zyxel_gs1920_series

Zyxel GS1920 series

The GS1920 series is a line of managed gigabit ethernet switches. Two revisions exist, but both are built with Realtek hardware.

Switch name RJ45 ports Combo SFP ports Dedicated SFP ports PoE ports SoC
GS1920-24 28 4 - - RTL8392M
GS1920-24HP 28 4 - 24 RTL8392M
GS1920-48 48 4 2 - RTL8393M
GS1920-48HP 48 4 2 48 RTL8393M
GS1920-8HPv2 10 2 - 8 RTL8391M
GS1920-24v2 28 4 - - RTL8391M
GS1920-24HPv2 28 4 - 24 RTL8391M
GS1920-48v2 48 4 2 - RTL8393M
GS1920-48HPv2 48 4 2 48 RTL8393M

Hardware

  • SoC: RTL839x
  • Ethernet:
    • 3× RTL8218 (to be confirmed)
    • 1× RTL???? (combo ports)
  • RAM: Nanya NT5CB64M16FP-DH, 128MiB DDR3
  • Flash: Macronix MX25L12835F, 16MiB SPI NOR
  • PoE controller: STM32F100
  • PoE PSE: 6× BCM59111
  • GPIO:
    • RTL8231 as GPIO expander: MII mode, device address 0x3
    • 3× RTL8231 as shift register: port status LEDs
    • HC164 shift register for device status LEDs
  • ADT7468 (I2C/SMBus) thermal controller with 3× 3-pin fan
  • Sipex SP3232 RS-232 transceiver

The serial port header J2 uses the standard DCE pinout, with TX/RX on pins 2 and 3, and ground on pin 5. Port settings are 9600 baud, 8n1, with ±5.6V logic levels.

The PoE management MCU and the ADT7468 fan controller are on a shared I2C bus. The PoE MCU is at address 0x20, while the fan controller is at (fixed) address 0x2E.

Photos

Board Pictures
Overview device front inside overview
Main board main board overview main board SoC and memory main board GPIOs main board fan control main board serial port and SFP cages main board backside
PoE daughter board PoE board PoE controller ICs PoE board backside

Hardware

  • SoC: RTL8393M
    • Ethernet:
    • 6 × RTL8218B (8 × giga copper ports) (based on datasheet)
    • 1 × RTL8214C (4 × giga copper/fiber combo ports) (based on datasheet)
  • RAM: Nanya NT5CB64M16FP-DH, 128MiB DDR3
  • Flash: Macronix MX25L12835F1), 16MiB SPI NOR, SOP-8
  • GPIO:
  • Power ICs:
    • STM PM6680A - System Voltage Regulator
  • ADT7463 PWM fan controller
  • Sipex SP3232E RS-232 transceiver
  • Delta AFB0412SHB, 12V, 0.35A

The Ethernet ICs are under a glued-down aluminum heatsink (removal was not attempted). The removal of the RTL8393M's heatsink was very challenging, requiring soaking with acetone and applying heat.

