Add support for Mikrotik RB912UAG-2HPnD r2

ae6xe · December 15, 2019, 3:47pm

Since the r2 board is not reporting in dmesg:

[ 9.956025] ath: EEPROM regdomain: 0x0
[ 9.956036] ath: EEPROM indicates default country code should be used
[ 9.956040] ath: doing EEPROM country->regdmn map search
[ 9.956057] ath: country maps to regdmn code: 0x3a
[ 9.956063] ath: Country alpha2 being used: US
[ 9.956066] ath: Regpair used: 0x3a
[ 9.969793] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[ 9.974704] ieee80211 phy0: Atheros AR9340 Rev:3 mem=0xb8100000, irq=47

could Mikrotik have shifted the ART data to a different location on flash? I understand ath9k will not come up if it can't find this calibration data.

Joe AE6XE

cezary · December 15, 2019, 4:09pm

Raises but reports error without calibration data.

On r2 is nothing is bootlog about ath.

ae6xe · December 17, 2019, 3:15pm

The pictures of the 'transceiver' are actually pictures of an Ethernet PHY port, an AR8033 chip. Is it confirmed, the R2 still has the AR93xx 802.11n chipset?

painfull30 · December 18, 2019, 7:44am

Have 951 and 951r2, kernel line diffs in

Kernel command line looks not same, in R2 was added

benand_no_swecc=2
board_rev=r2

I tried to copy uboot (booter partition) from r1 to r2 - no luck, still no wifi!

And here are diffs in dmesg (left == working)
Screenshot_5|690x175

anon50098793 · December 18, 2019, 9:22am

binwalk and strings the r2 .bin ( or oem rootfs ) for ath

xback · January 5, 2020, 11:17pm

I'll check this issue this week normally.
It's pretty urgent internally in the company too.

I have contacted Mikrotik about this before my holidays and they state it should work, so it seems a bit unsuspected.

psyborg · January 5, 2020, 11:21pm

i read few days ago, some other mtik devices had wrong number of tx/rx chains burned in eeprom causing similar problems. maybe worth to check that

xback · January 6, 2020, 12:30pm

Ok .. 1 issue solved:

[    0.642553] m25p80 spi0.0: unrecognized JEDEC id bytes: c8, 40, 10
[    0.649381] NAND flash driver for the RouterBOARD 91x series

After patch:

[    0.641714] m25p80 spi0.0: found gd25d05, expected m25p80
[    0.649916] m25p80 spi0.0: gd25d05 (64 Kbytes)
[    0.655122] Creating 4 MTD partitions on "spi0.0":
[    0.660164] 0x000000000000-0x00000000c000 : "routerboot"
[    0.667782] 0x00000000c000-0x00000000d000 : "hard_config"
[    0.675073] 0x00000000d000-0x00000000e000 : "bios"
[    0.682613] 0x00000000e000-0x00000000f000 : "soft_config"
[    0.690304] NAND flash driver for the RouterBOARD 91x series

xback · January 6, 2020, 3:06pm

I noticed the patch upstream some time ago, but this issue causes error/warnings.
The issue here is that the radio hardware is not even detected at all.

Lipton2kirov · January 13, 2020, 6:13pm

--- a/target/linux/ar71xx/files/arch/mips/ath79/routerboot.c
+++ b/target/linux/ar71xx/files/arch/mips/ath79/routerboot.c
@@ -207,6 +207,7 @@ __rb_get_wlan_data(u16 id)
                u16 erd_len;
 
                if (id == 0)
+               pr_err("debug: id 0\n");
                        goto err_free;
 
                err = routerboot_find_tag(tag, tag_len, id,

root@OpenWrt:~# dmesg | grep debug
[    0.620550] rb: debug: id 0

ampledata · January 13, 2020, 6:49pm

We have several Rev2 boards here if there's any help needed in debugging.

xback · January 13, 2020, 9:16pm

I'm currently discussing the issue for r2 with MikroTik support in the background.

I hope to have some news later this week.

Lipton2kirov · January 15, 2020, 12:26pm

can you show spi flash dump from working device?

kondratspb · January 20, 2020, 11:12am

Hi! Do you have any news?

xback · January 20, 2020, 3:30pm

Yeah,

I provided 2 serial nr of 2 boards.
According to Mikrotik there is not a single change to the SoC or WLAN hardware here.
So the only delta (next to some enw SPI chip) is the bootloader.
The kernel cmdline shows a different in GPIO config.

