Hi,
Recently got a Zyxel XGS1250 and accidentally uploaded the sysupdate image instead of the initramfs when following the easy OEM update guide: https://openwrt.org/toh/zyxel/xgs1250-12
Now the device is in a boot loop, as I can judge when connecting via serial. Any changes to debrick this device?
Thank you any hold on this topic.
Best
There's a web recovery listed on the git commit that's missing from the wiki:
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=5b8b382df9a960d880df14b79213b7f705aa9e90
Web recovery
The XGS1250-12 has a handy web recovery that will load when U-boot does
not find a bootable kernel. In case you would like to trigger the web
recovery manually, partially overwrite the firmware partition with some
zeroes:dd if=/dev/zero of=/dev/mtd5 bs=1M count=2
If you have serial connected you'll see U-boot will start the web recovery
and print it's listening on 192.168.1.1, but by default it seems to be on
the OEM default IP for the switch - 192.168.1.3. The web recovery only
listens on HTTP (80) and not on 443 (HTTPS) unlike the web UI.
Thank you for the quick reply. I do not know how I could get there. It is loading openwrt partly, but cannot find the root partition and reboots by itself. I guess, I would need something to stop the loading of OpenWrt or stopping openwrt from rebooting.
U-Boot Version V2.0.0.5 (Oct 19 2023 - 16:25:52)
Board: RTL9300 CPU:800MHz LX:175MHz DDR:600MHz
DRAM: 128 MB
SPI-F: MXIC/C22018/MMIO16-1/ModeC 1x16 MB (plr_flash_info @ 83f958e0)
Loading 65536B env. variables from offset 0xe0000
Net: Net Initialization Skipped
No ethernet found.
RTCORE Driver Module Initialize
IOAL init
Hardware-profile probe GPIO probe (unit 0): (found)
GPIO Init
(XGS1250_12_V2)
Hardware-profile init
GPIO probe (unit 0): (found)
GPIO Init rtl9300_gpio_init had already been initialized!
SPI init (unit 0)
I2C probe (unit 0)
I2C init (unit 0)
NIC probe (unit 0)
Loader RTNIC Driver Module Initialize
IOAL init
CPU : 800 MHz
RAM : 128 MB
FLASH: 16 MB
Model: XGS1250_12_V2
MAC : F4:4D:5C:9B:6D:F2
0
Enable network
RTK Driver Module Initialize
MAC probe (unit 0)
Chip 9302 (found)
MAC init (unit 0)
SMI protocol probe (unit 0)
PHY probe (unit 0)
Chip Construct (unit 0)
Chip Construct
Disable PHY Polling
PHY Reset
MAC Construct
Turn Off Serdes
Serdes Construct
PHY Construct
Turn On Serdes
Mac_Polling_PHY Config
Enable PHY Polling
Misc
PHY init (unit 0)
Mgmt_dev init (unit 0)
Please wait for PHY init-time ...
## Booting kernel from Legacy Image at 81000000 ...
Image Name: MIPS OpenWrt Linux-5.15.167
Created: 2024-09-23 12:34:46 UTC
Image Type: MIPS Linux Kernel Image (gzip compressed)
Data Size: 3214601 Bytes = 3.1 MB
Load Address: 80100000
Entry Point: 80100000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 5.15.167 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r24106-10cc5fcd00) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Mon Sep 23 12:34:46 2024
[ 0.000000] RTL838X model is 0
[ 0.000000] RTL839X model is 0
[ 0.000000] RTL93XX model is 93021001
[ 0.000000] SoC Type: RTL9302B
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019555 (MIPS 34Kc)
[ 0.000000] MIPS: machine is Zyxel XGS1250-12 Switch
[ 0.000000] earlycon: ns16550a0 at MMIO 0x18002000 (options '115200n8')
[ 0.000000] printk: bootconsole [ns16550a0] enabled
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Using appended Device Tree.
