Commit Graph

1838 Commits

Author SHA1 Message Date
Jonas Jelonek
e4ed8e7fe7
realtek: add support for Ubiquiti UniFi USW Aggregation
Add support for the RTL9303-based Ubiquiti UniFi USW Aggregation, an
8-port 10G SFP+ aggregation switch.

Hardware
========

  - RTL9303 SoC
  - 256 MiB DDR
  - 16 MiB SPI-NOR flash
  - 8x 1G/10G SFP+ cages
  - Per-port LEDs: 1x white LED per SFP+ cage
  - Buttons: 1x Reset
  - Console: TTL 3.3V, 115200 8N1, internal unpopulated 4-hole THT
    footprint (the device must be opened to solder a header)
    - pinout (with the front panel facing you, left to right):
      VCC/unused, RX, TX, GND
  - Front touch display (see below)
  - Software chain:
    - U-Boot (Ubiquiti-flavoured)
    - UniFi OS (OpenWrt-based)

MAC address
===========

Single MAC address derived from the eeprom partition. Applied to all
switch ports.

Front touch display
===================

The unit has a touch-capable front display, driven by a dedicated
STM32-based MCU connected to the host via UART. The MCU runs Ubiquiti's
LCM firmware and exposes a high-level JSON protocol (page selection,
button-press events, etc.); arbitrary pixel-level control is not
possible without replacing the MCU firmware. The display is therefore
not supported beyond what the stock LCM firmware offers.

Disclaimer
==========

Stock uses a dual-bank layout (kernel0/kernel1, 7 MiB each). OpenWrt
replaces both banks with a single contiguous firmware partition.
Flashing OpenWrt overwrites both stock kernel slots; U-Boot remains
intact and can be used for recovery.

The stock firmware blob is RSA-signed and cannot be flashed via the
UniFi web UI. Installation has to be done from a root shell on the
running UniFi OS.

Installation
============

1. Enable SSH on the stock UniFi OS and log in as root.

2. Copy the OpenWrt sysupgrade image to /tmp on the switch (e.g. via
   scp).

3. Adjust IMG below to point at the copied file, then run the block as
   a whole. It writes kernel0, splits into kernel1 if the image is
   larger than that slot (otherwise invalidates kernel1 so U-Boot
   cannot pick a stale bank), and reboots:

   IMG=/tmp/openwrt-realtek-rtl930x-ubnt_usw-aggregation-squashfs-sysupgrade.bin
   K0_BLOCKS=$((0x710000 / 0x10000))

   dd if="$IMG" of=/dev/mtdblock2 bs=64k count=$K0_BLOCKS conv=fsync
   if [ "$(wc -c < "$IMG")" -gt $((0x710000)) ]; then
       dd if="$IMG" of=/dev/mtdblock3 bs=64k skip=$K0_BLOCKS conv=fsync
   else
       dd if=/dev/zero of=/dev/mtdblock3 bs=64k count=1 conv=fsync
   fi
   sync
   reboot

   The switch comes up in OpenWrt after reboot.

It does not matter which bank stock booted from when the dd block
runs: both banks are touched in the same pass (kernel0 written, kernel1
either written or invalidated). With kernel1 invalidated, U-Boot's
internal fallback kicks in and permanently switches to kernel0 on the
next boot, so the device stays on OpenWrt as long as kernel0 is
bootable.

Recovery
========

Since the installation procedure invalidates or partially overwrites
the second bank, recovery requires serial console access (see Hardware
above for pinout).

1. Interrupt U-Boot autoboot by spamming a key during early boot to
   drop into the U-Boot prompt.

2. Bring up networking:

   rtk network on

3. Transfer an OpenWrt initramfs image via TFTP and boot it:

   tftpboot 0x82000000 <server>:<initramfs.bin>
   bootm 0x82000000

4. From the running initramfs OpenWrt, re-run the installation
   procedure above (the dd block, with $IMG pointing at the image on
   /tmp).

Return to stock firmware
========================

There is no fully-supported revert path. The stock firmware blob is a
Ubiquiti UBNT archive (header + parts, see firmware-utils' fw.h) that
embeds a u-boot and a kernel0 uImage payload; only the latter is
relevant when writing back to the kernel partitions.

