Conclusion
The result of my hard work is a switch that can be configured to segregate, tag and untag vlan-packets on all different ports, just like the E80 stock 5-port managed switch I would have to buy instead, and all that for E17 plus a few quid on parts. Ofcourse, for that money you don't get a nice web-interface or whatever remote accessability, but for a switch living sitting nearby a workstation that's usually not needed.
The source code of my hack is, as usual, licensed under the GPLv3 and can be downloaded by clicking this link. It fills out the ATMega88 almost completely and still isn't as userfriendly and featureful as it could be: this is partially because I don't have the datasheet so I don't know where most of the registers are. It's also partly because I only need the VLAN-functionality and am too lazy to implement the rest. As usual, if you come up with an improvement on my code, I'd appreciate an e-mail. In case you have a RTL8369SB or -RB in your (8-port) switch, you can probably adapt the code for that too: it's the same beast but with 8 usable ports instead of 5.
If you have v5.x of this switch, the code doesn't work anymore because the chip in it is an RTL8367. Luckily, Bercik has made a version that works on those chips.
« Prev 4
34 commentsThanks a lot for the great work! The firmware by Bercik for the RTL8367 chip works a the TL-SG108 8-port switch. I get 0x3700 for the chip's name value, which is unknown to me. But it works. See https://www.physik.tu-berlin.de/~nschmidt/things/unmanaged-to-vlan-switch/index.html .
Bercik's site is gone but the Wayback Machine still has the file: https://web.archive.org/web/20140824233323if_/http://bercik.wel.wat.edu.pl/switch_hack_by_Bercik.zip
Hi ,nice hack! I'm interested in RTL8370, and i have found the datasheet of RTL8370(M) in a Chinese website at http://download.csdn.net/detail/reggae25/8157377 . @Bercik mentioned "SMI got no ack" and I think maybe the SMI_SEL pin has not been pulled down (see datasheet, it should help). Also I had hacked a RTL8370N switch, see https://github.com/libc0607/RTL8370N_switch_hacking (Chinese, pls use translate). I had read the firmware of a web-managed switch, flashed it into an unmanaged switch, and it works.
Hello, nice hack. I've been wondering, has anyone tried using raspberry pi instead of arduino for this hack?
It's kind of funny because as of 2015 (yeah, I know that has been more than 5 years since this hack took place) I got a TL-WR841N who is fully openWRT-compatible for those 17€ you paid... about 6 months ago I'd say (from Amaz*n Spain if anyone feels curious). I really admire what you've done thru these years in terms of hacking, and I'd definitely like to know about electronics and fiddling witch MCUs as much as you do... but in terms of investment we're kind of even hehehe :P Cheers and keep up your mods, great Spritem! P.S: I knew of you because of /r/Mechanicalkeyboards and your CMStorm Rapid-I custom fw letting you play snake... An awesome work isn't enough to describe what it is :)
Cool hack. Any progress in hacking RTL8370 by openrrcp?
Any progress in hacking RTL8370?
For some time i've tried to use hack for TL-SG1008D with RTL8370. It seems that 8370 have the same registers names and positions as 8367b but always from SMI interface I get "no ack" :/ Even if i try to read EEPROM with known adress 0xa0 ... strange...
I am really intrigued by your hardware hacking skills...The HD lnx hack and this are both awesome. I have been messing around with trying to hack a 1st generation Toshiba Flashair wifi sd card. I managed to dump the firmware in diassembly and find the processor (little to no documentation). I have made a little headway but maybe you could take a crack at it sometime, if you have any suggestions or ideas I would be happy to take them. I don't mean to spam your site or anything but here is my page: http://geekitguide.com/wifi-sd-cards/ thanks and again awesome hacks!
Bercik: Thanks! I've linked to your sources in the article.
Hi to all, here it is my compilation of this hack. In zip package there are folder with sources files and two hex files for Atmega88. I use the same pin configuration for SDA/SCL like in original project. I does some changes and optimalizations, all of this modification are described in README.txt. - switch_hack_8367b.hex -> is for RTL8367B which is in v5.x of TP-Link. - switch_hack_8366rb.hex -> is for RTL8366RB which is in v3.x of TP-Link. So yes, you can use this in v5.0 of TL-SG1005D :P If you have any questions, please write to me. In README.txt there is my e-mail. http://bercik.wel.wat.edu.pl/switch_hack_by_Bercik.zip
Nice hack, but hardly worth the effort. You can get a Mikrotik 5 port switch for approximately twice the price, and it has basic management capabilities via IP.
