NBG6716 - failed to erase block

Hello, I've been following the tutorial on how to install Lede, but it doesn't install that easily.

root@NBG6716:/tmp# mtd write lede-17.01.4-ar71xx-nand-nbg6716-squashfs-factory.bin /dev/mtd7
Unlocking /dev/mtd7 ...
Writing from lede-17.01.4-ar71xx-nand-nbg6716-squashfs-factory.bin to /dev/mtd7 ...  [e]Failed to erase block
root@NBG6716:/tmp# mtd erase /dev/mtd7
Unlocking /dev/mtd7 ...
Erasing /dev/mtd7 ...
Failed to erase block on /dev/mtd7 at 0x320000
Failed to erase block on /dev/mtd7 at 0x460000

I'm really stuck on this, any help appreciated. Thank you

It is possible that there is something holding those blocks hostage and that it is a software problem. Assuming the device isn't bricked at this point (is TFTP upgrade working?), upgrading stock firmware before moving on to OpenWRT might help.

If not, I would assume the problem is bad blocks (hardware damage) in the NAND flash.

LP,
Jure

I'm actually installing it from stock firmware. The device gets bricked after that. However, the TFTP works fine, so I can get it back to working again. No luck installing Lede though.

I mean, is the stock firmware the latest version?

LP,
Jure

Yes, latest "V1.00(AAKG.12)" is installed right now.

Hi,

I have checked this in some depth and now know enough to be able to build an OpenWRT image that would work with the stock flash tool. :slight_smile:

Here is the decoded stock image files (it's OpenWRT, just not LEDE):
http://pritisni.ctrl-alt-del.si/fajli/openwrt/stockNBG6716.tar.bz2
...if you have any use for them.

(I'm assuming since stock works, that these files contain the secret why.)

Here are the flash commands as they are written in the stock firmware flashing program:

flash_eraseall /dev/mtd6 > /tmp/fwup_log
nandwrite -mp /dev/mtd6 /tmp/fw_header >> /tmp/fwup_log
flash_eraseall /dev/mtd7 >> /tmp/fwup_log
nandwrite -mp /dev/mtd7 /tmp/fw_img >> /tmp/fwup_log

The nandwrite -m parameter indicates that the stock firmware flashing tool accounts for bad blocks on the flash while recording the firmware.

The commands are provided by the mtd-utils package which is installed in stock firmwmare.

The files "fw_header" and "fw_img" are created from the firmware upgrade file by what appears to be a propertiary program. But, considering the obvious structure of the firmware file, header is the first 131072 bytes of the upgrade file and seems to contain the firmware version, hardware model and a lot of empty space, whereas the rest is a JFFS2 filesystem containing all OpenWRT files including "boot/vmlinux.lzma.uImage".

Perhaps you could try using this same approach to upgrading your firmware:

flash_eraseall /dev/mtd7
nandwrite -mp /dev/mtd7 lede-17.01.4-ar71xx-nand-nbg6716-squashfs-factory.bin

LP,
Jure

So, I tried the way you mentioned, went like this:

root@NBG6716:/tmp# flash_eraseall /dev/mtd7
Erasing 128 Kibyte @ 300000 -- 10 % complete.
Skipping bad block at 0x00320000
Erasing 128 Kibyte @ 440000 -- 14 % complete.
Skipping bad block at 0x00460000
Erasing 128 Kibyte @ 1e00000 -- 100 % complete.
root@NBG6716:/tmp# nandwrite -mp /dev/mtd7 lede-17.01.4-ar71xx-nand-nbg6716-squashfs-factory.bin
-ash: nandwrite: Input/output error
root@NBG6716:/tmp#

I guess the tools went missing, so I skipped the erase command and it went like this:

root@NBG6716:/tmp# nandwrite -mp /dev/mtd7 lede-17.01.4-ar71xx-nand-nbg6716-squashfs-factory.bin
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
Writing data to block 9 at offset 0x120000
Writing data to block 10 at offset 0x140000
Writing data to block 11 at offset 0x160000
Writing data to block 12 at offset 0x180000
Writing data to block 13 at offset 0x1a0000
Writing data to block 14 at offset 0x1c0000
Writing data to block 15 at offset 0x1e0000
Writing data to block 16 at offset 0x200000
Writing data to block 17 at offset 0x220000
Writing data to block 18 at offset 0x240000
Writing data to block 19 at offset 0x260000
Writing data to block 20 at offset 0x280000
Writing data to block 21 at offset 0x2a0000
Writing data to block 22 at offset 0x2c0000
Writing data to block 23 at offset 0x2e0000
Writing data to block 24 at offset 0x300000
Writing data to block 25 at offset 0x320000
Bad block at 320000, 1 block(s) from 320000 will be skipped
Writing data to block 26 at offset 0x340000
Writing data to block 27 at offset 0x360000
Writing data to block 28 at offset 0x380000
Writing data to block 29 at offset 0x3a0000
Writing data to block 30 at offset 0x3c0000
Writing data to block 31 at offset 0x3e0000
Writing data to block 32 at offset 0x400000
Writing data to block 33 at offset 0x420000
Writing data to block 34 at offset 0x440000
Writing data to block 35 at offset 0x460000
Bad block at 460000, 1 block(s) from 460000 will be skipped
Writing data to block 36 at offset 0x480000
Writing data to block 37 at offset 0x4a0000
Writing data to block 38 at offset 0x4c0000
Writing data to block 39 at offset 0x4e0000
Writing data to block 40 at offset 0x500000
Writing data to block 41 at offset 0x520000
Writing data to block 42 at offset 0x540000
Writing data to block 43 at offset 0x560000
Writing data to block 44 at offset 0x580000
Writing data to block 45 at offset 0x5a0000
root@NBG6716:/tmp# reboot

Unluckily, the router wouldn't boot and only the LEDs would on.

It seems strange indeed, I found this post and they seem they nailed it just fine.

I wonder if the file you are flashing has support for mtd-utils' way of marking bad blocks.

It's probable that the other person you linked didn't have bad blocks in their NAND, hence why the solution worked for them.

LP,
Jure