I want to say the S1300WP-8XGT-4S+ had a busted U-Boot. The Realtek SDK built in several cpu+phy combo configurations, but none of which had functioning network access, aka no tftpboot.
1 Like
That would be ok if a serial console (to uboot / bootloader) is available, however.
Y-modem wasn't too bad for a once off image load 
Do you have a full OEM boot log?
There's still some info missing:
- RAM size
- FLASH size
- GPIO for sys LED
- Whether there is a reset button or similar
- LED configuration for ports, inc.
- number of LEDs
- indicated LED behaviour from OEM labels (green=1gbps activity etc)
- how they are driven (rtl8231 or other)
- PHY configuration
- what PHY chips (if it's like the S1100WP-8GT then it's using 5xRTL8226/RTL8221B PHYs)
- what MDIO buses and addresses the PHYs have
Similar information would be needed for the F1100WP-4XS-4XGT
The F1100WP-4XS-4XGT is my main switch so I donāt want to mess around with it.
The S600WP-5GT-2S+_SE is in a box unused so Iām a bit more open to messing with it, but I donāt want to overwrite the flash at this point in time. If the image can be loaded from tftp or something like that, I suppose I could try that if I get serial console working on it (again, the RJ45 console port is unpopulated). I have managed to get a root shell on it in the past though thanks to Whiterat earlier in this thread, so I might be able to get some information from it that way.
Output from tech-support commands:
hasivo-switch# show tech-support board
!
------------------ Board Configuration ------------------
****************************
RTL9301-5X2P5GE_2XGE
****************************
============================
Board GPIO
============================
Device Pin Direction Default Current Purpose
------- ---- ---------- -------- -------- --------
INT 0 OUT 0 0
INT 1 OUT 0 0
INT 8 IN 0 0
INT 9 IN 0 0
INT 10 OUT 0 1
INT 11 IN 0 1
INT 12 IN 0 0
INT 14 OUT 0 1
INT 19 IN 0 0
INT 20 IN 0 0
INT 21 IN 0 1
INT 22 IN 0 1
INT 23 IN 0 1
EXT 0 IN (IN ) 0 0
EXT 1 IN (IN ) 0 0
EXT 3 IN (IN ) 0 0
EXT 4 IN (IN ) 0 0
EXT 5 IN (IN ) 0 0
EXT 6 IN (IN ) 0 0
EXT 7 IN (IN ) 0 0
EXT 8 IN (IN ) 0 0
EXT 9 IN (IN ) 0 0
EXT 12 IN (IN ) 0 0
EXT 13 IN (IN ) 0 0
EXT 14 IN (IN ) 0 0
EXT 21 IN (IN ) 0 0
EXT 24 IN (IN ) 0 0
EXT 25 IN (IN ) 0 0
EXT 26 IN (IN ) 0 0
EXT 33 IN (IN ) 0 0
============================
Board Configuration
============================
====== Port ==================
Type Usr Phy Media Speed Duplex Attr
----------- ---- ------- ----------- -------------- -------- -------
10G 1 (0) 0 Copper Auto 1
10G 2 (0) 8 Copper Auto 1
10G 3 (0) 16 Copper Auto 1
10G 4 (0) 20 Copper Auto 1
10G 5 (0) 24 Copper Auto 0
LAG 6 (0) 26 Fiber Auto 0
LAG 7 (0) 27 Fiber Auto 0
====== Fiber =================
Fiber Port Number: 2
------------ Fiber Detect
LPort Present MediaChg OE Status LOS Status
------ -------- --------- ---------------------- ----------------------
5 LOS None DisabledEnabled (GPIO:INT_0 ) Enabled (GPIO:INT_9 )
6 LOS None DisabledEnabled (GPIO:INT_12) Enabled (GPIO:INT_13)
------------ Fiber Optical Connect by I2C Hardware Controller 0
LPort I2C DEV I2C TYPE ID Delay SCK SDA
------ -------- --------- ----- ------- ------ ------
5 0 8 BITS 0x50 50 INT_7 INT_6
6 1 8 BITS 0x50 50 INT_11 INT_10
====== Led ===================
SYS (GPIO Blink)
ALARM (REG)
====== WatchDog ==============
Type: REG
hasivo-switch# show tech-support mtd
!
------------------ MTD Information ------------------
mtd0: 0xbd000000-0xbd0dffff "LOADER"
mtd1: 0xbd0e0000-0xbd0effff "BDINFO"
mtd2: 0xbd0f0000-0xbd0fffff "SYSINFO"
mtd3: 0xbd100000-0xbd1fffff "JFFS2
mtd4: 0xbd200000-0xbd2fffff "JFFS2
mtd5: 0xbd300000-0xbdefffff "RUNTIME"
mtd6: 0xbdf00000-0xbdffffff "OEMINFO"
No build environment, no. I could set that up, but Iām not going to overwrite the flash at this point in time so unless it can be loaded in some other way, Iām going to have to pass on that.
