Add support to Unifi Switch - BCM53343

cesarvog · March 26, 2021, 5:09pm

Here is the output of the dmesg command from the "defective" switch, taken from the Linux command line right after the "defective" switch booted from it's default OS, and right before it rebooted from because of the PSE error. I don't know much about it, but looks to me that no error is found beside something the Ubiquiti programed to be verified during the INIT sequence. Sorry if this sounds confusing, English is not my native language.
I'm going to try to capture a lsmod output next. I'll have to try a few times, because there's a very short period of time after the PSE error is encountered in the INIT sequence, where I have to provide the username and password, and the command I wish to capture the output has to end, before the unit restarts automatically.

UBNT-US.v4.0.18# dmesg
[    0.000000] Booting Linux on physical CPU 0
[    0.000000] Linux version 3.6.5 (builder@owrt1505-us48p) (gcc version 4.7.2 (OpenWrt GCC 4.7.2 unknown) ) #1 SMP Wed Jan 16 18:09:43 MST 2019
[    0.000000] CPU: ARMv7 Processor [414fc091] revision 1 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine: Broadcom iProc
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] BUG: mapping for 0x18000000 at 0xf0000000 out of vmalloc space
[    0.000000] BUG: mapping for 0x19000000 at 0xf1000000 out of vmalloc space
[    0.000000] On node 0 totalpages: 65536
[    0.000000] free_area_init_node: node 0, pgdat c0e8d040, node_mem_map c0ebe000
[    0.000000]   Normal zone: 256 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32512 pages, LIFO batch:7
[    0.000000]   HighMem zone: 3328 pages used for memmap
[    0.000000]   HighMem zone: 29440 pages, LIFO batch:7
[    0.000000] smp_init_cpus: Enter ncores 1
[    0.000000] smp_init_cpus: Leave ncores 1
[    0.000000] PERCPU: Embedded 7 pages/cpu @c1cc7000 s6272 r8192 d14208 u32768
[    0.000000] pcpu-alloc: s6272 r8192 d14208 u32768 alloc=8*4096
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 61952
[    0.000000] Kernel command line: console=ttyS0,115200 mem=128M@0x0 mem=128M@0x68000000 mtdparts=spi1.0:768k(u-boot),64k(u-boot-env),64k(shmoo),15360k(kernel0),15424k(kernel1),1024k(cfg),64k(EEPROM) ubntbootid=0 ubootver=usw-v1.1.4.115-g14af1ee6
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 128MB 128MB = 256MB total
[    0.000000] Memory: 244896k/244896k available, 17248k reserved, 131072K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xc8800000 - 0xf0000000   ( 632 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc8000000   ( 128 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0018000 - 0xc034d7f0   (3286 kB)
[    0.000000]       .init : 0xc034e000 - 0xc0e64880   (11355 kB)
[    0.000000]       .data : 0xc0e66000 - 0xc0e8ed40   ( 164 kB)
[    0.000000]        .bss : 0xc0e8ed64 - 0xc0ebd354   ( 186 kB)
[    0.000000] SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000]  RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=1.
[    0.000000] NR_IRQS:292
[    0.000000] Clock Div = 0x2012
[    0.000000] Active frequency ID 6
[    0.000000] a9pll0_status: clk 0xc0e7c0f8
[    0.000000] parent rate 25000000