Unfortunately, I dont have a R1 board anymore to upgrade the bootloader to the same version as the R2 ..

Lipton2kirov · January 20, 2020, 3:55pm

I asked:

to compare dumps spi flash revisions.
How will we proceed?

github.com/openwrt/openwrt

ath79: add support for MikroTik RouterBOARD wAP G-5HacT2HnD

committed 04:05PM - 16 Jan 20 UTC

rogerpueyo

+224 -0

This commit adds support for the MikroTik RouterBOARD wAP G-5HacT2HnD (wAP AC), …a small weatherproof dual band, dual-radio 802.11ac wireless AP with integrated omnidirectional anntennae and one 10/100/1000 Mbps Ethernet port. See https://mikrotik.com/product/RBwAPG-5HacT2HnD for more info. Specifications: - SoC: Qualcomm Atheros QCA9556 - RAM: 64 MB - Storage: 16 MB NOR - Wireless: · Atheros AR9550 (SoC) 802.11b/g/n 2x2:2, 2 dBi antennae · Qualcomm QCA9880 802.11a/n/ac 3x3:3, 2 dBi antennae - Ethernet: Atheros AG71xx (SoC, AR8033), 1x 1000/100/10 port, passive PoE in Working: - Board/system detection - Sysupgrade - Serial console - Ethernet - 2.4 GHz radio - 5 GHz radio and LED - Reset button Not working/Unsupported: - 2.4 GHz LED - AP/CAP LED - ZT2046Q SPI temperature and voltage sensor Patches needed to be applied: - https://patchwork.ozlabs.org/patch/1084137/ - https://patchwork.ozlabs.org/patch/1084136/ Acknowledgments: Robert Marko <robimarko@gmail.com> Andrew Cameron <apcameron@softhome.net> Signed-off-by: Roger Pueyo Centelles <roger.pueyo@guifi.net>

it will not help us in any way?

xback · January 20, 2020, 3:59pm

I'll try to provide that tomorrow.

I didn't want to provide them earlier as the working board had bootloader 3.x while the r2 has 6.x ..

Lipton2kirov · January 21, 2020, 12:27pm

spi cut information with 0xс000 size 0x1000:

dd if=951_1 of=hc951 skip=49152 count=4096 bs=1

compiled https://github.com/robimarko/openwrt/tree/BaseBox2/package/utils/rbextract/src

I see

root@OpenWrt:~# rbextract -a /tmp/hc951 
Board name: 
Board product code: 951Ui-2HnD
Board identifier: 951HnD
Board serial: B8570AAB8420
Board MAC: 744D28C0
HW Options 290005
Factory RouterBoot version: 6.43.2
Flash identifier: c21020c2

also checked this file using a script

github.com

zorun/openwrt-hacking/blob/master/tools/parse-routerboot.py

#!/usr/bin/env python3

"""
Decodes a Mikrotik "hard_config" or "soft_config" partition.

Inspired from arch/mips/ath79/routerboot.c and rbcfg
"""

import sys

import hexdump


RB_MAGIC_HARD = 0x64726148  # String for "Hard" in little-endian
RB_MAGIC_SOFT = 0x74666F53  # String for "Soft" in little-endian
RB_MAGIC_ERD  = 0x00455244  # "ERD"
RB_MAGIC_LZOR = 0x524f5a4c  # "LZOR"
RB_MAGICS = {RB_MAGIC_HARD: "RB_MAGIC_HARD",
             RB_MAGIC_SOFT: "RB_MAGIC_SOFT",
             RB_MAGIC_ERD:  "RB_MAGIC_ERD",

