Netgear GS308T V1

The Netgear GS308T V1 is a relatively cheap managed 8-port desktop-switch and could probably be seen as the successor to the trusty Netgear GS108E. It is powered by a RTL8380M Switch-SOC Datasheet which comes with an embedded MIPS 4KEc CPU Core (Datasheet). The switch is supported out of the box by OpenWrt and can be flashed from the OEM GUI and recovered with an easily accessible serial connection (need to solder on pin-headers) in case something goes wrong. The GS308T is therefore a good entry-level device for a OpenWrt managed switch.

Caution: The is GS308T is a switch, not a router. It can't do NAT, firewalling or routing in a performant way. Use a dedicated router for these purposes. Flashing a switch with OpenWrt gives you a modern OS and GUI, a well defined configuration-API, the option to log directly to a grafana instance via collectd and much more. However running OpenWrt on switches is not yet very common and so quite some features of the OEM firmware are not yet supported by OpenWrt.

Out of the box the switch comes with DHCP configured. If no DHCP server is available, the switch configures itself with a static ip of 192.168.0.239/24. You can then open the Web-GUI via http in your browser. The default password is password which needs to be changed immediately after login.

Update the switch to the latest OEM firmware) first, before trying to flash OpenWrt. Unzip the downloaded file and upload the .bix-File as firmware to the image1-partition. Then reboot the switch. After the update is complete, copy the new image1 firmware also to the image2 slot in case you need to recover to OEM firmware later on.

Download the initramfs image for the GS308T switch and check the sha256sum.

Select the image as file for firmware-update in the OEM GUI. Always flash image1 with OpenWrt and leave image2 as OEM firmware, because the OpenWrt sysupgrade-tool will only ever write to image1 partition.

After the upload is done, restart the switch one more time. OpenWrt will boot in initramfs (ramdisk-mode) and configure itself with a static ip of 192.168.1.1/24. During boot the Power-LED will blink green during boot and become solid green after OpenWrt has finished booting. Caution: the Port-LED will stay offline at this point and it might look like you have no link. This is normal (see port leds below).

The freshly flashed switch will not do any DHCP and you need to configure yourself an IP out of the aforementioned net, before you can visit http://192.168.1.1/ and login with an empty password.

Now download the sysupgrade image for the GS308T and once again check the sha265sum.

Flash this image from within the OpenWrt Web-GUI. During the flashing the Power-LED will blink orange before changing to solid orange on success, then going off for a couple of seconds and continuing with the usual green blink, then solid green cycle, at which point the switch has been completely flashed with OpenWrt. The Port-LEDs will stay dark, even if there is a link up.

To temporarily boot into the second firmware image, which still contains the OEM Firmware, run the following command on the OpenWrt shell:

fw_setsys bootpartition 1
reboot

The device will now boot the OEM Firmware from image2 and continue to do so unless you change the boot-image back to image1 (Maintainace → File Management → Dual Image Configuration → Active Image → Apply in the OEM Firmware). If you want you can copy the OEM Firmware from image2 back to image1 to completely erase OpenWrt from the device (Maintainance → File Management → Copy in the OEM Firmware).

To directly and permanently flash the OEM firmware back to image1, download the latest OEM Firmware and copy the .bix file from the Zip-Archive to /tmp/ on the OpenWrt installation. Then run this command:

sysupgrade -n -F /tmp/GS308T_*.bix

The Port-LEDs are not working after flashing OpenWrt, because OpenWrt fails to initialize the Switch-ASIC to control the LEDs. Until this is fixed, there are two options to configure the LEDs:

1. via U-Boot during early boot. This has the side effect that the switch is initialized early on and might start leaking data.
2. via rc.local script after bootup

you can execute the following command inside OpenWrt:

fw_setenv bootcmd "rtk network on; boota"
reboot

This configures the bootloader (U-Boot) to setup the realtek network before booting the OS. This feature is normally used to boot a kernel via TFTP, but it has the side-effect of already configuring the Switch-ASIC to control the LEDs. Reboot after changing this flag. To restore to the original state, execute:

fw_setenv bootcmd "boota"

You can put the following commands into /etc/rc.local, right before exit 0:

echo 0x2f396a1b > /sys/kernel/debug/rtl838x/led/led_glb_ctrl
echo 0x3e007dea > /sys/kernel/debug/rtl838x/led/led_mode_ctrl
echo 0x00000004 > /sys/kernel/debug/rtl838x/led/led_mode_sel
echo 0x0000ff00 > /sys/kernel/debug/rtl838x/led/led_p_en_ctrl

See DSA for a list of commands to manage the switch from within OpenWrt.

