Makefile: Lower limit of --xram-size to protect ChaCha20 space

ChaCha20 uses 256 bytes starting from 0xbf00 for its calculations. Make sure the linker checks that this space is not overwritten.
ChaCha20 implementation for encryption
2026-10-29 17:54:14 +08:00 · 2026-10-17 06:30:16 +02:00 · 2026-10-17 06:30:14 +02:00 · 2026-10-14 02:01:59 -05:00 · 2026-10-14 02:01:55 -05:00 · 2026-10-14 01:35:24 -05:00
173 changed files with 7283 additions and 1886 deletions
@@ -20,9 +20,11 @@ jobs:
          apt install make gcc sdcc xxd python-is-python3 libjson-c-dev zlib1g-dev -y
      - name: Run the host-side unit tests
        run: make -C test
-      - name: Check if machine.c can be compiled for all machines
+      - name: Check that every machine definition can be compiled
        run: make machine_check
      - name: Make project (4x2/RTL8372)
        run: make CI=1 MACHINE="KP_9000_6XHML_X2"
      - name: Make project (8x1/RTL8373)
        run: make CI=1 MACHINE="KP_9000_9XHML_X_V3_1"
+      - name: Make project with the health instrumentation
+        run: make clean && make CI=1 MACHINE="KP_9000_6XHML_X2" HEALTH=1
@@ -14,6 +14,12 @@

 ## Fixed

+- Config
+  - A startup configuration line longer than the command buffer no longer stops the replay:
+    the offending line is skipped and the following lines are still applied.
+  - The web UI and the configuration upload now refuse a line the replay cannot take,
+    instead of writing it to flash.
+
 ## Breaking changes

 - Config
@@ -7,23 +7,33 @@ HTML_LOCATION = 262144
 ifeq ($(origin CC),default)
 CC = sdcc
 endif
-CC_FLAGS = -mmcs51 -I. -Ihttpd -Iuip
+CC_FLAGS = -mmcs51 -I. -Imachine -Ihttpd -Iuip
 ASM ?= sdas8051
 AFLAGS= -plosgff

 SUBDIRS := tools
 SUBDIRSCLEAN=$(addsuffix clean,$(SUBDIRS))

-ifeq ($(MACHINE),)
-	MACHINE:= $(shell grep "^\s*#define MACHINE_" machine.h | sed "s/^\s*#define MACHINE_//")
-else
+# $MACHINE selects machine/$(MACHINE).c as the board definition and is passed
+# on as -DMACHINE_$(MACHINE), which the rest of the firmware tests with
+# #if defined(MACHINE_...), and as -DMACHINE_NAME, which machine.h uses to
+# include machine/$(MACHINE).h. Both take the same value, so they cannot drift.
+ifneq ($(MACHINE),)
 	CC_FLAGS += -DMACHINE_$(MACHINE)
+	CC_FLAGS += -DMACHINE_NAME=$(MACHINE)
+endif
+# Health instrumentation and the "health" console command: HEALTH=1 gmake ...
+ifneq ($(HEALTH),)
+	CC_FLAGS += -DHEALTH
 endif

 ifeq ($(CI),1)
 	CC_FLAGS += --Werror
 endif

+# The board definition being built: one file per MACHINE_* symbol in machine.h.
+MACHINE_SRC = machine/$(MACHINE).c
+
 BUILDDIR = output/$(MACHINE)
 VERSION_HEADER := version.h

@@ -47,16 +57,31 @@ BUILD_DATE := $(shell date -u -d @$(SOURCE_DATE_EPOCH) +"%Y-%m-%d %H:%M:%S" 2>/d
 	|| date -u -r $(SOURCE_DATE_EPOCH) +"%Y-%m-%d %H:%M:%S")
 endif

-all: create_build_dir $(VERSION_HEADER) $(SUBDIRS) $(BUILDDIR)/rtlplayground-$(FILENAME_EXTENSION).bin
+# $(MACHINE_SRC) is listed here so an unknown $MACHINE fails before anything else
+# is built, including the tools/ subdirectory.
+all: create_build_dir $(VERSION_HEADER) $(MACHINE_SRC) $(SUBDIRS) $(BUILDDIR)/rtlplayground-$(FILENAME_EXTENSION).bin

 create_build_dir:
 	mkdir -p "$(BUILDDIR)"
 	mkdir -p "$(BUILDDIR)/uip"
 	mkdir -p "$(BUILDDIR)/httpd"
+	mkdir -p "$(BUILDDIR)/machine"
+	mkdir -p "$(BUILDDIR)/crypto"

-# Keep machine.c in first position to fail immediately on invalid $MACHINE value
+# Every machine is a pair machine/<MACHINE>.c + machine/<MACHINE>.h. Selecting
+# them by name means no #if/#elif chain, so an unknown or empty $MACHINE is
+# caught here instead of by a #error further down the build.
+$(MACHINE_SRC):
+	@echo "ERROR: MACHINE='$(MACHINE)' has no definition (expected $(MACHINE_SRC))." >&2
+	@echo "       Every machine is one file pair under machine/, named after the" >&2
+	@echo "       MACHINE_* symbol it defines; see machine/*.c for the full list." >&2
+	@echo "       Example: make MACHINE=KP_9000_6XHML_X2" >&2
+	@false
+
+# Keep the per-machine definition in first position to fail immediately on an
+# invalid $MACHINE value
 SRCS = \
-	machine.c \
+	$(MACHINE_SRC) \
 	machine_init.c \
 	cmd_editor.c \
 	cmd_parser.c \
@@ -65,8 +90,13 @@ SRCS = \
 	rtlplayground.c \
 	boot.c \
 	sfp.c \
+	dns.c \
+	dns_cli.c \
+	ntp.c \
+	ntp_cli.c \
 	syslog.c \
-	udp_apps.c
+	udp_apps.c \
+	crypto/chacha20.c

 # RTL837x
 SRCS += \
@@ -75,10 +105,15 @@ SRCS += \
 	rtl837x_igmp.c \
 	rtl837x_init.c \
 	rtl837x_leds.c \
+	rtl837x_leds_dump.c \
 	rtl837x_phy.c \
 	rtl837x_pins.c\
 	rtl837x_port.c \
-	rtl837x_stp.c
+	rtl837x_stp.c \
+	rtl837x_lldp.c \
+	rtl837x_storm.c \
+	rtl837x_lacp.c \
+	rtl837x_trap.c
 SRCS += \
 	httpd/httpd.c \
 	httpd/page_impl.c
@@ -108,11 +143,14 @@ html_min: $(HTML)
 html_data.c html_data.h &: $(HTML) | tools html_min
 	tools/output/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -b BANK1 -z -d $(HTML_MIN) -p html_data

-$(VERSION_HEADER):
+$(VERSION_HEADER): FORCE
 	@printf '%s\n' "#ifndef VERSION_H" "#define VERSION_H" \
 		"#define VERSION_SW \"$(VERSION_EXTENSION)\"" \
 		"#define BUILD_DATE \"$(BUILD_DATE)\"" \
-		"#endif" > $(VERSION_HEADER)
+		"#endif" > $(VERSION_HEADER).tmp
+	@cmp -s $(VERSION_HEADER).tmp $(VERSION_HEADER) \
+		&& rm -f $(VERSION_HEADER).tmp \
+		|| mv $(VERSION_HEADER).tmp $(VERSION_HEADER)

 httpd: html_data.h

@@ -130,15 +168,25 @@ distclean: $(SUBDIRSCLEAN)
 $(SUBDIRSCLEAN):
 	$(MAKE) -C $(@:clean=) clean

-$(BUILDDIR)/%.rel: %.c | create_build_dir html_data.h
+# Objects depend on the flags they were built with, through a stamp file that
+# is rewritten only when CC_FLAGS actually changes.
+CCFLAGS_STAMP := $(BUILDDIR)/.ccflags
+
+.PHONY: FORCE
+FORCE:
+
+$(CCFLAGS_STAMP): FORCE | create_build_dir
+	@echo '$(CC_FLAGS)' | cmp -s - $@ 2>/dev/null || echo '$(CC_FLAGS)' > $@
+
+$(BUILDDIR)/%.rel: %.c $(CCFLAGS_STAMP) | create_build_dir html_data.h
 	$(CC) -MMD $(CC_FLAGS) -o $@ -c $<

-$(BUILDDIR)/%.rel: %.asm | create_build_dir
+$(BUILDDIR)/%.rel: %.asm $(CCFLAGS_STAMP) | create_build_dir
 	${ASM} ${AFLAGS} -o $@ $<
 #	mv -f $(addprefix $(basename $^), .lst .rel .sym) .

-$(BUILDDIR)/rtlplayground.ihx: $(OBJS) $(BUILDDIR)/crtbank.rel $(BUILDDIR)/crc16.rel
-	$(CC) $(CC_FLAGS) --xram-size 49151 -Wl-bHOME=0x00000 -Wl-bBANK1=0x14000 -Wl-bBANK2=0x24000 -Wl-bBANK3=0x34000 -Wl-r -o $@ $^
+$(BUILDDIR)/rtlplayground.ihx: $(OBJS) $(BUILDDIR)/crtbank.rel $(BUILDDIR)/crc16.rel $(BUILDDIR)/crypto/chacha_8051.rel
+	$(CC) $(CC_FLAGS) --xram-size 48896 -Wl-bHOME=0x00000 -Wl-bBANK1=0x14000 -Wl-bBANK2=0x24000 -Wl-bBANK3=0x34000 -Wl-r -o $@ $^

 $(BUILDDIR)/rtlplayground.img: $(BUILDDIR)/rtlplayground.ihx
 	objcopy --input-target=ihex -O binary $< $@
@@ -148,21 +196,28 @@ $(BUILDDIR)/rtlplayground-$(FILENAME_EXTENSION).bin: $(BUILDDIR)/rtlplayground.i
 	tools/output/imagebuilder -i $^ $@
 	tools/output/fileadder -a $(DEFAULT_CONFIG_LOCATION) -s $(IMAGESIZE) -d config.txt $@
 	tools/output/fileadder -a $(CONFIG_LOCATION) -s $(IMAGESIZE) -d config.txt $@
-	tools/output/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -z -d $(HTML_MIN) -p html_data -b BANK1 $@
+	tools/output/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -z -d $(HTML_MIN) -b BANK1 $@
 	tools/output/crc_calculator -u $@
 	ln -sf $(MACHINE)/rtlplayground-$(FILENAME_EXTENSION).bin output/rtlplayground.bin

-.PHONY: clean distclean all $(SUBDIRS) $(SUBDIRSCLEAN) $(VERSION_HEADER) create_build_dir
+.PHONY: clean distclean all $(SUBDIRS) $(SUBDIRSCLEAN) create_build_dir
+
+# Every machine/ definition is compiled, so a machine added to machine/ is
+# covered without registering it anywhere. The machine-specific defines are
+# filtered out of $(CC_FLAGS) and supplied per iteration instead, so this also
+# works as "make machine_check MACHINE=...".
+MACHINE_DEFS := $(sort $(patsubst machine/%.c,%,$(wildcard machine/*.c)))
+MACHINE_LESS_CC_FLAGS = $(filter-out -DMACHINE_%,$(CC_FLAGS))

 .PHONY:
 machine_check:
 	@mkdir -p $(BUILDDIR)/tmp
 	@set -eo pipefail; \
-	for MACHINE in `grep -E '^[[:space:]]*(//[[:space:]]*)?#define MACHINE_' machine.h | sed -E 's%^[[:space:]]*(//[[:space:]]*)?#define MACHINE_%%' | awk '{print $$1}' | sort -u`; \
+	for MACHINE in $(MACHINE_DEFS); \
 	do \
 	echo "Checking $${MACHINE}"; \
-	$(CC) $(CC_FLAGS) -DMACHINE_$${MACHINE} -MMD -o $(BUILDDIR)/tmp/machine_check -c machine.c; \
-	$(CC) $(CC_FLAGS) -DMACHINE_$${MACHINE} -MMD -o $(BUILDDIR)/tmp/machine_check -c machine_init.c; \
+	$(CC) $(MACHINE_LESS_CC_FLAGS) -DMACHINE_$${MACHINE} -DMACHINE_NAME=$${MACHINE} -MMD -o $(BUILDDIR)/tmp/machine_check -c machine/$${MACHINE}.c; \
+	$(CC) $(MACHINE_LESS_CC_FLAGS) -DMACHINE_$${MACHINE} -DMACHINE_NAME=$${MACHINE} -MMD -o $(BUILDDIR)/tmp/machine_check -c machine_init.c; \
 	done
 	@rm -rf $(BUILDDIR)/tmp