The snippet below extracts the kernel0 uImage from such a blob by
locating the uImage magic and using the size carried in the uImage
header itself, without parsing any UBNT framing. It is provided as a
best-effort starting point; verify the result before flashing,
otherwise you're on your own:

   BLOB=US.rtl930x_X.Y.Z.bin
   OFF=$(grep -aboF $'\x27\x05\x19\x56' "$BLOB" | head -1 | cut -d: -f1)
   SIZE=$(( $(dd if="$BLOB" bs=1 skip=$((OFF + 12)) count=4 2>/dev/null \
               | hexdump -e '1/4 "%u"') + 64 ))
   dd if="$BLOB" of=kernel0.uImage bs=1 skip="$OFF" count="$SIZE"

Once you have a clean uImage, write it to both kernel banks (since
the bootselect mechanism is not yet decoded, this guarantees U-Boot
picks the stock image regardless of bank):

   dd if=kernel0.uImage of=/dev/mtdblock2 bs=64k conv=fsync
   dd if=kernel0.uImage of=/dev/mtdblock3 bs=64k conv=fsync

Link: https://github.com/openwrt/openwrt/pull/23506
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 19:32:31 +02:00
Jan Hoffmann
b20068672b
kernel: realtek: replace RTL8226 MDI swap patch by upstream version
A version of this patch has been accepted upstream, so use it here.

Link: https://lore.kernel.org/netdev/177932162564.3801238.2549776951847746974.git-patchwork-notify@kernel.org/
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
Link: https://github.com/openwrt/openwrt/pull/23493
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-23 17:25:59 +02:00
Jonas Jelonek
15593de376
realtek: pcs: derive SerDes link count from DT at probe time
Previously, sds->num_of_links was incremented from rtpcs_create() as
each DSA port bound its phylink_pcs. The count therefore relied on a
temporal contract (DSA must finish enumerating before pcs_config runs)
and on rtpcs_create() being the single chokepoint for all consumers.

Replace this with a probe-time scan of pcs-handle references in the
live OF tree: for every available consumer node carrying a pcs-handle
property pointing at one of our SerDes subnodes, bump that SerDes'
num_of_links. After the scan, the count is final regardless of when
or whether DSA later calls in.

To allow of_parse_phandle_with_args() to walk the property correctly,
add #pcs-cells = <0> to every serdes@N node in the 838x/839x/930x/931x
.dtsi files. A future cell-bearing form remains possible without
touching the scan.

Over-references (DT pointing more consumers at one SerDes than the
hardware can carry) are clamped at RTPCS_MAX_LINKS_PER_SDS and warned
about, but do not fail probe — the correctly-wired ports on that
SerDes still come up, and only the surplus reference is dropped.

The bounds check and the bare ++ in rtpcs_create() become redundant
under the scan-driven count and are removed.

This decouples num_of_links from DSA call ordering and is a prereq
for migrating to fwnode_pcs providers, where rtpcs_create() goes away
as the centralised counter.

Link: https://github.com/openwrt/openwrt/pull/23484
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-23 11:02:15 +02:00
Daniel Golle
8c264cf222 generic: 6.18: drop downstream RTL8261N driver
Now that the upstream RealTek PHY driver is patched to support also
the new 5G and 10G PHYs we can start to phase-out the messy downstream
driver.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-05-21 17:04:55 +01:00
Balázs Triszka
6369c9e5c7 generic: net: phy: realtek: add 5G and 10G PHY support
The functionality/support for 5G and 10G PHYs was extracted from the
realtek-phy driver and ported to the upstream Linux realtek PHY driver.
These PHY chips need a sequence of register writes (and similar operations)
for initialization. These sequences are provided as firmware files which
are interpreted/applied by a new register patch engine.

By switching to the upstream driver, it should be possible to get rid of a
large chunk of (from OpenWrt perspective) unmaintained code from Realtek.
The actual Linux phy-core infrastructure from Linux can be mostly used and
only the Realtek specific quirks need to be handled.

The files which need to be provided are depending on the PHY:

* rtl8261n.bin (package "rtl8261n-firmware" or "rtl8261n-lp-firmware")
  - RTL8251L 5Gbps PHY
  - RTL8261BE 10Gbps PHY
  - RTL8261N 10Gbps PHY
* rtl8264b.bin (package "rtl8264b-firmware")
  - RTL8254B 5Gbps PHY
  - RTL8264 10Gbps PHY
  - RTL8264B 10Gbps PHY

Files which are affected by this change (DEVICE_PACKAGES dependencies,
hwmon paths, default kernel configurations, refresh of patches, ...) are
updated at the same times.

