Show pageOld revisionsBacklinksFold/unfold allBack to top This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ====== Zyxel XS1930 series ====== The XS1930 series is a line of managed multi-gigabit Ethernet switches. ^ Switch name ^ multi-gigabit RJ45 ports ^ SFP+ ports ^ PoE ports ^ | XS1930-10 | 8 | 2 | - | | XS1930-12HP | 10 | 2 | 8 | | XS1930-12F | 2 | 10 | - | ===== Models ===== ==== XS1930-10 ==== === Hardware === * SoC: RTL9313 * Ethernet: Aquantia AQR813 * RAM: Winbond W632GU6MB 256MiB DDR3 * Flash: Macronix MX25L25645G, 32MiB SPI NOR * GPIO: 1× RTL8231 * HC164 shift register for device status LEDs * 3-pin fan The serial port is accessible via pins from the outside on the right side of the device. Pins are front to back: GND, TX, RX, Vcc. Port settings are 115200 baud, 8n1, with 3.3V logic level. If you are using a Raspberry Pi, ensure that the serial port is activated first, many guides list these steps, here is a decent guide: https://www.engineersgarage.com/articles-raspberry-pi-serial-communication-uart-protocol-ttl-port-usb-serial-boards/ Once wired up, and the serial port is enabled test that this works. Confirm the system can use the port. $ setserial -g /dev/ttyS[0123] /dev/ttyS0, UART: 16550A, Port: 0x03f8, IRQ: 4 /dev/ttyS1, UART: 16550A, Port: 0x02f8, IRQ: 3 /dev/ttyS2, UART: unknown, Port: 0x03e8, IRQ: 4 /dev/ttyS3, UART: unknown, Port: 0x02e8, IRQ: 3 It's likely /dev/ttyS0, use Linux's cli, 'cu' $ cu -l /dev/ttyS0 -s 115200 If done correctly, you will be presented with a login prompt, the login credentials for the web interface and this serial interface are the same. Test that the system is wired properly before restarting. Quite from cu with ~. , that's a tilde, followed by a period. === Photos === ^ Board ^ Pictures ^ | Overview | {{:wiki:xs1930-10_overview.jpg?200|inside overview}} | | Main board | {{:wiki:xs1930-10_pcb.jpg?200|main board overview}} {{:wiki:xs1930-10_back.jpg?200|main board back side}} | | Serial port location | {{:pxl_20220615_023152806.jpg?200|}} {{:pxl_20220615_023152806--highlight.jpg?200|}} | | Serial Port connected (raspi client) | {{:pxl_20220615_023958093--connected.jpg?200|}} | ===== Firmware ===== The firmware of the Zyxel 1930 devices is based on Zynos [[https://github.com/dev-zzo/router-tools/blob/master/zynos.md]], itself a descendant of ThreadX. There is no Linux Kernel running. The initial configuration of the hardware is performed by U-Boot, which then boots a second stage Zynos bootloader and finally ZynOS itself. The second stage bootloader is merely there for flashing the device, define capabilities and setting up Zynos in memory. There is no hardware configuration done at this point. Zynos seems to simply be a big blob loaded from flash to memory with all functionality linked together. The normal startup sequence is <code> Bootbase Version: V1.00 | 08/26/2019 16:03:22 RAM: Size = 262144 Kbytes DRAM POST: Testing: 262144K OK DRAM Test SUCCESS ! FLASH: 32M ZyNOS Version: V4.60(ABQE.0)C0 | 12/20/2019 14:53:53 Press any key to enter debug mode within 1 second. ....... Enter Debug Mode XS1930-10> athe ======= Debug Command Listing ======= AT