Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision
Previous revision
Next revisionBoth sides next revision
toh:linksys:lgs352c [2022/12/01 18:15] – created plappermaultoh:linksys:lgs352c [2024/10/18 19:22] – [USB] plappermaul
Line 1: Line 1:
-====== Linksys LGS352C ======+====== Linksys LGS3xxC / LGS3xxMPC ====== 
 + 
 +Linksys LGS3xxC / LGS3xxMPC are a series of smart gigabyte switches based on the RTL83xx/RTL93xx SOCs. OpenWrt supports **LGS310C**. 
 + 
 +===== U-Boot ===== 
 + 
 +To enter U-Boot press "a" "c" "p" during startup. 
 + 
 +===== Dual boot ===== 
 + 
 +The devices support dual boot with two firmware images. In case something went badly wrong one execute the following commands to change the active image. 
 + 
 +U-Boot switch to first image and reboot 
 +<code> 
 +switch# # setsys bootpartition 0 
 +switch# # savesys 
 +Erasing SPI flash...II: Erasing 4096 bytes from 00090000... 100% 
 +Writing to SPI flash...II: Writting 4096 bytes to 00090000... 100% 
 +done 
 +switch# # boota 
 +## Booting image from partition ... 0 
 +</code> 
 + 
 +U-Boot switch to second image and reboot 
 +<code> 
 +switch# # setsys bootpartition 1 
 +switch# # savesys 
 +Erasing SPI flash...II: Erasing 4096 bytes from 00090000... 100% 
 +Writing to SPI flash...II: Writting 4096 bytes to 00090000... 100% 
 +done 
 +switch# # boota 
 +## Booting image from partition ... 1 
 +</code> 
 + 
 +Linksys CLI switch to first image and reboot 
 +<code> 
 +LGS3xxC# boot system image1 
 +Setup partition 1 as active. 
 +LGS3xxC# show activepartition 
 +Activepartition is partition 1. 
 +LGS3xxC# reboot 
 +</code> 
 + 
 +Linksys CLI switch to second image and reboot 
 +<code> 
 +LGS3xxC# boot system image2 
 +Setup partition 2 as active. 
 +LGS3xxC# show activepartition 
 +Activepartition is partition 2. 
 +LGS3xxC# reboot 
 +</code> 
 + 
 +Switch from OpenWrt running on primary partion back to vendor firmware running on secondary partition  
 + 
 +<code> 
 +root@OpenWrt:/# fw_setsys bootpartition 1 
 +root@OpenWrt:/# reboot 
 +</code> 
 + 
 +===== Installation ===== 
 + 
 +Although being dual image devices OpenWrt can only be installed to the primary partition 
 + 
 + 
 +==== Install from web interface (easy) ==== 
 + 
 +:!: Before you install OpenWrt on the switch boot it with vendor firmware from active partition 2. :!: 
 + 
 +Upload image openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-factory.imag from the vendor WebUI via Configure > Maintenance > Firmware upgrade to the first partition. At the time of upload it should be labeled "Backup"
 + 
 +==== Install from CLI (convenient) ==== 
 + 
 +:!: Before you install OpenWrt on the switch boot it with vendor firmware from backup partition 2. :!: 
 + 
 +If one has enabled SSH CLI in the vendor firmare the OpenWrt image can be installed via tftp from command line. Afterwards switch boot process to primary partition. 
 + 
 +<code> 
 +LGS3xxC# boot system image2 
 +Setup partition 2 as active. 
 +LGS3xxC# show activepartition 
 +Activepartition is partition 2. 
 +LGS3xxC# reboot 
 + 
 +LGS3xxC# firmware upgrade tftp://192.168.2.86/openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-factory.imag flash:normal image 1 
 + ...Completed: 10 %, Time: 01:20(M:S) ... 
 + ...Completed: 20 %, Time: 01:20(M:S) ... 
 + ...Completed: 30 %, Time: 01:20(M:S) ... 
 + ...Completed: 40 %, Time: 01:20(M:S) ... 
 + ...Completed: 50 %, Time: 01:20(M:S) ... 
 + ...Completed: 60 %, Time: 01:20(M:S) ... 
 + ...Completed: 70 %, Time: 01:20(M:S) ... 
 + ...Completed: 80 %, Time: 01:20(M:S) ... 
 + ...Completed: 90 %, Time: 01:20(M:S) ... 
 +% Firmware upgrade successful ..!!! 
 + 
 +LGS3xxC# boot system image1 
 +Setup partition 1 as active. 
 +LGS3xxC# show activepartition 
 +Activepartition is partition 1. 
 +LGS3xxC# reboot 
 +</code> 
 + 
 +==== Install from serial console (hard) ==== 
 + 
 +When you have access to the serial console you can directly install the sysupgrade image from an TFTP server. Finally change the boot order to the primary partition. 
