realtek: add support for Ubiquiti UniFi USW Aggregation

Add support for the RTL9303-based Ubiquiti UniFi USW Aggregation, an
8-port 10G SFP+ aggregation switch.

Hardware
========

  - RTL9303 SoC
  - 256 MiB DDR
  - 16 MiB SPI-NOR flash
  - 8x 1G/10G SFP+ cages
  - Per-port LEDs: 1x white LED per SFP+ cage
  - Buttons: 1x Reset
  - Console: TTL 3.3V, 115200 8N1, internal unpopulated 4-hole THT
    footprint (the device must be opened to solder a header)
    - pinout (with the front panel facing you, left to right):
      VCC/unused, RX, TX, GND
  - Front touch display (see below)
  - Software chain:
    - U-Boot (Ubiquiti-flavoured)
    - UniFi OS (OpenWrt-based)

MAC address
===========

Single MAC address derived from the eeprom partition. Applied to all
switch ports.

Front touch display
===================

The unit has a touch-capable front display, driven by a dedicated
STM32-based MCU connected to the host via UART. The MCU runs Ubiquiti's
LCM firmware and exposes a high-level JSON protocol (page selection,
button-press events, etc.); arbitrary pixel-level control is not
possible without replacing the MCU firmware. The display is therefore
not supported beyond what the stock LCM firmware offers.

Disclaimer
==========

Stock uses a dual-bank layout (kernel0/kernel1, 7 MiB each). OpenWrt
replaces both banks with a single contiguous firmware partition.
Flashing OpenWrt overwrites both stock kernel slots; U-Boot remains
intact and can be used for recovery.

The stock firmware blob is RSA-signed and cannot be flashed via the
UniFi web UI. Installation has to be done from a root shell on the
running UniFi OS.

Installation
============

1. Enable SSH on the stock UniFi OS and log in as root.

2. Copy the OpenWrt sysupgrade image to /tmp on the switch (e.g. via
   scp).

3. Adjust IMG below to point at the copied file, then run the block as
   a whole. It writes kernel0, splits into kernel1 if the image is
   larger than that slot (otherwise invalidates kernel1 so U-Boot
   cannot pick a stale bank), and reboots:

   IMG=/tmp/openwrt-realtek-rtl930x-ubnt_usw-aggregation-squashfs-sysupgrade.bin
   K0_BLOCKS=$((0x710000 / 0x10000))

   dd if="$IMG" of=/dev/mtdblock2 bs=64k count=$K0_BLOCKS conv=fsync
   if [ "$(wc -c < "$IMG")" -gt $((0x710000)) ]; then
       dd if="$IMG" of=/dev/mtdblock3 bs=64k skip=$K0_BLOCKS conv=fsync
   else
       dd if=/dev/zero of=/dev/mtdblock3 bs=64k count=1 conv=fsync
   fi
   sync
   reboot

   The switch comes up in OpenWrt after reboot.

It does not matter which bank stock booted from when the dd block
runs: both banks are touched in the same pass (kernel0 written, kernel1
either written or invalidated). With kernel1 invalidated, U-Boot's
internal fallback kicks in and permanently switches to kernel0 on the
next boot, so the device stays on OpenWrt as long as kernel0 is
bootable.

Recovery
========

Since the installation procedure invalidates or partially overwrites
the second bank, recovery requires serial console access (see Hardware
above for pinout).

1. Interrupt U-Boot autoboot by spamming a key during early boot to
   drop into the U-Boot prompt.

2. Bring up networking:

   rtk network on

3. Transfer an OpenWrt initramfs image via TFTP and boot it:

   tftpboot 0x82000000 <server>:<initramfs.bin>
   bootm 0x82000000

4. From the running initramfs OpenWrt, re-run the installation
   procedure above (the dd block, with $IMG pointing at the image on
   /tmp).

Return to stock firmware
========================

There is no fully-supported revert path. The stock firmware blob is a
Ubiquiti UBNT archive (header + parts, see firmware-utils' fw.h) that
embeds a u-boot and a kernel0 uImage payload; only the latter is
relevant when writing back to the kernel partitions.

The snippet below extracts the kernel0 uImage from such a blob by
locating the uImage magic and using the size carried in the uImage
header itself, without parsing any UBNT framing. It is provided as a
best-effort starting point; verify the result before flashing,
otherwise you're on your own:

   BLOB=US.rtl930x_X.Y.Z.bin
   OFF=$(grep -aboF $'\x27\x05\x19\x56' "$BLOB" | head -1 | cut -d: -f1)
   SIZE=$(( $(dd if="$BLOB" bs=1 skip=$((OFF + 12)) count=4 2>/dev/null \
               | hexdump -e '1/4 "%u"') + 64 ))
   dd if="$BLOB" of=kernel0.uImage bs=1 skip="$OFF" count="$SIZE"

