Netgear GS108Tv3/GS110TPv3/GS110TPP switch support

svanheule · August 23, 2020, 7:29pm

Following up on recently developed support for RTL83xx targets, I was considering to have a look at the Netgear GS110TPP switch that I recently purchased. It appears to also use a similar SoC, most likely the RTL8381M-VB-CG [to confirm].

Since Netgear is slowly pushing their users to cloud management (subscription based, of course), having OpenWrt support would be a nice way of staying in control.

Specs that I've been able to just read from the pcb:

Flash: 32MiB (MX25L25635FM)
RAM: 256MiB DDR3 (W631GG8MB)
Phy: RTL8214C (ports 9 and 10), connected to SoC with QSGMII
???: RTL8231
Sensor monitoring (?): Nuvoton M0516LDN
PoE management: BCM59121

Since the GS108Tv3 and GS110TPv3 use the same firmware, they very likely use the same SoC and shouldn't differ that much.

anon13997276 · August 23, 2020, 8:02pm

You should be able to re-use the D-Link DGS-1210-10P configuration (.dts file) for this board, it should be very similar, maybe the LEDs differ. The Nuvoton ARM SoC does the PoE management, it talks with the RTL SoC via a serial protocol as described in the referenced post, the protocol might be somewhat different from the DLink, though, there seem to be different philosophies from the vendors what e.g. happens when the power budget is used up.
First step is to connect to the serial console of the board, normally 115200 8N1 3.3V. The serial port so far has always been GND-TX-RX-VCC with VCC the square pin, there might be a second/third header close to the Nuvonton chip to snoop on the serial conversation with the RTL SoC and to program the Nuvoton SoC via SWD. In U-Boot you can use the command

rtk network on

to enable the network. Then you can use tftpboot to download and run an initram image from the RAM of the board. Good luck,
Kobi

svanheule · August 24, 2020, 7:25am

I had the 4th pin mapped out as GND, so your mapping could match. There might be some unpopulated resistors on my board, since I couldn't see any voltage on pin 1, 2, or 3.

Two headers next to the Nuvoton chip. I've ordered a logic analyser and some related parts, so that should help in debugging.

Thanks for the tips!

anon13997276 · August 24, 2020, 7:44am

Could you post a photo of your board?
BTW: The RTL8231 is responsible for steering the LEDs and is sometimes also used as a GPIO expander for buttons. It talks SMI (Realteks MDIO with the RTL SoC).

svanheule · August 24, 2020, 9:02am

GS110TPP board pictures:

[Album] GS110TPP board

anon13997276 · August 24, 2020, 9:58am

J1 is definitely the serial console port for the RTL SoC, and I don't think that there are resistors missing, only the solder bridges in your image above the SMD resistors need to be connected for RX, TX and VCC. Try to test whether there is a voltage on those bridges and then it should be sufficient to bridge these with 3 tiny wires or big blobs of solder. Of course the professional solution is to use SMD resistors with 0 Ohm...
The serial port for the PoE connection (Normally 19200 8N1) seems to be functional (J3), the connection to the SoC goes via the 2 white Optocuplers (On Semi H11L1).
There is no support for the RTL8214C PHY so far in the code, but support is normally little work. The first step is to figure out the PHY ID that should be provided for the unknown PHY during OpenWRT boot. This is needed to do the auto detection. Unfortunately, a lot of the PHYs from Realtek have the same ID (both the RTL8218B and the RTL8214FC have 0x001cc981), then this will need some thinking. I'll see whether I can already dig out the configuration sequence for the 8214C from some U-Boot dump and put it into a "firmware" blob.

anon13997276 · August 24, 2020, 11:07am

I just commit initial support for the RTL8214C using a guesstimated PHY ID of 0x001cc941. The last digit might be wrong, though, as it depends on the revision of the PHY chip. No support for EEE yet.
The reset button seems to be connected to the RTL8231 chip. In the .dts you will need the following:

	keys {
		compatible = "gpio-keys-polled";
		poll-interval = <20>;
		reset {
			label = "reset";
			gpios = <&gpio0 67 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};
	};

&gpio0 {
	indirect-access-bus-id = <0>;
};

the indirect-acess-bus-id enables GPIO via the 8231 and the button statement gives the GPIO number of the reset button, should be between 64 and 99 (67 seems to be a common choice).

svanheule · August 24, 2020, 11:07am

I added a header, but bridging wasn't required. Only VCC wasn't connected (missing R9), but that's not an issue. The pinout you listed is correct: [1] VCC, (2) TX, (3) RX, (4) GND.

