EXPIRED Mellanox SX6036 36ports QSFP €150

dcmist

New Member
Nov 15, 2020
1
0
1
Took way longer to get the SX6036 to the latest firmware than it did to get the ethernet license. Thanks to a couple folks that helped point me the right direction.

I did NOT need the conversion so simply needed to create the dummy license, watch the call via ltrace, grab the shared secret, and create the key. Will keep the ubuntu VM around that I used for this in case someone else needs assistance.
Would you be able to point me in the right direction on this?
Thank you.
 

cyrus104

New Member
Aug 13, 2020
22
1
3
Quick question for those that have this switch with ethernet enabled.

I have a 10 gbps SFP DAC connected via a QSA adapter and auto negotiate doesn't work. The switch pulls all of the information from the SFP and knows it's a 10gbps DAC but the link stays down until I manually change it to 10gbps (in web interface or cli). I have confirmed that the auto-negotiate checkbox is checked so I'm not sure if it's a limitation of the switch or something is wrong.
 

i386

Well-Known Member
Mar 18, 2016
2,574
726
113
32
Germany
I had no problems with sfp+ dac cables connected to the switch with (hp branded) qsa adapters.
 

cyrus104

New Member
Aug 13, 2020
22
1
3
Hmm, ok. I'm using ipolex SFP+ DACs and those are not auto negotiating. I might try and buy some other DACs but wanted to see if anyone else is having that issue.

Also anybody know if it's possible and how to modify the SFP+ firmware?
 

grepler

New Member
Jun 19, 2018
4
3
3
I have two SX6036G switches I bought second-hand, but they came with their old configurations and I can't get the old passwords. I have tried the fifteen-second reset button approach without success (looking at the console, it simply reboots the device). I have also tried to enter the boot manager but there is a password there as well, so I cannot initiate a reset via the console.
Is there any other approach I can take, either to flash a new OS with factory defaults or to forcibly reset the device? Happy to open the chassis and poke around if necessary. @cw823 any chance you can lend a helping hand?

1608654114643.png
 
Last edited:

Veers

New Member
Dec 20, 2020
2
0
1
I finally found that I can use the xmladmin/xmladmin account to login. This one was reset with the 15 second push on reset button. Whit this account, I can change the admin password. Thank you for your reply!
 

kaz

New Member
Nov 21, 2020
14
5
3
San Jose, CA, USA
I have two SX6036G switches I bought second-hand, but they came with their old configurations and I can't get the old passwords. I have tried the fifteen-second reset button approach without success (looking at the console, it simply reboots the device). I have also tried to enter the boot manager but there is a password there as well, so I cannot initiate a reset via the console.
I had experienced the same issue with SX6036F last month. For my case, it looks that 15 seconds were not enough.
After struggling for a couple of days, I could reset the admin password by pushing the reset button for a couple of minutes patiently.
 

grepler

New Member
Jun 19, 2018
4
3
3
I finally found that I can use the xmladmin/xmladmin account to login. This one was reset with the 15 second push on reset button. Whit this account, I can change the admin password. Thank you for your reply!
I whooped with joy when I was able to login using xmladmin on the switch. Thank you @Veers! Very helpful.


I had experienced the same issue with SX6036F last month. For my case, it looks that 15 seconds were not enough.
After struggling for a couple of days, I could reset the admin password by pushing the reset button for a couple of minutes patiently.
I then put on a podcast, opened a tty console and held down the reset button. about three minutes later I saw in the console that the admin password reset was successful (see screenshot).
1608655810319.png

I continued to hold the button while the switch finished booting (another four minutes) and was able to sign into the admin account without a password prompt. Only then did I release the reset button, which prompted another restart. 7 minutes later I am able to login using admin, no password prompt.

1608656407654.png

I love this forum. Thanks again @kaz and @Veers for your quick responses! I've done a longer-form response with screenshots so the next poor soul can benefit.
 
  • Like
Reactions: klui, cw823 and kaz

AmusedGoose

New Member
Mar 16, 2019
23
12
3
Has anyone found a solution to the very slow response time / very high CPU utilization in newer OS versions? I'm thinking to revert back to 3.6.5009 or something to alleviate the problem, on 3.6.3004 my CPU utilization was 1-2%, on 3.6.8012 it is constantly 100% (tested more than 1 switch).

