Cannot Upgrade from Stock Firmware to DD-WRT

7 posts / 0 new
Last post
RaHoor's picture
Cannot Upgrade from Stock Firmware to DD-WRT


I am new here. I tried to flash the dd-wrt Kong Firmware from this Link

I downloaded the zip file, exctracted the chk file and followed the guides I found here

I made a 30-30-30 reset, I am hard wired, no other devices were plugged in (I really followed the instructions!) but it always ends with a bootloop. After returning to stock firmware over serial I tried an older Kong Firmware but the result was the same.

After a 30-30-30 reset i cancelled the boot process, activated tftpd and transfered the firmware with tftp. This way ended with a bootloop, too.

I have no idea what I have done wrong but it seems that I am the first here with this problem. Because of the possibility to go back to stock firmware over serial I am not affraid to try some suggestions.

I copied this from minicom. I marked some lines that could be interesting. Thank you for reading!

Uncompressing Linux... done, booting the kernel.                                
** 16 printk messages dropped ** PERCPU: Embedded 11 pages/cpu @86dd4000 s129406
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65280      
Kernel command line: console=ttyS0,115200 panic=10 root=/dev/mtdblock3 earlyprih
PID hash table entries: 512 (order: -1, 2048 bytes)                             
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)                  
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)                    
Memory: 254176K/262144K available (3414K kernel code, 195K rwdata, 1204K rodata)
Virtual kernel memory layout:                                                   
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)                               
    fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)                               
    vmalloc : 0x88800000 - 0xff800000   (1904 MB)                               
    lowmem  : 0x80000000 - 0x88000000   ( 128 MB)                               
    pkmap   : 0x7fe00000 - 0x80000000   (   2 MB)                               
    modules : 0x7f000000 - 0x7fe00000   (  14 MB)                               
      .text : 0x80008000 - 0x8048ae3c   (4620 kB)                               
      .init : 0x8048b000 - 0x804e0000   ( 340 kB)                               
      .data : 0x804e0000 - 0x80510ef0   ( 196 kB)                               
       .bss : 0x80513000 - 0x805881e4   ( 469 kB)                               
Hierarchical RCU implementation.                                                
        CONFIG_RCU_FANOUT set to non-default value of 2                         
        Build-time adjustment of leaf fanout to 2.                              
MPCORE GIC init                                                                 
add clk lookups                                                                 
MPCORE Global Timer Clock 400000000Hz on IRQ 27                                 
sched_clock: 32 bits at 400MHz, resolution 2ns, wraps every 5368709118ns        
clocksource: mpcore_gtimer: mask: 0xffffffffffffffff max_cycles: 0x5c4093a7d1, s
register local timer                                                            
smp_twd: clock not found -2                                                     
Calibrating local timer... 399.68MHz.                                           
Calibrating delay loop... 1594.16 BogoMIPS (lpj=7970816)                        
pid_max: default: 32768 minimum: 301                                            
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)                     
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)                
CPU: Testing write buffer coherency: ok                                         
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000                                
2 cores has been found                                                          
Setting up static identity map for 0x85e0 - 0x8614                              
L2C: platform provided aux values permit register corruption.                   
L2C: DT/platform modifies aux control register: 0x0a130000 -> 0x7a530000        
L2C-310 erratum 769419 enabled                                                  
L2C-310 enabling early BRESP for Cortex-A9                                      
L2C-310 full line of zeros enabled for Cortex-A9                                
L2C-310 dynamic clock gating enabled, standby mode enabled                      
L2C-310 cache controller enabled, 16 ways, 256 kB                               
L2C-310: CACHE_ID 0x410000c8, AUX_CTRL 0x4e530001                               
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001                                
Brought up 2 CPUs                                                               
SMP: Total of 2 processors activated (3188.32 BogoMIPS).                        
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 191s
NET: Registered protocol family 16                                              
DMA: preallocated 256 KiB pool for atomic coherent allocations                  
coherence_win_size = 10000000                                                   
coherence_flag = FFFFFFF8                                                       
ddr_phys_offset_va =FFFFFFFF                                                    
ddr_phys_offset2_va =A8000000                                                   
Found a Samsung NAND flash:                                                     
Total size:  128MB                                                              
Block size:  128KB                                                              
Page Size:   2048B                                                              
OOB Size:    64B                                                                
Sector size: 512B                                                               
Spare size:  16B                                                                
ECC level:   8 (8-bit)                                                          
Device ID: 0xec 0xf1 0x 0 0x95 0x40 0xec                                        
found nand nvram at 80000                                                       
CCA UART Clock Config: Sel=1 Ovr=1 Div=48                                       
CCA UART Clock rate 100000000Hz CCB UART Clock rate 100000000Hz                 
