Linksys LGS3xxC / LGS3xxMPC

Linksys LGS3xxC / LGS3xxMPC are a series of smart gigabyte switches based on the RTL83xx/RTL93xx SOCs. OpenWrt supports LGS310C.

To enter U-Boot press “a” “c” “p” during startup.

Initramfs works straight forward on these switches. In case you want to avoid manual typing every time you can configure the environment in the bootloader as follows:

# setenv ipaddr 192.168.1.1
# setenv serverip 192.168.1.100
# setenv loadaddr 0x84f00000
# setenv bootfile 'openwrt-realtek-rtl838x-linksys_lgs310c-initramfs-kernel.bin'
# saveenv

Afterwards booting is as simple as this

# rtk network on
# tftpboot
# bootm

TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'openwrt-realtek-rtl838x-linksys_lgs310c-initramfs-kernel.bin'.
Load address: 0x84f00000
Loading: #########...

If you want to boot always automatically from TFTP and initramfs change the boot command

setenv bootcmd 'rtk network on; tftpboot; bootm'
save 

If you want to boot in normal mode again change the eonviroment as follows.

setenv bootcmd 'boota'
save 

The devices support dual boot with two firmware images. In case something went badly wrong one execute the following commands to change the active image.

U-Boot switch to first image and reboot

switch# # setsys bootpartition 0
switch# # savesys
Erasing SPI flash...II: Erasing 4096 bytes from 00090000... 100%
Writing to SPI flash...II: Writting 4096 bytes to 00090000... 100%
done
switch# # boota
## Booting image from partition ... 0

U-Boot switch to second image and reboot

switch# # setsys bootpartition 1
switch# # savesys
Erasing SPI flash...II: Erasing 4096 bytes from 00090000... 100%
Writing to SPI flash...II: Writting 4096 bytes to 00090000... 100%
done
switch# # boota
## Booting image from partition ... 1

Linksys CLI switch to first image and reboot

LGS3xxC# boot system image1
Setup partition 1 as active.
LGS3xxC# show activepartition
Activepartition is partition 1.
LGS3xxC# reboot

Linksys CLI switch to second image and reboot

LGS3xxC# boot system image2
Setup partition 2 as active.
LGS3xxC# show activepartition
Activepartition is partition 2.
LGS3xxC# reboot

Switch from OpenWrt running on primary partion back to vendor firmware running on secondary partition

root@OpenWrt:/# fw_setsys bootpartition 1
root@OpenWrt:/# reboot

Although being dual image devices OpenWrt can only be installed to the primary partition

Before you install OpenWrt on the switch boot it with vendor firmware from active partition 2.

Upload image openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-factory.imag from the vendor WebUI via Configure > Maintenance > Firmware upgrade to the first partition. At the time of upload it should be labeled “Backup”.

Before you install OpenWrt on the switch boot it with vendor firmware from backup partition 2.

If one has enabled SSH CLI in the vendor firmare the OpenWrt image can be installed via tftp from command line. Afterwards switch boot process to primary partition.

LGS3xxC# boot system image2
Setup partition 2 as active.
LGS3xxC# show activepartition
Activepartition is partition 2.
LGS3xxC# reboot

LGS3xxC# firmware upgrade tftp://192.168.2.86/openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-factory.imag flash:normal image 1
 ...Completed: 10 %, Time: 01:20(M:S) ...
 ...Completed: 20 %, Time: 01:20(M:S) ...
 ...Completed: 30 %, Time: 01:20(M:S) ...
 ...Completed: 40 %, Time: 01:20(M:S) ...
 ...Completed: 50 %, Time: 01:20(M:S) ...
 ...Completed: 60 %, Time: 01:20(M:S) ...
 ...Completed: 70 %, Time: 01:20(M:S) ...
 ...Completed: 80 %, Time: 01:20(M:S) ...
 ...Completed: 90 %, Time: 01:20(M:S) ...
% Firmware upgrade successful ..!!!

LGS3xxC# boot system image1
Setup partition 1 as active.
LGS3xxC# show activepartition
Activepartition is partition 1.
LGS3xxC# reboot

When you have access to the serial console you can directly install the sysupgrade image from an TFTP server. Finally change the boot order to the primary partition.

switch# # upgrade runtime 192.168.2.86:openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin
Upgrade runtime image [192.168.2.86:openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin]......
Enable network
Force port28 link up 1G
Please wait for PHY init-time ...