Edit: CPU utilization stays high for a long time after upgrading but gradually lowers to an average of ~20% on 3.6.8012 (vs. ~15% on 3.6.3004). The biggest difference comes from enabling ETH upon further inspection, with infiniband it is about 10% on recent versions, around 5% on 3.6.5000 or older.

Edit2: One of my switches responds much slower due to its CPU utilization being near 100%, even after being online for a couple of days..

Edit3: Problem resolved after another factory reset. I had reset prior to upgrading. (in CLI-> 'enable' -> 'config t' -> 'reset factory' -> 'YES')
 
Last edited:

NablaSquaredG

Active Member
Aug 17, 2020
321
120
43
One thing to keep in mind:
The price includes 0% VAT.
If you are NOT a company with valid VAT number of EU-member
(example valid VAT ID: DE999999999)
you must pay additional 23% VAT
 

gmuehl

New Member
Jan 30, 2021
4
2
3
Hi, I bought one from that seller and did not pay the 23%. Just don't mention that you are not a company. Moreover, buyers from outside the EU never have to pay that kind of tax, but import tax.

Cheers
 
  • Like
Reactions: rootpeer

crash_maxed

New Member
Oct 30, 2019
3
13
3
This thread has had a load of useful hints and information that has assisted me with both my EMC OS (now cross-flashed) SX6018 and my native MLNX-OS SX6036. If anyone comes across this and wanted bash CLI access and hasn't figured it out yet here's a guide.

First off get your switch flashed up to the latest version. We'll need to clear the U-Boot password and there's some minimum version required, apparently somewhere around 3.6.6003. Clear the U-Boot password per https://forums.servethehome.com/index.php?threads/mellanox-sx6012-help.9628/#post-192305.

Code:
enable
configure terminal
boot bootmgr password 7 ""
write memory
show bootvar
Using the CLI or the web interface, create a new administrative user that will have bash CLI access. I suppose you could use the existing admin or xmladmin accounts, but I am making a dedicated account.

mlnxos_adduser.png

Next up we need to boot into the manufacturing OS using the files and instructions from https://forums.servethehome.com/ind...anox-sx6xxx-on-ebay.10786/page-42#post-287938 and https://forums.servethehome.com/ind...-as-mellanox-sx6xxx-on-ebay.10786/post-288220. I used a CentOS Linux VM for my TFTP server. All of my stuff was in /var/lib/tftpboot/mlnx460ex/.

Code:
-rw-rw-r--. 1 1561 101       598 Mar  6  2012 checksum
lrwxrwxrwx. 1 1561 101        30 Mar  6  2012 fdt -> fdt-PPC_M460EX-SX_3.2.0100.img
-rw-r--r--. 1 1561 101      9230 Mar  6  2012 fdt-PPC_M460EX-SX_3.2.0100.img
lrwxrwxrwx. 1 1561 101        32 Mar  6  2012 image.img -> image-PPC_M460EX-SX_3.2.0100.img
-rw-r--r--. 1 1561 101 205968387 Mar  6  2012 image-PPC_M460EX-SX_3.2.0100.img
-rw-r--r--. 1 1561 101 211653024 Mar  6  2012 mfgusb-SX_PPC_M460EX-ppc-m460ex-20120306-222353.zip
-rw-r--r--. 1 1561 101   6015702 Mar  6  2012 rootflop-SX_PPC_M460EX-ppc-m460ex-20120306-222353.img
lrwxrwxrwx. 1 1561 101        33 Mar  6  2012 rootfs -> rootfs-PPC_M460EX-SX_3.2.0100.img
-rw-r--r--. 1 1561 101   6015766 Mar  6  2012 rootfs-PPC_M460EX-SX_3.2.0100.img
lrwxrwxrwx. 1 1561 101        33 Mar  6  2012 u-boot.bin -> u-boot-PPC_M460EX-SX_3.2.0100.bin
-rw-r--r--. 1 1561 101    393216 Mar  6  2012 u-boot-PPC_M460EX-SX_3.2.0100.bin
lrwxrwxrwx. 1 1561 101        34 Mar  6  2012 vmlinuz -> vmlinuz-PPC_M460EX-SX_3.2.0100.img
-rw-r--r--. 1 1561 101   1862752 Mar  6  2012 vmlinuz-PPC_M460EX-SX_3.2.0100.img
A few environment variables need to be set to increase the ramdisk size and set the target TFTP server, 10.10.2.51 in my case.

