Commit Graph

257 Commits

Author SHA1 Message Date
Jonas Jelonek
e4ed8e7fe7
realtek: add support for Ubiquiti UniFi USW Aggregation
Add support for the RTL9303-based Ubiquiti UniFi USW Aggregation, an
8-port 10G SFP+ aggregation switch.

Hardware
========

  - RTL9303 SoC
  - 256 MiB DDR
  - 16 MiB SPI-NOR flash
  - 8x 1G/10G SFP+ cages
  - Per-port LEDs: 1x white LED per SFP+ cage
  - Buttons: 1x Reset
  - Console: TTL 3.3V, 115200 8N1, internal unpopulated 4-hole THT
    footprint (the device must be opened to solder a header)
    - pinout (with the front panel facing you, left to right):
      VCC/unused, RX, TX, GND
  - Front touch display (see below)
  - Software chain:
    - U-Boot (Ubiquiti-flavoured)
    - UniFi OS (OpenWrt-based)

MAC address
===========

Single MAC address derived from the eeprom partition. Applied to all
switch ports.

Front touch display
===================

The unit has a touch-capable front display, driven by a dedicated
STM32-based MCU connected to the host via UART. The MCU runs Ubiquiti's
LCM firmware and exposes a high-level JSON protocol (page selection,
button-press events, etc.); arbitrary pixel-level control is not
possible without replacing the MCU firmware. The display is therefore
not supported beyond what the stock LCM firmware offers.

Disclaimer
==========

Stock uses a dual-bank layout (kernel0/kernel1, 7 MiB each). OpenWrt
replaces both banks with a single contiguous firmware partition.
Flashing OpenWrt overwrites both stock kernel slots; U-Boot remains
intact and can be used for recovery.

The stock firmware blob is RSA-signed and cannot be flashed via the
UniFi web UI. Installation has to be done from a root shell on the
running UniFi OS.

Installation
============

1. Enable SSH on the stock UniFi OS and log in as root.

2. Copy the OpenWrt sysupgrade image to /tmp on the switch (e.g. via
   scp).

3. Adjust IMG below to point at the copied file, then run the block as
   a whole. It writes kernel0, splits into kernel1 if the image is
   larger than that slot (otherwise invalidates kernel1 so U-Boot
   cannot pick a stale bank), and reboots:

   IMG=/tmp/openwrt-realtek-rtl930x-ubnt_usw-aggregation-squashfs-sysupgrade.bin
   K0_BLOCKS=$((0x710000 / 0x10000))

   dd if="$IMG" of=/dev/mtdblock2 bs=64k count=$K0_BLOCKS conv=fsync
   if [ "$(wc -c < "$IMG")" -gt $((0x710000)) ]; then
       dd if="$IMG" of=/dev/mtdblock3 bs=64k skip=$K0_BLOCKS conv=fsync
   else
       dd if=/dev/zero of=/dev/mtdblock3 bs=64k count=1 conv=fsync
   fi
   sync
   reboot

   The switch comes up in OpenWrt after reboot.

It does not matter which bank stock booted from when the dd block
runs: both banks are touched in the same pass (kernel0 written, kernel1
either written or invalidated). With kernel1 invalidated, U-Boot's
internal fallback kicks in and permanently switches to kernel0 on the
next boot, so the device stays on OpenWrt as long as kernel0 is
bootable.

Recovery
========

Since the installation procedure invalidates or partially overwrites
the second bank, recovery requires serial console access (see Hardware
above for pinout).

1. Interrupt U-Boot autoboot by spamming a key during early boot to
   drop into the U-Boot prompt.

2. Bring up networking:

   rtk network on

3. Transfer an OpenWrt initramfs image via TFTP and boot it:

   tftpboot 0x82000000 <server>:<initramfs.bin>
   bootm 0x82000000

4. From the running initramfs OpenWrt, re-run the installation
   procedure above (the dd block, with $IMG pointing at the image on
   /tmp).

Return to stock firmware
========================

There is no fully-supported revert path. The stock firmware blob is a
Ubiquiti UBNT archive (header + parts, see firmware-utils' fw.h) that
embeds a u-boot and a kernel0 uImage payload; only the latter is
relevant when writing back to the kernel partitions.

The snippet below extracts the kernel0 uImage from such a blob by
locating the uImage magic and using the size carried in the uImage
header itself, without parsing any UBNT framing. It is provided as a
best-effort starting point; verify the result before flashing,
otherwise you're on your own:

   BLOB=US.rtl930x_X.Y.Z.bin
   OFF=$(grep -aboF $'\x27\x05\x19\x56' "$BLOB" | head -1 | cut -d: -f1)
   SIZE=$(( $(dd if="$BLOB" bs=1 skip=$((OFF + 12)) count=4 2>/dev/null \
               | hexdump -e '1/4 "%u"') + 64 ))
   dd if="$BLOB" of=kernel0.uImage bs=1 skip="$OFF" count="$SIZE"

Once you have a clean uImage, write it to both kernel banks (since
the bootselect mechanism is not yet decoded, this guarantees U-Boot
picks the stock image regardless of bank):

   dd if=kernel0.uImage of=/dev/mtdblock2 bs=64k conv=fsync
   dd if=kernel0.uImage of=/dev/mtdblock3 bs=64k conv=fsync

Link: https://github.com/openwrt/openwrt/pull/23506
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 19:32:31 +02:00
Jonas Jelonek
15593de376
realtek: pcs: derive SerDes link count from DT at probe time
Previously, sds->num_of_links was incremented from rtpcs_create() as
each DSA port bound its phylink_pcs. The count therefore relied on a
temporal contract (DSA must finish enumerating before pcs_config runs)
and on rtpcs_create() being the single chokepoint for all consumers.

Replace this with a probe-time scan of pcs-handle references in the
live OF tree: for every available consumer node carrying a pcs-handle
property pointing at one of our SerDes subnodes, bump that SerDes'
num_of_links. After the scan, the count is final regardless of when
or whether DSA later calls in.

To allow of_parse_phandle_with_args() to walk the property correctly,
add #pcs-cells = <0> to every serdes@N node in the 838x/839x/930x/931x
.dtsi files. A future cell-bearing form remains possible without
touching the scan.

Over-references (DT pointing more consumers at one SerDes than the
hardware can carry) are clamped at RTPCS_MAX_LINKS_PER_SDS and warned
about, but do not fail probe — the correctly-wired ports on that
SerDes still come up, and only the surplus reference is dropped.

The bounds check and the bare ++ in rtpcs_create() become redundant
under the scan-driven count and are removed.

This decouples num_of_links from DSA call ordering and is a prereq
for migrating to fwnode_pcs providers, where rtpcs_create() goes away
as the centralised counter.

