Add assmebler injection script

This adds a howto for figuring out LED configuration via tracing
of functions in the originam firmware image. The method also provides
information on PHY and SDS configuration, including PHY patches.

.dockerignore

@@ -0,0 +1,19 @@
+.git/
+.gitignore
+.gitattributes
+.github/
+output/
+installer/output/
+*.bin
+html_data.c
+html_data.h
+*.o
+*.rel
+*.lst
+*.sym
+*.asm
+*.ihx
+*.img
+*.map
+*.mem
+*.lk

.github/workflows/build.yml

@@ -3,6 +3,7 @@ name: Build firmware
 on:
   push:
     branches: ['**']
+  pull_request:
 
 jobs:
   build:
@@ -16,8 +17,14 @@ jobs:
       - name: Install dependencies
         run: |
           apt update
-          apt install make gcc sdcc xxd python-is-python3 libjson-c-dev -y
+          apt install make gcc sdcc xxd python-is-python3 libjson-c-dev zlib1g-dev -y
+      - name: Run the host-side unit tests
+        run: make -C test
       - name: Check if machine.c can be compiled for all machines
         run: make machine_check
-      - name: Make project
-        run: make MACHINE="KP_9000_6XHML_X2"
+      - name: Make project (4x2/RTL8372)
+        run: make CI=1 MACHINE="KP_9000_6XHML_X2"
+      - name: Make project (8x1/RTL8373)
+        run: make CI=1 MACHINE="KP_9000_9XHML_X_V3_1"
+      - name: Make project with the health instrumentation
+        run: make clean && make CI=1 MACHINE="KP_9000_6XHML_X2" HEALTH=1

.gitignore

@@ -7,3 +7,7 @@ version.h
 tools/httpd_sim
 tools/injector
 tools/fileadder
+
+# host-test stand-ins for the two generated headers
+!test/stub/html_data.h
+!test/stub/version.h

CHANGELOG.md

@@ -0,0 +1,37 @@
+# Change Log
+
+## [0.x] - 2026-xx-XX
+
+## Added
+
+- Web UI
+  - Compress the embedded assets (minify + gzip) and switch to a single-page layout. #315
+  - Replace the multi-page UI with a themed single-page app: light, dark and Selenized themes following the browser by default,
+    English, Japanese and Chinese, save to flash merges the command log into the startup config and verifies the write,
+    firmware images are checked in the browser before upload. #429
+
+## Changed
+
+## Fixed
+
+- Config
+  - A startup configuration line longer than the command buffer no longer stops the replay:
+    the offending line is skipped and the following lines are still applied.
+  - The web UI and the configuration upload now refuse a line the replay cannot take,
+    instead of writing it to flash.
+
+## Breaking changes
+
+- Config
+  - VLAN don't accept port `u`-suffix anymore.
+    So `vlan 1 4u` is not valid anymore.
+    Replace it with `vlan 1 4`.
+- Commands
+  - port zero/`0` is treated as the `CPU_PORT`. #326
+  - Many commands don't accept the CPU_PORT anymore. See #334.
+    When the CPU_PORT is needed, the command/service will add the CPU_PORT automaticly.
+    Only `isolate` accept the CPU_PORT as destination port.
+
+## [v0.1_aplha] - 2025-11-03
+
+First release.

Dockerfile

@@ -0,0 +1,19 @@
+FROM debian:13-slim
+
+RUN apt-get update && apt-get install -y \
+    make \
+    gcc \
+    sdcc \
+    xxd \
+    python3 \
+    libjson-c-dev \
+    git \
+    zlib1g-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# git safe.directory for mounted repos (Makefile uses git describe)
+RUN git config --global --add safe.directory /workspace
+
+WORKDIR /workspace
+
+CMD ["bash"]

Makefile

@@ -4,9 +4,11 @@ DEFAULT_CONFIG_LOCATION = 454656
 CONFIG_LOCATION = 458752
 HTML_LOCATION = 262144
 
+ifeq ($(origin CC),default)
 CC = sdcc
+endif
 CC_FLAGS = -mmcs51 -I. -Ihttpd -Iuip
-ASM = sdas8051
+ASM ?= sdas8051
 AFLAGS= -plosgff
 
 SUBDIRS := tools
@@ -17,6 +19,14 @@ ifeq ($(MACHINE),)
 else
 	CC_FLAGS += -DMACHINE_$(MACHINE)
 endif
+# Health instrumentation and the "health" console command: HEALTH=1 gmake ...
+ifneq ($(HEALTH),)
+	CC_FLAGS += -DHEALTH
+endif
+
+ifeq ($(CI),1)
+	CC_FLAGS += --Werror
+endif
 
 BUILDDIR = output/$(MACHINE)
 VERSION_HEADER := version.h
@@ -30,76 +40,149 @@ endif
 VERSION_EXTENSION = v$(VERSION)-$(GIT_VERSION)
 FILENAME_EXTENSION = $(VERSION_EXTENSION)-$(MACHINE)
 
+# Deterministic build date: honor SOURCE_DATE_EPOCH, else the HEAD commit date,
+# else wall-clock (no-git fallback). Keeps same-commit builds byte-identical
+# (BUILD_DATE is baked into the image and covered by the trailing CRC).
+SOURCE_DATE_EPOCH ?= $(shell git show -s --format=%ct HEAD 2>/dev/null)
+ifeq ($(SOURCE_DATE_EPOCH),)
+BUILD_DATE := $(shell date +"%Y-%m-%d %H:%M:%S")
+else
+BUILD_DATE := $(shell date -u -d @$(SOURCE_DATE_EPOCH) +"%Y-%m-%d %H:%M:%S" 2>/dev/null \
+	|| date -u -r $(SOURCE_DATE_EPOCH) +"%Y-%m-%d %H:%M:%S")
+endif
+
 all: create_build_dir $(VERSION_HEADER) $(SUBDIRS) $(BUILDDIR)/rtlplayground-$(FILENAME_EXTENSION).bin
 
 create_build_dir:
-	mkdir -p $(BUILDDIR)
-	mkdir -p $(BUILDDIR)/uip
-	mkdir -p $(BUILDDIR)/httpd
+	mkdir -p "$(BUILDDIR)"
+	mkdir -p "$(BUILDDIR)/uip"
+	mkdir -p "$(BUILDDIR)/httpd"
+
+# Keep machine.c in first position to fail immediately on invalid $MACHINE value
+SRCS = \
+	machine.c \
+	machine_init.c \
+	cmd_editor.c \
+	cmd_parser.c \
+	dhcp.c \
+	html_data.c \
+	rtlplayground.c \
+	boot.c \
+	sfp.c \
+	syslog.c \
+	udp_apps.c
+
+# RTL837x
+SRCS += \
+	rtl837x_bandwidth.c \
+	rtl837x_flash.c \
+	rtl837x_igmp.c \
+	rtl837x_init.c \
+	rtl837x_leds.c \
+	rtl837x_leds_dump.c \
+	rtl837x_phy.c \
+	rtl837x_pins.c\
+	rtl837x_port.c \
+	rtl837x_stp.c \
+	rtl837x_lldp.c \
+	rtl837x_storm.c
+SRCS += \
+	httpd/httpd.c \
+	httpd/page_impl.c
+SRCS += \
+	uip/timer.c \
+	uip/uip.c \
+	uip/uiplib.c \
+	uip/uip_arp.c \
+	uip/uip-fw.c \
+	uip/uip-neighbor.c \
+	uip/uip-split.c
 
-SRCS = rtlplayground.c rtl837x_flash.c rtl837x_leds.c rtl837x_phy.c rtl837x_port.c cmd_parser.c html_data.c rtl837x_igmp.c
-SRCS += rtl837x_stp.c rtl837x_pins.c dhcp.c machine.c cmd_editor.c rtl837x_bandwidth.c rtl837x_init.c syslog.c
-SRCS += uip/timer.c uip/uip.c uip/uip_arp.c uip/uiplib.c uip/uip-fw.c uip/uip-neighbor.c uip/uip-split.c udp_apps.c
-SRCS += httpd/httpd.c httpd/page_impl.c
 OBJS = ${SRCS:%.c=$(BUILDDIR)/%.rel}
 DEPS := ${SRCS:%.c=$(BUILDDIR)/%.d}
-HTML := $(shell find $(html) -name '*.js' -or -name '*.html' -or -name '*.svg')
+HTML := $(shell find html -name '*.js' -or -name '*.html' -or -name '*.svg' -or -name '*.css' -or -name '*.ico')
 
-html_data.c html_data.h: $(HTML) tools/output/fileadder
-	tools/output/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -b BANK1 -d html -p html_data
+# Minified copy of the web UI sources, used as the fileadder input.
+# The raw html/ sources stay untouched for development; the minified
+# copy is a build artifact under output/.
+HTML_MIN := output/html_min
+.PHONY: html_min
+html_min: $(HTML)
+	rm -rf $(HTML_MIN)
+	mkdir -p $(HTML_MIN)
+	@for f in $(HTML); do python3 tools/minify.py $$f $(HTML_MIN)/$$(basename $$f) || exit 1; done
 
-$(VERSION_HEADER):
-	@echo "#ifndef VERSION_H" > $(VERSION_HEADER)
-	@echo "#define VERSION_H" >> $(VERSION_HEADER)
-	@echo "#define VERSION_SW \"$(VERSION_EXTENSION)\"" >> $(VERSION_HEADER)
-	@echo "#define BUILD_DATE \"$(shell date +"%Y-%m-%d %H:%M:%S")\"" >> $(VERSION_HEADER)
-	@echo "#endif" >> $(VERSION_HEADER)
+html_data.c html_data.h &: $(HTML) | tools html_min
+	tools/output/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -b BANK1 -z -d $(HTML_MIN) -p html_data
+
+$(VERSION_HEADER): FORCE
+	@printf '%s\n' "#ifndef VERSION_H" "#define VERSION_H" \
+		"#define VERSION_SW \"$(VERSION_EXTENSION)\"" \
+		"#define BUILD_DATE \"$(BUILD_DATE)\"" \
+		"#endif" > $(VERSION_HEADER).tmp
+	@cmp -s $(VERSION_HEADER).tmp $(VERSION_HEADER) \
+		&& rm -f $(VERSION_HEADER).tmp \
+		|| mv $(VERSION_HEADER).tmp $(VERSION_HEADER)
 
 httpd: html_data.h
 
 $(SUBDIRS):
 	$(MAKE) -C $@
 
-clean:
+clean: $(SUBDIRSCLEAN)
 	-rm -f html_data.c html_data.h $(VERSION_HEADER)
 	-if [ -d $(BUILDDIR) ]; then find $(BUILDDIR) -type f ! -name "*.bin" -delete; fi
 
-distclean:
+distclean: $(SUBDIRSCLEAN)
 	-rm -f html_data.c html_data.h $(VERSION_HEADER)
 	-rm -rf $(BUILDDIR)
 
-$(BUILDDIR)/%.rel: %.c
+$(SUBDIRSCLEAN):
+	$(MAKE) -C $(@:clean=) clean
+
+# Objects depend on the flags they were built with, through a stamp file that
+# is rewritten only when CC_FLAGS actually changes.
+CCFLAGS_STAMP := $(BUILDDIR)/.ccflags
+
+.PHONY: FORCE
+FORCE:
+
+$(CCFLAGS_STAMP): FORCE | create_build_dir
+	@echo '$(CC_FLAGS)' | cmp -s - $@ 2>/dev/null || echo '$(CC_FLAGS)' > $@
+
+$(BUILDDIR)/%.rel: %.c $(CCFLAGS_STAMP) | create_build_dir html_data.h
 	$(CC) -MMD $(CC_FLAGS) -o $@ -c $<
 
-$(BUILDDIR)/%.rel: %.asm
+$(BUILDDIR)/%.rel: %.asm $(CCFLAGS_STAMP) | create_build_dir
 	${ASM} ${AFLAGS} -o $@ $<
 #	mv -f $(addprefix $(basename $^), .lst .rel .sym) .
 
-$(BUILDDIR)/rtlplayground.ihx: $(OBJS) $(BUILDDIR)/crtstart.rel $(BUILDDIR)/crc16.rel
-	$(CC) $(CC_FLAGS) -Wl-bHOME=0x00000 -Wl-bBANK1=0x14000 -Wl-bBANK2=0x24000 -Wl-r -o $@ $^
+$(BUILDDIR)/rtlplayground.ihx: $(OBJS) $(BUILDDIR)/crtbank.rel $(BUILDDIR)/crc16.rel
+	$(CC) $(CC_FLAGS) --xram-size 49151 -Wl-bHOME=0x00000 -Wl-bBANK1=0x14000 -Wl-bBANK2=0x24000 -Wl-bBANK3=0x34000 -Wl-r -o $@ $^
 
 $(BUILDDIR)/rtlplayground.img: $(BUILDDIR)/rtlplayground.ihx
 	objcopy --input-target=ihex -O binary $< $@
 
-$(BUILDDIR)/rtlplayground-$(FILENAME_EXTENSION).bin: $(BUILDDIR)/rtlplayground.img
+$(BUILDDIR)/rtlplayground-$(FILENAME_EXTENSION).bin: $(BUILDDIR)/rtlplayground.img | tools
 	if [ -e $@ ]; then rm $@; fi
 	tools/output/imagebuilder -i $^ $@
 	tools/output/fileadder -a $(DEFAULT_CONFIG_LOCATION) -s $(IMAGESIZE) -d config.txt $@
 	tools/output/fileadder -a $(CONFIG_LOCATION) -s $(IMAGESIZE) -d config.txt $@
-	tools/output/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -d html -p html_data -b BANK1 $@
+	tools/output/fileadder -a $(HTML_LOCATION) -s $(IMAGESIZE) -z -d $(HTML_MIN) -b BANK1 $@
 	tools/output/crc_calculator -u $@
 	ln -sf $(MACHINE)/rtlplayground-$(FILENAME_EXTENSION).bin output/rtlplayground.bin
 
-.PHONY: clean all $(SUBDIRS) $(VERSION_HEADER)
+.PHONY: clean distclean all $(SUBDIRS) $(SUBDIRSCLEAN) create_build_dir
 
 .PHONY:
 machine_check:
 	@mkdir -p $(BUILDDIR)/tmp
 	@set -eo pipefail; \
-	for MACHINE in `grep -e ' MACHINE_' machine.c | sed -e 's%^.* MACHINE_%%' -e 's%[ ]*//.*$$%%' | sort -u`; \
+	for MACHINE in `grep -E '^[[:space:]]*(//[[:space:]]*)?#define MACHINE_' machine.h | sed -E 's%^[[:space:]]*(//[[:space:]]*)?#define MACHINE_%%' | awk '{print $$1}' | sort -u`; \
 	do \
 	echo "Checking $${MACHINE}"; \
 	$(CC) $(CC_FLAGS) -DMACHINE_$${MACHINE} -MMD -o $(BUILDDIR)/tmp/machine_check -c machine.c; \
+	$(CC) $(CC_FLAGS) -DMACHINE_$${MACHINE} -MMD -o $(BUILDDIR)/tmp/machine_check -c machine_init.c; \
 	done
 	@rm -rf $(BUILDDIR)/tmp
 

README.md

@@ -2,15 +2,15 @@
 A Playground for Firmware development for advanced user of RTL8372/RTL8373 based 2.5GBit Switches.
 
 For each hardware configuration of these devices, there is usually a managed and an
-umanaged version sold, with mostly identical hardware. The aim is to provide management
+unmanaged version sold, with mostly identical hardware. The aim is to provide management
 features also for unmanaged devices with additional features such as Management VLAN,
-dhcp servers, multi-language support, IPv6 and TLS-encrypted web-pages. At present, however
+DHCP servers, multi-language support, IPv6 and TLS-encrypted web-pages. At present, however
 only the following features are provided:
 - A modern web-interface with mouse-over to display further information
 - A serial console interface to configure all features
 - IGMP to configure Multicast streaming
-- Port configuration showing detailed informtion about own and Link-partner advertised
-  Speed settins and configuration of these settings on the local side
+- Port configuration showing detailed information about own and Link-partner advertised
+  Speed settings and configuration of these settings on the local side
 - Per-port configuration of frame sizes (MTUs) for Jumbo-Frame support or limiting MTUs
   for particular devices
 - EEE (Energy Efficient Ethernet) can be configured per-port. Detailed information is
@@ -25,17 +25,19 @@ only the following features are provided:
 - Firmware updates via the web
 - Installation as a firmware upgrade from the original web-interface
 
-<img width="1420" height="623" alt="GUI" src="doc/images/gui.png" />
+<img width="1673" height="977" alt="GUI" src="doc/images/gui.png" />
 
 While the firmware provides already considerable improvements over the original managed firmware,
-the firmware still lacks support for STP and the proprietary loop prevention
-protocols as well as DHCP. If you need these features, do not install the playground on your managed
+the firmware still lacks support for the proprietary loop prevention
+protocols as well as DHCP. Spanning Tree is available (see doc/stp.md), but is
+a simplified implementation - read that document before enabling it on a
+switch you administer over the network. If you need these features, do not install the playground on your managed
 devices. In any case, installation is strongly discouraged unless you can at least make
 a backup of the original flash content via a SOIC clamp such as also used for BIOS
 backups and can re-install that firmware in case something is wrong. For this no soldering
 skills are necessary.
 
-The firmware supports all hardware featues of devices with
+The firmware supports all hardware features of devices with
 - 4 2.5GBit ports + 2 SFP+ ports
 - 5 2.5GBIT + 1 SFP+ port
 - 8 2.5GBit + 1 SFP+ port
@@ -57,9 +59,56 @@ device simulator is provided, which runs entirely under Linux as a local webserv
 Install the following particular build requisites (Debian 12/13), note that Ubuntu 24.04
 still has an older version of sdcc, but you will need sdcc version 4.5 for the code to compile:
 ```
-sudo apt install make gcc sdcc xxd python-is-python3 libjson-c-dev
+sudo apt install make gcc sdcc xxd python-is-python3 libjson-c-dev zlib1g-dev
 ```
 
+<details>
+<summary>If using Docker (click to expand)</summary>
+
+### Prerequisites
+
+Install Docker for your platform:
+
+- **Linux (Debian/Ubuntu)**: `sudo apt install docker.io` then `sudo usermod -aG docker $USER` (log out and back in)
+- **Linux (other distros)**: Follow the [Docker Engine install guide](https://docs.docker.com/engine/install/)
+- **Windows**: Install [Docker Desktop for Windows](https://docs.docker.com/desktop/setup/install/windows-install/)
+- **macOS**: Install [Docker Desktop for Mac](https://docs.docker.com/desktop/setup/install/mac-install/)
+
+### Usage
+
+A Dockerfile is provided for a reproducible build environment:
+
+```
+docker build -t rtlplayground-dev .
+```
+
+Build the firmware (replace MACHINE with your target, e.g. `DEFAULT_8C_1SFP`):
+
+```
+docker run --rm -v $(pwd):/workspace rtlplayground-dev make MACHINE=DEFAULT_8C_1SFP
+```
+
+The resulting `.bin` file appears in `output/` on your host.
+
+Build host tools only:
+
+```
+docker run --rm -v $(pwd):/workspace rtlplayground-dev make -C tools
+```
+
+Run the web-interface simulator locally:
+
+```
+docker run --rm -p 8080:8080 -v $(pwd):/workspace rtlplayground-dev \
+  tools/output/httpd_sim /workspace/html
+```
+
+Edit `machine.h` or `config.txt` on your host, then re-run `make` — the
+source directory is mounted into the container, so changes take effect
+immediately. To build for a different machine, pass `MACHINE=...`.
+
+</details>
+
 ## (1) Compiling for direct chip flashing AND upgrading an existing RTLPlayground running device
 
 Edit machine.h with an editor like vi or nano. Select the correct machine the firmware should build for.
@@ -82,7 +131,7 @@ rtlplayground-v0.1.0-12c98ba-dirty-LIANGUO_ZX_SWTGW215AS.bin
 
 > [!CAUTION]
 > This image can be flashed directly to the chip OR through the firmware update/upgrade
-> interface of RTLPlaygound interface
+> interface of RTLPlayground interface
 
 ## (2) Compiling for OEM running device with management options (web upgrade)
 
@@ -126,11 +175,11 @@ Header checksum is: 0x5a1
 ## (3) Sandbox Usage with Ghidra (optional)
 
 You can play with the image using ghidra or flash real Switch Hardware. For
-ghidra see this information about [Ghidra images](ghidra.md).
+ghidra see this information about [Ghidra images](doc/ghidra.md).
 
