I've got two Netgear GS108Tv1 8-port gigabit switches sitting around, and after some digging, I discovered that the underlying hardware might be supported by OpenWRT.
Quick specs that I can discern:
Broadcom BCM5836P cpu, ~264MHz
Broadcom BCM5398 8-port GbE Switch
16MB RAM
4MB Flash
Uses ~12W of power, max
OS is some eCos version
Bootloader appears to be CFE (judging by the contents of the STARTUP NVRAM var)
So I opened it up, and there is a 6-pin header that looks like a serial port. Using a multimeter, I read 3.3V off of most of the pins, so I assume this to need a 3.3VTTL converter, which I bought. However, plugging the converter in, loading up Teraterm, and then powering up the switch yields no output (tried multiple bauds, etc). Everywhere I've read suggests that CFE *always* has output of some kind, but I am left wondering if Netgear somehow disabled it in this device.
There are two HTTP servers in the firmware. One is the Broadcom "loader" firmware that only activates if the Netgear firmware can't boot, and I am unable to brick the thing in order to do so. Once you downgrade the flash to the older 1.x firmwares, you can access an eCos shell via Telnet, but even messing around with the 'nvram' command, I cannot corrupt, delete, or alter the STARTUP var to brick the device. According to this blog post, it is possible to intentionally brick the thing, and I might be able to load an OpenWRT *.trx flash image onto it via the loader HTTP server.
The other HTTP server is the Netgear one that you normally manage the device with, and it does verification on any new firmware images being loaded, so you can't flash OpenWRT on that way, either.
I was able to compile an OpenWRT image that was only 3.7MB in size, which should be small enough to fit into the flash, using these settings:
Target System (Broadcom BCM47xx/53xx (MIPS))
Subtarget (Generic)
Target Profile (Broadcom SoC, all Ethernet, No WiFi)
But until I can flash the image, I have no way of knowing if this will even work.
There does appear to be a 14-pin JTAG spot, but I'll have to hunt down a header for it, and then figure out how to actually talk to it (never done JTAG before), but that's my last-resort option. I am hoping someone else here has ideas on why the supposed serial header isn't working or knows of ways to nuke the Netgear eCos firmware so the Broadcom loader HTTP server comes up instead.
I've uploaded two photos, one front, one back, of the circuit board, which might help explain the serial bit:
I am open to other things to try. Ideas?