If youāre talking about the boot log from the serial console, I donāt have that at the moment. I can try to grab it the next time I reboot it.
S600WP-5GT-2S+_SE seems to have 128 MB of RAM according to this earlier post.
S600WP-5GT-2S+_SE vendor firmware (board: RTL9301-5X2P5GE_2XGE):
F1100WP-4XS-4XGT vendor firmware:
You don't need to overwrite the flash, it can be all initramfs testing at least until at a point where you'd be happy running the new firmware in lieu of the vendor firmware.
You will need to mount an RJ45 for console access (for the S600) however.
I don't know of any other way to get uboot / bootloader access.
We'll also want high res photos of the PCBs too. You likely won't need to take off any heatsinks, since hopefully we already know what's under each heatsink. But removing at least the top cover of the case to get the PCB exposed for the photos will be necessary (unless you can direct us to such photos that already exist for the exact models you have).
You haven't provided the details on the LEDs. It appears from the text that there's a single System LED (GPIO driven), but there's then normally two or three LEDs per port for link state and activity, and potentially another LED for the PoE state.
Yes, I've seen people booting just initramfs images from RAM in the past but you talked about flashing images, which to me implied overwriting flash. Iāve just ordered some RJ45 connectors that seem to match the holes in the PCB.
The only PCB photos I know of for the S600 model in question are the ones posted by hazza64 earlier in this thread. The top one isn't high enough resolution to read the chip models though. I would have to open it up later and take some new photos.
S600WP-5GT-2S+_SE:
RAM size: 128 MB
FLASH size: Unknown
GPIO for sys LED: Unknown
Reset button: Yes, a recessed one furthest to the right when looking at the front label.
LEDs:
Manufacturer render:
- 1 green PWR LED below the SYS LED. Lights up solidly.
- 1 green SYS LED (blinking quickly during boot, then slowly blinking during normal operation) above the PWR LED.
- RJ45 ports: 2 LED ālensesā (looks like two different LEDs behind at least the left one) at the top of each port. The left one lights up orange at 2.5 Gbit/s and green at 1 Gbit/s, blinking with activity. The right one indicates 100 / 10 Mbit/s.
- SFP+ slots: A separate square cluster of 4 LEDs directly to the left of the PWR and SYS LEDs. The two at the top indicate a 10 Gbit/s link (one for each slot), the bottom two a 1 Gbit/s link.
- PoE LEDs: The render suggests it has an LED under each of the 4 leftmost RJ45 ports, but I have the unbranded OEM front label on mine so the existence of those isn't clear.
F1100WP-4XS-4XGT:
RAM size: Unknown
FLASH size: Unknown
GPIO for sys LED: Unknown
Reset button: Presumably yes, a recessed one furthest to the right when looking at the front label. It's labeled RET though.
LEDs:
Manufacturer render (note that the real switch has no RJ45 port LEDs):
1 green/red PWR LED. Blinks alternatingly between green and red. This is confirmed normal by Hasivo.
Port LEDs: As seen in the picture, two rows of 4 LEDs each are used for link/activity for both RJ45 and SFP+ slots. Red indicates 10 Gbit/s, while green indicates 2.5 Gbit/s (and possibly all lower speeds).
Ok,
I've got something of a rough devicetree for the S600WP.
Items that are likely in question:
- Reset button IO assignment
- System LED IO assignment
- Maximum power ratings for the SFP+ ports
- Port & serdes assignments for the SFP+ ports
The rest should be ok, but would need testing. Did you get an RJ45 installed for the console port?
If you can get uboot access (needed for the testing) then it should be possible to easily identify the reset button just by reading the GPIO register to see which input changes when the button is depressed.
Iāll put a rough FW1100WP DTS together tomorrow night. Are the LEDS on the RJ45s not used at all for the FW1100? I would have expected similar for the SFP+ ports between the twoā¦ that the LEDs on the left would be for SFP, whilst the RJ45 LEDs would be for them..
2 Likes
Great! Iāll give it a try once I have a working console port.
No, I ordered a few of them on AliExpress so it will probably be a week or two before I get them, at least.
Like I said, there are no LEDs on the RJ45 ports on the FW1100 model. What you see is just a slightly inaccurate product render. All the link and activity LEDs are there on the left. I think that might be because they have other models that only differ in the port arrangement. For instance, there is a model with 6 SFP+ and 2 RJ45 (10GBASE-T) if I recall correctly.
1 Like
I recently got one of these Hasivo S1100WP-8XGT-SE switches second hand for 150 euro (with pre-installed noctuas!) and as an OpenWRT enjoyer I wanted to see if thereās anything I can do to to help getting official PoE support, since I donāt need to be using this switch actively, I will be able to perform tests without it being a hassle for me.
