Netgear GS108Tv3/GS110TPv3/GS110TPP switch support

johnsmith31 · February 15, 2024, 2:02am

I was able to carry out the following downgrade path for Netgear's "GS108Tv3_GS110TPv3_GS110TPPv1" firmware:

7.0.19.9 --> 7.0.9.9 --> 7.0.8.4

but can't downgrade any farther back. (Tried all of these further downgrades with no success: version 7.0.7.2, 7.0.6.2, 7.0.5.2, 7.0.4.8. Did a 15-second power-off cold reboot and retried downgrading to 7.0.7.2 just to be sure.)

I also cannot cross-grade from the presently-active Netgear v7.0.8.4 to openwrt-23.05.2-realtek-rtl838x-netgear_gs110tpp-v1-initramfs-kernel.bin.

Of note but no eventual help, in version 7.0.8.4, tftp appears to be working properly at the telnet:60000 administrative command line. It copies files, but is still doing version-checking on the copied files, rejecting anything older than 7.0.8.4 (or not a Netgear-released file, i.e. OpenWRT binaries).

(The !!!!!! characters are progress indicators, appearing at a rate of about 1 Hz during the tftp transfer.)

Seem to have hit a brick wall here. Suggestions for next steps to try?

bmork · February 15, 2024, 7:14am

Can't see anything new and magic in those images. I suspect this is a simple version number check against the "uimage name" field in the header. We're using OpenWrt defaults there for these swicthes
("MIPS OpenWrt Linux-x.x.x"), simply because earlier OEM firmwares didn't care. But there is no reason we can't fake a version number high enough instead, if required. Many devices do that.

Look at e.g. Device/allnet_all-sg8208m in target/linux/realtek/image/rtl838x.mk. It sets

UIMAGE_NAME := 2.2.2.0

You could try adding something similar to the Device/netgear_gs110tpp-v1 definition, using version number strings looking like those used by the OEM firmware. For example

UIMAGE_NAME := 7.0.9.19

If this works then we should try to figure out how high we can set this value without breaking OEM compatibility, and IMHO try to make it easy do identify as an OpenWrt image even if we have to drop "OpenWrt" from the string, I assume this version number will show up here and there in the OEM management interfaces. Numbers matching real OEM versions will be confusing.

johnsmith31 · February 15, 2024, 7:19am

Hmm.

Once I got a working TFTP going where it was actively and verifiably moving files as-commanded, I did in fact try renaming files.

Using TFTP on the GS110TPP, GETting from an Ubuntu-hosted TFTP server on my LAN, changing the stock Netgear fw. file name from the official GS108T_110TP_TPP_V7.0.8.4.bix to testimage.bin yielded a successful TFTP GET, leading me to believe (almost presume) that it is checking a hash of the file contents, not just the filename:

GS110TPP# copy tftp://192.168.1.30/testimage.bin  flash://image1
Downloading file. Please wait...
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Upgrade firmware success. Do you want to reboot now? (y/n)n

EDIT:

But maybe it's nothing to do with hashes/checksums and indeed it's just a version ID or similar that could be changed in the OpenWRT image to satisfy the Netgear firmware updater.

bmork · February 15, 2024, 7:37am

This is not uncommon as you'll see if you grep for UIMAGE_NAME in the OpenWrt source. It's probably intended to protect users against installing too old firmware on newer hardware revisions. They have no need to prevent image modification.

johnsmith31 · February 15, 2024, 7:48am

So,

Changing UIMAGE_NAME := 2.2.2.0 to UIMAGE_NAME := 7.0.9.19 is something I need to set in the source code and then recompile, yes? It's not something that can be implemented as an option in the firmware-builder utility?

I'm not a developer so I don't understand (as yet) the mechanics of attempting a custom build.

If it's easy for someone to do I'd be happy to be a beta-tester for it.

bmork · February 15, 2024, 7:59am

That's correct. Or rather, there is no UIMAGE_NAME to change. You have to add it to the Netgear GS110TPP image rule build the firmware from scratch.

It is possible to binary edit the header of an existing image as an alternative, I don't know any tools that will let you do that in an easy way, but there might be some in the OpenWrt toolbox. Maybe someone else knows? You'll have to update the header checksum too, so doing a manual edit is a hassle.

johnsmith31 · February 15, 2024, 8:03am

I understand what's needed but it's not in my wheelhouse, i.e. I don't have the dev skills. Maybe a dev with some time to spare wouldn't mind helping out with this. The GS110TPP is listed as 'supported' and there's a firmware built for it already, but I don't see any custom installation instructions for it separate from the GS108Tv3.

If the binary-edit method worked reliably that'd be fine as it could just be added to the OpenWRT installation notes for the GS108Tv3. That's also not something I know how to do.

johnsmith31 · February 15, 2024, 9:15am

I poked around using a hex editor to compare 4 different versions of the Netgear firmware. Location of the version number is very consistent, but yes, changing a single digit of the version number causes a Flash image is invalid error when attempting to TFTP-update.

I'm not sure how or where the checksum gets stored in the binary file. Didn't find any human-readable text in the file besides the version number at the start.

bmork · February 15, 2024, 10:20am

I don't think that is necessary. If we can figure out how to build an image which just works, then users don't have to do anything special. If my assumption is correct, then all we need is a successful test of a modified image.

IYou can find a test image at
https://www.mork.no/~bjorn/xx/openwrt-realtek-rtl838x-netgear_gs110tpp-v1-initramfs-kernel-v9.9.9.9.bin

The sha256sum is
a76d53d469c4d81c45cff0bff313e0073881c49bb750c44e877a9c04ab4f1123 openwrt-realtek-rtl838x-netgear_gs110tpp-v1-initramfs-kernel-v9.9.9.9.bin

This is an initramfs image for the GS110TPP v1 built with

UIMAGE_NAME := 9.9.9.9

Note that this is a snapshot build from the head of the current master branch. So there is no LuCi or anything else. You have to log in using ssh and then use sysupgrade to install a proper OpenWrt image. Installing a 23.05.2 sysupgrade image should work fine. In theory.

No guarantees about anything... I have tested a similar image on a GS108Tv3 and it didn't break boot at least. But my switch is in a remote location, with console but only via the same switch... So I can't easily test OEM firmwares or initramfs images at the moment.

johnsmith31 · February 15, 2024, 10:45am

Thanks for your efforts, definite progress:

This successfully installed using Netgear's command-line TFTP. (Though I suspect it would also have worked fine via the browser upgrade interface.)
Upon switching the live fw image selector within the Netgear GUI, I rebooted, and can successfully ping & initiate an ssh connection to the device over the LAN at 192.168.1.1.

It's getting late now so I will proceed w/ the next phase, sysupgrade, tomorrow.

-- EDIT: deleted previous text re: "root password," I had left my Wifi adapter also active and was trying to ssh into the wrong device. (!).

johnsmith31 · February 15, 2024, 12:52pm

Update: TL;DR, stuck in recovery mode. Regardless of what I do at the shell prompt after logging in via SSH, upon rebooting it reverts to your test image.

First attempt, using a custom-configured firmware that simply omitted the firewall package (no other customizations):

root@OpenWrt:/tmp# sysupgrade -v openwrt-23.05.2-0e2918ed85b9-realtek-rtl838x-netgear_gs110tpp-v1-squashfs-sysupgrade.bin
Cannot save config while running from ramdisk.
Wed Feb 14 15:54:20 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.

