diff --git a/doc/devices/S25G1109FP_V1_3.md b/doc/devices/S25G1109FP_V1_3.md
new file mode 100644
index 00000000..e5bf8b4c
--- /dev/null
+++ b/doc/devices/S25G1109FP_V1_3.md
@@ -0,0 +1,148 @@
+# Sirivision SR-S25G2109F (S25G1109FP V1.3)
+
+RTL8373 (non-N) with an RTL8224 quad 2.5G PHY: 8 × 2.5G RJ45 + 1 × SFP+,
+2 MB flash, no PoE.
+
+## Label specifications
+
+| Item | Value |
+|------|-------|
+| Manufacturer | Sirivision |
+| Model | SR-S25G2109F |
+| Ports | 8 × RJ45 10/100/1000/2500 Mbps, 1 × SFP+ 1G/2.5G/10G |
+| Power input | 12 V DC, 1.5 A |
+| Stock firmware | version 1.0.8.0 |
+| Stock defaults | IP 192.168.1.199, user `admin`, password `admin` |
+| Serial number | 001008130002003A000005 (also on the PCB barcode sticker) |
+
+The label does not carry a MAC address.  After a factory initialisation the
+stock firmware uses exactly the values printed on the label.
+
+## PCB silkscreen and naming
+
+Top side: `S25G1109FP V1.3 SIRIVISION`.  That model name belongs to an unmanaged
+PoE switch; this board omits the PoE section entirely.  What is actually shipped
+is the label model `SR-S25G2109F`: a simply managed, non-PoE switch.  Its stock
+firmware provides a web interface, but it responds very slowly.
+
+## CPU, PHY and flash
+
+| Part | Identification |
+|------|----------------|
+| SoC | RTL8373, non-N: `regget 4` returns `0x83730000` and the boot console prints `Detecting CPU: RTL8373` |
+| PHY | RTL8224, reported as `RTL8224 ID: 0x82240000` |
+| Flash | GigaDevice 25Q16ESIG (U7), 2 MB, JEDEC id `c8 40 15` |
+
+The two large ICs sit under soldered heatsinks, their markings are not readable.
+
+## Build
+
+```
+make MACHINE=S25G1109FP_V1_3 CI=1
+```
+
+The resulting image can be uploaded through the web interface (`System` page)
+or the stock web UI.
+
+## Port mapping
+
+| Front port | ASIC MAC | Interface |
+|------------|----------|-----------|
+| 1–8 | 0–7 | RJ45 2.5G |
+| 9 | 8 | SFP+ (SDS1) |
+
+## Board signals
+
+| Function | GPIO |
+|----------|------|
+| SFP detect (ModAbs) | 30, low with a module inserted |
+| SFP LOS | 37, high without light |
+| SFP TX disable | not connected, `GPIO_NA` |
+| SFP I2C | SDA 39 / SCL 40, `I2CBUS(GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1)` |
+| Reset button | 54 |
+
+ModAbs and LOS are separate signals here: GPIO30 tells whether a module is
+inserted, GPIO37 whether it receives light, so a module is identified even
+before the link comes up and loss of signal is reported.  GPIO38 and GPIO48,
+which the 8+1 reference boards use for ModAbs and for the reset button, never
+change on this board; with GPIO38 as ModAbs the firmware believed a module was
+permanently present and retried the I2C read forever.
+
+Serial console: the stock firmware runs the loader at 57600 baud and the runtime
+at 9600 baud, RTLPlayground uses 115200.
+
+## Front panel
+
+Each copper port has two LEDs, labelled `Link/Act` (left, yellow) and `2.5G`
+(right, green).  The SFP cage has a single green `Link/Act` LED; next to it are
+a `Power` LED and the `Reset` button.
+
+## LED configuration
+
+Copper ports use LED set 0, the SFP port uses LED set 1:
+
+| Set | Function 0 (left / SFP) | Function 1 (right) |
+|-----|-------------------------|--------------------|
+| SET0 | all speeds, link with activity | 2.5G link |
+| SET1 | all speeds, link with activity | not populated |
+
+The board is wired in the stock port order — LED pin `3n+m` belongs to port
+`n+1`, LED function `m` — so the mux table is the chip default with a single
+change: the SFP LED sits on pin 25 and is driven by LED function 0, while the
+default table maps pin 25 to function 1, which is unpopulated in SET1.  Without
+that change the SFP LED stays dark.
+
+A speed condition alone leaves an LED dark, `LEDS_LINK` has to be set as well.
+
+## Reset button
+
+| Hold time while running | Effect |
+|-------------------------|--------|
+| less than 3 s | no action |
+| 3–10 s | reset the switch chip, the firmware reboots (~20 s of downtime) |
+| more than 10 s | additionally restore the default configuration |
+
+The system LED blinks slowly while the button is held.  Holding the button
+during power-up instead waits for the release and restores the default
+configuration when it is released after 10–30 s.
