Went to the biot.com wiki, but could not find a link to request an account. How do I get an account to add additional devices with detailed chipset information?
Usually there is an ARM microcontroller on the board which controls the actual PoE controller chip which should be from Broadcom (the alternative is that there is only a PowerDsine chip). The ARM microcontroller (we have seen Nuvoton and STM) talks uart to the RTL83xx SoC and SPI to the BCM chip. You can sniff the uart either on the pins of the ARM microcontroller or sometimes on a pin-header close to the microcontroller. In addition there is usually an ARM SWD header to program the microcontroller. On biot's wiki there is a description of the PoE protocol as far as it is understood. blogic as written a daemon talking ubus to control it, there might be the need to put the right values for your switch in, though.
While waiting for the SOIC16 clip to arrive, I had a look at the TP-Link firmware upgrade file structure - in order to allow future upgrades from stock. I've created a Wiki page with what I know so far (IMHO it's very different to the known TP-Link router firmware formats):
Btw, has anybody done a flash dump of one of the TP-Link switches with the same firmware scheme? I'd be interested in what actually ends up on the flash (T1500G or T2500G).
1 Like
I am so happy to finally see OpenWrt support for a major switch SoC platform. Just got myself a ZyXEL GS1900-10HP, which I assumed should be a piece-of-cake to get up and running. But I guess I am a little too stupid for this....
I checked out the current rtl83xx_dev branch from https://github.com/bkobl/openwrt.git and built a GS1900-10HP image using mostly default settings. But trying to load the sysupgrade.bin in the OEM web GUI results in:
Firmware Validation Error
Invalid image signature
So I thought I'd simply tftpboot the initramfs image and see where I could get from there. Ran
rtk network on
tftpboot 10hp.bin
where 10hp.bin is the name of the initramfs file on my tftp server. And I can see that uboot starts a tftp transfer. But it's just incredibly slow with a number of timouts, eventually failing to complete. I guess there either is some magic tftp setting I can't figure out, or some magic switch setting. I do notice that the network seems to be completely dead after such an attempt. I have link on both sides (or a green LED on the GS1900 at least), but I can't ping either way anymore. Doing
rtk network off
rtk network on
does not help either. I tried a few different ports, even including the SFP ports, with exactly the same result. Only way I found to get uboot networking up again is by power cycling the switch.
So I seem to be stuck there. Can't tftp boot and can't sysupgrade using the OEM web gui. Any hints on how to proceed?
I guess you have the wrong load address and you are overwriting the u-boot code. Try
tftpboot 0x84f00000 192.168.1.150:openwrt-rtl838x-zyxel_gs1900-10hp-initramfs-kernel.bin
And then
bootm
Make sure you don't try to run the sysupgrade code here.
Indeed, official Zyxel GS1900-10HP support is still missing, with the possibility to flash it from the OEM web-interface. In general, however, the device is very well supported, you should be able to flash out of the initram image (not tested!). Try also the poe package with blogic's PoE daemon from that repository. Any feedback is very wellcome.
Thanks! Yes, that made all the difference.
Tried looking at the OEM firmware, but can't say I recognize the header format immediately. Nor does "file". Do you happen to know if it is something used by other supported devices , or if this is a specific wrapper for these ZyXEL switches?
EDIT: ok, so that's just a standard uImage header with 0x83800000 as magic and a typical ZyXEL version string?
Yes, the level of support was one of the reasons I went for this model. And the fact that it has a console header which is accessible without even opening the case. ZyXEL are often nice enough to solder a header on their console ports and leave the console fully functional. But it's the first time I've seen them make an access hole like this. Did see something similar on a D-Link camera, but that's another story.
I do plan to use the PoE daemon, and maybe extend it with a snmp plugin if I can make that fly. I love the Power Ethernet MIB (RFC3621) support on more expensive switches. it would be nice to have something similar for these devices too, for both monitoring and control.
For now I seem to have some issues building lua-rs232. And the rtl83xx-poe package is messed up by a DOS editor. Will provide better feedback and patches when I get around to looking at it. First I'll play with the basic features and see if I can manage to flash OpenWrt with bricking the switch 
EDIT: no problem there. just write the sysupgrade image to the firmware partition and make sure it is configured as active by running
setsys bootpartition=0
savesys
in the bootloader. I assume OpenWrt can't (yet) boot from the second partition since mtd5 is hard coded as "firmware". But this can be nice for keeping an OEM backup installation, anyway.
I don't seem to have much success with th PoE daemon unfortunately. I enabled some of the debug prints and added one on send, just to see that it's actually sending what I expect. The daemon starts up fine and seems to communicate with the controller. But I am unable to turn on power on any port, whether on startup or by ubus calls.