Subsequent attempts I used a stock / plain 23.05.2 image, first with -v, then -n, and finally even -F. Note, the hour timestamps are not in the correct sequence, but the actual commands / files used are listed in the sequence I used them. I did at least (2) 10-second cold reboots before doing the 3rd and 4th attempts.

Additional sysupgrade attempts

root@OpenWrt:/tmp# sysupgrade -v openwrt-23.05.2-realtek-rtl838x-netgear_gs110tpp-v1-squashfs-sysupgrade.bin
Cannot save config while running from ramdisk.
Wed Feb 14 15:40:27 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.

----

root@OpenWrt:/tmp# sysupgrade -n openwrt-23.05.2-realtek-rtl838x-netgear_gs110tpp-v1-squashfs-sysupgrade.bin
Wed Feb 14 15:41:40 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.
-------

root@OpenWrt:/tmp# sysupgrade -F openwrt-23.05.2-realtek-rtl838x-netgear_gs110tpp-v1-squashfs-sysupgrade.bin
Cannot save config while running from ramdisk.
Wed Feb 14 15:33:26 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.

There was nothing in /sys/fs/pstore:

root@OpenWrt:~# cat /sys/fs/pstore/*
cat: can't open '/sys/fs/pstore/*': No such file or directory

Here is dmesg output. Advice/suggestion on what to try next?