@@ -344,6 +344,7 @@ netmask zzz.zzz.zzz.zzz = Network mask of the switch
 port x name xxx         = Name xxx the port number x
 port z 1g               = Set 1g speed for port z
 igmp on/off             = Turn IGMP on or off
+session xxxx            = Web session timeout in seconds (default 200)
 ```
 [To be continue]

@@ -358,5 +359,7 @@ The following documents give further documentation on specific features of the R
 - [IGMP (IP-MC streaming)](doc/igmp.md)
 - [SFP+ ports](doc/sfp.md) 
 - [Trunking aka. port aggregation](doc/trunking.md)
+- [LACP (802.3ad link aggregation)](doc/lacp.md)
 - [VLAN](doc/vlan.md)
+- [Storm control](doc/storm_control.md)
 - [Modifications and Flash replacement](doc/mods.md)
@@ -21,6 +21,7 @@ extern __code const struct machine machine;
 extern __xdata struct machine_runtime machine_detected;
 extern __xdata uint8_t sfr_data[4];
 extern volatile __xdata uint32_t ticks;
+__xdata uint32_t rtl8224_release_tick;
 extern __xdata uint8_t tx_seq;
 extern __code const uint8_t * __code const hex;

@@ -240,10 +241,10 @@ void rtl8224_enable(void) __banked
 	reg_bit_clear(RTL837X_REG_GPIO_32_63_OUTPUT, 4);
 	// Configure Pin as output
 	reg_bit_set(RTL837X_REG_GPIO_32_63_DIRECTION, 4);
-	delay(100);
+	delay(4);
 	// Set pin 4 high
 	reg_bit_set(RTL837X_REG_GPIO_32_63_OUTPUT, 4);
-	delay(500);
+	rtl8224_release_tick = ticks;
 }


@@ -5,6 +5,8 @@
 // #define DEBUG
 // #define REGDBG 1

+#include <8051.h>
+#include "cmd_parser.h"
 #include "rtl837x_common.h"
 #include "rtl837x_port.h"
 #include "rtl837x_flash.h"
@@ -12,15 +14,22 @@
 #include "rtl837x_regs.h"
 #include "rtl837x_sfr.h"
 #include "rtl837x_stp.h"
+#include "rtl837x_lacp.h"
 #include "rtl837x_igmp.h"
 #include "rtl837x_bandwidth.h"
+#include "rtl837x_lldp.h"
+#include "rtl837x_storm.h"
+#include "rtl837x_trap.h"
 #include "sfp.h"
 #include "dhcp.h"
 #include "syslog.h"
+#include "dns.h"
+#include "ntp.h"
 #include "uip/uip.h"
 #include "version.h"

 #include "machine.h"
+#include "rtl837x_leds.h"
 #include "phy.h"

 #pragma codeseg BANK2
@@ -29,6 +38,7 @@
 extern __code const struct machine machine;
 extern __xdata bool stp_enabled;
 extern __code const uint8_t log_to_phys_port[9];
+extern __xdata bool lldp_enabled;

 extern volatile __xdata uint32_t ticks;
 extern volatile __xdata uint8_t sfr_data[4];
@@ -41,6 +51,8 @@ extern __xdata struct flash_region_t flash_region;

 extern __xdata char passwd[21];

+extern __xdata uint16_t session_timeout;
+
 extern __xdata struct dhcp_state dhcp_state;

 __xdata uint8_t vlan_names[VLAN_NAMES_SIZE];
@@ -59,7 +71,6 @@ __xdata uint8_t hexvalue[4] = { 0 };

 // Buffer for writing to flash 0x1fd000, copy to 0x1fe000
 __xdata uint8_t cmd_buffer[CMD_BUF_SIZE];
-__xdata uint8_t cmd_available;

 __xdata	char save_cmd;

@@ -524,11 +535,21 @@ void parse_lag(void)
 		goto err;

 	if (cmd_compare(2, "d")) {
+		lacp_lag_set(group, 0);
 		port_lag_members_set(group, 0);
 		return;
 	}

 	uint8_t w = 2;
+	__xdata uint8_t lacp_mode = 0;
+	if (cmd_words_len > 2 && cmd_compare(2, "lacp")) {
+		lacp_mode = 1;
+		w = 3;
+		if (cmd_words_len > 3 && cmd_compare(3, "off")) {
+			lacp_lag_set(group, 0);
+			return;
+		}
+	}
 	while (w < cmd_words_len) {
 		// Parse port.
 		if (cmd_parse_port_separator(cmd_words_b[w++]) == 0)
@@ -536,10 +557,15 @@ void parse_lag(void)

 		members |= ((uint16_t)1) << atoi_results_u8;
 	}
+	if (lacp_mode) {
+		lacp_lag_set(group, members);
+	} else {
+		lacp_lag_set(group, 0);
 		port_lag_members_set(group, members);
+	}
 	return;
 err:
-	cmd_error("lag (show | <1-4> (d | <port>...))\n");
+	cmd_error("lag (show | <1-4> (d | [lacp] <port>...))\n");
 }


@@ -837,9 +863,14 @@ void parse_mirror(void)
 	if (cmd_words_len < 2)
 		goto err;

+	// The first argument is the mirroring (monitor) port
+	uint8_t ret = cmd_parse_port(cmd_words_b[1]);
+	if (ret == 0)
+		goto err;
+	mirroring_port = atoi_results_u8;
+
 	uint8_t w = 2;
 	uint8_t port;
-	uint8_t ret;
 	while (w < cmd_words_len) {
 		uint8_t idx = cmd_words_b[w++];
 		ret = cmd_parse_port(idx);
@@ -849,10 +880,6 @@ void parse_mirror(void)
 		idx += ret;
 		port = atoi_results_u8;

-		// Use the first port argument as mirroring_port
-		if (w == 2)
-			mirroring_port = port;
-
 		ret = cmd_buffer[idx];
 		uint16_t pmask = ((uint16_t)1) << port;
 		if (ret != 't')
@@ -875,6 +902,7 @@ void parse_port(void)
 		cmd_error("\nUsage:" \
 					 "\nport <port> [show|on|off]" \
 					 "\nport <port> [10m|100m|1g|2g5|duplex] [half|full]" \
+					 "\nport <port> lldp [block|permit]" \
 					 "\nport <port> name [custom port name]\n");
 		return;
 	}
@@ -893,10 +921,13 @@ void parse_port(void)
 		print_string_x(port_names[phy_settings.port]);
 		if (!machine.is_sfp[phy_settings.port]) {
 			phy_show(phy_settings.port);
+		} else {
+			write_char('\n');
 		}
+		port_media_show(phy_settings.port);
 	} else if (cmd_compare(2, "name")) {
 		uint8_t i = 0;
-		while ( (i < PORT_NAME_SIZE-1) && (cmd_buffer[cmd_words_b[3] + i] != NUL) ) {
+		while ( cmd_words_len > 3 && (i < PORT_NAME_SIZE-1) && (cmd_buffer[cmd_words_b[3] + i] != NUL) ) {
 			port_names[phy_settings.port][i] = name_char(cmd_buffer[cmd_words_b[3] + i]);
 			i++;
 		}
@@ -904,6 +935,14 @@ void parse_port(void)
 		print_string("\nName set to: \"");
 		print_string_x(port_names[phy_settings.port]);
 		print_string("\"\n");
+	} else if (cmd_compare(2, "lldp")) {
+		if (cmd_compare(3, "block")){
+			lldp_logical_port_status &= ~((uint16_t)1 << phy_settings.port);
+		} else if (cmd_compare(3, "permit")) {
+			lldp_logical_port_status |= (uint16_t)1 << phy_settings.port;
+		} else {
+			print_string ("Unknown port <port> lldp [block|permit] command\n");
+		}
 	} else if (machine.is_sfp[phy_settings.port]) {
 		print_string(" is SFP no PHY information available.\n");
 	} else if (cmd_compare(2, "10m")) {
@@ -1165,6 +1204,32 @@ err:
 }


+static void print_temperature(uint16_t reg)
+{
+	int16_t v;
+
+	reg_read(reg);
+	v = SFR_DATA_U16;
+	if (v < 0) {
+		write_char('-');
+		v = -v;
+	}
+	itoa(v >> 7);
+	write_char('.');
+	itoa(((v & 0x7f) * 10) >> 7);
+	print_string(" C\n");
+}
+
+
+void parse_temp(void)
+{
+	print_string("\nChip temperature: ");
+	print_temperature(RTL837X_TM_RESULT);
+	print_string("At power-on:      ");
+	print_temperature(RTL837X_TM_RESULT_POWERON);
+}
+
+
 void parse_sdsget(void)
 {
 	__xdata uint8_t sds_id, page, reg, hex_size;
@@ -1541,6 +1606,57 @@ err:
 	cmd_error("bw [in|out|status] <port> [<hexvalue>|off|drop|fc]\n");
 }

+static __code const char * __code const storm_types[STORM_TYPES] = { "bcast", "mcast", "ucast", "umcast" };
+
+void parse_storm(void)
+{
+	uint8_t port, type, d;
+	__xdata uint32_t rate;
+	__xdata uint8_t *p;
+
+	if (cmd_words_len == 1)
+		return storm_show();
+	if (cmd_words_len < 4 || !cmd_parse_port_separator(cmd_words_b[1]))
+		goto err;
+	port = atoi_results_u8;
+
+	type = 0;
+	while (!cmd_compare(2, storm_types[type])) {
+		if (++type == STORM_TYPES)
+			goto err;
+	}
+
+	if (cmd_words_len == 4 && cmd_compare(3, "off"))
+		return storm_off(port, type);
+	if (cmd_words_len != 5)
+		goto err;
+
+	rate = 0;
+	p = &cmd_buffer[cmd_words_b[3]];
+	do {
+		d = *p++ - '0';
+		if (d > 9 || rate > 99999999)
+			goto err;
+		rate = (rate << 3) + (rate << 1) + d;
+	} while (*p != ' ' && *p != NUL);
+
+	if (cmd_compare(4, "pps")) {
+		if (!rate || rate > 0xfffff)
+			goto err;
+		storm_set(port, type, rate, 1);
+	} else if (cmd_compare(4, "kbps")) {
+		if (!rate || rate > 10000000)
+			goto err;
+		storm_set(port, type, rate, 0);
+	} else {
+		goto err;
+	}
+	return;
+
+err:
+	print_string("usage: storm [<port> bcast|mcast|ucast|umcast <rate> pps|kbps|off]\n");
+}
+
 void parse_syslog(void)
 {
 	if (cmd_words_len < 2) // no argument -> print status
@@ -1609,6 +1725,25 @@ void parse_syslog(void)
 	}
 }

+void parse_session(void)
+{
+	if (cmd_words_len >= 2) {
+		/* atoi_short() returns zero for no digits and for a value past
+		 * 65535; a zero-second timeout is not useful either, so both
+		 * tests are needed. */
+		if (!atoi_short(cmd_words_b[1]) || !atoi_results_short) {
+			print_string("Must be 1-65535 s\n");
+			return;
+		}
+		session_timeout = atoi_results_short;
+	}
+	/* Also the confirmation after setting: one message for both. */
+	print_string("Session timeout: ");
+	itoa_short(session_timeout);
+	print_string(" s\n");
+}
+
+
 // Parse command into words
 // cmd_words_len contains the number of words found.
 // cmd_words_b[] contains only start of a word offset.
@@ -1751,6 +1886,10 @@ void cmd_parser(void) __banked
 			parse_mtu();
 		} else if (cmd_compare(0, "syslog")) {
 			parse_syslog();
+		} else if (cmd_compare(0, "dns")) {
+			dns_parse();
+		} else if (cmd_compare(0, "ntp") || cmd_compare(0, "time")) {
+			ntp_parse();
 		} else if (cmd_compare(0, "ip")) {
 			if (cmd_compare(1, "dhcp")) {
 				dhcp_start();
@@ -1847,6 +1986,17 @@ void cmd_parser(void) __banked
 			}
 		} else if (cmd_compare(0, "stp")) {
 			stp_parse();
+#ifdef HEALTH
+		} else if (cmd_compare(0, "health")) {
+			health_show();
+#endif
+		} else if (cmd_compare(0, "lacp")) {
+			if (cmd_compare(1, "show"))
+				lacp_show();
+			else if (cmd_compare(1, "off"))
+				lacp_off();
+			else
+				cmd_error("lacp (show | off); a group starts LACP with: lag <1-4> lacp <port>...\n");
 		} else if (cmd_compare(0, "pvid")) {
 			if (cmd_words_len == 3 && cmd_parse_port_separator(cmd_words_b[1]) != 0
 			    && atoi_short(cmd_words_b[2]) && atoi_results_short && atoi_results_short <= 4094)
@@ -1869,6 +2019,8 @@ void cmd_parser(void) __banked
 			write_char('\n');
 		} else if (cmd_compare(0, "gpio")) {
 			print_gpio_status();
+		} else if (cmd_compare(0, "leds")) {
+			leds_dump();
 		} else if (cmd_compare(0, "regget")) {
 			parse_regget();
 		} else if (cmd_compare(0, "regset")) {
@@ -1889,13 +2041,12 @@ void cmd_parser(void) __banked
 			parse_eee();
 		} else if (cmd_compare(0, "bw")) {
 			parse_bw();
+		} else if (cmd_compare(0, "temp")) {
+			parse_temp();
+		} else if (cmd_compare(0, "storm")) {
+			parse_storm();
 		} else if (cmd_compare(0, "version")) {
 			print_sw_version();
-		} else if (cmd_compare(0, "time")) {
-			print_string("  Tick counter: "); print_long(ticks); print_string("   Sec Counter: ");
-			reg_read_m(RTL837X_REG_SEC_COUNTER);
-			print_sfr_data();
-			write_char('\n');
 		} else if (cmd_compare(0, "history")) {
 			__xdata uint16_t p = (cmd_history_ptr + 1) & CMD_HISTORY_MASK;
 			__xdata uint8_t found_begin = 0;
@@ -1911,6 +2062,18 @@ void cmd_parser(void) __banked
 			}
 		} else if (cmd_compare(0, "ingress")) {
 			parse_ingress();
+		} else if (cmd_compare(0, "session")) {
+			parse_session();
+		} else if (cmd_compare(0, "lldp")) {
+			if (cmd_compare(1, "on")) {
+				print_string("LLDP enabled\n");
+				lldp_enabled = 1;
+				trap_rma_set(RTL837X_RMA0E_CONF, RTL837X_RMA_ACT_TRAP);
+			} else {
+				print_string("LLDP disabled\n");
+				lldp_enabled = 0;
+				trap_rma_set(RTL837X_RMA0E_CONF, RTL837X_RMA_ACT_FORWARD);
+			}
 		}
 		else {
 			cmd_error("Unknown command\n");
@@ -1962,6 +2125,7 @@ void execute_config(void) __banked
 	save_cmd = 0;

 	uint8_t cmd_idx = 0;
+	uint8_t skipping = 0;
 	do {
 		flash_region.addr = pos;
 		flash_region.len = FLASH_READ_BURST_SIZE;
@@ -1972,29 +2136,34 @@ void execute_config(void) __banked
 		do {
 			if (cmd_idx >= (CMD_BUF_SIZE - 1)) {
 				cmd_buffer[cmd_idx] = NUL;
-				print_string("ERROR: Command too long: ");
+				print_string("ERROR: Command too long, skipped: ");
 				print_string_x(cmd_buffer);
 				write_char('\n');
-				err_status = ERR_CMD_TOO_LONG;
-				goto config_done;
+				cmd_idx = 0;
+				skipping = 1;
 			}
 			c = flash_buf[cfg_idx++];
 			if (c == 0 || c == '\n') {
+				if (skipping) {
+					skipping = 0;
+				} else {
 					cmd_buffer[cmd_idx] = NUL;
 					if (cmd_idx) {
 						cmd_tokenize();
-					if (err_status != ERR_OK)
-						goto config_done;
+						if (err_status == ERR_OK)
 							cmd_parser();
 					}
+				}
 				if (c == 0)
 					goto config_done;
 				cmd_idx = 0;
 				continue;
 			}

+			if (!skipping) {
 				cmd_buffer[cmd_idx] = c;
 				cmd_idx++;
+			}
 		} while (cfg_idx);

 		pages_left--;
@@ -2045,3 +2214,161 @@ void execute_commands(__xdata uint8_t *p) __banked {
 		p++;
 	};
 }
+
+#ifdef HEALTH
+/*
+ * Health instrumentation. The counters live in xdata and are fed from the
+ * main loop through the banked entry points below; the "health" command
+ * prints everything in one go. All figures are raw hex, diffing two dumps
+ * gives the rates. Phase times are in system ticks (SYS_TICK_HZ = 200,
+ * 5 ms each); a phase counts as slow when it spans 2 or more ticks.
+ */
+extern __xdata uint16_t len_left;	/* httpd: bytes still to send of the current file */
+extern __xdata uint8_t entry;		/* httpd: index of the file being sent */
+
+static __xdata uint32_t health_loops;
+__xdata uint16_t health_rx_frames;
+
+static __xdata uint16_t ph_last_t;
+static __xdata uint8_t  ph_max[HEALTH_PHASES];
+static __xdata uint16_t ph_slow[HEALTH_PHASES];
+
+/* The ISR increments ticks between the two byte reads of a 16-bit load, so
+ * read until two loads agree. */
+static uint16_t ticks_lo(void)
+{
+	uint16_t a, b;
+	a = (uint16_t)ticks;
+	do {
+		b = a;
+		a = (uint16_t)ticks;
+	} while (a != b);
+	return a;
+}
+
+
+void health_loop_start(void) __banked
+{
+	health_loops++;
+	ph_last_t = ticks_lo();
+}
+
+
+void health_phase(uint8_t id) __banked
+{
+	__xdata uint16_t now = ticks_lo();
+	__xdata uint16_t d = now - ph_last_t;
+	ph_last_t = now;
+	if (d > 0xff)
+		d = 0xff;
+	if ((uint8_t)d > ph_max[id])
+		ph_max[id] = d;
+	if (d >= 2)
+		ph_slow[id]++;
+}
+
+
+/* Fill the stack area above the current frame with a pattern; the dump scans
+ * for how much of it survived. The 8051 stack grows upward, so everything
+ * above SP is free at this point. Interrupts are held off so an ISR does not
+ * push into the area mid-paint. */
+void health_stack_paint(void) __banked
+{
+	__xdata uint8_t from = SP + 4;
+	__xdata uint8_t ea = EA;
+	EA = 0;
+	for (uint8_t i = 0xff; i >= from; i--)
+		*(__idata uint8_t *)i = 0xa5;
+	EA = ea;
+}
+
+
+static void ph_line(__code const char *name, uint8_t id)
+{
+	print_string(name);
+	print_string(" max ");
+	print_byte(ph_max[id]);
+	print_string(" slow ");
+	print_short(ph_slow[id]);
+	write_char('\n');
+}
+
+
+void health_show(void) __banked
+{
+	__xdata uint8_t i;
+
+	print_string("up ");
+	reg_read_m(RTL837X_REG_SEC_COUNTER);
+	print_byte(sfr_data[0]); print_byte(sfr_data[1]);
+	print_byte(sfr_data[2]); print_byte(sfr_data[3]);
+	print_string(" ticks ");
+	print_long(ticks);
+	print_string(" loops ");
+	print_long(health_loops);
+	print_string(" rx ");
+	print_short(health_rx_frames);
+	write_char('\n');
+
+	/* Phase timing: max duration seen (ticks of 5 ms) and slow-pass count */
+	ph_line("link", HEALTH_PH_LINK);
+	ph_line("sfp ", HEALTH_PH_SFP);
+	ph_line("rx  ", HEALTH_PH_RX);
+	ph_line("tx  ", HEALTH_PH_TX);
+	ph_line("stp ", HEALTH_PH_STP);
+	ph_line("cmd ", HEALTH_PH_CMD);
+
+	/* Stack: current depth plus how much of the painted area is untouched */
+	print_string("sp ");
+	print_byte(SP);
+	print_string(" untouched ");
+	i = 0;
+	while (*(__idata uint8_t *)(0xff - i) == 0xa5 && i < 0x86)
+		i++;
+	print_byte(i);
+	write_char('\n');
+
+	/* The TCP connection slot. One on this configuration; a build with more
+	 * has to say which slot each line is, so make that a visible decision. */
+#if UIP_CONNS != 1
+#error "health: the tcp dump prints a single slot, extend it for UIP_CONNS > 1"
+#endif
+	i = 0;
+	{
+		print_string("tcp ");
+		print_string("st ");
+		print_byte(uip_conns[i].tcpstateflags);
+		print_string(" tmr ");
+		print_byte(uip_conns[i].timer);
+		print_string(" rtx ");
+		print_byte(uip_conns[i].nrtx);
+		print_string(" rto ");
+		print_byte(uip_conns[i].rto);
+		print_string(" len ");
+		print_short(uip_conns[i].len);
+		print_string(" mss ");
+		print_short(uip_conns[i].mss);
+		write_char('\n');
+		print_string("  lport ");
+		print_short(HTONS(uip_conns[i].lport));
+		print_string(" rport ");
+		print_short(HTONS(uip_conns[i].rport));
+		print_string(" rip ");
+		print_short(HTONS(uip_conns[i].ripaddr[0]));
+		write_char(' ');
+		print_short(HTONS(uip_conns[i].ripaddr[1]));
+		write_char('\n');
+	}
+
+	/* httpd transfer state and the protocol flags */
+	print_string("httpd left ");
+	print_short(len_left);
+	print_string(" entry ");
+	print_byte(entry);
+	print_string(" stp ");
+	print_byte(stp_enabled);
+	print_string(" mvlan ");
+	print_short(management_vlan);
+	write_char('\n');
+}
+#endif
@@ -6,9 +6,36 @@
 #include "rtl837x_common.h"

 extern __xdata uint8_t cmd_buffer[CMD_BUF_SIZE];
-extern __xdata uint8_t cmd_available;
+extern __bit __at(0x03) cmd_available;
 extern __xdata uint8_t err_status;

+/* Health instrumentation, built with HEALTH=1. Without it the hooks below
+ * compile to nothing and the "health" command does not exist. */
+#ifdef HEALTH
+/* Phase ids, in main-loop order */
+#define HEALTH_PH_LINK	0
+#define HEALTH_PH_SFP	1
+#define HEALTH_PH_RX	2
+#define HEALTH_PH_TX	3
+#define HEALTH_PH_STP	4
+#define HEALTH_PH_CMD	5
+#define HEALTH_PHASES	6
+#define HEALTH_LLDP     7
+
+extern __xdata uint16_t health_rx_frames;
+#define health_rx_frame()	health_rx_frames++
+
+void health_loop_start(void) __banked;	/* once per idle() pass, resets the phase baseline */
+void health_phase(uint8_t id) __banked;	/* after each phase; accounts ticks since last checkpoint */
+void health_stack_paint(void) __banked;	/* paint the unused stack area once at boot */
+void health_show(void) __banked;	/* "health" CLI dump */
+#else
+#define health_rx_frame()
+#define health_loop_start()
+#define health_phase(id)
+#define health_stack_paint()
+#endif
+
 void cmd_tokenize(void) __banked;
 void cmd_parser(void) __banked;
 void execute_config(void) __banked;
@@ -0,0 +1,23 @@
+#ifndef _CHACHA_H_
+#define _CHACHA_H_
+
+#include <stdint.h>
+
+struct chacha20_t {
+	uint8_t wstate[64];		// 64 bytes written here
+	uint8_t constant[16];		// 128 bit constant
+        uint8_t key[32];		// 256-bit secret key
+        uint32_t cnt;			// 32-bit block counter 1, 2.. Big Endian!
+        uint8_t nonce[12];		// 96-bit nonce
+        __xdata uint8_t *plaintext;
+        uint16_t length;
+        __xdata uint8_t *cyphertext;
+};
+
+// Encrypt a plaintext with ChaCha20 as per RFC7539
+void chacha20_encrypt(void);
+
+// Test ChaCha20 using the example from RFC7539
+void chacha20_test(void);
+
+#endif
@@ -0,0 +1,103 @@
+#include "rtl837x_common.h"
+#include "chacha.h"
+
+void chacha_20(void);
+void chacha_update(void);
+void chacha_count(void);
+
+// generate a block of ChaCha20 keystream as per RFC7539
+
+
+__xdata struct chacha20_t __at(0xbf00) chacha20;
+
+#ifdef CHACHA20_TEST
+__xdata uint8_t plaintext[256];
+__xdata uint8_t cyphertext[256];
+#endif
+
+#ifdef DEBUG
+void chacha20_print_block(void)
+{
+        for (uint8_t i=0; i < 64; i++) {
+            print_byte(*(uint8_t * __xdata)(chacha20.wstate + i));
+	    if (i%4 == 3)
+		    write_char(' ');
+        }
+}
+#endif
+
+void chacha20_encrypt(void)
+{
+	__xdata uint8_t *p = chacha20.plaintext;
+
+	while (chacha20.length) {
+		register uint8_t i;
+		chacha_count();
+		memcpy(chacha20.wstate, chacha20.wstate + 64, 64);
+#ifdef DEBUG
+		chacha20_print_block(); write_char('\n');
+#endif
+		chacha_20();
+		chacha_update();
+#ifdef DEBUG
+		chacha20_print_block(); write_char('\n');
+#endif
+		for (i = 0; i < ((chacha20.length > 64) ? 64 : chacha20.length); i++)
+			*chacha20.cyphertext++ = *p++ ^ chacha20.wstate[i];
+		chacha20.length -= chacha20.length > 64 ? 64 : chacha20.length;
+#ifdef DEBUG
+		print_string("\n  round done\n");
+#endif
+	};
+}
+
+#ifdef CHACHA20_TEST
+// Test the example of RFC 7539 Section 2.4.2
+void chacha20_test(void)
+{
+	__code uint8_t chacha_c[16] =
+		{ 0x61, 0x70, 0x78, 0x65,  0x33, 0x20, 0x64, 0x6e,
+		  0x79, 0x62, 0x2d, 0x32,  0x6b, 0x20, 0x65, 0x74 };
+
+	__code uint8_t key[32] =
+		{ 0x03, 0x02, 0x01, 0x00,  0x07, 0x06, 0x05, 0x04,
+		  0x0b, 0x0a, 0x09, 0x08,  0x0f, 0x0e, 0x0d, 0x0c,
+		  0x13, 0x12, 0x11, 0x10,  0x17, 0x16, 0x15, 0x14,
+		  0x1b, 0x1a, 0x19, 0x18,  0x1f, 0x1e, 0x1d, 0x1c };
+	
+	__code uint8_t nonce[12] = {
+		  0x00, 0x00, 0x00, 0x00,  0x4a, 0x00, 0x00, 0x00,
+		  0x00, 0x00, 0x00, 0x00 };
+
+	__code uint8_t sunscreen[] = "Ladies and Gentlemen of the class of '99: If I could offer you only one tip for " \
+				     "the future, sunscreen would be it.";
+
+/*
+	Ciphertext Sunscreen (from RFC 7539 Section 2.4.2):
+	000  6e 2e 35 9a 25 68 f9 80 41 ba 07 28 dd 0d 69 81  n.5.%h..A..(..i.
+	016  e9 7e 7a ec 1d 43 60 c2 0a 27 af cc fd 9f ae 0b  .~z..C`..'......
+	032  f9 1b 65 c5 52 47 33 ab 8f 59 3d ab cd 62 b3 57  ..e.RG3..Y=..b.W
+	048  16 39 d6 24 e6 51 52 ab 8f 53 0c 35 9f 08 61 d8  .9.$.QR..S.5..a.
+	064  07 ca 0d bf 50 0d 6a 61 56 a3 8e 08 8a 22 b6 5e  ....P.jaV....".^
+	080  52 bc 51 4d 16 cc f8 06 81 8c e9 1a b7 79 37 36  R.QM.........y76
+	096  5a f9 0b bf 74 a3 5b e6 b4 0b 8e ed f2 78 5e 42  Z...t.[......x^B
+	112  87 4d 
+*/
+	strcpy(plaintext, sunscreen);
+	memcpyc(chacha20.constant, chacha_c, 16);
+	memcpyc(chacha20.key, key, 32);
+	chacha20.cnt = 0;
+	memcpyc(chacha20.nonce, nonce, 12);
+	chacha20.plaintext = plaintext;
+	chacha20.length = strlen_x(plaintext);
+	chacha20.cyphertext = cyphertext;
+
+	print_string("Encrypting...\n");
+	chacha20_encrypt();
+	print_string("Cypertext:\n");
+	uint16_t len = strlen_x(plaintext);
+	for (uint8_t i = 0; i < len; i++) {
+		print_byte(cyphertext[i]); write_char(' ');
+	}
+}
+#endif
@@ -0,0 +1,455 @@
+; ChaCha Quater-Round implementation in Assembler
+	.module chacha_8051
+; Global variables:
+	.globl _chacha_20
+	.globl _chacha_update
+	.globl _chacha_count
+
+;#define CHACHA_QR(A, B, C, D) { \
+;    A += B; D ^= A; D = ROTL32(D, 16);  \
+;    C += D; B ^= C; B = ROTL32(B, 12);  \
+;    A += B; D ^= A; D = ROTL32(D, 8);   \
+;    C += D; B ^= C; B = ROTL32(B, 7);   \
+;}
+
+; 		r0      r1    r2   r3
+; CHACHA_QR( v[ 0], v[ 4], v[ 8], v[12] );
+
+	.area HOME    (CODE)
+
+store_32:
+	ar7 = 0x07
+	ar6 = 0x06
+	ar5 = 0x05
+	ar4 = 0x04
+	ar3 = 0x03
+	ar2 = 0x02
+	ar1 = 0x01
+	ar0 = 0x00
+
+	mov	a, r7
+	movx	@dptr, a
+	dec	dpl
+	mov	a, r6
+	movx	@dptr, a
+	dec	dpl
+	mov	a, r5
+	movx	@dptr, a
+	dec	dpl
+	mov	a, r4
+	movx	@dptr, a
+	ret
+
+rol_b:
+	clr	c
+	mov	a, r7
+	rlc	a
+	mov	r7, a
+	mov	a, r6
+	rlc	a
+	mov	r6, a
+	mov	a, r5
+	rlc	a
+	mov	r5, a
+	mov	a, r4
+	rlc	a
+	mov	r4, a
+	clr	a
+	addc	a, r7
+	mov	r7, a
+	djnz	dpl, rol_b
+	ret
+
+
+chacha_plus_xor:
+; Load A into registers r4-r7, A pointed to by r0
+	mov	dptr, #_chacha20
+	mov	dpl, r0
+	movx	a, @dptr
+	mov	r7, a
+	dec	dpl
+	movx	a, @dptr
+	mov	r6, a
+	dec	dpl
+	movx	a, @dptr
+	mov	r5, a
+	dec	dpl
+	movx	a, @dptr
+	mov	r4, a
+
+; A += B, B pointed to by r1
+	mov	dpl, r1
+	movx	a, @dptr
+	add	a, r7
+	mov	r7, a
+
+	dec	dpl
+	movx	a, @dptr
+	addc	a, r6
+	mov	r6, a
+
+	dec	dpl
+	movx	a, @dptr
+	addc	a, r5
+	mov	r5, a
+
+	dec	dpl
+	movx	a, @dptr
+	addc	a, r4
+	mov	r4, a
+
+	mov	dpl, r0		; Store A back
+	mov	a, r7
+	movx	@dptr, a
+	dec	dpl
+	mov	a, r6
+	movx	@dptr, a
+	dec	dpl
+	mov	a, r5
+	movx	@dptr, a
+	dec	dpl
+	mov	a, r4
+	movx	@dptr, a
+
+; D ^= A
+	mov	dpl, r3
+	movx	a, @dptr
+	xrl	a, r7
+	mov	r7, a
+	dec	dpl
+
+	movx	a, @dptr
+	xrl	a, r6
+	mov	r6, a
+	dec	dpl
+
+	movx	a, @dptr
+	xrl	a, r5
+	mov	r5, a
+	dec	dpl
+
+	movx	a, @dptr
+	xrl	a, r4
+	mov	r4, a
+	dec	dpl
+	ret
+
+chacha_qr:
+; QR Part: A += B; D ^= A; D = ROTL32(D, 16);
+	acall	chacha_plus_xor
+
+; rotate left 16. D is r4, r5, r6, r7 -> r6, r7, r4, r5
+	mov	a, r6
+	xch	a, r4
+	mov	r6, a
+	mov	a, r7
+	xch	a, r5
+	mov	r7, a
+	mov     dpl, r3 ; Store D
+	acall   store_32
+
+;QR Part: C += D; B ^= C; B = ROTL32(B, 12);
+; Swap A <-> C and D <-> B
+	mov	a, r0
+	xch	a, r2
+	mov	r0, a
+	mov	a, r1
+	xch	a, r3
+	mov	r1, a
+	acall	chacha_plus_xor
+
+; rotate left 12. D is r4, r5, r6, r7 -> r5, r6, r7, r4
+	mov	a, r4
+	xch	a, r7
+	xch	a, r6
+	xch	a, r5
+	mov	r4, a
+
+	mov	dpl, #4
+	acall	rol_b
+	mov	dpl, r3	; Store D (being B)
+	acall	store_32
+
+; Swap A <-> C and D <-> B
+	mov	a, r0
+	xch	a, r2
+	mov	r0, a
+	mov	a, r1
+	xch	a, r3
+	mov	r1, a
+
+; QR Part A += B; D ^= A; D = ROTL32(D, 8);
+	acall	chacha_plus_xor
+	mov	a, r4
+	xch	a, r7
+	xch	a, r6
+	xch	a, r5
+	mov	r4, a
+	mov	dpl, r3	; Store D
+	acall	store_32
+
+; QR Part
+;    C += D; B ^= C; B = ROTL32(B, 7);
+line4:
+; Swap A <-> C and D <-> B
+	mov	a, r0
+	xch	a, r2
+	mov	r0, a
+	mov	a, r1
+	xch	a, r3
+	mov	r1, a
+	acall	chacha_plus_xor
+
+; Roll left 7 bits, start by rolling 8 bits left, then roll 1 to the right
+	mov	a, r4
+	xch	a, r7
+	xch	a, r6
+	xch	a, r5
+	mov	r4, a
+
+	clr	c
+	mov	a, r4
+	rrc	a
+	mov	r4, a
+	mov	a, r5
+	rrc	a
+	mov	r5, a
+	mov	a, r6
+	rrc	a
+	mov	r6, a
+	mov	a, r7
+	rrc	a
+	mov	r7, a
+	clr	a
+	rrc	a
+	add	a, r4
+	mov	r4, a
+
+; Swap A <-> C and D <-> B
+	mov	a, r0
+	xch	a, r2
+	mov	r0, a
+	mov	a, r1
+	xch	a, r3
+	mov	r1, a
+	mov	dpl, r1	; Store B
+	acall	store_32
+	ret
+
+
+;
+; Implementation of 20 ChaCha Rounds (10 Double Rounds)
+;
+_chacha_20:
+	push    acc
+	push    b
+	push    dpl
+	push    dph
+	push    ar7
+	push    ar6
+	push    ar5
+	push    ar4
+	push    ar3
+	push    ar2
+	push    ar1
+	push    ar0
+	push    psw
+
+	mov	b, #10 ; 10 Double rounds
+chacha_20_loop:
+;	CHACHA_QR( v[ 0], v[ 4], v[ 8], v[12] );
+	mov r0, #3
+	mov r1, #19
+	mov r2, #35
+	mov r3, #51
+	acall	chacha_qr
+	
+;        CHACHA_QR( v[ 1], v[ 5], v[ 9], v[13] ); 7  23  39  55
+	mov r0, #7
+	mov r1, #23
+	mov r2, #39
+	mov r3, #55
+	acall	chacha_qr
+
+; 	CHACHA_QR( v[ 2], v[ 6], v[10], v[14] ); 11 27  43  59
+	mov r0, #11
+	mov r1, #27
+	mov r2, #43
+	mov r3, #59
+	acall	chacha_qr
+
+;	CHACHA_QR( v[ 3], v[ 7], v[11], v[15] ); 15 31  47  63
+        mov r0, #15
+        mov r1, #31
+        mov r2, #47
+        mov r3, #63
+	acall	chacha_qr
+
+;	CHACHA_QR( v[ 0], v[ 5], v[10], v[15] ); 3  23  43  63
+	mov r0, #3
+	mov r1, #23
+	mov r2, #43
+	mov r3, #63
+	acall	chacha_qr
+
+;	CHACHA_QR( v[ 1], v[ 6], v[11], v[12] ); 7  27  47  51
+	mov r0, #7
+	mov r1, #27
+	mov r2, #47
+	mov r3, #51
+	acall	chacha_qr
+
+;	CHACHA_QR( v[ 2], v[ 7], v[ 8], v[13] ); 11 31  35  55
+	mov r0, #11
+	mov r1, #31
+	mov r2, #35
+	mov r3, #55
+	acall	chacha_qr
+
+;	CHACHA_QR( v[ 3], v[ 4], v[ 9], v[14] ); 15 19  39  59
+	mov r0, #15
+	mov r1, #19
+	mov r2, #39
+	mov r3, #59
+	acall	chacha_qr
+	djnz	b, chacha_20_loop
+
+	pop     psw
+	pop     ar0
+	pop     ar1
+	pop     ar2
+	pop     ar3
+	pop     ar4
+	pop     ar5
+	pop     ar6
+	pop     ar7
+	pop     dph
+	pop     dpl
+	pop     b
+	pop     acc
+	ret
+
+;
+; Update ChaCHa state
+;
+_chacha_update:
+	push    acc
+	push    b
+	push    dpl
+	push    dph
+	push    ar4
+	push    ar3
+	push    ar2
+	push    ar1
+	push    ar0
+	push    psw
+
+	mov	dptr, #_chacha20
+	mov	b, #16 ; 16 uint32
+update_loop:
+	mov	a, b ; multiply by 4 and subtract 1
+	rl	a
+	rl	a
+	dec	a
+; Load Working State variable into registers r0-r3
+	mov	dpl, a
+
+	orl	a, #64	; Save pointer to state
+	mov	r4, a
+
+	movx	a, @dptr
+	mov	r3, a
+	dec	dpl
+	movx	a, @dptr
+	mov	r2, a
+	dec	dpl
+	movx	a, @dptr
+	mov	r1, a
+	dec	dpl
+	movx	a, @dptr
+	mov	r0, a
+
+; Add to State variable
+	mov	a, r4
+	mov	dpl, a
+	movx	a, @dptr
+	add	a, r3
+	mov	r3, a
+
+	dec	dpl
+	movx	a, @dptr
+	addc	a, r2
+	mov	r2, a
+
+	dec	dpl
+	movx	a, @dptr
+	addc	a, r1
+	mov	r1, a
+
+	dec	dpl
+	movx	a, @dptr
+	addc	a, r0
+	mov	r0, a
+
+; Store back state variable in LSB, first sequence (serialized)
+	mov	a, r4
+	xrl	a, #64	; Save pointer to working state
+	mov	dpl, a
+	mov	a, r0
+	movx	@dptr, a
+	dec	dpl
+	mov	a, r1
+	movx	@dptr, a
+	dec	dpl
+	mov	a, r2
+	movx	@dptr, a
+	dec	dpl
+	mov	a, r3
+	movx	@dptr, a
+
+	djnz	b, update_loop
+
+	pop     psw
+	pop     ar0
+	pop     ar1
+	pop     ar2
+	pop     ar3
+	pop     ar4
+	pop     dph
+	pop     dpl
+	pop     b
+	pop     acc
+	ret
+
+;
+; Increase counter in state
+;
+_chacha_count:
+	push    acc
+	push    dpl
+	push    dph
+	mov	dptr, #_chacha20
+	mov	dpl, #112 + 3
+	movx	a, @dptr
+	inc	a
+	movx	@dptr, a	
+	jnz	chacha_count_done
+	dec	dpl
+	movx	a, @dptr
+	inc	a
+	movx	@dptr, a
+	jnz	chacha_count_done
+	dec	dpl
+	movx	a, @dptr
+	inc	a
+	movx	@dptr, a
+	jnz	chacha_count_done
+	dec	dpl
+	movx	a, @dptr
+	inc	a
+	movx	@dptr, a
+chacha_count_done:
+	pop     dph
+	pop     dpl
+	pop     acc
+	ret
@@ -139,7 +139,6 @@ void dhcp_addopt_request_ip(void)
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.current_ip[1];
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.current_ip[2];
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.current_ip[3];
-	memcpy(&DHCP_OPT[dhcp_state.opt_ptr], uip_ethaddr.addr, 4);
 }


@@ -151,13 +150,11 @@ void dhcp_addopt_server_id(void)
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.server[1];
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.server[2];
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.server[3];
-	memcpy(&DHCP_OPT[dhcp_state.opt_ptr], uip_ethaddr.addr, 4);
 }


 void dhcp_send_discover(void)
 {
-	print_string("dhcp_send_discover called\n");
 	dhcp_prepare_request();

 	dhcp_state.opt_ptr = 0;
@@ -193,7 +190,6 @@ void dhcp_send_discover(void)

 void dhcp_send_request(void)
 {
-	print_string("dhcp_send_request called\n");
 	dhcp_prepare_request();

 	dhcp_state.opt_ptr = 0;
@@ -232,19 +228,21 @@ void ip_opt(__xdata uint8_t * ip)
 {
 	dhcp_state.opt_ptr++;
 	uint8_t len = DHCP_OPT[dhcp_state.opt_ptr++];
-	*ip++ = DHCP_OPT[dhcp_state.opt_ptr++];
-	*ip++ = DHCP_OPT[dhcp_state.opt_ptr++];
-	*ip++ = DHCP_OPT[dhcp_state.opt_ptr++];
-	*ip++ = DHCP_OPT[dhcp_state.opt_ptr++];
+	if (len >= 4)
+		memcpy(ip, &DHCP_OPT[dhcp_state.opt_ptr], 4);
 	 // There may be more than one IP option, such as 2 DNS servers advertised
-	dhcp_state.opt_ptr += len - 4;
+	dhcp_state.opt_ptr += len;
 }


-void long_opt(void)
+uint8_t long_opt(void)
 {
 	dhcp_state.opt_ptr++;
-	dhcp_state.opt_ptr++;
+	uint8_t len = DHCP_OPT[dhcp_state.opt_ptr++];
+	if (len < 4) {
+		dhcp_state.opt_ptr += len;
+		return 0;
+	}
 	long_value =  DHCP_OPT[dhcp_state.opt_ptr++];
 	long_value <<= 8;
 	long_value |= DHCP_OPT[dhcp_state.opt_ptr++];
@@ -252,6 +250,8 @@ void long_opt(void)
 	long_value |= DHCP_OPT[dhcp_state.opt_ptr++];
 	long_value <<= 8;
 	long_value |= DHCP_OPT[dhcp_state.opt_ptr++];
+	dhcp_state.opt_ptr += len - 4;
+	return 1;
 }


@@ -275,15 +275,15 @@ void parse_opts(void)
 			ip_opt(&dhcp_state.broadcast[0]);
 			break;
 		case DHCP_LEASE:
-			long_opt();
+			if (long_opt())
 				dhcp_state.lease = long_value;
 			break;
 		case DHCP_REBIND:
-			long_opt();
+			if (long_opt())
 				dhcp_state.rebind = long_value;
 			break;
 		case DHCP_RENEWAL:
-			long_opt();
+			if (long_opt())
 				dhcp_state.renewal = long_value;
 			break;
 		case DHCP_END:
@@ -376,13 +376,11 @@ void dhcp_start(void) __banked
 	*tid++ = SFR_DATA_8;
 	*tid = SFR_DATA_0;
 	dhcp_state.state = DHCP_START;
-	print_string("dhcp_start done\n");
 }


 void dhcp_stop(void) __banked
 {
-	print_string("dhcp_stop called\n");
 	uip_udp_remove(dhcp_state.conn);
 	dhcp_state.state = DHCP_OFF;
 }
@@ -0,0 +1,238 @@
+/*
+ * DNS resolver for the RTL837x platform
+ * This code is in the Public Domain
+ */
+
+#include <stdint.h>
+#include "rtl837x_common.h"
+#include "cmd_parser.h"
+#include "uip/uip.h"
+#include "dhcp.h"
+#include "dns.h"
+
+#pragma codeseg BANK3
+#pragma constseg BANK3
+
+#define DNS_PORT	53
+#define DNS_TRIES	6
+#define DNS_TIMEOUT	(2 * SYS_TICK_HZ)
+
+extern __xdata struct dhcp_state dhcp_state;
+extern volatile __xdata uint32_t ticks;
+
+__xdata struct dns_state dns_state;
+__xdata uip_ipaddr_t dns_ip;
+uint8_t * __xdata dns_cand[3];
+
+
+static uint8_t dns_used(__xdata uint8_t *a) __reentrant
+{
+	return a[0] | a[1] | a[2] | a[3];
+}
+
+
+static uint8_t dns_name_is_ip(void) __reentrant
+{
+	__xdata char *s = dns_state.name;
+	uint8_t i, n;
+	uint16_t v;
+
+	for (i = 0; i < 4; i++) {
+		v = 0;
+		n = 0;
+		while (*s >= '0' && *s <= '9') {
+			v = v * 10 + (*s++ - '0');
+			if (++n > 3 || v > 255)
+				return 0;
+		}
+		if (!n)
+			return 0;
+		dns_state.addr[i] = v;
+		if (i < 3 && *s++ != '.')
+			return 0;
+	}
+	return !*s;
+}
+
+
+static void dns_next(void) __reentrant
+{
+	uint8_t k = 0;
+
+	if (dns_state.conn) {
+		uip_udp_remove(dns_state.conn);
+		dns_state.conn = 0;
+	}
+	if (dns_used(dns_state.server[0]))
+		dns_cand[k++] = dns_state.server[0];
+	if (dns_used(dns_state.server[1]))
+		dns_cand[k++] = dns_state.server[1];
+	if (dns_used(dhcp_state.dns))
+		dns_cand[k++] = dhcp_state.dns;
+	if (!k || dns_state.tries >= DNS_TRIES) {
+		dns_state.status = DNS_FAILED;
+		if (dns_state.verbose)
+			print_string(k ? "DNS: no answer\n" : "DNS: no server\n");
+		return;
+	}
+	k = dns_state.tries % k;
+	uip_ipaddr(dns_ip, dns_cand[k][0], dns_cand[k][1], dns_cand[k][2], dns_cand[k][3]);
+	dns_state.conn = uip_udp_new(&dns_ip, HTONS(DNS_PORT));
+	if (!dns_state.conn) {
+		dns_state.status = DNS_FAILED;
+		print_string("DNS: no free UDP connection\n");
+		return;
+	}
+	dns_state.send = 1;
+}
+
+
+static void dns_query(void) __reentrant
+{
+	__xdata uint8_t *p = (__xdata uint8_t *)uip_appdata;
+	__xdata char *n = dns_state.name;
+	__xdata uint8_t *label;
+	uint16_t len = 12;
+
+	dns_state.id++;
+	p[0] = dns_state.id >> 8;
+	p[1] = dns_state.id;
+	p[2] = 0x01;
+	p[3] = 0x00;
+	p[4] = 0;
+	p[5] = 1;
+	p[6] = p[7] = p[8] = p[9] = p[10] = p[11] = 0;
+	while (*n) {
+		label = p + len++;
+		*label = 0;
+		while (*n && *n != '.') {
+			p[len++] = *n++;
+			(*label)++;
+		}
+		if (*n)
+			n++;
+	}
+	p[len++] = 0;
+	p[len++] = 0;
+	p[len++] = 1;
+	p[len++] = 0;
+	p[len++] = 1;
+	uip_udp_send(len);
+}
+
+
+static uint16_t dns_skip_name(__xdata uint8_t *p, uint16_t i, uint16_t len) __reentrant
+{
+	while (i < len) {
+		if (!p[i])
+			return i + 1;
+		if ((p[i] & 0xc0) == 0xc0)
+			return i + 2;
+		i += p[i] + 1;
+	}
+	return len;
+}
+
+
+static void dns_answer(void) __reentrant
+{
+	__xdata uint8_t *p = (__xdata uint8_t *)uip_appdata;
+	uint16_t len = uip_datalen();
+	uint16_t i, an;
+
+	if (dns_state.status != DNS_PENDING || len < 12 || !(p[2] & 0x80)
+	    || p[0] != (uint8_t)(dns_state.id >> 8) || p[1] != (uint8_t)dns_state.id)
+		return;
+	an = ((uint16_t)p[6] << 8) | p[7];
+	i = dns_skip_name(p, 12, len) + 4;
+	while (!(p[3] & 0x0f) && an-- && i + 10 <= len) {
+		i = dns_skip_name(p, i, len);
+		if (i + 10 > len)
+			break;
+		if (!p[i] && p[i + 1] == 1 && !p[i + 8] && p[i + 9] == 4 && i + 14 <= len) {
+			memcpy(dns_state.addr, p + i + 10, 4);
+			dns_state.status = DNS_DONE;
+			uip_udp_remove(dns_state.conn);
+			dns_state.conn = 0;
+			if (dns_state.verbose) {
+				print_string("DNS: ");
+				print_string_x(dns_state.name);
+				print_string(" is ");
+				print_ip(dns_state.addr);
+				write_char('\n');
+			}
+			return;
+		}
+		i += 10 + (((uint16_t)p[i + 8] << 8) | p[i + 9]);
+	}
+	dns_state.tries = DNS_TRIES;
+	dns_next();
+}
+
+
+void dns_init(void) __banked
+{
+	memset(dns_state.server, 0, sizeof(dns_state.server));
+	dns_state.name[0] = 0;
+	dns_state.status = DNS_IDLE;
+	dns_state.conn = 0;
+}
+
+
+void dns_lookup(void) __banked
+{
+	if (dns_name_is_ip()) {
+		dns_state.status = DNS_DONE;
+		return;
+	}
+	dns_state.tries = 0;
+	dns_state.status = DNS_PENDING;
+	dns_next();
+}
+
+
+void dns_show(void) __banked
+{
+	print_string("DNS servers ");
+	print_ip(dns_state.server[0]);
+	write_char(' ');
+	print_ip(dns_state.server[1]);
+	print_string(", from DHCP ");
+	print_ip(dhcp_state.dns);
+	write_char('\n');
+	if (!dns_state.name[0])
+		return;
+	print_string("Last lookup ");
+	print_string_x(dns_state.name);
+	print_string(": ");
+	if (dns_state.status == DNS_DONE)
+		print_ip(dns_state.addr);
+	else if (dns_state.status == DNS_PENDING)
+		print_string("pending");
+	else
+		print_string("failed");
+	write_char('\n');
+}
+
+
+void dns_callback(uint16_t lport) __banked __reentrant
+{
+	if (!dns_state.conn || lport != dns_state.conn->lport)
+		return;
+	if (uip_newdata()) {
+		dns_answer();
+		return;
+	}
+	if (dns_state.status != DNS_PENDING)
+		return;
+	if (dns_state.send) {
+		dns_state.send = 0;
+		dns_state.sent = ticks;
+		dns_query();
+		return;
+	}
+	if (ticks - dns_state.sent >= DNS_TIMEOUT) {
+		dns_state.tries++;
+		dns_next();
+	}
+}
@@ -0,0 +1,36 @@
+#ifndef _DNS_H_
+#define _DNS_H_
+
+#include <stdint.h>
+
+#define DNS_NAME_LEN	48
+
+#define DNS_IDLE	0
+#define DNS_PENDING	1
+#define DNS_DONE	2
+#define DNS_FAILED	3
+
+struct uip_udp_conn;
+
+struct dns_state {
+	uint8_t server[2][4];	/* configured servers, 0.0.0.0 = unused */
+	char name[DNS_NAME_LEN];	/* name of the current or last lookup */
+	uint8_t addr[4];	/* address found by the last lookup */
+	uint8_t status;		/* DNS_* */
+	uint8_t verbose;	/* print the result of the lookup */
+	uint8_t tries;		/* queries sent for the current lookup */
+	uint8_t send;		/* a query is due on the connection */
+	uint16_t id;
+	uint32_t sent;		/* ticks when the last query went out */
+	struct uip_udp_conn *conn;
+};
+
+extern __xdata struct dns_state dns_state;
+
+void dns_init(void) __banked;
+void dns_lookup(void) __banked;
+void dns_show(void) __banked;
+void dns_callback(uint16_t lport) __banked __reentrant;
+void dns_parse(void) __banked __reentrant;
+
+#endif
@@ -0,0 +1,63 @@
+/*
+ * Command line interface of the DNS resolver for the RTL837x platform
+ * This code is in the Public Domain
+ */
+
+#include <stdint.h>
+#include "rtl837x_common.h"
+#include "cmd_parser.h"
+#include "dns.h"
+
+#pragma codeseg BANK2
+#pragma constseg BANK2
+
+extern __xdata uint8_t cmd_buffer[CMD_BUF_SIZE];
+extern __xdata uint8_t cmd_words_len;
+extern __xdata uint8_t cmd_words_b[15];
+extern __xdata uint8_t ip[4];
+uint8_t cmd_compare(uint8_t start, __code const uint8_t * cmd);
+uint8_t parse_ip(uint8_t idx);
+
+
+void dns_parse(void) __banked __reentrant
+{
+	__xdata uint8_t *s;
+	uint8_t n;
+
+	if (cmd_words_len < 2) {
+		dns_show();
+		return;
+	}
+	if (cmd_compare(1, "server") && cmd_words_len >= 3 && parse_ip(cmd_words_b[2])) {
+		memcpy(dns_state.server[0], ip, 4);
+		memset(dns_state.server[1], 0, 4);
+		if (cmd_words_len >= 4) {
+			if (!parse_ip(cmd_words_b[3]))
+				goto err;
+			memcpy(dns_state.server[1], ip, 4);
+		}
+		return;
+	}
+	if (cmd_compare(1, "lookup") && cmd_words_len >= 3) {
+		if (dns_state.status == DNS_PENDING) {
+			print_string("DNS: a lookup is already running\n");
+			return;
+		}
+		s = &cmd_buffer[cmd_words_b[2]];
+		for (n = 0; s[n] && s[n] != ' '; n++) {
+			if (n == DNS_NAME_LEN - 1)
+				goto err;
+			dns_state.name[n] = s[n];
+		}
+		dns_state.name[n] = 0;
+		dns_state.verbose = 1;
+		dns_lookup();
+		if (dns_state.status == DNS_DONE) {
+			print_ip(dns_state.addr);
+			write_char('\n');
+		}
+		return;
+	}
+err:
+	print_string("Error: dns [server <ip> [<ip>]|lookup <name>]\n");
+}
@@ -0,0 +1,40 @@
+### 2M-PCB23-V3.2
+
+## Brands
+|Brand|Type|Managed|PCB|Flash|Chip RTL|
+|---|---|---|---|---|---|
+| keepLINK | KP-9000-9XHML-X | Yes|  2M-PCB23-V3.2 | 2M (Winbond 25Q) | |
+
+The original web interface reports this board as hardware version V3.2
+(original firmware V100.9.25, January 2026).
+
+## PCB
+
+<img src="photos/2M-PCB23-V3.2-managed/2M-PCB23-V3.2-top.jpeg" width="300" />
+
+## Compared to V3.1
+
+The component placement matches [2M-PCB23-V3.1](2M-PCB23-V3_1.md): same
+positions for the flash (U8), the T7/T8/T9/T10 headers, the SFP cage and its
+LED, and the unpopulated U7/U9 footprints. Build with
+`MACHINE=KP_9000_9XHML_X_V3_2`, which uses the V3.1 machine definition and
+only differs in the reported name.
+
+## Tested
+
+Installed from the original firmware through its web interface with
+`installer/output/rtlplayground_oem_upgrade.bin`, then:
+
+- RJ45 ports link at 2.5G; LEDs: orange at 2.5G, green below
+- SFP port: module detected with vendor/model/serial and DOM readings
+  (temperature, Vcc, TX bias, TX/RX power), link up at 10G
+- factory MAC read from flash (0x1FC000)
+- reset button (GPIO48): held for more than 10 s it restores the default config
+
+## Flash access
+
+Reading the flash in-circuit with a SOIC-8 clip did not work: the chip ID
+comes back as `EF FF FF` (only the manufacturer byte is right) and reads
+return 0xff, the same as on a V3.1 board. The switch chip is powered through
+the clip and keeps driving the SPI lines. Make sure a way back is acceptable
+before installing, or hold the switch chip in reset while reading.
@@ -0,0 +1,75 @@
+# Hasivo S1100WP-8GT-1SX-SE
+
+RTL8373-based 8×2.5G PoE + 1×SFP switch.
+
+### Label specifications
+
+- **Manufacturer**: Hasivo
+- **Model**: S1100WP-8GT-1SX-SE
+- **Ports**:
+  - 8 × RJ45: 10/100/1000/2500 Mbps with PoE
+  - 1 × SFP: 1G / 2.5G / 10G
+- **Power input**: DC 52V 2.5A
+- **Stock firmware defaults**: IP 192.168.0.1, user/password `admin`/`admin`
+
+### What works
+
+- All eight 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps (PoE is not configurable via RTLPlayground)
+- SFP port supporting 1G, 2.5G and 10G modules
+- LEDs: green (2.5G) and amber (1G/100M/10M) per copper port; combined link/act on the SFP port
+
+### Photos
+
+Front panel:
+
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/front.jpg" width="600" />
+
+Label:
+
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/label.jpg" width="600" />
+
+### PCB overview
+
+Top side:
+
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/pcb_top.jpg" width="600" />
+
+Bottom side:
+
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/pcb_bottom.jpg" width="600" />
+
+### Port layout
+
+| Logical port | Physical port | Type   |
+|--------------|---------------|--------|
+| 1-8          | 1-8           | Copper |
+| 9            | 9             | SFP    |
+
+### LED configuration
+
+Copper ports use LED SET0, the SFP port uses LED SET1.
+
+| SET  | LED0                                          | LED2                                                 |
+|------|-----------------------------------------------|------------------------------------------------------|
+| SET0 | Green — lights on 2.5G link with activity     | Amber — lights on 1G / 100M / 10M link with activity |
+| SET1 | All speeds — lights on any link with activity | —                                                    |
+
+### SFP GPIO assignments
+
+| SFP (logical 9) | pin_detect (ModAbs) | pin_los | pin_tx_disable | SerDes | I2C SDA         | I2C SCL             |
+|-----------------|---------------------|---------|----------------|--------|-----------------|---------------------|
+| SFP             | GPIO30_ACL_BIT3_EN  | GPIO37  | GPIO_NA        | SDS1   | GPIO39_I2C_SDA4 | GPIO40_I2C_SCL3_MDC1 |
+
+### Machine configuration
+
+- `reset_pin`: GPIO54_ACL_BIT2_EN
+- High LEDs (pads 27-29): mux = `LED_27 | LED_28_SYS | LED_29`, enable = `LED_28_SYS | LED_29`
+
+### PoE
+
+The 8 copper ports support PoE powered by a DC 52V 2.5A input. Power management is handled by two HS104PTI chipsets over I2C (GPIO47_I2C_SDA0, GPIO46_I2C_SCL0):
+
+* Chip 1 (I2C address 0x1A): 2.5G Ports 1–4
+* Chip 2 (I2C address 0x2A): 2.5G Ports 5–8
+
+Note: The current implementation does not yet support PoE management. Consequently, PoE currently operates in standalone mode without software control.
@@ -0,0 +1,122 @@
+# ONT-S207CW-62TS-SE / Binardat 2G06-04210GSM / Binardat 2G06-04210GS
+
+## Overview
+
+ONT-S207CW-62TS-SE, Binardat 2G06-04210GSM (managed), and Binardat 2G06-04210GS (unmanaged) are **switches with identical hardware**:
+- **CPU:** RTL8372N (confirmed via serial: "Detecting CPU: RTL8372N")
+- **Flash:** GD25Q128E (16MB)
+- **Ports:** 4x 2.5G RJ45 + 2x 10G SFP+
+- **Console:** 115200 baud (RTLPlayground firmware) / 9600 baud (stock firmware)
+
+**Note:** These devices are **RTL8372N-based** with **LAN ports mounted upside-down on the PCB**, requiring a custom configuration. The `MACHINE_ONT_S207CW_62TS_SE` definition uses a **custom configuration** with:
+- Corrected port mapping (physical ports 1-4 = RJ45, 5-6 = SFP)
+- Optimized LED sets for different port wiring (RJ45 Ports 1-2 have reversed LED wiring)
+- Custom LED mux configuration
+
+## Device Photos
+
+### Binardat 2G06-04210GSM
+
+**Front View:**
+<img src="photos/ONT-S207CW-Binardat-2G06-04210GSM/binardat-2g06-04210gsm-front.jpg" width="400" />
+
+**Back View:**
+<img src="photos/ONT-S207CW-Binardat-2G06-04210GSM/binardat-2g06-04210gsm-back.jpg" width="400" />
+
+**PCB View:**
+<img src="photos/ONT-S207CW-Binardat-2G06-04210GSM/binardat-2g06-04210gsm-pcb.jpg" width="400" />
+
+*Photos courtesy of [andreas5232](https://github.com/andreas5232) from [emesix/ONT-S207CW-62TS-SE#1](https://github.com/emesix/ONT-S207CW-62TS-SE/issues/1)*
+
+## Hardware Specification
+
+| Feature | Value |
+|---|---|
+| **CPU** | RTL8372N |
+| **Flash** | GD25Q128E (16MB) |
+| **RAM** | Integrated in RTL8372N |
+| **RJ45 Ports** | 4x 2.5GBase-T (Ports 1-4) |
+| **SFP+ Ports** | 2x 10G (Ports 5-6) |
+| **Console** | UART (115200 baud for RTLPlayground, 9600 baud for stock) |
+| **Stock Web UI IP** | 192.168.2.1 |
+| **Loader Mode IP** | 192.168.10.247 |
+
+## Port Layout
+
+```
+┌─────────────────────────────────────────────┐
+│  ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐   ┌─────┐ ┌─────┐  │
+│  │RJ45 │ │RJ45 │ │RJ45 │ │RJ45 │   │SFP+ │ │SFP+ │  │
+│  │  1  │ │  2  │ │  3  │ │  4  │   │  5  │ │  6  │  │
+│  └─────┘ └─────┘ └─────┘ └─────┘   └─────┘ └─────┘  │
+│                                                     │
+│  [System LEDs]                                      │
+└─────────────────────────────────────────────┘
+```
+
+## LED Behavior
+
+### RJ45 Ports (Physical 1-4)
+
+| LED Color | Speed |
+|---|---|
+| **Green** | 2.5G |
+| **Orange** | 1G / 100M / 10M |
+| **Off** | No link |
+
+### SFP+ Ports (Physical 5-6)
+
+| LED Color | Speed |
+|---|---|
+| **Green** | 10G |
+| **Orange** | 2.5G / 1G |
+| **Off** | No link / No SFP module |
+
+## Port to Logical Mapping
+
+Custom mapping for ONT-S207CW-62TS-SE:
+
+| Physical Port | Logical Port | Type | LED Set |
+|---|---|---|---|
+| 1 | 7 | RJ45 | 2 |
+| 2 | 6 | RJ45 | 2 |
+| 3 | 5 | RJ45 | 0 |
+| 4 | 4 | RJ45 | 0 |
+| 5 | 3 | SFP+ (SDS0) | 3 |
+| 6 | 8 | SFP+ (SDS1) | 3 |
+
+**Note:** Ports 1-2 (RJ45) have reversed LED wiring and use LED-Set 2. SFP Ports 5-6 use LED-Set 3 to account for wiring differences.
+
+## Flashing Instructions
+
+See the [README.md](../../README.md) for general flashing instructions.
+
+## Stock Firmware Information
+
+| Property | Value |
+|---|---|
+| **Default IP** | 192.168.2.1 (ONT) / 192.168.10.247 (Loader Mode) |
+| **Default Login** | admin/admin (may vary by OEM) |
+| **Console Baud** | 9600 (stock) / 115200 (RTLPlayground) |
+| **CPU String** | "RTL8372N" |
+| **Loader Mode IP** | 192.168.10.247 |
+
+## Configuration Details
+
+- **CPU:** RTL8372N
+- **SFP:** SDS0 on logical port 3 (GPIO37), SDS1 on logical port 8 (GPIO38)
+- **Port Mapping:** Physical 1-4 → Logical 7-4, Physical 5-6 → Logical 3,8
+- **LED Wiring:** RJ45 Ports 1-2 and SFP Port 6 have reversed LED pins (orange/green swapped)
+- **LED Sets:** Set 0 for RJ45 Ports 3-4, Set 1 unused, Set 2 for RJ45 Ports 1-2, Set 3 for SFP Ports 5-6
+
+## Notes
+
+- ONT-S207CW-62TS-SE, Binardat 2G06-04210GSM (managed), and Binardat 2G06-04210GS (unmanaged) are **RTL8372N-based** with **LAN ports mounted upside-down on the PCB**
+- Web UI shows correct physical port order (1-2-3-4 for RJ45, 5-6 for SFP)
+- Loader Mode always remains accessible at `192.168.10.247` for recovery
+- Serial console: 9600 baud (stock) → 115200 baud (RTLPlayground)
+
+## References
+
+- [GitHub Issue: emesix/ONT-S207CW-62TS-SE#1](https://github.com/emesix/ONT-S207CW-62TS-SE/issues/1) - Original photos and discussion
+- [PR: logicog/RTLPlayground#465](https://github.com/logicog/RTLPlayground/pull/465) - Feedback and improvements
@@ -1,9 +1,10 @@
 # SWTG018AS-A V2.0
 ## Brands
 | Brand   | Type             |Managed| PCB              | Flash           | Chip RTL      |
-|--------|------------------|-------|------------------|-----------------|---------------|
+|---------|------------------|-------|------------------|-----------------|---------------|
 | Ampcom  | SWTG018AS-A V2.0 | No    | SWTG018AS-A V2.0 | 2MB             | 8273N + 8224N |
 | Horaco  | HC-SWTGW218AS-A  | Yes   | SWTG018AS-A V2.0 | 2MB(25Q16JVSIQ) | 8273N + 8224N |
+| GoodTop | GT-ST018M        | Yes   | SWTG018AS-A V2.0 | ?               | 8273N + 8224N |


 The following is a documentation for the unmanaged switch marked as `SWTG018AS-A V2.0`.
@@ -0,0 +1,23 @@
+# DNS
+
+The switch can resolve host names to IPv4 addresses, for the NTP client and
+for anything else that is given a name instead of an address.
+
+```
+dns server <ip> [<ip>]   # one or two servers, 0.0.0.0 removes them
+dns lookup <name>        # resolve a name and print the address
+dns                      # show the servers and the last lookup
+```
+
+The answer to a lookup arrives after the command has returned, so it is
+printed on the serial console and in the syslog. In the console of the web
+interface, run `dns` afterwards to see it.
+
+Without a configured server the resolver uses the one handed out by DHCP.
+Only address records are looked up; a query goes to the servers in turn,
+every two seconds, and gives up after six tries. A name that already is a
+dotted address is taken as it is, without a query.
+
+The DNS servers are set in the Network card of the System page as well.
+Settings made there or on the console are kept only once the configuration is
+saved.
@@ -0,0 +1,79 @@
+# The health command
+
+`health` prints a one-page snapshot of the firmware's vital signs on the
+serial console. It exists for the situations where the switch misbehaves and
+every probe from the network measures the network instead of the device: the
+dump is taken from inside, costs one command, and works while HTTP does not.
+
+```
+> health
+up 0000001f ticks 0x00001f4c loops 0x000016da rx 0x024e
+link max 01 slow 0x0000
+sfp  max 74 slow 0x0001
+rx   max 00 slow 0x0000
+tx   max 00 slow 0x0000
+stp  max 04 slow 0x0001
+cmd  max 02 slow 0x0001
+sp 80 untouched 62
+tcp st 00 tmr 00 rtx 00 rto 00 len 0x0000 mss 0x05b4
+  lport 0x0000 rport 0x0000 rip 0x0000 0x0000
+httpd left 0x0000 entry 00 stp 01 mvlan 0x0002
+```
+
+The instrumentation is not part of a default build. It costs about 1.1 kB
+of bank 2, a few bytes of xdata and seven banked calls per main-loop pass,
+which is nothing a user needs unless they are chasing a problem, so it is
+switched on at build time:
+
+```
+make MACHINE=SWTGW218AS HEALTH=1
+```
+
+Without it the hooks compile to nothing and `health` is not a command.
+
+All figures are raw hex. The counters are cumulative: take two dumps a known
+time apart and the differences give the rates.
+
+## The first line
+
+`up` is the seconds counter, `ticks` the system tick (200 per second),
+`loops` the number of main-loop passes and `rx` the frames handle_rx has
+taken off the NIC. A healthy loop completes one pass per tick, so the
+difference in `loops` tracks the difference in `ticks`; a loop that falls
+behind is being held up by one of the phases below. The `rx` rate separates
+a flooded CPU port from a stalled loop, which look identical from outside.
+
+## Phases
+
+Each line is one section of the main loop: the link poll, SFP handling,
+frame reception, TCP transmission, the STP timers and the command dispatch.
+`max` is the worst time that section has taken, in ticks of 5 ms; `slow`
+counts the passes that took two ticks or more. A misbehaving subsystem
+names itself here, which is the difference between knowing that the loop is
+slow and knowing why.
+
+A dump of its own output takes the console some milliseconds, so running
+`health` repeatedly increments the `cmd` counters by itself. That is the
+instrument observing itself, not a fault.
+
+## Stack
+
+At boot the free stack area is painted with a pattern. `sp` is the live
+stack pointer; `untouched` counts the painted bytes still intact at the top,
+which is the closest thing to a high-water mark this hardware offers. A
+shrinking `untouched` across dumps means something is reaching deeper than
+anything before it.
+
+## The TCP slot
+
+The connection table is printed whole, one slot per pair of lines: TCP
+state (3 is ESTABLISHED, 0 closed), retransmission timer and counter, bytes
+in flight, negotiated MSS, then the ports and the peer address. With a
+single slot serving the entire web interface, one glance answers the
+question every management outage starts with: who is holding it. A slot
+showing state 3 with nothing in flight and a peer that no longer answers is
+a connection whose owner went away.
+
+`httpd left` and `entry` describe the file transfer the web server believes
+it is in the middle of, and the trailing flags show whether STP is running
+and which VLAN carries management.
@@ -69,18 +69,26 @@ The code currently provides the following functions:
 void igmp_setup(void) __banked;
 void igmp_enable(void) __banked;
 void igmp_router_port_set(uint16_t pmask) __banked;
-void igmp_packet_handler(void) __banked;
+uint8_t igmp_packet_handler(void) __banked;
 void igmp_show(void) __banked;
 ```c
 `igmp_setup()` is called at boot-time and configures flooding of all IP-MC packets by
-default, as otherwise no IP-MC would be possible in the network.
+default, as otherwise no IP-MC would be possible in the network. `igmp off` calls it as
+well; groups learned while IGMP was on stay in the table, but are no longer looked up.

