Add support to Unifi Switch - BCM53343

[cesarvog]

Hello all,

Does anybody know if it would be possible to run OpenWRT on US-8-150, US-16-150 or US-24-250 switches, made by Ubiquiti?
The processor is the BCM53343.

Since OpenWRT is already available for some ASUS BCM based routers, I thought of trying to interrupt the stock boot loader and try to run initramfs from one of those units and then do a sysupgrade in my defective Unifi US-16-150 (I suppose the only problem on it is the PoE, but the stock OS does not go ahead if the PSE check fails - see log below). Unfortunately, I could not yet test with OpenWRT because there is only complete trx firmware files available for those somewhat similar ASUS routers...

Does anyone know how can I get separate initramfs file for the ASUS RT-AC68U, for example, as well as a sysupgrade file, to try to see if I can make it boot from RAM and then install OpenWRT from there on my Unifi switch?

Adittionaly, which commands do I need to run on the interrupted boot loader screen on the Unifi switch, in order to help this moving forward?

I'm in no way a developer, but can follow instructions and was even able to make a backup of the stock EPROM from my US-16-150, by using a flashcat and a 16 pin Pomona Clip. I'm sure I can try to help this initiative moving forward, if any more experienced souls would be willing to offer some guidance.
In the meantime, stay safe, everyone.

[cesarvog]

Since my switch is somewhat defective, it goes on a boot loop after the PSE error is found and there's nothing I can do in it's stock OS, to try to verify if the error lies only on the PoE capability...

Here is the uninterrupted boot captured from the switch's console:

U-Boot usw-v1.1.4.115-g14af1ee6 (Feb 14 2017 - 18:50:54)

DEV ID= 0000db56
SKU ID = 0x8343
DDR type: DDR3
MEMC 0 DDR speed = 667MHz
Validate Shmoo parameters stored in flash ..... OK
Press Ctrl-C to run Shmoo ..... skipped
Restoring Shmoo parameters from flash ..... done
Running simple memory test ..... OK
DDR Tune Completed
DRAM:  256 MiB
WARNING: Caches not enabled

 soc_pcie_hw_init : port->reg_base = 0x18012000 , its value = 0x4 
PCIe port 0 in RC mode

 pos is 172
==>PCIE: LINKSTA reg 0xbe val 0x1001

**************
 port 0 is not active!!
**************
In:    serial
Out:   serial
Err:   serial
Unlocking L2 Cache ...Done
arm_clk=400MHz, axi_clk=200MHz, apb_clk=50MHz, arm_periph_clk=200MHz
Disabling outer cache
Net:   Board Net Initialization Failed
No ethernet found.
Hit any key to stop autoboot:  0 
ubnt_bootsel_init: bootsel magic=a34de82b, bootsel = 0 
UBNT application initialized 
Boot partition selected = 0 
Loading Kernel Image @ 1000000, size = 15728640 
Verifying 'kernel0' parition:OK
## Booting kernel from Legacy Image at 01000000 ...
   Image Name:   Ubiquiti 4.0.18.9926
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    15166784 Bytes = 14.5 MiB
   Load Address: 00018000
   Entry Point:  00018000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
boot_prep_linux commandline: console=ttyS0,115200 mem=128M@0x0 mem=128M@0x68000000 mtdparts=spi1.0:768k(u-boot),64k(u-boot-env),64k(shmoo),15360k(kernel0),15424k(kernel1),1024k(cfg),64k(EEPROM) ubntbootid=0

Starting kernel ...

