Looking at the Zyxel web-page there seems to be only one model of the GS1900-48, with only one firmware download. So the difference is not in something that is configured at compile-time such as GPIOs, but in something that is auto-detected and for this the CPU-model is a good candidate. I'll go through their source code to look at whether this might cause differences. Looks like
is a bit simplistic 
So, I figured out that the revision of the RTL8393 chips is given by the last digit of the model number divided by 2.
This gives in your case revision "B" (A is 0) and in mine "D" (because I have version 3).
Unfortunately, it looks as if there is a bigger difference in the features of Chip models < Revision C, one seems to be related to the 10GPort, the other to the PMASK table (it seems broken in revisions < C).
Could you try the following:
In target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/rtl839x.c edit function
rtl839x_write_mcast_pmask
to do nothing by commenting everything in {} out with /* */
and in function rtl839x_write_read_pmask
return 0x001fffffffffffff and comment everything else out?
If this does not work, you would need to help me figure out where it hangs by putting pr_info() into the code until you find the place it hangs.
May be the same issue as Switch-M48eG PN28480K.
U-Boot 2011.12.46351-1.00.09-svn5722 (Mar 12 2015 - 20:08:54)
Board: RTL839x CPU:700MHz LXB:200MHz MEM:400MHz
DRAM: 128 MB
SPI-F: 1x32 MB
Loading 65536B env. variables from offset 0x80000
#### Periphery Devices Init Successfully ####
Switch Model: RTL8393M_8218B_8218FB_2SFP (Port Count: 48)
Switch Chip: RTL8393M
Model Info: 83936802
### RTL8218B config - MAC ID = 0 ###
### RTL8218B config - MAC ID = 8 ###
### RTL8218B config - MAC ID = 16 ###
### RTL8218B config - MAC ID = 24 ###
### RTL8218B config - MAC ID = 32 ###
### RTL8218FB config - MAC ID = 40 ###
PHY[0]: disable EEE
PHY[1]: disable EEE
PHY[2]: disable EEE
PHY[3]: disable EEE
PHY[4]: disable EEE
PHY[5]: disable EEE
RTL839x# # rtk network on
Enable network
Please wait for PHY init-time ...
RTL839x# # tftp 0x81000000
*** Warning: no boot file name; using '0101A8C0.img'
Using rtl8390#0 device
TFTP from server 192.168.1.111; our IP address is 192.168.1.1
Filename '0101A8C0.img'.
Load address: 0x81000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
############################################
done
Bytes transferred = 6362748 (61167c hex)
RTL839x# # bootm
## Booting kernel from Legacy Image at 81000000 ...
Image Name: MIPS OpenWrt Linux-5.4.143
Created: 2021-09-12 13:37:17 UTC
Image Type: MIPS Linux Kernel Image (gzip compressed)
Data Size: 6362684 Bytes = 6.1 MB
Load Address: 80000000
Entry Point: 80000400
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 5.4.143 (musashino205@TAIHA.NET) (gcc version 10.3.0 (OpenWrt GCC 10.3.0 r17396+47-98eb95dd00)) #0 Sun Sep 12 13:37:17 2021
[ 0.000000] RTL838X model is ffffffff
[ 0.000000] RTL839X model is 83936802
[ 0.000000] SoC Type: RTL8393
[ 0.000000] Kernel command line:
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019555 (MIPS 34Kc)
[ 0.000000] MIPS: machine is Panasonic Switch-M48eG PN28480K
[ 0.000000] Registering _machine_restart
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Using appended Device Tree.
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] On node 0 totalpages: 32768
[ 0.000000] Normal zone: 288 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 32768 pages, LIFO batch:7
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] Kernel command line: console=ttyS0,9600
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=0001fd86
[ 0.000000] Readback ErrCtl register=0001fd86
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 113520K/131072K available (5156K kernel code, 191K rwdata, 1168K rodata, 9476K init, 199K bss, 17552K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 32
[ 0.000000] random: get_random_bytes called from start_kernel+0x288/0x468 with crng_init=0
[ 0.000000] timer_probe: no matching timers found
[ 0.000000] CPU frequency from device tree: 700MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5460744132 ns
[ 0.000008] sched_clock: 32 bits at 350MHz, resolution 2ns, wraps every 6135667710ns
[ 0.102036] Calibrating delay loop... 464.48 BogoMIPS (lpj=2322432)
[ 0.243325] pid_max: default: 32768 minimum: 301
[ 0.304248] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.400321] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.510664] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.638977] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.728466] pinctrl core: initialized pinctrl subsystem
[ 0.797699] NET: Registered protocol family 16
[ 0.889654] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[ 1.019532] clocksource: Switched to clocksource MIPS
[ 1.086319] NET: Registered protocol family 2
[ 1.142687] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 1.238227] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 1.347629] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 1.448405] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 1.541205] TCP: Hash tables configured (established 1024 bind 1024)
[ 1.625003] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 1.710824] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 1.802783] NET: Registered protocol family 1
[ 2.108820] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 2.200297] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 2.275960] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 2.434125] pinctrl-single bb000004.pinmux: 32 pins, size 4
[ 2.506796] Probing RTL838X GPIOs
[ 2.592639] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 2.676288] printk: console [ttyS0] disabled
[ 2.731406] b8002000.uart: ttyS0 at MMIO 0xb8002000 (irq = 31, base_baud = 12500000) is a 16550A
[ 2.847078] printk: console [ttyS0] enabled
[ 2.847078] printk: console [ttyS0] enabled
[ 2.957124] printk: bootconsole [early0] disabled
[ 2.957124] printk: bootconsole [early0] disabled
[ 3.081814] b8002100.uart: ttyS1 at MMIO 0xb8002100 (irq = 30, base_baud = 12500000) is a 16550A
[ 3.351180] brd: module loaded
[ 3.391738] Initializing rtl838x_nor_driver
[ 3.446885] SPI resource base is b8001200
[ 3.499680] Address mode is 4 bytes
[ 3.545536] rtl838x_nor_init called
[ 3.596596] rtl838x-nor b8001200.spi: mx25l25635e (32768 Kbytes)
[ 3.675848] 8 fixed-partitions partitions found on MTD device rtl838x_nor
[ 3.765294] Creating 8 MTD partitions on "rtl838x_nor":
[ 3.834097] 0x000000000000-0x000000080000 : "u-boot"
[ 3.900564] 0x000000080000-0x000000090000 : "u-boot-env"
[ 3.971649] 0x000000090000-0x0000000a0000 : "u-boot-env2"
[ 4.043847] 0x0000000a0000-0x000000100000 : "sysinfo"
[ 4.111452] 0x000000100000-0x000000e00000 : "fs_reserved"
[ 4.183652] 0x000000e00000-0x000001e00000 : "firmware"
[ 4.268353] 0x000001e00000-0x000001f00000 : "vlog_data"
[ 4.338306] 0x000001f00000-0x000002000000 : "elog_data"
[ 4.409086] libphy: Fixed MDIO Bus: probed
[ 4.465363] Probing RTL838X eth device pdev: 87ca4800, dev: 87ca4810
[ 4.557479] Found SoC ID: 8393: RTL8393, family 8390
[ 4.622894] Using MAC 0000005040101ab6
[ 4.672330] libphy: rtl839x-eth-mdio: probed
[ 5.482638] NET: Registered protocol family 10
[ 5.546024] Segment Routing with IPv6
[ 5.594322] NET: Registered protocol family 17
[ 5.653138] 8021q: 802.1Q VLAN Support v1.8
[ 5.708991] i2c-gpio i2c-gpio-0: Slow GPIO pins might wreak havoc into I2C/SMBus bus timing
[ 5.819498] i2c-gpio i2c-gpio-0: using lines 23 (SDA) and 22 (SCL)
[ 5.901178] i2c-gpio i2c-gpio-1: Slow GPIO pins might wreak havoc into I2C/SMBus bus timing
[ 6.011613] pca953x 1-0020: using no AI
[ 6.063773] pca953x 1-0075: using no AI
[ 6.115478] GPIO line 492 (ext-switch-reset) hogged as output/high
[ 6.197274] GPIO line 494 (portled-sregister-reset) hogged as output/high
[ 6.287329] i2c-gpio i2c-gpio-1: using lines 9 (SDA) and 8 (SCL)
[ 6.929560] random: fast init done
[ 138.159580] random: crng init done
You meant rtl839x_read_mcast_pmask, right?
I compiled with the modifications. It's still the same.
II: Copied Preloader data from 0x9fc00000(15804B) to 0x9f000000.
II: Cleared Preloader BSS section at 0x9f003dbc(0B).
II: PLL...�II: PLL is set by SW... OK
Setting DTR
II: DRAM is set by software calibration... PASSED
DCDR(0xb8001060):0x80000000
DIDER(0xb8001050):0x80800000
MCR (0xb8001000):0x200421e0, 0x21220000, 0x65533b30, 0x05050313
DTR2(0xb8001010):0x08311000
PHY Registers(0xb8001500):
0xb8001500:0x80060730, 0x0000007f, 0xa1a00000, 0xffffffff
0xb8001510:0x001a0d00, 0x001a0d00, 0x001a0d00, 0x00180c00
0xb8001520:0x001c0e00, 0x00180c00, 0x001c0e00, 0x00180c00
0xb8001530:0x00180c00, 0x001a0d00, 0x00180c00, 0x001a0d00
0xb8001540:0x001a0d00, 0x001a0d00, 0x00180c00, 0x001a0d00
0xb8001550:0x00180c00, 0x00180c00, 0x001a0d00, 0x00160b00
0xb8001560:0x00180c00, 0x00160b00, 0x001a0d00, 0x00160b00
0xb8001570:0x00180c00, 0x00180c00, 0x00160b00, 0x00180c00
0xb8001580:0x00160b00, 0x00180c00, 0x00160b00, 0x00180c00
0xb8001590:0x00000000, 0x09498696, 0xa0a01850, 0x5050acad
0xb80015a0:0x5252a5a5, 0x00000000, 0x00000000, 0x00000000
II: Selected DRAM model #0.