Full dmesg output

root@OpenWrt:~# dmesg
[    0.000000] Linux version 5.15.148 (bjorn@canardo) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r25153-869df9ecdf0a) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Wed Feb 14 15:22:53 2024
[    0.000000] RTL838X model is 83806800
[    0.000000] SoC Type: RTL8380
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019070 (MIPS 4KEc)
[    0.000000] MIPS: machine is Netgear GS110TPP v1
[    0.000000] earlycon: ns16550a0 at MMIO 0x18002000 (options '115200n8')
[    0.000000] printk: bootconsole [ns16550a0] enabled
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Using appended Device Tree.
[    0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: earlycon
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 110776K/131072K available (6013K kernel code, 608K rwdata, 1328K rodata, 10796K init, 209K bss, 20296K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] rtl83xx-clk: initialized, CPU 500 MHz, MEM 300 MHz (8 Bit DDR3), LXB 200 MHz
[    0.000000] clocksource: realtek_otto_timer: mask: 0xfffffff max_cycles: 0xfffffff, max_idle_ns: 38225208801 ns
[    0.000005] sched_clock: 28 bits at 3125kHz, resolution 320ns, wraps every 42949672800ns
[    0.009326] Calibrating delay loop... 498.89 BogoMIPS (lpj=2494464)
[    0.136015] pid_max: default: 32768 minimum: 301
[    0.143594] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.151865] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.181247] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.192287] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.200449] pinctrl core: initialized pinctrl subsystem
[    0.209802] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.255477] rtl83xx-clk clock-controller: rate setting enabled, CPU 300-625 MHz, MEM 300-300 MHz, LXB 200-200 MHz, OVERCLOCK AT OWN RISK
[    0.273868] clocksource: Switched to clocksource realtek_otto_timer
[    0.284761] NET: Registered PF_INET protocol family
[    0.290862] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.300842] tcp_listen_portaddr_hash hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.310438] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.319193] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.327870] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.335856] TCP: Hash tables configured (established 1024 bind 1024)
[    0.343541] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.351028] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.359895] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.444805] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.466751] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.473287] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.540126] pinctrl-single 1b001000.pinmux: 32 pins, size 4
[    0.547514] pinctrl-single 1b00a000.pinmux: 32 pins, size 4
[    0.556563] Probing RTL8231 GPIOs
[    0.560292] rtl8231_init called, MDIO bus ID: 31
[    0.568346] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.577798] printk: console [ttyS0] disabled
[    0.582700] 18002000.uart: ttyS0 at MMIO 0x18002000 (irq = 31, base_baud = 12500000) is a 16550A
[    0.592644] printk: console [ttyS0] enabled
[    0.602136] printk: bootconsole [early0] disabled
[    0.612766] printk: bootconsole [ns16550a0] disabled
[    0.625559] 18002100.uart: ttyS1 at MMIO 0x18002100 (irq = 30, base_baud = 12500000) is a 16550A
[    0.842733] brd: module loaded
[    0.866418] spi-nor spi0.0: w25q256 (32768 Kbytes)
[    0.871924] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.879228] OF: Bad cell count for /soc/spi@1200/flash@0/partitions
[    0.886424] OF: Bad cell count for /soc/spi@1200/flash@0/partitions
[    0.894198] Creating 7 MTD partitions on "spi0.0":
[    0.899612] 0x000000000000-0x0000000e0000 : "u-boot"
[    0.944858] 0x0000000e0000-0x0000000f0000 : "u-boot-env"
[    0.964770] 0x0000000f0000-0x000000100000 : "u-boot-env2"
[    0.984880] 0x000000100000-0x000000200000 : "jffs"
[    0.993671] 0x000000200000-0x000000300000 : "jffs2"
[    1.014853] 0x000000300000-0x000001180000 : "firmware"
[    1.035939] 2 uimage-fw partitions found on MTD device firmware
[    1.042606] Creating 2 MTD partitions on "firmware":
[    1.048420] 0x000000000000-0x000000240000 : "kernel"
[    1.074838] 0x000000240000-0x000000e80000 : "rootfs"
[    1.083524] mtd: setting mtd7 (rootfs) as root device
[    1.104255] 1 squashfs-split partitions found on MTD device rootfs
[    1.111363] 0x0000004f0000-0x000000e80000 : "rootfs_data"
[    1.135018] 0x000001180000-0x000002000000 : "runtime2"
[    1.168915] Probing RTL838X eth device pdev: 82094000, dev: 82094010
[    1.226664] Found SoC ID: 8380: RTL8380, family 8380
[    1.232375] rtl8380_init_mac
[    1.235770] Using MAC 0000000000010000
[    1.570246] Realtek RTL8218B (internal) mdio-bus:08: Detected internal RTL8218B
[    1.578556] Firmware loaded. Size 1184, magic: 83808380
[    2.404688] Realtek RTL8218B (internal) mdio-bus:08: ERROR: Port 8 not ready for patch.
[    2.413671] Realtek RTL8218B (internal): probe of mdio-bus:08 failed with error -1
[    2.731998] Realtek RTL8214C mdio-bus:10: Detected external RTL8214C
[    2.790826] i2c_dev: i2c /dev entries driver
[    2.806395] NET: Registered PF_INET6 protocol family
[    2.848279] Segment Routing with IPv6
[    2.852630] In-situ OAM (IOAM) with IPv6
[    2.857552] NET: Registered PF_PACKET protocol family
[    2.864334] 8021q: 802.1Q VLAN Support v1.8
[    3.214373] Realtek RTL8218B (internal) rtl838x slave mii-0:08: Detected internal RTL8218B
[    3.223658] Firmware loaded. Size 1184, magic: 83808380
[    4.045070] Realtek RTL8218B (internal) rtl838x slave mii-0:08: ERROR: Port 8 not ready for patch.
[    4.055207] Realtek RTL8218B (internal): probe of rtl838x slave mii-0:08 failed with error -1
[    4.371524] Realtek RTL8214C rtl838x slave mii-0:10: Detected external RTL8214C
[    4.544771] Realtek RTL8380 SERDES rtl838x slave mii-0:18: Detected internal RTL8380 SERDES
[    4.554281] Firmware loaded. Size 1184, magic: 83808380
[    4.560192] SDS power down value: 3
[    4.588224] PLL control register: efffffff
[    4.592863] SDS power down value now: 3f
[    4.597354] Configuration of SERDES done
[    4.900666] In rtl83xx_vlan_setup
[    4.904547] UNKNOWN_MC_PMASK: 000000001fffffff
[    4.909546] VLAN profile 0: L2 learning: 1, UNKN L2MC FLD PMSK 511, 		UNKN IPMC FLD PMSK 511, UNKN IPv6MC FLD PMSK: 511
[    5.943898] rtl83xx_enable_phy_polling:            3ff00
[    6.984675] rtl83xx-switch switch@1b000000: configuring for fixed/internal link mode
[    6.994366] rtl83xx-switch switch@1b000000: Link is Up - 1Gbps/Full - flow control off
[    7.005399] rtl83xx-switch switch@1b000000 lan1 (uninitialized): PHY [mdio-bus:08] driver [Generic PHY] (irq=POLL)
[    7.023207] rtl83xx-switch switch@1b000000 lan2 (uninitialized): PHY [mdio-bus:09] driver [Realtek RTL8218B (internal)] (irq=POLL)
[    7.040125] rtl83xx-switch switch@1b000000 lan3 (uninitialized): PHY [mdio-bus:0a] driver [Realtek RTL8218B (internal)] (irq=POLL)
[    7.060475] rtl83xx-switch switch@1b000000 lan4 (uninitialized): PHY [mdio-bus:0b] driver [Realtek RTL8218B (internal)] (irq=POLL)
[    7.077657] rtl83xx-switch switch@1b000000 lan5 (uninitialized): PHY [mdio-bus:0c] driver [Realtek RTL8218B (internal)] (irq=POLL)
[    7.097907] rtl83xx-switch switch@1b000000 lan6 (uninitialized): PHY [mdio-bus:0d] driver [Realtek RTL8218B (internal)] (irq=POLL)
[    7.115101] rtl83xx-switch switch@1b000000 lan7 (uninitialized): PHY [mdio-bus:0e] driver [Realtek RTL8218B (internal)] (irq=POLL)
[    7.135592] rtl83xx-switch switch@1b000000 lan8 (uninitialized): PHY [mdio-bus:0f] driver [Realtek RTL8218B (internal)] (irq=POLL)
[    7.164436] rtl83xx-switch switch@1b000000 lan9 (uninitialized): PHY [mdio-bus:10] driver [Realtek RTL8214C] (irq=POLL)
[    7.192247] rtl83xx-switch switch@1b000000 lan10 (uninitialized): PHY [mdio-bus:11] driver [Realtek RTL8214C] (irq=POLL)
[    7.206973] DSA: tree 0 setup
[    7.210407] LINK state irq: 20
[    7.214025] In rtl83xx_setup_qos
[    7.217665] Setting up RTL838X QoS
[    7.221463] RTL838X_PRI_SEL_TBL_CTRL(i): 00033112
[    7.226818] Current Intprio2queue setting: 00000000
[    7.232298] QM_PKT2CPU_INTPRI_MAP: 00fac688
[    7.237291] rtl838x_dbgfs_init called
[    7.241536] rtl83xx_fib_event_work_do: FIB4 default rule failed
[    7.377756] Freeing unused kernel image (initmem) memory: 10796K
[    7.384642] This architecture does not have kernel memory protection.
[    7.391887] Run /init as init process
[    7.396080]   with arguments:
[    7.399426]     /init
[    7.401969]   with environment:
[    7.405571]     HOME=/
[    7.408244]     TERM=linux
[    8.529968] init: Console is alive
[    8.535107] init: - watchdog -
[    8.576314] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    8.599195] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    8.618544] init: - preinit -
[    9.298743] random: jshn: uninitialized urandom read (4 bytes read)
[    9.460295] random: jshn: uninitialized urandom read (4 bytes read)
[   10.791128] random: jshn: uninitialized urandom read (4 bytes read)
[   10.889992] random: jshn: uninitialized urandom read (4 bytes read)
[   11.035485] random: jshn: uninitialized urandom read (4 bytes read)
[   11.634072] RESETTING 8380, CPU_PORT 28
[   11.839240] rtl838x-eth 1b00a300.ethernet eth0: configuring for fixed/internal link mode
[   11.848301] In rtl838x_mac_config, mode 1
[   11.855990] rtl83xx-switch switch@1b000000 lan1: configuring for phy/internal link mode
[   11.865287] rtl838x-eth 1b00a300.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
[   11.875003] 8021q: adding VLAN 0 to HW filter on device lan1
[   11.881936] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   11.889161] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   11.896752] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   11.930031] rtl83xx_fib_event_work_do: FIB4 failed
[   11.939240] rtl83xx_fib_event_work_do: FIB4 failed
[   11.954128] rtl83xx_fib_event_work_do: FIB4 failed
[   11.965931] random: procd: uninitialized urandom read (4 bytes read)
[   13.783984] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   14.338893] rtl83xx_fib4_del: no such gateway: 0.0.0.0
[   14.348465] rtl83xx_fib4_del: no such gateway: 0.0.0.0
[   14.364044] rtl83xx_fib4_del: no such gateway: 0.0.0.0
[   14.413954] procd: - early -
[   14.417992] procd: - watchdog -
[   15.269949] procd: - watchdog -
[   15.274951] procd: - ubus -
[   15.299466] random: ubusd: uninitialized urandom read (4 bytes read)
[   15.329720] random: ubusd: uninitialized urandom read (4 bytes read)
[   15.337820] random: ubusd: uninitialized urandom read (4 bytes read)
[   15.357472] procd: - init -
[   16.585971] random: jshn: uninitialized urandom read (4 bytes read)
[   16.888079] kmodloader: loading kernel modules from /etc/modules.d/*
[   16.908450] GACT probability on
[   16.927154] Mirror/redirect action on
[   16.987284] u32 classifier
[   16.990356]     input device check on
[   16.994567]     Actions configured
[   17.374592] kmodloader: done loading kernel modules from /etc/modules.d/*
[   19.494683] urngd: v1.0.2 started.
[   23.064736] random: crng init done
[   23.068577] random: 24 urandom warning(s) missed due to ratelimiting
[   25.833400] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   53.715414] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   53.828995] in rtl838x_eth_stop
[   53.832796] rtl838x-eth 1b00a300.ethernet eth0: Link is Down
[   54.354470] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   54.361896] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   54.369440] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   54.376959] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   55.693277] Using MAC 000080cc9c97fa0c
[   55.713799] RESETTING 8380, CPU_PORT 28
[   55.918969] rtl838x-eth 1b00a300.ethernet eth0: configuring for fixed/internal link mode
[   55.928029] In rtl838x_mac_config, mode 1
[   55.933076] rtl838x-eth 1b00a300.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
