Unmanaged Binardat Switch 8port 2.5g + SFP Support

[Ansuel]

Hi I took this unmanaged switch for a while and on open I notice it's the reference RTL design RTL8373 + RTL8224 + 10g SFP.

I dumped the SPI and it's a 1MB NOR.

I flashed the firmware compiled from this repository and to my surprise it does more or less work. I have UART output and the port from 8373 are actually bridged. What I can notice is that 8224 seems to be not correctly configured and the SFP port isa detected but from stat i have "NO SFP".

I assume this is a problem with GPIO configuration.

I added the log for reference.

Detecting CPU: RTL8373

Starting up...
  Flash controller
NIC reset

rtl8373_init called
CPU revision: 6868

phy_config_8224 called
R02f8-00000bff R02f4-00000bed
phy_config_8224 done

RTL837X_REG_SDS_MODES: 0x00000bff

RTL837X_REG_SDS_MODES: 0x00000bff
sds_config sds: 00, mode: 0d

RTL837X_REG_SDS_MODES: 0x00000bed

Trying to set SDS mode to 0x0d

rtl8224_phy_enable called
R02f8-00000003 R02f4-0000000c
rtl8224_phy_enable done

rtl8373_init done

vlan_setup called
vlan_setup done

port_l2_setup called

port_l2_forget called
port_l2_forget done

port_l2_setup done
uip_arp_init called
A minimal prompt to explore the RTL8372:

Clock register: 0x00001101
Register 0x7b20/RTL837X_REG_SDS_MODES: 0x00000bed
Verifying PHY settings:

 Port   State   Link    TxGood          TxBad           RxGood          RxBad
1       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
2       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
3       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
4       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
5       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
6       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
7       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
8       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
9       NO SFP  2500G   0x00000000      0x00000000      0x00000000      0x00000000

>
<SFP-RX OK>


> stat

 Port   State   Link    TxGood          TxBad           RxGood          RxBad
1       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
2       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
3       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
4       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
5       On      1000M   0x00000068      0x00000000      0x00000000      0x00000000
6       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
7       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
8       On      Down    0x00000000      0x00000000      0x00000000      0x00000000
9       NO SFP  2500G   0x00000000      0x00000000      0x00000000      0x00000000

Also I'm attaching the original firmware. I will further research and inspect the source.

Would be interesting to inspect the structure of the original firmware.

Also honestly I think we need a slimmed down version that reduce the size for platform that have only 1MB flash.

[logicog]

Hi I took this unmanaged switch for a while and on open I notice it's the reference RTL design RTL8373 + RTL8224 + 10g SFP.

There seem only to be 3 designs:

1. 4 Ethernet + 2 SFP+ ports (RTL8372)
2. 5 Ethernet + 1 SFP+ port (RTL8372 + RTL8221)
3. 8 Ethernet + 1 SFP+ port (RTL8373 + RTL8224)

I flashed the firmware compiled from this repository and to my surprise it does more or less work. I have UART output and the port from 8373 are actually bridged. What I can notice is that 8224 seems to be not correctly configured and the SFP port isa detected but from stat i have "NO SFP".

I assume this is a problem with GPIO configuration.

Yes. There is autodetection between the RTL8372 and the RTL8373 which should make the RTL8224 work, but the GPIO configuration cannot be auto-detected. At the head of the rtl837x_common.h file there is:

// This has to be set to the number of SFP+ ports, i.e. 1 or 2
#define NSFP 2

Could you change that to "1" and then do a make clean; make?

Would be interesting to inspect the structure of the original firmware.

I hope that the GPIOs are somewhat standardized. Could you first try setting the number of SFP+-ports to 1, and try again? If this does not work, then it is possible to dump the GPIO registers while you insert a module, and then we can directly see the GPIO-lines involved with RX-LOS and Module-Insertion. No need to share the code. You would need to add in the loop at the end just printing out the GPIO registers in the main-routine of rtlplayground.c

Also honestly I think we need a slimmed down version that reduce the size for platform that have only 1MB flash.

This seems a popular request, have a look at and check-out: #11
We'll merge that very soon, I believe.

Please also check out the web-interface on port 80. Feedback is very welcome!

[Ansuel]

thanks for the feedback. I think posting the dump or the nor is not copyright infringement but deleted anyway.

I will try with the sfp thing.

I don't think i have a web interface since the nor is 1mb and doesn't fit the image that is 2mb. Am I wrong?