 ## (4) Installation through the Web interface (software way)
 
-Managed switches (OEM firmware of RTLplaygroud firmware) can be upgraded via the web interface.
+Managed switches (OEM firmware of RTLplayground firmware) can be upgraded via the web interface.
 Unmanaged switch cannot be flashed this way (see 5).
 
 Go to "Firmware update" tab, select the correct file.
@@ -141,7 +190,7 @@ Go to "Firmware update" tab, select the correct file.
 
 > [!CAUTION]
 > Check one more time that your device matches the machine type before flashing.
-> Be shure you have a backup of the original firmware before diving in RTLPlaygroung.
+> Be sure you have a backup of the original firmware before diving in RTLPlayground.
 
 Finally, push the Upload File Button and you're done !
 
@@ -149,7 +198,7 @@ Finally, push the Upload File Button and you're done !
 ## (5) Flashing the ROM directly (hardware way, but also only way to rescue)
 
 This procedure is the only way to flash unmanaged switches, if the ROM chip is large enough.
-This is also the only way to unbrick your device if something went wroong.
+This is also the only way to unbrick your device if something went wrong.
 
 > [!IMPORTANT]
 > You need a SOIC-8 clip to flash the ROM chip directly onboard.
@@ -169,7 +218,7 @@ This is also the only way to unbrick your device if something went wroong.
 - ERASE THE ROM (BLANK) !
 - Load the firmware into IMSProg.
 - Flash is to the ROM chip.
-- Disconect the clip from the ROM chip.
+- Disconnect the clip from the ROM chip.
 - You're done, ready for the first boot.
 
 ## (6) Connecting a serial interface (optional)
@@ -184,7 +233,7 @@ When you power up the switch, the device will perform some examples and provide
 ## (8) The web-interface
 
 The web-interface can be reached under the [default 192.168.10.247](http://192.168.10.247) unless you
-specified an IP adress in the config.txt before compilation.
+specified an IP address in the config.txt before compilation.
 
 > [!TIP]
 > The default password is `1234`.
@@ -284,17 +333,18 @@ While in compilation part, you might write directly to config.txt file before ma
 nano config.txt
 ```
 
-If you want to modify settings after the flash is done, go to the Advanced Settings tab in System Settings
+If you want to modify settings after the flash is done, go to the System tab and find the Startup Configuration.
 
-<img width="1085" height="646" alt="ADVANCED SETTINGS" src="doc/images/advanced_settings.png" />
+<img width="1673" height="978" alt="ADVANCED SETTINGS" src="doc/images/advanced_settings.png" />
 
