19.07 boot-loop [nbg6716]

Hi,
I flashed my Zyxel NBG6716 with
nbg6716-squashfs-sysupgrade.tar
with the keep settings option unchecked.

device rebooted and is now stuck in a bootloop.
ports come up briefly, but that's about it.

Previously it had been running 18.06.
Originally the NBG6716 came with a tweaked version of BB, but has been running every version of wrt/lede ever since.

any help in restoring back to normal operation would be much appreciated,
thanks.

not sure if this has anything to do with it but there seem to be two snapshots for the nbg6716

ath79/nand -> http://downloads.openwrt.org/snapshots/targets/ath79/nand/
ar71xx/nand -> http://downloads.openwrt.org/snapshots/targets/ar71xx/nand/

only one release though.

It's recommended to move to ath79 since 19.07 is the last release for ar71xx (source only after that).

I recommend following the recovery procedure and flashing the ath79 factory image. Hopefully that works better than what looks like a botched sysupgrade.

thanks @borromini , but I can't even seem to get into recovery.

reset button doesn't do anything.
wps button doesn't do anything.

during boot or after it doesn't do anything, not even look for a tftp server.

The time between reboots does seem to vary randomly, but otherwise it looks pretty much bricked.

https://openwrt.org/toh/zyxel/zyxel_nbg6617#oem_installation_using_the_tftp_method

That should always work.

@slh, i guess it should... but it doesn't...

the power led will go on and off while counting out the seconds. (not sure if this in itself is already a reboot) and eventually will reboot even with the WPS button held down.

wireshark doesn't show any activity whatsoever....

@slh You're linking to the NBG6617 though and he has an NBG6716.

@undef See if this does work?

1 Like

@Borromini,
yes, I have ... the procedure is pretty much the same anyway :wink:
i have the latest stock image (renamed to ras.bin) on my tftp server.
but wireshark isn't registering any activity from the device at all. :frowning:

Recovery

The device is able to flash from a tftp server. You have to fullfill following requirements:

  • Configure your server to 192.168.1.33, netmask 255.255.255.0

  • Copy your firmware file into the tftp directory and name it ras.bin (IE download it from zyxel directly)

  • Boot up your device holding the WPS (Key) button.

After the image has been flashed all LEDs will blink. It takes about 10seconds.

It was worth a try...

Did you try putting a switch in between? That might help sometimes.

1 Like

Check with wireshark what is happening on the wire, perhaps the IPs or the file name aren't correct.

alright, got me a terminal and it looks like something went wrong flashing the new image.
I'm not at home with the serial console/bootlog but it looks like the flash is corrupt.

this is the bootlog for a normal boot i.e. without holding down the WDS (recovery button)

U-Boot 2009.11 (Jul 12 2013 - 14:30:56)

NBG6716 - Scorpion 1.0
DRAM:  32bit ddr2 256 MB
Flash: 16 MB
*** Warning *** : PCIe WLAN Module not found !!!
Net:   eth0, eth1
NAND:  Hynix NAND 256MiB 3,3V 8-bit [256MB]