clocksource: Switched to clocksource mpcore_gtimer                              
NET: Registered protocol family 2                                               
TCP established hash table entries: 1024 (order: 0, 4096 bytes)                 
TCP bind hash table entries: 1024 (order: 1, 8192 bytes)                        
TCP: Hash tables configured (established 1024 bind 1024)                        
UDP hash table entries: 256 (order: 1, 8192 bytes)                              
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)                         
NET: Registered protocol family 1                                               
init gpio code                                                                  
Netgear AC1450/R6250/R6300v2/EX6200 init                                        
PCI: no core                                                                    
PCI: no core                                                                    
PCI: scanning bus 0                                                             
PCI host bridge to bus 0000:00                                                  
pci_bus 0000:00: root bus resource [io  0x0000-0xffffffff]                      
pci_bus 0000:00: root bus resource [mem 0x00000000-0xffffffff]                  
pci_bus 0000:00: root bus resource [bus 00-ff]                                  
pci 0000:00:0f.0: [Firmware Bug]: reg 0X10: invalid BAR (can't size)            
PCI: Fixing up bus 0 domain 0                                                   
PCIE1 link=1                                                                    
PCI host bridge to bus 0001:00                                                  
pci_bus 0001:00: root bus resource [mem 0x08000000-0x0fffffff]                  
pci_bus 0001:00: No busn resource found for root bus, will use [bus 00-ff]      
PCI: Fixing up bus 0 domain 1                                                   
PCI: bus0: Fast back to back transfers disabled                                 
PCI: Fixing up bus 1 domain 1                                                   
PCI: bus1: Fast back to back transfers disabled                                 
pci 0001:00:00.0: BAR 8: assigned [mem 0x08000000-0x080fffff]                   
pci 0001:01:00.0: BAR 0: assigned [mem 0x08000000-0x08007fff 64bit]             
pci 0001:00:00.0: PCI bridge to [bus 01]                                        
pci 0001:00:00.0:   bridge window [mem 0x08000000-0x080fffff]                   
PCIE2 link=1                                                                    
PCIE2 switching to GEN2                                                         
PCIE2 link=1                                                                    
PCI host bridge to bus 0002:00                                                  
pci_bus 0002:00: root bus resource [mem 0x40000000-0x47ffffff]                  
pci_bus 0002:00: No busn resource found for root bus, will use [bus 00-ff]      
PCI: Fixing up bus 0 domain 2                                                   
PCI: bus0: Fast back to back transfers disabled                                 
pci 0002:01:00.0: Max Payload Size set to 512 (was 128, max 512)                
PCI: Fixing up bus 1 domain 2                                                   
PCI: bus1: Fast back to back transfers disabled                                 
pci 0002:00:00.0: BAR 8: assigned [mem 0x40000000-0x400fffff]                   
pci 0002:01:00.0: BAR 0: assigned [mem 0x40000000-0x40007fff 64bit]             
pci 0002:00:00.0: PCI bridge to [bus 01]                                        
pci 0002:00:00.0:   bridge window [mem 0x40000000-0x400fffff]                   
PCIE3 link=0                                                                    
futex hash table entries: 512 (order: 3, 32768 bytes)                           
squashfs: version 3.0 (2006/03/15) Phillip Lougher                              
io scheduler noop registered (default)                                          
io scheduler cfq registered                                                     
Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled                        
console [ttyS0] disabled                                                        
serial8250.0: ttyS0 at MMIO 0x18000300 (irq = 117, base_baud = 6250000) is a 160
console [ttyS0] enabled                                                         
serial8250.0: ttyS1 at MMIO 0x18000400 (irq = 117, base_baud = 6250000) is a 160
brd: module loaded                                                              
loop: module loaded                                                             
bcmsflash: found no supported devices                                           
Boot partition size = 524288(0x80000)                                           
lookup_nflash_rootfs_offset: offset = 0x380000 size = 0x1c80000, 0x20000        
found TRX Header on nflash!                                                     
nflash: squash filesystem with lzma found at block 42                           
Creating 5 MTD partitions on "nflash":                                          
0x000000000000-0x000000080000 : "boot"                                          
0x000000080000-0x000000200000 : "nvram"                                         
0x000000380000-0x000002000000 : "linux"                                         
0x000000540000-0x000002000000 : "rootfs"                                        
0x000000200000-0x000000220000 : "board_data"                                    
tun: Universal TUN/TAP device driver, 1.6                                       
tun: (C) 1999-2004 Max Krasnyansky <[email protected]>                          
PPP generic driver version 2.4.2                                                
PPP BSD Compression module registered                                           
PPP Deflate Compression module registered                                       
PPP MPPE Compression module registered                                          
NET: Registered protocol family 24                                              
GACT probability NOT on                                                         
Mirror/redirect action on                                                       
Simple TC action Loaded                                                         
netem: version 1.3                                                              
u32 classifier                                                                  
