Support for D-Link DGS-1250 switches

plappermaul · March 18, 2026, 7:58pm

There are currently two series.

RTL930x based: DGS-1250-28X: 24x1G + 4x10G SFP
RTL931x based: DGS-1250-52X: 48x1G + 4x10G SFP

Characteristics

64MB NOR flash
256MB RAM

Any U-Boot output is surpressed and the swich seems to boot directly into a "switchlinux cli". Spamming CTRL+C during boot for some reason intercepts a startup script and one gets a root shell.

Please wait for loading...
^C^C^C^C^C^C^
~ #
~ #
~ # dmesg
Linux version 3.18.24-18 (mouan_liao@lanbuild02) (gcc version 4.9.4 (switchlinux-1.0-4) ) #3 Mon Mar 25 22:31:47 CST 2019
MIPS: machine is RTL9300
bootconsole [early0] enabled
CPU0 revision is: 00019555 (MIPS 34Kc)
[cpu0, rtl9300_auto_probe_memsize:274]: AUTO byte_size = 0x10000000 Byte
[cpu0, prom_memory_size_get:378]: Get total memory size by auto probe result
[cpu0, prom_memory_size_get:381]: Get dma size from kernel commnad line
[cpu0, prom_meminit:429]: DMA size=0xc00000(B)
[cpu0, prom_meminit:457]: mem zone0: Base=0x0, size=0xf400000(B)
Determined physical RAM map:
 memory: 0f400000 @ 00000000 (usable)
[cpu0, plat_remove_mem_parameter:248]: cmdline=console= boardmodel=28 mtdparts=nor0:1M(uboot),512K(env),512K(sys),-(fs) loglevel=1 bootldr=3.3.0.31-13  console=ttyS0,115200 mem=256M rtk_dma_size=12M, 80436160, 804361de
[cpu0, plat_remove_mem_parameter:253]: cmdline=console= boardmodel=28 mtdparts=nor0:1M(uboot),512K(env),512K(sys),-(fs) loglevel=1 bootldr=3.3.0.31-13  console=ttyS0,115200  rtk_dma_size=12M
[cpu0, plat_remove_mem_parameter:248]: cmdline=console= boardmodel=28 mtdparts=nor0:1M(uboot),512K(env),512K(sys),-(fs) loglevel=1 bootldr=3.3.0.31-13  console=ttyS0,115200 mem=256M rtk_dma_size=12M, 80431f94, 80432012
[cpu0, plat_remove_mem_parameter:253]: cmdline=console= boardmodel=28 mtdparts=nor0:1M(uboot),512K(env),512K(sys),-(fs) loglevel=1 bootldr=3.3.0.31-13  console=ttyS0,115200  rtk_dma_size=12M
Initrd not found or empty - disabling initrd
Zone ranges:
  Normal   [mem 0x00000000-0x0f3fffff]
  HighMem  empty
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00000000-0x0f3fffff]
Initmem setup node 0 [mem 0x00000000-0x0f3fffff]
On node 0 totalpages: 62464
free_area_init_node: node 0, pgdat 80416940, node_mem_map 81000000
  Normal zone: 488 pages used for memmap
  Normal zone: 0 pages reserved
  Normal zone: 62464 pages, LIFO batch:15
Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 61976
Kernel command line: console= boardmodel=28 mtdparts=nor0:1M(uboot),512K(env),512K(sys),-(fs) loglevel=1 bootldr=3.3.0.31-13  console=ttyS0,115200  rtk_dma_size=12M
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Writing ErrCtl register=0003aef1
Readback ErrCtl register=0003aef1
Memory: 236580K/249856K available (2994K kernel code, 154K rwdata, 1032K rodata, 6688K init, 167K bss, 13276K reserved, 0K highmem)
NR_IRQS:128
console [ttyS0] enabled
bootconsole [early0] disabled
Calibrating delay loop... 530.43 BogoMIPS (lpj=265216)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
devtmpfs: initialized
NET: Registered protocol family 16
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 2048 (order: 3, 40960 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 12288 bytes)
UDP-Lite hash table entries: 256 (order: 1, 12288 bytes)
NET: Registered protocol family 1
futex hash table entries: 256 (order: 0, 7168 bytes)
msgmni has been set to 462
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
start plist test
end plist test
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 39, base_baud = 10764700) is a 16550A
serial8250: ttyS1 at MMIO 0x0 (irq = 38, base_baud = 10908700) is a 16550A
RTK_SPI_FLASH_MIO driver is bypassed
RTK_NORSFG3 driver is used
=================================================================
init_luna_nor_spi_map: flash map at 0xb4000000
SPI NOR driver probe...
MXIC/C2201A/MMIO32-4/ModeC
4 cmdlinepart partitions found on MTD device nor0
add SPI NOR partition
MTD partitions obtained from kernel command line
Creating 4 MTD partitions on "nor0":
0x000000000000-0x000000100000 : "uboot"
0x000000100000-0x000000180000 : "env"
0x000000180000-0x000000200000 : "sys"
0x000000200000-0x000004000000 : "fs"
=================================================================
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
rtk_gen1_hcd_cs_init: rtk_gen1_hcd_cs_init()!
rtk_gen1_hcd_cs_init: register rtk_gen1_ehci ok!
usb_phy_configure_process: usb_phy_configure_process()!
rtk_gen1-ehci rtk_gen1-ehci: Realtek On-Chip EHCI Host Controller
rtk_gen1-ehci rtk_gen1-ehci: new USB bus registered, assigned bus number 1
rtk_gen1-ehci rtk_gen1-ehci: irq 25, io mem 0x18021000
rtk_gen1-ehci rtk_gen1-ehci: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
usbcore: registered new interface driver usbtmc
usbcore: registered new interface driver usb-storage
TCP: cubic registered
NET: Registered protocol family 17
Freeing unused kernel memory: 6688K (80418000 - 80aa0000)
UBI: attaching mtd3 to ubi0
UBI: scanning is finished
UBI: attached mtd3 (name "fs", size 62 MiB) to ubi0
UBI: PEB size: 16384 bytes (16 KiB), LEB size: 16256 bytes
UBI: min./max. I/O unit sizes: 1/1, sub-page size 1
UBI: VID header offset: 64 (aligned 64), data offset: 128
UBI: good PEBs: 3968, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 94
UBI: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 1654326921
UBI: available PEBs: 0, total reserved PEBs: 3968, PEBs reserved for bad PEB handling: 0
UBI: background thread "ubi_bgt0d" started, PID 698
UBIFS: background thread "ubifs_bgt0_0" started, PID 702
UBIFS: mounted UBI device 0, volume 0, name "fs"
UBIFS: LEB size: 16256 bytes (15 KiB), min./max. I/O unit sizes: 8 bytes/8 bytes
UBIFS: FS size: 64194944 bytes (61 MiB, 3949 LEBs), journal size 8111744 bytes (7 MiB, 499 LEBs)
UBIFS: reserved for root: 0 bytes (0 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 7FEA79B7-56E5-49B5-893F-03E4342DBF03, big LPT model
syslogd started: BusyBox v1.24.1
init: starting pid 730, tty '': '/sbin/mdev -s'
NET: Registered protocol family 10
init: starting pid 733, tty '/dev/ttyS0': '/bin/login -f root'
login[733]: root login on 'ttyS0'
random: nonblocking pool is initialized
~ # uname -a
Linux Alpha 3.18.24-18 #3 Mon Mar 25 22:31:47 CST 2019 mips GNU/Linux
~ # id
uid=0(root) gid=0(root) groups=0(root)