BOOT Loader Version 1.0.0.5 (2019-03-15 17:08:23 UTC)

Board: RTL838x CPU:500MHz LXB:200MHz MEM:300MHz
CPU  : 500 MHz
RAM  : 128 MB
FLASH: 32 MB

Model: GS110TPP
MAC  : 38:94:ED:XX:YY:ZZ

Hit Esc key to stop autoboot:  1  0 
## Booting image from partition ... 0
## Booting kernel from Legacy Image at 81000000 ...
   Version:      7.0.1.16
   Created:      2019-05-10  18:20:41 UTC
   Data Size:    8502811 Bytes = 8.1 MB
   Checksum ... OK
   Uncompressing ... OK

Starting kernel ...

<181>1 2019-01-01T00:00:11.440Z: %0.0.0.0-1 TRAPMGR-5-SYSTEM_COLDSTART sal_snmp.c(772): Cold startup
Press any key to continue
<181>1 2019-01-01T00:00:13.850Z: %0.0.0.0-1 TRAPMGR-5-PORT_LINK_UP ksi_snmp.c(232): Interface GigabitEthernet1 link up
<181>1 2019-01-01T00:00:13.860Z: %0.0.0.0-1 TRAPMGR-5-PORT_LINK_UP rsd_l3_intf.c(126): Interface VLAN-MGMT link up
<181>1 2019-01-01T00:00:13.900Z: %0.0.0.0-1 TRAPMGR-5-PORT_LINK_UP ksi_snmp.c(232): Interface GigabitEthernet10 link up

With admin:password credentials, you can then log in into a limited shell:

Username: admin
Password: ********
<181>1 2019-01-01T00:00:40.550Z: %192.168.1.123-1 AAA-5-CONNECT vtysh_main.c(471): New console connection for user admin, source async ACCEPTED
GS110TPP# ?
  clear             Reset functions
  clock             Manage the system clock
  configure         Configuration Mode
  copy              Copy from one file to another
  debug             Debug Options
  delete            Delete a file from the flash file system
  disable           Turn off privileged mode command
  end               End current mode and change to enable mode
  exit              Exit current mode and down to previous mode
  no                Negate command
  ping              Send ICMP ECHO_REQUEST to network hosts
  reboot            Halt and perform a cold restart
  renew             Renew functions
  restore-defaults  Restore to default
  save              Save running configuration to flash
  show              Show running system information
  ssl               Setup SSL host keys
  terminal          Terminal configuration
  traceroute        Trace route to network hosts

U-Boot shell:

Hit Esc key to stop autoboot:  1 0
RTL838x# ?
?       - alias for 'help'
base    - print or set address offset
boota   - boota  - boot application image from one of dual images partition automatically
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
env     - environment handling commands
erase   - erase FLASH memory
flerase - Erase flash partition
flinfo  - print FLASH memory information
flshow  - Show flash partition layout
go      - start application at address 'addr'
help    - print command description/usage
iminfo  - print header information for application image
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
printsys- printsys - print system information variables

protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
rtk     - rtk     - Realtek commands

run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
savesys - savesys - save system information variables to persistent storage

setenv  - set environment variables
setsys  - setsys  - set system information variables

sf      - SPI flash sub-system
sleep   - delay execution for some time
tftpboot- boot image via network using TFTP protocol
upgrade - Upgrade loader or runtime image
version - print monitor, compiler and linker version
RTL838x# printenv
SN=60B1975PF004E
baudrate=115200
boardmodel=RTL8393M_DEMO
bootcmd=boota
bootdelay=1
ethact=rtl8380#0
ethaddr=38:94:ED:XX:YY:ZZ
fileaddr=81000000
filesize=AA6887
ipaddr=192.168.1.1
ledModeInitSkip=0
serverip=192.168.1.111
stderr=serial
stdin=serial
stdout=serial

Environment size: 293/65532 bytes
RTL838x# printsys
bootpartition=0
SN=0987654321
dualfname1=image
System information size: 47/4096 bytes
RTL838x# version

BOOT Loader Version 1.0.0.5 (2019-03-15 17:08:23 UTC)
mips-linux-xgcc (Realtek MSDK-4.8.5p1 Build 2220) 4.8.5 20150209 (prerelease)
GNU ld (Realtek MSDK-4.8.5p1 Build 2220) 2.24.0.20141017
RTL838x# rtk help
Usage:
rtk     - Realtek commands