[   55.954076] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   55.961232] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   55.968864] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   56.317261] rtl83xx-switch switch@1b000000 lan1: configuring for phy/internal link mode
[   56.359635] 8021q: adding VLAN 0 to HW filter on device lan1
[   56.383066] switch: port 1(lan1) entered blocking state
[   56.389082] switch: port 1(lan1) entered disabled state
[   56.395874] device lan1 entered promiscuous mode
[   56.401080] device eth0 entered promiscuous mode
[   56.499624] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   56.536446] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   57.004645] rtl83xx-switch switch@1b000000 lan2: configuring for phy/internal link mode
[   57.020638] 8021q: adding VLAN 0 to HW filter on device lan2
[   57.077077] switch: port 2(lan2) entered blocking state
[   57.082983] switch: port 2(lan2) entered disabled state
[   57.104327] device lan2 entered promiscuous mode
[   57.304227] rtl83xx-switch switch@1b000000 lan3: configuring for phy/internal link mode
[   57.315074] 8021q: adding VLAN 0 to HW filter on device lan3
[   57.376970] switch: port 3(lan3) entered blocking state
[   57.382870] switch: port 3(lan3) entered disabled state
[   57.404902] device lan3 entered promiscuous mode
[   57.624193] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   57.631647] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   57.640825] rtl83xx-switch switch@1b000000 lan4: configuring for phy/internal link mode
[   57.674271] 8021q: adding VLAN 0 to HW filter on device lan4
[   57.758318] switch: port 4(lan4) entered blocking state
[   57.764330] switch: port 4(lan4) entered disabled state
[   57.808780] device lan4 entered promiscuous mode
[   57.978162] RTL8380 Link change: status: 1, ports 1000
[   58.107249] rtl83xx-switch switch@1b000000 lan5: configuring for phy/internal link mode
[   58.139565] 8021q: adding VLAN 0 to HW filter on device lan5
[   58.225600] switch: port 5(lan5) entered blocking state
[   58.231497] switch: port 5(lan5) entered disabled state
[   58.264350] device lan5 entered promiscuous mode
[   58.475724] rtl83xx-switch switch@1b000000 lan6: configuring for phy/internal link mode
[   58.504380] 8021q: adding VLAN 0 to HW filter on device lan6
[   58.564998] switch: port 6(lan6) entered blocking state
[   58.570895] switch: port 6(lan6) entered disabled state
[   58.577805] device lan6 entered promiscuous mode
[   58.791661] rtl83xx-switch switch@1b000000 lan7: configuring for phy/internal link mode
[   58.821897] 8021q: adding VLAN 0 to HW filter on device lan7
[   58.870343] switch: port 7(lan7) entered blocking state
[   58.876361] switch: port 7(lan7) entered disabled state
[   58.883161] device lan7 entered promiscuous mode
[   59.084221] rtl83xx-switch switch@1b000000 lan8: configuring for phy/internal link mode
[   59.104273] 8021q: adding VLAN 0 to HW filter on device lan8
[   59.177333] switch: port 8(lan8) entered blocking state
[   59.183234] switch: port 8(lan8) entered disabled state
[   59.190179] device lan8 entered promiscuous mode
[   59.384212] rtl83xx-switch switch@1b000000 lan9: configuring for phy/qsgmii link mode
[   59.404271] 8021q: adding VLAN 0 to HW filter on device lan9
[   59.468598] switch: port 9(lan9) entered blocking state
[   59.474612] switch: port 9(lan9) entered disabled state
[   59.481459] device lan9 entered promiscuous mode
[   59.633224] rtl83xx-switch switch@1b000000 lan10: configuring for phy/qsgmii link mode
[   59.642932] 8021q: adding VLAN 0 to HW filter on device lan10
[   59.680773] switch: port 10(lan10) entered blocking state
[   59.686972] switch: port 10(lan10) entered disabled state
[   59.694181] device lan10 entered promiscuous mode
[   59.717077] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   61.198802] RTL8380 Link change: status: 1, ports 1000
[   61.387697] rtl83xx-switch switch@1b000000 lan5: Link is Up - 1Gbps/Full - flow control off
[   61.456685] switch: port 5(lan5) entered blocking state
[   61.462588] switch: port 5(lan5) entered forwarding state
[   61.524064] IPv6: ADDRCONF(NETDEV_CHANGE): switch: link becomes ready
[   61.569870] IPv6: ADDRCONF(NETDEV_CHANGE): switch.1: link becomes ready
[   63.544095] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[   63.551558] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  105.038833] RTL8380 Link change: status: 1, ports 100
[  105.390284] rtl83xx-switch switch@1b000000 lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[  105.400020] switch: port 1(lan1) entered blocking state
[  105.406051] switch: port 1(lan1) entered forwarding state
[  177.546399] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  177.564636] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  177.573007] rtl83xx_fib4_del: found a route with id 1, nh-id 0
[  177.579754] rtl83xx-switch switch@1b000000: unknown nexthop, id 0
[  177.603501] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  177.611088] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  177.618630] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  177.628212] rtl83xx-switch switch@1b000000: unknown nexthop, id 0
[  177.644074] rtl83xx_fib4_del: no such gateway: 0.0.0.0
[  177.674586] switch: port 5(lan5) entered disabled state
[  177.680787] switch: port 1(lan1) entered disabled state
[  177.725376] device lan1 left promiscuous mode
[  177.730619] switch: port 1(lan1) entered disabled state
[  177.754374] rtl83xx-switch switch@1b000000 lan1: Link is Down
[  177.772734] RTL8380 Link change: status: 1, ports 100
[  177.851335] device lan10 left promiscuous mode
[  177.856807] switch: port 10(lan10) entered disabled state
[  177.948904] device lan2 left promiscuous mode
[  177.954314] switch: port 2(lan2) entered disabled state
[  178.044631] device lan3 left promiscuous mode
[  178.049879] switch: port 3(lan3) entered disabled state
[  178.143249] device lan4 left promiscuous mode
[  178.148623] switch: port 4(lan4) entered disabled state
[  178.238278] device lan5 left promiscuous mode
[  178.243524] switch: port 5(lan5) entered disabled state
[  178.252479] rtl83xx-switch switch@1b000000 lan5: Link is Down
[  178.275592] RTL8380 Link change: status: 1, ports 1000
[  178.349184] device lan6 left promiscuous mode
[  178.354570] switch: port 6(lan6) entered disabled state
[  178.444174] device lan7 left promiscuous mode
[  178.449428] switch: port 7(lan7) entered disabled state
[  178.540135] device lan8 left promiscuous mode
[  178.545505] switch: port 8(lan8) entered disabled state
[  178.724304] device lan9 left promiscuous mode
[  178.729594] switch: port 9(lan9) entered disabled state
[  178.784120] device eth0 left promiscuous mode
[  178.796133] in rtl838x_eth_stop
[  178.800679] rtl838x-eth 1b00a300.ethernet eth0: Link is Down
[  179.317083] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  179.324631] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  179.332025] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  179.339557] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  179.705828] rtl83xx_fib4_del: no such gateway: 0.0.0.0
[  179.711648] rtl83xx_fib4_del: no such gateway: 0.0.0.0
[  179.720371] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  179.727948] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  179.764000] rtl83xx_fib4_del: no such gateway: 0.0.0.0
[  183.994670] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  184.062914] Using MAC 000080cc9c97fa0c
[  184.074997] RESETTING 8380, CPU_PORT 28
[  184.280170] rtl838x-eth 1b00a300.ethernet eth0: configuring for fixed/internal link mode
[  184.289230] In rtl838x_mac_config, mode 1
[  184.294475] rtl838x-eth 1b00a300.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
[  184.303788] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[  184.311037] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  184.318641] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  184.516428] rtl83xx-switch switch@1b000000 lan1: configuring for phy/internal link mode
[  184.537345] 8021q: adding VLAN 0 to HW filter on device lan1
[  184.550663] switch: port 1(lan1) entered blocking state
[  184.556690] switch: port 1(lan1) entered disabled state
[  184.563288] device lan1 entered promiscuous mode
[  184.568637] device eth0 entered promiscuous mode
[  184.619755] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  184.636192] Not offloading default route for now
[  184.647254] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  184.984553] rtl83xx-switch switch@1b000000 lan2: configuring for phy/internal link mode
[  185.024485] 8021q: adding VLAN 0 to HW filter on device lan2
[  185.074257] switch: port 2(lan2) entered blocking state
[  185.080161] switch: port 2(lan2) entered disabled state
[  185.104220] device lan2 entered promiscuous mode
[  185.294282] rtl83xx-switch switch@1b000000 lan3: configuring for phy/internal link mode
[  185.332090] 8021q: adding VLAN 0 to HW filter on device lan3
[  185.386975] switch: port 3(lan3) entered blocking state
[  185.392940] switch: port 3(lan3) entered disabled state
[  185.414290] device lan3 entered promiscuous mode
[  185.614243] rtl83xx-switch switch@1b000000 lan4: configuring for phy/internal link mode
[  185.654299] 8021q: adding VLAN 0 to HW filter on device lan4
[  185.737712] switch: port 4(lan4) entered blocking state
[  185.743611] switch: port 4(lan4) entered disabled state
[  185.774230] device lan4 entered promiscuous mode
[  186.074224] rtl83xx-switch switch@1b000000 lan5: configuring for phy/internal link mode
[  186.134276] 8021q: adding VLAN 0 to HW filter on device lan5
[  186.230606] switch: port 5(lan5) entered blocking state
[  186.236627] switch: port 5(lan5) entered disabled state
[  186.274403] device lan5 entered promiscuous mode
[  186.281156] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  186.288789] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  186.544214] rtl83xx-switch switch@1b000000 lan6: configuring for phy/internal link mode
[  186.584255] 8021q: adding VLAN 0 to HW filter on device lan6
[  186.659689] switch: port 6(lan6) entered blocking state
[  186.665703] switch: port 6(lan6) entered disabled state
[  186.672349] device lan6 entered promiscuous mode
[  186.894222] rtl83xx-switch switch@1b000000 lan7: configuring for phy/internal link mode
[  186.934266] 8021q: adding VLAN 0 to HW filter on device lan7
[  187.006332] switch: port 7(lan7) entered blocking state
[  187.012238] switch: port 7(lan7) entered disabled state
[  187.019067] device lan7 entered promiscuous mode
[  187.214218] rtl83xx-switch switch@1b000000 lan8: configuring for phy/internal link mode
[  187.254256] 8021q: adding VLAN 0 to HW filter on device lan8
[  187.321602] switch: port 8(lan8) entered blocking state
[  187.327610] switch: port 8(lan8) entered disabled state
[  187.334507] device lan8 entered promiscuous mode
[  187.534226] rtl83xx-switch switch@1b000000 lan9: configuring for phy/qsgmii link mode
[  187.565492] 8021q: adding VLAN 0 to HW filter on device lan9
[  187.601776] switch: port 9(lan9) entered blocking state
[  187.607788] switch: port 9(lan9) entered disabled state
[  187.614718] device lan9 entered promiscuous mode
[  187.709290] rtl83xx-switch switch@1b000000 lan10: configuring for phy/qsgmii link mode
[  187.729647] 8021q: adding VLAN 0 to HW filter on device lan10
[  187.766485] switch: port 10(lan10) entered blocking state
[  187.772583] switch: port 10(lan10) entered disabled state
[  187.779698] device lan10 entered promiscuous mode
[  187.801160] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  189.074178] RTL8380 Link change: status: 1, ports 1000
[  189.392655] rtl83xx-switch switch@1b000000 lan5: Link is Up - 1Gbps/Full - flow control off
[  189.445795] switch: port 5(lan5) entered blocking state
[  189.451698] switch: port 5(lan5) entered forwarding state
[  189.494110] IPv6: ADDRCONF(NETDEV_CHANGE): switch: link becomes ready
[  189.524164] IPv6: ADDRCONF(NETDEV_CHANGE): switch.1: link becomes ready
[  190.744718] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported
[  190.752178] rtl83xx_fib_event: FIB_RULE ADD/DEL for IPv6 not supported

