MikroTik rb450gx4 support

#1


Details
Product code RB450Gx4
Architecture ARM 32bit
CPU IPQ-4019
CPU core count 4
CPU nominal frequency 716 MHz
Dimensions 90 x 115 mm
License level 5
Operating System RouterOS
Size of RAM 1 GB
Storage size 512 MB
Storage type NAND

2 Likes
#2

Good HW on a fully supported platform but RouterBoot will be causing issues.
I dont think that anybody knows how to get it to load OpenWrt without actually replacing it with uBoot

#4

Well I assume that they are all on ar71xx target?

Just take a look at the efforts to get the ramips based ones working.

1 Like
#5

RB450G is ar71xx

RB450Gx4 IPQ-4019
Architecture ARM 32bit
CPU IPQ-4019
CPU core count 4
CPU nominal frequency 716 MHz

#6

Its not ar71xx
Its ipq40xx

#8

So, has anyone got OpenWRT working with the RB450Gx4 yet?

#9

This is what it prints on console when booting:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00096
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1339 - bootable_media_detect_entry, Start
B -      1679 - bootable_media_detect_success, Start
B -      1693 - elf_loader_entry, Start
B -      5076 - auth_hash_seg_entry, Start
B -      7222 - auth_hash_seg_exit, Start
B -    573284 - elf_segs_hash_verify_entry, Start
B -    688799 - PBL, End
B -    688824 - SBL1, Start
B -    777244 - pm_device_init, Start
D -         6 - pm_device_init, Delta
B -    778756 - boot_flash_init, Start
D -     45271 - boot_flash_init, Delta
B -    828220 - boot_config_data_table_init, Start
D -      3842 - boot_config_data_table_init, Delta - (419 Bytes)
B -    835443 - clock_init, Start
D -      7573 - clock_init, Delta
B -    847537 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0
B -    851025 - sbl1_ddr_set_params, Start
B -    856012 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    860504 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13146 - sbl1_ddr_set_params, Delta
B -    875577 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    943490 - sbl1_wait_for_ddr_training, Start
D -        29 - sbl1_wait_for_ddr_training, Delta
B -    964581 - Image Load, Start
D -    140546 - QSEE Image Loaded, Delta - (262104 Bytes)
B -   1105625 - Image Load, Start
D -      1442 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1115867 - Image Load, Start
D -     17189 - APPSBL Image Loaded, Delta - (30420 Bytes)
B -   1133472 - QSEE Execution, Start
D -        58 - QSEE Execution, Delta
B -   1139580 - SBL1, End
D -    452865 - SBL1, Delta
S - Flash Throughput, 1854 KB/s  (294991 Bytes,  159083 us)
S - DDR Frequency, 672 MHz
#10

I have test on my rb450gx4 (routeros v6.42.7), and I use https://github.com/0ki/mikrotik-tools to get the temporary root shell, here is some useful system info:

# cat /proc/cpuinfo 
Processor	: ARMv7 Processor rev 5 (v7l)
processor	: 0
BogoMIPS	: 1430.32

processor	: 1
BogoMIPS	: 1430.32

processor	: 2
BogoMIPS	: 1430.32

processor	: 3
BogoMIPS	: 1430.32

Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt 
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x0
CPU part	: 0xc07
CPU revision	: 5

Hardware	: Qualcomm (Flattened Device Tree)
Revision	: 0000
Serial		: 0000000000000000

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00800000 00040000 "RouterBoard NAND 1 Boot"
mtd1: 1f800000 00040000 "RouterBoard NAND 1 Main"
mtd2: 00040000 00001000 "RouterBoot"