RTL838x# rtk
Usage:
rtk     - Realtek commands

RTL838x# flinfo
RTL838x# flshow
=============== FLASH Partition Layout ===============
Index  Name       Size       Address
------------------------------------------------------
 0     LOADER     0xe0000    0xb4000000-0xb40dffff
 1     BDINFO     0x10000    0xb40e0000-0xb40effff
 2     SYSINFO    0x10000    0xb40f0000-0xb40fffff
 3     JFFS2_CFG  0x100000   0xb4100000-0xb41fffff
 4     JFFS2_LOG  0x100000   0xb4200000-0xb42fffff
 5     RUNTIME1   0xe80000   0xb4300000-0xb517ffff
 6     RUNTIME2   0xe80000   0xb5180000-0xb5ffffff
======================================================
RTL838x# base
Base Address: 0x00000000

anon13997276 · August 24, 2020, 11:13am

Looks to me as if you are in business. To boot an image, I use the following macros:

BOOT Loader Version 1.0.0.5 (2017-12-28 09:35:22 UTC)

CPU  : 700 MHz
RAM  : 128 MB
FLASH: 32 MB

Model: GS728TPv2
MAC  : 00:E0:4C:00:00:00

Hit Esc key to stop autoboot:  0 
GS728_752TP_TPP# printenv
baudrate=115200
boardmodel=RTL8393M_DEMO
bootcmd=boota
bootdelay=5
ethact=rtl8390#0
ethaddr=00:E0:4C:00:00:00
ipaddr=192.168.1.140
ledModeInitSkip=0
loadcmd=tftpboot 0x84f00000 192.168.1.150:openwrt-rtl838x-netgear_gs728tpv2-initramfs-kernel.bin
serverip=192.168.1.150
stderr=serial
stdin=serial
stdout=serial

Environment size: 337/65532 bytes
GS728_752TP_TPP# rtk network on
Enable network
Please wait for PHY init-time ...

GS728_752TP_TPP# run loadcmd   
Using rtl8390#0 device
TFTP from server 192.168.1.150; our IP address is 192.168.1.140
Filename 'openwrt-rtl838x-netgear_gs728tpv2-initramfs-kernel.bin'.
Load address: 0x84f00000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################
done
Bytes transferred = 5016309 (4c8af5 hex)
GS728_752TP_TPP# bootm
## Booting kernel from Legacy Image at 84f00000 ...
   Version:      MIPS OpenWrt Linux-5.4.24
   Created:      2020-08-10   5:55:21 UTC
   Data Size:    5016245 Bytes = 4.8 MB
   Checksum ... OK
   Uncompressing ... OK

Starting kernel ...

