Show pageOld revisionsBacklinksFold/unfold allBack to top This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ====== 24p POE+ 4sfp ====== {{ :dscn6769.jpg?direct&800 |}} This is an Fullriver FR-S3128GT-370P2 managed multi-gigabit POE+ (370W) Ethernet switche. === Architecture Overview === The switch makes use of the various SerDeS units on the [[rtl93xx|RTL9301]]. ^ SDS ^ Use ^ Connection | port(s) | | 0? | RTL8218D | QSGMII | 0 - 4 | | 1? | RTL8218D | QSGMII | 5 - 7 | | 2? | RTL8218D | XSGMII | 8 - 15 | | 3? | RTL8218D | XSGMII | 16 - 23 | | 4? | SFP+ | 10GBase-R | 24 | | 6? | SFP+ | 10GBase-R | 25 | | 8? | SFP+ | 10GBase-R | 26 | | 9? | SFP+ | 10GBase-R | 27 | <uml> @startuml package "RTL93xx" { node "MIPS 34kc" as mips { [VPE0] [VPE1] } database DDR3 { } database Flash { } mips -- DDR3 mips -- [SwitchCore] [SwitchCore] --> [RTL8218D_0]: MDI Bus [SwitchCore] <--> [RTL8218D_0]: MII/8 [SwitchCore] --> [RTL8218D_1]: MDI Bus [SwitchCore] <--> [RTL8218D_1]: MII/8 [SwitchCore] --> [RTL8218D_2]: MDI Bus [SwitchCore] <--> [RTL8218D_2]: MII/8 [SwitchCore] <--> [SFP0] : I2C DATA [SwitchCore] <--> [SFP1] : IC2 DATA [SwitchCore] <--> [SFP2] : IC2 DATA [SwitchCore] <--> [SFP3] : IC2 DATA mips -- [SPI0] [SPI0] <--> Flash: QSPI mips -- [UART0] } [SwitchCore] --> [RTL8321_0]: SMI Bus RTL8321_0 --> [RTL8321_1] : Dailychain [UART0] -- console RTL8218D_0 --> "lan1-8" RTL8218D_1 --> "lan9-16" RTL8218D_2 --> "lan17-24" SFP0 --> lan25 SFP1 --> lan26 SFP2 --> lan27 SFP3 --> lan28 @enduml </uml> ===== Models ===== ===== Hardware ===== * [[rtl93xx|RTL9301]] SoC * Winbond [[https://www.winbond.com/hq/product/code-storage-flash-memory/serial-nor-flash/?__locale=en&partNo=W25Q256JV|W25Q256JV]] {{ :w25q256jv_spi_revl_10182022_plus.pdf |(256MB flash)}} * Winbond W632GG6NB-1q (256MB DDR3 SDRAM) * 2x [[RTL8231]] GPIO extender to control the port LEDs + 3x [[https://www.ti.com/product/SN74LV595A|TI LV595A]] {{ :sn74lv595a.pdf |shift register}} * 3x RTL8218D 8x Gigabit PHY * 3x RTL8238B POE controller * Holtek [[https://www.holtek.com/productdetail/-/vg/HT32F50231_41|HT32F50231]] POE protocol-controller * reset button * power-led (pwr1, always not controllable) * run-led (sys1, gpio0) 4 Uplink ports are SFP+ cages which support 10GBit Base-X mini GBIC modules. Power is supplied via a 100V-24-V 10A standard IEC connector. A Serial header can be connected to from the outside of the switch trough the RJ45 'console' port with a standard cisco 'blue' pinout. Serial connection is via 115200 baud, 8N1. {{ :dscn6758.jpg?600 |}} {{ :dscn6759.jpg?600 |}} {{ :dscn6760.jpg?600 |}} {{ :dscn6757.jpg?600 |}} {{ :dscn6761.jpg?600 |}} {{ :dscn6762.jpg?600 |}} {{ :dscn6765.jpg?&600 |}} {{ :dscn6755.jpg?600 |}} {{ :dscn6767.jpg?&600 |}} {{ :dscn6768.jpg?600 |}} {{ :img_20230228_152804.jpg?600 |}} {{:sfp_tracing.png?800|}} {{ :sfp_annotation.png?200 |}} ==== OEM Firmware ===== === OEM U-Boot environment === <code> RTL9300# # printenv baudrate=115200 boardmodel=RTL8393M_DEMO bootcmd=boota bootdelay=1 ethaddr=00:E0:4C:00:00:00 ipaddr=192.168.1.1 ledModeInitSkip=0 serverip=192.168.1.111 stderr=serial stdin=serial stdout=serial Environment size: 217/65532 bytes </code> === OEM SYS environment === <code> RTL9300# # printsys bootpartition=1 ...<0xff>... System information size: 4093/4096 bytes </code> === OEM bootlog === ++++ Bootlog | <code> U-Boot 2011.12.