II: Copying U-Boot from 0x9fc03dbc(225728B) to 0x83f00000... OK
II: NOR SPI Flash... searching flash parameters... supported flash ID: [c22018][c22018][c22018]... detected flash ID: [c22018]... OK
U-Boot 1.0.2-svn45936 (Jan 15 2014 - 16:30:16)
Board: RTL839x CPU:750MHz LXB:200MHz MEM:400MHz
DRAM: 128 MB
SPI-F: 1x16 MB
Loading 1024B env. variables from offset 0x40000
Switch Model: ZyXEL_GS1900_48 (Port Count: 50)
Switch Chip: RTL8393M
Model Info: 83936802
### RTL8218B config - MAC ID = 0 ###
### RTL8218B config - MAC ID = 8 ###
### RTL8218B config - MAC ID = 16 ###
### RTL8218B config - MAC ID = 24 ###
### RTL8218B config - MAC ID = 32 ###
### RTL8218B config - MAC ID = 40 ###
PHY[0]: disable EEE
PHY[1]: disable EEE
PHY[2]: disable EEE
PHY[3]: disable EEE
PHY[4]: disable EEE
PHY[5]: disable EEE
PHY[6]: not supported in EEE
Net: Net Initialization Skipped
rtl8390#0
Hit any key to stop autoboot: 1 0
RTL839x# setenv bootargs console=ttyS0,115200 mem=128M;
RTL839x# setenv ipaddr 192.168.2.16;
RTL839x# setenv serverip 192.168.2.8;
RTL839x# rtk network on;
Enable network
Please wait for PHY init-time ...
RTL839x# tftpboot 0x84f00000 zyxel/kinit.bin;
Using rtl8390#0 device
TFTP from server 192.168.2.8; our IP address is 192.168.2.16
Filename 'zyxel/kinit.bin'.
Load address: 0x84f00000
Loading: *#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################
done
Bytes transferred = 6043077 (5c35c5 hex)
RTL839x# bootm
## Booting kernel from Legacy Image at 84f00000 ...
Image Name: MIPS OpenWrt Linux-5.4.143
Created: 2021-09-11 8:16:17 UTC
Image Type: MIPS Linux Kernel Image (gzip compressed)
Data Size: 6043013 Bytes = 5.8 MB
Load Address: 80000000
Entry Point: 80000400
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 5.4.143 (edwin@medusa) (gcc version 10.3.0 (OpenWrt GCC 10.3.0 r17476-27a99e40f7)) #0 Sat Sep 11 08:16:17 2021
[ 0.000000] RTL838X model is ffffffff
[ 0.000000] RTL839X model is 83936802
[ 0.000000] SoC Type: RTL8393
[ 0.000000] Kernel command line: console=ttyS0,115200 mem=128M
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019555 (MIPS 34Kc)
[ 0.000000] MIPS: machine is Zyxel GS1900-48
[ 0.000000] Registering _machine_restart
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Using appended Device Tree.
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] On node 0 totalpages: 32768
[ 0.000000] Normal zone: 288 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 32768 pages, LIFO batch:7
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] Kernel command line: console=ttyS0,115200
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=00000004
[ 0.000000] Readback ErrCtl register=00000004
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 114868K/131072K available (5122K kernel code, 169K rwdata, 1116K rodata, 8240K init, 199K bss, 16204K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 32
[ 0.000000] random: get_random_bytes called from start_kernel+0x288/0x468 with crng_init=0
[ 0.000000] timer_probe: no matching timers found
[ 0.000000] CPU frequency from device tree: 700MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5460744132 ns
[ 0.000007] sched_clock: 32 bits at 350MHz, resolution 2ns, wraps every 6135667710ns
[ 0.009211] Calibrating delay loop... 464.48 BogoMIPS (lpj=2322432)
[ 0.076464] pid_max: default: 32768 minimum: 301
[ 0.082090] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.090663] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.107340] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.118924] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.127023] pinctrl core: initialized pinctrl subsystem
[ 0.133736] NET: Registered protocol family 16
[ 0.170738] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[ 0.185800] clocksource: Switched to clocksource MIPS
[ 0.192943] NET: Registered protocol family 2
[ 0.198175] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.207306] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 0.217178] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.226170] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.234468] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.242136] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.249837] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 0.258344] NET: Registered protocol family 1
[ 0.422096] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 0.437146] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.443947] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.477215] pinctrl-single bb001000.pinmux: 32 pins, size 4
[ 0.484047] Probing RTL8231 GPIOs
[ 0.487928] rtl8231_init called, MDIO bus ID: 3
[ 0.494733] Probing RTL838X GPIOs
[ 0.540625] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 0.549183] printk: console [ttyS0] disabled
[ 0.554177] b8002000.uart: ttyS0 at MMIO 0xb8002000 (irq = 31, base_baud = 12500000) is a 16550A
[ 0.564589] printk: console [ttyS0] enabled
[ 0.564589] printk: console [ttyS0] enabled
[ 0.574495] printk: bootconsole [early0] disabled
[ 0.574495] printk: bootconsole [early0] disabled
[ 0.586527] b8002100.uart: ttyS1 at MMIO 0xb8002100 (irq = 30, base_baud = 12500000) is a 16550A
[ 0.738409] brd: module loaded
[ 0.742423] Initializing rtl838x_nor_driver
[ 0.747496] SPI resource base is b8001200
[ 0.752276] Address mode is 3 bytes
[ 0.756468] rtl838x_nor_init called
[ 0.765567] rtl838x-nor b8001200.spi: mx25l12805d (16384 Kbytes)
[ 0.772842] 7 fixed-partitions partitions found on MTD device rtl838x_nor
[ 0.780977] Creating 7 MTD partitions on "rtl838x_nor":
[ 0.787243] 0x000000000000-0x000000040000 : "u-boot"
[ 0.794232] 0x000000040000-0x000000050000 : "u-boot-env"
[ 0.801712] 0x000000050000-0x000000060000 : "u-boot-env2"
[ 0.809260] 0x000000060000-0x000000160000 : "jffs"
[ 0.816088] 0x000000160000-0x000000260000 : "jffs2"
[ 0.822942] 0x000000260000-0x000000930000 : "runtime"
[ 0.840451] 0x000000930000-0x000001000000 : "runtime2"
[ 0.848874] libphy: Fixed MDIO Bus: probed
[ 0.856117] Probing RTL838X eth device pdev: 87c9aa00, dev: 87c9aa10
[ 0.880200] Found SoC ID: 8393: RTL8393, family 8390
[ 0.886171] Using MAC 0000588bf3fe05d5
[ 0.891046] libphy: rtl839x-eth-mdio: probed
[ 1.580963] rtl8393_serdes_probe: id: 48
[ 1.585658] Realtek RTL8393 SERDES mdio-bus:30: Detected internal RTL8390 SERDES
[ 1.607282] rtl8393_serdes_probe: id: 49
[ 1.611973] Realtek RTL8393 SERDES mdio-bus:31: Detected internal RTL8390 SERDES
[ 1.623281] NET: Registered protocol family 10
[ 1.633692] Segment Routing with IPv6
[ 1.638235] NET: Registered protocol family 17
[ 1.643845] 8021q: 802.1Q VLAN Support v1.8
[ 1.649639] i2c-gpio i2c-gpio-0: Slow GPIO pins might wreak havoc into I2C/SMBus bus timing
[ 1.659807] i2c-gpio i2c-gpio-0: using lines 184 (SDA) and 185 (SCL)
[ 1.667733] i2c-gpio i2c-gpio-1: Slow GPIO pins might wreak havoc into I2C/SMBus bus timing
[ 1.677896] i2c-gpio i2c-gpio-1: using lines 190 (SDA) and 191 (SCL)
[ 1.685747] libphy: SFP I2C Bus: probed
[ 1.690725] sfp sfp-p9: Host maximum power 1.0W
[ 1.696588] libphy: SFP I2C Bus: probed
[ 1.701538] sfp sfp-p10: Host maximum power 1.0W
[ 2.605786] random: fast init done
[ 133.805843] random: crng init done
Would you show me where I have to put it?
I couldn't flash the sysupgrade after tftpbooting the ramdisk:
Sun Sep 12 15:58:44 UTC 2021 upgrade: Sending signal TERM to ntpd (3551)
[ 81.320966] rtl83xx_fib4_del: found a route with id 3, nh-id 0
[ 81.327953] rtl83xx-switch switch@bb000000: unknown nexthop, id 0
Sun Sep 12 15:58:48 UTC 2021 upgrade: Sending KILL to remaining processes ...
[ 91.439890] sh (3664): drop_caches: 3
Sun Sep 12 15:58:54 UTC 2021 upgrade: Switching to ramdisk...
Sun Sep 12 15:58:57 UTC 2021 upgrade: Performing system upgrade...
[ 93.670147] sh (3664): drop_caches: 3
Could not open mtd device: firmware
Can't open device for writing!
cat: write error: Broken [ 93.700976] reboot: Restarting system
p[ 93.705374] System restart.
It looks like sysupgrade is not aware of the partition layout and firmware is just a generic placeholder:
root@OpenWrt:/# cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "u-boot-env2"
mtd3: 00100000 00010000 "jffs"
mtd4: 00100000 00010000 "jffs2"
mtd5: 006d0000 00010000 "runtime"
mtd6: 006d0000 00010000 "runtime2"
So you mean that instead of 64 in this patch:
we should be using only 52? Did you try 56? Because that would be the maximum number that the RTL839x can support.