 ```
-ip xxx.xxx.xxx.xxx      = IP adress of the switch
-gw yyy.yyy.yyy.yyy      = IP adress of the gateway
+ip xxx.xxx.xxx.xxx      = IP address of the switch
+gw yyy.yyy.yyy.yyy      = IP address of the gateway
 netmask zzz.zzz.zzz.zzz = Network mask of the switch 
 port x name xxx         = Name xxx the port number x
 port z 1g               = Set 1g speed for port z
 igmp on/off             = Turn IGMP on or off
+session xxxx            = Web session timeout in seconds (default 200)
 ```
 [To be continue]
 
@@ -310,4 +360,5 @@ The following documents give further documentation on specific features of the R
 - [SFP+ ports](doc/sfp.md) 
 - [Trunking aka. port aggregation](doc/trunking.md)
 - [VLAN](doc/vlan.md)
+- [Storm control](doc/storm_control.md)
 - [Modifications and Flash replacement](doc/mods.md)

boot.c

@@ -0,0 +1,479 @@
+#pragma codeseg BANK3
+#pragma constseg BANK3
+
+#include <8051.h>
+#include <stdint.h>
+#include <stdbool.h>
+
+#include "rtl837x_sfr.h"
+#include "rtl837x_regs.h"
+#include "rtl837x_common.h"
+#include "rtl837x_flash.h"
+#include "rtl837x_pins.h"
+#include "rtl837x_phy.h"
+#include "rtl837x_port.h"
+#include "rtl837x_init.h"
+#include "machine.h"
+#include "phy.h"
+#include "boot.h"
+
+extern __code const struct machine machine;
+extern __xdata struct machine_runtime machine_detected;
+extern __xdata uint8_t sfr_data[4];
+extern volatile __xdata uint32_t ticks;
+__xdata uint32_t rtl8224_release_tick;
+extern __xdata uint8_t tx_seq;
+extern __code const uint8_t * __code const hex;
+
+
+
+void sds_config_mac(uint8_t sds, uint8_t mode) __banked
+{
+	reg_read_m(RTL837X_REG_SDS_MODES);
+	sfr_data[0] = 0;
+	sfr_data[1] = 0;
+	switch (sds) {
+	case 0:
+		sfr_mask_data(0, 0x1f, mode);
+		break;
+	case 1:
+		sfr_mask_data(0, 0xe0, mode << 5);
+		sfr_mask_data(1, 0x03, mode >> 3);
+		break;
+	case 2:
+		sfr_mask_data(1, 0xfc, 0x02 << 2);
+	}
+	if (machine_detected.isRTL8373) // Set 3rd SERDES Mode to 0x2 for RTL8224
+		sfr_mask_data(1, 0xfc, 0x02 << 2);
+	else
+		sfr_data[2] &= 0x03;
+	reg_write_m(RTL837X_REG_SDS_MODES);
+	print_string("\nRTL837X_REG_SDS_MODES: ");
+	print_reg(RTL837X_REG_SDS_MODES);
+	print_string("\n");
+}
+
+
+
+void early_boot_handle_button(void) __banked
+{
+	if (machine.reset_pin == GPIO_NA)
+		return;
+
+	gpio_input_setup(machine.reset_pin);
+
+	// Debounce after init
+	delay(100);
+	// If the button is not already held at boot, continue normally.
+	if (gpio_pin_test(machine.reset_pin))
+		return;
+
+	set_sys_led_state(SYS_LED_FAST);
+	print_string("\n[Reset button held at boot]\n");
+
+	if (gpio_pin_test(machine.reset_pin))
+		return;
+
+	const __xdata uint32_t min_hold_ticks = 10UL * SYS_TICK_HZ;
+	const __xdata uint32_t max_hold_ticks = 30UL * SYS_TICK_HZ;
+	const __xdata uint32_t blink_ticks = SYS_TICK_HZ / 10;      // 100 ms
+	const __xdata uint32_t pause_ticks = SYS_TICK_HZ / 2;       // 500 ms
+	__xdata uint32_t start_ticks = ticks;
+	__xdata uint32_t last_blink_step = start_ticks;
+	__xdata uint8_t blink_step = 0;
+
+	set_sys_led_state(SYS_LED_ON);
+
+	while (!gpio_pin_test(machine.reset_pin)) {
+		__xdata uint32_t held_ticks = ticks - start_ticks;
+
+		if (held_ticks > max_hold_ticks) {
+			print_string("[Button held >30s at boot; continuing normal boot]\n");
+			return;
+		}
+
+		// Double blink pattern while button is held:
+		// ON (100ms), OFF (100ms), ON (100ms), OFF (500ms)
+		__xdata uint32_t step_ticks = (blink_step == 3) ? pause_ticks : blink_ticks;
+		if ((ticks - last_blink_step) >= step_ticks) {
+			blink_step = (blink_step + 1) & 0x3;
+			set_sys_led_state((blink_step == 0 || blink_step == 2) ? SYS_LED_ON : SYS_LED_OFF);
+			last_blink_step = ticks;
+		}
+
+		PCON |= 1;
+	}
+
+	set_sys_led_state(SYS_LED_ON);
+
+	if ((ticks - start_ticks) >= min_hold_ticks) {
+		print_string("[Button held 10s-30s at boot; restoring default config]\n");
+		set_sys_led_state(SYS_LED_FAST);
+		flash_default_config();
+		delay(3UL * SYS_TICK_HZ);
+	}
+}
+
+
+/*
+ * Configure the SerDes of the SoC for a particular mode
+ * to connect to an SFP module or a PHY
+ * Valid modes are SDS_10GR, SDS_QXGMII, SDS_HISGMII, SDS_HSG, SDS_SGMII and SDS_1000BX_FIBER
+ * The SerDes ID may be 0 or 1 for RTL8272 and 0-2 for RTL8373
+ * SDS_QXGMII is used for 10G Fiber, RTL8224 and RTL8261BE
+ */
+void sds_config(uint8_t sds, uint8_t mode) __banked
+{
+	print_string("sds_config sds: "); print_byte(sds); print_string(", mode: "); print_byte(mode); write_char('\n');
+	sds_config_mac(sds, mode);
+
+	if (mode == SDS_10GR || mode == SDS_QXGMII)
+		sds_write_v(sds, 0x21, 0x10, 0x4480); // Q002110:6480
+	else
+		sds_write_v(sds, 0x21, 0x10, 0x6480); // Q002110:6480
+	sds_write_v(sds, 0x21, 0x13, 0x0400); // Q002113:0400
+	sds_write_v(sds, 0x21, 0x18, 0x6d02); // Q002118:6d02
+	sds_write_v(sds, 0x21, 0x1b, 0x424e); // Q00211b:424e
+	sds_write_v(sds, 0x21, 0x1d, 0x0002); // Q00211d:0002
+	sds_write_v(sds, 0x36, 0x1c, 0x1390); // Q00361c:1390
+	sds_write_v(sds, 0x36, 0x14, 0x003f); // Q003614:003f
+
+	uint8_t page = 0;
+	uint16_t v = 0;
+
+	switch (mode) {
+	case SDS_SGMII:
+	case SDS_1000BX_FIBER:
+		v = 0x0300;
+		page = 0x24;
+		break;
+	case SDS_HISGMII:
+	case SDS_HSG:
+		v = 0x0200;
+		page = 0x28;
+		break;
+	case SDS_10GR:
+	case SDS_QXGMII:
+		v = 0x0200;
+		page = 0x2e;
+		break;
+	case SDS_100FX:
+		v = 0x0200;
+		page = 0x26;
+		break;
+	default:
+		print_string("Error in SDS Mode\n");
+		return;
+	}
+	sds_write_v(sds, 0x36, 0x10, v); // Q003610:0200
+
+	if (page == 0x2e) {  // 10G Fiber / SDS_QXGMII
+		sds_write_v(sds, page, 0x04, 0x0080); // Q012e04:0080
+		sds_write_v(sds, page, 0x06, 0x0408); // Q012e06:0408
+		sds_write_v(sds, page, 0x07, 0x020d); // Q012e07:020d
+		sds_write_v(sds, page, 0x09, 0x0601); // Q012e09:0601
+		sds_write_v(sds, page, 0x0b, 0x222c); // Q012e0b:222c
+		sds_write_v(sds, page, 0x0c, 0xa217); // Q012e0c:a217
+		sds_write_v(sds, page, 0x0d, 0xfe40); // Q012e0d:fe40
+		sds_write_v(sds, page, 0x15, 0xf5c1); // Q012e15:f5c1
+	} else {
+		sds_write_v(sds, page, 0x04, 0x0080); // Q002804:0080
+		sds_write_v(sds, page, 0x07, 0x1201); // Q002807:1201
+		sds_write_v(sds, page, 0x09, 0x0601); // Q002809:0601
+		sds_write_v(sds, page, 0x0b, 0x232c); // Q00280b:232c
+		sds_write_v(sds, page, 0x0c, 0x9217); // Q00280c:9217
+		sds_write_v(sds, page, 0x0f, 0x5b50); // Q00280f:5b50
+		sds_write_v(sds, page, 0x15, 0xe7c1); // Q002815:e7f1 BUG !
+	}
+
+	sds_write_v(sds, page, 0x16, 0x0443); // Q002816:0443 / Q012e16:0443
+	sds_write_v(sds, page, 0x1d, 0xabb0); // Q00281d:abb0 / Q012e1d:abb0
+
+	sds_write_v(sds, 0x06, 0x12, 0x5078); // Q000612:5078
+	sds_write_v(sds, 0x07, 0x06, 0x9401); // Q000706:9401
+	sds_write_v(sds, 0x07, 0x08, 0x9401); // Q000708:9401
+	sds_write_v(sds, 0x07, 0x0a, 0x9401); // Q00070a:9401
+	sds_write_v(sds, 0x07, 0x0c, 0x9401); // Q00070c:9401
+	sds_write_v(sds, 0x1f, 0x0b, 0x0003); // Q001f0b:0003
+	sds_write_v(sds, 0x06, 0x03, 0xc45c); // Q000603:c45c
+
+	// RTL8261BE
+	if (machine.n_10g && mode == SDS_QXGMII) {
+		sds_write_v(sds, 0x06, 0x1f, 0x2100); // Q00061f:2100
+		sds_write_v(sds, 0x07, 0x11, 0x054f); // Q000711:054f
+		sds_write_v(sds, 0x20, 0x00, 0x0030); // Q002000:0030
+		sds_write_v(sds, 0x20, 0x00, 0x0010); // Q002000:0010
+		sds_write_v(sds, 0x20, 0x00, 0x0050); // Q002000:0050
+		sds_write_v(sds, 0x20, 0x00, 0x00d0); // Q002000:00d0
+		sds_write_v(sds, 0x20, 0x00, 0x0cd0); // Q002000:0cd0
+		sds_write_v(sds, 0x20, 0x00, 0x04d0); // Q002000:04d0
+		sds_write_v(sds, 0x20, 0x00, 0x04d0); // Q002000:04d0
+		sds_write_v(sds, 0x20, 0x00, 0x0cd0); // Q002000:0cd0
+		sds_write_v(sds, 0x20, 0x00, 0x00d0); // Q002000:00d0
+		sds_write_v(sds, 0x20, 0x00, 0x00d0); // Q002000:00d0
+		sds_write_v(sds, 0x20, 0x00, 0x0050); // Q002000:0050
+		sds_write_v(sds, 0x20, 0x00, 0x0010); // Q002000:0010
+		sds_write_v(sds, 0x20, 0x00, 0x0010); // Q002000:0010
+		sds_write_v(sds, 0x20, 0x00, 0x0030); // Q002000:0030
+		sds_write_v(sds, 0x20, 0x00, 0x0000); // Q002000:0000
+		sds_write_v(sds, 0x1f, 0x00, 0x000b); // Q001f00:000b
+		sds_write_v(sds, 0x1f, 0x00, 0x0000); // Q001f00:0000
+		return;
+	}
+	if (mode != SDS_QXGMII)
+		sds_write_v(sds, 0x06, 0x1f, 0x2100); // Q00061f:2100
+
+	if (mode == SDS_1000BX_FIBER) {
+		sds_write_v(sds, 0x02, 0x04, 0x0020); 	// Q000204:0020
+		sds_write_v(sds, 0x00, 0x02, 0x73d0); 	// Q000002:73d0
+		sds_write_v(sds, 0x00, 0x04, 0x074d); 	// Q000004:074d
+		sds_write_v(sds, 0x20, 0x04, 0x0000); 	// Q002000:0000
+		sds_write_v(sds, 0x1f, 0x00, 0x0000); 	// Q001f00:0000
+	}
+}
+
+
+
+
+void rtl8224_enable(void) __banked
+{
+	// Set Pin 4 low
+	reg_bit_clear(RTL837X_REG_GPIO_32_63_OUTPUT, 4);
+	// Configure Pin as output
+	reg_bit_set(RTL837X_REG_GPIO_32_63_DIRECTION, 4);
+	delay(4);
+	// Set pin 4 high
+	reg_bit_set(RTL837X_REG_GPIO_32_63_OUTPUT, 4);
+	rtl8224_release_tick = ticks;
+}
+
+
+
+void nic_setup(void) __banked
+{
+	// Enable NIC
+	// r6040:00000100 R6040-00001100
+	reg_bit_set(RTL837X_REG_HW_CONF, 0xc);
+
+	// This sets the size of the RX buffer, the filling level is in 0x7874
+	// R7848-000004ff
+	REG_SET(RTL837X_REG_NIC_RXBUFF_RX, 0x4ff);
+
+	// R7844-000007fe
+	REG_SET(RTL837X_REG_NIC_BUFFSIZE_TX, 0x7fe);
+
+	// Configure NIC RX to receive various types of packets
+	// RTL837X_REG_RX_CTRL: Set bits 24-31 to 0x4, clear bits 16/17
+	reg_read_m(RTL837X_REG_RX_CTRL);
+	sfr_mask_data(3, 0xff, 0x04);
+	sfr_mask_data(2, 0x03, 0);
+	reg_write_m(RTL837X_REG_RX_CTRL);
+
+	// Enable NIC TX (set bit 0)
+	reg_bit_set(RTL837X_REG_TX_CTRL, 0);
+
+	// Enable NIC RX (set bit 0)
+	reg_bit_set(RTL837X_REG_RX_CTRL, 0);
+
+	// Drop packets with invalid CRC
+	reg_bit_clear(RTL837X_REG_RX_CTRL, 2);
+
+	// R603c-00000200
+	// CPU-port is CPU-Tag aware (bit 9)
+	REG_SET(RTL837X_REG_CPU_TAG_AWARE_PMASK, 0x200);
+
+	// Insert CPU-tag for internally received packets (bit 0), MODE is 0, i.e. ALL packets (bits 8-9)
+	reg_read_m(RTL837X_REG_CPU_TAG);
+	sfr_mask_data(0, 1, 1);
+	sfr_mask_data(1, 3, 0);
+	reg_write_m(RTL837X_REG_CPU_TAG);
+
+	// Force MAC mode of the CPU port (port 9)
+	// r6368:00000194 R6368-00000197
+	reg_read_m(RTL837X_REG_MAC_FORCE_MODE + 9 * 4);
+	sfr_mask_data(0, 0, 3); // Set bits 0, 1: Force link
+	reg_write_m(RTL837X_REG_MAC_FORCE_MODE+ 9 * 4);
+
+	// Sequence number of TX packets
+	tx_seq = 0;
+}
+
+
+
+void rtl8373_revision(void) __banked
+{
+	reg_read_m(RTL837X_REG_CHIP_INFO);
+	sfr_mask_data(2, 0x0a, 0x0a); 	// Enable reading version
+	reg_write_m(RTL837X_REG_CHIP_INFO);
+	delay(50);
+
+	reg_read_m(RTL837X_REG_CHIP_INFO);
+	print_string("CPU revision: "); print_byte(sfr_data[2]); print_byte(sfr_data[2]); write_char('\n');
+	sfr_mask_data(2, 0x0a, 0x00); 	// Enable reading version
+	reg_write_m(RTL837X_REG_CHIP_INFO);
+}
+
+
+/*
+ * The SoC manages Link-State for steering the LEDs and can set PHY-settings
+ * automatically through Realtek's SMI (Simple Managagement) Interface, a
+ * proprietary version of MDIO which for example allows for more PHYs on the same
+ * bus.
+ * Configure polling via SMI and the interface setup during boot.
+ */
+void init_smi(void) __banked
+{
+	print_string("\ninit_switch called\n");
+
+	/* Set the SMI(i.e.I2C) type for PHY polling, 0b01 is 2.5/10G PHY. Disable (0b00) for the SFP-ports
+	 * which are at port 8 and additionally at port 3 for a dual SFP device
+	 */
+
+	// Default: 0x00005555
+	// Workaround for SDCC BUG 4070: SFR_DATA_U32 = 0x00005555;
+	SFR_DATA_U16_UPPER = 0x0000;
+	SFR_DATA_U16 = 0x5555;
+	if (machine.n_10g == 2) {
+		// 0x00015555, only change the bytes that differs from the default.
+		SFR_DATA_16 = 0x01;
+	} else if (machine.n_sfp == 2)
+		// 0x00005515
+		SFR_DATA_0 = 0x15;
+	reg_write(RTL837X_REG_SMI_MAC_TYPE);
+
+	// Configure polling of all PHYs by the MAC to detect link-state changes
+	// Default: 0x000000ff
+	// Workaround for SDCC BUG 4070: SFR_DATA_U32 = 0x000000ff;
+	SFR_DATA_U16_UPPER = 0x0000;
+	SFR_DATA_U16 = 0x00ff;
+	if (!machine_detected.isRTL8373) {
+		if (machine.n_sfp == 2) {
+			// 0x000000f0, only change the bytes that differs from the default.
+			SFR_DATA_0 = 0xf0;
+		} else {
+			// 0x000001f8, only change the bytes that differs from the default.
+			SFR_DATA_8 = 0x01;
+			SFR_DATA_0 = 0xf8;
+		}
+	}
+	reg_write(RTL837X_REG_SMI_PORT_POLLING);
+	// Enable MDC
+	reg_read_m(RTL837X_REG_SMI_CTRL);
+	sfr_mask_data(1, 0, 0x70); 	// Set bits 12-14 to enable MDC for SMI0-SMI2
+	reg_write_m(RTL837X_REG_SMI_CTRL);
+	delay(50);
+
+	if (!machine_detected.isRTL8373) {
+		// Change I2C addresses for SMI of the non-existent PHYs
+		// r6450:000020e6 R6450-000000e6
+		reg_read_m(RTL837X_REG_SMI_PORT6_9_ADDR);
+		sfr_mask_data(1, 0x7c, 0);
+		reg_write_m(RTL837X_REG_SMI_PORT6_9_ADDR);
+
+		// r644c:0a418820 R644c-0a400820
+		reg_read_m(RTL837X_REG_SMI_PORT0_5_ADDR);
+		sfr_mask_data(2, 0x0f, 0);
+		sfr_mask_data(1, 0x80, 0);
+		reg_write_m(RTL837X_REG_SMI_PORT0_5_ADDR);
+	}
+
+	if (machine.n_10g == 2) {
+		// Set address of second external PHY on port 8
+		REG_SET(RTL837X_REG_SMI_PORT6_9_ADDR, 0x000040e6);
+	}
+}
+
+
+
+
+void setup_i2c(void) __banked
+{
+	REG_SET(RTL837X_REG_I2C_MST_IF_CTRL, 0);
+	// Configure SFP EEPROM address (0x50) as I2C device address
+	// Configure SFP readings address (0x51) as I2C device address
+	REG_WRITE(RTL837X_REG_I2C_CTRL, 0x00, 0x1 << (I2C_MEM_ADDR_WIDTH-16),  0x50 >> 5, (0x50 << 3) & 0xff);
+
+	REG_SET(RTL837X_REG_I2C_CTRL2, 0);
+
+	// HW Control register, enable I2C depending on PIN configuration
+	reg_read_m(RTL837X_PIN_MUX_1);
+	for (uint8_t sfp = 0; sfp < machine.n_sfp; sfp++) {
+		uint8_t i2c = machine.sfp_port[sfp].i2c;
+		uint8_t scl_bus = (i2c >> RTL837X_REG_I2C_SCL_SHIFT) & RTL837X_REG_I2C_SCL_MASK;
+		uint8_t sda_bus = (i2c >> RTL837X_REG_I2C_SDA_SHIFT) & RTL837X_REG_I2C_SDA_MASK;
+		print_string("Configuring I2C for SFP idx="); print_byte(sfp); print_string(" SCL="); print_byte(scl_bus); print_string(", SDA="); print_byte(sda_bus); write_char('\n');
+		// `& RTL837X_REG_I2C_SCL_MASK` is needed to silens a compiler warning 110.
+		switch (scl_bus & RTL837X_REG_I2C_SCL_MASK) {
+			case 3:
+				// Bit 5-6 0b10 -> SCL (implies enabled SDA on bus 3)
+				sfr_mask_data(0, 0x60, 0x40);
+				break;
+			case 2: 
+				// Bit 15-16 0b01 -> SCL
+				sfr_mask_data(1, 0x80, 0x80);
+				sfr_mask_data(2, 0x01, 0x00);
+				break;
+			case 1:
+				// Bit 11-12 0b01 -> SCL
+				sfr_mask_data(1, 0x18, 0x08);
+				break;
+			case 0:
+				// Bit 7-8 0b01 -> SCL
+				sfr_mask_data(0, 0x80, 0x80);
+				sfr_mask_data(1, 0x01, 0x00);
+				break;
+		}
+
+		switch (sda_bus) {
+			case 4:
+				// Bit 29 0b0 -> SDA
+				sfr_mask_data(3, 0x20, 0x00);
+				break;
+			case 3:
+				// Bit 5-6 0b10 -> SDA (implies enabled SCL on bus 3)
+				sfr_mask_data(0, 0x60, 0x40);
+				break;
+			case 2:
+				// Bit 17-18 0b01 -> SDA
+				sfr_mask_data(2, 0x06, 0x02);
+				break;
+			case 1:
+				// Bit 13-14 0b01 -> SDA
+				sfr_mask_data(1, 0x60, 0x20);
+				break;
+			case 0:
+				// Bit 9-10 0b01 -> SDA
+				sfr_mask_data(1, 0x06, 0x02);
+				break;
+		}
+	}
+	reg_write_m(RTL837X_PIN_MUX_1);	
+}
+
+
+/* Give the switch a name carrying the tail of its MAC, so several of them on
+ * one network are distinguishable out of the box. Called after the startup
+ * config has been replayed and returns at once if that config already set a
+ * name, so a configured switch does no work for it (suggested in review).
+ *
+ * Written without a loop on purpose. Locals - counters and pointers alike -
+ * land in the 8051's internal-RAM overlay, and on an image with LACP and STP
+ * both enabled that overlay is exhausted: a loop here makes the linker fail
+ * with "Could not get 8 consecutive bytes in internal RAM for area OSEG".
+ * Moving the code into its own function does not help; the overlay is shared
+ * across the whole image. Hoisting the locals to xdata does not help either,
+ * because itohex() is inline and brings its own frame. */
+void set_hostname_default(void) __banked
+{
+	if (hostname[0] != NUL)
+		return;
+
+	strcpy((__xdata uint8_t *)hostname, "RTLPlayground-");
+	hostname[14] = hex[uip_ethaddr.addr[3] >> 4];
+	hostname[15] = hex[uip_ethaddr.addr[3] & 0xf];
+	hostname[16] = hex[uip_ethaddr.addr[4] >> 4];
+	hostname[17] = hex[uip_ethaddr.addr[4] & 0xf];
+	hostname[18] = hex[uip_ethaddr.addr[5] >> 4];
+	hostname[19] = hex[uip_ethaddr.addr[5] & 0xf];
+	hostname[20] = NUL;
+}

boot.h

@@ -0,0 +1,14 @@
+#ifndef BOOT_H
+#define BOOT_H
+
+void sds_config_mac(uint8_t sds, uint8_t mode) __banked;
+void sds_config(uint8_t sds, uint8_t mode) __banked;
+void early_boot_handle_button(void) __banked;
+void rtl8224_enable(void) __banked;
+void nic_setup(void) __banked;
+void rtl8373_revision(void) __banked;
+void init_smi(void) __banked;
+void setup_i2c(void) __banked;
+void set_hostname_default(void) __banked;
+
+#endif

cmd_editor.c

@@ -40,21 +40,24 @@ void cmd_edit(void) __banked
 {
 	while (l != sbuf_ptr) {
 		if (sbuf[l] >= ' ' && sbuf[l] < 127) { // A printable character, copy to command line
-			if (cmd_line_len >= CMD_BUF_SIZE)
-				continue;
-			write_char(sbuf[l]);
-			// Shift buffer to right
-			for (uint8_t i = cmd_line_len; i > cursor; i--)
-				cmd_buffer[i] = cmd_buffer[i-1];
-			// Insert char in comand buffer
-			cmd_buffer[cursor++] = sbuf[l];
-			cmd_line_len++;
-			// Print rest of line
-			for (uint8_t i = cursor; i < cmd_line_len; i++)
-				write_char(cmd_buffer[i]);
-			// Move backwards
-			for (uint8_t i = cursor; i < cmd_line_len; i++)
-				write_char('\010'); // BS works like cursor-left
+			// Reserve one byte for the terminating NUL written on Enter. When the
+			// line is full, drop the character but still fall through to advance the
+			// serial-ring read pointer below; a 'continue' here would spin forever.
+			if (cmd_line_len < CMD_BUF_SIZE - 1) {
+				write_char(sbuf[l]);
+				// Shift buffer to right
+				for (uint8_t i = cmd_line_len; i > cursor; i--)
+					cmd_buffer[i] = cmd_buffer[i-1];
+				// Insert char in comand buffer
+				cmd_buffer[cursor++] = sbuf[l];
+				cmd_line_len++;
+				// Print rest of line
+				for (uint8_t i = cursor; i < cmd_line_len; i++)
+					write_char(cmd_buffer[i]);
+				// Move backwards
+				for (uint8_t i = cursor; i < cmd_line_len; i++)
+					write_char('\010'); // BS works like cursor-left
+			}
 		} else if (sbuf[l] == '\033') { // ESC-Sequence
 			// Wait until we have at least 3 characters including the ESC character in the serial buffer
 			if (((sbuf_ptr + SBUF_SIZE - l) & SBUF_MASK) < 3)
@@ -190,7 +193,7 @@ void cmd_edit(void) __banked
 		// Check whether return was pressed:
 		if (sbuf[l] == '\n' || sbuf[l] == '\r') {
 			write_char('\n');
-			cmd_buffer[cmd_line_len] = '\0';
+			cmd_buffer[cmd_line_len] = NUL;
 //			write_char('>'); print_string_x(cmd_buffer); write_char('<');
 			// If there is a command we print the prompt after execution
 			// otherwise immediately because there is nothing to execute

cmd_parser.h

@@ -6,13 +6,42 @@
 #include "rtl837x_common.h"
 
 extern __xdata uint8_t cmd_buffer[CMD_BUF_SIZE];
-extern __xdata uint8_t cmd_available;
+extern __bit __at(0x03) cmd_available;
 extern __xdata uint8_t err_status;
 
+/* Health instrumentation, built with HEALTH=1. Without it the hooks below
+ * compile to nothing and the "health" command does not exist. */
+#ifdef HEALTH
+/* Phase ids, in main-loop order */
+#define HEALTH_PH_LINK	0
+#define HEALTH_PH_SFP	1
+#define HEALTH_PH_RX	2
+#define HEALTH_PH_TX	3
+#define HEALTH_PH_STP	4
+#define HEALTH_PH_CMD	5
+#define HEALTH_PHASES	6
+#define HEALTH_LLDP     7
+
+extern __xdata uint16_t health_rx_frames;
+#define health_rx_frame()	health_rx_frames++
+
+void health_loop_start(void) __banked;	/* once per idle() pass, resets the phase baseline */
+void health_phase(uint8_t id) __banked;	/* after each phase; accounts ticks since last checkpoint */
+void health_stack_paint(void) __banked;	/* paint the unused stack area once at boot */
+void health_show(void) __banked;	/* "health" CLI dump */
+#else
+#define health_rx_frame()
+#define health_loop_start()
+#define health_phase(id)
+#define health_stack_paint()
+#endif
+
 void cmd_tokenize(void) __banked;
 void cmd_parser(void) __banked;
 void execute_config(void) __banked;
 void execute_commands(__xdata uint8_t *p) __banked;
+void print_ip(__xdata uint8_t *ptr) __banked;
+void print_mac(__xdata uint8_t *ptr) __banked;
 void print_sw_version(void) __banked;
 void clear_command_history(void) __banked;
 

crc16.asm

@@ -3,6 +3,8 @@
 ;
 	.globl 	_crc_value
 	.globl 	_crc16
+	.globl 	_crc16_bank1
+	.globl 	__sdcc_banked_ret
 	.equ	BANK, 0x96
 ;	.equ	DPS, 0x86
 ; Variable in XMEM holding current CRC16 value, being updated
@@ -18,7 +20,7 @@ _crc_value::
 	.area HOME    (CODE)
 	.area CSEG    (CODE)
 ;	.area BANK1   (CODE)
-_crc16:
+_crc16_bank1:
 	mov	BANK, #1
 	push	dph
 	push	dpl
@@ -52,6 +54,10 @@ _crc16:
 
 	.area BANK1   (CODE)
 
+_crc16:
+	lcall	_crc16_bank1
+	ljmp	__sdcc_banked_ret
+
 crc16_table_l:
 	.byte #0x00, #0xc1, #0x81, #0x40, #0x01, #0xc0, #0x80, #0x41
 	.byte #0x01, #0xc0, #0x80, #0x41, #0x00, #0xc1, #0x81, #0x40

crtbank.asm

@@ -0,0 +1,29 @@
+	.area HOME    (CODE)
+	.area GSINIT0 (CODE)
+	.area GSINIT1 (CODE)
+	.area GSINIT2 (CODE)
+	.area GSINIT3 (CODE)
+	.area GSINIT4 (CODE)
+	.area GSINIT5 (CODE)
+	.area GSINIT  (CODE)
+	.area GSFINAL (CODE)
+	.area CSEG    (CODE)
+
+
+	.area HOME    (CODE)
+
+__sdcc_banked_call::
+	push	_PSBANK
+	xch	a,r0
+	push	a
+	mov	a,r1
+	push	a
+	mov	a,r2
+	anl	a,#0x1f
+	mov	_PSBANK, a
+	xch	a, r0
+	ret
+
+__sdcc_banked_ret::
+	pop	_PSBANK
+	ret

crtstart.asm

@@ -1,17 +0,0 @@
-	.area GSFINAL (CODE)
-
-__sdcc_banked_call::
-	push	_PSBANK
-	xch	a,r0
-	push	a
-	mov	a,r1
-	push	a
-	mov	a,r2
-	anl	a,#0x1f
-	mov	_PSBANK, a
-	xch	a, r0
-	ret
-
-__sdcc_banked_ret::
-	pop	_PSBANK
-	ret

dhcp.c

@@ -41,6 +41,7 @@ __xdata uip_ipaddr_t server;
 #define DHCP_REBIND_LEN		4
 #define DHCP_CLIENT_ID		61
 #define DHCP_CLIENT_ID_LEN	7
+#define DHCP_HOSTNAME		12
 #define DHCP_REQUEST_IP		50
 #define DHCP_REQUEST_IP_LEN	4
 #define DHCP_PARAMS		55
@@ -49,7 +50,7 @@ __xdata uip_ipaddr_t server;
 #define DHCP_PARAM_DNS		6
