Dear OpenWrt folks,
On the Allnet ALL-SG8208M is it possible to use a flash emulator without desoldering the SPI flash ROM chip? I have access to a DediProg EM100Pro, and wonder if that could be used. (I guess one needs the schematics and the knowledge how to read them to determine that.)
Kind regards,
Paul
You can use a CH341A programmer with a SOIC8 clamp to manipulate the flash directly? With that you can manipulate most NOR flash chips I believe (my experience ranges from a TL-WR1043ND v2 to a ZyXEL XGS1250-12, so quite a few years between those). The latter is based on a Realtek SoC just like yours.
Thank you for your reply. I meant a flash ROM emulator though, so I do not need to “touch” (modify) the soldered on flash ROM chip.
I don't quite get this insistence on a "flash emulator" - spi nor is cheap and readily available (and not that fragile or prone to being written to death either). In order to use your flash emulator, you will have to desolder the original spi-nor flash anyways, at which point you can just as easily solder on a socket instead or a pin header, which allows you easy removal of the flash as needed. If you want to play it extra safe, don't even touch the original flash (that's a little paranoid, as long as you have a full backup, but hey a replacement costs around a buck) and exclusively work on a compatible flash chip.
Maybe I'm blind, but I don't see what an emulator would give you in addition. The bootloader side should be covered within relatively few iterations, and once settled, serial console access and tftpboot from u-boot would be your 'normal' mode of operations, leaving direct spi-nor access for disastrous recovery (it will happen, but not daily, rarely enough for a socketed flash to be more than good enough).
I don't quite get this insistence on a "flash emulator" - spi nor is cheap and readily available (and not that fragile or prone to being written to death either).
Once it works it’s really fast and easy to use.
In order to use your flash emulator, you will have to desolder the original spi-nor flash anyways, …
No, on some boards, it’s possible to mount the clip (or solder wires), and to disable the soldered on flash ROM chip, and so the one (like emulator) connected to the clip is used instead.
Does somebody have the schematics? icon from #coreboot@irc.libera.chat wrote, that I need to find out if the chip has a /HOLD pin, so it can be overridden. Also, that pin needs a weak pull-up on the board. If it has a strong pull-up or is directly connected to VCC, it cannot be overridden.
The board only has an unpopulated serial port pad(?), so soldering is also needed to use the serial port.
I would expect it to be pre-populated, but even if not - three through-hole 2.54mm pins would be much easier to solder than SMD/ SOIC-8.
Btw., I still don't get what you're looking for here either.
The ALL-SG8208M is already fully supported
https://downloads.openwrt.org/releases/21.02.3/targets/realtek/generic/openwrt-21.02.3-realtek-generic-allnet_all-sg8208m-squashfs-sysupgrade.bin
Due to the vastly easier default network/ VLAN configuration in 22.03.x for the realtek target, I would suggest to go with the 22.03(.0-rc1 or newer) images though, https://downloads.openwrt.org/releases/22.03.0-rc1/targets/realtek/rtl838x/openwrt-22.03.0-rc1-realtek-rtl838x-allnet_all-sg8208m-squashfs-sysupgrade.bin
Installing appears to be easy
Based on the gs1900-8 (identical hardware, but slightly different bootloader/ flash partitioning), even recovery via (pre-populated) serial console should be easy:
meaning, as long as you don't clobber the bootloader (that is possible, but almost requires intent to do so), this hardware should be close to unbrickable - and even if the worst would happen (overwritten bootloader), you'd rather look at re-flashing the existing spi-nor flash chip (via the aforementioned soic-8 clamp/ ch-341, ideally in-place, at worst externally -once- after desoldering the chip), rather than doing anything complicated with a flash emulator.
So I really don't get why you want to make life complicated for yourself, given that you can (apparently) just flash OpenWrt from the OEM webinterface or recover via serial console.
Three standard philips-head screws and you're done...
https://svanheule.net/switches/all8208m
Wow, this is something new!
