Yeah, for now, it's just copy/paste of the SDK.
But you technically don't need the PHY. The usb stack can work happily without it, in that, an integrated solution, or a PHY that 'just works'. The ehci drivers wouldn't know nothing is connected without a PHY i reccon ...
At some point, I will solder some wires to my pads for sure 
gotta more carefully trace out @svidpet photo's to see what components sit on the signal path. Though I think we need one picture without the heatsink. The heatsink is only 'stuck' with thermal paste anyway afaik, so should be easy to remove 
hint hint, nudge nudge.
Heatsink removed.
It was glued with some nasty silicone.
Kewl! but sadly, not MUCH extra data to see there. Btw, any purpose of storing them as BW? I don't mind so much, but technically, unless you have a BW camera which truely has only a monochrome sensor, having the color data can be useful
Anyway, what I see is the same, the USB pins come out of the SoC, without any termination or reflection resistors. The pads at the bottom (near C128) seem to go to via's and then go to the pin-pads. So that's good to now, meaning attaching a wire is possible for us not so blessed
BTW, the goop is sticky when cold; usually warming it makes it very easy to remove and re-attach.
I'm happy to report, that @olliver 's u-boot works on this unit.
upgrade:
RTL9300# # ping 192.168.1.133
Using rtl9300#0 device
host 192.168.1.133 is alive
RTL9300# # upgrade loaderforce
Upgrade loader image [u-boot.bin]......
Enable network
Please wait for PHY init-time ...
Using rtl9300#0 device
TFTP from server 192.168.1.133; our IP address is 192.168.1.2
Filename 'u-boot.bin'.
Load address: 0x81000000
Loading: T #################################################################
####################################
done
Bytes transferred = 515212 (7dc8c hex)
Erasing 917504 B from 00000000... 100% ~ 000dffff/917504 B
Writing 917504 B from 81000000 to 00000000... 100% ~ 000dffff/917504 B
Comparing file ......
Total of 917504 bytes were the same
Upgrade loader image [u-boot.bin] success
new flash layout:
RTL9300# # flshow
=============== FLASH Partition Layout ===============
Index Name Size Address
------------------------------------------------------
0 LOADER 0xe0000 0xb4000000-0xb40dffff
1 BDINFO 0x10000 0xb40e0000-0xb40effff
2 RUNTIME1 0xd00000 0xb40f0000-0xb4deffff
======================================================
but 
What's the next step? rtk network on not fully functional, so i can't tftpboot the unit. Serial upload by loadb works well, but the default address is 0x80000000, so I'll run into the same issue like above.
here's a comparison of the rtk network on command output. Factory fw on the left, new on the right:
U-Boot 2011.12.(1.0.0.2) (Dec 20 2022 - 04:42:03) | U-Boot 2011.12.001-owrt (Aug 12 2022 - 14:40:05)
Board: RTL9300 CPU:800MHz LX:175MHz DDR:600MHz | Board: RTL9300 CPU:800MHz LX:175MHz DDR:600MHz
DRAM: 128 MB | DRAM: 128 MB
SPI-F: WINBOND/EF4018/MMIO16-1/ModeC 1x16 MB (plr_flash_info @ 83f852e0) | SPI-F: WINBOND/EF4018/MMIO16-1/ModeC 1x16 MB (plr_flash_info @ 83f5a148)
Loading 65536B env. variables from offset 0xe0000 | Loading 65536B env. variables from offset 0xe0000
Net: Net Initialization Skipped | Net: Net Initialization Skipped
No ethernet found. | No ethernet found.
Hit Esc key to stop autoboot: 0 | Hit Esc key to stop autoboot: 0
Enable network | Enable network
RTCORE Driver Module Initialize | RTCORE Driver Module Initialize
IOAL init | IOAL init
Hardware-profile probe | Hardware-profile probe (Forced profile: RTL9302B_8218D_2x8226_2xGE)
(RTL9301_3x8218D_4XGE_HR) | (RTL9302B_8218D_2x8226_2xGE)
Hardware-profile init | Hardware-profile init
GPIO probe (unit 0): (found) | GPIO probe (unit 0): (found)
GPIO Init | GPIO Init
| Reset PHY gpio OK!
SPI init (unit 0) | SPI init (unit 0) (type3)
| SPI Master init
I2C probe (unit 0) | I2C probe (unit 0)
| I2C init (unit 0)
RTL8231 probe (unit 0): (found) |
RTL8231 init (unit 0) |
NIC probe (unit 0) | NIC probe (unit 0)
Loader RTNIC Driver Module Initialize | Loader RTNIC Driver Module Initialize
IOAL init | IOAL init
RTK Driver Module Initialize | RTK Driver Module Initialize
MAC probe (unit 0) | MAC probe (unit 0)
Chip 9301 (found) | Chip 9301 (found)
MAC init (unit 0) | MAC init (unit 0)
SMI protocol probe (unit 0) | SMI protocol probe (unit 0)
PHY probe (unit 0) | PHY probe (unit 0)
Chip Construct (unit 0) | Chip Construct (unit 0)
Chip Construct | Chip Construct
Disable PHY Polling | Disable PHY Polling
PHY Reset | PHY Reset
MAC Construct | MAC Construct
Turn Off Serdes | Turn Off Serdes
Serdes Construct | Serdes Construct
PHY Construct | PHY Construct
Turn On Serdes | Turn On Serdes
Mac_Polling_PHY Config
Enable PHY Polling | Enable PHY Polling
Misc | Misc
PHY init (unit 0) | PHY init (unit 0)
Mgmt_dev init (unit 0) | Mgmt_dev init (unit 0)
Please wait for PHY init-time ... |Please wait for PHY init-time ...
I guess this will be the part of Network functionality and diag support needs some extra 'post-setup' steps as per manual.
Hi,
I'd like to get back on this train, since the unit was just collected dust in the last year.
The point where I was stuck is that in the custom u-boot, the rtk network on didn't bring the network functionality alive. My guess is that this u-boot was compiled for the Zyxel unit, hence the incompatibility at Hardware-profile probe
factory u-boot: (RTL9301_3x8218D_4XGE_HR)
custom u-boot: (Forced profile: RTL9302B_8218D_2x8226_2xGE)
Right now I can see the only chance to get openwrt running on this unit is to run the Mestechs MSG9424 u-boot.
Since this horaco & the Mestechs looks identical by comparing the PCBs,
can somebody with this unit help me, and send it's u-boot image?
Thank you in advance.