While the GS308T does not have an externally available console, the lid can be removed with only two screws and the PCB has easily accessible through-hole pads that expose a 3.3V serial console. The serial format is 115200 8N1. The pin-header is labeled as J1 on the PCB with the pin-1 marker towards the back of the device. The Pinout is as follows:

J1 |  1 234
     [o]ooo
      ^ ||`------ GND
      | |`------- TXD
      | `-------- RXD
      `---------- Do not connect

The bootloader is basded on uboot. It supports booting from both images, booting from tftp and booting from the serial console via either ymodem or kermit protocol.

A typical bootloader-prompt will look like this:

BOOT Loader Version 1.0.0.1 (2018-05-18 10:58:12 UTC)

Board: RTL838x CPU:500MHz LXB:200MHz MEM:300MHz
[NGC] Init SDK HW Profile & RTCORE
RTCORE Driver Module Initialize
  IOAL init
  Hardware-profile probe
  GPIO probe (unit 0): (found)
  GPIO Init
  RTL8231 probe (unit 0): (found)
  RTL8231 init (unit 0)
[NGC] Set Multiplex Mode
[NGC] Set GPIO dev 1 dir IN pin 6 value 1
[NGC] Set GPIO dev 1 dir IN pin 7 value 1
[NGC] Set GPIO dev 1 dir OUT pin 8 value 0
[NGC] Set GPIO dev 1 dir OUT pin 9 value 0
[NGC] Set GPIO dev 1 dir OUT pin 10 value 0
[NGC] Set GPIO dev 1 dir IN pin 13 value 1
[NGC] Set GPIO dev 1 dir IN pin 14 value 1
[NGC] Set GPIO dev 1 dir OUT pin 20 value 1
[NGC] Set GPIO dev 1 dir OUT pin 21 value 1
[NGC] Set GPIO dev 1 dir OUT pin 23 value 1
[NGC] Set GPIO dev 1 dir OUT pin 24 value 1
[NGC] Set GPIO dev 1 dir OUT pin 25 value 1
[NGC] Set GPIO dev 1 dir OUT pin 26 value 1
[NGC] Set GPIO dev 1 dir OUT pin 27 value 1
[NGC] Set GPIO dev 1 dir OUT pin 28 value 1
[NGC] Set GPIO dev 1 dir OUT pin 29 value 1
[NGC] Set GPIO dev 1 dir OUT pin 30 value 1
[NGC] Set GPIO dev 1 dir OUT pin 31 value 1
[NGC] Set GPIO dev 1 dir OUT pin 32 value 0
[NGC] Set GPIO dev 1 dir OUT pin 33 value 0
[NGC] Set GPIO dev 1 dir OUT pin 34 value 1
[NGC] Set GPIO dev 1 dir OUT pin 35 value 1
[NGC] Set GPIO dev 1 dir OUT pin 36 value 1
[NGC] Enable 8231
  Hardware-profile init (GS308T)
  I2C probe (unit 0)
  I2C init (unit 0)
  NIC probe (unit 0)
  Loader RTNIC Driver Module Initialize
CPU  : 500 MHz
RAM  : 128 MB
FLASH: 32 MB

Model: GS308T
MAC  : C8:9E:43:A8:E5:62

Hit Esc key to stop autoboot:  0 
RTL838x# 
RTL838x# help
?       - alias for 'help'
base    - print or set address offset
boota   - boota  - boot application image from one of dual images partition automatically
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
env     - environment handling commands
erase   - erase FLASH memory
flerase - Erase flash partition
flinfo  - print FLASH memory information
flshow  - Show flash partition layout
go      - start application at address 'addr'
help    - print command description/usage
iminfo  - print header information for application image
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
printsys- printsys - print system information variables

protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
rtk     - rtk     - Realtek commands

run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
savesys - savesys - save system information variables to persistent storage

setenv  - set environment variables
setsys  - setsys  - set system information variables

sf      - SPI flash sub-system
sleep   - delay execution for some time
tftpboot- boot image via network using TFTP protocol
upgrade - Upgrade loader or runtime image
version - print monitor, compiler and linker version

RTL838x# printenv 
SN=5GK51C58008F1
baudrate=115200
boardmodel=RTL8393M_DEMO
bootcmd=boota
bootdelay=1
ethact=rtl8380#0
ethaddr=C8:9E:43:A8:E5:62
fileaddr=81000000
filesize=7ABE74
ipaddr=192.168.1.1
ledModeInitSkip=0
serverip=192.168.1.111
stderr=serial
stdin=serial
stdout=serial
Environment size: 293/65532 bytes

RTL838x# printsys 
SN=00000000001
dualfname1=image
bootpartition=0

RTL838x# boota 
## Booting image from partition ... 0
## Booting kernel from Legacy Image at 81000000 ...
   Version:      MIPS OpenWrt Linux-5.15.130
   Created:      2023-09-03  11:40:14 UTC
   Data Size:    2494913 Bytes = 2.4 MB
   Checksum ... OK
   Uncompressing ... OK

Starting kernel ...