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] Kernel command line: earlycon
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=00048810
[ 0.000000] Readback ErrCtl register=00048810
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 120756K/131072K available (6177K kernel code, 619K rwdata, 764K rodata, 1200K init, 218K bss, 10316K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 256
[ 0.000000] Failed to get CPU clock: -2
[ 0.000000] CPU frequency from device tree: 800MHz
[ 0.000000] clocksource: realtek_otto_timer: mask: 0xfffffff max_cycles: 0xfffffff, max_idle_ns: 38225208801 ns
[ 0.000001] sched_clock: 28 bits at 3125kHz, resolution 320ns, wraps every 42949672800ns
[ 0.008986] Calibrating delay loop... 531.66 BogoMIPS (lpj=2658304)
[ 0.065685] pid_max: default: 32768 minimum: 301
[ 0.071711] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.079737] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.095945] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.106730] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.114414] pinctrl core: initialized pinctrl subsystem
[ 0.121639] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.142167] clocksource: Switched to clocksource realtek_otto_timer
[ 0.150712] NET: Registered PF_INET protocol family
[ 0.156343] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.165276] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.174590] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.183079] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.191444] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.199168] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.206289] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.213513] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.221584] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.232076] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 0.245493] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.251874] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.265075] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[ 0.275300] pinctrl-single 1b00cc00.pinmux: 32 pins, size 4
[ 0.282962] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[ 0.293188] printk: console [ttyS0] disabled
[ 0.297928] 18002000.uart: ttyS0 at MMIO 0x18002000 (irq = 30, base_baud = 10937500) is a 16550A
[ 0.307601] printk: console [ttyS0] enabled
[ 0.307601] printk: console [ttyS0] enabled
[ 0.316931] printk: bootconsole [early0] disabled
[ 0.316931] printk: bootconsole [early0] disabled
[ 0.327403] printk: bootconsole [ns16550a0] disabled
[ 0.327403] printk: bootconsole [ns16550a0] disabled
[ 0.385283] brd: module loaded
[ 0.395315] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[ 0.401145] 7 fixed-partitions partitions found on MTD device spi0.0
[ 0.408376] OF: Bad cell count for /soc/spi@1200/flash@0/partitions
[ 0.415445] OF: Bad cell count for /soc/spi@1200/flash@0/partitions
[ 0.422718] Creating 7 MTD partitions on "spi0.0":
[ 0.428073] 0x000000000000-0x0000000e0000 : "u-boot"
[ 0.436511] 0x0000000e0000-0x0000000f0000 : "u-boot-env"
[ 0.443784] 0x0000000f0000-0x000000100000 : "u-boot-env2"
[ 0.452920] 0x000000100000-0x000000200000 : "jffs"
[ 0.459520] 0x000000200000-0x000000300000 : "jffs2"
[ 0.468071] 0x000000300000-0x000000fe0000 : "firmware"
[ 0.477722] 2 uimage-fw partitions found on MTD device firmware
[ 0.484389] Creating 2 MTD partitions on "firmware":
[ 0.489915] 0x000000000000-0x000000710000 : "kernel"
[ 0.496846] 0x000000710000-0x000000ce0000 : "rootfs"
[ 0.505323] mtd: setting mtd7 (rootfs) as root device
[ 0.511042] mtdsplit: no squashfs found in "rootfs"
[ 0.516620] 0x000000fe0000-0x000001000000 : "log"
[ 0.533198] Probing RTL838X eth device pdev: 82097000, dev: 82097010
[ 0.559725] Found SoC ID: 9302: RTL9302B, family 9300
[ 0.565480] Using MAC 0000000000010000
[ 0.569693] set sds port 0 to 2
[ 0.573261] set sds port 24 to 6
[ 0.576856] set sds port 25 to 7
[ 0.580437] set sds port 26 to 8
[ 0.584054] set sds port 27 to 9
[ 0.588405] c45_mask: 000e0000
[ 0.655031] mdio_bus mdio-bus: MDIO device at address 24 is missing.
[ 0.668547] mdio_bus mdio-bus: MDIO device at address 25 is missing.
[ 0.682063] mdio_bus mdio-bus: MDIO device at address 26 is missing.
