmc write 0x84000080 0x4622 0x14c05
MMC write: dev # 0, block # 17954, count 84997 ... 84997 blocks write: OK
boot_partition_set 1
mmc_read will run command: mmc read 0x871cfb50 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
Burn BOOT PARTITION DATA (= 110101) into ART block
mmc_read will run command: mmc read 0x871cfb50 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
mmc_sect_erase will run command: mmc erase 0x2a22 0x100
MMC erase: dev # 0, block # 10786, count 256 ... 256 blocks erase: OK
mmc_write will run command: mmc write 0x871cfb50 0x2a22 0x100
MMC write: dev # 0, block # 10786, count 256 ... 256 blocks write: OK
Done.
Alive-timer 22
Done
Rebooting...
resetting ...
Valid chip addresses: 27 48
and the log of the restart (I've removed lots of MMC read log lines for clarity)
logs
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAAAANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000023
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1339 - bootable_media_detect_entry, Start
B - 17387 - bootable_media_detect_success, Start
B - 17401 - elf_loader_entry, Start
B - 19819 - auth_hash_seg_entry, Start
B - 21967 - auth_hash_seg_exit, Start
B - 56125 - elf_segs_hash_verify_entry, Start
B - 169316 - PBL, End
B - 169341 - SBL1, Start
B - 257848 - pm_device_init, Start
D - 6 - pm_device_init, Delta
B - 259418 - boot_flash_init, Start
D - 594 - boot_flash_init, Delta
B - 266256 - boot_config_data_table_init, Start
D - 73578 - boot_config_data_table_init, Delta - (419 Bytes)
B - 345709 - clock_init, Start
D - 7518 - clock_init, Delta
B - 356654 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B - 360134 - sbl1_ddr_set_params, Start
B - 365119 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 369609 - Pre_DDR_clock_init, Start
D - 5 - Pre_DDR_clock_init, Delta
D - 13143 - sbl1_ddr_set_params, Delta
B - 382875 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 453700 - sbl1_wait_for_ddr_training, Start
D - 28 - sbl1_wait_for_ddr_training, Delta
B - 469956 - Image Load, Start
D - 785174 - QSEE Image Loaded, Delta - (262104 Bytes)
B - 1255632 - Image Load, Start
D - 886 - SEC Image Loaded, Delta - (0 Bytes)
B - 1265457 - Image Load, Start
D - 1185486 - APPSBL Image Loaded, Delta - (413427 Bytes)
B - 2451373 - QSEE Execution, Start
D - 58 - QSEE Execution, Delta
B - 2457640 - SBL1, End
D - 2290290 - SBL1, Delta
S - Flash Throughput, 342 KB/s (675950 Bytes, 1976099 us)
S - DDR Frequency, 672 MHz
U-Boot 2012.07 [Barrier Breaker unknown,unknown] (Jul 29 2016 - 22:37:42)
U-boot dni1 V1.1 for DNI HW ID: 29765352; NOR flash 32MB; EMMC flash 4000MB; RAM 512MB
smem ram ptable found: ver: 1 len: 3
DRAM: 512 MiB
machid : 0x8010001
NAND: Nand Flash error. Status = 64
ONFI Read id cmd failed
ONFI probe failed
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
0 MiB
MMC: qca_mmc: 0
PCI0 Link Intialized
In: serial
Out: serial
Err: serial
machid: 8010001
flash_type: 1
Net: MAC0 addr:b0:b9:8a:61:af:26
PHY ID1: 0x4d
PHY ID2: 0xd0b1
ipq40xx_ess_sw_init done
eth0
Hit any key to stop autoboot: 0
Valid chip addresses: 27 48
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :100 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
Client starts...[Listening] for ADVERTISE...TTT
Retry count exceeded; boot the image as usual
nmrp server is stopped or failed !
Read BootPart from BOARD DATA...
mmc_read will run command: mmc read 0x871cfca8 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
boot partition : 1
BootPart = 1
Loading DNI firmware for checking...
MMC read: dev # 0, block # 17954, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 18210, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 18466, count 256 ... 256 blocks read: OK
( ... )
MMC read: dev # 0, block # 102690, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 102946, count 256 ... 256 blocks read: OK