Maybe there is a different solution, because in principle this should not hang, just because there is nothing on that bus at a given PHY-id...
I think you need to just rename the partition "runtime" to "firmware" in rtl8393_zyxel_gs1900-48.dts .
Have a look how this is done in rtl8380_zyxel_gs1900.dtsi
To be honest, I have no idea about it...
No I didn't, I'll try 
I tried to use 56 instead of 52, but the kernel hangs. I've also tried to skip 52 while scanning phys in mdio_bus.c in kernel, but hangs when trying to scan phy 53.
from modified mdio_bus.c:
for (i = 0; i < PHY_MAX_ADDR; i++) {
if (i == 52) {
dev_info(&bus->dev, "skipping phy 52\n");
continue;
}
if ((bus->phy_mask & (1 << i)) == 0) {
struct phy_device *phydev;
phydev = mdiobus_scan(bus, i);
dev_info(&bus->dev, "scanned phy %d\n", i);
if (IS_ERR(phydev) && (PTR_ERR(phydev) != -ENODEV)) {
err = PTR_ERR(phydev);
goto error;
}
}
}
U-Boot 2011.12.46351-1.00.09-svn5722 (Mar 12 2015 - 20:08:54)
Board: RTL839x CPU:700MHz LXB:200MHz MEM:400MHz
DRAM: 128 MB
SPI-F: 1x32 MB
Loading 65536B env. variables from offset 0x80000
#### Periphery Devices Init Successfully ####
Switch Model: RTL8393M_8218B_8218FB_2SFP (Port Count: 48)
Switch Chip: RTL8393M
Model Info: 83936802
### RTL8218B config - MAC ID = 0 ###
### RTL8218B config - MAC ID = 8 ###
### RTL8218B config - MAC ID = 16 ###
### RTL8218B config - MAC ID = 24 ###
### RTL8218B config - MAC ID = 32 ###
### RTL8218FB config - MAC ID = 40 ###
PHY[0]: disable EEE
PHY[1]: disable EEE
PHY[2]: disable EEE
PHY[3]: disable EEE
PHY[4]: disable EEE
PHY[5]: disable EEE
RTL839x# # rtk network on
Enable network
Please wait for PHY init-time ...
RTL839x# # tftp 0x81000000
*** Warning: no boot file name; using '0101A8C0.img'
Using rtl8390#0 device
TFTP from server 192.168.1.111; our IP address is 192.168.1.1
Filename '0101A8C0.img'.
Load address: 0x81000000
Loading: T #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
############################################
done
Bytes transferred = 6362670 (61162e hex)
RTL839x# # bootm
## Booting kernel from Legacy Image at 81000000 ...
Image Name: MIPS OpenWrt Linux-5.4.143
Created: 2021-09-12 13:37:17 UTC
Image Type: MIPS Linux Kernel Image (gzip compressed)
Data Size: 6362606 Bytes = 6.1 MB
Load Address: 80000000
Entry Point: 80000400
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
[ 0.000000] Linux version 5.4.143 (musashino205@TAIHA.NET) (gcc version 10.3.0 (OpenWrt GCC 10.3.0 r17396+47-98eb95dd00)) #0 Sun Sep 12 13:37:17 2021
[ 0.000000] RTL838X model is ffffffff
[ 0.000000] RTL839X model is 83936802
[ 0.000000] SoC Type: RTL8393
[ 0.000000] Kernel command line:
[ 0.000000] printk: bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019555 (MIPS 34Kc)
[ 0.000000] MIPS: machine is Panasonic Switch-M48eG PN28480K
[ 0.000000] Registering _machine_restart
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Using appended Device Tree.
[ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[ 0.000000] On node 0 totalpages: 32768
[ 0.000000] Normal zone: 288 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 32768 pages, LIFO batch:7
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480
[ 0.000000] Kernel command line: console=ttyS0,9600
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[ 0.000000] Writing ErrCtl register=00039f95
[ 0.000000] Readback ErrCtl register=00039f95
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 113520K/131072K available (5156K kernel code, 191K rwdata, 1168K rodata, 9476K init, 199K bss, 17552K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 32
[ 0.000000] random: get_random_bytes called from start_kernel+0x288/0x468 with crng_init=0
[ 0.000000] timer_probe: no matching timers found
[ 0.000000] CPU frequency from device tree: 700MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5460744132 ns
[ 0.000008] sched_clock: 32 bits at 350MHz, resolution 2ns, wraps every 6135667710ns
[ 0.102037] Calibrating delay loop... 464.48 BogoMIPS (lpj=2322432)
[ 0.243327] pid_max: default: 32768 minimum: 301
[ 0.304252] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.400322] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.510702] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.639082] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[ 0.728569] pinctrl core: initialized pinctrl subsystem
[ 0.797804] NET: Registered protocol family 16
[ 0.889752] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[ 1.019612] clocksource: Switched to clocksource MIPS
[ 1.086427] NET: Registered protocol family 2
[ 1.142792] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 1.238330] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[ 1.347735] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 1.448510] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 1.541310] TCP: Hash tables configured (established 1024 bind 1024)
[ 1.625110] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 1.710929] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[ 1.802890] NET: Registered protocol family 1
[ 2.108905] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[ 2.200345] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 2.275960] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 2.434263] pinctrl-single bb000004.pinmux: 32 pins, size 4
[ 2.506900] Probing RTL838X GPIOs
[ 2.592854] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 2.676503] printk: console [ttyS0] disabled
[ 2.731615] b8002000.uart: ttyS0 at MMIO 0xb8002000 (irq = 31, base_baud = 12500000) is a 16550A
[ 2.847287] printk: console [ttyS0] enabled
[ 2.847287] printk: console [ttyS0] enabled
[ 2.957332] printk: bootconsole [early0] disabled
[ 2.957332] printk: bootconsole [early0] disabled
[ 3.082025] b8002100.uart: ttyS1 at MMIO 0xb8002100 (irq = 30, base_baud = 12500000) is a 16550A
[ 3.352441] brd: module loaded
[ 3.393097] Initializing rtl838x_nor_driver
[ 3.448239] SPI resource base is b8001200
[ 3.500931] Address mode is 4 bytes
[ 3.546787] rtl838x_nor_init called
[ 3.597325] rtl838x-nor b8001200.spi: mx25l25635e (32768 Kbytes)
[ 3.676580] 8 fixed-partitions partitions found on MTD device rtl838x_nor
[ 3.766025] Creating 8 MTD partitions on "rtl838x_nor":
[ 3.834828] 0x000000000000-0x000000080000 : "u-boot"
[ 3.901270] 0x000000080000-0x000000090000 : "u-boot-env"
[ 3.972370] 0x000000090000-0x0000000a0000 : "u-boot-env2"
[ 4.044591] 0x0000000a0000-0x000000100000 : "sysinfo"
[ 4.112288] 0x000000100000-0x000000e00000 : "fs_reserved"
[ 4.184483] 0x000000e00000-0x000001e00000 : "firmware"
[ 4.269052] 0x000001e00000-0x000001f00000 : "vlog_data"
[ 4.339056] 0x000001f00000-0x000002000000 : "elog_data"
[ 4.409873] mdio_bus fixed-0: scanned phy 0
[ 4.464968] mdio_bus fixed-0: scanned phy 1
[ 4.519984] mdio_bus fixed-0: scanned phy 2
[ 4.575020] mdio_bus fixed-0: scanned phy 3
[ 4.630062] mdio_bus fixed-0: scanned phy 4
[ 4.685097] mdio_bus fixed-0: scanned phy 5
[ 4.740139] mdio_bus fixed-0: scanned phy 6
[ 4.795175] mdio_bus fixed-0: scanned phy 7
[ 4.850219] mdio_bus fixed-0: scanned phy 8
[ 4.905252] mdio_bus fixed-0: scanned phy 9
