Support for RTL838x based managed switches

Additionally chances are that it will be rather similar to;a=commitdiff;h=c5b44af2fc5ffe620405ccb743b6f4acc461d4de (apart from having 128 MB RAM, instead of 64 MB and lacking PoE), but the details will still need confirming based on the tech-support contents (and experimentation).

1 Like

See the WikiDevi entry which is correct and confirmed by the unit I have. In addition below is relevant output from 'show tech-support':

------------------ Board Configuration ------------------

 Board GPIO
Device  Pin  Direction  Default  Current
------- ---- ---------- -------- --------
INT     0    OUT        0        0       
INT     1    OUT        1        1       
INT     2    OUT        0        0       
INT     3    OUT        0        0       
INT     8    OUT        1        1       
INT     9    OUT        1        1       
INT     12   IN         0        0       
INT     13   OUT        1        1       
INT     14   OUT        1        1       
INT     15   OUT        1        1       
INT     16   IN         0        0       
INT     17   OUT        1        1       
INT     18   OUT        0        0       
INT     19   IN         0        0       
INT     20   OUT        1        1       
INT     21   IN         0        0       
INT     22   IN         0        0       
INT     23   OUT        1        1       
EXT     0    IN  (IN  ) 0        1       
EXT     1    IN  (IN  ) 0        1       
EXT     2    IN  (IN  ) 0        0       
EXT     3    IN  (IN  ) 0        1       
EXT     4    IN  (IN  ) 0        0       
EXT     5    OUT (OUT ) 1        1       
EXT     6    OUT (OUT ) 1        1       
EXT     7    IN  (IN  ) 0        1       
EXT     8    OUT (OUT ) 1        1       
EXT     13   OUT (OUT ) 0        0       
EXT     14   OUT (OUT ) 0        0       
EXT     15   OUT (OUT ) 0        0       
EXT     16   OUT (OUT ) 0        0       
EXT     17   OUT (IN  ) 0        0       
EXT     18   OUT (IN  ) 0        0       
EXT     22   IN  (IN  ) 0        0       
EXT     23   OUT (OUT ) 0        0       
EXT     24   OUT (OUT ) 0        0       
EXT     25   OUT (OUT ) 0        0       
EXT     26   IN  (IN  ) 0        0       
EXT     27   IN  (IN  ) 0        0       
EXT     28   IN  (IN  ) 0        0       
EXT     29   OUT (OUT ) 0        0       
EXT     30   OUT (OUT ) 0        0       
EXT     31   OUT (OUT ) 0        0       
EXT     32   IN  (IN  ) 0        0       
EXT     33   IN  (IN  ) 0        0       
EXT     34   OUT (OUT ) 1        1       

 Board Configuration
====== Port ==================
Type       Usr  Phy     Media       Speed          Duplex   Attr
---------- ---- ------- ----------- -------------- -------- -------
1000M      1    (0) 1   Copper      (A) ALL        Auto     0      
1000M      2    (0) 0   Copper      (A) ALL        Auto     0      
1000M      3    (0) 3   Copper      (A) ALL        Auto     0      
1000M      4    (0) 2   Copper      (A) ALL        Auto     0      
1000M      5    (0) 5   Copper      (A) ALL        Auto     0      
1000M      6    (0) 4   Copper      (A) ALL        Auto     0      
1000M      7    (0) 7   Copper      (A) ALL        Auto     0      
1000M      8    (0) 6   Copper      (A) ALL        Auto     0      
1000M      9    (0) 9   Copper      (A) ALL        Auto     0      
1000M      10   (0) 8   Copper      (A) ALL        Auto     0      
1000M      11   (0) 11  Copper      (A) ALL        Auto     0      
1000M      12   (0) 10  Copper      (A) ALL        Auto     0      
1000M      13   (0) 13  Copper      (A) ALL        Auto     0      
1000M      14   (0) 12  Copper      (A) ALL        Auto     0      
1000M      15   (0) 15  Copper      (A) ALL        Auto     0      
1000M      16   (0) 14  Copper      (A) ALL        Auto     0      
1000M      17   (0) 17  Copper      (A) ALL        Auto     0      
1000M      18   (0) 16  Copper      (A) ALL        Auto     0      
1000M      19   (0) 19  Copper      (A) ALL        Auto     0      
1000M      20   (0) 18  Copper      (A) ALL        Auto     0      
1000M      21   (0) 21  Copper      (A) ALL        Auto     0      
1000M      22   (0) 20  Copper      (A) ALL        Auto     0      
1000M      23   (0) 23  Copper      (A) ALL        Auto     0      
1000M      24   (0) 22  Copper      (A) ALL        Auto     0      

====== Button ================

------------ Reset Button
Timer: 3(sec)  Action: Reboot
Timer: 6(sec)  Action: Restore Factory