[    0.000000] Linux version 5.4.24 (birger@AMDDesktop) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r12728-52208e10cb)) #0 Mon Aug 10 05:55:21 2020
[    0.000000] prom_init called
[    0.000000] RTL838X model is ffffffff
[    0.000000] RTL839X model is 83916806
[    0.000000] SoC Type: RTL8391
[    0.000000] Kernel command line: 
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019555 (MIPS 34Kc)
[    0.000000] plat_mem_setup called 
[    0.000000] MIPS: machine is Netgear GS728TPv2
[    0.000000] Registering _machine_restart
[    0.000000] NO PCI device found
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] device_tree_init called
[    0.000000] Using appended Device Tree.
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] On node 0 totalpages: 32768
[    0.000000]   Normal zone: 288 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32768 pages, LIFO batch:7
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00020b6a
[    0.000000] Readback ErrCtl register=00020b6a
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 111692K/131072K available (4540K kernel code, 160K rwdata, 1000K rodata, 12148K init, 198K bss, 19380K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 64
[    0.000000] random: get_random_bytes called from start_kernel+0x32c/0x51c with crng_init=0
[    0.000000] CPU frequency from device tree: 700000000
[    0.000000] CPU Clock: 700 MHz
[    0.000000] PLL control register: 0
[    0.000000] Using default baud rate: 38400
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5460744132 ns
[    0.000008] sched_clock: 32 bits at 350MHz, resolution 2ns, wraps every 6135667710ns
[    0.008566] printk: console [ttyS0] enabled
[    0.008566] printk: console [ttyS0] enabled
[    0.017723] printk: bootconsole [early0] disabled
[    0.017723] printk: bootconsole [early0] disabled
[    0.028124] Calibrating delay loop... 464.48 BogoMIPS (lpj=2322432)
[    0.094990] pid_max: default: 32768 minimum: 301
[    0.100242] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.108336] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.121882] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.132785] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.140429] pinctrl core: initialized pinctrl subsystem
[    0.146792] NET: Registered protocol family 16
[    0.177359] clocksource: Switched to clocksource MIPS
[    0.184114] NET: Registered protocol family 2
[    0.189755] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.199052] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.207531] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.215328] TCP: Hash tables configured (established 1024 bind 1024)
[    0.222503] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.229780] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.237809] NET: Registered protocol family 1
[    0.517489] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.531830] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.538314] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.567332] Probing RTL838X GPIOs
[    0.571040] Unknown GPIO chip id (ffff)
[    0.614156] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.621344] serial8250: ttyS0 at MMIO 0x0 (irq = 31, base_baud = 12442400) is a 16550A
[    0.631071] b8002100.uart: ttyS1 at MMIO 0xb8002100 (irq = 30, base_baud = 12500000) is a 16550A
[    0.770899] brd: module loaded
[    0.774644] Initializing rtl838x_nor_driver
[    0.779333] Address mode is 4 bytes
[    0.783172] rtl838x_nor_init called
[    0.787016] Flash ID: ffc22019
[    0.795114] rtl838x-nor b8001200.spi: mx25l25635e (32768 Kbytes)
[    0.801843] 7 fixed-partitions partitions found on MTD device rtl838x_nor
[    0.809352] Creating 7 MTD partitions on "rtl838x_nor":
[    0.815128] 0x000000000000-0x0000000e0000 : "u-boot"
[    0.821590] 0x0000000e0000-0x0000000f0000 : "u-boot-env"
[    0.828487] 0x0000000f0000-0x000000100000 : "u-boot-env2"
[    0.835401] 0x000000100000-0x000000200000 : "jffs2_cfg"
[    0.842212] 0x000000200000-0x000000300000 : "jffs2_log"
[    0.848998] 0x000000300000-0x000001180000 : "rootfs"
[    0.855422] mtd: device 5 (rootfs) set to be root filesystem
[    0.861753] mtdsplit: no squashfs found in "rootfs"
[    0.882761] 0x000001180000-0x000002000000 : "firmware2"
[    0.901569] libphy: Fixed MDIO Bus: probed
[    0.906214] Chip-Info: a0036290

anon13997276 · August 24, 2020, 11:24am

I suggest using the image from the DLink 1210-10P board or the supported Allnet board. When you compile OpenWRT, make sure that you disable the MIPS16 instructions

Advanced configuration options (for developers)  --->
  Target Options
   [ ]   Build packages with MIPS16 instructions

In principle, the Linux Kernel should be able to emulate these, but this either does not work, or I configured the kernel wrongly. The kernel itself never uses these instructions. On the 838x (MIPS 4KEc) the init process will crash, on a 839x (34Kc), you will see Illegal instructions popping up in the Kernel logs without disabling this.

svanheule · August 24, 2020, 11:32am

Thanks for all the info so far! I will try to look at building an image tonight, or later this week.

svanheule · August 24, 2020, 12:16pm

Somewhat off-topic: Is this by chance also a 16-pin package? Your build doesn't seem to provide persistent storage (a rootfs_data jffs2 partition). @PolynomialDivision has been having issues with 16-pin macronix flash on the Nanobeam AC Gen 2. So if you have a working device, it might be useful if you could try to reproduce the issue he's been having.

anon13997276 · August 24, 2020, 7:16pm

For the Netgear GS728v2, the package has 16 pins, indeed. But as you say, for the initramfs images, there is no persistent memory defined so far, only the squashfs images use persistent images. And I am not yet ready to flash the Netgear GS728v2, yet, this is my playground for porting the drivers to the RTL839x architecture: as you can see, it boots, the flash driver works, I have even managed to configure VLANs for the up to 52 ports supported, but then I am stuck on getting the Receive DMA working for the CPU-Port
But I am also not sure that the problem you refer to also applies to the SPI-NOR driver of the RTL838x SoCs. The SoCs are able to directly map NOR flash into memory, they even boot directly from a flash chip, which is mapped into memory at the beginning of the reset vectors of the SoCs on reset. For this strapping pins are used to configure the flash chip, the SoCs do not generally have any ROM that they boot into. Therefore, the NOR driver is very basic and relies on the SoC to do all the work.

svanheule · August 29, 2020, 5:00pm

First light!

BOOT Loader Version 1.0.0.5 (2019-03-15 17:08:23 UTC)

Board: RTL838x CPU:500MHz LXB:200MHz MEM:300MHz
CPU  : 500 MHz
RAM  : 128 MB
FLASH: 32 MB

Model: GS110TPP
MAC  : 38:94:ED:AE:6D:BC

Hit Esc key to stop autoboot:  1 0
RTL838x# rtk network on
Enable network
Please wait for PHY init-time ...