Disabling outer cache
[    0.000000] Booting Linux on physical CPU 0
[    0.000000] Linux version 3.6.5 (builder@owrt1505-us48p) (gcc version 4.7.2 (OpenWrt GCC 4.7.2 unknown) ) #1 SMP Wed Jan 16 18:09:43 MST 2019
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Broadcom iProc
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] BUG: mapping for 0x18000000 at 0xf0000000 out of vmalloc space
[    0.000000] BUG: mapping for 0x19000000 at 0xf1000000 out of vmalloc space
[    0.000000] PERCPU: Embedded 7 pages/cpu @c1cc7000 s6272 r8192 d14208 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 61952
[    0.000000] Kernel command line: console=ttyS0,115200 mem=128M@0x0 mem=128M@0x68000000 mtdparts=spi1.0:768k(u-boot),64k(u-boot-env),64k(shmoo),15360k(kernel0),15424k(kernel1),1024k(cfg),64k(EEPROM) ubntbootid=0 ubootver=usw-v1.1.4.115-g14af1ee6
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 128MB 128MB = 256MB total
[    0.000000] Memory: 244896k/244896k available, 17248k reserved, 131072K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xc8800000 - 0xf0000000   ( 632 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0018000 - 0xc034d7f0   (3286 kB)
[    0.000000]       .init : 0xc034e000 - 0xc0e64880   (11355 kB)
[    0.000000]       .data : 0xc0e66000 - 0xc0e8ed40   ( 164 kB)
[    0.000000]        .bss : 0xc0e8ed64 - 0xc0ebd354   ( 186 kB)
[    0.000000] SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000]  RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=1.
[    0.000000] NR_IRQS:292
[    0.000000] sched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps every 4294967286ms
[    0.010000] Calibrating delay loop... 795.44 BogoMIPS (lpj=3977216)
[    0.050000] pid_max: default: 4096 minimum: 301
[    0.050000] Mount-cache hash table entries: 512
[    0.050000] CPU: Testing write buffer coherency: ok
[    0.050000] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.050000] Setting up static identity map for 0x282250 - 0x2822a8
[    0.050000] L310 cache controller enabled
[    0.050000] l2x0: 8 ways, CACHE_ID 0x410000c9, AUX_CTRL 0x0a120000, Cache size: 131072 B
[    0.050000] Brought up 1 CPUs
[    0.050000] SMP: Total of 1 processors activated (795.44 BogoMIPS).
[    0.050000] devtmpfs: initialized
[    0.060000] NET: Registered protocol family 16
[    0.060000] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.060000] GENPLL[5] mdiv=40 rate=2000000000
[    0.060000] Sel=1 Ovr=1 Div=48
[    0.060000] UART clock rate 50000000
[    0.080000] bio: create slab <bio-0> at 0
[    0.080000] Bluetooth: Core ver 2.16
[    0.080000] NET: Registered protocol family 31
[    0.080000] Bluetooth: HCI device and connection manager initialized
[    0.080000] Bluetooth: HCI socket layer initialized
[    0.080000] Bluetooth: L2CAP socket layer initialized
[    0.080000] Bluetooth: SCO socket layer initialized
[    0.080000] Switching to clocksource iproc_gtimer
[    0.090000] NET: Registered protocol family 2
[    0.090000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.090000] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[    0.090000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.090000] TCP: reno registered
[    0.090000] UDP hash table entries: 128 (order: 0, 4096 bytes)
[    0.090000] UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
[    0.090000] NET: Registered protocol family 1
[   14.560000] pm_init: Initializing Power Management ....
[   14.560000] iproc gpiochip add GPIOA
[   14.560000] GPIOA:ioaddr f0000060 
[   14.560000] GPIOA:intr_ioaddr f0000000 dmu_ioaddr   (null)
[   14.810000] PCIE0: LINKSTA reg 0xbe val 0x1001
[   14.810000] reg[0xac]=0x10, reg[0xae]=0x42, reg[0xb0]=0x8000, reg[0xb4]=0x2c10, reg[0xb6]=0x10, reg[0xb8]=0x5c12, reg[0xba]=0x65, reg[0xbe]=0x1001, reg[0xc6]=0x40, reg[0xca]=0x1, reg[0xd0]=0x1f, reg[0xd2]=0x8, reg[0xdc]=0x2, PCIE0 link=0
[   15.160000] PCIe port 1 in End-Point mode - ignored
[   15.160000] Registering iproc_pmu_device
[   15.170000] bounce pool size: 64 pages
[   15.180000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[   15.180000] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[   15.180000] msgmni has been set to 222
[   15.190000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[   15.190000] io scheduler noop registered
[   15.190000] io scheduler deadline registered (default)
[   15.190000] io scheduler cfq registered
[   15.190000] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
[   15.190000] serial8250.0: ttyS0 at MMIO 0x18000400 (irq = 123) is a 16550A
[   15.670000] console [ttyS0] enabled
[   15.670000] serial8250.0: ttyS1 at MMIO 0x18000300 (irq = 123) is a 16550A
[   15.700000] brd: module loaded
[   15.710000] loop: module loaded
[   15.720000] nbd: registered device at major 43
[   15.740000] tun: Universal TUN/TAP device driver, 1.6
[   15.750000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[   15.760000] Bluetooth: HCI UART driver ver 2.2
[   15.760000] Bluetooth: HCI H4 protocol initialized
[   15.760000] Bluetooth: HCI BCSP protocol initialized
[   15.770000] TCP: cubic registered
[   15.780000] NET: Registered protocol family 10
[   15.780000] sit: IPv6 over IPv4 tunneling driver
[   15.790000] NET: Registered protocol family 17
[   15.800000] Bluetooth: RFCOMM TTY layer initialized
[   15.800000] Bluetooth: RFCOMM socket layer initialized
[   15.810000] Bluetooth: RFCOMM ver 1.11
[   15.810000] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   15.820000] Bluetooth: BNEP filters: protocol multicast
[   15.820000] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[   15.830000] 8021q: 802.1Q VLAN Support v1.8
[   15.830000] GENPLL[5] mdiv=40 rate=2000000000
[   15.840000] qspi_iproc qspi_iproc.1: 1-lane output, 3-byte address
[   15.840000] m25p80 spi1.0: found mx25l25635e, expected m25p80
[   15.850000] m25p80 spi1.0: mx25l25635e (32768 Kbytes)
[   15.850000] 7 cmdlinepart partitions found on MTD device spi1.0
[   15.860000] Creating 7 MTD partitions on "spi1.0":
[   15.860000] 0x000000000000-0x0000000c0000 : "u-boot"
[   15.870000] 0x0000000c0000-0x0000000d0000 : "u-boot-env"
[   15.880000] 0x0000000d0000-0x0000000e0000 : "shmoo"
[   15.890000] 0x0000000e0000-0x000000fe0000 : "kernel0"
[   15.890000] 0x000000fe0000-0x000001ef0000 : "kernel1"
[   15.900000] 0x000001ef0000-0x000001ff0000 : "cfg"
[   15.910000] 0x000001ff0000-0x000002000000 : "EEPROM"
[   15.940000] Freeing init memory: 11352K
[   15.980000] ubnt_common: module license 'Proprietary' taints kernel.
[   15.990000] Disabling lock debugging due to kernel taint
[   16.080000] gpiodev: reset_timeout=3
...running /sbin/init
init started: BusyBox v1.23.2 (2019-01-16 18:00:28 MST)
+ exec
Restoring EEPROM data from ubnthal
MAC: f0:9f:c2:0d:73:7c
Validating the active image /dev/mtd3..."4.0.18.9926"
Validating the backup image /dev/mtd4..."4.0.16.9882"
DMA pool size: 4194304
AXI unit 0: Dev 0x8343, Rev 0x01, Chip BCM53343_A0, Driver BCM56150_A0
SOC unit 0 attached to PCI device BCM53343_A0