 `igmp_enable()`starts IGMP which cause IGMP packets to be handled by the CPU and forwarding
 of IP-MC packets to be limited to only subscribed ports.

 `igmp_router_port_set()`configures forwarding ports for IGMP messages.

-`igmp_packet_handler()` implements handling of trapped IGMP packets by the CPU.
+`igmp_packet_handler()` implements handling of trapped IGMP packets by the CPU. It is called
+for frames to 01:00:5e:xx:xx:xx and returns 0 when the frame is not a trapped IGMP packet,
+so that it is passed on to the IP stack. IGMPv1/v2 reports (0x12, 0x16) join the group given
+in the IGMP header, IGMPv2 leaves (0x17) leave it, IGMPv3 reports use the first group record
+(type 4 joins, type 3 leaves). Trapped IGMP frames arrive without a VLAN tag.
+Reports for groups in 224.0.0.0/24 are ignored: the switch floods that block
+even with IGMP on, and an entry for a group such as 224.0.0.251 (mDNS) would
+otherwise limit it to the ports that reported it, as RFC 4541 warns against.

 `igmp_show()` prints out the IGMP configuration on the CLI.

@@ -73,13 +73,14 @@ without being flooded to the other ports. No bridge relays these frames:
 their addresses are in the set that 802.1D-2004 clause 7.12.6 forbids a
 bridge to forward, and what travels the network is the information, with
 every bridge regenerating BPDUs of its own on its designated ports. The reserved-multicast *trap* action
-cannot do that on this hardware, because its destination is an external CPU
-attached to a physical port, which these boards do not populate. The protocol
-modules therefore leave the reserved-multicast action at *forward* and constrain
-the egress with a static L2 multicast entry instead: the lookup hits the entry's
-own port mask rather than the VLAN flood mask. Verified on a SWTGW218AS both
-ways, with the CPU bit cleared, where delivery stops, and with the CPU bit alone,
-where nothing egresses.
+does that: it delivers to the port named in `EXT_CPU_CTRL` (0x6724), which
+`trap_init()` sets to 9, the CPU port, at startup; with the reset value 0xf it
+names no port and the trapped frame is dropped. STP traps its address while it
+runs (see stp.md). Where the action is left at *forward*, the egress can be
+constrained with a static L2 multicast entry instead: the lookup hits the
+entry's own port mask rather than the VLAN flood mask. Verified on a SWTGW218AS
+both ways, with the CPU bit cleared, where delivery stops, and with the CPU bit
+alone, where nothing egresses.