 + 
 +<code> 
 +switch# # upgrade runtime 192.168.2.86:openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin 
 +Upgrade runtime image [192.168.2.86:openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin]...... 
 +Enable network 
 +Force port28 link up 1G 
 +Please wait for PHY init-time ... 
 + 
 +Using rtl8380#0 device 
 +TFTP from server 192.168.2.86; our IP address is 192.168.2.70 
 +Filename 'openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin'
 +Load address: 0x81000000 
 +Loading: ################################################################# 
 +         ################################################################# 
 +         ##################### 
 +done 
 +Bytes transferred = 6030120 (5c0328 hex) 
 +   Image Name:   MIPS OpenWrt Linux-5.15.161 
 +   Model Name: 
 +   Magic Number: 27051956 
 +   Created:      2024-07-30  19:42:33 UTC 
 +   Image Type:   MIPS Linux Kernel Image (gzip compressed) 
 +   Data Size:    3316370 Bytes = 3.2 MB 
 +   Load Address: 80100000 
 +   Entry Point:  80100000 
 +II: Erasing 13828096 bytes from 005a0000... 100% 
 +II: Writting 13828096 bytes to 005a0000... 100% 
 +Comparing file ...... 
 +Total of 13828096 bytes were the same 
 +Upgrade runtime image [192.168.2.86:openwrt-realtek-rtl838x-linksys_lgs310c-squashfs-sysupgrade.bin] to partition 0 success 
 + 
 +switch# # setsys bootpartition 0 
 +switch# # savesys 
 +Erasing SPI flash...II: Erasing 4096 bytes from 00090000... 100% 
 +Writing to SPI flash...II: Writting 4096 bytes to 00090000... 100% 
 +done 
 +switch# # boota 
 +## Booting image from partition ... 0 
 +</code> 
 + 
 + 
 + 
 + 
 +===== Images ===== 
 + 
 +==== File encapsulation ==== 
 + 
 +Linksys firmware images are constructed of two parts: 
 + 
 +  * A 64 byte header that resembles a U-Boot legacy format image header, all data in network byte order (aka natural aka bigendian) 
 +  * an appended tar archive.  
 + 
 +^ start ^ size ^ description ^ 
 +| 0 | 4 | magic number (different from board magic) | 
 +| 4 | 4 | header CRC (based on CRC32) | 
 +| 8 | 4 | creation date ( Unix timestamp in seconds sind 01.01.1970 ) | 
 +| 12 | 4 | size of appended tar archive | 
 +| 16 | 8 | company = 'belkin'
 +| 24 | 4 | CRC of appended tar archive (based on CRC32) | 
 +| 28 | 1 | version 1st number | 
 +| 29 | 1 | version 2nd number | 
 +| 30 | 1 | version 3rd number | 
 +| 31 | 1 | version 4th number | 
 +| 32 | 32 | module name (= readable image name) + model name (= encrypted board name) | 
 +| 64 | ... | tar archive | 
 + 
 +The tar archive contains several files. 
 + 
 +^ filename ^ description ^ 
 +| firmware_information.txt | version information | 
 +| iss_imagecheck.sh | check if firmware matches the board | 
 +| iss_imageupgrade.sh | upgrade script | 
 +| supportlist.txt | list of supported boards | 
 +| series_vmlinux.bix | boot image | 
 + 
 + 
 +==== Boards ==== 
 + 
 +Linksys switches boards are identified by magic numbers. These are stored in the U-Boot environment partion. For identifcation use  
 + 
 +<code> 
 +switch# # printenv magic_number 
 +magic_number=0x60402060 
 +</code>   
 + 
 +From the different available firmware images we get a complete picture 
 + 
 +^ Offical name ^ Magic Number ^ internal name ^ extra info ^ 
 +| LGS310MPC            | 0x60402010 | 8380_2fib_1g | 3955,1000,201,3,10,3 | 
 +| LGS310C              | 0x60402060 | 8380_2fib_1g | 3955,1000,201,3,10,1 | 
 +| LGS328PC             | 0x60401070 | 838X | 3955,1000,201,3,28,2 | 
 +| LGS328PC(RTL8218D)   | 0x60401080 | 838X | 3955,1000,201,3,28,2 | 
 +| LGS310MPCv2          | 0x60402090 | 8380_2fib_1g | 3955,1000,201,3,10,3 | 
 +| LGS328MPC            | 0x60412020 | 930X | 3955,1000,201,3,28,3 |  
 +| LGS328C              | 0x60412040 | 930X | 3955,1000,201,3,28,1 |  
 +| LGS328MPCv2          | 0x60412060 | 930X | 3955,1000,201,3,28,3 |  
 +| LGS352MPC            | 0x60422030 | 931X | 3955,1000,201,3,52,3 |  
 +LGS352C              | 0x60422050 | 931X | 3955,1000,201,3,52,1 |  
 +| LGS352MPCv2          | 0x60422070 | 931X | 3955,1000,201,3,52,3 |  
 + 
 + 
 +===== LGS310C ===== 
 + 
 +The 8 Port GbE plus 2 SFP 1GbE Switch is based on the RTL8380 SOC with 256 MB RAM and 32 MB flash. The switch has a 3.3V populated UART header and 115200 8N1.  