[ 0.695672] REALTEK RTL9300 SERDES mdio-bus:1b: Detected internal RTL9300 Serdes
[ 0.703993] rtl9300_configure_serdes: Port 27, SerDes is 9
[ 0.714127] rtl9300_configure_serdes CMU BAND is 16
[ 0.719552] rtl9300_sds_rst 31
[ 0.742937] rtl9300_configure_serdes PATCHING SerDes 9
[ 0.749686] rtl9300_phy_enable_10g_1g 1gbit phy: 00001140
[ 0.755706] rtl9300_phy_enable_10g_1g 1gbit phy enabled: 00001140
[ 0.763504] rtl9300_phy_enable_10g_1g 10gbit phy: 00002040
[ 0.769607] rtl9300_phy_enable_10g_1g 10gbit phy after: 00002040
[ 0.777303] rtl9300_phy_enable_10g_1g set medium: 00000002
[ 0.783432] rtl9300_phy_enable_10g_1g set medium after: 00000002
[ 0.810087] rtl9300_configure_serdes: Configuring RTL9300 SERDES 9, mode 1a
[ 0.819850] rtl9300_serdes_mac_link_config: registers before 00000000 00001403
[ 0.829909] rtl9300_serdes_mac_link_config: registers after 00000000 00001403
[ 0.857848] rtl9300_force_sds_mode: SDS: 9, mode 0
[ 0.863207] rtl9300_force_sds_mode --------------------- serdes 9 forcing to 1f ...
[ 0.874741] rtl9300_force_sds_mode: SDS: 9, mode 27
[ 0.880164] rtl9300_force_sds_mode --------------------- serdes 9 forcing to 1a ...
[ 5.599602] rtl9300_force_sds_mode --------------------- serdes 9 forced to 1a DONE
[ 5.608159] start_1.1.1 initial value for sds 9
[ 5.641192] end_1.1.1 --
[ 5.644037] start_1.1.2 Load DFE init. value
[ 5.649774] end_1.1.2
[ 5.652314] start_1.1.3 disable LEQ training,enable DFE clock
[ 5.664723] end_1.1.3 --
[ 5.667543] start_1.1.4 offset cali setting
[ 5.673215] end_1.1.4
[ 5.675739] start_1.1.5 LEQ and DFE setting
[ 5.687385] end_1.1.5
[ 5.696912] start_1.2.1 ForegroundOffsetCal_Manual
[ 5.704262] end_1.2.1
[ 5.712266] start_1.2.3 Foreground Calibration
[ 5.725727] rtl9300_do_rx_calibration_2_3: fgcal_gray: 1, fgcal_binary 3
[ 5.734202] rtl9300_do_rx_calibration_2_3: end_1.2.3
[ 5.739716] start_1.4.1
[ 5.961348] end_1.4.1
[ 5.964096] start_1.4.2
[ 5.972624] vth_set_bin = 1
[ 5.975339] vth_set_bin = 0
[ 5.979434] Vth Maunal = 1
[ 6.091368] Tap0 Sign : +
[ 6.094402] tap0_coef_bin = 1
[ 6.098312] tap0 manual = 1
[ 6.104624] end_1.4.2
[ 6.107734] start_1.5.2
[ 6.184150] end_1.5.2
[ 6.271895] i2c_dev: i2c /dev entries driver
[ 6.279403] rtl9300_i2c_probe probing I2C adapter
[ 6.284732] i2c-rtl9300 1b00036c.i2c-rtl9300: SCL speed 100000, mode is 0
[ 6.292330] rtl9300_i2c_probe scl_num 0
[ 6.296592] rtl9300_i2c_probe sda_num 1
[ 6.304192] NET: Registered PF_INET6 protocol family
[ 6.323181] Segment Routing with IPv6
[ 6.327365] In-situ OAM (IOAM) with IPv6
[ 6.331853] NET: Registered PF_PACKET protocol family
[ 6.337688] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[ 6.352752] 8021q: 802.1Q VLAN Support v1.8
[ 6.358943] sfp sfp-p12: Host maximum power 1.0W
[ 6.422319] REALTEK RTL9300 SERDES rtl838x slave mii-0:1b: Detected internal RTL9300 Serdes
[ 6.431634] REALTEK RTL9300 SERDES rtl838x slave mii-0:1b: No DT node.
[ 6.438942] REALTEK RTL9300 SERDES: probe of rtl838x slave mii-0:1b failed with error -22
[ 6.454390] REALTEK RTL9300 SERDES rtl838x slave mii-0:3f: Detected internal RTL9300 Serdes
[ 6.463765] REALTEK RTL9300 SERDES rtl838x slave mii-0:3f: No DT node.
