Add support to Unifi Switch - BCM53343

yes, fundamentally... from here on in... things get a little complex... but essentially... combinations of;

  • edit dts > turn dts into dtb with 'dtc' command > readd dtb to kernel and add header then test ( quite a few posts / guides on this )
  • same but use 'make kernel_menuconfig' and include (or remove) drivers ( also posts and guides
    on this )
  • [guru-level] add or modify drivers within the kernel ( good luck )

most of it is beyond my skillset... but I can talk you through the 'make kernel_menuconfig' if you get a buildroot up and running...

yeah... pcie, timer and mdio are the main things to pay attention to in that output...

( even if you stop where you are... this thread is a valuable reference / starting point for anyone who comes along in the future... so it's an achievement in itself )

1 Like

So much to learn, so little neurons still working... (I'm 59, btw).

2 Likes

Here is the output of the dmesg command from the "defective" switch, taken from the Linux command line right after the "defective" switch booted from it's default OS, and right before it rebooted from because of the PSE error. I don't know much about it, but looks to me that no error is found beside something the Ubiquiti programed to be verified during the INIT sequence. Sorry if this sounds confusing, English is not my native language.
I'm going to try to capture a lsmod output next. I'll have to try a few times, because there's a very short period of time after the PSE error is encountered in the INIT sequence, where I have to provide the username and password, and the command I wish to capture the output has to end, before the unit restarts automatically.