RTL838x# run loadcmd
Using rtl8380#0 device
TFTP from server 192.168.1.109; our IP address is 192.168.1.10
Filename 'openwrt-rtl838x-netgear_gs110tpp-v1-initramfs-kernel.bin'.
Load address: 0x84f00000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################
done
Bytes transferred = 3581295 (36a56f hex)
RTL838x# bootm
## Booting kernel from Legacy Image at 84f00000 ...
   Version:      MIPS OpenWrt Linux-5.4.24
   Created:      2020-08-24  10:59:31 UTC
   Data Size:    3581231 Bytes = 3.4 MB
   Checksum ... OK
   Uncompressing ... OK

Starting kernel ...

[    0.000000] Linux version 5.4.24 (build@terra) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r12805-6ef9db9e1c)) #0 Mon Aug 24 10:59:31 2020
[    0.000000] prom_init called
[    0.000000] RTL838X model is 83806800
[    0.000000] SoC Type: RTL8380
[    0.000000] Kernel command line: 
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019070 (MIPS 4KEc)
[    0.000000] plat_mem_setup called 
[    0.000000] MIPS: machine is Netgear GSS110TPP
[    0.000000] Registering _machine_restart
[    0.000000] NO PCI device found
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] device_tree_init called


[    0.000000] Using appended Device Tree.
[    0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] On node 0 totalpages: 32768
[    0.000000]   Normal zone: 288 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32768 pages, LIFO batch:7
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 117912K/131072K available (4543K kernel code, 157K rwdata, 1000K rodata, 5940K init, 198K bss, 13160K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 64
[    0.000000] random: get_random_bytes called from start_kernel+0x32c/0x51c with crng_init=0
[    0.000000] CPU frequency from device tree: 500000000
[    0.000000] CPU Clock: 500 MHz
[    0.000000] PLL control register: efffffff
[    0.000000] Using default baud rate: 38400
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041786 ns
[    0.000016] sched_clock: 32 bits at 250MHz, resolution 4ns, wraps every 8589934590ns
[    0.008635] printk: console [ttyS0] enabled
[    0.008635] printk: console [ttyS0] enabled
[    0.017776] printk: bootconsole [early0] disabled
[    0.017776] printk: bootconsole [early0] disabled
[    0.028241] Calibrating delay loop... 498.89 BogoMIPS (lpj=2494464)
[    0.095209] pid_max: default: 32768 minimum: 301
[    0.100780] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.108907] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.127378] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.138381] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.146217] pinctrl core: initialized pinctrl subsystem
[    0.153426] NET: Registered protocol family 16
[    0.226843] clocksource: Switched to clocksource MIPS
[    0.235296] NET: Registered protocol family 2
[    0.241741] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.251180] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.259775] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.267684] TCP: Hash tables configured (established 1024 bind 1024)
[    0.275281] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.282675] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.291091] NET: Registered protocol family 1
[    0.694672] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.718417] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.724886] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.787390] Probing RTL838X GPIOs
[    0.791089] rtl8231_init
[    0.844017] RTL8231 led function now: ffff
[    0.848595] rtl8231_init done
[    0.959045] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.966366] serial8250: ttyS0 at MMIO 0x0 (irq = 31, base_baud = 12442400) is a 16550A
[    0.977229] b8002100.uart: ttyS1 at MMIO 0xb8002100 (irq = 30, base_baud = 12500000) is a 16550A
[    1.378752] brd: module loaded
[    1.383011] Initializing rtl838x_nor_driver
[    1.387809] Address mode is 4 bytes
[    1.391661] rtl838x_nor_init called
[    1.395517] Flash ID: ffc22019
[    1.401712] rtl838x-nor b8001200.spi: mx25l25635e (32768 Kbytes)
[    1.408550] 7 fixed-partitions partitions found on MTD device rtl838x_nor
[    1.416055] Creating 7 MTD partitions on "rtl838x_nor":
[    1.421919] 0x000000000000-0x0000000e0000 : "u-boot"
[    1.429786] 0x0000000e0000-0x0000000f0000 : "u-boot-env"
[    1.438016] 0x0000000f0000-0x000000100000 : "sysinfo"
[    1.445820] 0x000000100000-0x000000200000 : "jffs2_cfg"