    Performance counters on                                                     
    input device check on                                                       
    Actions configured                                                          
Netfilter messages via NETLINK v0.30.                                           
nf_conntrack version 0.5.0 (3971 buckets, 15884 max)                            
nf_conntrack_rtsp v0.7 loading                                                  
xt_time: kernel timezone is -0000                                               
ip_set: protocol 6                                                              
gre: GRE over IPv4 demultiplexor driver                                         
nf_nat_rtsp v0.7 loading                                                        
ip_tables: (C) 2000-2006 Netfilter Core Team                                    
NET: Registered protocol family 17                                              
bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update yo.
Bridge firewalling registered                                                   
8021q: 802.1Q VLAN Support v1.8                                                 
Registering SWP/SWPB emulation handler                                          
max nvram space = 131072                                                        
read 65536 bytes to offset 0                                                    
Key type encrypted registered                                                   
Northstar brcmnand NAND Flash Controller driver, Version 0.1 (c) Broadcom Inc. 2
nand: device found, Manufacturer ID: 0xec, Chip ID: 0xf1                        
nand: Samsung NAND 128MiB 3,3V 8-bit                                            
nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64          
Spare area=64 eccbytes 56, ecc bytes located at:                                
 2 3 4 5 6 7 8 9 10 11 12 13 14 15 18 19 20 21 22 23 24 25 26 27 28 29 30 31 343
Available 7 bytes at (off,len):                                                 
(1,1) (16,2) (32,2) (48,2) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0) (0,0
Scanning device for bad blocks                                                  
Bad eraseblock 40 at 0x000000500000                                             
Bad eraseblock 225 at 0x000001c20000                                            
Options: CACHEPRG,NO_SUBPAGE_WRITE,                                             
Creating 1 MTD partitions on "brcmnand":                                        
0x000002000000-0x000008000000 : "ddwrt"                                         
VFS: Cannot open root device "mtdblock3" or unknown-block(31,3): error -19      
Please append a correct "root=" boot option; here are the available partitions:
0100            4096 ram0  (driver?)                                            
0101            4096 ram1  (driver?)                                            
0102            4096 ram2  (driver?)                                            
0103            4096 ram3  (driver?)                                            
0104            4096 ram4  (driver?)                                            
0105            4096 ram5  (driver?)                                            
0106            4096 ram6  (driver?)                                            
0107            4096 ram7  (driver?)                                            
0108            4096 ram8  (driver?)                                            
0109            4096 ram9  (driver?)                                            
010a            4096 ram10  (driver?)                                           
010b            4096 ram11  (driver?)                                           
010c            4096 ram12  (driver?)                                           
010d            4096 ram13  (driver?)                                           
010e            4096 ram14  (driver?)                                           
010f            4096 ram15  (driver?)                                           
1f00             512 mtdblock0  (driver?)                                       
1f01            1536 mtdblock1  (driver?)                                       
1f02           29184 mtdblock2  (driver?)                                       
1f03           27392 mtdblock3  (driver?)                                       
1f04             128 mtdblock4  (driver?)                                       
1f05           98304 mtdblock5  (driver?)                                       
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,3)
CPU1: stopping                                                                  
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.30 #142                           
Hardware name: Northstar Prototype                                              
[<8001b0c8>] (dump_backtrace) from [<8001b29c>] (show_stack+0x18/0x1c)          
 r7:87853f58 r6:60000193 r5:00000000 r4:80500edc                                
[<8001b284>] (show_stack) from [<8015e560>] (dump_stack+0x8c/0xa0)              
[<8015e4d4>] (dump_stack) from [<8001ce7c>] (handle_IPI+0x110/0x1a8)            
 r7:87853f58 r6:00000001 r5:00000000 r4:805131a0                                
[<8001cd6c>] (handle_IPI) from [<80009394>] (gic_handle_irq+0x78/0x7c)          
 r7:b0100100 r6:87853f58 r5:b010010c r4:804efb14                                
[<8000931c>] (gic_handle_irq) from [<80009e80>] (__irq_svc+0x40/0x54)           
Exception stack(0x87853f58 to 0x87853fa0)                                       
3f40:                                                       86ddf240 00000000   
3f60: 00000848 8000a960 87852000 804ef8e0 804250cc 804dc220 87853fc8 413fc090   
3f80: 00000000 87853fb4 87853fb8 87853fa8 80018d28 80018d2c 60000013 ffffffff   
 r9:413fc090 r8:87853fc8 r7:87853f8c r6:ffffffff r5:60000013 r4:80018d2c        
[<80018cf0>] (arch_cpu_idle) from [<80069d10>] (default_idle_call+0x30/0x34)    
[<80069ce0>] (default_idle_call) from [<80069e1c>] (cpu_startup_entry+0x108/0x1)
[<80069d14>] (cpu_startup_entry) from [<8001cb34>] (secondary_start_kernel+0x15)
 r7:80513180 r4:804fd858                                                        
[<8001c9e4>] (secondary_start_kernel) from [<00009428>] (0x9428)                
 r5:00000055 r4:0782c06a                                                        
Rebooting in 10 seconds..

