Linksys LGS3xxC / LGS3xxMPC
Linksys LGS3xxC / LGS3xxMPC are a series of smart gigabyte switches based on the RTL83xx/RTL93xx SOCs. OpenWrt supports LGS310C.
U-Boot
To enter U-Boot press “a” “c” “p” during startup.
Dual boot
The devices support dual boot with two firmware images. In case something went badly wrong one execute the following commands to change the active image.
U-Boot switch to first image and reboot
switch# # setsys bootpartition 0 switch# # savesys Erasing SPI flash...II: Erasing 4096 bytes from 00090000... 100% Writing to SPI flash...II: Writting 4096 bytes to 00090000... 100% done switch# # boota ## Booting image from partition ... 0
U-Boot switch to second image and reboot
switch# # setsys bootpartition 1 switch# # savesys Erasing SPI flash...II: Erasing 4096 bytes from 00090000... 100% Writing to SPI flash...II: Writting 4096 bytes to 00090000... 100% done switch# # boota ## Booting image from partition ... 1
Linksys CLI switch to first image and reboot
LGS3xxC# boot system image1 Setup partition 1 as active. LGS3xxC# show activepartition Activepartition is partition 1. LGS3xxC# reboot
Linksys CLI switch to second image and reboot
LGS3xxC# boot system image2 Setup partition 2 as active. LGS3xxC# show activepartition Activepartition is partition 2. LGS3xxC# reboot
Switch from OpenWrt running on primary partion back to vendor firmware running on secondary partition
root@OpenWrt:/# fw_setsys bootpartition 1 root@OpenWrt:/# reboot
Installation
Although being dual image devices OpenWrt can only be installed to the primary partition
Install from web interface (easy)
Before you install OpenWrt on the switch boot it with vendor firmware from active partition 2.
Upload image openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-factory.imag from the vendor WebUI via Configure > Maintenance > Firmware upgrade to the first partition. At the time of upload it should be labeled “Backup”.
Install from CLI (convenient)
Before you install OpenWrt on the switch boot it with vendor firmware from backup partition 2.
If one has enabled SSH CLI in the vendor firmare the OpenWrt image can be installed via tftp from command line. Afterwards switch boot process to primary partition.
LGS3xxC# boot system image2 Setup partition 2 as active. LGS3xxC# show activepartition Activepartition is partition 2. LGS3xxC# reboot LGS3xxC# firmware upgrade tftp://192.168.2.86/openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-factory.imag flash:normal image 1 ...Completed: 10 %, Time: 01:20(M:S) ... ...Completed: 20 %, Time: 01:20(M:S) ... ...Completed: 30 %, Time: 01:20(M:S) ... ...Completed: 40 %, Time: 01:20(M:S) ... ...Completed: 50 %, Time: 01:20(M:S) ... ...Completed: 60 %, Time: 01:20(M:S) ... ...Completed: 70 %, Time: 01:20(M:S) ... ...Completed: 80 %, Time: 01:20(M:S) ... ...Completed: 90 %, Time: 01:20(M:S) ... % Firmware upgrade successful ..!!! LGS3xxC# boot system image1 Setup partition 1 as active. LGS3xxC# show activepartition Activepartition is partition 1. LGS3xxC# reboot
Install from serial console (hard)
When you have access to the serial console you can directly install the sysupgrade image from an TFTP server. Finally change the boot order to the primary partition.
switch# # upgrade runtime 192.168.2.86:openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin
Upgrade runtime image [192.168.2.86:openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin]......
Enable network
Force port28 link up 1G
Please wait for PHY init-time ...
Using rtl8380#0 device
TFTP from server 192.168.2.86; our IP address is 192.168.2.70
Filename 'openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin'.
Load address: 0x81000000
Loading: #################################################################
#################################################################
#####################
done
Bytes transferred = 6030120 (5c0328 hex)
Image Name: MIPS OpenWrt Linux-5.15.161
Model Name:
Magic Number: 27051956
Created: 2024-07-30 19:42:33 UTC
Image Type: MIPS Linux Kernel Image (gzip compressed)
Data Size: 3316370 Bytes = 3.2 MB
Load Address: 80100000
Entry Point: 80100000
II: Erasing 13828096 bytes from 005a0000... 100%
II: Writting 13828096 bytes to 005a0000... 100%
Comparing file ......
Total of 13828096 bytes were the same
Upgrade runtime image [192.168.2.86:openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin] to partition 0 success
switch# # setsys bootpartition 0
switch# # savesys
Erasing SPI flash...II: Erasing 4096 bytes from 00090000... 100%
Writing to SPI flash...II: Writting 4096 bytes to 00090000... 100%
done
switch# # boota
## Booting image from partition ... 0
Images
File encapsulation
Linksys firmware images are constructed of two parts:
- A 64 byte header that resembles a U-Boot legacy format image header, all data in network byte order (aka natural aka bigendian)
- an appended tar archive.
| start | size | description |
|---|---|---|
| 0 | 4 | magic number (different from board magic) |
| 4 | 4 | header CRC (based on CRC32) |
| 8 | 4 | creation date ( Unix timestamp in seconds sind 01.01.1970 ) |
| 12 | 4 | size of appended tar archive |
| 16 | 8 | company = 'belkin' |
| 24 | 4 | CRC of appended tar archive (based on CRC32) |
| 28 | 1 | version 1st number |
| 29 | 1 | version 2nd number |
| 30 | 1 | version 3rd number |
| 31 | 1 | version 4th number |
| 32 | 32 | module name (= readable image name) + model name (= encrypted board name) |
| 64 | ... | tar archive |
The tar archive contains several files.