+
+## MAC address
+
+The factory MAC sits at `0x1FC000`, six bytes followed by `0xFF` padding.  The
+stock value is a locally administered address (`1A:5D:23:47:4D:EB`), which the
+firmware rejects, so the device runs with a UUID-derived MAC (`06:…`).  A valid
+globally administered address stored there is used instead.
+
+## What works
+
+- all eight 2.5GBASE-T ports at 10/100/1000/2500 Mbps
+- SFP+ with 10G and 1G modules, including DDM data where the module provides it
+  - 10G: Finisar FCBG110SD1C05 AOC (no DDM), rate `0x67`, SerDes mode `1a`
+  - 1G: ETU ESB5312-3SCD20 (DDM), rate `0x0d`, SerDes mode `04`
+- LEDs, module insert/remove detection, loss of signal reporting, reset button
+
+## Unverified
+
+- 2.5G SFP modules, none was available for testing
+
+## Photos
+
+Front panel:
+
+![Front panel](photos/S25G1109FP_V1_3/front.jpg)
+
+Label:
+
+![Label](photos/S25G1109FP_V1_3/label.jpg)
+
+PCB top side:
+
+![PCB top side](photos/S25G1109FP_V1_3/pcb_top.jpg)
+
+PCB bottom side:
+
+![PCB bottom side](photos/S25G1109FP_V1_3/pcb_bottom.jpg)
+
+Flash chip, GigaDevice 25Q16ESIG:
+
+![Flash chip](photos/S25G1109FP_V1_3/flash.jpg)
diff --git a/doc/devices/photos/S25G1109FP_V1_3/flash.jpg b/doc/devices/photos/S25G1109FP_V1_3/flash.jpg
new file mode 100644
index 00000000..30179e2c
Binary files /dev/null and b/doc/devices/photos/S25G1109FP_V1_3/flash.jpg differ
diff --git a/doc/devices/photos/S25G1109FP_V1_3/front.jpg b/doc/devices/photos/S25G1109FP_V1_3/front.jpg
new file mode 100644
index 00000000..18692aca
Binary files /dev/null and b/doc/devices/photos/S25G1109FP_V1_3/front.jpg differ
diff --git a/doc/devices/photos/S25G1109FP_V1_3/label.jpg b/doc/devices/photos/S25G1109FP_V1_3/label.jpg
new file mode 100644
index 00000000..6e012a22
Binary files /dev/null and b/doc/devices/photos/S25G1109FP_V1_3/label.jpg differ
diff --git a/doc/devices/photos/S25G1109FP_V1_3/pcb_bottom.jpg b/doc/devices/photos/S25G1109FP_V1_3/pcb_bottom.jpg
new file mode 100644
index 00000000..07536652
Binary files /dev/null and b/doc/devices/photos/S25G1109FP_V1_3/pcb_bottom.jpg differ
diff --git a/doc/devices/photos/S25G1109FP_V1_3/pcb_top.jpg b/doc/devices/photos/S25G1109FP_V1_3/pcb_top.jpg
new file mode 100644
index 00000000..071a2323
Binary files /dev/null and b/doc/devices/photos/S25G1109FP_V1_3/pcb_top.jpg differ
diff --git a/doc/supported_devices.md b/doc/supported_devices.md
index 5d330db0..2217130d 100644
--- a/doc/supported_devices.md
+++ b/doc/supported_devices.md
@@ -43,6 +43,7 @@ The following devices have been tested and are fully working:
 | Ruiying  | RY-4GT-2SX      | No      | [FG-4GT-2SX_V2.0](devices/FG-4GT-2SX_V2.0.md)                             | 4M    | 4 + 2 |
 | Ruiying  | RY-8GT-1SX      | No      | [FG-8GT-1SX](devices/FG-8GT-1SX.md)                                       | 1M    | 8 + 1 |
 | SICSOLINK| SL-G0402F       | No      | [PCB-K0402WS-V3.0](devices/PCB-K0402WS-V3.0.md)                           |       | 4 + 2 |
+| Sirivision | SR-S25G2109F  | Yes     | [S25G1109FP V1.3](devices/S25G1109FP_V1_3.md)                             | 2M    | 8 + 1 |
 | Sodola   | SL-SWTG124AS-D  | Yes     | [SWTG024AS-v2.0-17452](devices/SWTG024AS.md)                              | 2M    | 4 + 2 |
 | Steamemo | IG204-V1        | No      | [PB-2131](devices/STEAMEMO_IG204_V1.md)                                   |       | 4 + 2 |
 | TRENDnet | TEG-S562        | No      | [TEG-S563/EU H/W: V1.0R](devices/TEG-S562.md)                             | 2M    | 4 + 2 |
diff --git a/machine/S25G1109FP_V1_3.c b/machine/S25G1109FP_V1_3.c
new file mode 100644
index 00000000..dab24ab5
--- /dev/null
+++ b/machine/S25G1109FP_V1_3.c
@@ -0,0 +1,53 @@
+#include "machine_defs.h"
+
+// Sirivision S25G1109FP V1.3 (label: SR-S25G2109F): 8x2.5G RJ45 + 1x10G SFP+,
+// 2 MB flash, RTL8373 (non-N) + RTL8224.  Derived from the KP-9000-9XHML-X V3.1
+// definition; every value below was confirmed on hardware, see the device doc
+// in doc/devices/S25G1109FP_V1_3.md.