 #define DHCP_END		255
 
-#pragma codeseg BANK2
+#pragma codeseg BANK3
 #pragma constseg BANK2
 
 struct dhcp_pkt {
@@ -93,7 +94,7 @@ void dhcp_prepare_request(void)
 	DHCP_P->hw_len = 6;
 	DHCP_P->hops = 0;
 
-	DHCP_P->tid = HTONS(dhcp_state.transaction_id);
+	DHCP_P->tid = dhcp_state.transaction_id;
 	DHCP_P->delay = HTONS(0);
 	DHCP_P->flags = 0;
 	// Clear fields client_ip to bootp_file
@@ -116,6 +117,20 @@ void dhcp_addopt_client_id(void)
 }
 
 
+void dhcp_addopt_hostname(void)
+{
+	uint8_t len = 0;
+	while (hostname[len])
+		len++;
+	if (!len)
+		return;
+	DHCP_OPT[dhcp_state.opt_ptr++] = DHCP_HOSTNAME;
+	DHCP_OPT[dhcp_state.opt_ptr++] = len;
+	memcpy(&DHCP_OPT[dhcp_state.opt_ptr], hostname, len);
+	dhcp_state.opt_ptr += len;
+}
+
+
 void dhcp_addopt_request_ip(void)
 {
 	DHCP_OPT[dhcp_state.opt_ptr++] = DHCP_REQUEST_IP;
@@ -124,7 +139,6 @@ void dhcp_addopt_request_ip(void)
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.current_ip[1];
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.current_ip[2];
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.current_ip[3];
-	memcpy(&DHCP_OPT[dhcp_state.opt_ptr], uip_ethaddr.addr, 4);
 }
 
 
@@ -136,13 +150,11 @@ void dhcp_addopt_server_id(void)
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.server[1];
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.server[2];
 	DHCP_OPT[dhcp_state.opt_ptr++] = dhcp_state.server[3];
-	memcpy(&DHCP_OPT[dhcp_state.opt_ptr], uip_ethaddr.addr, 4);
 }
 
 
 void dhcp_send_discover(void)
 {
-	print_string("dhcp_send_discover called\n");
 	dhcp_prepare_request();
 
 	dhcp_state.opt_ptr = 0;
@@ -152,6 +164,7 @@ void dhcp_send_discover(void)
 
 	dhcp_addopt_client_id();
 	dhcp_addopt_request_ip();
+	dhcp_addopt_hostname();
 
 	DHCP_OPT[dhcp_state.opt_ptr++] = DHCP_PARAMS;
 	DHCP_OPT[dhcp_state.opt_ptr++] = 3;
@@ -177,7 +190,6 @@ void dhcp_send_discover(void)
 
 void dhcp_send_request(void)
 {
-	print_string("dhcp_send_request called\n");
 	dhcp_prepare_request();
 
 	dhcp_state.opt_ptr = 0;
@@ -188,6 +200,7 @@ void dhcp_send_request(void)
 	dhcp_addopt_client_id();
 	dhcp_addopt_request_ip();
 	dhcp_addopt_server_id();
+	dhcp_addopt_hostname();
 
 	DHCP_OPT[dhcp_state.opt_ptr++] = DHCP_PARAMS;
 	DHCP_OPT[dhcp_state.opt_ptr++] = 3;
@@ -215,19 +228,21 @@ void ip_opt(__xdata uint8_t * ip)
 {
 	dhcp_state.opt_ptr++;
 	uint8_t len = DHCP_OPT[dhcp_state.opt_ptr++];
-	*ip++ = DHCP_OPT[dhcp_state.opt_ptr++];
-	*ip++ = DHCP_OPT[dhcp_state.opt_ptr++];
-	*ip++ = DHCP_OPT[dhcp_state.opt_ptr++];
-	*ip++ = DHCP_OPT[dhcp_state.opt_ptr++];
+	if (len >= 4)
+		memcpy(ip, &DHCP_OPT[dhcp_state.opt_ptr], 4);
 	 // There may be more than one IP option, such as 2 DNS servers advertised
-	dhcp_state.opt_ptr += len - 4;
+	dhcp_state.opt_ptr += len;
 }
 
 
-void long_opt(void)
+uint8_t long_opt(void)
 {
 	dhcp_state.opt_ptr++;
-	dhcp_state.opt_ptr++;
+	uint8_t len = DHCP_OPT[dhcp_state.opt_ptr++];
+	if (len < 4) {
+		dhcp_state.opt_ptr += len;
+		return 0;
+	}
 	long_value =  DHCP_OPT[dhcp_state.opt_ptr++];
 	long_value <<= 8;
 	long_value |= DHCP_OPT[dhcp_state.opt_ptr++];
@@ -235,6 +250,8 @@ void long_opt(void)
 	long_value |= DHCP_OPT[dhcp_state.opt_ptr++];
 	long_value <<= 8;
 	long_value |= DHCP_OPT[dhcp_state.opt_ptr++];
+	dhcp_state.opt_ptr += len - 4;
+	return 1;
 }
 
 
@@ -258,16 +275,16 @@ void parse_opts(void)
 			ip_opt(&dhcp_state.broadcast[0]);
 			break;
 		case DHCP_LEASE:
-			long_opt();
-			dhcp_state.lease = long_value;
+			if (long_opt())
+				dhcp_state.lease = long_value;
 			break;
 		case DHCP_REBIND:
-			long_opt();
-			dhcp_state.rebind = long_value;
+			if (long_opt())
+				dhcp_state.rebind = long_value;
 			break;
 		case DHCP_RENEWAL:
-			long_opt();
-			dhcp_state.renewal = long_value;
+			if (long_opt())
+				dhcp_state.renewal = long_value;
 			break;
 		case DHCP_END:
 			break;
@@ -283,7 +300,7 @@ void parse_opts(void)
 
 void parse_dhcp(void)
 {
-	if (!DHCP_P->tid == HTONS(dhcp_state.transaction_id))
+	if (DHCP_P->tid != dhcp_state.transaction_id)
 		return;
 	if (DHCP_P->cookie[0] != 0x63 || DHCP_P->cookie[1] != 0x82 || DHCP_P->cookie[2] != 0x53 || DHCP_P->cookie[3] != 0x63)
 		return;
@@ -315,6 +332,18 @@ void parse_dhcp(void)
 		uip_ipaddr(&uip_hostaddr, dhcp_state.current_ip[0], dhcp_state.current_ip[1], dhcp_state.current_ip[2], dhcp_state.current_ip[3]);
 		uip_ipaddr(&uip_draddr, dhcp_state.router[0], dhcp_state.router[1], dhcp_state.router[2], dhcp_state.router[3]);
 		uip_ipaddr(&uip_netmask, dhcp_state.subnet[0], dhcp_state.subnet[1], dhcp_state.subnet[2], dhcp_state.subnet[3]);
+		/* T1 is optional. Without it the renewal time stays zero, which
+		 * makes dhcp_timer zero, and the callback then sends a REQUEST on
+		 * every pass through LEASING: client and server trade REQUEST and
+		 * ACK as fast as the round trip allows. RFC 2131 has the client
+		 * renew at half the lease when the server does not say, and if
+		 * there is no lease either, pick something rather than zero. Only
+		 * filled in when absent, so a server that asks for a short renewal
+		 * still gets it. */
+		if (!dhcp_state.renewal)
+			dhcp_state.renewal = dhcp_state.lease / 2;
+		if (!dhcp_state.renewal)
+			dhcp_state.renewal = 60;
 		dhcp_state.state = DHCP_LEASING;
 		dhcp_state.ticks = SYS_TICK_HZ;
 		dhcp_state.dhcp_timer = dhcp_state.renewal > 0xffff ? 0xffff : dhcp_state.renewal;
@@ -324,6 +353,12 @@ void parse_dhcp(void)
 
 void dhcp_start(void) __banked
 {
+	/* Starting twice would leave the first socket bound: uip_udp_new() takes
+	 * the next free slot while the old one keeps port 68, and dhcp_callback()
+	 * matches on that port rather than on the connection, so every leftover
+	 * runs the state machine too and the timers count down once per socket. */
+	if (dhcp_state.state != DHCP_OFF)
+		dhcp_stop();
 	uip_ipaddr(server, 255,255,255,255);
 	dhcp_state.conn = uip_udp_new(&server, HTONS(DHCPC_SERVER_PORT));
 	dhcp_state.current_ip[0] = dhcp_state.current_ip[1] = dhcp_state.current_ip[2] = dhcp_state.current_ip[3] = 0;
@@ -334,15 +369,18 @@ void dhcp_start(void) __banked
 		return;
 	}
 	get_random_32();
-	dhcp_state.transaction_id = SFR_DATA_U32;
+	// Workaround SDCC bug 4070: dhcp_state.transaction_id = SFR_DATA_U32;
+	__xdata uint8_t * tid = &dhcp_state.transaction_id;
+	*tid++ = SFR_DATA_24;
+	*tid++ = SFR_DATA_16;
+	*tid++ = SFR_DATA_8;
+	*tid = SFR_DATA_0;
 	dhcp_state.state = DHCP_START;
-	print_string("dhcp_start done\n");
 }
 
 
 void dhcp_stop(void) __banked
 {
-	print_string("dhcp_stop called\n");
 	uip_udp_remove(dhcp_state.conn);
 	dhcp_state.state = DHCP_OFF;
 }

doc/CpuPort.md

@@ -64,3 +64,33 @@ Writing 0x1 to register 0x7850 will transmit the frame. The Ethernet frame
 checksum and the TCP checksum are automatically calculated (offloaded) by the
 ASIC before transmitting on the wire.
 
+
+## The RTL tag words
+
+The frame header uses the Realtek Remote Control Protocol (RRCP) format or
+the like.
+
+The `flags` word:
+
+```
+bit15 EFID_EN | 14:12 EFID | 11 PRI_EN | 10:8 PRI |
+bit7  KEEP    | 6 VSEL     | 5 LEARN_DIS         | 4:0 VIDX
+```
+
+All fields are in network byte order.
+
+* `EFID_EN`, `EFID`: look the destination up under this filtering ID
+  instead of the port's own
+* `PRI_EN`, `PRI`: force the given priority on the frame
+* `KEEP`: keep the 802.1Q tagging of the frame exactly as injected,
+  bypassing the egress tagging rules of the port
+* `VSEL`, `VIDX`: classify the frame into the VLAN at this index of the
+  VLAN table
+* `LEARN_DIS`: do not learn the source address from this frame
+
+The `pmask` word: bit 15 is `ALLOW`, bits 14 to 0 are a port mask.
+
+* `ALLOW` clear: the mask is the egress set, the frame goes to exactly
+  the ports given
+* `ALLOW` set: the ASIC looks the destination up as usual and the mask
+  only limits which ports the result may use

doc/devices/2M-PCB23-V3_2.md

@@ -0,0 +1,40 @@
+### 2M-PCB23-V3.2
+
+## Brands
+|Brand|Type|Managed|PCB|Flash|Chip RTL|
+|---|---|---|---|---|---|
+| keepLINK | KP-9000-9XHML-X | Yes|  2M-PCB23-V3.2 | 2M (Winbond 25Q) | |
+
+The original web interface reports this board as hardware version V3.2
+(original firmware V100.9.25, January 2026).
+
+## PCB
+
+<img src="photos/2M-PCB23-V3.2-managed/2M-PCB23-V3.2-top.jpeg" width="300" />
+
+## Compared to V3.1
+
+The component placement matches [2M-PCB23-V3.1](2M-PCB23-V3_1.md): same
+positions for the flash (U8), the T7/T8/T9/T10 headers, the SFP cage and its
+LED, and the unpopulated U7/U9 footprints. Build with
+`MACHINE=KP_9000_9XHML_X_V3_2`, which uses the V3.1 machine definition and
+only differs in the reported name.
+
+## Tested
+
+Installed from the original firmware through its web interface with
+`installer/output/rtlplayground_oem_upgrade.bin`, then:
+
+- RJ45 ports link at 2.5G; LEDs: orange at 2.5G, green below
+- SFP port: module detected with vendor/model/serial and DOM readings
+  (temperature, Vcc, TX bias, TX/RX power), link up at 10G
+- factory MAC read from flash (0x1FC000)
+- reset button (GPIO48): held for more than 10 s it restores the default config
+
+## Flash access
+
+Reading the flash in-circuit with a SOIC-8 clip did not work: the chip ID
+comes back as `EF FF FF` (only the manufacturer byte is right) and reads
+return 0xff, the same as on a V3.1 board. The switch chip is powered through
+the clip and keeps driving the SPI lines. Make sure a way back is acceptable
+before installing, or hold the switch chip in reset while reading.

doc/devices/2M-PCB43-V1.1.md

@@ -0,0 +1,55 @@
+# 2G040210GSM
+
+The following is a documentation for the managed switch marked as `2G040210GSM`
+and sold by Mokerlink.
+
+### Label specifications
+
+- **Name**: 4-port 2.5G Web Managed Switch
+- **Ports**:
+  - 4 × RJ45: 10/100/1000/2500 Mbps
+  - 2 × SFP+: 1000 / 2500 / 10000 Mbps
+- **Power**: 12V DC, 1A barrel connector 
+
+### What works
+The device is fully supported:
+- All 4 2.5GBASE-T RJ45 ports work at 10/100/1000/2500 Mbps
+- The SFP+ port supports 1G, 2.5G and 10G modules 
+- LEDs work with the same indiciations as the OEM firmware (use KP_9000_6XHML_X2_V1_1 in machine.h if building yourself or the corresponding pre-compiled binary)
+- untested due to missing Hardware: SFP+ ports equipped with 1G or 2.5G SFPs.
+
+### Hardware overview
+Front
+
+<img src="photos/2M-PCB43-V1.1-managed/2M-PCB43-V1.1-front.jpeg" width="300" />
+
+Label
+
+<img src="photos/2M-PCB43-V1.1-managed/2M-PCB43-V1.1-label.jpeg" width="300" />
+
+### PCB overview
+
+**Board markings**
+- Top silkscreen: 2M-PCB43-V1.1
+
+Top side
+
+<img src="photos/2M-PCB43-V1.1-managed/2M-PCB43-V1.1-top.jpeg" width="300" />
+
+Bottom
+
+<img src="photos/2M-PCB43-V1.1-managed/2M-PCB43-V1.1-bottom.jpeg" width="300" />
+
+### J1, serial console
+
+| `J8` pin | Signal      |
+| -------- | ----------- |
+| 1        | RX (Input)  |
+| 2        | TX (Output) |
+| 3        | GND         |
+| 4        | 3V3         |
+
+
+## Power supply
+
+Input power is delivered via barell plug, `12V 1A` adapter was provided.

doc/devices/2M-PCB51-ML-V1_1.md

@@ -0,0 +1,32 @@
+# MokerLink POE-2G080110GS
+
+The `POE-2G080110GS` is an unmanaged 8x2.5G RJ45 and 1xSFP+ PoE switch sold by Mokerlink. There is also a `POE-2G080110GSM` managed version of the switch which may be similar but this has not been verified on actual hardware.
+
+## Brands
+| Brand  | Type             |Managed| PCB              | Flash           | Chip RTL      |
+|--------|------------------|-------|------------------|-----------------|---------------|
+| Mokerlink | POE-2G080110GS | No | 2M-PCB51-ML-V1.1 | 4MB (W25Q32JV) | 8373N + 8224N |
+
+## Hardware overview
+Front
+
+<img src="photos/POE-2G080110GS/POE-2G080110GS-front.jpg" width="300" />
+
+Label
+
+<img src="photos/POE-2G080110GS/POE-2G080110GS-label.jpg" width="300" />
+
+The stock firmware from a POE-2G080110GS device had a sha256sum of `4c280853465eaad80e1772075c0f2d29c11fb8c561547f06353d3a5443c388e9`.
+
+### PCB
+
+Top silkscreen is marked `2M-PCB51-ML-V1.1`. PoE is provided by RTL8238C. Flash chip is 4 MB Winbond 25Q32JV (U8).
+
+<img src="photos/POE-2G080110GS/POE-2G080110GS-pcb.jpg" width="300" />
+
+> [!CAUTION]
+> This device operates on mains voltage, which can be a dangerous or potentially lethal hazard. Even after the device is unplugged, high-voltage capacitors can remain charged afterward and may still shock you. Do not attempt to open/disassemble a mains powered device unless you understand how to do so safely. Also, opening the device may void your warranty.
+
+## Notes
+
+The stock firmware blinks both the 2.5G and 1G LEDs on activity, despite the front of the device indicating that each LED should be independent. The `POE_2G080110GS` machine config behaves as the front of the device indicates (and what seems more logical) -- each port LED turns on and blinks independently.

doc/devices/F7008-2.5.md

@@ -0,0 +1,70 @@
+# F7008-2.5
+
+Documentation for the unmanaged 8 + 1 switch sold as `7018-2.5G` by Guangnianwei
+(光年微), board marking `F7008-2.5`, PCB `F7008-2.5GPOE-V1.2`.
+
+### Brands
+
+| Brand | Type | Managed | PCB | Flash | Chip RTL |
+|-------|------|---------|-----|-------|----------|
+| Guangnianwei (光年微) | 7018-2.5G | No | F7008-2.5GPOE-V1.2 | W25Q64JVSSIQ | 8373N + 8224N |
+
+### What works
+
+- All eight 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps
+- SFP+ port with 1G/2.5G/10G modules
+- LEDs of the eight RJ45 ports
+
+### Not verified
+
+- The LED pads for the SFP+ cage are not mapped yet. The SFP+ lamps are left
+  undriven, so an inserted module lights nothing.
+- The UART header footprint is present but unpopulated, and no boot log could be
+  captured from it, so the baud rate is unknown. There are most likely
+  unpopulated 0-Ohm resistors next to the header; bridging those should bring
+  the console to life.
+
+### Build target
+
+```
+make MACHINE=F7008_2_5
+```
+
+### LED wiring
+
+Measured pad to lamp map (`led_mux` index -> lamp):
+
+| Port | green lamp | yellow lamp |
+|------|-----------|-------------|
+| 1 | pad 0  | pad 1  |
+| 2 | pad 2  | pad 3  |
+| 3 | pad 4  | pad 5  |
+| 4 | pad 6  | pad 8  |
+| 5 | pad 9  | pad 10 |
+| 6 | pad 12 | pad 15 |
+| 7 | pad 18 | pad 21 |
+| 8 | pad 24 | pad 25 |
+
+Pads 7, 11, 13, 14, 16, 17, 19, 20, 22, 23, 26 and 27 do not drive an RJ45 lamp.
+
+The front panel is silkscreened `2.5G: Green / 10/100M: Yellow`, and the target
+follows it: the green lamp is on while the port is linked at 2.5G, the yellow
+lamp blinks while data is flowing.
+
+### PCB overview
+
+The board is marked `F7008-2.5GPOE-V1.2`.
+
+Top side:
+
+<img src="photos/F7008-2.5/PCB-top.jpg" width="600" />
+
+Bottom side:
+
+<img src="photos/F7008-2.5/PCB-bottom.jpg" width="600" />
+
+### Hardware notes
+
+- 4 x `RT4802SNE` magnetics
+- Unpopulated UART header footprint, next to the magnetics
+- Power input 12V 1A, 180 x 84 x 29 mm metal case

doc/devices/FG-4GT-2SX_V2.0.md

@@ -0,0 +1,39 @@
+# FG-4GT-2SX_V2.0
+
+Following is documentation for unmanaged switch marked as `FG-4GT-2SX_V2.0`.
+
+Original software is running UART on 9600 baud rate.
+
+## Brands
+
+* Ruiying RY-4GT-2SX
+
+<img src="photos/FG-4GT-2SX_V2.0/RY-4GT-2SX_label.jpg" width="300" />
+
+## What works
+
+- All four 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps  
+- Both SFP ports supporting 1G, 2.5G and 10G modules 
+- LEDs
+
+## PCB overview
+
+**Board markings**  
+
+- Top silkscreen: FG-4GT-2SX_V2.0
+
+Front panel
+
+<img src="photos/FG-4GT-2SX_V2.0/chassis-front.jpg" width="300" />
+
+Top side
+
+<img src="photos/FG-4GT-2SX_V2.0/PCB-top.jpg" width="300" />
+
+Bottom
+
+<img src="photos/FG-4GT-2SX_V2.0/PCB-bottom.jpg" width="300" />
+
+## Power supply
+
+Input power is delivered via barell plug, `12V 1A` adapter was provided.

doc/devices/FG-8GT-1SX.md

@@ -0,0 +1,79 @@
+# FG-8GT-1SX
+
+Following is documentation for unmanaged switch marked as `FG-8GT-1SX`.
+
+Original software is running UART on 9600 baud rate.
+
+Using SPI clamp in-board is the only method for initial installation.
+
+### Brands
+
+| Brand   | Type       | Managed | PCB        | Flash       | Chip RTL      |
+|---------|------------|---------|------------|-------------|---------------|
+| Ruiying | RY-8GT-1SX | No      | FG-8GT-1SX | GD25Q80ESIG | 8373N + 8224N |
+
+### What works
+
+- All eight 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps
+- SFP port with 1G/2.5G/10G modules
+- LEDs
+
+### PCB overview
+
+**Board markings**
+
+- Top silkscreen: FG-8GT-1SX
+
+Top side:
+
+<img src="photos/FG-8GT-1SX/PCB-top.jpg" width="600" />
+
+Bottom:
+
+<img src="photos/FG-8GT-1SX/PCB-bottom.jpg" width="600" />
+
+### Serial console
+
+The PCB has five unpopulated through-holes near the SoC, with a white rectangle surrouding them, labeled as `J18` and a triangle points to the square shaped first pin.
+
+This is where the "expected" UART header should be soldered at, with redundant 3V3 VCC, but also with missing 0Ω resistors between TX/RX and SoC, so simply soldering a header would not work. One need also add the missing resistors or solder the pads together, while making sure not connecting unrelated pads.
+
+Numbered from the triangle, the header pinout is:
+
+| Position | Signal | GPIO   | Status      |
+|----------|--------|--------|-------------|
+| 1        | GND    | GND    | Internal    |
+| 2        | TX     | GPIO31 | Unconnected |
+| 3        | RX     | GPIO32 | Unconnected |
+| 4        | 3V3    | -      | Internal    |
+| 5        | 3V3    | -      | Internal    |
+
+There're four resistor pads near the header.
+
+| Resistor ID | SoC Side    | Header Side |
+|-------------|-------------|-------------|
+| R1240       | TX / GPIO31 | Pin 2       |
+| R1243       | 3V3         | -           |
+| R1242       | 3V3         | Pin 3       |
+| R1241       | RX / GPIO32 | -           |
+
+To get TX working, solder a 0Ω resistor between the pads for R1240 or solder them together.
+
+For RX However, the designer certainly made a mistake, as the SoC-side lines to the resistor expected for Rx (R1242) and 3V3 (R1241) are swapped. For RX to work, the R1241 SoC side and R1242 header side shall be connected, so either:
+
+- Solder: R1241 SoC side -> R1241 header side -> R1242 header side
+- Jump wire: R1241 SoC side -> R1242 header side
+
+Be sure not to bring R1242 SoC side to the connection as that would wire Rx to 3v3.
+
+A complete working serial header should look like following on this PCB:
+
+<img src="photos/FG-8GT-1SX/Serial.png" width="600" />
+
+- **Settings**: 115200 baud / 8N1 / 3.3V TTL
+- Connect a USB-TTL adapter: adapter GND → pin 1, RX → pin 2, TX → pin 3
+
+### Power supply
+
+Input power is delivered via barell plug, `12V 1A` adapter was provided.
+

doc/devices/HASIVO_S1100WP_8GT_1SX_SE.md

@@ -0,0 +1,75 @@
+# Hasivo S1100WP-8GT-1SX-SE
+
+RTL8373-based 8×2.5G PoE + 1×SFP switch.
+
+### Label specifications
+
+- **Manufacturer**: Hasivo
+- **Model**: S1100WP-8GT-1SX-SE
+- **Ports**:
+  - 8 × RJ45: 10/100/1000/2500 Mbps with PoE
+  - 1 × SFP: 1G / 2.5G / 10G
+- **Power input**: DC 52V 2.5A
+- **Stock firmware defaults**: IP 192.168.0.1, user/password `admin`/`admin`
+
+### What works
+
+- All eight 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps (PoE is not configurable via RTLPlayground)
+- SFP port supporting 1G, 2.5G and 10G modules
+- LEDs: green (2.5G) and amber (1G/100M/10M) per copper port; combined link/act on the SFP port
+
+### Photos
+
+Front panel:
+
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/front.jpg" width="600" />
+
+Label:
+
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/label.jpg" width="600" />
+
+### PCB overview
+
+Top side:
+
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/pcb_top.jpg" width="600" />
+
+Bottom side:
+
+<img src="photos/HASIVO_S1100WP-8GT-1SX-SE/pcb_bottom.jpg" width="600" />
+
+### Port layout
+
+| Logical port | Physical port | Type   |
+|--------------|---------------|--------|
+| 1-8          | 1-8           | Copper |
+| 9            | 9             | SFP    |
+
+### LED configuration
+
+Copper ports use LED SET0, the SFP port uses LED SET1.
+
+| SET  | LED0                                          | LED2                                                 |
+|------|-----------------------------------------------|------------------------------------------------------|
+| SET0 | Green — lights on 2.5G link with activity     | Amber — lights on 1G / 100M / 10M link with activity |
+| SET1 | All speeds — lights on any link with activity | —                                                    |
+
+### SFP GPIO assignments
+
+| SFP (logical 9) | pin_detect (ModAbs) | pin_los | pin_tx_disable | SerDes | I2C SDA         | I2C SCL             |
+|-----------------|---------------------|---------|----------------|--------|-----------------|---------------------|
+| SFP             | GPIO30_ACL_BIT3_EN  | GPIO37  | GPIO_NA        | SDS1   | GPIO39_I2C_SDA4 | GPIO40_I2C_SCL3_MDC1 |
+
+### Machine configuration
+
+- `reset_pin`: GPIO54_ACL_BIT2_EN
+- High LEDs (pads 27-29): mux = `LED_27 | LED_28_SYS | LED_29`, enable = `LED_28_SYS | LED_29`
+
+### PoE
+
+The 8 copper ports support PoE powered by a DC 52V 2.5A input. Power management is handled by two HS104PTI chipsets over I2C (GPIO47_I2C_SDA0, GPIO46_I2C_SCL0):
+
+* Chip 1 (I2C address 0x1A): 2.5G Ports 1–4
+* Chip 2 (I2C address 0x2A): 2.5G Ports 5–8
+
+Note: The current implementation does not yet support PoE management. Consequently, PoE currently operates in standalone mode without software control.

doc/devices/HYWS-SGT0108S.md

@@ -0,0 +1,64 @@
+# Lianguo HYWS-SGT0108S
+
+Following is documentation for unmanaged switch marked as `HYWS-SGT0108S`.
+
+Original software is running UART on 9600 baud rate. Output is very minimal.
+
+Using SPI clamp in-board is the only method for initial installation and update.
+
+Stock flash chip is 512KB in size. Consider replacing for update through Web UI.
+
+- Header for uart is clearly identified.
+- The red LED act as a powered-on LED.
+- There is no SYS LED.