[ 6.471029] REALTEK RTL9300 SERDES: probe of rtl838x slave mii-0:3f failed with error -22
[ 6.481798] rtl93xx_setup called
[ 6.485504] In rtl83xx_vlan_setup
[ 6.489187] In rtl930x_vlan_profile_setup
[ 6.493684] In rtl930x_vlan_profile_setup
[ 6.498143] UNKNOWN_MC_PMASK: 000000001fffffff
[ 6.503106] VLAN 0: L2 learn: 0; Unknown MC PMasks: L2 1fffffff, IPv4 1fffffff, IPv6: 1fffffff
[ 6.503124] Routing enabled: IPv4 UC y, IPv6 UC y, IPv4 MC y, IPv6 MC y
[ 6.520260] Bridge enabled: IPv4 MC n, IPv6 MC n,
[ 6.525701] VLAN profile 0: raw 00033000 00000000 1fffffff 1fffffff 1fffffff
[ 7.612172] rtl83xx_enable_phy_polling: f0000ff
[ 7.618099] rtl930x_pie_init
[ 7.621508] rtl930x_led_init called
[ 7.625527] rtl930x_led_init bb00cc00: 01052659
[ 7.630568] rtl930x_led_init bb00cc04: aaaa5555
[ 7.635629] rtl930x_led_init bb00cc08: 007faaaa
[ 7.640670] rtl930x_led_init bb00cc0c: 00000000
[ 7.645733] rtl930x_led_init bb00cc10: 00000000
[ 7.650772] rtl930x_led_init bb00cc14: 0000ffff
[ 7.655831] rtl930x_led_init bb00cc18: 0a200a01
[ 7.660866] rtl930x_led_init bb00cc1c: 0a0b0a28
[ 7.665921] rtl930x_led_init bb00cc20: 0a820a0b
[ 7.670960] rtl930x_led_init bb00cc24: 0000ffff
[ 7.676015] rtl930x_led_init bb00cc28: 0a200b80
[ 7.681053] rtl930x_led_init bb00cc2c: 00000000
[ 7.686108] rtl930x_led_init bb00cc30: 00950000
[ 7.691148] rtl930x_led_init bb00cc34: 00000000
[ 7.696203] rtl930x_led_init bb00cc38: 00950000
[ 7.701241] rtl930x_led_init bb00cc3c: 0f0000ff
[ 7.706297] rtl930x_led_init bb00cc40: 0f0000ff
[ 7.711334] rtl930x_led_init bb00cc44: 0f0000ff
[ 7.716390] rtl930x_led_init bb00cc48: 00000000
[ 7.721429] rtl930x_led_init bb00cc4c: 00000000
[ 7.726484] rtl930x_led_init bb00cc50: 00000000
[ 7.731522] rtl930x_led_init bb00cc54: 00000000
[ 7.736577] rtl930x_led_init bb00cc58: 00000000
[ 7.741615] rtl930x_led_init bb00cc5c: 00000000
[ 7.746965] rtl83xx-switch switch@1b000000: configuring for fixed/internal link mode
[ 7.755663] rtl93xx_phylink_mac_config port 28, mode 1, phy-mode: internal, speed 10000, link 0
[ 7.765587] rtl83xx-switch switch@1b000000 lan1 (uninitialized): PHY [mdio-bus:00] driver [REALTEK RTL8218D] (irq=POLL)
[ 7.779017] rtl83xx-switch switch@1b000000 lan2 (uninitialized): PHY [mdio-bus:01] driver [REALTEK RTL8218D] (irq=POLL)
[ 7.792447] rtl83xx-switch switch@1b000000 lan3 (uninitialized): PHY [mdio-bus:02] driver [REALTEK RTL8218D] (irq=POLL)
[ 7.805773] rtl83xx-switch switch@1b000000 lan4 (uninitialized): PHY [mdio-bus:03] driver [REALTEK RTL8218D] (irq=POLL)
[ 7.819099] rtl83xx-switch switch@1b000000 lan5 (uninitialized): PHY [mdio-bus:04] driver [REALTEK RTL8218D] (irq=POLL)
[ 7.832632] rtl83xx-switch switch@1b000000 lan6 (uninitialized): PHY [mdio-bus:05] driver [REALTEK RTL8218D] (irq=POLL)