[ 4.960294] mdio_bus fixed-0: scanned phy 10
[ 5.016477] mdio_bus fixed-0: scanned phy 11
[ 5.072664] mdio_bus fixed-0: scanned phy 12
[ 5.128848] mdio_bus fixed-0: scanned phy 13
[ 5.185035] mdio_bus fixed-0: scanned phy 14
[ 5.241221] mdio_bus fixed-0: scanned phy 15
[ 5.297404] mdio_bus fixed-0: scanned phy 16
[ 5.353591] mdio_bus fixed-0: scanned phy 17
[ 5.409776] mdio_bus fixed-0: scanned phy 18
[ 5.465961] mdio_bus fixed-0: scanned phy 19
[ 5.522148] mdio_bus fixed-0: scanned phy 20
[ 5.578330] mdio_bus fixed-0: scanned phy 21
[ 5.634517] mdio_bus fixed-0: scanned phy 22
[ 5.690703] mdio_bus fixed-0: scanned phy 23
[ 5.746889] mdio_bus fixed-0: scanned phy 24
[ 5.803075] mdio_bus fixed-0: scanned phy 25
[ 5.859260] mdio_bus fixed-0: scanned phy 26
[ 5.915445] mdio_bus fixed-0: scanned phy 27
[ 5.971631] mdio_bus fixed-0: scanned phy 28
[ 6.027814] mdio_bus fixed-0: scanned phy 29
[ 6.084002] mdio_bus fixed-0: scanned phy 30
[ 6.140187] mdio_bus fixed-0: scanned phy 31
[ 6.196369] mdio_bus fixed-0: scanned phy 32
[ 6.252557] mdio_bus fixed-0: scanned phy 33
[ 6.308741] mdio_bus fixed-0: scanned phy 34
[ 6.364928] mdio_bus fixed-0: scanned phy 35
[ 6.421113] mdio_bus fixed-0: scanned phy 36
[ 6.477297] mdio_bus fixed-0: scanned phy 37
[ 6.533483] mdio_bus fixed-0: scanned phy 38
[ 6.589669] mdio_bus fixed-0: scanned phy 39
[ 6.645853] mdio_bus fixed-0: scanned phy 40
[ 6.702040] mdio_bus fixed-0: scanned phy 41
[ 6.758223] mdio_bus fixed-0: scanned phy 42
[ 6.814410] mdio_bus fixed-0: scanned phy 43
[ 6.870597] mdio_bus fixed-0: scanned phy 44
[ 6.926780] mdio_bus fixed-0: scanned phy 45
[ 6.982967] mdio_bus fixed-0: scanned phy 46
[ 7.039157] mdio_bus fixed-0: scanned phy 47
[ 7.095337] mdio_bus fixed-0: scanned phy 48
[ 7.151523] mdio_bus fixed-0: scanned phy 49
[ 7.207706] mdio_bus fixed-0: scanned phy 50
[ 7.263893] mdio_bus fixed-0: scanned phy 51
[ 7.320076] mdio_bus fixed-0: skipping phy 52
[ 7.377408] mdio_bus fixed-0: scanned phy 53
[ 7.433596] mdio_bus fixed-0: scanned phy 54
[ 7.489781] mdio_bus fixed-0: scanned phy 55
[ 7.545959] libphy: Fixed MDIO Bus: probed
[ 7.602229] Probing RTL838X eth device pdev: 87ca4800, dev: 87ca4810
[ 7.694367] Found SoC ID: 8393: RTL8393, family 8390
[ 7.759789] Using MAC 0000005040101ab6
[ 7.809229] mdio_bus mdio-bus: skipping phy 52
[ 7.867774] libphy: rtl839x-eth-mdio: probed
[ 8.675882] NET: Registered protocol family 10
[ 8.739312] Segment Routing with IPv6
[ 8.787623] NET: Registered protocol family 17
[ 8.846539] 8021q: 802.1Q VLAN Support v1.8
[ 8.902401] i2c-gpio i2c-gpio-0: Slow GPIO pins might wreak havoc into I2C/SMBus bus timing
[ 9.012889] i2c-gpio i2c-gpio-0: using lines 23 (SDA) and 22 (SCL)
[ 9.094600] i2c-gpio i2c-gpio-1: Slow GPIO pins might wreak havoc into I2C/SMBus bus timing
[ 9.205114] pca953x 1-0020: using no AI
[ 9.257268] pca953x 1-0075: using no AI
[ 9.308974] GPIO line 492 (ext-switch-reset) hogged as output/high
[ 9.390773] GPIO line 494 (portled-sregister-reset) hogged as output/high
[ 9.480819] i2c-gpio i2c-gpio-1: using lines 9 (SDA) and 8 (SCL)
[ 9.579440] mdio_bus rtl838x slave mii-0: scanned phy 0
[ 9.648298] random: fast init done
[ 9.708091] mdio_bus rtl838x slave mii-0: scanned phy 1
[ 9.792398] mdio_bus rtl838x slave mii-0: scanned phy 2
[ 9.876275] mdio_bus rtl838x slave mii-0: scanned phy 3
[ 9.960560] mdio_bus rtl838x slave mii-0: scanned phy 4
[ 10.044437] mdio_bus rtl838x slave mii-0: scanned phy 5
[ 10.128741] mdio_bus rtl838x slave mii-0: scanned phy 6
[ 10.213021] mdio_bus rtl838x slave mii-0: scanned phy 7
[ 10.296910] mdio_bus rtl838x slave mii-0: scanned phy 8
[ 10.381186] mdio_bus rtl838x slave mii-0: scanned phy 9
[ 10.465063] mdio_bus rtl838x slave mii-0: scanned phy 10
[ 10.550625] mdio_bus rtl838x slave mii-0: scanned phy 11
[ 10.635772] mdio_bus rtl838x slave mii-0: scanned phy 12
[ 10.721345] mdio_bus rtl838x slave mii-0: scanned phy 13
[ 10.806464] mdio_bus rtl838x slave mii-0: scanned phy 14
[ 10.892028] mdio_bus rtl838x slave mii-0: scanned phy 15
[ 10.977588] mdio_bus rtl838x slave mii-0: scanned phy 16
[ 11.063171] mdio_bus rtl838x slave mii-0: scanned phy 17
[ 11.148714] mdio_bus rtl838x slave mii-0: scanned phy 18
[ 11.234277] mdio_bus rtl838x slave mii-0: scanned phy 19
[ 11.319416] mdio_bus rtl838x slave mii-0: scanned phy 20
[ 11.404564] mdio_bus rtl838x slave mii-0: scanned phy 21
[ 11.489791] mdio_bus rtl838x slave mii-0: scanned phy 22
[ 11.574838] mdio_bus rtl838x slave mii-0: scanned phy 23
[ 11.660435] mdio_bus rtl838x slave mii-0: scanned phy 24
[ 11.745993] mdio_bus rtl838x slave mii-0: scanned phy 25
[ 11.831560] mdio_bus rtl838x slave mii-0: scanned phy 26
[ 11.916717] mdio_bus rtl838x slave mii-0: scanned phy 27
[ 12.002259] mdio_bus rtl838x slave mii-0: scanned phy 28
[ 12.087402] mdio_bus rtl838x slave mii-0: scanned phy 29
[ 12.172968] mdio_bus rtl838x slave mii-0: scanned phy 30
[ 12.258546] mdio_bus rtl838x slave mii-0: scanned phy 31
[ 12.344085] mdio_bus rtl838x slave mii-0: scanned phy 32
[ 12.429710] mdio_bus rtl838x slave mii-0: scanned phy 33
[ 12.515211] mdio_bus rtl838x slave mii-0: scanned phy 34
[ 12.600779] mdio_bus rtl838x slave mii-0: scanned phy 35
[ 12.686350] mdio_bus rtl838x slave mii-0: scanned phy 36
[ 12.771913] mdio_bus rtl838x slave mii-0: scanned phy 37
[ 12.857064] mdio_bus rtl838x slave mii-0: scanned phy 38
[ 12.942602] mdio_bus rtl838x slave mii-0: scanned phy 39
[ 13.028162] mdio_bus rtl838x slave mii-0: scanned phy 40
[ 13.113746] mdio_bus rtl838x slave mii-0: scanned phy 41
[ 13.198867] mdio_bus rtl838x slave mii-0: scanned phy 42
[ 13.284006] mdio_bus rtl838x slave mii-0: scanned phy 43
[ 13.369156] mdio_bus rtl838x slave mii-0: scanned phy 44
[ 13.454304] mdio_bus rtl838x slave mii-0: scanned phy 45
[ 13.539432] mdio_bus rtl838x slave mii-0: scanned phy 46
[ 13.624571] mdio_bus rtl838x slave mii-0: scanned phy 47
[ 13.695407] mdio_bus rtl838x slave mii-0: scanned phy 48
[ 13.766106] mdio_bus rtl838x slave mii-0: scanned phy 49
[ 13.836805] mdio_bus rtl838x slave mii-0: scanned phy 50
[ 13.907504] mdio_bus rtl838x slave mii-0: scanned phy 51
[ 13.977470] mdio_bus rtl838x slave mii-0: skipping phy 52
[ 142.639659] random: crng init done
Could you try to figure out where it actually hangs. I guess it goes into mdiobus_scan(), which will probably try to identify PHYs on the MDIO/SMI bus. My present working assumption is that the hardware on some SoCs is not able to handle such requests. Could you follow this down into the driver code until you hit some register calls (sw_w32()/sw_r32())? Unfortunately my two 839x switches are not affected, so I am not able to test.
Side remark: I managed yesterday to enable 10GBit on the 3 Zyxel XGS1250-12 ports and it works together with my QNAP 10GBit PCI card 
Now I am on the 10GBit fibre port...
OK, I'll try 
I tried to find, the kernel hangs while reading phy id in get_phy_id in phy_device.c.
mdiobus_scan (mdio_bus.c) -> get_phy_device (phy_device.c) -> get_phy_id (phy_device.c)
rtl839x_read_phy in dsa/rtl83xx/rt839x.c is called to read id and hangs at do-while loop for reading bit 0 in RTL839X_PHYREG_ACCESS_CTRL.