MMC read: dev # 0, block # 17954, count 1 ... 1 blocks read: OK
** rootfs address : 0x843bffc0 **
## Checking Image at 84000000 ...
FIT image found
FIT description: ARM OpenWrt FIT (Flattened Image Tree)
Image 0 (kernel@1)
Description: ARM OpenWrt Linux-3.14.77
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x840000e4
Data Size: 3524167 Bytes = 3.4 MiB
Architecture: ARM
OS: Linux
Load Address: 0x80208000
Entry Point: 0x80208000
Hash algo: crc32
Hash value: 4b698f35
Hash algo: sha1
Hash value: 439cf7c76bf93d7dd525f87978dbfb0a718c7bf7
Image 1 (fdt@1)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8435c86c
Data Size: 39067 Bytes = 38.2 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 2fbe7ae7
Hash algo: sha1
Hash value: 10a7fad2926d324e8b06b192c3531c391f78a6ed
Image 2 (fdt@2)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84366214
Data Size: 38617 Bytes = 37.7 KiB
Architecture: ARM
Hash algo: crc32
Hash value: c0098bb9
Hash algo: sha1
Hash value: baf8b2904ec24c626934dabf5d6815eadedadc29
Image 3 (fdt@3)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8436f9fc
Data Size: 42101 Bytes = 41.1 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 0109faf0
Hash algo: sha1
Hash value: 34ee6bdafd6315d361d6aa99b5ad45a9944b32dd
Image 4 (fdt@4)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84379f80
Data Size: 34248 Bytes = 33.4 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 0fa6ee98
Hash algo: sha1
Hash value: dcec33a744cfed6a21c9a9be313791f98b1081ff
Image 5 (fdt@5)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x84382654
Data Size: 34407 Bytes = 33.6 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 96f6beb1
Hash algo: sha1
Hash value: 3a938e8901b816f4fa7d73aacbc3e2b54422c5d0
Image 6 (fdt@6)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8438adc8
Data Size: 34547 Bytes = 33.7 KiB
Architecture: ARM
Hash algo: crc32
Hash value: ce835bd9
Hash algo: sha1
Hash value: f48535f83fe16c4d3471b18ddab6dfa5d1a633e7
Image 7 (fdt@7)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x843935c8
Data Size: 38588 Bytes = 37.7 KiB
Architecture: ARM
Hash algo: crc32
Hash value: bb010bc8
Hash algo: sha1
Hash value: a52a0530438afae1fe5fed13cb380503d0ee576b
Image 8 (fdt@8)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x8439cd90
Data Size: 38467 Bytes = 37.6 KiB
Architecture: ARM
Hash algo: crc32
Hash value: 311234ec
Hash algo: sha1
Hash value: c7be34f25ccb51f0d0eaa6985af77d30b872eaef
Image 9 (fdt@9)
Description: ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x843a64e0
Data Size: 38165 Bytes = 37.3 KiB
Architecture: ARM
Hash algo: crc32
Hash value: f91b53ee
Hash algo: sha1
Hash value: 7f783a91e42dc651bb82f01479f5207640db0d53
Default Configuration: 'config@1'
Configuration 0 (config@1)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@1
Configuration 1 (config@2)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@2
Configuration 2 (config@3)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@3
Configuration 3 (config@4)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@4
Configuration 4 (config@5)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@5
Configuration 5 (config@6)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@6
Configuration 6 (config@7)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@7
Configuration 7 (config@8)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@8
Configuration 8 (config@9)
Description: OpenWrt
Kernel: kernel@1
FDT: fdt@9
## Checking hash(es) for FIT Image at 84000000 ...
Hash(es) for Image 0 (kernel@1): crc32+ sha1+
Hash(es) for Image 1 (fdt@1): crc32+ sha1+
Hash(es) for Image 2 (fdt@2): crc32+ sha1+
Hash(es) for Image 3 (fdt@3): crc32+ sha1+
Hash(es) for Image 4 (fdt@4): crc32+ sha1+
Hash(es) for Image 5 (fdt@5): crc32+ sha1+
Hash(es) for Image 6 (fdt@6): crc32+ sha1+
Hash(es) for Image 7 (fdt@7): crc32+ sha1+
Hash(es) for Image 8 (fdt@8): crc32+ sha1+
Hash(es) for Image 9 (fdt@9): crc32+ sha1+
## Checking Image at 843bffc0 ...
Legacy image found
Image Name: ARM OpenWrt Linux-3.14.77
Image Type: ARM Linux Kernel Image (lzma compressed)
Data Size: 39585792 Bytes = 37.8 MiB
Load Address: 40908000
Entry Point: 40908000
Verifying Checksum ... OK
mmc_read will run command: mmc read 0x871cfca8 0x2a22 0x100
MMC read: dev # 0, block # 10786, count 256 ... 256 blocks read: OK
boot partition : 1
MMC read: dev # 0, block # 17954, count 7680 ... 7680 blocks read: OK
data abort
pc : [<87303568>] lr : [<87304250>]
sp : 871efd60 ip : 871f0ad3 fp : 87303557
r10: 00000000 r9 : 00000002 r8 : 871eff60
r7 : 871f0ab8 r6 : 87360cec r5 : 871f0ab8 r4 : 8735e6a4
r3 : ffffffff r2 : 00000158 r1 : 00000000 r0 : 87360cec
Flags: nZCv IRQs off FIQs off Mode SVC_32
Resetting CPU ...
resetting ...
Valid chip addresses: 27 68
Here is the printenv command:
(IPQ40xx) # printenv
baudrate=115200
bootcmd=reset_i2c; mii write 0x0 0x0 0x0800; sleep 1; nmrp; bootdni; bootm 0x84000000
bootdelay=2
delenv=mmc erase 0x1622 0x200
ethact=eth0
flash_type=1
ipaddr=192.168.1.1
loadaddr=0x84000000
machid=8010001
serverip=192.168.1.10
stderr=serial
stdin=serial
stdout=serial
Environment size: 313/262140 bytes
I executed the bootcmd manually and I've confirmed that the "data abord" is issued by the "bootm 0x84000000".
Any help would be appreciated.