# uname -an
Linux MikroTik 3.3.5 #1 SMP Fri Aug 10 13:35:23 UTC 2018 armv7l unknown

#  cat /proc/version 
Linux version 3.3.5 (build@builder) (gcc version 4.8.2 (GCC) ) #1 SMP Fri Aug 10 13:35:23 UTC 2018

# cat /proc/mounts 
rootfs / rootfs rw 0 0
proc /proc proc rw,relatime 0 0
tmpfs /ram tmpfs rw,relatime 0 0
devtmpfs /dev devtmpfs rw,relatime,size=509112k,nr_inodes=127278,mode=755 0 0
ubi1:RouterOS /flash ubifs rw,noatime 0 0
ubi0:Kernel /flash/boot ubifs rw,noatime,compr=none 0 0
5:4096 / squashfs ro,relatime 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
proc /ram/netns/main proc rw,relatime 0 0
5:4096 /ram/disk1 squashfs ro,relatime 0 0
5:4096 /ram/disk2 squashfs ro,relatime 0 0
5:4096 /ram/pckg/option squashfs ro,relatime 0 0
/dev/mmcblk0p1 /ram/disk2 ext3 rw,relatime,errors=continue,barrier=1,data=writeback 0 0

# cat /proc/meminfo 
MemTotal:        1018512 kB
MemFree:          964068 kB
Buffers:              12 kB
Cached:            25776 kB
SwapCached:            0 kB
Active:             6432 kB
Inactive:          22996 kB
Active(anon):       3712 kB
Inactive(anon):      104 kB
Active(file):       2720 kB
Inactive(file):    22892 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          3700 kB
Mapped:             4808 kB
Shmem:               164 kB
Slab:              11664 kB
SReclaimable:       1692 kB
SUnreclaim:         9972 kB
KernelStack:         616 kB
PageTables:          352 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:      509256 kB
Committed_AS:       8044 kB
VmallocTotal:    1024000 kB
VmallocUsed:       10072 kB
VmallocChunk:     878776 kB
# 

#11

And I just need a netboot kernel file such as lede-ipq4019-mikrotik-vmlinux-initramfs.elf, (I see the master branch has ready support the ipq40xx), is there any guide line to build the netboot kernel file?

#12

@yourchanges I finally got my hands on RB450Gx4

How did you manage to get root shell?

#13
  1. prepare an empty micro sd card (2GB or above)

  2. use https://github.com/0ki/mikrotik-tools/blob/master/exploit-defconf/make_usb.sh to "format && prepare" the micro sd card, like this:

./make_usb.sh /dev/sdb
  1. when finished, plugin the micro sd card into the RB450Gx4 (you need open the outside iron box, and the sdcard slot is on the circuit board)

  2. make sure the your pc can connect to the RB450Gx4 (and the sshd service is open)

  3. execute the https://github.com/0ki/mikrotik-tools/blob/master/exploit-defconf/second_stage.sh , you'll asked to input the device ip and possible password if you have set.

  4. waiting for the device reboot, you'll login the root shell automatically.

  5. upload the busybox (https://busybox.net/downloads/binaries/1.28.1-defconfig-multiarch/busybox-armv7l) and give it executable permission, you can do whatever you want.

Notes: when you reboot the device, the root shell is gone, you need execute the second_stage.sh script again. and don't remove the sd card.

my device partition layout:

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00800000 00040000 "RouterBoard NAND 1 Boot"
mtd1: 1f800000 00040000 "RouterBoard NAND 1 Main"
mtd2: 00040000 00001000 "RouterBoot"
#14

any updates?

#15

Take a look at this thread:

You can build my branch here:

And then you can load the elf over TFTP and sysupgrade from it.
Dont be scared when warnings start poping up in dmesg as those are from SD card driver

#16

Thank you!!!! I'll try it later.

#17

Builds fine, boots fine. I assume it's reasonably safe to install via sysupgrade, it does not interfere with Routerboot's partition layout?

#18

Why would it interfere with RouterBoot?
I still gotta include patches by adron for rbcfg to work properly so recovery to RouterOS is simpler

#19

Just checking if its "native" support for RouterBoot, as opposed to the "interim" support that required uBoot (for RB750GR3, for example). It clearly is :slight_smile:.

#20

Its native support.
adron has made a auxiliary loader that RouterBoot loads and which then loads and decompresses the kernel.

