From e4ed8e7fe7e0d49e5bd3bafa6b7eb9c4804b08f8 Mon Sep 17 00:00:00 2001 From: Jonas Jelonek Date: Wed, 13 May 2026 19:58:44 +0000 Subject: [PATCH] realtek: add support for Ubiquiti UniFi USW Aggregation Add support for the RTL9303-based Ubiquiti UniFi USW Aggregation, an 8-port 10G SFP+ aggregation switch. Hardware ======== - RTL9303 SoC - 256 MiB DDR - 16 MiB SPI-NOR flash - 8x 1G/10G SFP+ cages - Per-port LEDs: 1x white LED per SFP+ cage - Buttons: 1x Reset - Console: TTL 3.3V, 115200 8N1, internal unpopulated 4-hole THT footprint (the device must be opened to solder a header) - pinout (with the front panel facing you, left to right): VCC/unused, RX, TX, GND - Front touch display (see below) - Software chain: - U-Boot (Ubiquiti-flavoured) - UniFi OS (OpenWrt-based) MAC address =========== Single MAC address derived from the eeprom partition. Applied to all switch ports. Front touch display =================== The unit has a touch-capable front display, driven by a dedicated STM32-based MCU connected to the host via UART. The MCU runs Ubiquiti's LCM firmware and exposes a high-level JSON protocol (page selection, button-press events, etc.); arbitrary pixel-level control is not possible without replacing the MCU firmware. The display is therefore not supported beyond what the stock LCM firmware offers. Disclaimer ========== Stock uses a dual-bank layout (kernel0/kernel1, 7 MiB each). OpenWrt replaces both banks with a single contiguous firmware partition. Flashing OpenWrt overwrites both stock kernel slots; U-Boot remains intact and can be used for recovery. The stock firmware blob is RSA-signed and cannot be flashed via the UniFi web UI. Installation has to be done from a root shell on the running UniFi OS. Installation ============ 1. Enable SSH on the stock UniFi OS and log in as root. 2. Copy the OpenWrt sysupgrade image to /tmp on the switch (e.g. via scp). 3. Adjust IMG below to point at the copied file, then run the block as a whole. It writes kernel0, splits into kernel1 if the image is larger than that slot (otherwise invalidates kernel1 so U-Boot cannot pick a stale bank), and reboots: IMG=/tmp/openwrt-realtek-rtl930x-ubnt_usw-aggregation-squashfs-sysupgrade.bin K0_BLOCKS=$((0x710000 / 0x10000)) dd if="$IMG" of=/dev/mtdblock2 bs=64k count=$K0_BLOCKS conv=fsync if [ "$(wc -c < "$IMG")" -gt $((0x710000)) ]; then dd if="$IMG" of=/dev/mtdblock3 bs=64k skip=$K0_BLOCKS conv=fsync else dd if=/dev/zero of=/dev/mtdblock3 bs=64k count=1 conv=fsync fi sync reboot The switch comes up in OpenWrt after reboot. It does not matter which bank stock booted from when the dd block runs: both banks are touched in the same pass (kernel0 written, kernel1 either written or invalidated). With kernel1 invalidated, U-Boot's internal fallback kicks in and permanently switches to kernel0 on the next boot, so the device stays on OpenWrt as long as kernel0 is bootable. Recovery ======== Since the installation procedure invalidates or partially overwrites the second bank, recovery requires serial console access (see Hardware above for pinout). 