Signed-off-by: Balázs Triszka <info@balika011.hu>
Co-authored-by: Semih Baskan <strst.gs@gmail.com>
Co-authored-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Co-authored-by: Gilly1970 <gilroyscott@hotmail.com>
Co-authored-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Co-authored-by: Carlo Szelinsky <github@szelinsky.de>
[sven: rebase, integrate suggestions from PR, add device packages, split]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[daniel: stripped to Linux 6.18 only, dropped unrelated changes]
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-05-21 17:04:55 +01:00
Markus Stockhausen
c27f9b3ba0 realtek: eth: rename netdev/ndev variables to dev
Right now the driver uses variable names netdev/ndev/dev to access
a net_device structure. Align this with most of the other upstream
drivers and convert everything to dev.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23420
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:19:47 +02:00
Markus Stockhausen
d3577dfbf3 realtek: eth: get rid of struct device
In the network context there might be confusion between "struct netdev"
and "struct device". The driver should avoid variables of type device
and name "dev" where possible. Remove all variables that point to the
device and use pdev->dev instead. This is like other network drivers
do it.

While we are here modernize logging during probing. Remove messages
from helpers and log errors during probing with dev_err_probe().

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23420
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:19:47 +02:00
Markus Stockhausen
04433b4e75 realtek: eth: better error handling in init_mac()
The function init_mac() can produce errors for the RTL931x devices.
When this happens it throws a message but continues. That can
leave the hardware in a wrong state.

Cleanup the error handling. Remove all messages from the function
and simply return an error value. In the probe() consumer evaluate
this error and abort probing if needed. As there were no reported
issues in the past it is ok to drop the detailed messages and
aggregate them in a single one.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23420
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:19:47 +02:00
Markus Stockhausen
a1a4b09076 realtek: eth: reorganize control structure setup
Early assign pdev and netdev to the control structure during probing.
This way it can be used at any time later.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23420
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:19:47 +02:00
Markus Stockhausen
76e47b4421 realtek: mdio: convert to scoped_guard()
Upstream netdev does not like big guards. Especially
around debugging functions. Convert to scoped_guard()
and only lock the really needed code parts. This way
all debugging can run outside of the lock.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23411
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:10:27 +02:00
Markus Stockhausen
b8fc512a05 realtek: mdio: convert to consistent a_to_b() helpers
Majority of kernel uses a_to_b(a) instead of b_from_a(a).
Convert to that to be consistent with all helpers in the
driver. Additionally drop inline function definitions.
Let the compiler decide what is best.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23411
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:10:27 +02:00
Markus Stockhausen
57dbfa0a9c realtek: mdio: checkpatch & documentation cleanup
checkpatch is complaining. Fix that. Additionally adapt the
documentation and move it up to the beginning of the driver.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23411
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:10:27 +02:00
Jonas Jelonek
c166c20cf6 realtek: add hog for PHY reset for XS1930-10 and -12HP
Add a GPIO hog for those two switches to avoid having a dangling GPIO
which might be pulled accidentally breaking all PHYs, and to have that
GPIO documented.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:42 +02:00
Jonas Jelonek
8d9103a420 realtek: improve DTS readability for XS1930 switches
Improve the readability of the DTS files for XS1930 switches by mostly
making nodes with only a single property a one-liner. This wastes less
visual space and makes it more fluent to read.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:42 +02:00
Jonas Jelonek
ce7a5037f3 realtek: make LED set config for XS1930 more generic
The led_set node was previously duplicated in the per-device DTS for
-10/-12HP and -12F, even though all three share the same Base-T LED
encoding. Move the shared led_set with the Base-T mapping into the
common DTSI as set 0, and have XS1930-12F append its SFP-port mapping
as led_set1 via a property override. Swap the led-set index on the
-12F ports accordingly so SFP ports use set 1 and the two Base-T
ports use set 0.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:42 +02:00
Jonas Jelonek
50185c8708 realtek: add additional LED for XS1930-12HP
The -12HP variant has a dedicated red LED on GPIO 3 that lights up
when the PoE budget is exhausted. Add it as led_poe_max with
function = "poe-usage" so userspace can drive it from the PoE stack.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:42 +02:00
Jonas Jelonek
9114f49446 realtek: fix LED function for XS1930 switches
The cloud and locator LEDs were declared with no function (cloud) or
with the generic LED_FUNCTION_INDICATOR (locator), which doesn't
match what the hardware actually exposes. Use the descriptive
function strings "cloud" and "locator" instead so the LEDs end up
with sensible names in sysfs.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:42 +02:00
Jonas Jelonek
15ff65e522 realtek: fix SYS LED for XS1930-12HP
The XS1930-12HP model from Zyxel doesn't actually use the same GPIOs for
the SYS LED. This was assumed first but proved wrong now. Instead, the
green part of the SYS LED is on another GPIO and the red part of the SYS
LED is on GPIO 0 instead of the green part. Adjust that accordingly in
the device tree.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:41 +02:00
Jonas Jelonek
d750f5f454 realtek: free restore button of XS1930 switches
The support addition for those switches defined the restore button as a
button to trigger a restart. However, those switches also have a reset
button which is wired to the SoC's reset line, causing a reset upon
pressing. Thus, using the restore button for basically the same purpose
doesn't make sense. Change the 'linux,code' property to 'BTN_0' to
assign no real function to that button, allowing it to be used for
different purposes.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:41 +02:00
Jonas Jelonek
161a871edd realtek: wire up GPIO fan for Zyxel XS1930 switches
The switches from Zyxels XS1930 have one or two fans in the case. They
might be controlled in a limited fashion. There's a single GPIO which -
depending on the state - drives the fan in slow or fast mode. Wire that
up as a device tree node to be able to control that in userspace.