Iām completely new to contributing to OpenWRT. Am I correct in understanding that in order to do anything useful Iād first have to order some of these and solder them into the switch in the unused port?
Pretty much, you could just connect to the pads directly with an RS232 serial adapter, but the nicest is to install the console RJ45 and use a Cisco rollover cable for it.
Unsure if the RJ45 you linked fits, it looks about right. I did provide an Amphenol part number much earlier in this topic.
I thought hazza64 had trouble doing so without the RJ45 port? Do you happen to know what the pin-out is?
Nope, I didnāt bother. Just get the RJ45, and a Cisco rollover cable.
Even this will almost certainly do.
You can Google Cisco rollover pinout if you want to see the signals for the RJ45. The chassis that Iāve seen all have a cutout in the metal for the console RJ45, so with a sharp knife you can just cut the plastic label and itāll look like it came stock. Useful since it gives you a serial port for later use also.
1 Like
I think you might be the only one of us (in this topic) with a switch which exposes the USB port from the RTL93xx SoCs.
This is another area where the current OpenWRT state doesnāt yet include the USB handling for these SoCs.
But this is something that Iād like to get working.
Have you tried a USB flash drive or similar in this port under the vendor firmware?
Itās possible this is the same USB PHY in our RTL SoCs.. linux/drivers/phy/realtek/phy-rtk-usb2.c at master Ā· torvalds/linux, it does seem to align a bit with what the Realtek SDK does with our PHY. But it also seems to do quite a bit more, so this linux driver might target a newer derived PHY, in which case weād need a Gen1 PHY driver created (which looks reasonably easy given the Realtek SDK).
Yes. It is working in vendor firmware (very limited functionality). Even in u-boot it has a menu related to USB and can list connected devices, but unfortunately I canāt get access to the file system there. Maybe someone has ideas about this? It would be very nice to be able to read something from USB in u-boot
Current status of my investigation:
- Got access to u-boot menu (you need to type
Ctrl + C,z,hon boot) - Network is not working in
u-boot.rtk onreport that there is no supported phys profile. - I canāt upload any custom builds, because the device reboots after approximately 250 seconds.
- I supposed that this is a watchdog and try to patch a
u-boot's watchdog configuration, but without success. - The only way I have to write something into the flash is by the clip with flash reader/writer.
Currently I postponed my research because donāt want to wear the flash chip.
Ideas for further research:
- check how original firmware is working with watchdog.
- try to create custom build and check it by flashing it into the router
@andrewjlamarche / @janh / @jonasj / @plappermaul sorry for the spam, just hoping that one of you can point me to how the PLL bits for the RTL930x / RTL931x get enabled / disabled in the current OpenWRT situation?
I was expecting something of a clock controller, but Iām only seeing something for the rtl8380/rtl8390 SoCs. Itās the USB PLL Enable that Iām looking to enable, from this register in the RTL930X series.
It looks like itās done quite differently in the RTL931X.. I canāt quite see from the Realtek SDK where the USB subsystem might be enabled, but assume it will be a set of bits in various clock/PLL registers that needs to be enabled.
I was hoping to trace it back from the SPI NAND driver, but I couldnāt see anything from that either, is it assuming uboot has already enabled the PLL?
Yes, I already have one of those cables. Iāll just wait for the RJ45 ports to arrive.
Yes, I know that from earlier posts. I donāt want to cut the label though since it itās right where the model information etc. is on my unit (the unbranded OEM label is different than the render, as can be seen here (video)), so it would be very obvious that it was added in later. Otherwise I probably would have done so since itās indeed a useful addition to have.
NO PLL.
1 Like
Joined the forum because this thread. Picked up some S600W-5XGT-1S+ and willing to mess with on one of them and join the effort. Looks very similar to the ones you are all working with. I'll try to figure out dumping it's firmware shortly.
2 Likes
If you install the RJ45, use the rollover cable, find a way into uboot, and then we should be pretty good.
Would then be able to boot an initramfs which should at least get you into an OpenWRT image where you could backup the various mtd partitions.
The 5x 2.5GbE ports should be easy enough to get sorted. The SFP+ might be a smidge trickier, with the additional GPIO / I2C interfaces it uses.
I've also poked around the ZX-SW82TS-L2P, but for me it seems to be Ctrl+C, z, h to get the u-boot prompt. There's also a patching feature in the switch's stock firmware you can use to run stuff as root. I have more extensive notes on the patching here and how I got Gemini to tell me about the unlock sequence here
rtk network on also complains about not finding a matching hardware profile. I did some experimentation with having Gemini look closer at the kernel modules on the stock firmware but got nothing solid yet.
2 Likes