1. Interrupt U-Boot autoboot by spamming a key during early boot to drop into the U-Boot prompt. 2. Bring up networking: rtk network on 3. Transfer an OpenWrt initramfs image via TFTP and boot it: tftpboot 0x82000000 : bootm 0x82000000 4. From the running initramfs OpenWrt, re-run the installation procedure above (the dd block, with $IMG pointing at the image on /tmp). Return to stock firmware ======================== There is no fully-supported revert path. The stock firmware blob is a Ubiquiti UBNT archive (header + parts, see firmware-utils' fw.h) that embeds a u-boot and a kernel0 uImage payload; only the latter is relevant when writing back to the kernel partitions. The snippet below extracts the kernel0 uImage from such a blob by locating the uImage magic and using the size carried in the uImage header itself, without parsing any UBNT framing. It is provided as a best-effort starting point; verify the result before flashing, otherwise you're on your own: BLOB=US.rtl930x_X.Y.Z.bin OFF=$(grep -aboF $'\x27\x05\x19\x56' "$BLOB" | head -1 | cut -d: -f1) SIZE=$(( $(dd if="$BLOB" bs=1 skip=$((OFF + 12)) count=4 2>/dev/null \ | hexdump -e '1/4 "%u"') + 64 )) dd if="$BLOB" of=kernel0.uImage bs=1 skip="$OFF" count="$SIZE" Once you have a clean uImage, write it to both kernel banks (since the bootselect mechanism is not yet decoded, this guarantees U-Boot picks the stock image regardless of bank): dd if=kernel0.uImage of=/dev/mtdblock2 bs=64k conv=fsync dd if=kernel0.uImage of=/dev/mtdblock3 bs=64k conv=fsync Link: https://github.com/openwrt/openwrt/pull/23506 Signed-off-by: Jonas Jelonek --- .../dts/rtl9303_ubnt_usw-aggregation.dts | 270 ++++++++++++++++++ target/linux/realtek/image/rtl930x.mk | 9 + 2 files changed, 279 insertions(+) create mode 100644 target/linux/realtek/dts/rtl9303_ubnt_usw-aggregation.dts diff --git a/target/linux/realtek/dts/rtl9303_ubnt_usw-aggregation.dts b/target/linux/realtek/dts/rtl9303_ubnt_usw-aggregation.dts new file mode 100644 index 00000000000..ed0284de8bf --- /dev/null +++ b/target/linux/realtek/dts/rtl9303_ubnt_usw-aggregation.dts @@ -0,0 +1,270 @@ +// SPDX-License-Identifier: GPL-2.0-or-later + +#include "rtl930x.dtsi" + +#include +#include +#include + +/ { + compatible = "ubnt,usw-aggregation", "realtek,rtl9303-soc"; + model = "UniFi USW Aggregation"; + + aliases { + label-mac-device = ðernet0; + }; + + memory@0 { + device_type = "memory"; + reg = <0x00000000 0x10000000>; + }; + + chosen { + stdout-path = "serial0:115200n8"; + }; + + keys { + compatible = "gpio-keys"; + + button-reset { + label = "reset"; + gpios = <&gpio0 3 GPIO_ACTIVE_LOW>; + linux,code = ; + }; + }; + + leds { + compatible = "gpio-leds"; + pinctrl-names = "default"; + pinctrl-0 = <&pinmux_enable_led_sync>; + }; + + led_set { + compatible = "realtek,rtl9300-leds"; + active-low; + + led_set0 = <(RTL93XX_LED_SET_10G | RTL93XX_LED_SET_5G | RTL93XX_LED_SET_2P5G | + RTL93XX_LED_SET_1G | RTL93XX_LED_SET_100M | RTL93XX_LED_SET_10M | + RTL93XX_LED_SET_LINK | RTL93XX_LED_SET_ACT) + RTL93XX_LED_SET_NONE>; + }; + + sfp0: sfp-p1 { + compatible = "sff,sfp"; + i2c-bus = <&i2c0>; + los-gpio = <&gpio2 0 GPIO_ACTIVE_HIGH>; + mod-def0-gpio = <&gpio2 2 GPIO_ACTIVE_LOW>; + tx-disable-gpio = <&gpio2 3 GPIO_ACTIVE_HIGH>; + tx-fault-gpio = <&gpio2 1 GPIO_ACTIVE_HIGH>; + }; + + sfp1: sfp-p2 { + compatible = "sff,sfp"; + i2c-bus = <&i2c1>; + los-gpio = <&gpio2 4 GPIO_ACTIVE_HIGH>; + mod-def0-gpio = <&gpio2 6 GPIO_ACTIVE_LOW>; + tx-disable-gpio = <&gpio2 7 GPIO_ACTIVE_HIGH>; + tx-fault-gpio = <&gpio2 5 GPIO_ACTIVE_HIGH>; + }; + + sfp2: sfp-p3 { + compatible = "sff,sfp"; + i2c-bus = <&i2c2>; + los-gpio = <&gpio2 8 GPIO_ACTIVE_HIGH>; + mod-def0-gpio = <&gpio2 10 GPIO_ACTIVE_LOW>; + tx-disable-gpio = <&gpio2 11 GPIO_ACTIVE_HIGH>; + tx-fault-gpio = <&gpio2 9 GPIO_ACTIVE_HIGH>; + }; + + sfp3: sfp-p4 { + compatible = "sff,sfp"; + i2c-bus = <&i2c3>; + los-gpio = <&gpio2 12 GPIO_ACTIVE_HIGH>; + mod-def0-gpio = <&gpio2 14 GPIO_ACTIVE_LOW>; + tx-disable-gpio = <&gpio2 15 GPIO_ACTIVE_HIGH>; + tx-fault-gpio = <&gpio2 13 GPIO_ACTIVE_HIGH>; + }; + + sfp4: sfp-p5 { + compatible = "sff,sfp"; + i2c-bus = <&i2c4>; + los-gpio = <&gpio1 0 GPIO_ACTIVE_HIGH>; + mod-def0-gpio = <&gpio1 2 GPIO_ACTIVE_LOW>; + tx-disable-gpio = <&gpio1 3 GPIO_ACTIVE_HIGH>; + tx-fault-gpio = <&gpio1 1 GPIO_ACTIVE_HIGH>; + }; + + sfp5: sfp-p6 { + compatible = "sff,sfp"; + i2c-bus = <&i2c5>; + los-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>; + mod-def0-gpio = <&gpio1 6 GPIO_ACTIVE_LOW>; + tx-disable-gpio = <&gpio1 7 GPIO_ACTIVE_HIGH>; + tx-fault-gpio = <&gpio1 5 GPIO_ACTIVE_HIGH>; + }; + + sfp6: sfp-p7 { + compatible = "sff,sfp"; + i2c-bus = <&i2c6>; + los-gpio = <&gpio1 8 GPIO_ACTIVE_HIGH>; + mod-def0-gpio = <&gpio1 10 GPIO_ACTIVE_LOW>; + tx-disable-gpio = <&gpio1 11 GPIO_ACTIVE_HIGH>; + tx-fault-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>; + }; + + sfp7: sfp-p8 { + compatible = "sff,sfp"; + i2c-bus = <&i2c7>; + los-gpio = <&gpio1 12 GPIO_ACTIVE_HIGH>; + mod-def0-gpio = <&gpio1 14 GPIO_ACTIVE_LOW>; + tx-disable-gpio = <&gpio1 15 GPIO_ACTIVE_HIGH>; + tx-fault-gpio = <&gpio1 13 GPIO_ACTIVE_HIGH>; + }; +}; + +&i2c_mst1 { + status = "okay"; + + i2c0: i2c@0 { reg = <0>; }; + i2c1: i2c@1 { reg = <1>; }; + i2c2: i2c@2 { reg = <2>; }; + i2c3: i2c@3 { reg = <3>; }; + i2c4: i2c@4 { + reg = <4>; + + gpio1: gpio@21 { + compatible = "nxp,pca9555"; + reg = <0x21>; + gpio-controller; + #gpio-cells = <2>; + }; + + gpio2: gpio@24 { + compatible = "nxp,pca9555"; + reg = <0x24>; + gpio-controller; + #gpio-cells = <2>; + }; + }; + i2c5: i2c@5 { reg = <5>; }; + i2c6: i2c@6 { reg = <6>; }; + i2c7: i2c@7 { reg = <7>; }; +}; + +&spi0 { + status = "okay"; + + flash@0 { + compatible = "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <10000000>; + + partitions { + compatible = "fixed-partitions"; + #address-cells = <1>; + #size-cells = <1>; + + partition@0 { + label = "u-boot"; + reg = <0x0 0xa0000>; + read-only; + }; + + partition@a0000 { + label = "u-boot-env"; + reg = <0xa0000 0x10000>; + }; + + partition@b0000 { + compatible = "openwrt,uimage", "denx,uimage"; + label = "firmware"; + reg = <0xb0000 0xe20000>; + }; + + /* this partition contains data used by U-boot and UniFi OS + * e.g. the bootpartition selector. + */ + partition@ed0000 { + label = "reserved"; + reg = <0xed0000 0x10000>; + }; + + partition@ee0000 { + label = "cdata"; + reg = <0xee0000 0x10000>; + }; + + partition@ef0000 { + label = "cfg"; + reg = <0xef0000 0x100000>; + }; + + partition@ff0000 { + label = "eeprom"; + reg = <0xff0000 0x10000>; + + nvmem-layout { + compatible = "fixed-layout"; + #address-cells = <1>; + #size-cells = <1>; + + factory_macaddr: macaddr@0 { + compatible = "mac-base"; + reg = <0x0 0x6>; + #nvmem-cell-cells = <1>; + }; + }; + }; + }; + }; +}; + +&gpio0 { + /* + * Lines 5/6 are wired to the front-panel STM32 MCU that drives + * the touch display: + * 5 = BOOT0 select (low: run firmware from flash, + * high: system bootloader / DFU) + * 6 = reset (active low) + * Named only, not claimed, so userspace can drive them. + */ + gpio-line-names = "", "", "", "", "", "lcm-mode", "lcm-reset"; +}; + +ðernet0 { + nvmem-cells = <&factory_macaddr 0>; + nvmem-cell-names = "mac-address"; +}; + +&switch0 { + ethernet-ports { + #address-cells = <1>; + #size-cells = <0>; + + SWITCH_PORT_SFP(20, 1, 5, 0, 0) + SWITCH_PORT_SFP(16, 2, 4, 0, 1) + SWITCH_PORT_SFP(25, 3, 7, 0, 2) + SWITCH_PORT_SFP(24, 4, 6, 0, 3) + SWITCH_PORT_SFP(27, 5, 9, 0, 4) + SWITCH_PORT_SFP(26, 6, 8, 0, 5) + SWITCH_PORT_SFP(8, 7, 3, 0, 6) + SWITCH_PORT_SFP(0, 8, 2, 0, 7) + + port@28 { + ethernet = <ðernet0>; + reg = <28>; + phy-mode = "internal"; + + fixed-link { + speed = <1000>; + full-duplex; + }; + }; + }; +}; + +&uart1 { + status = "okay"; + + /* front touch display MCU reachable here */ +}; diff --git a/target/linux/realtek/image/rtl930x.mk b/target/linux/realtek/image/rtl930x.mk index 7e78b63ff9a..a1f8848efe1 100644 --- a/target/linux/realtek/image/rtl930x.mk +++ b/target/linux/realtek/image/rtl930x.mk @@ -85,6 +85,15 @@ define Device/tplink_tl-st1008f-v2 endef TARGET_DEVICES += tplink_tl-st1008f-v2 +define Device/ubnt_usw-aggregation + SOC := rtl9303 + DEVICE_VENDOR := Ubiquiti + DEVICE_MODEL := UniFi USW Aggregation + IMAGE_SIZE := 14464k + $(Device/kernel-lzma) +endef +TARGET_DEVICES += ubnt_usw-aggregation + define Device/vimin_vm-s100-0800ms SOC := rtl9303 UIMAGE_MAGIC := 0x93000000