Mastec's picture
Assuming you are using

Assuming you are using Windows.  What I do when I install is as follows....

Open a Command Prompt window and at the prompt enter "ping -t" without the quotes.  This will let you know when your router is ready to use.

1) Open Netwrork and Sharing Center.

2) Click on Ethernet to open the Ethernet Statud box.

3) Click on Properties.

4) Click to highlight Internet Protocol Version 4 (TCP/IPv4)

5) Click on Properties to open a new box.

6) Click on "Use the following DNS server address:"

7) in IP address enter

8) in Subnet mask: enter

9) in Default gateway: enter

10) Click OK

11) Click OK

12) Click Close

13) Open a browser window and open

14) If Netgear Genie opens reset everything to default

15) Click on the link to upgrade the firmware and find the KONG file on your computer

16)  Click Upgrade

17) Keep an eye on the Command Prompt window.  You will see the router stop talking to your computer.  If there is no ping DO NOT click on Continue.  Wait until you see "Reply from bytes=32 time<1ms TTL=64".  This will tell you that your router is back on line and ready to go.


I hope this helps you.  Good Luck.


Mastec's picture
OH YEAH!  Don't forget to

OH YEAH!  Don't forget to repeat steps 2 thru 5 and click on Obtain an IP address automatically then click OK.  OK again. Finally Close.

Mastec's picture
Just reread what I poste3d

Just reread what I poste3d and realized I made an error. 

8) in Subnet mask: enter should actually be



RaHoor's picture


thank you for helping me. I am on Ubuntu not on Windows but it doesn't matter because i do not use dhcp so I always have a static IP (

That is not the problem. After restoring system defaults I choose the dd-wrt.K3_R6250.chk and upload it. Because I am connected through serial port I can see via minicom that the file is uploaded and flashed successfully. After an automatic rebbot I stuck in a bootloop as described. :(

So for me your first 12 steps are not necessary (getting static IP in the router network) and the other steps are in logical order. I have no idea what I am doing wrong...

RaHoor's picture
OK I figured out the problem.

OK I figured out the problem. After searching for hours on different sites someone has the same problem. The good news is I've done nothing wrong. Bad news is there is no tested solution yet. As you can see in the log in the first post I have some bad blocks on the Samsung chip. The bad blocks cannot be rewritten so dd-wrt is not able to flash the rootfs partition correctly. That causes the kernel panic and the bootloop.


I need to write the partition to another adress on the NAND. but I do not know how. If I have more time I will try to set a new offset, hoping the flash progress will continue properly. If I succeed I will post my solution...

obertuckerz112's picture
It has also been reported by

It has also been reported by someone on the dd-wrt forums that downgrading to an older kong release works. Then you can upgrade from there.

Kongs command line method is the suggested method.
It works great.