just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtension Debug Flag (y=password) ATSE show the seed of password generator ATTI(h,m,s) change system time to hour:min:sec or show current time ATDA(y,m,d) change system date to year/month/day or show current date ATDS dump RAS stack ATDT dump Boot Module Common Area ATDUx,y dump memory contents from address x for length y ATRBx display the 8-bit value of address x ATRWx display the 16-bit value of address x ATRLx display the 32-bit value of address x ATGO(x) run program at addr x or boot router ATGR boot router ATGT run Hardware Test Program ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations) ATSH dump manufacturer related data in ROM ATDOx,y download from address x for length y to PC via XMODEM ATTD download router configuration to PC via XMODEM ATUR upload router firmware to flash ROM < press any key to continue > ATLC upload router configuration file to flash ROM ATXSx xmodem select: x=0: CRC mode(default); x=1: checksum mode ATSR system reboot ATFT(x,y,z) offset, pattern, len ATPA(x) Pause for x ms ATCP show CPU ATGI select boot image XS1930-10> aten1,C621E14A OK OKXS1930-10> atsh ZyNOS Version : V4.60(ABQE.0)C0 | 12/20/2019 14:53:53 Bootbase Version : V1.00 | 08/26/2019 16:03:22 Serial Number : S202L10080128 Vendor Name : Zyxel Product Model : XS1930-10 ZyNOS ROM address : 0xb40a0000 System Type : 8 First MAC Address : BCCFXXXXXXC7 Last MAC Address : BCCFXXXXXXD2 MAC Address Quantity : 12 Default Country Code : FF Boot Module Debug Flag : 00 CPLD Version : N/A RomFile Version : 67 RomFile Checksum : ebd1 ZyNOS Checksum : eeee SNMP MIB level & OID : 060102030405060708091011121314151617181920 Main Feature Bits : C0 Other Feature Bits : 02 74 00 00 00 00 00 00-00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00-00 13 00 00 00 00 OK XS1930-10> ATMP ROMIO image start at 0xb4280000 code version: code start: 0x80220000 code length: 5745CA memMapTab: 27 entries, start = 0xb42b0000, checksum = 75B9 $RAM Section: 0: BootExt(RAMBOOT), start=0x80220000, len=50000 1: BootData(RAM), start=0x80270000, len=4000 2: RasCode(RAMCODE), start=0x80274000, len=4000000 3: RasData(RAM), start=0x84274000, len=9C8C000 4: BootExtA(RAMBOOT), start=0x80220000, len=50000 5: RasCodeA(RAMCODE), start=0x80274000, len=4000000 $ROM Section: 6: BootBas(ROMIMG), start=0xb4000000, len=A0000 7: DbgArea(ROMIMG), start=0xb40a0000, len=20000 8: RomDir2(ROMDIR), start=0xb40c0000, len=120000 9: LogArea1(ROMIMG), start=0xb41e0000, len=20000 10: LogArea2(ROMIMG), start=0xb4200000, len=20000 11: License(ROMIMG), start=0xb4220000, len=10000 12: GenFS(ROMIMG), start=0xb4230000, len=10000 13: LogArea3(ROMIMG), start=0xb4240000, len=20000 14: Reserved(ROMIMG), start=0xb4260000, len=10000 15: ramParam(ROMIMG), start=0xb4270000, len=10000 16: BootExt(ROMIMG), start=0xb4280030, len=2FFD0 17: MemMapT(ROMMAP), start=0xb42b0000, len=1400 18: termcap(ROMIMG), start=0xb42b1400, len=400 19: RomDefa(ROMBIN), start=0xb42b1800, len=180000 (Compressed) Version: RAS XS1930, start: 0xb42b1830 Length: 160000, Checksum: 962F Compressed Length: 53D1, Checksum: FCC0 20: RasCode(ROMBIN), start=0xb4431800, len=BCE800 (Compressed) Version: XS1930, start: 