Link: https://github.com/openwrt/openwrt/pull/23484
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-23 11:02:15 +02:00
Jonas Jelonek
c166c20cf6 realtek: add hog for PHY reset for XS1930-10 and -12HP
Add a GPIO hog for those two switches to avoid having a dangling GPIO
which might be pulled accidentally breaking all PHYs, and to have that
GPIO documented.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:42 +02:00
Jonas Jelonek
8d9103a420 realtek: improve DTS readability for XS1930 switches
Improve the readability of the DTS files for XS1930 switches by mostly
making nodes with only a single property a one-liner. This wastes less
visual space and makes it more fluent to read.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:42 +02:00
Jonas Jelonek
ce7a5037f3 realtek: make LED set config for XS1930 more generic
The led_set node was previously duplicated in the per-device DTS for
-10/-12HP and -12F, even though all three share the same Base-T LED
encoding. Move the shared led_set with the Base-T mapping into the
common DTSI as set 0, and have XS1930-12F append its SFP-port mapping
as led_set1 via a property override. Swap the led-set index on the
-12F ports accordingly so SFP ports use set 1 and the two Base-T
ports use set 0.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:42 +02:00
Jonas Jelonek
50185c8708 realtek: add additional LED for XS1930-12HP
The -12HP variant has a dedicated red LED on GPIO 3 that lights up
when the PoE budget is exhausted. Add it as led_poe_max with
function = "poe-usage" so userspace can drive it from the PoE stack.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:42 +02:00
Jonas Jelonek
9114f49446 realtek: fix LED function for XS1930 switches
The cloud and locator LEDs were declared with no function (cloud) or
with the generic LED_FUNCTION_INDICATOR (locator), which doesn't
match what the hardware actually exposes. Use the descriptive
function strings "cloud" and "locator" instead so the LEDs end up
with sensible names in sysfs.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:42 +02:00
Jonas Jelonek
15ff65e522 realtek: fix SYS LED for XS1930-12HP
The XS1930-12HP model from Zyxel doesn't actually use the same GPIOs for
the SYS LED. This was assumed first but proved wrong now. Instead, the
green part of the SYS LED is on another GPIO and the red part of the SYS
LED is on GPIO 0 instead of the green part. Adjust that accordingly in
the device tree.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:41 +02:00
Jonas Jelonek
d750f5f454 realtek: free restore button of XS1930 switches
The support addition for those switches defined the restore button as a
button to trigger a restart. However, those switches also have a reset
button which is wired to the SoC's reset line, causing a reset upon
pressing. Thus, using the restore button for basically the same purpose
doesn't make sense. Change the 'linux,code' property to 'BTN_0' to
assign no real function to that button, allowing it to be used for
different purposes.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:41 +02:00
Jonas Jelonek
161a871edd realtek: wire up GPIO fan for Zyxel XS1930 switches
The switches from Zyxels XS1930 have one or two fans in the case. They
might be controlled in a limited fashion. There's a single GPIO which -
depending on the state - drives the fan in slow or fast mode. Wire that
up as a device tree node to be able to control that in userspace.

XS1930-10 and XS1930-12HP use the same GPIO while XS1930-12F moves that
to one of its GPIO expanders. Also add 'kmod-hwmon-gpiofan' for all
three devices to be selected by default.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:41 +02:00
Jonas Jelonek
0c50884201 realtek: reorganize DTS for Zyxel XS1930
XS1930-10 and XS1930-12HP share most of their layout: the same
8-port AQR813 Base-T block, the same SFP+ GPIO mux, identical I2C
master config and serdes polarity. Carve those shared pieces out
into a new intermediate rtl9313_zyxel_xs1930-aqr813.dtsi and have both
device DTS files include it, leaving only their device-specific
differences (LED-set masks, extra PoE bits on -12HP, extra AQR113C
PHYs on -12HP) in the per-device files. XS1930-12F continues to
include the common DTSI directly since its layout differs too much
to share usefully.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:41 +02:00
Jonas Jelonek
d349945f82 realtek: move XS1930 LED definitions to common DTSI
The power, cloud and locator LEDs exist on all three XS1930 variants
with the same colors and roles, only the GPIOs differ. Declare them
once in the common DTSI with the -10/-12HP pinout and let -12F
override the gpios properties via phandle references. This removes
three near-identical led-node blocks from the device DTS files.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23428
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-21 12:08:41 +02:00
Jonas Jelonek
48b242733a realtek: add support for Zyxel XGS1930-28HP
Add support for the RTL9301-based Zyxel XGS1930-28HP, a 28-port Gigabit
PoE+ switch. The XGS1930 is an EOL Zyxel series of RTL9301-based
switches available with 28 or 52 ports, with and without PoE.

Hardware
========

  - RTL9301 SoC
  - 512 MiB DDR3 RAM
  - 32 MiB SPI-NOR flash
  - 24x 10/100/1000M RJ45 ports
  - 4x 1G/10G SFP+ cages
  - PoE:
    - 802.3af/at on all 24 RJ45 ports
    - 375 W total power budget
  - RTL8231 for port LEDs
  - Front LEDs: PWR, SYS, CLOUD, LOCATOR, PoE usage bar (5 steps)
  - Buttons: 1x "Restore"
  - Console: TTL 3.3V, 115200 8N1, 4-pin header
    - pinout (front to back): GND RX TX -
  - Software chain:
    - Bootbase/stripped-down U-Boot
    - RAS/ZyNOS

MAC address
===========

Single MAC address derived from the board partition. Applied to all
switch ports.

Disclaimer
==========

PoE is not yet supported.

Flashing OpenWrt overwrites ZyNOS. The Bootbase/U-Boot remains intact
and can be used for recovery.

Installation
============

Simple web upgrade:

1. Take the OpenWrt factory.bin image generated by the build.

2. In the ZyNOS web UI, login and go to Maintenance -> Firmware Upgrade.

3. If the device runs ZyNOS 5.00, untick "Enhanced firmware integrity
   check sha256sum". Otherwise the upload check will reject the image.

4. Select and upload the factory.bin image and click upgrade.

5. After flashing has finished, reboot the switch. It will now boot
   into OpenWrt.

Initramfs boot
==============

Luckily the switch uses a standard design, thus networking works with
a default hardware profile of RTK U-boot.

1. Connect to the serial console and interrupt the boot process by
   spamming '$' during the DRAM test to drop into Bootbase/U-Boot.

2. Bring up the network:

   > rtk network on

   Use a copper port; the SFP+ cages are likely not usable from the
   bootloader.

3. Load the initramfs image via TFTP:

   > tftpboot 0x82000000 <server>:<image>

4. Run the image (not bootm, the image has no uImage header):

   > go 0x82000000

Return to stock firmware
========================

1. Download the stock firmware for the switch from the Zyxel website
   and unzip it; there should be a .bin file with an alphanumeric name.

2. Upload that file to the running OpenWrt instance.

3. Flash it (use -F since the image has no OpenWrt metadata):

   > sysupgrade -F <stock-firmware>.bin

4. Wait for sysupgrade to finish and the switch to reboot. ZyNOS should
  come up again.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23389
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 13:12:18 +02:00
Andreas Böhler
6ee3f80efb realtek: add support for XikeStor SKS7300-4X4T
The XikeStor SKS7300-4X4T is a 10GbE switch with 4x copper ports and
4x SFP slots. It has a built-in console port and is powered by a RTL9303
SoC.

