Help w/ flash on NETGEAR WNDR4300v2

I tried flashing openwrt-21.02.0-rc2 on NETGEAR WNDR4300v2. The fashing worked but the deviced was bricked after on power-cycle. I reported the issue here a while back and it was confirmed by another user. Unfortunately the issues did not progress any further.

There has been a similar thread on this device here but it went nowhere.

I wonder if I have any other options moving forward. Is there anything else I could try?

I've the same issue after flashing OpenWrt master (built using ImageBuilder with necessary packages included), from WNDR4300v2 stock web interface.

It worked fine initially. Then I powered it down to move it to the place I want to deploy it, only to find it's not booting.

Technically, it bootloops:

  1. The power LED turns amber.
  2. All LAN LEDs turn amber for 1 second.
  3. About 20-30s later, the power LED turned green briefly. Any connected and active LAN ports may blink green during the brief moment.
  4. The power LED turns off then becomes amber again, and repeats the steps 1-3.

Don't know if it's possible to recover from this state. While I may be able to try recovering it via tftp, I don't have any tool nor experience to open the router or do serial console so I'm SOL if it turned out I have to do that.

EDIT: I just read that issue. It's the same as what's happening on my device now.

EDIT 2: Do you have a detailed step on how I should recover the device with a stock image using nmrpflash, in case I really can't get out of the situation?

I don't know if this works on V2, but on V1 you are able to boot into a special state and use tftp to transfer the firmware, which the device then installs. you don't need to open the device for it. you need only a network cable

[OpenWrt Wiki] NETGEAR WNDR4300 v1

See the bug report I linked in the original post, it has the steps I used to recover the device.

1 Like

I managed to restore it using nmrpflash following your guide, and flashed OpenWrt again. Just that I need to compile a binary myself as the libpcap I'm using is too new.

OpenWrt works as long as I don't power cycle and I'm able to configure everything I need (and of course, back up the configured stuffs).

In case the device power-cycled or the device lost power somehow, I could repeat the process to maintain OpenWrt until this critical issue gets finally resolved. For now, this kind of makes using OpenWrt on this device "semi-tethered".

At least I know the device is not entirely bricked... yet...

I flashed the device again from OpenWrt using the sysupgrade image file of the same build. The router still boots after flashing.

I don't know if this might solve the issue according to this post, but I wouldn't dare trying it now as I need this router to stay working at the moment.

As it seems this router is similar to WNDR4500v3, don't know if this thread might be relevant...

EDIT: It seems there really are bad blocks. Even the bad block number (991) is the same as the one in the thread I linked...

Tue Oct 12 10:28:31 2021 kern.notice kernel: [    2.128265] UBI: auto-attach mtd1
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    2.131761] ubi0: attaching mtd1
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    2.570657] random: fast init done
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.167984] ubi0: scanning is finished
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.197662] ubi0: attached mtd1 (name "ubi", size 124 MiB)
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.203377] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.210471] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.217494] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.224690] ubi0: good PEBs: 991, bad PEBs: 1, corrupted PEBs: 0
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.230899] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.238354] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 726417369
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.247698] ubi0: available PEBs: 0, total reserved PEBs: 991, PEBs reserved for bad PEB handling: 19
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.257327] ubi0: background thread "ubi_bgt0d" started, PID 398
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.265680] ubi0 warning: do_sync_erase: error -5 while erasing PEB 991, retry
Tue Oct 12 10:28:31 2021 kern.info kernel: [    4.276167] block ubiblock0_0: created from ubi0:0(rootfs)
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.281891] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.289781] ubi0 warning: do_sync_erase: error -5 while erasing PEB 991, retry
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.297338] ubi0 warning: do_sync_erase: error -5 while erasing PEB 991, retry
Tue Oct 12 10:28:31 2021 kern.info kernel: [    4.316547] VFS: Mounted root (squashfs filesystem) readonly on device 259:0.
Tue Oct 12 10:28:31 2021 kern.info kernel: [    4.330677] Freeing unused kernel memory: 1220K
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.335353] This architecture does not have kernel memory protection.
Tue Oct 12 10:28:31 2021 kern.info kernel: [    4.342002] Run /sbin/init as init process
Tue Oct 12 10:28:31 2021 kern.err kernel: [    4.346429] ubi0 error: do_sync_erase: cannot erase PEB 991, error -5
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.353119] CPU: 0 PID: 398 Comm: ubi_bgt0d Not tainted 5.4.152 #0
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.359490] Stack : 80770000 8070d458 00000000 00000000 8070c880 874add3c 8069e6e8 87d8a520
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.368128]         8074ad63 808a32d8 0000018e 000003df 808a0000 00000001 874adcf0 9b19215a
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.376763]         00000000 00000000 808d0000 00000084 00000000 00000000 65642035 2e342e31
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.385391]         00000084 874adc19 ffffffff ffffffff 00000000 87ce9000 000003df 00000000
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.394019]         806e7b38 000003df 808a0000 00000000 00000001 80396d64 00000000 808a0000
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.402648]         ...
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.405169] Call Trace:
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.407711] [<8006970c>] show_stack+0x30/0x100
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.412309] [<80403a44>] do_sync_erase+0xdc/0x1b8
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.417162] [<80403ccc>] ubi_io_sync_erase+0x1ac/0x308
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.422477] [<804047a0>] sync_erase+0x68/0x218
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.427062] [<80404cb0>] __erase_worker+0x44/0x42c
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.432019] [<804050bc>] erase_worker+0x24/0xa0
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.436694] [<80404128>] do_work+0x80/0x108
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.441025] [<80406528>] ubi_thread+0xfc/0x184
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.445617] [<8009f354>] kthread+0x138/0x140
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.450027] [<80064b18>] ret_from_kernel_thread+0x14/0x1c
Tue Oct 12 10:28:31 2021 kern.err kernel: [    4.455620] ubi0 error: __erase_worker: failed to erase PEB 991, error -5
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.462635] ubi0: mark PEB 991 as bad
Tue Oct 12 10:28:31 2021 kern.warn kernel: [    4.467427] nand: failed to write BBM to block @7fe0000 (err = -5)
Tue Oct 12 10:28:31 2021 kern.notice kernel: [    4.473843] ubi0: 18 PEBs left in the reserve

EDIT 2: I think this might be the case. After flashing the factory image, flashing the sysupgrade image of the same build from OpenWrt might be able to trigger a check that would correctly mark the bad blocks. I haven't power-cycled my device yet, but others can try.

A bump here.

I powered down the device today as I'm moving it to another place. After powering up the router is working normally.

Guess it is indeed mandatory to flash a sysupgrade image (can be the same build) after initially flashing the factory one, so any bad blocks in the NAND flash can be detected and marked.

1 Like