Makefile: Lower limit of --xram-size to protect ChaCha20 space

ChaCha20 uses 256 bytes starting from 0xbf00 for its calculations. Make sure the linker checks that this space is not overwritten.
ChaCha20 implementation for encryption
2026-11-01 18:04:12 +08:00 · 2026-10-17 06:30:16 +02:00 · 2026-10-17 06:30:14 +02:00
455 changed files with 3943 additions and 15495 deletions
@@ -3,7 +3,6 @@
 .gitattributes
 .github/
 output/
 toolchain/
 installer/output/
 *.bin
 html_data.c
@@ -5,9 +5,6 @@ on:
    branches: ['**']
  pull_request:
 permissions:
  contents: read
 jobs:
  build:
    runs-on: ubuntu-latest
@@ -16,38 +13,18 @@ jobs:
    steps:
      - uses: actions/checkout@v6
        with:
          path: branch
      - uses: actions/checkout@v6
        with:
          path: main
          ref: main
      - name: Install dependencies
        run: |
          apt update
-          apt install make gcc g++ bison flex libboost-dev patch bzip2 curl ca-certificates xxd python-is-python3 libjson-c-dev zlib1g-dev -y
+          apt install make gcc sdcc xxd python-is-python3 libjson-c-dev zlib1g-dev -y
      - name: Cache the patched SDCC
        uses: actions/cache@v4
        with:
          path: branch/toolchain
          key: sdcc-${{ hashFiles('branch/sdcc/*') }}
      - name: Run the host-side unit tests
-        run: cd branch && make -C test
+        run: make -C test
      - name: Check that every machine definition can be compiled
-        run: cd branch && make machine_check
+        run: make machine_check
      - name: Make project (4x2/RTL8372)
-        run: mkdir -p /tmp/branch /tmp/main && cd branch && make CI=1 MACHINE="KEEPLINK_KP_9000_6XHML_X2" && cp -r output/KEEPLINK_KP_9000_6XHML_X2/rtlplayground.map output/KEEPLINK_KP_9000_6XHML_X2/rtlplayground.mem output/KEEPLINK_KP_9000_6XHML_X2/html_min /tmp/branch/
+        run: make CI=1 MACHINE="KP_9000_6XHML_X2"
      - name: Make project (8x1/RTL8373)
-        run: cd branch && make CI=1 MACHINE="KEEPLINK_KP_9000_9XHML_X_V3_1"
+        run: make CI=1 MACHINE="KP_9000_9XHML_X_V3_1"
      - name: Make project with the health instrumentation
-        run: cd branch && make clean && make CI=1 MACHINE="KEEPLINK_KP_9000_6XHML_X2" HEALTH=1
+        run: make clean && make CI=1 MACHINE="KP_9000_6XHML_X2" HEALTH=1
      - name: Make main
        run: |
          ln -s ../branch/toolchain main/toolchain
          PATH="$(echo "$PWD"/branch/toolchain/sdcc-*/bin):$PATH"
          cd main && make CI=1 MACHINE="KEEPLINK_KP_9000_6XHML_X2" && cp -r output/KEEPLINK_KP_9000_6XHML_X2/rtlplayground.map output/KEEPLINK_KP_9000_6XHML_X2/rtlplayground.mem output/KEEPLINK_KP_9000_6XHML_X2/html_min /tmp/main/
      - name: Calculate bank growth
        run: |
          bash branch/tools/bank_occupancy.sh KP_9000_6XHML_X2 /tmp/main /tmp/branch >> "$GITHUB_STEP_SUMMARY"
@@ -1,17 +1,13 @@
 .gitignore
 .idea/
 output/
 output-main/
 toolchain/
 html_data.c
 html_data.h
 version.h
 tools/httpd_sim
 tools/injector
 tools/fileadder
 build/
 # host-test stand-ins for the two generated headers
 !test/stub/html_data.h
 !test/stub/version.h
 .vscode
@@ -4,17 +4,6 @@
 ## Added
 - Devices
  - Support the hongyavision HYWS-SGT0204S (PCB marking `2G5F4_10G2_V1.01`), an
    RTL8372 based 4x2.5G + 2xSFP+ unmanaged switch with a 512 KB Bright Moon
    `T25S40` flash. It is a sibling of the KP-9000-6XH-X2 (2M-PCB43-V1.1) with
    the two SFP+ cages wired the other way round (physical 5 is on SDS1,
    physical 6 on SDS0), no reset button fitted, wrong silkscreen labels on the
    serial header, `LED_GLB_IO_EN` bit 6 has to be set for the port LEDs to
    work, and the fitted T25S40 cannot be read in DIO mode on this board, so the
    target selects single-IO flash reads (`flash_sio`). New machine target
    `MACHINE_2G5F4_10G2_V1_01`, see `doc/devices/2G5F4_10G2_V1.01.md`.
 - Web UI
  - Compress the embedded assets (minify + gzip) and switch to a single-page layout. #315
  - Replace the multi-page UI with a themed single-page app: light, dark and Selenized themes following the browser by default,
@@ -23,41 +12,14 @@
 ## Changed
 - Web UI
  - The web session expires after one hour without a request (was 200 seconds). The UI stops
    polling while its tab is hidden, so with 200 seconds switching tabs for a few minutes logged
    you out. `session <seconds>` still sets it.
 ## Fixed
 - Time
  - `rtl8372_init()` sets SDS 0 to SGMII as the stock firmware does. The masks were 0, so on RTL8372
    boards without 10G ports both SerDes stayed off, and with SDS 0 off `RTL837X_REG_SEC_COUNTER`
    does not hold a written value: NTP never retried after a failed first attempt at boot and
    froze the clock after a sync.
 - Web UI
  - Firefox no longer fills a saved login into the new admin password fields. It also put the
    user name into the NTP poll interval, which marked the Time card as edited, so it kept its
    defaults (NTP off, no server, UTC-12:00) instead of the switch's settings.
  - Accept firmware uploads regardless of the file part's MIME type, including
    `application/macbinary` sent by Chrome on macOS for `.bin` files.
 - Health
  - `HEALTH=1` builds no longer write past the phase timing arrays at the LLDP checkpoint, which
    corrupted the `link` slow counter and the DHCP client state. #658
 - Config
  - A startup configuration line longer than the command buffer no longer stops the replay:
    the offending line is skipped and the following lines are still applied.
  - The web UI and the configuration upload now refuse a line the replay cannot take,
    instead of writing it to flash.
 - Startup
  - Initialised and zero-initialised globals above xdata 0x4000 now get their values at boot.
    Hardware reset leaves SFR 0x97 at 1, which maps xdata 0x4000-0xbfff to the flash image,
    and it was cleared only in `main()`, after the C startup code had copied and cleared them.
    This showed as a random web session timeout and LLDP blocked on some ports without config.
 ## Breaking changes
 - Config
@@ -3,14 +3,7 @@ FROM debian:13-slim
 RUN apt-get update && apt-get install -y \
    make \
    gcc \
-    g++ \
+    sdcc \
    bison \
    flex \
    libboost-dev \
    patch \
    bzip2 \
    curl \
    ca-certificates \
    xxd \
    python3 \
    libjson-c-dev \
@@ -4,25 +4,8 @@ DEFAULT_CONFIG_LOCATION = 454656
 CONFIG_LOCATION = 458752
 HTML_LOCATION = 262144
 # Startup configuration embedded in the image. Override it to build a specific
 # machine with its own configuration: make MACHINE=<name> CONFIG=<file>
 CONFIG ?= config.txt
 SDCC_TOOLCHAIN = sdcc-$(shell cat sdcc/* | cksum | cut -d' ' -f1)
 SDCC_PREFIX = toolchain/$(SDCC_TOOLCHAIN)
 ifeq ($(origin CC),default)
-SDCC = $(SDCC_PREFIX)/bin/sdcc
+CC = sdcc
 CC = $(SDCC)
 ASM = $(SDCC_PREFIX)/bin/sdas8051
 SDCC_REV := $(shell git log -1 --format=%h -- sdcc 2>/dev/null)
 ifneq ($(SDCC_REV),)
 ifneq ($(shell git status --porcelain --untracked-files=no -- sdcc 2>/dev/null),)
 SDCC_REV := $(SDCC_REV)-dirty
 endif
 endif
 SDCC_BANNER = $(if $(SDCC_REV),sdcc/ at $(SDCC_REV),$(SDCC_TOOLCHAIN)) ($(words $(wildcard sdcc/*.patch)) patches)
 else
 SDCC_BANNER = system
 endif
 CC_FLAGS = -mmcs51 -I. -Imachine -Ihttpd -Iuip
 ASM ?= sdas8051
@@ -32,10 +15,11 @@ SUBDIRS := tools
 SUBDIRSCLEAN=$(addsuffix clean,$(SUBDIRS))
 # $MACHINE selects machine/$(MACHINE).c as the board definition and is passed
-# on as -DMACHINE_NAME, which machine.h uses to include machine/$(MACHINE).h.
+# on as -DMACHINE_$(MACHINE), which the rest of the firmware tests with
-# Board selection itself needs no MACHINE_* symbol for #if chains, so the
+# #if defined(MACHINE_...), and as -DMACHINE_NAME, which machine.h uses to
-# definition is all the compiler has to know.
+# include machine/$(MACHINE).h. Both take the same value, so they cannot drift.
 ifneq ($(MACHINE),)
 	CC_FLAGS += -DMACHINE_$(MACHINE)
 	CC_FLAGS += -DMACHINE_NAME=$(MACHINE)
 endif
 # Health instrumentation and the "health" console command: HEALTH=1 gmake ...
@@ -50,17 +34,7 @@ endif
 # The board definition being built: one file per MACHINE_* symbol in machine.h.
 MACHINE_SRC = machine/$(MACHINE).c
 MACHINE_INIT_DEFAULT := machine/default_machine_init.c
 MACHINE_INIT_SRC := $(wildcard machine/$(MACHINE)_init.c)
 ifeq ($(MACHINE_INIT_SRC),)
 	MACHINE_INIT_SRC := $(MACHINE_INIT_DEFAULT)
 endif
 ifndef BUILDDIR
 BUILDDIR = output/$(MACHINE)
 endif
 CONFIG_STAMP := $(BUILDDIR)/.config
 VERSION_HEADER := version.h
 GIT_VERSION := $(shell git rev-parse --short HEAD)
@@ -83,19 +57,16 @@ BUILD_DATE := $(shell date -u -d @$(SOURCE_DATE_EPOCH) +"%Y-%m-%d %H:%M:%S" 2>/d
 	|| date -u -r $(SOURCE_DATE_EPOCH) +"%Y-%m-%d %H:%M:%S")
 endif
-# $(MACHINE_SRC) and $(CONFIG) are listed here so an unknown $MACHINE or a
+# $(MACHINE_SRC) is listed here so an unknown $MACHINE fails before anything else
-# missing config file fails before anything else is built, including the tools/
+# is built, including the tools/ subdirectory.
-# subdirectory.
+all: create_build_dir $(VERSION_HEADER) $(MACHINE_SRC) $(SUBDIRS) $(BUILDDIR)/rtlplayground-$(FILENAME_EXTENSION).bin
 all: create_build_dir $(VERSION_HEADER) $(MACHINE_SRC) $(CONFIG) $(SUBDIRS) $(BUILDDIR)/rtlplayground-$(FILENAME_EXTENSION).bin
-bank_size:
+create_build_dir:
 	tools/bank_occupancy.sh "$(MACHINE)"
 create_build_dir: $(SDCC)
 	mkdir -p "$(BUILDDIR)"
 	mkdir -p "$(BUILDDIR)/uip"
 	mkdir -p "$(BUILDDIR)/httpd"
 	mkdir -p "$(BUILDDIR)/machine"
 	mkdir -p "$(BUILDDIR)/crypto"
 # Every machine is a pair machine/<MACHINE>.c + machine/<MACHINE>.h. Selecting
 # them by name means no #if/#elif chain, so an unknown or empty $MACHINE is
@@ -107,17 +78,11 @@ $(MACHINE_SRC):
 	@echo "       Example: make MACHINE=KP_9000_6XHML_X2" >&2
 	@false
 # Fail with a clear message when CONFIG names a file that does not exist.
 $(CONFIG):
 	@echo "ERROR: CONFIG='$(CONFIG)' does not exist." >&2
 	@echo "       Point CONFIG at a configuration file, or omit it to use config.txt." >&2
 	@false
 # Keep the per-machine definition in first position to fail immediately on an
 # invalid $MACHINE value
 SRCS = \
 	$(MACHINE_SRC) \
-	$(MACHINE_INIT_SRC) \
+	machine_init.c \
 	cmd_editor.c \
 	cmd_parser.c \
 	dhcp.c \
@@ -127,20 +92,18 @@ SRCS = \
 	sfp.c \
 	dns.c \
 	dns_cli.c \
 	sessions.c \
 	ntp.c \
 	ntp_cli.c \
 	syslog.c \
-	udp_apps.c
+	udp_apps.c \
 	crypto/chacha20.c
 # RTL837x
 SRCS += \
 	rtl837x_bandwidth.c \
 	rtl837x_cabletest.c \
 	rtl837x_flash.c \
 	rtl837x_igmp.c \
 	rtl837x_init.c \
 	rtl837x_nic.c \
 	rtl837x_leds.c \
 	rtl837x_leds_dump.c \
 	rtl837x_phy.c \
@@ -150,12 +113,10 @@ SRCS += \
 	rtl837x_lldp.c \
 	rtl837x_storm.c \
 	rtl837x_lacp.c \
-	rtl837x_trap.c \
+	rtl837x_trap.c
 	rtl837x_stp_cli.c
 SRCS += \
 	httpd/httpd.c \
-	httpd/page_impl.c \
+	httpd/page_impl.c
 	httpd/page_stp.c
 SRCS += \
 	uip/timer.c \
 	uip/uip.c \
@@ -167,37 +128,25 @@ SRCS += \
 OBJS = ${SRCS:%.c=$(BUILDDIR)/%.rel}
 DEPS := ${SRCS:%.c=$(BUILDDIR)/%.d}
-HTML := $(shell find html -name '*.html' -or -name '*.svg' -or -name '*.css' -or -name '*.ico')
+HTML := $(shell find html -name '*.js' -or -name '*.html' -or -name '*.svg' -or -name '*.css' -or -name '*.ico')
 # Minified copy of the web UI sources, used as the fileadder input.
 # The raw html/ sources stay untouched for development; the minified
 # copy is a build artifact under output/.
-HTML_MIN := $(BUILDDIR)/html_min
+HTML_MIN := output/html_min
 HTML_MIN_LIST := $(BUILDDIR)/html_min.list
 HTML_MIN_STAMP := $(BUILDDIR)/html_min.stamp
 .PHONY: html_min
-html_min: $(HTML_MIN_STAMP)
+html_min: $(HTML)
 $(HTML_MIN_LIST): FORCE
 	@mkdir -p $(BUILDDIR)
 	@echo $(sort $(HTML)) > $@.tmp
 	@cmp -s $@.tmp $@ && rm -f $@.tmp || mv $@.tmp $@
 $(HTML_MIN_STAMP): $(HTML) html/app.js $(HTML_MIN_LIST) tools/minify.py tools/rjsmin.py $(if $(wildcard $(HTML_MIN)),,FORCE)
 	rm -rf $(HTML_MIN)
 	mkdir -p $(HTML_MIN)
 	@for f in $(HTML); do python3 tools/minify.py $$f $(HTML_MIN)/$$(basename $$f) || exit 1; done
 	python3 tools/rjsmin.py < html/app.js > $(HTML_MIN)/app.js || exit 1
 	@touch $@
-html_data.c html_data.h &: $(HTML_MIN_STAMP) | tools
+html_data.c html_data.h &: $(HTML) | tools html_min
-	tools/$(BUILDDIR)/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -b BANK1 -z -d $(HTML_MIN) -p html_data
+	tools/output/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -b BANK1 -z -d $(HTML_MIN) -p html_data
 $(VERSION_HEADER): FORCE
 	@printf '%s\n' "#ifndef VERSION_H" "#define VERSION_H" \
 		"#define VERSION_SW \"$(VERSION_EXTENSION)\"" \
 		"#define BUILD_DATE \"$(BUILD_DATE)\"" \
 		"#define SDCC_TOOLCHAIN \"$(SDCC_BANNER)\"" \
 		"#endif" > $(VERSION_HEADER).tmp
 	@cmp -s $(VERSION_HEADER).tmp $(VERSION_HEADER) \
 		&& rm -f $(VERSION_HEADER).tmp \
@@ -206,21 +155,15 @@ $(VERSION_HEADER): FORCE
 httpd: html_data.h
 $(SUBDIRS):
-	$(MAKE) -C $@ BUILDDIR=$(BUILDDIR)
+	$(MAKE) -C $@
 clean: $(SUBDIRSCLEAN)
-	-rm -f html_data.c html_data.h $(VERSION_HEADER) $(HTML_MIN_LIST) $(HTML_MIN_STAMP)
+	-rm -f html_data.c html_data.h $(VERSION_HEADER)
 	-if [ -d $(BUILDDIR) ]; then find $(BUILDDIR) -type f ! -name "*.bin" -delete; fi
 distclean: $(SUBDIRSCLEAN)
-	-rm -f html_data.c html_data.h $(VERSION_HEADER) $(HTML_MIN_LIST) $(HTML_MIN_STAMP)
+	-rm -f html_data.c html_data.h $(VERSION_HEADER)
 	-rm -rf $(BUILDDIR)
 	-rm -rf toolchain
 ifneq ($(SDCC),)
 $(SDCC):
 	sh sdcc/build.sh $(abspath $(SDCC_PREFIX))
 endif
 $(SUBDIRSCLEAN):
 	$(MAKE) -C $(@:clean=) clean
@@ -235,12 +178,6 @@ FORCE:
 $(CCFLAGS_STAMP): FORCE | create_build_dir
 	@echo '$(CC_FLAGS)' | cmp -s - $@ 2>/dev/null || echo '$(CC_FLAGS)' > $@
 # The same for $(CONFIG): its path is stamped so switching to a config file
 # older than the image still rebuilds it, while $(CONFIG) itself as a normal
 # prerequisite covers edits to the selected file.
 $(CONFIG_STAMP): FORCE | create_build_dir
 	@echo '$(CONFIG)' | cmp -s - $@ 2>/dev/null || echo '$(CONFIG)' > $@
 $(BUILDDIR)/%.rel: %.c $(CCFLAGS_STAMP) | create_build_dir html_data.h
 	$(CC) -MMD $(CC_FLAGS) -o $@ -c $<
@@ -248,45 +185,39 @@ $(BUILDDIR)/%.rel: %.asm $(CCFLAGS_STAMP) | create_build_dir