[    1.453992] 0x000000200000-0x000000300000 : "jffs2_log"
[    1.462112] 0x000000300000-0x000001180000 : "runtime1"
[    1.495250] 0x000001180000-0x000002000000 : "runtime2"
[    1.512743] libphy: Fixed MDIO Bus: probed
[    1.517576] Probing RTL838X switch device
[    1.522229] SoC ID: 8380: RTL8380
[    1.525891] Chip version B
[    1.528954] In rtl838x_mdio_probe
[    1.532661] Found compatible MDIO node!
[    1.536955] Deferring probe of mdio bus
[    1.541191] STOPPING Traffic
[    1.645559] Probing RTL838X eth device pdev: 87c6c200, dev: 87c6c210
[    1.666017] Found SoC ID: 8380: RTL8380, family 8380
[    1.671580] rtl8380_init_mac
[    1.674801] Using MAC 000000e04c000000
[    1.678989] In rtl838x_mdio_init
[    1.682902] rtl838x_mdio_reset
[    1.686301] libphy: rtl838x-eth-mdio: probed
[    1.801758] In rtl838x_validate
[    1.805302] In rtl838x_validate
[    1.811643] NET: Registered protocol family 10
[    1.828763] Segment Routing with IPv6
[    1.833034] NET: Registered protocol family 17
[    1.838898] 8021q: 802.1Q VLAN Support v1.8
[    1.844643] Probing RTL838X switch device
[    1.849395] SoC ID: 8380: RTL8380
[    1.853065] Chip version B
[    1.856042] In rtl838x_mdio_probe
[    1.859811] Found compatible MDIO node!
[    1.945863] REATLTEK RTL8218B (internal) rtl838x slave mii-0:08: Detected internal RTL8218B
[    1.956650] Firmware loaded. Size 1184, magic: 83808380
[    4.650303] libphy: rtl838x slave mii: probed
[    4.655221] In rtl838x_mdio_probe done
[    4.667141] rtl838x_setup called
[    4.670758] > 10000001 10000002 10000004 10000008 10000010 10000020 10000040 10000080
[    4.679499] > 1fffffff 1fffffff 10000400 10000800 10001000 10002000 1fffffff 1fffffff
[    4.688221] > 1fffffff 1fffffff 1fffffff 1fffffff 1fffffff 1fffffff 1fffffff 1fffffff
[    4.696939] > 1fffffff 1fffffff 1fffffff 1fffffff     3cff        0        0        0
[    4.705584] CPU_PORT>     3cff
[    5.796874] rtl83xx_enable_phy_polling:             3cff
[    5.802755] Please wait until PHY is settled
[    6.837025] In rtl838x_phylink_validate, port 0
[    6.837547] In rtl838x_phylink_validate, port 0
[    6.852907] rtl838x-eth bb00a300.ethernet eth0: error -22 setting up slave phy
[    6.870695] rtl838x-switch 0.switch: Error registering switch: -22
[    6.877701] rtl838x-switch: probe of 0.switch failed with error -22
[    6.974590] Freeing unused kernel memory: 5940K
[    6.979685] This architecture does not have kernel memory protection.
[    6.986860] Run /init as init process
[    7.158810] init: Console is alive
[    7.177511] init: - preinit -
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
rtl838x_set_preinit_iface called
Illegal instruction
[    7.440037] rtl838x_eth_open called 87640c60, ring a7000000
[    7.446215] RESETTING 8380, CPU_PORT 28
[    8.049445] rtl838x-eth bb00a300.ethernet eth0: configuring for fixed/internal link mode
[    8.058423] In rtl838x_mac_config, mode 1
[    8.062850] rtl838x_hw_en_rxtx
[    8.068210] In rtl838x_mac_config, mode 1
[    8.072659] In rtl838x_mac_link_up
[    8.076452] rtl838x-eth bb00a300.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
Illegal instruction
[    8.096985] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
[   12.360514] procd: - early -
[   14.490881] procd: - ubus -
[   14.508755] random: ubusd: uninitialized urandom read (4 bytes read)
[   14.548263] random: ubusd: uninitialized urandom read (4 bytes read)
[   14.556139] random: ubusd: uninitialized urandom read (4 bytes read)
[   14.566310] procd: - init -
Please press Enter to activate this console.
[   16.677312] urandom_read: 6 callbacks suppressed
[   16.677327] random: ubusd: uninitialized urandom read (4 bytes read)

Illegal instruction


BusyBox v1.31.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r12805-6ef9db9e1c
 -----------------------------------------------------
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
Illegal instruction
root@(none):/# cd /sys/class/gpio/
Illegal instruction
root@(none):/sys/class/gpio# [   30.698313] random: fast init done
root@(none):/sys/class/gpio# cd gpiochip0
root@(none):/sys/devices/platform/b8003500.gpio-controller/gpio/gpiochip0# cat ngpio
196
Illegal instruction
root@(none):/sys/devices/platform/b8003500.gpio-controller/gpio/gpiochip0# halt
Illegal instruction
root@(none):/sys/devices/platform/b8003500.gpio-controller/gpio/gpiochip0# [  102.138763] reboot: System halted
[  102.142450] System halted.