(3.6.7.55090) (Jan 11 2023 - 11:23:36) Board: RTL9300 CPU:800MHz LX:175MHz DDR:600MHz DRAM: 256 MB SPI-F: WINBOND/EF4019/MMIO32-2/ModeC 1x32 MB (plr_flash_info @ 83f93cc4) Loading 65536B env. variables from offset 0xe0000 Net: Net Initialization Skipped No ethernet found. Hit Esc key to stop autoboot: 0 ## dual_image_sel ... -1-1-1 ## Booting image from partition ... 1 ## Booting kernel from Legacy Image at 81000000 ... Image Name: RTK_SDK Created: 2023-01-11 11:28:27 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 9173575 Bytes = 8.7 MB Load Address: 80000000 Entry Point: 802b3350 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... Loading drivers..................................OK Loading basic manager applications...............OK Loading L2 applications..........................OK Loading L3 applications..........................OK Loading manager applications.....................OK Load successfully. Username(1-64 chars):admin Password(1-128 chars):admin Switch> </code> ++++ ==== OEM Flash layout ==== === U-Boot === <code> RTL9300# # flshow =============== FLASH Partition Layout =============== Index Name Size Address ------------------------------------------------------ 0 LOADER 0xe0000 0xb4000000-0xb40dffff 1 BDINFO 0x10000 0xb40e0000-0xb40effff 2 SYSINFO 0x10000 0xb40f0000-0xb40fffff 3 JFFS2_CFG 0x100000 0xb4100000-0xb41fffff 4 JFFS2_LOG 0x400000 0xb4200000-0xb45fffff 5 RUNTIME1 0xd00000 0xb4600000-0xb52fffff 6 RUNTIME2 0xd00000 0xb5300000-0xb5ffffff ====================================================== </code> === GPIO's === By looking at 0xb8003300 from U-Boot, we can see the GPIO's toggling the bits. Inserting an SFP module into the SFP port triggers 'some' GPIO, either ABS or something else as the pinout doesn't seem to match exactly. TBC. * GPIO00 sysled * GPIO01 External watchdog disable (NC) * GPIO02 External watchdog ping (NC) * GPIO03 reset button * GPIO04 GPIO I2C_CLK to fan controller (NC) * GPIO05 GPIO I2C_DATA to fan controller (NC) * GPIO06 EN PHY (NC) * GPIO07 SDC * GPIO08 port24 (sfp0) SDA * GPIO09 port25 (sfp1) SDA * GPIO10 port26 (sfp2) SDA * GPIO11 port27 (sfp3) SDA * GPIO12 port24 (sfp0) TXD * GPIO13 port24 (sfp0) LOS * GPIO14 port25 (sfp1) TXD * GPIO15 port25 (sfp1) LOS * GPIO16 port26 (sfp2) TXD * GPIO17 port26 (sfp2) LOS * GPIO18 port27 (sfp3) TXD * GPIO19 port27 (sfp3) LOS * GPIO20 has POE hardware board fitted * GPIO21 - 23 Board ID === Connectors === Order of pinout is not the same for J1 and J2 ... == J1 (connects to LED board) == * 1: VDD * 2: GPIO00 (SYS_LED) * 3: LED_CLK (rtl8231) * 4: LED_DAT (rtl8231) * 5: Reset (rtl8231) * 6: GND * 7: LED Latch (from POE controller?) * 8: MOSI (from POE controller?) * 9: LED Output enable (from POE controller?) * 10: SCK (from POE controller?) == J2 (Connects to POE board) == * 1: VDD * 2: VDD * 3: JTAG_TDO * 4: JTAG_TMS * 5: JTAG_TCK * 6: JTAG_TDI * 7: GND * 8: GND * 9: MOSI (from POE controller?) * 10: LED Latch (from POE controller?) * 11: SCK (from POE controller?) * 12: LED Output enable (from POE controller?) Probably to test/sniff the POE leds and/or program the POE micro controller; though that one has its own pinout (J3) ... ====== Notes ====== `rtk network on` in U-Boot sets all SPI pins to SPI pins, which breaks the reset GPIO. Use <code>'rtk network on; mw 0xbb0003a0 0x00340000; tftpboot; bootm'</code> instead rtl93xx/fullriver-fr-s3128gt-370p2.txt Last modified: 2023/04/12 20:46by oliver