ZyXEL zloader v1.01 (Jul 12 2013 - 14:55:02)
Multiboot clinent version: 1.1
could not establish link on eth0
eth_init failed!
### JFFS2 loading '/boot/vmlinux.lzma.uImage' to 0x80400000
Scanning JFFS2 FS: '/boot/vmlinux.lzma.uImage' found, done
Loading file: done
### JFFS2 load complete: 1686071 bytes loaded to 0x80400000
## Booting kernel from Legacy Image at 80400000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.162
   Created:      2020-01-06  16:47:09 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1686007 Bytes =  1.6 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 4.14.162 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r10860-a3ffeb413b)) #0 Mon Jan 6 16:47:09 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 10000000 @ 00000000 (usable)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 10000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] random: get_random_bytes called from 0x8053a740 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 65024
[    0.000000] Kernel command line:  board=NBG6716 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(env)ro,64k(RFdata)ro,-(nbu);ar934x-nfc:2048k(zyxel_rfsd),2048k(romd),1024k(header),2048k(kernel),-(ubi) mem=256M ethaddr=FC:F5:28:D3:09:20 rootfstype=squashfs noinitrd
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 254052K/262144K available (4253K kernel code, 178K rwdata, 528K rodata, 216K init, 213K bss, 8092K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] Clocks: CPU:720.000MHz, DDR:600.000MHz, AHB:200.000MHz, Ref:40.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns
[    0.000007] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns
[    0.008293] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[    0.074984] pid_max: default: 32768 minimum: 301
[    0.080077] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.087115] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.096469] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.106962] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.114389] NET: Registered protocol family 16
[    0.120257] MIPS: machine is Zyxel NBG6716
[    0.169426] ar724x-pci ar724x-pci.0: PCIe link is down
[    0.174899] registering PCI controller with io_map_base unset
[    0.181150] registering PCI controller with io_map_base unset
[    0.670490] PCI host bridge to bus 0000:00
[    0.674893] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.682198] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.688132] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.695353] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.703910] PCI host bridge to bus 0000:01
[    0.708266] pci_bus 0000:01: root bus resource [mem 0x12000000-0x13ffffff]
[    0.715593] pci_bus 0000:01: root bus resource [io  0x0001]
[    0.721519] pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
[    0.728744] pci_bus 0000:01: No busn resource found for root bus, will use [bus 01-ff]
[    0.737569] pci 0000:01:00.0: BAR 0: assigned [mem 0x12000000-0x121fffff 64bit]
[    0.745388] pci 0000:01:00.0: BAR 6: assigned [mem 0x12200000-0x1220ffff pref]
[    0.755803] clocksource: Switched to clocksource MIPS
[    0.762021] NET: Registered protocol family 2
[    0.767406] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    0.774846] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.781668] TCP: Hash tables configured (established 2048 bind 2048)
[    0.788555] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.794776] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.801678] NET: Registered protocol family 1
[    0.808674] Crashlog allocated RAM at address 0x3f00000
[    0.815247] workingset: timestamp_bits=30 max_order=16 bucket_order=0
[    0.826304] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.832504] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.851152] io scheduler noop registered
[    0.855319] io scheduler deadline registered (default)
[    0.861174] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.869693] console [ttyS0] disabled
[    0.893579] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 2500000) is a 16550A
[    0.902764] console [ttyS0] enabled
[    0.902764] console [ttyS0] enabled
[    0.910189] bootconsole [early0] disabled
[    0.910189] bootconsole [early0] disabled
[    0.923753] m25p80 spi0.0: found mx25l12805d, expected m25p80
[    0.930119] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[    0.935274] 4 cmdlinepart partitions found on MTD device spi0.0
[    0.941310] Creating 4 MTD partitions on "spi0.0":
[    0.946193] 0x000000000000-0x000000040000 : "u-boot"
[    0.952587] 0x000000040000-0x000000050000 : "env"
[    0.958484] 0x000000050000-0x000000060000 : "RFdata"
[    0.965113] 0x000000060000-0x000001000000 : "nbu"
[    0.971991] nand: device found, Manufacturer ID: 0xad, Chip ID: 0xda
[    0.978475] nand: Hynix NAND 256MiB 3,3V 8-bit
[    0.982982] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    0.990938] Scanning device for bad blocks
[    0.996491] Bad eraseblock 16 at 0x000000200000
[    1.001126] Bad eraseblock 17 at 0x000000220000
[    1.007424] random: fast init done
[    1.053653] Bad eraseblock 556 at 0x000004580000
[    1.181559] 5 cmdlinepart partitions found on MTD device ar934x-nfc
[    1.187929] Creating 5 MTD partitions on "ar934x-nfc":
[    1.193158] 0x000000000000-0x000000200000 : "zyxel_rfsd"
[    1.199640] 0x000000200000-0x000000400000 : "romd"
[    1.206090] 0x000000400000-0x000000500000 : "header"
[    1.212174] 0x000000500000-0x000000700000 : "kernel"
[    1.218808] 0x000000700000-0x000010000000 : "ubi"
[    1.226253] libphy: Fixed MDIO Bus: probed
[    1.237796] switch0: Atheros AR8337 rev. 2 switch registered on ag71xx-mdio.0
[    1.935964] libphy: ag71xx_mdio: probed
[    2.567211] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    2.578464] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii
[    3.207340] eth1: Atheros AG71xx at 0xba000000, irq 5, mode: sgmii
[    3.215442] NET: Registered protocol family 10
[    3.224265] Segment Routing with IPv6
[    3.228107] NET: Registered protocol family 17
[    3.232655] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    3.246236] 8021q: 802.1Q VLAN Support v1.8
[    3.253581] UBI: auto-attach mtd8
[    3.257002] ubi0: attaching mtd8
[    4.169796] random: crng init done
[    7.053029] ubi0: scanning is finished
[    7.077447] ubi0: attached mtd8 (name "ubi", size 249 MiB)
[    7.083020] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    7.090026] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    7.096916] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    7.103970] ubi0: good PEBs: 1991, bad PEBs: 1, corrupted PEBs: 0
[    7.110160] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    7.117492] ubi0: max/mean erase counter: 4/2, WL threshold: 4096, image sequence number: 269488360
[    7.126677] ubi0: available PEBs: 0, total reserved PEBs: 1991, PEBs reserved for bad PEB handling: 39
[    7.136155] ubi0: background thread "ubi_bgt0d" started, PID 370
[    7.143559] block ubiblock0_0: created from ubi0:0(rootfs)
[    7.149173] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
[    7.156249] hctosys: unable to open rtc device (rtc0)
[    7.165007] squashfs: SQUASHFS error: unable to read id index table
[    7.171582] List of all partitions:
[    7.175137] 1f00             256 mtdblock0
[    7.175141]  (driver?)
[    7.181793] 1f01              64 mtdblock1
[    7.181796]  (driver?)
[    7.188436] 1f02              64 mtdblock2
[    7.188439]  (driver?)
[    7.195062] 1f03           16000 mtdblock3
[    7.195064]  (driver?)
[    7.201697] 1f04            2048 mtdblock4
[    7.201700]  (driver?)
[    7.208332] 1f05            2048 mtdblock5
[    7.208336]  (driver?)
[    7.214958] 1f06            1024 mtdblock6
[    7.214961]  (driver?)
[    7.221594] 1f07            2048 mtdblock7
[    7.221598]  (driver?)
[    7.228238] 1f08          254976 mtdblock8
[    7.228241]  (driver?)
[    7.234863] fe00            2852 ubiblock0_0
[    7.234866]  (driver?)
[    7.241671] No filesystem could mount root, tried:
[    7.241674]  squashfs
[    7.246625]
[    7.250440] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(254,0)
[    7.259984] Rebooting in 1 seconds..