Specifications:
---------------

  * Soc: RTL9303
  * Flash: 32 MiB SPI flash
  * RAM: 512 MiB
  * Ethernet: 8x 10/100/1000/2500/5000/10000 Mbps
  * Buttons: 1x Reset
  * UART: CISCO console ports on the front, 115200, 8n1
  * controllable fan, integrated temperature sensor

Not yet enabled:
----------------
  * Fan control: it's controlled via simple i2c registers, but no driver
                 has been written yet.

Installation:
-------------

This device uses an obfuscated bootloader and an obfuscated image. As such,
the installation can only be performed using the console ports.

1. Set the switch to boot from the first image.

2. Attach console cable and hold Ctrl+C while powering on the switch

3. After a few seconds, a very basic U-Boot menu appears. Wait for the user
   input to appear, then press "z" to get to the message "Please input auth
   code".

4. Type "jiangks" as the password, the RTL9300 prompt appears.

5. Load the OpenWrt initramfs image via TFTP:

   > setenv serverip 192.168.0.1
   > setenv ipaddr 192.168.0.2
   > tftpboot 0x83000000 openwrt.bin
   > bootm 0x83000000

6. Once OpenWrt has booted, use the "sysupgrade" image to perform the
   actual installation.

7. Reboot the switch and enjoy OpenWrt.

Recovery/return to stock:
-------------------------

Flash an OEM firmware upgrade file via sysupgrade.

Signed-off-by: Andreas Böhler <dev@aboehler.at>
Link: https://github.com/openwrt/openwrt/pull/23305
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 13:11:05 +02:00
Rosen Penev
3887ef5d8a treewide: remove unused u-boot,env compatible
This was used for non nvmem-layout ubootenv support. Since that's gone
and it's not even used anyway, remove.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22367
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-14 23:02:47 +02:00
Sven Eckelmann
12d41dce06 realtek: rtl930x: psx8: specify RTL8224 reset GPIO
The nRESET pins of the RTL8224 PHYs on the PSX8/PSX10 are wired to GPIO6
(lan1-4) + GPIO10 (lan5-8) of the SoC, but this was never described in the
devicetree.

GPIO 6 is the global reset shared by (logical) PHYs 0-3 on MDIO bus0. GPIO
10 is the global reset shared by (logical) PHYs 8-11 on mdio bus0. It is
intentionally not declared as reset-gpios on any bus: the MDIO driver /
phylink only support a single reset GPIO per bus, not two (or more). And a
GPIO can only be used as reset-gpio on a single PHY. Attaching it to a
single PHY would still reset the other PHYs on the same chip as a side
effect, leaving their software state out of sync with the hardware and
likely breaking them.

Signed-off-by: Sven Eckelmann <se@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/23297
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-13 11:34:34 +02:00
Sven Eckelmann
80e53edc87 realtek: rtl931x: psx28: specify RTL8224 reset GPIO
The nRESET pins of the RTL8224 PHYs on the PSX28/ESX28 are wired to GPIO29
of the SoC, but this was never described in the devicetree.

GPIO 29 is the global reset shared by all PHYs across all MDIO busses. It
is intentionally not declared as reset-gpios on any bus: the MDIO driver /
phylink only support a reset GPIO per bus, not on the parent controller.
Attaching it to a single bus would still reset the PHYs on the other busses
as a side effect, leaving their software state out of sync with the
hardware and likely breaking them.

Signed-off-by: Sven Eckelmann <se@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/23297
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-13 11:34:34 +02:00
Jonas Jelonek
bdddc753c5 realtek: add support for Zyxel XMG1915-10EP
Specifications
==============

- SoC: RTL9302C
- Flash: 32 MiB SPI NOR flash
- RAM: 256 MiB
- Ethernet: 8x 10/100/1000/2500 Mbps (RTL8224)
- PoE: 802.3 af/at/bt on 8x RJ45 ports
    - 60W per port, 130W total budget
- SFP: 2x SFP+ cages
- UART: 1x 4 pins serial header, 115200 bauds, 8n1, 3.3v logic levels,
        pinout: unused (top), TX, RX, GND (bottom)
- Buttons: 1x "Restore" button, 1x "LED mode" button

MAC address
===========

Single MAC address derived from board partition with vendor-specific
format. MAC address is 70:49:a2:xx:xx:xx and applied to all switch
ports.

PoE
===

PoE is supported by realtek-poe package. To make it work, additional
options in the realtek-poe configuration file /etc/config/poe must be
set:

    config globals
            option force_baudrate '115200'
	    option force_dialect 'realtek'

Disclaimer
==========

Flashing OpenWrt will overwrite BootExtension + ZyNOS. BootExtension
functionality is not available anymore then. The U-boot/Bootbase still
has some limited functionality which can be used in emergency cases.

Installation
============

Simple web upgrade:

1. Take the OpenWrt factory.bin image generated by the build.

2. In the ZyNOS web UI, login and go to Maintenance -> Firmware Upgrade.

3. Under "Boot Image", make sure the Config Boot Image is set to 1. In
   other words, make sure the switch booted from firmware image 1 or it
   will do so on next reboot.
   This is crucial, otherwise OpenWrt cannot boot.

4. Below, select and upload the factory.bin image. After clicking
   upgrade, the image will be flashed.

5. After flashing has finished, reboot the switch. It will now boot into
   OpenWrt.

U-Boot
======

This device ships with U-boot masked as Bootbase. After the device is
powered, a DRAM test is performed. Spamming $ during that test will drop
you into a shell after test finished. You'll have a limited command set
at first.

Unlocking the shell with [1] or [2] will give you a normal U-boot
command set. From here, you can perform initramfs boot or recovery.

Initramfs boot:
> loady 0x82000000 + go 0x82000000

Recovery:
> upgradeY image2 0x82000000 115200

Return to stock firmware
========================

1. Download the firmware for the switch from Zyxel website.

2. Unzip the download, there should be a .bin file with a alphanumeric
   name.

3. Upload this file to running OpenWrt.

4. Run (use -F since the image doesn't have image metadata):

   > sysupgrade -F <stock-firmware>.bin

5. Wait for the sysupgrade to succeed and the switch reboot. At the next
   boot, ZyNOS should come up again.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23218
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:34:53 +02:00
Jonas Jelonek
e9de36484d realtek: dts: rtl930x: add pinctrl and pinmux for UART1
RTL930x SoCs have a second serial interface UART1 which is exposed on
dual-function pins shared with JTAG. The SoC defaults to the JTAG
functionality after reset. Similar to existing pinmux registers, there's
a separate register for that where a selector decides about JTAG vs
UART.