<10> Jan  1 00:00:40 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(5129) 56 %% PSE init failed 0x000c, retry 1

<10> Jan  1 00:00:46 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(5129) 75 %% PSE init failed 0x000c, retry 2

<10> Jan  1 00:00:53 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(5129) 112 %% PSE init failed 0x000c, retry 3

<10> Jan  1 00:00:53 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(3974) 113 %% PoE Initialization failed in Hardware

cnfgrApiCallback: Failed by component 171 - UBNT_POE
task 0x33b135c - Cnfgr_Thread 
Cnfgr current state 150 - UNKNOWN
Cnfgr next state 150 - UNKNOWN
The system is restarting due to the inconsistent state 171 in file: cnfgr_tally.c line 233

<8> Jan  1 00:00:54 UBNT LOG[Cnfgr_Thread ]: log_cnfgr.c(1258) 133 %% The system is restarting due to inconsistent state.

Switching software SIGSEGV Handler
This build was configured to copy this crash information to
  a file.
Symbols already loaded.
/home/builder/uap.work/build/openwrt/build_dir/arm/fastpath/src/mgmt/broadcom/cli_web_mgr/cli_web_util.c: 1395: Failed to create cliWebIORedirectHandle

[cesarvog]

If I interrupt boot, by pressing a key, it shows a u-boot> prompt.