====== Led ===================

====== Reset =================
Type: GPIO

====== WatchDog ==============
Type: REG

After putting in an SOIC-8 socket on my XGS1250, and modifying the u-boot env, I'm able to access the bootloader. I can transfer images via tftp like on other devices, but I'm unable to use the memory commands (md, mw) on MMIO addresses that map to CPU peripherals. The bootloader just hangs when I try that :frowning:

Which mmio areas do you mean in particular? I am able to see e.g. the switch/ethernet registers and the Timer/Counter registers:

RTL9300# # md.l 0xbb000000
bb000000: 00000000 93021001 00000000 00005000    ..............P.
bb000010: 00000000 00000000 0000000c 00000200    ................
RTL9300# # md.l 0xb8003200
b8003200: 00000000 00000000 00000000 00000000    ................
b8003210: 0fffffff 0899adbf 1100002c 00000000    ...........,....

BTW it is interesting that u-boot seems to use TC1 including enabled IRQ. I was under the impression that u-boot for these SoCs was not able to use IRQs.

1 Like

The difference was that I wasn't adding the 0x prefix to the number. Unprefixed hex numbers work on the GS1900-series, but not on the XGS1250 apparently! This is my favourite tool for poking the registers, so I was quite disappointed it wasn't working for me :sweat_smile:

And after dropping the SMP patches from brainslayer's pie branch, I've got a booting system :smiley:

root@OpenWrt:/# cat /proc/cpuinfo 
system type		: RTL9302B
machine			: Zyxel XGS1250-12 Switch
processor		: 0
cpu model		: MIPS 34Kc V5.5
1 Like

Do any of the RTL838x switches support loading OpenWRT from their web interface or ssh interface?

Usually, I'd check in the TOH but that appears to be out of action at the moment.

ToH should be working again, I can access it again.

Some switches do allow loading an initramfs image from the OEM web interface, as the first stage of the OpenWrt installation process.

Please note this issue and proposed patch:

Serial console should still work, or you could apply the patch yourself and rebuild the initramfs image.

Well, unless ZyXEL are cheating, and I don't think they are, then we have both their U-Boot source and configuration. So we should be able to figure this out. In theory.

But there are a gazillion CONFIG_ options and associated ifdefs here. I think we end up with this part (in multiple incarnations) from loader/u-boot-2011.12/common/main.c:

#if !defined(RTK_CODE)
#define RTK_ABOUT_AUTOBOOT_CHAR     0x1B  /* key to abort the auto boot process, 0x20 - space, 0x1B - ESC */
#define RTK_ABOUT_AUTOBOOT_CHAR     0x1A  /* key to abort the auto boot process, 0x20 - space, 0x1A - ^Z */
                        tkey = getc();
                        if(tkey == RTK_ABOUT_AUTOBOOT_CHAR) /*Equal to space key*/
                            puts ("\b\b\b 0");
                            abort = 1;  /* don't auto boot      */

So it looks like it's either ESC or ^Z. You might want to try the latter if you haven't already...

Although I can't really figure out if RTK_CODE is defined. I see that turnkey/vendor/ZYXEL/XGS1210/config.arch adds -DRTK_CODE to CFLAGS when UCLINUX_BUILD_USER is defined, but I'm not sure that is relevant for the U-Boot build.

It's easier to just try the alternatives :slight_smile:

Can you show one example of this

Not sure what "this" refers to since it looks like I touched a ton of different subjects.. That's my fault.

But if it's the process from stock, then I have a few screen shots.

  1. Initial state with OEM firmware in both partitions and the first one ("0") is active:

  2. Uploading openwrt initramfs to the "Active" slot (i.e. first partition or image "0") via http.
    Note that the image has been renamed from openwrt-snapshot-realtek-generic-zyxel_gs1900-10hp-initramfs-kernel.bin to the shorter openwrt-initramfs.bin because the OEM web application has a 64 character filename limit:

  3. Wait for the "Firmware upgrade success" and reboot into your OpenWrt initramfs

  4. Configure the other end of the "lan1 " link to match the OpenWrt realtek LAN defaults. This depends on the connected system obviously. Showing an example from my Debian laptop with "eth0" connected to "lan1" on the switch:

root@miraculix:/tmp# ip link add link eth0 name eth0.100 type vlan id 100
root@miraculix:/tmp# ifconfig eth0.100 up
  1. Copy the OpenWrt sysupgrade image to the switc and install it:
bjorn@miraculix:~$ scp /tmp/openwrt-snapshot-realtek-generic-zyxel_gs1900-10hp-squashfs-sysupgrade.bin root@
The authenticity of host ' (' can't be established.
ED25519 key fingerprint is SHA256:MAiY7yL0y/TNTZRIVivpXa7Nxnjj47+UgSJ1Bd2K1/o.
No matching host key fingerprint found in DNS.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '' (ED25519) to the list of known hosts.
openwrt-snapshot-realtek-generic-zyxel_gs1900-10hp-squashfs-sysupgrade.bin               100% 5121KB   1.9MB/s   00:02