[    0.000000] Clock divisor 4
[    0.000000] Clock rate 400000005
[    0.000000] Clock Div = 0x2012
[    0.000000] Active frequency ID 6
[    0.000000] Clock divisor 2
[    0.000000] Clock rate 200000002
[    0.000000] iproc_clocksource_init: CPU global timer freq 200000002
[    0.000000] cpu_clk_freq: 200000002
[    0.000000] HZ: 100, ticks_per_jiffy: 2000000
[    0.000000] sched_clock: 32 bits at 100 Hz, resolution 10000000ns, wraps every 4294967286ms
[    0.010000] Calibrating delay loop... 795.44 BogoMIPS (lpj=3977216)
[    0.050000] pid_max: default: 4096 minimum: 301
[    0.050000] Mount-cache hash table entries: 512
[    0.050000] CPU: Testing write buffer coherency: ok
[    0.050000] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.050000] Setting up static identity map for 0x282250 - 0x2822a8
[    0.050000] L310 cache controller enabled
[    0.050000] l2x0: 8 ways, CACHE_ID 0x410000c9, AUX_CTRL 0x0a120000, Cache size: 131072 B
[    0.050000] Brought up 1 CPUs
[    0.050000] SMP: Total of 1 processors activated (795.44 BogoMIPS).
[    0.050000] devtmpfs: initialized
[    0.060000] NET: Registered protocol family 16
[    0.060000] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.060000] board_init: Enter
[    0.060000] GENPLL[5] mdiv=40 rate=2000000000
[    0.060000] Sel=1 Ovr=1 Div=48
[    0.060000] UART clock rate 50000000
[    0.060000] board_init: Leave
[    0.080000] bio: create slab <bio-0> at 0
[    0.080000] Bluetooth: Core ver 2.16
[    0.080000] NET: Registered protocol family 31
[    0.080000] Bluetooth: HCI device and connection manager initialized
[    0.080000] Bluetooth: HCI socket layer initialized
[    0.080000] Bluetooth: L2CAP socket layer initialized
[    0.080000] Bluetooth: SCO socket layer initialized
[    0.080000] Switching to clocksource iproc_gtimer
[    0.090000] NET: Registered protocol family 2
[    0.090000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.090000] TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
[    0.090000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.090000] TCP: reno registered
[    0.090000] UDP hash table entries: 128 (order: 0, 4096 bytes)
[    0.090000] UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
[    0.090000] NET: Registered protocol family 1
[    0.090000] PCI: CLS 0 bytes, default 64
[   14.570000] pm_init: Initializing Power Management ....
[   14.570000] iproc gpiochip add GPIOA
[   14.570000] GPIOA:ioaddr f0000060 
[   14.570000] GPIOA:intr_ioaddr f0000000 dmu_ioaddr   (null)
[   14.820000] PCIE0: LINKSTA reg 0xbe val 0x1001
[   14.820000] reg[0xac]=0x10, reg[0xae]=0x42, reg[0xb0]=0x8000, reg[0xb4]=0x2c10, reg[0xb6]=0x10, reg[0xb8]=0x5c12, reg[0xba]=0x65, reg[0xbe]=0x1001, reg[0xc6]=0x40, reg[0xca]=0x1, reg[0xd0]=0x1f, reg[0xd2]=0x8, reg[0xdc]=0x2, PCIE0 link=0
[   15.170000] PCIe port 1 in End-Point mode - ignored
[   15.170000] Registering iproc_pmu_device
[   15.170000] bounce pool size: 64 pages
[   15.190000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[   15.190000] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[   15.190000] msgmni has been set to 222
