Support for RTL838x based managed switches

For Developers
847

CTRL+Z works to interrupt the bootloader. Nice detective work! :slight_smile:

After the bootloader is interrupted however, it asks for a password on the XGS1250-12. If you just press Enter there (or provide the wrong password?), it will still run the default boot command. To change that, I needed to modify the u-boot environment variables externally.

In the meantime, I got GPIO and GPIO interrupts working. SFP(+) modules are detected, but I don't think networking is available yet.

[   33.698186] sfp sfp-p12: module UBNT             UF-SM-1G-S       rev      sn FT20061626296    dc 200616
[   33.708775] sfp sfp-p12: Host does not support 2.0W modules, module left in power mode 1
[   42.718961] sfp sfp-p12: module removed
[   67.078184] sfp sfp-p12: module UBNT             UF-SM-1G-S       rev      sn FT20061600315    dc 200616  
[   67.088974] sfp sfp-p12: Host does not support 2.0W modules, module left in power mode 1
[   69.676125] sfp sfp-p12: module removed
[  106.218630] sfp sfp-p12: module FINISAR CORP.    FTLX1471D3BCL-EX rev A    sn EX101L72970      dc 210726  
[  110.129986] sfp sfp-p12: module removed
[  125.938855] sfp sfp-p12: module OEM              GLC-BX-U         rev 10.0 sn S102010C444      dc 101207  
[  128.334325] sfp sfp-p12: module removed
[  139.398863] sfp sfp-p12: module OEM              GLC-BX-D-1490-20 rev 10.0 sn S402010C649      dc 101111  
[  140.972272] sfp sfp-p12: module removed
848

Great! Then we can assume that this code was built with RTK_CODE defined.

Looks like that is what happens here, after we've successfully avoided the first attempt to do run_command2(s, 0);

        if (bootdelay >= 0 && s && !abortboot (bootdelay)) {
# ifdef CONFIG_AUTOBOOT_KEYED
                int prev = disable_ctrlc(1);    /* disable Control C checking */
# endif

                run_command2(s, 0);

# ifdef CONFIG_AUTOBOOT_KEYED
                disable_ctrlc(prev);    /* restore Control C checking */
# endif
        }

#if defined(RTK_CODE)
    if (!loader_shell_login())
        run_command2(s, 0);
#endif

Crazy ifdef-hell. But we know RTK_CODE is defined so that loader_shell_login() test will run. But that's defined as

extern int loader_shell_login(void);

and I cannot find that function anywhere in the GPL dump. Neither source nor binary. Which is unexpected.

849

Hi again.

My Usb Serial come in the weekend, and now i can connect the RS232 and receive the response from the uboot.

But my time to press the key to abort the boot script are 0, so i can't install from the tftp.

or maibe the RX port are burn.

Just to check, this switch rs232 port are 3V or 5V?

Thanks

850

It's 3.3V. Just press the key immediately after powering on. You don't have to wait for the prompt

851

Thanks for your time, but like i said

"maibe the RX port are burn"

Unluck for me.

Lets try compile from source and apply the patch.

852

Hello Again.

Some "Saint" applied the patch and recompile the snapshot, and take several "Souls" from hell (including my self) in this day.

And finally i flash the openwrt into these device and started configure it.

Thanks for the help.

Ps.: for the "saint" Thanks a lot!!!!

1 Like
853

I'm curious to try this (my ISP router is using my public IP address, so it is definitely on a different subnet), could you give some link or more details on how to use this routing offload ?

854

I don't think this will work as you probably have a default route via your gateway router. The following is supported for example:

ip route add 192.168.2.0/24 via 192.168.2.254

then, "ip route show" should show "offloaded" as status. In fact if the route cannot be offloaded, there will already be some info printed. This works by snatching incoming packets with destination address "192.168.2.0/24" directly from the ingress interface, fixing up the source IP address and forwarding it out directly on the interface on the 192.168.2.x interface on your switch. Note that it bypasses all firewalling or kernel handling. This is the reason you cannot offload the default route as this is a lower priority route. If you want to do packet filtering directly on the ingress interface, you have to use the tc flower offloaded filter and issue the commands before you issue the routing command, so that first the filtering happens and then the routing. In fact the filtering and routing live in the same Packet Inspection Engine rule memory and rules are matched against starting by the first rule added.

3 Likes
855

Here you go:

U-Boot log:

 II: Copied Preloader data from 0x9fc00000(15356B) to 0x9f000000.
II: Cleared Preloader BSS section at 0x9f003bfc(0B).

