Support for RTL838x based managed switches

For Developers
646

@Borromini

Motherboard from 24HP is totally different. This wiki site:http://wikidevi.wi-cat.ru/ZyXEL_GS1900-24 shows 10pin header j5 as serial. However I have tried al pins in that j5 block and only midle pin of top row is ground and most right pin at bottom row is ~6V all the other pins are 0.15v not 3,3v. These pins indeed matches IDC10 suggested by @slh !
Orientation is bottom of board are etherports facing towards myself on front of router and top of board is backside of router facing away from me.

@bmork
I did flash it from a v2.40 Zyxel firmware maybe that was less strict on rejecting this AAZI 10HP version. However the first time it did complain about the name of the image being to long 64characters. Renaming it to "2102rc4.bin" did flash succesfull and asked for rebooting so I did.

Interresting note on shorting J2 jumper!
The switch starts to go on and ethernet interface goes up for ~30 seconds enough to let Wireshark capture packets of the mac address of the Zyxel searching for 192.168.154.80 and tell to 192.168.154.89... If my machine responds with static IP.80 nothing happens I cannot ping it. BTW shorting J2 didn't magically make J5 pins go to 3,3v or something...

Anyone noticed a recovery environment on these switches related to this ip address 192.168.154.89 maybe in u-boot with specific tftp recovery filename?

Update J4 14solderpoints:
There is also a J4 14pin pinless header under the POE board on the mainboard, with 3 pins measuring 3.4v on resistor r126,r128,r131.

647

@bmork
Could you try to make an openwrt initfs/kernel image for your GS1900-10HP with the 24HP AAHM identifier and see if the original Zyxel webinterface v2.40 rejects it or just flashes it as in my case?

648

That's strange. I only discovered the image creation bug because one of my 10HPs rejected the image due to the version code mismatch.

Given that the OEM firmware is the same I can't see how an image with the same issue could possibly be accepted by another model. The only significant difference is that my 10HP was running V2.50.0. But I find it unlikely that this is a bug ZyXEL fixed between V2.40.0 and V2.50.0. Much more likely that it is something we do wrong. I just can't understand what that would be.

649

Sorry, both my 10HPs are in "production" use now. I can't boot OEM firmware on them.

1 Like
650

Its ok, but like you mention its really strange since I used a openwrt image indeed without any correct identifier...

hexdump -C openwrt-21.02.0-rc4-realtek-generic-zyxel_gs1900-10hp-initramfs-kernel.bin | tail 
005b8800  42 97 0a 87 18 26 bc 4b  29 62 d6 24 99 7d 6b e0  |B....&.K)b.$.}k.|
005b8810  0f fd 43 f8 86 eb 18 50  21 4b ad f1 01 dd db 24  |..C....P!K.....$|
005b8820  7e 2f a0 97 78 42 11 4d  e8 79 32 02 70 5d 14 9f  |~/..xB.M.y2.p]..|
005b8830  72 e0 e9 b3 51 70 0b 71  39 5f 5f 1c c3 b1 0e 27  |r...Qp.q9__....'|
005b8840  f9 e4 d4 ed 50 eb ba 7e  95 47 2d e9 f4 c5 93 dc  |....P..~.G-.....|
005b8850  ce e8 88 d2 3f ab 4e 38  05 e5 07 fd 28 e1 8d 3e  |....?.N8....(..>|
005b8860  86 85 84 22 44 7e 83 7e  56 bb 41 af ae be 09 8d  |..."D~.~V.A.....|
005b8870  2a 46 0a ff 3f c8 7d 3c  f7 ea 55 d7 00 56 45 52  |*F..?.}<..U..VER|
005b8880  53 0a                                             |S.|
005b8882

@bmork and @Borromini later this weak I will solder 3 pins on j14 header and see if that gives a u-boot uart serial output. Do I need to press any key's to make it verbose?

Thanks for the input sofar.

651

Do you have a good resolution photo of the PCB somewhere?

Guesstimating, I'd say it should be similar to the gs1900-24, gs1900-48 and gs1900-48hp, with a 10-pin IDC10 connector (J4 or J5?) - and probably RS232C powerlevels (not 3.3V?!), courtesy of U8.

1 Like
652

The mistake you made is loading firmware that wants 128MB of RAM when this device only has 64MB. Once you get serial port access you should be able to recover by using u-boot to change the active firmware to Partition 1 instead of partition 0. You will then need an image built for this device with only 64MB of RAM!