[   15.190000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[   15.190000] io scheduler noop registered
[   15.190000] io scheduler deadline registered (default)
[   15.190000] io scheduler cfq registered
[   15.190000] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
[   15.200000] serial8250.0: ttyS0 at MMIO 0x18000400 (irq = 123) is a 16550A
[   15.670000] console [ttyS0] enabled
[   15.680000] serial8250.0: ttyS1 at MMIO 0x18000300 (irq = 123) is a 16550A
[   15.710000] brd: module loaded
[   15.720000] loop: module loaded
[   15.730000] nbd: registered device at major 43
[   15.750000] tun: Universal TUN/TAP device driver, 1.6
[   15.760000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[   15.760000] Bluetooth: HCI UART driver ver 2.2
[   15.770000] Bluetooth: HCI H4 protocol initialized
[   15.770000] Bluetooth: HCI BCSP protocol initialized
[   15.780000] TCP: cubic registered
[   15.780000] NET: Registered protocol family 10
[   15.790000] sit: IPv6 over IPv4 tunneling driver
[   15.800000] NET: Registered protocol family 17
[   15.800000] Bluetooth: RFCOMM TTY layer initialized
[   15.810000] Bluetooth: RFCOMM socket layer initialized
[   15.810000] Bluetooth: RFCOMM ver 1.11
[   15.820000] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   15.820000] Bluetooth: BNEP filters: protocol multicast
[   15.830000] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[   15.830000] 8021q: 802.1Q VLAN Support v1.8
[   15.840000] GENPLL[5] mdiv=40 rate=2000000000
[   15.840000] qspi_iproc qspi_iproc.1: 1-lane output, 3-byte address
[   15.850000] m25p80 spi1.0: found mx25l25635e, expected m25p80
[   15.860000] m25p80 spi1.0: mx25l25635e (32768 Kbytes)
[   15.860000] 7 cmdlinepart partitions found on MTD device spi1.0
[   15.870000] Creating 7 MTD partitions on "spi1.0":
[   15.870000] 0x000000000000-0x0000000c0000 : "u-boot"
[   15.880000] 0x0000000c0000-0x0000000d0000 : "u-boot-env"
[   15.890000] 0x0000000d0000-0x0000000e0000 : "shmoo"
[   15.890000] 0x0000000e0000-0x000000fe0000 : "kernel0"
[   15.900000] 0x000000fe0000-0x000001ef0000 : "kernel1"
[   15.910000] 0x000001ef0000-0x000001ff0000 : "cfg"
[   15.920000] 0x000001ff0000-0x000002000000 : "EEPROM"
[   15.920000] creating /proc/iproc-pse
[   15.920000]          /proc/iproc-pse/enable
[   15.950000] Freeing init memory: 11352K
[   15.990000] ubnt_common: module license 'Proprietary' taints kernel.
[   15.990000] Disabling lock debugging due to kernel taint
[   16.070000] creating procfs for ubnthal
[   16.070000] creating proc entry for system.info
[   16.070000] creating proc entry for board
[   16.070000] creating procfs for status
[   16.070000] creating proc entry for IsDefault
[   16.070000] creating proc entry for IsLocated
[   16.070000] creating proc entry for IsIsolated
[   16.080000] gpiodev: reset_timeout=3
[   16.090000] creating /proc/gpio/
[   16.090000]          /proc/gpio/ledbar_control
[   16.090000]          /proc/gpio/led_pattern
[   16.090000]          /proc/gpio/led_tempo
[   16.090000]          /proc/gpio/poe_passthrough
[   16.090000]          /proc/gpio/resetbtn
[   16.090000]          /proc/gpio/resetbtn_age
[   16.340000] Ubiquiti: system 0xeb21 revision 7