[Ansuel]

I hope that the GPIOs are somewhat standardized. Could you first try setting the number of SFP+-ports to 1, and try again? If this does not work, then it is possible to dump the GPIO registers while you insert a module, and then we can directly see the GPIO-lines involved with RX-LOS and Module-Insertion. No need to share the code. You would need to add in the loop at the end just printing out the GPIO registers in the main-routine of rtlplayground.c

I just tested and no luck. Guess I have to dump the GPIO. Also I can see the LED port are very confusing. Plugging port 8 makes the LED of port 7 turn on.

[logicog]

Thanks for deletion, the dump contains not just configuration values but also executable code. Realtek guards at least the source-code thereof, which contains their API for the SoCs, quite carefully.

There is an updated PR#12 with the smaller image 512kB it may now maybe be working. Could you try that?

If the LEDs are off by 1, then this means that they use different GPIOs or different LED-numbers. How many leds are there per port? 2? Is that a bi-color LED? The SoC could even use 3 LEDs or a 3-color LED per port.

[Ansuel]

2 led, 1 greed one amber. Classing link on for link (and blink traffic) and 2.5g and amber for 10/100/1000mb

[Ansuel]

BTW this is the dump of GPIO

Module attached

Addr: 0x40
00000010

Addr: 0x44
ff5f69ff

Addr: 0x48
0a7fdb9f

Module detached

Addr: 0x40
00000010

Addr: 0x44
ff5f69ff

Addr: 0x48
0a7fdbd3

[logicog]

2 led, 1 greed one amber. Classing link on for link (and blink traffic) and 2.5g and amber for 10/100/1000mb

That is the same as for the switch I use. The KeepLink 8+1 SFP. It could also be a different attribution of the PHYs to the MACs. Is traffic switched between all ports?

The GPIOs are not straightforward to decode, since some of the bits fluctuate randomly, or at least in a way that looks randomly. And they mask the bits that are really changed. Can you repeat that a couple of times and see which ones really change. It should be 1 for the module in and then when the module has either Ethernet up or the fiber with light in, the other bit should change. They usually go low.

[Ansuel]

Is traffic switched between all ports?

no only for the main 8373. 8224 is silent. But maybe the reset pin is different?

For GPIO debug i think we need to implement a command. For now I added a simple gpio that dump those 3 register but ideally we should also write to it to find the pin to reset the 8224.

[vDorst]

Is traffic switched between all ports?

no only for the main 8373. 8224 is silent. But maybe the reset pin is different?

For GPIO debug i think we need to implement a command. For now I added a simple gpio that dump those 3 register but ideally we should also write to it to find the pin to reset the 8224.

This sound familiar, I have seen a reset hack online.
But can´t find it of course.

[Ansuel]

I think I found the MOD_DEF0 pin. GPIO_C BIT 6

Still not sure about the LOS...

[logicog]

I can use Ghidra to figure the reset pin out. But that is for tomorrow. We will need a way of having a per-device config it seems, too...

[Ansuel]

@logicog header for the initial simple thing. For sure the function needs to be generalized a bit with define magic.

[Ansuel]

I can use Ghidra to figure the reset pin out. But that is for tomorrow. We will need a way of having a per-device config it seems, too...

If you have any hint so I can also have some fun with it :D

[vDorst]

I found what I thought is related to this issue, unfortanty it is about reset button.
Reset button issue: https://github.com/KunYi/SWTG118AS_L2Switch
I think still useful for your board but it is not about reset-gpio of the RTL8224.

I made a simple gpio readout. Show per io-bank the current value and the changes when last used the "gpio" command.
For looking a gpio, this stuck because you have the active the command everything by hand.

So I moved the gpio readout into the timer tick seconds routing so it automatically reads-out the gpio-data. I need to make this a bit nicer, but it was already late.

On my device I found already some GPIO pins. Currently working on it to map it out.
Ideally I want to make a wiki to document this of course.
But I also want to see a wiki with all the PCB versions but also all the brand, device types that have that PCB inside.

[logicog]

I believe the following is done to reset/enable the RTL8224:

void rtl8224_enable(void)
{
	reg_bit_clear(0x3c, 0x1e);
	reg_bit_clear(0x7f94, 3);  // Change some IO Multiplex value
        reg_bit_set(0x4c, 0x1e);
	delay(100);
	reg_bit_set(0x3c, 0x1e);
	delay(500);
}

Can you try this instead of the function with the same name in rtlplayground.c ?
If this works, we need to figure out what this actually does...