XS1930-10 and XS1930-12HP use the same GPIO while XS1930-12F moves that
to one of its GPIO expanders. Also add 'kmod-hwmon-gpiofan' for all
three devices to be selected by default.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:41 +02:00
Jonas Jelonek
0c50884201 realtek: reorganize DTS for Zyxel XS1930
XS1930-10 and XS1930-12HP share most of their layout: the same
8-port AQR813 Base-T block, the same SFP+ GPIO mux, identical I2C
master config and serdes polarity. Carve those shared pieces out
into a new intermediate rtl9313_zyxel_xs1930-aqr813.dtsi and have both
device DTS files include it, leaving only their device-specific
differences (LED-set masks, extra PoE bits on -12HP, extra AQR113C
PHYs on -12HP) in the per-device files. XS1930-12F continues to
include the common DTSI directly since its layout differs too much
to share usefully.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:41 +02:00
Jonas Jelonek
d349945f82 realtek: move XS1930 LED definitions to common DTSI
The power, cloud and locator LEDs exist on all three XS1930 variants
with the same colors and roles, only the GPIOs differ. Declare them
once in the common DTSI with the -10/-12HP pinout and let -12F
override the gpios properties via phandle references. This removes
three near-identical led-node blocks from the device DTS files.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:41 +02:00
Markus Stockhausen
3c4a547eb2 realtek: thermal: separate initialization/operation
The driver uses lazy initialization - during first temperature
get. Checking enabled status over and over again does not make
sense. Provide separate setup functions for this. With this split
the error handling will be improved. If initialization fails, the
sensor will not be registered at all.

While we are here fix some minor typos.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23405
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:07:57 +02:00
Markus Stockhausen
da2a5cc3ac realtek: irq: switch to of_fwnode_handle()
Kernel 6.19 will get rid of of_node_to_fwnode(). Switch to its
successor of_fwnode_handle() that is already available in 6.18.
This will simplify a future kernel upgrade.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23434
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-19 10:52:23 +02:00
Jonas Jelonek
48b242733a realtek: add support for Zyxel XGS1930-28HP
Add support for the RTL9301-based Zyxel XGS1930-28HP, a 28-port Gigabit
PoE+ switch. The XGS1930 is an EOL Zyxel series of RTL9301-based
switches available with 28 or 52 ports, with and without PoE.

Hardware
========

  - RTL9301 SoC
  - 512 MiB DDR3 RAM
  - 32 MiB SPI-NOR flash
  - 24x 10/100/1000M RJ45 ports
  - 4x 1G/10G SFP+ cages
  - PoE:
    - 802.3af/at on all 24 RJ45 ports
    - 375 W total power budget
  - RTL8231 for port LEDs
  - Front LEDs: PWR, SYS, CLOUD, LOCATOR, PoE usage bar (5 steps)
  - Buttons: 1x "Restore"
  - Console: TTL 3.3V, 115200 8N1, 4-pin header
    - pinout (front to back): GND RX TX -
  - Software chain:
    - Bootbase/stripped-down U-Boot
    - RAS/ZyNOS

MAC address
===========

Single MAC address derived from the board partition. Applied to all
switch ports.