#21

I have created a new device page for RB450Gx4 in OpenWRT's Table of Hardware, added the device as WiP, pre-built the current images and included some of the information from this thread and the related development threads (including installation instructions) on the RB450Gx4 device page.
I will continue to maintain and update the relevant pages as necessary.

2 Likes
#22

@robimarko I have booted the openwrt by netboot, and when I try to mount the routeros mtd partition, it get failed, Do you know why? or I missed something.

Here is what I do in old RB450G:


mkdir -p /mnt2

mount -t yaffs2 -o rw /dev/mtdblock6 /mnt2

touch /mnt2/nova/etc/devel-login

mkdir -p /mnt2/rw/pckg/plugin

#echo "dd" > /mnt2/nova/etc/devel-login

ls -l /mnt2/nova/etc

mkdir -p /mnt2/etc/rc.d/run.d/

I can mount the /dev/mtdblock6 in rw mode, and I can modify the routeros to add something.

Here is what I do in RB450Gx4, it gets failed:

=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------

root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
rootfs                  500.8M      5.4M    495.3M   1% /
tmpfs                   503.3M     60.0K    503.2M   0% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev

root@OpenWrt:/# uname -an                                                                                         
Linux OpenWrt 4.19.23 #0 SMP Sat Feb 23 19:47:43 2019 armv7l GNU/Linux

root@OpenWrt:/sbin# ls /dev/                                                                                       
console             memory_bandwidth    ppp
cpu_dma_latency     mmcblk0             ptmx
full                mmcblk0p1           pts
gpiochip0           mtd0                random
hwrng               mtd0ro              shm
kmsg                mtd1                tty
log                 mtd1ro              ttyMSM0
loop-control        mtd2                ttyS0
loop0               mtd2ro              ttyS1
loop1               mtdblock0           ubi0
loop2               mtdblock1           ubi0_0
loop3               mtdblock2           ubi_ctrl
loop4               network_latency     urandom
loop5               network_throughput  watchdog
loop6               null                watchdog0
loop7               port                zero
root@OpenWrt:/sbin#

root@OpenWrt:/# mkdir -p /mnt2

root@OpenWrt:/# df -h                                                                                             
Filesystem                Size      Used Available Use% Mounted on
rootfs                  500.8M      5.4M    495.3M   1% /
tmpfs                   503.3M     60.0K    503.2M   0% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock                                                               
mtdblock0  mtdblock1  mtdblock2
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock                                                               
mtdblock0  mtdblock1  mtdblock2
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock2 /mnt2                                                         
mount: mounting /dev/mtdblock2 on /mnt2 failed: No such device
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock /mnt2                                                         
mtdblock0  mtdblock1  mtdblock2
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock6 /mnt2                                                         
mount: mounting /dev/mtdblock6 on /mnt2 failed: No such device
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock0 /mnt2                                                         
mount: mounting /dev/mtdblock0 on /mnt2 failed: No such device
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock2 /mnt2                                                         
mount: mounting /dev/mtdblock2 on /mnt2 failed: No such device
root@OpenWrt:/#



root@OpenWrt:/sbin# ifconfig                                                                                       
br-lan    Link encap:Ethernet  HWaddr B8:69:F4:A0:79:1B 
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::ba69:f4ff:fea0:791b/64 Scope:Link
          inet6 addr: fd2d:f1bd:88fa::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1627 errors:0 dropped:0 overruns:0 frame:0
          TX packets:122 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:124435 (121.5 KiB)  TX bytes:12336 (12.0 KiB)

eth0      Link encap:Ethernet  HWaddr B8:69:F4:A0:79:1B 
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1693 errors:0 dropped:0 overruns:0 frame:0
          TX packets:130 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:155541 (151.8 KiB)  TX bytes:13937 (13.6 KiB)

eth1      Link encap:Ethernet  HWaddr B8:69:F4:A0:79:1A 
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:230 errors:0 dropped:0 overruns:0 frame:0
          TX packets:230 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:15736 (15.3 KiB)  TX bytes:15736 (15.3 KiB)

root@OpenWrt:/sbin#