 	${ASM} ${AFLAGS} -o $@ $<
 #	mv -f $(addprefix $(basename $^), .lst .rel .sym) .
-$(BUILDDIR)/rtlplayground.ihx: $(OBJS) $(BUILDDIR)/crtbank.rel $(BUILDDIR)/crc16.rel
+$(BUILDDIR)/rtlplayground.ihx: $(OBJS) $(BUILDDIR)/crtbank.rel $(BUILDDIR)/crc16.rel $(BUILDDIR)/crypto/chacha_8051.rel
-	$(CC) $(CC_FLAGS) --xram-size 49151 -Wl-bHOME=0x00000 -Wl-bBANK1=0x14000 -Wl-bBANK2=0x24000 -Wl-bBANK3=0x34000 -Wl-bBANK4=0x44000 -Wl-r -o $@ $^
+	$(CC) $(CC_FLAGS) --xram-size 48896 -Wl-bHOME=0x00000 -Wl-bBANK1=0x14000 -Wl-bBANK2=0x24000 -Wl-bBANK3=0x34000 -Wl-r -o $@ $^
 $(BUILDDIR)/rtlplayground.img: $(BUILDDIR)/rtlplayground.ihx
 	objcopy --input-target=ihex -O binary $< $@
-$(BUILDDIR)/rtlplayground-$(FILENAME_EXTENSION).bin: $(BUILDDIR)/rtlplayground.img $(CONFIG) $(CONFIG_STAMP) | tools
+$(BUILDDIR)/rtlplayground-$(FILENAME_EXTENSION).bin: $(BUILDDIR)/rtlplayground.img | tools
 	if [ -e $@ ]; then rm $@; fi
-	tools/$(BUILDDIR)/imagebuilder -i $(BUILDDIR)/rtlplayground.img $@
+	tools/output/imagebuilder -i $^ $@
-	tools/$(BUILDDIR)/fileadder -a $(DEFAULT_CONFIG_LOCATION) -s $(IMAGESIZE) -d "$(CONFIG)" $@
+	tools/output/fileadder -a $(DEFAULT_CONFIG_LOCATION) -s $(IMAGESIZE) -d config.txt $@
-	tools/$(BUILDDIR)/fileadder -a $(CONFIG_LOCATION) -s $(IMAGESIZE) -d "$(CONFIG)" $@
+	tools/output/fileadder -a $(CONFIG_LOCATION) -s $(IMAGESIZE) -d config.txt $@
-	tools/$(BUILDDIR)/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -z -d $(HTML_MIN) -b BANK1 $@
+	tools/output/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -z -d $(HTML_MIN) -b BANK1 $@
-	tools/$(BUILDDIR)/crc_calculator -u $@
+	tools/output/crc_calculator -u $@
-	ln -sf $(MACHINE)/rtlplayground-$(FILENAME_EXTENSION).bin $(BUILDDIR)/../rtlplayground.bin
+	ln -sf $(MACHINE)/rtlplayground-$(FILENAME_EXTENSION).bin output/rtlplayground.bin
 .PHONY: clean distclean all $(SUBDIRS) $(SUBDIRSCLEAN) create_build_dir
 # Every machine/ definition is compiled, so a machine added to machine/ is
-# covered without registering it anywhere. A board only counts once both its
+# covered without registering it anywhere. The machine-specific defines are
-# <machine>.c and its <machine>.h are present: the header is what the rest of
+# filtered out of $(CC_FLAGS) and supplied per iteration instead, so this also
-# the build includes, so a .c without one is an incomplete board. The _init.c
+# works as "make machine_check MACHINE=...".
-# files are excluded here: they are the boot hooks, compiled separately below
+MACHINE_DEFS := $(sort $(patsubst machine/%.c,%,$(wildcard machine/*.c)))
 # (the board's own if it exists, otherwise default_machine_init.c). The
 # machine-specific defines are filtered out of $(CC_FLAGS) and supplied per
 # iteration instead, so this also works as "make machine_check MACHINE=...".
 MACHINE_DEFS := $(sort $(filter $(patsubst machine/%.h,%,$(wildcard machine/*.h)),$(patsubst machine/%.c,%,$(filter-out machine/%_init.c,$(wildcard machine/*.c)))))
 MACHINE_LESS_CC_FLAGS = $(filter-out -DMACHINE_%,$(CC_FLAGS))
-.PHONY: machine_check
+.PHONY:
-machine_check: $(SDCC)
+machine_check:
 	@mkdir -p $(BUILDDIR)/tmp
 	@set -eo pipefail; \
 	for MACHINE in $(MACHINE_DEFS); \
 	do \
 	echo "Checking $${MACHINE}"; \
-	$(CC) $(MACHINE_LESS_CC_FLAGS) -DMACHINE_NAME=$${MACHINE} -MMD -o $(BUILDDIR)/tmp/machine_check -c machine/$${MACHINE}.c; \
+	$(CC) $(MACHINE_LESS_CC_FLAGS) -DMACHINE_$${MACHINE} -DMACHINE_NAME=$${MACHINE} -MMD -o $(BUILDDIR)/tmp/machine_check -c machine/$${MACHINE}.c; \
-	INIT=machine/$${MACHINE}_init.c; \
+	$(CC) $(MACHINE_LESS_CC_FLAGS) -DMACHINE_$${MACHINE} -DMACHINE_NAME=$${MACHINE} -MMD -o $(BUILDDIR)/tmp/machine_check -c machine_init.c; \
 	if [ ! -e $$INIT ] && [ ! -L $$INIT ]; then INIT=$(MACHINE_INIT_DEFAULT); fi; \
 	$(CC) $(MACHINE_LESS_CC_FLAGS) -DMACHINE_NAME=$${MACHINE} -MMD -o $(BUILDDIR)/tmp/machine_check -c $$INIT; \
 	done
 	@rm -rf $(BUILDDIR)/tmp
@@ -56,19 +56,12 @@ device simulator is provided, which runs entirely under Linux as a local webserv
 ## (0) Compiling Requirements
-Install the following particular build requisites (Debian 12/13):
+Install the following particular build requisites (Debian 12/13), note that Ubuntu 24.04
 still has an older version of sdcc, but you will need sdcc version 4.5 for the code to compile:
 ```
-sudo apt install make gcc g++ bison flex libboost-dev patch bzip2 curl xxd python-is-python3 libjson-c-dev zlib1g-dev
+sudo apt install make gcc sdcc xxd python-is-python3 libjson-c-dev zlib1g-dev
 ```
 The first `make` downloads SDCC 4.6.0, applies the fixes in `sdcc/` and builds it into
 `toolchain/`, which takes a few minutes. Later builds reuse it. The released SDCC 4.5.0
 and 4.6.0 miscompile parts of this code, see [SDCC bug #4153](https://sourceforge.net/p/sdcc/bugs/4153/)
 and [#4154](https://sourceforge.net/p/sdcc/bugs/4154/); both fixes are in SDCC trunk since
 r17039. The third patch is for [#4070](https://sourceforge.net/p/sdcc/bugs/4070/), where the
 assembler drops the top byte of a `__sfr32` address list; it is proposed upstream and lets
 `SFR_DATA_U32` be used again. To use an SDCC you installed yourself instead, run `make CC=sdcc ...`.
 <details>
 <summary>If using Docker (click to expand)</summary>
@@ -97,57 +90,37 @@ docker run --rm -v $(pwd):/workspace rtlplayground-dev make MACHINE=DEFAULT_8C_1
 The resulting `.bin` file appears in `output/` on your host.
 Build the OEM web upgrade bin (after building the firmware bin)
 ```
 docker run --rm -v $(pwd):/workspace rtlplayground-dev make -C installer
 ```
 The resulting `rtlplayground_oem_upgrade.bin` file appears in `installer/output/` on your host.
 Build host tools only:
 ```
 docker run --rm -v $(pwd):/workspace rtlplayground-dev make -C tools
 ```
-Run the web-interface simulator through docker:
+Run the web-interface simulator locally:
 ```
-docker run --rm -p 8081:8081 -v $(pwd):/workspace rtlplayground-dev \
+docker run --rm -p 8080:8080 -v $(pwd):/workspace rtlplayground-dev \
-  tools/output/httpd_sim.py /workspace/html
+  tools/output/httpd_sim /workspace/html
 ```
-Edit `config.txt` on your host, then re-run `make` — the
+Edit `machine.h` or `config.txt` on your host, then re-run `make` — the
 source directory is mounted into the container, so changes take effect
-immediately. To build for a different machine, pass `MACHINE=<name>`, which
+immediately. To build for a different machine, pass `MACHINE=...`.
 selects `machine/<name>.c` (see [Adding a new device](doc/adding-a-device.md)).
 </details>
 ## (1) Compiling for direct chip flashing AND upgrading an existing RTLPlayground running device
-Pass the machine that matches your device, for example:
+Edit machine.h with an editor like vi or nano. Select the correct machine the firmware should build for.
 ```
 make MACHINE=DEFAULT_8C_1SFP
 ```
 The name selects the board definition `machine/<name>.c`; `make` without a
 `MACHINE` value stops with an error listing what is expected. If your board is
 not in the list yet, see [Adding a new device](doc/adding-a-device.md).
 To embed a machine-specific startup configuration, pass `CONFIG`:
 ```
 make MACHINE=DEFAULT_8C_1SFP CONFIG=configs/DEFAULT_8C_1SFP.txt
 ```
 `CONFIG` defaults to `config.txt`; the selected file is embedded in the image
 and changing it triggers a rebuild.
 > [!TIP]
 > You can write configuration parameters in config.txt (see below) in order your switch to get
 > straight at the first boot, a correct IP configuration.
-Now, building the firmware image should work.
+Now, building the firmware image should work:
-
+```
 make 
 ```
 Note, that the image generated ends in .bin, not .img, in order to make IMSProg happy.
 image location is stored in `RTLPlayground/output/rtlplayground_version_machine.bin`
@@ -185,9 +158,9 @@ example of compilation console output
 RTLPlayground/installer$ make
 mkdir -p output
 gcc updatebuilder.c -o output/updatebuilder
-../toolchain/sdcc-3390765201/bin/sdas8051 -plosgff -o output/crtstart.rel crtstart.asm
+sdas8051 -plosgff -o output/crtstart.rel crtstart.asm
-../toolchain/sdcc-3390765201/bin/sdcc -mmcs51 --code-loc 0x1000 -o output/installer.rel -c installer.c
+sdcc -mmcs51 --code-loc 0x1000 -o output/installer.rel -c installer.c
-../toolchain/sdcc-3390765201/bin/sdcc -mmcs51 -Wl-bHOME=0x1100 -Wl-r -o output/rtlinstaller.ihx output/crtstart.rel output/installer.rel
+sdcc -mmcs51 -Wl-bHOME=0x1100 -Wl-r -o output/rtlinstaller.ihx output/crtstart.rel output/installer.rel
 ./output/updatebuilder -i output/rtlinstaller.ihx -o output/rtlplayground_oem_upgrade.bin ../output/rtlplayground.bin
 Input file size: 524288
 Bytes read: 524288
@@ -213,7 +186,7 @@ Go to "Firmware update" tab, select the correct file.
 > [!IMPORTANT]
 > If your device already runs RTLPlayground, you must upload the binary file /RTLPlayground/output/rtlplayground_Version_Machine.bin
-> If your device is OEM, you must upload the binary file /RTLPlayground/installer/output/rtlplayground_oem_upgrade.bin
+> If your device is OEM, you must upload the binary file /RTLPlayground/installer/outputrtlplayground_oem_upgrade.bin
 > [!CAUTION]
 > Check one more time that your device matches the machine type before flashing.
@@ -371,46 +344,21 @@ netmask zzz.zzz.zzz.zzz = Network mask of the switch
 port x name xxx         = Name xxx the port number x
 port z 1g               = Set 1g speed for port z
 igmp on/off             = Turn IGMP on or off
-session xxxx            = Web session timeout in seconds (default 3600)
+session xxxx            = Web session timeout in seconds (default 200)
 ```
 [To be continue]
 Enjoy playing!
-## (13) HTTP Simulator for front-end development
+## (11) Other documents
 The simulator is available in tools as `./httpd_sim.py`
 By default it will serve the content in the current working directory so the easiest way to run this is to:
 ```
 cd ./html
 ../tools/httpd_sim.py
 ```
 And the simulator will be available on http://127.0.0.1:8081
 There are commandline options available:
 ```
 usage: httpd_sim.py [-h] [--machine MACHINE] [--port PORT] [--bindaddr BINDADDR] [--verbose]
 options:
  -h, --help           show this help message and exit
  --machine MACHINE    path to machine.c or .h file to parse (optional)
  --port PORT          port to bind to (default 8081)
  --bindaddr BINDADDR  address to bind (default 127.0.0.1)
  --verbose            enable verbose output
 ```
 The machine parsing is somewhat experimental.
 ## (12) Other documents
 The following documents give further documentation on specific features of the RTL837x SoCs:
 - [Adding a new device](doc/adding-a-device.md)
 - [RTL8372/3 Feature support](doc/hardware.md)
 - [CPU Port](doc/CpuPort.md)
 - [L2 learning](doc/l2.md) 
 - [IGMP (IP-MC streaming)](doc/igmp.md)
 - [SFP+ ports](doc/sfp.md) 
- [Trunking aka. port aggregation](doc/link_aggregation.md)
+- [Trunking aka. port aggregation](doc/trunking.md)
 - [LACP (802.3ad link aggregation)](doc/lacp.md)
 - [VLAN](doc/vlan.md)
 - [Storm control](doc/storm_control.md)
@@ -125,6 +125,18 @@ void early_boot_handle_button(void) __banked
 void sds_config(uint8_t sds, uint8_t mode) __banked
 {
 	print_string("sds_config sds: "); print_byte(sds); print_string(", mode: "); print_byte(mode); write_char('\n');
 	sds_config_mac(sds, mode);
 	if (mode == SDS_10GR || mode == SDS_QXGMII)
 		sds_write_v(sds, 0x21, 0x10, 0x4480); // Q002110:6480
 	else
 		sds_write_v(sds, 0x21, 0x10, 0x6480); // Q002110:6480
 	sds_write_v(sds, 0x21, 0x13, 0x0400); // Q002113:0400
 	sds_write_v(sds, 0x21, 0x18, 0x6d02); // Q002118:6d02
 	sds_write_v(sds, 0x21, 0x1b, 0x424e); // Q00211b:424e
 	sds_write_v(sds, 0x21, 0x1d, 0x0002); // Q00211d:0002
 	sds_write_v(sds, 0x36, 0x1c, 0x1390); // Q00361c:1390
 	sds_write_v(sds, 0x36, 0x14, 0x003f); // Q003614:003f
 	uint8_t page = 0;
 	uint16_t v = 0;
@@ -153,21 +165,6 @@ void sds_config(uint8_t sds, uint8_t mode) __banked
 		print_string("Error in SDS Mode\n");
 		return;
 	}
 	sds_config_mac(sds, mode);
 	if (mode == SDS_10GR || mode == SDS_QXGMII)
 		sds_write_v(sds, 0x21, 0x10, 0x4480); // Q002110:6480
 	else
 		sds_write_v(sds, 0x21, 0x10, 0x6480); // Q002110:6480
 	sds_write_v(sds, 0x21, 0x13, 0x0400); // Q002113:0400
 	sds_write_v(sds, 0x21, 0x18, 0x6d02); // Q002118:6d02
 	sds_write_v(sds, 0x21, 0x1b, 0x424e); // Q00211b:424e
 	sds_write_v(sds, 0x21, 0x1d, 0x0002); // Q00211d:0002
 	sds_write_v(sds, 0x36, 0x1c, 0x1390); // Q00361c:1390
 	sds_write_v(sds, 0x36, 0x14, 0x003f); // Q003614:003f
 	sds_write_v(sds, 0x36, 0x10, v); // Q003610:0200
 	if (page == 0x2e) {  // 10G Fiber / SDS_QXGMII
@@ -260,7 +257,7 @@ void nic_setup(void) __banked
 	// This sets the size of the RX buffer, the filling level is in 0x7874
 	// R7848-000004ff
-	REG_SET(RTL837X_REG_NIC_RXBUFF_RX, RTL837X_NIC_RX_LAST_SLOT);
+	REG_SET(RTL837X_REG_NIC_RXBUFF_RX, 0x4ff);
 	// R7844-000007fe
 	REG_SET(RTL837X_REG_NIC_BUFFSIZE_TX, 0x7fe);
@@ -299,7 +296,6 @@ void nic_setup(void) __banked
 	// Sequence number of TX packets
 	tx_seq = 0;
 	REG_SET(RTL837X_NIC_INT_MSK, NIC_INT_RXIE);
 }
@@ -20,11 +20,9 @@
 #include "rtl837x_lldp.h"
 #include "rtl837x_storm.h"
 #include "rtl837x_trap.h"
 #include "rtl837x_cabletest.h"
 #include "sfp.h"
 #include "dhcp.h"
 #include "syslog.h"
 #include "sessions.h"
 #include "dns.h"
 #include "ntp.h"
 #include "uip/uip.h"
@@ -168,15 +166,10 @@ uint8_t atoi_hex(uint8_t idx)
 			break;
 		}
 		if (h_idx == 8) {
 			h_idx = 0;
 			break;
 		}
 		// swap hex nibbles
 		val = (val >> 4) | (val << 4);
-		if ((uint8_t)(c - '0') < 10) {
+		if (c - '0' < 10) {
 			val |= c - '0';
 		} else {
 			c |= 0x20;
@@ -267,7 +260,7 @@ uint8_t cmd_parse_port(uint8_t idx) {
 		return 0;
 	port = machine.phys_to_log_port[port];
-	if (!MACHINE_PORT_VALID(port))
+	if (port < machine.min_port || port > machine.max_port)
 		return 0;
 	atoi_results_u8 = port;
@@ -744,9 +737,9 @@ void parse_isolate(void)
    }
 	if (cmd_compare(2, "off")) {
-		for (uint8_t i = MACHINE_MIN_PORT; i <= MACHINE_MAX_PORT; i++)
+		for (uint8_t i = machine.min_port; i <= machine.max_port; i++)