Disclaimer
==========

PoE is not yet supported.

Flashing OpenWrt overwrites ZyNOS. The Bootbase/U-Boot remains intact
and can be used for recovery.

Installation
============

Simple web upgrade:

1. Take the OpenWrt factory.bin image generated by the build.

2. In the ZyNOS web UI, login and go to Maintenance -> Firmware Upgrade.

3. If the device runs ZyNOS 5.00, untick "Enhanced firmware integrity
   check sha256sum". Otherwise the upload check will reject the image.

4. Select and upload the factory.bin image and click upgrade.

5. After flashing has finished, reboot the switch. It will now boot
   into OpenWrt.

Initramfs boot
==============

Luckily the switch uses a standard design, thus networking works with
a default hardware profile of RTK U-boot.

1. Connect to the serial console and interrupt the boot process by
   spamming '$' during the DRAM test to drop into Bootbase/U-Boot.

2. Bring up the network:

   > rtk network on

   Use a copper port; the SFP+ cages are likely not usable from the
   bootloader.

3. Load the initramfs image via TFTP:

   > tftpboot 0x82000000 <server>:<image>

4. Run the image (not bootm, the image has no uImage header):

   > go 0x82000000

Return to stock firmware
========================

1. Download the stock firmware for the switch from the Zyxel website
   and unzip it; there should be a .bin file with an alphanumeric name.

2. Upload that file to the running OpenWrt instance.

3. Flash it (use -F since the image has no OpenWrt metadata):

   > sysupgrade -F <stock-firmware>.bin

4. Wait for sysupgrade to finish and the switch to reboot. ZyNOS should
  come up again.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23389
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 13:12:18 +02:00
Andreas Böhler
6ee3f80efb realtek: add support for XikeStor SKS7300-4X4T
The XikeStor SKS7300-4X4T is a 10GbE switch with 4x copper ports and
4x SFP slots. It has a built-in console port and is powered by a RTL9303
SoC.

Specifications:
---------------

  * Soc: RTL9303
  * Flash: 32 MiB SPI flash
  * RAM: 512 MiB
  * Ethernet: 8x 10/100/1000/2500/5000/10000 Mbps
  * Buttons: 1x Reset
  * UART: CISCO console ports on the front, 115200, 8n1
  * controllable fan, integrated temperature sensor

Not yet enabled:
----------------
  * Fan control: it's controlled via simple i2c registers, but no driver
                 has been written yet.

Installation:
-------------

This device uses an obfuscated bootloader and an obfuscated image. As such,
the installation can only be performed using the console ports.

1. Set the switch to boot from the first image.

2. Attach console cable and hold Ctrl+C while powering on the switch

3. After a few seconds, a very basic U-Boot menu appears. Wait for the user
   input to appear, then press "z" to get to the message "Please input auth
   code".

4. Type "jiangks" as the password, the RTL9300 prompt appears.

5. Load the OpenWrt initramfs image via TFTP:

   > setenv serverip 192.168.0.1
   > setenv ipaddr 192.168.0.2
   > tftpboot 0x83000000 openwrt.bin
   > bootm 0x83000000

6. Once OpenWrt has booted, use the "sysupgrade" image to perform the
   actual installation.

7. Reboot the switch and enjoy OpenWrt.

Recovery/return to stock:
-------------------------

Flash an OEM firmware upgrade file via sysupgrade.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
Link: https://github.com/openwrt/openwrt/pull/23305
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 13:11:05 +02:00
Andreas Böhler
c0dccbfb82 realtek: kernel: enable GPIO watchdog modules
Enable the GPIO watchdog kernel module

Signed-off-by: Andreas Böhler <dev@aboehler.at>
Link: https://github.com/openwrt/openwrt/pull/23305
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 13:11:05 +02:00
Andreas Böhler
83ee633b19 realtek: add xikestor sks7300-img tool
Add build recipe for creating images using the sks7300-img tool that was
recently added to firmware-utils.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
Link: https://github.com/openwrt/openwrt/pull/23305
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 13:11:05 +02:00
Markus Stockhausen
42cf34d3f8 realtek: pcs: use devm_kzalloc()
Just for safety. Use device managed operation so the
memory is automatically reclaimed when the parent PCS
controller is removed.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23391
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 12:34:47 +02:00
Markus Stockhausen
c83c74a482 realtek: pcs: replace mdelay() with usleep_range()
Use CPU friendly operation.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23391
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 12:34:47 +02:00
Markus Stockhausen
410cc636d7 realtek: pcs: fix use after free
In rtpcs_probe_serdes_bus(), the code manages the device
tree node reference incorrectly:

- It acquires a node pointer np via of_find_compatible_node(),
  which increments the reference count.