Starting with ports 1 to 3 enabled:
root@OpenWrt:~# /tmp/poe.lua 65 1 1 1 0 0 0 0 0
OK, port open with values 'device: /dev/ttyS1, baud: 19200, data bits: 8, parity: none, stop bits: 1, flow control: off'
send 12 bytes: 20 01 ff ff ff ff ff ff ff ff ff 18
valid: Reply: 20 01 02 08 01 e1 21 16 00 05 04 4d
send 12 bytes: 18 01 00 00 00 00 00 ff ff ff ff 15
valid: Reply: 18 01 00 00 ff ff ff ff ff ff ff 12
send 12 bytes: 17 00 02 ff ff ff ff ff ff ff ff 11
valid: Reply: 17 00 00 ff ff ff ff ff ff ff ff 0f
send 12 bytes: 06 00 01 ff ff ff ff ff ff ff ff ff
valid: Reply: 06 00 00 ff ff ff ff ff ff ff ff fe
send 12 bytes: 00 00 00 00 ff ff ff ff ff ff ff f9
valid: Reply: 00 00 00 00 ff ff ff ff ff ff ff f9
send 13 bytes: 00 00 00 00 ff ff ff ff ff ff ff f9
valid: Reply: 00 00 00 00 ff ff ff ff ff ff ff f9
send 12 bytes: 00 01 01 00 ff ff ff ff ff ff ff fb
valid: Reply: 00 01 01 00 ff ff ff ff ff ff ff fb
send 13 bytes: 00 01 01 00 ff ff ff ff ff ff ff fb
valid: Reply: 00 01 01 00 ff ff ff ff ff ff ff fb
send 12 bytes: 00 02 02 00 ff ff ff ff ff ff ff fd
valid: Reply: 00 02 02 00 ff ff ff ff ff ff ff fd
send 13 bytes: 00 02 02 00 ff ff ff ff ff ff ff fd
valid: Reply: 00 02 02 00 ff ff ff ff ff ff ff fd
send 12 bytes: 00 03 03 00 ff ff ff ff ff ff ff ff
valid: Reply: 00 03 03 00 ff ff ff ff ff ff ff ff
send 13 bytes: 00 03 03 00 ff ff ff ff ff ff ff ff
valid: Reply: 00 03 03 00 ff ff ff ff ff ff ff ff
send 12 bytes: 00 04 04 00 ff ff ff ff ff ff ff 01
valid: Reply: 00 04 04 00 ff ff ff ff ff ff ff 01
send 13 bytes: 00 04 04 00 ff ff ff ff ff ff ff 01
valid: Reply: 00 04 04 00 ff ff ff ff ff ff ff 01
send 12 bytes: 00 05 05 00 ff ff ff ff ff ff ff 03
valid: Reply: 00 05 05 00 ff ff ff ff ff ff ff 03
send 13 bytes: 00 05 05 00 ff ff ff ff ff ff ff 03
valid: Reply: 00 05 05 00 ff ff ff ff ff ff ff 03
send 12 bytes: 00 06 06 00 ff ff ff ff ff ff ff 05
valid: Reply: 00 06 06 00 ff ff ff ff ff ff ff 05
send 13 bytes: 00 06 06 00 ff ff ff ff ff ff ff 05
valid: Reply: 00 06 06 00 ff ff ff ff ff ff ff 05
send 12 bytes: 00 07 07 00 ff ff ff ff ff ff ff 07
valid: Reply: 00 07 07 00 ff ff ff ff ff ff ff 07
send 13 bytes: 00 07 07 00 ff ff ff ff ff ff ff 07
valid: Reply: 00 07 07 00 ff ff ff ff ff ff ff 07
send 12 bytes: 02 00 01 ff ff ff ff ff ff ff ff fb
valid: Reply: 02 00 00 ff ff ff ff ff ff ff ff fa
send 12 bytes: 00 00 00 00 ff ff ff ff ff ff ff f9
valid: Reply: 00 00 00 00 ff ff ff ff ff ff ff f9
send 13 bytes: 00 00 00 00 ff ff ff ff ff ff ff f9
valid: Reply: 00 00 00 00 ff ff ff ff ff ff ff f9
send 12 bytes: 00 01 01 00 ff ff ff ff ff ff ff fb
valid: Reply: 00 01 01 00 ff ff ff ff ff ff ff fb
send 13 bytes: 00 01 01 00 ff ff ff ff ff ff ff fb
valid: Reply: 00 01 01 00 ff ff ff ff ff ff ff fb
send 12 bytes: 00 02 02 00 ff ff ff ff ff ff ff fd
valid: Reply: 00 02 02 00 ff ff ff ff ff ff ff fd
send 13 bytes: 00 02 02 00 ff ff ff ff ff ff ff fd
valid: Reply: 00 02 02 00 ff ff ff ff ff ff ff fd
send 12 bytes: 00 03 03 00 ff ff ff ff ff ff ff ff
valid: Reply: 00 03 03 00 ff ff ff ff ff ff ff ff
send 13 bytes: 00 03 03 00 ff ff ff ff ff ff ff ff
valid: Reply: 00 03 03 00 ff ff ff ff ff ff ff ff
send 12 bytes: 00 04 04 00 ff ff ff ff ff ff ff 01
valid: Reply: 00 04 04 00 ff ff ff ff ff ff ff 01
send 13 bytes: 00 04 04 00 ff ff ff ff ff ff ff 01