 			members |= ((uint16_t)1) << i;
-		members |= PMASK_CPU; // CPU-port
+		members |= 0x200; // CPU-port
 		port_isolate(port_configured, members);
 		return;
 	}
@@ -798,7 +791,7 @@ void parse_ingress(void)
 		if (!cmd_is_space_or_nul(idx))
 			goto err;
 		// Setting mode for all ports at once
-		for (log_port = MACHINE_MIN_PORT; log_port <= MACHINE_MAX_PORT; log_port++) {
+		for (log_port = machine.min_port; log_port <= machine.max_port; log_port++) {
 			if (!port_ingress_filter(log_port, mode)) {
 				cmd_error("cannot set the ingress filter for port "); print_phys_port(log_port); write_char('\n');
 				return;
@@ -850,7 +843,7 @@ void parse_mirror(void)
 			print_string("NOT Enabled: ");
 		}
 		print_string("Mirroring port: ");
-		print_phys_port(mPort >> 1);
+		print_phys_port(mirroring_port);
 		reg_read_m(RTL837x_MIRROR_CONF);
 		uint16_t m = sfr_data[0];
 		m = (m << 8) | sfr_data[1];
@@ -910,7 +903,6 @@ void parse_port(void)
 					 "\nport <port> [show|on|off]" \
 					 "\nport <port> [10m|100m|1g|2g5|duplex] [half|full]" \
 					 "\nport <port> lldp [block|permit]" \
 					 "\nport <port> cabletest [show]" \
 					 "\nport <port> name [custom port name]\n");
 		return;
 	}
@@ -945,8 +937,6 @@ void parse_port(void)
 		print_string("\"\n");
 	} else if (cmd_compare(2, "lldp")) {
 		if (cmd_compare(3, "block")){
 			if (lldp_enabled)
 				lldp_shutdown((uint16_t)1 << phy_settings.port);
 			lldp_logical_port_status &= ~((uint16_t)1 << phy_settings.port);
 		} else if (cmd_compare(3, "permit")) {
 			lldp_logical_port_status |= (uint16_t)1 << phy_settings.port;
@@ -955,11 +945,6 @@ void parse_port(void)
 		}
 	} else if (machine.is_sfp[phy_settings.port]) {
 		print_string(" is SFP no PHY information available.\n");
 	} else if (cmd_compare(2, "cabletest")) {
 		if (cmd_words_len > 3 && cmd_compare(3, "show"))
 			cabletest_show();
 		else
 			cabletest_run();
 	} else if (cmd_compare(2, "10m")) {
 		print_string(" 10M\n");
 		phy_settings.speed = PHY_SPEED_10M;
@@ -1022,7 +1007,7 @@ void parse_mtu(void)
 	uint8_t p;
 	if (cmd_compare(1, "show")) {
-		for (p = MACHINE_MIN_PORT; p <= MACHINE_MAX_PORT; p++) {
+		for (p = machine.min_port; p <= machine.max_port; p++) {
 			reg_read_m(RTL8373_REG_MAC_L2_PORT_MAX_LEN + ((uint16_t) p << 8));
 			uint16_t mtu = SFR_DATA_U16 & 0x3fff;
 			print_string("Port "); print_phys_port(p);
@@ -1482,9 +1467,6 @@ void parse_passwd(void)
 			passwd[j++] = c;
 		} while (c != NUL && j < 20);
 		passwd[j] = NUL;
 		/* Logins made with the old password end here. With one session the next
 		 * login pushed a leftover one out; with several it would stay valid. */
 		session_init();
 		return;
 	}
 	cmd_error("Missing password\n");
@@ -1842,8 +1824,6 @@ void print_gpio_status(void) {
 void print_sw_version(void) __banked {
 	print_string("Software version: " VERSION_SW);
 	print_string("\nBuild date: " BUILD_DATE);
 	print_string("\nCompiler: SDCC " STR(__SDCC_VERSION_MAJOR) "." STR(__SDCC_VERSION_MINOR) "." STR(__SDCC_VERSION_PATCH) " #" STR(__SDCC_REVISION));
 	print_string("\nToolchain: " SDCC_TOOLCHAIN);
 	print_string("\nHardware: ");
 	print_string(machine.machine_name);
 	write_char('\n');
@@ -1872,10 +1852,6 @@ void cmd_parser(void) __banked
 		if (cmd_compare(0, "reset")) {
 			print_string("\nRESET\n\n");
 			reset_chip();
 		} else if (cmd_compare(0, "factory-reset")) {
 			print_string("\nFACTORY RESET\n\n");
 			flash_default_config();
 			reset_chip();
 		} else if (cmd_compare(0, "sfp")) {
 			parse_sfp();
 		} else if (cmd_compare(0, "stat")) {
@@ -2023,10 +1999,10 @@ void cmd_parser(void) __banked
 				cmd_error("lacp (show | off); a group starts LACP with: lag <1-4> lacp <port>...\n");
 		} else if (cmd_compare(0, "pvid")) {
 			if (cmd_words_len == 3 && cmd_parse_port_separator(cmd_words_b[1]) != 0
-			    && atoi_short(cmd_words_b[2]) && atoi_results_short <= 4094)
+			    && atoi_short(cmd_words_b[2]) && atoi_results_short && atoi_results_short <= 4094)
 				port_pvid_set(atoi_results_u8, atoi_results_short);
 			else {
-				cmd_error("pvid <port> <0-4094>\n");
+				cmd_error("pvid <port> <1-4094>\n");
 			}
 		} else if (cmd_compare(0, "vlan")) {
 			parse_vlan();
@@ -2095,8 +2071,6 @@ void cmd_parser(void) __banked
 				trap_rma_set(RTL837X_RMA0E_CONF, RTL837X_RMA_ACT_TRAP);
 			} else {
 				print_string("LLDP disabled\n");
 				if (lldp_enabled)
 					lldp_shutdown(lldp_logical_port_status);
 				lldp_enabled = 0;
 				trap_rma_set(RTL837X_RMA0E_CONF, RTL837X_RMA_ACT_FORWARD);
 			}
@@ -2169,7 +2143,7 @@ void execute_config(void) __banked
 				skipping = 1;
 			}
 			c = flash_buf[cfg_idx++];
-			if (c == 0 || c == '\n' || c == '\r') {
+			if (c == 0 || c == '\n') {
 				if (skipping) {
 					skipping = 0;
 				} else {
@@ -2343,7 +2317,6 @@ void health_show(void) __banked
 	ph_line("tx  ", HEALTH_PH_TX);
 	ph_line("stp ", HEALTH_PH_STP);
 	ph_line("cmd ", HEALTH_PH_CMD);
 	ph_line("lldp", HEALTH_PH_LLDP);
 	/* Stack: current depth plus how much of the painted area is untouched */
 	print_string("sp ");
@@ -19,8 +19,8 @@ extern __xdata uint8_t err_status;
 #define HEALTH_PH_TX	3
 #define HEALTH_PH_STP	4
 #define HEALTH_PH_CMD	5
-#define HEALTH_PH_LLDP	6
+#define HEALTH_PHASES	6
-#define HEALTH_PHASES	(HEALTH_PH_LLDP + 1)	/* last id + 1: sizes the arrays in cmd_parser.c */
+#define HEALTH_LLDP     7
 extern __xdata uint16_t health_rx_frames;
 #define health_rx_frame()	health_rx_frames++
@@ -0,0 +1,23 @@
 #ifndef _CHACHA_H_
 #define _CHACHA_H_
 #include <stdint.h>
 struct chacha20_t {
 	uint8_t wstate[64];		// 64 bytes written here
 	uint8_t constant[16];		// 128 bit constant
        uint8_t key[32];		// 256-bit secret key
        uint32_t cnt;			// 32-bit block counter 1, 2.. Big Endian!
        uint8_t nonce[12];		// 96-bit nonce
        __xdata uint8_t *plaintext;
        uint16_t length;
        __xdata uint8_t *cyphertext;
 };
 // Encrypt a plaintext with ChaCha20 as per RFC7539
 void chacha20_encrypt(void);
 // Test ChaCha20 using the example from RFC7539
 void chacha20_test(void);
 #endif
@@ -0,0 +1,103 @@
 #include "rtl837x_common.h"
 #include "chacha.h"
 void chacha_20(void);
 void chacha_update(void);
 void chacha_count(void);
 // generate a block of ChaCha20 keystream as per RFC7539
 __xdata struct chacha20_t __at(0xbf00) chacha20;
 #ifdef CHACHA20_TEST
 __xdata uint8_t plaintext[256];
 __xdata uint8_t cyphertext[256];
 #endif
 #ifdef DEBUG
 void chacha20_print_block(void)
 {
        for (uint8_t i=0; i < 64; i++) {
            print_byte(*(uint8_t * __xdata)(chacha20.wstate + i));
 	    if (i%4 == 3)
 		    write_char(' ');
        }
 }
 #endif
 void chacha20_encrypt(void)
 {
 	__xdata uint8_t *p = chacha20.plaintext;
 	while (chacha20.length) {
 		register uint8_t i;
 		chacha_count();
 		memcpy(chacha20.wstate, chacha20.wstate + 64, 64);
 #ifdef DEBUG
 		chacha20_print_block(); write_char('\n');
 #endif
 		chacha_20();
 		chacha_update();
 #ifdef DEBUG
 		chacha20_print_block(); write_char('\n');
 #endif
 		for (i = 0; i < ((chacha20.length > 64) ? 64 : chacha20.length); i++)
 			*chacha20.cyphertext++ = *p++ ^ chacha20.wstate[i];
 		chacha20.length -= chacha20.length > 64 ? 64 : chacha20.length;
 #ifdef DEBUG
 		print_string("\n  round done\n");
 #endif
 	};
 }
 #ifdef CHACHA20_TEST
 // Test the example of RFC 7539 Section 2.4.2
 void chacha20_test(void)
 {
 	__code uint8_t chacha_c[16] =
 		{ 0x61, 0x70, 0x78, 0x65,  0x33, 0x20, 0x64, 0x6e,
 		  0x79, 0x62, 0x2d, 0x32,  0x6b, 0x20, 0x65, 0x74 };
 	__code uint8_t key[32] =
 		{ 0x03, 0x02, 0x01, 0x00,  0x07, 0x06, 0x05, 0x04,
 		  0x0b, 0x0a, 0x09, 0x08,  0x0f, 0x0e, 0x0d, 0x0c,
 		  0x13, 0x12, 0x11, 0x10,  0x17, 0x16, 0x15, 0x14,
 		  0x1b, 0x1a, 0x19, 0x18,  0x1f, 0x1e, 0x1d, 0x1c };
 	__code uint8_t nonce[12] = {
 		  0x00, 0x00, 0x00, 0x00,  0x4a, 0x00, 0x00, 0x00,
 		  0x00, 0x00, 0x00, 0x00 };
 	__code uint8_t sunscreen[] = "Ladies and Gentlemen of the class of '99: If I could offer you only one tip for " \
 				     "the future, sunscreen would be it.";
 /*
 	Ciphertext Sunscreen (from RFC 7539 Section 2.4.2):
 	000  6e 2e 35 9a 25 68 f9 80 41 ba 07 28 dd 0d 69 81  n.5.%h..A..(..i.
 	016  e9 7e 7a ec 1d 43 60 c2 0a 27 af cc fd 9f ae 0b  .~z..C`..'......
 	032  f9 1b 65 c5 52 47 33 ab 8f 59 3d ab cd 62 b3 57  ..e.RG3..Y=..b.W
 	048  16 39 d6 24 e6 51 52 ab 8f 53 0c 35 9f 08 61 d8  .9.$.QR..S.5..a.
 	064  07 ca 0d bf 50 0d 6a 61 56 a3 8e 08 8a 22 b6 5e  ....P.jaV....".^
 	080  52 bc 51 4d 16 cc f8 06 81 8c e9 1a b7 79 37 36  R.QM.........y76
 	096  5a f9 0b bf 74 a3 5b e6 b4 0b 8e ed f2 78 5e 42  Z...t.[......x^B
 	112  87 4d 
 */
 	strcpy(plaintext, sunscreen);
 	memcpyc(chacha20.constant, chacha_c, 16);
 	memcpyc(chacha20.key, key, 32);
 	chacha20.cnt = 0;
 	memcpyc(chacha20.nonce, nonce, 12);
 	chacha20.plaintext = plaintext;
 	chacha20.length = strlen_x(plaintext);
 	chacha20.cyphertext = cyphertext;
 	print_string("Encrypting...\n");
 	chacha20_encrypt();
 	print_string("Cypertext:\n");
 	uint16_t len = strlen_x(plaintext);
 	for (uint8_t i = 0; i < len; i++) {
 		print_byte(cyphertext[i]); write_char(' ');
 	}
 }
 #endif
@@ -0,0 +1,455 @@
 ; ChaCha Quater-Round implementation in Assembler
 	.module chacha_8051
 ; Global variables:
 	.globl _chacha_20
 	.globl _chacha_update
 	.globl _chacha_count
 ;#define CHACHA_QR(A, B, C, D) { \
 ;    A += B; D ^= A; D = ROTL32(D, 16);  \
 ;    C += D; B ^= C; B = ROTL32(B, 12);  \
 ;    A += B; D ^= A; D = ROTL32(D, 8);   \
 ;    C += D; B ^= C; B = ROTL32(B, 7);   \
 ;}
 ; 		r0      r1    r2   r3
 ; CHACHA_QR( v[ 0], v[ 4], v[ 8], v[12] );
 	.area HOME    (CODE)
 store_32:
 	ar7 = 0x07
 	ar6 = 0x06
 	ar5 = 0x05
 	ar4 = 0x04
 	ar3 = 0x03
 	ar2 = 0x02
 	ar1 = 0x01
 	ar0 = 0x00
 	mov	a, r7
 	movx	@dptr, a
 	dec	dpl
 	mov	a, r6
 	movx	@dptr, a
 	dec	dpl
 	mov	a, r5
 	movx	@dptr, a
 	dec	dpl
 	mov	a, r4
 	movx	@dptr, a
 	ret
 rol_b:
 	clr	c
 	mov	a, r7
 	rlc	a
 	mov	r7, a
 	mov	a, r6
 	rlc	a
 	mov	r6, a
 	mov	a, r5
 	rlc	a
 	mov	r5, a
 	mov	a, r4
 	rlc	a
 	mov	r4, a
 	clr	a
 	addc	a, r7
 	mov	r7, a
 	djnz	dpl, rol_b
 	ret
 chacha_plus_xor:
 ; Load A into registers r4-r7, A pointed to by r0
 	mov	dptr, #_chacha20
 	mov	dpl, r0
 	movx	a, @dptr
 	mov	r7, a
 	dec	dpl
 	movx	a, @dptr
 	mov	r6, a
 	dec	dpl
 	movx	a, @dptr
 	mov	r5, a
 	dec	dpl
 	movx	a, @dptr
 	mov	r4, a
 ; A += B, B pointed to by r1
 	mov	dpl, r1
 	movx	a, @dptr
 	add	a, r7
 	mov	r7, a
 	dec	dpl
 	movx	a, @dptr
 	addc	a, r6
 	mov	r6, a
 	dec	dpl
 	movx	a, @dptr
 	addc	a, r5
 	mov	r5, a
 	dec	dpl
 	movx	a, @dptr
 	addc	a, r4
 	mov	r4, a
 	mov	dpl, r0		; Store A back
 	mov	a, r7
 	movx	@dptr, a
 	dec	dpl
 	mov	a, r6
 	movx	@dptr, a
 	dec	dpl
 	mov	a, r5
 	movx	@dptr, a
 	dec	dpl
 	mov	a, r4
 	movx	@dptr, a
 ; D ^= A
 	mov	dpl, r3
 	movx	a, @dptr
 	xrl	a, r7
 	mov	r7, a
 	dec	dpl
 	movx	a, @dptr
 	xrl	a, r6
 	mov	r6, a
 	dec	dpl
 	movx	a, @dptr
 	xrl	a, r5
 	mov	r5, a
 	dec	dpl
 	movx	a, @dptr
 	xrl	a, r4
 	mov	r4, a
 	dec	dpl
 	ret
 chacha_qr:
 ; QR Part: A += B; D ^= A; D = ROTL32(D, 16);
 	acall	chacha_plus_xor
 ; rotate left 16. D is r4, r5, r6, r7 -> r6, r7, r4, r5
 	mov	a, r6
 	xch	a, r4
 	mov	r6, a
 	mov	a, r7
 	xch	a, r5
 	mov	r7, a
 	mov     dpl, r3 ; Store D
 	acall   store_32
 ;QR Part: C += D; B ^= C; B = ROTL32(B, 12);
 ; Swap A <-> C and D <-> B
 	mov	a, r0
 	xch	a, r2
 	mov	r0, a
 	mov	a, r1
 	xch	a, r3
 	mov	r1, a
 	acall	chacha_plus_xor
 ; rotate left 12. D is r4, r5, r6, r7 -> r5, r6, r7, r4
 	mov	a, r4
 	xch	a, r7
 	xch	a, r6
 	xch	a, r5
 	mov	r4, a
 	mov	dpl, #4
 	acall	rol_b
 	mov	dpl, r3	; Store D (being B)
 	acall	store_32
 ; Swap A <-> C and D <-> B
 	mov	a, r0
 	xch	a, r2
 	mov	r0, a
 	mov	a, r1
 	xch	a, r3
 	mov	r1, a
 ; QR Part A += B; D ^= A; D = ROTL32(D, 8);
 	acall	chacha_plus_xor
 	mov	a, r4
 	xch	a, r7
 	xch	a, r6
 	xch	a, r5
 	mov	r4, a
 	mov	dpl, r3	; Store D
 	acall	store_32
 ; QR Part
 ;    C += D; B ^= C; B = ROTL32(B, 7);
 line4:
 ; Swap A <-> C and D <-> B
 	mov	a, r0
 	xch	a, r2
 	mov	r0, a
 	mov	a, r1
 	xch	a, r3
 	mov	r1, a
 	acall	chacha_plus_xor
 ; Roll left 7 bits, start by rolling 8 bits left, then roll 1 to the right
 	mov	a, r4
 	xch	a, r7
 	xch	a, r6
 	xch	a, r5
 	mov	r4, a
 	clr	c
 	mov	a, r4
 	rrc	a
 	mov	r4, a
 	mov	a, r5
 	rrc	a
 	mov	r5, a
 	mov	a, r6
 	rrc	a
 	mov	r6, a
 	mov	a, r7
 	rrc	a
 	mov	r7, a
 	clr	a
 	rrc	a
 	add	a, r4
 	mov	r4, a
 ; Swap A <-> C and D <-> B
 	mov	a, r0
 	xch	a, r2
 	mov	r0, a
 	mov	a, r1
 	xch	a, r3
 	mov	r1, a
 	mov	dpl, r1	; Store B
 	acall	store_32
 	ret
 ;
 ; Implementation of 20 ChaCha Rounds (10 Double Rounds)
 ;
 _chacha_20:
 	push    acc
 	push    b
 	push    dpl
 	push    dph
 	push    ar7
 	push    ar6
 	push    ar5
 	push    ar4
 	push    ar3
 	push    ar2
 	push    ar1
 	push    ar0
 	push    psw
 	mov	b, #10 ; 10 Double rounds
 chacha_20_loop:
 ;	CHACHA_QR( v[ 0], v[ 4], v[ 8], v[12] );
 	mov r0, #3
 	mov r1, #19
 	mov r2, #35
 	mov r3, #51
 	acall	chacha_qr
 ;        CHACHA_QR( v[ 1], v[ 5], v[ 9], v[13] ); 7  23  39  55
 	mov r0, #7
 	mov r1, #23
 	mov r2, #39
 	mov r3, #55
 	acall	chacha_qr
 ; 	CHACHA_QR( v[ 2], v[ 6], v[10], v[14] ); 11 27  43  59
 	mov r0, #11
 	mov r1, #27
 	mov r2, #43
 	mov r3, #59
 	acall	chacha_qr
 ;	CHACHA_QR( v[ 3], v[ 7], v[11], v[15] ); 15 31  47  63
        mov r0, #15
        mov r1, #31
        mov r2, #47
        mov r3, #63
 	acall	chacha_qr
 ;	CHACHA_QR( v[ 0], v[ 5], v[10], v[15] ); 3  23  43  63
 	mov r0, #3
 	mov r1, #23
 	mov r2, #43
 	mov r3, #63
 	acall	chacha_qr
 ;	CHACHA_QR( v[ 1], v[ 6], v[11], v[12] ); 7  27  47  51
 	mov r0, #7
 	mov r1, #27
 	mov r2, #47
 	mov r3, #51
 	acall	chacha_qr
 ;	CHACHA_QR( v[ 2], v[ 7], v[ 8], v[13] ); 11 31  35  55
 	mov r0, #11
 	mov r1, #31
 	mov r2, #35
 	mov r3, #55
 	acall	chacha_qr
 ;	CHACHA_QR( v[ 3], v[ 4], v[ 9], v[14] ); 15 19  39  59
 	mov r0, #15
 	mov r1, #19
 	mov r2, #39
 	mov r3, #59
 	acall	chacha_qr
 	djnz	b, chacha_20_loop
 	pop     psw
 	pop     ar0
 	pop     ar1
 	pop     ar2
 	pop     ar3
 	pop     ar4
 	pop     ar5
 	pop     ar6