plappermaul · March 18, 2026, 7:59pm

/mnt/flash # df
Filesystem           1K-blocks      Used Available Use% Mounted on
devtmpfs                118288         4    118284   0% /dev
tmpfs                   121632         4    121628   0% /dev/shm
tmpfs                   121632         0    121632   0% /tmp
/dev/ubi0_0              45220     24948     20272  55% /mnt/flash
/mnt/flash # find .
.
./root
./root/.switch
./uImage
./switchfs
./switchfs/Image1
./switchfs/Image2
./switchfs/Config1
./switchfs/Config2
./switchfs/system
./switchfs/system/zh_cn.lang
./switchfs/system/ja_jp.lang
./switchfs/system/de_de.lang
./switchfs/system/ru_ru.lang
./switchfs/system/self-signed.crt
./switchfs/system/self-signed.pem
./switchfs/system/image.ini
./switchfs/system/it_it.lang
./switchfs/system/zh_tw.lang
./switchfs/system/sys_lang.cfg
./switchfs/system/es_es.lang
./switchfs/system/pt_pt.lang
./switchfs/system/cfg.ini
./switchfs/system/syslog
./switchfs/system/fr_fr.lang

plappermaul · March 18, 2026, 8:09pm

If there is space for an U-Boot env then it does not contain any data.

~ # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00004000 "uboot"
mtd1: 00080000 00004000 "env"
mtd2: 00080000 00004000 "sys"
mtd3: 03e00000 00004000 "fs"
~ # hexdump -C /dev/mtd1
00000000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00080000
~ # hexdump -C /dev/mtd2
00000000  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00080000

plappermaul · March 18, 2026, 8:14pm

Looking at the U-Boot partition there is some hardcoded stuff inside.

# strings /dev/mtd0 | grep -i boot
...
U-Boot 2011.12.(3.3.0.31-13) (Oct 16 2019 - 17:11:31)
bootargs=console=ttyS0,115200 boardmodel=28 mtdparts=nor0:1M(uboot),512K(env),512K(sys),-(fs) loglevel=1 bootldr=3.3.0.31-13
bootcmd=mtdparts default; ubi part fs; ubifsmount fs;ubifsload 0x87000000 uImage;bootm 0x87000000;
bootdelay=1
...

plappermaul · March 18, 2026, 9:11pm

To enter U-Boot press "&" during start. And we have a fully working network environment.

