realtek: add support for Ubiquiti UniFi USW Aggregation

Add support for the RTL9303-based Ubiquiti UniFi USW Aggregation, an
8-port 10G SFP+ aggregation switch.

Hardware
========

  - RTL9303 SoC
  - 256 MiB DDR
  - 16 MiB SPI-NOR flash
  - 8x 1G/10G SFP+ cages
  - Per-port LEDs: 1x white LED per SFP+ cage
  - Buttons: 1x Reset
  - Console: TTL 3.3V, 115200 8N1, internal unpopulated 4-hole THT
    footprint (the device must be opened to solder a header)
    - pinout (with the front panel facing you, left to right):
      VCC/unused, RX, TX, GND
  - Front touch display (see below)
  - Software chain:
    - U-Boot (Ubiquiti-flavoured)
    - UniFi OS (OpenWrt-based)

MAC address
===========

Single MAC address derived from the eeprom partition. Applied to all
switch ports.

Front touch display
===================

The unit has a touch-capable front display, driven by a dedicated
STM32-based MCU connected to the host via UART. The MCU runs Ubiquiti's
LCM firmware and exposes a high-level JSON protocol (page selection,
button-press events, etc.); arbitrary pixel-level control is not
possible without replacing the MCU firmware. The display is therefore
not supported beyond what the stock LCM firmware offers.

Disclaimer
==========

Stock uses a dual-bank layout (kernel0/kernel1, 7 MiB each). OpenWrt
replaces both banks with a single contiguous firmware partition.
Flashing OpenWrt overwrites both stock kernel slots; U-Boot remains
intact and can be used for recovery.

The stock firmware blob is RSA-signed and cannot be flashed via the
UniFi web UI. Installation has to be done from a root shell on the
running UniFi OS.

Installation
============

1. Enable SSH on the stock UniFi OS and log in as root.

2. Copy the OpenWrt sysupgrade image to /tmp on the switch (e.g. via
   scp).

3. Adjust IMG below to point at the copied file, then run the block as
   a whole. It writes kernel0, splits into kernel1 if the image is
   larger than that slot (otherwise invalidates kernel1 so U-Boot
   cannot pick a stale bank), and reboots:

   IMG=/tmp/openwrt-realtek-rtl930x-ubnt_usw-aggregation-squashfs-sysupgrade.bin
   K0_BLOCKS=$((0x710000 / 0x10000))

   dd if="$IMG" of=/dev/mtdblock2 bs=64k count=$K0_BLOCKS conv=fsync
   if [ "$(wc -c < "$IMG")" -gt $((0x710000)) ]; then
       dd if="$IMG" of=/dev/mtdblock3 bs=64k skip=$K0_BLOCKS conv=fsync
   else
       dd if=/dev/zero of=/dev/mtdblock3 bs=64k count=1 conv=fsync
   fi
   sync
   reboot

   The switch comes up in OpenWrt after reboot.

It does not matter which bank stock booted from when the dd block
runs: both banks are touched in the same pass (kernel0 written, kernel1
either written or invalidated). With kernel1 invalidated, U-Boot's
internal fallback kicks in and permanently switches to kernel0 on the
next boot, so the device stays on OpenWrt as long as kernel0 is
bootable.

Recovery
========

Since the installation procedure invalidates or partially overwrites
the second bank, recovery requires serial console access (see Hardware
above for pinout).

1. Interrupt U-Boot autoboot by spamming a key during early boot to
   drop into the U-Boot prompt.

2. Bring up networking:

   rtk network on

3. Transfer an OpenWrt initramfs image via TFTP and boot it:

   tftpboot 0x82000000 <server>:<initramfs.bin>
   bootm 0x82000000

4. From the running initramfs OpenWrt, re-run the installation
   procedure above (the dd block, with $IMG pointing at the image on
   /tmp).

Return to stock firmware
========================

There is no fully-supported revert path. The stock firmware blob is a
Ubiquiti UBNT archive (header + parts, see firmware-utils' fw.h) that
embeds a u-boot and a kernel0 uImage payload; only the latter is
relevant when writing back to the kernel partitions.

