Support for RTL838x and RTL93xx based managed switches

luizluca · July 8, 2026, 7:04pm

I checked a uboot upgrade process for another model (ECS4510-28T_uboot_upgrade_v2.1.4)
It looks like it needs chr(13) and chr(21).

You can open the serial in a screen:

screen -S edge /dev/ttyUSB0 115200

And send the chars from another terminal:

screen -S edge -X stuff $'\x0b\x15'

After that, it asks for a password (and possibly another enable password). The issue we don't have it. From the ECS4510-28T we have these:

vnyq66ic (uboot)
xmpavxa3 (enable)
xkqacau9 (enable)

You can even combine the two:

screen -S edge -X stuff $'\x0b\x15'; sleep 1; screen -S edge -X stuff 'vnyq66ic
'$'\r'

However, without the real password, it is as far as I could get. I tried:

realtek
rtk
admin
root
edgecore
accton
ecs2110
ecs2100
super
1234
12345678

I don't have the tools to dump the flash. The password must be hardcoded in the uboot or in its env data.

plappermaul · July 8, 2026, 7:15pm

Maybe

melzui5r (ECS2100)
m0fz2zjv (ECS4510)
b4g2jgn (ECS4510)
kcnfss82 (ECS4510)

luizluca · July 8, 2026, 9:47pm

That was unexpected too soon

I tested it in a ECS2110 device and it did not work

I didn't test these passwords (I don't have the device) but the passwords bellow should be good passwords for ECS4510:

@plappermaul, where did your guesses come from? Do you have an u-boot dump to share?

russell · July 9, 2026, 5:21am

Hi, can someone recommend a realtek-based 24 or 48-port switch with PoE, with working openwrt support in master branch, where price isn't especially an object, 2.5Gbps+ and SFP+ sockets are desirable. This is to recommend for a grant.

jonasj · July 9, 2026, 7:15am

Plasmacloud PSX28 has 24x2.5G with 4x SFP+, apart from that there are some others like Linksys LGS328MPC/LGS352MPC (latter not officially supported, but easily doable) but they just have 1G ports then.

The Ubiquiti UniFi USW Pro Max 24 PoE I merged yesterday has 8x 1G PoE+, 8x 1G PoE++, 8x 2.5G PoE++ and 2x SFP+. The Pro Max 48 PoE might be the bigger variant of this with double that, but I'm not sure whether this uses 931x then or two cascaded 930x (never really looked into that cascaded setup yet).

russell · July 9, 2026, 8:26am

Where can I learn more about the status of the WIP Realtek PSE MCU driver?

jonasj · July 9, 2026, 8:41am

https://github.com/openwrt/openwrt/pull/23222 and https://lore.kernel.org/netdev/20260706112425.3149226-1-jelonek.jonas@gmail.com/

raspitoaster · July 9, 2026, 9:21am

I gave it a try and replaced bootcmd = 'rtk network on;boota' with bootcmd = 'boota'
After rebooting the switches, they are still accessible through the trunk - but all of the other connections are dead: untagged ports, tagged ports with one VLAN as well as other trunk ports with multiple VLANs.
Ports are up, but no traffic - including traffic to the switch itself.

jonasj · July 9, 2026, 11:16am

Could you also check with the default config aka VLAN 1 all ports untagged, nothing else?

raspitoaster · July 9, 2026, 2:46pm

I did a "reset to defaults" ending up with all ports untagged in VLAN 1.
This was even worse, because no network connectivity at all.
Then I did a fw_setenv 'rtk network on;boota' via serial connection and the switch is back as it should.

jonasj · July 9, 2026, 3:17pm

Hard to believe that nothing works. Just to be sure, did you try with 25.12 or SNAPSHOT?

plappermaul · July 9, 2026, 3:42pm

Mabye some shifting or other xoring ...