 + 
 +Factory image layout is 
 + 
 +^ start     ^ size       ^ name          ^ description ^ 
 +| 0x00000000 | 0x00080000 | LOADER   | U-Boot | 
 +| 0x00080000 | 0x00010000 | BDINFO   | U-Boot environment (printenv/setenv use 64K) | 
 +| 0x00090000 | 0x00010000 | SYSINFO  | System information (printsys/setsys use 4K) | 
 +| 0x000a0000 | 0x00500000 | JFFS2 CFG | | 
 +| 0x005a0000 | 0x00d30000 | KERNEL    | primary image | 
 +| 0x012d0000 | 0x00d30000 | KERNEL2   | secondary image | 
 + 
 +{{:media:lgs310c.jpg?400|}} 
 + 
 +GPIO 31 is used as shared serial interface clock (SCL) for both SFPs. 
 + 
 +{{:media:lgs310c2.jpg?400|}} 
 + 
 +===== LGS352C ===== 
 + 
 +The 48 Port GbE plus 4 SFP+ 10GbE Switch is based on the RTL9311 SOC with 512 MB RAM and 128 MB flash. The switch has a RJ45 serial console with Cisco style pinout and 115200 8N1. 
 + 
 +{{:media:lgs352c-1.jpg?400|}} 
 + 
 +{{:media:lgs352c-2.jpg?400|}} 
 + 
 +{{:media:lgs352c-3.jpg?400|}} 
 + 
 +==== USB ==== 
 +Picture of the USB/LED/Console area 
 + 
 +{{:media:lgs352c-4.jpg?400|}} 
 + 
 +USB lanes with missing resistors (and other stuff). Assumption is 
 + 
 +- R are 22 Ohm resistors 
 +- D is a TVS diode (Transient Voltage Suppressor) 
 +- L is unknown  
 + 
 +{{:media:lgs-352c-usb.jpg?nolink&400|}} 
 +==== NAND ==== 
 +Picture of the 128MB (1GBit) NAND. 
 + 
 +{{:media:lgs352c-5.jpg?400|}} 
 + 
 +Nand startup log: 
 +<code> 
 +RTK_SPI_NAND driver is used 
 +[rtk_spi_nand_detect] Start to probe SPI NAND Flash ...... 
 +[rtk_spi_nand_detect] Probe SPI NAND Flash Successed !!! 
 +Use nandbase bb func 
 +Use nandbase bb scan 
 +nand: device found, Manufacturer ID: 0xc2, Chip ID: 0x12 
 +nand: Macronix 
 +nand: 128MiB, SLC, page size: 2048, OOB size: 64 
 +Scanning device for bad blocks 
 +Bad eraseblock 114 at 0x000000e40000 
 +Creating 3 MTD partitions on "spinand": 
 +0x000000000000-0x000004000000 : "ubifs" 
 +0x000004000000-0x000005e00000 : "runtime1" 
 +0x000005e00000-0x000007c00000 : "runtime2" 
 +Creating 1 MTD partitions on "rtk_norsf_g3": 
 +0x000000100000-0x000000200000 : "JFFS2 CFG" 
 +Realtek SPINAND Flash Driver is successfully installing. 
 +ipip: IPv4 over IPv4 tunneling driver 
 +TCP: cubic registered 
 +NET: Registered protocol family 17 
 +console [netcon0] enabled 
 +netconsole: network logging started 
 +Freeing unused kernel memory: 16952K (803f2000 - 81480000) 
 +## Error: "init_customize" not defined 
 +UBI: attaching mtd4 to ubi0 
 +[SPINAND] ECC ERROR(ret=ECDEAD08) page_addr 6BC1! Do retry! 
 +[SPINAND] ECC ERROR(ret=ECDEAD08) page_addr 6BC1! 
 +UBI: scanning is finished 
 +UBI: attached mtd4 (name "ubifs", size 64 MiB) to ubi0 
 +UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes 
 +UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048 
 +UBI: VID header offset: 2048 (aligned 2048), data offset: 4096 
 +UBI: good PEBs: 511, bad PEBs: 1, corrupted PEBs: 0 
 +UBI: user volume: 1, internal volumes: 1, max. volumes count: 128 
 +UBI: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 539790213 
 +UBI: available PEBs: 0, total reserved PEBs: 511, PEBs reserved for bad PEB handling: 19 
 +UBI: background thread "ubi_bgt0d" started, PID 40 
 +UBI device number 0, total 511 LEBs (64884736 bytes, 61.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB) 
 +</code>
  
-press "a" "c" "p" during bootup to enter U-Boot 
  
  • Last modified: 2024/10/18 20:24
  • by plappermaul