0xb4431830 Length: 1F06778, Checksum: 6F84 Compressed Length: 3C2DC9, Checksum: E874 21: RomDir2A(ROMDIR), start=0xb50c0000, len=120000 22: BootExtA(ROMIMG), start=0xb5280030, len=2FFD0 23: MemMapTA(ROMMAP), start=0xb52b0000, len=1400 24: termcapA(ROMIMG), start=0xb52b1400, len=400 25: RomDefaA(ROMBIN), start=0xb52b1800, len=180000 (Compressed) Version: RAS XS1930, start: 0xb52b1830 Length: 160000, Checksum: 962F Compressed Length: 53D1, Checksum: FCC0 26: RasCodeA(ROMBIN), start=0xb5431800, len=BCE800 (Compressed) Version: XS1930, start: 0xb5431830 Length: 1F06778, Checksum: 6F84 Compressed Length: 3C2DC9, Checksum: E874 $USER Section: Msecs 128 Heap0 16 34816 4096 Heap1 32 24576 2048 Heap2 64 65520 8192 Heap3 128 16384 1024 Heap4 192 8192 1024 Heap5 256 2048 128 Heap6 320 2048 128 Heap7 384 576 128 Heap8 448 512 64 Heap9 512 256 128 Heap10 576 1536 64 Heap11 1024 1088 64 Heap12 1536 1280 128 Heap13 2048 512 128 Heap14 4096 542 64 Heap15 8192 158 8 Heap16 10496 606 32 Heap17 12288 94 16 Heap18 13312 320 5 Heap19 17408 158 5 Heap20 26944 1200 5 Heap21 36864 30 3 Heap22 64000 20 3 MbufInt 400 400 400 MbufIO 256 2048 2048 0 0 Queue 128 Cbuf 40960 FuncId 50 Proc 128 Timer 1024 DNS 128 FilterSet 12 IpRoute 33 IpxRoute 4 IpMaxRt 128 IpxMaxRt 128 IpxMaxSap 128 FwTos 1200 10 10 10 AclType0 51200 9 400 AclType1 2048 4 100 AclType2 2048 4 20 AclType3 2048 4 128 AclType4 2048 4 128 AclType5 32768 8 128 AppleTalkRoute 0 Bridge 4 RemoteNode 1 Profile 1 Endpoint 4 NATServerSet 1 DHCPEntry 253 PoeSvrCnt 4 ScheduleSet 12 AclBuffer 1 IPSecManualSA 120 IPSecIkePeer 120 IPSecIkeSA 120 IPSecAclBuffer 1 IPSecSPD 120 NatAclBuffer 1 CustomPort 10 NatSessions 1024 IpPolicySet 12 PoeSvrCnt 0 ScheduleSet 0 MiscFirewallBuffer 1 AveBuffer 1 CyberPatrolBuffer 1 CyberPatrolListBuffer 1 TrustedIPNum 0 IPBUFixpart 1 NatRulePerSet 12 DHCPMacNum 8 UPNPNum 1 IPSecExtendNum 120 Model 2 29698 29954 CoeFixedPart 1 CbqSpecialClass 1 AccessSecHost 16 SwitchStpPort 52 Switch1QPort 52 Switch1QStaticEntry 1024 WebManagementUser 5 snmpManager 4 dot1xProfileEntry 5 swStaticMacEntry 256 swFilterEntry 256 swMirrorEntry 52 swBWEntry 52 swTrunkEntry 24 bcastDmEntry 17 CMMemberEntry 24 swDSMarkEntry 0 OSPFArea 0 OSPFVL 0 VrrpRouterEntry 0 swClassifierEntry 256 swFilterActionEntry 256 sptFSGen 128 1024 genBuffer 1 rmonEventTable 64 rmonAlarmTable 64 l2InbandIpdrvIfEntry 64 IGMPMVREntry 5 IGMPMVRAddrEntry 261 IGMPFilteringPort 52 IGMPFilteringRecEntry 256 SyslogTypeEntry 5 SyslogServerEntry 4 swPBVlanEntry 0 swVlanProtoBasedEntry 364 cardTypeEntry 0 swMRStpEntry 2 radiusServer 1 SwitchMRStpPort 52 IGMPMVlanEntry 16 swVlanSubnetBasedEntry 16 TrTCMEntry 52 tacPlusAuthSvr 2 tacPlusAcctSvr 2 enablePassword 15 authTypeEntry 2 acctTypeEntry 4 dhcpSnpEntry 1 arpInspectEntry 1 ipSrcGuardEntry 512 authorTypeEntry 2 SnmpManagementUser 5 displayConf 1 FwVersion VHello%world%|%12/20/2019 FwVersion0 29698,V4.60(ABQE.0)C0%|%12/20/2019 FwVersion1 29954,V4.60(ABQF.0)C0%|%12/20/2019 OK </code> In the above sequence, the second stage ZynOS loader was interrupted by pressing a key. In order to get into the initial U-Boot, the "$" key needs to be pressed until the end of the DRAM test routine. Both