MikroTik rb450gx4 support

I have test on my rb450gx4 (routeros v6.42.7), and I use https://github.com/0ki/mikrotik-tools to get the temporary root shell, here is some useful system info:

# cat /proc/cpuinfo 
Processor	: ARMv7 Processor rev 5 (v7l)
processor	: 0
BogoMIPS	: 1430.32

processor	: 1
BogoMIPS	: 1430.32

processor	: 2
BogoMIPS	: 1430.32

processor	: 3
BogoMIPS	: 1430.32

Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt 
CPU implementer	: 0x41
CPU architecture: 7
CPU variant	: 0x0
CPU part	: 0xc07
CPU revision	: 5

Hardware	: Qualcomm (Flattened Device Tree)
Revision	: 0000
Serial		: 0000000000000000

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00800000 00040000 "RouterBoard NAND 1 Boot"
mtd1: 1f800000 00040000 "RouterBoard NAND 1 Main"
mtd2: 00040000 00001000 "RouterBoot"

# uname -an
Linux MikroTik 3.3.5 #1 SMP Fri Aug 10 13:35:23 UTC 2018 armv7l unknown

#  cat /proc/version 
Linux version 3.3.5 (build@builder) (gcc version 4.8.2 (GCC) ) #1 SMP Fri Aug 10 13:35:23 UTC 2018

# cat /proc/mounts 
rootfs / rootfs rw 0 0
proc /proc proc rw,relatime 0 0
tmpfs /ram tmpfs rw,relatime 0 0
devtmpfs /dev devtmpfs rw,relatime,size=509112k,nr_inodes=127278,mode=755 0 0
ubi1:RouterOS /flash ubifs rw,noatime 0 0
ubi0:Kernel /flash/boot ubifs rw,noatime,compr=none 0 0
5:4096 / squashfs ro,relatime 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
sysfs /sys sysfs rw,relatime 0 0
debugfs /sys/kernel/debug debugfs rw,relatime 0 0
proc /ram/netns/main proc rw,relatime 0 0
5:4096 /ram/disk1 squashfs ro,relatime 0 0
5:4096 /ram/disk2 squashfs ro,relatime 0 0
5:4096 /ram/pckg/option squashfs ro,relatime 0 0
/dev/mmcblk0p1 /ram/disk2 ext3 rw,relatime,errors=continue,barrier=1,data=writeback 0 0

# cat /proc/meminfo 
MemTotal:        1018512 kB
MemFree:          964068 kB
Buffers:              12 kB
Cached:            25776 kB
SwapCached:            0 kB
Active:             6432 kB
Inactive:          22996 kB
Active(anon):       3712 kB
Inactive(anon):      104 kB
Active(file):       2720 kB
Inactive(file):    22892 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          3700 kB
Mapped:             4808 kB
Shmem:               164 kB
Slab:              11664 kB
SReclaimable:       1692 kB
SUnreclaim:         9972 kB
KernelStack:         616 kB
PageTables:          352 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:      509256 kB
Committed_AS:       8044 kB
VmallocTotal:    1024000 kB
VmallocUsed:       10072 kB
VmallocChunk:     878776 kB
# 

And I just need a netboot kernel file such as lede-ipq4019-mikrotik-vmlinux-initramfs.elf, (I see the master branch has ready support the ipq40xx), is there any guide line to build the netboot kernel file?

@yourchanges I finally got my hands on RB450Gx4

How did you manage to get root shell?

  1. prepare an empty micro sd card (2GB or above)

  2. use https://github.com/0ki/mikrotik-tools/blob/master/exploit-defconf/make_usb.sh to "format && prepare" the micro sd card, like this:

./make_usb.sh /dev/sdb
  1. when finished, plugin the micro sd card into the RB450Gx4 (you need open the outside iron box, and the sdcard slot is on the circuit board)

  2. make sure the your pc can connect to the RB450Gx4 (and the sshd service is open)

  3. execute the https://github.com/0ki/mikrotik-tools/blob/master/exploit-defconf/second_stage.sh , you'll asked to input the device ip and possible password if you have set.

  4. waiting for the device reboot, you'll login the root shell automatically.

  5. upload the busybox (https://busybox.net/downloads/binaries/1.28.1-defconfig-multiarch/busybox-armv7l) and give it executable permission, you can do whatever you want.

Notes: when you reboot the device, the root shell is gone, you need execute the second_stage.sh script again. and don't remove the sd card.

my device partition layout:

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00800000 00040000 "RouterBoard NAND 1 Boot"
mtd1: 1f800000 00040000 "RouterBoard NAND 1 Main"
mtd2: 00040000 00001000 "RouterBoot"

any updates?