int rtl839x_read_phy(u32 port, u32 page, u32 reg, u32 *val)
{
u32 v;
if (port >= 50)
pr_info("In %s: port %d, page %04x, reg %04x, val %04x\n",
__func__, port, page, reg, val);
if (port > 63 || page > 4095 || reg > 31)
return -ENOTSUPP;
mutex_lock(&smi_lock);
sw_w32_mask(0xffff0000, port << 16, RTL839X_PHYREG_DATA_CTRL);
if (port >= 50)
pr_info(" wrote RTL839X_PHYREG_DATA_CTRL\n");
v = reg << 5 | page << 10 | ((page == 0x1fff) ? 0x1f : 0) << 23;
sw_w32(v, RTL839X_PHYREG_ACCESS_CTRL);
if (port >= 50)
pr_info(" wrote RTL839X_PHYREG_ACCESS_CTRL\n");
sw_w32(0x1ff, RTL839X_PHYREG_CTRL);
if (port >= 50)
pr_info(" wrote RTL839X_PHYREG_CTRL\n");
v |= 1;
sw_w32(v, RTL839X_PHYREG_ACCESS_CTRL);
if (port >= 50)
pr_info(" wrote RTL839X_PHYREG_ACCESS_CTRL\n");
do {
} while (sw_r32(RTL839X_PHYREG_ACCESS_CTRL) & 0x1);
if (port >= 50)
pr_info(" exit RTL839X_PHYREG_ACCESS_CTRL loop\n");
*val = sw_r32(RTL839X_PHYREG_DATA_CTRL) & 0xffff;
mutex_unlock(&smi_lock);
return 0;
}
[ 14.092471] mdio_bus rtl838x slave mii-0: scanned phy 48
[ 14.163169] mdio_bus rtl838x slave mii-0: scanned phy 49
[ 14.233068] In rtl839x_read_phy: port 50, page 0000, reg 0002, val 87dedbfc
[ 14.324794] wrote RTL839X_PHYREG_DATA_CTRL
[ 14.380977] wrote RTL839X_PHYREG_ACCESS_CTRL
[ 14.439448] wrote RTL839X_PHYREG_CTRL
[ 14.489901] wrote RTL839X_PHYREG_ACCESS_CTRL
[ 14.548379] exit RTL839X_PHYREG_ACCESS_CTRL loop
[ 14.611455] In rtl839x_read_phy: port 50, page 0000, reg 0003, val 87dedbfc
[ 14.703184] wrote RTL839X_PHYREG_DATA_CTRL
[ 14.759360] wrote RTL839X_PHYREG_ACCESS_CTRL
[ 14.817840] wrote RTL839X_PHYREG_CTRL
[ 14.868294] wrote RTL839X_PHYREG_ACCESS_CTRL
[ 14.926772] exit RTL839X_PHYREG_ACCESS_CTRL loop
[ 14.989848] mdio_bus rtl838x slave mii-0: scanned phy 50
[ 15.059795] In rtl839x_read_phy: port 51, page 0000, reg 0002, val 87dedbfc
[ 15.151520] wrote RTL839X_PHYREG_DATA_CTRL
[ 15.207696] wrote RTL839X_PHYREG_ACCESS_CTRL
[ 15.266177] wrote RTL839X_PHYREG_CTRL
[ 15.316627] wrote RTL839X_PHYREG_ACCESS_CTRL
[ 15.375108] exit RTL839X_PHYREG_ACCESS_CTRL loop
[ 15.438181] In rtl839x_read_phy: port 51, page 0000, reg 0003, val 87dedbfc
[ 15.529914] wrote RTL839X_PHYREG_DATA_CTRL
[ 15.586087] wrote RTL839X_PHYREG_ACCESS_CTRL
[ 15.644568] wrote RTL839X_PHYREG_CTRL
[ 15.695018] wrote RTL839X_PHYREG_ACCESS_CTRL
[ 15.753498] exit RTL839X_PHYREG_ACCESS_CTRL loop
[ 15.816574] mdio_bus rtl838x slave mii-0: scanned phy 51
[ 15.886524] In rtl839x_read_phy: port 52, page 0000, reg 0002, val 87dedbfc
[ 15.978249] wrote RTL839X_PHYREG_DATA_CTRL
[ 16.034425] wrote RTL839X_PHYREG_ACCESS_CTRL
[ 16.092904] wrote RTL839X_PHYREG_CTRL
[ 16.143355] wrote RTL839X_PHYREG_ACCESS_CTRL
(hang)
That is interesting, this is definitely a difference in the behaviour of the SoC, probably version dependent. I noticeed that in the SDK they are trying to find the highest existing PHY ID and seem to limit scans to up to that ID, so there the issue is not present.
A good solution would be to introduce a time-out for the while loop, say 100ms. In some places I already have done this, but correct error handling and time-out implementation is surprisingly difficult when done properly. Could you look a the solution in rtl838x_read_phy(), this is using a timeout. I think I never hit this condition so it is untested.
Oops, I tried the same implementation of timeout in rtl838x.c for rtl839x, but failed to probe the switch due to -ENOTSUPP error.
diff --git a/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/rtl839x.c b/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/rtl839x.c
index c62dc441c1..a75df46b8c 100644
--- a/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/rtl839x.c
+++ b/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/rtl839x.c
@@ -487,15 +487,32 @@ int rtl8390_sds_power(int mac, int val)
return 0;
}
+int rtl839x_smi_wait_op(int timeout)
+{
+ do {
+ timeout--;
+ udelay(10);
+ } while ((sw_r32(RTL839X_PHYREG_ACCESS_CTRL) & 0x1) && (timeout >= 0));
+ if (timeout <= 0)
+ return -1;
+ return 0;
+}
+
int rtl839x_read_phy(u32 port, u32 page, u32 reg, u32 *val)
{
u32 v;
+ if (port >= 50)
+ pr_info("In %s: port %d, page %04x, reg %04x\n",
+ __func__, port, page, reg);
if (port > 63 || page > 4095 || reg > 31)
return -ENOTSUPP;
mutex_lock(&smi_lock);
+ if (rtl839x_smi_wait_op(10000))
+ goto timeout;
+
sw_w32_mask(0xffff0000, port << 16, RTL839X_PHYREG_DATA_CTRL);
v = reg << 5 | page << 10 | ((page == 0x1fff) ? 0x1f : 0) << 23;
sw_w32(v, RTL839X_PHYREG_ACCESS_CTRL);
@@ -505,13 +522,19 @@ int rtl839x_read_phy(u32 port, u32 page, u32 reg, u32 *val)
v |= 1;
sw_w32(v, RTL839X_PHYREG_ACCESS_CTRL);
- do {
- } while (sw_r32(RTL839X_PHYREG_ACCESS_CTRL) & 0x1);
+ if (rtl839x_smi_wait_op(10000)) {
+ goto timeout;
+ }
*val = sw_r32(RTL839X_PHYREG_DATA_CTRL) & 0xffff;
mutex_unlock(&smi_lock);
return 0;
+
+timeout:
+ pr_info(" timeout\n");
+ mutex_unlock(&smi_lock);
+ return -ENOTSUPP;
}
int rtl839x_write_phy(u32 port, u32 page, u32 reg, u32 val)
[ 10.022110] mdio_bus rtl838x slave mii-0: scanned phy 0
[ 10.105991] mdio_bus rtl838x slave mii-0: scanned phy 1
[ 10.189905] mdio_bus rtl838x slave mii-0: scanned phy 2
[ 10.274181] mdio_bus rtl838x slave mii-0: scanned phy 3
[ 10.358461] mdio_bus rtl838x slave mii-0: scanned phy 4
[ 10.442755] mdio_bus rtl838x slave mii-0: scanned phy 5
[ 10.527066] mdio_bus rtl838x slave mii-0: scanned phy 6
[ 10.611340] mdio_bus rtl838x slave mii-0: scanned phy 7
[ 10.695220] mdio_bus rtl838x slave mii-0: scanned phy 8
[ 10.779501] mdio_bus rtl838x slave mii-0: scanned phy 9
[ 10.863807] mdio_bus rtl838x slave mii-0: scanned phy 10
[ 10.948939] mdio_bus rtl838x slave mii-0: scanned phy 11
[ 11.034499] mdio_bus rtl838x slave mii-0: scanned phy 12
[ 11.119728] mdio_bus rtl838x slave mii-0: scanned phy 13
[ 11.205209] mdio_bus rtl838x slave mii-0: scanned phy 14
[ 11.290771] mdio_bus rtl838x slave mii-0: scanned phy 15
[ 11.375910] mdio_bus rtl838x slave mii-0: scanned phy 16
[ 11.461490] mdio_bus rtl838x slave mii-0: scanned phy 17
[ 11.547041] mdio_bus rtl838x slave mii-0: scanned phy 18
[ 11.632596] mdio_bus rtl838x slave mii-0: scanned phy 19
[ 11.718158] mdio_bus rtl838x slave mii-0: scanned phy 20
[ 11.803727] mdio_bus rtl838x slave mii-0: scanned phy 21
[ 11.888888] mdio_bus rtl838x slave mii-0: scanned phy 22
[ 11.974424] mdio_bus rtl838x slave mii-0: scanned phy 23
[ 12.060030] mdio_bus rtl838x slave mii-0: scanned phy 24
[ 12.145587] mdio_bus rtl838x slave mii-0: scanned phy 25
[ 12.231141] mdio_bus rtl838x slave mii-0: scanned phy 26
[ 12.316296] mdio_bus rtl838x slave mii-0: scanned phy 27
[ 12.401851] mdio_bus rtl838x slave mii-0: scanned phy 28
[ 12.487407] mdio_bus rtl838x slave mii-0: scanned phy 29
[ 12.572979] mdio_bus rtl838x slave mii-0: scanned phy 30
[ 12.658558] mdio_bus rtl838x slave mii-0: scanned phy 31
[ 12.744101] mdio_bus rtl838x slave mii-0: scanned phy 32
[ 12.829235] mdio_bus rtl838x slave mii-0: scanned phy 33
[ 12.914802] mdio_bus rtl838x slave mii-0: scanned phy 34
[ 13.000372] mdio_bus rtl838x slave mii-0: scanned phy 35
[ 13.085520] mdio_bus rtl838x slave mii-0: scanned phy 36
[ 13.171083] mdio_bus rtl838x slave mii-0: scanned phy 37
[ 13.256653] mdio_bus rtl838x slave mii-0: scanned phy 38
[ 13.342189] mdio_bus rtl838x slave mii-0: scanned phy 39
[ 13.427749] mdio_bus rtl838x slave mii-0: scanned phy 40
[ 13.513333] mdio_bus rtl838x slave mii-0: scanned phy 41
[ 13.598879] mdio_bus rtl838x slave mii-0: scanned phy 42
[ 13.684016] mdio_bus rtl838x slave mii-0: scanned phy 43
[ 13.769582] mdio_bus rtl838x slave mii-0: scanned phy 44
[ 13.855161] mdio_bus rtl838x slave mii-0: scanned phy 45
[ 13.940711] mdio_bus rtl838x slave mii-0: scanned phy 46
[ 14.025845] mdio_bus rtl838x slave mii-0: scanned phy 47
[ 14.096689] mdio_bus rtl838x slave mii-0: scanned phy 48
[ 14.167378] mdio_bus rtl838x slave mii-0: scanned phy 49
[ 14.237339] In rtl839x_read_phy: port 50, page 0000, reg 0002
[ 14.313190] In rtl839x_read_phy: port 50, page 0000, reg 0003
[ 14.389300] mdio_bus rtl838x slave mii-0: scanned phy 50
[ 14.459264] In rtl839x_read_phy: port 51, page 0000, reg 0002
[ 14.535101] In rtl839x_read_phy: port 51, page 0000, reg 0003
[ 14.611219] mdio_bus rtl838x slave mii-0: scanned phy 51
[ 14.681192] In rtl839x_read_phy: port 52, page 0000, reg 0002
[ 14.858250] timeout
[ 14.888101] mdio_bus rtl838x slave mii-0: scanned phy 52
[ 14.963718] rtl83xx-switch: probe of switch@bb000000 failed with error -5
...