 `port_l2mc_set()` writes one such entry. The SMI layout is the L2 multicast
 variant of the table entry:
@@ -0,0 +1,155 @@
+# LACP (Link Aggregation Control Protocol, IEEE 802.3ad)
+
+A static link aggregation group works only if both ends are configured for the
+same links, and nothing checks that they are. LACP lets the two ends agree on
+which links reach the same partner, aggregates only those, and takes a link out
+of the group when the partner stops answering.
+
+The switch runs LACP in software on the 8051. LACP frames belong to the Slow
+Protocols, with destination `01:80:C2:00:00:02` and ethertype `0x8809`; the
+subtype of LACP frames is 1. The implementation has the Receive, Selection and
+Mux machines of 802.3ad clause 43 and does not aggregate links whose partners
+differ. Up to `LACP_NUM_LAGS` (4) groups can run LACP; the others stay static.
+
+## Getting the frames to the CPU
+
+While LACP runs, the reserved multicast action for `01:80:C2:00:00:02` is
+*trap*, the same mechanism STP uses for its BPDUs, see [stp.md](stp.md). A
+trapped LACPDU has no VLAN tag after the RTL tag, and `TRAP_RX_BODY()` gives the
+offset of the LACPDU in the received frame. When the last group leaves LACP,
+the action goes back to *drop*.
+
+## What has to match across the members
+
+802.3ad requires that every link in an aggregate be full duplex and run at the
+same speed. Beyond the standard, anything that changes how a frame is treated
+has to be identical across members, because the hash picks the member per frame
+and a difference would make the behaviour depend on that choice:
+
+* must match: speed and duplex, VLAN membership and pvid, ingress filtering,
+  port isolation
+* may differ: EEE, LED configuration, counters, cable diagnostics
+
+None of this is enforced yet — `port_lag_members_set()` writes a member mask and
+a hash setting and validates nothing. See #377 for the discussion of whether a
+mismatch should be rejected or applied to the whole group.
+
+## Protocol timing
+
+The timer values are in units of the LACP timer, which steps every four ticks
+of the system clock, 50 times per second:
+
+| Constant             | Value | Time |
+|----------------------|-------|------|
+| `LACP_FAST_PERIODIC` | 50    | 1 s  |
+| `LACP_SLOW_PERIODIC` | 1500  | 30 s |
+| `LACP_SHORT_TIMEOUT` | 200   | 4 s  |
+
+802.3ad specifies a fast periodic time of 1 s with a short timeout of 3 s, and a
+slow periodic time of 30 s with a long timeout of 90 s. The switch transmits at
+the rate the partner asks for with its TIMEOUT bit. Its own timeout is always
+the short one, one second above the standard, so a partner that stops sending
+while its link stays up leaves the trunk after 4 s.
+
+The Partner block of a transmitted LACPDU repeats the partner's actor
+information as it was last received: system priority, system, key, port
+priority, port and state. A Linux partner sets our SYNC only when this block
+matches what it sent.
+
+## LACP API
+
+```
+void lacp_init(void) __banked;
+void lacp_off(void) __banked;
+void lacp_lag_set(uint8_t lag, __xdata uint16_t ports) __banked;
+void lacp_in(void) __banked;
+void lacp_timers(void) __banked;
+void lacp_show(void) __banked;
+```
+
+`lacp_init()` has to run before the startup configuration replays, because xdata
+is not zeroed and the port-to-LAG map uses `0xff` as "no LAG"; a stray zero would
+make a port look like it belongs to LAG 0.
+
+## LACP configuration on the serial console
+
+A group is put under LACP by adding `lacp` to the `lag` command:
+
+```
+lag 1 lacp 7 8      # ports 7 and 8 become LACP candidates of group 1
+lag 1 lacp off      # group 1 leaves LACP, its trunk is cleared (so does "lag 1 lacp")
+lag 1 d             # group 1 disabled, whether it ran LACP or not
+lag 1 7 8           # plain static aggregation, no protocol
+```
+
+A group put under LACP gives up the static trunk it had: the hardware trunk is
+cleared and rebuilt from the ports that converge. The other way round, `lag 1 d`
+and a static member list take the group out of LACP before they touch the
+trunk. A port named in another LACP group moves to the new one. The protocol
+starts with the first group put under LACP and stops when the last one is taken
+out; there is no separate switch for it. Two commands act on the whole engine:
+
+```
+lacp off            # every group leaves LACP, protocol stopped
+lacp show
+```
+
+`lacp show` prints the engine state, then one line per group with its candidate
+ports, the elected aggregator and the trunk members actually programmed into the
+hardware, then one line per port with the actor and partner state bytes and the
+receive-machine state.
+
+## LACP configuration via the Web Interface
+
+Each group on the LAG page has a Static/LACP mode next to its member ports;
+for an LACP group it shows the elected aggregator and the active members. Below
+the groups a table has one row per LACP port with its group, actor and partner
+state, receive state, LACPDU count and partner system. The page reads
+`/lacp.json` every three seconds while it is open. The member checkboxes of a
+static group come from the hardware registers in `/lag.json`.
+
+## A test with a Linux 802.3ad bond
+
+Two ports of the switch to two interfaces of one host:
+
+```
+ip link add bond0 type bond mode 802.3ad
+ip link set enp1s0 down && ip link set enp1s0 master bond0
+ip link set enp2s0 down && ip link set enp2s0 master bond0
+ip link set bond0 up
+```
+
+On the switch, with those two ports as the group:
+
+```
+lag 1 lacp 7 8
+```
+
+`lacp show` should then give both ports an actor state of `0x3f` (ACTIVITY,
+TIMEOUT, AGGREGATION, SYNC, COLLECTING and DISTRIBUTING), a partner state with
+SYNC set, and the partner's system MAC. `lag show` lists the trunk members as
+programmed in the hardware and should show both ports.
+
+On the host, `/proc/net/bonding/bond0` should show the same `Aggregator ID` for
+both slaves; different IDs mean that each link is in a group of its own. Both
+churn states should read `none`.
+
+Further checks:
+
+* `tcpdump -i enp1s0 ether proto 0x8809` on each slave shows the LACPDUs of the
+  switch and of that slave, never those of the other slave.
+* The host log has no `illegal loopback`.
+* The three reserved bytes after the actor state in a LACPDU from the switch
+  are zero.
+
+When one slave goes down, the group narrows to the remaining member, and the
+slave rejoins after it comes back.
+
+## Known limits
+
+* No Churn Detection machines and no Marker protocol.
+* Coupled Mux: collecting and distributing are enabled together.
+* One aggregator per group.
+* Selection compares the partner's system only, not its key: two aggregates
+  that one partner system offers on the same group land in one trunk here.
+* Member compatibility is not validated; see #377.
@@ -227,3 +227,7 @@ iperf Done.
 ```
 As you can see, the total throughput was 4.71 GBit/sec which is close to the
 maximum possible with a single 5GBit link.
+
+## LACP
+
+Dynamic aggregation with LACP is described in [lacp.md](lacp.md).
@@ -0,0 +1,33 @@
+# Time
+
+The switch has no battery backed clock. It counts seconds from power on, and
+it can take the date and time from an NTP server once the network is up. The
+time is lost at every restart and set again at the first synchronisation.
+
+```
+ntp server <name|ip>     # default pool.ntp.org
+ntp interval <1-1440>    # minutes between two synchronisations, default 60
+ntp timezone <+hh:mm>    # offset from UTC, -12:00 to +14:00
+ntp dst off|eu|us        # daylight saving rule
+ntp on
+ntp off
+ntp                      # settings and time
+time                     # local date and time
+```
+
+The client speaks SNTP version 4 and synchronises at once when turned on,
+then after every interval. A server given by name is resolved through the DNS
+resolver before every synchronisation. An answer from an unsynchronised
+server is ignored, and a failed attempt is repeated after 30 seconds.
+
+The local time is UTC plus the time zone offset, plus one hour while daylight
+saving time applies:
+
+* `eu`: from 01:00 UTC on the last Sunday of March to 01:00 UTC on the last
+  Sunday of October;
+* `us`: from 02:00 local time on the second Sunday of March to 02:00 local
+  time on the first Sunday of November.
+
+The same settings, with the current local time and the last synchronisation,
+are in the Time card of the System page. Settings made there or on the
+console are kept only once the configuration is saved.
@@ -0,0 +1,54 @@
+# Storm Control
+Storm control limits the rate at which a port admits broadcast, multicast,
+unknown unicast and unknown multicast frames. Frames of a type above its limit
+are dropped at ingress, so a loop or a misbehaving host cannot flood the rest
+of the network through that port. Known unicast traffic is not affected.
+
+## Commands
+```
+storm <port> bcast|mcast|ucast|umcast <rate> pps
+storm <port> bcast|mcast|ucast|umcast <rate> kbps
+storm <port> bcast|mcast|ucast|umcast off
+storm
+```
+`ucast` is unicast to a MAC address the switch has not learned yet, and
+`umcast` is multicast without an entry in the address table. Multicast groups
+get their entries from IGMP snooping, so without `igmp on` all multicast is
+unknown and only the `umcast` limit applies to it; `mcast` covers the groups
+IGMP has learned. A limit in
+packets per second goes from 1 to 1048575, a limit in kbit/s from 1 to
+10000000. `storm` without arguments prints the limits of every port. The
+limits are kept in the configuration like any other setting, and the Bandwidth
+page of the web interface has a Storm control card to set them.
+
+## Registers
+Each port and type has an enable bit and a meter index, and each limit uses
+one of the 64 shared meters of the switch. RTLPlayground gives every port and
+type its own meter, index `24 + port * 4 + type`, so one port's storm does not
+eat into the limit of another. Storm control uses meters 24 to 63 and leaves
+0 to 23 to the ACL. The limit of a meter is in `RTL837X_METER_RATE + 4 *
+meter`, and bit `meter % 32` of `RTL837X_METER_MODE + 4 * (meter / 32)`
+selects pps instead of kbit/s.
+```
+#define RTL837X_STORM_CTRL		0x54e4	/* + 4 * type, bit = port */
+#define RTL837X_STORM_MIDX		0x54f4	/* + 8 * type + 4 * (port / 5), 6 bits per port */
+#define RTL837X_METER_RATE		0x5cf0	/* + 4 * meter, 24 bits, kbit/s or pps */
+#define RTL837X_METER_MODE		0x5ef0	/* + 4 * (meter / 32), bit set = pps */
+```
+In kbit/s mode one step of the rate is 1 kbit/s. Measured with 100 and 1000 byte
+frames, the meter counts a frame with its FCS, but without preamble and
+interframe gap. Every meter has a bit that adds them, in `0x5f08 + 4 * (meter
+/ 32)`, which storm control leaves cleared. `IGBW_INC_IFG` and `EGBW_INC_IFG`
+are the matching bits of the bandwidth control.
+
+An ingress bandwidth limit on the same port works on the same arriving frames
+as the storm limit rather than after it, and the two together pass far less
+than either one: a 1 Mbit/s `umcast` limit with a 10 Mbit/s ingress limit let
+0.12 to 0.16 Mbit/s of a 1.4 Gbit/s stream through, where each alone passed
+1.17 and 10.2 Mbit/s.
+
+The type is 0 for broadcast, 1 for multicast, 2 for unknown unicast and 3 for
+unknown multicast. The burst size of a meter (0x5df0 + 4 * meter) counts packets
+in pps mode; its default of 0x2000 lets 8192 frames through before a pps limit
+bites, so a pps limit sets the burst to one second of traffic. A kbit/s limit
+puts back the default.
@@ -35,28 +35,34 @@ BPDUs are addressed to `01:80:C2:00:00:00`, a reserved link-local group. The
 ASIC's Reserved-Multicast action for that address decides what happens to the
 frame.

-Forwarding to the CPU port works normally: the 8051 sits behind an ordinary
-port of the internal switch and is an ordinary member of a forwarding mask.
-The *trap* action does not deliver to it. Its destination is an external CPU
-attached to a physical port (`cpuTag_externalCpuPort_set`, `EXT_CPU_CTRL` in
-the vendor SDK), which these boards do not populate. The ACL trap and
-redirect actions do not deliver to the 8051 either.
+While STP runs, the action is *trap*. A trap delivers to the port named in
+`EXT_CPU_CTRL` (0x6724), whose reset value 0xf names no port, and with that
+value the trapped frame is dropped at ingress. `trap_init()` sets it to 9, the
+port the 8051 sits behind, once at startup. The trap needs no per-VLAN L2
+entries, so it does not depend on which VLANs exist or on the PVIDs, and turning
+STP on no longer walks the whole VLAN table. BPDUs reach the CPU on a port that
+STP holds in blocking with either action: measured on a SWTGW218AS by sending
+BPDUs into a blocked port with forward and with trap, both ports stopped being
+edge and waited out the forward delay. The chip exempts this address from the
+ingress state check; the slow-protocols address used by LACP is not exempt.

-Delivery therefore uses the *forward* action, constrained to the CPU port
-by a static L2 multicast entry (`port_l2mc_set()`), one per VLAN in use:
+A trapped frame reaches the CPU in the format it came in with: unlike a
+forwarded one it has no VLAN tag inserted after the RTL tag, and the RTL tag
+carries the trap reason. `stp_in()` reads the BPDU from the offset
+`TRAP_RX_BODY()` returns, which works for both.

-* while STP runs, the entry's member mask is the CPU port only — BPDUs reach
-  the CPU and are not flooded to other ports, as a participating bridge
-  requires;
-* with STP off, the same entries are retargeted to all ports, restoring the
-  transparency an unmanaged switch is expected to have, so a surrounding
-  spanning tree can span *through* this device.
+With STP off, the action goes back to *forward* and a static L2 multicast
+entry per VLAN in use (`port_l2mc_set()`) targets all ports, restoring the
+transparency an unmanaged switch is expected to have, so a surrounding
+spanning tree can span *through* this device.

-A BPDU delivered this way is an ordinary frame to the port's ingress logic
-and passes through its acceptable-frame-type filter. BPDUs are untagged, so a
-port set to admit tagged frames only (`ingress <port>t`) never delivers one
-to the CPU. `stp_setup()` prints a warning for every STP-enabled port in that
-state.
+The port's acceptable-frame-type filter treats the two actions differently.
+BPDUs are untagged, so a port set to admit tagged frames only
+(`ingress <port>t`) drops a forwarded BPDU before it reaches the CPU, while a
+trapped one passes. Both were measured on a SWTGW218AS with `ingress 3t`:
+LACPDUs, delivered by forward, stopped arriving on port 3, and BPDUs sent into
+the same port, delivered by trap, kept arriving. A port that admits tagged
+frames only therefore takes part in STP.

 ## Link aggregation

@@ -7,6 +7,8 @@ The following devices have been tested and are fully working:
 | Davuaz   | Da-K6501W       | No      | [PCB-K0501W-V2.0](devices/K0501W_V2_0.md)                                 |       | 5 + 1 |
 | FOXNEO   | FNS-1200P       | No      | [PCB-K0402W-U13-V2.0](devices/FNS-1200P.md)                               | 2M    | 4 + 2 |
 | Goalake  | IG108           | No      | [PB-2132](devices/PB-2132.md)                                             | 4M    | 8 + 1 |
+| GoodTop  | GT-ST018M       | Yes     | [SWTG018AS-A V2.0](devices/SWTG018AS_A_V2_0.md)                           | ?     | 8 + 1 |
+| Hasivo   | S1100WP_8GT_1SX_SE | Yes  | [S1100WP_8GT_1SX_SE-V1.05](devices/HASIVO_S1100WP_8GT_1SX_SE.md)          | 2M    | 8 + 1 |
 | Hisource | Hi-K0402WS      | No      | [PCB-K0402WS-V3.0](devices/PCB-K0402WS-V3.0.md)                           |       | 4 + 2 |
 | Hisource | Hi-K0402WS      | No      | [PCB-K0402WS-V2.0](devices/PCB-K0402WS-V2.0.md)                           | 2M    | 4 + 2 |
 | Hisource | Hi-K0801WS      | No      | [PCB-KO801W-V2.0](devices/HI-K0801WS.md)                                  |       | 8 + 1 |
@@ -20,12 +22,15 @@ The following devices have been tested and are fully working:
 | Keeplink | KP-9000-6XH-X2 / KP-9000-6XHML-X2 | No/Yes | [2M-PCB43-V1.2 / V2.1](devices/KP-9000-6XH-X2.md) |       | 4 + 2 |
 | keepLINK | KP-9000-9XHML-X | Yes     | [2M-PCB23-V2.2](devices/2M-PCB23-V2_2.md)                                 | 2M    | 8 + 1 |
 | keepLINK | KP-9000-9XHML-X | Yes     | [2M-PCB23-V3.1](devices/2M-PCB23-V3_1.md)                                 | 2M    | 8 + 1 |
+| keepLINK | KP-9000-9XHML-X | Yes     | [2M-PCB23-V3.2](devices/2M-PCB23-V3_2.md)                                 | 2M    | 8 + 1 |
 | LIANGUO  | SWTG024AS       | No      | [SWTG024AS-v2.0-17452](devices/SWTG024AS.md)                              | 0.5M  | 4 + 2 |
 | Lianguo  | ZX-SWTGW215AS   | Yes     | [PCB-SWTG115AS-V2.0 / PCB-SWTG115AS-V2.1](devices/SWTGW215AS.md)          | 2M    | 5 + 1 |
 | Lianguo  | HYWS-SGT0108S   | No      | [2G5F_20G_V1.01](devices/HYWS-SGT0108S.md)                                | 0.5M  | 8 + 1 |
 | Mokerlink| 2G040210GSM     | Yes     | [2M-PCB43-V1.1](devices/2M-PCB43-V1.1.md)                                 |       | 4 + 2 |
 | Mokerlink| ZX-SWTGW218AS   | Yes     | [SWTG118AS-V2.0-16029](devices/SWTGW218AS.md)                             | 2M    | 8 + 1 |
 | MokerLink| POE-2G080110GS  | No      | [2M-PCB51-ML-V1.1](devices/2M-PCB51-ML-V1_1.md)                           | 4M    | 8 + 1 |
+| Binardat | 2G06-04210GSM    | No      | [PCB-SWTG024AS-A-2.0.1](devices/ONT-S207CW-62TS-SE.md)                 | 0.5M  | 4 + 2 |
+| ONT      | ONT-S207CW-62TS-SE | No   | [PCB-SWTG024AS-A-2.0.1](devices/ONT-S207CW-62TS-SE.md)                 | 0.5M  | 4 + 2 |
 | Netcore  | GS9             | No      | [PB-2132](devices/PB-2132.md)                                             | 4M    | 8 + 1 |
 | Ruiying  | RY-4GT-2SX      | No      | [FG-4GT-2SX_V2.0](devices/FG-4GT-2SX_V2.0.md)                             | 4M    | 4 + 2 |
 | Ruiying  | RY-8GT-1SX      | No      | [FG-8GT-1SX](devices/FG-8GT-1SX.md)                                       | 1M    | 8 + 1 |
@@ -2,8 +2,8 @@
 var LANG={
 en:{
 nav_dash:"Dashboard",nav_ports:"Ports",nav_stp:"Spanning tree",nav_stats:"Statistics",
-nav_vlan:"VLANs",nav_l2:"MAC table",nav_mirror:"Mirroring",nav_lag:"LAG",nav_eee:"EEE",
-nav_bw:"Bandwidth",nav_system:"System",nav_fw:"Firmware",
+nav_vlan:"VLANs",nav_l2:"MAC table",nav_mirror:"Mirroring",nav_isolate:"Isolation",nav_lag:"LAG",nav_eee:"EEE",
+nav_bw:"Bandwidth",nav_system:"System",nav_fw:"Firmware",nav_lldp:"LLDP",
 hdr_dirty:"unsaved changes",hdr_dirty_t:"Running config differs from startup config",
 hdr_save:"Save to flash",hdr_save_t:"Persist running configuration to flash",
 th_auto:"System",th_auto_sel:"System (Selenized)",sy_display:"Display",sy_theme:"Theme",sy_display_note:"Stored in this browser only.",th_light:"Light",th_dark:"Dark",
@@ -15,7 +15,7 @@ c_full:"full",c_half:"half",c_devices:"devices",c_yes:"yes",c_no:"no",
 d_ports:"Ports",d_ports_h:"click a port for details",d_system:"System",d_traffic:"Traffic",
 d_traffic_h:"packets/s, live",d_txpps:"TX pps",d_rxpps:"RX pps",d_txbad:"TX bad",d_rxbad:"RX bad",
 i_host:"Hostname",i_ip:"IP address",i_mask:"Netmask",i_gw:"Gateway",i_mac:"MAC",i_fw:"Firmware",
-i_built:"Built",i_hw:"Hardware",i_flash:"Flash",i_syslog:"Syslog",
+i_built:"Built",i_hw:"Hardware",i_temp:"Temperature",i_flash:"Flash",i_syslog:"Syslog",
 p_state:"State",p_disabled:"disabled",p_up:"up",p_txgb:"TX good / bad",p_rxgb:"RX good / bad",
 p_pkts:"pkts",p_module:"Module",p_temp:"Temperature",p_vcc:"Vcc",p_txbias:"TX bias",p_txpower:"TX power",
 p_rxpower:"RX power",p_txfault:"TX fault",p_txdis:"TX disabled",p_rxlos:"RX LOS",p_adv:"Advertising",
@@ -40,6 +40,7 @@ stp_en_q:"Enable spanning tree?",
 stp_en_d:"Ports start blocked and take up to twice the forward delay to reach forwarding; edge ports recover immediately.",
 stp_dis_q:"Disable spanning tree?",stp_dis_d:"All ports go straight to forwarding; loop protection is lost.",
 stp_cost_err:"Path cost must be 0-200000000",
+lldp_enabled: "LLDP Enabled",lldp_title:"Service Status",lldp_portname:"Name",lldp_enable:"Send Frames",
 st_title:"Port statistics",st_h:"totals since boot",st_txg:"TX good",st_txb:"TX bad",st_rxg:"RX good",
 st_rxb:"RX bad",st_details:"Details",st_counters:"MIB counters",st_nonzero:"non-zero only",
 st_autoref:"auto-refresh",st_counter:"Counter",st_value:"Value",st_fail:"failed to load counters",
@@ -62,7 +63,13 @@ l2_learned:"learned",l2_loading:"loading...",l2_failed:"load failed",l2_entries:
 l2_del_t:"Delete entry",l2_flush_q:"Flush all learned MAC entries?",
 m_title:"Port mirroring",m_active:"active",m_monitor:"Monitor port",m_mirror:"Mirror",m_both:"Both",
 m_note:"Both = mirror RX and TX of the port to the monitor port.",m_none:"Select at least one mirrored port",
+iso_title:"Port isolation",iso_from:"From port",iso_to:"To port",iso_all:"Allow all",
+iso_intro:"A frame entering a port may only leave through the ports ticked in its row. Isolation is decided before forwarding, so a port that is not ticked is unreachable directly, whatever the address table says.",
+iso_legend:"The cell of the port itself is always allowed. A port number in red marks a port that is not fully open.",
 lag_hash:"Hash:",lag_note:"A LAG needs at least one member to be saved in the startup config; applying an empty group clears it.",
+lacp_heading:"LACP (802.3ad)",lag_mode:"Mode",lag_static:"Static",lacp_neg:"negotiating",lacp_agg:"aggregator",
+lacp_members:"active members",lacp_hint:"LACP: select candidate ports and press Apply to start negotiation",
+lacp_actor:"Actor",lacp_partner:"Partner",lacp_rxstate:"RX state",lacp_rx:"LACPDUs received",lacp_psys:"Partner system",
 lag_clear_q:"Clear LAG {n}?",lag_clear_d:"All member ports return to normal operation.",
 e_title:"Energy Efficient Ethernet",e_adv:"Advertised",e_lp:"Link partner",e_active:"Active",e_enable:"Enable",
 e_note:"Advertised and link-partner flags per speed: 100M, 1G, 2.5G. SFP ports do not support EEE.",
@@ -70,8 +77,12 @@ e_idle:"idle",e_na:"n/a",
 bw_title:"Bandwidth limits",bw_h:"Mbit/s, 0.016-10000",bw_in:"Ingress limit",bw_out:"Egress limit",
 bw_exceed:"When exceeded",bw_fc:"Flow control",bw_drop:"Drop",
 bw_in_err:"Ingress limit must be 0.016-10000 Mbit/s",bw_out_err:"Egress limit must be 0.016-10000 Mbit/s",
+sc_title:"Storm control",sc_h:"per port and traffic type, empty = off",sc_bcast:"Broadcast",sc_mcast:"Multicast",
+sc_ucast:"Unknown unicast",sc_umcast:"Unknown multicast",sc_err:"Storm limit must be 1-1048575 pps or 1-10000000 kbit/s",
+sc_note:"Frames of a type above its limit are dropped where they enter the switch.",
 sy_network:"Network",sy_dhcp:"Use DHCP",sy_dhcp_t:"Request address via DHCP",sy_services:"Services",
 sy_igmp:"IGMP snooping",sy_sysip:"server IP",sy_server:"Server",sy_port:"Port",
+sy_sesstmo:"Session timeout (s)",sy_sesstmo_err:"Session timeout must be 1-65535 s",
 sy_services_note:"Service state reflects the startup config; runtime state is not readable.",
 sy_password:"Admin password",sy_newpw:"New password",sy_repeat:"Repeat",sy_pwapply:"Change password",
 sy_pw_note:"Takes effect immediately; save to flash to keep it after reboot.",sy_console:"Console",
@@ -82,7 +93,14 @@ sy_ip_err:"Invalid IP / netmask / gateway",sy_host_err:"Hostname: 1-23 printable
 sy_net_q:"Apply network settings?",sy_net_d:"The management IP changes to {ip}: this page will need to be reopened there.",
 sy_ip_changed:"IP changed, reconnect at http://{ip}/",sy_dhcp_q:"Switch to DHCP?",
 sy_dhcp_d:"The switch requests an address via DHCP. You must find its new IP to reconnect.",
-sy_sysip_err:"Invalid syslog server IP",sy_sysport_err:"Syslog port must be 1-65535",
+sy_sysip_err:"Invalid syslog server IP",sy_dns1:"DNS server",sy_dns2:"Second DNS",sy_dns_err:"Invalid DNS server IP",sy_dns_dhcp:"from DHCP: {ip}",
+sy_time:"Time",sy_ntp:"NTP",sy_ntpsrv:"NTP server",sy_ntpsrv_p:"host name or IPv4 address",sy_ntpint:"Poll interval [min]",
+sy_tz:"Time zone",sy_dst:"Daylight saving",sy_dst_eu:"Europe",
+sy_dst_us:"United States",sy_now:"Local time",
+sy_sync:"Last synchronisation",sy_ntpaddr:"Server address",sy_nosync:"not synchronised",sy_waiting:"waiting for the server",
+sy_ago:"{n} min ago",sy_ntp_err:"Enter the host name or IPv4 address of the NTP server",sy_ntpint_err:"Poll interval must be 1-1440",
+sy_time_note:"The switch has no battery backed clock: the time is lost at every restart and set again from the NTP server once the network is up. Save to flash to keep the settings.",
+sy_sysport_err:"Syslog port must be 1-65535",
 sy_pw_len:"Password: 1-20 characters",sy_pw_space:"Password cannot contain spaces",sy_pw_match:"Passwords do not match",
 sy_pw_q:"Change admin password?",sy_pw_d:"Takes effect immediately for new logins. Save to flash to persist.",
 sy_reboot_q:"Reboot the switch?",sy_reboot_d:"There are UNSAVED changes and they will be lost. Save to flash first if you want to keep them.",
@@ -90,6 +108,7 @@ sy_rebooting:"Rebooting, reconnect in about 20 s",sy_bytes:"bytes",
 cw_title:"Write this startup configuration?",cw_save_title:"Save running configuration to flash?",
 cw_info:"{n} / 2048 bytes, replayed line by line on every boot",
 cw_toolarge:"Too large: the config sector accepts at most 2048 bytes. Remove lines first.",
+cw_longline:"Line {n} is {m} bytes long: the switch can only replay lines up to 126 bytes and would skip it on boot, so the write is refused. Shorten it first.",
 cw_unknown:"Not in the known config grammar (will still be written): ",cw_empty:"(empty)",
 cw_writing:"Writing configuration...",cw_failed:"config write failed: HTTP {n}",
 cw_verify_fail:"Verification failed: flash content differs from what was sent. Command log NOT cleared.",
@@ -100,6 +119,7 @@ fw_intro:"Upload an RTLPlayground image (512 KiB .bin). The image is staged to f
 fw_upload:"Upload",fw_checking:"{f}: {n} bytes. Checking...",fw_size_err:"size is {n}, expected 524288 (512 KiB)",
 fw_magic_err:"missing bank header / LJMP magic: not a firmware image",fw_crc_err:"CRC16 check failed: corrupt image",
 fw_valid:"valid RTLPlayground image (size, magic and CRC16 OK)",fw_q:"Upload firmware?",
+fw_other:"This image was not built for this switch ({m}): its SFP, LED and button pins may differ. Upload it only if you are sure.",
 fw_d:"On a good checksum the switch resets itself and applies the image during boot (the startup config is preserved). Do not power it off until it comes back.",
 fw_finishing:"finishing flash write... {s} s",fw_uploading:"uploading... {p}% / {s} s",
 fw_verified:"checksum verified, the switch is rebooting...",
@@ -126,7 +146,7 @@ c_full:"全二重",c_half:"半二重",c_devices:"デバイス",c_yes:"はい",c_
 d_ports:"ポート",d_ports_h:"ポートをクリックすると詳細を表示",d_system:"システム",d_traffic:"トラフィック",
 d_traffic_h:"パケット/秒、リアルタイム",d_txpps:"TX pps",d_rxpps:"RX pps",d_txbad:"TX 異常",d_rxbad:"RX 異常",
 i_host:"ホスト名",i_ip:"IP アドレス",i_mask:"ネットマスク",i_gw:"ゲートウェイ",i_mac:"MAC",i_fw:"ファームウェア",
-i_built:"ビルド日",i_hw:"ハードウェア",i_flash:"フラッシュ",i_syslog:"Syslog",
+i_built:"ビルド日",i_hw:"ハードウェア",i_temp:"温度",i_flash:"フラッシュ",i_syslog:"Syslog",
 p_state:"状態",p_disabled:"無効",p_up:"アップ",p_txgb:"TX 正常 / 異常",p_rxgb:"RX 正常 / 異常",
 p_pkts:"pkts",p_module:"モジュール",p_temp:"温度",p_vcc:"電圧",p_txbias:"TX バイアス",p_txpower:"TX 電力",
 p_rxpower:"RX 電力",p_txfault:"TX 障害",p_txdis:"TX 無効",p_rxlos:"RX 信号ロス",p_adv:"アドバタイズ",
@@ -183,6 +203,7 @@ bw_exceed:"超過時の動作",bw_fc:"フロー制御",bw_drop:"破棄",
 bw_in_err:"入力制限は 0.016〜10000 Mbit/s の範囲で指定してください",bw_out_err:"出力制限は 0.016〜10000 Mbit/s の範囲で指定してください",
 sy_network:"ネットワーク",sy_dhcp:"DHCP を使用",sy_dhcp_t:"DHCP でアドレスを取得",sy_services:"サービス",
 sy_igmp:"IGMP スヌーピング",sy_sysip:"サーバー IP",sy_server:"サーバー",sy_port:"ポート",
+sy_sesstmo:"セッションタイムアウト (秒)",sy_sesstmo_err:"セッションタイムアウトは 1〜65535 秒で指定してください",
 sy_services_note:"サービスの状態は起動設定を反映しています。実行時の状態は読み取れません。",
 sy_password:"管理者パスワード",sy_newpw:"新しいパスワード",sy_repeat:"再入力",sy_pwapply:"パスワードを変更",