II: PLL... 
II: PLL is set by SW... OK
Setting DTR
INFO: Applying ZQ result directly by plat_memctl_ZQ_force_config()
II: DRAM is set by software calibration... Start claibation test...PASSED

MCR  (0xb8001000):0x100421e0, 0x20320000, 0x54422830, 0x0404030f
DTR2 (0xb8001010):0x0630d000
DIDER(0xb8001050):0x80000000
DCDR (0xb8001060):0x9b540000
ZQPCR(0xb8001090):0x1f000000, 0x00000000, 0x00000000
PHY Registers(0xb8001500):
0xb8001500:0x80000010, 0x0000007f, 0x00000000, 0x00000000
0xb8001510:0x0a1e0f00, 0x0a1e0f00, 0x0a1e0f00, 0x0a1e0f00
0xb8001520:0x0a1e0f00, 0x0a1e0f00, 0x0a1e0f00, 0x0a1e0f00
0xb8001530:0x1e000000, 0x1e000000, 0x1e000000, 0x1e000000
0xb8001540:0x1e000000, 0x1e000000, 0x1e000000, 0x1e000000
0xb8001550:0x001e0f00, 0x001e0f00, 0x001e0f00, 0x001e0f00
0xb8001560:0x001e0f00, 0x001e0f00, 0x001e0f00, 0x001e0f00
0xb8001570:0x00000000, 0x00000000, 0x00000000, 0x00000000
0xb8001580:0x00000000, 0x00000000, 0x00000000, 0x00000000
0xb8001590:0x08000000, 0x66996699, 0x00000000, 0xaa55aa55
0xb80015a0:0x00000000, 0x00000000, 0x00000000, 0x00000000
II: Selected DRAM model #0.
II: Copying U-Boot from 0x9fc03bfc(237328B) to 0x83f00000... OK
II: NOR SPI Flash... searching flash parameters... supported flash ID: [c22018][c22019][c22019]... detected flash ID: [c22018]... OK


U-Boot 2011.12.39239-svn41394 (Jul 25 2013 - 09:27:53)

Board: RTL838x CPU:500MHz LXB:200MHz MEM:300MHz
DRAM:  128 MB
SPI-F: 1x16 MB
Loading 1024B env. variables from offset 0x40000
Switch Model: ZyXEL_GS1900_24E (Port Count: 24)
Switch Chip: RTL8382M
**************************************************
#### RTL8218B config - MAC ID = 0 ####
Now External 8218B
**************************************************
#### RTL8218B config - MAC ID = 8 ####
Now Internal PHY
**************************************************
#### RTL8218B config - MAC ID = 16 ####
Now External 8218B
REG32(0xbb00a17c) is        0
PHY[0]: disable EEE on port [0x000000ff]
PHY[1]: disable EEE on port [0x0000ff00]
PHY[2]: disable EEE on port [0x00ff0000]
Net:   Net Initialization Skipped
rtl8380#0
Hit any key to stop autoboot:  1  0 
## Booting image from partition ... 1
## Booting kernel from Legacy Image at b4930000 ...
   Image Name:   V2.60.4
   Created:      2021-05-24   7:39:11 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    6878379 Bytes = 6.6 MB
   Load Address: 80000000
   Entry Point:  8026b000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.19 (gcc version 3.4.4 mipssde-6.03.00-20051020) #2 PREEMPT Mon May 24 07:38:56 UTC 2021
CPU revision is: 00019070
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 16256
Kernel command line: console=ttyS0,115200 mem=64M
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 56556k/65536k available (2055k kernel code, 8920k reserved, 416k data, 5800k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 2048 bind 1024)
TCP reno registered
squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 31) is a 16550A
loop: loaded (max 8 devices)

Probe: SPI CS1 Flash Type MX25L12845E
Creating 7 MTD partitions on "Total SPI FLASH":
0x00000000-0x00040000 : "LOADER"
0x00040000-0x00050000 : "BDINFO"
0x00050000-0x00060000 : "SYSINFO"
0x00060000-0x00160000 : "JFFS2 CFG"
0x00160000-0x00260000 : "JFFS2 LOG"
0x00260000-0x00930000 : "RUNTIME"
0x00930000-0x01000000 : "RUNTIME2"
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Freeing unused kernel memory: 5800k freed
Init RTCORE Driver Module....OK
Init RTK Driver Module....OK
board_conf: module license 'Realtek Semiconductor Corp.' taints kernel.
Init RTDRV Driver Module....OK
Default IP Setting.

Here is the "show tech-support" output on firmware 2.60(AAHK.4)C0:
https://pastebin.com/E47pyvA5

Now, what do I have to do to get a working image done? I can get a linux system up to build it and know how to get a build system up, but which sources do I need to compile?

856

The TP-Link TL-SG3216 V2 aka TP-LINK T2600G-18TS V2 has the same crippled bootUtil like andyboeh's TP-Link T1600G-52PS V4. Serial output is accessible via the RJ45 console port (38400 8N1). I will post some photos of the PCB's and everything else.

Press CTRL-B to enter the bootUtil
                *********************************************
                *         TP-LINK  BOOTUTIL(v1.0.0)         *
                *********************************************
                Copyright (c) 2015 TP-LINK Tech. Co., Ltd
                Create Date: Jan 14 2015 14:34:55

 help                    - print this list
 reboot                  - reboot the system
 ifconfig                - config the interface
 ftp                     - config the remote host ip,the user name,user password and the image file name
 upgrade                 - upgrade the firmware
 start                   - start the system
 reset                   - reset the system to the factory config.