| filename | description |
|---|---|
| firmware_information.txt | version information |
| iss_imagecheck.sh | check if firmware matches the board |
| iss_imageupgrade.sh | upgrade script |
| supportlist.txt | list of supported boards |
| series_vmlinux.bix | boot image |
Boards
Linksys switches boards are identified by magic numbers. These are stored in the U-Boot environment partion. For identifcation use
switch# # printenv magic_number magic_number=0x60402060
From the different available firmware images we get a complete picture
| Offical name | Magic Number | internal name | extra info |
|---|---|---|---|
| LGS310MPC | 0x60402010 | 8380_2fib_1g | 3955,1000,201,3,10,3 |
| LGS310C | 0x60402060 | 8380_2fib_1g | 3955,1000,201,3,10,1 |
| LGS328PC | 0x60401070 | 838X | 3955,1000,201,3,28,2 |
| LGS328PC(RTL8218D) | 0x60401080 | 838X | 3955,1000,201,3,28,2 |
| LGS310MPCv2 | 0x60402090 | 8380_2fib_1g | 3955,1000,201,3,10,3 |
| LGS328MPC | 0x60412020 | 930X | 3955,1000,201,3,28,3 |
| LGS328C | 0x60412040 | 930X | 3955,1000,201,3,28,1 |
| LGS328MPCv2 | 0x60412060 | 930X | 3955,1000,201,3,28,3 |
| LGS352MPC | 0x60422030 | 931X | 3955,1000,201,3,52,3 |
| LGS352C | 0x60422050 | 931X | 3955,1000,201,3,52,1 |
| LGS352MPCv2 | 0x60422070 | 931X | 3955,1000,201,3,52,3 |
LGS310C
The 8 Port GbE plus 2 SFP 1GbE Switch is based on the RTL8380 SOC with 256 MB RAM and 32 MB flash. The switch has a 3.3V populated UART header and 115200 8N1.
Factory image layout is
| start | size | name | description |
|---|---|---|---|
| 0x00000000 | 0x00080000 | LOADER | U-Boot |
| 0x00080000 | 0x00010000 | BDINFO | U-Boot environment (printenv/setenv use 64K) |
| 0x00090000 | 0x00010000 | SYSINFO | System information (printsys/setsys use 4K) |
| 0x000a0000 | 0x00500000 | JFFS2 CFG | |
| 0x005a0000 | 0x00d30000 | KERNEL | primary image |
| 0x012d0000 | 0x00d30000 | KERNEL2 | secondary image |
GPIO 31 is used as shared serial interface clock (SCL) for both SFPs.
LGS352C
The 48 Port GbE plus 4 SFP+ 10GbE Switch is based on the RTL9311 SOC with 512 MB RAM and 128 MB flash. The switch has a RJ45 serial console with Cisco style pinout and 115200 8N1.
USB
Picture of the USB/LED/Console area
USB lanes with missing resistors (and other stuff). Assumption is
- Rxxx are 22 Ohm resistors
- Dxxx is a TVS diode (Transient Voltage Suppressor) - Maybe something like this
- Lxxx is unknown
NAND
Picture of the 128MB (1GBit) NAND.
Nand startup log:
RTK_SPI_NAND driver is used [rtk_spi_nand_detect] Start to probe SPI NAND Flash ...... [rtk_spi_nand_detect] Probe SPI NAND Flash Successed !!! Use nandbase bb func Use nandbase bb scan nand: device found, Manufacturer ID: 0xc2, Chip ID: 0x12 nand: Macronix nand: 128MiB, SLC, page size: 2048, OOB size: 64 Scanning device for bad blocks Bad eraseblock 114 at 0x000000e40000 Creating 3 MTD partitions on "spinand": 0x000000000000-0x000004000000 : "ubifs" 0x000004000000-0x000005e00000 : "runtime1" 0x000005e00000-0x000007c00000 : "runtime2" Creating 1 MTD partitions on "rtk_norsf_g3": 0x000000100000-0x000000200000 : "JFFS2 CFG" Realtek SPINAND Flash Driver is successfully installing. ipip: IPv4 over IPv4 tunneling driver TCP: cubic registered NET: Registered protocol family 17 console [netcon0] enabled netconsole: network logging started Freeing unused kernel memory: 16952K (803f2000 - 81480000) ## Error: "init_customize" not defined UBI: attaching mtd4 to ubi0 [SPINAND] ECC ERROR(ret=ECDEAD08) page_addr = 6BC1! Do retry! [SPINAND] ECC ERROR(ret=ECDEAD08) page_addr = 6BC1! UBI: scanning is finished UBI: attached mtd4 (name "ubifs", size 64 MiB) to ubi0 UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 UBI: VID header offset: 2048 (aligned 2048), data offset: 4096 UBI: good PEBs: 511, bad PEBs: 1, corrupted PEBs: 0 UBI: user volume: 1, internal volumes: 1, max. volumes count: 128 UBI: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 539790213 UBI: available PEBs: 0, total reserved PEBs: 511, PEBs reserved for bad PEB handling: 19 UBI: background thread "ubi_bgt0d" started, PID 40 UBI device number 0, total 511 LEBs (64884736 bytes, 61.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)