 sy_pw_note:"即時に反映されます。再起動後も保持するにはフラッシュに保存してください。",sy_console:"コンソール",
@@ -201,6 +222,7 @@ sy_rebooting:"再起動中です。約 20 秒後に再接続してください",
 cw_title:"この起動設定を書き込みますか?",cw_save_title:"実行中の設定をフラッシュに保存しますか?",
 cw_info:"{n} / 2048 バイト、起動のたびに 1 行ずつ実行されます",
 cw_toolarge:"サイズ超過: 設定セクタは最大 2048 バイトです。先に行を削除してください。",
+cw_longline:"{n} 行目は {m} バイトです: スイッチが起動時に実行できる行は 126 バイトまでで、この行は読み飛ばされるため、書き込みを拒否します。先に短くしてください。",
 cw_unknown:"既知の設定文法に含まれない行 (そのまま書き込まれます): ",cw_empty:"(空)",
 cw_writing:"設定を書き込み中...",cw_failed:"設定の書き込みに失敗しました: HTTP {n}",
 cw_verify_fail:"検証失敗: フラッシュの内容が送信内容と異なります。コマンドログは消去されていません。",
@@ -237,7 +259,7 @@ c_full:"全双工",c_half:"半双工",c_devices:"台设备",c_yes:"是",c_no:"
 d_ports:"端口",d_ports_h:"点击端口查看详情",d_system:"系统",d_traffic:"流量",
 d_traffic_h:"包/秒，实时",d_txpps:"TX pps",d_rxpps:"RX pps",d_txbad:"TX 错误",d_rxbad:"RX 错误",
 i_host:"主机名",i_ip:"IP 地址",i_mask:"子网掩码",i_gw:"网关",i_mac:"MAC",i_fw:"固件",
-i_built:"构建日期",i_hw:"硬件",i_flash:"Flash",i_syslog:"Syslog",
+i_built:"构建日期",i_hw:"硬件",i_temp:"温度",i_flash:"Flash",i_syslog:"Syslog",
 p_state:"状态",p_disabled:"已禁用",p_up:"已连接",p_txgb:"TX 正常 / 错误",p_rxgb:"RX 正常 / 错误",
 p_pkts:"个包",p_module:"模块",p_temp:"温度",p_vcc:"供电电压",p_txbias:"TX 偏置电流",p_txpower:"TX 光功率",
 p_rxpower:"RX 光功率",p_txfault:"TX 故障",p_txdis:"TX 禁用",p_rxlos:"RX 信号丢失",p_adv:"通告能力",
@@ -294,6 +316,7 @@ bw_exceed:"超限动作",bw_fc:"流量控制",bw_drop:"丢弃",
 bw_in_err:"入方向限速范围为 0.016-10000 Mbit/s",bw_out_err:"出方向限速范围为 0.016-10000 Mbit/s",
 sy_network:"网络",sy_dhcp:"使用 DHCP",sy_dhcp_t:"通过 DHCP 获取地址",sy_services:"服务",
 sy_igmp:"IGMP 侦听",sy_sysip:"服务器 IP",sy_server:"服务器",sy_port:"端口",
+sy_sesstmo:"会话超时（秒）",sy_sesstmo_err:"会话超时必须为 1-65535 秒",
 sy_services_note:"服务状态反映启动配置；运行时状态无法读取。",
 sy_password:"管理员密码",sy_newpw:"新密码",sy_repeat:"重复输入",sy_pwapply:"修改密码",
 sy_pw_note:"立即生效；如需重启后保留请保存到 Flash。",sy_console:"控制台",
@@ -312,6 +335,7 @@ sy_rebooting:"正在重启，约 20 秒后重新连接",sy_bytes:"字节",
 cw_title:"写入此启动配置?",cw_save_title:"将运行配置保存到 Flash?",
 cw_info:"{n} / 2048 字节，每次启动时逐行执行",
 cw_toolarge:"过大: 配置扇区最多容纳 2048 字节。请先删除部分行。",
+cw_longline:"第 {n} 行有 {m} 字节: 交换机启动时只能执行不超过 126 字节的行，该行会被跳过，因此拒绝写入。请先缩短该行。",
 cw_unknown:"不属于已知配置语法的行 (仍会写入): ",cw_empty:"(空)",
 cw_writing:"正在写入配置...",cw_failed:"配置写入失败: HTTP {n}",
 cw_verify_fail:"校验失败: Flash 内容与发送内容不一致。命令日志未清除。",
@@ -405,6 +429,7 @@ bw_exceed:"Al excederse",bw_fc:"Control de flujo",bw_drop:"Descartar",
 bw_in_err:"El límite de entrada debe estar entre 0.016 y 10000 Mbit/s",bw_out_err:"El límite de salida debe estar entre 0.016 y 10000 Mbit/s",
 sy_network:"Red",sy_dhcp:"Usar DHCP",sy_dhcp_t:"Solicitar dirección mediante DHCP",sy_services:"Servicios",
 sy_igmp:"IGMP snooping",sy_sysip:"IP del servidor",sy_server:"Servidor",sy_port:"Puerto",
+sy_sesstmo:"Tiempo de sesión (s)",sy_sesstmo_err:"El tiempo de sesión debe estar entre 1 y 65535 s",
 sy_services_note:"El estado del servicio refleja la configuración de inicio; el estado en ejecución no es legible.",
 sy_password:"Contraseña de administrador",sy_newpw:"Nueva contraseña",sy_repeat:"Repetir",sy_pwapply:"Cambiar contraseña",
 sy_pw_note:"Toma efecto inmediatamente; guarda en flash para conservarla tras el reinicio.",sy_console:"Consola",
@@ -443,6 +468,240 @@ fw_applied:"actualización aplicada",fw_done_t:"Firmware actualizado",
 fw_done:"El switch verificó la imagen y se reinició con ella. La sesión se restableció, así que se te pedirá que vuelvas a iniciar sesión.",
 fw_login:"Ir al inicio de sesión",fw_rebooting:"el switch se está reiniciando...",
 fw_timeout:"el switch no ha vuelto tras 150 s: comprueba la alimentación / consola serie"
+},
+fr:{
+nav_dash:"Tableau de bord",nav_ports:"Ports",nav_stp:"Arborescence",nav_stats:"Statistiques",
+nav_vlan:"LANs virtuels",nav_l2:"Table MAC",nav_mirror:"Mise en mirroir",nav_lag:"Aggrégation",nav_eee:"Energie",
+nav_bw:"Bande passante",nav_system:"Système",nav_fw:"Micro logiciel",
+hdr_dirty:"Changements non sauvegardés",hdr_dirty_t:"La configuration utilisée diffère de celle au démarrage",
+hdr_save:"Sauvegarder en flash",hdr_save_t:"Maintenir la configuration actuelle en flash",
+th_auto:"Système",th_auto_sel:"Système (sélénisé)",sy_display:"Affichage",sy_theme:"Thème",sy_display_note:"Enregistré seulement dans ce navigateur.",th_light:"Clair",th_dark:"Sombre",
+th_sel_light:"Clair (sélénisé)",th_sel_dark:"Sombre (sélénisé)",
+c_port:"Port",c_name:"Nom",c_link:"Lien",c_apply:"Appliquer",c_cancel:"Annuler",c_confirm:"Confirmer",
+c_close:"Fermer",c_refresh:"Raffraichir",c_off:"arrêt",c_offc:"Arrêt",c_down:"arrêt",c_on:"Marche",c_auto:"Auto",c_delete:"Supprimer",
+c_type:"Type",c_state:"Etat",c_enabled:"Activé",c_load:"Charger",c_disable:"Désactivé",c_sfp:"SFP",
+c_full:"full",c_half:"half",c_devices:"Equipements",c_yes:"oui",c_no:"non",
+d_ports:"Ports",d_ports_h:"Cliquez ou survollez pour plus de détails",d_system:"Système",d_traffic:"Trafic",
+d_traffic_h:"paquets/s (en direct)",d_txpps:"TX pps",d_rxpps:"RX pps",d_txbad:"TX KO",d_rxbad:"RX KO",
+i_host:"Nom d'hote",i_ip:"Adresse IP",i_mask:"Masque réseau",i_gw:"Passerelle",i_mac:"Adresse MAC",i_fw:"Micro logiciel",
+i_built:"Compilé le",i_hw:"Matériel",i_temp:"Température",i_flash:"Taille Flash",i_syslog:"Journal système",
+p_state:"Etat",p_disabled:"Inactif",p_up:"Actif",p_txgb:"TX bon / mauvais",p_rxgb:"RX bon / mauvais",
+p_pkts:"paquets",p_module:"Module",p_temp:"Température",p_vcc:"Vcc",p_txbias:"TX biais",p_txpower:"TX puissance",
+p_rxpower:"RX puissance",p_txfault:"TX erreur",p_txdis:"TX désactivé",p_rxlos:"RX pertes de signaux",p_adv:"Capacités",
+pt_title:"Configuration du port",pt_conn:"Connecté à",pt_speed:"Vitesse",pt_mtu:"MTU",
+pt_sfp_note:"La vitesse SFP est paramétrée pour le port et n'est pas enregistrée dans la configuration de démarrage.",
+pt_name_err:"Nom du port: 1 à 15 caractères, sans espaces",pt_mtu_err:"MTU doit être comrpis entre 64 et 16383",
+stp_title:"Arborescence",stp_h:"RSTP, 802.1w",stp_version:"Protocole",stp_v_stp:"Compatible STP",
+stp_prio:"Priorité",stp_hello:"Bonjour [s]",stp_maxage:"Age max [s]",stp_fwd:"Délai de transmission [s]",
+stp_txhold:"TX en attente",stp_bridge_apply:"Appliquer les paramètres du pont",
+stp_off_msg:"Arborescence désactivée: Tous les ports sont retransmis.",stp_bridge:"Pont",stp_root:"Racine",
+stp_root_self:"Ce pont est la racine",stp_via:"via le port",stp_cost:"coût du chemin",stp_tc:"changements de topologie",
+stp_prio_note:"La priorité la plus basse devient la racine (défaut 8 à 32768). Les paramètres s'appliquent immediatement; utiliser Sauvegarder en flash pour les conserver.",
+stp_portcfg:"Configuration du port",stp_edge:"Port terminal",stp_pcost:"Coût du chemin",stp_pprio:"Priorité",
+stp_guard:"Protection",stp_filter:"Filtre BPDU",stp_p2p:"Point-à-point",
+stp_port_note:"Les ports en bordure sont transmis immediatemment et ne change pas la topologie; Auto traite le port comme une bordure après 3s sans BPDUs, et chaque BPDU reçu le révoque. Le coût du chemin  0 = automatique.",
+stp_status:"Statut du port",stp_role:"Rôle",stp_db:"Pont désigné",stp_dp:"Port désigné",
+stp_dc:"Coût désigné",stp_oedge:"Oper. terminales",stp_op2p:"Oper. en P2P",
+stp_s0:"désactivé",stp_s1:"bloquage",stp_s2:"apprentissage",stp_s3:"retransmission",
+stp_r1:"Racine",stp_r2:"Designé",stp_r3:"Alternatif",stp_trip:"protection déclenchée",
+stp_g_none:"Aucun",stp_g_bpdu:"BPDU",stp_g_root:"Racine",
+stp_en_q:"Activer l'arbrescence?",
+stp_en_d:"Les ports sont d'abord bloqués et cela prend deux fois le délai de retransmission pour atteindre l'état de retransmission; les ports en bordures recouvrent immédiatement leur état.",
+stp_dis_q:"Désactiver l'arborescence ?",stp_dis_d:"Tous les ports vont être retransmis; la protection de boucles est perdue.",
+stp_cost_err:"Le coût du chemin doit être compris entre 0 et 200000000",
+st_title:"Statiqtique du port",st_h:"cumul depuis le démarrage",st_txg:"TX OK",st_txb:"TX KO",st_rxg:"RX OK",
+st_rxb:"RX KO",st_details:"Détails",st_counters:"Compteur MIB",st_nonzero:"non-zero seulement",
+st_autoref:"rafraichissement automatique",st_counter:"Compteur",st_value:"Valeur",st_fail:"Erreur au chargement des compteurs",
+v_title:"VLANs",v_vid:"VID",v_members:"Membres",v_tagged:"Tagué",v_untagged:"Détagué",v_pvid_on:"PVID on",
+v_empty:"Aucun VLANs configuré.",v_mgmt:"VLAN de management",v_mgmt_none:"détagué",v_editor:"Editeur de VLAN",
+v_optional:"optionel",v_setmgmt:"Mette en VLAN de management",v_setmgmt_t:"Mettre celui-ci en VLAN de management",
+v_member:"Membre",v_pvid:"PVID",
+v_legend:"U = Membre détagué (UnTagged), T = membre tagué (Tagged), - = non membre. PVID (Port VLan ID) assigne ce VLAN au trafic entrant non tagué.",
+v_ingress:"Filtrage entrant",v_ingress_h:"en ériture seule: cet état n'est pas lisible depuis le communtateur réseau",
+v_accept:"Accepté",v_ing_all:"Tous",v_ing_apply:"Appliquer les filtes",v_del_t:"Supprimer le VLAN",
+v_del_q:"Supprimer le VLAN {n}?",v_del_d:"Les ports conservent leur PVID tant qu'ils ne sont pas réassignés.",
+v_vid_err:"Entrez un identifiant VLAN (1-4094)",v_name_err:"Le nom doit commencer par une lettre (lettre, chiffres, _)",
+v_loaded:"VLAN chargés {n}",v_notfound:"VLAN {n} non trouvé (un nouveau peut toutefois être créé)",
+v_nomember:"Selectionnez au moins un port membre (ou supprimez le VLAN)",
+v_ing_none:"Sélectionnez le mode entrant pour au moins un port",v_vid_first:"Entrez un identifiant VLAN d'abord",
+v_mgmt_q:"Mettre ce VLAN {n} en tant que VLAN de management?",
+v_mgmt_d:"Ce commutateur commencera par taguer son propre trafic avec ce VLAN. Si le port avec lequel vous êtes connecté ne le permet pas, cette page deviendra inaccessible et les paramètres ne pourront plus être changés que via la console.",
+l2_title:"Table des adresses MAC",l2_filter:"filtre...",l2_flush:"Effacer les entrées apprises",l2_static:"static",
+l2_learned:"appris",l2_loading:"chargement...",l2_failed:"chargement non réussi",l2_entries:"entrées",
+l2_del_t:"Supprimer l'entrée",l2_flush_q:"Effacer toutes les entrées MAC apprises?",
+m_title:"Duplication de ports",m_active:"actif",m_monitor:"Port de supervision",m_mirror:"Mirroir",m_both:"RX&TX",
+m_note:"RX&TX = duplique RX et TX du port vers le port de supervision.",m_none:"Selectionnez au moins un port à dupliquer",
+iso_title:"Isolation des ports",iso_from:"Du port",iso_to:"Au port",iso_all:"Tout autoriser",
+iso_intro:"Une trame réseau accédant à un port ne peut repartir que par le port selectionné dans cette ligne. L'isolement est prioritaire sur la retransmission, un port non non coché n'est pas accessible directement, quoi que dit la table d'adresses.",
+iso_legend:"La cellule du port lui-même est toujours autorisée. Une port de couleur rouge indique que celui-ci n'est que partiellement ouvert.",
+lag_hash:"Hachage:",lag_note:"Un groupe d'agrégation de Lien (LAG) nécessite au moins un membre pour être sauvegardé dans la configuration de démarrage; Utiliser un groupe vide fait office de remise à zero.",
+lag_clear_q:"Effacer l'agrégation {n}?",lag_clear_d:"Tous les ports membres vont redevenir normaux.",
+e_title:"Gestion énergétique des ports",e_adv:"Capacités",e_lp:"Capacité du partenaire",e_active:"Actif",e_enable:"Basse consommation",
+e_note:"Capacité de l'hôte et des partenaires : 100M, 1G, 2.5G. Les ports SFP ne peuvent pas bénéficier de l'EEE.",
+e_idle:"Inactif",e_na:"N/A",
+bw_title:"Limitations de bande passante",bw_h:"Mbit/s, 0.016-10000",bw_in:"Limite entrante",bw_out:"Limite sortante",
+bw_exceed:"Lorsque dépassé",bw_fc:"Limiter",bw_drop:"Rejetter",
+bw_in_err:"La limite entrante doit être comprise entre 0.016 et 10000 Mbit/s",bw_out_err:"La limite sortante doit être comprise entre 0.016 et 10000 Mbit/s",
+sy_network:"Réseau",sy_dhcp:"Uiliser DHCP",sy_dhcp_t:"Aquérir l'adresse via le protocole DHCP",sy_services:"Services",
+sy_igmp:"Surveillance IGMP",sy_sysip:"IP du serveur...",sy_server:"Serveur",sy_port:"Port",
+sy_sesstmo:"Temps mort de session (s)",sy_sesstmo_err:"Le temps morts de session doit être compris en 1-65535 s",  
+sy_services_note:"L'état de service dépend de la configuration de démarrage; Le temps de fonctionnement n'est pas consultable.",
+sy_password:"Gestion de l'accès",sy_newpw:"Mot de passe",sy_repeat:"Confirmation",sy_pwapply:"Changer le mot de passe",
+sy_pw_note:"Prends effet immédiatement; Sauvegardez en flash afin de conserver la configuration lors du redémarrage.",sy_console:"Console",
+sy_cmd:"Ligne de commande...",sy_send:"Envoyer",sy_startup:"Configuration de démarrage",sy_replayed:"Rejouée à chaque redémarrage",
+sy_reload:"Recharger depuis la mémoire flash",sy_write:"Ecrire en mémoire flash",sy_unknown_note:"Les lignes incorrectes sont mises en évidence avant l'écriture.",
+sy_maint:"Maintenance",sy_reboot:"Redémarre le commutateur",sy_lang:"Langage",
+sy_ip_err:"Erreur d'IP / masque réseau / passerelle",sy_host_err:"Nom d'hôte : 1 à 23 caractères, sans espace ni apostrophes",
+sy_net_q:"Appliquer les paramètres réseau?",sy_net_d:"L'adresse IP de  management va devenir {ip}: merci de réouvrir le page depuis cette adresse.",
+sy_ip_changed:"L'adresse IP a changée, reconnectez-vous à http://{ip}/",sy_dhcp_q:"Passer en DHCP?",
+sy_dhcp_d:"Le commutateur va demander une addresse via le DHCP. Vous devrez rechercher sa prochaine adresse IP pour vous reconnecter.",
+sy_sysip_err:"Adresse IP du serveur Syslog invalide",sy_sysport_err:"Le port Syslog doit être compris entre 1 et 65535",
+sy_pw_len:"Mot de passe : 1 à 20 caractères",sy_pw_space:"Le mot de passe ne doit pas contenir d'espaces",sy_pw_match:"Les mots de passe ne correspondent pas",
+sy_pw_q:"Changer le mot de passe d'administration?",sy_pw_d:"Cela prend effet immédiatement dès la prochaine connection. Enregistrez en Flash pour rendre la modification persistante.",
+sy_reboot_q:"Redémarrer le commutateur ?",sy_reboot_d:"Il y a des paramètres NON SAUVEGARDES qui vont être perdus. Sauvegardez-les au préalable en mémoire flash si vous souhaitez les conserver.",
+sy_rebooting:"Redémarrage, reconnectez-vous d'ici 20s",sy_bytes:"bytes",
+cw_title:"Enregistrer cette configuration de démarrage?",cw_save_title:"Enregistrer la configuration active en mémoire flash?",
+cw_info:"{n} / 2048 bytes, qui seront rejouées ligne par ligne à chaque redémarrage",
+cw_toolarge:"Trop grand : La quota du secteur de démarrage ne peut excéder 2048 bytes. Supprimez des lignes.",
+cw_longline:"La ligne {n} est longue de {m} bytes: Le commutateur ne peut exécuter des lignes de plus de 126 bytes et les omettra donc au démarragee, l'écriture est refusé. Raccourcissez les d'abord.",
+cw_unknown:"Ne respecte pas la grammaire de configuration (sera néanmoins sauvegardé): ",cw_empty:"(vide)",
+cw_writing:"Configuration enregistrée...",cw_failed:"Echec de l'enregistrement de la configuration: HTTP {n}",
+cw_verify_fail:"Verification erronée: La mémoire flash présente des différences par rapport à ce qui a été transmis. Le log de commande ne sera pas éffacé.",
+cw_saved:"Configuration de démarrage sauvegardée et vérifiée",cw_collect:"Récolement des modification des paramètres courants...",
+t_applied:"Appliqué: {c}",t_cmds:"{n} commande(s) appliquée(s)",t_rejected:"commandes rejetées: {c}",t_failed:"échecs: {c}",
+fw_title:"Mise à jour du micro-logiciel",
+fw_intro:"Charge une image RTLPlayground (512 KiB .bin). L'image est envoée en mémoire flash, analysée et sa somme de contrôle est vérifiée; en cas de succès le commutateur va redémarrer, re-verifiez l'image et appliquez-là. LA configuration de démarrage est conservée.",
+fw_upload:"Charger",fw_checking:"{f}: {n} bytes. Vérification...",fw_size_err:"la taille est {n} alors que nous attendons 524288 (512 KiB)",
+fw_magic_err:"Entête de banque de donnée manquant / contrôle LJMP: ce n'est pas une image de firmware",fw_crc_err:"Somme de contrôle erronée: image corrompue",
+fw_valid:"Image RTLPlayground valide (taille, LJMP et somme de contrôle OK)",fw_q:"Chargement du firmware?",
+fw_other:"Cette image n'a pas été prévue pour ce commutateur({m}): La puce, les LED et les boouton peuvent être différents. Poursuivez seulement si vous êtes sûrs de vous.",
+fw_d:"Si la somme de contrôle est correcte, le commutateur va redémarrer tout seul et charger la nouvelle image lors du démarrage (la configuration est préservée). Ne pas éteindre l'appareil avant que les voyants ne s'éteignent.",
+fw_finishing:"Fin d'écriture en mémoire flash... {s} s",fw_uploading:"Chargement... {p}% / {s} s",
+fw_verified:"Somme de contrôle vérifiée, le commutateur redémarre...",
+fw_rejected:"L'image est rejettée en raison d'une somme de contrôle incorrecte, rien n'a été appliqué",
+fw_lost:"Erreur lors du chargement: connection perdue à mi-transfert",
+fw_noreboot:"Pas de redemarrage détecté: l'image a certainement été refusée. Si vous chargesz un ancien firmware, verifiez la version affichée après l'écran de connection.",
+fw_applied:"Mise à jour effectuée",fw_done_t:"Firmware mis à jour",
+fw_done:"Le commutateur a vérifié l'image et vient de redémarrer. La session a été remise à zero, vous devez vous reconnecter.",
+fw_login:"Vers l'écran de connection",fw_rebooting:"Le commutateur redémarre...",
+fw_timeout:"Le commutateur n'est plus joignable depuis 150 s: verifiez l'alimentation ou utilisez la console série"
+},
+de:{
+nav_dash:"Übersicht",nav_ports:"Ports",nav_stp:"Spanning Tree",nav_stats:"Statistik",
+nav_vlan:"VLANs",nav_l2:"MAC-Tabelle",nav_mirror:"Spiegelung",nav_lag:"LAG",nav_eee:"EEE",
+nav_bw:"Bandbreite",nav_system:"System",nav_fw:"Firmware",
+hdr_dirty:"ungespeicherte Änderungen",hdr_dirty_t:"Laufende Konfiguration weicht von der Startkonfiguration ab",
+hdr_save:"Im Flash speichern",hdr_save_t:"Laufende Konfiguration dauerhaft im Flash speichern",
+th_auto:"System",th_auto_sel:"System (Selenized)",sy_display:"Anzeige",sy_theme:"Farbschema",sy_display_note:"Wird nur in diesem Browser gespeichert.",th_light:"Hell",th_dark:"Dunkel",
+th_sel_light:"Selenized Hell",th_sel_dark:"Selenized Dunkel",
+c_port:"Port",c_name:"Name",c_link:"Link",c_apply:"Übernehmen",c_cancel:"Abbrechen",c_confirm:"Bestätigen",
+c_close:"Schliessen",c_refresh:"Aktualisieren",c_off:"aus",c_offc:"Aus",c_down:"getrennt",c_on:"Ein",c_auto:"Auto",c_delete:"Löschen",
+c_type:"Typ",c_state:"Zustand",c_enabled:"Aktiviert",c_load:"Laden",c_disable:"Deaktivieren",c_sfp:"SFP",
+c_full:"voll",c_half:"halb",c_devices:"Geräte",c_yes:"ja",c_no:"nein",
+d_ports:"Ports",d_ports_h:"Port anklicken für Details",d_system:"System",d_traffic:"Datenverkehr",
+d_traffic_h:"Pakete/s, live",d_txpps:"TX Pakete/s",d_rxpps:"RX Pakete/s",d_txbad:"TX fehlerhaft",d_rxbad:"RX fehlerhaft",
+i_host:"Hostname",i_ip:"IP-Adresse",i_mask:"Netzmaske",i_gw:"Gateway",i_mac:"MAC",i_fw:"Firmware",
+i_built:"Erstellt",i_hw:"Hardware",i_temp:"Temperatur",i_flash:"Flash",i_syslog:"Syslog",
+p_state:"Zustand",p_disabled:"deaktiviert",p_up:"verbunden",p_txgb:"TX gut / fehlerhaft",p_rxgb:"RX gut / fehlerhaft",
+p_pkts:"Pakete",p_module:"Modul",p_temp:"Temperatur",p_vcc:"Vcc",p_txbias:"TX-Bias",p_txpower:"Sendeleistung",
+p_rxpower:"Empfangsleistung",p_txfault:"TX-Fehler",p_txdis:"TX deaktiviert",p_rxlos:"RX LOS",p_adv:"Angeboten",
+pt_title:"Port-Konfiguration",pt_conn:"Verbunden",pt_speed:"Geschwindigkeit",pt_mtu:"MTU",
+pt_sfp_note:"Die SFP-Geschwindigkeit wird pro Steckplatz gesetzt und nicht in der Startkonfiguration gespeichert.",
+pt_name_err:"Port-Name: 1-15 Zeichen, keine Leerzeichen",pt_mtu_err:"MTU muss zwischen 64 und 16383 liegen",
+stp_title:"Spanning Tree",stp_h:"RSTP, 802.1w",stp_version:"Version",stp_v_stp:"STP-kompatibel",
+stp_prio:"Bridge-Priorität",stp_hello:"Hello [s]",stp_maxage:"Max. Alter [s]",stp_fwd:"Forward Delay [s]",
+stp_txhold:"TX Hold",stp_bridge_apply:"Bridge-Einstellungen übernehmen",
+stp_off_msg:"Spanning Tree ist deaktiviert: Alle Ports leiten weiter.",stp_bridge:"Bridge",stp_root:"Root",
+stp_root_self:"diese Bridge ist Root",stp_via:"über Port",stp_cost:"Pfadkosten",stp_tc:"Topologieänderungen",
+stp_prio_note:"Die niedrigere Priorität gewinnt die Root-Wahl (Standard 8 = 32768). Einstellungen wirken sofort; mit „Im Flash speichern“ bleiben sie erhalten.",
+stp_portcfg:"Port-Konfiguration",stp_edge:"Edge",stp_pcost:"Pfadkosten",stp_pprio:"Priorität",
+stp_guard:"Guard",stp_filter:"BPDU-Filter",stp_p2p:"Punkt-zu-Punkt",
+stp_port_note:"Edge-Ports leiten sofort weiter und lösen keine Topologieänderung aus; bei Auto gilt ein Port nach 3 s ohne BPDUs als Edge, jede empfangene BPDU hebt das wieder auf. Pfadkosten 0 = automatisch.",
+stp_status:"Port-Status",stp_role:"Rolle",stp_db:"Designated Bridge",stp_dp:"Designated Port",
+stp_dc:"Designated Cost",stp_oedge:"Edge (aktiv)",stp_op2p:"P2P (aktiv)",
+stp_s0:"deaktiviert",stp_s1:"blockiert",stp_s2:"lernt",stp_s3:"leitet weiter",
+stp_r1:"Root",stp_r2:"Designated",stp_r3:"Alternate",stp_trip:"Guard ausgelöst",
+stp_g_none:"Keiner",stp_g_bpdu:"BPDU",stp_g_root:"Root",
+stp_en_q:"Spanning Tree aktivieren?",
+stp_en_d:"Die Ports starten blockiert und brauchen bis zum doppelten Forward Delay, bis sie weiterleiten; Edge-Ports sind sofort wieder aktiv.",
+stp_dis_q:"Spanning Tree deaktivieren?",stp_dis_d:"Alle Ports leiten sofort weiter; der Schutz vor Netzwerkschleifen entfällt.",
+stp_cost_err:"Pfadkosten müssen zwischen 0 und 200000000 liegen",
+st_title:"Port-Statistik",st_h:"Summen seit dem Start",st_txg:"TX gut",st_txb:"TX fehlerhaft",st_rxg:"RX gut",
+st_rxb:"RX fehlerhaft",st_details:"Details",st_counters:"MIB-Zähler",st_nonzero:"nur ungleich null",
+st_autoref:"automatisch aktualisieren",st_counter:"Zähler",st_value:"Wert",st_fail:"Zähler konnten nicht geladen werden",
+v_title:"VLANs",v_vid:"VID",v_members:"Mitglieder",v_tagged:"Tagged",v_untagged:"Untagged",v_pvid_on:"PVID auf",
+v_empty:"Keine VLANs konfiguriert.",v_mgmt:"Management-VLAN",v_mgmt_none:"untagged",v_editor:"VLAN-Editor",
+v_optional:"optional",v_setmgmt:"Als Management-VLAN",v_setmgmt_t:"Dieses VLAN zum Management-VLAN machen",
+v_member:"Mitglied",v_pvid:"PVID",
+v_legend:"U = Mitglied untagged, T = Mitglied tagged, - = kein Mitglied. PVID ordnet eingehenden Verkehr ohne Tag diesem VLAN zu.",
+v_ingress:"Ingress-Filter",v_ingress_h:"nur schreibbar: der Zustand lässt sich vom Switch nicht auslesen",
+v_accept:"Annehmen",v_ing_all:"Alle",v_ing_apply:"Ingress-Modi übernehmen",v_del_t:"VLAN löschen",
+v_del_q:"VLAN {n} löschen?",v_del_d:"Die Ports behalten ihre PVID, bis sie neu zugewiesen wird.",
+v_vid_err:"VLAN-ID eingeben (1-4094)",v_name_err:"Der Name muss mit einem Buchstaben beginnen (Buchstaben, Ziffern, _)",
+v_loaded:"VLAN {n} geladen",v_notfound:"VLAN {n} nicht gefunden (es kann neu angelegt werden)",
+v_nomember:"Mindestens einen Mitglieds-Port wählen (oder das VLAN stattdessen löschen)",
+v_ing_none:"Für mindestens einen Port einen Ingress-Modus wählen",v_vid_first:"Zuerst eine VLAN-ID eingeben",
+v_mgmt_q:"VLAN {n} als Management-VLAN setzen?",
+v_mgmt_d:"Der Switch versieht dann seinen eigenen Verkehr mit diesem VLAN-Tag. Führt der Port, über den du verbunden bist, dieses VLAN nicht, ist diese Seite nicht mehr erreichbar und die Einstellung lässt sich nur noch über die serielle Konsole zurücknehmen.",
+l2_title:"MAC-Adresstabelle",l2_filter:"filtern...",l2_flush:"Gelernte Einträge löschen",l2_static:"statisch",
+l2_learned:"gelernt",l2_loading:"lädt...",l2_failed:"Laden fehlgeschlagen",l2_entries:"Einträge",
+l2_del_t:"Eintrag löschen",l2_flush_q:"Alle gelernten MAC-Einträge löschen?",
+m_title:"Port-Spiegelung",m_active:"aktiv",m_monitor:"Monitor-Port",m_mirror:"Spiegeln",m_both:"Beide",
+m_note:"Beide = RX und TX des Ports auf den Monitor-Port spiegeln.",m_none:"Mindestens einen zu spiegelnden Port wählen",
+lag_hash:"Hash:",lag_note:"Eine LAG braucht mindestens ein Mitglied, um in der Startkonfiguration gespeichert zu werden; eine leere Gruppe zu übernehmen löscht sie.",
+lag_clear_q:"LAG {n} auflösen?",lag_clear_d:"Alle Mitglieds-Ports kehren in den Normalbetrieb zurück.",
+e_title:"Energy Efficient Ethernet",e_adv:"Angeboten",e_lp:"Gegenstelle",e_active:"Aktiv",e_enable:"Aktivieren",
+e_note:"Angebotene und von der Gegenstelle unterstützte Stufen je Geschwindigkeit: 100M, 1G, 2.5G. SFP-Ports unterstützen kein EEE.",
+e_idle:"inaktiv",e_na:"k. A.",
+bw_title:"Bandbreitenbegrenzung",bw_h:"Mbit/s, 0.016-10000",bw_in:"Eingangslimit",bw_out:"Ausgangslimit",
+bw_exceed:"Bei Überschreitung",bw_fc:"Flusskontrolle",bw_drop:"Verwerfen",
+bw_in_err:"Eingangslimit muss zwischen 0.016 und 10000 Mbit/s liegen",bw_out_err:"Ausgangslimit muss zwischen 0.016 und 10000 Mbit/s liegen",
+sc_title:"Storm Control",sc_h:"pro Port und Verkehrsart, leer = aus",sc_bcast:"Broadcast",sc_mcast:"Multicast",
+sc_ucast:"Unbekannter Unicast",sc_umcast:"Unbekannter Multicast",sc_err:"Grenzwert muss 1-1048575 pps oder 1-10000000 kbit/s betragen",
+sc_note:"Pakete einer Verkehrsart über ihrem Grenzwert werden beim Eintritt in den Switch verworfen.",
+sy_network:"Netzwerk",sy_dhcp:"DHCP verwenden",sy_dhcp_t:"Adresse per DHCP beziehen",sy_services:"Dienste",
+sy_igmp:"IGMP Snooping",sy_sysip:"Server-IP",sy_server:"Server",sy_port:"Port",
+sy_sesstmo:"Sitzungs-Timeout (s)",sy_sesstmo_err:"Sitzungs-Timeout muss zwischen 1 und 65535 s liegen",
+sy_services_note:"Der Dienststatus entspricht der Startkonfiguration; der laufende Zustand ist nicht auslesbar.",
+sy_password:"Admin-Passwort",sy_newpw:"Neues Passwort",sy_repeat:"Wiederholen",sy_pwapply:"Passwort ändern",
+sy_pw_note:"Wirkt sofort; im Flash speichern, damit es nach einem Neustart erhalten bleibt.",sy_console:"Konsole",
+sy_cmd:"CLI-Befehl...",sy_send:"Senden",sy_startup:"Startkonfiguration",sy_replayed:"wird bei jedem Start ausgeführt",
+sy_reload:"Aus dem Flash neu laden",sy_write:"In den Flash schreiben",sy_unknown_note:"Unbekannte Zeilen werden vor dem Schreiben hervorgehoben.",
+sy_maint:"Wartung",sy_reboot:"Switch neu starten",sy_lang:"Sprache",
+sy_ip_err:"Ungültige IP / Netzmaske / Gateway",sy_host_err:"Hostname: 1-23 druckbare Zeichen, keine Leerzeichen oder Anführungszeichen",
+sy_net_q:"Netzwerkeinstellungen übernehmen?",sy_net_d:"Die Management-IP ändert sich auf {ip}: Diese Seite muss dort neu geöffnet werden.",
+sy_ip_changed:"IP geändert, neu verbinden unter http://{ip}/",sy_dhcp_q:"Auf DHCP umstellen?",
+sy_dhcp_d:"Der Switch bezieht seine Adresse per DHCP. Du musst seine neue IP herausfinden, um dich wieder zu verbinden.",
+sy_sysip_err:"Ungültige IP des Syslog-Servers",sy_sysport_err:"Syslog-Port muss zwischen 1 und 65535 liegen",
+sy_pw_len:"Passwort: 1-20 Zeichen",sy_pw_space:"Das Passwort darf keine Leerzeichen enthalten",sy_pw_match:"Die Passwörter stimmen nicht überein",
+sy_pw_q:"Admin-Passwort ändern?",sy_pw_d:"Gilt sofort für neue Anmeldungen. Im Flash speichern, damit es erhalten bleibt.",
+sy_reboot_q:"Switch neu starten?",sy_reboot_d:"Es gibt UNGESPEICHERTE Änderungen, sie gehen verloren. Zuerst im Flash speichern, wenn du sie behalten willst.",
+sy_rebooting:"Neustart läuft, in etwa 20 s neu verbinden",sy_bytes:"Bytes",
+cw_title:"Diese Startkonfiguration schreiben?",cw_save_title:"Laufende Konfiguration im Flash speichern?",
+cw_info:"{n} / 2048 Bytes, wird bei jedem Start Zeile für Zeile ausgeführt",
+cw_toolarge:"Zu gross: Der Konfigurationssektor fasst höchstens 2048 Bytes. Zuerst Zeilen entfernen.",
+cw_longline:"Zeile {n} ist {m} Bytes lang: Der Switch kann beim Start nur Zeilen bis 126 Bytes ausführen und würde sie überspringen, deshalb wird das Schreiben abgelehnt. Zuerst kürzen.",
+cw_unknown:"Nicht in der bekannten Konfigurationssyntax (wird trotzdem geschrieben): ",cw_empty:"(leer)",
+cw_writing:"Konfiguration wird geschrieben...",cw_failed:"Schreiben der Konfiguration fehlgeschlagen: HTTP {n}",
+cw_verify_fail:"Prüfung fehlgeschlagen: Der Flash-Inhalt weicht vom Gesendeten ab. Befehlsprotokoll wurde NICHT gelöscht.",
+cw_saved:"Startkonfiguration gespeichert und geprüft",cw_collect:"Laufende Änderungen werden gesammelt...",