UBNT-US.v4.0.18# dmesg
[    0.000000] Booting Linux on physical CPU 0
[    0.000000] Linux version 3.6.5 (builder@owrt1505-us48p) (gcc version 4.7.2 (OpenWrt GCC 4.7.2 unknown) ) #1 SMP Wed Jan 16 18:09:43 MST 2019
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Broadcom iProc
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] BUG: mapping for 0x18000000 at 0xf0000000 out of vmalloc space
[    0.000000] BUG: mapping for 0x19000000 at 0xf1000000 out of vmalloc space
[    0.000000] On node 0 totalpages: 65536
[    0.000000] free_area_init_node: node 0, pgdat c0e8d040, node_mem_map c0ebe000
[    0.000000]   Normal zone: 256 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32512 pages, LIFO batch:7
[    0.000000]   HighMem zone: 3328 pages used for memmap
[    0.000000]   HighMem zone: 29440 pages, LIFO batch:7
[    0.000000] smp_init_cpus: Enter ncores 1
[    0.000000] smp_init_cpus: Leave ncores 1
[    0.000000] PERCPU: Embedded 7 pages/cpu @c1cc7000 s6272 r8192 d14208 u32768
[    0.000000] pcpu-alloc: s6272 r8192 d14208 u32768 alloc=8*4096
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 61952
[    0.000000] Kernel command line: console=ttyS0,115200 mem=128M@0x0 mem=128M@0x68000000 mtdparts=spi1.0:768k(u-boot),64k(u-boot-env),64k(shmoo),15360k(kernel0),15424k(kernel1),1024k(cfg),64k(EEPROM) ubntbootid=0 ubootver=usw-v1.1.4.115-g14af1ee6
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 128MB 128MB = 256MB total
[    0.000000] Memory: 244896k/244896k available, 17248k reserved, 131072K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xc8800000 - 0xf0000000   ( 632 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0018000 - 0xc034d7f0   (3286 kB)
[    0.000000]       .init : 0xc034e000 - 0xc0e64880   (11355 kB)
[    0.000000]       .data : 0xc0e66000 - 0xc0e8ed40   ( 164 kB)
[    0.000000]        .bss : 0xc0e8ed64 - 0xc0ebd354   ( 186 kB)
[    0.000000] SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000]  RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=1.
[    0.000000] NR_IRQS:292
[    0.000000] Clock Div = 0x2012
[    0.000000] Active frequency ID 6
[    0.000000] a9pll0_status: clk 0xc0e7c0f8
[    0.000000] parent rate 25000000
[    0.000000] Clock divisor 4
[    0.000000] Clock rate 400000005
[    0.000000] Clock Div = 0x2012
[    0.000000] Active frequency ID 6
[    0.000000] Clock divisor 2
[    0.000000] Clock rate 200000002
[    0.000000] iproc_clocksource_init: CPU global timer freq 200000002
[    0.000000] cpu_clk_freq: 200000002
[    0.000000] HZ: 100, ticks_per_jiffy: 2000000
[    0.000000] sched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps every 4294967286ms
[    0.010000] Calibrating delay loop... 795.44 BogoMIPS (lpj=3977216)
[    0.050000] pid_max: default: 4096 minimum: 301
[    0.050000] Mount-cache hash table entries: 512
[    0.050000] CPU: Testing write buffer coherency: ok
[    0.050000] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.050000] Setting up static identity map for 0x282250 - 0x2822a8
[    0.050000] L310 cache controller enabled
[    0.050000] l2x0: 8 ways, CACHE_ID 0x410000c9, AUX_CTRL 0x0a120000, Cache size: 131072 B
[    0.050000] Brought up 1 CPUs
[    0.050000] SMP: Total of 1 processors activated (795.44 BogoMIPS).
[    0.050000] devtmpfs: initialized
[    0.060000] NET: Registered protocol family 16
[    0.060000] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.060000] board_init: Enter
[    0.060000] GENPLL[5] mdiv=40 rate=2000000000
[    0.060000] Sel=1 Ovr=1 Div=48
[    0.060000] UART clock rate 50000000
[    0.060000] board_init: Leave
[    0.080000] bio: create slab <bio-0> at 0
[    0.080000] Bluetooth: Core ver 2.16
[    0.080000] NET: Registered protocol family 31
[    0.080000] Bluetooth: HCI device and connection manager initialized
[    0.080000] Bluetooth: HCI socket layer initialized
[    0.080000] Bluetooth: L2CAP socket layer initialized
[    0.080000] Bluetooth: SCO socket layer initialized
[    0.080000] Switching to clocksource iproc_gtimer
[    0.090000] NET: Registered protocol family 2
[    0.090000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.090000] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[    0.090000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.090000] TCP: reno registered
[    0.090000] UDP hash table entries: 128 (order: 0, 4096 bytes)
[    0.090000] UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
[    0.090000] NET: Registered protocol family 1
[    0.090000] PCI: CLS 0 bytes, default 64
[   14.570000] pm_init: Initializing Power Management ....
[   14.570000] iproc gpiochip add GPIOA
[   14.570000] GPIOA:ioaddr f0000060 
[   14.570000] GPIOA:intr_ioaddr f0000000 dmu_ioaddr   (null)
[   14.820000] PCIE0: LINKSTA reg 0xbe val 0x1001
[   14.820000] reg[0xac]=0x10, reg[0xae]=0x42, reg[0xb0]=0x8000, reg[0xb4]=0x2c10, reg[0xb6]=0x10, reg[0xb8]=0x5c12, reg[0xba]=0x65, reg[0xbe]=0x1001, reg[0xc6]=0x40, reg[0xca]=0x1, reg[0xd0]=0x1f, reg[0xd2]=0x8, reg[0xdc]=0x2, PCIE0 link=0
[   15.170000] PCIe port 1 in End-Point mode - ignored
[   15.170000] Registering iproc_pmu_device
[   15.170000] bounce pool size: 64 pages
[   15.190000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[   15.190000] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[   15.190000] msgmni has been set to 222
[   15.190000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[   15.190000] io scheduler noop registered
[   15.190000] io scheduler deadline registered (default)
[   15.190000] io scheduler cfq registered
[   15.190000] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
[   15.200000] serial8250.0: ttyS0 at MMIO 0x18000400 (irq = 123) is a 16550A
[   15.670000] console [ttyS0] enabled
[   15.680000] serial8250.0: ttyS1 at MMIO 0x18000300 (irq = 123) is a 16550A
[   15.710000] brd: module loaded
[   15.720000] loop: module loaded
[   15.730000] nbd: registered device at major 43
[   15.750000] tun: Universal TUN/TAP device driver, 1.6
[   15.760000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[   15.760000] Bluetooth: HCI UART driver ver 2.2
[   15.770000] Bluetooth: HCI H4 protocol initialized
[   15.770000] Bluetooth: HCI BCSP protocol initialized
[   15.780000] TCP: cubic registered
[   15.780000] NET: Registered protocol family 10
[   15.790000] sit: IPv6 over IPv4 tunneling driver
[   15.800000] NET: Registered protocol family 17
[   15.800000] Bluetooth: RFCOMM TTY layer initialized
[   15.810000] Bluetooth: RFCOMM socket layer initialized
[   15.810000] Bluetooth: RFCOMM ver 1.11
[   15.820000] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   15.820000] Bluetooth: BNEP filters: protocol multicast
[   15.830000] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[   15.830000] 8021q: 802.1Q VLAN Support v1.8
[   15.840000] GENPLL[5] mdiv=40 rate=2000000000
[   15.840000] qspi_iproc qspi_iproc.1: 1-lane output, 3-byte address
[   15.850000] m25p80 spi1.0: found mx25l25635e, expected m25p80
[   15.860000] m25p80 spi1.0: mx25l25635e (32768 Kbytes)
[   15.860000] 7 cmdlinepart partitions found on MTD device spi1.0
[   15.870000] Creating 7 MTD partitions on "spi1.0":
[   15.870000] 0x000000000000-0x0000000c0000 : "u-boot"
[   15.880000] 0x0000000c0000-0x0000000d0000 : "u-boot-env"
[   15.890000] 0x0000000d0000-0x0000000e0000 : "shmoo"
[   15.890000] 0x0000000e0000-0x000000fe0000 : "kernel0"
[   15.900000] 0x000000fe0000-0x000001ef0000 : "kernel1"
[   15.910000] 0x000001ef0000-0x000001ff0000 : "cfg"
[   15.920000] 0x000001ff0000-0x000002000000 : "EEPROM"
[   15.920000] creating /proc/iproc-pse
[   15.920000]          /proc/iproc-pse/enable
[   15.950000] Freeing init memory: 11352K
[   15.990000] ubnt_common: module license 'Proprietary' taints kernel.
[   15.990000] Disabling lock debugging due to kernel taint
[   16.070000] creating procfs for ubnthal
[   16.070000] creating proc entry for system.info
[   16.070000] creating proc entry for board
[   16.070000] creating procfs for status
[   16.070000] creating proc entry for IsDefault
[   16.070000] creating proc entry for IsLocated
[   16.070000] creating proc entry for IsIsolated
[   16.080000] gpiodev: reset_timeout=3
[   16.090000] creating /proc/gpio/
[   16.090000]          /proc/gpio/ledbar_control
[   16.090000]          /proc/gpio/led_pattern
[   16.090000]          /proc/gpio/led_tempo
[   16.090000]          /proc/gpio/poe_passthrough
[   16.090000]          /proc/gpio/resetbtn
[   16.090000]          /proc/gpio/resetbtn_age
[   16.340000] Ubiquiti: system 0xeb21 revision 7
long-shot-disable-panic-probably-no-use