2 Likes
653

The board of the GS1900-24HP indeed has more resemblance with the gs1900-48 not the gs1900-24 which @Borromini hinted earlier, although the connectors or pinout groups are named the other way around J4<>J5 and angled 180 degrees.

Further looking at the pinout of J4 on this 48 board and J5 on my 24HP indeed fits a IDC10 (AT/EVEREX) connector (also the print on my PCB with a stub matches the cable) with pin5 ground and pin 2/3 TX/RX which is written on the pcb picture seen here:

On my GS1900-24HP I connected a old IDC10 to DB9sub with null model cable on 2 different usb to serial adapters even a real serial port on a older intel atom board but still no output of bootloader. Last try will be an old intel P3, maybe more compatible with -+5V to -+15V.

@anon13997276 Did this J4 connector with IDC10 to DSUB and null modem cable worked on your GS1900-48 for getting serial, if so at what settings/voltages? Update: already working with shorter cable 115200 8n1 pin 5,2,3.

654

Priority or good practice would indeed be serial/tftp booting to ram and maybe even backup the spi flash chip. All of this was possible before hand, but figuring there was a backup mechanism and the flash chips were the same on the 10HP and 24HP I choose this option.

On the otherhand this mistake showed that it is indeed still possible to flash firmware from a different model via the v2.40 original webinterface without any protection warnings like @bmork noticed with his 10HP models refusing firmware files with the wrong model info in its hexdump tail.

Soldering 3 pins on J4 and see if uart 3,3volt will do something and last resort using the 8soic spi clip with the raspberry pi or CH341A and see if an insuti flashrom readout/flash will give possibilities to trigger backup partition boot. Don't have a agenda for that yet.

655

Please do provide a high resolution photo of the gs1900-24, before starting too invasive procedures. Ideally both an overview of the whole board and the area around j4, j5 and u8 in particular.

656

Photos for the GS1900-24HP are on my todo for the weekend and fill biot or tohwiki here. BTW didn't understand "u8"mentioned earlier but I see now its a place on the PCB.

657

u8 seems to be a level shifter in front of the serial port on the gs1900-48, gs1900-48hp and gs1900-24, I just assume it to be similar on the gs1900-24hp. That's the interesting question, is it populated or not

658

(Un)bricked!
On the GS1900-24HP u8 is called u7, by skipping the ICD10-DSUB-breakout <-> null-modem-cable and directly wiring the J5 pins 5,2,3 on the USB rs232 DSUB I had u-boot access!

@RaylynnKnight although the boot parameter mem=64M was used it is not accepted and indeed crashed on initializing 128MB see log:

U-Boot Version: 2.0.0.59413 (Jul 08 2015 - 10:01:00)

CPU:   500MHz
DRAM:  64 MB
FLASH: 16 MB
Model: ZyXEL_GS1900_24HP
SN:    S192L33000175
MAC:   BC:CF:4F:59:7E:F5 - BC:CF:4F:59:7F:0F

Press SPACE to abort boot script:  0 
## Booting image from partition ... 0
   Version:   MIPS OpenWrt Linux-5.4.137
   Created:   2021-07-31  17:21:01 UTC
   Size:      5998658 Bytes = 5.7 MB
   Verifying Checksum ... OK
   Uncompressing Image ... OK

Starting ...