 	pop     ar7
 	pop     dph
 	pop     dpl
 	pop     b
 	pop     acc
 	ret
 ;
 ; Update ChaCHa state
 ;
 _chacha_update:
 	push    acc
 	push    b
 	push    dpl
 	push    dph
 	push    ar4
 	push    ar3
 	push    ar2
 	push    ar1
 	push    ar0
 	push    psw
 	mov	dptr, #_chacha20
 	mov	b, #16 ; 16 uint32
 update_loop:
 	mov	a, b ; multiply by 4 and subtract 1
 	rl	a
 	rl	a
 	dec	a
 ; Load Working State variable into registers r0-r3
 	mov	dpl, a
 	orl	a, #64	; Save pointer to state
 	mov	r4, a
 	movx	a, @dptr
 	mov	r3, a
 	dec	dpl
 	movx	a, @dptr
 	mov	r2, a
 	dec	dpl
 	movx	a, @dptr
 	mov	r1, a
 	dec	dpl
 	movx	a, @dptr
 	mov	r0, a
 ; Add to State variable
 	mov	a, r4
 	mov	dpl, a
 	movx	a, @dptr
 	add	a, r3
 	mov	r3, a
 	dec	dpl
 	movx	a, @dptr
 	addc	a, r2
 	mov	r2, a
 	dec	dpl
 	movx	a, @dptr
 	addc	a, r1
 	mov	r1, a
 	dec	dpl
 	movx	a, @dptr
 	addc	a, r0
 	mov	r0, a
 ; Store back state variable in LSB, first sequence (serialized)
 	mov	a, r4
 	xrl	a, #64	; Save pointer to working state
 	mov	dpl, a
 	mov	a, r0
 	movx	@dptr, a
 	dec	dpl
 	mov	a, r1
 	movx	@dptr, a
 	dec	dpl
 	mov	a, r2
 	movx	@dptr, a
 	dec	dpl
 	mov	a, r3
 	movx	@dptr, a
 	djnz	b, update_loop
 	pop     psw
 	pop     ar0
 	pop     ar1
 	pop     ar2
 	pop     ar3
 	pop     ar4
 	pop     dph
 	pop     dpl
 	pop     b
 	pop     acc
 	ret
 ;
 ; Increase counter in state
 ;
 _chacha_count:
 	push    acc
 	push    dpl
 	push    dph
 	mov	dptr, #_chacha20
 	mov	dpl, #112 + 3
 	movx	a, @dptr
 	inc	a
 	movx	@dptr, a	
 	jnz	chacha_count_done
 	dec	dpl
 	movx	a, @dptr
 	inc	a
 	movx	@dptr, a
 	jnz	chacha_count_done
 	dec	dpl
 	movx	a, @dptr
 	inc	a
 	movx	@dptr, a
 	jnz	chacha_count_done
 	dec	dpl
 	movx	a, @dptr
 	inc	a
 	movx	@dptr, a
 chacha_count_done:
 	pop     dph
 	pop     dpl
 	pop     acc
 	ret
@@ -51,7 +51,7 @@ __xdata uip_ipaddr_t server;
 #define DHCP_END		255
 #pragma codeseg BANK3
-#pragma constseg BANK3
+#pragma constseg BANK2
 struct dhcp_pkt {
 	uint8_t type;
@@ -34,21 +34,6 @@ Next, transfer the actual packet over by repeating the SFR function with a
 pointer to the frame on the ASIC directly after the frame header and a
 length as given by the length in the frame header + 7, again divided by 8.
 The RX ring's inclusive last slot is configured as `0x4ff`, giving a byte
 range of `0x0000` through `0x27ff`. If the descriptor occupies the last slot
 at `0x27f8`, its payload starts at `0x0000`, not `0x2800`. The RX copy code
 normalizes that starting address before DMA. It relies on the hardware to
 wrap transfers that start inside the ring and cross its end, as observed
 on SWTGW218AS. Programming an initial address of `0x2800` does not wrap
 and can instead read zeros or stale TX data outside the RX ring.
 Frame lengths are checked against `UIP_CONF_BUFFER_SIZE` before copying.
 DMA works in whole eight-byte units. `UIP_CONF_BUFFER_ALLOC_SIZE` rounds
 the backing storage up to the next complete word: 1,560 bytes for the
 1,556-byte logical frame limit. This padding allows a maximum-size frame
 to be transferred directly without a separate tail copy. The logical
 frame limit and advertised MSS are unchanged.
 The received frame will have an RTL proprietary Ethernet frame type of
 0x8899 (RRPC) where normally the frame type 0x0800 for IPv4 would be located.
 Further 6 bytes follow describing the frame, before the normal IPv4 data
@@ -1,220 +0,0 @@
 # Adding a new device
 A device is supported by adding one board header `.h` and board definition `.c` file
 under `machine/`. 
 the build selects the definition by name, and CI compiles every file it finds.
 To compile for your added device, do:
 ```
 make MACHINE=<NAME>
 ```
 ## What a new device consists of
 | File | Purpose |
 |------|---------|
 | `machine/<NAME>.c` | the `struct machine machine` board definition |
 | `machine/<NAME>.h` | `MACHINE_MODEL` (the model string shown in the UI and the CLI) and `MACHINE_CHIPSET` (`RTL8372` or `RTL8373`) |
 | `machine/<NAME>_init.c` | optional `machine_custom_init()` boot hook, for registers the machine definition cannot express |
 | `doc/devices/<name>.md` + `doc/supported_devices.md` | (only if the board is verified and you want to support it publicly) user-facing documentation |
 `<NAME>` is the machine symbol without its `MACHINE_` prefix, so `MACHINE` is
 passed exactly as spelled on the command line: `make MACHINE=MY_BOARD_1_0`
 needs `machine/MY_BOARD_1_0.c` and `machine/MY_BOARD_1_0.h`.
 ## Step 1: the board header
 `machine/<NAME>.h` carries the product string and the SoC family. Use the
 existing files as the template:
 ```c
 #ifndef _MACHINE_MY_BOARD_1_0_H_
 #define _MACHINE_MY_BOARD_1_0_H_
 #define MACHINE_MODEL "Brand Model V1.0"
 #define MACHINE_CHIPSET RTL8373
 #endif
 ```
 `MACHINE_CHIPSET` is `RTL8373` or `RTL8372`; a build without it will fail. It selects the default
 logical port range: `MACHINE_MIN_PORT` is `0` for RTL8373 and `3` for RTL8372, while
 `MACHINE_MAX_PORT` is `8`, the highest logical port index. A board with a different range defines
 `MACHINE_MIN_PORT` and/or `MACHINE_MAX_PORT` in its header to override the
 defaults.
 The device product string is what the CLI or the Web-Interface will print to identify the device; `machine.h` includes it by name.
 > [!NOTE]
 > `machine_name` is a `char[30]` and `MACHINE_MODEL` is copied into it at
 > compile time. A longer model string still builds, but SDCC emits
 > `warning 147: excess elements in array of chars initializer` and the name is
 > truncated in the UI. Keep it to 29 characters or less.
 ## Step 2: the board definition
 `machine/<NAME>.c` starts with the shared prelude and then defines the single
 `machine` object. Copy the closest existing board and adjust it — do not start
 from a blank file, the field meanings are easier to see in a real example.
 The best choice is usually a device that has the same number and type of Ethernet
 ports and the same number of SFP+ cages.
 ```c
 #include "machine_defs.h"
 __code const struct machine machine = {
 	MACHINE_COMMON_SETTING,
 	.n_sfp = 1,
 	.log_to_phys_port = {1, 2, 3, 4, 5, 6, 7, 8, 9},
 	.phys_to_log_port = {0, 1, 2, 3, 4, 5, 6, 7, 8},
 	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
 	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
 	.sfp_port[0].pin_los = GPIO37,
 	.sfp_port[0].pin_tx_disable = GPIO_NA,
 	.sfp_port[0].sds = 1,
 	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
 	.reset_pin = GPIO_NA,
 	.high_leds = { .mux = LED_27 | LED_29, .enable = LED_28_SYS | LED_29 },
 	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 1 },
 	.led_sets = {
 		{   /* RJ45 ports */
 			LEDS_2G5 | LEDS_LINK,
 			LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
 			0,
 			0
 		}, { /* SFP port, single green LED */
 			LEDS_10G | LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
 			0,
 			0,
 			0
 		}
 	},
 };
 ```
 `MACHINE_COMMON_SETTING` (from `machine_defs.h`) initializes `machine_name` and
 `isRTL8373` from the header's `MACHINE_MODEL` and `MACHINE_CHIPSET`. The logical
 port range comes from `MACHINE_MIN_PORT` and `MACHINE_MAX_PORT` in `machine.h`.
 Keep it as the first initializer and list the board-specific fields after it.
 ### Fields
 | Field | Meaning |
 |-------|---------|
 | `MACHINE_COMMON_SETTING` | expands to `machine_name` (`MACHINE_MODEL`) and `isRTL8373` (`1` for `RTL8373`, `0` for `RTL8372`); both are derived from the header's `MACHINE_CHIPSET` (see Step 1) |
 | `n_sfp` | number of SFP+ cages |
 | `n_10g` | SerDes 10G capability used by the RTL837xN init: `0` none, `1` one, `2` two 10G-capable SerDes |
 | `log_to_phys_port[9]` | logical port (0-based index) → physical front-panel port number |
 | `phys_to_log_port[9]` | the inverse, physical port 1 is index 0, unused slots are 0 |
 | `is_sfp[9]` | `0` for copper, `1` for left slot and `2` for right slot |
 | `sfp_port[2]` | per-cage wiring, `sfp_port[0]` is the leftmost cage |
 | `reset_pin` | GPIO of the reset button, `GPIO_NA` if unpopulated |
 | `high_leds` | mux/enable for the LED pins 27–29 (`LED_27`, `LED_28_SYS`, `LED_29`) |
 | `port_led_set[9]` | which LED set (0–3) each logical port uses |
 | `led_sets[4][4]` | Each port can have up to 4 GPIO output pins assigned. 4 sets of LEDs with 4 LED-conditions per set; the conditions define which GPIO pins become active for a port given a port link-state. Which LEDs are then enabled depends on the wiring of the pins to up to 3 LEDs for that port, which can make a logical combination of the 4 LED output-pins. |
 | `led_mux_custom` / `led_mux[28]` | `1` plus the 28 mux values when the stock LED muxing does not fit the board |
 | `mac_flash_offset` | flash offset of the factory MAC address, omit or `0` if the board does not store one |
 Each `struct sfp_port` entry holds `pin_detect`, `pin_los`, `pin_tx_disable`,
 `sds` (which SerDes drives the cage) and `i2c` (built with `I2CBUS(sda, scl)`,
 or `GPIO_NA`-based values where a cage has no such pin).
 `I2CBUS(...)` only accepts the pin pairs listed in `machine_defs.h`. A wrong
 pair is caught at compile time: SDCC reports
 `error 176: sizeof applied to an incomplete type` pointing at the offending
 `.i2c` line, because the macro deliberately turns an invalid bus number into an
 array of size 0.
 ### Reusing an existing definition
 If the new board is electrically identical to one that already exists — same
 port mapping, same SFP wiring, same LEDs — do not copy the file. Make the new
 `.c` a symlink and keep only a distinct `.h`, so the two boards cannot drift
 apart:
 ```
 ln -s KP_9000_6XHML_X2.c machine/MY_BOARD_1_0.c
 ```
 The new board still needs `machine/MY_BOARD_1_0.h` (pick the version number on
 the PCB) with its own `MACHINE_MODEL` and `MACHINE_CHIPSET`: `MACHINE_MODEL` is
 what distinguishes the products, and `MACHINE_CHIPSET` must match the SoC of
 the board definition being reused.
 Existing examples: `machine/PCB_K0402WS_V3.c`, `machine/KP_9000_9XHML_X_V3_2.c`
 and the six `KP_9000_*` revision variants.
 Two files that differ only in whitespace or comments are duplicates and should
 be collapsed this way.
 ### Optional custom init hook
 If the board needs custom initialization, add
 `machine/<NAME>_init.c` defining `machine_custom_init()`. The Makefile picks the
 file up by name and compiles it.
 Boards that need the same hook share one file: keep the code in a single
 `machine/<NAME>_init.c` whose `machine/<NAME>.c` is a real file (not a symlink),
 and make the other boards' `_init.c` symlinks to it, for example:
 ```
 ln -s KP_9000_6XH_X2_init.c machine/MY_BOARD_1_0_init.c
 ```
 ## Step 3: build and verify
 ```
 make MACHINE=MY_BOARD_1_0
 ```
 The generated flash image appears as `output/rtlplayground-<version>-MY_BOARD_1_0.bin`. An
 unknown or empty `MACHINE` fails immediately with a message naming the expected
 file, before anything is compiled.
 Then run the checks CI runs:
 ```
 make machine_check    # compiles machine/<NAME>.c and its optional _init.c for every machine
 make -C test          # host-side unit tests
 ```
 `make machine_check` discovers the definitions with
 `$(wildcard machine/*.c)`, so a new file is covered without registering it
 anywhere. CI (`.github/workflows/build.yml`) runs it on every push and pull
 request, alongside full builds for a 4+2 and an 8+1 board.
 A successful compile only proves the definition is syntactically valid. The
 actual behaviour — port numbering, SFP detection, LEDs — has to be confirmed on
 hardware, and the console commands (`port`, `stat`, `sfp`, `leds`) are the
 tools for that.
 ## Step 4: documentation
 Once the board has been tested on hardware:
 1. Add a row to the table in [Supported devices](supported_devices.md).
 2. Add `doc/devices/<name>.md` describing the board, the build target
   (`make MACHINE=MY_BOARD_1_0`), what works and what is unverified, plus
   photos and the PCB silkscreen marking.
 3. If the board shares a PCB with other revisions, follow
   `doc/devices/KP-9000-6XH-X2.md` and document which `MACHINE` to pick for
   which silkscreen.
 ### Identifying the CPU variant
 For RTL8373-based devices, use the read-only console command below to distinguish
 the N and non-N CPU variants:
 ```text
 regget 4
 ```
 | Register 0x0004 value | CPU |
 |---|---|
 | `0x83730000` | RTL8373 (non-N) |
 | `0x83737000` | RTL8373N |
 Record the identified CPU in the device documentation. These values identify
 only the CPU variant; document PHY and flash-chip models separately when verified.
@@ -1,178 +0,0 @@
 hongyavision HYWS-SGT0204S
 RTL8372-based 4×2.5G + 2×SFP+ unmanaged switch.
 Also marked on the PCB as `2G5F4_10G2_V1.01`.
 Stock firmware runs a factory test console on UART at 9600 baud 8N1 (banner
 `RTL8371B start`, prompt `RTL8371B:`). There is no management CLI and no Web
 interface.
 Using SPI clamp in-board is the only method for initial installation and update.
 Erase the whole chip and verify the write (`flashrom -v`) before powering the
 board, so an incomplete write is caught before the board is powered up.
 Stock flash chip is 512 KB (Bright Moon `T25S40`, 4 Mbit, SOP-8), which the
 RTLPlayground image fills exactly.
 ### Label specifications
 Case, top / front / nameplate:
 <img src="photos/2G5F4_10G2_V1.01/assembled-top.jpg" width="300" />
 <img src="photos/2G5F4_10G2_V1.01/assembled-front.jpg" width="300" />
 <img src="photos/2G5F4_10G2_V1.01/assembled-bottom.jpg" width="300" />
 - **Manufacturer**: hongyavision (Shenzhen Hongyavision Electronic Technology
  Co., Ltd.)
 - **Model**: HYWS-SGT0204S — the nameplate is printed in Chinese and reads
  "10/100/1000/2500M fibre switch" and "4x 2.5G copper port + 2x 10G SFP+
  optical port"
 - **Ports**:
  - 4 × RJ45: 10/100/1000/2500 Mbps
  - 2 × SFP+: 1G / 2.5G / 10G
 - **Power**: 12 V DC, 2 A
 - **Serial number**: `S/N-YYYYMMDDNNNN`, e.g. `S/N-202312010028`
 The top of the case only carries generic printing ("2.5G+10G High Speed Fiber
 Transceiver / 4-Port 2.5G Ethernet Switch+10G Fiber"), so the nameplate on the
 bottom is what identifies the device.