The snippet below extracts the kernel0 uImage from such a blob by
locating the uImage magic and using the size carried in the uImage
header itself, without parsing any UBNT framing. It is provided as a
best-effort starting point; verify the result before flashing,
otherwise you're on your own:

   BLOB=US.rtl930x_X.Y.Z.bin
   OFF=$(grep -aboF $'\x27\x05\x19\x56' "$BLOB" | head -1 | cut -d: -f1)
   SIZE=$(( $(dd if="$BLOB" bs=1 skip=$((OFF + 12)) count=4 2>/dev/null \
               | hexdump -e '1/4 "%u"') + 64 ))
   dd if="$BLOB" of=kernel0.uImage bs=1 skip="$OFF" count="$SIZE"

Once you have a clean uImage, write it to both kernel banks (since
the bootselect mechanism is not yet decoded, this guarantees U-Boot
picks the stock image regardless of bank):

   dd if=kernel0.uImage of=/dev/mtdblock2 bs=64k conv=fsync
   dd if=kernel0.uImage of=/dev/mtdblock3 bs=64k conv=fsync

Link: https://github.com/openwrt/openwrt/pull/23506
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

diff --git a/target/linux/realtek/dts/rtl9303_ubnt_usw-aggregation.dts b/target/linux/realtek/dts/rtl9303_ubnt_usw-aggregation.dts
new file mode 100644 (file)
index 0000000..ed0284d
--- /dev/null
+++ b/target/linux/realtek/dts/rtl9303_ubnt_usw-aggregation.dts
@@ -0,0 +1,270 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl930x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+       compatible = "ubnt,usw-aggregation", "realtek,rtl9303-soc";
+       model = "UniFi USW Aggregation";
+
+       aliases {
+               label-mac-device = &ethernet0;
+       };
+
+       memory@0 {
+               device_type = "memory";
+               reg = <0x00000000 0x10000000>;
+       };
+
+       chosen {
+               stdout-path = "serial0:115200n8";
+       };
+
+       keys {
+               compatible = "gpio-keys";
+
+               button-reset {
+                       label = "reset";
+                       gpios = <&gpio0 3 GPIO_ACTIVE_LOW>;
+                       linux,code = <KEY_RESTART>;
+               };
+       };
+
+       leds {
+               compatible = "gpio-leds";
+               pinctrl-names = "default";
+               pinctrl-0 = <&pinmux_enable_led_sync>;
+       };
+
+       led_set {
+               compatible = "realtek,rtl9300-leds";
+               active-low;
+
+               led_set0 = <(RTL93XX_LED_SET_10G | RTL93XX_LED_SET_5G | RTL93XX_LED_SET_2P5G |
+                            RTL93XX_LED_SET_1G | RTL93XX_LED_SET_100M | RTL93XX_LED_SET_10M |
+                            RTL93XX_LED_SET_LINK | RTL93XX_LED_SET_ACT)
+                           RTL93XX_LED_SET_NONE>;
+       };
+
+       sfp0: sfp-p1 {
+               compatible = "sff,sfp";
+               i2c-bus = <&i2c0>;
+               los-gpio = <&gpio2 0 GPIO_ACTIVE_HIGH>;
+               mod-def0-gpio = <&gpio2 2 GPIO_ACTIVE_LOW>;
+               tx-disable-gpio = <&gpio2 3 GPIO_ACTIVE_HIGH>;
+               tx-fault-gpio = <&gpio2 1 GPIO_ACTIVE_HIGH>;
+       };
+
+       sfp1: sfp-p2 {
+               compatible = "sff,sfp";
+               i2c-bus = <&i2c1>;
+               los-gpio = <&gpio2 4 GPIO_ACTIVE_HIGH>;
+               mod-def0-gpio = <&gpio2 6 GPIO_ACTIVE_LOW>;
+               tx-disable-gpio = <&gpio2 7 GPIO_ACTIVE_HIGH>;
+               tx-fault-gpio = <&gpio2 5 GPIO_ACTIVE_HIGH>;
+       };
+
+       sfp2: sfp-p3 {
+               compatible = "sff,sfp";
+               i2c-bus = <&i2c2>;
+               los-gpio = <&gpio2 8 GPIO_ACTIVE_HIGH>;
+               mod-def0-gpio = <&gpio2 10 GPIO_ACTIVE_LOW>;
+               tx-disable-gpio = <&gpio2 11 GPIO_ACTIVE_HIGH>;
+               tx-fault-gpio = <&gpio2 9 GPIO_ACTIVE_HIGH>;