Code:
U-Boot 2009.01 SX_PPC_M460EX SX_3.2.0330-82 ppc (Dec 20 2012 - 17:53:54)

CPU:   AMCC PowerPC 460EX Rev. B at 1000 MHz (PLB=166, OPB=83, EBC=83 MHz)
       Security/Kasumi support
       Bootstrap Option H - Boot ROM Location I2C (Addr 0x52)
       Internal PCI arbiter disabled
       32 kB I-Cache 32 kB D-Cache
Board: Mellanox PPC460EX Board
FDEF:  No
I2C:   ready
DRAM:   2 GB (ECC enabled, 333 MHz, CL3)
FLASH: 16 MB
NAND:  1024 MiB
PCI:   Bus Dev VenId DevId Class Int
PCIE0: link is not up.
PCIE1: successfully set as root-complex
        01  00  15b3  c738  0c06  00
Net:   ppc_4xx_eth0, ppc_4xx_eth1
Reading image settings from EEPROM

Mellanox MLNX-OS

Default image: 'PPC_M460EX 3.6.8012 2019-02-22 07:53:42 ppc'
Press Enter to boot this image, or 'Ctrl B' for boot menu

Booting default image in:  0


Mellanox MLNX-OS Boot Menu:

   1: PPC_M460EX 3.6.8010 2018-08-20 18:04:16 ppc
*  2: PPC_M460EX 3.6.8012 2019-02-22 07:53:42 ppc
   u: USB menu (if USB device connected)
   c: Command prompt

   Choice:
Entering command prompt
=> setenv mfg_extra_args ramdisk=262144
=> setenv mfg_root 10.10.2.51:/
=> run mfg
Manufacture will DHCP, TFTP from directory 10.10.2.51:/mlnx460ex, and boot