anon50098793 · March 26, 2021, 5:16pm

long-shot-disable-panic-probably-no-use

you might try ( note: panic=0 ) at uboot prompt before loady... ( on the OEM OS )

setenv bootargs 'bootargs=console=ttyS0,115200 mem=128M@0x0 mem=128M@0x68000000 mtdparts=spi1.0:768k(u-boot),64k(u-boot-env),64k(shmoo),15360k(kernel0),15424k(kernel1),1024k(cfg),64k(EEPROM) panic=0'

( do NOT type saveenv this way you can just reboot it you stuff up the variable)
( use 'printenv' after you set the above line to make sure it worked )

( with openwrt... bootloader command line options are sometimes ignored anyway -> needs changing the dts ... but it will say ignored usually with the OEM firmware i'm not sure how it behaves or even if it's a panic ( more likely some sort of watchdog or other logic ) ... but worth trying )

actually

the above looks interesting... wonder if it's in /sys or /proc or other... setting it to 3000 may just give you some time?

here is the full 'section' from some random online log... ( does have '3' tho' )

<10> Jan  1 03:00:41 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(5128) 27 %% PSE init failed 0x003f, retry 1

<10> Jan  1 03:00:44 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(5128) 80 %% PSE init failed 0x003f, retry 2

<10> Jan  1 03:00:46 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(5128) 81 %% PSE init failed 0x003f, retry 3

<10> Jan  1 03:00:46 UBNT UBNT_POE[Cnfgr_Thread ]: ubnt_poe_common.c(3955) 82 %% PoE Initialization failed in Hardware

cnfgrApiCallback: Failed by component 171 - UBNT_POE
task 0x33d57ac - Cnfgr_Thread
Cnfgr current state 150 - UNKNOWN
Cnfgr next state 150 - UNKNOWN
The system is restarting due to the inconsistent state 171 in file: cnfgr_tally.c line 233

wonder what's with the 27% > 81% stuff? ( wonder if a 50v2200uF near the POE chips / regulators might do anything... ? it's definately consistent with the failure mode [time!damage] if you know someone good with electronics ... definately worth a look i.e. check for bad caps )

or?

echo -n 0 > /proc/gpio/poe_passthrough
echo -n 0 > /proc/iproc-pse/enable ???

cesarvog · March 26, 2021, 5:32pm

Ok, here is the lsmod capture:

UBNT-US.v4.0.18# lsmod
Module                  Size  Used by    Tainted: P  
linux_user_bde        103232  0 
linux_kernel_bde      122972  1 linux_user_bde
gpiodev                 9161  0 
ubnthal               820789  2 linux_kernel_bde,gpiodev
ubnt_common             2553  0

Quite short...

cesarvog · March 26, 2021, 5:35pm

Will try ASAP. In a Zoom meeting now.

cesarvog · March 26, 2021, 9:00pm

Here is the binwalk of the OEM current firmware. My "defective" unit is not running this same version. It's running a very old one, actually. This switch has failed on me about 2 years ago and I just recently found the time to see if it's still salvageable.

cesarvog@ubuntu:~/Unifi$ binwalk -e US.bcm5334x_5.43.34+12682.210318.0402.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Ubiquiti firmware header, header size: 264 bytes, ~CRC32: 0xA43D534C, version: "US.bcm5334x.v5.43.34+12682.210318.0402"
268           0x10C           Ubiquiti partition header, header size: 56 bytes, name: "PARTu-boot", base address: 0x1C000000, data size: 443926 bytes
281552        0x44BD0         CRC32 polynomial table, little endian
325488        0x4F770         gzip compressed data, maximum compression, from Unix, last modified: 2013-04-09 21:31:53
433824        0x69EA0         CRC32 polynomial table, little endian
444258        0x6C762         Ubiquiti partition header, header size: 56 bytes, name: "PARTkernel0", base address: 0x1C0E0000, data size: 15117696 bytes
444314        0x6C79A         uImage header, header size: 64 bytes, header CRC: 0x933AD13D, created: 2021-03-18 04:10:43, image size: 15117632 bytes, Data Address: 0x18000, Entry Point: 0x18000, data CRC: 0x36C962F9, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Ubiquiti 5.43.34.12682"
1559231       0x17CABF        Certificate in DER format (x509 v3), header length: 4, sequence length: 1284
1559351       0x17CB37        Certificate in DER format (x509 v3), header length: 4, sequence length: 1288
2433319       0x252127        Certificate in DER format (x509 v3), header length: 4, sequence length: 1292
2433323       0x25212B        Certificate in DER format (x509 v3), header length: 4, sequence length: 1316
2433327       0x25212F        Certificate in DER format (x509 v3), header length: 4, sequence length: 1320
2979916       0x2D784C        Linux kernel version 3.6.5
3451044       0x34A8A4        Unix path: /sys/bcm/mem
3451086       0x34A8CE        Unix path: /sys/bcm/mem
3451134       0x34A8FE        Unix path: /sys/bcm/mem
3516802       0x35A982        xz compressed data
3574391       0x368A77        Neighborly text, "NeighborSolicitsgrams"
3574408       0x368A88        Neighborly text, "NeighborAdvertisements"
3576758       0x3693B6        Neighborly text, "neighbor %.2x%.2x.%pM lostename link %s to %s"
3956394       0x3C5EAA        LZMA compressed data, properties: 0x6D, dictionary size: 1048576 bytes, uncompressed size: -1 bytes
15441370      0xEB9DDA        CRC32 polynomial table, little endian
15486258      0xEC4D32        Intel x86 or x64 microcode, sig 0x18012fff, pf_mask 0x00, 2000-18-01, size 2048
15496605      0xEC759D        LZMA compressed data, properties: 0xC0, dictionary size: 0 bytes, uncompressed size: 32 bytes
15562018      0xED7522        Signed Ubiquiti end header, RSA 2048 bit, header size: 264 bytes