+t_applied:"Übernommen: {c}",t_cmds:"{n} Befehl(e) übernommen",t_rejected:"Befehl abgelehnt: {c}",t_failed:"fehlgeschlagen: {c}",
+fw_title:"Firmware-Update",
+fw_intro:"Ein RTLPlayground-Image hochladen (.bin, 512 KiB). Das Image wird im Flash abgelegt und per CRC geprüft; ist es in Ordnung, startet der Switch neu, prüft das Image erneut und übernimmt es. Die Startkonfiguration bleibt erhalten.",
+fw_upload:"Hochladen",fw_checking:"{f}: {n} Bytes. Wird geprüft...",fw_size_err:"Grösse ist {n}, erwartet 524288 (512 KiB)",
+fw_magic_err:"Bank-Header / LJMP-Kennung fehlt: kein Firmware-Image",fw_crc_err:"CRC16-Prüfung fehlgeschlagen: Image beschädigt",
+fw_valid:"gültiges RTLPlayground-Image (Grösse, Kennung und CRC16 in Ordnung)",fw_q:"Firmware hochladen?",
+fw_other:"Dieses Image wurde nicht für diesen Switch ({m}) gebaut: SFP-, LED- und Tasten-Pins können abweichen. Nur hochladen, wenn du sicher bist.",
+fw_d:"Ist die Prüfsumme korrekt, startet der Switch neu und übernimmt das Image beim Hochfahren (die Startkonfiguration bleibt erhalten). Nicht vom Strom trennen, bis er wieder erreichbar ist.",
+fw_finishing:"Flash wird fertig beschrieben... {s} s",fw_uploading:"wird hochgeladen... {p}% / {s} s",
+fw_verified:"Prüfsumme bestätigt, der Switch startet neu...",
+fw_rejected:"der Switch hat das Image abgelehnt (falsche Prüfsumme), es wurde nichts übernommen",
+fw_lost:"Hochladen fehlgeschlagen: Verbindung während der Übertragung abgebrochen",
+fw_noreboot:"kein Neustart erkannt: Das Image wurde sehr wahrscheinlich abgelehnt. Bei einem Update von alter Firmware nach dem erneuten Anmelden die Version in der Seitenleiste prüfen.",
+fw_applied:"Update übernommen",fw_done_t:"Firmware aktualisiert",
+fw_done:"Der Switch hat das Image geprüft und damit neu gestartet. Die Sitzung wurde zurückgesetzt, du wirst erneut zur Anmeldung aufgefordert.",
+fw_login:"Zur Anmeldung",fw_rebooting:"Switch startet neu...",
+fw_timeout:"Der Switch ist nach 150 s nicht zurück: Stromversorgung / serielle Konsole prüfen"
 }
 };
 var rtlLang=(function(){
@@ -538,6 +797,10 @@ var CONF_CMDS=[
  /^ip\s+(\d{1,3}\.){3}\d{1,3}$/,/^ip\s+dhcp$/,
  /^gw\s+(\d{1,3}\.){3}\d{1,3}$/,/^netmask\s+(\d{1,3}\.){3}\d{1,3}$/,
  /^syslog\s+(on|off)$/,/^syslog\s+ip\s+(\d{1,3}\.){3}\d{1,3}$/,/^syslog\s+port\s+\d{1,5}$/,
+  /^session\s+\d{1,5}$/,
+  /^dns\s+server\s+(\d{1,3}\.){3}\d{1,3}(\s+(\d{1,3}\.){3}\d{1,3})?$/,
+  /^ntp\s+(on|off)$/,/^ntp\s+server\s+[A-Za-z0-9.-]{1,47}$/,/^ntp\s+interval\s+\d{1,4}$/,
+  /^ntp\s+timezone\s+[+-]?\d{1,2}(:\d{2})?$/,/^ntp\s+dst\s+(off|eu|us)$/,
  /^passwd\s+\S+$/,/^hostname\s+\S{1,23}$/,
  /^vlan\s+\d{1,4}\s+d$/,/^vlan\s+\d{1,4}\s+mgmt$/,
  /^vlan\s+\d{1,4}(\s+[a-zA-Z]\w*)?(\s+\d{1,2}t?)+$/,
@@ -545,9 +808,10 @@ var CONF_CMDS=[
  /^ingress(\s+\d{1,2}[tua])+$/,/^ingress\s+[tua]$/,
  /^port\s+\d{1,2}\s+(10m|100m|1g|2g5|5g|10g|auto|on|off)(\s+(half|full))?$/,
  /^port\s+\d{1,2}\s+name\s+\S+$/,
+  /^port\s+\d{1,2}\s+lldp\s+(permit|block)+$/,
  /^eee\s+(on|off)(\s+\d{1,2})?(\s+(100m|1g|2g5))?$/,
  /^mirror(\s+\d{1,2})(\s+\d{1,2}[tr]?)+$/,/^mirror\s+off$/,
-  /^lag\s+[1-4](\s+\d{1,2})+$/,/^lag\s+[1-4]\s+d$/,/^laghash\s+[1-4](\s+\w+)+$/,
+  /^lag\s+[1-4](\s+\d{1,2})+$/,/^lag\s+[1-4]\s+d$/,/^lag\s+[1-4]\s+lacp(\s+\d{1,2})+$/,/^lag\s+[1-4]\s+lacp\s+off$/,/^laghash\s+[1-4](\s+\w+)+$/,
  /^isolate\s+\d{1,2}(\s+(off|\d{1,2}))+$/,
  /^stp\s+(on|off)$/,/^stp\s+(prio|hello|maxage|fwd|txhold)\s+\d{1,2}$/,
  /^stp\s+version\s+(rstp|stp)$/,
@@ -555,8 +819,9 @@ var CONF_CMDS=[
  /^stp\s+(port\s+\d{1,2}|lag\s+[1-4])\s+cost\s+\d{1,9}$/,/^stp\s+(port\s+\d{1,2}|lag\s+[1-4])\s+prio\s+\d{1,3}$/,
  /^stp\s+(port\s+\d{1,2}|lag\s+[1-4])\s+guard\s+(none|bpdu|root)$/,/^stp\s+(port\s+\d{1,2}|lag\s+[1-4])\s+filter\s+(on|off)$/,
  /^stp\s+(port\s+\d{1,2}|lag\s+[1-4])\s+p2p\s+(auto|on|off)$/,
-  /^igmp\s+(on|off)$/,/^mtu\s+\d{1,2}\s+\d+$/,
+  /^igmp\s+(on|off)$/,/^mtu\s+\d{1,2}\s+\d+$/,/^lldp\s+(on|off)$/,
  /^bw\s+(in|out)\s+\d{1,2}\s+\S+$/,
+  /^storm\s+\d{1,2}\s+(bcast|mcast|ucast|umcast)\s+(off|\d{1,8}\s+(pps|kbps))$/,
 ];
 function isConfCmd(line){
  for(var i=0;i<CONF_CMDS.length;i++)if(CONF_CMDS[i].test(line))return true;
@@ -614,7 +879,9 @@ var TABS=[
  {id:"vlan",  icon:"M12 3v6M12 9l-7 5M12 9l7 5M5 14v5M19 14v5M3 21h4M17 21h4"},
  {id:"l2",    icon:"M4 5h16M4 12h16M4 19h10"},
  {id:"mirror",icon:"M12 3v18M7 8l-4 4 4 4M17 8l4 4-4 4"},
+  {id:"isolate",icon:"M4 4h6v6H4zM14 14h6v6h-6zM14 4h6v6h-6zM4 14h6v6H4z"},
  {id:"lag",   icon:"M7 8a4 4 0 100 8h3M17 8a4 4 0 110 8h-3M9 12h6"},
+  {id:"lldp",  icon:"M11 12a1 1 0 002 0 1 1 0 00-2 0M8.5 8.5a5 5 0 000 7M15.5 8.5a5 5 0 010 7M5.6 5.6a9 9 0 000 12.8M18.4 5.6a9 9 0 010 12.8"},
  {id:"eee",   icon:"M13 2L4 14h6l-1 8 9-12h-6z"},
  {id:"bw",    icon:"M4 18a8 8 0 0116 0M12 18l4-6"},
  {id:"system",icon:"M12 8a4 4 0 100 8 4 4 0 000-8zM4 12h2M18 12h2M12 4v2M12 18v2M6 6l1.5 1.5M16.5 16.5L18 18M18 6l-1.5 1.5M7.5 16.5L6 18"},
@@ -796,14 +1063,18 @@ function portDetail(i){
 function renderInfo(){
  var m=[["i_host","hostname"],["i_ip","ip_address"],["i_mask","ip_netmask"],
    ["i_gw","ip_gateway"],["i_mac","mac_address"],["i_fw","sw_ver"],["i_built","build_date"],
-    ["i_hw","hw_ver"],["i_flash","flash_size"],["i_syslog","syslog_server"]];
+    ["i_hw","hw_ver"],["i_temp","chip_temp"],["i_flash","flash_size"],["i_syslog","syslog_server"]];
  var tb=$("sysinfo");tb.innerHTML="";
  m.forEach(function(r){
    var v=S.info[r[1]];
    if(v==null||v==="")return;
    tb.appendChild(h("tr",null,[h("td",{class:"mut",text:t(r[0])}),h("td",{class:"mono",text:String(v)})]));
  });
-  if(S.info.hostname)$("brandname").textContent=$("brandname").title=S.info.hostname;
+  if(S.info.hostname){
+    $("brandname").textContent=$("brandname").title=document.title=S.info.hostname;
+    // Remembered per switch (each has its own origin) for the login page tab
+    try{localStorage.setItem("rtl_host",S.info.hostname);}catch(e){}
+  }
  if(S.info.sw_ver)$("fver").textContent="RTLPlayground "+S.info.sw_ver;
 }
 function pollInfo(){
@@ -1469,6 +1740,76 @@ $("moff").addEventListener("click",function(){
 });
 tabHooks.mirror={enter:function(){needPorts(function(){buildMirror();mirrorLoad().catch(function(){})})}};

+var isoAllow=[];
+function isoBox(r,c){return $("iso"+r+"_"+c)}
+function isoMark(){
+  for(var r=1;r<=S.n;r++){
+    var full=true;
+    for(var c=1;c<=S.n+1;c++){var b=isoBox(r,c);if(b&&!b.checked)full=false;}
+    $("isoh"+r).style.color=full?"":"var(--bad)";
+  }
+}
+function isoTouch(){$("isotbl").dataset.dirty="1";isoMark()}
+function isoTh(row,txt,attrs){var e=h("th",attrs);e.textContent=txt;row.appendChild(e);return e}
+function buildIso(){
+  var tb=$("isotbl");
+  if(tb.tBodies[0].rows.length)return;
+  var h1=tb.tHead.insertRow(),h2=tb.tHead.insertRow();
+  isoTh(h1,t("iso_from"),{rowspan:"2"});isoTh(h1,t("iso_to"),{colspan:String(S.n),style:"text-align:center"});isoTh(h1,"CPU",{rowspan:"2"});
+  for(var c=1;c<=S.n;c++)isoTh(h2,String(c),{style:"text-align:center"});
+  for(var r=1;r<=S.n;r++){
+    var tr=tb.tBodies[0].insertRow();
+    isoTh(tr,String(r),{id:"isoh"+r});
+    for(c=1;c<=S.n+1;c++){
+      var td=tr.insertCell();
+      td.style.textAlign="center";
+      if(r===c){td.className="mut";td.textContent="\u2022";continue;}
+      td.appendChild(h("input",{type:"checkbox",id:"iso"+r+"_"+c,onchange:isoTouch}));
+    }
+  }
+}
+function isoLoad(){
+  return getJSON("/isolation.json").then(function(s){
+    isoAllow=s;
+    if($("isotbl").dataset.dirty)return;
+    s.forEach(function(e){
+      var m=parseInt(e.allow,16);
+      for(var c=1;c<=S.n;c++){var b=isoBox(e.portNum,c);if(b)b.checked=!!((m>>S.physToLog[c-1])&1);}
+      var cpu=isoBox(e.portNum,S.n+1);
+      if(cpu)cpu.checked=!!(m&0x200);
+    });
+    isoMark();
+  });
+}
+function isoMask(r){
+  var m=0;
+  for(var c=1;c<=S.n;c++){var b=isoBox(r,c);if(r===c||(b&&b.checked))m|=1<<S.physToLog[c-1];}
+  var cpu=isoBox(r,S.n+1);
+  if(cpu&&cpu.checked)m|=0x200;
+  return m;
+}
+$("isoapply").addEventListener("click",function(){
+  var cmds=[];
+  for(var r=1;r<=S.n;r++){
+    var cur=-1;
+    isoAllow.forEach(function(e){if(e.portNum===r)cur=parseInt(e.allow,16)});
+    if(isoMask(r)===cur)continue;
+    var cmd="isolate "+r;
+    for(var c=1;c<=S.n;c++){var b=isoBox(r,c);if(r===c||(b&&b.checked))cmd+=" "+c;}
+    var cpu=isoBox(r,S.n+1);
+    if(cpu&&cpu.checked)cmd+=" 0";
+    cmds.push(cmd);
+  }
+  delete $("isotbl").dataset.dirty;
+  if(!cmds.length){isoLoad().catch(function(){});return;}
+  postCmds(cmds).then(isoLoad).catch(function(){});
+});
+$("isoall").addEventListener("click",function(){
+  for(var r=1;r<=S.n;r++)for(var c=1;c<=S.n+1;c++){var b=isoBox(r,c);if(b)b.checked=true;}
+  isoTouch();
+});
+tabHooks.isolate={enter:function(){needPorts(function(){buildIso();isoLoad().catch(function(){})})}};
+
 var HASHF=["spa","smac","dmac","sip","dip","sport","dport"];
 function buildLag(){
  var w=$("lagwrap");
@@ -1476,6 +1817,15 @@ function buildLag(){
  for(var g=1;g<=4;g++)(function(g){
    var card=h("div",{class:"card"});
    card.appendChild(h("h2",{text:"LAG "+g}));
+    var mr=h("div",{style:"display:flex;gap:10px;flex-wrap:wrap;align-items:center;margin-bottom:10px",class:"small"});
+    mr.appendChild(h("span",{class:"mut",text:t("lag_mode")}));
+    var ms=h("select",{class:"in",id:"lgm"+g});
+    ms.appendChild(h("option",{value:"static",text:t("lag_static")}));
+    ms.appendChild(h("option",{value:"lacp",text:"LACP"}));
+    ms.addEventListener("change",function(){$("lgs"+g).textContent=ms.value==="lacp"?t("lacp_hint"):""});
+    mr.appendChild(ms);
+    card.appendChild(mr);
+    card.appendChild(h("p",{class:"small mono",id:"lgs"+g,style:"margin-bottom:10px"}));
    var pr=h("div",{style:"display:flex;gap:10px;flex-wrap:wrap;margin-bottom:10px"});
    for(var p=1;p<=S.n;p++)pr.appendChild(h("label",null,[
      h("input",{type:"checkbox",id:"lg"+g+"p"+p}),document.createTextNode(" "+p+" "),
@@ -1488,14 +1838,34 @@ function buildLag(){
    });
    card.appendChild(hr);
    card.appendChild(h("button",{class:"ctl pri",text:t("c_apply"),onclick:function(){lagApply(g)}}));
+    card.addEventListener("change",function(){card.dataset.dirty="1"});
    w.appendChild(card);
  })(g);
 }
+var lacpCfg=[0,0,0,0,0];
+function maskPorts(m){var r=[];for(var p=1;p<=S.n;p++)if((m>>S.physToLog[p-1])&1)r.push(p);return r.length?r.join(" "):"-"}
 function lagLoad(){
-  return getJSON("/lag.json").then(function(s){
+  return getJSON("/lacp.json").then(function(c){
+    var tb=$("lacptbl").tBodies[0];
+    tb.innerHTML="";
+    c.lags.forEach(function(lg,i){
+      var g=i+1;
+      lacpCfg[g]=parseInt(lg.cfg,16);
+      if($("lgm"+g).closest(".card").dataset.dirty)return;
+      $("lgm"+g).value=lacpCfg[g]?"lacp":"static";
+      $("lgs"+g).textContent=lacpCfg[g]?"LACP: "+t("lacp_agg")+" "+(lg.aggValid?lg.agg:"("+t("lacp_neg")+")")+", "+t("lacp_members")+" "+maskPorts(parseInt(lg.members,16)):"";
+    });
+    if(c.on)c.ports.forEach(function(p){
+      if(p.lag===255)return;
+      var tr=tb.insertRow();
+      [p.p,p.lag+1,p.a,p.pt,p.rs,parseInt(p.rx,16),p.psys].forEach(function(v){tr.insertCell().textContent=v});
+    });
+    return getJSON("/lag.json");
+  }).then(function(s){
    s.forEach(function(l){
      var g=l.lagNum+1;
-      var members=parseInt(l.members,2);
+      if($("lgm"+g).closest(".card").dataset.dirty)return;
+      var members=lacpCfg[g]||parseInt(l.members,2);
      for(var p=1;p<=S.n;p++)
        $("lg"+g+"p"+p).checked=!!((members>>S.physToLog[p-1])&1);
      var hash=parseInt(l.hash,16);
@@ -1504,21 +1874,51 @@ function lagLoad(){
  });
 }
 function lagApply(g){
-  var cmd="lag "+g,n=0;
+  var lacp=$("lgm"+g).value==="lacp",cmd="lag "+g+(lacp?" lacp":""),n=0,pre=[];
+  delete $("lgm"+g).closest(".card").dataset.dirty;
  for(var p=1;p<=S.n;p++)if($("lg"+g+"p"+p).checked){cmd+=" "+p;n++;}
-  if(!n){
+  if(!lacp&&lacpCfg[g])pre.push("lag "+g+" lacp off");
+  if(lacp&&!n)cmd="lag "+g+" lacp off";
+  if(!n&&!lacp){
    confirmModal(t("lag_clear_q",{n:g}),t("lag_clear_d"),function(){
-      postCmd("lag "+g+" d").then(lagLoad).catch(function(){});
+      postCmds(pre.concat(["lag "+g+" d"])).then(lagLoad).catch(function(){});
    });
    return;
  }
  var hcmd="laghash "+g,nh=0;
  HASHF.forEach(function(f){if($("lg"+g+"h"+f).checked){hcmd+=" "+f;nh++;}});
-  var cmds=[cmd];
+  var cmds=pre.concat([cmd]);
  if(nh)cmds.push(hcmd);
  postCmds(cmds).then(lagLoad).catch(function(){});
 }
-tabHooks.lag={enter:function(){needPorts(function(){buildLag();lagLoad().catch(function(){})})}};
+var lagPoller=new Poller(function(){return lagLoad().catch(function(){})},3000);
+tabHooks.lag={enter:function(){needPorts(function(){buildLag();lagPoller.start()})},leave:function(){lagPoller.stop()}};
+
+
+function lldpLoad(){
+  return getJSON("/lldp.json").then(function(s){
+    $("lldp_en").checked=s.on;
+    var tb=$("lldp_table").tBodies[0];tb.innerHTML="";
+    byPort(s.portStatus).forEach(function(p){
+      var tr=tb.insertRow();
+      tr.insertCell().textContent=p.portNum;
+      tr.insertCell().textContent=p.name;
+      var sw=h("label",{class:"switch"},[
+        h("input",{type:"checkbox",onchange:function(){
+          postCmd("port "+p.portNum+" lldp "+(this.checked?"permit":"block"))
+            .then(function(){setTimeout(lldpLoad,300)}).catch(function(){});
+        }}),h("i")]);
+      sw.firstChild.checked=p.permitted;
+      tr.insertCell().appendChild(sw);
+    });
+  });
+}
+
+$("lldp_en").addEventListener("change",function(){
+  var el=this;
+  postCmd("lldp "+(el.checked?"on":"off")).catch(function(){el.checked=!el.checked});
+});
+tabHooks.lldp={enter:lldpLoad};

 function eeeFlags(bits){
  var b=parseInt(bits,2);
@@ -1605,7 +2005,61 @@ function bwApply(n){
  }else cmds.push("bw out "+n+" off");
  postCmds(cmds).then(bwLoad).catch(function(){});
 }
-tabHooks.bw={enter:function(){needPorts(function(){bwLoad().catch(function(){})})}};
+var SC_TYPES=["bcast","mcast","ucast","umcast"],scSig="";
+function scLoad(){
+  return getJSON("/storm.json").then(function(s){
+    var tb=$("sctable").tBodies[0];
+    byPort(s);
+    var sig=s.map(function(p){return p.portNum}).join();
+    if(sig!==scSig){
+      scSig=sig;tb.innerHTML="";
+      s.forEach(function(p){
+        var n=p.portNum,tr=tb.insertRow();
+        tr.id="scr"+n;
+        tr.addEventListener("input",function(){tr.dataset.dirty="1"});
+        tr.addEventListener("change",function(){tr.dataset.dirty="1"});
+        tr.insertCell().textContent=n;
+        SC_TYPES.forEach(function(ty){
+          tr.insertCell().appendChild(h("span",{style:"display:flex;gap:4px"},[
+            h("input",{class:"in sm",id:"scv"+ty+n,type:"number",min:"1",step:"1"}),
+            h("select",{class:"in",id:"scu"+ty+n},[
+              h("option",{value:"pps",text:"pps"}),
+              h("option",{value:"kbps",text:"kbit/s"}),
+            ]),
+          ]));
+        });
+        tr.insertCell().appendChild(h("button",{class:"ctl",text:t("c_apply"),onclick:function(){scApply(n)}}));
+      });
+    }
+    s.forEach(function(p){
+      var n=p.portNum;
+      if($("scr"+n).dataset.dirty)return;
+      SC_TYPES.forEach(function(ty,k){
+        var on=p.en.charAt(k)==="1",pps=p.pps.charAt(k)==="1",raw=parseInt(p.rate.substr(k*6,6),16);
+        var inp=$("scv"+ty+n),sel=$("scu"+ty+n);
+        inp.value=on?raw:"";
+        sel.value=on&&!pps?"kbps":"pps";
+        inp.dataset.cur=on?inp.value+" "+sel.value:"off";
+      });
+    });
+  });
+}
+function scApply(n){
+  var cmds=[];
+  for(var k=0;k<SC_TYPES.length;k++){
+    var ty=SC_TYPES[k],inp=$("scv"+ty+n),u=$("scu"+ty+n).value,v=inp.value.trim(),want="off";
+    if(v!==""&&v!=="0"){
+      var x=Number(v);
+      if(!Number.isInteger(x)||x<1||(u==="pps"&&x>1048575)||(u==="kbps"&&x>10000000)){toast(t("sc_err"),"err");return;}
+      want=x+" "+u;
+    }
+    if(want!==inp.dataset.cur)cmds.push("storm "+n+" "+ty+" "+want);
+  }
+  delete $("scr"+n).dataset.dirty;
+  if(!cmds.length)return;
+  postCmds(cmds).then(scLoad).catch(function(){});
+}
+tabHooks.bw={enter:function(){needPorts(function(){bwLoad().then(scLoad).catch(function(){})})}};

 var IPRE=/^(\d{1,3}\.){3}\d{1,3}$/;
 function okIp(s){
@@ -1621,8 +2075,19 @@ function sysLoad(){
    var sl=(S.info.syslog_server||"").split(":");
    if(sl[0]&&sl[0]!=="0.0.0.0")$("sy-sysip").value=sl[0];
    if(sl[1])$("sy-sysport").value=sl[1];
+    if(S.info.session_timeout)$("sy-sesstmo").value=S.info.session_timeout;
  }).catch(function(){});
  cfgReload();
+  dnsLoad();
+}
+function dnsLoad(){
+  return api("/cmd",{method:"POST",body:"dns"}).then(function(r){
+    var m=r.body.match(/DNS servers ([\d.]+) ([\d.]+), from DHCP ([\d.]+)/);
+    if(!m)return;
+    function v(x){return x==="0.0.0.0"?"":x}
+    $("sy-dns1").value=v(m[1]);$("sy-dns2").value=v(m[2]);
+    $("sy-dnsdhcp").textContent=m[3]==="0.0.0.0"?"":t("sy_dns_dhcp",{ip:m[3]});
+  }).catch(function(){});
 }
 function cfgParseKnown(txt){
  var igmp=false,syslog=false;
@@ -1639,13 +2104,15 @@ function cfgParseKnown(txt){
 $("sy-apply").addEventListener("click",function(){
  var ip=$("sy-ip").value.trim(),mask=$("sy-mask").value.trim(),gw=$("sy-gw").value.trim();
  if(!okIp(ip)||!okIp(mask)||!okIp(gw)){toast(t("sy_ip_err"),"err");return;}
+  var d1=$("sy-dns1").value.trim(),d2=$("sy-dns2").value.trim();
+  if((d1&&!okIp(d1))||(d2&&!okIp(d2))){toast(t("sy_dns_err"),"err");return;}
  var cmds=[];
  var hn=$("sy-host").value.trim();
  if(hn&&hn!==S.info.hostname){
    if(!/^[\x21-\x7e]{1,23}$/.test(hn)||/["\\]/.test(hn)){toast(t("sy_host_err"),"err");return;}
    cmds.push("hostname "+hn);
  }
-  cmds.push("ip "+ip,"netmask "+mask,"gw "+gw);
+  cmds.push("ip "+ip+"\nnetmask "+mask+"\ngw "+gw+"\ndns server "+(d1||"0.0.0.0")+(d2?" "+d2:""));
  var changingIp=ip!==S.info.ip_address;
  confirmModal(t("sy_net_q"),changingIp?t("sy_net_d",{ip:ip}):"",function(){
    postCmds(cmds).then(function(){
@@ -1673,6 +2140,11 @@ $("sy-syslog").addEventListener("change",function(){
  }else cmds.push("syslog off");
  postCmds(cmds).catch(function(){});
 });
+$("sy-sesstmo").addEventListener("change",function(){
+  var v=+this.value;
+  if(!(v>=1&&v<=65535)){toast(t("sy_sesstmo_err"),"err");sysLoad();return;}
+  postCmd("session "+v).catch(function(){sysLoad()});
+});
 $("sy-pwapply").addEventListener("click",function(){
  var a=$("sy-pw1").value,b=$("sy-pw2").value;
  if(a.length<1||a.length>20){toast(t("sy_pw_len"),"err");return;}
@@ -1715,11 +2187,16 @@ function cfgReload(){
    cfgParseKnown(x);
  }).catch(function(){});
 }
+function cfgLongLine(v){
+  var ls=v.split("\n");
+  for(var i=0;i<ls.length;i++){var n=new Blob([ls[i]]).size;if(n>126)return{n:i+1,m:n};}
+  return null;
+}
 function cfgBytes(){
-  var n=new Blob([$("cfgedit").value]).size;
+  var v=$("cfgedit").value,n=new Blob([v]).size;
  var el=$("cfgbytes");
  el.textContent=n+" / 2048 "+t("sy_bytes");
-  el.style.color=n>2048?"var(--bad)":"";
+  el.style.color=(n>2048||cfgLongLine(v))?"var(--bad)":"";
  return n;
 }
 $("cfgedit").addEventListener("input",cfgBytes);
@@ -1727,21 +2204,68 @@ $("cfgreload").addEventListener("click",cfgReload);
 $("cfgwrite").addEventListener("click",function(){
  writeConfig($("cfgedit").value,t("cw_title"));
 });
-tabHooks.system={enter:sysLoad};
+var ntpBase=null,ntpTimer=null;
+function tzText(m){var a=Math.abs(m);return(m<0?"-":"+")+String(Math.floor(a/60)).padStart(2,"0")+":"+String(a%60).padStart(2,"0")}
+function ntpTick(){
+  if(!ntpBase)return;
+  var d=new Date(ntpBase.ms+(Date.now()-ntpBase.at));
+  function p(n){return String(n).padStart(2,"0")}
+  $("sy-sync").textContent=t("sy_ago",{n:ntpBase.sync+Math.floor((Date.now()-ntpBase.at)/60000)});
+  $("sy-now").textContent=d.getUTCFullYear()+"-"+p(d.getUTCMonth()+1)+"-"+p(d.getUTCDate())+" "
+    +p(d.getUTCHours())+":"+p(d.getUTCMinutes())+":"+p(d.getUTCSeconds())+" UTC"+ntpBase.tz;
+}
+function ntpLoad(){
+  return api("/cmd",{method:"POST",body:"ntp"}).then(function(r){
+    var m=r.body.match(/NTP (on|off), server (\S*), address ([\d.]+), interval (\d+) min, timezone ([+-]\d\d:\d\d), dst (\w+)/);
+    if(!m)return;
+    var x=r.body.match(/Time (\d{4})-(\d\d)-(\d\d) (\d\d):(\d\d):(\d\d) UTC([+-]\d\d:\d\d)( DST)?, synchronised (\d+) min ago/);
+    $("sy-ntpaddr").textContent=m[3]==="0.0.0.0"?"-":m[3];
+    if(x){
+      ntpBase={at:Date.now(),ms:Date.UTC(+x[1],+x[2]-1,+x[3],+x[4],+x[5],+x[6]),tz:x[7]+(x[8]?" DST":""),sync:+x[9]};
+      ntpTick();
+    }else{
+      ntpBase=null;
+      $("sy-now").textContent=t("sy_nosync");
+      $("sy-sync").textContent=m[1]==="on"?t("sy_waiting"):"-";
+    }
+    if($("sy-ntpcard").dataset.dirty)return;
+    $("sy-ntp").checked=m[1]==="on";$("sy-ntpsrv").value=m[2];$("sy-ntpint").value=m[4];
+    $("sy-tz").value=m[5];$("sy-dst").value=m[6];
+  }).catch(function(){});
+}
+[-720,-660,-600,-570,-540,-480,-420,-360,-300,-240,-210,-180,-120,-60,0,60,120,180,210,240,270,300,330,345,
+ 360,390,420,480,525,540,570,600,630,660,720,765,780,840].forEach(function(z){
+  $("sy-tz").appendChild(h("option",{value:tzText(z),text:"UTC"+tzText(z)}));
+});
+["change","input"].forEach(function(ev){$("sy-ntpcard").addEventListener(ev,function(){this.dataset.dirty="1"})});
+$("sy-ntpapply").addEventListener("click",function(){
+  var srv=$("sy-ntpsrv").value.trim(),iv=$("sy-ntpint").value.trim();
+  if(!/^[A-Za-z0-9.-]{1,47}$/.test(srv)){toast(t("sy_ntp_err"),"err");return;}
+  if(!(+iv>=1&&+iv<=1440)){toast(t("sy_ntpint_err"),"err");return;}
+  delete $("sy-ntpcard").dataset.dirty;
+  postCmds(["ntp server "+srv,"ntp interval "+iv,"ntp timezone "+$("sy-tz").value,"ntp dst "+$("sy-dst").value,
+    "ntp "+($("sy-ntp").checked?"on":"off")]).then(ntpLoad).catch(function(){});
+});
+$("sy-ntprefresh").addEventListener("click",ntpLoad);
+tabHooks.system={
+  enter:function(){sysLoad();ntpLoad();clearInterval(ntpTimer);ntpTimer=setInterval(ntpTick,1000)},
+  leave:function(){clearInterval(ntpTimer)},
+};

 var CONF_OVERWRITE=[
  /^ip\b/,/^gw\b/,/^netmask\b/,/^hostname\b/,
-  /^syslog\s+ip\b/,/^syslog\s+port\b/,/^passwd\b/,
+  /^syslog\s+ip\b/,/^syslog\s+port\b/,/^dns\s+server\b/,/^passwd\b/,/^session\b/,
+  /^ntp\s+server\b/,/^ntp\s+interval\b/,/^ntp\s+timezone\b/,/^ntp\s+dst\b/,
  /^vlan\s+\d{1,4}\s+mgmt$/,/^vlan\s+\d{1,4}(?!\s+mgmt\b)/,
-  /^pvid\s+\d{1,2}\b/,/^ingress\b/,
+  /^pvid\s+\d{1,2}\b/,
  /^port\s+\d{1,2}(?!\s+name\b)/,/^port\s+\d{1,2}\s+name\b/,
  /^mirror\b/,
  /^lag\s+\d\b/,/^laghash\s+\d\b/,/^isolate\s+\d{1,2}\b/,
  /^stp\s+(prio|hello|maxage|fwd|txhold|version)\b/,
  /^stp\s+(port\s+\d{1,2}|lag\s+[1-4])\s+(edge|cost|prio|guard|filter|p2p)\b/,
-  /^igmp\b/,/^mtu\s+\d{1,2}\b/,
+  /^igmp\b/,/^mtu\s+\d{1,2}\b/,/^storm\s+\d{1,2}\s+(bcast|mcast|ucast|umcast)\b/,
 ];
-var CONF_TOGGLE=[/^(syslog)\s+(on|off)$/,/^(stp)\s+(on|off)$/,/^(stp\s+(port\s+\d{1,2}|lag\s+[1-4]))\s+(on|off)$/];
+var CONF_TOGGLE=[/^(syslog)\s+(on|off)$/,/^(ntp)\s+(on|off)$/,/^(stp)\s+(on|off)$/,/^(stp\s+(port\s+\d{1,2}|lag\s+[1-4]))\s+(on|off)$/];
 function mergeConf(base,texts){
  var conf=base.slice();
  function drop(rx){conf=conf.filter(function(c){return!rx.test(c)})}
@@ -1757,8 +2281,24 @@ function mergeConf(base,texts){
        else drop(/^eee /);
        conf.push(line);return;
      }
+      if((m=line.match(/^lag (\d) lacp off$/))){drop(new RegExp("^lag "+m[1]+" lacp( |$)"));return;}
      if(line==="mirror off"){drop(/^mirror /);return;}
      if(!isConfCmd(line))return;
+      if((m=line.match(/^ingress (.+)$/))){
+        if(/^[tua]$/.test(m[1])){drop(/^ingress /);conf.push(line);return;}
+        var ports={},order=[],last=-1;
+        conf.forEach(function(c,i){if(/^ingress [tua]$/.test(c))last=i;});
+        conf.forEach(function(c,i){
+          var cm=c.match(/^ingress (.+)$/);
+          if(!cm||/^[tua]$/.test(cm[1])||i<last)return;
+          cm[1].split(" ").forEach(function(tk){var n=tk.slice(0,-1);if(!(n in ports))order.push(n);ports[n]=tk;});
+        });
+        m[1].split(" ").forEach(function(tk){var n=tk.slice(0,-1);if(!(n in ports))order.push(n);ports[n]=tk;});
+        conf=conf.filter(function(c){var cm=c.match(/^ingress (.+)$/);return!cm||/^[tua]$/.test(cm[1])});
+        order.sort(function(a,b){return a-b});
+        conf.push("ingress "+order.map(function(n){return ports[n]}).join(" "));
+        return;
+      }
      if((m=line.match(/^bw (in|out) (\d{1,2}) (\S+)$/))){
        var pre="^bw "+m[1]+" "+m[2]+" ";
        if(m[1]==="out"||m[3]==="off")drop(new RegExp(pre));
@@ -1786,18 +2326,18 @@ function mergeConf(base,texts){
  });
  return conf;
 }
-function writeConfig(txt,title){
+function writeConfig(txt,title,fromLog){
  var info=h("p",{class:"small mut"}),warn=h("p",{class:"small"});
  var ed=h("textarea",{class:"cfg",spellcheck:"false",placeholder:t("cw_empty"),style:"min-height:45vh"});
  ed.value=txt.replace(/\r\n/g,"\n");
-  var ok=h("button",{class:"ctl pri",text:t("sy_write"),onclick:function(){closeModal();doWriteConfig(cfgText(ed.value))}});
+  var ok=h("button",{class:"ctl pri",text:t("sy_write"),onclick:function(){closeModal();doWriteConfig(cfgText(ed.value),fromLog)}});
  function refresh(){
-    var v=cfgText(ed.value),bytes=new Blob([v]).size;
+    var v=cfgText(ed.value),bytes=new Blob([v]).size,long=cfgLongLine(v);
    var unknown=v.split("\n").filter(function(l){return l.trim()&&!isConfCmd(l.trim().replace(/\s+/g," "))});
    info.textContent=t("cw_info",{n:bytes});
-    ok.disabled=bytes>2048;
+    ok.disabled=bytes>2048||!!long;
    warn.style.color=ok.disabled?"var(--bad)":"var(--warn)";
-    warn.textContent=ok.disabled?t("cw_toolarge"):(unknown.length?t("cw_unknown")+unknown.join(" | "):"");
+    warn.textContent=bytes>2048?t("cw_toolarge"):long?t("cw_longline",long):(unknown.length?t("cw_unknown")+unknown.join(" | "):"");
  }
  ed.addEventListener("input",refresh);refresh();
  modal(title,h("div",null,[info,warn,ed]),[h("button",{class:"ctl",text:t("c_cancel"),onclick:closeModal}),ok]);
@@ -1806,7 +2346,7 @@ function cfgText(txt){
  txt=txt.replace(/\r\n/g,"\n");
  return txt&&txt.slice(-1)!=="\n"?txt+"\n":txt;
 }
-function doWriteConfig(txt){
+function doWriteConfig(txt,fromLog){
  var form=new FormData();
  form.append("configuration",new Blob([txt],{type:"application/octet-stream"}),"config.txt");
  toast(t("cw_writing"));
@@ -1816,9 +2356,10 @@ function doWriteConfig(txt){
  }).then(function(back){
    back=back.replace(/\0[\s\S]*$/,"").replace(/\r\n/g,"\n").trim();
    if(back!==txt.trim())throw new Error(t("cw_verify_fail"));
-    return api("/cmd_log_clear").catch(function(){});
-  }).then(function(){
-    setDirty(false);
+    if(!fromLog)return false;
+    return api("/cmd_log_clear").then(function(){return true},function(){return true});
+  }).then(function(cleared){
+    if(cleared)setDirty(false);
    $("cfgedit").value=txt;cfgBytes();cfgParseKnown(txt);
    toast(t("cw_saved"),"ok");
  }).catch(function(e){toast(e.message||String(e),"err")});
@@ -1829,16 +2370,32 @@ $("saveBtn").addEventListener("click",function(){
    getText("/config").catch(function(){return""}),
    getText("/cmd_log").catch(function(){return""}),
  ]).then(function(r){
-    var cur=r[0].replace(/\0[\s\S]*$/,"");
-    var merged=mergeConf([],[cur,r[1].replace(/\0[\s\S]*$/,"")]);
-    writeConfig(merged.join("\n"),t("cw_save_title"));
+    var cur=r[0].replace(/\0[\s\S]*$/,"").split(/\r?\n/).map(function(l){return l.trim().replace(/\s+/g," ")}).filter(Boolean);
+    var merged=mergeConf(cur,[r[1].replace(/\0[\s\S]*$/,"")]);
+    writeConfig(merged.join("\n"),t("cw_save_title"),true);
  });
 });

-var fwBuf=null;
+var fwBuf=null,fwOther=false;
+// Every image carries its machine name as a NUL-terminated string, the same
+// one the running switch reports as hw_ver: an image without it was built
+// for another board (SFP, LED and button pins differ between machines).
+function fwForThisSwitch(u){