--- Pressing ? shows the following available commands:

u-boot> ?
?       - alias for 'help'
base    - print or set address offset
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
chpart  - change active partition
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
echo    - echo args to console
env     - environment handling commands
exit    - exit script
false   - do nothing, unsuccessfully
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
go      - start application at address 'addr'
help    - print command description/usage
itest   - return true/false on integer compare
license - print GPL license text
loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
ls      - list files in a directory (default /)
md      - memory display
mdc     - memory display cyclic
mm      - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
mwc     - memory write cyclic
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
showvar - print local hushshell variables
sleep   - delay execution for some time
source  - run script from memory
sspi    - SPI utility command
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
tftpsrv - act as a TFTP server and boot the first received file
true    - do nothing, successfully
urescue - urescue       - start TFTP server and wait for firmware

--- Typing printenv shows the following:

u-boot> printenv
bootargs=console=ttyS0,115200 mem=128M@0x0 mem=128M@0x68000000 mtdparts=spi1.0:768k(u-boot),64k(u-boot-env),64k(shmoo),15360k(kernel0),15424k(kernel1),1024k(cfg),64k(EEPROM)
bootcmd=run ubntappinit ubntboot
bootdelay=3
ethaddr=<obfuscated>
ipaddr=192.168.1.20
loadaddr=0x01000000
mtdparts=mtdparts=spi1.0:768k(u-boot),64k(u-boot-env),64k(shmoo),15360k(kernel0),15424k(kernel1),1024k(cfg),64k(EEPROM)
serverip=192.168.1.254
stderr=serial
stdin=serial
stdout=serial
ubntaddr=67030020
ubntappinit=go ${ubntaddr} uappinit;go ${ubntaddr} ureset_button;urescue;go ${ubntaddr} uwrite;go ${ubntaddr} ubntboot
ubntboot=bootm 0x01000000

--- showvar displays the following:

u-boot> showvar
HUSH_VERSION=0.01

[cesarvog]

IF I ever find a initramfs file compatible, based on the printenv results above, I suppose I have to do the following:

a) Configure my Mac to be a TFTP server at 192.168.1.20
b) From the u-boot prompt, Run tftp 0x01000000 to fetch the initramfs file. Run bootm 0x01000000 to boot OpenWrt. Wait until messages stop, hit enter and should find an OpenWrt prompt on the terminal screen.
c) Using scp or something similar (being a Mac user, I normally use Cyberduck), push the sysupgrade file to the router filesystem, login in as root@192.168.1.1.
d) From the router terminal screen run sysupgrade <sysupgrade_filename>.
If everything works as expected, once it reboots I will have OpenWrt installed and "ready" to use. "Ready" because all this assumes the hypothetical sysupgrade file I'm yet to find from the similar hardware is more or less similar (which I believe will be. fingers crossed)...

Tks for @mk24 on Flashing the Ubiquiti Unifi UAP v2 - #3 by BennoHouse for helping other users on a different thread, which I used as basis for my crazy ideas above...

[cesarvog]

Ok, I found out that I can use the u-boot command "loady" to send a binary file to the 0x01000000 address using YMODEM from my terminal emulator (Serial v.2 (Mac))... If only I had a compatible initramfs binary file...

[anon50098793]

@cesarvog

IF I ever find a initramfs file

some ideas...

• for new devices... rolling your sleeves up and familiarising yourself with the buildroot means you will have total control over the recipe for actual initramfs format that your device supports, including what is actually in the initramfs itself rather than just finding something random...
• alot of bcm5x something targetsdevices were disabled at some point in the kernel bumping history post 18 I think... they are only disabled but it may mean that rewinding to around that point may yeild more options for you

[cesarvog]

Tks for your reply.
I also thought so, but frankly have no idea how to start familiarizing myself with the build system. I've already taken a look at the developers section of the main OpenWRT page (https://openwrt.org/docs/guide-developer/start). I very fast found myself lost in a sea of terms I have no idea about...

[anon50098793]

well if you know a few linux commands / have a linux pc... then what you are attempting to do... at least in it's basic form is not terribly challenging...

• setup a buildroot and do a build for the closest target to yours if one exists ( bcm53xx? )...
• cat target/linux/YOURTARGEST/image/Makefile and pick a recipe/device that you think may be close to yours... for ubquiti you should probably also check other target ubiquiti recipes for common formatting rules in addition to binwalking and googling regaring image format for that device
• make your own device section in the Makefile(and probably dts copy something similar) and test adding or changing parts to achieve the result you desire...

[cesarvog]

Ok, tks for helping me out here.
If I understand you correctly I will need a Linux virtual machine (I'm a Mac user). Is Debian Buster without desktop adequate to start with? Or maybe Ubuntu (what version)?
Once Linux is up, the next step would be to setup a buildroot (I suppose I can find instructions on how to do that in the above mentioned section of the developers guide).

"binwalking"?
"dts"?

Many, many tks for your patience, time and hard work (I've been using your RPi4 build as well).