you might try ( note: panic=0 ) at uboot prompt before loady... ( on the OEM OS )

setenv bootargs 'bootargs=console=ttyS0,115200 mem=128M@0x0 mem=128M@0x68000000 mtdparts=spi1.0:768k(u-boot),64k(u-boot-env),64k(shmoo),15360k(kernel0),15424k(kernel1),1024k(cfg),64k(EEPROM) panic=0'

( do NOT type saveenv this way you can just reboot it you stuff up the variable)
( use 'printenv' after you set the above line to make sure it worked )

( with openwrt... bootloader command line options are sometimes ignored anyway -> needs changing the dts ... but it will say ignored usually with the OEM firmware i'm not sure how it behaves or even if it's a panic ( more likely some sort of watchdog or other logic ) ... but worth trying )

actually

the above looks interesting... wonder if it's in /sys or /proc or other... setting it to 3000 may just give you some time?

here is the full 'section' from some random online log... ( does have '3' tho' )

<10> Jan  1 03:00:41 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(5128) 27 %% PSE init failed 0x003f, retry 1

<10> Jan  1 03:00:44 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(5128) 80 %% PSE init failed 0x003f, retry 2

<10> Jan  1 03:00:46 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(5128) 81 %% PSE init failed 0x003f, retry 3

<10> Jan  1 03:00:46 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(3955) 82 %% PoE Initialization failed in Hardware

cnfgrApiCallback: Failed by component 171 - UBNT_POE
task 0x33d57ac - Cnfgr_Thread
Cnfgr current state 150 - UNKNOWN
Cnfgr next state 150 - UNKNOWN
The system is restarting due to the inconsistent state 171 in file: cnfgr_tally.c line 233

wonder what's with the 27% > 81% stuff? ( wonder if a 50v2200uF near the POE chips / regulators might do anything... ? it's definately consistent with the failure mode [time!damage] if you know someone good with electronics ... definately worth a look i.e. check for bad caps )

or?

echo -n 0 > /proc/gpio/poe_passthrough
echo -n 0 > /proc/iproc-pse/enable ???