valid: Reply: 00 04 04 00 ff ff ff ff ff ff ff 01
send 12 bytes: 00 05 05 00 ff ff ff ff ff ff ff 03
valid: Reply: 00 05 05 00 ff ff ff ff ff ff ff 03
send 13 bytes: 00 05 05 00 ff ff ff ff ff ff ff 03
valid: Reply: 00 05 05 00 ff ff ff ff ff ff ff 03
send 12 bytes: 00 06 06 00 ff ff ff ff ff ff ff 05
valid: Reply: 00 06 06 00 ff ff ff ff ff ff ff 05
send 13 bytes: 00 06 06 00 ff ff ff ff ff ff ff 05
valid: Reply: 00 06 06 00 ff ff ff ff ff ff ff 05
send 12 bytes: 00 07 07 00 ff ff ff ff ff ff ff 07
valid: Reply: 00 07 07 00 ff ff ff ff ff ff ff 07
send 13 bytes: 00 07 07 00 ff ff ff ff ff ff ff 07
valid: Reply: 00 07 07 00 ff ff ff ff ff ff ff 07
send 12 bytes: 02 00 01 ff ff ff ff ff ff ff ff fb
valid: Reply: 02 00 00 ff ff ff ff ff ff ff ff fa
send 12 bytes: 1d 00 00 07 ff ff ff ff ff ff ff 1d
valid: Reply: 1d 00 00 00 ff ff ff ff ff ff ff 16
send 12 bytes: 1d 00 01 06 ff ff ff ff ff ff ff 1d
valid: Reply: 1d 00 01 00 ff ff ff ff ff ff ff 17
send 12 bytes: 1d 00 02 05 ff ff ff ff ff ff ff 1d
valid: Reply: 1d 00 02 00 ff ff ff ff ff ff ff 18
send 12 bytes: 1d 00 03 04 ff ff ff ff ff ff ff 1d
valid: Reply: 1d 00 03 00 ff ff ff ff ff ff ff 19
send 12 bytes: 1d 00 04 03 ff ff ff ff ff ff ff 1d
valid: Reply: 1d 00 04 00 ff ff ff ff ff ff ff 1a
send 12 bytes: 1d 00 05 02 ff ff ff ff ff ff ff 1d
valid: Reply: 1d 00 05 00 ff ff ff ff ff ff ff 1b
send 12 bytes: 1d 00 06 01 ff ff ff ff ff ff ff 1d
valid: Reply: 1d 00 06 00 ff ff ff ff ff ff ff 1c
send 12 bytes: 1d 00 07 00 ff ff ff ff ff ff ff 1d
valid: Reply: 1d 00 07 00 ff ff ff ff ff ff ff 1d
send 12 bytes: 25 01 ff ff ff ff ff ff ff ff ff 1d
valid: Reply: 25 01 ff 00 00 00 00 00 00 ff ff 23
send 12 bytes: 18 01 00 02 8a 00 46 ff ff ff ff e7
valid: Reply: 18 01 00 00 ff ff ff ff ff ff ff 12
send 12 bytes: 23 01 ff ff ff ff ff ff ff ff ff 1b
valid: Reply: 23 01 00 00 02 dc 07 02 ff ff 00 09
send 12 bytes: 11 00 00 01 ff ff ff ff ff ff ff 0b
valid: Reply: 11 00 00 00 ff ff ff ff ff ff ff 0a
send 12 bytes: 13 00 00 02 ff ff ff ff ff ff ff 0e
valid: Reply: 13 00 00 00 ff ff ff ff ff ff ff 0c
send 12 bytes: 15 00 00 01 ff ff ff ff ff ff ff 0f
valid: Reply: 15 00 00 00 ff ff ff ff ff ff ff 0e
send 12 bytes: 10 00 00 03 ff ff ff ff ff ff ff 0c
valid: Reply: 10 00 00 00 ff ff ff ff ff ff ff 09
send 12 bytes: 11 01 01 01 ff ff ff ff ff ff ff 0d
valid: Reply: 11 01 01 00 ff ff ff ff ff ff ff 0c
send 12 bytes: 13 01 01 02 ff ff ff ff ff ff ff 10
valid: Reply: 13 01 01 00 ff ff ff ff ff ff ff 0e
send 12 bytes: 15 01 01 01 ff ff ff ff ff ff ff 11
valid: Reply: 15 01 01 00 ff ff ff ff ff ff ff 10
send 12 bytes: 10 01 01 03 ff ff ff ff ff ff ff 0e
valid: Reply: 10 01 01 00 ff ff ff ff ff ff ff 0b
send 12 bytes: 11 02 02 01 ff ff ff ff ff ff ff 0f
valid: Reply: 11 02 02 00 ff ff ff ff ff ff ff 0e
send 12 bytes: 13 02 02 02 ff ff ff ff ff ff ff 12
valid: Reply: 13 02 02 00 ff ff ff ff ff ff ff 10
send 12 bytes: 15 02 02 01 ff ff ff ff ff ff ff 13
valid: Reply: 15 02 02 00 ff ff ff ff ff ff ff 12
send 12 bytes: 10 02 02 03 ff ff ff ff ff ff ff 10
valid: Reply: 10 02 02 00 ff ff ff ff ff ff ff 0d
send 12 bytes: 11 03 03 01 ff ff ff ff ff ff ff 11
valid: Reply: 11 03 03 00 ff ff ff ff ff ff ff 10
send 12 bytes: 13 03 03 02 ff ff ff ff ff ff ff 14
valid: Reply: 13 03 03 00 ff ff ff ff ff ff ff 12