cesarvog · March 26, 2021, 10:00pm

Please press Enter to activate this console. 
UBNT login: ubnt
Password: 


BusyBox v1.23.2 (2019-01-16 18:00:28 MST) built-in shell (ash)


  ___ ___      .__________.__
 |   |   |____ |__\_  ____/__|
 |   |   /    \|  ||  __) |  |   (c) 2010-2019
 |   |  |   |  \  ||  \   |  |   Ubiquiti Networks, Inc.
 |______|___|  /__||__/   |__|
            |_/                  https://www.ui.com/

      Welcome to UniFi USW-16P-150!

UBNT-US.v4.0.18# cat /proc/iproc-pse/enable
1 (0=off, 1=on)

Problem is, how to change it from 1 to 0, since the damn thing keeps rebooting and reading it's config back from the flash storage?

cesarvog · March 27, 2021, 7:39pm

Just finished configuring my OpenWrt build environment. Currently awaiting make to finish. While I do not expect my first attempt to even boot, it's certainly a first step moving forward...

anon50098793 · March 27, 2021, 7:49pm

one of the advantages of having a bootable initramfs... even with no networking... is you can get direct access to on-device flash / hardware without having to rip the board apart...

another thing you may wish to try... is in the normalOS... addingto/setting the uboot bootargs

init=/bin/bash #or /bin/sh or /bin/ash etc. etc.

this may get you a small shell so you can poke around a little... i.e.;

strings /sbin/init
strings $(cat /proc/mtd | grep EEPROM | cut -d' ' -f1)

cesarvog · March 27, 2021, 8:16pm

Yeah, I'm yet to investigate more from the bootable initramfs shared by @clayface above.

https://community.ui.com/questions/ES-8-150W-uboot-recovery-options/aa3e58b5-18cc-4bf8-bd42-7ec1f16ce2cf

I used the information above to find out how to backup the flash storage directly by using a FlashcatUSB and a Pomona Clip. The last post got me thinking wether it would be possible to flash just a portion of the firmware. I have not investigated more, because my initial intent was only getting a backup of the current "defective" situation, and trying to restore the backup from a working switch, as already discussed above. But, may be a path moving forward....

cesarvog · March 27, 2021, 9:17pm

Gee, this thing takes forever...

cesarvog · March 28, 2021, 6:23pm

Yeah, my first attempt failed miserably with code 1:

    ERROR: target/linux failed to build.
make -r world: build failed. Please re-run make with -j1 V=s or V=sc for a higher verbosity level to see what's going on
make: *** [/home/cesarvog/openwrt/include/toplevel.mk:230: world] Error 1

Tried re-running with -J1 V=s and got so overwhelmed by the amount of scrolling text that decided to take a deep breath and get back to it sometime in the future. Not being a developer, I found most of the scrolling text totally gibberish.