Add a now pinctrl node for that register and a pinmux node to enable
UART1 functionality. Reference the pinmux in the (by default disabled)
uart1 node. Without this, UART1 doesn't work when it is actually needed.
This is e.g. the case with some PoE-capable switch where the PSE MCU
communicates with the SoC via UART instead of I2C.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23218
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:34:53 +02:00
Jonas Jelonek
426b1a97ac realtek: make Zyxel XMG1915-10E generic for whole family
The XMG1915 is a switch family with multiple variants sharing nearly
all hardware (same SoC, PHYs, SFP cages, LEDs) and mainly differing
in PoE and minor details.

In preparation for adding further variants, move the bulk of the
device tree into a shared rtl9302_zyxel_xmg1915.dtsi and reduce the
per-device dts to the device identity (compatible, model) plus any
variant-specific nodes.

For images, factor a Device/zyxel_xmg1915 template holding the shared
build settings so per-device definitions only need DEVICE_MODEL.

No functional change for XMG1915-10E.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23218
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:34:53 +02:00
Jonas Jelonek
f9bdfcb553 realtek: fix Zyxel XMG1915-10E partition layout
When support for this device was added, the partition layout was defined
in a way that doesn't use space as intended and wastes quite a lot of
it.

(1) firmware partition starts at offset 0x1260000. This is the second
    partition/B partition in the A/B scheme used by Zyxel. While the
    commit mentions the image is written to A, the firmware partition
    is defined in the B space.
(2) firmware partition only ~16MB in size. The device has a total of
    32MB of flash. The vendor uses an A/B scheme but OpenWrt doesn't use
    it. Thus, OpenWrt can make use of the full available space.
(3) loader partition too big. Other devices using rt-loader explicitly
    in a partition use a size of 0x10000. This is more than enough
    already. The device here uses 0x30000 which is mostly wasted.

Those issues are fixed accordingly. While at it, move partitions 'loader'
and 'firmware' into a parent partition 'factory'. This is a preparation
for adding web upgrade support for this device.

Fixes: 94607d6285 ("realtek: add support for Zyxel XMG1915-10E")
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23218
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 10:34:53 +02:00
Markus Stockhausen
593df57731 realtek: dts: adapt RTL839x mdio bus topology
The RTL839x actually has two mdio busses.

- mdio bus 0 serves ports 0..23
- mdio bus 1 serves ports 24..51

This is baked into hardware and cannot be changed during mdio driver
setup with any register write. With the recent changes the driver
handles ports, phys and busses in a more logical way. So a port X
is assigned to a bus Y and a phy Z (on that bus). This gives a
mapping like

- port 16 <=> bus 0, address 16
- port 32 <=> bus 1, address 8

This unique assignment is used in the mdio driver as follows:

- Request to read bus 1, address 8
- Lookup corresponding port = 32
- Read from port 32

Looking at RTL839x it becomes clear that bus/phy => port lookup can
be achieved in multiple different ways. The simple reason is, that
for this device the driver cannot setup the smi topology. It is
baked into the hardware. So adding a "virtual" second bus does not
change the hardware access but allows to keep phy addresses below 32.
Making an example

mdio_bus0 {
  PHY_C22(40, 40)
}

resolves to port 40. But the same can be achieved with

mdio_bus1 {
  PHY_C22(40, 16)
}

In the first case the kernel sees bus/phy = 0/40 and in the second
case it sees bus/phy = 1/16. Both result in the access to the same
phy device on hardware port 40.

Use this analogy for RTL839x devices to match the real hardware
topology. For this change the existing dts and

- activate mdio bus 1 in rtl839x.dtsi
- rearrange devices with ports 24..51 to make use of bus 1

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23186
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-06 10:52:40 +02:00
Markus Stockhausen
4c16b5766c realtek: hwmon: backport lm75 alert polarity patches
The lm75 alert polarity active-high patch has been accepted upstream.
Replace the downstream version. Additionally add an upstream bugfix
that was identified during the implementation.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23232
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-06 10:51:32 +02:00
Manuel Stocker
79a6d2aab2 realtek: support configurable LED interface mode on RTL930x
Add support for changing the LED mode via the device tree.
Currently it always defaults to SERIAL mode. With this change,
one can also use the SINGLE_COLOR_SCAN and BI_COLOR_SCAN modes.

Signed-off-by: Manuel Stocker <mensi@mensi.ch>
Link: https://github.com/openwrt/openwrt/pull/23160
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-03 01:32:52 +02:00
Jonas Jelonek
84233220d3 realtek: dts: rtl93xx: use macro for PHY port definitions
Use SWITCH_PORT_LED instead of full verbose port definitions to
simplify and clean up the DTS.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23118
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-01 12:41:49 +02:00
Jonas Jelonek
322f8e6771 realtek: dts: rtl93xx: use PHY_* macros for Zyxel XGS1X10/1250
Replace the verbose ethernet-phy node definitions with the PHY_C45 and
PHY_C45_PAIR_ORDER macros to drop boilerplate.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23118
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-01 12:41:49 +02:00
Jonas Jelonek
0136c48bd5 realtek: dts: rtl93xx: replace LED magic values with macros
Replace the raw bitmask values for led_set entries with the
RTL93XX_LED_SET_* macros from macros.dtsi to make the LED configuration
self-explanatory.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23118
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-01 12:41:49 +02:00
Jonas Jelonek
858dfdd832 realtek: dts: rtl93xx: use SWITCH_PORT_SFP for ports
Make use of the SWITCH_PORT_SFP macro to simplify and make the DTS of
several devices cleaner.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23118
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-01 12:41:49 +02:00
Sven Eckelmann
fcb2ff6ec6 realtek: rtl930x: mcx3: specify RTL8224 reset GPIO
The nRESET pins of the RTL8224 PHY on the MCX3 are wired to GPIO6 of the
SoC, but this was never described in the devicetree.

Commit c99a30668d ("realtek: add RTL8224 initialization to Realtek
driver") introduced support for reinitializing RTL8224 PHYs, and commit
084da38a2e ("realtek: mdio: activate multiple busses") allowed the MDIO
bus provider load the devicetree properties to the bus, including reset
descriptors. With both in place, a bus level PHY reset via the hardware pin
is now correctly triggered before reinitialization.

Add the missing reset-gpios property so the PHY can be reset via the
hardware pin.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://github.com/openwrt/openwrt/pull/22966
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-28 11:24:28 +02:00
Carlo Szelinsky
8275b62ecd realtek: rtl930x: add Hasivo S600WP-5GT-2SX-SE
This commit adds support for Hasivo S600WP-5GT-2SX-SE switch.

