Semi-bricked ZyXEL XGS1250-12

[hanswurstian]

I flashed my XGS1250-12 with the instructions provided in this section of the wiki: https://openwrt.org/toh/zyxel/xgs1250-12#oem_easy_installation

However the three 10GBit ports were not working so i tried to reflash the stock firmware with the following command and binary from the Zyxel Website:

sysupgrade -F -n XGS1250-12_Firmware_V1.00(ABWE.1)C0.bix

Now apart from the serial console nothing seems to work. I get the following output:

U-Boot Version V2.0.0.5 (Oct 19 2023 - 16:25:52)

Board: RTL9300 CPU:800MHz LX:175MHz DDR:600MHz
DRAM:  128 MB
SPI-F: MXIC/C22018/MMIO16-1/ModeC 1x16 MB (plr_flash_info @ 83f958e0)
Loading 65536B env. variables from offset 0xe0000
Net:   Net Initialization Skipped
No ethernet found.
RTCORE Driver Module Initialize
  IOAL init
  Hardware-profile probe  GPIO probe (unit 0): (found)
  GPIO Init
 (XGS1250_12_V2)
  Hardware-profile init
  GPIO probe (unit 0): (found)
  GPIO Init rtl9300_gpio_init had already been initialized!

  SPI init (unit 0) 
  I2C probe (unit 0)
  I2C init (unit 0)
  NIC probe (unit 0)
  Loader RTNIC Driver Module Initialize
  IOAL init
  CPU  : 800 MHz
  RAM  : 128 MB
  FLASH: 16 MB
  Model: XGS1250_12_V2
  MAC  : 70:49:A2:08:AE:4D

 0 
Enable network
RTK Driver Module Initialize
  MAC probe (unit 0)
    Chip 9302 (found)
  MAC init (unit 0)
  SMI protocol probe (unit 0)
  PHY probe (unit 0)
  Chip Construct (unit 0)
    Chip Construct
    Disable PHY Polling
    PHY Reset
    MAC Construct
    Turn Off Serdes
    Serdes Construct
    PHY Construct
    Turn On Serdes
    Mac_Polling_PHY Config
    Enable PHY Polling
    Misc
  PHY init (unit 0)
  Mgmt_dev init (unit 0) 
Please wait for PHY init-time ...

## Booting kernel from Legacy Image at 81000000 ...
   Image Name:   V1.00(ABWE.3)C0
   Created:      2022-12-02  15:27:29 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    6628673 Bytes = 6.3 MB
   Load Address: 80000000
   Entry Point:  802c10a0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[2][hal] !rtkErr: unit=0,port=24,database not init!
*** [RT_ERR] drivers/net/switch/rtk/hal/phy/phy_cust1.c:386: In function '_phy_aqr407_rtkPort_to_aqPort'
             Error Code: 0xF032

[3][hal] WARN.phy_aqr407_reg_mmd_get:2917:U0 P24 mmd 0x1E reg 0xC820 get fail f00e
[3][hal] WARN.phy_cust1_phyTemperature_get:3640:U0 P24 phy_cust1_phyTemperature_get error
[2][hal] !rtkErr: unit=0,port=25,database not init!
*** [RT_ERR] drivers/net/switch/rtk/hal/phy/phy_cust1.c:386: In function '_phy_aqr407_rtkPort_to_aqPort'
             Error Code: 0xF032

The error at the bottom repeats infinitly. Am I able to flash openwrt again via serial with tftp or kermit?

[hecatae]

Did you undo the u-boot command?

[hanswurstian]

Do you mean the following?

fw_setenv bootcmd 'rtk network on; boota'

No, i just installed the openwrt image as described. I used the latest snapshot image but then switched to 24.10.1 because of the 10GBit ports which didn't work. After that i tried to switch back to the stock image.

[hanswurstian]

After reading several wiki articles about the boot process, flashing via serial console and partition layouts, I think I have to resort to this procedure:

[OpenWrt Wiki] ZyXEL XGS1250-12

As far as I understand, uboot works fine and boots the OEM kernel, which is somehow broken. I can access the Zyxel commands, but there is no possibility to flash anything from there. As mentioned in the "Debricking" section, it should be possible to reach a debug mode by modifying the BIOS and reflashing an image.

Can someone elaborate on the uboot commands? I don't really get what the meaning of "boota" and "bootu"

[janh]

Which hardware revision is your switch? The manual describes how to find the revision on the label: https://download.zyxel.com/XGS1250-12/user_guide/XGS1250-12_V2.00_Ed2.pdf#page=9

Revision B1 uses different PHYs, and the SMI addresses for them are also different.

OpenWrt does not support this revision yet. There is some more information in the RTL838x switch topic.

For stock firmware, you need to use version 2.

[hanswurstian]

Thanks for your hint. It is indeed Rev. B1. I guess this explains why the ports were not working with openwrt in the first place. Then I flashed the wrong stock image (version 1 instead of 2), which led to the broken setup.

Do you know if there's another way of recovering the switch apart from the one in the debricking section?

[janh]

If the wiki is correct, and there is really no way to access the U-Boot console on this device, then you are probably out of luck and need a flash programmer.

Other devices from this series allow accessing the console by pressing Esc (at least the XGS1010-12 which I have does). But the prompt to do so is missing in your boot log. So this doesn't look good.

[hanswurstian]

I tried some keys and key combinations, but it just starts booting the kernel. I ordered the flash programmer. Is there any chance that v2 of this switch will be supported by openwrt? The topic you sent shows that two chips are diffrent with version 2, which i can confirm. Here are two pictures:

As far as i understand there is only a driver for the rtl8261n but not rtl8261be. There are no datasheets publicly available for this chip. Is there something that can be done or is it just wait and hope until something gets released?

[janh]

Maybe @antanas has some more information. But from the recent posts in the RTL838x topic, it looks like they are also stuck because of the missing PHY driver currently.

[antanas]

For 1G ports you can try this https://github.com/openwrt/openwrt/pull/18362
To get multi-ports working I'd like to know the PHY ID of it

[hanswurstian]

Hi again. I was away for some days but now I'm back and i have a CH341A flash programmer. I was able to read the content of the bios which is a MX25L12833FM2I-10G... This chip also seems to be a different one than the one on the V1 board. Here's an Image:

After reading the flash two times, I compared the md5 sums which were identical. Then i changed the boota entries to bootu in the following sections:

The system however just keeps booting the kernel anyways. Have I done something wrong or isn't this working? I also compared the md5 sum of the modified binary and the flashed one, which was fine. In the binary there's something mentioned about bootm.

[hanswurstian]

I was able to solve the problem in a very messy way. I took the backup that I had previously created and overwrote the firmware that starts at address 0x300000 with FF using a hex editor. Then I copied the official Zyxel firmware there.
After flashing, the switch started without any problems. All ports work and the device is accessible via the web interface.
It might be useful to point out in the wiki that bootu does not work with version 2 and that this is a way to reset the switch to its original state.