If we don't want the probe to fail, rtl839x_read_phy seems to need to return -EIO or -ENODEV:
https://elixir.bootlin.com/linux/v5.4.144/source/drivers/net/phy/phy_device.c#L792
BTW, once in this state, it seems that it will timeout when trying to access phys less than 52 after that... (replaced to -EIO from -ENOTSUPP)
[ 14.092458] mdio_bus rtl838x slave mii-0: scanned phy 48
[ 14.163155] mdio_bus rtl838x slave mii-0: scanned phy 49
[ 14.233065] In rtl839x_read_phy: port 50, page 0000, reg 0002
[ 14.308955] In rtl839x_read_phy: port 50, page 0000, reg 0003
[ 14.385069] mdio_bus rtl838x slave mii-0: scanned phy 50
[ 14.454991] In rtl839x_read_phy: port 51, page 0000, reg 0002
[ 14.530878] In rtl839x_read_phy: port 51, page 0000, reg 0003
[ 14.606985] mdio_bus rtl838x slave mii-0: scanned phy 51
[ 14.676917] In rtl839x_read_phy: port 52, page 0000, reg 0002
[ 14.854077] timeout
[ 14.883931] mdio_bus rtl838x slave mii-0: scanned phy 52
[ 14.953884] In rtl839x_read_phy: port 53, page 0000, reg 0002
[ 15.131034] timeout
[ 15.160790] mdio_bus rtl838x slave mii-0: scanned phy 53
[ 15.230745] In rtl839x_read_phy: port 54, page 0000, reg 0002
[ 15.407890] timeout
[ 15.437652] mdio_bus rtl838x slave mii-0: scanned phy 54
[ 15.507606] In rtl839x_read_phy: port 55, page 0000, reg 0002
[ 15.684754] timeout
[ 15.714515] mdio_bus rtl838x slave mii-0: scanned phy 55
[ 15.784468] In rtl839x_read_phy: port 56, page 0000, reg 0002
[ 15.961615] timeout
[ 15.991378] mdio_bus rtl838x slave mii-0: scanned phy 56
[ 16.061329] In rtl839x_read_phy: port 57, page 0000, reg 0002
[ 16.238474] timeout
[ 16.268237] mdio_bus rtl838x slave mii-0: scanned phy 57
[ 16.338190] In rtl839x_read_phy: port 58, page 0000, reg 0002
[ 16.515337] timeout
[ 16.545099] mdio_bus rtl838x slave mii-0: scanned phy 58
[ 16.615055] In rtl839x_read_phy: port 59, page 0000, reg 0002
[ 16.792196] timeout
[ 16.821961] mdio_bus rtl838x slave mii-0: scanned phy 59
[ 16.891915] In rtl839x_read_phy: port 60, page 0000, reg 0002
[ 17.069059] timeout
[ 17.098821] mdio_bus rtl838x slave mii-0: scanned phy 60
[ 17.168775] In rtl839x_read_phy: port 61, page 0000, reg 0002
[ 17.345921] timeout
[ 17.375683] mdio_bus rtl838x slave mii-0: scanned phy 61
[ 17.445636] In rtl839x_read_phy: port 62, page 0000, reg 0002
[ 17.622784] timeout
[ 17.652545] mdio_bus rtl838x slave mii-0: scanned phy 62
[ 17.722498] In rtl839x_read_phy: port 63, page 0000, reg 0002
[ 17.899649] timeout
[ 17.929404] mdio_bus rtl838x slave mii-0: scanned phy 63
[ 17.999356] libphy: rtl838x slave mii: probed
[ 18.071055] In rtl83xx_vlan_setup
[ 18.114680] UNKNOWN_MC_PMASK: 001fffffffffffff
[ 18.173124] VLAN profile 0: L2 learning: 1, UNKN L2MC FLD PMSK 511, UNKN IPMC FLD PMSK 511, UNKN IPv6MC FLD PMSK: 511
[ 18.173132] VLAN profile 0: raw 000001ff, 003fe3ff
[ 20.541240] timeout
[ 20.672526] timeout
[ 20.702306] rtl83xx-switch switch@bb000000 lan1 (uninitialized): PHY [mdio-bus:00] driver [Realtek RTL8218B (external)]
[ 20.947057] timeout
[ 21.078332] timeout
[ 21.108113] rtl83xx-switch switch@bb000000 lan2 (uninitialized): PHY [mdio-bus:01] driver [Realtek RTL8218B (external)]
[ 21.352818] timeout
[ 21.484138] timeout
[ 21.513919] rtl83xx-switch switch@bb000000 lan3 (uninitialized): PHY [mdio-bus:02] driver [Realtek RTL8218B (external)]
[ 21.758652] timeout
[ 21.889953] timeout
[ 21.919725] rtl83xx-switch switch@bb000000 lan4 (uninitialized): PHY [mdio-bus:03] driver [Realtek RTL8218B (external)]
[ 22.164450] timeout
[ 22.295750] timeout
[ 22.325532] rtl83xx-switch switch@bb000000 lan5 (uninitialized): PHY [mdio-bus:04] driver [Realtek RTL8218B (external)]
[ 22.570262] timeout
[ 22.701562] timeout
[ 22.731339] rtl83xx-switch switch@bb000000 lan6 (uninitialized): PHY [mdio-bus:05] driver [Realtek RTL8218B (external)]
[ 22.976057] timeout
[ 23.107363] timeout
[ 23.137145] rtl83xx-switch switch@bb000000 lan7 (uninitialized): PHY [mdio-bus:06] driver [Realtek RTL8218B (external)]
[ 23.381922] timeout
[ 23.513169] timeout
[ 23.542952] rtl83xx-switch switch@bb000000 lan8 (uninitialized): PHY [mdio-bus:07] driver [Realtek RTL8218B (external)]
[ 23.787702] timeout
[ 23.918979] timeout
[ 23.948758] rtl83xx-switch switch@bb000000 lan9 (uninitialized): PHY [mdio-bus:08] driver [Realtek RTL8218B (external)]
[ 24.193498] timeout
[ 24.324782] timeout
[ 24.354565] rtl83xx-switch switch@bb000000 lan10 (uninitialized): PHY [mdio-bus:09] driver [Realtek RTL8218B (external)]
[ 24.600446] timeout
[ 24.731741] timeout
[ 24.761517] rtl83xx-switch switch@bb000000 lan11 (uninitialized): PHY [mdio-bus:0a] driver [Realtek RTL8218B (external)]
[ 25.007408] timeout
[ 25.138688] timeout
[ 25.168470] rtl83xx-switch switch@bb000000 lan12 (uninitialized): PHY [mdio-bus:0b] driver [Realtek RTL8218B (external)]
[ 25.414365] timeout
[ 25.545640] timeout
[ 25.575423] rtl83xx-switch switch@bb000000 lan13 (uninitialized): PHY [mdio-bus:0c] driver [Realtek RTL8218B (external)]
[ 25.821347] timeout
[ 25.952598] timeout
[ 25.982376] rtl83xx-switch switch@bb000000 lan14 (uninitialized): PHY [mdio-bus:0d] driver [Realtek RTL8218B (external)]
[ 26.228280] timeout
[ 26.359547] timeout
[ 26.389329] rtl83xx-switch switch@bb000000 lan15 (uninitialized): PHY [mdio-bus:0e] driver [Realtek RTL8218B (external)]
[ 26.635206] timeout
[ 26.766506] timeout
[ 26.796282] rtl83xx-switch switch@bb000000 lan16 (uninitialized): PHY [mdio-bus:0f] driver [Realtek RTL8218B (external)]
[ 27.042177] timeout
[ 27.173452] timeout
[ 27.203235] rtl83xx-switch switch@bb000000 lan17 (uninitialized): PHY [mdio-bus:10] driver [Realtek RTL8218B (external)]
[ 27.449124] timeout
[ 27.580412] timeout
[ 27.610188] rtl83xx-switch switch@bb000000 lan18 (uninitialized): PHY [mdio-bus:11] driver [Realtek RTL8218B (external)]
[ 27.856084] timeout
[ 27.987359] timeout
[ 28.017141] rtl83xx-switch switch@bb000000 lan19 (uninitialized): PHY [mdio-bus:12] driver [Realtek RTL8218B (external)]
[ 28.263042] timeout
[ 28.394311] timeout
[ 28.424094] rtl83xx-switch switch@bb000000 lan20 (uninitialized): PHY [mdio-bus:13] driver [Realtek RTL8218B (external)]
[ 28.669989] timeout
[ 28.801271] timeout
[ 28.831047] rtl83xx-switch switch@bb000000 lan21 (uninitialized): PHY [mdio-bus:14] driver [Realtek RTL8218B (external)]
[ 29.076973] timeout
[ 29.208217] timeout
[ 29.237999] rtl83xx-switch switch@bb000000 lan22 (uninitialized): PHY [mdio-bus:15] driver [Realtek RTL8218B (external)]
[ 29.483896] timeout
[ 29.615170] timeout
[ 29.644952] rtl83xx-switch switch@bb000000 lan23 (uninitialized): PHY [mdio-bus:16] driver [Realtek RTL8218B (external)]