Waiting for PHY auto negotiation to complete... done
ENET Speed is 1000 Mbps - FULL duplex connection (EMAC0)
BOOTP broadcast 1
BOOTP broadcast 2
BOOTP broadcast 3
DHCP client bound to address 10.10.2.139
Using ppc_4xx_eth0 device
TFTP from server 10.10.2.51; our IP address is 10.10.2.139
Filename '/mlnx460ex/vmlinuz'.
Load address: 0x400000
Loading: #################################################################
         ##############################################################
done
Bytes transferred = 1862752 (1c6c60 hex)
Using ppc_4xx_eth0 device
TFTP from server 10.10.2.51; our IP address is 10.10.2.139
Filename '/mlnx460ex/fdt'.
Load address: 0x800000
Loading: #
done
Bytes transferred = 9230 (240e hex)
Using ppc_4xx_eth0 device
TFTP from server 10.10.2.51; our IP address is 10.10.2.139
Filename '/mlnx460ex/rootfs'.
Load address: 0xc00000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ####################
done
Bytes transferred = 6015766 (5bcb16 hex)
Booting mfg
## Loading init Ramdisk from Legacy Image at 00c00000 ...
   Verifying Checksum ... OK
   Loading Ramdisk to 2fa43000, end 2ffffad6 ... OK
Using mlnx460ex machine description
Linux version 2.6.27-MELLANOXbfuni-m460ex (root@fit15) (gcc version 4.2.2) SX_PPC_M460EX SX_3.2.0100 #1 2012-03-06 22:23:53
Found initrd at 0xefa43000:0xeffffad6
Zone PFN ranges:
  DMA      0x00000000 -> 0x00030000
  Normal   0x00030000 -> 0x00030000
  HighMem  0x00030000 -> 0x00080000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00080000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 520192
Kernel command line: root=/dev/ram rw ramdisk_size=180224 ramdisk=262144 console=ttyS0,9600
UIC0 (32 IRQ sources) at DCR 0xc0
UIC1 (32 IRQ sources) at DCR 0xd0
UIC2 (32 IRQ sources) at DCR 0xe0
UIC3 (32 IRQ sources) at DCR 0xf0
PID hash table entries: 4096 (order: 12, 16384 bytes)
clocksource: timebase mult[400000] shift[22] registered
Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
Memory: 2068972k/2097152k available (3700k kernel code, 27136k reserved, 136k data, 135k bss, 160k init)
SLUB: Genslabs=10, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Calibrating delay loop... 1998.84 BogoMIPS (lpj=3997696)
Mount-cache hash table entries: 512
net_namespace: 776 bytes
NET: Registered protocol family 16
256k L2-cache enabled
PCIE0: Checking link...
PCIE0: No device detected.
PCI host bridge /plb/pciex@d00000000 (primary) ranges:
 MEM 0x0000000e00000000..0x0000000e7fffffff -> 0x0000000080000000
 MEM 0x0000000f00000000..0x0000000f000fffff -> 0x0000000000000000
  IO 0x0000000f80000000..0x0000000f8000ffff -> 0x0000000000000000
 Removing ISA hole at 0x0000000f00000000
4xx PCI DMA offset set to 0x00000000
PCIE0: successfully set as root-complex
PCIE1: Checking link...
PCIE1: Device detected, waiting for link...
PCIE1: link is up !
PCI host bridge /plb/pciex@d20000000 (primary) ranges:
 MEM 0x0000000e80000000..0x0000000effffffff -> 0x0000000080000000
 MEM 0x0000000f00100000..0x0000000f001fffff -> 0x0000000000000000
  IO 0x0000000f80010000..0x0000000f8001ffff -> 0x0000000000000000
 Removing ISA hole at 0x0000000f00100000
4xx PCI DMA offset set to 0x00000000
PCIE1: successfully set as root-complex
PCI: Probing PCI hardware
PCI: Hiding 4xx host bridge resources 0000:40:00.0
PCI: Hiding 4xx host bridge resources 0001:80:00.0
pci 0000:40:00.0: PCI bridge, secondary bus 0000:41
pci 0000:40:00.0:   IO window: disabled
pci 0000:40:00.0:   MEM window: disabled
pci 0000:40:00.0:   PREFETCH window: disabled
pci 0001:80:00.0: PCI bridge, secondary bus 0001:81
pci 0001:80:00.0:   IO window: disabled
pci 0001:80:00.0:   MEM window: 0x80000000-0x800fffff
pci 0001:80:00.0:   PREFETCH window: disabled
bus: 40 index 0 io port: [fffe0000, fffeffff]
bus: 40 index 1 mmio: [e00000000, e7fffffff]
bus: 41 index 0 mmio: [fffe0000, fffe0fff]
bus: 41 index 1 mmio: [d80000000, d800fffff]
bus: 41 index 2 mmio: [d80000000, d800fffff]
bus: 41 index 3 mmio: [0, 0]
bus: 80 index 0 io port: [0, ffff]
bus: 80 index 1 mmio: [e80000000, effffffff]
bus: 81 index 0 mmio: [0, fff]
bus: 81 index 1 mmio: [e80000000, e800fffff]
bus: 81 index 2 mmio: [0, 0]
bus: 81 index 3 mmio: [0, 0]
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 32768 (order: 5, 131072 bytes)
TCP established hash table entries: 131072 (order: 8, 1048576 bytes)
TCP bind hash table entries: 65536 (order: 6, 262144 bytes)
TCP: Hash tables configured (established 131072 bind 65536)
TCP reno registered
NET: Registered protocol family 1
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 5874k freed
Configuring USB GPIO 16 + 19
highmem bounce pool size: 64 pages
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
msgmni has been set to 1494
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
Serial: 8250/16550 driver4 ports, IRQ sharing enabled
serial8250.0: ttyS0 at MMIO 0x4ef600300 (irq = 20) is a 16550A
console [ttyS0] enabled
4ef600300.serial: ttyS0 at MMIO 0x4ef600300 (irq = 20) is a 16550A
brd: module loaded
PPC 4xx OCP EMAC driver, version 3.54
MAL v2 /plb/mcmal, 2 TX channels, 16 RX channels
ZMII /plb/opb/emac-zmii@ef600d00 initialized
RGMII /plb/opb/emac-rgmii@ef601500 initialized with MDIO support
TAH /plb/opb/emac-tah@ef601350 initialized
TAH /plb/opb/emac-tah@ef601450 initialized
/plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
eth0: EMAC-0 /plb/opb/ethernet@ef600e00, MAC ef42412c
eth0: found Generic MII PHY (0x00)
/plb/opb/emac-rgmii@ef601500: input 1 in RGMII mode
eth1: EMAC-1 /plb/opb/ethernet@ef600f00, MAC ef42512c
eth1: found Generic MII PHY (0x01)
Driver 'sd' needs updating - please use bus_type methods
4ff000000.nor_flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Intel/Sharp Extended Query Table at 0x010A
 Intel/Sharp Extended Query Table at 0x010A
 Intel/Sharp Extended Query Table at 0x010A
 Intel/Sharp Extended Query Table at 0x010A
 Intel/Sharp Extended Query Table at 0x010A
Using buffer write method
Using auto-unlock on power-up/resume
cfi_cmdset_0001: Erase suspend on write enabled
RedBoot partition parsing not available
Creating 6 MTD partitions on "4ff000000.nor_flash":
0x00000000-0x001e0000 : "KERNEL_1"
0x001e0000-0x00200000 : "FDT_1"
0x00200000-0x003e0000 : "KERNEL_2"
0x003e0000-0x00400000 : "FDT_2"
0x00f80000-0x00fa0000 : "UBOOTENV"
0x00fa0000-0x01000000 : "UBOOT"
NAND device: Manufacturer ID: 0xec, Chip ID: 0xd3 (Samsung NAND 1GiB 3,3V 8-bit)
2 NAND chips detected
Scanning device for bad blocks
Bad eraseblock 1430 at 0x0b2c0000
Bad eraseblock 4579 at 0x23c60000
Bad eraseblock 6849 at 0x35820000
Bad eraseblock 15143 at 0x764e0000
Creating 4 MTD partitions on "4e0000000.ndfc.nand":
0x00000000-0x20000000 : "ROOT_1"
0x20000000-0x40000000 : "ROOT_2"
0x40000000-0x46400000 : "CONFIG"
0x46400000-0x7c000000 : "VAR"
ppc-of-ehci 4bffd0400.ehci: OF EHCI
ppc-of-ehci 4bffd0400.ehci: new USB bus registered, assigned bus number 1
ppc-of-ehci 4bffd0400.ehci: irq 32, io mem 0x4bffd0400
ppc-of-ehci 4bffd0400.ehci: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
i2c /dev entries driver
ibm-iic 4ef600700.i2c: using standard (100 kHz) mode
rtc-ds1307 0-0068: rtc core: registered ds1338 as rtc0
rtc-ds1307 0-0068: 56 bytes nvram
ibm-iic 4ef600800.i2c: using standard (100 kHz) mode
hwmon-vid: Unknown VRM version of your CPU
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
rtc-ds1307 0-0068: setting system clock to 2021-03-07 07:48:10 UTC (1615103290)
RAMDISK: Compressed image found at block 0
EXT2-fs warning: checktime reached, running e2fsck is recommended
VFS: Mounted root (ext2 filesystem).
Freeing unused kernel memory: 160k init
hwclock: Could not access RTC: No such file or directory
Running startup scripts.
Running /etc/init.d/rcS.d/S05hwrng
Probing for HRNG module
Mixing in entropy from HRNG
Running /etc/init.d/rcS.d/S10tms_dhcpc
Starting DHCP client on interfaces: eth0 eth1