- It calls of_mdio_find_bus(np) to locate the bus.

- It calls of_node_put(np), which decrements the reference
  count. If this was the last reference, the node is freed.

- It then attempts to check if (!of_device_is_available(np)).

The pointer np is used after its reference has been released.
This can lead to a kernel oops or unpredictable behavior if
the memory has been reclaimed.

Fixes: fe27cce1e ("realtek: add SerDes PCS driver")
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23391
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 12:34:47 +02:00
Markus Stockhausen
965bfd55c2 realtek: eth: create phylink before device registration
As soon as devm_register_netdev returns, the network
interface is "live" and the kernel can call rteth_open().
If the interface is brought up immediately (e.g., by a
userspace script), rteth_open will attempt to call
phylink_start(ctrl->phylink), which will crash the
system because ctrl->phylink has not been assigned yet.

Reorder probing sequence.

While we are here sort the variables by length.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23375
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 12:23:34 +02:00
Markus Stockhausen
8134e6d187 realtek: eth: fix transmit path unmapping order
packet->dma is overwritten with a new mapping before
the previous buffer is unmapped. This causes the kernel
to unmap the wrong memory address, leading to memory
leaks and potential corruption.

Additionally set skb pointer to NULL to avoid a free
when the buffer is recycled next time.

Reorder unmapping/mapping sequence.

Fixes: 41300fd88 ("refactor transmit function")
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23375
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 12:23:34 +02:00
Markus Stockhausen
ae38d72a7a realtek: mdio: rename "busses" to "buses"
Use upstream standard for plural of bus.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23299
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 12:22:08 +02:00
Markus Stockhausen
530f544e25 realtek: mdio: Enable polling after setup
The mdio driver currently leaves the phy polling disabled after
setup. The dsa driver takes over and mangles the polling registers
so that they fit its needs. While polling is something in between
mdio (PHY) and dsa (MAC) it should be controlled by the mdio
driver.

Add a final "polling enable" function to the mdio driver so that
the MAC registers are filled automatically. For this

- split valid_ports into phy_ports (attached to PHY) and sds_ports
  (attached to SerDes)
- Improve the probing so it can differentiate between a phy and a
  sds port. This is resolved by the "phy-handle" attribute.
- Split the for_each_port macro into a phy and sds version.
- After probing enable polling for all phy and sds ports.

With this in place the dsa driver can remove the polling setup
completely.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23299
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 12:22:08 +02:00
Rosen Penev
3887ef5d8a treewide: remove unused u-boot,env compatible
This was used for non nvmem-layout ubootenv support. Since that's gone
and it's not even used anyway, remove.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22367
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-14 23:02:47 +02:00
Sven Eckelmann
12d41dce06 realtek: rtl930x: psx8: specify RTL8224 reset GPIO
The nRESET pins of the RTL8224 PHYs on the PSX8/PSX10 are wired to GPIO6
(lan1-4) + GPIO10 (lan5-8) of the SoC, but this was never described in the
devicetree.

GPIO 6 is the global reset shared by (logical) PHYs 0-3 on MDIO bus0. GPIO
10 is the global reset shared by (logical) PHYs 8-11 on mdio bus0. It is
intentionally not declared as reset-gpios on any bus: the MDIO driver /
phylink only support a single reset GPIO per bus, not two (or more). And a
GPIO can only be used as reset-gpio on a single PHY. Attaching it to a
single PHY would still reset the other PHYs on the same chip as a side
effect, leaving their software state out of sync with the hardware and
likely breaking them.

Signed-off-by: Sven Eckelmann <se@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/23297
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-13 11:34:34 +02:00
Sven Eckelmann
80e53edc87 realtek: rtl931x: psx28: specify RTL8224 reset GPIO
The nRESET pins of the RTL8224 PHYs on the PSX28/ESX28 are wired to GPIO29
of the SoC, but this was never described in the devicetree.

GPIO 29 is the global reset shared by all PHYs across all MDIO busses. It
is intentionally not declared as reset-gpios on any bus: the MDIO driver /
phylink only support a reset GPIO per bus, not on the parent controller.
Attaching it to a single bus would still reset the PHYs on the other busses
as a side effect, leaving their software state out of sync with the
hardware and likely breaking them.