 ### What works
 - All four 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps
 - Both SFP+ ports supporting 1G, 2.5G and 10G modules
 - Copper LEDs: white (2.5G) and blue (link/activity)
 - SFP LEDs: one single LED per port (link/activity)
 - SFP EEPROM and DDM readable on both cages, verified with a 10G module
  (`Rate: 0x67`, module identity and DDM values via the `sfp` console command)
 - Serial console at 115200 8N1 (RTLPlayground) / 9600 8N1 (stock)
 ### Not verified
 - The reset button footprint is unpopulated and the case has no opening for it,
  so it could not be tested.
 ### PCB overview
 **Board markings**
 - Top silkscreen: `2G5F4_10G2_V1.01`
 **Key components**
 - Main switch: RTL8372 (RTL8371B family), reported as `RTL8372` (non-N) by
  RTLPlayground. The chip sits under a heatsink and its package marking is not
  readable.
 - U1: SPI NOR flash, Bright Moon `T25S40`, 4 Mbit / 512 KB, SOP-8
 - A 3-hole reset button footprint is present but unpopulated, and the case has
  no opening for it, so there is no usable reset button
 Top side:
 <img src="photos/2G5F4_10G2_V1.01/pcb_top.jpg" width="600" />
 Bottom:
 <img src="photos/2G5F4_10G2_V1.01/pcb_bottom.jpg" width="600" />
 The stock flash chip, Bright Moon `T25S40` (SOP-8, 4 Mbit / 512 KB):
 <img src="photos/2G5F4_10G2_V1.01/flash_t25s40.jpg" width="300" />
 ### Port layout
 | Front panel position | Logical port | Physical port | Type    |
 |----------------------|--------------|---------------|---------|
 | SFP left             | 8            | 5             | SFP+    |
 | RJ45 1               | 4            | 1             | Copper  |
 | RJ45 2               | 5            | 2             | Copper  |
 | RJ45 3               | 6            | 3             | Copper  |
 | RJ45 4               | 7            | 4             | Copper  |
 | SFP right            | 3            | 6             | SFP+    |
 Copper ports 1–4 match the KP-9000-6XH-X2 (2M-PCB43-V1.1) layout, which this
 board is a sibling of. The two SFP+ cages are wired the other way round
 compared to that board: physical port 5 is on SDS1 and physical port 6 is on
 SDS0.
 ### Serial console
 The board has three through-holes used as the serial console, next to the
 heatsink in the middle of the board and visible in the top side photo above (the
 silkscreen labels are printed rotated by 90°). **The silkscreen labels are
 wrong**: they are shifted relative to the actual signals.
 | Silkscreen label | Actual signal |
 |------------------|---------------|
 | TX               | GND           |
 | RX               | TX            |
 | GND              | RX            |
 Wiring (following the measured signals, not the labels):
 | USB-TTL adapter | Board pad            |
 |-----------------|----------------------|
 | GND             | pad labelled `TX`    |
 | RX              | pad labelled `RX`    |
 | TX              | pad labelled `GND`   |
 - **Settings**: 115200 baud / 8N1 / 3.3V TTL (RTLPlayground), 9600 baud for the
  stock firmware
 - The stock firmware only prints a few bytes and a factory test menu
  (`?`, `rst`, `f`, `r`, `10`, `100`, `g1`, `sd`, `eye`, …); it is not an
  interactive management console
 ### LED configuration
 Case silkscreen, below the RJ45 ports:
 ```
 White : 2.5G    Blue : 1000M/2500M L/A
 ```
 The front panel also carries a `PWR` LED and one LED per SFP cage (`SFP1`,
 `SFP2`) on the right hand side.
 | Port       | LED          | Linked, idle | With traffic |
 |------------|--------------|--------------|--------------|
 | Copper     | white        | 2.5G only    | same         |
 | Copper     | blue         | solid        | blinks (L/A) |
 | SFP        | single LED   | solid        | blinks (L/A) |
 Measured LED-ID mapping (from the RTL837x LED set registers):
 | LED-ID | Function                        |
 |--------|---------------------------------|
 | LED-ID0| copper blue LED                 |
 | LED-ID1| copper white LED                |
 | LED-ID2| SFP single LED                  |
 **Important**: `RTL837X_REG_LED_GLB_IO_EN` bit 6 must be set in
 `machine_custom_init()`. Without it the RTL837x "solid" conditions (LINK/speed)
 do not drive the LEDs at all and only `ACT` does, which makes the white LED
 glow faintly at non-2.5G speeds.
 ### SFP GPIO assignments
 | SFP               | pin\_detect (ModAbs)          | pin\_los         | SerDes | I2C SDA                 | I2C SCL                  |
 |-------------------|-------------------------------|------------------|--------|-------------------------|--------------------------|
 | Left (logical 8, physical 5) | GPIO30\_ACL\_BIT3\_EN | GPIO37   | SDS1   | GPIO39\_I2C\_SDA4       | GPIO40\_I2C\_SCL3\_MDC1  |
 | Right (logical 3, physical 6)| GPIO50\_I2C\_SCL2\_UART1\_TX | GPIO10\_LED10 | SDS0 | GPIO41\_I2C\_SDA3\_MDIO1 | GPIO40\_I2C\_SCL3\_MDC1 |
 `pin_tx_disable` is GPIO\_NA on both ports. Both I2C buses are confirmed
 working: with the same 10G module inserted, the `sfp` console command reads its
 vendor and model from the left cage (`Slot 1`) and from the right cage
 (`Slot 2`), DDM values included. The insertion also shows which SerDes drives
 each cage - the left cage reports `sds_config sds: 01` and the right cage
 `sds: 00`, which matches the table above.
 ### Machine target
 Build for this device with `make MACHINE=HONGYAVISION_HYWS_SGT0204S`, which selects the
 `machine/HONGYAVISION_HYWS_SGT0204S.c` board definition. It is derived from
 `machine/KEEPLINK_KP_9000_6XHML_X2.c` with the SFP cage order and the reset pin changed.
 The fitted T25S40 cannot be read in DIO mode on this board: an image that leaves
 DIO enabled does not come up at all, both at the default read clock divider of 4
 and at 8 (two boards tested), while the same image with single-IO boots and runs
 normally. The board definition therefore sets `flash_sio`, which makes
 `flash_init()` use `CMD_FREAD` at divider 8. Only the management plane is
 slower, the ASIC keeps forwarding in hardware.
@@ -7,7 +7,7 @@
 ## PCB
-<img src="photos/2M-PCB23-V2.2/2M-PCB23-V2.2-top.jpg" width="300" />
+<img src="photos/2M-PCB23-V2.2-managed/2M-PCB23-V2.2-top.jpg" width="300" />
 ## Port overview
@@ -7,7 +7,7 @@
 ## PCB
-<img src="photos/2M-PCB23-V3.1/2M-PCB23-V3.1-top.jpeg" width="300" />
+<img src="photos/2M-PCB23-V3.1-managed/2M-PCB23-V3.1-top.jpeg" width="300" />
 ## Port overview
@@ -10,15 +10,15 @@ The original web interface reports this board as hardware version V3.2
 ## PCB
-<img src="photos/2M-PCB23-V3.2/2M-PCB23-V3.2-top.jpeg" width="300" />
+<img src="photos/2M-PCB23-V3.2-managed/2M-PCB23-V3.2-top.jpeg" width="300" />
 ## Compared to V3.1
-The component placement matches [2M-PCB23-V3.1](2M-PCB23-V3.1.md): same
+The component placement matches [2M-PCB23-V3.1](2M-PCB23-V3_1.md): same
 positions for the flash (U8), the T7/T8/T9/T10 headers, the SFP cage and its
 LED, and the unpopulated U7/U9 footprints. Build with
-`make MACHINE=KEEPLINK_KP_9000_9XHML_X_V3_2`, whose board file is a symlink to the V3.1
+`MACHINE=KP_9000_9XHML_X_V3_2`, which uses the V3.1 machine definition and
-definition and only differs in the reported name.
+only differs in the reported name.
 ## Tested
@@ -15,17 +15,17 @@ and sold by Mokerlink.
 The device is fully supported:
 - All 4 2.5GBASE-T RJ45 ports work at 10/100/1000/2500 Mbps
 - The SFP+ port supports 1G, 2.5G and 10G modules 
- LEDs work with the same indiciations as the OEM firmware (build with `make MACHINE=MOKERLINK_2G040210GSM` if building yourself, or use the corresponding pre-compiled binary)
+- LEDs work with the same indiciations as the OEM firmware (use KP_9000_6XHML_X2_V1_1 in machine.h if building yourself or the corresponding pre-compiled binary)
 - untested due to missing Hardware: SFP+ ports equipped with 1G or 2.5G SFPs.
 ### Hardware overview
 Front
-<img src="photos/2M-PCB43-V1.1/2M-PCB43-V1.1-front.jpeg" width="300" />
+<img src="photos/2M-PCB43-V1.1-managed/2M-PCB43-V1.1-front.jpeg" width="300" />
 Label
-<img src="photos/2M-PCB43-V1.1/2M-PCB43-V1.1-label.jpeg" width="300" />
+<img src="photos/2M-PCB43-V1.1-managed/2M-PCB43-V1.1-label.jpeg" width="300" />
 ### PCB overview
@@ -34,11 +34,11 @@ Label
 Top side
-<img src="photos/2M-PCB43-V1.1/2M-PCB43-V1.1-top.jpeg" width="300" />
+<img src="photos/2M-PCB43-V1.1-managed/2M-PCB43-V1.1-top.jpeg" width="300" />
 Bottom
-<img src="photos/2M-PCB43-V1.1/2M-PCB43-V1.1-bottom.jpeg" width="300" />
+<img src="photos/2M-PCB43-V1.1-managed/2M-PCB43-V1.1-bottom.jpeg" width="300" />
 ### J1, serial console
@@ -1,22 +1,20 @@
 # MokerLink POE-2G080110GS
 The `POE-2G080110GS` is an unmanaged 8x2.5G RJ45 and 1xSFP+ PoE switch sold by Mokerlink. There is also a `POE-2G080110GSM` managed version of the switch which may be similar but this has not been verified on actual hardware.
 The`KP-9000-9XHP-X` is the KeepLink rebrand for same product.
 ## Brands
 | Brand  | Type             |Managed| PCB              | Flash           | Chip RTL      |
 |--------|------------------|-------|------------------|-----------------|---------------|
 | Mokerlink | POE-2G080110GS | No | 2M-PCB51-ML-V1.1 | 4MB (W25Q32JV) | 8373N + 8224N |
 | KeepLink  | KP-9000-9XHP-X | No | 2M-PCB51-ML-V1.1 | 4MB (W25Q32JV) | 8373N + 8224N |
 ## Hardware overview
 Front
-<img src="photos/2M-PCB51-ML-V1.1/POE-2G080110GS-front.jpg" width="300" />
+<img src="photos/POE-2G080110GS/POE-2G080110GS-front.jpg" width="300" />
 Label
-<img src="photos/2M-PCB51-ML-V1.1/POE-2G080110GS-label.jpg" width="300" />
+<img src="photos/POE-2G080110GS/POE-2G080110GS-label.jpg" width="300" />
 The stock firmware from a POE-2G080110GS device had a sha256sum of `4c280853465eaad80e1772075c0f2d29c11fb8c561547f06353d3a5443c388e9`.
@@ -24,11 +22,11 @@ The stock firmware from a POE-2G080110GS device had a sha256sum of `4c280853465e
 Top silkscreen is marked `2M-PCB51-ML-V1.1`. PoE is provided by RTL8238C. Flash chip is 4 MB Winbond 25Q32JV (U8).
-<img src="photos/2M-PCB51-ML-V1.1/POE-2G080110GS-pcb.jpg" width="300" />
+<img src="photos/POE-2G080110GS/POE-2G080110GS-pcb.jpg" width="300" />
 > [!CAUTION]
 > This device operates on mains voltage, which can be a dangerous or potentially lethal hazard. Even after the device is unplugged, high-voltage capacitors can remain charged afterward and may still shock you. Do not attempt to open/disassemble a mains powered device unless you understand how to do so safely. Also, opening the device may void your warranty.
 ## Notes
-The stock firmware blinks both the 2.5G and 1G LEDs on activity, despite the front of the device indicating that each LED should be independent. The `MOKERLINK_POE_2G080110GS` machine config behaves as the front of the device indicates (and what seems more logical) -- each port LED turns on and blinks independently.
+The stock firmware blinks both the 2.5G and 1G LEDs on activity, despite the front of the device indicating that each LED should be independent. The `POE_2G080110GS` machine config behaves as the front of the device indicates (and what seems more logical) -- each port LED turns on and blinks independently.
@@ -27,7 +27,7 @@ Documentation for the unmanaged 8 + 1 switch sold as `7018-2.5G` by Guangnianwei
 ### Build target
 ```
-make MACHINE=GUANGNIANWEI_7018_2_5G
+make MACHINE=F7008_2_5
 ```
 ### LED wiring
@@ -57,11 +57,11 @@ The board is marked `F7008-2.5GPOE-V1.2`.
 Top side:
-<img src="photos/F7008-2.5GPOE-V1.2/PCB-top.jpg" width="600" />
+<img src="photos/F7008-2.5/PCB-top.jpg" width="600" />
 Bottom side:
-<img src="photos/F7008-2.5GPOE-V1.2/PCB-bottom.jpg" width="600" />
+<img src="photos/F7008-2.5/PCB-bottom.jpg" width="600" />
 ### Hardware notes
@@ -30,11 +30,11 @@ Using SPI clamp in-board is the only method for initial installation.
 Front panel
-<img src="photos/PCB-K0402W-U13-V2.0/chassis-front.jpg" width="400" />
+<img src="photos/FNS-1200P/chassis-front.jpg" width="400" />
 Top side (PCB)
-<img src="photos/PCB-K0402W-U13-V2.0/PCB-top.jpg" width="300" />
+<img src="photos/FNS-1200P/PCB-top.jpg" width="300" />
 ### Port layout
@@ -22,21 +22,21 @@ RTL8373-based 8×2.5G PoE + 1×SFP switch.
 Front panel:
-<img src="photos/S1100W-8GT-1SX_SE-V1.05/front.jpg" width="600" />
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/front.jpg" width="600" />
 Label:
-<img src="photos/S1100W-8GT-1SX_SE-V1.05/label.jpg" width="600" />
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/label.jpg" width="600" />
 ### PCB overview
 Top side:
-<img src="photos/S1100W-8GT-1SX_SE-V1.05/pcb_top.jpg" width="600" />
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/pcb_top.jpg" width="600" />
 Bottom side:
-<img src="photos/S1100W-8GT-1SX_SE-V1.05/pcb_bottom.jpg" width="600" />
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/pcb_bottom.jpg" width="600" />
 ### Port layout
@@ -1,36 +0,0 @@
 ### HG0402XG V1.1
 ## Brands
 |Brand|Type|Managed|PCB|Flash|Chip RTL|
 |---|---|---|---|---|---|
 | ZoeRax | HG0402XG | No|  HG0402XG V1.1 | 1M (Winbond 25Q) | |
 ### Label specifications
 - **Name**: ZOERAX 2.5G 2SFP 4-Port Gigabit Switch
 - **Model**: HG0402XG-EU
 - **Ports**:
  - 4 × RJ45: 10/100/1000/2500 Mbps
  - 2 × SFP+: 1000 / 2500 / 10000 Mbps
 <img src="photos/HG0402XG-V1.1/ZOERAX_HG0402XG_V1_1_bottom.jpg" width="300" />
 ## PCB
 <img src="photos/HG0402XG-V1.1/ZOERAX_HG0402XG_V1_1_top.jpg" width="300" />
 <img src="photos/HG0402XG-V1.1/ZOERAX_HG0402XG_V1_1_bottom.jpg" width="300" />
 Be aware that the UART header is metric, the pitch is 2mm. The JST PH2.0mm header shown was addeded after purchase
 The slider switch controls microcontroller U4 in order to configure the VLAN on/off settings. U4 can reset the SoC
 and also write into its registers to configure VLAN. With RTLPlayground the slider cannot be used for anything else
 than triggering reset. Any change in the position will trigger this reset.
 ### Installation
 Using SPI clamp on-board is the only method for initial installation.
 ### What works
 - All four 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps
 - SFP ports with various 1G/10G Fiber and Ethernet modules
 - LEDs
@@ -21,15 +21,15 @@ Using SPI clamp in-board is the only method for initial installation.
 ### PCB overview
 **Board markings**  
- Top silkscreen: PCB-K0801W-V2.0 / DIP-KO801WS-V2.0  
+- Top silkscreen: PCB-KO801W-V2.0 / DIP-KO801WS-V2.0  
 Top side
-<img src="photos/PCB-K0801W-V2.0/PCB-top.jpg" width="300" />
+<img src="photos/K0801W-V2.0-unmanaged\PCB-top.jpg" width="300" />
 Bottom
-<img src="photos/PCB-K0801W-V2.0/PCB-bottom.jpg" width="300" />
+<img src="photos/K0801W-V2.0-unmanaged\PCB-bottom.jpg" width="300" />
 ## Power supply
@@ -32,15 +32,15 @@ Stock flash chip is 512KB in size. Consider replacing for update through Web UI.
 Top side
-<img src="photos/2G5F_20G_V1.01/Assembled-top.jpg" width="300" />
+<img src="photos/HYWS-SGT0108S-unmanaged\Assembled-top.jpg" width="300" />
 Front
-<img src="photos/2G5F_20G_V1.01/Assembled-front.jpg" width="300" />
+<img src="photos/HYWS-SGT0108S-unmanaged\Assembled-front.jpg" width="300" />
 Bottom
-<img src="photos/2G5F_20G_V1.01/Assembled-bottom.jpg" width="300" />
+<img src="photos/HYWS-SGT0108S-unmanaged\Assembled-bottom.jpg" width="300" />
 ### PCB overview
@@ -49,15 +49,15 @@ Bottom
 Top side
-<img src="photos/2G5F_20G_V1.01/PCB-top.jpg" width="300" />
+<img src="photos/HYWS-SGT0108S-unmanaged\PCB-top.jpg" width="300" />
 Bottom
-<img src="photos/2G5F_20G_V1.01/PCB-bot.jpg" width="300" />
+<img src="photos/HYWS-SGT0108S-unmanaged\PCB-bot.jpg" width="300" />
 Original SPI Flash Chip
-<img src="photos/2G5F_20G_V1.01/og_spi_flash.jpg" width="300" />
+<img src="photos/HYWS-SGT0108S-unmanaged\og_spi_flash.jpg" width="300" />
 ## Power supply
@@ -18,6 +18,6 @@ The BoyaMicro 25Q16BSSIG flash chip is supported by flashprog with chip name "B.