Device specification
--------------------
SoC Type:               Realtek RTL9303
RAM:                    128MB DDR3 SDRAM
Flash:                  Fudan FM25Q128A (16 MB)
Ethernet:               5x RTL8221B 10/100/1000/2500Mbps PHY (RJ45)
                        2x SFP+ 10G (I2C/DOM via bit-banged GPIO)
LEDs:                   1x power green (no control)
                        1x system green (via RTL9303 GPIO)
                        3x RJ45 LEDs/port (HC595 shift regs on LED SPI)
                                1x Green (1G link)
                                1x Green (10M/100M link)
                                1x Orange (2.5G link)
                        2x SFP+ LEDs/port (HC595 shift regs on LED SPI)
                                1x 10G link
                                1x 1G link
Button:                 Reset
USB ports:              None
Bootloader:             Realtek U-Boot 2011.12
PoE:                    1x HS104PTI for 802.3af/at/bt PoE (driver
                        will follow in a separate patch)

Installing OpenWrt
------------------
1. UART RJ45 requires soldering a connector to the empty footprint (RJ1).
   (Amphenol RJHSEE380 or similar)
2. Connect to UART 38400@8n1, using Cisco Console Rollover cable (RS232)
3. Enter bootloader by pressing esc key during boot
4. Enter password `Hs2021cfgmg`
5. Type `XXXX` to get into U-Boot
6. Increase baudrate: `setenv baudrate 115200`
7. Use serial transfer (Y modem) via minicom:
   `loady 0x84f00000`
   Then send the initramfs image via minicom's Y modem upload.
8. `bootm 0x84f00000`

Now you should be in OpenWrt, and can use sysupgrade to install.

Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Link: https://github.com/openwrt/openwrt/pull/22310
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-24 12:17:26 +02:00
Jonas Jelonek
90c0a37ddc realtek: pcs: switch SerDes polarity to {rx,tx}-polarity
With the recent backport of the common PHY properties infrastructure
(phy-common-props and the phy_get_manual_{rx,tx}_polarity() helpers) to
OpenWrt, the generic `{rx,tx}-polarity` device tree properties are now
usable for the Realtek PCS driver. Switch the driver and all affected
boards from the local vendor-specific `realtek,pnswap-{rx,tx}` booleans
to the common properties.

Add a `config_polarity` SerDes op (implemented by RTL930x and RTL931x;
RTL838x/RTL839x polarity support not yet added) and a generic wrapper
that resolves the requested polarity via phy_get_manual_{rx,tx}_polarity()
and dispatches to the op. Variants without the op silently accept the
default polarity but warn when a non-default polarity is requested,
since that cannot be honored.

Move the polarity programming out of the variant setup_serdes callbacks
into rtpcs_pcs_config, so it runs before setup_serdes. This matches the
ordering used by the vendor SDK, which configures polarity first.

Update all board DTS files that previously used `realtek,pnswap-{rx,tx}`
to the new `{rx,tx}-polarity = <PHY_POL_INVERT>` property, and select
PHY_COMMON_PROPS from Kconfig.

Each SerDes now retains its DT node for later polarity lookup. Use
for_each_child_of_node_scoped for the iterator, and register a
devm_add_action_or_reset for each stored reference so it is released on
unbind or probe failure.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23044
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-24 10:13:38 +02:00
Markus Stockhausen
26f2bc96b9 realtek: dts: drop EXTERNAL_SFP_PHY macro
The EXTERNAL_SFP_PHY macro is very strange. It has attributes
sfp and media but is not linked to any SFP definition. There
is nothing that the kernel can evaluate better than the classic
PHY_C22 macro.

Remark! For the current D-Link DGS-1210 consumers this macro
should be converted to a PHY_C22_SFP in the future. As of now
there is no hardware to identify the proper gpios and define
and verify the corresponding SFP ports. Add a TODO comment
where needed.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23036
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-22 16:58:04 +02:00
Markus Stockhausen
11d49521c4 realtek: dts: convert EXTERNAL_SFP_PHY_FULL to PHY_C22_SFP
Several EXTERNAL macros have been removed in the past. There is
no need to distinguish if a phy is built into the SoC or is
attached externally.

Do the same for EXTERNAL_SFP_PHY_FULL. This macro denotes a phy
that has a SFP port attached to it. This is usually RTL8214FC
based. To be consistent with other macros name it PHY_C22_SFP.
While we are here make use of the new port/phy notation.

So PHY_C22_SFP(p, n, s) gives

- p: the overall port number
- n: the phy address on the current bus
- s: the sfp identifier

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/23036
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-22 16:58:04 +02:00
Jonas Jelonek
a8d5544c83 realtek: add support for Zyxel XS1930-12HP
Add support for RTL9313-based Zyxel XS1930-12HP, a 12-port Multi-Gig
switch with 10x 100M/1G/2.5G/5G/10G RJ45 and 2x 1G/10G SFP+ ports.

Hardware
========

  - RTL9313 SoC
  - 256MiB DDR3 RAM (Winbond W632GU6MB)
  - 32MiB SPI-NOR Flash (Macronix MX25L25645G)
  - 8x 100M/1G/2.5G/5G/10G RJ45 (Aquantia AQR813)
  - 2x 100M/1G/2.5G/5G/10G RJ45 (2x Aquantia AQR113C)
  - 2x 1G/10G SFP+
  - PoE:
    - Ports 1-8 with PoE++/802.3bt
    - 2x RTL8239 + GigaDevice FD32F103 MCU
  - RTL8231 for port LEDs
  - LM96000 I2C hardware monitor
  - 3-pin fans
  - Front LEDs: PWR, SYS, CLOUD, LOCATOR, POE USAGE
  - Console: TTL 3.3V, 115200 8N1
  - Software chain:
    - Bootbase/stripped-down U-Boot
    - BootExt
    - RAS/ZyNOS

Console
=======

The console port is a 4-pin header reachable without opening case.
Looking at the front port-side of the device, turn the device 90 degrees
clockwise. On this side, there's a rectangular opening in the honeycomb
structure. Pinout is (from left/front to right/back): GND RX TX VCC

Hardware quirks
===============

* The SFP signals RX_LOS, MOD_ABS and TX_FAULT do not have dedicated GPIO
  lines each. Instead, there's a multiplexer (using GPIO12 and GPIO14)
  which - depending on its state - connect this single GPIO line to RX_LOS,
  MOD_ABS or TX_FAULT (GPIO19 for SFP1, GPIO27 for SFP2). This requires
  a special adapter driver (which is backed by a gpio-mux) that makes
  this hardware design and Linux' SFP core work together.

* SFP slots are disabled by default. GPIO6 and GPIO7 seems to be gates
  for SFP1 and SFP2 respectively. The need to be pulled low to make SFP
  modules work (i.e. respond to I2C requests and pass GPIO signals).

* Fan can only be set to SLOW or FAST mode, no real speed/PWM control.

Disclaimer
==========

PoE not yet supported.

Flashing OpenWrt will overwrite BootExtension + ZyNOS. BootExtension
functionality (e.g. initramfs boot as mentioned below) is not available
anymore then. The U-boot/Bootbase still has some limited functionality
which can be used in emergency cases.

Installation
============

Simple web upgrade:

1. Take the OpenWrt factory.bin image generated by the build.

2. In the ZyNOS web UI, login and go to Maintenance -> Firmware Upgrade.

3. Under "Boot Image", make sure the Config Boot Image is set to 1. In
   other words, make sure the switch booted from firmware image 1 or it
   will do so on next reboot.
   This is crucial, otherwise OpenWrt cannot boot.