bmork · February 15, 2024, 1:09pm

What does fw_printsys say? If it says bootpartition=1 then try

fw_setsys bootpartition 0

I thought maybe we fixed that up automatically, but maybe we don't?

johnsmith31 · February 15, 2024, 1:21pm

It looks like maybe it's not copying the sysupgrade firmware to either of the boot partitions?

root@OpenWrt:~#  fw_printsys
bootpartition=1
SN=0987654321
dualfname1=openwrt-realtek-rtl838x-netgear_gs110tpp-v1-initramfs-kernel-v9.9.9.9.bin

root@OpenWrt:~# fw_setsys bootpartition 0
root@OpenWrt:~# reboot

Then, after a warm reboot, this output:

root@OpenWrt:~# fw_printsys
SN=0987654321
dualfname1=openwrt-realtek-rtl838x-netgear_gs110tpp-v1-initramfs-kernel-v9.9.9.9.bin
bootpartition=0

(Verified same with a cold reboot just in case, no change.)

FWIW: I just came across this very similar thread for a GS308Tv3. It seems like the fw_setsys bootpartition 0 worked for them.

EDIT 1:
I think what I might need to do now is re-attempt sysupgrade -n now that the system is set to partition 0 for boot. Certainly can't hurt to try.

EDIT 2:
I tried another round of sysupgrade -n and it made no difference. Same behavior, same fw_printsys output.

bmork · February 15, 2024, 7:18pm

This is weird. Let's collect the current state and see where we are.

Verify what's installed in the two partitions (named "firmware" and "runtime2"). Example from my GS108Tv3:

root@gs108tv3:~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 000e0000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "u-boot-env2"
mtd3: 00100000 00010000 "jffs"
mtd4: 00100000 00010000 "jffs2"
mtd5: 00e80000 00010000 "firmware"
mtd6: 00260000 00010000 "kernel"
mtd7: 00c20000 00010000 "rootfs"
mtd8: 00a60000 00010000 "rootfs_data"
mtd9: 00e80000 00010000 "runtime2"
root@gs108tv3:~# hexdump -C -n 100 /dev/mtd5ro
00000000  4e 47 45 20 65 22 51 20  65 cc da cd 00 25 33 80  |NGE e"Q e....%3.|
00000010  80 10 00 00 80 10 00 00  b0 6e 49 f8 05 05 02 03  |.........nI.....|
00000020  39 2e 39 2e 39 2e 39 00  00 00 00 00 00 00 00 00  |9.9.9.9.........|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  6d 00 00 80 00 d2 79 80  00 00 00 00 00 00 04 06  |m.....y.........|
00000050  c8 ea 00 07 04 9d ab e3  d2 04 76 d3 7c 75 ec 50  |..........v.|u.P|
00000060  f1 28 71 27                                       |.(q'|
00000064
root@gs108tv3:~# hexdump -C -n 100 /dev/mtd9ro
00000000  4e 47 45 20 11 45 09 fd  5f 4f d1 d8 00 8e 05 13  |NGE .E.._O......|
00000010  80 00 00 00 80 2d 48 b0  0d b9 20 5e 05 05 02 03  |.....-H... ^....|
00000020  37 2e 30 2e 34 2e 38 00  00 00 00 00 00 00 00 00  |7.0.4.8.........|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  5d 00 00 00 04 ff ff ff  ff ff ff ff ff 00 00 6f  |]..............o|
00000050  fd ff ff a3 b7 7f 63 c5  55 81 bd 5b 5e 9d 54 f7  |......c.U..[^.T.|
00000060  9d ec 67 91                                       |..g.|
00000064

You should see "MIPS OpenWrt" etc in the "firmware" partition. And I assume you have the 9.9.9.9 initramfs in "runtime2". With bootpartition=0 this should boot the "MIPS OpenWrt ..." image, which is split into "kernel", "rootfs" and "rootfs_data".