Ok, here is the lsmod capture:

UBNT-US.v4.0.18# lsmod
Module                  Size  Used by    Tainted: P  
linux_user_bde        103232  0 
linux_kernel_bde      122972  1 linux_user_bde
gpiodev                 9161  0 
ubnthal               820789  2 linux_kernel_bde,gpiodev
ubnt_common             2553  0

Quite short...

Will try ASAP. In a Zoom meeting now.

Here is the binwalk of the OEM current firmware. My "defective" unit is not running this same version. It's running a very old one, actually. This switch has failed on me about 2 years ago and I just recently found the time to see if it's still salvageable.

cesarvog@ubuntu:~/Unifi$ binwalk -e US.bcm5334x_5.43.34+12682.210318.0402.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Ubiquiti firmware header, header size: 264 bytes, ~CRC32: 0xA43D534C, version: "US.bcm5334x.v5.43.34+12682.210318.0402"
268           0x10C           Ubiquiti partition header, header size: 56 bytes, name: "PARTu-boot", base address: 0x1C000000, data size: 443926 bytes
281552        0x44BD0         CRC32 polynomial table, little endian
325488        0x4F770         gzip compressed data, maximum compression, from Unix, last modified: 2013-04-09 21:31:53
433824        0x69EA0         CRC32 polynomial table, little endian
444258        0x6C762         Ubiquiti partition header, header size: 56 bytes, name: "PARTkernel0", base address: 0x1C0E0000, data size: 15117696 bytes
444314        0x6C79A         uImage header, header size: 64 bytes, header CRC: 0x933AD13D, created: 2021-03-18 04:10:43, image size: 15117632 bytes, Data Address: 0x18000, Entry Point: 0x18000, data CRC: 0x36C962F9, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Ubiquiti 5.43.34.12682"
1559231       0x17CABF        Certificate in DER format (x509 v3), header length: 4, sequence length: 1284
1559351       0x17CB37        Certificate in DER format (x509 v3), header length: 4, sequence length: 1288
2433319       0x252127        Certificate in DER format (x509 v3), header length: 4, sequence length: 1292
2433323       0x25212B        Certificate in DER format (x509 v3), header length: 4, sequence length: 1316
2433327       0x25212F        Certificate in DER format (x509 v3), header length: 4, sequence length: 1320
2979916       0x2D784C        Linux kernel version 3.6.5
3451044       0x34A8A4        Unix path: /sys/bcm/mem
3451086       0x34A8CE        Unix path: /sys/bcm/mem
3451134       0x34A8FE        Unix path: /sys/bcm/mem
3516802       0x35A982        xz compressed data
3574391       0x368A77        Neighborly text, "NeighborSolicitsgrams"
3574408       0x368A88        Neighborly text, "NeighborAdvertisements"
3576758       0x3693B6        Neighborly text, "neighbor %.2x%.2x.%pM lostename link %s to %s"
3956394       0x3C5EAA        LZMA compressed data, properties: 0x6D, dictionary size: 1048576 bytes, uncompressed size: -1 bytes
15441370      0xEB9DDA        CRC32 polynomial table, little endian
15486258      0xEC4D32        Intel x86 or x64 microcode, sig 0x18012fff, pf_mask 0x00, 2000-18-01, size 2048
15496605      0xEC759D        LZMA compressed data, properties: 0xC0, dictionary size: 0 bytes, uncompressed size: 32 bytes
15562018      0xED7522        Signed Ubiquiti end header, RSA 2048 bit, header size: 264 bytes
1 Like
Please press Enter to activate this console. 
UBNT login: ubnt
Password: 


BusyBox v1.23.2 (2019-01-16 18:00:28 MST) built-in shell (ash)


  ___ ___      .__________.__
 |   |   |____ |__\_  ____/__|
 |   |   /    \|  ||  __) |  |   (c) 2010-2019
 |   |  |   |  \  ||  \   |  |   Ubiquiti Networks, Inc.
 |______|___|  /__||__/   |__|
            |_/                  https://www.ui.com/

      Welcome to UniFi USW-16P-150!

UBNT-US.v4.0.18# cat /proc/iproc-pse/enable
1 (0=off, 1=on)

Problem is, how to change it from 1 to 0, since the damn thing keeps rebooting and reading it's config back from the flash storage?