4. Below, select and upload the factory.bin image. After clicking
   upgrade, the image will be flashed.

5. After flashing has finished, reboot the switch. It will now boot into
   OpenWrt.

Initramfs boot
==============

NOTE: You need to use Xmodem transfer, the bootloader doesn't support
      Ymodem nor any networking.
      This only works as long as the default ZyNOS firmware is
      installed.

1. Connect to the switch using serial and interrupt the boot process
   to enter debug/recovery mode.

2. You need to unlock the bootloader. Use known methods [1] and [2] to
   obtain the unlock code and unlock the bootloader with:

   > ATEN 1,<unlock_code>

3. Upload the initramfs image using Xmodem:

   > ATUP <address>,<file_length>

   <address>: you may use any RAM address >= 0x80300000
   <file_length>: length of image in bytes

4. After the transfer has finished, boot the image with:

   > ATGO <address>

5. Wait for OpenWrt to boot. At this stage, it might be wise to create a
   backup/dump of the Flash partitions.

Return to stock firmware
========================

1. Download the firmware for the switch from Zyxel website.

2. Unzip the download, there should be a .bin file with a alphanumeric
   name.

3. Upload this file to running OpenWrt.

4. Run (use -F since the image doesn't have image metadata):

   > sysupgrade -F <stock-firmware>.bin

5. Wait for the sysupgrade to succeed and the switch reboot. At the next
   boot, ZyNOS should come up again.

Recovery
========

The Bootbase loader is actually a modified U-Boot variant. You can enter
it by spamming $ during the DRAM test.

The U-Boot shell can be unlocked with [1] and [2]. Note that the command
is slightly different, using a space instead of a comma, and lowercase:

> aten 1 <unlock_code>

You should now have more-or-less a standard RTK-U-boot shell from where
you can upload and write a new image to flash. Use e.g.:

> upgradeY image2 81000000 115200

Wait for the upgrade process to finish and reboot the switch.

===
[1] https://akao.co.uk/tools/zyxel_unlocker/
[2] https://www.ixo.de/info/zyxel_uclinux/

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22909
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-20 11:13:06 +02:00
Jonas Jelonek
4a9c32b264 realtek: add support for Zyxel XS1930-12F
Add support for RTL9313-based Zyxel XS1930-12F, a 12-port Multi-Gig
switch with 8x 1G/10G SFP+ ports and 2x 100M/1G/2.5G/5G/10G RJ45.

Hardware
========

  - RTL9313 SoC
  - 256MiB DDR3 RAM (Nanya NT5CC128M16JR-EK)
  - 32MiB SPI-NOR Flash (Macronix MX25L25645G)
  - 10x 1G/10G SFP+
  - 2x 100M/1G/2.5G/5G/10G RJ45 (2x Aquantia AQR113C)
  - 2x RTL8231 for GPIO expansion + port LEDs
  - TI PM555 GPIO expander
  - LM96000 I2C hardware monitor
  - 3-pin fan
  - Front LEDs: PWR, SYS, CLOUD, LOCATOR
  - Console: TTL 3.3V, 115200 8N1
  - Software chain:
    - Bootbase/stripped-down U-Boot
    - BootExt
    - RAS/ZyNOS

Console
=======

The console port is a 4-pin header reachable without opening case.
Looking at the front port-side of the device, turn the device 90 degrees
clockwise. On this side, there's a rectangular opening in the honeycomb
structure. Pinout is (from left/front to right/back): GND RX TX VCC

Hardware quirks
===============

* SFP slots are disabled by default. Several GPIO lines on the PM555
  GPIO expander need to be pulled low to activate SFPs, one for each SFP
  slot. Otherwise modules cannot respond to I2C requests and GPIO signals
  do not reach the SoC.

* Fan can only be set to SLOW or FAST mode, no real speed/PWM control.

Disclaimer
==========

Flashing OpenWrt will overwrite BootExtension + ZyNOS. BootExtension
functionality (e.g. initramfs boot as mentioned below) is not available
anymore then. The U-boot/Bootbase still has some limited functionality
which can be used in emergency cases.

Installation
============

Simple web upgrade:

1. Take the OpenWrt factory.bin image generated by the build.

2. In the ZyNOS web UI, login and go to Maintenance -> Firmware Upgrade.

3. Under "Boot Image", make sure the Config Boot Image is set to 1. In
   other words, make sure the switch booted from firmware image 1 or it
   will do so on next reboot.
   This is crucial, otherwise OpenWrt cannot boot.

4. Below, select and upload the factory.bin image. After clicking
   upgrade, the image will be flashed.

5. After flashing has finished, reboot the switch. It will now boot into
   OpenWrt.

Initramfs boot
==============

NOTE: You need to use Xmodem transfer, the bootloader doesn't support
      Ymodem nor any networking.
      This only works as long as the default ZyNOS firmware is
      installed.

1. Connect to the switch using serial and interrupt the boot process
   to enter debug/recovery mode.

2. You need to unlock the bootloader. Use known methods [1] and [2] to
   obtain the unlock code and unlock the bootloader with:

   > ATEN 1,<unlock_code>

3. Upload the initramfs image using Xmodem:

   > ATUP <address>,<file_length>

   <address>: you may use any RAM address >= 0x80300000
   <file_length>: length of image in bytes

4. After the transfer has finished, boot the image with:

   > ATGO <address>

5. Wait for OpenWrt to boot. At this stage, it might be wise to create a
   backup/dump of the Flash partitions.

Return to stock firmware
========================

1. Download the firmware for the switch from Zyxel website.

2. Unzip the download, there should be a .bin file with a alphanumeric
   name.

3. Upload this file to running OpenWrt.

4. Run (use -F since the image doesn't have image metadata):

   > sysupgrade -F <stock-firmware>.bin

5. Wait for the sysupgrade to succeed and the switch reboot. At the next
   boot, ZyNOS should come up again.

Recovery
========

The Bootbase loader is actually a modified U-Boot variant. You can enter
it by spamming $ during the DRAM test.

The U-Boot shell can be unlocked with [1] and [2]. Note that the command
is slightly different, using a space instead of a comma, and lowercase:

> aten 1 <unlock_code>

You should now have more-or-less a standard RTK-U-boot shell from where
you can upload and write a new image to flash. Use e.g.:

> upgradeY image2 81000000 115200

Wait for the upgrade process to finish and reboot the switch.

===
[1] https://akao.co.uk/tools/zyxel_unlocker/
[2] https://www.ixo.de/info/zyxel_uclinux/

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22909
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-20 11:13:06 +02:00
Jonas Jelonek
be54b1d008 realtek: add support for Zyxel XS1930-10
Add support for RTL9313-based Zyxel XS1930-10, a 10-port Multi-Gig
switch with 8x 100M/1G/2.5G/5G/10G RJ45 and 2x 1G/10G SFP+ ports.