[    0.000000] Linux version 5.4.137 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r16256-2d5ee43dc6)) #0 Sat Jul 31 17:21:01 21
[    0.000000] RTL838X model is 83826800
[    0.000000] SoC Type: RTL8382
[    0.000000] Kernel command line: console=ttyS0,115200 mem=64M quiet 
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019070 (MIPS 4KEc)
[    0.000000] MIPS: machine is ZyXEL GS1900-10HP Switch
[    0.000000] Registering _machine_restart
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Using appended Device Tree.
[    0.000000] Primary instruction cache 16kB, VIPT, 4-way, linesize 16 bytes.
[    0.000000] Primary data cache 16kB, 2-way, VIPT, cache aliases, linesize 16 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] On node 0 totalpages: 32768
[    0.000000]   Normal zone: 288 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32768 pages, LIFO batch:7
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 114700K/131072K available (5088K kernel code, 171K rwdata, 636K rodata, 8944K init, 207K bss, 16372K reserved, 0K cm)
[    0.000000] CPU 0 Unable to handle kernel paging request at virtual address 2610003c, epc == 8011d2d8, ra == 805cf0b0
[    0.000000] Oops[#1]:
[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.4.137 #0
[    0.000000] $ 0   : 00000000 00000001 26100038 87c02e84
[    0.000000] $ 4   : 87c02000 00000100 00000000 00000000
[    0.000000] $ 8   : 0000000c 804f1d50 00000100 00002000
[    0.000000] $12   : 00000400 0000000b 00000004 00000007
[    0.000000] $16   : 87c02000 00000000 00000900 80eb0000
[    0.000000] $20   : 00000000 00000000 00000100 00000000
[    0.000000] $24   : 00000020 00000000                  
[    0.000000] $28   : 8059a000 8059bde8 00000001 805cf0b0
[    0.000000] Hi    : 00000000
[    0.000000] Lo    : 00000020
[    0.000000] epc   : 8011d2d8 0x8011d2d8
[    0.000000] ra    : 805cf0b0 0x805cf0b0
[    0.000000] Status: 10100802 KERNEL EXL 
[    0.000000] Cause : 00800008 (ExcCode 02)
[    0.000000] BadVA : 2610003c
[    0.000000] PrId  : 00019070 (MIPS 4KEc)
[    0.000000] Modules linked in:
[    0.000000] Process swapper (pid: 0, threadinfo=(ptrval), task=(ptrval), tls=00000000)
[    0.000000] Stack : 00000001 805cf038 00000000 00000008 00000087 80568f0c 80510e6c 00000100
[    0.000000]         00000000 805cf0b0 80000400 00000000 00000000 00000900 00000000 00000080
[    0.000000]         80568f0c 00000008 80568f10 00000000 805e8db4 805cf2a0 81000000 80eb0000
[    0.000000]         805e76e8 8011b458 00000100 80eb0000 80eb0000 80510f5c 80510000 80510e10
[    0.000000]         805e76e8 805e77c0 00000001 80eb0000 80eb0000 805e6668 805e40b8 80fda4e0
[    0.000000]         ...
[    0.000000] Call Trace:
[    0.000000] [<805cf038>] 0x805cf038
[    0.000000] [<805cf0b0>] 0x805cf0b0
[    0.000000] [<80000400>] 0x80000400
[    0.000000] [<805cf2a0>] 0x805cf2a0
[    0.000000] [<8011b458>] 0x8011b458
[    0.000000] [<80000400>] 0x80000400
[    0.000000] [<805d2160>] 0x805d2160
[    0.000000] [<805c4964>] 0x805c4964
[    0.000000] [<805c42e4>] 0x805c42e4
[    0.000000] 
[    0.000000] Code: 12000041  8fbf0024  8e020000 <8c470004> 8e060000  8cd10000  12200043  8cc20008  10400041 
[    0.000000] 
[    0.000000] random: get_random_bytes called from 0x80024030 with crng_init=0
[    0.000000] ---[ end trace 0000000000000000 ]---
[    0.000000] Kernel panic - not syncing: Fatal exception
[    0.000000] Rebooting in 1 seconds..
[    0.000000] System restart.
[    0.000000] PLL control register: aaaaaaaf, applying reset value aaaaaaaf

Flashed back v2.60.2 to first partition 0, and now all is back to normal.

GS1900# show board     
****************************
 GS1900-24HP
****************************
============================
 Board GPIO
============================
Device  Pin  Direction  Default  Current
------- ---- ---------- -------- --------
INT     0    OUT        0        0       
INT     1    OUT        1        1       
INT     2    OUT        0        0       
INT     3    OUT        0        0       
INT     8    OUT        1        1       
INT     9    OUT        1        1       
INT     12   IN         0        0       
INT     13   OUT        1        1       
INT     14   OUT        1        1       
INT     15   OUT        1        1       
INT     16   IN         0        0       
INT     17   OUT        1        1       
INT     18   OUT        0        0       
INT     19   IN         0        0       
INT     20   OUT        1        1       
INT     21   IN         0        0       
INT     22   IN         0        0       
INT     23   OUT        1        1       
EXT     0    IN  (IN  ) 0        1       
EXT     1    IN  (IN  ) 0        0       
EXT     2    IN  (IN  ) 0        1       
EXT     3    IN  (IN  ) 0        1       
EXT     4    IN  (IN  ) 0        0       
EXT     5    OUT (OUT ) 1        1       
EXT     6    OUT (OUT ) 1        1       
EXT     7    IN  (IN  ) 0        1       
EXT     8    OUT (OUT ) 1        1       
EXT     13   OUT (OUT ) 0        1       
EXT     14   OUT (OUT ) 0        0       
EXT     15   OUT (OUT ) 0        0       
EXT     16   OUT (OUT ) 0        0       
EXT     17   OUT (IN  ) 0        0       
EXT     18   OUT (IN  ) 0        0       
EXT     21   IN  (IN  ) 0        0       
EXT     22   IN  (IN  ) 0        1       
EXT     23   OUT (OUT ) 0        0       
EXT     24   OUT (OUT ) 0        1       
EXT     25   OUT (OUT ) 0        1       
EXT     26   IN  (IN  ) 0        1       
EXT     27   IN  (IN  ) 0        1       
EXT     28   IN  (IN  ) 0        1       
EXT     29   OUT (OUT ) 0        0       
EXT     30   OUT (OUT ) 0        1       
EXT     31   OUT (OUT ) 0        1       
EXT     32   IN  (IN  ) 0        1       
EXT     33   IN  (IN  ) 0        1       
EXT     34   OUT (OUT ) 1        1       