Once you have a clean uImage, write it to both kernel banks (since
the bootselect mechanism is not yet decoded, this guarantees U-Boot
picks the stock image regardless of bank):

   dd if=kernel0.uImage of=/dev/mtdblock2 bs=64k conv=fsync
   dd if=kernel0.uImage of=/dev/mtdblock3 bs=64k conv=fsync

Link: https://github.com/openwrt/openwrt/pull/23506
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit is contained in:
Jonas Jelonek
2026-05-13 19:58:44 +00:00
parent 903310097b
commit e4ed8e7fe7
2 changed files with 279 additions and 0 deletions
@@ -0,0 +1,270 @@
// SPDX-License-Identifier: GPL-2.0-or-later
#include "rtl930x.dtsi"
#include <dt-bindings/input/input.h>
#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/leds/common.h>
/ {
compatible = "ubnt,usw-aggregation", "realtek,rtl9303-soc";
model = "UniFi USW Aggregation";
aliases {
label-mac-device = &ethernet0;
};
memory@0 {
device_type = "memory";
reg = <0x00000000 0x10000000>;
};
chosen {
stdout-path = "serial0:115200n8";
};
keys {
compatible = "gpio-keys";
button-reset {
label = "reset";
gpios = <&gpio0 3 GPIO_ACTIVE_LOW>;
linux,code = <KEY_RESTART>;
};
};
leds {
compatible = "gpio-leds";
pinctrl-names = "default";
pinctrl-0 = <&pinmux_enable_led_sync>;
};
led_set {
compatible = "realtek,rtl9300-leds";
active-low;
led_set0 = <(RTL93XX_LED_SET_10G | RTL93XX_LED_SET_5G | RTL93XX_LED_SET_2P5G |
RTL93XX_LED_SET_1G | RTL93XX_LED_SET_100M | RTL93XX_LED_SET_10M |
RTL93XX_LED_SET_LINK | RTL93XX_LED_SET_ACT)
RTL93XX_LED_SET_NONE>;
};
sfp0: sfp-p1 {
compatible = "sff,sfp";
i2c-bus = <&i2c0>;
los-gpio = <&gpio2 0 GPIO_ACTIVE_HIGH>;
mod-def0-gpio = <&gpio2 2 GPIO_ACTIVE_LOW>;
tx-disable-gpio = <&gpio2 3 GPIO_ACTIVE_HIGH>;
tx-fault-gpio = <&gpio2 1 GPIO_ACTIVE_HIGH>;
};
sfp1: sfp-p2 {
compatible = "sff,sfp";
i2c-bus = <&i2c1>;
los-gpio = <&gpio2 4 GPIO_ACTIVE_HIGH>;
mod-def0-gpio = <&gpio2 6 GPIO_ACTIVE_LOW>;
tx-disable-gpio = <&gpio2 7 GPIO_ACTIVE_HIGH>;
tx-fault-gpio = <&gpio2 5 GPIO_ACTIVE_HIGH>;
};
sfp2: sfp-p3 {
compatible = "sff,sfp";
i2c-bus = <&i2c2>;
los-gpio = <&gpio2 8 GPIO_ACTIVE_HIGH>;
mod-def0-gpio = <&gpio2 10 GPIO_ACTIVE_LOW>;
tx-disable-gpio = <&gpio2 11 GPIO_ACTIVE_HIGH>;
tx-fault-gpio = <&gpio2 9 GPIO_ACTIVE_HIGH>;
};
sfp3: sfp-p4 {
compatible = "sff,sfp";
i2c-bus = <&i2c3>;
los-gpio = <&gpio2 12 GPIO_ACTIVE_HIGH>;
mod-def0-gpio = <&gpio2 14 GPIO_ACTIVE_LOW>;
tx-disable-gpio = <&gpio2 15 GPIO_ACTIVE_HIGH>;
tx-fault-gpio = <&gpio2 13 GPIO_ACTIVE_HIGH>;
};
sfp4: sfp-p5 {
compatible = "sff,sfp";
i2c-bus = <&i2c4>;
los-gpio = <&gpio1 0 GPIO_ACTIVE_HIGH>;
mod-def0-gpio = <&gpio1 2 GPIO_ACTIVE_LOW>;
tx-disable-gpio = <&gpio1 3 GPIO_ACTIVE_HIGH>;
tx-fault-gpio = <&gpio1 1 GPIO_ACTIVE_HIGH>;
};
sfp5: sfp-p6 {
compatible = "sff,sfp";
i2c-bus = <&i2c5>;
los-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>;
mod-def0-gpio = <&gpio1 6 GPIO_ACTIVE_LOW>;
tx-disable-gpio = <&gpio1 7 GPIO_ACTIVE_HIGH>;
tx-fault-gpio = <&gpio1 5 GPIO_ACTIVE_HIGH>;
};
sfp6: sfp-p7 {
compatible = "sff,sfp";
i2c-bus = <&i2c6>;
los-gpio = <&gpio1 8 GPIO_ACTIVE_HIGH>;
mod-def0-gpio = <&gpio1 10 GPIO_ACTIVE_LOW>;