+       };
+
+       sfp3: sfp-p4 {
+               compatible = "sff,sfp";
+               i2c-bus = <&i2c3>;
+               los-gpio = <&gpio2 12 GPIO_ACTIVE_HIGH>;
+               mod-def0-gpio = <&gpio2 14 GPIO_ACTIVE_LOW>;
+               tx-disable-gpio = <&gpio2 15 GPIO_ACTIVE_HIGH>;
+               tx-fault-gpio = <&gpio2 13 GPIO_ACTIVE_HIGH>;
+       };
+
+       sfp4: sfp-p5 {
+               compatible = "sff,sfp";
+               i2c-bus = <&i2c4>;
+               los-gpio = <&gpio1 0 GPIO_ACTIVE_HIGH>;
+               mod-def0-gpio = <&gpio1 2 GPIO_ACTIVE_LOW>;
+               tx-disable-gpio = <&gpio1 3 GPIO_ACTIVE_HIGH>;
+               tx-fault-gpio = <&gpio1 1 GPIO_ACTIVE_HIGH>;
+       };
+
+       sfp5: sfp-p6 {
+               compatible = "sff,sfp";
+               i2c-bus = <&i2c5>;
+               los-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+               mod-def0-gpio = <&gpio1 6 GPIO_ACTIVE_LOW>;
+               tx-disable-gpio = <&gpio1 7 GPIO_ACTIVE_HIGH>;
+               tx-fault-gpio = <&gpio1 5 GPIO_ACTIVE_HIGH>;
+       };
+
+       sfp6: sfp-p7 {
+               compatible = "sff,sfp";
+               i2c-bus = <&i2c6>;
+               los-gpio = <&gpio1 8 GPIO_ACTIVE_HIGH>;
+               mod-def0-gpio = <&gpio1 10 GPIO_ACTIVE_LOW>;
+               tx-disable-gpio = <&gpio1 11 GPIO_ACTIVE_HIGH>;
+               tx-fault-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+       };
+
+       sfp7: sfp-p8 {
+               compatible = "sff,sfp";
+               i2c-bus = <&i2c7>;
+               los-gpio = <&gpio1 12 GPIO_ACTIVE_HIGH>;
+               mod-def0-gpio = <&gpio1 14 GPIO_ACTIVE_LOW>;
+               tx-disable-gpio = <&gpio1 15 GPIO_ACTIVE_HIGH>;
+               tx-fault-gpio = <&gpio1 13 GPIO_ACTIVE_HIGH>;
+       };
+};
+
+&i2c_mst1 {
+       status = "okay";
+
+       i2c0: i2c@0 { reg = <0>; };
+       i2c1: i2c@1 { reg = <1>; };
+       i2c2: i2c@2 { reg = <2>; };
+       i2c3: i2c@3 { reg = <3>; };
+       i2c4: i2c@4 {
+               reg = <4>;
+
+               gpio1: gpio@21 {
+                       compatible = "nxp,pca9555";
+                       reg = <0x21>;
+                       gpio-controller;
+                       #gpio-cells = <2>;
+               };
+
+               gpio2: gpio@24 {
+                       compatible = "nxp,pca9555";
+                       reg = <0x24>;
+                       gpio-controller;
+                       #gpio-cells = <2>;
+               };
+       };
+       i2c5: i2c@5 { reg = <5>; };
+       i2c6: i2c@6 { reg = <6>; };
+       i2c7: i2c@7 { reg = <7>; };
+};
+
+&spi0 {
+       status = "okay";
+
+       flash@0 {
+               compatible = "jedec,spi-nor";
+               reg = <0>;
+               spi-max-frequency = <10000000>;
+
+               partitions {
+                       compatible = "fixed-partitions";
+                       #address-cells = <1>;
+                       #size-cells = <1>;
+
+                       partition@0 {
+                               label = "u-boot";
+                               reg = <0x0 0xa0000>;
+                               read-only;
+                       };
+
+                       partition@a0000 {
+                               label = "u-boot-env";
+                               reg = <0xa0000 0x10000>;
+                       };
+
+                       partition@b0000 {
+                               compatible = "openwrt,uimage", "denx,uimage";
+                               label = "firmware";
+                               reg = <0xb0000 0xe20000>;
+                       };
+