[ 7.846062] rtl83xx-switch switch@1b000000 lan7 (uninitialized): PHY [mdio-bus:06] driver [REALTEK RTL8218D] (irq=POLL)
[ 7.859440] rtl83xx-switch switch@1b000000 lan8 (uninitialized): PHY [mdio-bus:07] driver [REALTEK RTL8218D] (irq=POLL)
[ 7.872935] rtl83xx-switch switch@1b000000 lan9 (uninitialized): no phy at 24
[ 7.880897] rtl83xx-switch switch@1b000000 lan9 (uninitialized): failed to connect to PHY: -ENODEV
[ 7.890927] rtl83xx-switch switch@1b000000 lan9 (uninitialized): error -19 setting up PHY for tree 0, switch 0, port 24
[ 7.903174] rtl83xx-switch switch@1b000000 lan10 (uninitialized): no phy at 25
[ 7.911230] rtl83xx-switch switch@1b000000 lan10 (uninitialized): failed to connect to PHY: -ENODEV
[ 7.921349] rtl83xx-switch switch@1b000000 lan10 (uninitialized): error -19 setting up PHY for tree 0, switch 0, port 25
[ 7.933635] rtl83xx-switch switch@1b000000 lan11 (uninitialized): no phy at 26
[ 7.941687] rtl83xx-switch switch@1b000000 lan11 (uninitialized): failed to connect to PHY: -ENODEV
[ 7.951805] rtl83xx-switch switch@1b000000 lan11 (uninitialized): error -19 setting up PHY for tree 0, switch 0, port 26
[ 7.965195] DSA: tree 0 setup
[ 7.968555] LINK state irq: 23
[ 7.971977] In rtl83xx_setup_qos
[ 7.975691] L3_IPUC_ROUTE_CTRL 00002000, IPMC_ROUTE 0000077e, IP6UC_ROUTE 00014400, IP6MC_ROUTE 0001db7e
[ 7.986278] L3_IPUC_ROUTE_CTRL 00002001, IPMC_ROUTE 00000501, IP6UC_ROUTE 00014581, IP6MC_ROUTE 00012881
[ 7.996848] L3_IP_ROUTE_CTRL 0000013f
[ 8.001026] rtl930x_dbgfs_init called
[ 8.007738] rtl93xx_phylink_mac_config port 28, mode 1, phy-mode: internal, speed 10000, link 1
[ 8.017514] rtl83xx-switch switch@1b000000: Link is Up - 10Gbps/Full - flow control off
[ 8.031911] rtl83xx_fib_event_work_do: FIB4 default rule failed
[ 8.038584] rtl83xx_fib_event_work_do: FIB4 default rule failed
[ 8.045864] clk: Disabling unused clocks
[ 8.052249] List of all partitions:
[ 8.056157] 0100 4096 ram0
[ 8.056169] (driver?)
[ 8.062995] 0101 4096 ram1
[ 8.063010] (driver?)
[ 8.069779] 0102 4096 ram2
[ 8.069786] (driver?)
[ 8.076594] 0103 4096 ram3
[ 8.076606] (driver?)
[ 8.083416] 0104 4096 ram4
[ 8.083431] (driver?)
[ 8.090204] 0105 4096 ram5
[ 8.090212] (driver?)
[ 8.097017] 0106 4096 ram6
[ 8.097029] (driver?)
[ 8.103831] 0107 4096 ram7
[ 8.103843] (driver?)
[ 8.110610] 0108 4096 ram8
[ 8.110618] (driver?)
[ 8.117424] 0109 4096 ram9
[ 8.117436] (driver?)
[ 8.124237] 010a 4096 ram10
[ 8.124250] (driver?)
[ 8.131113] 010b 4096 ram11
[ 8.131121] (driver?)
[ 8.138024] 010c 4096 ram12
[ 8.138036] (driver?)
[ 8.144932] 010d 4096 ram13
[ 8.144944] (driver?)
[ 8.151810] 010e 4096 ram14
[ 8.151818] (driver?)
[ 8.158720] 010f 4096 ram15
[ 8.158733] (driver?)
[ 8.165629] 1f00 896 mtdblock0
[ 8.165641] (driver?)