+- There is a footprint for a Reset button. Unpopulated. Unclear if routed back to RTL8373.
+
+### Label specifications
+
+- **Name**: 2.5G Ethernet Switch 8+1
+- **Model**: HYWS-SGT0108S
+- **Ports**:  
+  - 8 × RJ45: 10/100/1000/2500 Mbps  
+  - 1 × SFP: 1000 / 2500 / 10000 Mbps  
+
+### What works
+
+- All eight 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps  
+- SFP port supporting 1G, 2.5G and 10G modules 
+- RJ45 LEDs (Blue+White)
+- SFP Single LED (Blue)
+
+### Assembled unit
+
+Top side
+
+<img src="photos/HYWS-SGT0108S-unmanaged\Assembled-top.jpg" width="300" />
+
+Front
+
+<img src="photos/HYWS-SGT0108S-unmanaged\Assembled-front.jpg" width="300" />
+
+Bottom
+
+<img src="photos/HYWS-SGT0108S-unmanaged\Assembled-bottom.jpg" width="300" />
+
+### PCB overview
+
+**Board markings**  
+- Top silkscreen: 2G5F_20G_V1.01 / 2023-09-28  
+
+Top side
+
+<img src="photos/HYWS-SGT0108S-unmanaged\PCB-top.jpg" width="300" />
+
+Bottom
+
+<img src="photos/HYWS-SGT0108S-unmanaged\PCB-bot.jpg" width="300" />
+
+Original SPI Flash Chip
+
+<img src="photos/HYWS-SGT0108S-unmanaged\og_spi_flash.jpg" width="300" />
+
+## Power supply
+
+Input power is delivered via barell plug, `12V 1A` adapter was provided.

doc/devices/KP-9000-6XH-X2.md

@@ -1,17 +1,36 @@
-# Keeplink KP-9000-6XH-X2
+# Keeplink KP-9000-6XH-X2 / KP-9000-6XHML-X2
 
-Following is documentation for unmanaged switch marked as `KP-9000-6XH-X2`.
+Following is documentation for switches marked as `KP-9000-6XH-X2` or
+`KP-9000-6XHML-X2`.
 
 Using SPI clamp in-board is the only method for initial installation.
 
 ### Label specifications
 
 - **Name**: 4X 2.5G RJ45 Port + 2 X 10G SFP+ Port  
-- **Model**: KP-9000-6XH-X2  
+- **Model**: KP-9000-6XH-X2 / KP-9000-6XHML-X2
 - **Ports**:  
   - 4 × RJ45: 10/100/1000/2500 Mbps  
   - 2 × SFP+: 1000 / 2500 / 10000 Mbps  
 
+### Machine target
+
+These devices exist with different PCB revisions. Select the machine target by
+the PCB silkscreen, not by the label on the case. The `6XH` / `6XHML`
+distinction appears to be a stock firmware, SKU or label difference, not a
+reliable indicator of PCB wiring. The PCB revision defines the hardware layout.
+
+| PCB silkscreen | Known labels / devices | Recommended machine target | Equivalent target | Legacy target |
+| --- | --- | --- | --- | --- |
+| `2M-PCB43-V1.1` | Mokerlink 2G040210GSM web-managed 4+2 switch | `MACHINE_KP_9000_6XHML_X2_V1_1` | `MACHINE_KP_9000_6XH_X2_V1_1` | `MACHINE_KP_9000_6XHML_X2` |
+| `2M-PCB43-V1.2` | `KP-9000-6XHML-X2` | `MACHINE_KP_9000_6XHML_X2_V1_2` | `MACHINE_KP_9000_6XH_X2_V1_2` | `MACHINE_KP_9000_6XHML_X2` |
+| `2M-PCB43-V2.1` | `KP-9000-6XH-X2`, `KP-9000-6XHML-X2` | `MACHINE_KP_9000_6XH_X2_V2_1` or `MACHINE_KP_9000_6XHML_X2_V2_1` | same V2.1 layout | `MACHINE_KP_9000_6XH_X2` |
+
+The V1.1 and V1.2 boards currently use the same V1.x GPIO, SFP, port and LED
+layout. The V2.1 board uses a different V2.1 layout with custom LED muxing.
+Legacy targets are preserved for compatibility with already-tested devices, but
+new builds should prefer the explicit PCB-revision targets.
+
 ### What works
 
 - All four 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps
@@ -19,7 +38,7 @@ Using SPI clamp in-board is the only method for initial installation.
 - LEDs
 - untested due to missing Hardware: SFP+ ports equipped with 1G or 2.5G SFPs.
 
-### Hardware overview
+### Hardware overview: 2M-PCB43-V2.1
 
 Front side:
 
@@ -44,6 +63,24 @@ Bottom
 
 <img src="photos/2M-PCB43-V2.1-unmanaged/2M-PCB43-V2.1-bottom.jpg" width="600" />
 
+### Hardware overview: 2M-PCB43-V1.1 / V1.2
+
+The V1.1 board has been reported in the Mokerlink 2G040210GSM web-managed 4+2
+switch. The V1.2 board has been seen in managed `KP-9000-6XHML-X2` devices.
+Both use the same V1.x layout.
+
+Label:
+
+<img src="photos/KP-9000-6XHML-X2/label.jpg" width="600" />
+
+Top side:
+
+<img src="photos/KP-9000-6XHML-X2/pcb_top.jpg" width="600" />
+
+Bottom:
+
+<img src="photos/KP-9000-6XHML-X2/pcb_bottom.jpg" width="600" />
+
 ## Reset Button
 
 There's an unpopulated Reset button on the front left side of the PCB.
@@ -54,4 +91,3 @@ The front case has already the hole in the metal case, you just have to punch a
 ## Power supply
 
 Input power is delivered via barell plug, `12V 1A` adapter was provided.
-

doc/devices/ONT-S207CW-62TS-SE.md

@@ -0,0 +1,122 @@
+# ONT-S207CW-62TS-SE / Binardat 2G06-04210GSM / Binardat 2G06-04210GS
+
+## Overview
+
+ONT-S207CW-62TS-SE, Binardat 2G06-04210GSM (managed), and Binardat 2G06-04210GS (unmanaged) are **switches with identical hardware**:
+- **CPU:** RTL8372N (confirmed via serial: "Detecting CPU: RTL8372N")
+- **Flash:** GD25Q128E (16MB)
+- **Ports:** 4x 2.5G RJ45 + 2x 10G SFP+
+- **Console:** 115200 baud (RTLPlayground firmware) / 9600 baud (stock firmware)
+
+**Note:** These devices are **RTL8372N-based** with **LAN ports mounted upside-down on the PCB**, requiring a custom configuration. The `MACHINE_ONT_S207CW_62TS_SE` definition uses a **custom configuration** with:
+- Corrected port mapping (physical ports 1-4 = RJ45, 5-6 = SFP)
+- Optimized LED sets for different port wiring (RJ45 Ports 1-2 have reversed LED wiring)
+- Custom LED mux configuration
+
+## Device Photos
+
+### Binardat 2G06-04210GSM
+
+**Front View:**
+<img src="photos/ONT-S207CW-Binardat-2G06-04210GSM/binardat-2g06-04210gsm-front.jpg" width="400" />
+
+**Back View:**
+<img src="photos/ONT-S207CW-Binardat-2G06-04210GSM/binardat-2g06-04210gsm-back.jpg" width="400" />
+
+**PCB View:**
+<img src="photos/ONT-S207CW-Binardat-2G06-04210GSM/binardat-2g06-04210gsm-pcb.jpg" width="400" />
+
+*Photos courtesy of [andreas5232](https://github.com/andreas5232) from [emesix/ONT-S207CW-62TS-SE#1](https://github.com/emesix/ONT-S207CW-62TS-SE/issues/1)*
+
+## Hardware Specification
+
+| Feature | Value |
+|---|---|
+| **CPU** | RTL8372N |
+| **Flash** | GD25Q128E (16MB) |
+| **RAM** | Integrated in RTL8372N |
+| **RJ45 Ports** | 4x 2.5GBase-T (Ports 1-4) |
+| **SFP+ Ports** | 2x 10G (Ports 5-6) |
+| **Console** | UART (115200 baud for RTLPlayground, 9600 baud for stock) |
+| **Stock Web UI IP** | 192.168.2.1 |
+| **Loader Mode IP** | 192.168.10.247 |
+
+## Port Layout
+
+```
+┌─────────────────────────────────────────────┐
+│  ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐   ┌─────┐ ┌─────┐  │
+│  │RJ45 │ │RJ45 │ │RJ45 │ │RJ45 │   │SFP+ │ │SFP+ │  │
+│  │  1  │ │  2  │ │  3  │ │  4  │   │  5  │ │  6  │  │
+│  └─────┘ └─────┘ └─────┘ └─────┘   └─────┘ └─────┘  │
+│                                                     │
+│  [System LEDs]                                      │
+└─────────────────────────────────────────────┘
+```
+
+## LED Behavior
+
+### RJ45 Ports (Physical 1-4)
+
+| LED Color | Speed |
+|---|---|
+| **Green** | 2.5G |
+| **Orange** | 1G / 100M / 10M |
+| **Off** | No link |
+
+### SFP+ Ports (Physical 5-6)
+
+| LED Color | Speed |
+|---|---|
+| **Green** | 10G |
+| **Orange** | 2.5G / 1G |
+| **Off** | No link / No SFP module |
+
+## Port to Logical Mapping
+
+Custom mapping for ONT-S207CW-62TS-SE:
+
+| Physical Port | Logical Port | Type | LED Set |
+|---|---|---|---|
+| 1 | 7 | RJ45 | 2 |
+| 2 | 6 | RJ45 | 2 |
+| 3 | 5 | RJ45 | 0 |
+| 4 | 4 | RJ45 | 0 |
+| 5 | 3 | SFP+ (SDS0) | 3 |
+| 6 | 8 | SFP+ (SDS1) | 3 |
+
+**Note:** Ports 1-2 (RJ45) have reversed LED wiring and use LED-Set 2. SFP Ports 5-6 use LED-Set 3 to account for wiring differences.
+
+## Flashing Instructions
+
+See the [README.md](../../README.md) for general flashing instructions.
+
+## Stock Firmware Information
+
+| Property | Value |
+|---|---|
+| **Default IP** | 192.168.2.1 (ONT) / 192.168.10.247 (Loader Mode) |
+| **Default Login** | admin/admin (may vary by OEM) |
+| **Console Baud** | 9600 (stock) / 115200 (RTLPlayground) |
+| **CPU String** | "RTL8372N" |
+| **Loader Mode IP** | 192.168.10.247 |
+
+## Configuration Details
+
+- **CPU:** RTL8372N
+- **SFP:** SDS0 on logical port 3 (GPIO37), SDS1 on logical port 8 (GPIO38)
+- **Port Mapping:** Physical 1-4 → Logical 7-4, Physical 5-6 → Logical 3,8
+- **LED Wiring:** RJ45 Ports 1-2 and SFP Port 6 have reversed LED pins (orange/green swapped)
+- **LED Sets:** Set 0 for RJ45 Ports 3-4, Set 1 unused, Set 2 for RJ45 Ports 1-2, Set 3 for SFP Ports 5-6
+
+## Notes
+
+- ONT-S207CW-62TS-SE, Binardat 2G06-04210GSM (managed), and Binardat 2G06-04210GS (unmanaged) are **RTL8372N-based** with **LAN ports mounted upside-down on the PCB**
+- Web UI shows correct physical port order (1-2-3-4 for RJ45, 5-6 for SFP)
+- Loader Mode always remains accessible at `192.168.10.247` for recovery
+- Serial console: 9600 baud (stock) → 115200 baud (RTLPlayground)
+
+## References
+
+- [GitHub Issue: emesix/ONT-S207CW-62TS-SE#1](https://github.com/emesix/ONT-S207CW-62TS-SE/issues/1) - Original photos and discussion
+- [PR: logicog/RTLPlayground#465](https://github.com/logicog/RTLPlayground/pull/465) - Feedback and improvements

doc/devices/PB-2132.md

@@ -0,0 +1,53 @@
+# IG108
+
+Following is documentation for unmanaged switch marked as `IG108`.
+
+Original software is running UART on 9600 baud rate.
+
+Using SPI clamp in-board is the only method for initial installation.
+
+### Brands
+
+| Brand   | Type       | Managed | PCB        | Flash       | Chip RTL      |
+|---------|------------|---------|------------|-------------|---------------|
+| Goalake | IG108      | No      | PB-2132    | cFeon Q32A  | 8373N + 8224N |
+| Netcore | GS9        | No      | PB-2132    | cFeon Q32A  | 8373N + 8224N |
+
+### What works
+
+- All eight 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps
+- SFP port with 1G/2.5G/10G modules
+- LEDs
+
+### PCB overview
+
+**Board markings**
+
+- Top silkscreen: PB-2132
+
+Front Goalake:
+
+<img src="photos/PB-2132/case.jpg" width="600" />
+
+Label Goalake: 
+
+<img src="photos/PB-2132/label.jpg" width="600" />
+
+Top side:
+
+<img src="photos/PB-2132/PCB-top.jpg" width="600" />
+
+Bottom:
+
+<img src="photos/PB-2132/PCB-bottom.jpg" width="600" />
+
+### Serial console
+
+The PCB has unpopulated through-holes near the SFP Port, with description of each pin, works out of the box.
+
+- **Settings**: 115200 baud / 8N1 / 3.3V TTL
+
+### Power supply
+
+Input power is delivered via barell plug, `12V 1A` adapter was provided.
+

doc/devices/PCB-K0402WS-V2.0.md

@@ -0,0 +1,97 @@
+Hisource Hi-K0402WS V2
+
+RTL8372-based 4×2.5G + 2×SFP+ unmanaged switch.
+
+Using SPI clamp in-board is the only method for initial installation.
+
+### Label specifications
+
+- **Manufacturer**: HISOURCE
+- **Model**: Hi-K0402WS V2
+- **Ports**:
+  - 4 × RJ45: 10/100/1000/2500 Mbps
+  - 2 × SFP+: 1G / 2.5G / 10G
+
+### What works
+
+- All four 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps
+- Both SFP+ ports supporting 1G, 2.5G and 10G modules
+- LEDs: amber (2.5G) and green (1G/100M/10M) per copper port; combined link/act on SFP ports
+
+### PCB overview
+
+**Board markings**
+- PCB-K0402WS-V2.0
+- DIP-K0402WS-V2.0
+
+**Key components**
+- U1: SPI NOR flash, 2 MiB
+- S1: unpopulated slide switch footprint (three through-holes used as serial console)
+
+Front panel
+
+<img src="photos/PCB-K0402WS-V2.0/chassis-front.jpg" width="400" />
+
+Bottom label
+
+<img src="photos/PCB-K0402WS-V2.0/chassis-bottom.jpg" width="400" />
+
+Top side (PCB)
+
+<img src="photos/PCB-K0402WS-V2.0/PCB-top.jpg" width="300" />
+
+### Port layout
+
+| Front panel position | Logical port | Physical port | Type    |
+|----------------------|--------------|---------------|---------|
+| SFP left             | 8            | 5             | SFP+    |
+| RJ45 1               | 4            | 1             | Copper  |
+| RJ45 2               | 5            | 2             | Copper  |
+| RJ45 3               | 6            | 3             | Copper  |
+| RJ45 4               | 7            | 4             | Copper  |
+| SFP right            | 3            | 6             | SFP+    |
+
+### Serial console
+
+The PCB has three unpopulated through-holes intended for a slide switch, directly connected to UART0.
+Numbered from the left (SFP port side), the pinout is:
+
+| Position (left→right) | Signal | GPIO                     |
+|-----------------------|--------|--------------------------|
+| 1 (leftmost)          | RX     | GPIO32\_UART0\_RX (32)   |
+| 2 (middle)            | GND    | GND                      |
+| 3 (rightmost)         | TX     | GPIO31\_UART0\_TX (31)   |
+
+- **Settings**: 115200 baud / 8N1 / 3.3V TTL
+- Connect a USB-TTL adapter: adapter TX → pin 1, GND → pin 2, adapter RX → pin 3
+
+### LED configuration
+
+Copper ports use LED SET0, SFP ports use LED SET1.
+
+| SET  | LED0                                             | LED2                                              |
+|------|--------------------------------------------------|---------------------------------------------------|
+| SET0 | Amber — lights on 2.5G link                      | Green — lights on 1G / 100M / 10M link            |
+| SET1 | All speeds — lights on any link with activity    | —                                                 |
+
+LED pad to physical port mapping:
+
+| GPIO pads | Port                    |
+|-----------|-------------------------|
+| GPIO8–11  | Physical port 5 (left SFP)  |
+| GPIO12–14 | Physical port 1 (RJ45 1)    |
+| GPIO15–17 | Physical port 2 (RJ45 2)    |
+| GPIO18–20 | Physical port 3 (RJ45 3)    |
+| GPIO21–23 | Physical port 4 (RJ45 4)    |
+| GPIO24–27 | Physical port 6 (right SFP) |
+
+### SFP GPIO assignments
+
+| SFP              | pin\_detect (ModAbs)        | pin\_los               | SerDes | I2C SDA              | I2C SCL                  |
+|------------------|-----------------------------|------------------------|--------|----------------------|--------------------------|
+| Left (logical 8) | GPIO30\_ACL\_BIT3\_EN       | GPIO37                 | SDS1   | GPIO39\_I2C\_SDA4    | GPIO40\_I2C\_SCL3\_MDC1  |
+| Right (logical 3)| GPIO50\_I2C\_SCL2\_UART1\_TX | GPIO51\_I2C\_SDA2\_UART1\_RX | SDS0 | GPIO41\_I2C\_SDA3\_MDIO1 | GPIO40\_I2C\_SCL3\_MDC1 |
+
+GPIO assignments were verified by observing GPIO state changes during SFP module insertion/removal
+and cross-checked against an original firmware register dump.
+`pin_tx_disable` is GPIO\_NA on both ports (original firmware keeps all GPIOs as inputs).

doc/devices/PCB-K0402WS-V3.0.md

@@ -19,6 +19,9 @@ of the device just above the big label, might be covered by a QC sticker.
 
 <img src="photos/PCB-K0402WS-V3.0/Ztyuav_Z-QWYT0402_label.jpg" width="300" />
 
+* Siscolink SL-G0402F
+
+<img src="photos/PCB-K0402WS-V3.0/Siscolink SL-G0402F.jpg" width="300"/>
 ### Programming
 
 Using SPI clamp in-board is the only method for initial installation.

doc/devices/STEAMEMO_IG204_V1.md

@@ -0,0 +1,43 @@
+# Steamemo IG204-V1
+
+Following is documentation for unmanaged switch marked as `IG204-V1`.
+
+Using SPI clamp in-board is the only method for initial installation.
+
+### Label specifications
+
+- **Name**: 2.5G Ethernet Switch  
+- **Model**: IG204 V1
+- **Ports**:  
+  - 4 × RJ45: 10/100/1000/2500 Mbps  
+  - 2 × SFP: 1000 / 2500 / 10000 Mbps  
+
+### What works (expected from label + similar devices)
+
+- Four 2.5GBASE-T RJ45 ports at 10/100/1000/2500 Mbps  
+- Two SFP ports supporting 1G, 2.5G and 10G modules 
+- LEDs
+
+### PCB overview
+
+**Board markings**  
+- Top silkscreen: PB-2131
+
+
+Top side
+
+<img src="photos/STEAMEMO_IG204_V1/PCB-top.jpg" width="600" />
+
+### Connectors
+### T7, serial console
+
+| `T7` pin | Signal      |
+| -------- | ----------- |
+| 1        | TX (Output) |
+| 2        | GND         |
+| 3        | RX (Input)  |
+| 4        | 3V3         |
+
+### Power supply
+
+Input power is delivered via barell plug, `12V 1A` adapter was provided.

doc/devices/SWTG018AS_A_V2_0.md

@@ -1,4 +1,11 @@
 # SWTG018AS-A V2.0
+## Brands
+| Brand   | Type             |Managed| PCB              | Flash           | Chip RTL      |
+|---------|------------------|-------|------------------|-----------------|---------------|
+| Ampcom  | SWTG018AS-A V2.0 | No    | SWTG018AS-A V2.0 | 2MB             | 8273N + 8224N |
+| Horaco  | HC-SWTGW218AS-A  | Yes   | SWTG018AS-A V2.0 | 2MB(25Q16JVSIQ) | 8273N + 8224N |
+| GoodTop | GT-ST018M        | Yes   | SWTG018AS-A V2.0 | ?               | 8273N + 8224N |
+
 
 The following is a documentation for the unmanaged switch marked as `SWTG018AS-A V2.0`.
 It is e.g. sold under the Ampcom brand, but no branh-markings are found on the device.

doc/devices/SWTG024AS-A-V2.0.1_4C_2SFP.md

@@ -0,0 +1,43 @@
+### SWTG024AS-A-V2.0.1_4C_2SFP
+It is highly similar to SWTG024AS-V2.0, with the only difference being the GPIO configuration for the SFP port.
+
+## Brands
+|Brand|Type|Managed|PCB|Flash|Chip RTL|
+|---|---|---|---|---|---|
+| Horaco | ZX-SG4T2 |  | PCB-SWTG024AS-A-V2.0.1_19650 | P25D40SH | ??? |
+
+### Label specifications
+
+- **Name**: 
+- **Ports**:
+  - 4 × RJ45: 10/100/1000/2500 Mbps
+  - 2 × SFP+: 1000 / 2500 / 10000 Mbps
+
+<img src="photos/SWTG024AS-A-V2_0_1_19650/horaco-zx-sg4t2-label.jpg" width="300" />
+
+### What works
+The device is fully supported:
+- ALL 2.5GBASE-T RJ45 ports work at 10/100/1000/2500 Mbps
+- The SFP+ port supports 1G, 2.5G and 10G modules 
+
+### PCB overview
+
+**Board markings**
+- Top silkscreen: PCB-SWTG024AS-A-V2.0.1_19650
+
+Top side
+
+<img src="photos/SWTG024AS-A-V2_0_1_19650/horaco-zx-sg4t2-pcb-top.jpg" width="300" />
+
+Bottom
+
+<img src="photos/SWTG024AS-A-V2_0_1_19650/horaco-zx-sg4t2-pcb-bottom.jpg" width="300" />
+
+### J1, serial console
+
+| `J1` pin | Signal      |
+| -------- | ----------- |
+| 1        | 3V3         |
+| 2        | GND         |
+| 3        | RX (Input)  |
+| 4        | TX (Output) |

doc/devices/SWTG024AS-A-V2.0.1_5C_1SFP.md

@@ -0,0 +1,44 @@
+### SWTG024AS-A-V2.0.1_5C_1SFP
+It is highly similar to SWTG024AS-V2.0, with the only difference being the GPIO configuration for the SFP port.
+
+## Brands
+|Brand|Type|Managed|PCB|Flash|Chip RTL|
+|---|---|---|---|---|---|
+| Horaco | HC-SWTGW215AS |  | PCB-SWTG024AS-A-V2.0.1_19650 | W25Q16JV | 8272N |
+
+### Label specifications
+
+- **Name**: 
+- **Ports**:
+  - 5 × RJ45: 10/100/1000/2500 Mbps
+  - 1 × SFP+: 1000 / 2500 / 10000 Mbps
+
+<!-- <img src="" width="300" /> -->
+
+### What works
+The device is fully supported:
+- ALL 2.5GBASE-T RJ45 ports work at 10/100/1000/2500 Mbps
+- The SFP+ port supports 1G, 2.5G and 10G modules 
+- LEDs work with the same indiciations as the OEM firmware
+
+### PCB overview
+
+**Board markings**
+- Top silkscreen: PCB-SWTG024AS-A-V2.0.1_19650
+
+Top side
+
+<!-- <img src="" width="300" /> -->
+
+Bottom
+
+<!-- <img src="" width="300" /> -->
+
+### J1, serial console
+
+| `J1` pin | Signal      |
+| -------- | ----------- |
+| 1        | 3V3         |
+| 2        | GND         |
+| 3        | RX (Input)  |
+| 4        | TX (Output) |

doc/devices/SWTG024AS-V2.0.md

@@ -0,0 +1,49 @@
+### SWTG024AS-V2.0
+
+## Brands
+|Brand|Type|Managed|PCB|Flash|Chip RTL|
+|---|---|---|---|---|---|
+| hongyavision | LG-SG5T1 | No | PCB-SWTG024AS-V2.0_16895 | 25Q40 | 8272 |
+
+### Label specifications
+
+- **Name**: 
+- **Ports**:
+  - 5 × RJ45: 10/100/1000/2500 Mbps
+  - 1 × SFP+: 1000 / 2500 / 10000 Mbps
+- **Power**: 12V DC, 1A  5525 connector 
+
+<img src="photos/SWTG024AS-V2.0/label.jpg" width="300" />
+
+### What works
+The device is fully supported:
+- ALL 2.5GBASE-T RJ45 ports work at 10/100/1000/2500 Mbps
+- The SFP+ port supports 1G, 2.5G and 10G modules 
+- LEDs work with the same indiciations as the OEM firmware
+- Online update does not work with 512KiB flash.
+### PCB overview
+
+**Board markings**
+- Top silkscreen: PCB-SWTG024AS-V2.0
+
+Top side
+
+<img src="photos/SWTG024AS-V2.0/pcb_top.jpg" width="300" />
+
+Bottom
+
+<img src="photos/SWTG024AS-V2.0/pcb_bottom.jpg" width="300" />
+
+### J1, serial console
+
+| `J1` pin | Signal      |
+| -------- | ----------- |
+| 1        | GND         |
+| 2        | RX (Input)  |
+| 3        | TX (Output) |
+
+Note,`R52`、`R53`may not be installed.You need to bridge them using either solder or resistors.
+
+## Power supply
+
+Input power is delivered via barell plug, `12V 1A` adapter was provided.

doc/devices/SWTG024AS.md

@@ -9,8 +9,8 @@ Also the RJ45 connectors can be all plastic/non-shielded or with metal shielding
 |Brand|Type|Managed|PCB|PCB Label|Flash|Chip RTL|
 |---|---|---|---|---|---|---|
 | LIANGUO |SWTG024AS |No|  SWTG024AS-v2.0-17452 | CM-23-11-2336 023-17453| 512 KiB | 8272 |
-| Haraco |ZX-SWTG124AS | Yes |  SWTG024AS-v2.0 | ??? | ??? | 8272 |
-| Xikestore |SKS3200M-4GPY2XF | Yes |  SWTG024AS-v1.0 | CM-23-08-2043 023-16721 | ??? | 8272 |
+| Horaco |ZX-SWTG124AS | Yes |  SWTG024AS-v2.0 | ??? | ??? | 8272 |
+| Xikestore |SKS3200M-4GPY2XF | Yes |  SWTG024AS-v1.0 | CM-23-08-2043 023-16721 | 2048 KiB | 8272 |
 | Sodola | SL-SWTG124AS-D | Yes | SWTG024AS-v2.0-17452 | ??? | 2048 KiB | 8272 |
 
 ## PCB

doc/devices/SWTGW215AS.md

@@ -1,9 +1,11 @@
-### ZX-SWTGW215AS
+# ZX-SWTGW215AS
 
 ## Brands
+
 |Brand|Type|Managed|PCB|Flash|Chip RTL|
 |---|---|---|---|---|---|
-| Lianguo | ZX-SWTGW215AS | Yes | PCB-SWTG115AS-V2.0 | FM25Q16A | 8272 |
+| Lianguo | ZX-SWTGW215AS | Yes | PCB-SWTG115AS-V2.0 | FM25Q16A | 8372 |
+| sold as Lianguo, actual device unbranded | ZX-SWTGW215AS | Yes | PCB-SWTG115AS-V2.1 | W25Q16JVSIQ (2MiB) | 8372 |
 
 ## RTLPlayground target
 
@@ -12,13 +14,23 @@ Use machine target `MACHINE_LIANGUO_ZX_SWTGW215AS` for this device.
 Physical hardware verification: 5x RJ45 ports + 1x SFP port. 
 Port 5 RJ45 is interfaced through a RTL8221B IC.
 
-## PCB
+## Label (V2.0)
 
-<img src="photos/ZX-SWTGW215AS/pcb_top.jpg" width="300" />
+<img src="photos/ZX-SWTGW215AS-V2.0/label.jpg" width="300" />
 
-# Connectors
+## PCB (V2.0)
 
-## Port overview
+<img src="photos/ZX-SWTGW215AS-V2.0/pcb_top.jpg" width="300" />
+<img src="photos/ZX-SWTGW215AS-V2.0/pcb_bottom.jpg" width="300" />
+
+## PCB (V2.1)
+
+<img src="photos/ZX-SWTGW215AS-V2.1/pcb-top.jpg" width="300" />
+<img src="photos/ZX-SWTGW215AS-V2.1/pcb-bottom.jpg" width="300" />
+
+## Connectors
+
+### Port overview
 
