Fixing a Zyxel GS1200-8HP Switch
I recently got a Zyxel GS1200-8HP switch that seemed to be stuck in a bootloop. It was located in a room that wasn’t heated during winter time and therefore there might be condensed water issues or whatever. But I was interested if I could fix the bootloop.
So I opened up the device and found a 4 pin connector.
I followed its traces and came up with the following 3.3V FTDI serial interface pinout:
Board FTDI Adapter +WJ1+ |GND| - |TXD| RXD |RXD| TXD |GND| GND +---+
Here is a picture showing the orientation:
Now afterwards I needed the correct baudrate to communicate with the device which is: 38400 baud, 8 data bits, 1 stop bit, no parity
When connecting a terminal program to it, it showed me the following:
-------------- GS608A Firmware ------------- ------ Press "f" into firmware update ------ ------- Press other key into boot up ------- == MAC Calculate Correct == Boot Up After 3s == Boot Up After 2s == Boot Up After 1s ----------------GS608A Start------------------ CMD> Pressed 6s !!!
So it seems that the REST-Switch triggered. Out of curiousity, I pressed “f” for firmware update. I suggest you to not do it,because it immediately starts erasing the firmware and then asks for the new one:
== Upgrade GS608A App Now == Erase Bank(0) ~ Bank(30)
Luckily, I was able to find out how to reflash it
Basically you need to do an XMODEM Transfer, i.e. via Tera Term program with 1K Blocksize activated (check the checkbox in the file open dialog).
Now I first suspected the RESET-button, but the button was OK. It is basically just a simple circuit that drives the Line LO that is usually tied high via a standard debouncing circuit:
When measuing, I measured that it was always LO, so maybe the capacitor became faulty and tied the line to GND or whatever.
I measured that the RESET line was connected to P3.3 or the IP210W CPU.
So instead of messing around with electronics, I took the easiest approach and simpy patched the firmware to ignore Reset. In the firmware, there is:
ROM:1A8B1 jnb P3.3, code_A8B7 ; Port 3 ROM:1A8B4 ljmp ROM_1A944
jnb means “Jump if port is not set”, so I NOPed out the Jump and replaced 30 B3 03 with 00 00 00 and reflashed the firmware. And really, the reset loop went away and the switch didn’t restart all the time anymore.
When testing the switch, I found out that the upper non-PoE port group (5-8) was faulty, the link light of port 8 stays lit all the time. I guess that the PHY dricing this port group got damaged. But the PoE Ports 1-4 work fine without issues, so at least I have a working 4-Port PoE-Switch now and don’t have to spend money on a PoE switch and it was a very easy fix.
Let’s see how long it keeps working.
System programmer