[TP-LINK]
857

Here are the pictures from TP-Link TL-SG3216 V2:

Main PCB with daughter PCB and PSU:

Main PCB:

Winbond W9425G6JH-5 DRAM chip, DDR SDRAM 256Mbit:

W9425G6JH-5 datasheet

ST Microelectronics M29W128GH flash chip 128 Mbit:

M29W128GH70N6E Datasheet

Daughter PCB connector to main PCB next to RS-232 I/O chip:

RS-232 I/O chip ASIX ZT1385E:

ZT1385E Datasheet

Voltages:


Frontpanel:


858

Thanks @anon13997276 for the explanation, I can confirm the offloading is working as expected as ip route show returns:

default via ROUTER_IP dev switch.1 proto static src ROUTER_IP 
ROUTER_IP/24 dev switch.1 proto kernel scope link src ROUTER_IP offload 
192.168.1.0/24 dev switch.100 proto kernel scope link src 192.168.1.1 offload

which explains why I get good performance on the LAN routing but poor performance WAN <-> LAN.
I'm looking into the tc command, I will report if I get any success with it.

859

That doesn't look like it will have an RTL8380-series SoC. These devices usually have at least 128MB RAM and 16MB flash. Yours only has 16MB of RAM, which really isn't enough these days to run OpenWrt.

2 Likes
860

I don't understand this distinction between default and other routes. It's just another route with a slightly different prefix-length.

What happens if you add something like

ip route add 0/1 via ROUTER_IP dev switch.1
ip route add 128.0.0.0/1 via ROUTER_IP dev switch.1

Are they offloaded? Does that make LAN<->WAN routing as fast as anything else?

861

OK, thank you for your answer.

Weird that the GPL sources are of this model listing RTL SoCs in /sdk/system/drv/swcore/chip.c

You can check it here:
https://www.tp-link.com/en/support/gpl-code/

Search for T2600G-18TS

Are you really sure?

862

The TL-SG3216 has multiple revisions. The picture on the product page doesn't look like your device, so you probably have the older v1. It could the that the v2 has been rebranded as the T2600G-18TS.

863

No, my version is V2, you can see on my pictures:

T2600G-18TS is just another naming scheme to fit into a "series":
https://www.tp-link.com/en/business-networking/managed-switch/t2600g-18ts/

The V1 name was also T2600G-18TS, depending on your location, in Germany they released it as TL-SG3216 for V1 and V2, which is the same model as you can see on the TP-Link website.

EDIT: OK, pretty weird, there are two different products with the only common TL-SG3216, they have different firmwares:
My TL-SG3216: https://www.tp-link.com/de/service-provider/managed-switch/tl-sg3216/
Not My T2600G-18TS(TL-SG3216): https://www.tp-link.com/de/business-networking/managed-switch/t2600g-18ts/

The TL-SG3216 is only available at the German website, the T2600G-18TS(TL-SG3216) also in english:
https://www.tp-link.com/en/business-networking/managed-switch/t2600g-18ts/

If you go to the support tab on either version, there are offered different firmware versions, TL-SG3216 is only ~2.8 MB in size, the T2600G-18TS(TL-SG3216) has ~9.2 MB of size. Maybe only the T2600G-18TS(TL-SG3216) is based on the Realtek SoC. But this would mean, that TP-Link is not offering GPL sources for the TL-SG3216 at all, just for the T2600G-18TS(TL-SG3216).

So I guess you are right and the TL-SG3216 is not a Realtek SoC based switch, the OEM firmware looks like VxWorks which means Broadcom? I have a TL-SG2216 here which is also based on VxWorks. So I can sell it again :smiley:

864

VxWorks doesn't imply Broadcom, it can run on a variety of SoCs - its wiki entry lists Intel, PowerPC and ARM, but old WRT54G(S?) had VxWorks already at some point and those were definitely MIPS.

865

Panasonic Switch-M24eG PN28240K (RTL8382M) uses VxWorks in stock firmware.

2 Likes
866

Hello,

what is the status of development for RTL8389M?
I have a zyxel GS1510-24 which is based on RTL8389M. I tried to contact zyxel for the souce code, but as it is too old it isn't available anymore.

Here's part of the bootlog:

U-Boot V1.00 (Mar 16 2011 - 11:57:18)

CPU: MIPS 4KEc 300 MHz, id: 0x90, rev: 0x6c
Peripheral: 200 MHz
DRAM:  32 MB
Flash:  8 MB
In:    serial
Out:   serial
Err:   serial
Chip configuration - $Revision: 9377 $
Switch Model: GS1510-24 (Port Count: 26)
Switch Chip: RTL8389M
RTL8218 config - PhyIdMask = 0x000000ff
RTL8218B initialize ...
RTL8218 config - PhyIdMask = 0x0000ff00
RTL8218B initialize ...
RTL8218 config - PhyIdMask = 0x00ff0000
RTL8218B initialize ...
Net:   rtl8389#0
>>>>>>>>>>  3  2  1  0

I tried to stop U-Boot with ESC or CTRL-z, but it I can't stop. Do you have any idea which key I can try to get the U-Boot CLI?