Let's verify that the rootfs and rootfs_data are as expected. They should look like this (same magic in the first 4 bytes):

root@gs108tv3:~# hexdump -C -n 32 /dev/mtd7ro
00000000  68 73 71 73 59 02 00 00  cd da cc 65 00 00 04 00  |hsqsY......e....|
00000010  16 00 00 00 04 00 12 00  c0 02 01 00 04 00 00 00  |................|
00000020
root@gs108tv3:~# hexdump -C -n 32 /dev/mtd8ro
00000000  19 85 20 03 00 00 00 0c  f0 60 dc 98 19 85 e0 01  |.. ......`......|
00000010  00 00 00 36 5d 44 48 fe  00 00 00 01 00 00 00 00  |...6]DH.........|
00000020

And the "rootfs" should be mounted with a writable overlay in "rootfs_data", looking like

root@gs108tv3:~# df -hT
Filesystem           Type            Size      Used Available Use% Mounted on
/dev/root            squashfs        1.8M      1.8M         0 100% /rom
tmpfs                tmpfs          59.3M    184.0K     59.1M   0% /tmp
/dev/mtdblock8       jffs2          10.4M    424.0K     10.0M   4% /overlay
overlayfs:/overlay   overlay        10.4M    424.0K     10.0M   4% /
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev

If everything looks just fine except for "df", then my best guess is that your bootloader verifies the version number in the header - rejecting the image in "firmware" as invalid. It would be extremely useful to have console output to verify that theory. But unfortunately that means soldering (or cheating with wires pressed against the board) on these switches.

Another way to test the theory is installing the matching 9.9.9.9 sysupgrade image I built. It will has the same limited functionality, but at least it will allow you to save files and install packages. But most importanly - if that works then we can assume the fix is required for newer Netgear switches regardless of installation method.

The "9.9.9.9" sysupgrade image is here: https://www.mork.no/~bjorn/xx/openwrt-realtek-rtl838x-netgear_gs110tpp-v1-squashfs-sysupgrade-v9.9.9.9.bin

sha256sum:

b64f82e7fabbbacd77a2614a92642af75c814daa4a9c5c59e8891969cf482894  openwrt-realtek-rtl838x-netgear_gs110tpp-v1-squashfs-sysupgrade-v9.9.9.9.bin

johnsmith31 · February 15, 2024, 8:49pm

TL;DR it works as expected after flashing your customized 9.9.9.9 sysupgrade image.

I was able to set a persistent IP address, do opkg update, then opkg istall luci. LuCi came right up and no longer has a warning about being booted from RAM, and LuCi also persists through reboots. Full logs at end of this post.

I am comfortable with soldering & getting a physical serial connection in place but at present I don't have the header pins needed. Do you know what diameter the pins (J1 holes) are? I haven't been able to find that clearly documented or stated elsewhere. It'll take a week or two for me to order & receive pins & get serial console in place.

Meantime I can set up the switch as intended for its basic use, i.e. simple VLAN'ing. I'm well advised that there is very little storage space on-device and that its CPU is not intended for routing, so I won't be doing any routing, firewalling, or running other extraneous services. (Router upstream from switch is an APU2E4 running the current version of OPNsense.)

I will reply further to this thread once I have a working serial console and can assist further with testing & debugging if / as needed.

Thanks for your ongoing work on this.

Logs follow below:

BEFORE flashing 9.9.9.9 sysupgrade image

BusyBox v1.36.1 (2023-11-14 13:38:11 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 23.05.2, r23630-842932a63d
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------

root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 000e0000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "u-boot-env2"
mtd3: 00100000 00010000 "jffs"
mtd4: 00100000 00010000 "jffs2"
mtd5: 00e80000 00010000 "firmware"
mtd6: 00240000 00010000 "kernel"
mtd7: 00c40000 00010000 "rootfs"
mtd8: 00990000 00010000 "rootfs_data"
mtd9: 00e80000 00010000 "runtime2"

root@OpenWrt:~# hexdump -C -n 100 /dev/mtd5ro
00000000  4e 47 45 20 23 5c f3 a4  65 53 78 43 00 23 c3 d1  |NGE #\..eSxC.#..|
00000010  80 10 00 00 80 10 00 00  4a db 1f dd 05 05 02 03  |........J.......|
00000020  4d 49 50 53 20 4f 70 65  6e 57 72 74 20 4c 69 6e  |MIPS OpenWrt Lin|
00000030  75 78 2d 35 2e 31 35 2e  31 33 37 00 00 00 00 00  |ux-5.15.137.....|
00000040  6d 00 00 80 00 f6 e2 79  00 00 00 00 00 00 04 07  |m......y........|
00000050  01 4e a0 07 04 9d ab e3  d4 03 7a d3 7c 75 ec 4f  |.N........z.|u.O|
00000060  6d 84 ef 7b                                       |m..{|
00000064

root@OpenWrt:~# hexdump -C -n 100 /dev/mtd9ro
00000000  4e 47 45 20 55 9e db ea  65 cc da cd 00 47 20 af  |NGE U...e....G .|
00000010  80 10 00 00 80 10 00 00  cb 07 97 81 05 05 02 03  |................|
00000020  39 2e 39 2e 39 2e 39 00  00 00 00 00 00 00 00 00  |9.9.9.9.........|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  6d 00 00 80 00 2a cc 14  01 00 00 00 00 00 04 06  |m....*..........|
00000050  c8 0b e0 07 04 9d ab e3  d4 03 7a d3 7c 75 ec 4f  |..........z.|u.O|
00000060  6d 84 ef 7b                                       |m..{|
00000064

root@OpenWrt:~# hexdump -C -n 32 /dev/mtd7ro
00000000  68 73 71 73 6b 04 00 00  43 78 53 65 00 00 04 00  |hsqsk...CxSe....|
00000010  29 00 00 00 04 00 12 00  c0 02 01 00 04 00 00 00  |)...............|
00000020

root@OpenWrt:~# hexdump -C -n 32 /dev/mtd8ro
00000000  19 85 20 03 00 00 00 0c  f0 60 dc 98 ff ff ff ff  |.. ......`......|
00000010  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000020

root@OpenWrt:~# df -hT
Filesystem           Type            Size      Used Available Use% Mounted on
/dev/root            squashfs        2.8M      2.8M         0 100% /rom
tmpfs                tmpfs          59.5M     32.0K     59.5M   0% /tmp
/dev/mtdblock8       jffs2           9.6M    420.0K      9.2M   4% /overlay
overlayfs:/overlay   overlay         9.6M    420.0K      9.2M   4% /
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev

root@OpenWrt:~# uname -a
Linux OpenWrt 5.15.137 #0 Tue Nov 14 13:38:11 2023 mips GNU/Linux

