Difficulties trying to access serial console

Installing and Using OpenWrt
1

I'm trying to install openwrt on a ZyXEL EMG2926-Q10A. It is actually an NBG6716 that the ISP rebranded. It is also locked down: there is no "firmware update" in the web ui and tftp seems to have been disabled.

Here's the wiki link: https://openwrt.org/toh/zyxel/nbg6716

Someone had installing openwrt on that device and reported on their experience in this (archived) blog post:

Because the "regular" install/upgrade mechanisms are not available, one of the first step is to access the device using a serial connection.This is also described in the wiki.

I am able to connect using a usb-ttl device (Jili Online 3.3V 5V USB to TTL Converter CH340G UART Serial Adapter Module) but there seems to be something weird.

First, I need to use "7 bit data" instead of 8 for the serial connection (aka 7-N-1) at 115120 bps, or else I see garbage. Note that I did not connect the 3.3V pin to the usb-ttl but rather left the regular router power supply connected.

When I turn on the device, I see the following on the serial port:

U-Boot 2009.11 (Feb 27 2014 - 03:41:50)

EMG2926 - Scorpion 1.0
DRAM:  32bit) ddr1
 4 MB

I find this a bit surprising, as other people (including the blog post) get something that looks like:

U-Boot 2009.11 (May 25 2015 - 13:40:13)

EMG2926 - Scorpion 1.0
DRAM:  32bit ddr2 256 MB
Flash: 16 MB
*** Warning *** : PCIe WLAN Module not found !!!
Net:   Max resets limit reached exiting...
eth0, eth1
NAND:  Hynix NAND 128MiB 3,3V 8-bit [128MB]


ZyXEL zloader v2.21 (May 25 2015 - 14:13:21)
Multiboot clinent version: 1.2

Hit any key to stop autoboot:  3

It looks like the DRAM line gets corrupted: f.e. there's a closing ) that slips before ddr1, there's nothing after ddr1 and there's a 4 MB alone on the next line. There doesn't seem to have the same "structure" as others reported, and there's nothing after the 4MB (ie the router doesn't seem to get to the bootloader).

There's also this post showing similar output to the blog post: ZyXel EMG2926 (NBG6716), can't access serial console

What could be causing this? Is the serial connection not properly configured? I am using CoolTerm under macos to connect, but got exactly the same with screen and SerialTools. I tried playing with other options but nothing has much useful effect. Here's a screenshot when I turn on the device:

CoolTerm
CoolTerm1624Ă—1344 121 KB

Is there something else on the device to do? For example disabling wifi (I tried)? Booting with the WPS (key) button pressed down (I tried)? Reset button?

Any idea?

Thanks!!

Edit: Forgot to post this (archived) forum post with some related information: https://forum.archive.openwrt.org/viewtopic.php?id=68668&p=1#p350341

2

Are you sure that they are actually identical inside? An ISP rebranded router might have custom firmware and lower-spec hardware, even if it has the same external casing and other seemingly similar features. It might be necessary to open the device to know for sure.

3

I opened the device and saw a board id: 7016A068100G. Googling it brings up this page:
https://techinfodepot.shoutwiki.com/wiki/ZyXEL_EMG2926-Q10A which says:

This device would seem to very similar (if not identical to) the ZyXEL NBG6716.
OpenWRT's wiki says something similar as the first sentence (https://openwrt.org/toh/zyxel/nbg6716):
Also known as ZyXEL Media Router AC 1750 Ultimate Performance or ZyXEL EMG2926-Q10A

4

But it is possible for the same board to be stuffed with different components. Check the RAM and flash storage chips, for example, to see if it is the same.

5

I guess it could be different. The 4MB I see in the "logs" seems to be quite low. But this is mentioned on the wiki:

There seem to be devices out there with different flash configuration:

6

Precisely. And if it is 4MiB, it's game over for installing OpenWrt.

7

Just to be sure, the OEM bootlog should give more details about the installed flash further into booting linux. At this point I wouldn't put too much emphasis on the bootloader messages, because they're partially garbled and may display unexpected results - 4 MB flash would be surprising for this device (but not impossible as a cost cutting measure, elthough that would indeed imply game over).

8

damn it :frowning:

Say I didn't see this and wanted to hit this wall when actually trying to install openwrt. I'm still puzzled by the serial connection behaviour. The log is sus, I would have expected more information.

9

It is probably fastest to simply look at the flash chip and grab the part number.. Google it, and let us know what you find.

10

Check the pin connections and -if you can- the actual voltages on the pins (both on your router and the data lines of your usb2serial adapter). These ch340g are usually quite good, but the pictures I find for your product name are looking a bit different (e.g. aspect ratio, …) from what I'm used to be seeing (although that might be down to bad image editing)

Sometimes usb2serial adapters and devices don't like each other too much, for no discernible reasons (unless you attack it with a scope and really go into the details of the connection), often you got fake chips with slightly differing behaviour - it does help to have a couple of different usb2serial adapters using different chipsets.

I would not expect 7 bit mode, but rather non-ideal connections, too long data cables, wrong voltages or a slight drift of the baudrate (either on the board or your usb2serial adapter). The question would be how deep you want to dive into this rabbit hole (the specs aren't really spectacular for 2024 - and if you really have less than 8 MB flash or less than 128 MB RAM (ath10k), there wouldn't be any point to dive any deeper).

11

I've opened the device to take a look at the chips.

If I'm reading it right, the flash is a MX25L3235EMI-10G (MXIC X133894 MX25L3235EMI-10G 3N527200BK). The RAM is a SK hynix H27U1G8F2BTR BC 346A (M1WEF093SA).

Googling around that gives 32 MB flash and 128 MB ram. That should be enough for openwrt, right?

I'm still puzzled by the serial output. Everywhere I see 115200 8-N-1 (see for example https://www.rodneybeede.com/security/tinkering-with-isp-autogenpassword-zyxel-emg2926-q10a-wifi-router.html) so I find it weird that I need to connect using 7-N-1.

12

Sizes are specified in MBit, not MByte - so divide by 8, which comes out to 4/16, game over.

2 Likes
13

The spec sheet for the SK hynix H27U1G8F2BTR ram says, under the MEMORY CELL ARRAY section:

(2 K + 64) bytes x 64 pages x 1024 blocks

This gives 135 266 304 bytes = 129 MB (I would have expected a power of two at 128MB?). The document also mentions 1 Gbit: 1e9 bits / (8 bits / byte) = 125 000 000 bytes = 119 MB. I'm probably mixing up mebibits and megabits in a couple of places, but I think the scale is right.

https://octopart.com/datasheet/h27u1g8f2btr-bc-hynix-44687195

For the flash, page 82, section 19.2 Part name description explodes the model name (see https://www.macronix.com/Lists/Datasheet/Attachments/8627/MX25L3235E,%203V,%2032Mb,%20v1.6.pdf) The 3235E in the model name would mean 3235E: 32Mb standard type.

Googling around I find other places referring to it as 32 Mbit.

So I got the flash size wrong. As you said, it's 32Mbit and not 32 MB, so basically 4 MB.

I guess it settles this adventure! That router is even worst than I expected! :laughing: