Difficulty to upgrade Zyxel EMG2926-Q10A

Installing and Using OpenWrt
1

I am trying to upgrade OpenWRT from a EMG2926-Q10A (who is in fact is a NBG6716)

ZLD   Version          : 2.21 (May 25 2015 - 14:13:19)
Bootbase Version       : U-Boot 2009.11 (May 25 2015 - 13:40:13)
Firmware Version       : V1.00(AAKG.12)C0
Product Model          : NBG6716
Serial Number          : XXXXXXXXXX
First MAC Address      : XXXXXXXXX
Default Country Code   : FF
Header      Checksum   : 0000da3a
RootFS      Checksum   : 00004280
Boot Module Debug Flag : 00
Boot Block Write Enable: no
HTP Mode Enable        : no

when i try the upgarde i get :

root@NBG6716:/tmp# mtd -f -r write openwrt-15.05.1-ar71xx-nand-nbg6716-squashfs-factory.bin /dev/mtd7
Unlocking /dev/mtd7 ...
Writing from openwrt-15.05.1-ar71xx-nand-nbg6716-squashfs-factory.bin to /dev/mtd7 ...  [e]Failed to erase block
root@NBG6716:/tmp#

I try with same result using the latest

Any help would be appreciated
thanks

2

Perhaps this helps:

3

hmm perhaps..
obviously there is something i did not ctahc in the command :
zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin | mtd -r -e ubi write - firmware; reboot -f

the -e expecting a device
and after the "-" what is the firmware...

sorry if it sound stupid.

4

-r reboots after mtd is done
-e <device> erases the specified device before writing
write does the obvious
- refers to stdin (so whatever zcat feeds into mtd)
firmware is the name of the target (mtd-) partition.

5 
root@NBG6716:~# ls
openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Kernel.bin
root@NBG6716:~# zcat openwrt-ath79-nand-zyxel_nbg6716-squashfs-sysupgrade-4M-Ker
nel.bin | mtd -r -e /dev/mtd7 write - /dev/mtd7; reboot -f
Unlocking /dev/mtd7 ...
Erasing /dev/mtd7 ...
Failed to erase block on /dev/mtd7 at 0xe0000
Writing from <stdin> to /dev/mtd7 ...  [e]Failed to erase block

root@NBG6716:~#
6

so question
is mtd7 the correct device :frowning:

root@NBG6716:/tmp# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "env"
mtd2: 00010000 00010000 "RFdata"
mtd3: 003a0000 00010000 "nbu"
mtd4: 00200000 00020000 "rootfs_data"
mtd5: 00200000 00020000 "romd"
mtd6: 00100000 00020000 "header"
mtd7: 01e00000 00020000 "rootfs"
mtd8: 00100000 00020000 "header1"
mtd9: 01e00000 00020000 "rootfs1"
mtd10: 00200000 00020000 "bu1"
mtd11: 03c00000 00020000 "bu2"
7

Is the device unlocked? See:

8

For me mtd7 was ok. but prior to that I had to flash using tftp. See the recovery procedure here :
https://openwrt.org/toh/zyxel/zyxel_nbg6716

try using ar71xx instead of ath79 and see if this works. For ath79 we are still having issues. If you really want to get it going on ath79, use snapshots and flash via tftp. See this :

9

@DigDug,

Yes i think so , i am able to flash stock firmware from Zyxel (V1.00(AAKG.12)C0.bin) . i have full access to console / Ssh

@Kev,
I triried the recovery and no luck. again i am able to flash stock Zyxel firmware (V1.00(AAKG.12)C0.bin) via tftp with no issue, but any method i tried for OpenWRT , are unsuccessfull, tftp, mtd, web ui
I will try flasihing later today with openwrt-ath79-nand-zyxel_nbg6716-squashfs-factory.bin via tftp to see

Thanks

10

it's probably not the issue here, but just in case, try to disconnect from ssh and issue the commands over the serial connection...

11

"Full access" is always possible with this device.
Try the 18 version of OpenWRT first.