U-Boot and the ZynOS loader have crippled functionality until they are unlocked. For this, there is an unlock code, which depends on the last digit of the MAC-Address, as described here: [[http://www.ixo.de/info/zyxel_uclinux/]]. In the above example, the ZynOS bootloader was unlocked with the ''aten1,C621E14A'' command, unlocking U-Boot is done by ''aten 1 C621E14A'' for this MAC address. Unfortunately U-Boot is not able to set up the Aquantia PHY, nor does it set up the fibre ports, even though ''rtk network on'' does seem to do something. Therefore development needs to be done through uploading images via the serial connection. Once U-Boot is unlocked, the following information is available: <code> XS1930$ flshow =============== FLASH Partition Layout =============== Index Name Size Address ------------------------------------------------------ 0 BootLoader 0x9e000 0xb4000000-0xb409dfff 1 BootEnvCfg 0x1000 0xb409e000-0xb409efff 2 MRD 0x1000 0xb409f000-0xb409ffff 3 DbgArea 0x20000 0xb40a0000-0xb40bffff 4 RomDir2 0x120000 0xb40c0000-0xb41dffff 5 LogArea1 0x20000 0xb41e0000-0xb41fffff 6 LogArea2 0x20000 0xb4200000-0xb421ffff 7 License 0x10000 0xb4220000-0xb422ffff 8 GenFS 0x10000 0xb4230000-0xb423ffff 9 LogArea3 0x20000 0xb4240000-0xb425ffff 10 Reserved 0x10000 0xb4260000-0xb426ffff 11 RamParam 0x10000 0xb4270000-0xb427ffff 12 BootExt 0x30000 0xb4280000-0xb42affff 13 MemMapT 0x1400 0xb42b0000-0xb42b13ff 14 Termcap 0x400 0xb42b1400-0xb42b17ff 15 RomDefa 0x180000 0xb42b1800-0xb44317ff 16 RasCode 0xbce800 0xb4431800-0xb4ffffff 17 RomDir2A 0x120000 0xb50c0000-0xb51dffff 18 BootExtA 0x30000 0xb5280000-0xb52affff 19 MemMapTA 0x1400 0xb52b0000-0xb52b13ff 20 TermcapA 0x400 0xb52b1400-0xb52b17ff 21 RomDefaA 0x180000 0xb52b1800-0xb54317ff 22 RasCodeA 0xbce800 0xb5431800-0xb5ffffff ====================================================== XS1930$ gobootext # starts the second stage ZynOS bootloader </code> The unlocked U-Boot allows disabling autoboot of the second stage. The flash layout is also found in the memory layout information obtained by the atmp command in the ZynOS bootloader. The Flash chip can be read out via a SOIC-clamp when the device is off. After splitting the image into the partitions, the ZynOS kernel and all the user-land code sit in <code> $ hd 16_RasCode.bin|head 00000000 00 00 00 00 00 00 53 49 47 04 01 f0 67 78 00 3c |......SIG...gx.<| 00000010 2d c9 e0 00 6f 84 e8 74 58 53 31 39 33 30 00 00 |-...o..tXS1930..| 00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000030 5d 00 00 80 00 78 67 f0 01 00 00 00 00 00 20 02 |]....xg....... .| 00000040 08 61 15 9e dc b2 69 e3 6d 0a d6 19 ab 9f 87 dd |.a....i.m.......| 00000050 60 1f b5 d1 d0 e4 62 e8 0a 8a 8b 58 c4 9d fa 3c |`.....b....X...<| 00000060 e6 b9 60 2b 3a 06 fb a2 98 bd 0d f0 b4 30 46 b8 |..`+:........0F.| 00000070 a9 2c 67 f7 97 9d 56 51 44 f6 e5 c9 df 6c 2f 51 |.,g...VQD....l/Q| 00000080 47 1d 24 9c e7 c8 82 97 9e 3f 9a 6c 6a fc 2f 30 |G.$......?.lj./0| 00000090 a3 2c cb b7 b0 b3 85 1d aa 0b 48 ab 9c 01 cd d3 |.,........H.....