Will it fit? /proc/mtd vs bin file size

The file size for openwrt-21.02.1-ath79-nand-zyxel_nbg6716-squashfs-factory.bin is 30,539,776. It looks like the target mtd partition is only 2 MB. Or am I reading /proc/mtd wrong? Is it hopeless to use this file on this router?

I'm trying to upgrade my ancient Zyxel NB6716. At some point in the past I installed openwrt-18.06.4-ar71xx-nand-nbg6716-squashfs-factory.bin. I finally bit the bullet and decided to upgrade to 21.02.1-ath79. The sysupgrade procedure bricked it. So I set up my Linux server to be a TFTP server and used the factory recovery procedure to load NBG6716_V1.00(AAKG.12)C0.zip. (Zyxel no longer seems to have their old images on their website. Fortunately I keep them around for occasssions like this.) After a reboot I could once again access the router.

I scp'd the latest OpenWrt factory image to the router's /tmp and tried to mtd it into place. I left a ping running from my server and the router stopped responding and hasn't come back. The lights suggest that it's stuck in a boot loop, even after power-cycling. Results below.

root@NBG6716:/tmp# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "env"
mtd2: 00010000 00010000 "RFdata"
mtd3: 00fa0000 00010000 "nbu"
mtd4: 00200000 00020000 "rootfs_data"
mtd5: 00200000 00020000 "romd"
mtd6: 00100000 00020000 "header"
mtd7: 01e00000 00020000 "rootfs"
mtd8: 00100000 00020000 "header1"
mtd9: 01e00000 00020000 "rootfs1"
mtd10: 00200000 00020000 "bu1"
mtd11: 0bc00000 00020000 "bu2"
root@NBG6716:/tmp# mtd -r write openwrt-21.02.1-ath79-nand-zyxel_nbg6716-squashfs-factory.bin /dev/mtd7
Unlocking /dev/mtd7 ...
Writing from openwrt-21.02.1-ath79-nand-zyxel_nbg6716-squashfs-factory.bin to /dev/mtd7 ...
Rebooting ...
/bin/sh: /sbin/reboot: Input/output error

The size of mtd7 is 01e00000, which is 31457280 decimal. So size shouldn't be a problem. But I think something is wrong with that file. In 19.07 the sysupgrade was 4870kB, and factory 5888kb. In 21.02 it is 7320kB vs. 29824kB. That cannot be good.

1 Like

Looks like you can download factory firmware here.
http://origin-eu.zyxel.com/support/download_library/product/nbg6716_12.shtml?c=gb&l=en&pid=20130207180045&tab=Firmware&pname=NBG6716&mtname=Firmware

1 Like

Something to note is that this is a dual boot device so if flashing don't work, it should be able to switch to alt rom somehow (hold reset button for a set time or poweron with reset button pressed?). When you get this to boot from last working rom, you can force switching roms type fw_printenv boot_part to see which rom you booted from and then fw_setenv boot_part 1 or fw_setenv boot_part 2 to load alt rom at next boot. If you install `luci-app-advanced-reboot' you can do it from browser. You should flash openwrt twice each time on these to ensure it goes on both partitions. If you can pick up a Linksys EA7500v1 cheap on ebay like this one, it would be a great upgrade. Just be sure you get the v1 not the lower spec v2. They go for around $40 and work great with 21.01.2 and also dual boot.

cat /proc/mtd | head -n1;cat /proc/mtd | tail -n +2 | gawk --non-decimal-data '{$2=sprintf("%d","0x"$2)/1024/1024"Mb"}{$3=sprintf("%d","0x"$3)/1024/1024"Mb"}1'
dev:    size   erasesize  name
mtd0: 0.25Mb 0.0625Mb "u-boot"
mtd1: 0.0625Mb 0.0625Mb "env"
mtd2: 0.0625Mb 0.0625Mb "RFdata"
mtd3: 15.625Mb 0.0625Mb "nbu"
mtd4: 2Mb 0.125Mb "rootfs_data"
mtd5: 2Mb 0.125Mb "romd"
mtd6: 1Mb 0.125Mb "header"
mtd7: 30Mb 0.125Mb "rootfs"
mtd8: 1Mb 0.125Mb "header1"
mtd9: 30Mb 0.125Mb "rootfs1"
mtd10: 2Mb 0.125Mb "bu1"
mtd11: 188Mb 0.125Mb "bu2"
1 Like

Doh, thanks. I must have been too tired when reading that and was looking at the line reading 20 0000, not 1e0 0000. I'd run it through Windows Calculator in programmer mode to convert it and obviously got the wrong value. Good call on the file sizes. I can try the previous version and see if that's any more successful.

Success. I was able to flash the 21.02.1 image via TFTP using the WPS button.

Another issue I ran into is lack of feedback on how long to wait for the flash to complete. The light at the far right of the box flashed rapidly for 10's of minutes. I finally power-cycled it and waited perhaps two minutes to get a ping response and finally saw an echo reply. At that point I could connect over the web interface. So I'm guessing that in my initial attempt I didn't wait long enough for the image to finish flashing.

BTW, my motivation for update was mostly to get IPv6 working with ndppd, and the old version in the older OpenWrt has a bug in that it can disable ALLMULTI during startup. (I'm successfully using ndppd at the office where I'm using a CentOS 7 box as my gateway.) I saw the newer version in the more recent OpenWrt. I'm also upgrading my Xfinity cable modem, for which the router is serving to isolate my LAN's DHCP/DNS setup (on my CentOS 7 server) from the forced DHCP/DNS of the cable modem.

Just in case I couldn't get this working, I googled for reviews of best OpenWrt-compatible routers for 2021 and the TP-Link Archer AX20 looked like a nice emergency fallback router for $85, so I'll be trying that out next. I'll probably repurpose the Zyxel as another WAP.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.