Zyxel gs1900-8hpv2 firmware bricked my device

nokoru · April 13, 2022, 2:42am

I am trying to understand what I did wrong that seems to have bricked my device.
Here is some context to what I was trying to do. Initially, I had wanted to install the stable release firmware for OpenWrt 21.02.2 onto my device. However, from my understanding, due to some firmware trailer mismatch issue, the OEM firmware had prevented the installation. I had to install a snapshot instead which fortunately worked. However, I realised that the snapshot firmware did not provide enough free flash memory for me to install what I need. Hence, I thought I could try "upgrading" to the stable release now that the trailer mismatch issue is no longer there (scp the squashfs-sysupgrade file and do a sysupgrade -v -n <file> via ssh). However, once that is done, I can no longer access the device via the IP 192.168.1.1. I can't even ping it. What did I do wrong? Was it due to using mismatching set of initramfs-kernel and squashfs-sysupgrade files? (snapshot initramfs-kernel with stable squashfs-sysupgrade)

slh · April 13, 2022, 2:48am

21.02.x should be fine for th gs1900-8hpv2, so I wouldn't expect issues with that.

What would be more likely, would be trying to write to sysupgrade image to the wrong flash slot (OpenWrt currently only boots from the primary slot, the initramfs image however could boot from either). The only way to be sure is connecting a 3.3V based usb2serial adapter now, which should also easily allow recovering the device.

nokoru · April 13, 2022, 2:55am

By flash slot are you referring to the primary/secondary partition mentioned in the OEM installation steps? I do not think this is the issue as I had the snapshot firmware running fine. In fact, what was not mentioned in my initial post is that I had successfully done sysupgrade from one snapshot release to another (uploaded at a later date) via the same method (scp the squashfs-sysupgrade file and do a sysupgrade -v -n <file> via ssh).

The only way to be sure is connecting a 3.3V based usb2serial adapter now

I do not see any port aside from rj45 on the device. Do I need to take apart the casing?

slh · April 13, 2022, 2:59am

Look at the cooling vents of the right side, the 4-pin header should be accessible from there (without opening the device).

github.com/openwrt/openwrt

realtek: add support for ZyXEL GS1900-8HP v1 and v2

committed 01:32PM - 08 Jan 21 UTC

+40 -0

The ZyXEL GS1900-8HP is an 8 port gigabit switch with PoE+ support. There are tw…o versions on the market (v1 & v2) which share similar specs (same flash size and flash layout, same RAM size, same PoE+ power envelope) but have a different case and board layout that they each share with other GS1900 siblings. The v1 seems to share its PCB and case with non-PoE GS1900-8; as such, adding support for the GS1900-8 would probably be trivial. The v2 seems to share its casing and platform with its already supported bigger brother, the GS1900-10HP - its board looks the same, except for two holes where the GS1900-10 has its SFP ports. Like their 10 port sibling, both devices have a dual firmware layout. Both GS1900-8HP boards have the same 70W PoE+ power budget. In order to manipulate the PoE+, one needs the rtl83xx-poe package [1]. After careful consideration it was decided to go with separate images for each version. Specifications (v1) ------------------- * SoC: Realtek RTL8380M 500 MHz MIPS 4KEc * Flash: Macronix MX25L12835F 16 MiB * RAM: Nanya NT5TU128M8HE-AC 128 MiB DDR2 SDRAM * Ethernet: 8x 10/100/1000 Mbit * PoE+: Broadcom BCM59111KMLG (IEEE 802.3at-2009 compliant, 2x) * UART: 1 serial header with populated standard pin connector on the left side of the PCB, towards the bottom. Pins are labeled: + VCC (3.3V) + TX + RX + GND Specifications (v2) ------------------- * SoC: Realtek RTL8380M 500 MHz MIPS 4KEc * Flash: Macronix MX25L12835F 16 MiB * RAM: Samsung K4B1G0846G 128 MiB DDR3 SDRAM * Ethernet: 8x 10/100/1000 Mbit * PoE+: Broadcom BCM59121B0KMLG (IEEE 802.3at-2009 compliant) * UART: 1 angled serial header with populated standard pin connector accessible from outside through the ventilation slits on the side. Pins from top to bottom are clearly marked on the PCB: + VCC (3.3V) + TX + RX + GND Serial connection parameters for both devices: 115200 8N1. Installation ------------ Instructions are identical to those for the GS1900-10HP and apply both to the GS1900-8HP v1 and v2 as well. * Configure your client with a static 192.168.1.x IP (e.g. 192.168.1.10). * Set up a TFTP server on your client and make it serve the initramfs image. * Connect serial, power up the switch, interrupt U-boot by hitting the space bar, and enable the network: > rtk network on * Since the GS1900-10HP is a dual-partition device, you want to keep the OEM firmware on the backup partition for the time being. OpenWrt can only boot off the first partition anyway (hardcoded in the DTS). To make sure we are manipulating the first partition, issue the following commands: > setsys bootpartition 0 > savesys * Download the image onto the device and boot from it: > tftpboot 0x84f00000 192.168.1.10:openwrt-realtek-generic-zyxel_gs1900-8hp-v{1,2}-initramfs-kernel.bin > bootm * Once OpenWrt has booted, scp the sysupgrade image to /tmp and flash it: > sysupgrade /tmp//tmp/openwrt-realtek-generic-zyxel_gs1900-8hp-v{1,2}-squashfs-sysupgrade.bin Signed-off-by: Stijn Segers <foss@volatilesystems.org> [merge PoE case, keep device definitions separate, change all those hashes in the commit message to something else so they don't get removed when changing the commit ...] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>

Similar to the design of the gs1900-10hp:

nokoru · April 13, 2022, 3:15am

Wow they are well hidden. What does the hard reset button do? I do not possess such a serial connector, so if I can use the reset button to eventually re-flash a working firmware that would be great.

slh · April 13, 2022, 3:17am

You'll need one, they usually start selling around 5 EUR/ USD with (quick) local shipping or ~1.50 EUR/ USD taking the scenic route from China.

slh · April 13, 2022, 3:34am

Btw., are you sure that you're trying to connect to your switch correctly?

21.03.x only accepts access from the management VLAN on port1 and from VID 100, follow these steps for details:

Still, get a correct(!) usb2serial adapter (you should have had it on your desk yesterday), don't destroy your ~130 EUR device by trying to save 5 bucks on the required tools.

nokoru · April 13, 2022, 6:00am

Btw., are you sure that you're trying to connect to your switch correctly?

I thought I was but I guess I was wrong. I am using a managed switch to do this since VLAN tagging on my PC's ethernet adaptor did not seem to work. Turns out my managed switch was configured incorrectly, leading to the ports I was using to be native VLAN 1 instead of 100.
I am able to access my device now. I guess the snapshot release was configured to not have this strange restriction.
Thanks!

system · April 23, 2022, 6:00am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.