[anon50098793]

yeah... a debian vm non-graphical is fine... follow the general wiki tutorial... can assist once host pc is up...

worst case scenario... you learn a little more about your device and its recovery... and also about how to use the buildroot to build images...

the other nice thing to have is the point about googling/binwalk... if the device in question gives you a shell ( if not uboot )... the manual way is to obtain a copy of the kernel... from the device and check it with the 'file' command or binwalk...

from a stock buildroot... you can often just take a kernel and attempt to boot it raw ( or wrap it manually in headers etc. )... pretty simple stuff... at least in order to give you 'somecontrol' over what your able to achieve on the thing... ( won't find a filesystem... but if you get to that point you know you are on the right track... )

the only catch is signed images... and as i'm not that familiar with ubiquiti they may 'obuscate' their firmware... which is why i'm suggesting trying to gather as much info in the image format as you can... before messing too much with your own building...

i suppose another thing to watch out for is alot of switches daisy chain another switch chip behind the primary one... I believe grommish is working on something similar at the moment... not saying this is the case with yours but if it does... it definitely puts the 'adding support' skillsets into the realm beyond most hobbyists...

[anon50098793]

@cesarvog

try to verify if the error lies only on the PoE capability

https://community.ui.com/questions/EdgeSwitch-ES-16-150W-stuck-in-reboot-loop/edc7fcd2-a3d9-4cd3-96d7-da4ffb570f70

https://community.ui.com/questions/ES-24-250W-crashing-restarting-console-info-nfgrApiCallback-Failed-by-component-171-UBNTPOE/15b1aa9c-a552-4e69-b1e0-d326ce7d8aac

[cesarvog]

Yeah, I've seen lots of similar reports in the UI community. I have even backed up the contents of another working US-16-150 flash storage chip and restored it to the "defective" unit. Unfortunately, Ubiquiti does hardware fingerprinting on it's products, so the "defective" restored unit ended up showing a different error, which essentially means it thinks it's a counterfeit... Once I restored the flash storage chip contents of the working unit into the "defective" unit, I thought I was on the right track, because the unit would not go into the endless boot loop. But further googling led me to understand the counterfeit angle of the new results.

EDIT: As a side note, I figure the ES16P_BCM silkscreened on the switch's PCB seem to indicate that the ES (EdgeSwitch) and US (Unifi Switch) share a common board, with somewhat different software and device fingerprinting. Reports of the EXACT same error I'm getting on my Unifi Switch all over the community referring to the Edge Switches as well as the Unifi Switches also seem to corroborate this thought.

[cesarvog]

About the reports of similar errors all over the UI community, what bothers me much is Ubiquiti does not seem to understand that every "defective" unit they fail to accept for RMA (warranty is 1 year only), adds another layer of heavy metal world poisoning due to premature and avoidable unit discard... So, they simpy replying the unit has some kind of hardware problem and basically saying to trash the unit while not letting after market technicians fix the problem equates to pure greed and short sight about the already over polluted environment in my book.

[anon50098793]

@cesarvog

ASUS RT-AC68U

different cpu [BCM4708A0]

[anon50098793]

@cesarvog

not letting after market technicians fix the problem

if you find another defective unit ( with different issue ) ... find this IC and switch ( ) it

Quad Integrated 802.3at-Compliant PSE Controller;Broadcom;BCM59111;;1;

[cesarvog]

Will try, This is indeed the PSE controller used in my unit (4x).
IN case the flash unit is somewhat corrupt (seen reports about it elsewhere), I also got an spare flash storage chip. I found out it's the same use in the PS4 and was very easy to find here in Brazil. I have already written the original backup from the defective unit to it, but currently do not have a hot air gun to make the exchange myself. Awaiting a friend to come here and help me.

[anon50098793]

here is your rt-68u initramfs... likely wont work being wrong chip but you can test your uboot commands

[cesarvog]

TKS!!!!

Will report back with the "bootm 0x01000000" command outcome in a few minutes.

[cesarvog]

Damn, wrong Image Format...

[anon50098793]

great... so we run 'file' and binwalk on it...

vert@peanut:/fs/sdd1/openwrt/RTNGext/cache/rpi4-opkg$ file ../../bcm5-1/bin/targets/bcm53xx/generic/openwrt-bcm53xx-generic-asus_rt-ac68u-initramfs.trx 
../../bcm5-1/bin/targets/bcm53xx/generic/openwrt-bcm53xx-generic-asus_rt-ac68u-initramfs.trx: data

'data' means it has no header... ( for uboot )

we need to run 'mkimage' to add a header to the file for uboot...