[ 29.890873] timeout
[ 30.022123] timeout
[ 30.051906] rtl83xx-switch switch@bb000000 lan24 (uninitialized): PHY [mdio-bus:17] driver [Realtek RTL8218B (external)]
[ 30.297820] timeout
[ 30.429076] timeout
[ 30.458859] rtl83xx-switch switch@bb000000 lan25 (uninitialized): PHY [mdio-bus:18] driver [Realtek RTL8218B (external)]
[ 30.704779] timeout
[ 30.836036] timeout
[ 30.865815] rtl83xx-switch switch@bb000000 lan26 (uninitialized): PHY [mdio-bus:19] driver [Realtek RTL8218B (external)]
[ 31.111785] timeout
[ 31.243087] timeout
[ 31.272870] rtl83xx-switch switch@bb000000 lan27 (uninitialized): PHY [mdio-bus:1a] driver [Realtek RTL8218B (external)]
[ 31.518772] timeout
[ 31.650054] timeout
[ 31.679822] rtl83xx-switch switch@bb000000 lan28 (uninitialized): PHY [mdio-bus:1b] driver [Realtek RTL8218B (external)]
[ 31.925744] timeout
[ 32.056993] timeout
[ 32.086776] rtl83xx-switch switch@bb000000 lan29 (uninitialized): PHY [mdio-bus:1c] driver [Realtek RTL8218B (external)]
[ 32.332662] timeout
[ 32.463945] timeout
[ 32.493726] rtl83xx-switch switch@bb000000 lan30 (uninitialized): PHY [mdio-bus:1d] driver [Realtek RTL8218B (external)]
[ 32.739656] timeout
[ 32.870911] timeout
[ 32.900680] rtl83xx-switch switch@bb000000 lan31 (uninitialized): PHY [mdio-bus:1e] driver [Realtek RTL8218B (external)]
[ 33.146583] timeout
[ 33.277852] timeout
[ 33.307634] rtl83xx-switch switch@bb000000 lan32 (uninitialized): PHY [mdio-bus:1f] driver [Realtek RTL8218B (external)]
[ 33.553537] timeout
[ 33.684803] timeout
[ 33.714586] rtl83xx-switch switch@bb000000 lan33 (uninitialized): PHY [mdio-bus:20] driver [Realtek RTL8218B (external)]
[ 33.960551] timeout
[ 34.091861] timeout
[ 34.121645] rtl83xx-switch switch@bb000000 lan34 (uninitialized): PHY [mdio-bus:21] driver [Realtek RTL8218B (external)]
[ 34.367555] timeout
[ 34.498814] timeout
[ 34.528596] rtl83xx-switch switch@bb000000 lan35 (uninitialized): PHY [mdio-bus:22] driver [Realtek RTL8218B (external)]
[ 34.774519] timeout
[ 34.905776] timeout
[ 34.935550] rtl83xx-switch switch@bb000000 lan36 (uninitialized): PHY [mdio-bus:23] driver [Realtek RTL8218B (external)]
[ 35.181532] timeout
[ 35.312825] timeout
[ 35.342607] rtl83xx-switch switch@bb000000 lan37 (uninitialized): PHY [mdio-bus:24] driver [Realtek RTL8218B (external)]
[ 35.588537] timeout
[ 35.719785] timeout
[ 35.749558] rtl83xx-switch switch@bb000000 lan38 (uninitialized): PHY [mdio-bus:25] driver [Realtek RTL8218B (external)]
[ 35.995495] timeout
[ 36.126733] timeout
[ 36.156513] rtl83xx-switch switch@bb000000 lan39 (uninitialized): PHY [mdio-bus:26] driver [Realtek RTL8218B (external)]
[ 36.402431] timeout
[ 36.533683] timeout
[ 36.563466] rtl83xx-switch switch@bb000000 lan40 (uninitialized): PHY [mdio-bus:27] driver [Realtek RTL8218B (external)]
[ 36.809387] timeout
[ 36.940652] timeout
[ 36.970419] rtl83xx-switch switch@bb000000 lan41 (uninitialized): PHY [mdio-bus:28] driver [Realtek RTL8218B (external)]
[ 37.216319] timeout
[ 37.347590] timeout
[ 37.377372] rtl83xx-switch switch@bb000000 lan42 (uninitialized): PHY [mdio-bus:29] driver [Realtek RTL8218B (external)]
[ 37.623302] timeout
[ 37.754550] timeout
[ 37.784325] rtl83xx-switch switch@bb000000 lan43 (uninitialized): PHY [mdio-bus:2a] driver [Realtek RTL8218B (external)]
[ 38.030257] timeout
[ 38.161496] timeout
[ 38.191278] rtl83xx-switch switch@bb000000 lan44 (uninitialized): PHY [mdio-bus:2b] driver [Realtek RTL8218B (external)]
[ 38.437233] timeout
[ 38.568553] timeout
[ 38.598335] rtl83xx-switch switch@bb000000 lan45 (uninitialized): PHY [mdio-bus:2c] driver [Realtek RTL8218B (external)]
[ 38.844250] timeout
[ 38.975513] timeout
[ 39.005288] rtl83xx-switch switch@bb000000 lan46 (uninitialized): PHY [mdio-bus:2d] driver [Realtek RTL8218B (external)]
[ 39.251280] timeout
[ 39.382563] timeout
[ 39.412345] rtl83xx-switch switch@bb000000 lan47 (uninitialized): PHY [mdio-bus:2e] driver [Realtek RTL8218B (external)]
[ 39.658276] timeout
[ 39.789517] timeout
[ 39.819298] rtl83xx-switch switch@bb000000 lan48 (uninitialized): PHY [mdio-bus:2f] driver [Realtek RTL8218B (external)]
[ 39.963657] rtl83xx-switch switch@bb000000: configuring for fixed/internal link mode
[ 40.065914] DSA: tree 0 setup
[ 40.104951] LINK state irq: 20
[ 40.145071] In rtl83xx_setup_qos
[ 40.187463] Setting up RTL839X QoS
[ 40.232178] RTL839X_PRI_SEL_TBL_CTRL(i): 01112111
[ 40.294100] Current Intprio2queue setting: 00000000
[ 40.358313] QM_PKT2CPU_INTPRI_MAP: 00fac688
[ 40.413380] rtl838x_dbgfs_init called
[ 40.552822] Freeing unused kernel memory: 9476K
[ 40.612470] This architecture does not have kernel memory protection.
[ 40.697303] Run /init as init process
[ 40.745784] rtl83xx-switch switch@bb000000: Link is Up - 1Gbps/Full - flow control off
[ 41.481929] init: Console is alive
[ 41.540996] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 41.633725] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 41.740021] init: - preinit -
[ 41.978022] random: jshn: uninitialized urandom read (4 bytes read)
[ 42.126480] random: jshn: uninitialized urandom read (4 bytes read)
[ 43.461162] random: jshn: uninitialized urandom read (4 bytes read)
[ 43.588505] random: jshn: uninitialized urandom read (4 bytes read)
[ 43.839084] random: jshn: uninitialized urandom read (4 bytes read)
[ 44.093638] RESETTING 8390, CPU_PORT 52
[ 44.343544] rtl838x-eth bb00a300.ethernet eth0: configuring for fixed/internal link mode
[ 44.450136] In rtl838x_mac_config, mode 1
[ 44.503963] rtl83xx-switch switch@bb000000 lan1: configuring for phy/qsgmii link mode
[ 44.708666] timeout
[ 44.738585] 8021q: adding VLAN 0 to HW filter on device lan1
[ 44.813442] In rtl838x_mac_config, mode 1
[ 44.866216] rtl838x-eth bb00a300.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
[ 45.076888] timeout
[ 45.106645] ------------[ cut here ]------------
[ 45.167453] WARNING: CPU: 0 PID: 89 at drivers/net/phy/phy.c:718 phy_state_machine+0x13c/0x284
[ 45.280953] Modules linked in: gpio_button_hotplug
[ 45.344015] CPU: 0 PID: 89 Comm: kworker/0:1 Not tainted 5.4.143 #0
[ 45.426577] Workqueue: events_power_efficient phy_state_machine
[ 45.504539] Stack : 87cf0a80 8030e990 00000009 00000000 80640000 800602d4 80599010 00000017
[ 45.614625] 87cf0abc 00000000 8058b270 87dedd74 8030e990 87cf0ad3 87dedd48 506befba
[ 45.724697] 00000000 00000000 00000000 000001bd 00000065 00000000 74655f6d 61636869
[ 45.834774] 000001bd 87dedc59 ffffffff ffffffff 00000000 00000000 00000000 8030e990
[ 45.944854] 00000009 00000000 80640000 8063ce4c 00000002 802b77cc 00000000 80fa0000
[ 46.054930] ...