Just finished configuring my OpenWrt build environment. Currently awaiting make to finish. While I do not expect my first attempt to even boot, it's certainly a first step moving forward...

1 Like

one of the advantages of having a bootable initramfs... even with no networking... is you can get direct access to on-device flash / hardware without having to rip the board apart...

another thing you may wish to try... is in the normalOS... addingto/setting the uboot bootargs

init=/bin/bash #or /bin/sh or /bin/ash etc. etc.

this may get you a small shell so you can poke around a little... i.e.;

strings /sbin/init
strings $(cat /proc/mtd | grep EEPROM | cut -d' ' -f1)

Yeah, I'm yet to investigate more from the bootable initramfs shared by @clayface above.

https://community.ui.com/questions/ES-8-150W-uboot-recovery-options/aa3e58b5-18cc-4bf8-bd42-7ec1f16ce2cf

I used the information above to find out how to backup the flash storage directly by using a FlashcatUSB and a Pomona Clip. The last post got me thinking wether it would be possible to flash just a portion of the firmware. I have not investigated more, because my initial intent was only getting a backup of the current "defective" situation, and trying to restore the backup from a working switch, as already discussed above. But, may be a path moving forward....

Gee, this thing takes forever...

Yeah, my first attempt failed miserably with code 1:

    ERROR: target/linux failed to build.
make -r world: build failed. Please re-run make with -j1 V=s or V=sc for a higher verbosity level to see what's going on
make: *** [/home/cesarvog/openwrt/include/toplevel.mk:230: world] Error 1

Tried re-running with -J1 V=s and got so overwhelmed by the amount of scrolling text that decided to take a deep breath and get back to it sometime in the future. Not being a developer, I found most of the scrolling text totally gibberish.

On a side note, I found out that the D-LINK DGS1210 rev C1 carries VERY similar hardware as the US-8-150 and it's bigger siblings:

https://openwrt.org/toh/d-link/dgs-1210?s[]=bcm56150

Wikidevi seems to corroborate this information:

https://wikidevi.wi-cat.ru/D-Link_DGS-1210-24_rev_A1

I seem to remember that the same product is already supported by OpenWrt, albeit only for Revisions F1 and G1...

Found the link:
https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875

and
https://gitlab.com/bkoblitz/openwrt-rtl838x

Wondering if experienced developers would be able to take the .config from the DGS-1210 switch from the links above and somehow add support to BCM-Iproc... For now its WAY above my pay grade...

Tks for your input on this. I recently found out that the DLink DGS-1210-ME-B1-Series uses the same SOC. I was even able to download the GPL files of the above mentioned series, but it's way over my head. I cannot make much sense of its content because I lack the necessary knowledge to fully undestand what I see.
In case anyone is interested, here is the link: https://tsd.dlink.com.tw
From there, select DGS on the left dropdown and 1210/ME on the right dropdown. On the next page, scroll to the end to obtain the GPL Source Code of each particular model and firmware version.

Even though the OpenWrt initramfs file you provided earlier did boot in my US-16-150, as you predicted, it did not go much further as ethernet was not operational. Since my switch is "defective", I do not know if it's problems go beyond PoE, including the ethernet ports, or the image was lacking support for it. If you are still interested in taking your ES-8-150 into working condition with OpenWrt, maybe the above post will be of interest to you.
Best regards.

I have an US8-150W here with which we could test.

Can you sum up, what to do? And provide the image to test?

The US-8-150 does not have a console port, like it's bigger brothers. You will have to open your unit and find the serial connection. You may also need to solder pins to the connector, as the pins may be missing altogether. Once you have serial connection operational, boot your unit, and look for the u-boot prompt to press any key to interrupt loading the OEM kernel. From there, you will need to transfer the file provided by @clayface (on post #44 above) to the memory of your US-8-150. Once it's transferred, type 'bootm 0x1000000' (without the single quotes). if it does not boot, then try bootm 0x1008000, as I really don't quite remember the correct memory load address. The correct load address is shown many times above, you will need to read the posts after #44 to get the correct address.

That should be no problem. Do you have a picture with the GPIO Header configuration (TX / RX / GND / 3,3V)?

Sorry I do not

Just for reference, I started a new thread for the Unifi switch us-8-60w (OpenWrt Support for Unifi switch 8 (us-8-60w)). The us-8-60w is using a different SOC and has no SPF ports.
Did anybody here got any further ?