Signed-off-by: Sven Eckelmann <se@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/23297
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-13 11:34:34 +02:00
Jonas Jelonek
6a3db77f2b realtek: pcs: rtl930x: drop superfluous debug prints
The RTL930x calibration code is especially chatty. There are debug
prints for every start and end of a section corresponding to the
sections the SDK uses. In the end, this doesn't help a user much and
just wastes CPU cycles. Moreover it doesn't help in understand what is
done there. As a first step, drop "start" and "end" prints but preserve
their meaning as comments.

While at it, slightly adjust two other prints and drop one confusing
print.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23288
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 14:41:53 +02:00
Jonas Jelonek
ac9e968a6f realtek: pcs: rtl930x: reduce chattiness and reg ops
There is no need to be extra chatty for simple writes which set a single
bit. As a nice side effect, without the prints there's no need to have
open-coded register access when there a helper that covers that.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23288
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 14:41:53 +02:00
Jonas Jelonek
44b809b73d realtek: pcs: rtl931x: reduce chattiness
The SerDes setup code for RTL931x still has a lot of debug prints as
pr_info from former times. A lot has changed and we don't need that
rather useless chattiness anymore. We reached a state where we have a
standalone setup of most hardware modes. The registers printed are still
"documented" in rtpcs_931x_sds_config_hw_mode and
rtpcs_93xx_sds_config_cmu. For every other issues we rely on comparison
of full SerDes dumps instead of cherry-picked registers.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23288
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 14:41:53 +02:00
Jonas Jelonek
bdddc753c5 realtek: add support for Zyxel XMG1915-10EP
Specifications
==============

- SoC: RTL9302C
- Flash: 32 MiB SPI NOR flash
- RAM: 256 MiB
- Ethernet: 8x 10/100/1000/2500 Mbps (RTL8224)
- PoE: 802.3 af/at/bt on 8x RJ45 ports
    - 60W per port, 130W total budget
- SFP: 2x SFP+ cages
- UART: 1x 4 pins serial header, 115200 bauds, 8n1, 3.3v logic levels,
        pinout: unused (top), TX, RX, GND (bottom)
- Buttons: 1x "Restore" button, 1x "LED mode" button

MAC address
===========

Single MAC address derived from board partition with vendor-specific
format. MAC address is 70:49:a2:xx:xx:xx and applied to all switch
ports.

PoE
===

PoE is supported by realtek-poe package. To make it work, additional
options in the realtek-poe configuration file /etc/config/poe must be
set:

    config globals
            option force_baudrate '115200'
	    option force_dialect 'realtek'

Disclaimer
==========

Flashing OpenWrt will overwrite BootExtension + ZyNOS. BootExtension
functionality is not available anymore then. The U-boot/Bootbase still
has some limited functionality which can be used in emergency cases.

Installation
============

Simple web upgrade:

1. Take the OpenWrt factory.bin image generated by the build.

2. In the ZyNOS web UI, login and go to Maintenance -> Firmware Upgrade.

3. Under "Boot Image", make sure the Config Boot Image is set to 1. In
   other words, make sure the switch booted from firmware image 1 or it
   will do so on next reboot.
   This is crucial, otherwise OpenWrt cannot boot.

4. Below, select and upload the factory.bin image. After clicking
   upgrade, the image will be flashed.

5. After flashing has finished, reboot the switch. It will now boot into
   OpenWrt.

U-Boot
======

This device ships with U-boot masked as Bootbase. After the device is
powered, a DRAM test is performed. Spamming $ during that test will drop
you into a shell after test finished. You'll have a limited command set
at first.

Unlocking the shell with [1] or [2] will give you a normal U-boot
command set. From here, you can perform initramfs boot or recovery.

Initramfs boot:
> loady 0x82000000 + go 0x82000000

Recovery:
> upgradeY image2 0x82000000 115200

Return to stock firmware
========================

1. Download the firmware for the switch from Zyxel website.

2. Unzip the download, there should be a .bin file with a alphanumeric
   name.

3. Upload this file to running OpenWrt.

4. Run (use -F since the image doesn't have image metadata):

   > sysupgrade -F <stock-firmware>.bin

5. Wait for the sysupgrade to succeed and the switch reboot. At the next
   boot, ZyNOS should come up again.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23218
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:34:53 +02:00
Jonas Jelonek
e9de36484d realtek: dts: rtl930x: add pinctrl and pinmux for UART1
RTL930x SoCs have a second serial interface UART1 which is exposed on
dual-function pins shared with JTAG. The SoC defaults to the JTAG
functionality after reset. Similar to existing pinmux registers, there's
a separate register for that where a selector decides about JTAG vs
UART.