 ```
 ┌──────────────────────────────────────────────────────────────────────────────────┐
@@ -36,7 +48,7 @@ Port 5 RJ45 is interfaced through a RTL8221B IC.
 | RJ45 | 3, 4, 5, 6, 7 | 1-5 | 
 | SFP | 8 | 6 |
 
-## J4
+### J4
 
 * Location: SFP connector `J4`.
 * Connected to: 10GMAC number 8, SerDes 1.
@@ -48,10 +60,11 @@ Port 5 RJ45 is interfaced through a RTL8221B IC.
 |5|	MODDEF1 – SCL     | GPIO40	| I2C SCL |
 |6|	MODDEF0 – PRESENT | GPIO30 | Detect |
 |8|	LOS	              | GPIO37 | RX Loss of Signal |
-### Notes
+
+#### Notes
 * Not all signals were mapped mechanically, hence they've been left out of documentation.
 
-## T3, Slave Interface
+### T3, Slave Interface
 
 This connector goes to U4 `I2C EEPROM` and U10 `SPI FLASH` (mappings identical to SWTG024AS).
 
@@ -65,11 +78,12 @@ For detailed Slave Interface functionality and protocol information, see [T3 doc
 |4| VCC |
 |5| 33R -> U10-P2 | SPI-DO/D1 | 
 |6| U10-P1 | SPI-CS |
-### Notes
+
+#### Notes
 * 1 pin is square shaped.
 
 
-## T5, Serial Console
+### T5, Serial Console
 
 |`T5` pin|GPIO|Signal|
 |---|---|---|
@@ -77,10 +91,11 @@ For detailed Slave Interface functionality and protocol information, see [T3 doc
 | 2 | GND | |
 | 3 | GPIO32 | U0RXD (Input) |
 | 4 | 3V3 | |
-### Notes
+
+#### Notes
 * 1 pin is square shaped.
 
-## T8
+### T8
 
 |`T8` pin|GPIO|Signal|
 |---|---|---|
@@ -91,18 +106,19 @@ For detailed Slave Interface functionality and protocol information, see [T3 doc
 | 5 | GPIO47 | |
 | 6 | GPIO49 | |
 
-### Notes
+#### Notes
 * 1 pin is square shaped.
 * Mapping unverified but assumed the same as [LIANGUO SWTG024AS](SWTG024AS.md#t8).
 
-# Reset Circuit
+## Reset Circuit
 | Function | GPIO |
 |---|---|
 | Reset button | GPIO54 |
+
 ### Notes
 * Circuit is active-low
 
-# GPIO
+## GPIO
 
 Note: T3/U4/U10-related signal annotations below are copied from [LIANGUO SWTG024AS T3 section](SWTG024AS.md#t3-slave-interface) as well as T8 port from [LIANGUO SWTG024AS T8 section](SWTG024AS.md#t8). They should be treated as assumed identical for ZX-SWTGW215AS as it has not been 100% confirmed true at the moment. 
 
@@ -141,7 +157,7 @@ Note: T3/U4/U10-related signal annotations below are copied from [LIANGUO SWTG02
 | 40000000 | GPIO30 | J4-6 | SFP DETECT |  | GPIO62 |   |  |
 | 80000000 | GPIO31 | T5-1 | U0TXD |  | GPIO63 |   |  |
 
-# LEDs
+## LEDs
 
 | NAME | GPIO | Port(s) | Function | Notes |
 | ---- | ---- | ---- | ---- | ---- |
@@ -162,3 +178,6 @@ Note: T3/U4/U10-related signal annotations below are copied from [LIANGUO SWTG02
 
 While [SWTG024AS.md](SWTG024AS.md) can be used as a general reference for hardware concepts and interface specifications, this device should not be assumed to be identical beside the difference implicitely highlighted below. Not all information has been validated for compatibility with the SWTG215AS. Consult the SWTG024AS documentation with caution and verify any critical details against this device's.
 