the bootlog while holding down the WDS button, i.e. which should trigger recovery
is exactly the same.... so is there another way to get the NBG6716 into recovery mode?

or failing that, try to flash /reover via the serial console maybe?

any help in getting the trusty workhorse back on its feet is much appreciated.

big update: I managed to get into recovery mode.
key is it only triggers recovery when a connected on LAN. (and not on the WAN port like i had it...)
small detail....

now, should I flash to the original Zyxel (CC?) image first, or go straigt for:
https://downloads.openwrt.org/releases/17.01.0/targets/ar71xx/nand/lede-17.01.0-r3205-59508e3-ar71xx-nand-nbg6716-squashfs-factory.bin?

i'd rather not go for one of the ath79 images as there's no release build for it, only a snapshot it seems
(and I'm not clear on what benefit it would bring, and from some other post I gathered I'd be losing 128MB of storage)

thanks.

If there's an initramfs image for ath79 you might want to boot that and see if that behaves better (although that won't touch your flash and that's where stuff seems to be going wrong (UBIFS?)).

Success! the NBG6716 is finally running 19.07
just in case somebody stumbles across this forum post, here are the loops to I ended up jumping through:

  • use a switch - do not connect directly to your laptop

  • use a LAN (yellow port) - do not use the WAN port (blue)

  • set laptop to ip address 192.168.1.33

  • get a tftp server that actually works - i tried many, winagents worked (linux would've been faster :wink:

  • (get the serial console up to see what actually works)

  • get the original Zyxel image (no need to rename but doesn't hurt)

  • flash via the tftpserver, interrupt the boot, press any key: then

NBG6716> ATUR ras.bin
download ras.bin to memory address 0x80000000
Using eth0 device
TFTP from server 192.168.1.33; our IP address is 192.168.1.1
Filename 'ras.bin'.
Load address: 0x80000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #####################
done
Bytes transferred = 23199744 (1620000 hex)

Please be patient, it may take few minutes to finish firmware upgrade!
Erasing at 0x4e0000 -- 100% complete.
done
Erasing at 0x22e0000 -- 100% complete...erase...
write...done
NBG6716> ATGO

the next part is just the same as upgrading from stock:
then ssh to 192.168.1.1 (password should be 1234, or set it via the webinterface which should be up)
scp the 19.07 image to /tmp
then mtd -r write /tmp/openwrt.bin /dev/mtd7 (replace openwrt.bin with whatever you named it)

joy!

if using the recovery procedure:

  • power off,
  • hold WDS,
  • power on,
  • wait a couple of seconds,
  • release WDS.
    in this case you must name your file ras.bin
    after this it's also back to the standard upgrade from stock procedure.

hope this helps someone some day.
thanks @slh and @Borromini for pointing me in the right direction.

1 Like

Glad you got it sorted! As an aside, you should always use a LAN port for flashing firmware.

Would you mind updating the flashing instructions in the wiki entry if they are lacking clarity?

Done: updated the recovery section on the wiki.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.