This file has been truncated. show original

python3 parse-routerboot.py ~/old_work/ch341prog/hc951 
Unknown magic: 0x48617264
Trying again in big-endian mode
RB_MAGIC_HARD
DATA type=26    len=4     data-offset=0x0008   00 00 00 00                                                                 |....|
DATA type=4     len=8     data-offset=0x0010   74 4d 28 c0 a0 73 00 00                                                     |tM(..s..|
DATA type=14    len=4     data-offset=0x001c   00 00 00 06                                                                 |....|
DATA type=10    len=4     data-offset=0x0024   0a ab 84 20                                                                 |... |
DATA type=13    len=4     data-offset=0x002c   08 00 00 00                                                                 |....|
DATA type=19    len=4     data-offset=0x0034   00 00 00 00                                                                 |....|
DATA type=18    len=4     data-offset=0x003c   00 00 f0 00                                                                 |....|
DATA type=20    len=4     data-offset=0x0044   08 21 d1 51                                                                 |.!.Q|
DATA type=21    len=4     data-offset=0x004c   00 29 00 05                                                                 |.)..|
DATA type=27    len=4     data-offset=0x0054   00 00 13 88                                                                 |....|
DATA type=11    len=16    data-offset=0x005c   42 38 35 37 30 41 41 42 38 34 32 30 00 00 00 00                             |B8570AAB8420....|
DATA type=5     len=20    data-offset=0x0070   39 35 31 55 69 2d 32 48 6e 44 00 00 00 00 00 00 00 00 00 00                 |951Ui-2HnD..........|
DATA type=33    len=4     data-offset=0x0088   00 00 00 00                                                                 |....|
DATA type=6     len=8     data-offset=0x0090   36 2e 34 33 2e 32 00 00                                                     |6.43.2..|
DATA type=25    len=20    data-offset=0x009c   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff                 |....................|
DATA type=3     len=20    data-offset=0x00b4   c2 10 20 c2 00 00 00 0c 00 00 00 10 02 00 00 33 02 01 04 00                 |.. ............3....|
DATA type=1     len=4     data-offset=0x00cc   01 7d 78 40                                                                 |.}x@|
DATA type=23    len=12    data-offset=0x00d4   39 35 31 48 6e 44 00 00 00 00 00 00                                         |951HnD......|
DATA type=8     len=48    data-offset=0x00e4   00 00 01 f4 40 08 1a 00 00 00 02 26 40 02 15 80 00 00 02 58 40 02 16 00 00  |....@......&@......X@....+
DATA type=28    len=636   data-offset=0x0118   00 00 00 c8 40 81 80 00 00 00 00 17 b8 00 00 b8 00 00 0e 59 b8 00 00 10 00  |....@..............Y.....+
DATA type=22    len=816   data-offset=0x0398   00 45 52 44 03 24 00 01 02 ff ff ff ff ff 20 00 00 00 00 00 00 00 00 00 00  |.ERD.$........ ..........+
Trying to recursively decode ERD partition
RB_MAGIC_ERD
DATA type=1     len=201   data-offset=0x0008   02 ff ff ff ff ff 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e9 00 00  |...... ..................+
DATA type=13312 len=335   data-offset=0x00d5   00 02 11 12 15 17 41 42 45 47 31 32 35 37 70 75 9d a2 70 75 a2 ff 6c 00 05  |......ABEG1257pu..pu..l..+
DATA type=48131 len=4885  data-offset=0x0228   40 01 90 03 90 00 88 02 4c 04 72 01 3c 7c 20 00 00 00 00 00 00 00 00 00 00  |@.......L.r.<| ..........+
Done decoding ERD
DATA type=30    len=24    data-offset=0x06cc   ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff     |........................|
DATA type=39    len=4     data-offset=0x06e8   72 32 00 00                                                                 |r2..|
DATA type=37    len=4     data-offset=0x06f0   06 2b 66 02                                                                 |.+f.|
Zero-length record with type 0, ending now

Does this give us any steps forward?
This is rb951ui-2hnd (r2) board.
P.S. Sorry for my English.

Lipton2kirov · January 22, 2020, 10:03pm

@robimarko @xback can this help us?

Lipton2kirov · January 29, 2020, 6:22pm

Found a router where Wi-Fi works (951ui-2hnd)
Dump spi from worked and not worked radio: https://yadi.sk/d/YdjK7UniRK4mQg
It seems that where the radio works, the lzo compression is not used in the calibration section.
I was able to extract them with rbexract -e.
Can anybody help? The problem is likely common to all new versions of Mikrotik.
P.S. I also soldered spi from a working router to a non-working one, after that the radio worked there. This suggests that I made the right conclusions that the data format is different.