Software

  • Product Model : GS1920-48
  • Bootbase Version : V1.00 | 11/15/2013
  • ZyNOS F/W Version : V4.50(AANZ.3) | 05/20/2020
  • RomRasSize : 3677044
BootBase Debug Command Listing
  1. Follow the guide provided at this link for detailed information on setting the debug flag.
  2. Use the command ATENx,y to set the flag.
  3. In my specific case, because my MAC address ends with 6, I successfully used the command ATEN1,8C43C295 as detailed in the guide, section "The DebugFlag and how to change it".
Command Description
AT just answer OK
ATHE print help
ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k
ATENx,(y) set BootExtension Debug Flag (y=password)
ATSE show the seed of password generator
ATTI(h,m,s) change system time to hour:min:sec or show current time
ATDA(y,m,d) change system date to year/month/day or show current date
ATDS dump RAS stack
ATDT dump Boot Module Common Area
ATDUx,y dump memory contents from address x for length y
ATWBx,y write address x with 8-bit value y
ATWWx,y write address x with 16-bit value y
ATWLx,y write address x with 32-bit value y
ATRBx display the 8-bit value of address x
ATRWx display the 16-bit value of address x
ATRLx display the 32-bit value of address x
ATGO(x) run program at addr x or boot router
ATGR boot router
ATGT run Hardware Test Program
AT%Tx Enable Hardware Test Program at boot up
ATBTx block0 write enable (1=enable, other=disable)
ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)
ATWEa(,b,c,d,e) write MAC addr, Country code, EngDbgFlag, FeatureBit, Serial Number to flash ROM
ATWZa(,b,c,d,e) write MAC addr, Country code, EngDbgFlag, FeatureBit, Serial Number to flash ROM
ATSNx set serial number in working buffer
ATCUx write Country code to flash ROM
ATCB copy from FLASH ROM to working buffer
ATCL clear working buffer
ATSB save working buffer to FLASH ROM
ATBU dump manufacturer related data in working buffer
ATSH dump manufacturer related data in ROM
ATWMx set MAC address in working buffer
ATCOx set country code in working buffer
ATFLx set EngDebugFlag in working buffer
ATSTx set ROMRAS address in working buffer
ATSYx set system type in working buffer
ATVDx set vendor name in working buffer
ATPNx set product name in working buffer
ATFEx,y,… set feature bits in working buffer
ATMP check & dump memMapTab
ATDOx,y download from address x for length y to PC via XMODEM
ATTD download router configuration to PC via XMODEM
ATUPx,y upload to RAM address x for length y from PC via XMODEM
ATUR upload router firmware to flash ROM
ATLC upload router configuration file to flash ROM
ATUXx(,y) xmodem upload from flash block x to y
ATERx,y erase flash rom from block x to y
ATWFx,y,z copy data from addr x to flash addr y, length z
ATXSx xmodem select: x=0: CRC mode(default); x=1: checksum mode
ATLOa,b,c,d Int/Trap Log Cmd
ATSR system reboot
ATFT(x,y,z) offset, pattern, len
ATBR Reset to default Romfile
ATDR(x) Reset to default Romfile x
ATPA(x) Pause for x ms
ATCP show CPU
ATGI select boot image
ATRF copy (R)am to (F)lash
Memory Map

Output of debug command ATMP (memMapTab)

ROMIO image start at b40b0000 code version: code start: 80014000 code length: 381B44 memMapTab: 22 entries, start = b40e0000, checksum = E323

Section Index Name Type Start Length Notes
$RAM 0 BootExt RAMBOOT 80014000 30000
$RAM 1 BootData RAM 80044000 4000
$RAM 2 RasCode RAMCODE 80048000 1AB8000
$RAM 3 RasData RAM 81b00000 6400000
$RAM 4 BootExtA RAMBOOT 80014000 30000
$RAM 5 RasCodeA RAMCODE 80048000 1AB8000
$ROM 6 BootBas ROMIMG b4000000 20000
$ROM 7 DbgArea ROMIMG b4020000 10000
$ROM 8 RomDir2 ROMDIR b4030000 80000
$ROM 9 BootExt ROMIMG b40b0030 2FFD0
$ROM 10 MemMapT ROMMAP b40e0000 2000
$ROM 11 termcap ROMIMG b40e2000 400
$ROM 12 RomDefa ROMBIN b40e2400 80000 Compressed. Version: RAS GS1920. Checksum: 1BC5, Comp. Checksum: 543B
$ROM 13 RasCode ROMBIN b4162400 64DC00 Compressed. Version: GS1920. Checksum: A50C, Comp. Checksum: DE1E
$ROM 14 LogArea1 ROMIMG b47c0000 20000
$ROM 15 LogArea2 ROMIMG b47e0000 20000
$ROM 16 RomDir2A ROMDIR b4830000 80000
$ROM 17 BootExtA ROMIMG b48b0030 2FFD0
$ROM 18 MemMapTA ROMMAP b48e0000 2000
$ROM 19 termcapA ROMIMG b48e2000 400
$ROM 20 RomDefaA ROMBIN b48e2400 80000 Compressed. Version: RAS GS1920. Checksum: 1BC5, Comp. Checksum: 543B
$ROM 21 RasCodeA ROMBIN b4962400 64DC00 Compressed. Version: GS1920. Checksum: A50C, Comp. Checksum: DE1E

Photos

Board Pictures
Overview  Label
Main board  Main SoC with thermal adhesive residue
Serial Console  Used Aliexpress adapter

  • zyxel_gs1920_series.txt
  • Last modified: 2025/01/25 23:54
  • by pineapple_academic