 The board is marked `PCB-K0501W-V2.0 DIP-K0501WS-V2.0`.
-<img src="photos/PCB-K0501W-V2.0/pcb-top.jpg" width="300" />
+<img src="photos/K0501W_V2_0/pcb-top.jpg" width="300" />
-<img src="photos/PCB-K0501W-V2.0/pcb-bottom.jpg" width="300" />
+<img src="photos/K0501W_V2_0/pcb-bottom.jpg" width="300" />
@@ -22,9 +22,9 @@ reliable indicator of PCB wiring. The PCB revision defines the hardware layout.
 | PCB silkscreen | Known labels / devices | Recommended machine target | Equivalent target | Legacy target |
 | --- | --- | --- | --- | --- |
-| `2M-PCB43-V1.1` | Mokerlink 2G040210GSM web-managed 4+2 switch | `MACHINE_MOKERLINK_2G040210GSM` | `MACHINE_KEEPLINK_KP_9000_6XH_V1_1` | `MACHINE_KEEPLINK_KP_9000_6XHML_X2` |
+| `2M-PCB43-V1.1` | Mokerlink 2G040210GSM web-managed 4+2 switch | `MACHINE_KP_9000_6XHML_X2_V1_1` | `MACHINE_KP_9000_6XH_X2_V1_1` | `MACHINE_KP_9000_6XHML_X2` |
-| `2M-PCB43-V1.2` | `KP-9000-6XHML-X2` | `MACHINE_KEEPLINK_KP_9000_6XHML_V1_2` | `MACHINE_KEEPLINK_KP_9000_6XH_V1_2` | `MACHINE_KEEPLINK_KP_9000_6XHML_X2` |
+| `2M-PCB43-V1.2` | `KP-9000-6XHML-X2` | `MACHINE_KP_9000_6XHML_X2_V1_2` | `MACHINE_KP_9000_6XH_X2_V1_2` | `MACHINE_KP_9000_6XHML_X2` |
-| `2M-PCB43-V2.1` | `KP-9000-6XH-X2`, `KP-9000-6XHML-X2` | `MACHINE_KEEPLINK_KP_9000_6XH_X2_V2_1` or `MACHINE_KEEPLINK_KP_9000_6XHML_V2_1` | same V2.1 layout | `MACHINE_KEEPLINK_KP_9000_6XH_X2` |
+| `2M-PCB43-V2.1` | `KP-9000-6XH-X2`, `KP-9000-6XHML-X2` | `MACHINE_KP_9000_6XH_X2_V2_1` or `MACHINE_KP_9000_6XHML_X2_V2_1` | same V2.1 layout | `MACHINE_KP_9000_6XH_X2` |
 The V1.1 and V1.2 boards currently use the same V1.x GPIO, SFP, port and LED
 layout. The V2.1 board uses a different V2.1 layout with custom LED muxing.
@@ -42,11 +42,11 @@ new builds should prefer the explicit PCB-revision targets.
 Front side:
-<img src="photos/2M-PCB43-V2.1/KP-9000-6XH-X2-front.jpg" width="600" />
+<img src="photos/2M-PCB43-V2.1-unmanaged/KP-9000-6XH-X2-front.jpg" width="600" />
 Label:
-<img src="photos/2M-PCB43-V2.1/KP-9000-6XH-X2-label.jpg" width="600" />
+<img src="photos/2M-PCB43-V2.1-unmanaged/KP-9000-6XH-X2-label.jpg" width="600" />
@@ -57,11 +57,11 @@ Label:
 Top side
-<img src="photos/2M-PCB43-V2.1/2M-PCB43-V2.1-top.jpg" width="600" />
+<img src="photos/2M-PCB43-V2.1-unmanaged/2M-PCB43-V2.1-top.jpg" width="600" />
 Bottom
-<img src="photos/2M-PCB43-V2.1/2M-PCB43-V2.1-bottom.jpg" width="600" />
+<img src="photos/2M-PCB43-V2.1-unmanaged/2M-PCB43-V2.1-bottom.jpg" width="600" />
 ### Hardware overview: 2M-PCB43-V1.1 / V1.2
@@ -71,15 +71,15 @@ Both use the same V1.x layout.
 Label:
-<img src="photos/2M-PCB43-V2.1/KP-9000-6XH-X2-label.jpg" width="600" />
+<img src="photos/KP-9000-6XHML-X2/label.jpg" width="600" />
 Top side:
-<img src="photos/2M-PCB43-V1.1/2M-PCB43-V1.1-top.jpeg" width="600" />
+<img src="photos/KP-9000-6XHML-X2/pcb_top.jpg" width="600" />
 Bottom:
-<img src="photos/2M-PCB43-V1.1/2M-PCB43-V1.1-bottom.jpeg" width="600" />
+<img src="photos/KP-9000-6XHML-X2/pcb_bottom.jpg" width="600" />
 ## Reset Button
@@ -18,13 +18,13 @@ ONT-S207CW-62TS-SE, Binardat 2G06-04210GSM (managed), and Binardat 2G06-04210GS
 ### Binardat 2G06-04210GSM
 **Front View:**
-<img src="photos/NONAME-20240111/binardat-2g06-04210gsm-front.jpg" width="400" />
+<img src="photos/ONT-S207CW-Binardat-2G06-04210GSM/binardat-2g06-04210gsm-front.jpg" width="400" />
 **Back View:**
-<img src="photos/NONAME-20240111/binardat-2g06-04210gsm-back.jpg" width="400" />
+<img src="photos/ONT-S207CW-Binardat-2G06-04210GSM/binardat-2g06-04210gsm-back.jpg" width="400" />
 **PCB View:**
-<img src="photos/NONAME-20240111/binardat-2g06-04210gsm-pcb.jpg" width="400" />
+<img src="photos/ONT-S207CW-Binardat-2G06-04210GSM/binardat-2g06-04210gsm-pcb.jpg" width="400" />
 *Photos courtesy of [andreas5232](https://github.com/andreas5232) from [emesix/ONT-S207CW-62TS-SE#1](https://github.com/emesix/ONT-S207CW-62TS-SE/issues/1)*
@@ -90,8 +90,6 @@ Custom mapping for ONT-S207CW-62TS-SE:
 ## Flashing Instructions
 See the [README.md](../../README.md) for general flashing instructions.
 For compilation, use command `make MACHINE=ONT_S207CW_62TS_SE` to specify the machine.
 If you are using managed version of the switch, you can then also compile the installer and flash using GUI - run command `cd installer` and finally `make`.
 ## Stock Firmware Information
@@ -1,93 +0,0 @@
 # PCB-AFGW SWTG218ANS V2.0.2
 RTL8373-based 8×2.5G PoE + 1×10G SFP+ web-managed switch, sold as the
 **RealHD PSW8-25MG**.
 ### Label specifications
 - **Manufacturer**: RealHD
 - **Model**: PSW8-25MG
 - **PCB marking**: `PCB-AFGW SWTG218ANS_V2.0.2` (silkscreened as `PCB-AFGW SWTG218ANS_V2.0.2_23308`)
 - **Ports**:
  - 8 × RJ45: 10/100/1000/2500 Mbps with PoE
  - 1 × SFP+: 1G / 2.5G / 10G (front panel marking `9(10G)`)
 - **Power input**: internal AC PSU, `100-240V~ 50/60Hz 2A MAX`, DC output `53.5V 2.8A 150W`
 - **Front panel LEDs**: `PWR`, `SYS`, per RJ45 port `Link/Act` and `PoE`, per SFP port 2.5G (green) and 10G (blue)
 - **Stock firmware defaults**: web-managed PoE switch
 ### What works
 - All eight 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps (PoE is not configurable via RTLPlayground)
 - SFP+ port supporting 1G, 2.5G and 10G modules
 - LEDs: green (2.5G) and amber (1G/100M/10M) per RJ45 port with activity, green (1G/2.5G) and blue (10G) on the SFP port, plus the `SYS` LED
 ### Photos
 Front panel:
 <img src="photos/PCB-AFGW-SWTG218ANS_V2.0.2_23308/device_front.jpg" width="800" />
 Board mounted in the case, with the internal PSU above it:
 <img src="photos/PCB-AFGW-SWTG218ANS_V2.0.2_23308/dev_top_w_pcb.jpg" width="800" />
 ### PCB overview
 Top side:
 <img src="photos/PCB-AFGW-SWTG218ANS_V2.0.2_23308/pcb_front.jpg" width="800" />
 Bottom side:
 <img src="photos/PCB-AFGW-SWTG218ANS_V2.0.2_23308/pcb_back.jpg" width="800" />
 A 4-pad UART header with `RXD` / `TXD` silkscreened sits next to the right heatsink. 
 ### Port layout
 | Logical port | Physical port | Type   |
 |--------------|---------------|--------|
 | 1-8          | 1-8           | RJ45   |
 | 9            | 9             | SFP+   |
 ### LED configuration
 RJ45 ports use LED SET0, the SFP+ port uses LED SET1. The board needs the custom
 LED mux (`led_mux_custom = 1`), and `RTL837X_REG_LED_GLB_IO_EN` is written to
 `0x7f24977f` in `machine_custom_init()` so the LED pins are enabled as wired here.
 | SET  | LED pin 0                                     | LED pin 1                                             |
 |------|-----------------------------------------------|-------------------------------------------------------|
 | SET0 | Green — lights on 2.5G link with activity     | Amber — lights on 1G / 100M / 10M link with activity  |
 | SET1 | All speeds — lights on any link with activity | 10G — lights on 10G link with activity                |
 On the front panel this gives one bi-color `Link/Act` LED per RJ45 port (green at
 2.5G, amber at 10/100/1000M, blinking with activity) and one `PoE` LED per RJ45
 port, which is driven by the PoE hardware and not by the switch. The SFP+ port has
 a green 2.5G LED and a blue 10G LED.
 ### SFP GPIO assignments
 | SFP (logical 9) | pin_detect (ModAbs) | pin_los | pin_tx_disable | SerDes | I2C SDA          | I2C SCL              |
 |-----------------|---------------------|---------|----------------|--------|------------------|----------------------|
 | SFP             | GPIO38              | GPIO_NA | GPIO_NA        | SDS1   | GPIO39_I2C_SDA4  | GPIO40_I2C_SCL3_MDC1 |
 ### Machine configuration
 ```
 make MACHINE=REALHD_PSW8_25MG
 ```
 ### Programming
 The serial console runs at 8N1 on 115200 baud with the RTLPlayground firmware
 (see the UART header note under *PCB overview*). The stock firmware baud rate 57600. The flash chip was 2MB.
 ### PoE
 The 8 RJ45 ports support PoE, powered by the internal 150W AC PSU (DC output
 53.5V 2.8A) mounted above the main board.
 Note: RTLPlayground does not provide PoE management for this board. The PoE
 hardware runs with its own configuration, the same as on the other PoE boards in
 this project.
@@ -1,72 +0,0 @@
 # PCB-K0402WS-V1.0
 This is the first revision of the PCB-K0402WS series of boards; it's very similar to 2.0 in terms of layout/wiring.
 The board does have footprints for a VLAN modeswitch at the front and a second flash chip on the bottom of the PCB, but these have been seen to ship unpopulated.
 ### Brands
 * YuanLey YS25-0402 <sup><sub>Note: there are [multiple revisions](PCB-K0402W-V3.0.md) of the YS25-0402. This first revision lacks the "Vlan" switch cutout on the front of the enclosure.</sub></sup>
 ### Programming
 Use a SOIC-8 clamp to the flash chip (U1 on silkscreen) at the top of the board, leaving it otherwise unpowered.
 The board has been seen to ship with a single [BoyaMicro BY25Q16BSSIG](https://www.lcsc.com/datasheet/C382744.pdf) 16Mbit (2MiB) chip, though exact BOM may vary.
 <a href="photos/PCB-K0402W-V1.0/flash.jpg"><img src="photos/PCB-K0402W-V1.0/flash.jpg" width="300" /></a>
 ### What works
 - All four 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps
 - Both SFP ports supporting 1G, 2.5G and 10G modules
 - LEDs (Power LED is always on)
 ### PCB overview
 #### Board markings
 - Top silkscreen: PCB-K0402W-V1.0 / DIP-K0402WS-V1.0
 #### Key components
 - U1: SPI NOR flash, 2 MiB
 - S1: unpopulated slide switch footprint (three through-holes used as serial console)
 Front panel
 <a href="photos/PCB-K0402W-V1.0/ports.jpg"><img src="photos/PCB-K0402W-V1.0/ports.jpg" width="300" /></a>
 PCB top
 <a href="photos/PCB-K0402W-V1.0/pcb-top.jpg"><img src="photos/PCB-K0402W-V1.0/pcb-top.jpg" width="300" /></a>
 PCB bottom
 <a href="photos/PCB-K0402W-V1.0/pcb-bottom.jpg"><img src="photos/PCB-K0402W-V1.0/pcb-bottom.jpg" width="300" /></a>
 Bottom and rear
 <a href="photos/PCB-K0402W-V1.0/bottom.jpg"><img src="photos/PCB-K0402W-V1.0/bottom.jpg" width="300" /></a>
 ### Power supply
 Input power is delivered via a standard DC barrel jack (5.5x2.1mm) with an included 12V 1A adapter.
 There is an optional grounding screw next to the DC input.
 ### Serial console
 The PCB has a slide switch footprint (unpopulated) at the front right that is connected to the UART. It is labeled as "S1" on the silkscreen.
 Facing the top front (port) side of the board, the pinout from left to right is:
 | Position | Signal | GPIO              |
 |----------|--------|-------------------|
 | 1        | RX     | GPIO32\_UART0\_RX |
 | 2        | GND    | N/A               |
 | 3        | TX     | GPIO31\_UART0\_TX |
 Standard 0.1" / 2.54mm pin headers will not fit, so wires or clips may be used instead.
 The image below shows some oversized clips clumsily attached.
 <a href="photos/PCB-K0402W-V1.0/uart.jpg"><img src="photos/PCB-K0402W-V1.0/uart.jpg" width="300" /></a>
@@ -30,15 +30,15 @@ Using SPI clamp in-board is the only method for initial installation.
 Front panel
-<img src="photos/PCB-K0402W-V2.0/chassis-front.jpg" width="400" />
+<img src="photos/PCB-K0402WS-V2.0/chassis-front.jpg" width="400" />
 Bottom label
-<img src="photos/PCB-K0402W-V2.0/chassis-bottom.jpg" width="400" />
+<img src="photos/PCB-K0402WS-V2.0/chassis-bottom.jpg" width="400" />
 Top side (PCB)
-<img src="photos/PCB-K0402W-V2.0/PCB-top.jpg" width="300" />
+<img src="photos/PCB-K0402WS-V2.0/PCB-top.jpg" width="300" />
 ### Port layout
@@ -11,22 +11,17 @@ of the device just above the big label, might be covered by a QC sticker.
 * Hisource Hi-K0402WS
-<img src="photos/PCB-K0402W-V3.0/HiSource_HI-K0402WS.jpg" width="300" />
+<img src="photos/PCB-K0402WS-V3.0/HiSource_HI-K0402WS.jpg" width="300" />
 * Ztyuav Z-QWYT0402
-<img src="photos/PCB-K0402W-V3.0/Ztyuav_Z-QWYT0402.jpg" width="300" />
+<img src="photos/PCB-K0402WS-V3.0/Ztyuav_Z-QWYT0402.jpg" width="300" />
-<img src="photos/PCB-K0402W-V3.0/Ztyuav_Z-QWYT0402_label.jpg" width="300" />
+<img src="photos/PCB-K0402WS-V3.0/Ztyuav_Z-QWYT0402_label.jpg" width="300" />
-* SICSOLINK SL-G0402F
+* Siscolink SL-G0402F
 <img src="photos/PCB-K0402W-V3.0/SICSOLINK SL-G0402F.jpg" width="300"/>
 * YuanLey YS25-0402 <sup><sub>Note: there are [multiple revisions](PCB-K0402W-V1.0.md) of the YS25-0402. This is the newer revision that has a "Vlan" switch on the front.</sub></sup>
 <img src="photos/PCB-K0402W-V3.0/YuanLey_YS25-0402.jpg" width="300"/>
 <img src="photos/PCB-K0402WS-V3.0/Siscolink SL-G0402F.jpg" width="300"/>
 ### Programming
 Using SPI clamp in-board is the only method for initial installation.
@@ -37,7 +32,7 @@ The switch actually controls the HOLD line of each flash chip, and toggling the
 If the programming clip keeps HOLD not connected, the flashing will commence on whatever the switch selected, regardless on which chip was clipped.
-For the initial flash (at least with flashrom), the bin file produced by the build is much smaller than the flash chip, it is suggested to pad the file to keep flashrom happy: `truncate -s 2097152 rtlplayground-*-HISOURCE_HI_K0402WS_PCB_K0402WS_V3_0.bin`. Note: do not then proceed to use this resulting padded file for the web flashing (as it bricks the device), use the original unpadded .bin.
+For the initial flash (at least with flashrom), the bin file produced by the build is much smaller than the flash chip, it is suggested to pad the file to keep flashrom happy: `truncate -s 2097152 rtlplayground-*-PCB_K0402WS_V3.bin`. Note: do not then proceed to use this resulting padded file for the web flashing (as it bricks the device), use the original unpadded .bin.
 ### What works (expected from label + similar devices)
@@ -48,15 +43,15 @@ For the initial flash (at least with flashrom), the bin file produced by the bui
 ### PCB overview
 **Board markings**  
- Top silkscreen: PCB-K0402W-V3.0 / DIP-K0402WS-V3.0  
+- Top silkscreen: PCB-KO4022W-V3.0 / DIP-KO4022WS-V3.0  
 Top side
-<img src="photos/PCB-K0402W-V3.0/PCB-top.jpg" width="300" />
+<img src="photos/PCB-K0402WS-V3.0/PCB-top.jpg" width="300" />
 Bottom
-<img src="photos/PCB-K0402W-V3.0/PCB-bottom.jpg" width="300" />
+<img src="photos/PCB-K0402WS-V3.0/PCB-bottom.jpg" width="300" />
 ### T2, serial console
@@ -82,15 +77,3 @@ Voltage is made by a `Techcode TD1720` .
 Voltage is created by chip marked as `Techcode TD1720`.
 **There seems to have been a miscalculation when choosing the inductor and the device is ~25% more efficient with an 5V power supply.**
 ## Reset Mod
 A reset button can be easily added by soldering a push button from TP131 (near the Spi ROM) to ground via a 1KOhm resistor.