+  var name=S.info.hw_ver;
+  if(!name)return true;
+  var n=[];
+  for(var i=0;i<name.length;i++)n.push(name.charCodeAt(i)&0xff);
+  n.push(0);
+  outer:for(var p=0;p<=u.length-n.length;p++){
+    for(var k=0;k<n.length;k++)if(u[p+k]!==n[k])continue outer;
+    return true;
+  }
+  return false;
+}
 $("fwfile").addEventListener("change",function(){
  var f=this.files[0];
  fwBuf=null;
+  fwOther=false;
  $("fwup").disabled=true;
  $("fwinfo").textContent="";
  if(!f)return;
@@ -1861,13 +2418,15 @@ $("fwfile").addEventListener("change",function(){
      return;
    }
    fwBuf=f;
-    info.innerHTML='<span style="color:var(--ok)">\u2713 '+esc(t("fw_valid"))+"</span>";
+    fwOther=!fwForThisSwitch(u);
+    info.innerHTML='<span style="color:var(--ok)">\u2713 '+esc(t("fw_valid"))+"</span>"+
+      (fwOther?'<br><span style="color:var(--warn)">\u26a0 '+esc(t("fw_other",{m:S.info.hw_ver}))+"</span>":"");
    $("fwup").disabled=false;
  });
 });
 $("fwup").addEventListener("click",function(){
  if(!fwBuf)return;
-  confirmModal(t("fw_q"),t("fw_d"),function(){
+  confirmModal(t("fw_q"),(fwOther?t("fw_other",{m:S.info.hw_ver})+" ":"")+t("fw_d"),function(){
    var form=new FormData();
    form.append("uploadedfile",fwBuf,fwBuf.name);
    var xhr=new XMLHttpRequest();
@@ -331,8 +331,36 @@ button.danger{background:var(--bad);color:#fff;border-color:transparent}
      </div>
    </section>

+    <section class="tab" id="tab-lldp">
+      <div class="card"><h2 data-i18n="lldp_title">LLDP</h2>
+        <label class="row"><span class="lb" data-i18n="lldp_enabled">Enabled</span>
+          <span class="switch"><input type="checkbox" id="lldp_en"><i></i></span>
+        </label>
+        <div class="scrollx"><table class="t" id="lldp_table">
+          <thead><tr><th data-i18n="c_port">Port Number</th><th data-i18n="lldp_portname">Name</th><th data-i18n="lldp_enable">Send Frames</th></tr></thead>
+          <tbody></tbody></table></div>
+      </div>
+    </section>
+
+    <section class="tab" id="tab-isolate">
+      <div class="card"><h2 data-i18n="iso_title">Port isolation</h2>
+        <p class="small mut" style="margin-bottom:10px" data-i18n="iso_intro">A frame entering a port may only leave through the ports ticked in its row.</p>
+        <div class="scrollx"><table class="t" id="isotbl" style="width:auto"><thead></thead><tbody></tbody></table></div>
+        <p class="small mut" style="margin-top:6px" data-i18n="iso_legend">The cell of the port itself is always allowed.</p>
+        <div style="display:flex;gap:12px;margin-top:10px">
+          <button class="ctl pri" id="isoapply" data-i18n="c_apply">Apply</button>
+          <button class="ctl" id="isoall" data-i18n="iso_all">Allow all</button>
+        </div>
+      </div>
+    </section>
+
    <section class="tab" id="tab-lag">
      <div id="lagwrap" class="grid2"></div>
+      <div class="card" style="margin-top:14px"><h2 data-i18n="lacp_heading">LACP (802.3ad)</h2>
+        <div class="scrollx"><table class="t" id="lacptbl">
+          <thead><tr><th data-i18n="c_port">Port</th><th>LAG</th><th data-i18n="lacp_actor">Actor</th><th data-i18n="lacp_partner">Partner</th><th data-i18n="lacp_rxstate">RX state</th><th data-i18n="lacp_rx">LACPDUs received</th><th data-i18n="lacp_psys">Partner system</th></tr></thead>
+          <tbody></tbody></table></div>
+      </div>
      <p class="small mut" style="margin-top:10px" data-i18n="lag_note">A LAG needs at least one member to be saved in the startup config; applying an empty group clears it.</p>
    </section>

@@ -351,6 +379,12 @@ button.danger{background:var(--bad);color:#fff;border-color:transparent}
          <thead><tr><th data-i18n="c_port">Port</th><th data-i18n="bw_in">Ingress limit</th><th>Mbit/s</th><th data-i18n="bw_exceed">When exceeded</th><th data-i18n="bw_out">Egress limit</th><th>Mbit/s</th><th></th></tr></thead>
          <tbody></tbody></table></div>
      </div>
+      <div class="card"><h2><span data-i18n="sc_title">Storm control</span> <span class="hint" data-i18n="sc_h">per port and traffic type, empty = off</span></h2>
+        <div class="scrollx"><table class="t" id="sctable">
+          <thead><tr><th data-i18n="c_port">Port</th><th data-i18n="sc_bcast">Broadcast</th><th data-i18n="sc_mcast">Multicast</th><th data-i18n="sc_ucast">Unknown unicast</th><th data-i18n="sc_umcast">Unknown multicast</th><th></th></tr></thead>
+          <tbody></tbody></table></div>
+        <p class="small mut" style="margin-top:8px" data-i18n="sc_note">Frames of a type above its limit are dropped where they enter the switch.</p>
+      </div>
    </section>

    <section class="tab" id="tab-system">
@@ -360,6 +394,9 @@ button.danger{background:var(--bad);color:#fff;border-color:transparent}
          <label class="row"><span class="lb" data-i18n="i_ip">IP address</span><input class="in" id="sy-ip" size="15"></label>
          <label class="row"><span class="lb" data-i18n="i_mask">Netmask</span><input class="in" id="sy-mask" size="15"></label>
          <label class="row"><span class="lb" data-i18n="i_gw">Gateway</span><input class="in" id="sy-gw" size="15"></label>
+          <label class="row"><span class="lb" data-i18n="sy_dns1">DNS server</span><input class="in" id="sy-dns1" size="15"></label>
+          <label class="row"><span class="lb" data-i18n="sy_dns2">Second DNS</span><input class="in" id="sy-dns2" size="15"></label>
+          <p class="small mut" id="sy-dnsdhcp"></p>
          <div style="display:flex;gap:10px;margin-top:12px">
            <button class="ctl pri" id="sy-apply" data-i18n="c_apply">Apply</button>
            <button class="ctl" id="sy-dhcp" data-i18n="sy_dhcp" data-i18n-t="sy_dhcp_t">Use DHCP</button>
@@ -375,8 +412,26 @@ button.danger{background:var(--bad);color:#fff;border-color:transparent}
            <input class="in" id="sy-sysip" style="flex:1;min-width:0;width:0" data-i18n-p="sy_sysip">
            <span class="small mut" data-i18n="sy_port">Port</span>
            <input class="in" id="sy-sysport" style="width:64px" type="number" min="1" max="65535"></div>
+          <label class="row" style="justify-content:space-between"><span data-i18n="sy_sesstmo">Session timeout (s)</span>
+            <input class="in" id="sy-sesstmo" style="width:80px" type="number" min="1" max="65535"></label>
          <p class="small mut" data-i18n="sy_services_note">Service state reflects the startup config; runtime state is not readable.</p>
        </div>
+        <div class="card" id="sy-ntpcard"><h2 data-i18n="sy_time">Time</h2>
+          <label class="row" style="justify-content:space-between"><span data-i18n="sy_ntp">NTP</span>
+            <span class="switch"><input type="checkbox" id="sy-ntp"><i></i></span></label>
+          <label class="row"><span class="lb" data-i18n="sy_ntpsrv">NTP server</span><input class="in" id="sy-ntpsrv" maxlength="47" data-i18n-p="sy_ntpsrv_p"></label>
+          <label class="row"><span class="lb" data-i18n="sy_ntpint">Poll interval [min]</span><input class="in sm" id="sy-ntpint" type="number" min="1" max="1440"></label>
+          <label class="row"><span class="lb" data-i18n="sy_tz">Time zone</span><select class="in" id="sy-tz"></select></label>
+          <label class="row"><span class="lb" data-i18n="sy_dst">Daylight saving</span><select class="in" id="sy-dst"><option value="off" data-i18n="c_offc">Off</option><option value="eu" data-i18n="sy_dst_eu">Europe</option><option value="us" data-i18n="sy_dst_us">United States</option></select></label>
+          <div style="display:flex;gap:10px;margin-top:8px">
+            <button class="ctl pri" id="sy-ntpapply" data-i18n="c_apply">Apply</button>
+            <button class="ctl" id="sy-ntprefresh" data-i18n="c_refresh">Refresh</button>
+          </div>
+          <label class="row" style="margin-top:10px"><span class="lb" data-i18n="sy_now">Local time</span><span class="mono" id="sy-now">-</span></label>
+          <label class="row"><span class="lb" data-i18n="sy_sync">Last synchronisation</span><span id="sy-sync">-</span></label>
+          <label class="row"><span class="lb" data-i18n="sy_ntpaddr">Server address</span><span class="mono" id="sy-ntpaddr">-</span></label>
+          <p class="small mut" style="margin-top:8px" data-i18n="sy_time_note">The switch has no battery backed clock.</p>
+        </div>
        <div class="card"><h2 data-i18n="sy_password">Admin password</h2>
          <label class="row"><span class="lb" data-i18n="sy_newpw">New password</span><input class="in" id="sy-pw1" type="password" maxlength="20"></label>
          <label class="row"><span class="lb" data-i18n="sy_repeat">Repeat</span><input class="in" id="sy-pw2" type="password" maxlength="20"></label>
@@ -393,10 +448,13 @@ button.danger{background:var(--bad);color:#fff;border-color:transparent}
        <div class="card"><h2 data-i18n="sy_display">Display</h2>
          <label class="row"><span class="lb" data-i18n="sy_lang">Language</span>
            <select class="in" id="langSel">
+              <option value="de">Deutsch</option>
              <option value="en">English</option>
+              <option value="es">Español</option>
+              <option value="fr">Français</option>
              <option value="ja">日本語</option>
              <option value="zh">中文</option>
-              <option value="es">Español</option>
+              
            </select></label>
          <label class="row"><span class="lb" data-i18n="sy_theme">Theme</span>
            <select class="in" id="themeSel">
@@ -81,17 +81,23 @@ button:hover{filter:brightness(1.1)}
 <script>
 (function(){
  var L={
+    de:["Switch-Anmeldung","RTLPlayground-Verwaltungsoberfläche","Passwort","Anmelden","Falsches Passwort, bitte erneut versuchen."],
    en:["Switch Login","RTLPlayground management interface","Password","Sign in","Wrong password, try again."],
    ja:["スイッチ ログイン","RTLPlayground 管理インターフェース","パスワード","ログイン","パスワードが違います。もう一度お試しください。"],
    zh:["交换机登录","RTLPlayground 管理界面","密码","登录","密码错误，请重试。"],
-    es:["Inicio de sesión del switch","Interfaz de gestión de RTLPlayground","Contraseña","Iniciar sesión","Contraseña incorrecta, inténtalo de nuevo."]
+    es:["Inicio de sesión del switch","Interfaz de gestión de RTLPlayground","Contraseña","Iniciar sesión","Contraseña incorrecta, inténtalo de nuevo."],
+    fr:["Utilisateur du commutateur","Interface de management RTLPlayground","Mot de passe","Se connecter","Mot de passe erronné, essayez à nouveau."]
  };
  var l=null;
  try{l=localStorage.getItem("rtl_lang");}catch(e){}
  if(!L[l])l=(navigator.language||"en").slice(0,2);
  var s=L[l]||L.en;
-  document.title=s[0];
-  document.getElementById("hn").textContent=s[0];
+  // Name the tab after the switch: the hostname seen at the last login here,
+  // otherwise the address, so several open switches can be told apart
+  var host=null;
+  try{host=localStorage.getItem("rtl_host");}catch(e){}
+  document.title=(host||location.hostname)+" – "+s[0];
+  document.getElementById("hn").textContent=host||s[0];
  document.getElementById("sub").textContent=s[1];
  document.getElementById("lp").textContent=s[2];
  document.getElementById("lb").textContent=s[3];
@@ -12,7 +12,11 @@
 #include "debug.h"

 #define SESSION_ID_LENGTH 12
-#define SESSION_TIMEOUT 200
+#define SESSION_TIMEOUT_DEFAULT 200
+
+/* Seconds of inactivity after which a session cookie stops validating.
+ * Configurable with the "session" command, see cmd_parser.c. */
+__xdata uint16_t session_timeout = SESSION_TIMEOUT_DEFAULT;

 #define CMARK_S 6

@@ -342,7 +346,7 @@ __xdata uint8_t *scan_header(__xdata uint8_t * __xdata p)
 	read_reg_timer(&now);

 	if (session && session_id[0]) {
-		if (now - last_session_use > SESSION_TIMEOUT) {
+		if (now - last_session_use > session_timeout) {
 			dbg_string("Session expired\n");
 		} else {
 			if (is_word_x(session, session_id)) {
@@ -377,8 +381,8 @@ void gen_random_hex_chars(__xdata uint8_t * b, __xdata uint8_t bytes)
 static uint8_t config_take(void)
 {
 	// #386: needs static, otherwise it still lands in SRAM/DSEG
-	static __xdata uint16_t cfg_pos, cfg_hdr, cfg_body, cfg_end, cfg_last;
-	__xdata uint8_t cfg_bl;
+	static __xdata uint16_t cfg_pos, cfg_hdr, cfg_body, cfg_end, cfg_last, cfg_i;
+	__xdata uint8_t cfg_bl, cfg_run;

 	cfg_bl = strlen_x(boundary);

@@ -420,6 +424,13 @@ static uint8_t config_take(void)
 				// the payload plus its terminator must fit the sector
 				if (cfg_end - cfg_body + 1 > CONFIG_LEN)
 					return 2;
+				cfg_run = 0;
+				for (cfg_i = cfg_body; cfg_i < cfg_end; cfg_i++) {
+					if (config_buf[cfg_i] == '\n')
+						cfg_run = 0;
+					else if (++cfg_run >= CMD_BUF_SIZE - 1)
+						return 2;
+				}
 				config_buf[cfg_end] = 0;
 				flash_region.addr = CONFIG_START;
 				flash_sector_erase();
@@ -1005,6 +1016,8 @@ void httpd_appcall(void)
 				send_eee();
 			} else if (is_word(q, "/bandwidth.json")) {
 				send_bandwidth();
+			} else if (is_word(q, "/storm.json")) {
+				send_storm();
 			} else if (is_word(q, "/l2.json")) {
 				parse_short(q + 13); // e.g.: /l2.json?idx=10
 				send_l2(short_parsed);
@@ -1013,12 +1026,18 @@ void httpd_appcall(void)
 				l2_delete(short_parsed);
 			} else if (is_word(q, "/mirror.json")) {
 				send_mirror();
+			} else if (is_word(q, "/isolation.json")) {
+				send_isolation();
 			} else if (is_word(q, "/mtu.json")) {
 				send_mtu();
 			} else if (is_word(q, "/lag.json")) {
 				send_lag();
 			} else if (is_word(q, "/stp.json")) {
 				send_stp();
+			} else if (is_word(q, "/lldp.json")) {
+				send_lldp();
+			} else if (is_word(q, "/lacp.json")) {
+				send_lacp();
 			} else if (is_word(q, "/vlanlist")) {
 				send_vlanlist();
 			} else if (is_word(q, "/config")) {
@@ -3,6 +3,7 @@
 #include "rtl837x_sfr.h"
 #include "rtl837x_common.h"
 #include "rtl837x_regs.h"
+#include "rtl837x_storm.h"
 #include "rtl837x_port.h"
 #include "rtl837x_flash.h"
 #include "rtl837x_pins.h"
@@ -13,6 +14,7 @@
 #include "version.h"
 #include "machine.h"
 #include "rtl837x_stp.h"
+#include "rtl837x_lacp.h"
 #include "page_impl.h"
 #include "syslog.h"

@@ -28,6 +30,7 @@ extern __code const struct machine machine;
 extern __xdata uint8_t outbuf[TCP_OUTBUF_SIZE];
 extern __xdata uint16_t slen;
 extern __xdata uint16_t management_vlan;
+extern __xdata uint16_t session_timeout;
 extern __xdata uint16_t cont_len;
 extern __xdata uint32_t cont_addr;
 extern __code const uint8_t * __code const hex;
@@ -47,6 +50,9 @@ extern __xdata char sfp_module_model[2][17];
 extern __xdata char sfp_module_serial[2][17];
 extern __xdata uint8_t sfp_options[2];

+extern __xdata uint16_t lldp_logical_port_status;
+extern __xdata bool lldp_enabled;
+
 __code const uint8_t * __code const HTTP_RESPONCE_JSON = "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: application/json\r\n\r\n";
 __code const uint8_t * __code const HTTP_RESPONCE_TXT = "HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: text/plain\r\n\r\n";

@@ -114,12 +120,14 @@ void itoa_html(uint8_t v)
 	char_to_html('0' + (v % 10));
 }

-void itoa16_html(uint16_t v) /* sufficient for VLAN IDs (max 4094) */
+void itoa16_html(uint16_t v) /* up to five digits (65535) */
 {
 	uint8_t print_zeros = 0;
 	uint8_t d;
-	d = v / 1000;
+	d = v / 10000;
 	if (d) { char_to_html('0' + d); print_zeros = 1; }
+	d = (v / 1000) % 10;
+	if (d || print_zeros) { char_to_html('0' + d); print_zeros = 1; }
 	d = (v / 100) % 10;
 	if (d || print_zeros) { char_to_html('0' + d); print_zeros = 1; }
 	d = (v / 10) % 10;
@@ -132,6 +140,23 @@ void string_to_html(__code const char *s)
 	while (*s) char_to_html(*s++);
 }

+static void temp_to_html(void)
+{
+	int16_t v;
+
+	reg_read(RTL837X_TM_RESULT);
+	v = SFR_DATA_U16;
+	if (v < 0) {
+		char_to_html('-');
+		v = -v;
+	}
+	itoa_html(v >> 7);
+	char_to_html('.');
+	itoa_html(((v & 0x7f) * 10) >> 7);
+	char_to_html(' ');
+	char_to_html('C');
+}
+
 uint16_t stat_content(void)
 {
 	dbg_string("stat_content called\n");
@@ -258,7 +283,9 @@ void send_basic_info(void)
 	itoa_html(syslog_state.server_ip[2]); char_to_html('.');
 	itoa_html(syslog_state.server_ip[3]); char_to_html(':');
 	itoa16_html(syslog_state.server_port);
-	slen += strtox(outbuf + slen, "\",\"mac_address\":\"");
+	slen += strtox(outbuf + slen, "\",\"session_timeout\":");
+	itoa16_html(session_timeout);
+	slen += strtox(outbuf + slen, ",\"mac_address\":\"");
 	byte_to_html(uip_ethaddr.addr[0]); char_to_html(':');
 	byte_to_html(uip_ethaddr.addr[1]); char_to_html(':');
 	byte_to_html(uip_ethaddr.addr[2]); char_to_html(':');
@@ -277,6 +304,8 @@ void send_basic_info(void)
 	slen += strtox(outbuf + slen, BUILD_DATE);
 	slen += strtox(outbuf + slen, "\",\"hw_ver\":\"");
 	slen += strtox(outbuf + slen, machine.machine_name);
+	slen += strtox(outbuf + slen, "\",\"chip_temp\":\"");
+	temp_to_html();
 	slen += strtox(outbuf + slen, "\",\"flash_size\":\"");
 	string_to_html(get_flash_size_str());

@@ -594,7 +623,6 @@ static void bridge_to_html(void)
 		byte_to_html(pi_mac[i]);
 }

-
 void send_stp(void)
 {
 	uint8_t i, j, st, dsg;
@@ -709,8 +737,84 @@ void send_stp(void)
 	slen += strtox(outbuf + slen, "]}");
 }

+void send_lacp(void)
+{
+	dbg_string("send_lacp called\n");
+	slen = strtox(outbuf, HTTP_RESPONCE_JSON);

+	slen += strtox(outbuf + slen, "{\"on\":");
+	bool_to_html(lacpEnabled);
+	slen += strtox(outbuf + slen, ",\"lags\":[");
+	for (uint8_t l = 0; l < LACP_NUM_LAGS; l++) {
+		slen += strtox(outbuf + slen, "{\"cfg\":\"");
+		byte_to_html(lacp_lag_ports[l] >> 8);
+		byte_to_html(lacp_lag_ports[l]);
+		slen += strtox(outbuf + slen, "\",\"aggValid\":");
+		bool_to_html(lacp_agg_valid[l]);
+		slen += strtox(outbuf + slen, ",\"agg\":\"");
+		for (uint8_t j = 0; j < MAC_ADDR_LEN; j++)
+			byte_to_html(lacp_agg_sys[l][j]);
+		slen += strtox(outbuf + slen, "\",\"members\":\"");
+		byte_to_html(lacp_members_last[l] >> 8);
+		byte_to_html(lacp_members_last[l]);
+		slen += strtox(outbuf + slen, "\"},");
+	}
+	slen -= 1; // remove comma
+	slen += strtox(outbuf + slen, "],\"ports\":[");
+	for (uint8_t i = machine.min_port; i <= machine.max_port; i++) {
+		slen += strtox(outbuf + slen, "{\"p\":");
+		itoa_html(machine.log_to_phys_port[i]);
+		slen += strtox(outbuf + slen, ",\"lag\":");
+		itoa_html(lacp_port_lag[i]);
+		slen += strtox(outbuf + slen, ",\"a\":\"");
+		byte_to_html(lacp_actor_state[i]);
+		slen += strtox(outbuf + slen, "\",\"pt\":\"");
+		byte_to_html(lacp_partner_state[i]);
+		slen += strtox(outbuf + slen, "\",\"rs\":");
+		itoa_html(lacp_rx_state[i]);
+		slen += strtox(outbuf + slen, ",\"rx\":\"");
+		byte_to_html(lacp_rx_count[i] >> 8);
+		byte_to_html(lacp_rx_count[i]);
+		slen += strtox(outbuf + slen, "\",\"psys\":\"");
+		for (uint8_t j = 0; j < MAC_ADDR_LEN; j++)
+			byte_to_html(lacp_partner_sys[i][j]);
+		slen += strtox(outbuf + slen, "\"},");
+	}
+	slen -= 1; // remove comma
+	slen += strtox(outbuf + slen, "]}");
+}

+void send_lldp(void)
+{
+	dbg_string("send_lldp called\n");
+	slen = strtox(outbuf, HTTP_RESPONCE_JSON);
+
+	slen += strtox(outbuf + slen, "{\"on\":");
+	bool_to_html(lldp_enabled);
+	slen += strtox(outbuf + slen, ",\"portStatus\":[");
+
+	for (uint8_t i = machine.min_port; i <= machine.max_port; i++) {
+		slen += strtox(outbuf + slen, "{\"portNum\":");
+		itoa_html(machine.log_to_phys_port[i]);
+
+		slen += strtox(outbuf + slen, ",\"logPort\":");
+		itoa_html(i);
+		slen += strtox(outbuf + slen, ",\"name\":\"");
+		for (uint8_t j = 0; j < PORT_NAME_SIZE && port_names[i][j]; j++) {
+			json_char_to_html(port_names[i][j]);
+		}
+
+		slen += strtox(outbuf + slen, "\",\"permitted\":");
+		bool_to_html(1 & (lldp_logical_port_status >> i));
+		slen += strtox(outbuf + slen, "}");
+
+		if (i < machine.max_port)
+			char_to_html(',');
+		else
+			char_to_html(']');
+	}
+	char_to_html('}');
+}

 void send_eee(void)
 {
@@ -804,6 +908,63 @@ void send_bandwidth(void)
 }


+void send_storm(void)
+{
+	__xdata uint8_t i, t, idx;
+
+	slen = strtox(outbuf, HTTP_RESPONCE_JSON);
+	char_to_html('[');
+	for (i = machine.min_port; i <= machine.max_port; i++) {
+		slen += strtox(outbuf + slen, "{\"portNum\":");
+		itoa_html(machine.log_to_phys_port[i]);
+		slen += strtox(outbuf + slen, ",\"en\":\"");
+		for (t = 0; t < STORM_TYPES; t++)
+			char_to_html(reg_bit_test(RTL837X_STORM_CTRL + (t << 2), i) ? '1' : '0');
+		slen += strtox(outbuf + slen, "\",\"pps\":\"");
+		for (t = 0; t < STORM_TYPES; t++) {
+			idx = STORM_METER(i, t);
+			char_to_html(reg_bit_test(RTL837X_METER_MODE + ((idx >> 5) << 2), idx & 0x1f) ? '1' : '0');
+		}
+		slen += strtox(outbuf + slen, "\",\"rate\":\"");
+		for (t = 0; t < STORM_TYPES; t++) {
+			reg_read_m(RTL837X_METER_RATE + (STORM_METER(i, t) << 2));
+			byte_to_html(sfr_data[1]);
+			byte_to_html(sfr_data[2]);
+			byte_to_html(sfr_data[3]);
+		}
+		char_to_html('"');
+		char_to_html('}');
+		if (i < machine.max_port)
+			char_to_html(',');
+		else
+			char_to_html(']');
+	}
+}
+
+
+void send_isolation(void)
+{
+	__xdata uint16_t allow;
+
+	dbg_string("send_isolation called\n");
+	slen = strtox(outbuf, HTTP_RESPONCE_JSON);
+	char_to_html('[');
+	for (uint8_t i = machine.min_port; i <= machine.max_port; i++) {
+		slen += strtox(outbuf + slen, "{\"portNum\":");
+		itoa_html(machine.log_to_phys_port[i]);
+		slen += strtox(outbuf + slen, ",\"allow\":\"");
+		allow = port_isolation_get(i);
+		byte_to_html(allow >> 8);
+		byte_to_html(allow & 0xff);
+		char_to_html('"');
+		char_to_html('}');
+		if (i < machine.max_port)
+			char_to_html(',');
+	}
+	char_to_html(']');
+}
+
+
 void send_mtu(void)
 {
 	dbg_string("send_mtu called\n");
@@ -1011,7 +1172,7 @@ void send_cmd_log(void)
 	__xdata uint8_t found_begin = 0;
 	dbg_string("History ptr: ");
 	dbg_short(cmd_history_ptr); dbg_char('\n');
-	while (p != cmd_history_ptr) {
+	while (p != cmd_history_ptr && slen < TCP_OUTBUF_SIZE) {
 		if (!cmd_history[p] || cmd_history[p] == '\n')
 			found_begin = 1;
 		if (found_begin && cmd_history[p])
@@ -1036,8 +1197,7 @@ void send_vlanlist(void)
 	slen += strtox(outbuf + slen, ",\"vlan\":[");

 	for (i = 1; i < 4095; i++) {
-		if (vlan_get(i) < 0)
-			continue;
+		vlan_get(i);
 		if (!(sfr_data[0] & 0x02)) /* bit 1: VLAN table entry valid */
 			continue;

@@ -5,20 +5,26 @@

 extern __code const uint8_t * __code const HTTP_RESPONCE_TXT;

+void itoa16_html(uint16_t v);
+
 bool send_counters(uint8_t phys_port);
 void send_status(void);
 void send_vlan(uint16_t vlan);
 void send_basic_info(void);
 void send_bandwidth(void);
+void send_storm(void);
 void send_eee(void);
 void send_l2(uint16_t idx);
 void l2_delete(uint16_t idx);
 void send_mirror(void);
 void send_mtu(void);
+void send_isolation(void);
 void send_config(void);
 void send_cmd_log(void);
 void send_lag(void);
 void send_stp(void);
+void send_lldp(void);
+void send_lacp(void);
 void send_vlanlist(void);

 /*  Convert only the lower nibble to ascii HEX char.
@@ -3,52 +3,19 @@

 #include <stdint.h>

-/*
- * Select your machine type below
- */
-// Legacy KP-9000 4+2 targets. Prefer the PCB-revision-specific targets below.
-// #define MACHINE_KP_9000_6XHML_X2
-// #define MACHINE_KP_9000_6XH_X2
+#define MACHINE_STR_HELPER(x)  #x
+#define MACHINE_STR(x) MACHINE_STR_HELPER(x)

-// KP-9000 4+2 targets by PCB silkscreen revision.
-// #define MACHINE_KP_9000_6XH_X2_V1_1
-// #define MACHINE_KP_9000_6XHML_X2_V1_1
-// #define MACHINE_KP_9000_6XH_X2_V1_2
-// #define MACHINE_KP_9000_6XHML_X2_V1_2
-// #define MACHINE_KP_9000_6XH_X2_V2_1
-// #define MACHINE_KP_9000_6XHML_X2_V2_1

-// #define MACHINE_KP_9000_6XH_X
-// #define MACHINE_KP_9000_9XH_X_EU
-// #define MACHINE_KP_9000_9XHML_X_V2_2
-// #define MACHINE_KP_9000_9XHML_X_V3_1
-// #define MACHINE_SWGT024_V2_0_MANAGED
-// #define MACHINE_SWGT024_V2_0_UNMANAGED
-// #define MACHINE_TRENDNET_TEG_S562
-// #define MACHINE_HG0402XG_V1_1
-// #define MACHINE_SWTG018AS_A_V_2_0
-// #define MACHINE_SWTGW218AS
-// #define MACHINE_PCB_SWTG018AS_V2_1_0
-// #define MACHINE_PCB_K0402WS_V3
-// #define MACHINE_PCB_K0402WS_V2
-// #define MACHINE_K0501W_V2_0
-// #define MACHINE_LIANGUO_ZX_SWTGW215AS
-// #define MACHINE_ZX310S_4T2XH
-// #define MACHINE_ZX310S_4T2XT
-// #define MACHINE_STEAMEMO_IG204_V1
-// #define MACHINE_DEFAULT_8C_1SFP
-// #define MACHINE_HI_K0801WS
-// #define MACHINE_FNS1200P
-// #define MACHINE_PCB_SWTG024AS_A_2_0_1
-// #define MACHINE_SWTG024AS_A_2_0_1_5C_1SFP
-// #define MACHINE_SWTG024AS_V2_0
-// #define MACHINE_FG_4GT_2SX_V2_0
-// #define MACHINE_FG_8GT_1SX
-// #define MACHINE_LIANGUO_HYWS_SGT0108S
-// #define MACHINE_POE_2G080110GS
-// #define MACHINE_PB_2132
-// #define MACHINE_HASIVO_S600W_4GT_2XGT_SE
-// #define MACHINE_F7008_2_5
+#define MACHINE_DEF_DIR machine
+
+#ifndef MACHINE_NAME
+	#define MACHINE_NAME default_machine
+#endif
+
+#define MACHINE_INC(dir,file) MACHINE_STR(dir/file)
+
+#include  MACHINE_INC(MACHINE_DEF_DIR,MACHINE_NAME.h)

 #define LED_27 1
 // SYSTEM LED
@@ -0,0 +1,25 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 1,
+	.min_port = 0,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = {1, 2, 3, 4, 5, 6, 7, 8, 9},
+	.phys_to_log_port = {0, 1, 2, 3, 4, 5, 6, 7, 8},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO37,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO_NA,
+	.high_leds = { .mux = LED_27 | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 0},
+	.led_sets = { { LEDS_2G5 | LEDS_TWO_PAIR_1G | LEDS_1G | LEDS_500M | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT | LEDS_10G | LEDS_TWO_PAIR_5G | LEDS_5G | LEDS_TWO_PAIR_2G5,
+			LEDS_2G5 | LEDS_LINK,
+			LEDS_1G | LEDS_LINK,
+			LEDS_2G5 | LEDS_LINK | LEDS_ACT },
+		    },
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_DEFAULT_8C_1SFP_H_
+#define _MACHINE_DEFAULT_8C_1SFP_H_
+
+#define MACHINE_MODEL "8+1 SFP Port Switch"
+
+#endif
@@ -0,0 +1,41 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 1,
+	.min_port = 0,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = {1, 2, 3, 4, 5, 6, 7, 8, 9},
+	.phys_to_log_port = {0, 1, 2, 3, 4, 5, 6, 7, 8},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO37,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO_NA,
+	.high_leds = { .mux = LED_27 | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.led_sets = {
+		{	/* SET0 */
+			LEDS_2G5 | LEDS_LINK,				/* LEDID0 - green: 2.5G link */
+			LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,	/* LEDID1 - yellow: traffic */
+			0,
+			0,
+		},
+		{	/* SET1 - SFP+ */
+			LEDS_10G | LEDS_5G | LEDS_2G5 | LEDS_LINK,
+			LEDS_10G | LEDS_5G | LEDS_2G5 | LEDS_1G | LEDS_LINK | LEDS_ACT,
+			0,
+			0,
+		},
+	},
+	.led_mux_custom = 1,
+	.led_mux = {
+		0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x0c, 0x02,
+		0x0d, 0x10, 0x11, 0x02, 0x14, 0x02, 0x02, 0x15,
+		0x02, 0x02, 0x18, 0x02, 0x02, 0x19, 0x02, 0x02,
+		0x1c, 0x1d, 0x02, 0x02,
+	},
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_F7008_2_5_H_
+#define _MACHINE_F7008_2_5_H_
+
+#define MACHINE_MODEL "F7008-2.5 8+1 SFP Port Switch"
+
+#endif
@@ -0,0 +1,66 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 0,
+	.min_port = 3,
+	.max_port = 8,
+	.n_sfp = 2,
+	.log_to_phys_port = {0, 0, 0, 6, 1, 2, 3, 4, 5},
+	.phys_to_log_port = {4, 5, 6, 7, 8, 3, 0, 0, 0},
+	.is_sfp = {0, 0, 0, 2, 0, 0, 0, 0, 1},
+	
+	// Left SFP port
+	.sfp_port[0].pin_detect = GPIO38, 
+	.sfp_port[0].pin_los = GPIO_NA, 
+	.sfp_port[0].sds = 1, 
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+
+	// Right SFP port
+	.sfp_port[1].pin_detect = GPIO37,
+	.sfp_port[1].pin_los = GPIO_NA, 
+	.sfp_port[1].sds = 0, 
+	.sfp_port[1].i2c = I2CBUS( GPIO41_I2C_SDA3_MDIO1, GPIO40_I2C_SCL3_MDC1 ),
+
+	.reset_pin = GPIO_NA,
+	.high_leds = { .mux = LED_27 | LED_28_SYS | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 1, 0, 0, 0, 0, 1},
+	/* Ports 1-4 RJ45 use set 0, port 5-6 SFP uses set 1 
+	 * Ports 1-4: Green: 2.5GBit, Amber: 10/100/1000MBit
+	 * Ports 5-6: Green: 100MBit-10GBit
+	 */
+	.led_sets = { 
+			{