send 12 bytes: 15 03 03 01 ff ff ff ff ff ff ff 15
valid: Reply: 15 03 03 00 ff ff ff ff ff ff ff 14
send 12 bytes: 10 03 03 03 ff ff ff ff ff ff ff 12
valid: Reply: 10 03 03 00 ff ff ff ff ff ff ff 0f
send 12 bytes: 11 04 04 01 ff ff ff ff ff ff ff 13
valid: Reply: 11 04 04 00 ff ff ff ff ff ff ff 12
send 12 bytes: 13 04 04 02 ff ff ff ff ff ff ff 16
valid: Reply: 13 04 04 00 ff ff ff ff ff ff ff 14
send 12 bytes: 15 04 04 01 ff ff ff ff ff ff ff 17
valid: Reply: 15 04 04 00 ff ff ff ff ff ff ff 16
send 12 bytes: 10 04 04 03 ff ff ff ff ff ff ff 14
valid: Reply: 10 04 04 00 ff ff ff ff ff ff ff 11
send 12 bytes: 11 05 05 01 ff ff ff ff ff ff ff 15
valid: Reply: 11 05 05 00 ff ff ff ff ff ff ff 14
send 12 bytes: 13 05 05 02 ff ff ff ff ff ff ff 18
valid: Reply: 13 05 05 00 ff ff ff ff ff ff ff 16
send 12 bytes: 15 05 05 01 ff ff ff ff ff ff ff 19
valid: Reply: 15 05 05 00 ff ff ff ff ff ff ff 18
send 12 bytes: 10 05 05 03 ff ff ff ff ff ff ff 16
valid: Reply: 10 05 05 00 ff ff ff ff ff ff ff 13
send 12 bytes: 11 06 06 01 ff ff ff ff ff ff ff 17
valid: Reply: 11 06 06 00 ff ff ff ff ff ff ff 16
send 12 bytes: 13 06 06 02 ff ff ff ff ff ff ff 1a
valid: Reply: 13 06 06 00 ff ff ff ff ff ff ff 18
send 12 bytes: 15 06 06 01 ff ff ff ff ff ff ff 1b
valid: Reply: 15 06 06 00 ff ff ff ff ff ff ff 1a
send 12 bytes: 10 06 06 03 ff ff ff ff ff ff ff 18
valid: Reply: 10 06 06 00 ff ff ff ff ff ff ff 15
send 12 bytes: 11 07 07 01 ff ff ff ff ff ff ff 19
valid: Reply: 11 07 07 00 ff ff ff ff ff ff ff 18
send 12 bytes: 13 07 07 02 ff ff ff ff ff ff ff 1c
valid: Reply: 13 07 07 00 ff ff ff ff ff ff ff 1a
send 12 bytes: 15 07 07 01 ff ff ff ff ff ff ff 1d
valid: Reply: 15 07 07 00 ff ff ff ff ff ff ff 1c
send 12 bytes: 10 07 07 03 ff ff ff ff ff ff ff 1a
valid: Reply: 10 07 07 00 ff ff ff ff ff ff ff 17
send 12 bytes: 00 00 00 01 ff ff ff ff ff ff ff fa
valid: Reply: 00 00 00 00 ff ff ff ff ff ff ff f9
send 12 bytes: 00 01 01 01 ff ff ff ff ff ff ff fc
valid: Reply: 00 01 01 00 ff ff ff ff ff ff ff fb
send 12 bytes: 00 02 02 01 ff ff ff ff ff ff ff fe
valid: Reply: 00 02 02 00 ff ff ff ff ff ff ff fd
Enabling port 4:
root@OpenWrt:/# ubus -v call poe port '{"enable":true,"port":4}'
{
}
send 12 bytes: 00 03 03 01 ff ff ff ff ff ff ff 00
valid: Reply: 00 03 03 00 ff ff ff ff ff ff ff ff
As you can see, all the enable attempts return a valid reply with power disabled. I tried adding a port status request on enable, and it confirmst that the port is disabled:
send 12 bytes: 00 02 02 01 ff ff ff ff ff ff ff fe
valid: Reply: 00 02 02 00 ff ff ff ff ff ff ff fd
send 12 bytes: 21 02 02 ff ff ff ff ff ff ff ff 1d
valid: Reply: 21 02 02 00 00 00 00 00 00 00 00 25
On Zyxel switches, there appear to be two extra initialisation commands that I don't see in your trace. Can you try adding them to the init procedure?
Regarding the TP-Link T1600G-52PS: Finally, my SOIC16 clip arrived! I was able to flash a self-compiled U-Boot and my switch still works and offers me a full U-Boot menu.
I also took the PoE board off: It contains, once again, different ICs:
- 12x TI TPS23861PW
- 1x TI 9BAJJ6T ISO7741
This ISO7741 is a quad-channel digital isolator - seems as if the PSE controllers were directly controlled via i2c by the SoC?
