Welcome

Conclusion


The result of my hard work is a switch that can be configured to segregate, tag and untag vlan-packets on all different ports, just like the E80 stock 5-port managed switch I would have to buy instead, and all that for E17 plus a few quid on parts. Ofcourse, for that money you don't get a nice web-interface or whatever remote accessability, but for a switch living sitting nearby a workstation that's usually not needed.

The source code of my hack is, as usual, licensed under the GPLv3 and can be downloaded by clicking this link. It fills out the ATMega88 almost completely and still isn't as userfriendly and featureful as it could be: this is partially because I don't have the datasheet so I don't know where most of the registers are. It's also partly because I only need the VLAN-functionality and am too lazy to implement the rest. As usual, if you come up with an improvement on my code, I'd appreciate an e-mail. In case you have a RTL8369SB or -RB in your (8-port) switch, you can probably adapt the code for that too: it's the same beast but with 8 usable ports instead of 5.

If you have v5.x of this switch, the code doesn't work anymore because the chip in it is an RTL8367. Luckily, Bercik has made a version that works on those chips.

« Prev 4 

31 comments

libc0607 wrote at 18 Feb 2017, 13.07:

Hi ,nice hack! I'm interested in RTL8370, and i have found the datasheet of RTL8370(M) in a Chinese website at http://download.csdn.net/detail/reggae25/8157377 . @Bercik mentioned "SMI got no ack" and I think maybe the SMI_SEL pin has not been pulled down (see datasheet, it should help). Also I had hacked a RTL8370N switch, see https://github.com/libc0607/RTL8370N_switch_hacking (Chinese, pls use translate). I had read the firmware of a web-managed switch, flashed it into an unmanaged switch, and it works.

Mike wrote at 27 Oct 2016, 6.50:

Hello, nice hack. I've been wondering, has anyone tried using raspberry pi instead of arduino for this hack?

fL0p wrote at 1 Sep 2015, 23.32:

It's kind of funny because as of 2015 (yeah, I know that has been more than 5 years since this hack took place) I got a TL-WR841N who is fully openWRT-compatible for those 17€ you paid... about 6 months ago I'd say (from Amaz*n Spain if anyone feels curious). I really admire what you've done thru these years in terms of hacking, and I'd definitely like to know about electronics and fiddling witch MCUs as much as you do... but in terms of investment we're kind of even hehehe :P Cheers and keep up your mods, great Spritem! P.S: I knew of you because of /r/Mechanicalkeyboards and your CMStorm Rapid-I custom fw letting you play snake... An awesome work isn't enough to describe what it is :)

adex wrote at 25 Feb 2015, 17.06:

Cool hack. Any progress in hacking RTL8370 by openrrcp?

adex wrote at 8 Feb 2015, 8.57:

Any progress in hacking RTL8370?

Bercik wrote at 19 Dec 2014, 23.18:

For some time i've tried to use hack for TL-SG1008D with RTL8370. It seems that 8370 have the same registers names and positions as 8367b but always from SMI interface I get "no ack" :/ Even if i try to read EEPROM with known adress 0xa0 ... strange...

Christopher Jones wrote at 17 Jun 2014, 23.11:

I am really intrigued by your hardware hacking skills...The HD lnx hack and this are both awesome. I have been messing around with trying to hack a 1st generation Toshiba Flashair wifi sd card. I managed to dump the firmware in diassembly and find the processor (little to no documentation). I have made a little headway but maybe you could take a crack at it sometime, if you have any suggestions or ideas I would be happy to take them. I don't mean to spam your site or anything but here is my page: http://geekitguide.com/wifi-sd-cards/ thanks and again awesome hacks!

Sprite_tm wrote at 3 Feb 2014, 11.15:

Bercik: Thanks! I've linked to your sources in the article.

Bercik wrote at 1 Feb 2014, 11.12:

Hi to all, here it is my compilation of this hack. In zip package there are folder with sources files and two hex files for Atmega88. I use the same pin configuration for SDA/SCL like in original project. I does some changes and optimalizations, all of this modification are described in README.txt. - switch_hack_8367b.hex -> is for RTL8367B which is in v5.x of TP-Link. - switch_hack_8366rb.hex -> is for RTL8366RB which is in v3.x of TP-Link. So yes, you can use this in v5.0 of TL-SG1005D :P If you have any questions, please write to me. In README.txt there is my e-mail. http://bercik.wel.wat.edu.pl/switch_hack_by_Bercik.zip

Elod wrote at 4 Jan 2014, 23.31:

Nice hack, but hardly worth the effort. You can get a Mikrotik 5 port switch for approximately twice the price, and it has basic management capabilities via IP.

lexen wrote at 6 Nov 2013, 15.53:

Could you help in adapting your code for sg1008d? Based on chip rtl8370, http://code.google.com/p/rt-n56u/source/browse/trunk/linux-3.0.x/drivers/net/rtl8367/?

SG1008D wrote at 14 May 2013, 18.06:

Would this hack also work for SG1008D, so for 8-port version?