============================
 Board Configuration
============================
====== Port ==================
Type       Usr  Phy     Media       Speed          Duplex   Attr
---------- ---- ------- ----------- -------------- -------- -------
1000M      1    (0) 0   Copper      (A) ALL        Auto     1      
1000M      2    (0) 1   Copper      (A) ALL        Auto     1      
1000M      3    (0) 2   Copper      (A) ALL        Auto     1      
1000M      4    (0) 3   Copper      (A) ALL        Auto     1      
1000M      5    (0) 4   Copper      (A) ALL        Auto     1      
1000M      6    (0) 5   Copper      (A) ALL        Auto     1      
1000M      7    (0) 6   Copper      (A) ALL        Auto     1      
1000M      8    (0) 7   Copper      (A) ALL        Auto     1      
1000M      9    (0) 8   Copper      (A) ALL        Auto     1      
1000M      10   (0) 9   Copper      (A) ALL        Auto     1      
1000M      11   (0) 10  Copper      (A) ALL        Auto     1      
1000M      12   (0) 11  Copper      (A) ALL        Auto     1      
1000M      13   (0) 12  Copper      (A) ALL        Auto     1      
1000M      14   (0) 13  Copper      (A) ALL        Auto     1      
1000M      15   (0) 14  Copper      (A) ALL        Auto     1      
1000M      16   (0) 15  Copper      (A) ALL        Auto     1      
1000M      17   (0) 16  Copper      (A) ALL        Auto     1      
1000M      18   (0) 17  Copper      (A) ALL        Auto     1      
1000M      19   (0) 18  Copper      (A) ALL        Auto     1      
1000M      20   (0) 19  Copper      (A) ALL        Auto     1      
1000M      21   (0) 20  Copper      (A) ALL        Auto     1      
1000M      22   (0) 21  Copper      (A) ALL        Auto     1      
1000M      23   (0) 22  Copper      (A) ALL        Auto     1      
1000M      24   (0) 23  Copper      (A) ALL        Auto     1      
1000M      25   (0) 24  Fiber       (A) ALL        Auto     0      
1000M      26   (0) 26  Fiber       (A) ALL        Auto     0      


====== Fiber =================
Fiber Port Number: 2

------------ Fiber Detect
LPort  Present  MediaChg  OE Status              LOS Status
------ -------- --------- ---------------------- ----------------------
24     OE       OE        Enabled  (GPIO:EXT_26) Enabled  (GPIO:EXT_27)
25     OE       OE        Enabled  (GPIO:EXT_32) Enabled  (GPIO:EXT_33)

------------ Fiber Optical
LPort  SMI DEV  SMI TYPE  ID    Delay   SCK    SDA
------ -------- --------- ----- ------- ------ ------
24     SFP1     8 BITS    0x50  4000    EXT_25 EXT_24
25     SFP2     8 BITS    0x50  4000    EXT_31 EXT_30

------------ Fiber TX Disable
LPort  GPIO
------ ------
24     EXT_23
25     EXT_29


====== Button ================

------------ Reset Button
GPIO: EXT_3 
Timer: 3(sec)  Action: Reboot
Timer: 6(sec)  Action: Restore Factory


====== Led ===================
SYS (REG)
ALARM (REG)


====== Reset =================
Type: GPIO
GPIO: EXT_5 


====== WatchDog ==============
Type: REG


====== PoE ===================

Power Configuration
--------------------------------
Nominal Power (admin) : 170000 mW
Nominal Power (actual): 180000 mW

Class Power Configuration
--------------------------------
Class    Power Limit (mW)
-------- ----------------
0        16200           
1        4200            
2        7400            
3        16200           