| 0a: 01f06778 Length (uncompressed) 0e: 003c2dc9 Length 14: 6f84 Checksum (before uncompression) 18: e874 Other Checksum </code> You can compare the header informtion in the first 0x30 bytes with the output of ATMP in the ZynOS bootloader to identify some data fields. The image is lzma compressed, but there seem to be some trailer that cannot be decompressed with standard tools, nevertheless the RAM image can be obtained by: <code> $ dd if=16_RasCode.bin bs=16 skip=3 of=16_RasCode_headerless.bin $ mv 16_RasCode_headerless.bin 16_RasCode_headerless.lzma $ xz -c -d 16_RasCode_headerless.lzma >RasCode_image.bin # ignore errors </code> You can directly load RasCode_image.bin into a disassembler at memory location 0x80274000 for analysis (see above: 2: RasCode(RAMCODE), start=0x80274000, len=4000000). Add a RAM segment after this: (3: RasData(RAM), start=0x84274000, len=9C8C000). ===== OpenWrt ===== A very initial boot of OpenWrt looks like this: <code> [ 0.000000] Calling smp_setup_processor_id [ 0.000000] Calling boot_cpu_init [ 0.000000] Linux version 5.4.70 (birger@AMDDesktop) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r14727-627da9a38c)) #0 Thu Oct 29 18:33:33 2020 [ 0.000000] prom_init called [ 0.000000] RTL838X model is 0 [ 0.000000] RTL839X model is 0 [ 0.000000] RTL93XX model is 93130001 [ 0.000000] SoC Type: RTL9313 [ 0.000000] Kernel command line: [ 0.000000] printk: bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001a120 (MIPS interAptiv (multi)) [ 0.000000] plat_mem_setup called [ 0.000000] MIPS: machine is Zyxel XS1900-10 [ 0.000000] Registering _machine_restart [ 0.000000] NO PCI device found [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] device_tree_init called [ 0.000000] Using appended Device Tree. [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] On node 0 totalpages: 32768 [ 0.000000] Normal zone: 288 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 32768 pages, LIFO batch:7 [ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768 [ 0.000000] pcpu-alloc: [0] 0 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480 [ 0.000000] Kernel command line: console=ttyS0,115200 [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear) [ 0.000000] Writing ErrCtl register=00000000 [ 0.000000] Readback ErrCtl register=00000000 [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 114840K/131072K available (4758K kernel code, 167K rwdata, 1056K rodata, 8732K init, 199K bss, 16232K reserved, 0K cma-reserved) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 64 [ 0.000000] Found Interrupt controller: cpuintc (cpuintc) [ 0.000000] ICU Memory: b8003000 [ 0.000000] random: get_random_bytes called from start_kernel+0x398/0x580 with crng_init=0 [ 0.000000] CPU frequency from device tree: 700000000 [ 0.000000] CPU Clock: 700 MHz [ 0.000000] PLL control register: 0 [ 0.000000] Found NS16550a: uart (uart@b8002000) [ 0.000000] Using default baud rate: 38400 b[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5460744132 ns [ 0.000011] sched_clock: 32 bits at 350MHz, resolution 2ns, wraps every 6135667710ns [ 2.733736] printk: console [ttyS0] enabled [ 2.733736] printk: console [ttyS0] enabled [ 4.214661] printk: bootconsole [early0] disabled [ 4.214661] printk: bootconsole [early0] disabled [ 5.880845] Calibrating delay loop... 464.38 