Linksys EG008W switch repair

I've had a Linksys EG008W Gigabit ethernet switch for some time now, and other than a noisy fan and no jumbo frames it has worked pretty well over the last seven years or so. It comes in a case that's rather definitive for Linksys.

Sadly, in the last few days it has started acting up in the form of random resets. It's now got to the point where it's spending more time in reset than switching, which makes it rather useless unless you want a notwork. So, now's a good time to tear it apart!

Once you've popped the front off, and slid the top half of the casing away, you'll be able to get to the insides.

Once you open the device up and remove the fan assembly, you discover the power supply section (Taking 12v down to 5v and 3.3v), a Broadcom BCM5388, a Broadcom BCM 5464, an Atmel 93C64 EEPROM and the magnetics for the gigabit ports. The BCM5388 is the switch fabric and has 8 MACs, and 4 PHYs.  At a basic level this means this chip provides the switching functions and 4 of the 8 gigabit ethernet ports. The BCM5464 provides the physical layer for the other 4 ports, by providing 4 RGMII interfaces. A quick diagram will probably help make sense of things, so the following is effectively the block diagram for the BCM5388 chip:

The 93C64 EEPROM contains the configuration settings for the switch controller, arranged as 64 16bit words. In theory, it should be possible to remove the EEPROM, change the configuration pins and have an external device configure the switch controller. I understand that the switch controller is similar to those used in other Broadcom SoCs used in home routers, so in theory it should be possible to co-opt the driver (roboswitch) and reuse it to configure the device. None of this is tried, as I don't know what pins set the switch controller to act as an SPI slave, instead of a master! Sadly, this means that QoS, VLANs, jumbo frames, port trunking, rate control and port mirroring features on the BCM5388 are all non-functional.
While I'm examining the board when it's powered up, I note that when I brushed over one of the chips with a finger, the board immediate reset itself. Repeating this, but with a bit more force causes the power light to extinguish, leading me to wonder if the fault is with the onboard power supply. The switcher in question is a RT9206 which is a buck converter with two linear controllers.

Taking a look over the board, I don't see any obvious damage, such as overheated tracks or failed capacitors. Just to ensure that things are happening how I think they should, I gently probe the high and low mosfet drives at R278 and R276 on the picture, and find a reasonable looking waveform with a duty cycle that's not static - not surprising given that each time it resets, it lights all the LEDs. Probing the capacitors that make up part of the output filters, and it becomes clear what's going on! (Note this is a simulation sadly - I failed to capture the original trace, but it's broadly similar.)

The two capacitors above the coil have degraded to the point that they're not able to maintain sufficient charge, hence the rather interesting waveform as the high and low switches open and close. Fortunately it's fairly easy to remove the two capacitors and replace them with something suitable. The device works fine now! It does make me wonder about the other output capacitors on the other switcher internally, but they don't seem to have excessive ripple. At least the switch works now!