+                       /* this partition contains data used by U-boot and UniFi OS
+                        * e.g. the bootpartition selector.
+                        */
+                       partition@ed0000 {
+                               label = "reserved";
+                               reg = <0xed0000 0x10000>;
+                       };
+
+                       partition@ee0000 {
+                               label = "cdata";
+                               reg = <0xee0000 0x10000>;
+                       };
+
+                       partition@ef0000 {
+                               label = "cfg";
+                               reg = <0xef0000 0x100000>;
+                       };
+
+                       partition@ff0000 {
+                               label = "eeprom";
+                               reg = <0xff0000 0x10000>;
+
+                               nvmem-layout {
+                                       compatible = "fixed-layout";
+                                       #address-cells = <1>;
+                                       #size-cells = <1>;
+
+                                       factory_macaddr: macaddr@0 {
+                                               compatible = "mac-base";
+                                               reg = <0x0 0x6>;
+                                               #nvmem-cell-cells = <1>;
+                                       };
+                               };
+                       };
+               };
+       };
+};
+
+&gpio0 {
+       /*
+        * Lines 5/6 are wired to the front-panel STM32 MCU that drives
+        * the touch display:
+        *   5 = BOOT0 select (low: run firmware from flash,
+        *                    high: system bootloader / DFU)
+        *   6 = reset (active low)
+        * Named only, not claimed, so userspace can drive them.
+        */
+       gpio-line-names = "", "", "", "", "", "lcm-mode", "lcm-reset";
+};
+
+&ethernet0 {
+       nvmem-cells = <&factory_macaddr 0>;
+       nvmem-cell-names = "mac-address";
+};
+
+&switch0 {
+       ethernet-ports {
+               #address-cells = <1>;
+               #size-cells = <0>;
+
+               SWITCH_PORT_SFP(20, 1, 5, 0, 0)
+               SWITCH_PORT_SFP(16, 2, 4, 0, 1)
+               SWITCH_PORT_SFP(25, 3, 7, 0, 2)
+               SWITCH_PORT_SFP(24, 4, 6, 0, 3)
+               SWITCH_PORT_SFP(27, 5, 9, 0, 4)
+               SWITCH_PORT_SFP(26, 6, 8, 0, 5)
+               SWITCH_PORT_SFP(8, 7, 3, 0, 6)
+               SWITCH_PORT_SFP(0, 8, 2, 0, 7)
+
+               port@28 {
+                       ethernet = <&ethernet0>;
+                       reg = <28>;
+                       phy-mode = "internal";
+
+                       fixed-link {
+                               speed = <1000>;
+                               full-duplex;
+                       };
+               };
+       };
+};
+
+&uart1 {
+       status = "okay";
+
+       /* front touch display MCU reachable here */
+};

diff --git a/target/linux/realtek/image/rtl930x.mk b/target/linux/realtek/image/rtl930x.mk
index 7e78b63ff9a413b78de4e049552c09f366c2cd4a..a1f8848efe1ff4848b74ac64960774fd1f750497 100644 (file)
--- a/target/linux/realtek/image/rtl930x.mk
+++ b/target/linux/realtek/image/rtl930x.mk
@@ -85,6 +85,15 @@ define Device/tplink_tl-st1008f-v2
 endef
 TARGET_DEVICES += tplink_tl-st1008f-v2
 
+define Device/ubnt_usw-aggregation
+  SOC := rtl9303
+  DEVICE_VENDOR := Ubiquiti
+  DEVICE_MODEL := UniFi USW Aggregation
+  IMAGE_SIZE := 14464k
+  $(Device/kernel-lzma)
+endef
+TARGET_DEVICES += ubnt_usw-aggregation
+
 define Device/vimin_vm-s100-0800ms
   SOC := rtl9303
   UIMAGE_MAGIC := 0x93000000