Could you help in adapting your code for sg1008d? Based on chip rtl8370, http://code.google.com/p/rt-n56u/source/browse/trunk/linux-3.0.x/drivers/net/rtl8367/?
Would this hack also work for SG1008D, so for 8-port version?
JaWi: OpenWRT seems to have support for that chipset; you may want to take a look at their code. https://dev.openwrt.org/browser/trunk/target/linux/generic/files/drivers/net/phy/rtl8367.c
Got a TL-SG1005 version 5 myself, which is now using a RTL8367 instead of the 8366. One improvement they\'ve made on the PCB is that they\'ve added a header for the I2C pins of the controller... Now on to finding the datasheet of the 8367...
I\'ve bought that switch but it seems to be a newer revision 4.0 with a completely black box and completely new pcb layout. I don\'t have termal glue, so do not remove the heatsink over the switch chip. Does somebody know what chip it is?
I am working on adapting your code to work on the 8 port model, but having difficulties. I have an ATMEGA88p and was wondering if you knew any reason your code would not run on this chip.
Sure! You would need a MAX232 or similar to convert the ttl-style signals to \'real\' RS232, tho\'.
Well done on this whole project, Sprite! One small question: the computer I would configure it with if I did it has a serial port. Would it be possible to connect a proper D-Sub RS-232 port to the Atmega88 so I don\'t need to work with small header-style connectors?
the \"broken\" i2c stems from the fact that it\'s actually not i2c, but smi (also called mdio). some ethernet switch controllers (like the ksz899*m series) offer actual i2c too, but this one doesn\'t. perhaps the atmel can be programmed to speak this protocol too? the usart is pretty versatile...
Hey Sprite_TM, I found a datasheet for the \"Embedded Menlow XL Processor for Gilmore Summit Baseboard\" from Intel, which has an RTL8366SB listed and (brief) detail of the pin-outs on page 29: http://edc.intel.com/Download.aspx?id=2343 I also found a datasheet for the RTL8366S/RTL8366SR, which looks like a newer revision of the chip. Not sure how similar it is to the -SB: http://realtek.info/pdf/rtl8366s_8366sr_datasheet_vpre-1.4_20071022.pdf
Found it, and tested it. rtlWrite(0x037f,0x1F); makes it correctly drop \'evil tagged frames\' and forward those that match membership. Changing address 2 in eeprom to 0x1F and adding rtlWrite(1,rtlRead(1)&~0x1f); after configuration plugs the forwarding that otherwise occurs between power-on and configuration load. It now appears to be leak proof. I noticed that the eeprom has 0x4000 in PECR, and the linux driver nulls it. Wonder what it is, it does not make power consumption change.
kkp: Good catch! I\'ll see if I can give the firmware an update to catch the inverted bit. It looks like more recent versions of the Linux-driver for the -rb-variant have the INGRESS-bit too, so I should be able to implement it in my firmware too.
Nifty. I found two things while plaing with this: a 5-second fix: The port status for FDX/HDX is inverted. The bit is set when in FDX. Here\'s a challenge: The equivalent of the non-sb\'s EN_INGRESS_RULE bit is not set. This means that anyone on any port can inject frames to any vlan: Make port 2 the only member of vlan2, feed it broadcast frames tagged for vlan1, and and all vlan1 ports will flash. Not good if you have a separate/wireless network full of evil people.
I already found that but the datasheet for the RTL8366SB (and yes, the -SB matters) isn\'t there.
You can find a datasheet here : http://realtek.info/pdf/
Great hack! Nice and web interface don\'t go together, though, of course.
Great hack! now I\'m going to open all my dumb switches in hopes of finding one that uses this chip or one of its ilk.
László Monda: He wanted a permanent solution ... that doesn\'t eve make sense.
hey mungewell found this link if anyone is looking for that http://www.paintyourdragon.com/?p=43
Cool hack. For the ultimate in cost reduction you could use the I2C bus directly, cheapest solution is the DDC pins on a VGA output. Google $0.50 I2C adapter.
Very nice! Chances are you could have been done this with the Bus Pirate much easier. http://code.google.com/p/the-bus-pirate/
https://www.physik.tu-berlin.de/~nschmidt/hardware/diy_managed_switch/