2 Likes
Interesting! I like this kind of PoE implementation more than the MCU-managed Broadcoms, since these have a fixed (and publicly documented) control interface.
You can also run the TPS23861 in fully auto mode, it's a smart thing so it will detect whether the PD device is preset at all.
Otherwise, there are semi-auto and full manual mode over I2C too, it's easy to debug since you simply read the values directly.
And there are full docs in the TI datasheet.
Sorry for interfering with your thread as I have no RTL boards, was just following it and have seen a reference to POE PSE IC we use on our boards.
2 Likes
That's what I thought! It should be a matter of identifying the i2c addresses and implementing a daemon.
Ah perfect, do you have some management code that you can share or can you point me towards a reference implementation?
But first I should get OpenWrt up and running...
Unfortunately, not yet, we don't do much messing with its controls as there is no need.
We are planning to push the Linux driver for at least monitoring the values in a human way upstream as we get everything sorted, there are some higher priorities now.
As I said, by default it is in automatic mode and it should work fine in that.
If you need to force it to do something, well then the design is messed up.
All of the registers and everything is in the TI datasheet that is public, there is also MSP430 based reference code:
https://www.ti.com/product/TPS23861#design-development##software-development
1 Like
We were discussing earlier whether the PoE stuff belongs in userspace or the kernel. With set-in-stone protocols such as TI's, or Microsemi's from the PD69xxx series, I think you have a far better chance of ever getting this into the kernel. Then you can integrate it with the sensors framework etc.
The MCU used with the Broadcom PSE doesn't have a fixed firmware, it can easily be upgraded to a new version. I've seen a number of different versions by now, running on different MCUs. I strongly doubt anything as volatile as this interface would ever be considered for inclusion in the kernel.
1 Like
Well, I personally think it belongs in the kernel and then userspace can interact with it.
I hate when people hack direct acess from userspace to devices.
Yeah, with magic blobs that change API with each release and no docs are no candidate for upstreaming.
Thanks for the pointer. I was using the script in package/rtl83xx-poe/files/bin/poe.lua and had not noticed those files in the target.
I took everything from the poe_zyxel.lua script and added to bin/poe.lua with a couple of minor fixups (this code was obviously not tested 
You can see the result here:
But still no go, unfortunately. Init, enabling port 3, and calling info:
root@OpenWrt:/# /tmp/poe.lua
OK, port open with values 'device: /dev/ttyS1, baud: 19200, data bits: 8, parity: none, stop bits: 1, flow control: off'
Getting status
send 20 01 ff ff ff ff ff ff ff ff ff 18
recv 20 01 02 08 01 e1 21 16 00 05 04 4d
01 e1 21 05
Getting status
send 20 02 ff ff ff ff ff ff ff ff ff 19
recv 20 02 02 08 01 e1 21 16 00 05 04 4e
01 e1 21 05
send 07 03 02 ff ff ff ff ff ff ff ff 04
recv 07 03 00 ff ff ff ff ff ff ff ff 02
send 17 04 02 ff ff ff ff ff ff ff ff 15
recv 17 04 00 ff ff ff ff ff ff ff ff 13
send 2b 05 ff ff ff ff ff ff ff ff ff 27
recv 2b 05 aa 01 00 00 00 01 01 ff 00 dc
send 0b 06 00 00 00 ff ff ff ff ff ff 0b
recv 0b 06 00 ff ff ff ff ff ff ff ff 09
send 0a 07 aa 00 01 ff ff ff ff ff ff b6
recv 0a 07 00 ff ff ff ff ff ff ff ff 09
send 41 08 01 00 00 02 00 00 00 41 ff 8c