RTL9300# # rtk network on
Enable network
RTCORE Driver Module Initialize
  IOAL init
  Hardware-profile probe (28)
  Hardware-profile init
  GPIO probe (unit 0): (found)
  GPIO Init
  SPI init (unit 0) (type3)
    SPI Master init
  I2C probe (unit 0)
  I2C init (unit 0)
  NIC probe (unit 0)
  Loader RTNIC Driver Module Initialize
RTK Driver Module Initialize
  MAC probe (unit 0)
    Chip 9301 (found)
  MAC init (unit 0)
  PHY probe (unit 0)
  Chip Construct (unit 0)
    Chip Construct
    Disable PHY Polling
    PHY Reset
    MAC Construct
    Turn Off Serdes
    Serdes Construct
    PHY Construct
    Turn On Serdes
    Enable PHY Polling
    Misc
  PHY init (unit 0)
  Mgmt_dev init (unit 0)
Please wait for PHY init-time ...

RTL9300# # ping 192.168.2.90
Using rtl9300#0 device
host 192.168.2.90 is alive

plappermaul · March 19, 2026, 9:20pm

On this switch there sits a PD9555 between SoC and the four SFP+ ports. One must get contorl over it to steer access to MOD_DEF, LOS, ... Tried out all i2c_mst1 channels but nothing to find there on any of them on address 0x20-0x27. Switching to slow speed 50khz does not help either.

@jonasj maybe you have an idea how to narrow this down.

jonasj · March 19, 2026, 9:59pm

I assume you already tried to get that information about GPIO assignment from the stock firmware. So some standard ideas first:

did you try i2c_mst2 too?
any toolset available in the root shell of the stock firmware that might help?
narrow down "free" GPIOs and try out combinations with i2c-gpio

I do not recommend this, just provide it as-is (because I have no fear doing it this way). Risky and not safe, but quite fast and accurate:

open up the device
find the PD9555 chip on the board
power the switch and boot OpenWrt
let gpiomon monitor several suspected GPIOs
take a wire with slim probes and shortly apply GND/3.3V to the SCL/SDA pins on the PD9555
see if and what happens in gpiomon

Basically the same procedure I use with my SFP breakout board, but riskier due to working on an opened device. So take this with great caution, I'm not responsible for any damage, etc.

plappermaul · March 19, 2026, 10:06pm

The PD9555 is on the backside of the board.

What I noticed so far: As soon as I insert a module into one of the four SFP slots gpio523 (translates to gpio 0 11 I assume) switches from 1->0. This is strange because I would expect the multiplexer to hand over only the one selected gpio to the SOC.

jonasj · March 19, 2026, 10:29pm

That wouldn't stop me but sure, makes it just more cumbersome and risky.

I've already seen quite some weird GPIO stuff, there doesn't seem to be a limit in creativity.
This might be a single "any SFP inserted"-detect signal, or something different and unrelated. I suppose since there is already such a full-fledged expander, all or most signals are connected to it. Maybe TX_D or MOD_DEF0 is kept on the SoC.
But I have no simple way to narrow down the I2C stuff right now, apart from what was listed above.

plappermaul · March 20, 2026, 7:36am

Thanks. will try around.

andyboeh · March 20, 2026, 8:08am

I usually export the GPIOs manually from sysfs and trigger outputs high/low while measuring the SDA/SCL pin. It's a tad more difficult if the IC is on the bottom side, but it usually works. Similar to @jonasj, I apply the same procedure to the SFP breakout board.

Sometimes, the trace can be followed to a nearby resistor where it's easier to measure, sometimes there is a via to the other side which makes measuring easier. Visually tracing the pins is my very first step.

plappermaul · March 20, 2026, 6:56pm

I made a hole into a tape and put it over the PD9555 leaving only the pin in scope open. Helped a lot.

The PD9555 is attached via gpio 15/13. Now i have 16 more gpios to test.

plappermaul · March 20, 2026, 7:42pm

plappermaul · March 21, 2026, 12:54pm

I do not understand the vendors. Having a fully featured I2C bus inside the SOC they are designing this around a shared gpio via 17/14, 18/14, 19/14 and 20/14 for the four SFP slots.

plappermaul · March 21, 2026, 5:16pm

slh · March 22, 2026, 5:07am

That would imply them having read/ understood (or have access to) the data sheet, which might be quite optimistic…

plappermaul · March 22, 2026, 6:41pm

@janh @andyboeh I know that this might be an enormous favour I'm asking for. But do you see a realistic chance to decode a D-Link DGS-1250 vendor firmware image? We currently have

an initial idea https://openwrt.org/toh/d-link/dgs-1250#firmware_images
two firmware images and the vendor decryptor/loader https://github.com/plappermaul/realtek-doc/tree/main/DGS-1250

If this is not possible (too complex / too little time) then I will skip a seamless integration and just generate a classic OpenWrt image that overwrites all vendor stuff.

plappermaul · March 23, 2026, 7:52am

Replying to myself. This was easier than thougt. Wiki updated.