BogoMIPS (lpj=928768) [ 5.918555] pid_max: default: 32768 minimum: 301 [ 5.926097] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 5.937684] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 5.956103] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns [ 5.971604] futex hash table entries: 256 (order: -1, 3072 bytes, linear) [ 5.982629] pinctrl core: initialized pinctrl subsystem [ 5.991980] NET: Registered protocol family 16 [ 5.999926] cpuidle: using governor ladder [ 6.053678] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512 [ 6.074570] clocksource: Switched to clocksource MIPS [ 6.084551] NET: Registered protocol family 2 [ 6.092686] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear) [ 6.106015] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 6.118152] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 6.129314] TCP: Hash tables configured (established 1024 bind 1024) [ 6.139640] UDP hash table entries: 256 (order: 0, 4096 bytes, linear) [ 6.150064] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear) [ 6.161582] NET: Registered protocol family 1 [ 6.623572] workingset: timestamp_bits=14 max_order=15 bucket_order=1 [ 6.642136] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 6.651435] jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 6.701133] Probing RTL838X GPIOs [ 6.706472] Unknown GPIO chip id (9313) [ 6.763285] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 6.773669] serial8250: ttyS0 at MMIO 0x0 (irq = 0, base_baud = 12442400) is a 16550A [ 6.787719] b8002100.uart: ttyS1 at MMIO 0xb8002100 (irq = 30, base_baud = 12500000) is a 16550A [ 7.029159] brd: module loaded [ 7.034875] Initializing rtl838x_nor_driver [ 7.041589] SPI resource base is b8001200 [ 7.047936] Address mode is 3 bytes [ 7.053441] rtl838x_nor_init called [ 7.060984] rtl838x-nor b8001200.spi: mx25l25635e (32768 Kbytes) [ 7.070668] 7 fixed-partitions partitions found on MTD device rtl838x_nor [ 7.081412] Creating 7 MTD partitions on "rtl838x_nor": [ 7.089693] 0x000000000000-0x000000040000 : "u-boot" [ 7.099307] 0x000000040000-0x000000050000 : "u-boot-env" [ 7.109428] 0x000000050000-0x000000060000 : "u-boot-env2" [ 7.119797] 0x000000060000-0x000000160000 : "jffs" [ 7.129070] 0x000000160000-0x000000260000 : "jffs2" [ 7.138489] 0x000000260000-0x000000930000 : "runtime" [ 7.168966] 0x000000930000-0x000001000000 : "runtime2" [ 7.179185] Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011) [ 7.196034] libphy: Fixed MDIO Bus: probed [ 7.202776] Probing RTL838X switch device [ 7.209210] Chip-Info: 0 [ 7.213223] Chip version A [ 7.217499] In rtl838x_mdio_probe [ 7.222783] Found compatible MDIO node! [ 7.228843] Deferring probe of mdio bus [ 7.235606] Probing RTL838X eth device pdev: 87c6c200, dev: 87c6c210 [ 7.267380] Found SoC ID: 9313: RTL9313, family 9310 [ 7.275232] rtl8380_init_mac [ 7.279842] rtl838x-eth bb00a300.ethernet (unnamed net_device) (uninitialized): Invalid MAC address, using random [ 7.296077] In rtl838x_set_mac_hw [ 7.301315] Using MAC 0000d2270eff996a [ 7.307244] Using MAC 0000d2270eff996a [ 7.313159] rtl838x_mdio_init called [ 7.319118] libphy: rtl839x-eth-mdio: probed [ 7.706251] In