On a side note, I found out that the D-LINK DGS1210 rev C1 carries VERY similar hardware as the US-8-150 and it's bigger siblings:

https://openwrt.org/toh/d-link/dgs-1210?s[]=bcm56150

Wikidevi seems to corroborate this information:

https://wikidevi.wi-cat.ru/D-Link_DGS-1210-24_rev_A1

I seem to remember that the same product is already supported by OpenWrt, albeit only for Revisions F1 and G1...

Found the link:
https://forum.openwrt.org/t/support-for-rtl838x-based-managed-switches/57875

and
https://gitlab.com/bkoblitz/openwrt-rtl838x

Wondering if experienced developers would be able to take the .config from the DGS-1210 switch from the links above and somehow add support to BCM-Iproc... For now its WAY above my pay grade...

cesarvog · April 24, 2021, 10:45pm

Tks for your input on this. I recently found out that the DLink DGS-1210-ME-B1-Series uses the same SOC. I was even able to download the GPL files of the above mentioned series, but it's way over my head. I cannot make much sense of its content because I lack the necessary knowledge to fully undestand what I see.
In case anyone is interested, here is the link: https://tsd.dlink.com.tw
From there, select DGS on the left dropdown and 1210/ME on the right dropdown. On the next page, scroll to the end to obtain the GPL Source Code of each particular model and firmware version.

cesarvog · April 25, 2021, 12:56pm

Even though the OpenWrt initramfs file you provided earlier did boot in my US-16-150, as you predicted, it did not go much further as ethernet was not operational. Since my switch is "defective", I do not know if it's problems go beyond PoE, including the ethernet ports, or the image was lacking support for it. If you are still interested in taking your ES-8-150 into working condition with OpenWrt, maybe the above post will be of interest to you.
Best regards.

MPW · May 27, 2021, 12:48am

I have an US8-150W here with which we could test.

Can you sum up, what to do? And provide the image to test?

cesarvog · May 27, 2021, 12:27pm

The US-8-150 does not have a console port, like it's bigger brothers. You will have to open your unit and find the serial connection. You may also need to solder pins to the connector, as the pins may be missing altogether. Once you have serial connection operational, boot your unit, and look for the u-boot prompt to press any key to interrupt loading the OEM kernel. From there, you will need to transfer the file provided by @clayface (on post #44 above) to the memory of your US-8-150. Once it's transferred, type 'bootm 0x1000000' (without the single quotes). if it does not boot, then try bootm 0x1008000, as I really don't quite remember the correct memory load address. The correct load address is shown many times above, you will need to read the posts after #44 to get the correct address.

MPW · May 27, 2021, 12:39pm

That should be no problem. Do you have a picture with the GPIO Header configuration (TX / RX / GND / 3,3V)?

cesarvog · May 27, 2021, 1:35pm

Sorry I do not

potl · November 25, 2021, 1:38pm

Just for reference, I started a new thread for the Unifi switch us-8-60w (OpenWrt Support for Unifi switch 8 (us-8-60w)). The us-8-60w is using a different SOC and has no SPF ports.
Did anybody here got any further ?

MPW · December 29, 2021, 7:53pm

Hello @cesarvog,

I finally found the time to look into this.

This is about: US8-150W

There are pins on the header. Connections works with

sudo screen /dev/ttyUSB0 115200,cs8

~~Unfortunately I can't type anything. Maybe the RX is not correctly wired on the board.~~

Never mind, we didn't connect the cable correctly.

