Zyxel GS1920 series
The GS1920 series is a line of managed gigabit ethernet switches. Two revisions exist, but both are built with Realtek hardware.
Switch name | RJ45 ports | Combo SFP ports | Dedicated SFP ports | PoE ports | SoC |
---|---|---|---|---|---|
GS1920-24 | 28 | 4 | - | - | RTL8392M |
GS1920-24HP | 28 | 4 | - | 24 | RTL8392M |
GS1920-48 | 48 | 4 | 2 | - | RTL8393M |
GS1920-48HP | 48 | 4 | 2 | 48 | RTL8393M |
GS1920-8HPv2 | 10 | 2 | - | 8 | RTL8391M |
GS1920-24v2 | 28 | 4 | - | - | RTL8391M |
GS1920-24HPv2 | 28 | 4 | - | 24 | RTL8391M |
GS1920-48v2 | 48 | 4 | 2 | - | RTL8393M |
GS1920-48HPv2 | 48 | 4 | 2 | 48 | RTL8393M |
Models
GS1920-24HP
Hardware
- SoC: RTL839x
- Ethernet:
- 3× RTL8218 (to be confirmed)
- 1× RTL???? (combo ports)
- RAM: Nanya NT5CB64M16FP-DH, 128MiB DDR3
- Flash: Macronix MX25L12835F, 16MiB SPI NOR
- PoE controller: STM32F100
- PoE PSE: 6× BCM59111
- GPIO:
- 1× RTL8231 as GPIO expander: MII mode, device address 0x3
- 3× RTL8231 as shift register: port status LEDs
- HC164 shift register for device status LEDs
- ADT7468 (I2C/SMBus) thermal controller with 3× 3-pin fan
- Sipex SP3232 RS-232 transceiver
The serial port header J2 uses the standard DCE pinout, with TX/RX on pins 2 and 3, and ground on pin 5. Port settings are 9600 baud, 8n1, with ±5.6V logic levels.
The PoE management MCU and the ADT7468 fan controller are on a shared I2C bus. The PoE MCU is at address 0x20, while the fan controller is at (fixed) address 0x2E.
Photos
GS1920-48
Hardware
- SoC: RTL8393M
- Ethernet:
- 6 × RTL8218B (8 × giga copper ports) (based on datasheet)
- 1 × RTL8214C (4 × giga copper/fiber combo ports) (based on datasheet)
- RAM: Nanya NT5CB64M16FP-DH, 128MiB DDR3
- Flash: Macronix MX25L12835F1), 16MiB SPI NOR, SOP-8
- GPIO:
- 1× RTL8231
- Power ICs:
- STM PM6680A - System Voltage Regulator
- ADT7463 PWM fan controller
- Sipex SP3232E RS-232 transceiver
- Delta AFB0412SHB, 12V, 0.35A
The Ethernet ICs are under a glued-down aluminum heatsink (removal was not attempted). The removal of the RTL8393M's heatsink was very challenging, requiring soaking with acetone and applying heat.
Software
- Product Model : GS1920-48
- Bootbase Version : V1.00 | 11/15/2013
- ZyNOS F/W Version : V4.50(AANZ.3) | 05/20/2020
- RomRasSize : 3677044
BootBase Debug Command Listing
- Follow the guide provided at this link for detailed information on setting the debug flag.
- Use the command
ATENx,y
to set the flag. - In my specific case, because my MAC address ends with 6, I successfully used the command
ATEN1,8C43C295
as detailed in the guide, section "The DebugFlag and how to change it".