Take a look at this thread:

You can build my branch here:

And then you can load the elf over TFTP and sysupgrade from it.
Dont be scared when warnings start poping up in dmesg as those are from SD card driver

Thank you!!!! I'll try it later.

Builds fine, boots fine. I assume it's reasonably safe to install via sysupgrade, it does not interfere with Routerboot's partition layout?

Why would it interfere with RouterBoot?
I still gotta include patches by adron for rbcfg to work properly so recovery to RouterOS is simpler

Just checking if its "native" support for RouterBoot, as opposed to the "interim" support that required uBoot (for RB750GR3, for example). It clearly is :slight_smile:.

Its native support.
adron has made a auxiliary loader that RouterBoot loads and which then loads and decompresses the kernel.

I have created a new device page for RB450Gx4 in OpenWRT's Table of Hardware, added the device as WiP, pre-built the current images and included some of the information from this thread and the related development threads (including installation instructions) on the RB450Gx4 device page.
I will continue to maintain and update the relevant pages as necessary.

2 Likes

@robimarko I have booted the openwrt by netboot, and when I try to mount the routeros mtd partition, it get failed, Do you know why? or I missed something.

Here is what I do in old RB450G:


mkdir -p /mnt2

mount -t yaffs2 -o rw /dev/mtdblock6 /mnt2

touch /mnt2/nova/etc/devel-login

mkdir -p /mnt2/rw/pckg/plugin

#echo "dd" > /mnt2/nova/etc/devel-login

ls -l /mnt2/nova/etc

mkdir -p /mnt2/etc/rc.d/run.d/

I can mount the /dev/mtdblock6 in rw mode, and I can modify the routeros to add something.

Here is what I do in RB450Gx4, it gets failed:

=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------

root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
rootfs                  500.8M      5.4M    495.3M   1% /
tmpfs                   503.3M     60.0K    503.2M   0% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev

root@OpenWrt:/# uname -an                                                                                         
Linux OpenWrt 4.19.23 #0 SMP Sat Feb 23 19:47:43 2019 armv7l GNU/Linux

root@OpenWrt:/sbin# ls /dev/                                                                                       
console             memory_bandwidth    ppp
cpu_dma_latency     mmcblk0             ptmx
full                mmcblk0p1           pts
gpiochip0           mtd0                random
hwrng               mtd0ro              shm
kmsg                mtd1                tty
log                 mtd1ro              ttyMSM0
loop-control        mtd2                ttyS0
loop0               mtd2ro              ttyS1
loop1               mtdblock0           ubi0
loop2               mtdblock1           ubi0_0
loop3               mtdblock2           ubi_ctrl
loop4               network_latency     urandom
loop5               network_throughput  watchdog
loop6               null                watchdog0
loop7               port                zero
root@OpenWrt:/sbin#

root@OpenWrt:/# mkdir -p /mnt2

root@OpenWrt:/# df -h                                                                                             
Filesystem                Size      Used Available Use% Mounted on
rootfs                  500.8M      5.4M    495.3M   1% /
tmpfs                   503.3M     60.0K    503.2M   0% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock                                                               
mtdblock0  mtdblock1  mtdblock2
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock                                                               
mtdblock0  mtdblock1  mtdblock2
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock2 /mnt2                                                         
mount: mounting /dev/mtdblock2 on /mnt2 failed: No such device
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock /mnt2                                                         
mtdblock0  mtdblock1  mtdblock2
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock6 /mnt2                                                         
mount: mounting /dev/mtdblock6 on /mnt2 failed: No such device
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock0 /mnt2                                                         
mount: mounting /dev/mtdblock0 on /mnt2 failed: No such device
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock2 /mnt2                                                         
mount: mounting /dev/mtdblock2 on /mnt2 failed: No such device
root@OpenWrt:/#



root@OpenWrt:/sbin# ifconfig                                                                                       
br-lan    Link encap:Ethernet  HWaddr B8:69:F4:A0:79:1B 
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::ba69:f4ff:fea0:791b/64 Scope:Link
          inet6 addr: fd2d:f1bd:88fa::1/60 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1627 errors:0 dropped:0 overruns:0 frame:0
          TX packets:122 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:124435 (121.5 KiB)  TX bytes:12336 (12.0 KiB)

eth0      Link encap:Ethernet  HWaddr B8:69:F4:A0:79:1B 
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1693 errors:0 dropped:0 overruns:0 frame:0
          TX packets:130 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:155541 (151.8 KiB)  TX bytes:13937 (13.6 KiB)

eth1      Link encap:Ethernet  HWaddr B8:69:F4:A0:79:1A 
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:230 errors:0 dropped:0 overruns:0 frame:0
          TX packets:230 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:15736 (15.3 KiB)  TX bytes:15736 (15.3 KiB)

root@OpenWrt:/sbin#

@robimarko

And here is the boot logs:

CPU frequency: 716 MHz
  Memory size: 1024 MiB
    NAND size: 512 MiB

Press any key within 2 seconds to enter setup..
trying dhcp protocol..................... OK
resolved mac address 74:D4:35:97:D9:35
Gateway: 192.168.1.1
transfer started ................................ transfer ok, time=3.61s
setting up elf image... OK
jumping to kernel code

OpenWrt kernel loader for Qualcomm IPQ-4XXX/IPQ-806X
Copyright (C) 2019  Sergey Sergeev <adron@mstnt.com>
                                                   
Extracting LZMA kernel...Done
Starting kernel at 0x80208000
                             
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.19.23 (lee@lee-Inspiron-7577) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r9419-d9ab3240a5)) #0 SMP Sat Feb 23 19:47:43 2019
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: Mikrotik RouterBOARD RB450Gx4
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] random: get_random_bytes called from start_kernel+0x78/0x414 with crng_init=0
[    0.000000] percpu: Embedded 15 pages/cpu @(ptrval) s29772 r8192 d23476 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 260096
[    0.000000] Kernel command line:
[    0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
[    0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Memory: 1025584K/1046528K available (4563K kernel code, 146K rwdata, 1284K rodata, 5120K init, 228K bss, 20944K reserved, 0K cma-reserved, 262144K highmem)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xf0800000 - 0xff800000   ( 240 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xf0000000   ( 768 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0x(ptrval) - 0x(ptrval)   (5556 kB)
[    0.000000]       .init : 0x(ptrval) - 0x(ptrval)   (5120 kB)
[    0.000000]       .data : 0x(ptrval) - 0x(ptrval)   ( 147 kB)
[    0.000000]        .bss : 0x(ptrval) - 0x(ptrval)   ( 229 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] arch_timer: cp15 timer(s) running at 48.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 440795203732 ns
[    0.000009] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns
[    0.000022] Switching to timer-based delay loop, resolution 20ns
[    0.000249] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000)
[    0.000266] pid_max: default: 32768 minimum: 301
[    0.000444] Mount-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000462] Mountpoint-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.001097] CPU: Testing write buffer coherency: ok
[    0.001941] Setting up static identity map for 0x80300000 - 0x80300060
[    0.002086] rcu: Hierarchical SRCU implementation.
[    0.002729] smp: Bringing up secondary CPUs ...
[    0.005394] smp: Brought up 1 node, 4 CPUs
[    0.005413] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.005423] CPU: All CPU(s) started in SVC mode.
[    0.009172] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.009306] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.009331] futex hash table entries: 1024 (order: 4, 65536 bytes)
[    0.009521] pinctrl core: initialized pinctrl subsystem
[    0.010525] NET: Registered protocol family 16
[    0.010782] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.011888] cpuidle: using governor ladder
[    0.011930] cpuidle: using governor menu
[    0.019235] ------------[ cut here ]------------
[    0.019266] WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1016 gic_irq_domain_translate+0x74/0xf4
[    0.019274] Modules linked in:
[    0.019293] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.23 #0
[    0.019301] Hardware name: Generic DT based system
[    0.019328] [<c030e6f4>] (unwind_backtrace) from [<c030b15c>] (show_stack+0x10/0x14)
[    0.019349] [<c030b15c>] (show_stack) from [<c075b8f0>] (dump_stack+0x88/0x9c)
[    0.019371] [<c075b8f0>] (dump_stack) from [<c031c34c>] (__warn+0xd4/0xf0)
[    0.019390] [<c031c34c>] (__warn) from [<c031c438>] (warn_slowpath_null+0x40/0x48)
[    0.019409] [<c031c438>] (warn_slowpath_null) from [<c04fead8>] (gic_irq_domain_translate+0x74/0xf4)
[    0.019429] [<c04fead8>] (gic_irq_domain_translate) from [<c035fa08>] (irq_create_fwspec_mapping+0xc4/0x328)