tx-disable-gpio = <&gpio1 11 GPIO_ACTIVE_HIGH>;
tx-fault-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
};
sfp7: sfp-p8 {
compatible = "sff,sfp";
i2c-bus = <&i2c7>;
los-gpio = <&gpio1 12 GPIO_ACTIVE_HIGH>;
mod-def0-gpio = <&gpio1 14 GPIO_ACTIVE_LOW>;
tx-disable-gpio = <&gpio1 15 GPIO_ACTIVE_HIGH>;
tx-fault-gpio = <&gpio1 13 GPIO_ACTIVE_HIGH>;
};
};
&i2c_mst1 {
status = "okay";
i2c0: i2c@0 { reg = <0>; };
i2c1: i2c@1 { reg = <1>; };
i2c2: i2c@2 { reg = <2>; };
i2c3: i2c@3 { reg = <3>; };
i2c4: i2c@4 {
reg = <4>;
gpio1: gpio@21 {
compatible = "nxp,pca9555";
reg = <0x21>;
gpio-controller;
#gpio-cells = <2>;
};
gpio2: gpio@24 {
compatible = "nxp,pca9555";
reg = <0x24>;
gpio-controller;
#gpio-cells = <2>;
};
};
i2c5: i2c@5 { reg = <5>; };
i2c6: i2c@6 { reg = <6>; };
i2c7: i2c@7 { reg = <7>; };
};
&spi0 {
status = "okay";
flash@0 {
compatible = "jedec,spi-nor";
reg = <0>;
spi-max-frequency = <10000000>;
partitions {
compatible = "fixed-partitions";
#address-cells = <1>;
#size-cells = <1>;
partition@0 {
label = "u-boot";
reg = <0x0 0xa0000>;
read-only;
};
partition@a0000 {
label = "u-boot-env";
reg = <0xa0000 0x10000>;
};
partition@b0000 {
compatible = "openwrt,uimage", "denx,uimage";
label = "firmware";
reg = <0xb0000 0xe20000>;
};
/* this partition contains data used by U-boot and UniFi OS
* e.g. the bootpartition selector.
*/
partition@ed0000 {
label = "reserved";
reg = <0xed0000 0x10000>;
};
partition@ee0000 {
label = "cdata";
reg = <0xee0000 0x10000>;
};
partition@ef0000 {
label = "cfg";
reg = <0xef0000 0x100000>;
};
partition@ff0000 {
label = "eeprom";
reg = <0xff0000 0x10000>;
nvmem-layout {
compatible = "fixed-layout";
#address-cells = <1>;
#size-cells = <1>;
factory_macaddr: macaddr@0 {
compatible = "mac-base";
reg = <0x0 0x6>;
#nvmem-cell-cells = <1>;
};
};
};
};
};
};
&gpio0 {
/*
* Lines 5/6 are wired to the front-panel STM32 MCU that drives
* the touch display:
* 5 = BOOT0 select (low: run firmware from flash,
* high: system bootloader / DFU)
* 6 = reset (active low)
* Named only, not claimed, so userspace can drive them.
*/
gpio-line-names = "", "", "", "", "", "lcm-mode", "lcm-reset";
};
&ethernet0 {
nvmem-cells = <&factory_macaddr 0>;
nvmem-cell-names = "mac-address";
};
&switch0 {
ethernet-ports {
#address-cells = <1>;
#size-cells = <0>;
SWITCH_PORT_SFP(20, 1, 5, 0, 0)
SWITCH_PORT_SFP(16, 2, 4, 0, 1)
SWITCH_PORT_SFP(25, 3, 7, 0, 2)
SWITCH_PORT_SFP(24, 4, 6, 0, 3)
SWITCH_PORT_SFP(27, 5, 9, 0, 4)
SWITCH_PORT_SFP(26, 6, 8, 0, 5)
SWITCH_PORT_SFP(8, 7, 3, 0, 6)
SWITCH_PORT_SFP(0, 8, 2, 0, 7)
port@28 {
ethernet = <&ethernet0>;
reg = <28>;
phy-mode = "internal";
fixed-link {
speed = <1000>;
full-duplex;
};
};
};
};
&uart1 {
status = "okay";
/* front touch display MCU reachable here */
};
+9
View File
@@ -85,6 +85,15 @@ define Device/tplink_tl-st1008f-v2
endef
TARGET_DEVICES += tplink_tl-st1008f-v2
define Device/ubnt_usw-aggregation
SOC := rtl9303
DEVICE_VENDOR := Ubiquiti
DEVICE_MODEL := UniFi USW Aggregation
IMAGE_SIZE := 14464k
$(Device/kernel-lzma)
endef
TARGET_DEVICES += ubnt_usw-aggregation
define Device/vimin_vm-s100-0800ms
SOC := rtl9303
UIMAGE_MAGIC := 0x93000000