AFTER flashing 9.9.9.9 sysupgrade image

 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r25153-869df9ecdf0a
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 000e0000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "u-boot-env2"
mtd3: 00100000 00010000 "jffs"
mtd4: 00100000 00010000 "jffs2"
mtd5: 00e80000 00010000 "firmware"
mtd6: 00250000 00010000 "kernel"
mtd7: 00c30000 00010000 "rootfs"
mtd8: 009d0000 00010000 "rootfs_data"
mtd9: 00e80000 00010000 "runtime2"

root@OpenWrt:~# hexdump -C -n 100 /dev/mtd5ro
00000000  4e 47 45 20 c0 f3 3b 33  65 cc da cd 00 24 d3 5f  |NGE ..;3e....$._|
00000010  80 10 00 00 80 10 00 00  bf 47 30 79 05 05 02 03  |.........G0y....|
00000020  39 2e 39 2e 39 2e 39 00  00 00 00 00 00 00 00 00  |9.9.9.9.........|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  6d 00 00 80 00 2a 1c 7f  00 00 00 00 00 00 04 06  |m....*..........|
00000050  c8 0b e0 07 04 9d ab e3  d4 03 7a d3 7c 75 ec 4f  |..........z.|u.O|
00000060  6d 84 ef 7b                                       |m..{|
00000064

root@OpenWrt:~# hexdump -C -n 100 /dev/mtd9ro
00000000  4e 47 45 20 55 9e db ea  65 cc da cd 00 47 20 af  |NGE U...e....G .|
00000010  80 10 00 00 80 10 00 00  cb 07 97 81 05 05 02 03  |................|
00000020  39 2e 39 2e 39 2e 39 00  00 00 00 00 00 00 00 00  |9.9.9.9.........|
00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  6d 00 00 80 00 2a cc 14  01 00 00 00 00 00 04 06  |m....*..........|
00000050  c8 0b e0 07 04 9d ab e3  d4 03 7a d3 7c 75 ec 4f  |..........z.|u.O|
00000060  6d 84 ef 7b                                       |m..{|
00000064

root@OpenWrt:~# hexdump -C -n 32 /dev/mtd7ro
00000000  68 73 71 73 26 03 00 00  cd da cc 65 00 00 04 00  |hsqs&......e....|
00000010  1f 00 00 00 04 00 12 00  c0 02 01 00 04 00 00 00  |................|
00000020

root@OpenWrt:~# hexdump -C -n 32 /dev/mtd8ro
00000000  19 85 20 03 00 00 00 0c  f0 60 dc 98 ff ff ff ff  |.. ......`......|
00000010  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
00000020

root@OpenWrt:~# df -hT
Filesystem           Type            Size      Used Available Use% Mounted on
/dev/root            squashfs        2.5M      2.5M         0 100% /rom
tmpfs                tmpfs          59.4M    164.0K     59.2M   0% /tmp
tmpfs                tmpfs          59.4M     44.0K     59.3M   0% /tmp/root
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev
/dev/mtdblock8       jffs2           9.8M    412.0K      9.4M   4% /overlay
overlayfs:/overlay   overlay         9.8M    412.0K      9.4M   4% /

root@OpenWrt:~# uname -a
Linux OpenWrt 5.15.148 #0 Wed Feb 14 15:22:53 2024 mips GNU/Linux

Output and --> errors <-- during LuCi opkg update & install

BusyBox v1.36.1 (2024-02-14 15:22:53 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r25153-869df9ecdf0a
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~#
root@OpenWrt:~#
root@OpenWrt:~# opkg update
Downloading https://downloads.openwrt.org/snapshots/targets/realtek/rtl838x/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_core
Downloading https://downloads.openwrt.org/snapshots/targets/realtek/rtl838x/packages/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/custom/Packages.gz
*** Failed to download the package list from https://downloads.openwrt.org/snapshots/packages/mips_4kec/custom/Packages.gz

Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_luci
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_packages
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/packages/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/routing/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_routing
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/routing/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/telephony/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_telephony
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/telephony/Packages.sig
Signature check passed.
Collected errors:
 * opkg_download: Failed to download https://downloads.openwrt.org/snapshots/packages/mips_4kec/custom/Packages.gz, wget returned 8.
root@OpenWrt:~#
root@OpenWrt:~#
root@OpenWrt:~# opkg install luci
Installing luci (git-23.051.66410-a505bb1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci_git-23.051.66410-a505bb1_all.ipk
Installing luci-proto-ipv6 (git-23.355.78783-4ad5f81) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-proto-ipv6_git-23.355.78783-4ad5f81_all.ipk
Installing rpcd (2023-07-01-c07ab2f9-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/rpcd_2023-07-01-c07ab2f9-1_mips_4kec.ipk
Installing rpcd-mod-file (2023-07-01-c07ab2f9-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/rpcd-mod-file_2023-07-01-c07ab2f9-1_mips_4kec.ipk
Installing rpcd-mod-luci (20230123-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/rpcd-mod-luci_20230123-1_mips_4kec.ipk
Installing rpcd-mod-ucode (2023-07-01-c07ab2f9-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/rpcd-mod-ucode_2023-07-01-c07ab2f9-1_mips_4kec.ipk
Installing cgi-io (2022-08-10-901b0f04-21) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/packages/cgi-io_2022-08-10-901b0f04-21_mips_4kec.ipk
Installing ucode-mod-math (2024-02-13-3f9811d2-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/ucode-mod-math_2024-02-13-3f9811d2-1_mips_4kec.ipk
Installing ucode-mod-html (1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/ucode-mod-html_1_mips_4kec.ipk
Installing liblucihttp0 (2023-03-15-9b5b683f-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/liblucihttp0_2023-03-15-9b5b683f-1_mips_4kec.ipk
Installing liblucihttp-ucode (2023-03-15-9b5b683f-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/liblucihttp-ucode_2023-03-15-9b5b683f-1_mips_4kec.ipk
Installing luci-base (git-24.040.70477-23ebdb3) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-base_git-24.040.70477-23ebdb3_mips_4kec.ipk
Installing luci-app-firewall (git-23.364.10482-c74c861) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-app-firewall_git-23.364.10482-c74c861_all.ipk
Installing libiwinfo-data (2023-11-19-a34977c0-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/libiwinfo-data_2023-11-19-a34977c0-1_mips_4kec.ipk
Installing libiwinfo20230701 (2023-11-19-a34977c0-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/libiwinfo20230701_2023-11-19-a34977c0-1_mips_4kec.ipk
Installing rpcd-mod-iwinfo (2023-07-01-c07ab2f9-1) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/rpcd-mod-iwinfo_2023-07-01-c07ab2f9-1_mips_4kec.ipk
Installing luci-mod-status (git-24.042.72310-eb6b2bd) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-mod-status_git-24.042.72310-eb6b2bd_mips_4kec.ipk
Installing luci-mod-system (git-23.364.85099-cbfa9ca) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-mod-system_git-23.364.85099-cbfa9ca_all.ipk
Installing luci-mod-network (git-24.045.70819-05af14b) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-mod-network_git-24.045.70819-05af14b_all.ipk
Installing luci-mod-admin-full (git-19.253.48496-3f93650) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-mod-admin-full_git-19.253.48496-3f93650_all.ipk
Installing luci-proto-ppp (git-21.158.38888-88b9d84) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-proto-ppp_git-21.158.38888-88b9d84_all.ipk
Installing luci-theme-bootstrap (git-23.346.66252-9ce280a) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-theme-bootstrap_git-23.346.66252-9ce280a_all.ipk
Installing rpcd-mod-rrdns (20170710) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/rpcd-mod-rrdns_20170710_mips_4kec.ipk
Installing uhttpd (2023-06-25-34a8a74d-3) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/uhttpd_2023-06-25-34a8a74d-3_mips_4kec.ipk
Installing uhttpd-mod-ubus (2023-06-25-34a8a74d-3) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/base/uhttpd-mod-ubus_2023-06-25-34a8a74d-3_mips_4kec.ipk
Installing luci-light (git-23.024.33244-34dee82) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-light_git-23.024.33244-34dee82_all.ipk
Installing luci-app-opkg (git-24.041.08693-c80ca79) to root...
Downloading https://downloads.openwrt.org/snapshots/packages/mips_4kec/luci/luci-app-opkg_git-24.041.08693-c80ca79_all.ipk
Configuring liblucihttp0.
Configuring cgi-io.
Configuring rpcd.
Configuring rpcd-mod-file.
Configuring rpcd-mod-luci.
Configuring rpcd-mod-ucode.
Configuring ucode-mod-math.
Configuring ucode-mod-html.
Configuring liblucihttp-ucode.
Configuring luci-base.
4+0 records in
4+0 records out
Configuring luci-app-opkg.
Configuring libiwinfo-data.
Configuring libiwinfo20230701.
Configuring luci-mod-system.
Configuring luci-theme-bootstrap.
/luci-static/bootstrap
Configuring rpcd-mod-iwinfo.
Configuring luci-mod-status.
Configuring luci-app-firewall.
Configuring luci-proto-ppp.
Configuring luci-mod-network.
Configuring luci-mod-admin-full.
Configuring luci-proto-ipv6.
Configuring uhttpd.
4+0 records in
4+0 records out
Configuring rpcd-mod-rrdns.
Configuring uhttpd-mod-ubus.
4+0 records in
4+0 records out
Configuring luci-light.
Configuring luci.
Collected errors:
 * pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.148-1-df1aacec6cd5488b3a994ba785c8143d) for kmod-nf-ipt
 * pkg_hash_fetch_best_installation_candidate: Packages for kmod-nf-ipt found, but incompatible with the architectures configured
 * pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.148-1-df1aacec6cd5488b3a994ba785c8143d) for kmod-ipt-core
 * pkg_hash_fetch_best_installation_candidate: Packages for kmod-ipt-core found, but incompatible with the architectures configured
 * pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.148-1-df1aacec6cd5488b3a994ba785c8143d) for kmod-ipt-conntrack
 * pkg_hash_fetch_best_installation_candidate: Packages for kmod-ipt-conntrack found, but incompatible with the architectures configured
 * pkg_hash_check_unresolved: cannot find dependency kernel (= 5.15.148-1-df1aacec6cd5488b3a994ba785c8143d) for kmod-ipt-nat
 * pkg_hash_fetch_best_installation_candidate: Packages for kmod-ipt-nat found, but incompatible with the architectures configured
root@OpenWrt:~#
root@OpenWrt:~#
root@OpenWrt:~# /etc/init.d/uhttpd restart
4+0 records in
4+0 records out
root@OpenWrt:~#
root@OpenWrt:~#
root@OpenWrt:~# Connection to 192.168.1.9 closed by remote host.

Note, in spite of the errors during LuCi update / install, at a cursory glance LuCi appears to work fine and normally.

OpenWRT recognizes all 10 ports. I haven't tested all 10 yet but 8 is plenty for my needs anyhow. None of the port connection / data / PoE lights work as of yet but I read about that earlier in other posts and I'm sure we can sort that out eventually. It is not necessary to basic functionality.

bmork · February 16, 2024, 7:02am

Glad you got it working, but I'm still confused. Because this shows that the system was running 23.05.2 just fine before you installed my sysupgrade image:

root@OpenWrt:~# df -hT
Filesystem           Type            Size      Used Available Use% Mounted on
/dev/root            squashfs        2.8M      2.8M         0 100% /rom
tmpfs                tmpfs          59.5M     32.0K     59.5M   0% /tmp
/dev/mtdblock8       jffs2           9.6M    420.0K      9.2M   4% /overlay
overlayfs:/overlay   overlay         9.6M    420.0K      9.2M   4% /
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev

root@OpenWrt:~# uname -a
Linux OpenWrt 5.15.137 #0 Tue Nov 14 13:38:11 2023 mips GNU/Linux

That kernel version matches the name in your "firmware" partition, so the system has no problems booting an image with a default uimage name. That's great. The fake version is only needed for installation from OEM.

And you did have an overlay mounted from the "rootfs_data" partition split out of the "firmware" partition, so no problems there either.

But what was the problem then? Exactly what symptoms did you still see after changing the "bootpartition" variable?

johnsmith31 · February 16, 2024, 7:17pm

The symptoms were just as-described in this post earlier.

Basically, after making that variable change alone, there was no change in behavior, no fix for the "booting into recovery mode" problem. I was able to install LuCi even, in that mode, but LuCi put the usual large banner across the browser window warning that system was in recovery mode and no changes would be saved.

johnsmith31 · February 21, 2024, 4:45am

I got some headers soldered in & tried hooking up this GS110TPP to a Silicon Labs CP2104 USB-TTL serial adapter. I'm using header J1, with a pinout (viewing top of board, as pictured below) of 1, 2, 3, 4, from left to right.

1-VCC, 2-RX, 3-TX, 4-GND

I've verified continuity on my breakout wires & connectors and tried lots of permutations of connections, at bauds ranging from 9600 to 115,200, 8-N-1.

The serial adapter & USB cable, as well as my console software on my laptop, are known-good, I tested them w/ the RS232 console port on one of my PCEngines APU2E4 units.

The closest I've gotten with the GS110TPP junk output that is paced correctly, i.e. it has the pacing of a standard boot-up console sequence, and it is reproducible, i.e. follows the same cadence on every powerup.

So far I haven't let out any magic blue smoke, thankfully.

Any suggestions as to what I'm doing wrong?

musashino · February 21, 2024, 4:56am

It looks like a RS232 (12V) adapter, not a TTL (3.3V) adapter. You need to buy a USB-TTL adapter instead.

example (amazon.com): https://www.amazon.com/s?k=usb-ttl&crid=1QRDUDQTWJU0C&sprefix=usb-tt%2Caps%2C243&ref=nb_sb_noss_2

johnsmith31 · February 21, 2024, 5:03am

Thanks. I guess I thought the CP2104 would handle TTL-level signals, the spec sheet seems to indicate it can handle 3.3V signals, but maybe I'm misunderstanding it.

EDIT: Yes, the SiLabs CP2104 can handle 3.3V signals -- but it respects whatever VCC is fed to it, i.e. if standard USB-C is feeding it a +5V signal, it will use 5V on all its I/O pins as well. So I need to get a dedicated, separate 3.3V unit.

I will get a USB- 3.3V TTL converter and try that instead.