+__code const struct machine machine = {
+	MACHINE_COMMON_SETTING,
+	.n_sfp = 1,
+	.log_to_phys_port = {1, 2, 3, 4, 5, 6, 7, 8, 9},
+	.phys_to_log_port = {0, 1, 2, 3, 4, 5, 6, 7, 8},
+	.is_sfp = {0, 0, 0, 0, 0, 0, 0, 0, 1},
+	/* ModAbs is GPIO30 (low with a module inserted, high with an empty cage),
+	 * LOS is GPIO37 (high without light).  GPIO38, the ModAbs pin of the
+	 * KP-9000 8+1 reference, is tied low here and never changes, which made the
+	 * firmware believe a module was always present. */
+	.sfp_port[0].pin_detect = GPIO30_ACL_BIT3_EN,
+	.sfp_port[0].pin_los = GPIO37,
+	.sfp_port[0].pin_tx_disable = GPIO_NA,
+	.sfp_port[0].sds = 1,
+	.sfp_port[0].i2c = I2CBUS( GPIO39_I2C_SDA4, GPIO40_I2C_SCL3_MDC1 ),
+	/* Reset button: GPIO54 reads high when idle and low while pressed.
+	 * GPIO48, used by the KP-9000 reference, never changes on this board. */
+	.reset_pin = GPIO54_ACL_BIT2_EN,
+	.high_leds = { .mux = LED_27 | LED_29, .enable = LED_28_SYS | LED_29 },
+	.port_led_set = { 0, 0, 0, 0, 0, 0, 0, 0, 1},
+	.led_sets = {
+		{   /* RJ45: left LED = link/activity, right LED = 2.5G */
+			LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT,
+			/* speed-only conditions leave the LED dark: the LINK bit has to be
+			 * set as well, otherwise the LED controller stays off */
+			LEDS_2G5 | LEDS_LINK,
+			0,
+			0,
+		}, { /* SFP PORT, SINGLE GREEN LED */
+			LEDS_2G5 | LEDS_1G | LEDS_100M | LEDS_10M | LEDS_LINK | LEDS_ACT | LEDS_10G,
+			0,
+			0,
+			0,
+		}},
+	/* 6 bits per LED pin, encoded as (port << 2) | led.  This is the chip
+	 * default for port-ordered wiring (pin 3n+m = port n+1, function m) with
+	 * one change: pin 25 drives the SFP LED with function 0, the only function
+	 * populated in led_sets[1].  See the device doc for the details. */
+	.led_mux_custom = 1,
+	.led_mux = {0x00, 0x01, 0x02, 0x04, 0x05, 0x06, 0x08, 0x09, 0x0a, 0x0c,
+				0x0d, 0x0e, 0x10, 0x11, 0x12, 0x14, 0x15, 0x16, 0x18, 0x19,
+				0x1a, 0x1c, 0x1d, 0x1e, 0x20, 0x20, 0x22, 0x23},
+	/* Factory MAC at flash 0x1FC000, verified in the stock dump.  The stock
+	 * value is a locally administered address, which is rejected, so a
+	 * UUID-derived MAC is used unless a valid one is stored here. */
+	.mac_flash_offset = 0x1FC000,
+};
diff --git a/machine/S25G1109FP_V1_3.h b/machine/S25G1109FP_V1_3.h
new file mode 100644
index 00000000..fbe6f7b3
--- /dev/null
+++ b/machine/S25G1109FP_V1_3.h
@@ -0,0 +1,10 @@
+#ifndef _MACHINE_S25G1109FP_V1_3_H_
+#define _MACHINE_S25G1109FP_V1_3_H_
+
+/* machine_name[] in struct machine is 30 bytes -> keep this <= 29 chars */
+/* The product is sold as SR-S25G2109F; S25G1109FP is the PCB silkscreen and
+ * belongs to a different (unmanaged PoE) model that shares this PCB. */
+#define MACHINE_MODEL "Sirivision SR-S25G2109F"
+#define MACHINE_CHIPSET RTL8373
+
+#endif