[ 46.087020] Call Trace:
[ 46.119154] [<80009cd0>] show_stack+0x30/0x100
[ 46.177635] [<80025e68>] __warn+0xcc/0xf0
[ 46.230373] [<80025ee8>] warn_slowpath_fmt+0x5c/0xac
[ 46.295731] [<8030e990>] phy_state_machine+0x13c/0x284
[ 46.363393] [<8003d8dc>] process_one_work+0x1f0/0x458
[ 46.429890] [<8003dcc8>] worker_thread+0x184/0x4f0
[ 46.492963] [<80043a08>] kthread+0x138/0x140
[ 46.549137] [<80004c78>] ret_from_kernel_thread+0x14/0x1c
[ 46.620237] ---[ end trace 962a78e3a0793e87 ]---
[ 46.698599] random: procd: uninitialized urandom read (4 bytes read)
Press the [f] key and [ 46.838480] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to [ 47.024322] timeout
select the debug level
[ 50.942417] ------------[ cut here ]------------
[ 51.003275] WARNING: CPU: 0 PID: 1638 at drivers/net/phy/phy.c:840 phy_stop+0xdc/0xf4
[ 51.106512] called from state HALTED
[ 51.153510] Modules linked in: gpio_button_hotplug
[ 51.216586] CPU: 0 PID: 1638 Comm: ip Tainted: G W 5.4.143 #0
[ 51.309458] Stack : 80660000 80600f74 00000000 00000000 805fffe0 87f85764 80599010 87efc7e0
[ 51.419538] 80638d43 80fa329c 00000666 805fecd0 87d6b0c0 00000001 87f85718 9ea2715b
[ 51.529618] 00000000 00000000 80fd0000 000001d5 00000030 00000000 20202057 20202020
[ 51.639699] 000001d5 87f85649 ffffffff ffffffff 80000000 87f857f8 00000000 8030ebb4
[ 51.749770] 00000009 805fecd0 87d6b0c0 87d98a10 00000003 802b77cc 00000000 80fa0000
[ 51.859851] ...
[ 51.891938] Call Trace:
[ 51.924073] [<80009cd0>] show_stack+0x30/0x100
[ 51.982554] [<80025e68>] __warn+0xcc/0xf0
[ 52.035290] [<80025f18>] warn_slowpath_fmt+0x8c/0xac
[ 52.100653] [<8030ebb4>] phy_stop+0xdc/0xf4
[ 52.155686] [<80309e9c>] phylink_stop+0x44/0xd0
[ 52.215329] [<804dbfc4>] dsa_port_disable_rt+0x30/0xa8
[ 52.282973] [<804dd948>] dsa_slave_close+0x3c/0x114
[ 52.347195] [<8036fe8c>] __dev_close_many+0x98/0x108
[ 52.412546] [<8037c2a4>] __dev_change_flags+0xd4/0x21c
[ 52.480189] [<8037c414>] dev_change_flags+0x28/0x70
[ 52.544422] [<8039349c>] do_setlink+0x228/0x9b0
[ 52.604025] [<80394300>] __rtnl_newlink+0x57c/0x810
[ 52.668235] [<803945e4>] rtnl_newlink+0x50/0x84
[ 52.727856] [<80391d3c>] rtnetlink_rcv_msg+0x32c/0x3ec
[ 52.795517] [<803d4060>] netlink_rcv_skb+0xb0/0x160
[ 52.859724] [<803d3778>] netlink_unicast+0x1a4/0x28c
[ 52.925078] [<803d3b40>] netlink_sendmsg+0x2e0/0x3c8
[ 52.990450] [<8035073c>] ____sys_sendmsg+0xc4/0x270
[ 53.054649] [<803510fc>] ___sys_sendmsg+0x7c/0xcc
[ 53.116570] [<803523b4>] sys_sendmsg+0x4c/0x94
[ 53.175047] [<8000ea8c>] syscall_common+0x34/0x58
[ 53.236964] ---[ end trace 962a78e3a0793e88 ]---
[ 53.308309] procd: - early -
[ 54.632536] procd: - ubus -
[ 54.678568] random: ubusd: uninitialized urandom read (4 bytes read)
[ 54.764236] random: ubusd: uninitialized urandom read (4 bytes read)
[ 54.849022] random: ubusd: uninitialized urandom read (4 bytes read)
[ 54.936618] procd: - init -
Please press Enter to activate this console.
[ 55.500424] kmodloader: loading kernel modules from /etc/modules.d/*
[ 55.702700] i2c /dev entries driver
[ 55.803430] i2c i2c-0: Added multiplexed i2c bus 2
[ 55.866876] i2c i2c-0: Added multiplexed i2c bus 3
[ 55.930258] i2c i2c-0: Added multiplexed i2c bus 4
[ 55.993727] i2c i2c-0: Added multiplexed i2c bus 5
[ 56.056810] pca954x 0-0070: registered 4 multiplexed busses for I2C switch pca9545
[ 56.161377] libphy: SFP I2C Bus: probed
[ 56.212588] sfp sfp-p45: Host maximum power 1.0W
[ 56.274747] libphy: SFP I2C Bus: probed
[ 56.325894] sfp sfp-p46: Host maximum power 1.0W
[ 56.388055] libphy: SFP I2C Bus: probed
[ 56.439208] sfp sfp-p47: Host maximum power 1.0W
[ 56.501385] libphy: SFP I2C Bus: probed
[ 56.552528] sfp sfp-p48: Host maximum power 1.0W
[ 56.624144] urngd: v1.0.2 started.
[ 56.806262] random: crng init done
[ 56.850992] random: 1 urandom warning(s) missed due to ratelimiting
[ 56.986892] lm75 1-0048: hwmon0: sensor 'tcn75'
[ 57.047317] lm75 1-0049: hwmon1: sensor 'tcn75'
[ 57.271812] xt_time: kernel timezone is -0000
[ 57.427290] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 80.675052] in rtl838x_eth_stop
[ 80.716654] rtl838x-eth bb00a300.ethernet eth0: Link is Down
[ 82.242490] Using MAC 00000a1b2c3d4e5f
[ 82.350014] RESETTING 8390, CPU_PORT 52
[ 82.599933] rtl838x-eth bb00a300.ethernet eth0: configuring for fixed/internal link mode
[ 82.706514] In rtl838x_mac_config, mode 1
[ 82.759584] In rtl838x_mac_config, mode 1
[ 82.812399] rtl838x-eth bb00a300.ethernet eth0: Link is Up - 1Gbps/Full - flow control off
[ 83.086357] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 83.439944] rtl83xx-switch switch@bb000000 lan1: configuring for phy/qsgmii link mode
[ 83.644732] timeout
[ 83.674651] 8021q: adding VLAN 0 to HW filter on device lan1
[ 83.854031] timeout
[ 83.883819] ------------[ cut here ]------------
[ 83.944632] WARNING: CPU: 0 PID: 89 at drivers/net/phy/phy.c:718 phy_state_machine+0x13c/0x284
[ 84.058130] Modules linked in: iptable_nat xt_state xt_nat xt_conntrack xt_REDIRECT xt_MASQUERADE nf_nat nf_conntrack ipt_REJECT xt_time xt_tcpudp xt_multiport xt_mark xt_mac xt_limit xt_comment xt_TCPMSS xt_LOG nf_reject_ipv4 nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 mdio_netlink lm75 iptable_mangle iptable_filter ip_tables i2c_mux_pca954x i2c_mux i2c_dev nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 gpio_button_hotplug
[ 84.617887] CPU: 0 PID: 89 Comm: kworker/0:1 Tainted: G W 5.4.143 #0
[ 84.718807] Workqueue: events_power_efficient phy_state_machine
[ 84.796770] Stack : 87cf0a80 8030e990 00000009 00000000 80640000 800602d4 80599010 00000017
[ 84.906846] 87cf0abc 00000000 8058b270 87dedd74 8030e990 00000001 87dedd48 506befba
[ 85.016922] 00000000 00000000 80647890 00000220 00000065 00000000 74655f6d 61636869
[ 85.127002] 00000220 87dedc59 ffffffff ffffffff 00000000 00000000 00000000 8030e990
[ 85.237077] 00000009 00000000 80640000 8063ce4c 00000002 802b77cc 00000000 80fa0000
[ 85.347154] ...
[ 85.379246] Call Trace:
[ 85.411379] [<80009cd0>] show_stack+0x30/0x100
[ 85.469862] [<80025e68>] __warn+0xcc/0xf0
[ 85.522597] [<80025ee8>] warn_slowpath_fmt+0x5c/0xac
[ 85.587958] [<8030e990>] phy_state_machine+0x13c/0x284
[ 85.655617] [<8003d8dc>] process_one_work+0x1f0/0x458
[ 85.722116] [<8003dcc8>] worker_thread+0x184/0x4f0
[ 85.785190] [<80043a08>] kthread+0x138/0x140
[ 85.841371] [<80004c78>] ret_from_kernel_thread+0x14/0x1c
[ 85.912458] ---[ end trace 962a78e3a0793e89 ]---
(and too many warnings...)
Now it really sounds like a bug in the SoC. I see that you also have revision "B" of the SoC.
Unfortunately the rtl839x_read_phy() function does not have access to the version, it lacks a parameter to the private data structure of the switch. What you could do would be the following:
You'll most likely want to build the sysupgrade image with the "openwrt,uimage" compatible and the correct magic too, or you won't have a root file system after sysupgrading.
Just renaming "runtime" to "firmware" worked.
rtl8393_zyxel_gs1900-48.dts:
127 partition@b260000 {
128 label = "firmware";
129 reg = <0x260000 0x6d0000>;
130 compatible = "denx,uimage";
131 };
rtl8380_zyxel_gs1900.dtsi has an additional compatible property and an image magic property:
91 partition@b260000 {
92 label = "firmware";
93 reg = <0x260000 0x6d0000>;
94 compatible = "openwrt,uimage", "denx,uimage";
95 openwrt,ih-magic = <0x83800000>;
96 };
But I think either the image magic and/or the ZYXEL_VERS hackery are required in order to flash the kernel-initramfs from the stock firmware.
EDIT: Well I have a rootfs, but barely any overlay space.
EDIT2: My build system isn't building a sysupgrade anymore, must have flashed an old one.
Just renaming is enough for flashing, but not for booting from the sysupgraded image. I believe the partition splitter needs to know about that non-default magic. Unless you flashed an image with a default U-Boot magic. That will probably work
Rookie mistake, ran out of space.