So I can just try flashing the image already, and if no bad-blocks are on the flash, it will work? So actually the ath79 NAND devices will also break if there are bad-blocks on the flash?
1 Like
Yes, you can.
Yes - they will break. Those with NAND flash drives. From my practice of using about 20 devices of RB2011 for 3 years, this has never happened, but others have complained about this problem.
1 Like
Is there already some WIP in some staging tree?
No, I’m still busy and didn’t start working on RB5009. But it seems to me that, like the rest of Mikrotiks, UART should be labeled in the board(something like tx/rx):
Even better, will just have to enable it in hard_config.
I am interested in whether RouterBoot supports ELF booting, cause if it does then we can just use SPL U-boot and use that to boot OpenWrt.
Of course it does. RouterOS has its Linux Kernel in ELF format!
Then just using U-boot pretty much gets rid of any need for YAFFS
I think YAFFS still can be needed. The loader somehow reads kernel from the flash memory. The whole question is where exactly they store the kernel - in NOR or in NAND? If it is in NOR, then YAFFS is not needed.
I will dump the SPI-NOR today, already got the case opened up.
It's a bit of a pain to open as the heatsink (Metal part of the case) has thermal pads and paste and you are then essentially running without any heatsinking at all.
Also, most of the top of the PCB is empty, its prepared for the WiFi and PoE version fully.
5 Likes
@adron Here is the SPI-NOR dump:
https://drive.google.com/drive/folders/1WnswllcXaAgT8hKBx4Imzr_FRHWunpL4?usp=sharing
I have also traced most of the pins on the SPI+UART header.
1 GND Vcc RX ? GND
#--------------------#
|.-. .-. .-. .-. .-. |
|'-' '-' '-' '-' '-' |
|.-. .-. .-. .-. .-. |
|'-' '-' '-' '-' '-' |
#--------------------#
2 CLK DO /CS TX DI
Those pads marked RX and TX are meant for the unpopulated PoE MCU it seems as they end on its pads.
I can see:
BootROM - 2.03
Starting AP IOROM 1.02
Booting from SPI NOR flash 0
Found valid image at boot postion 0x000
lmv_ddr: mv_ddr-1.1.0-g8c6defd127 (Aug 03 2021 - 18:17:37)
mv_ddr: completed successfully
BL2: Initiating SCP_BL2 transfer to SCP
So UART needs to be enabled in the hard config as it's disabled in ATF and later.
I have changed:
15 00 04 00 05
to
15 00 04 00 00
But UART still stops working
3 Likes
Try these values for UART : 15 00 04 00 04
Regarding the SPI flash drive dump - I've already seen it before. It can be obtained without a programmer - by jailbreaking the RouterOS and reading /dev/mtdblock2 - 1M size partition!
So there is no Linux kernel on the SPi flash drive, only bootloaders and HARD + SOFT + DTS configs.
There is not even a hint of any ELF headers in this dump.
1 Like
Unfortunately, these don't work as well.
It prints some gibberish after the SCP2 is loaded:
BootROM - 2.03
Starting AP IOROM 1.02
Booting from SPI NOR flash 0
Found valid image at boot postion 0x000
lmv_ddr: mv_ddr-1.1.0-g8c6defd127 (Aug 03 2021 - 18:17:37)
mv_ddr: completed successfully
BL2: Initiating SCP_BL2 transfer to SCP
/7:%/FH=t�
Yeah, I would say that they using it like in other NAND based platforms just for the RouterBoot and other configs while the kernel and rootfs are on the NAND
Yes, this is not very good. Apparently this is a feature (or just a bug) of RouterBOOT for RouterOS V7. Or, maybe, there is another(second) UART on the board !?!
Well, at least - for start, you can try to load(via TFTP) an UBoot ELF image(TEXT_BASE=0x01100000).
I will make a dummy U-boot that only has UART and try loading it(Hopefully today).
The second UART appears to be used for the PoE MCU on the PoE variant that they will release.
@adron For me DHCP loading doesn't work at all in RouterBoot v7, it gets offered a DHCP lease but newer ACK-s it.
RouterBoot v6 worked fine
Though they could be using one of the CP peripheral UART-s it still would end up on the header.
It even says SPI+UART, it gotta be SW related for sure
@f00b4r0 I know that you have a lot of experience with MikroTik devices, any ideas?
1 Like
Anybody got any ideas?
I have pretty much run out of things to try
Try to use a Mikrotik RouterOS as the DHCP server. And be sure to set in its settings that bootp-lease-time == forever.
And then, on the RB5009, do the following commands:
/system routerboard settings set boot-protocol=dhcp
or
/system routerboard settings set boot-protocol=bootp
and then
/system routerboard settings set boot-device=try-ethernet-once-then-nand
/system reboot
That's the irony, I am already using my RB4011 as the DHCP server.
I have updated it today to ROSv7 and will give it another go, bootp-lease-time is already set to forever
@adron Nah, even in ROSv7 DHCP it won't work.
Just a bunch of:
dhcp1 offering lease 192.168.2.17 for DC:2C:6E:43:EC:3D without success
3 Likes
Doesn't work even with boot-protocol=dhcp ?
Also try to to use with Always Broadcast checkbox.
Ok, so I was kind of pissed and made a dummy U-boot and ATF images just to see whether the UART works.
Had to rework the example DRAM config as they are using x16 DRAM as well as a single CS instead of the usual 2 CS.
And it works, after loading the image via UART as BootROM supports doing that.
The final pinout of the SPI+UART header is:
1 GND Vcc RX ? GND
#--------------------#
|.-. .-. .-. .-. .-. |
|'-' '-' '-' '-' '-' |
|.-. .-. .-. .-. .-. |
|'-' '-' '-' '-' '-' |
#--------------------#
2 CLK DO /CS TX DI
CE: CP MSS startup is postponed
NOTICE: Done
NOTICE: Load image to AP0 MSS
NOTICE: Loading MSS FW from addr. 0x404662c Size 0x5400 to MSS at 0xf0580000
NOTICE: Done
NOTICE: BL1: Booting BL31
lNOTICE: Starting CP0 MSS CPU
NOTICE: BL31: v2.6(release):v2.6-137-gc8076a0e6
NOTICE: BL31: Built : 12:10:43, Dec 29 2021
U-Boot 2022.01-rc4-dirty (Dec 29 2021 - 11:52:30 +0100)
DRAM: 1 GiB
Comphy chip #0:
Comphy-0: UNCONNECTED 1.25 Gbps
Comphy-1: UNCONNECTED 1.25 Gbps
Comphy-2: UNCONNECTED 1.25 Gbps
Comphy-3: UNCONNECTED 1.25 Gbps
Comphy-4: UNCONNECTED 1.25 Gbps
Comphy-5: UNCONNECTED 1.25 Gbps
MMC:
Loading Environment from SPIFlash... Invalid bus 0 (err=-19)
*** Warning - spi_flash_probe_bus_cs() failed, using default environment
Model: Marvell Armada 7040 DB board
Cannot find PCA9555: -19
Net: No ethernet found.
Hit any key to stop autoboot: 0
Ignore the errors, I removed everything except for the UART pinctrl and UART.
It's at the standard AP pins 11 and 19, so WTF is it not being enabled is a mystery.
Maybe they have changed the v7 tags or added a checksum?
@adron Since DHCP still doesn't work for me, can you see if they left /dev/mem enabled in their kernel?
They left out most of the pinctrl and rely on the bootloader to see it, so it would be great if the pinmuxing registers can be read directly
6 Likes