[    0.000000] Linux version 5.15.130 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23875-b4db76a5e5) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Sun Sep 3 11:40:14 2023
[    0.000000] RTL838X model is 83806800
…

The bootlog of the OEM firmware looks like this:

BOOT Loader Version 1.0.0.1 (2018-05-18 10:58:12 UTC)

Board: RTL838x CPU:500MHz LXB:200MHz MEM:300MHz
[NGC] Init SDK HW Profile & RTCORE
RTCORE Driver Module Initialize
  IOAL init
  Hardware-profile probe
  GPIO probe (unit 0): (found)
  GPIO Init
  RTL8231 probe (unit 0): (found)
  RTL8231 init (unit 0)
[NGC] Set Multiplex Mode
[NGC] Set GPIO dev 1 dir IN pin 6 value 1
[NGC] Set GPIO dev 1 dir IN pin 7 value 1
[NGC] Set GPIO dev 1 dir OUT pin 8 value 0
[NGC] Set GPIO dev 1 dir OUT pin 9 value 0
[NGC] Set GPIO dev 1 dir OUT pin 10 value 0
[NGC] Set GPIO dev 1 dir IN pin 13 value 1
[NGC] Set GPIO dev 1 dir IN pin 14 value 1
[NGC] Set GPIO dev 1 dir OUT pin 20 value 1
[NGC] Set GPIO dev 1 dir OUT pin 21 value 1
[NGC] Set GPIO dev 1 dir OUT pin 23 value 1
[NGC] Set GPIO dev 1 dir OUT pin 24 value 1
[NGC] Set GPIO dev 1 dir OUT pin 25 value 1
[NGC] Set GPIO dev 1 dir OUT pin 26 value 1
[NGC] Set GPIO dev 1 dir OUT pin 27 value 1
[NGC] Set GPIO dev 1 dir OUT pin 28 value 1
[NGC] Set GPIO dev 1 dir OUT pin 29 value 1
[NGC] Set GPIO dev 1 dir OUT pin 30 value 1
[NGC] Set GPIO dev 1 dir OUT pin 31 value 1
[NGC] Set GPIO dev 1 dir OUT pin 32 value 0
[NGC] Set GPIO dev 1 dir OUT pin 33 value 0
[NGC] Set GPIO dev 1 dir OUT pin 34 value 1
[NGC] Set GPIO dev 1 dir OUT pin 35 value 1
[NGC] Set GPIO dev 1 dir OUT pin 36 value 1
[NGC] Enable 8231
  Hardware-profile init (GS308T)
  I2C probe (unit 0)
  I2C init (unit 0)
  NIC probe (unit 0)
  Loader RTNIC Driver Module Initialize
CPU  : 500 MHz
RAM  : 128 MB
FLASH: 32 MB

Model: GS308T
MAC  : C8:9E:43:A8:E5:62

Hit Esc key to stop autoboot:  0 
## Booting image from partition ... 1
## Booting kernel from Legacy Image at 81000000 ...
   Version:      1.0.5.7
   Created:      2022-09-27  15:51:55 UTC
   Data Size:    8352231 Bytes = 8 MB
   Checksum ... OK
   Uncompressing ... OK

Starting kernel ...

Board ID: 0

Unable to bind server socket to port 22: Address already in use
<181>1 2022-01-01T00:00:05.370Z: %0.0.0.0-1 TRAPMGR-5-SYSTEM_WARMSTART sal_snmp.c(762): Warm startup
Press any key to continue
<181>1 2022-01-01T00:00:06.970Z: %0.0.0.0-1 TRAPMGR-5-PORT_LINK_UP ksi_snmp.c(232): Interface GigabitEthernet1 link up
<181>1 2022-01-01T00:00:06.980Z: %0.0.0.0-1 TRAPMGR-5-PORT_LINK_UP rsd_l3_intf.c(130): Interface VLAN-MGMT link up
<181>1 2022-01-01T00:00:11.820Z: %192.168.0.239-1 TRAPMGR-5-STP_TC ksi_snmp.c(486): Bridge topology change.
Username: admin
Password: ********************
GS308T# <181>1 2022-01-01T00:00:40.520Z: %10.125.1.97-1 AAA-5-CONNECT vtysh_main.c(2149): New console connection for user admin, source  ACCEPTED
GS308T# 
  clear             Reset functions
  configure         Configuration Mode
  copy              Copy from one file to another
  delete            Delete a file from the flash file system
  disable           Turn off privileged mode command
  end               End current mode and change to enable mode
  exit              Exit current mode and down to previous mode
  ip                IP configuration
  no                Negate command
  ping              Send ICMP ECHO_REQUEST to network hosts
  reboot            Halt and perform a warm restart
  restore-defaults  Restore to default
  save              Save running configuration to flash
  show              Show running system information
GS308T# 

The console is the same that is also exposed via ssh by the OEM Firmware.