I uploaded the 18.05.6 (factory) firmware as openwrt.bin to the /tmp directory on device using WinSCP in SCP mode.
Then login using ssh into /tmp and the write the firmware using mtd -r write openwrt.bin /dev/mtd7

12

Ok some news.

i was able to tftp flash with openwrt-ath79-nand-zyxel_nbg6716-squashfs-factory.bin

done
Bytes transferred = 30539776 (1d20000 hex)

Please be patient, start to upgrade RAS!
Erasing at 0x4e0000 -- 100% complete.
done
Skipping bad block at  0x005e0000
Erasing at 0x22e0000 -- 100% complete.
write...Skip bad block 0x005e0000
done

First 0x6 last 0x6 sector size 0x10000                                         6
Erased 1 sectors
write addr: 9f060000

But end up with reboot loop

[    2.073108] UBI error: no valid UBI magic found inside mtd9
[    2.079768] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    2.087363] Please append a correct "root=" boot option; here are the available partitions:
[    2.095888] 1f00             256 mtdblock0
[    2.095892]  (driver?)
[    2.102540] 1f01              64 mtdblock1
[    2.102543]  (driver?)
[    2.109185] 1f02              64 mtdblock2
[    2.109188]  (driver?)
[    2.115817] 1f03            3712 mtdblock3
[    2.115820]  (driver?)
[    2.122454] 1f04            2048 mtdblock4
[    2.122457]  (driver?)
[    2.129099] 1f05            2048 mtdblock5
[    2.129102]  (driver?)
[    2.135731] 1f06            1024 mtdblock6
[    2.135734]  (driver?)
[    2.142368] 1f07          125952 mtdblock7
[    2.142371]  (driver?)
[    2.149014] 1f08            4096 mtdblock8
[    2.149017]  (driver?)
[    2.155646] 1f09          121856 mtdblock9
[    2.155649]  (driver?)
[    2.162281] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    2.171554] Rebooting in 1 seconds..

interesting seeing mtd9 instead of mtd7

Then i tried to tftp flash with openwrt-18.06.5-ar71xx-nand-nbg6716-squashfs-factory.bin
and i get :

done

Bytes transferred = 6029312 (5c0000 hex)

Wrong header checksum, stop to upgrade RAS image!

so i will try mtd9 next i think

13

Ok i try writing to mtd9 , it did work but device failed to boot .....
Back to sqare 1 ....

but i notive only the bigger file firmware seems to work via tftp

-rw-r--r-- 1 root   root    5767168 Mar 15  2016  openwrt-15.05.1-ar71xx-nand-nbg6716-squashfs-factory.bin
-rw-rw-r-- 1 root  root  6029312 Dec  7 17:36  openwrt-18.06.5-ar71xx-nand-nbg6716-squashfs-factory.bin
-rw-r--r-- 1 root   root    6029312 Dec  1 03:20  openwrt-19.07.0-rc2-ar71xx-nand-nbg6716-squashfs-factory.bin
-rw-rw-r-- 1 root  root  30539776 Dec  8 09:52  openwrt-ath79-nand-zyxel_nbg6716-squashfs-factory.bin
-rw-rw-r-- 1 root  root  23199744 Oct 30  2017 'V1.00(AAKG.12)C0.bin'

So far only the last 2 on the listing work via tftp, and only one actually successfully boot.
Really weird.

14

i am about to give up :frowning:
Seems like the 18.xxx bin missing some part that the ath79 have.... to get the device flash
and seems the ath79 bin do not found my root FS

[    2.073299] UBI error: no valid UBI magic found inside mtd9
[    2.079875] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    2.087462] Please append a correct "root=" boot option; here are the available partitions:

I dont have the knowledge rigth now to make this change so i will continue study

15

Are you at least able to reflash the stock firmware from zyxel and get it to work? If so, from time to time I have to do this prior to trying snapshots... but you may have something else going on.

Check this post, where I show different outputs for cat /proc/mtd

so it seems to change depending on the version... reflashing the stock firmware via tftp saved me a few times.

Don't give up!!

16

Hello,
Yes i am totally able to reflash with stock firmware, it is actually the only firmware who actually boot.
I will revisit this again and see if newer snapshot work.

17

Hello,

For your information, I followed the instruction on this webpage (in French) to be able to install the OpenWrt firmware: https://blog.incloudus.com/2017/flasher-routeur-zyxel-emg2926-q10a-de-chez-videotron/.

Hope it will help,

1 Like
18

I've had the same problem 2 years ago, I never got to flash OpenWRT and have been stuck with the Zyxel modified version ever since. Seems like this issue is related with mine. Tried flashing the newest ath79 image today. Goes through tftp but never boots, I am able to revert back though.

19

This How-To (that saved me a lot of trouble) has been archived here:

for posterity.

Thanks a lot for this post @neynim .