+				LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+				LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+				0,
+				LEDS_2G5 | LEDS_LINK | LEDS_ACT
+			},
+			{  
+				LEDS_10G | LEDS_5G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+				LEDS_10G | LEDS_LINK,
+				0,
+				LEDS_COL | LEDS_DUPLEX
+			},
+			{
+				LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+				LEDS_2G5 | LEDS_1G | LEDS_LINK,
+				LEDS_5G | LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+				LEDS_10G | LEDS_LINK | LEDS_ACT
+			},
+			{
+				LEDS_TX,
+				LEDS_RX,
+				LEDS_10G | LEDS_TWO_PAIR_5G | LEDS_5G | LEDS_TWO_PAIR_2G5 |
+					LEDS_2G5 | LEDS_TWO_PAIR_1G | LEDS_1G | LEDS_500M | LEDS_100M | LEDS_10M | LEDS_ACT,
+				LEDS_10G | LEDS_TWO_PAIR_5G | LEDS_5G | LEDS_TWO_PAIR_2G5 |
+					LEDS_2G5 | LEDS_TWO_PAIR_1G | LEDS_1G | LEDS_500M | LEDS_100M | LEDS_10M | LEDS_LINK
+			},
+	 },
+	.led_mux_custom = 1,
+	.led_mux = {
+				0x0c, 0x0d, 0x0e, 0x10, 0x11, 0x12, 0x14, 0x3f, 0x15, 0x16,
+				0x18, 0x0e, 0x19, 0x11, 0x12, 0x1a, 0x15, 0x16, 0x1c, 0x19,
+				0x1a, 0x1d, 0x1d, 0x1e, 0x1e, 0x20, 0x21, 0x22
+		},
+	};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_FG_4GT_2SX_V2_0_H_
+#define _MACHINE_FG_4GT_2SX_V2_0_H_
+
+#define MACHINE_MODEL "FG-4GT-2SX_V2.0"
+
+#endif
@@ -0,0 +1,45 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 1,
+	.min_port = 0,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = {1, 2, 3, 4, 5, 6, 7, 8, 9},
+	.phys_to_log_port = {0, 1, 2, 3, 4, 5, 6, 7, 8},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.sfp_port[0].pin_detect = GPIO38,
+	.sfp_port[0].pin_los = GPIO_NA,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO_NA,
+	.high_leds = { .mux = LED_27 | LED_28_SYS | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.led_sets = {
+		/*
+			Ports 1-8: Left Amber 10/100/1000MBit (Vendor no 10M, but we add it)
+					   Right Green 2.5GBit
+			SFP-port: Any speed
+		*/
+		{
+			LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+			LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+			0,
+			0,
+		},
+		{
+			LEDS_10G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+			0,
+			0,
+			0,
+		},
+	},
+	.led_mux_custom = 1,
+	.led_mux = {
+		0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x0c, 0x09, 0x0d, 0x10,
+		0x11, 0x0e, 0x14, 0x11, 0x12, 0x15, 0x15, 0x16, 0x18, 0x19,
+		0x1a, 0x19, 0x1d, 0x1e, 0x1c, 0x1d, 0x20, 0x21,
+	},
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_FG_8GT_1SX_H_
+#define _MACHINE_FG_8GT_1SX_H_
+
+#define MACHINE_MODEL "FG-8GT-1SX"
+
+#endif
@@ -0,0 +1,55 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+    .machine_name = MACHINE_MODEL,
+    .isRTL8373 = 0,
+    .min_port = 3,
+    .max_port = 8,
+    .n_sfp = 2,
+    .log_to_phys_port = {0, 0, 0, 6, 1, 2, 3, 4, 5},
+    .phys_to_log_port = {4, 5, 6, 7, 8, 3, 0, 0, 0},
+    .is_sfp = {0, 0, 0, 2, 0, 0, 0, 0, 1},
+
+    /* Left SFP (logical 8, SDS1): GPIO30=ModAbs, GPIO37=RX_LOS */
+    .sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+    .sfp_port[0].pin_los = GPIO37,
+    .sfp_port[0].pin_tx_disable = GPIO_NA,
+    .sfp_port[0].sds = 1,
+    .sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+
+    /* Right SFP (logical 3, SDS0): GPIO50=ModAbs, GPIO51=RX_LOS */
+    .sfp_port[1].pin_detect = GPIO50_I2C_SCL2_UART1_TX,
+    .sfp_port[1].pin_los = GPIO51_I2C_SDA2_UART1_RX,
+    .sfp_port[1].pin_tx_disable = GPIO_NA,
+    .sfp_port[1].sds = 0,
+    .sfp_port[1].i2c = I2CBUS( GPIO41_I2C_SDA3_MDIO1, GPIO40_I2C_SCL3_MDC1 ),
+
+    .reset_pin = GPIO_NA,
+
+    .high_leds = { .mux = LED_27 | LED_28_SYS | LED_29, .enable = LED_28_SYS | LED_29 },
+
+    /* Copper ports use SET0; SFP ports use SET1 */
+    .port_led_set = {0, 0, 0, 1, 0, 0, 0, 0, 1},
+
+    .led_sets = {
+        {   /* SET0: copper — LED0=amber (2.5G), LED2=green (1G/100M/10M) */
+            LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+            0,
+            LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+            0
+        },
+        {   /* SET1: SFP — all speeds link/act */
+            LEDS_10G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+            0,
+            0, 0
+        },
+    },
+
+    .led_mux_custom = 1,
+    .led_mux = {
+        0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x3f,  /* GPIO0-7: unused */
+        0x0f, 0x0c, 0x0d, 0x0e, 0x10, 0x11, 0x12,          /* GPIO8-14 */
+        0x14, 0x15, 0x16, 0x18, 0x19, 0x1a,                 /* GPIO15-20 */
+        0x1c, 0x1d, 0x1e, 0x20, 0x21, 0x22, 0x23            /* GPIO21-27 */
+    },
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_FNS1200P_H_
+#define _MACHINE_FNS1200P_H_
+
+#define MACHINE_MODEL "FNS-1200P"
+
+#endif
@@ -0,0 +1,32 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 1,
+	.mac_flash_offset = 0x1FC000,
+	.min_port = 0,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = {1, 2, 3, 4, 5, 6, 7, 8, 9},
+	.phys_to_log_port = {0, 1, 2, 3, 4, 5, 6, 7, 8},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO37,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO54_ACL_BIT2_EN,
+	.high_leds = { .mux = LED_27 | LED_28_SYS | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.led_sets = { { LEDS_2G5 | LEDS_LINK | LEDS_ACT, // Green LED (right)
+					0,
+					LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT, // Amber LED (left)
+					0
+				  },
+				  { LEDS_10G | LEDS_5G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_LINK | LEDS_ACT, // SFP LED
+					0, 
+					0,
+					0
+				  },
+				},
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_HASIVO_S1100WP_8GT_1SX_SE_H_
+#define _MACHINE_HASIVO_S1100WP_8GT_1SX_SE_H_
+
+#define MACHINE_MODEL "Hasivo S1100WP-8GT-1SX-SE"
+
+#endif
@@ -0,0 +1,43 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+    .machine_name = MACHINE_MODEL,
+    .isRTL8373 = 0,
+    .min_port = 3,
+    .max_port = 8,
+    .n_sfp = 0,
+    .n_10g = 2,
+    .log_to_phys_port = {0, 0, 0, 5, 1, 2, 3, 4, 6},
+    .phys_to_log_port = {4, 5, 6, 7, 3, 8, 0, 0, 0},
+    .is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 0},
+    .reset_pin = GPIO54_ACL_BIT2_EN,
+    .high_leds = { .mux = LED_28_SYS | LED_29, .enable = LED_28_SYS | LED_29 },
+    .port_led_set = { 0, 0, 0, 1, 0, 0, 0, 0, 1 },
+    /* Ports 1-4: Green: 2.5GBit, Orange: 10/100/1000MBit
+     * Ports 5-6: Green: 10GBit, Orange: 5/2.5GBit, None: 10/100/1000MBit
+     */
+    .led_sets = {
+        {
+            LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT, // Yellow
+            LEDS_2G5 | LEDS_LINK, // Green
+            LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK, // Orange
+            0, // Unused
+        },
+        {
+            LEDS_10G | LEDS_5G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT, // Yellow
+            LEDS_10G | LEDS_LINK, // Green
+            LEDS_5G | LEDS_2G5 | LEDS_LINK, // Orange
+            0, // Unused
+        },
+    },
+    .led_mux_custom = 1,
+    .led_mux = {
+        0x3f, 0x3f, 0x3f, 0x3f, 0x3f,
+        0x3f, 0x3f, 0x3f, 0x0f, 0x20,
+        0x21, 0x22, 0x10, 0x11, 0x12,
+        0x14, 0x15, 0x16, 0x18, 0x19,
+        0x1a, 0x1c, 0x1d, 0x1e, 0x0c,
+        0x0d, 0x0e, 0x23
+    },
+
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_HASIVO_S600W_4GT_2XGT_SE_H_
+#define _MACHINE_HASIVO_S600W_4GT_2XGT_SE_H_
+
+#define MACHINE_MODEL "Hasivo S600W-4GT-2XGT-SE"
+
+#endif
@@ -0,0 +1,38 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 0,
+	.min_port = 3,
+	.max_port = 8,
+	.n_sfp = 2,
+	.log_to_phys_port = {0, 0, 0, 5, 1, 2, 3, 4, 6},
+	.phys_to_log_port = {4, 5, 6, 7, 3, 8, 0, 0, 0},
+	.is_sfp = {0, 0, 0, 2, 0, 0, 0, 0, 1},
+	.sfp_port[0].pin_detect = 50,
+	.sfp_port[0].pin_los = 10,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO41_I2C_SDA3_MDIO1, GPIO40_I2C_SCL3_MDC1 ),
+	.sfp_port[1].pin_detect = 30,
+	.sfp_port[1].pin_los = 51,
+	.sfp_port[1].pin_tx_disable = GPIO_NA,
+	.sfp_port[1].sds = 0,
+	.sfp_port[1].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO_NA,
+	.high_leds = { .mux = LED_27 , .enable = LED_27 | LED_29 },
+	.port_led_set = { 0, 0, 0, 1, 0, 0, 0, 0, 1},
+	/* The Ethernet ports have 1 amber LED (left) and 1 green LED (right)
+	 * The SFP ports have also 1 amber LED and 1 green LED
+	 * Ethernet ports use LED-set 0, SFP ports use LED-set 1
+	 */
+	.led_sets = { { LEDS_10M | LEDS_LINK | LEDS_ACT,
+			LEDS_1G | LEDS_100M | LEDS_10M | LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+			LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+			0 },
+			{ LEDS_100M | LEDS_10M | LEDS_LINK,
+			LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_10M | LEDS_LINK | LEDS_ACT | LEDS_10G,
+			LEDS_10G | LEDS_LINK,
+			0 },
+		    },
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_HG0402XG_V1_1_H_
+#define _MACHINE_HG0402XG_V1_1_H_
+
+#define MACHINE_MODEL "HG0402XG V1.1"
+
+#endif
@@ -0,0 +1,46 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 0,
+	.min_port = 3,
+	.max_port = 8,
+	.n_sfp = 2,
+	.log_to_phys_port = {0, 0, 0, 6, 1, 2, 3, 4, 5},
+	.phys_to_log_port = {4, 5, 6, 7, 8, 3, 0, 0, 0},
+	.is_sfp = {0, 0, 0, 2, 0, 0, 0, 0, 1},
+	
+	// Left SFP port
+	.sfp_port[0].pin_detect = GPIO38, 
+	.sfp_port[0].pin_los = GPIO_NA, 
+	.sfp_port[0].sds = 1, 
+	.sfp_port[0].i2c =  I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+
+	// Right SFP port
+	.sfp_port[1].pin_detect = GPIO37,
+	.sfp_port[1].pin_los = GPIO_NA, 
+	.sfp_port[1].sds = 0, 
+	.sfp_port[1].i2c = I2CBUS( GPIO41_I2C_SDA3_MDIO1, GPIO40_I2C_SCL3_MDC1 ),
+
+	.reset_pin = GPIO_NA,
+	.high_leds = { .mux =  LED_28_SYS | LED_29, .enable = LED_27 | LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 1, 0, 0, 0, 0, 1},
+	.led_sets = { 
+			{
+				LEDS_2G5 | LEDS_LINK | LEDS_10M | LEDS_ACT,
+				LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT | LEDS_10G,
+				LEDS_1G | LEDS_LINK, 
+				0 
+			},
+			{  
+				LEDS_10G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK,
+				LEDS_10G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_ACT,
+				0,
+				0
+			},
+	 },
+	.led_mux_custom = 1,
+	.led_mux = {
+				0x00,0x01,0x04,0x05,0x08,0x09,0x0c,0x3f,0x0d,0x10,0x11,0x0e,0x14,0x11,0x12,0x15,0x15,0x16,0x18,0x19,0x1a,0x19,0x1d,0x1e,0x1c,0x1d,0x20,0x21
+		},
+	};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_HI_K0402WS_H_
+#define _MACHINE_HI_K0402WS_H_
+
+#define MACHINE_MODEL "PCB-K0402WS-V3.0"
+
+#endif
@@ -0,0 +1,45 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+    .machine_name = MACHINE_MODEL,
+    .isRTL8373 = 1,
+    .min_port = 0,
+    .max_port = 8,
+    .n_sfp = 1,
+    .log_to_phys_port = {1, 2, 3, 4, 5, 6, 7, 8, 9},
+    .phys_to_log_port = {0, 1, 2, 3, 4, 5, 6, 7, 8},
+    .is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+
+    .sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+    .sfp_port[0].pin_los = GPIO37,
+    .sfp_port[0].pin_tx_disable = GPIO_NA,
+    .sfp_port[0].sds = 1,
+    .sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+    .reset_pin = GPIO_NA,
+
+    .high_leds = {
+        .mux = LED_27 | LED_29,
+        .enable = LED_28_SYS | LED_29
+    },
+
+    /* Ports 1-8 use set 0, port 9 SFP uses set 1 */
+    .port_led_set = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+
+    .led_sets = {
+        {   /* Set 0: RJ45 copper ports
+             * Amber = 2.5G
+             * Green = 1G/100M/10M with activity
+             */
+            LEDS_2G5 | LEDS_LINK | LEDS_ACT, /* Amber */
+            0,
+            LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT, /* Green */
+            0
+        },
+        {   /* Set 1: SFP port, single green LED for all valid speeds */
+            LEDS_10G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+            0,
+            0,
+            0
+        },
+    },
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_HI_K0801WS_H_
+#define _MACHINE_HI_K0801WS_H_
+
+#define MACHINE_MODEL "Hi-Source HI-k0801WS"
+
+#endif
@@ -0,0 +1,34 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 0,
+	.min_port = 3,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = {0, 0, 0, 5, 1, 2, 3, 4, 6},
+	.phys_to_log_port = {4, 5, 6, 7, 3, 8, 0, 0, 0},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO37,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c =  I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+
+	.reset_pin = GPIO_NA,
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.led_sets = {
+		{
+			LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+			0,
+			LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+			0
+		},
+		{
+			LEDS_10G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+			0,
+			0,
+			0
+		},
+	 },
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_K0501W_V2_0_H_
+#define _MACHINE_K0501W_V2_0_H_
+
+#define MACHINE_MODEL "K0501W V2.0"
+
+#endif
@@ -0,0 +1,37 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 0,
+	.min_port = 3,
+	.max_port = 8,
+	.n_sfp = 2,
+	.log_to_phys_port = {0, 0, 0, 5, 1, 2, 3, 4, 6},
+	.phys_to_log_port = {4, 5, 6, 7, 3, 8, 0, 0, 0},
+	.is_sfp = {0, 0, 0, 1, 0, 0, 0, 0, 2},
+	// Left SFP port (5)
+	.sfp_port[0].pin_detect = GPIO50_I2C_SCL2_UART1_TX,
+	.sfp_port[0].pin_los = GPIO10_LED10,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 0,
+	.sfp_port[0].i2c = I2CBUS( GPIO41_I2C_SDA3_MDIO1, GPIO40_I2C_SCL3_MDC1 ),
+	// Right SFP port (6)
+	.sfp_port[1].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[1].pin_los = GPIO37,
+	.sfp_port[1].pin_tx_disable = GPIO_NA,
+	.sfp_port[1].sds = 1,
+	.sfp_port[1].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO54_ACL_BIT2_EN,
+	.high_leds = { .mux = LED_27 | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 0},
+	/* Conditions for LED on:
+	 * dual led orange: ledset_0 & ledset_2
+	 * dual led green: ledset_2 & !ledset_0
+	 * single right led green: ledset_0 & !ledset_1
+	*/
+	.led_sets = { { LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT | LEDS_10G,
+			LEDS_2G5 | LEDS_LINK | LEDS_10G,
+			LEDS_1G | LEDS_LINK,
+			0 },
+		    },
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_6XHML_X2_H_
+#define _MACHINE_KP_9000_6XHML_X2_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-6XHML-X2"
+
+#endif
@@ -0,0 +1 @@
+KP_9000_6XHML_X2.c
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_6XHML_X2_V1_1_H_
+#define _MACHINE_KP_9000_6XHML_X2_V1_1_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-6XHML V1.1"
+
+#endif
@@ -0,0 +1 @@
+KP_9000_6XHML_X2.c
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_6XHML_X2_V1_2_H_
+#define _MACHINE_KP_9000_6XHML_X2_V1_2_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-6XHML V1.2"
+
+#endif
@@ -0,0 +1 @@
+KP_9000_6XH_X2.c
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_6XHML_X2_V2_1_H_
+#define _MACHINE_KP_9000_6XHML_X2_V2_1_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-6XHML V2.1"
+
+#endif
@@ -0,0 +1,28 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 0,
+	.min_port = 3,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = {0, 0, 0, 5, 1, 2, 3, 4, 6},
+	.phys_to_log_port = {4, 5, 6, 7, 3, 8, 0, 0, 0},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO37,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO_NA,
+	/* Conditions for LED on:
+	 * dual led orange: ledset_0 & ledset_2
+	 * dual led green: ledset_2 & !ledset_0
+	 * single right led green: ledset_0 & !ledset_1
+	*/
+	.led_sets = { { LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT | LEDS_10G,
+			LEDS_2G5 | LEDS_LINK | LEDS_10G,
+			LEDS_1G | LEDS_LINK,
+			0 },
+		    },
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_6XH_X_H_
+#define _MACHINE_KP_9000_6XH_X_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-6XH-X"
+
+#endif
@@ -0,0 +1,48 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 0,
+	.min_port = 3,
+	.max_port = 8,
+	.n_sfp = 2,
+	.log_to_phys_port = {0, 0, 0, 6, 1, 2, 3, 4, 5},
+	.phys_to_log_port = {4, 5, 6, 7, 8, 3, 0, 0, 0},
+	.is_sfp = {0, 0, 0, 2, 0, 0, 0, 0, 1},
+
+	// Left SFP port
+	.sfp_port[0].pin_detect = GPIO38,
+	.sfp_port[0].pin_los = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+
+	// Right SFP port
+	.sfp_port[1].pin_detect = GPIO37,
+	.sfp_port[1].pin_los = GPIO_NA,
+	.sfp_port[1].sds = 0,
+	.sfp_port[1].i2c = I2CBUS( GPIO41_I2C_SDA3_MDIO1, GPIO40_I2C_SCL3_MDC1 ),
+
+	.reset_pin = GPIO48_I2C_SCL1,   // Button-Switch is unpopulated on PCB, but can be added manually (hole in case is already there)
+	.high_leds = { .mux =  LED_28_SYS | LED_29, .enable = LED_27 | LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 1, 0, 0, 0, 0, 1},
+	.led_sets = {
+			{
+				LEDS_2G5 | LEDS_LINK,												// Left LED (Amber)
+				LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,   // Right LED (Green)
+				0,
+				0
+			},
+			{
+				LEDS_10G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+				0,
+				0,
+				0
+			},
+	 },
+	.led_mux_custom = 1,
+	.led_mux = {
+				0x00,0x01,0x04,0x05,0x08,0x09,0x0c,0x3f,0x0d,0x10,
+				0x11,0x0e,0x14,0x11,0x12,0x15,0x15,0x16,0x18,0x19,
+				0x1a,0x19,0x1d,0x1e,0x1c,0x1d,0x20,0x21
+		},
+	};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_6XH_X2_H_
+#define _MACHINE_KP_9000_6XH_X2_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-6XH-X2"
+
+#endif
@@ -0,0 +1 @@
+KP_9000_6XHML_X2.c
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_6XH_X2_V1_1_H_
+#define _MACHINE_KP_9000_6XH_X2_V1_1_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-6XH V1.1"
+
+#endif
@@ -0,0 +1 @@
+KP_9000_6XHML_X2.c
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_6XH_X2_V1_2_H_
+#define _MACHINE_KP_9000_6XH_X2_V1_2_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-6XH V1.2"
+
+#endif
@@ -0,0 +1 @@
+KP_9000_6XH_X2.c
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_6XH_X2_V2_1_H_
+#define _MACHINE_KP_9000_6XH_X2_V2_1_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-6XH-X2 V2.1"
+
+#endif
@@ -0,0 +1,51 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 1,
+	.min_port = 0,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = { 1, 2, 3, 4, 5, 6, 7, 8, 9 },
+	.phys_to_log_port = { 0, 1, 2, 3, 4, 5, 6, 7, 8 },
+	.is_sfp = { 0, 0, 0, 0, 0, 0, 0, 0, 1 },
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO37,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO54_ACL_BIT2_EN,
+	.high_leds = { .mux = LED_27 | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 1 },
+	.led_sets = {
+		{   /* Set 0 for RJ45 connectors */
+			/* LED0: Right Green */
+			LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+			/* LED1: Left Orange */
+			LEDS_2G5 | LEDS_LINK,
+			/* LED2: Left Green */
+			LEDS_1G | LEDS_LINK,
+			/* LED3: None */
+			0,
+		}, { /* Set 1 for SFP port */
+			/* LED0: Single Green "9" LED */
+			LEDS_2G5 | LEDS_TWO_PAIR_1G | LEDS_1G | LEDS_500M | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT | LEDS_10G | LEDS_TWO_PAIR_5G | LEDS_5G | LEDS_TWO_PAIR_2G5,
+			/* LED1: D23 LED on PCB */
+			LEDS_1G | LEDS_LINK,
+			/* LED2: D22 LED on PCB */
+			LEDS_2G5 | LEDS_LINK,
+			/* LED3: Unused */
+			LEDS_COL | LEDS_DUPLEX,
+		}, { /* Set 2: Unused, but set to same things as stock firmware for consistency */
+			LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+			LEDS_1G | LEDS_LINK | LEDS_ACT,
+			LEDS_2G5 | LEDS_LINK | LEDS_ACT | LEDS_5G,
+			LEDS_10G | LEDS_ACT | LEDS_LINK,
+		}, { /* Set 3: Unused, but set to same things as stock firmware for consistency */
+			LEDS_TX,
+			LEDS_RX,
+			LEDS_2G5 | LEDS_TWO_PAIR_1G | LEDS_1G | LEDS_500M | LEDS_100M | LEDS_10M | LEDS_ACT | LEDS_10G | LEDS_TWO_PAIR_5G | LEDS_5G | LEDS_TWO_PAIR_2G5,
+			LEDS_2G5 | LEDS_TWO_PAIR_1G | LEDS_1G | LEDS_500M | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_10G | LEDS_TWO_PAIR_5G | LEDS_5G | LEDS_TWO_PAIR_2G5,
+		},
+	},
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_9XHML_X_V2_2_H_
+#define _MACHINE_KP_9000_9XHML_X_V2_2_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-9XHML-X V2.2"
+
+#endif
@@ -0,0 +1,37 @@
+#include "machine_defs.h"
+
+// 2M-PCB23-V3.2 is wired like V3.1 (SFP detection, LEDs, factory MAC location)
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 1,
+	.min_port = 0,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = {1, 2, 3, 4, 5, 6, 7, 8, 9},
+	.phys_to_log_port = {0, 1, 2, 3, 4, 5, 6, 7, 8},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.sfp_port[0].pin_detect = GPIO38,
+	.sfp_port[0].pin_los = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO48_I2C_SCL1,
+	.high_leds = { .mux = LED_27 | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.led_sets = {
+		{   /* RJ45: First LED, yellow, second LED: green */
+			LEDS_2G5 | LEDS_LINK,
+            LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+			0,
+			0,
+		}, { /* SFP PORT, SINGLE GREEN LED */
+			LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT | LEDS_10G,
+			0,
+			0,
+			0,
+		}},
+	.led_mux_custom = 1,
+	.led_mux = {0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x0c, 0x09, 0x0d, 0x10,
+				0x11, 0x0e, 0x14, 0x11, 0x12, 0x15, 0x15, 0x16, 0x18, 0x19,
+				0x1a, 0x19, 0x1d, 0x1e, 0x1c, 0x1d, 0x20, 0x21},
+	.mac_flash_offset = 0x1FC000,
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_9XHML_X_V3_1_H_
+#define _MACHINE_KP_9000_9XHML_X_V3_1_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-9XHML-X V3.1"
+
+#endif
@@ -0,0 +1 @@
+KP_9000_9XHML_X_V3_1.c
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_9XHML_X_V3_2_H_
+#define _MACHINE_KP_9000_9XHML_X_V3_2_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-9XHML-X V3.2"
+
+#endif
@@ -0,0 +1,25 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 1,
+	.min_port = 0,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = {1, 2, 3, 4, 5, 6, 7, 8, 9},
+	.phys_to_log_port = {0, 1, 2, 3, 4, 5, 6, 7, 8},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO37,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO_NA,
+	.high_leds = { .mux = LED_27 | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 0},
+	.led_sets = { { LEDS_2G5 | LEDS_TWO_PAIR_1G | LEDS_1G | LEDS_500M | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT | LEDS_10G | LEDS_TWO_PAIR_5G | LEDS_5G | LEDS_TWO_PAIR_2G5,
+			LEDS_2G5 | LEDS_LINK,
+			LEDS_1G | LEDS_LINK, 
+			LEDS_2G5 | LEDS_LINK | LEDS_ACT },
+		    },
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_KP_9000_9XH_X_EU_H_
+#define _MACHINE_KP_9000_9XH_X_EU_H_
+
+#define MACHINE_MODEL "keepLink KP-9000-9XH-X-EU"
+
+#endif
@@ -0,0 +1,36 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+    .machine_name = MACHINE_MODEL,
+    .isRTL8373 = 1,
+    .min_port = 0,
+    .max_port = 8,
+    .n_sfp = 1,
+    .log_to_phys_port = {2, 1, 4, 3, 5, 6, 7, 8, 9},
+    .phys_to_log_port = {1, 0, 3, 2, 4, 5, 6, 7, 8},
+    .is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+
+    .sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+    .sfp_port[0].pin_los = GPIO37,
+    .sfp_port[0].pin_tx_disable = GPIO_NA,
+    .sfp_port[0].sds = 1,
+    .sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+
+    .reset_pin = GPIO_NA,
+	.high_leds = { .mux = 0, .enable = 0 },
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 1 },
+	.led_sets = { 
+		{ 
+			LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT, // RJ45 Blue LEDs
+			LEDS_2G5 | LEDS_LINK, // RJ45 White LEDs
+			0,
+			0
+		},
+		{ 
+			LEDS_10G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT, // SFP blue LED?
+			0,
+			0,
+			0
+		},
+	},
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_LIANGUO_HYWS_SGT0108S_H_
+#define _MACHINE_LIANGUO_HYWS_SGT0108S_H_
+
+#define MACHINE_MODEL "Lianguo HYWS-SGT0108S"
+
+#endif
@@ -0,0 +1,33 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 0,
+	.mac_flash_offset = 0x1FC000,
+	.min_port = 3,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = {0, 0, 0, 5, 1, 2, 3, 4, 6},
+	.phys_to_log_port = {4, 5, 6, 7, 3, 8, 0, 0, 0},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO37,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO54_ACL_BIT2_EN,
+	.high_leds = { .mux = LED_27 | LED_28_SYS | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.led_sets = { { LEDS_2G5 | LEDS_LINK | LEDS_ACT, // Green LED (right)
+					0, // unused
+					LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT, // Amber LED (left)
+					0
+				  }, // unused
+				  { LEDS_10G | LEDS_5G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_LINK | LEDS_ACT, // SFP LED
+					0, // unused
+					0, // unused
+					0
+				  }, // unused		    	},
+				},
+	.led_mux_custom = 0,
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_LIANGUO_ZX_SWTGW215AS_H_
+#define _MACHINE_LIANGUO_ZX_SWTGW215AS_H_
+
+#define MACHINE_MODEL "Lianguo ZX-SWTGW215AS"
+
+#endif
@@ -0,0 +1,61 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+    .machine_name = MACHINE_MODEL,
+    .isRTL8373 = 0,
+    .min_port = 3,
+    .max_port = 8,
+    .n_sfp = 2,
+    .log_to_phys_port = {0, 0, 0, 5, 4, 3, 2, 1, 6},
+    .phys_to_log_port = {7, 6, 5, 4, 3, 8, 0, 0, 0},
+    .is_sfp = {0, 0, 0, 1, 0, 0, 0, 0, 2},
+
+    // SFP port on SDS0 / logical port 3
+    .sfp_port[0].pin_detect = GPIO37,
+    .sfp_port[0].pin_los = GPIO_NA,
+    .sfp_port[0].pin_tx_disable = GPIO_NA,
+    .sfp_port[0].sds = 0,
+    .sfp_port[0].i2c = I2CBUS( GPIO41_I2C_SDA3_MDIO1, GPIO40_I2C_SCL3_MDC1 ),
+
+    // SFP port on SDS1 / logical port 8
+    .sfp_port[1].pin_detect = GPIO38,
+    .sfp_port[1].pin_los = GPIO_NA,
+    .sfp_port[1].pin_tx_disable = GPIO_NA,
+    .sfp_port[1].sds = 1,
+    .sfp_port[1].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+
+    .reset_pin = GPIO_NA,
+    .high_leds = { .mux =  LED_28_SYS | LED_29, .enable = LED_27 | LED_28_SYS | LED_29 },
+    .port_led_set = { 0, 0, 0, 3, 0, 0, 2, 2, 3},
+    .mac_flash_offset = 0x1FC000,
+    .led_sets = {
+        { // RJ45 Ports 3-4 (normal wiring)
+            LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+            LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+            0,
+            0
+        },
+        { // Unused
+            0,
+            0,
+            0,
+            0
+        },
+        { // RJ45 Ports 1-2 (reversed wiring)
+            LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+            LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+            0,
+            0
+        },
+        { // SFP Ports 5-6
+            LEDS_10G | LEDS_LINK | LEDS_ACT,
+            LEDS_2G5 | LEDS_1G | LEDS_LINK | LEDS_ACT,
+            0,
+            0
+        },
+    },
+    .led_mux_custom = 1,
+    .led_mux = {
+        0x00,0x01,0x04,0x05,0x08,0x09,0x0c,0x3f,0x0d,0x10,0x11,0x0e,0x14,0x11,0x12,0x15,0x15,0x16,0x18,0x19,0x1a,0x19,0x1d,0x1e,0x1c,0x1d,0x20,0x21
+    },
+};
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_ONT_S207CW_62TS_SE_H_
+#define _MACHINE_ONT_S207CW_62TS_SE_H_
+
+#define MACHINE_MODEL "ONT-S207CW-62TS-SE / Binardat 2G06-04210GSM / Binardat 2G06-04210GS"
+
+#endif
@@ -0,0 +1,41 @@
+#include "machine_defs.h"
+
+__code const struct machine machine = {
+	.machine_name = MACHINE_MODEL,
+	.isRTL8373 = 1,
+	.min_port = 0,
+	.max_port = 8,
+	.n_sfp = 1,
+	.log_to_phys_port = {1, 2, 3, 4, 5, 6, 7, 8, 9},
+	.phys_to_log_port = {0, 1, 2, 3, 4, 5, 6, 7, 8},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO37,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+
+	.reset_pin = GPIO_NA,
+
+	.high_leds = { .mux = LED_27 | LED_28_SYS | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 1},
+
+	.led_sets = {
+		{
+			/* LED0 = RJ45: Amber LED: 2.5G */
+			LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+			/* LED1 = RJ45: Green LED: 10M / 100M / 1000M */
+			LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+			0,
+			0
+		},
+		{
+			/* SFP+ single Green LED. */
+			LEDS_10G | LEDS_5G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_LINK | LEDS_ACT,
+			0,
+			0,
+			0
+		},
+	},
+ };
@@ -0,0 +1,6 @@
+#ifndef _MACHINE_PB_2132_H_
+#define _MACHINE_PB_2132_H_
+
+#define MACHINE_MODEL "PB-2132"
+
+#endif