I can perfectly well understand (and I've done so myself plenty of times) using virtual NOR and NAND under Linux to inspect and/or modify image-dumps or for making new, flashable images, but I've never heard of anyone wanting to emulate such in hardware and connect the emulator to a physical device. Seems....kind of pointless to me.
What do people even use for this? Using an RP2040 or one of the billion STM32 MCUs as the emulator comes to mind, but do premade solutions exist?
EDIT: Oops, didn't notice that link to Dediprog at first. Never seen such before.
I missed the tftpboot option, and have to check that out.
I tried to flash it externally with a BeagleBone Black with BBB screwdriver image. I connected the clip and all eight pins of the flash ROM chip to the BBB. I can read the chip, but the Allnet device also gets powered by it. Should I leave some wires out?
I actually bought an all-sg8208m myself two weeks ago, you can stop u-boot's autobooting by pressing a key via serial console and then proceed as-normal (see the gs1900 examples):
U-Boot Version 1.0.0.48161 (Nov 28 2014 - 19:10:20)
Board: RTL838x CPU:500MHz LXB:200MHz MEM:300MHz
DRAM: 128 MB
SPI-F: 1x16 MB
Loading 65536B env. variables from offset 0x80000
[DBG] ### Board Probe ###
[DBG] ### Mac Driver Init ###
[DBG] ### Chip Config ###
Switch Model: NETRONIX_DEMO (Port Count: 8)
Switch Chip: RTL8382M
[DBG] PHY[0] RTL8218B : macid = 8, phy_max = 8
[DBG] ### Platform Config ###
[DBG] ### MAC Config ###
[DBG] ### Intra-Serdes Config ###
[DBG] ### PHY Config (RTL82XX) ###
**************************************************
#### RTL8218B config - MAC ID = 8 ####
Now Internal PHY
[DBG] ### Misc Config ###
Net: Net Initialization Skipped
rtl8380#0
Hit any key to stop autoboot: 3
RTL838x# # rtk network on
Enable network
Force port28 link up 1G
Please wait for PHY init-time ...
RTL838x# # tftpboot 0x84f00000 192.168.1.43:openwrt-realtek-rtl838x-allnet_all-sg8208m-initramfs-kernel.bin
Using rtl8380#0 device
TFTP from server 192.168.1.43; our IP address is 192.168.1.1
Filename 'openwrt-realtek-rtl838x-allnet_all-sg8208m-initramfs-kernel.bin'.
Load address: 0x84f00000
Loading: *
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
################
done
Bytes transferred = 6911522 (697622 hex)
RTL838x# # bootm
## Booting kernel from Legacy Image at 84f00000 ...
Image Name: 2.2.2.0
Created: 2022-10-08 9:05:03 UTC
Image Type: MIPS Linux Kernel Image (gzip compressed)
Data Size: 6911458 Bytes = 6.6 MB
Load Address: 80000000
Entry Point: 80000400
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 5.10.146 (slh@peacekeeper) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r20885-629f2de1a7) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 Sat Oct 8 09:05:03 2022
[ 0.000000] RTL838X model is 83806800
[ 0.000000] SoC Type: RTL8380
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019070 (MIPS 4KEc)
[ 0.000000] MIPS: machine is ALLNET ALL-SG8208M
[…]
and then just sysupgrade from the RAM booted image.
Horrible OEM firmware, open high-profile security issues, the interface is …, only using half of the flash and unnecessarily limiting RAM to 64 MB, but installing and using OpenWrt works nicely.
you can stop u-boot's autobooting by pressing a key via serial console
Unfortunately, that didn’t work for me last time.
I assume, I connected the USB-to-serial adapter incorrectly. I have to check that again.
Sometimes you might need to disable Hardware Flow Control. Check your terminal emulator for that.
Thank you for the hint. Unfortunately, disabling Hardware Flow Control in minicom, did not help either. The FTDI TTL-232R-3V3 works fine with the BeagleBone Black, which has a six pin header. But as written in the other thread, I think I connected them correctly, and receiving works.
What serial to USB adapter are you using?
A cheap cp2102.
It also does not work with a renkforce USB/TTL cable (PL2302HX). For some reason the TX pin seems broken. No idea how to test that though.