Sprite_tm wrote at 11 Jun 2012, 10.42:

JaWi: OpenWRT seems to have support for that chipset; you may want to take a look at their code. https://dev.openwrt.org/browser/trunk/target/linux/generic/files/drivers/net/phy/rtl8367.c

JaWi wrote at 10 Jun 2012, 13.53:

Got a TL-SG1005 version 5 myself, which is now using a RTL8367 instead of the 8366. One improvement they've made on the PCB is that they've added a header for the I2C pins of the controller... Now on to finding the datasheet of the 8367...

Unai wrote at 21 Jan 2012, 9.54:

I've bought that switch but it seems to be a newer revision 4.0 with a completely black box and completely new pcb layout. I don't have termal glue, so do not remove the heatsink over the switch chip. Does somebody know what chip it is?

Segfault wrote at 22 May 2011, 23.52:

I am working on adapting your code to work on the 8 port model, but having difficulties. I have an ATMEGA88p and was wondering if you knew any reason your code would not run on this chip.

Sprite_tm wrote at 26 Jan 2011, 12.31:

Sure! You would need a MAX232 or similar to convert the ttl-style signals to 'real' RS232, tho'.

MarkProvanP wrote at 26 Jan 2011, 1.18:

Well done on this whole project, Sprite! One small question: the computer I would configure it with if I did it has a serial port. Would it be possible to connect a proper D-Sub RS-232 port to the Atmega88 so I don't need to work with small header-style connectors?

onitake wrote at 4 Jan 2011, 15.11:

the "broken" i2c stems from the fact that it's actually not i2c, but smi (also called mdio). some ethernet switch controllers (like the ksz899*m series) offer actual i2c too, but this one doesn't. perhaps the atmel can be programmed to speak this protocol too? the usart is pretty versatile...

technomalogical wrote at 5 Nov 2010, 1.56:

Hey Sprite_TM, I found a datasheet for the "Embedded Menlow XL Processor for Gilmore Summit Baseboard" from Intel, which has an RTL8366SB listed and (brief) detail of the pin-outs on page 29: http://edc.intel.com/Download.aspx?id=2343 I also found a datasheet for the RTL8366S/RTL8366SR, which looks like a newer revision of the chip. Not sure how similar it is to the -SB: http://realtek.info/pdf/rtl8366s_8366sr_datasheet_vpre-1.4_20071022.pdf

kkp wrote at 20 Jul 2010, 13.32:

Found it, and tested it. rtlWrite(0x037f,0x1F); makes it correctly drop 'evil tagged frames' and forward those that match membership. Changing address 2 in eeprom to 0x1F and adding rtlWrite(1,rtlRead(1)&~0x1f); after configuration plugs the forwarding that otherwise occurs between power-on and configuration load. It now appears to be leak proof. I noticed that the eeprom has 0x4000 in PECR, and the linux driver nulls it. Wonder what it is, it does not make power consumption change.

Sprite_tm wrote at 20 Jul 2010, 10.21:

kkp: Good catch! I'll see if I can give the firmware an update to catch the inverted bit. It looks like more recent versions of the Linux-driver for the -rb-variant have the INGRESS-bit too, so I should be able to implement it in my firmware too.

kkp wrote at 18 Jul 2010, 22.19:

Nifty. I found two things while plaing with this: a 5-second fix: The port status for FDX/HDX is inverted. The bit is set when in FDX. Here's a challenge: The equivalent of the non-sb's EN_INGRESS_RULE bit is not set. This means that anyone on any port can inject frames to any vlan: Make port 2 the only member of vlan2, feed it broadcast frames tagged for vlan1, and and all vlan1 ports will flash. Not good if you have a separate/wireless network full of evil people.

Sprite_tm wrote at 17 Jul 2010, 16.05:

I already found that but the datasheet for the RTL8366SB (and yes, the -SB matters) isn't there.

Raboliot wrote at 13 Jul 2010, 13.50:

You can find a datasheet here : http://realtek.info/pdf/

tissit wrote at 22 Jun 2010, 15.44:

Great hack! Nice and web interface don't go together, though, of course.

db wrote at 27 May 2010, 16.57:

Great hack! now I'm going to open all my dumb switches in hopes of finding one that uses this chip or one of its ilk.

Forrest Voight wrote at 27 May 2010, 3.57:

László Monda: He wanted a permanent solution ... that doesn't eve make sense.

alex wrote at 27 May 2010, 3.54:

hey mungewell found this link if anyone is looking for that http://www.paintyourdragon.com/?p=43

mungewell wrote at 27 May 2010, 3.29:

Cool hack. For the ultimate in cost reduction you could use the I2C bus directly, cheapest solution is the DDC pins on a VGA output. Google $0.50 I2C adapter.

László Monda wrote at 27 May 2010, 1.16:

Very nice! Chances are you could have been done this with the Bus Pirate much easier. http://code.google.com/p/the-bus-pirate/

Leave a comment:

Your name:

What does this picture say?
Sorry, this is a captcha

Your comment:


© 2006-2016 Sprite_tm - Contact