recv 41 08 00 ff ff ff ff ff ff ff ff 41
send 18 09 00 03 02 00 00 ff ff ff ff 22
recv 18 09 00 00 ff ff ff ff ff ff ff 1a
send 18 0a 01 03 02 00 00 ff ff ff ff 24
recv 18 0a 01 00 ff ff ff ff ff ff ff 1c
send 18 0b 02 03 02 00 00 ff ff ff ff 26
recv 18 0b 02 00 ff ff ff ff ff ff ff 1e
send 18 0c 03 03 02 00 00 ff ff ff ff 28
recv 18 0c 03 00 ff ff ff ff ff ff ff 20
send 18 0d 04 03 02 00 00 ff ff ff ff 2a
recv 18 0d 04 00 ff ff ff ff ff ff ff 22
send 18 0e 05 03 02 00 00 ff ff ff ff 2c
recv 18 0e 05 00 ff ff ff ff ff ff ff 24
send 18 0f 06 03 02 00 00 ff ff ff ff 2e
recv 18 0f 06 00 ff ff ff ff ff ff ff 26
send 18 10 07 03 02 00 00 ff ff ff ff 30
recv 18 10 07 00 ff ff ff ff ff ff ff 28
send 1d 11 03 03 00 00 01 01 02 02 ff 39
recv 1d 11 03 00 00 00 01 00 02 00 ff 33
send 1c 12 03 03 00 03 01 03 02 03 ff 3f
recv 1c 12 03 00 00 00 01 00 02 00 ff 33
send 15 13 03 01 00 01 01 01 02 01 ff 31
recv 15 13 03 00 00 00 01 00 02 00 ff 2d
send 1d 14 07 07 04 04 05 05 06 06 ff 5c
recv 1d 14 07 00 04 00 05 00 06 00 ff 46
send 1c 15 07 03 04 03 05 03 06 03 ff 52
recv 1c 15 07 00 04 00 05 00 06 00 ff 46
send 15 16 07 01 04 01 05 01 06 01 ff 44
recv 15 16 07 00 04 00 05 00 06 00 ff 40
send 02 17 01 ff ff ff ff ff ff ff ff 12
recv 02 17 00 ff ff ff ff ff ff ff ff 11
send 27 18 00 ff ff ff ff ff ff ff ff 37
recv 27 18 02 00 00 00 00 00 00 00 00 41
send 28 19 00 01 01 01 02 01 03 01 ff 4a
recv 28 19 00 00 01 00 02 00 03 00 ff 46
send 28 1a 04 01 05 01 06 01 07 01 ff 4a
send 22 1b 00 00 ff ff ff ff ff ff ff 36
recv 22 1b 00 00 00 00 00 00 ff ff ff 3a
send 22 1c 00 01 ff ff ff ff ff ff ff 38
recv 22 1c 00 00 00 00 00 00 ff ff ff 3b
send 22 1d 00 02 ff ff ff ff ff ff ff 3a
recv 22 1d 00 00 00 00 00 00 ff ff ff 3c
send 22 1e 00 03 ff ff ff ff ff ff ff 3c
recv 22 1e 00 00 00 00 00 00 ff ff ff 3d
send 22 1f 00 04 ff ff ff ff ff ff ff 3e
recv 22 1f 00 00 00 00 00 00 ff ff ff 3e
send 22 20 00 05 ff ff ff ff ff ff ff 40
recv 22 20 00 00 00 00 00 00 ff ff ff 3f
send 22 21 00 06 ff ff ff ff ff ff ff 42
recv 22 21 00 00 00 00 00 00 ff ff ff 40
send 22 22 00 07 ff ff ff ff ff ff ff 44
recv 22 22 00 00 00 00 00 00 ff ff ff 41
send 17 23 01 ff ff ff ff ff ff ff ff 33
recv 17 23 00 ff ff ff ff ff ff ff ff 32
send 0b 24 01 00 00 ff ff ff ff ff ff 2a
recv 0b 24 00 ff ff ff ff ff ff ff ff 27
send 1c 25 00 00 01 00 02 00 03 00 ff 46
recv 1c 25 00 00 01 00 02 00 03 00 ff 46
send 1c 26 04 00 05 00 06 00 07 00 ff 46
send 1a 27 00 00 01 00 02 00 03 00 ff 46
recv 1a 27 00 00 01 00 02 00 03 00 ff 46
send 1a 28 04 00 05 00 06 00 07 00 ff 46
send 15 29 00 01 01 01 02 01 03 01 ff 47
recv 15 29 00 00 01 00 02 00 03 00 ff 43
send 15 2a 04 01 05 01 06 01 07 01 ff 47
send 16 2b 00 9c 01 9c 02 9c 03 9c ff b6
recv 16 2b 00 00 01 00 02 00 03 00 ff 46
send 16 2c 04 9c 05 9c 06 9c 07 9c ff b6
send 25 2d 00 ff ff ff ff ff ff ff ff 4a
recv 25 2d 00 01 00 02 01 02 00 ff ff 56
send 00 2e 00 00 ff ff ff ff ff ff ff 27
recv 00 2e 00 00 ff ff ff ff ff ff ff 27
send 03 2f 00 01 ff ff ff ff ff ff ff 2c
recv 03 2f 00 00 ff ff ff ff ff ff ff 2b
send 25 30 00 ff ff ff ff ff ff ff ff 4d
recv 25 30 00 00 00 02 01 02 00 ff ff 58
send 00 31 01 00 ff ff ff ff ff ff ff 2b
recv 00 31 01 00 ff ff ff ff ff ff ff 2b
send 03 32 01 01 ff ff ff ff ff ff ff 30
recv 03 32 01 00 ff ff ff ff ff ff ff 2f
send 25 33 01 ff ff ff ff ff ff ff ff 51
recv 25 33 01 00 00 02 01 02 00 ff ff 5c
send 00 34 02 00 ff ff ff ff ff ff ff 2f
recv 00 34 02 00 ff ff ff ff ff ff ff 2f
send 03 35 02 01 ff ff ff ff ff ff ff 34
recv 03 35 02 00 ff ff ff ff ff ff ff 33
send 25 36 02 ff ff ff ff ff ff ff ff 55