rtl838x_validate [ 7.711393] In rtl838x_validate [ 7.716632] i2c /dev entries driver [ 7.724338] NET: Registered protocol family 10 [ 7.740036] Segment Routing with IPv6 [ 7.746079] NET: Registered protocol family 17 [ 7.753816] 8021q: 802.1Q VLAN Support v1.8 [ 7.761510] Probing RTL838X switch device [ 7.767996] Chip-Info: 0 [ 7.772015] Chip version A [ 7.776292] In rtl838x_mdio_probe [ 7.781572] Found compatible MDIO node! [ 7.891354] rtl838x-switch: probe of 0.switch failed with error -5 [ 7.927723] Freeing unused kernel memory: 8732K [ 7.934917] This architecture does not have kernel memory protection. [ 7.945087] Run /init as init process [ 8.075879] init: Console is alive [ 8.117882] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 8.133249] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 8.159197] init: - preinit - [ 8.475963] random: jshn: uninitialized urandom read (4 bytes read) [ 8.573223] random: jshn: uninitialized urandom read (4 bytes read) ls: /sys/class/net/*/dsa: No such file or directory [ 8.713165] random: jshn: uninitialized urandom read (4 bytes read) Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 11.991619] procd: - early - [ 13.883957] procd: - ubus - [ 13.902292] urandom_read: 2 callbacks suppressed [ 13.902306] random: ubusd: uninitialized urandom read (4 bytes read) [ 13.939781] random: ubusd: uninitialized urandom read (4 bytes read) [ 13.950929] random: ubusd: uninitialized urandom read (4 bytes read) [ 13.963796] procd: - init - Please press Enter to activate this console. [ 14.728783] kmodloader: loading kernel modules from /etc/modules.d/* [ 14.799004] Mirror/redirect action on [ 14.842726] u32 classifier [ 14.847072] input device check on [ 14.852861] Actions configured [ 14.975248] xt_time: kernel timezone is -0000 [ 15.038988] PPP generic driver version 2.4.2 [ 15.060796] NET: Registered protocol family 24 [ 15.098664] urngd: v1.0.2 started. [ 15.113580] kmodloader: done loading kernel modules from /etc/modules.d/* [ 15.298600] random: crng init done [ 15.304005] random: 2 urandom warning(s) missed due to ratelimiting BusyBox v1.31.1 () built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r14727-627da9a38c ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:/# cat /proc/cpuinfo system type : RTL9313 machine : Zyxel XS1900-10 processor : 0 cpu model : MIPS interAptiv (multi) V2.0 BogoMIPS : 464.38 wait instruction : yes microsecond timers : yes tlb_entries : 64 extra interrupt vector : yes hardware watchpoint : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb] isa : mips1 mips2 mips32r1 mips32r2 ASEs implemented : mips16 dsp mt eva Options implemented : tlb tlbinv segments 4kex 4k_cache 32fpr prefetch mcheck ejtag llsc pindexed_dcache userlocal perf_cntr_intr_bit cdmm ebase_wg perf shadow register sets : 1 kscratch registers : 0 package : 0 core : 0 VCED exceptions : not available VCEI exceptions : not available root@OpenWrt:/# cat /proc/interrupts CPU0 2: 0 MIPS 2 IRQ cascade 1 3: 0 MIPS 3 IRQ cascade 2 4: 0 MIPS 4 IRQ cascade 3 5: 0 MIPS 5 IRQ cascade 4 6: 0 MIPS 6 IRQ cascade 5 7: 0 MIPS 7 timer ERR: 0 </code> zyxel_xs1930_series.txt Last modified: 2022/11/15 15:48by pmenzel