[ 8.172925] 1f01 64 mtdblock1
[ 8.172937] (driver?)
[ 8.180186] 1f02 64 mtdblock2
[ 8.180194] (driver?)
[ 8.187484] 1f03 1024 mtdblock3
[ 8.187497] (driver?)
[ 8.194788] 1f04 1024 mtdblock4
[ 8.194802] (driver?)
[ 8.202059] 1f05 13184 mtdblock5
[ 8.202067] (driver?)
[ 8.209356] 1f06 7232 mtdblock6
[ 8.209368] (driver?)
[ 8.216659] 1f07 5952 mtdblock7
[ 8.216672] (driver?)
[ 8.223956] 1f08 128 mtdblock8
[ 8.223968] (driver?)
[ 8.231215] No filesystem could mount root, tried:
[ 8.231219] squashfs
[ 8.236660]
[ 8.240827] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,7)
[ 8.250107] Rebooting in 1 seconds..
the link @hecatae posted says you're supposed to be able to interrupt the boot loader, start there.
Thank you, yes I found this part. The thing is only that Uboot does find a bootimage, OpenWRT, but OpenWrt does not boot correctly. I do not find anything mentioning for my case here. e.g. entering the webrecovery, with openwrt partly booting. If Openwrt would let me "in", I can zero out the mtd5 as has been mention.
can you press space or escape or something repeatedly while uboot is loading?
we want you to access it, to do a printenv for us...
Thank you. Yes I tried to typical keycodes: ESC, DEL, F1, SPACE, CTRL+C. Not sure I am missing some? Nothing has stopped the boot process.
Thank you for your reply. I certainly would also like to do so. But I cannot get more than the current boot log I have posted. Have not found a way to interrupt the boot process to do anything myself.
ok, you could try booting holding the reset button down
Thank you. Also tried again now, seems not to do anything, at least does not interrupt the boot process.
when I reread the git commit, it seems serial's available once openwrt initramfs have booted, you're not really talking to u-boot.
Yes, I also think something like this. The first line printed from the boot log says U-Boot, but it seems I only have access, after the initramfs is loaded correctly. I would need something to break to boot of OpenWRT and go the TFTP path.
someone else fixed their xgs1250 with a ch341a programmer:
looks similar to your predicament:
your issue is because you have not passed the boot command rtk network on
you're not the only one who has done this:
I think I'll attach warnings on the wiki
it does read like uboot is not directly accessible, which is typical of most manufacturers who are trying to prevent the customer from owning their device.
Yes, Thank you. This look indeed like the right direction. I will get my hands on a ch341a. It is never bad to get hands-on more toys to play with. Will report back, if is solved my problems.
Hi,
wanted to share, that I had recovered the switch. Thanks to everyone for pointing me into the right direction. As the information required for this is spread over several topics or even non existent, I wrote some instructions for anyone in similar situations. Please feel free to copy them over into the wiki.
If you should find yourself in the situation, where the devices does not boot properly or just keeps re-booting in a loop due to kernel errors, the switch can be recovered changing the BIOS externally. A common mistake that can lead to those problems, is using the wrong image during the OEM or RAM installation process explained above. Both of them required to initially use the initramfs to make a first boot into OpenWRT and then write the system with the sysupgrade image.
Recovering the switch now required more efforts, as it requires to open the case, find the BIOS chip, read the chip and write back a modified version:
flashrom --programmer ch341a_spi -r backup1.bin -c "MX25L12805D" This takes a few minutesflashrom --programmer ch341a_spi -r backup2.bin -c "MX25L12805D"md5sum backup1.bin, md5sum backup2.bin and compare the two hash sums. If those two do not match, something went wrong. Better start over again.bootcmd=boota. Depending on what went wrong on your switch, you might directly search for this directly, but if you have follow this some instructions from this website, you might find something like rtk network on; before the "boota" instruction.flashrom --programmer ch341a_spi -w modified.bin -c "MX25L12805D"Thrown it into debricking:
https://openwrt.org/toh/zyxel/xgs1250-12#debricking
I'll tidy up.
whoa! that's a huge wall of text 
yes needs some images instead of a lot of the words, currently stripping out redundant text, all those days being MoDaCo newsteam are coming in handy