 **PS:** `The reset button GPIO must be defined in the machine.c file before building the image, it must be selected the GPIO30_ACL_BIT3_EN instead of GPIO_NA under the PCB-K0402W-V3.0 configuration.`
 Photo of the mod
 <img src="photos/PCB-K0402W-V3.0/Reset_mod.jpg" width="300" />
@@ -1,47 +0,0 @@
 ### SWTG024AS-A-V2.0.1_4C_2SFP
 It is highly similar to PCB-SWTG024AS-V2.0_16895, with the only difference being the GPIO configuration for the SFP port.
 ## Brands
 |Brand    |Type          |Managed|PCB                           |Flash           |Chip RTL|
 |---------|--------------|-------|------------------------------|----------------|--------|
 | Horaco  | ZX-SG4T2     | No    | PCB-SWTG024AS-A-V2.0.1_19650 | 512K (P25D40SH)| 8372N  |
 | Horaco  | HC-SWTG124AS | Yes   | PCB-SWTG024AS-A-V2.0.1_19650 | 2M   (W25Q16JV)| 8372N  |
 | GoodTop | GT-ST024M    | Yes   | PCB-SWTG024AS-A-V2.0.1_19650 | 2M             | 8372N  |
 ### Label specifications
 - **Name**: 
 - **Ports**:
  - 4 × RJ45: 10/100/1000/2500 Mbps
  - 2 × SFP+: 1000 / 2500 / 10000 Mbps
 <img src="photos/PCB-SWTG024AS-A-V2.0.1_19650/horaco-zx-sg4t2-label.jpg" width="300" />
 ### What works
 The device is fully supported:
 - ALL 2.5GBASE-T RJ45 ports work at 10/100/1000/2500 Mbps
 - The SFP+ port supports 1G, 2.5G and 10G modules 
 ### PCB overview
 **Board markings**
 - Top silkscreen: PCB-SWTG024AS-A-V2.0.1_19650
 Top side
 <img src="photos/PCB-SWTG024AS-A-V2.0.1_19650/horaco-zx-sg4t2-pcb-top.jpg" width="300" />
 Bottom
 <img src="photos/PCB-SWTG024AS-A-V2.0.1_19650/horaco-zx-sg4t2-pcb-bottom.jpg" width="300" />
 On Horaco HC-SWTG124AS with board PCB-SWTG024AS-A-V2.0.1_19650 the reset button is soldered at `SW1` (on the top left, GPIO48).
 ### J1, serial console
 | `J1` pin | Signal      |
 | -------- | ----------- |
 | 1        | 3V3         |
 | 2        | GND         |
 | 3        | RX (Input)  |
 | 4        | TX (Output) |
@@ -1,48 +0,0 @@
 ### SWTG024AS-V2.1
 ## Brands
 |Brand|Type|Managed|PCB|Flash|Chip RTL|
 |---|---|---|---|---|---|
 | Xikestor | SKS3200-4E2X    | Yes | PCB-SWTG024AS-V2.1.0_19023 | 25Q16A | 8372N |
 | Solola   | SL902-SWTG024AS | Yes | PCB-SWTG024AS-V2.1.0_19023 |        | 8372N |
 ### Label specifications
 - **Ports**:
  - 4 × RJ45: 10/100/1000/2500 Mbps
  - 2 × SFP+: 1000/2500/10000 Mbps
 - **Power**: 1A @ 12V DC
 #### Xikestore SKS-3200-4E2X label
 <img src="photos/PCB-SWTG024AS-V2.1.0_19023/label.jpg" width="300" />
 ### What works
 - ALL 2.5GBASE-T RJ45 ports work at 10/100/1000/2500 Mbps
 - The SFP+ ports supports 1G, 2.5G and 10G modules.
 - LEDs work with the same indiciations as the OEM firmware.
 ### PCB overview
 **Board markings**
 - Top silkscreen: PCB-SWTG024AS-V2.1.0_19023
 Top side
 <img src="photos/PCB-SWTG024AS-V2.1.0_19023/pcb-top.jpg" width="300" />
 Bottom
 <img src="photos/PCB-SWTG024AS-V2.1.0_19023/pcb-bottom.jpg" width="300" />
 ### Serial console
 The four-pin through-hole serial header can be seen to the right of the CPU heatsink in the photo above. It is labelled J1, with pin 1 (Indicated by a triangle on the silkscren) at the bottom. the pinout is also on the silkscreen:
 | Pin | Label  |
 |-----|--------|
 | 1   | TX     |
 | 2   | RX     |
 | 3   | GND    |
 | 4   | 3V3    |
 Adding a header is a few moments work with a soldering iron. Only pins 1-3 are required for serial port use, and the stock firmware outputs at 57600bps at boot.
@@ -1 +0,0 @@
 PCB-SWTG115AS-V2.0-16030.md
@@ -1,31 +0,0 @@
 ### ZX-MOKERLINK_ZX_SWTGW218AS
 ## Brands
 |Brand|Type|Managed|PCB|Flash|Chip RTL|
 |---|---|---|---|---|---|
 | Mokerlink | ZX-MOKERLINK_ZX_SWTGW218AS | Yes|  PCB-SWTG118AS-V2.0-16029 | 2MB (FM25Q16A)| 8273N + 8224N |
 | Sodola | | | | | |
 | Horaco | HC-MOKERLINK_ZX_SWTGW218AS | Yes | SWTG118AS-V2.1 | 2MB | 8373 (non-N) |
 | XikeStor | SKS3200-8E1X | Yes | SWTG118AS-V2.1-17462 | 2MB (25Q16JVSIQ) | |
 All boards in this table use `MACHINE=MOKERLINK_ZX_SWTGW218AS`. The Horaco HC-MOKERLINK_ZX_SWTGW218AS is also sold with the
 [PCB-SWTG018AS-A V2.0.1_19649](PCB-SWTG018AS-A-V2.0.1_19649.md) board, which needs a different firmware. Check the marking
 on the PCB before flashing.
 The PHY and flash-chip models for the tested Horaco units remain unverified.
 ## Photos
 <img src="photos/PCB-SWTG118AS-V2.0-16029/front.png" width="800" />
 <img src="photos/PCB-SWTG118AS-V2.0-16029/label.jpg" width="800" />
 ## PCB
 See up'n'atom's Repo:
 https://github.com/up-n-atom/SWTG118AS/blob/main/photos/SWTG118AS-v2.0/SWTG118AS-v2.0-pcb-top.JPG
 https://github.com/up-n-atom/SWTG118AS/blob/main/photos/SWTG118AS-v2.0/SWTG118AS-v2.0-pcb-bottom.JPG
@@ -1,41 +0,0 @@
 # Hasivo S1100P-8GT-1SX-73N-S-V1.01
 RTL8373N switch with 8 × 2.5G RJ45 ports and 1 × SFP port. GD25Q16 2 MiB flash.
 ## Port mapping
 | Front port | ASIC MAC | Interface |
 | --- | --- | --- |
 | 1–8 | 0–7 | RJ45 |
 | 9 | 8 | SFP (SDS1) |
 ## Board signals
 | Function | GPIO |
 | --- | --- |
 | SFP detect | 38 |
 | SFP LOS | 37 |
 | SFP TX disable | Not connected (`GPIO_NA`) |
 | SFP I2C SDA / SCL | 39 / 40 |
 | Reset | 54 |
 PoE is managed by an RTL8238B and a separate STC8H8K64U controller, not directly by the RTL8373N. RTLPlayground does not control PoE on this board.
 ## Build
 `make MACHINE=HASIVO_S1100P_8GT_1SX_S CI=1`
 ## Photos
 Front panel:
 ![Front panel](photos/S1100P-8GT-1SX-73N-S-V1.01/front.jpg)
 PCB top:
 ![PCB top](photos/S1100P-8GT-1SX-73N-S-V1.01/pcb_top.jpg)
 PCB bottom:
 ![PCB bottom](photos/S1100P-8GT-1SX-73N-S-V1.01/pcb_bottom.jpg)
@@ -1,148 +0,0 @@
 # Sirivision SR-S25G2109F (S25G1109FP V1.3)
 RTL8373 (non-N) with an RTL8224 quad 2.5G PHY: 8 × 2.5G RJ45 + 1 × SFP+,
 2 MB flash, no PoE.
 ## Label specifications
 | Item | Value |
 |------|-------|
 | Manufacturer | Sirivision |
 | Model | SR-S25G2109F |
 | Ports | 8 × RJ45 10/100/1000/2500 Mbps, 1 × SFP+ 1G/2.5G/10G |
 | Power input | 12 V DC, 1.5 A |
 | Stock firmware | version 1.0.8.0 |
 | Stock defaults | IP 192.168.1.199, user `admin`, password `admin` |
 | Serial number | 001008130002003A000005 (also on the PCB barcode sticker) |
 The label does not carry a MAC address.  After a factory initialisation the
 stock firmware uses exactly the values printed on the label.
 ## PCB silkscreen and naming
 Top side: `S25G1109FP V1.3 SIRIVISION`.  That model name belongs to an unmanaged
 PoE switch; this board omits the PoE section entirely.  What is actually shipped
 is the label model `SR-S25G2109F`: a simply managed, non-PoE switch.  Its stock
 firmware provides a web interface, but it responds very slowly.
 ## CPU, PHY and flash
 | Part | Identification |
 |------|----------------|
 | SoC | RTL8373, non-N: `regget 4` returns `0x83730000` and the boot console prints `Detecting CPU: RTL8373` |
 | PHY | RTL8224, reported as `RTL8224 ID: 0x82240000` |
 | Flash | GigaDevice 25Q16ESIG (U7), 2 MB, JEDEC id `c8 40 15` |
 The two large ICs sit under soldered heatsinks, their markings are not readable.
 ## Build
 ```
 make MACHINE=SIRIVISION_SR_S25G2109F CI=1
 ```
 The resulting image can be uploaded through the web interface (`System` page)
 or the stock web UI.
 ## Port mapping
 | Front port | ASIC MAC | Interface |
 |------------|----------|-----------|
 | 1–8 | 0–7 | RJ45 2.5G |
 | 9 | 8 | SFP+ (SDS1) |
 ## Board signals
 | Function | GPIO |
 |----------|------|
 | SFP detect (ModAbs) | 30, low with a module inserted |
 | SFP LOS | 37, high without light |
 | SFP TX disable | not connected, `GPIO_NA` |
 | SFP I2C | SDA 39 / SCL 40, `I2CBUS(GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1)` |
 | Reset button | 54 |
 ModAbs and LOS are separate signals here: GPIO30 tells whether a module is
 inserted, GPIO37 whether it receives light, so a module is identified even
 before the link comes up and loss of signal is reported.  GPIO38 and GPIO48,
 which the 8+1 reference boards use for ModAbs and for the reset button, never
 change on this board; with GPIO38 as ModAbs the firmware believed a module was
 permanently present and retried the I2C read forever.
 Serial console: the stock firmware runs the loader at 57600 baud and the runtime
 at 9600 baud, RTLPlayground uses 115200.
 ## Front panel
 Each copper port has two LEDs, labelled `Link/Act` (left, yellow) and `2.5G`
 (right, green).  The SFP cage has a single green `Link/Act` LED; next to it are
 a `Power` LED and the `Reset` button.
 ## LED configuration
 Copper ports use LED set 0, the SFP port uses LED set 1:
 | Set | Function 0 (left / SFP) | Function 1 (right) |
 |-----|-------------------------|--------------------|
 | SET0 | all speeds, link with activity | 2.5G link |
 | SET1 | all speeds, link with activity | not populated |
 The board is wired in the stock port order — LED pin `3n+m` belongs to port
 `n+1`, LED function `m` — so the mux table is the chip default with a single
 change: the SFP LED sits on pin 25 and is driven by LED function 0, while the
 default table maps pin 25 to function 1, which is unpopulated in SET1.  Without
 that change the SFP LED stays dark.
 A speed condition alone leaves an LED dark, `LEDS_LINK` has to be set as well.
 ## Reset button
 | Hold time while running | Effect |
 |-------------------------|--------|
 | less than 3 s | no action |
 | 3–10 s | reset the switch chip, the firmware reboots (~20 s of downtime) |
 | more than 10 s | additionally restore the default configuration |
 The system LED blinks slowly while the button is held.  Holding the button
 during power-up instead waits for the release and restores the default
 configuration when it is released after 10–30 s.
 ## MAC address
 The factory MAC sits at `0x1FC000`, six bytes followed by `0xFF` padding.  The
 stock value is a locally administered address (`1A:5D:23:47:4D:EB`), which the
 firmware rejects, so the device runs with a UUID-derived MAC (`06:…`).  A valid
 globally administered address stored there is used instead.
 ## What works
 - all eight 2.5GBASE-T ports at 10/100/1000/2500 Mbps
 - SFP+ with 10G and 1G modules, including DDM data where the module provides it
  - 10G: Finisar FCBG110SD1C05 AOC (no DDM), rate `0x67`, SerDes mode `1a`
  - 1G: ETU ESB5312-3SCD20 (DDM), rate `0x0d`, SerDes mode `04`
 - LEDs, module insert/remove detection, loss of signal reporting, reset button
 ## Unverified
 - 2.5G SFP modules, none was available for testing
 ## Photos
 Front panel:
 ![Front panel](photos/S25G1109FP-V1.3/front.jpg)
 Label:
 ![Label](photos/S25G1109FP-V1.3/label.jpg)
 PCB top side:
 ![PCB top side](photos/S25G1109FP-V1.3/pcb_top.jpg)
 PCB bottom side:
 ![PCB bottom side](photos/S25G1109FP-V1.3/pcb_bottom.jpg)
 Flash chip, GigaDevice 25Q16ESIG:
 ![Flash chip](photos/S25G1109FP-V1.3/flash.jpg)
@@ -1,32 +0,0 @@
 ### SIRIVISION_S25G2206FP_V1_1
 ## Brands
 |Brand|Type|Managed|PCB|Flash|Chip RTL|
 |---|---|---|---|---|---|
 | YuanLey | YS25-0402M | Yes | SIRIVISION_S25G2206FP_V1_1 | 2M | 8372 |
 ### Label specifications
 - **Name**:
 - **Ports**:
  - 4 × RJ45: 10/100/1000/2500 Mbps
  - 2 × SFP+: 1000 / 2500 / 10000 Mbps
 - **Power**: 12V DC, 1A  5525 connector
 ### What works
 The device is fully supported:
 - ALL 2.5GBASE-T RJ45 ports work at 10/100/1000/2500 Mbps
 - ALL SFP+ ports support 1G, 2.5G and 10G modules
 - LEDs work with the same indiciations as the OEM firmware
 ### PCB overview
 **Board markings**
 - Top silkscreen: SIRIVISION S25G2206FP V1.1
 Top side
 <img src="photos/S25G2206FP-V1.1/dev_pcb_top.jpg" width="300" />
 ## Power supply
 Input power is delivered via barell plug, `12V 1A` adapter was provided.
@@ -26,7 +26,7 @@ Using SPI clamp in-board is the only method for initial installation.
 Top side
-<img src="photos/PB-2131/PCB-top.jpg" width="600" />
+<img src="photos/STEAMEMO_IG204_V1/PCB-top.jpg" width="600" />
 ### Connectors
 ### T7, serial console
@@ -1,21 +1,20 @@
-# PCB-SWTG018AS-A V2.0.1_19649
+# SWTG018AS-A V2.0
 ## Brands
 | Brand   | Type             |Managed| PCB              | Flash           | Chip RTL      |
 |---------|------------------|-------|------------------|-----------------|---------------|
-| Ampcom  | PCB-SWTG018AS-A V2.0.1_19649 | No    | PCB-SWTG018AS-A V2.0.1_19649 | 2MB             | 8273N + 8224N |
+| Ampcom  | SWTG018AS-A V2.0 | No    | SWTG018AS-A V2.0 | 2MB             | 8273N + 8224N |
-| Horaco  | HC-MOKERLINK_ZX_SWTGW218AS-A  | Yes   | PCB-SWTG018AS-A V2.0.1_19649 | 2MB(25Q16JVSIQ) | 8273N + 8224N |
+| Horaco  | HC-SWTGW218AS-A  | Yes   | SWTG018AS-A V2.0 | 2MB(25Q16JVSIQ) | 8273N + 8224N |
-| GoodTop | GT-ST018M        | Yes   | PCB-SWTG018AS-A V2.0.1_19649 | 2MB             | 8273N + 8224N |
+| GoodTop | GT-ST018M        | Yes   | SWTG018AS-A V2.0 | ?               | 8273N + 8224N |
 | MokerLink | MOKERLINK_2G08110GSN     | No    | PCB-SWTG018AS-A V2.0.1_19649 | 512KB(25Q40)    | 8273N + 8224N |
-The following is a documentation for the unmanaged switch marked as `PCB-SWTG018AS-A V2.0.1_19649`.
+The following is a documentation for the unmanaged switch marked as `SWTG018AS-A V2.0`.
 It is e.g. sold under the Ampcom brand, but no branh-markings are found on the device.
 The original software is running UART on 9600 baud rate. 
 Using a SOIC clamp in-board is the only method for initial installation.
-The board has a single flash chips `BS` with 2M-byte size. The front switch, switches between the two flash chips.
+The board has a single flash chips `BS` with 4M-bit size. The front switch, switches between the two flash chips.
 These can be programed independently by using said switch - so it is e.g. possible to run the original and new firmware in parallel.
 ### Label specifications
@@ -26,7 +25,7 @@ These can be programed independently by using said switch - so it is e.g. possib
  - 1 × SFP+: 1000 / 2500 / 10000 Mbps
 - **Power**: 12V DC, 1A barrel connector 
-<img src="photos/PCB-SWTG018AS-A-V2.0.1_19649/label.jpg" width="300" />
+<img src="photos/SWTG018AS_A_V_2_0/label.jpg" width="300" />
 ### What works
 The device is fully supported:
@@ -41,11 +40,11 @@ The device is fully supported:
 Top side
-<img src="photos/PCB-SWTG018AS-A-V2.0.1_19649/pcb_top.jpg" width="300" />
+<img src="photos/SWTG018AS_A_V_2_0/pcb_top.jpg" width="300" />
 Bottom
-<img src="photos/PCB-SWTG018AS-A-V2.0.1_19649/pcb_bottom.jpg" width="300" />
+<img src="photos/SWTG018AS_A_V_2_0/pcb_bottom.jpg" width="300" />
 ### J1, serial console
@@ -0,0 +1,43 @@
 ### SWTG024AS-A-V2.0.1_4C_2SFP
 It is highly similar to SWTG024AS-V2.0, with the only difference being the GPIO configuration for the SFP port.