# strings uboot-ecs-2100.bin
...
passwd
sethwinfo
saveenv
format
sf write
sf erase
sf updatenand
abcdefghijklmnopqrstuvwxyz1234567890
acctonruntime
Permission denied.
Operation is not allowed.
New password:
Illegal password.
Retype New password:
Password does not match.
Password is changed successfully.
Password :
melzui5r
Incorrect Password.
Privileged mode is enabled.
boardmodel
RTL8382M_8218B_INTPHY_8218B_8214FC_DEMO
setenv boardmodel 'RTL8382M_8218B_INTPHY_8218B_8214FC_DEMO
RTL8380M_INTPHY_2FIB_1G_DEMO
setenv boardmodel 'RTL8380M_INTPHY_2FIB_1G_DEMO
reset
mtdparts

raspitoaster · July 9, 2026, 4:19pm

I used the openwrt imagebuilder with snapshot from yesterday and the day before.

make image PROFILE=zyxel_xgs1250-12-b1 PACKAGES="-firewall4 -fwtool -kmod-nf-conntrack -kmod-nf-conntrack6 -kmod-nf-flow -kmod-nf-log -kmod-nf-log6 -kmod-nf-nat -kmod-nf-reject -kmod-nf-reject6 -kmod-nfnetlink -kmod-nft-core -kmod-nft-fib -kmod-nft-nat -kmod-nft-offload -libnftnl11 -nftables-json -odhcp6c luci-base luci-mod-admin-full proto-bonding luci-theme-material uhttpd" CONFIG_IPV6=n

jonasj · July 9, 2026, 5:26pm

Just did a test on my XGS1210-12 and 1250-12, A1 though. From the PCS side everything should be fine. At least the 8 1G ports should work, otherwise it would be broken for me too. Same for fiber modules on the SFP ports.

goetz · July 9, 2026, 6:22pm

Does anybody have any experience with routing performance of the RTL930x based switches?

raspitoaster · July 9, 2026, 7:46pm

I repeated the test with the unmodified sysupgrade image from todays devel snapshot.
After poking around, the results are like this:

with bootcmd rtk network on;boota the network of the switch is working as expected
with bootcmd boota the ports are up, but no connection is possible on each of the 1G ports.
the 10G ports connect perfectly well (this is why my switches were reachable after I tried the first time without rtk network on. I thought, the reason for this was because they are configured as trunks),

plappermaul · July 9, 2026, 8:15pm

If its RTL8218E than we have no configuration for that in the PHY driver.

github.com/openwrt/openwrt

target/linux/realtek/files-6.18/drivers/net/phy/realtek/realtek_multiport.c

25ee12629


      
          		.read_mmd	= rtl821x_read_mmd,
          		.read_page	= rtl821x_read_page,
          		.resume		= genphy_resume,
          		.suspend	= genphy_suspend,
          		.write_mmd	= rtl821x_write_mmd,
          		.write_page	= rtl821x_write_page,
          	},
          	{
          		PHY_ID_MATCH_EXACT(PHY_ID_RTL8218E),
          		.name		= "REALTEK RTL8218E",
          		.config_init	= rtl821x_config_init,
          		.features	= PHY_GBIT_FEATURES,
          		.probe		= rtl8218x_phy_probe,
          		.read_mmd	= rtl821x_read_mmd,
          		.read_page	= rtl821x_read_page,
          		.resume		= genphy_resume,
          		.suspend	= genphy_suspend,
          		.write_mmd	= rtl821x_write_mmd,
          		.write_page	= rtl821x_write_page,
          	},
          };

jonasj · July 9, 2026, 8:32pm

Good call ... https://git.openwrt.org/openwrt/openwrt/commit/?id=c8c187f0f08a7660b0f66fd624c04e44fb8f8f6f is apparently incomplete then and only worked because U-boot on the test device already sets some missing bits.

luizluca · July 10, 2026, 3:06am

I think each model has is own password. They might have modified U-Boot to have two levels of privileges. The normal password might be an unsalted sha256 while the enable could be that plaintext melzui5r. Just the code can tell.

I checked the repo you mentioned but I couldn't find one with U-Boot to extract `uboot-ecs-2100.bin`. BTW, I opened an issue in that project last year (I didn't remember) to inform the magic key to stop U-Boot Is ctrl+u, or \x15.

Anyway, I'll check the firmware I have for the newer version to find out how they autenticate. It night be the same.

hmartin · July 10, 2026, 3:40pm

The flash dump of the ECS2100 (-10P and -28P) has the password: passwd=melzlntn

Unfortunately running screen -S edge -X stuff $'\x0b\x15' does not stop the boot timer countdown.

Edit: must be something wrong with the command, because ctrl+u in Minicom does stop the boot countdown. Unfortunately though, the password melzlntn does not work and the device resets.