Command | Description |
---|---|
AT | just answer OK |
ATHE | print help |
ATBAx | change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k |
ATENx,(y) | set BootExtension Debug Flag (y=password) |
ATSE | show the seed of password generator |
ATTI(h,m,s) | change system time to hour:min:sec or show current time |
ATDA(y,m,d) | change system date to year/month/day or show current date |
ATDS | dump RAS stack |
ATDT | dump Boot Module Common Area |
ATDUx,y | dump memory contents from address x for length y |
ATWBx,y | write address x with 8-bit value y |
ATWWx,y | write address x with 16-bit value y |
ATWLx,y | write address x with 32-bit value y |
ATRBx | display the 8-bit value of address x |
ATRWx | display the 16-bit value of address x |
ATRLx | display the 32-bit value of address x |
ATGO(x) | run program at addr x or boot router |
ATGR | boot router |
ATGT | run Hardware Test Program |
AT%Tx | Enable Hardware Test Program at boot up |
ATBTx | block0 write enable (1=enable, other=disable) |
ATRTw,x,y(,z) | RAM test level w, from address x to y (z iterations) |
ATWEa(,b,c,d,e) | write MAC addr, Country code, EngDbgFlag, FeatureBit, Serial Number to flash ROM |
ATWZa(,b,c,d,e) | write MAC addr, Country code, EngDbgFlag, FeatureBit, Serial Number to flash ROM |
ATSNx | set serial number in working buffer |
ATCUx | write Country code to flash ROM |
ATCB | copy from FLASH ROM to working buffer |
ATCL | clear working buffer |
ATSB | save working buffer to FLASH ROM |
ATBU | dump manufacturer related data in working buffer |
ATSH | dump manufacturer related data in ROM |
ATWMx | set MAC address in working buffer |
ATCOx | set country code in working buffer |
ATFLx | set EngDebugFlag in working buffer |
ATSTx | set ROMRAS address in working buffer |
ATSYx | set system type in working buffer |
ATVDx | set vendor name in working buffer |
ATPNx | set product name in working buffer |
ATFEx,y,… | set feature bits in working buffer |
ATMP | check & dump memMapTab |
ATDOx,y | download from address x for length y to PC via XMODEM |
ATTD | download router configuration to PC via XMODEM |
ATUPx,y | upload to RAM address x for length y from PC via XMODEM |
ATUR | upload router firmware to flash ROM |
ATLC | upload router configuration file to flash ROM |
ATUXx(,y) | xmodem upload from flash block x to y |
ATERx,y | erase flash rom from block x to y |
ATWFx,y,z | copy data from addr x to flash addr y, length z |
ATXSx | xmodem select: x=0: CRC mode(default); x=1: checksum mode |
ATLOa,b,c,d | Int/Trap Log Cmd |
ATSR | system reboot |
ATFT(x,y,z) | offset, pattern, len |
ATBR | Reset to default Romfile |
ATDR(x) | Reset to default Romfile x |
ATPA(x) | Pause for x ms |
ATCP | show CPU |
ATGI | select boot image |
ATRF | copy (R)am to (F)lash |
Memory Map
Output of debug command ATMP (memMapTab)
ROMIO image start at b40b0000
code version:
code start: 80014000
code length: 381B44
memMapTab: 22 entries, start = b40e0000, checksum = E323
Section | Index | Name | Type | Start | Length | Notes |
---|---|---|---|---|---|---|
$RAM | 0 | BootExt | RAMBOOT | 80014000 | 30000 | |
$RAM | 1 | BootData | RAM | 80044000 | 4000 | |
$RAM | 2 | RasCode | RAMCODE | 80048000 | 1AB8000 | |
$RAM | 3 | RasData | RAM | 81b00000 | 6400000 | |
$RAM | 4 | BootExtA | RAMBOOT | 80014000 | 30000 | |
$RAM | 5 | RasCodeA | RAMCODE | 80048000 | 1AB8000 | |
$ROM | 6 | BootBas | ROMIMG | b4000000 | 20000 | |
$ROM | 7 | DbgArea | ROMIMG | b4020000 | 10000 | |
$ROM | 8 | RomDir2 | ROMDIR | b4030000 | 80000 | |
$ROM | 9 | BootExt | ROMIMG | b40b0030 | 2FFD0 | |
$ROM | 10 | MemMapT | ROMMAP | b40e0000 | 2000 | |
$ROM | 11 | termcap | ROMIMG | b40e2000 | 400 | |
$ROM | 12 | RomDefa | ROMBIN | b40e2400 | 80000 | Compressed. Version: RAS GS1920. Checksum: 1BC5, Comp. Checksum: 543B |
$ROM | 13 | RasCode | ROMBIN | b4162400 | 64DC00 | Compressed. Version: GS1920. Checksum: A50C, Comp. Checksum: DE1E |
$ROM | 14 | LogArea1 | ROMIMG | b47c0000 | 20000 | |
$ROM | 15 | LogArea2 | ROMIMG | b47e0000 | 20000 | |
$ROM | 16 | RomDir2A | ROMDIR | b4830000 | 80000 | |
$ROM | 17 | BootExtA | ROMIMG | b48b0030 | 2FFD0 | |
$ROM | 18 | MemMapTA | ROMMAP | b48e0000 | 2000 | |
$ROM | 19 | termcapA | ROMIMG | b48e2000 | 400 | |
$ROM | 20 | RomDefaA | ROMBIN | b48e2400 | 80000 | Compressed. Version: RAS GS1920. Checksum: 1BC5, Comp. Checksum: 543B |
$ROM | 21 | RasCodeA | ROMBIN | b4962400 | 64DC00 | Compressed. Version: GS1920. Checksum: A50C, Comp. Checksum: DE1E |