 ## Brands
 |Brand|Type|Managed|PCB|Flash|Chip RTL|
 |---|---|---|---|---|---|
 | Horaco | ZX-SG4T2 |  | PCB-SWTG024AS-A-V2.0.1_19650 | P25D40SH | ??? |
 ### Label specifications
 - **Name**: 
 - **Ports**:
  - 4 × RJ45: 10/100/1000/2500 Mbps
  - 2 × SFP+: 1000 / 2500 / 10000 Mbps
 <img src="photos/SWTG024AS-A-V2_0_1_19650/horaco-zx-sg4t2-label.jpg" width="300" />
 ### What works
 The device is fully supported:
 - ALL 2.5GBASE-T RJ45 ports work at 10/100/1000/2500 Mbps
 - The SFP+ port supports 1G, 2.5G and 10G modules 
 ### PCB overview
 **Board markings**
 - Top silkscreen: PCB-SWTG024AS-A-V2.0.1_19650
 Top side
 <img src="photos/SWTG024AS-A-V2_0_1_19650/horaco-zx-sg4t2-pcb-top.jpg" width="300" />
 Bottom
 <img src="photos/SWTG024AS-A-V2_0_1_19650/horaco-zx-sg4t2-pcb-bottom.jpg" width="300" />
 ### J1, serial console
 | `J1` pin | Signal      |
 | -------- | ----------- |
 | 1        | 3V3         |
 | 2        | GND         |
 | 3        | RX (Input)  |
 | 4        | TX (Output) |
@@ -1,5 +1,5 @@
 ### SWTG024AS-A-V2.0.1_5C_1SFP
-It is highly similar to PCB-SWTG024AS-V2.0_16895, with the only difference being the GPIO configuration for the SFP port.
+It is highly similar to SWTG024AS-V2.0, with the only difference being the GPIO configuration for the SFP port.
 ## Brands
 |Brand|Type|Managed|PCB|Flash|Chip RTL|
@@ -1,4 +1,4 @@
-### PCB-SWTG024AS-V2.0_16895
+### SWTG024AS-V2.0
 ## Brands
 |Brand|Type|Managed|PCB|Flash|Chip RTL|
@@ -13,7 +13,7 @@
  - 1 × SFP+: 1000 / 2500 / 10000 Mbps
 - **Power**: 12V DC, 1A  5525 connector 
-<img src="photos/PCB-SWTG024AS-V2.0_16895/label.jpg" width="300" />
+<img src="photos/SWTG024AS-V2.0/label.jpg" width="300" />
 ### What works
 The device is fully supported:
@@ -24,15 +24,15 @@ The device is fully supported:
 ### PCB overview
 **Board markings**
- Top silkscreen: PCB-SWTG024AS-V2.0_16895
+- Top silkscreen: PCB-SWTG024AS-V2.0
 Top side
-<img src="photos/PCB-SWTG024AS-V2.0_16895/pcb_top.jpg" width="300" />
+<img src="photos/SWTG024AS-V2.0/pcb_top.jpg" width="300" />
 Bottom
-<img src="photos/PCB-SWTG024AS-V2.0_16895/pcb_bottom.jpg" width="300" />
+<img src="photos/SWTG024AS-V2.0/pcb_bottom.jpg" width="300" />
 ### J1, serial console
@@ -8,14 +8,14 @@ Also the RJ45 connectors can be all plastic/non-shielded or with metal shielding
 ## Brands
 |Brand|Type|Managed|PCB|PCB Label|Flash|Chip RTL|
 |---|---|---|---|---|---|---|
-| LIANGUO |SWTG024AS |No| PCB-SWTG024AS-V2.0-17452 | CM-23-11-2336 023-17453| 512 KiB | 8272 |
+| LIANGUO |SWTG024AS |No|  SWTG024AS-v2.0-17452 | CM-23-11-2336 023-17453| 512 KiB | 8272 |
-| Horaco |ZX-SWTG124AS | Yes | PCB-SWTG024AS-V2.0-17452 | ??? | ??? | 8272 |
+| Horaco |ZX-SWTG124AS | Yes |  SWTG024AS-v2.0 | ??? | ??? | 8272 |
-| Xikestore |SKS3200M-4GPY2XF | Yes | PCB-SWTG024AS-V2.0-17452 | CM-23-08-2043 023-16721 | 2048 KiB | 8272 |
+| Xikestore |SKS3200M-4GPY2XF | Yes |  SWTG024AS-v1.0 | CM-23-08-2043 023-16721 | 2048 KiB | 8272 |
-| Sodola | SL-SWTG124AS-D | Yes | PCB-SWTG024AS-V2.0-17452 | ??? | 2048 KiB | 8272 |
+| Sodola | SL-SWTG124AS-D | Yes | SWTG024AS-v2.0-17452 | ??? | 2048 KiB | 8272 |
 ## PCB
-<img src="photos/PCB-SWTG024AS-V2.0-17452/SWTG024AS-v2.0-top-uman.png" width="300" />
+<img src="photos/SWTG024AS-v2.0-unmanaged/SWTG024AS-v2.0-top-uman.png" width="300" />
 # SWTG024AS-v2.0 managed vs unmanged
 Changes I found with my board vs [Managed version](https://github.com/up-n-atom/SWTG118AS/tree/main/photos/SWGT024AS-v2.0) of the PCB.
@@ -6,28 +6,27 @@
 |---|---|---|---|---|---|
 | Lianguo | ZX-SWTGW215AS | Yes | PCB-SWTG115AS-V2.0 | FM25Q16A | 8372 |
 | sold as Lianguo, actual device unbranded | ZX-SWTGW215AS | Yes | PCB-SWTG115AS-V2.1 | W25Q16JVSIQ (2MiB) | 8372 |
 | Sodola | SL-SWTGW215AS-D | Yes | SWTG115AS-V2.1-17433 | W25Q16JVSIQ (2MiB) | 8372 |
 ## RTLPlayground target
-Build for this device with `make MACHINE=LIANGUO_ZX_SWTGW215AS`, which selects the `machine/LIANGUO_ZX_SWTGW215AS.c` board definition.
+Use machine target `MACHINE_LIANGUO_ZX_SWTGW215AS` for this device.
 Physical hardware verification: 5x RJ45 ports + 1x SFP port. 
 Port 5 RJ45 is interfaced through a RTL8221B IC.
 ## Label (V2.0)
-<img src="photos/PCB-SWTG115AS-V2.0-16030/label.jpg" width="300" />
+<img src="photos/ZX-SWTGW215AS-V2.0/label.jpg" width="300" />
 ## PCB (V2.0)
-<img src="photos/PCB-SWTG115AS-V2.0-16030/pcb_top.jpg" width="300" />
+<img src="photos/ZX-SWTGW215AS-V2.0/pcb_top.jpg" width="300" />
-<img src="photos/PCB-SWTG115AS-V2.0-16030/pcb_bottom.jpg" width="300" />
+<img src="photos/ZX-SWTGW215AS-V2.0/pcb_bottom.jpg" width="300" />
 ## PCB (V2.1)
-<img src="photos/PCB-SWTG115AS-V2.1-17443/pcb-top.jpg" width="300" />
+<img src="photos/ZX-SWTGW215AS-V2.1/pcb-top.jpg" width="300" />
-<img src="photos/PCB-SWTG115AS-V2.1-17443/pcb-bottom.jpg" width="300" />
+<img src="photos/ZX-SWTGW215AS-V2.1/pcb-bottom.jpg" width="300" />
 ## Connectors
@@ -69,7 +68,7 @@ Port 5 RJ45 is interfaced through a RTL8221B IC.
 This connector goes to U4 `I2C EEPROM` and U10 `SPI FLASH` (mappings identical to SWTG024AS).
-For detailed Slave Interface functionality and protocol information, see [T3 documentation in SWTG024AS.md](PCB-SWTG024AS-V2.0-17452.md#t3-slave-interface).
+For detailed Slave Interface functionality and protocol information, see [T3 documentation in SWTG024AS.md](SWTG024AS.md#t3-slave-interface).
 |`T3` pin|what|Signal|
 |---|---|---|
@@ -109,7 +108,7 @@ For detailed Slave Interface functionality and protocol information, see [T3 doc
 #### Notes
 * 1 pin is square shaped.
-* Mapping unverified but assumed the same as [LIANGUO SWTG024AS](PCB-SWTG024AS-V2.0-17452.md#t8).
+* Mapping unverified but assumed the same as [LIANGUO SWTG024AS](SWTG024AS.md#t8).
 ## Reset Circuit
 | Function | GPIO |
@@ -121,7 +120,7 @@ For detailed Slave Interface functionality and protocol information, see [T3 doc
 ## GPIO
-Note: T3/U4/U10-related signal annotations below are copied from [LIANGUO SWTG024AS T3 section](PCB-SWTG024AS-V2.0-17452.md#t3-slave-interface) as well as T8 port from [LIANGUO SWTG024AS T8 section](PCB-SWTG024AS-V2.0-17452.md#t8). They should be treated as assumed identical for ZX-SWTGW215AS as it has not been 100% confirmed true at the moment. 
+Note: T3/U4/U10-related signal annotations below are copied from [LIANGUO SWTG024AS T3 section](SWTG024AS.md#t3-slave-interface) as well as T8 port from [LIANGUO SWTG024AS T8 section](SWTG024AS.md#t8). They should be treated as assumed identical for ZX-SWTGW215AS as it has not been 100% confirmed true at the moment. 
 | HEX VAL. | GPIO   | Component / Purpose | Notes |  | GPIO | Component / Purpose | Notes |
 | -------- | ------ |  ---- | ---- | ---- | ---- | ---- | ---- |
@@ -135,14 +134,14 @@ Note: T3/U4/U10-related signal annotations below are copied from [LIANGUO SWTG02
 | 00000080 | GPIO07 | | |  | GPIO39 | J4-4 | SFP I2C SDA |
 | 00000100 | GPIO08 | | |  | GPIO40 | J4-5 | SFP I2C SCL |
 | 00000200 | GPIO09 | | |  | GPIO41 |   |  |
-| 00000400 | GPIO10 | | |  | GPIO42 | U10-P6, U4-P6, T3-1 | SPI FLASH CLK / I2C-SCL (from [LIANGUO SWTG024AS](PCB-SWTG024AS-V2.0-17452.md#gpio)) |
+| 00000400 | GPIO10 | | |  | GPIO42 | U10-P6, U4-P6, T3-1 | SPI FLASH CLK / I2C-SCL (from [LIANGUO SWTG024AS](SWTG024AS.md#gpio)) |
-| 00000800 | GPIO11 | | |  | GPIO43 | U10-P5, U4-P5, T3-3 | SPI FLASH DI/IO0 / I2C-SDA (from [LIANGUO SWTG024AS](PCB-SWTG024AS-V2.0-17452.md#gpio)) |
+| 00000800 | GPIO11 | | |  | GPIO43 | U10-P5, U4-P5, T3-3 | SPI FLASH DI/IO0 / I2C-SDA (from [LIANGUO SWTG024AS](SWTG024AS.md#gpio)) |
-| 00001000 | GPIO12 | | |  | GPIO44 | U10-P2, T3-5 | SPI FLASH DO/IO1 (from [LIANGUO SWTG024AS](PCB-SWTG024AS-V2.0-17452.md#gpio)) |
+| 00001000 | GPIO12 | | |  | GPIO44 | U10-P2, T3-5 | SPI FLASH DO/IO1 (from [LIANGUO SWTG024AS](SWTG024AS.md#gpio)) |
-| 00002000 | GPIO13 | PORT1 LED GREEN |  |  | GPIO45 | U10-P1, T3-6 | SPI FLASH CS (from [LIANGUO SWTG024AS](PCB-SWTG024AS-V2.0-17452.md#gpio)) |
+| 00002000 | GPIO13 | PORT1 LED GREEN |  |  | GPIO45 | U10-P1, T3-6 | SPI FLASH CS (from [LIANGUO SWTG024AS](SWTG024AS.md#gpio)) |
-| 00004000 | GPIO14 | PORT1 LED ORANGE |  |  | GPIO46 | T8-1 | (from [LIANGUO SWTG024AS](PCB-SWTG024AS-V2.0-17452.md#gpio)) |
+| 00004000 | GPIO14 | PORT1 LED ORANGE |  |  | GPIO46 | T8-1 | (from [LIANGUO SWTG024AS](SWTG024AS.md#gpio)) |
-| 00008000 | GPIO15 | | |  | GPIO47 | T8-5 | (from [LIANGUO SWTG024AS](PCB-SWTG024AS-V2.0-17452.md#gpio)) |
+| 00008000 | GPIO15 | | |  | GPIO47 | T8-5 | (from [LIANGUO SWTG024AS](SWTG024AS.md#gpio)) |
-| 00010000 | GPIO16 | PORT2 LED GREEN |  |  | GPIO48 | T8-3 | (from [LIANGUO SWTG024AS](PCB-SWTG024AS-V2.0-17452.md#gpio)) |
+| 00010000 | GPIO16 | PORT2 LED GREEN |  |  | GPIO48 | T8-3 | (from [LIANGUO SWTG024AS](SWTG024AS.md#gpio)) |
-| 00020000 | GPIO17 | PORT2 LED ORANGE |  |  | GPIO49 | T8-6 | (from [LIANGUO SWTG024AS](PCB-SWTG024AS-V2.0-17452.md#gpio)) |
+| 00020000 | GPIO17 | PORT2 LED ORANGE |  |  | GPIO49 | T8-6 | (from [LIANGUO SWTG024AS](SWTG024AS.md#gpio)) |
 | 00040000 | GPIO18 | PORT3 LED GREEN |  |  | GPIO50 |   |  |
 | 00080000 | GPIO19 | PORT3 LED ORANGE |  |  | GPIO51 |   |  |
 | 00100000 | GPIO20 | PORT4 LED GREEN |  |  | GPIO52 |   |  |
@@ -177,7 +176,7 @@ Note: T3/U4/U10-related signal annotations below are copied from [LIANGUO SWTG02
 ## Notes
-While [SWTG024AS.md](PCB-SWTG024AS-V2.0-17452.md) can be used as a general reference for hardware concepts and interface specifications, this device should not be assumed to be identical beside the difference implicitely highlighted below. Not all information has been validated for compatibility with the SWTG215AS. Consult the SWTG024AS documentation with caution and verify any critical details against this device's.
+While [SWTG024AS.md](SWTG024AS.md) can be used as a general reference for hardware concepts and interface specifications, this device should not be assumed to be identical beside the difference implicitely highlighted below. Not all information has been validated for compatibility with the SWTG215AS. Consult the SWTG024AS documentation with caution and verify any critical details against this device's.
 ## Flashing
@@ -0,0 +1,25 @@
 ### ZX-SWTGW218AS
 ## Brands
 |Brand|Type|Managed|PCB|Flash|Chip RTL|
 |---|---|---|---|---|---|
 | Mokerlink | ZX-SWTGW218AS | Yes|  SWTG118AS-V2.0-16029 | 2MB (FM25Q16A)| 8273N + 8224N |
 | Sodola | | | | | |
 | Horaco | | | | | |
 | XikeStor | SKS3200-8E1X | Yes | SWTG118AS-V2.1-17462 | 2MB (25Q16JVSIQ) | |
 ## Photos
 <img src="photos/SWTGW218AS-managed/front.png" width="800" />
 <img src="photos/SWTGW218AS-managed/label.jpg" width="800" />
 ## PCB
 See up'n'atom's Repo:
 https://github.com/up-n-atom/SWTG118AS/blob/main/photos/SWTG118AS-v2.0/SWTG118AS-v2.0-pcb-top.JPG
 https://github.com/up-n-atom/SWTG118AS/blob/main/photos/SWTG118AS-v2.0/SWTG118AS-v2.0-pcb-bottom.JPG
@@ -26,11 +26,11 @@ Manufacturer information be found [on the product page](https://www.trendnet.com
 Top side
-<img src="photos/270-NB1-MS206B004A1-REV.A1/TEG-S562-v1.0R-top.jpg" width="300" />
+<img src="photos/TEG-S562/TEG-S562-v1.0R-top.jpg" width="300" />
 Bottom
-<img src="photos/270-NB1-MS206B004A1-REV.A1/TEG-S562-v1.0R-bottom.jpg" width="300" />
+<img src="photos/TEG-S562/TEG-S562-v1.0R-bottom.jpg" width="300" />
 ## Connectors
@@ -22,7 +22,7 @@ PHY RTL8261BE
  - 1 × SFP+: 1000 / 2500 / 10000 Mbps
 - **Power**: 12V DC, 2A barrel connector 
-<img src="photos/PCB-SL310S-4T1T1X-V1.0.1-24107/label.jpg" width="300" />
+<img src="photos/ZX310S-4T2XH/label.jpg" width="300" />
 ### What works
 The device is fully supported:
@@ -38,11 +38,11 @@ The device is fully supported:
 Top side
-<img src="photos/PCB-SL310S-4T1T1X-V1.0.1-24107/pcb_top.jpg" width="300" />
+<img src="photos/ZX310S-4T2XH/pcb_top.jpg" width="300" />
 Bottom
-<img src="photos/PCB-SL310S-4T1T1X-V1.0.1-24107/pcb_bottom.jpg" width="300" />
+<img src="photos/ZX310S-4T2XH/pcb_bottom.jpg" width="300" />
 ### J1, serial console
@@ -17,7 +17,7 @@ PHY 2x RTL8261BE
  - 2 x RJ45: 10/100/1000/2500/5000/10000 Mbps
 - **Power**: 12V DC, 2A barrel connector
-<img src="photos/PCB-310S-4T2XT-V1.0.0_22273/label.jpg" width="300" />
+<img src="photos/ZX310S-4T2XT/label.jpg" width="300" />
 ### What works
 The device is fully supported:
@@ -28,15 +28,15 @@ The device is fully supported:
 ### PCB overview
 **Board markings**
- Top silkscreen: PCB-310S-4T2XT-V1.0.0_22273
+- Top silkscreen: PCB-SL310S-4T2XT-V1.0.0-22273
 Top side
-<img src="photos/PCB-310S-4T2XT-V1.0.0_22273/pcb_top.jpg" width="300" />
+<img src="photos/ZX310S-4T2XT/pcb_top.jpg" width="300" />
 Bottom
-<img src="photos/PCB-310S-4T2XT-V1.0.0_22273/pcb_bottom.jpg" width="300" />
+<img src="photos/ZX310S-4T2XT/pcb_bottom.jpg" width="300" />
 ### J1, serial console