recv 25 36 02 00 00 02 01 02 00 ff ff 60
send 00 37 03 00 ff ff ff ff ff ff ff 33
recv 00 37 03 00 ff ff ff ff ff ff ff 33
send 03 38 03 01 ff ff ff ff ff ff ff 38
recv 03 38 03 00 ff ff ff ff ff ff ff 37
send 25 39 03 ff ff ff ff ff ff ff ff 59
recv 25 39 03 00 00 02 01 02 00 ff ff 64
send 00 3a 04 00 ff ff ff ff ff ff ff 37
recv 00 3a 04 00 ff ff ff ff ff ff ff 37
send 03 3b 04 01 ff ff ff ff ff ff ff 3c
recv 03 3b 04 00 ff ff ff ff ff ff ff 3b
send 25 3c 04 ff ff ff ff ff ff ff ff 5d
recv 25 3c 04 00 00 02 01 02 00 ff ff 68
send 00 3d 05 00 ff ff ff ff ff ff ff 3b
recv 00 3d 05 00 ff ff ff ff ff ff ff 3b
send 03 3e 05 01 ff ff ff ff ff ff ff 40
recv 03 3e 05 00 ff ff ff ff ff ff ff 3f
send 25 3f 05 ff ff ff ff ff ff ff ff 61
recv 25 3f 05 00 00 02 01 02 00 ff ff 6c
send 00 40 06 00 ff ff ff ff ff ff ff 3f
recv 00 40 06 00 ff ff ff ff ff ff ff 3f
send 03 41 06 01 ff ff ff ff ff ff ff 44
recv 03 41 06 00 ff ff ff ff ff ff ff 43
send 25 42 06 ff ff ff ff ff ff ff ff 65
recv 25 42 06 00 00 02 01 02 00 ff ff 70
send 00 43 07 00 ff ff ff ff ff ff ff 43
recv 00 43 07 00 ff ff ff ff ff ff ff 43
send 03 44 07 01 ff ff ff ff ff ff ff 48
recv 03 44 07 00 ff ff ff ff ff ff ff 47
send 25 45 07 ff ff ff ff ff ff ff ff 69
recv 25 45 07 00 00 02 01 02 00 ff ff 74
send 10 46 7f 02 ff ff ff ff ff ff ff d0
recv 10 46 7f 00 ff ff ff ff ff ff ff ce
send 2b 47 ff ff ff ff ff ff ff ff ff 69
recv 2b 47 aa 01 00 00 00 01 01 ff 00 1e
send 0b 48 00 00 00 ff ff ff ff ff ff 4d
recv 0b 48 00 ff ff ff ff ff ff ff ff 4b
send 2b 49 ff ff ff ff ff ff ff ff ff 6b
recv 2b 49 aa 00 00 00 00 01 01 ff 00 1f
send 0b 4a 01 00 00 ff ff ff ff ff ff 50
recv 0b 4a 00 ff ff ff ff ff ff ff ff 4d
send 00 4b 00 01 ff ff ff ff ff ff ff 45
recv 00 4b 00 00 ff ff ff ff ff ff ff 44
send 03 4c 00 01 ff ff ff ff ff ff ff 49
recv 03 4c 00 00 ff ff ff ff ff ff ff 48
send 00 4d 01 01 ff ff ff ff ff ff ff 48
recv 00 4d 01 00 ff ff ff ff ff ff ff 47
send 03 4e 01 01 ff ff ff ff ff ff ff 4c
recv 03 4e 01 00 ff ff ff ff ff ff ff 4b
send 00 4f 02 01 ff ff ff ff ff ff ff 4b
recv 00 4f 02 00 ff ff ff ff ff ff ff 4a
send 03 50 02 01 ff ff ff ff ff ff ff 4f
recv 03 50 02 00 ff ff ff ff ff ff ff 4e
send 00 51 03 01 ff ff ff ff ff ff ff 4e
recv 00 51 03 00 ff ff ff ff ff ff ff 4d
send 03 52 03 01 ff ff ff ff ff ff ff 52
recv 03 52 03 00 ff ff ff ff ff ff ff 51
send 00 53 04 01 ff ff ff ff ff ff ff 51
recv 00 53 04 00 ff ff ff ff ff ff ff 50
send 03 54 04 01 ff ff ff ff ff ff ff 55
recv 03 54 04 00 ff ff ff ff ff ff ff 54
send 00 55 05 01 ff ff ff ff ff ff ff 54
recv 00 55 05 00 ff ff ff ff ff ff ff 53
send 03 56 05 01 ff ff ff ff ff ff ff 58
recv 03 56 05 00 ff ff ff ff ff ff ff 57
send 00 57 06 01 ff ff ff ff ff ff ff 57
recv 00 57 06 00 ff ff ff ff ff ff ff 56
send 03 58 06 01 ff ff ff ff ff ff ff 5b
recv 03 58 06 00 ff ff ff ff ff ff ff 5a
send 00 59 07 01 ff ff ff ff ff ff ff 5a
recv 00 59 07 00 ff ff ff ff ff ff ff 59
send 03 5a 07 01 ff ff ff ff ff ff ff 5e
recv 03 5a 07 00 ff ff ff ff ff ff ff 5d
root@OpenWrt:~# ubus -v call poe port '{"enable":true,"port":3}'
{
}
send 00 5b 02 01 ff ff ff ff ff ff ff 57
recv 00 5b 02 00 ff ff ff ff ff ff ff 56
root@OpenWrt:~# ubus -v call poe info
{
"ports": [
],
"power_budget": "65W",
"power_consumption": "0W"
}
send 23 5c ff ff ff ff ff ff ff ff ff 76
recv 23 5c 00 00 03 02 07 02 ff ff 00 8b
send 2a 5d 00 ff ff ff ff ff ff ff ff 7f
recv 2a 5d 00 00 00 00 00 00 00 00 00 87
Oh, yes, and I changed the sequence number thing to increase for every command. Wondered if the reuse could confuse the firmware, and it certainly confused me.