Using rtl8380#0 device
TFTP from server 192.168.2.86; our IP address is 192.168.2.70
Filename 'openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin'.
Load address: 0x81000000
Loading: #################################################################
         #################################################################
         #####################
done
Bytes transferred = 6030120 (5c0328 hex)
   Image Name:   MIPS OpenWrt Linux-5.15.161
   Model Name:
   Magic Number: 27051956
   Created:      2024-07-30  19:42:33 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    3316370 Bytes = 3.2 MB
   Load Address: 80100000
   Entry Point:  80100000
II: Erasing 13828096 bytes from 005a0000... 100%
II: Writting 13828096 bytes to 005a0000... 100%
Comparing file ......
Total of 13828096 bytes were the same
Upgrade runtime image [192.168.2.86:openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin] to partition 0 success

switch# # setsys bootpartition 0
switch# # savesys
Erasing SPI flash...II: Erasing 4096 bytes from 00090000... 100%
Writing to SPI flash...II: Writting 4096 bytes to 00090000... 100%
done
switch# # boota
## Booting image from partition ... 0

Linksys firmware images are constructed of two parts:

• A 64 byte header that resembles a U-Boot legacy format image header, all data in network byte order (aka natural aka bigendian)
• an appended tar archive.

The tar archive contains several files.

Linksys switches boards are identified by magic numbers. These are stored in the U-Boot environment partion. For identifcation use

switch# # printenv magic_number
magic_number=0x60402060

From the different available firmware images we get a complete picture

The 8 Port GbE plus 2 SFP 1GbE Switch is based on the RTL8380 SOC with 256 MB RAM and 32 MB flash. The switch has a 3.3V populated UART header and 115200 8N1.

Factory image layout is

GPIO 31 is used as shared serial interface clock (SCL) for both SFPs.

The 48 Port GbE plus 4 SFP+ 10GbE Switch is based on the RTL9311 SOC with 512 MB RAM and 128 MB flash. The switch has a RJ45 serial console with Cisco style pinout and 115200 8N1.

Picture of the USB/LED/Console area

USB lanes with missing resistors (and other stuff). Assumption is

1. Rxxx are 22 Ohm resistors
2. Dxxx is a TVS diode (Transient Voltage Suppressor) - Maybe something like this
3. Lxxx is unknown

Picture of the 128MB (1GBit) NAND.

Nand startup log:

RTK_SPI_NAND driver is used
[rtk_spi_nand_detect] Start to probe SPI NAND Flash ......
[rtk_spi_nand_detect] Probe SPI NAND Flash Successed !!!
Use nandbase bb func
Use nandbase bb scan
nand: device found, Manufacturer ID: 0xc2, Chip ID: 0x12
nand: Macronix
nand: 128MiB, SLC, page size: 2048, OOB size: 64
Scanning device for bad blocks
Bad eraseblock 114 at 0x000000e40000
Creating 3 MTD partitions on "spinand":
0x000000000000-0x000004000000 : "ubifs"
0x000004000000-0x000005e00000 : "runtime1"
0x000005e00000-0x000007c00000 : "runtime2"
Creating 1 MTD partitions on "rtk_norsf_g3":
0x000000100000-0x000000200000 : "JFFS2 CFG"
Realtek SPINAND Flash Driver is successfully installing.
ipip: IPv4 over IPv4 tunneling driver
TCP: cubic registered
NET: Registered protocol family 17
console [netcon0] enabled
netconsole: network logging started
Freeing unused kernel memory: 16952K (803f2000 - 81480000)
## Error: "init_customize" not defined
UBI: attaching mtd4 to ubi0
[SPINAND] ECC ERROR(ret=ECDEAD08) page_addr = 6BC1! Do retry!
[SPINAND] ECC ERROR(ret=ECDEAD08) page_addr = 6BC1!
UBI: scanning is finished
UBI: attached mtd4 (name "ubifs", size 64 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 511, bad PEBs: 1, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 539790213
UBI: available PEBs: 0, total reserved PEBs: 511, PEBs reserved for bad PEB handling: 19
UBI: background thread "ubi_bgt0d" started, PID 40
UBI device number 0, total 511 LEBs (64884736 bytes, 61.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)