(Picture is WTFPL in case someone needs it)

Here a full bootlog:

U-Boot usw-v1.1.4.115-g14af1ee6 (Feb 14 2017 - 18:50:54)

DEV ID= 0000db56
SKU ID = 0x8Validate Shmoo parameters stored in flash ..... OK
Press Ctrl-C to run Shmoo ..... RAM:  256 MiB                                                                                                                                                             0 
Verifying 'kernel0' parition:OK
## Booting kernel from Legacy Image at 01000000 ...
   Image: console=ttyS0,115200 mem=128M@0x0 mem=128M@0x68000000 mtdpartux on physical CPU 0
[    0.000000] Linux version 3.6.5 (builde   0.000000] BUG: mapping for 0x18000000 at 0xf0000000 out of vmalloc space
[    0.000000] BUG: mapping for 0x10:768k(u-boot),64k(u-boot-env),64k(shmoo),15360k(kernel0),15424kntries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cacheghmem
[    0.000000] Virtual kernel memory layout:
[    0.0000896 kB)
[    0.000000]     vmalloc : 0xc8800000 - 0xf0000000   0e41880   (11215 kB)
[    0.000000]       .data : 0xc0e42000 - 0xc0e6ad40   ( 164 kB)
[    0.000000]        .b000000] NR_IRQS:292
[    0.000000] sched_clock: 32 bits at 100 ting up static identity map for 0x282350 - 0x2823a8
[    0.0500 SMP: Total of 1 processors activated (795.44 BogoMIPS).
[    00000] UART clock rate 50000000
[    0.080000] bio: create slab .080000] Bluetooth: HCI device and connection manager initialized protocol family 2
[    0.090000] TCP established hash table ed 4096)
[    0.090000] TCP: reno registered
[    0.090000] UDP0000] GPIOA:intr_ioaddr f0000000 dmu_ioaddr   (n620000] reg[0xac]=0x10, reg[0xae]=0x42, reg[0xb0]=0x8000, reg[0xeg[0xd2]=0x8, reg[0xdc]=0x2, PCIE0 link=0
[   14.970000] PCIe pllip Lougher
[   14.990000] jffs2: version 2.2. (NAND) © 2001-erial8250.0: ttyS0 at MMIO 0x18000400 (irq = 1230000] serial8250.0: ttyS1 at MMIO 0x18000300 (irq = 123) is a 16[   15.500000] brd: module loaded
[   15.520000] loop: module loaded
[   15.530000] nbd: register[   15.550000] tun: Universal TUN/TAP device driver, 1.6
[   15 15.590000] sit: IPv6 over IPv4 tunneling driver
[   15.600000]00] Bluetooth: RFCOMM TTY layer initialized
[   15.610000] Blue[   15.640000] GENPLL[5] mdiv=40 rate=2000000000
[   15.640000]address
[   15.650000] m25p80 spi1.0: found mx25l25635e, expect000] 0x0000000d0000-0x0000000e0000 : "shmoo"
[   15.690000] 0x000000] 0x000000fe0000-0x000001ef0000 : "kernel1"
[   15.710000][   15.890000] Data abort at addr=0xc8a10224, fsr=0x1406 ignored.
Validating the backup image /dev/mtd4..."4.0.54.10625"
DMA pool size: 4194304
150_A0
ait ...

Applying Interface configuration, please wait ...
[   55.200000] device eth0 entered promiscuous mode

Unfortunately I can't type anything. Any suggestions?

Best,
Matthias

/edit: @cesarvog, how did you exactly manipulate the image to make it boot? We managed to copy it into the router, but it freezes after the go command.

We used this file (Add support to Unifi Switch - BCM53343 - #44 by clayface) and tried all go and bootm commands we found here. No success.

cesarvog · December 30, 2021, 5:22pm

I'm sorry, but I think your kit uses a totally different SOC than the USW-8-PoE my investigation was about, so, if I'm right, the BCMxxxxx image won't ever work on your kit.
If memory serves me well, I seem to have read somewhere around this very forum that the newer gen. Ubiquiti switches are built around Realtek SOCs. I may be wrong and your particular model may indeed be based on the same SOC as mine (USW-8-PoE), but this is the best guess I can come out with now.
Regarding the input not working, your edit seem to indicate that you somehow was able to fix that, if so, for the benefit of the community, do you mind posting here which particular set of keys were used to stop the boot process?