Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FS#3324 - Zyxel EMG2926-Q10A (aka NBG6716) requires changes in tree #8183

openwrt-bot opened this issue Sep 6, 2020 · 5 comments


Copy link

openwrt-bot commented Sep 6, 2020


459c8c9 added support for the Zyxel NBG6716 device. Unfortunately, I believe it made an error in the partition layout. Because the RAS image header is written to flash, the offsets for sub-partitions of //firmware// must be shifted down by the size of this header (i.e., 128KiB):

diff --git a/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts index 90328078dd..148a6ea2d1 100644 --- a/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts +++ b/target/linux/ath79/dts/qca9558_zyxel_nbg6716.dts @@ -148,14 +148,19 @@ reg = <0x500000 0x7b00000>; };
  •           partition@500000 {
  •           // There's a RAS image header inside the firmware partition,
  •           // taking up one erase block (128KiB), so the kernel and ubi
  •           // partitions are shifted by that amount.
  •           partition@520000 {
  •                   // JFFS2 containing the compressed kernel
                      label = "kernel";
  •                   reg = <0x500000 0x400000>;
  •                   reg = <0x520000 0x400000>;
  •           partition@900000 {
  •           partition@920000 {
                      label = "ubi";
  •                   reg = <0x900000 0x7700000>;
  •                   reg = <0x920000 0x76C0000>;


Without this change, the bootloader finds the kernel inside its JFFS2 partition just fine, but then the kernel dies when it cannot find the UBI header at the indicated offset.

It is not clear to me whether this change should be applied to all NBG6716-equivalent devices or merely the one I have in hand.

Speaking of, that device calls itself a //AAVK-EMG2926Q10A// in its RAS header and refuses to flash anything not so labeled. Therefore, I have added a target for it by lightly extending the existing one:

diff --git a/target/linux/ath79/dts/qca9558_zyxel_aavk-emg2926q10a.dts b/target/linux/ath79/dts/qca9558_zyxel_aavk-emg2926q10a.dts new file mode 100644 index 0000000000..ec94aa0d73 --- /dev/null +++ b/target/linux/ath79/dts/qca9558_zyxel_aavk-emg2926q10a.dts @@ -0,0 +1,2 @@ +/* This is just an alias, really */ +#include "qca9558_zyxel_nbg6716.dts" diff --git a/target/linux/ath79/image/ b/target/linux/ath79/image/ index ad79c487ad..7336dc45d7 100644 --- a/target/linux/ath79/image/ +++ b/target/linux/ath79/image/ @@ -263,3 +263,9 @@ define Device/zyxel_nbg6716 UBINIZE_OPTS := -E 5 endef TARGET_DEVICES += zyxel_nbg6716 + +define Device/zyxel_aavk-emg2926q10a + $(call Device/zyxel_nbg6716) + RAS_BOARD := AAVK-EMG2926Q10A +endef +TARGET_DEVICES += zyxel_aavk-emg2926q10a
Copy link

openwrt-bot commented Aug 17, 2021


I can confirm - I have Zyxel NBG6716 with 256MB flash and it's not possible to flash 21.02 on the device - it bootlops:

[ 7.134014] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 7.141345] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 97628008
[ 7.150435] ubi0: available PEBs: 1948, total reserved PEBs: 43, PEBs reserved for bad PEB handling: 39
[ 7.159989] hctosys: unable to open rtc device (rtc0)
[ 7.165200] ubi0: background thread "ubi_bgt0d" started, PID 368
[ 7.171602] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[ 7.179227] Please append a correct "root=" boot option; here are the available partitions:
[ 7.187711] 1f00 256 mtdblock0
[ 7.187715] (driver?)
[ 7.194341] 1f01 64 mtdblock1
[ 7.194344] (driver?)
[ 7.200986] 1f02 64 mtdblock2
[ 7.200989] (driver?)
[ 7.207632] 1f03 16000 mtdblock3
[ 7.207635] (driver?)
[ 7.214263] 1f04 2048 mtdblock4
[ 7.214266] (driver?)
[ 7.220900] 1f05 2048 mtdblock5
[ 7.220903] (driver?)
[ 7.227546] 1f06 1024 mtdblock6
[ 7.227549] (driver?)
[ 7.234178] 1f07 2048 mtdblock7
[ 7.234181] (driver?)
[ 7.240815] 1f08 254976 mtdblock8
[ 7.240818] (driver?)
[ 7.247459] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[ 7.256820] Rebooting in 1 seconds..

Copy link

openwrt-bot commented Aug 17, 2021


full boot log plz, does it work with the patch pasted above ? if so kindly post the patch on openwrt-devel

Copy link

openwrt-bot commented Aug 17, 2021


I don't have oppoturnity right now to have bootlog again (I need that hardware working) and I don't have option to test out the patch (as I don't have knowledge and tools needed to compile that).

If firmware with patch provided, I can test it later on and provide bootlog.

Copy link

openwrt-bot commented Aug 17, 2021


Thanks to local openwrt forum user I was able to test firmware compiled with patch (nbg6716) and it works flawlessly.

Copy link

nwf commented Mar 8, 2022

I now have another of these devices with which to experiment and I believe the confusion here is that the wiki's instructions do not account for the RAS header in the factory binary, while the zloader that runs in the TFTP recovery path does. While I do not have its source at hand, it does, from observation and from looking at strings, write the header and the rootfs components to flash separately.

I believe this issue can be closed once the wiki is updated to shave off the 0x20000 bytes from the start of the OpenWRT factory.bin image.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet

No branches or pull requests

2 participants