Port Configuration
--------------------------------
LPort    PoE Port Default Mode
-------- -------- ----------------
0        0.0      IEEE 802.3at
1        0.1      IEEE 802.3at
2        0.2      IEEE 802.3at
3        0.3      IEEE 802.3at
4        0.4      IEEE 802.3at
5        0.5      IEEE 802.3at
6        0.6      IEEE 802.3at
7        0.7      IEEE 802.3at
8        0.8      IEEE 802.3at
9        0.9      IEEE 802.3at
10       0.10     IEEE 802.3at
11       0.11     IEEE 802.3at
12       0.12     IEEE 802.3at
13       0.13     IEEE 802.3at
14       0.14     IEEE 802.3at
15       0.15     IEEE 802.3at
16       0.16     IEEE 802.3at
17       0.17     IEEE 802.3at
18       0.18     IEEE 802.3at
19       0.19     IEEE 802.3at
20       0.20     IEEE 802.3at
21       0.21     IEEE 802.3at
22       0.22     IEEE 802.3at
23       0.23     IEEE 802.3at

LED Configuration
--------------------------------

Port LED Configuration
--------------------------------
Port     Type     Configuration                   
-------- -------- --------------------------------
0        SW_CTRL  Entity: 1, Port 0
1        SW_CTRL  Entity: 1, Port 1
2        SW_CTRL  Entity: 1, Port 2
3        SW_CTRL  Entity: 1, Port 3
4        SW_CTRL  Entity: 1, Port 4
5        SW_CTRL  Entity: 1, Port 5
6        SW_CTRL  Entity: 1, Port 6
7        SW_CTRL  Entity: 1, Port 7
8        SW_CTRL  Entity: 1, Port 8
9        SW_CTRL  Entity: 1, Port 9
10       SW_CTRL  Entity: 1, Port 10
11       SW_CTRL  Entity: 1, Port 11
12       SW_CTRL  Entity: 1, Port 12
13       SW_CTRL  Entity: 1, Port 13
14       SW_CTRL  Entity: 1, Port 14
15       SW_CTRL  Entity: 1, Port 15
16       SW_CTRL  Entity: 1, Port 16
17       SW_CTRL  Entity: 1, Port 17
18       SW_CTRL  Entity: 1, Port 18
19       SW_CTRL  Entity: 1, Port 19
20       SW_CTRL  Entity: 1, Port 20
21       SW_CTRL  Entity: 1, Port 21
22       SW_CTRL  Entity: 1, Port 22
23       SW_CTRL  Entity: 1, Port 23

SMI Configuration
--------------------------------
Type: UART
Buadrate: 19200 bps

Disabled Pin Configuration
--------------------------------
Type     GPIO     Active  
-------- -------- --------
DISABLE  EXT_13   0   

Reset Pin Configuration
--------------------------------
Type     GPIO     Active   Period Time(sec) Restart(sec)     
-------- -------- -------- ---------------- ---------------- 
RESET    EXT_34   0        500              3500
1 Like
659

@walterav Nevermind me, I overlooked the HP suffix. Glad you got it going again.

660

That's the problem of having to fly blind, without an idea how the gs1900-24 PCB looks like :wink:

That's to be expected, as the DTS overrides and ignores your cmdline parameters, you must build your own image (as there is no other device with <128 MB merged so far), with:

	memory@0 {
		device_type = "memory";
		reg = <0x0 0x4000000>;
	};

I would suggest to take @RaylynnKnight's gs1900-16 support as example, as that should be closer to your device than the gs1900-10hp (PoE is mostly userspace, aside from the UART settings needed for the communication channel). Extend the (ethernet-) port definitions based on the information gathered from show tech-support on the OEM firmware.

While at it, also use the correct ZYXEL_VERS and apply https://patchwork.ozlabs.org/project/openwrt/patch/20210624210408.19248-1-bjorn@mork.no/.

2 Likes
661

In addition to the GS1900-16 I also have the GS1900-24HP, GS1900-24E and GS1900-24. I just haven't had any time lately to work on them. Too many work and family obligations! I did note that the GS1900-24 and GS1900-24HP both have only 64MB RAM. The GS1900-16 and GS1900-24E have 128MB. There is also was a GS1900-24EP available on Amazon in the US until recently.

3 Likes
662

Great to know that more people share this GS1900-24HP model.

@slh
Just added some pictures of the pcb on wikidevi.wi-cat.ru

663

Where do I sign-up for biot.com wiki switches to dump console output of show tech-support info?
@slh @RaylynnKnight @svanheule @biot

664

I opened a PR to add Kernel 5.10 support:

8 Likes
665

Any plans to push for official support for GS1900-16 please?