Hardware
========

  - RTL9313 SoC
  - 256MiB DDR3 RAM (Winbond W632GU6MB)
  - 32MiB SPI-NOR Flash (Macronix MX25L25645G)
  - 8x 100M/1G/2.5G/5G/10G RJ45 (Aquantia AQR813)
  - 2x 1G/10G SFP+
  - RTL8231 for port LEDs
  - LM96000 I2C hardware monitor
  - 3-pin fan
  - Front LEDs: PWR, SYS, CLOUD, LOCATOR
  - Console: TTL 3.3V, 115200 8N1
  - Software chain:
    - Bootbase/stripped-down U-Boot
    - BootExt
    - RAS/ZyNOS

Console
=======

The console port is a 4-pin header reachable without opening case.
Looking at the front port-side of the device, turn the device 90 degrees
clockwise. On this side, there's a rectangular opening in the honeycomb
structure. Pinout is (from left/front to right/back): GND RX TX VCC

Hardware quirks
===============

* The SFP signals RX_LOS, MOD_ABS and TX_FAULT do not have dedicated GPIO
  lines each. Instead, there's a multiplexer (using GPIO12 and GPIO14)
  which - depending on its state - connect this single GPIO line to RX_LOS,
  MOD_ABS or TX_FAULT (GPIO19 for SFP1, GPIO27 for SFP2). This requires
  a special adapter driver (which is backed by a gpio-mux) that makes
  this hardware design and Linux' SFP core work together.

* SFP slots are disabled by default. GPIO6 and GPIO7 seems to be gates
  for SFP1 and SFP2 respectively. The need to be pulled low to make SFP
  modules work (i.e. respond to I2C requests and pass GPIO signals).

* Fan can only be set to SLOW or FAST mode, no real speed/PWM control.

Disclaimer
==========

Flashing OpenWrt will overwrite BootExtension + ZyNOS. BootExtension
functionality (e.g. initramfs boot as mentioned below) is not available
anymore then. The U-boot/Bootbase still has some limited functionality
which can be used in emergency cases.

Installation
============

Simple web upgrade:

1. Take the OpenWrt factory.bin image generated by the build.

2. In the ZyNOS web UI, login and go to Maintenance -> Firmware Upgrade.

3. Under "Boot Image", make sure the Config Boot Image is set to 1. In
   other words, make sure the switch booted from firmware image 1 or it
   will do so on next reboot.
   This is crucial, otherwise OpenWrt cannot boot.

4. Below, select and upload the factory.bin image. After clicking
   upgrade, the image will be flashed.

5. After flashing has finished, reboot the switch. It will now boot into
   OpenWrt.

Initramfs boot
==============

NOTE: You need to use Xmodem transfer, the bootloader doesn't support
      Ymodem nor any networking.
      This only works as long as the default ZyNOS firmware is
      installed.

1. Connect to the switch using serial and interrupt the boot process
   to enter debug/recovery mode.

2. You need to unlock the bootloader. Use known methods [1] and [2] to
   obtain the unlock code and unlock the bootloader with:

   > ATEN 1,<unlock_code>

3. Upload the initramfs image using Xmodem:

   > ATUP <address>,<file_length>

   <address>: you may use any RAM address >= 0x80300000
   <file_length>: length of image in bytes

4. After the transfer has finished, boot the image with:

   > ATGO <address>

5. Wait for OpenWrt to boot. At this stage, it might be wise to create a
   backup/dump of the Flash partitions.

Return to stock firmware
========================

1. Download the firmware for the switch from Zyxel website.

2. Unzip the download, there should be a .bin file with a alphanumeric
   name.

3. Upload this file to running OpenWrt.

4. Run (use -F since the image doesn't have image metadata):

   > sysupgrade -F <stock-firmware>.bin

5. Wait for the sysupgrade to succeed and the switch reboot. At the next
   boot, ZyNOS should come up again.

Recovery
========

The Bootbase loader is actually a modified U-Boot variant. You can enter
it by spamming $ during the DRAM test.

The U-Boot shell can be unlocked with [1] and [2]. Note that the command
is slightly different, using a space instead of a comma, and lowercase:

> aten 1 <unlock_code>

You should now have more-or-less a standard RTK-U-boot shell from where
you can upload and write a new image to flash. Use e.g.:

> upgradeY image2 81000000 115200

Wait for the upgrade process to finish and reboot the switch.

===
[1] https://akao.co.uk/tools/zyxel_unlocker/
[2] https://www.ixo.de/info/zyxel_uclinux/

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22909
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-20 11:13:06 +02:00
Jonas Jelonek
1409c25c9a realtek: add generic support for Zyxel XS1930 lineup
Add generic support for Zyxel's XS1930 10G switch lineup. This will be
used by subsequent patches to share common behavior/settings.

Common specs:

- Realtek RTL9313 switch SoC
- 256MB RAM
- 32MB Flash with shared layout
- different 10G copper/SFP port configurations

The devices use a proprietary software chain from Zyxel, consisting of:
- stripped-down, heavily modified U-boot masked as "Bootbase"
- BootExtension stage2 loader
- Thread-X based ZyNOS

Those devices require to add some symbols to the kernel config, i.e.
CONFIG_AQUANTIA_PHY for the used PHYs and symbols for GPIO peripherals
and muxes due to the hardware design.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22909
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-20 11:13:06 +02:00
Damien Dejean
94607d6285 realtek: add support for Zyxel XMG1915-10E
The XMG1915-10E is a switch with 8 copper ports and 2 SFP+ cages.

Specifications:
---------------
  * SoC: RTL9302C
  * Flash: 32 MiB SPI NOR flash
  * RAM: 256 MiB
  * Ethernet: 8x 10/100/1000/2500 Mbps (RTL8224)
  * SFP: 2x SFP+ cages
  * UART: 1x 4 pins serial header, 115200 bauds, 8n1, 3.3v logic levels,
          pinout: unused (top), TX, RX, GND (bottom)
  * Buttons: 1x "Reset" button

Works:
------
  - 2 SFP+ cages either 1G/10G or 2.5G
  - 8*2.5G Ethernet ports
  - Switch function
  - LEDs
  - Boot from flash
  - Assigning MAC addresses from flash

Ethernet ports:
---------------
The 8x 2.5Gbps ethernet ports are provided by two RTL8224 chips. The
ports are supported by the upstream realtek PHY driver plus a local
initialization patch for the 10g-qxgmii mode.

Installation:
-------------
This device uses ZyNOS instead of Linux which makes the installation a
bit cumbersome. OpenWRT will be installed on the slot of the second
firmware image, thus the switch original firmware can be booted with a
little change. The serial console is required.

1. Set the switch to boot from the first image. This is required to
   be sure not to be blocked in the middle of the installation
   procedure.