+## Flashing
+
+For devices with Winbond 25Q16JVSIQ, flashing is possible for example using flashprog with device "W25Q16.V". Note that you should not overwrite the whole flash to keep device-specific data (like the MAC address at 0x1fc000). Also, creating a backup of the entire falsh before is of course a very good idea.

doc/devices/SWTGW218AS.md

@@ -6,6 +6,7 @@
 | Mokerlink | ZX-SWTGW218AS | Yes|  SWTG118AS-V2.0-16029 | 2MB (FM25Q16A)| 8273N + 8224N |
 | Sodola | | | | | |
 | Horaco | | | | | |
+| XikeStor | SKS3200-8E1X | Yes | SWTG118AS-V2.1-17462 | 2MB (25Q16JVSIQ) | |
 
 
 ## Photos

doc/devices/ZX310S-4T2XT.md

@@ -0,0 +1,53 @@
+# ZX310S-4T2XT
+
+The following is a documentation for the managed switch marked as
+`ZX310S-4T2XT` and sold by Horaco.
+
+The original software is running UART on 57600 baud rate 8N1.
+
+CPU: RTL8372
+Flash: 2MByte Winbond W25Q16DV (U3)
+PHY 2x RTL8261BE
+
+### Label specifications
+
+- **Name**:
+- **Ports**:
+  - 4 × RJ45: 10/100/1000/2500 Mbps
+  - 2 x RJ45: 10/100/1000/2500/5000/10000 Mbps
+- **Power**: 12V DC, 2A barrel connector
+
+<img src="photos/ZX310S-4T2XT/label.jpg" width="300" />
+
+### What works
+The device is fully supported:
+- All 4 2.5GBASE-T RJ45 ports work at 10/100/1000/2500 Mbps, including EEE
+- The 10GBit ports works, including EEE.
+- LEDs work with the same indiciations as the OEM firmware
+
+### PCB overview
+
+**Board markings**
+- Top silkscreen: PCB-SL310S-4T2XT-V1.0.0-22273
+
+Top side
+
+<img src="photos/ZX310S-4T2XT/pcb_top.jpg" width="300" />
+
+Bottom
+
+<img src="photos/ZX310S-4T2XT/pcb_bottom.jpg" width="300" />
+
+### J1, serial console
+
+| `J1` pin | Signal      |
+| -------- | ----------- |
+| 1        | TX (Output) |
+| 2        | RX (Input)  |
+| 3        | GND         |
+| 4        | 3V3         |
+
+
+## Power supply
+
+Input power is delivered via barell plug, `12V 2A` adapter was provided.

doc/health.md

@@ -0,0 +1,79 @@
+# The health command
+
+`health` prints a one-page snapshot of the firmware's vital signs on the
+serial console. It exists for the situations where the switch misbehaves and
+every probe from the network measures the network instead of the device: the
+dump is taken from inside, costs one command, and works while HTTP does not.
+
+```
+> health
+up 0000001f ticks 0x00001f4c loops 0x000016da rx 0x024e
+link max 01 slow 0x0000
+sfp  max 74 slow 0x0001
+rx   max 00 slow 0x0000
+tx   max 00 slow 0x0000
+stp  max 04 slow 0x0001
+cmd  max 02 slow 0x0001
+sp 80 untouched 62
+tcp st 00 tmr 00 rtx 00 rto 00 len 0x0000 mss 0x05b4
+  lport 0x0000 rport 0x0000 rip 0x0000 0x0000
+httpd left 0x0000 entry 00 stp 01 mvlan 0x0002
+```
+
+The instrumentation is not part of a default build. It costs about 1.1 kB
+of bank 2, a few bytes of xdata and seven banked calls per main-loop pass,
+which is nothing a user needs unless they are chasing a problem, so it is
+switched on at build time:
+
+```
+make MACHINE=SWTGW218AS HEALTH=1
+```
+
+Without it the hooks compile to nothing and `health` is not a command.
+
+All figures are raw hex. The counters are cumulative: take two dumps a known
+time apart and the differences give the rates.
+
+## The first line
+
+`up` is the seconds counter, `ticks` the system tick (200 per second),
+`loops` the number of main-loop passes and `rx` the frames handle_rx has
+taken off the NIC. A healthy loop completes one pass per tick, so the
+difference in `loops` tracks the difference in `ticks`; a loop that falls
+behind is being held up by one of the phases below. The `rx` rate separates
+a flooded CPU port from a stalled loop, which look identical from outside.
+
+## Phases
+
+Each line is one section of the main loop: the link poll, SFP handling,
+frame reception, TCP transmission, the STP timers and the command dispatch.
+`max` is the worst time that section has taken, in ticks of 5 ms; `slow`
+counts the passes that took two ticks or more. A misbehaving subsystem
+names itself here, which is the difference between knowing that the loop is
+slow and knowing why.
+
+A dump of its own output takes the console some milliseconds, so running
+`health` repeatedly increments the `cmd` counters by itself. That is the
+instrument observing itself, not a fault.
+
+## Stack
+
+At boot the free stack area is painted with a pattern. `sp` is the live
+stack pointer; `untouched` counts the painted bytes still intact at the top,
+which is the closest thing to a high-water mark this hardware offers. A
+shrinking `untouched` across dumps means something is reaching deeper than
+anything before it.
+
+## The TCP slot
+
+The connection table is printed whole, one slot per pair of lines: TCP
+state (3 is ESTABLISHED, 0 closed), retransmission timer and counter, bytes
+in flight, negotiated MSS, then the ports and the peer address. With a
+single slot serving the entire web interface, one glance answers the
+question every management outage starts with: who is holding it. A slot
+showing state 3 with nothing in flight and a peer that no longer answers is
+a connection whose owner went away.
+
+`httpd left` and `entry` describe the file transfer the web server believes
+it is in the middle of, and the trailing flags show whether STP is running
+and which VLAN carries management.