But still no power on port 3. Which has a RPi4 with the PoE hat connected for this test. Known to be working with another PoE switch, and also working fine with the OEM firmware on the GS1900-10HP. So there is still some magic piece missing here.
I'm currently looking at the implementation in D-Link firmwares, which also has a global port enable (command 06). I'll update the wiki later, but you could try inserting this command in the PoE initialisation:
06 sq 01 ff ff ff ff ff ff ff ff ck
Thanks. I've now tried the 06 sq 01 command as well as lots of random other changes. Still no success. I have concluded that there is no point to continue without some idea on exactly what goes wrong. I need to look at what the ZyXEL firmware does differently.
Unfortunately, I am not equipped (or qualified 
) to peek at two pins 0.5 mm apart on an QFP48 package, so I have ruled out snooping on the microcontroller. Has anyone else done this? And if so, are the raw traces available anywhere? I guess it's easy to miss a detail or two when analyzing, and I can offer an extra pair of eyes looking at it.
Another option is getting the OEM source. I have sent a request to ZyXEL, who in my experience are among the best wrt following their GPL obligations. So I do expect to get the sources in a few days. But I also expect the PoE application and similar stuff to have a closed license, and only be provided as binaries (which I consider a pity, but within their full rights). Still, this will with some luck provide the means to rebuild the OEM image with a few tweaks. If I can get an old enough toolchain running. That's usuatlly the biggest problem there.
Then there is the possibility of modifying the OEM binary image I already have. I guess it should be possible to gain a normal root shell there, and maybe even install a serial snooping tool? Of course, there is again the big question of whether this is within my capabilities, but I can give it a try.
Or maybe just lean back and wait for someone else to figure this out While I do something else. So I started looking at the SFP slots. They have worked just fine for my limited testing so far. But it would be nice to have access to the "eeprom", and in particular do the DOM readings. Example from the OEM firmware with a SFP with DOM support and no connection in port 10:
GS1900# sh fiber-transceiver interfaces 9-10
Port | Temperature | Voltage | Current | Output power | Input power | OE-Present | LOS
| [C] | [Volt] | [mA] | [mWatt] | [mWatt] | |
===================================================================================================
9 | N/S | N/S | N/S | N/S | N/S | Remove | Loss
10 | 40.41 (OK) | 3.29 (OK) | 4.19 (OK) | 0.26 (OK) | 0.00 (E) | Insert | Loss
In my naïvity, I imagined that I should simply be able to dump something from the i2c buses already defined in the DTS. But that was also a nogo:
root@OpenWrt:/# i2cdetect -l
i2c-1 i2c i2c-gpio-1 I2C adapter
i2c-0 i2c i2c-gpio-0 I2C adapter
root@OpenWrt:/# i2cdetect 1
i2cdetect: WARNING! This program can confuse your I2C bus
Continue? [y/N] y
0 1 2 3 4 5 6 7 8 9 a b c d e f
00: -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --
root@OpenWrt:/# i2cdump 1 0x50
i2cdump: WARNING! This program can confuse your I2C bus
Continue? [y/N] y
0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef
00: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
10: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
20: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
30: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
40: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
50: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
60: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
70: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
80: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
90: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
a0: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
b0: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
c0: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
d0: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
e0: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
f0: XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XXXXXXXXXXXXXXXX
So I am missing something here as well, and starting to wonder it this is really for me at all...
The pin definitions in the DTS seem to match the board configuration the OEM firmware nicely presents in "show tech-support" output:
====== Fiber =================
Fiber Port Number: 2
------------ Fiber Detect
LPort Present MediaChg OE Status LOS Status
------ -------- --------- ---------------------- ----------------------
8 OE OE Enabled (GPIO:EXT_26) Enabled (GPIO:EXT_27)
9 OE OE Enabled (GPIO:EXT_32) Enabled (GPIO:EXT_33)
------------ Fiber Optical
LPort SMI DEV SMI TYPE ID Delay SCK SDA
------ -------- --------- ----- ------- ------ ------
8 SFP1 8 BITS 0x50 4000 EXT_25 EXT_24
9 SFP2 8 BITS 0x50 4000 EXT_31 EXT_30
------------ Fiber TX Disable
LPort GPIO
------ ------
8 EXT_23
9 EXT_29
Is this just me not understanding something basic again?
It seems that you are trying to get stuff from 0x50 which is a dedicated SFP basic page.
You can only see it when there is an SFP module inserted, if there is an advanced page with DOM you will also see 0x51.
You can see that they have 2 I2C buses as you need one per SFP or to use a switch.
Yes, there is one bus defined per SFP slot, but as you can see from the i2cdetect there is nothing showing up on any adress. Nothing on either 0x50 or 0x51.