I did have an issue with the makefile. I added an entry for the gs110 before the gs728, so that they would be in alphabetical order. However, the uImage contained the NETGEAR_KERNEL_MAGIC value set by gs728. When I swapped the order of these two, the output image contained the right uImage magic.
Edit: Fixed by adding NETGEAR_KERNEL_MAGIC to DEVICE_VARS

I forgot to disable the MIPS16 instructions, but (luckily) all I got was "Illegal instruction" notifications. I rebuilt after enabling, but make didn't seem to pick that up. So I'll have to make clean/dirclean, but at least it's booting

svanheule · August 29, 2020, 7:11pm

anon13997276:

The reset button seems to be connected to the RTL8231 chip. In the .dts you will need the following:
	keys {
		compatible = "gpio-keys-polled";
		poll-interval = <20>;
		reset {
			label = "reset";
			gpios = <&gpio0 67 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};
	};

&gpio0 {
	indirect-access-bus-id = <0>;
};
the indirect-acess-bus-id enables GPIO via the 8231 and the button statement gives the GPIO number of the reset button, should be between 64 and 99 (67 seems to be a common choice).

In my prelimary DTS, I've got this indirect-access-bus-id setting, giving me 195 GPIO lines on gpiochip0. Currently going through the list to see what's what. Reset is an active low input on GPIO24. GPIOs 32-63 are all outputs, as are 100-195, although the latter are all set to 0. When toggling 32-63, the lights on the switch ports change, but the mapping doesn't appear to be 1-to-1 with GPIOs.

anon13997276 · August 30, 2020, 4:25pm

Let me try to shed some light on this. The RTL838x SoC has several ways of controlling GPIOs, which means mostly Port-Leds for switches with many ports. Currently the GPIO driver does the following mapping:

* 0-31: internal GPIO lines of the SoC via RTL838X_GPIO_PABC_xxx registers
* 32-63, LED control register of the SoC via RTL838X_LED_GLB_CTRL register
* 64-99: external RTL8231 controlled via RTL838X_EXTRA_GPIO_CTRL / RTL838X_EXT_GPIO_INDRT_ACCESS registers
* 100-131: PORT-LED 0 via Serial LED interface of RTL838x, e.g. Green
* 132-163: PORT-LED 1, e.g. Yellow LEDs
* 164-195: PORT-LED 2, e.g. Red LEDs

The RTL838X_GPIO_PABC_xxx registers are not part of the Switch feature block of the RTL838x SoC, but come from a different function block:

#define GPIO_CTRL_REG_BASE		((volatile void *) 0xb8003500)
#define RTL838X_GPIO_PABC_CNR		(GPIO_CTRL_REG_BASE + 0x0)
#define RTL838X_GPIO_PABC_TYPE		(GPIO_CTRL_REG_BASE + 0x04)
#define RTL838X_GPIO_PABC_DIR		(GPIO_CTRL_REG_BASE + 0x8)
#define RTL838X_GPIO_PABC_DATA		(GPIO_CTRL_REG_BASE + 0xc)
#define RTL838X_GPIO_PABC_ISR		(GPIO_CTRL_REG_BASE + 0x10)
#define RTL838X_GPIO_PAB_IMR		(GPIO_CTRL_REG_BASE + 0x14)
#define RTL838X_GPIO_PC_IMR		(GPIO_CTRL_REG_BASE + 0x18)

These pins refer to the GPIO lines of the RTL 838x chips themselves. While there are many, the problem is that the chips only have a handful of such PINs. E.G the RTL8380M has 7 GPIOs, plus one dedicated to the SYS led (GPIO0). Pins are called GPIO1-3, GPIO10-11, GPIO12-14. 7 GPIOs is far too few to power PHYs, read a Reset button and sense things.