dhcp eth0: starting
dhcp eth1: starting
dhcp eth0: obtained lease
dhcp eth0: adding address: 10.10.2.139 / 24
dhcp eth0: adding default gw: 10.10.2.1
dhcp eth0: adding domain:
dhcp eth0: adding dns: 10.10.2.1
dhcp eth1: failed to get lease
Running /etc/init.d/rcS.d/S30tms_autostart
Running /etc/init.d/rcS.d/S34automfg
-
(none) login: root


BusyBox v1.00 (2010.12.03-23:16+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.


Processing /etc/profile... Done

#
Once in the manufacturing OS we can mount the OS areas, /dev/mtdblock6 and/or /dev/mtdblock7 as well as the config area, /dev/mtdblock8.

Code:
# mkdir /mnt/root2
# mount -t jffs2 /dev/mtdblock7 /mnt/root2
# mount -t jffs2 /dev/mtdblock8 /mnt/root2/config

# df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/ram0                59717     18152     41565  30% /
/dev/mtdblock7          524288    495684     28604  95% /mnt/root2
/dev/mtdblock8          102400      3148     99252   3% /mnt/root2/config
The manufacuring OS does have mddbreq, but it seems to be too old or something as it has issues.

Code:
# mddbreq /mnt/root2/config/db/initial query get - /cluster/config/shared-secret
An error occurred; see logs for details.