Add a now pinctrl node for that register and a pinmux node to enable
UART1 functionality. Reference the pinmux in the (by default disabled)
uart1 node. Without this, UART1 doesn't work when it is actually needed.
This is e.g. the case with some PoE-capable switch where the PSE MCU
communicates with the SoC via UART instead of I2C.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23218
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:34:53 +02:00
Jonas Jelonek
426b1a97ac realtek: make Zyxel XMG1915-10E generic for whole family
The XMG1915 is a switch family with multiple variants sharing nearly
all hardware (same SoC, PHYs, SFP cages, LEDs) and mainly differing
in PoE and minor details.

In preparation for adding further variants, move the bulk of the
device tree into a shared rtl9302_zyxel_xmg1915.dtsi and reduce the
per-device dts to the device identity (compatible, model) plus any
variant-specific nodes.

For images, factor a Device/zyxel_xmg1915 template holding the shared
build settings so per-device definitions only need DEVICE_MODEL.

No functional change for XMG1915-10E.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23218
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:34:53 +02:00
Jonas Jelonek
24aeb5cc09 realtek: support web vendor upgrade for XMG1915-10E
So far the XMG1915-10E used the rt-loader-bootbase recipe which
produces a separate loader.bin and only allows installation/upgrade
from the CLI side, not via the Zyxel web UI.

Switch to the standard zyxel_zynos image recipe shared with the other
Zyxel rtl930x devices. The loader now lives inside the 'factory'
parent partition introduced in the previous commit, so the resulting
single sysupgrade image can be flashed both from the vendor web UI
and via sysupgrade. Hook the device into the existing xs1930 case in
platform.sh which sets PART_NAME=factory and calls default_do_upgrade.

This makes the installation and revert procedure in 94607d6285
("realtek: add support for Zyxel XMG1915-10E") mostly obsolete and
partly not working anymore (due to different build images that are
emitted).

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23218
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:34:53 +02:00
Jonas Jelonek
f9bdfcb553 realtek: fix Zyxel XMG1915-10E partition layout
When support for this device was added, the partition layout was defined
in a way that doesn't use space as intended and wastes quite a lot of
it.

(1) firmware partition starts at offset 0x1260000. This is the second
    partition/B partition in the A/B scheme used by Zyxel. While the
    commit mentions the image is written to A, the firmware partition
    is defined in the B space.
(2) firmware partition only ~16MB in size. The device has a total of
    32MB of flash. The vendor uses an A/B scheme but OpenWrt doesn't use
    it. Thus, OpenWrt can make use of the full available space.
(3) loader partition too big. Other devices using rt-loader explicitly
    in a partition use a size of 0x10000. This is more than enough
    already. The device here uses 0x30000 which is mostly wasted.

Those issues are fixed accordingly. While at it, move partitions 'loader'
and 'firmware' into a parent partition 'factory'. This is a preparation
for adding web upgrade support for this device.

Fixes: 94607d6285 ("realtek: add support for Zyxel XMG1915-10E")
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23218
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:34:53 +02:00
Markus Stockhausen
8482b9983b realtek: mdio: add reverse lookup bus/phy to port
Until now there is a O(n) loop that looks up a port for a
given bus/phy combination. This is slow for high port count
devices (RTL839x and RTL931x). Implement a efficient reverse
lookup table for that.

While we are here adapt tiny bits of the documentation to
better reflect the driver logic after the recent refactoring.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23230
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:32:30 +02:00
Markus Stockhausen
dc08ffc707 realtek: mdio: drop memset
Use modern compound literal assignment instead.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23230
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:32:30 +02:00
Markus Stockhausen
f3cd53b6a1 realtek: mdio: convert to modern fwnode helpers
Upstream is slowly converting from "of_" to "fwnode_" handling.
This is a more modern and generic approach. Make use of it.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23230
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:32:29 +02:00
Markus Stockhausen
6186f04af8 realtek: mdio: change prefix from "rtmdio_" to "rtmd_"
The long prefix distracts the reader from the real variables,
functions and defines. Shorten it to "rtmd_" that is not
used by any other upstream driver.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23230
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:32:29 +02:00