bjorn@miraculix:~$ ssh root@
X11 forwarding request failed on channel 0

BusyBox v1.33.1 (2021-06-24 12:05:45 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 OpenWrt SNAPSHOT, r17034+1-3342d574be08
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
root@OpenWrt:~# sysupgrade -v /tmp/openwrt-snapshot-realtek-generic-zyxel_gs1900-10hp-squashfs-sysupgrade.bin 
Cannot save config while running from ramdisk.
Thu Jun 24 12:10:39 UTC 2021 upgrade: Commencing upgrade. Closing all shell sessions.
Connection to closed by remote host.
Connection to closed.

After this the switch is running OpenWrt with a writeable rootfs, allowing you to reconfigure it as you like. With the normal care to avoid cutting off the branch you're sitting on of course.... Failsafe is your friend if that happens. Or console.

Sorry. First time using this forum.

Thanks a lot for you reply. but i still can't flash the openwrt into this switch using the web-ui

1° - I Download the firmware from

2° - Try to flash from web, and this are the response.

"Device only can support firmware from V2.10(AAHI.0) and later version"

3° - Have downgrade my switch from 2.60, to 2.50 like yours, but still can't install.

You have tell about some Header and Footer need to the router recognize the image to flash, but the snapshot's don't have any.

I manually try edit with a hexeditor and "adjust" the header and insert the footer extracted from the original firmware. but this don't work either. have one checksum CRC32 error.

For some reason my RS232 don't work, i only receive garbage. I have tested my usb-serial adapter with a loop-back cable, and every thing is fine.

For checking i have buy another adapter to try again.

For now,i am stuck with the Original Firmware. Do you have any other advice, or cam post a pre generated file just to first flash this switch.


PS: my switch are ano ZyXel GS1900-8hp Revision: B1

This is due to the bug mentioned by @mpa above. The fix has been stuck in patchworks "forever":

Sorry that you had to go through all that trouble for nothing. I should have made this clear along with the recipe. There are currently no pre-built images which are installable from OEM on the ZyXEL realtek switches. You need to build an initramfs with that fix yourself. Or push some developer to commit it so we can start using the official snapshots again.

1 Like

Anything we can do to get this patch pushed. It has become annoying how long some perfectly good patches sit waiting for someone to merge them!

Thanks again. Can you post the link to the image builder necessary to generate the initramfs. And how to generate these files?

Looks like the patch hash been committed to master. Thanks @bmork and @chunkeey!


thanks for the great job, I have been able to install OpenWRT ( SNAPSHOT r17900-e06aaba4e3) on my GS1900-8HPv1 without issues following the detailed instruction in the wiki for the GS1900-10HP.

However I am having bandwidth issue on WAN <-> LAN (<25Mbps, ksoftirqd using >75% of the cpu).
LAN <-> LAN works at ~1 Gbps as expected and I checked that I have 1 Gbps connecting my computer directly to my ISP modem.
I guess I messed up something in my config (my goal was to have lan1 connected to my ISP modem and use lan2 to lan8 for LAN). Here is my /etc/config/network:

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr ''
	option netmask ''

config globals 'globals'
	option ula_prefix 'fdxx:xxxx:xxxx::/48'
	option packet_steering '1'

config device 'switch'
	option name 'switch'
	option type 'bridge'
        option macaddr 'xx:xx:xx:xx:xx:xx'

config bridge-vlan 'wan_vlan'
	option device 'switch'
	option vlan '1'
	option ports 'lan1'

config interface 'wan'
	option device 'switch.1'
	option proto 'dhcp'
	option ip6assign '64'

config interface 'wan6'
	option device 'switch.1'
	option proto 'dhcpv6'

config bridge-vlan 'lan_vlan'
	option device 'switch'
	option vlan '100'
	option ports 'lan2 lan3 lan4 lan5 lan6 lan7 lan8'

config interface 'lan'
	option device 'switch.100'
	option proto 'static'
	option ipaddr ''
	option netmask ''
	option ip6assign '60'

config device
	option name 'switch.1'
	option type '8021q'
	option ifname 'switch'
	option vid '1'
	option macaddr 'xx:xx:xx:xx:xx:xx'

The SoC is too weak to do wirespeed routing AFAIK. Better put a real router in front of it.


The SoC is too weak to do wirespeed routing AFAIK. Better put a real router in front of it.

Thanks for the answer, after searching the forum for a router that is up to the task, I will probably get a NanoPi R2S.

There is some routing offload capability possible with RTL838x based routers in master. It is limited to point to point IPv4 routes though. It could be useful if your router is in a different subnet. The offloading always works at wire speed.