# tail /var/log/messages
Mar  7 07:07:58 (none) local7.debug mddbreq[1160]: [mddbreq.DEBUG]: Mddbreq launched (argv: mddbreq /mnt/root2/config/db/initial query get - /cluster/config/shared-secret)
Mar  7 07:07:58 (none) local7.debug mddbreq[1160]: [mddbreq.DEBUG]: Db change id now 1 (db open: /mnt/root2/config/db/initial)
Mar  7 07:07:58 (none) local7.warn mddbreq[1160]: [mddbreq.WARNING]: Database had bad nodes (containing attributes with an unrecognized data type). Use '--fix-bad-nodes' option to read and/or write this database file.
Mar  7 07:07:58 (none) local7.err mddbreq[1160]: [mddbreq.ERR]: do_db_op(), mddbr_main.c:603, build 1: Couldn't open database file /mnt/root2/config/db/initial (database contains node with unrecognized type)
Mar  7 07:07:58 (none) local7.err mddbreq[1160]: [mddbreq.ERR]: main(), mddbr_main.c:58, build 1: Error code 14301 (database contains node with unrecognized type) returned
Mar  7 07:07:58 (none) local7.debug mddbreq[1160]: [mddbreq.DEBUG]: Mddbreq exiting (exec time: 468 ms)
Maybe using --fix-bad-nodes would work for reading, but considering the chroot alternative works without issue I feel it's safer to just go that route. My 3.6.8012 image is on the second OS area, /dev/mtdblock7. I figure both should have a new enough version if you flashed through the supported version upgrade path. Adjust if there is a need to use the first OS area, /dev/mtdblock6.

Code:
# mount -t proc /proc /mnt/root2/proc/
# mount -o bind /sys /mnt/root2/sys/
# mount -o bind /dev /mnt/root2/dev/
# chroot /mnt/root2 /bin/bash
While we're here, make a backup of the DB.

Code:
bash-4.1# cp -p /config/db/initial /config/db/initial-$(date "+%Y%m%dT%H%M%S")
And also while we're here, we can take a look at the native MLNX-OS IB SM HA cluster shared secret. This has nothing to do with the license key shared secret. I'm pretty sure this is the same password I have on my luggage.

Code:
bash-4.1# mddbreq /config/db/initial query get - /cluster/config/shared-secret
Name: /cluster/config/shared-secret
        Attrib: value
        Type: string
        Value: 1234567890123456
Check, change, and verify the new value of the shell for the admincli user.

Code:
bash-4.1# mddbreq /config/db/initial query get - /auth/passwd/user/admincli/shell
Name: /auth/passwd/user/admincli/shell
        Attrib: value
        Type: string
        Value: /opt/tms/bin/cli

bash-4.1# mddbreq /config/db/initial set modify - /auth/passwd/user/admincli/shell string "/bin/bash"

bash-4.1# mddbreq /config/db/initial query get - /auth/passwd/user/admincli/shell
Name: /auth/passwd/user/admincli/shell
        Attrib: value
        Type: string
        Value: /bin/bash
Reboot the system and verify that you can get into the bash CLI. Here I'm just logging into the normal admin account first to make sure the system is fully booted.

Code:
bash-4.1# exit
exit
# reboot
umount: /dev/mtdblock7 busy - remounted read-only
Mar  7 07:21:40 (none) daemon.info init: Starting pid 1178, console /dev/ttyS0: '/sbin/swapoff'
# Mar  7 07:21:40 (none) daemon.info init: The system is going down NOW !!
Mar  7 07:21:40 (none) daemon.info init: Sending SIGTERM to all processes.
Mar  7 07:21:40 (none) syslog.info System log daemon exiting.
Please stand by while rebooting the system.
Restarting system.

~~~ The usual boot stuff ~~~

Mellanox MLNX-OS Switch Management

CM-SW-2 login: admin
Password:
Last login: Sat Mar  6 19:18:26 on ttyS0

Mellanox Switch

    System is initializing!
This may take a few minutes


    Modules are being configured
CM-SW-2 [standalone: master] > exit


Mellanox MLNX-OS Switch Management

CM-SW-2 login: admincli
Password:
Last login: Sun Mar  7 00:24:38 on ttyS0

Mellanox Switch

[admin@CM-SW-2 ~]# id
uid=0(admin) gid=0(root) groups=0(root)
Hope this of use to anyone wanting to tweak with their native MLNX-OS equipment. For example, mess with mlxi2c_bf to tweak fan speed parameters.

Code:
mlxi2c_bf --master-mode set_fan /FAN/FAN 1 65
mlxi2c_bf --master-mode set_fan /PS1/FAN 1 65