2. Connect to the switch using the serial adapter and interrupt the boot
   process by pressing "Enter" repeatedly.

3. Load the OpenWRT initramfs image using xmodem. From bootext console
   (use ATHE to get the list of commands):

   > ATUP 81800000,file_length
   > ATGO 81800000

4. Wait for OpenWRT to boot, once this is done transfer the loader
   binary and the sysupgrade image to /tmp using scp.

5. Install OpenWRT permanently by writing the images on the flash:

  > mtd write /tmp/loader.bin loader
  > mtd write /tmp/sysupgrade.bin firmware

6. Reboot the switch and from the stock firmware set the configuration
   to boot from the second image (Maintenance > Firmware upgrade > Boot
   image).

7. Reboot again and enjoy OpenWRT.

Recovery/Return to stock:
-------------------------
1. Connect the switch using the serial adapter and interrupt the boot
   process during the "DRAM POST: Testing:" sequence by pressing '$'
   until the "XMG1915$" prompt appears.

2. Start an ymodem upgrade using the following command and use an xmodem
   upload tool to send the .bin file provided in an OEM upgrade package.

   XMG1915$ upgradeY image2 81000000 115200
   ## Ready for binary (ymodem) download to 0x081000000 at 115200 bps...

3. Wait for the upgrade process to finish and reboot the switch.

Signed-off-by: Damien Dejean <dam.dejean@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21341
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-16 14:26:03 +02:00
Markus Stockhausen
4d3159dbc1 realtek: dts: convert DGS-1250-28X to SWITCH_PORT_SFP()
Use the new macro for the SFP ports.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/22947
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-16 11:28:04 +02:00
Sven Eckelmann
39beab3c55 realtek: rtl931x: psx28: specify POE MCU reset GPIO
The MCU (GD32E230G8) which controls the RTL8239 POE++ PSE chips can
sometimes hang. In this case, it is necessary to to reset the chip using
the nRESET pin which is connected to the GPIO1 of the RTL8231 GPIO
expander.

For a reset, the `/sys/class/gpio/poe_mcu_reset/value` file must be set to
1 for a short period and then back to 0. After that, the poemgr must be
"restarted" to the MCU back in the expected state.

Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://github.com/openwrt/openwrt/pull/22916
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-14 10:38:28 +02:00
Markus Stockhausen
ca8d931205 realtek: drop INTERNAL_PHY() macro
Since f1f0572d1 ("remove redundant integrated phy attribute") the
phy-is-integrated attribute of an phy in the dts is obsolete.
This was important for the INTERNAL_PHY() macro. Now it is
useless. Convert the macro to its successor PHY_C22().

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/22892
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-13 18:42:33 +02:00
Andreas Böhler
a3988cd65c realtek: XikeStor SKS8300-12E2T2X: fix GPIO assignments
The initial bringup missed two GPIO-related settings:
  - TX Disable GPIO for the SFP modules
  - LED Sync GPIO selection for the port LEDs

This adds the missing TX Disable GPIOs and muxes GPIO18 to LED sync
(there are HC595 shift registers on the board that require the sync).

Signed-off-by: Andreas Böhler <dev@aboehler.at>
Link: https://github.com/openwrt/openwrt/pull/22551
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-13 11:02:35 +02:00
Markus Stockhausen
a2540f566f realtek: dts: fix TP-Link SG2452P mdio bus
For some unknown reason carving out the mdio bus from the ethernet
node forgot the TP-Link SG2452P. The notation still reads

&ethernet0 {
  mdio: mdio-bus {
    compatible = "realtek,rtl838x-mdio";
    ...

Like everywhere else it should be

&mdio_bus0 {
  PHY_C22(0, 0)
  ...

Fix that.

Fixes: 57b270684 ("rearrange mdio-bus below mdio-controller")
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/22866
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-04-12 18:32:35 +02:00
Jonas Jelonek
a2154c2b32 realtek: dts: repurpose SFP port macro
Repurpose a currently unused macro to make it usable for common SFP port
definitions. Do so by changing defined properties, drop the fixed link,
etc.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22827
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-04-12 18:23:08 +02:00
Jonas Jelonek
e343f3a2e2 realtek: fix pinmux comment in rtl931x.dtsi
The pinmux entry for disabling JTAG includes a comment which points to
which GPIOs are sacrificed for using JTAG. However, this comment so far
was only aware of GPIO6 and GPIO7. From RTL931X application notes and
datasheets we know which GPIOs are actually affected here.

Extend the comment to include GPIOs 3-5 too.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22827
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-04-12 18:23:08 +02:00
Klaus Rubenstein
4f637a09b8 realtek: gs1900-48: add RTL8231 resets
Add reset-gpios for both RTL8231 expanders and hog the PHY reset
line on expander@3.

Signed-off-by: Klaus Rubenstein <klaus.rubenstein@gmail.com>
Tested-by: Sander Vanheule <sander@svanheule.net>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
2026-04-11 19:36:17 +02:00
Klaus Rubenstein
aa1b83d5ca realtek: add Zyxel GS1900-48HP A1 support
Add support for the Zyxel GS1900-48HP A1 managed PoE switch based on
RTL8393 SoC with 48 copper ports (6x RTL8218B), 2 SFP slots and PoE
(170W budget). Includes DTS, image definition, network config and
u-boot-env support.

The device has 48 copper ports but only ports 1-24 are powered by
the PoE PSE controller.

PoE support requires the realtek-poe package from the packages feed
with an additional configuration for PSE ID 7 to address the MCU on
this device.

Signed-off-by: Klaus Rubenstein <klaus.rubenstein@gmail.com>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
2026-04-11 19:35:53 +02:00
Klaus Rubenstein
5eca03fa07 realtek: extract shared GS1900-48 dtsi
Move the shared hardware description from rtl8393_zyxel_gs1900-48-a1.dts
into a common rtl8393_zyxel_gs1900-48.dtsi include file. This allows
other GS1900-48 variants to reuse the shared definitions.

Signed-off-by: Klaus Rubenstein <klaus.rubenstein@gmail.com>
Tested-by: Sander Vanheule <sander@svanheule.net>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
2026-04-11 19:32:57 +02:00
Harshal Gohel
901ca8213c realtek: Fix pair-order for rtl930x based plasmacloud devices
This change is needed as we move towards removing rtk init from bootloader
and makes it possible to initialize and configure RTL8224 phy driver

Signed-off-by: Harshal Gohel <hg@simonwunderlich.de>
Link: https://github.com/openwrt/openwrt/pull/22826
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-11 12:17:30 +02:00
Mieczyslaw Nalewaj
3e42e349d4
treewide: strip trailing whitespace
Strip trailing whitespace in all code:
find . -type f | grep "\.c$" | xargs sed -i 's/[ \t]\+$//'
find . -type f | grep "\.h$" | xargs sed -i 's/[ \t]\+$//'
find . -type f | grep "\.dts$" | xargs sed -i 's/[ \t]\+$//'
find . -type f | grep "\.dtsi$" | xargs sed -i 's/[ \t]\+$//'

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/22840
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2026-04-08 10:05:53 +02:00