doc/howto_leds.md

@@ -0,0 +1,572 @@
+# LEDs HOWTO using firmware function tracing
+
+This is a tutorial to show how to figure out the LED configuration for
+unmanaged switches (on managed ones one can just print out the registers
+from the command line) without using an I2C port on the device together
+an I2C-capable microcontroller. You will only need to have a SOIC clamp
+and will have to run ghidra to do a bit of reversing.
+
+The additional advantage of this method is that it not only gives the LED
+configuration but also the full PHY configuration and SDS configuration e.g.
+in case of additional PHYs being used on the device.
+
+We will use the ZoeRax HG0402XG V1.1 as an example device.
+
+The first step is to read out the flash with a SOIC clamp.
+Save the image as
+`zoerax_hg0402xg.bin`
+
+The next step is to use a decompiler such as ghidra to identify the
+functions used to write or read registers, SDS or to the PHY.
+
+<img src="images/ghidra_open.png" width="300" />
+
+First, load the code in BANK0 into ghidra. The type of code is
+8051 default big-endian. The code starts at offset 0x0002 in the file
+and has length 0x3ffd
+
+<img src="images/ghidra_add_block.png" width="300" />
+Add BANK1 into ghidra by using File->Add to program...
+and add the code starting at 0x4000 in `zoerax_hg0402xg.bin` with length
+0xc000. Repeat for BANK2 (starts at 0x10000) and BANK3 (starts at 0x1c0000).
+They both have length 0xc000.
+
+<img src="images/ghidra_search_read_reg.png" width="300" />
+
+Now, find the read_reg function. An example of the read-register function
+is given below. Note the critical bit, namely the execution of the
+read-function of an ASIC register via an SFR: 
+```
+CODE1::4dc9 75 a0 01           MOV        SFR_EXEC_GO,#0x1
+```
+
+This sequence of bytes is very specific. Replace 0x01 with 0x03 and you have
+the regster write SFR, 0x05 reads the SerDes, 0x07 writes it. 0x09 reads
+from the PHY and 0x0b writes to it.
+
+
+```
+                             **************************************************************
+                             *                          FUNCTION                          *
+                             **************************************************************
+                             undefined reg_read()
+             undefined         <UNASSIGNED>   <RETURN>
+                             reg_read
+     CODE1::4da9 ab 07              MOV        R3,BANK0_R7                                      = ??
+     CODE1::4dab aa 06              MOV        R2,BANK0_R6                                      = ??
+     CODE1::4dad e4                 CLR        A
+     CODE1::4dae ff                 MOV        R7,A
+     CODE1::4daf fe                 MOV        R6,A
+     CODE1::4db0 fd                 MOV        R5,A
+     CODE1::4db1 fc                 MOV        R4,A
+     CODE1::4db2 90 00 c9           MOV        DPTR,#0xc9
+     CODE1::4db5 12 06 15           LCALL      FUN_CODE_0615                                    undefined FUN_CODE_0615()
+     CODE1::4db8 e4                 CLR        A
+     CODE1::4db9 ff                 MOV        R7,A
+     CODE1::4dba fe                 MOV        R6,A
+     CODE1::4dbb fd                 MOV        R5,A
+     CODE1::4dbc fc                 MOV        R4,A
+     CODE1::4dbd 90 00 c5           MOV        DPTR,#0xc5
+     CODE1::4dc0 12 06 15           LCALL      FUN_CODE_0615                                    undefined FUN_CODE_0615()
+     CODE1::4dc3 ea                 MOV        A,R2
+     CODE1::4dc4 f5 a2              MOV        SFR_A_ADDRH,A                                    = ??
+     CODE1::4dc6 eb                 MOV        A,R3
+     CODE1::4dc7 f5 a3              MOV        SFR_A_ADDRL,A                                    = ??
+     CODE1::4dc9 75 a0 01           MOV        SFR_EXEC_GO,#0x1 <<<<<<<< Executes READ REG
+                             LAB_CODE1__4dcc                                 XREF[1]:     CODE1::4dcf(j)  
+     CODE1::4dcc af a1              MOV        R7,SFR_EXEC_STATUS                               = ??
+     CODE1::4dce ef                 MOV        A,R7
+     CODE1::4dcf 70 fb              JNZ        LAB_CODE1__4dcc
+     CODE1::4dd1 af a4              MOV        R7,DAT_SFR_a4                                    = ??
+     CODE1::4dd3 fc                 MOV        R4,A
+     CODE1::4dd4 fd                 MOV        R5,A
+     CODE1::4dd5 fe                 MOV        R6,A
+     CODE1::4dd6 90 00 c9           MOV        DPTR,#0xc9
+     CODE1::4dd9 12 06 15           LCALL      FUN_CODE_0615                                    undefined FUN_CODE_0615()
+     CODE1::4ddc 90 00 c5           MOV        DPTR,#0xc5
+     CODE1::4ddf 12 05 f9           LCALL      FUN_CODE_05f9                                    undefined FUN_CODE_05f9()
+     CODE1::4de2 c0 00              PUSH       BANK0_R0
+     CODE1::4de4 90 00 c9           MOV        DPTR,#0xc9
+     CODE1::4de7 12 05 dd           LCALL      read_xmem_32_b                                   undefined read_xmem_32_b()
+     CODE1::4dea 78 18              MOV        R0,#0x18
+     CODE1::4dec 12 05 86           LCALL      FUN_CODE_0586                                    undefined FUN_CODE_0586()
+     CODE1::4def d0 00              POP        BANK0_R0
+     CODE1::4df1 12 05 48           LCALL      FUN_CODE_0548                                    undefined FUN_CODE_0548()
+     CODE1::4df4 90 00 c5           MOV        DPTR,#0xc5
+     CODE1::4df7 12 06 15           LCALL      FUN_CODE_0615                                    undefined FUN_CODE_0615()
+     CODE1::4dfa af a5              MOV        R7,DAT_SFR_a5                                    = ??
+     CODE1::4dfc e4                 CLR        A
+     CODE1::4dfd fc                 MOV        R4,A
+     CODE1::4dfe fd                 MOV        R5,A
+     CODE1::4dff fe                 MOV        R6,A
+     CODE1::4e00 90 00 c9           MOV        DPTR,#0xc9
+     CODE1::4e03 12 06 15           LCALL      FUN_CODE_0615                                    undefined FUN_CODE_0615()
+     CODE1::4e06 90 00 c5           MOV        DPTR,#0xc5
+     CODE1::4e09 12 05 f9           LCALL      FUN_CODE_05f9                                    undefined FUN_CODE_05f9()
+     CODE1::4e0c c0 00              PUSH       BANK0_R0
+     CODE1::4e0e 90 00 c9           MOV        DPTR,#0xc9
+     CODE1::4e11 12 05 dd           LCALL      read_xmem_32_b                                   undefined read_xmem_32_b()
+     CODE1::4e14 78 10              MOV        R0,#0x10
+     CODE1::4e16 12 05 86           LCALL      FUN_CODE_0586                                    undefined FUN_CODE_0586()
+     CODE1::4e19 d0 00              POP        BANK0_R0
+     CODE1::4e1b 12 05 48           LCALL      FUN_CODE_0548                                    undefined FUN_CODE_0548()
+     CODE1::4e1e 90 00 c5           MOV        DPTR,#0xc5
+     CODE1::4e21 12 06 15           LCALL      FUN_CODE_0615                                    undefined FUN_CODE_0615()
+     CODE1::4e24 af a6              MOV        R7,DAT_SFR_a6                                    = ??
+     CODE1::4e26 e4                 CLR        A
+     CODE1::4e27 fc                 MOV        R4,A
+     CODE1::4e28 fd                 MOV        R5,A
+     CODE1::4e29 fe                 MOV        R6,A
+     CODE1::4e2a 90 00 c9           MOV        DPTR,#0xc9
+     CODE1::4e2d 12 06 15           LCALL      FUN_CODE_0615                                    undefined FUN_CODE_0615()
+     CODE1::4e30 90 00 c5           MOV        DPTR,#0xc5
+     CODE1::4e33 12 05 f9           LCALL      FUN_CODE_05f9                                    undefined FUN_CODE_05f9()
+     CODE1::4e36 c0 00              PUSH       BANK0_R0
+     CODE1::4e38 90 00 c9           MOV        DPTR,#0xc9
+     CODE1::4e3b 12 05 dd           LCALL      read_xmem_32_b                                   undefined read_xmem_32_b()
+     CODE1::4e3e 78 08              MOV        R0,#0x8
+     CODE1::4e40 12 05 86           LCALL      FUN_CODE_0586                                    undefined FUN_CODE_0586()
+     CODE1::4e43 d0 00              POP        BANK0_R0
+     CODE1::4e45 12 05 48           LCALL      FUN_CODE_0548                                    undefined FUN_CODE_0548()
+     CODE1::4e48 90 00 c5           MOV        DPTR,#0xc5
+     CODE1::4e4b 12 06 15           LCALL      FUN_CODE_0615                                    undefined FUN_CODE_0615()
+     CODE1::4e4e af a7              MOV        R7,DAT_SFR_a7                                    = ??
+     CODE1::4e50 e4                 CLR        A
+     CODE1::4e51 fc                 MOV        R4,A
+     CODE1::4e52 fd                 MOV        R5,A
+     CODE1::4e53 fe                 MOV        R6,A
+     CODE1::4e54 90 00 c9           MOV        DPTR,#0xc9
+     CODE1::4e57 12 06 15           LCALL      FUN_CODE_0615                                    undefined FUN_CODE_0615()
+     CODE1::4e5a 90 00 c5           MOV        DPTR,#0xc5
+     CODE1::4e5d 12 05 dd           LCALL      read_xmem_32_b                                   undefined read_xmem_32_b()
+     CODE1::4e60 90 00 c9           MOV        DPTR,#0xc9
+     CODE1::4e63 12 05 f9           LCALL      FUN_CODE_05f9                                    undefined FUN_CODE_05f9()
+     CODE1::4e66 12 05 48           LCALL      FUN_CODE_0548                                    undefined FUN_CODE_0548()
+     CODE1::4e69 90 00 c5           MOV        DPTR,#0xc5
+     CODE1::4e6c 12 06 15           LCALL      FUN_CODE_0615                                    undefined FUN_CODE_0615()
+     CODE1::4e6f 90 00 c5           MOV        DPTR,#0xc5
+     CODE1::4e72 02 05 dd           LJMP       read_xmem_32_b                                   undefined read_xmem_32_b()
+                             -- Flow Override: CALL_RETURN (CALL_TERMINATOR)
+
+```
+
+INSERT ghidra_search_read_reg.png
+
+Identify all the read and write function to the HW of the SoC using the find
+in memory function.
+
+The next task is to adapt the intercept routines in a special assembler
+file. Don't worry, you do not need to understand assembler to do this.
+
+```
+; Assembler file to intercept register writes/reads and PHY writes/reads
+; assemble with as31
+; Compile with
+; as31 -Fbyte -Orwintercept_zoerax_hg0402xg.hex rwintercept_zoerax_hg0402xg.asm
+; ./injector zoerax_hg0402xg.bin RTLPlayground/rwintercept_zoerax_hg0402xg.hex zoerax_hg0402xg_patched.bin
+; Start at 0x3b00, where there is always some space in BANK 0
+	.equ	valptr, 0x199
+
+
+	.equ	SFR_DATA_0, 0xa7
+	.equ	SFR_DATA_8, 0xa6
+	.equ	SFR_DATA_16, 0xa5
+	.equ	SFR_DATA_24, 0xa4
+
+; Intercept Register Write
+	.org 0x4d62
+	lcall	reg_write
+	nop
+
+; Intercept Register Read
+	.org 0x4dad
+	lcall	reg_read_head
+	.org 0x4e6f
+	lcall	reg_read_tail
+
+; Intercept PHY write
+	.org 0x522c
+	lcall	phy_write
+
+; Intercept PHY read
+	.org 0x526f
+	lcall	phy_read_head
+	.org 0x5295
+	ljmp	phy_read_tail
+
+; Intercept SDS write
+	.org 0x503c
+	lcall	sds_write
+	nop
+
+; Intercept SDS read
+	.org 0x5061
+	lcall	sds_read_head
+	nop
+	.org 0x507b
+	ljmp	sds_read_tail
+
+;
+; BEGIN actual code at unused end of BANK0
+;
+	.org 0x3b00
+
+;
+; print the address of a register write. The address is in R6/R7. A and r4 can be scratched
+;
+reg_write:	
+	mov	a, #'R'
+	acall	putc
+
+	mov	a, r6
+	acall	wbyte
+
+	mov	a, r7
+	acall	wbyte
+
+	mov	a, #'-'
+	acall	putc
+
+	mov	dptr, #valptr
+	movx	a, @dptr
+	acall	wbyte
+	mov	dptr, #valptr + 1
+	movx	a, @dptr
+	acall	wbyte
+	mov	dptr, #valptr + 2
+	movx	a, @dptr
+	acall	wbyte
+	mov	dptr, #valptr + 3
+	movx	a, @dptr
+	acall	wbyte
+
+	mov	a, #' '
+	acall	putc
+
+	mov	a, r7
+	mov	r5, a
+	mov	a, r6
+	mov	r4, a
+	ret
+[...]
+```
+
+The full assembler file can be found here: XXXXXXXXXX
+
+
+Once you have assembled the code, inject the bytes into the existing image,
+creating a patched version:
+```
+$ as31 -Fbyte -Orwintercept_zoerax_hg0402xg.hex rwintercept_zoerax_hg0402xg.asm
+Begin Pass #1
+Begin Pass #2
+./injector zoerax_hg0402xg.bin rwintercept_zoerax_hg0402xg.hex zoerax_hg0402xg_patched.bin
+Input file size: 1048576
+Bytes read:: 1048576
+Patched 417 bytes.
+```
+
+Now flash `zoerax_hg0402xg_patched.bin` onto device.
+
+Connect a serial adapter and plug in power. You will see:
+
+```
+$ picocom -b 9600 /dev/ttyUSB0 
+picocom v3.1
+
+port is        : /dev/ttyUSB0
+flowcontrol    : none
+baudrate is    : 9600
+parity is      : none
+databits are   : 8
+stopbits are   : 1
+escape is      : C-a
+local echo is  : no
+noinit is      : no
+noreset is     : no
+hangup is      : no
+nolock is      : no
+send_cmd is    : sz -vv
+receive_cmd is : rz -vv -E
+imap is        : 
+omap is        : 
+emap is        : crcrlf,delbs,
+logfile is     : none
+initstring     : none
+exit_after is  : not set
+exit is        : no
+
+Type [C-a] [C-h] to see available commands
+Terminal ready
+[The printout only starts once the serial peripherial has been set up. Initially its timing is off:]
+�.Ӛ�҂���������30-00005555 r6330:00005555 R6330-00005515 [RTL837X_REG_SMI_MAC_TYPE]
+[RTL837X_REG_SMI_PORT_POLLING: ]
+r6334:00000000 R6334-000000f0
+r6454:00000000 R6454-00007000
+
+[Read SoC-Revision]
+r000c:00200000 R000c-002a0000 r000c:202a6818 r000c:202a6818 R000c-20206818
+p001e.000d:ffff R02f8-0000ffff R02f4-0000fffa P000001.1e00000d:fffa p001e.000d:ffff p001e.000d:ffff
+R02f8-0000ffff R02f4-0000fff0 P000001.1e00000d:fff0
+
+[RTL837X_REG_LED_MODE being configured:]
+r6520:0021fdb0 R6520-0021e7b0 r6520:0021e7b0 R6520-0021e6b0
+
+[RLDP Leds configured via RTL837X_REG_LED_RLDP_X:]
+r65f8:00000018 R65f8-0000001b R65fc-fffff000 r6600:00000000 R6600-0000000f
+
+[RTL837X_REG_LED_GLB_IO_EN: ]
+r65dc:5fffff00 R65dc-7fffff00 r65dc:7fffff00 R65dc-77ffff00
+
+[RTL837X_PIN_MUX_0, makes serial go out of sync:]
+r7f8c:30000000 R7f8c-30000000 r7f8c:300��.Ӛ�҂���������30-00005555
+
+r6330:00005555 R6330-00005515 r6334:00000000 R6334-000000f0
+
+r6454:00000000 R6454-00007000
+
+[Read SoC-Revision (again)]
+r000c:00200000 R000c-002a0000 r000c:202a6818 r000c:202a6818 R000c-20206818
+p001e.000d:ffff R02f8-0000ffff R02f4-0000fffa P000001.1e00000d:fffa p001e.000d:ffff p001e.000d:ffff
+R02f8-0000ffff R02f4-0000fff0
+P000001.1e00000d:fff0
+
+#### LED configuration ########
+[RTL837X_REG_LED_MODE being configured (final):]
+r6520:0021fdb0 R6520-0021e7b0 r6520:0021e7b0 R6520-0021e6b0
+
+[More RTL837X_REG_LED_RLDP]
+r65f8:00000018 R65f8-0000001b R65fc-fffff000 r6600:00000000 R6600-0000000f
+
+[RTL837X_REG_LED_GLB_IO_EN]
+r65dc:5fffff00 R65dc-7fffff00 r65dc:7fffff00 R65dc-77ffff00
+
+[RTL837X_PIN_MUX_0
+r7f8c:30000000 R7f8c-30000000 r7f8c:30000000 R7f8c-38000000
+
+[RTL837X_LED_PORT_SET_SEL]
+r654c:00000000 R654c-00010000
+
+[RTL837X_REG_LED1_0_SET0]
+R6548-00000141
+
+[RTL837X_REG_LED3_2_SET0]
+r6544:01411000 R6544-01410174
+
+[RTL837X_REG_LED1_0_SET1]
+r6540:00440070 R6540-0044017f
+
+[RTL837X_REG_LED3_0_SET1]
+r6528:00000000 R6528-000f0000
+
+[SDS 0 being configure:]
+r7b20:00000bff R7b20-000003ff r7b20:000003ff R7b20-000003fa r7b20:000003fa R7b20-000003fa
+Q002110:4480 Q002113:0400 Q002118:6d02 Q00211b:424e Q00211d:0002 Q00361c:1390 
+Q003614:003f Q003610:0200 Q002e04:0080 Q002e06:0408 Q002e07:020d Q002e09:0601 
+Q002e0b:222c Q002e0c:a217 Q002e0d:fe40 Q002e15:f5c1 Q002e16:0443 Q002e1d:abb0 
+Q000612:5078 Q000706:9401 Q000708:9401 Q00070a:9401 Q00070c:9401 Q001f0b:0003 
+Q000603:c45c Q00061f:2100 q001f0b:0003 Q001f0b:000f q002000:0000 Q002000:0030 
+q002000:0030 Q002000:0010 q002000:0010 Q002000:0050 q002000:0050 Q002000:00d0 
+q002000:00d0 Q002000:0cd0 q002000:0cd0 Q002000:04d0 q002000:04d0 Q002000:04d0 
+q002000:04d0 Q002000:0cd0 q002000:0cd0 Q002000:00d0 q002000:00d0 Q002000:00d0 
+q002000:00d0 Q002000:0050 q002000:0050 Q002000:0010 q002000:0010 Q002000:0010 
+q002000:0010 Q002000:0030 q002000:0030 Q002000:0000 q001f00:0000 Q001f00:000b 
+q001f00:000b Q001f00:0000
+
+[SDS 1 being configured]
+r7b20:000003fa R7b20-000003fa r7b20:000003fa R7b20-0000035a r7b20:0000035a R7b20-0000035a
+Q012110:4480 Q012113:0400 Q012118:6d02 Q01211b:424e Q01211d:0002 Q01361c:1390 
+Q013614:003f Q013610:0200 Q012e04:0080 Q012e06:0408 Q012e07:020d Q012e09:0601 
+Q012e0b:222c Q012e0c:a217 Q012e0d:fe40 Q012e15:f5c1 Q012e16:0443 Q012e1d:abb0 
+Q010612:5078 Q010706:9401 Q010708:9401 Q01070a:9401 Q01070c:9401 Q011f0b:0003 
+Q010603:c45c Q01061f:2100 q011f0b:0003 Q011f0b:000f q012000:0000 Q012000:0030 
+q012000:0030 Q012000:0010 q012000:0010 Q012000:0050 q012000:0050 Q012000:00d0 
+q012000:00d0 Q012000:0cd0 q012000:0cd0 Q012000:04d0 q012000:04d0 Q012000:04d0 
+q012000:04d0 Q012000:0cd0 q012000:0cd0 Q012000:00d0 q012000:00d0 Q012000:00d0 
+q012000:00d0 Q012000:0050 q012000:0050 Q012000:0010 q012000:0010 Q012000:0010 
+q012000:0010 Q012000:0030 q012000:0030 Q012000:0000 q011f00:0000 Q011f00:000b 
+q011f00:000b Q011f00:0000 q012100:4902 Q012100:4906 q013605:0000 Q013605:4000 
+Q011f02:001f q011f15:0096 q002100:4902 Q002100:4906 q003605:0000 Q003605:4000 
+Q001f02:001f q001f15:00a6
+
+r0a90:000000f3 R0a90-000000fc P0000f0.1f00a610:2858 r5fd4:0002914a 
+R5fd4-001a914a r1538:00000e33 R1538-00000e37 r1538:00000e37 R1538-00000e37 
+r1538:00000e37 R1538-00000f37 r1638:00000e33 R1638-00000e37 r1638:00000e37 
+R1638-00000e37 r1638:00000e37 R1638-00000f37 r1738:00000e33 R1738-00000e37 
+r1738:00000e37 R1738-00000e37 r1738:00000e37 R1738-00000f37 r1838:00000e33 
+R1838-00000e37 r1838:00000e37 R1838-00000e37 r1838:00000e37 R1838-00000f37 
+r1938:00000e33 R1938-00000e37 r1938:00000e37 R1938-00000e37 r1938:00000e37 
+R1938-00000f37 r1a38:00000e33 R1a38-00000e37 r1a38:00000e37 R1a38-00000e37 
+r1a38:00000e37 R1a38-00000f37 r0b7c:000000d8 R0b7c-000000f8 R7124-00001050 
+R7128-00001050 R712c-00001050 R7130-00001050 R7134-00001050 R7138-00001050 
+R713c-00001050 R7140-00001050 R7144-00001050 R7148-00001050 r6040:00000030 
+R6040-00000031 p041f.a436:8195 P000010.1f00a436:0005 p041f.a438:02d4 
+P000010.1f00a436:801e p041f.a438:0000 p041f.b820:0000 P000010.1f00b820:0010 
+p041f.b800:00c0 p041f.a436:801e P000010.1f00a436:8023 p041f.a438:0000 
+P000010.1f00a438:1802 p041f.a436:8025 
+
+[PHY with ID 5 being patched] P000010.1f00a436:b82e p041f.a438:0000 
+P000010.1f00a438:0001 p041f.b820:0010 P000010.1f00b820:0090 
+P000010.1f00a436:a016 P000010.1f00a438:0000 P000010.1f00a436:a012 
+P000010.1f00a438:0000 P000010.1f00a436:a014 P000010.1f00a438:1800 
+P000010.1f00a438:8010 P000010.1f00a438:1800 P000010.1f00a438:8013 
+P000010.1f00a438:1800 P000010.1f00a438:8026 P000010.1f00a438:1800 
+P000010.1f00a438:802a P000010.1f00a438:1800 P000010.1f00a438:802e 
+P000010.1f00a438:1800 P000010.1f00a438:802e P000010.1f00a438:1800 
+P000010.1f00a438:802e P000010.1f00a438:1800 P000010.1f00a438:802e 
+...
+```
+Where:
+```
+r: read-reg
+R: write-reg
+q: read SDS
+Q: write SDS
+p: read PHY
+P: write SDS
+```
+
+The LED configuration has been marked above. We now write exactly those registers
+into the registers of `rtlplayground.c` on startup:
+
+```
+[...]
+	set_sys_led_state(SYS_LED_ON);
+
+	// [RTL837X_REG_LED_MODE being configured (final):]
+	// r6520:0021fdb0 R6520-0021e7b0 r6520:0021e7b0 R6520-0021e6b0
+	REG_SET(RTL837X_REG_LED_MODE, 0x0021e6b0);
+
+	// [More RTL837X_REG_LED_RLDP]
+	// r65f8:00000018 R65f8-0000001b R65fc-fffff000 r6600:00000000 R6600-0000000f
+	REG_SET(0x65f8, 0x0000001b);
+	REG_SET(0x65fc, 0xfffff000);
+	REG_SET(0x6600, 0x0000000f);
+
+	// [RTL837X_REG_LED_GLB_IO_EN]
+	// r65dc:5fffff00 R65dc-7fffff00 r65dc:7fffff00 R65dc-77ffff00
+	REG_SET(0x65dc, 0x77ffff00);
+
+	// [RTL837X_PIN_MUX_0
+	// r7f8c:30000000 R7f8c-30000000 r7f8c:30000000 R7f8c-38000000
+	REG_SET(0x7f8c, 0x38000000);
+
+	// [RTL837X_LED_PORT_SET_SEL]
+	// r654c:00000000 R654c-00010000
+	REG_SET(0x654c, 0x00010040);
+
+	// [RTL837X_REG_LED1_0_SET0]
+	// R6548-00000141
+	REG_SET(0x6548, 0x00000141);
+
+	// [RTL837X_REG_LED3_2_SET0]
+	// r6544:01411000 R6544-01410174
+	REG_SET(0x6544, 0x01410174);
+
+	// [RTL837X_REG_LED1_0_SET1]
+	// r6540:00440070 R6540-0044017f
+	REG_SET(0x6540, 0x0044017f);
+
+	// [RTL837X_REG_LED3_0_SET1]
+	// r6528:00000000 R6528-000f0000
+	REG_SET(0x6528, 0x000f0000);
+
+	cmd_editor_init();
+[...]
+```
+
+Create an initial configuraiton for your device by copying over an existing one
+for the same device type, i.e. same port-configuraiton and same SoC,
+give it a new name. Make sure that the led_mux_custom and led_mux fields are not
+used, because our device does not customize the LED muxes.
+
+Compile and flash onto your device.
+
+Now, boot the switch and issue the `leds`command, which will print out:
+```
+RTL837X_PIN_MUX_0: 0x38000000
+RTL837X_REG_LED_GLB_IO_EN: 0x77ffff00
+RTL837X_REG_LED1_0_SET0: 0x00000141
+RTL837X_REG_LED3_2_SET0: 0x01410174
+RTL837X_REG_LED1_0_SET1: 0x0044017f
+RTL837X_REG_LED3_2_SET1: 0x18000040
+RTL837X_REG_LED1_0_SET2: 0x00000000
+RTL837X_REG_LED3_2_SET2: 0x00000000
+RTL837X_REG_LED1_0_SET3: 0x00000000
+RTL837X_REG_LED3_2_SET3: 0x00000000
+RTL837X_REG_LED3_0_SET1: 0x000f0000
+RTL837X_REG_LED3_0_SET3: 0x00000000
+RTL837X_LED_PORT_SET_SEL: 0x00010040
+RTL837X_REG_LED_GLB_MUX_1: 0x3fffffff
+RTL837X_REG_LED_GLB_MUX_2: 0x0c3fffff
+RTL837X_REG_LED_GLB_MUX_3: 0x1245038d
+RTL837X_REG_LED_GLB_MUX_4: 0x19616554
+RTL837X_REG_LED_GLB_MUX_5: 0x2079d71a
+RTL837X_REG_LED_GLB_MUX_6: 0x000238a1
+RTL837X_REG_LED_GLB_ACTIVE: 0x3ffbedff
+RTL837X_REG_LED_MODE: 0x0021e6b0
+LED pad Configuration:
+00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 
+3f 3f 3f 3f 3f 3f 3f 3f 0f 0c 0d 0e 10 11 12 14 15 16 18 19 1a 1c 1d 1e 20 21 22 23 
+LED-set Configuration:
+LED-ID          0               1               2               3
+SET 0:     000141          000000          000174          000141
+SET 1:     0f017f          000044          000040          001800
+SET 2:     000000          000000          000000          000000
+SET 3:     000000          000000          000000          000000
+Port 3: SET 1: ( 2G5 TWO_1G 1G 500M 100M 10M LINK ACT 10G TWO_5G 5G TWO_2G5), ( 1G LINK), ( LINK), ( COL DUPLEX), 
+Port 4: SET 0: ( 2G5 LINK ACT), (), ( 1G 100M 10M LINK ACT), ( 2G5 LINK ACT), 
+Port 5: SET 0: ( 2G5 LINK ACT), (), ( 1G 100M 10M LINK ACT), ( 2G5 LINK ACT), 
+Port 6: SET 0: ( 2G5 LINK ACT), (), ( 1G 100M 10M LINK ACT), ( 2G5 LINK ACT), 
+Port 7: SET 0: ( 2G5 LINK ACT), (), ( 1G 100M 10M LINK ACT), ( 2G5 LINK ACT), 
+Port 8: SET 1: ( 2G5 TWO_1G 1G 500M 100M 10M LINK ACT 10G TWO_5G 5G TWO_2G5), ( 1G LINK), ( LINK), ( COL DUPLEX), 
+
+```
+Together with the GPIO information, this will give you the following machine configuration:
+```
+_code const struct machine machine = {
+	.machine_name = "ZOERAX HG0402XG",
+	.isRTL8373 = 0,
+	.min_port = 3,
+	.max_port = 8,
+	.n_sfp = 2,
+	.log_to_phys_port = {0, 0, 0, 5, 1, 2, 3, 4, 6},
+	.phys_to_log_port = {4, 5, 6, 7, 3, 8, 0, 0, 0},
+	.is_sfp = {0, 0, 0, 1, 0, 0, 0, 0, 2},
+	// Left SFP port (5)
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO_NA,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	// Right SFP port (6)
+	.sfp_port[1].pin_detect = GPIO50_I2C_SCL2_UART1_TX,
+	.sfp_port[1].pin_los = GPIO_NA,
+	.sfp_port[1].pin_tx_disable = GPIO_NA,
+	.sfp_port[1].sds = 0,
+	.sfp_port[1].i2c = I2CBUS( GPIO41_I2C_SDA3_MDIO1, GPIO40_I2C_SCL3_MDC1 ),
+	.reset_pin = GPIO_NA,
+	.high_leds = { .mux = LED_27 | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 1, 0, 0, 0, 0, 1},
+	/* On Ethernet: Left led is orange, right green
+	 * 100M and 1G give right led green with activity
+	 * 2.5GBit adds solid left orange LED
+	 * LEDs for the SFP-ports are the same as for the Ethernet ports
+	*/
+	.led_sets = { { LEDS_2G5 | LEDS_LINK | LEDS_ACT,
+			0,
+			LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+			LEDS_2G5 | LEDS_LINK | LEDS_ACT
+		      },
+		      { LEDS_2G5 | LEDS_TWO_PAIR_1G | LEDS_1G | LEDS_500M | LEDS_100M | LEDS_10M |
+			LEDS_LINK | LEDS_ACT | LEDS_10G | LEDS_TWO_PAIR_5G | LEDS_5G | LEDS_TWO_PAIR_2G5,
+			LEDS_1G | LEDS_LINK,
+			LEDS_LINK,
+			LEDS_COL | LEDS_DUPLEX
+		      } 
+		    }
+		    
+};
+```
+
+

doc/igmp.md

@@ -69,7 +69,7 @@ The code currently provides the following functions:
 void igmp_setup(void) __banked;
 void igmp_enable(void) __banked;
 void igmp_router_port_set(uint16_t pmask) __banked;
-void igmp_packet_handler(void) __banked;
+uint8_t igmp_packet_handler(void) __banked;
 void igmp_show(void) __banked;
 ```c
 `igmp_setup()` is called at boot-time and configures flooding of all IP-MC packets by
@@ -80,7 +80,11 @@ of IP-MC packets to be limited to only subscribed ports.
 
 `igmp_router_port_set()`configures forwarding ports for IGMP messages.
 
-`igmp_packet_handler()` implements handling of trapped IGMP packets by the CPU.
+`igmp_packet_handler()` implements handling of trapped IGMP packets by the CPU. It is called
+for frames to 01:00:5e:xx:xx:xx and returns 0 when the frame is not a trapped IGMP packet,
+so that it is passed on to the IP stack. IGMPv1/v2 reports (0x12, 0x16) join the group given
+in the IGMP header, IGMPv2 leaves (0x17) leave it, IGMPv3 reports use the first group record
+(type 4 joins, type 3 leaves). Trapped IGMP frames arrive without a VLAN tag.
 
 `igmp_show()` prints out the IGMP configuration on the CLI.