RTL838X_LED_GLB_CTRL allows to switch steer the SYS LED, sometimes also the Power Led:

#define RTL8380_LED_GLB_CTRL_ADDR           (0xBB000000 + 0xA000)
  #define RTL8380_LED_GLB_CTRL_BLINK_TIME_SEL_2_OFFSET      (30)
  #define RTL8380_LED_GLB_CTRL_ASIC_CFG_8231_OFFSET         (29)
  #define RTL8380_LED_GLB_CTRL_BUZZER_CMD_OFFSET            (28)
  #define RTL8380_LED_GLB_CTRL_BUZZER_FREQ_SEL_OFFSET       (25)
  #define RTL8380_LED_GLB_CTRL_BUZZER_SEL_OFFSET            (24)
  #define RTL8380_LED_GLB_CTRL_BLINK_TIME_SEL_OFFSET        (22)
  #define RTL8380_LED_GLB_CTRL_EXT_8231_GPIO_EN_2_0_OFFSET  (19)
  #define RTL8380_LED_GLB_CTRL_LED_LOAD_EN_OFFSET           (18)
  #define RTL8380_LED_GLB_CTRL_SYS_LED_MODE_OFFSET          (16)
  #define RTL8380_LED_GLB_CTRL_SYS_LED_EN_OFFSET            (15)
  #define RTL8380_LED_GLB_CTRL_STEP2_PWR_ON_LED_2_0_OFFSET  (12)
  #define RTL8380_LED_GLB_CTRL_STEP1_PWR_ON_LED_2_0_OFFSET   (9)
  #define RTL8380_LED_GLB_CTRL_COMBO_PORT_MODE_OFFSET        (7)
  #define RTL8380_LED_GLB_CTRL_LED_MDC_DUTY_SEL_OFFSET       (6)
  #define RTL8380_LED_GLB_CTRL_P27_24_LED_MASK_SEL_OFFSET    (3)
  #define RTL8380_LED_GLB_CTRL_LED_MASK_SEL_2_0_OFFSET       (0)

So typically you can switch the SYS LED via GPIO 32 + 15 = 47.

To use the serial LED features via a shift register IC, in the DTS the "take_port_leds" option must be set, otherwise they remain under ASIC control, you cannot control them via software. There are more options, then:

if (of_property_read_bool(np, "take-port-leds")) {
		if(of_property_read_u32(np, "leds-per-port", &gpios->leds_per_port))
			gpios->leds_per_port = 2;
		if(of_property_read_u32(np, "led-mode", &gpios->led_mode))
			gpios->led_mode = (0x1ea << 15) | 0x1ea ;
		if(of_property_read_u32(np, "num-leds", &gpios->num_leds))
			gpios->num_leds = 32;
		if(of_property_read_u32(np, "min-led", &gpios->min_led))
			gpios->min_led = 0;
		take_port_leds(gpios);
	}

Frankly a lot of this is not understood, merely configurable
Kobi

svanheule · August 30, 2020, 7:10pm

Looking back at the PCB pictures, there are three (non-latching) SN74HC164 8-bit shift registers, and two (latching) SN74LV595A 8-bit shift registers. The traces for the port-speed LEDs (green for GbE, amber for FE) appear to lead to the 74HC164s. The traces for the PoE status (green for PoE+, amber for PoE) would go to the 74LV595s. This would make sense, as these LED groups respectively require 20 (out of 24) and 16 (out of 16) pins to control.

I hadn't implemented take-port-leds yet, I'll give that a shot tomorrow.

anon13997276 · August 30, 2020, 9:25pm

For LED software control, have a look at the DTS of the TP-Link T2500g-10TS:

github.com

rtk-owlab/openwrt/blob/tgtadd/rtl838x_bk/target/linux/rtl838x/dts/rtl8380_tp-link_t2500g-10ts.dts

/dts-v1/;

#include "rtl838x.dtsi"

#include <dt-bindings/input/input.h>
#include <dt-bindings/gpio/gpio.h>

/ {
	compatible = "tp-link,t2500g-10ts", "realtek,rtl838x-soc";
	model = "TP-Link T2500-10TS Switch";

	aliases {
		led-boot = &led_sys;
		led-failsafe = &led_sys;
		led-running = &led_sys;
		led-upgrade = &led_sys;
	};	

	chosen {
		bootargs = "console=ttyS0,38400";

This file has been truncated. show original

While this works, the issue at the next step is that for a DSA switch there are not the right triggers for the LEDs, see Blink led in different color for 100 or 1000 GBit

svanheule · September 1, 2020, 11:39am

As an sidenote: I'll keep track of my changes on github:

svanheule · September 4, 2020, 7:00pm

I've added two wires to my board, at R163 and R165, to probe MDIO and MDC. I figured this would be useful, since the other phys seem to require a binary blob, but I can't find this anywhere in Netgear's GPL dump.