[    0.019446] [<c035fa08>] (irq_create_fwspec_mapping) from [<c035fcb8>] (irq_create_of_mapping+0x4c/0x54)
[    0.019463] [<c035fcb8>] (irq_create_of_mapping) from [<c0638444>] (of_irq_get+0x5c/0x94)
[    0.019479] [<c0638444>] (of_irq_get) from [<c0638494>] (of_irq_to_resource+0x18/0xb0)
[    0.019494] [<c0638494>] (of_irq_to_resource) from [<c0638548>] (of_irq_to_resource_table+0x1c/0x48)
[    0.019513] [<c0638548>] (of_irq_to_resource_table) from [<c0634360>] (of_device_alloc+0xfc/0x14c)
[    0.019531] [<c0634360>] (of_device_alloc) from [<c06343f8>] (of_platform_device_create_pdata+0x48/0xb8)
[    0.019549] [<c06343f8>] (of_platform_device_create_pdata) from [<c0634764>] (of_platform_bus_create+0x2b8/0x340)
[    0.019568] [<c0634764>] (of_platform_bus_create) from [<c06347a0>] (of_platform_bus_create+0x2f4/0x340)
[    0.019586] [<c06347a0>] (of_platform_bus_create) from [<c063491c>] (of_platform_populate+0x54/0xa0)
[    0.019607] [<c063491c>] (of_platform_populate) from [<c0918ef4>] (of_platform_default_populate_init+0xa0/0xb8)
[    0.019627] [<c0918ef4>] (of_platform_default_populate_init) from [<c0302690>] (do_one_initcall+0x7c/0x184)
[    0.019645] [<c0302690>] (do_one_initcall) from [<c0900e5c>] (kernel_init_freeable+0x140/0x1dc)
[    0.019664] [<c0900e5c>] (kernel_init_freeable) from [<c076f1fc>] (kernel_init+0x8/0x114)
[    0.019680] [<c076f1fc>] (kernel_init) from [<c03010e8>] (ret_from_fork+0x14/0x2c)
[    0.019689] Exception stack(0xef05dfb0 to 0xef05dff8)
[    0.019702] dfa0:                                     00000000 00000000 00000000 00000000
[    0.019716] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    0.019729] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    0.019745] ---[ end trace 8ea5ad8de92c3669 ]---
[    0.019799] ------------[ cut here ]------------
[    0.019817] WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1016 gic_irq_domain_translate+0x74/0xf4
[    0.019824] Modules linked in:
[    0.019839] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W         4.19.23 #0
[    0.019847] Hardware name: Generic DT based system
[    0.019866] [<c030e6f4>] (unwind_backtrace) from [<c030b15c>] (show_stack+0x10/0x14)
[    0.019884] [<c030b15c>] (show_stack) from [<c075b8f0>] (dump_stack+0x88/0x9c)
[    0.019903] [<c075b8f0>] (dump_stack) from [<c031c34c>] (__warn+0xd4/0xf0)
[    0.019921] [<c031c34c>] (__warn) from [<c031c438>] (warn_slowpath_null+0x40/0x48)
[    0.019940] [<c031c438>] (warn_slowpath_null) from [<c04fead8>] (gic_irq_domain_translate+0x74/0xf4)
[    0.019959] [<c04fead8>] (gic_irq_domain_translate) from [<c04fef30>] (gic_irq_domain_alloc+0x30/0x7c)
[    0.019977] [<c04fef30>] (gic_irq_domain_alloc) from [<c035f69c>] (__irq_domain_alloc_irqs+0x140/0x240)
[    0.019993] [<c035f69c>] (__irq_domain_alloc_irqs) from [<c035fb7c>] (irq_create_fwspec_mapping+0x238/0x328)
[    0.020009] [<c035fb7c>] (irq_create_fwspec_mapping) from [<c035fcb8>] (irq_create_of_mapping+0x4c/0x54)
[    0.020025] [<c035fcb8>] (irq_create_of_mapping) from [<c0638444>] (of_irq_get+0x5c/0x94)
[    0.020040] [<c0638444>] (of_irq_get) from [<c0638494>] (of_irq_to_resource+0x18/0xb0)
[    0.020056] [<c0638494>] (of_irq_to_resource) from [<c0638548>] (of_irq_to_resource_table+0x1c/0x48)
[    0.020073] [<c0638548>] (of_irq_to_resource_table) from [<c0634360>] (of_device_alloc+0xfc/0x14c)
[    0.020090] [<c0634360>] (of_device_alloc) from [<c06343f8>] (of_platform_device_create_pdata+0x48/0xb8)
[    0.020108] [<c06343f8>] (of_platform_device_create_pdata) from [<c0634764>] (of_platform_bus_create+0x2b8/0x340)
[    0.020127] [<c0634764>] (of_platform_bus_create) from [<c06347a0>] (of_platform_bus_create+0x2f4/0x340)
[    0.020145] [<c06347a0>] (of_platform_bus_create) from [<c063491c>] (of_platform_populate+0x54/0xa0)
[    0.020164] [<c063491c>] (of_platform_populate) from [<c0918ef4>] (of_platform_default_populate_init+0xa0/0xb8)
[    0.020182] [<c0918ef4>] (of_platform_default_populate_init) from [<c0302690>] (do_one_initcall+0x7c/0x184)
[    0.020199] [<c0302690>] (do_one_initcall) from [<c0900e5c>] (kernel_init_freeable+0x140/0x1dc)
[    0.020217] [<c0900e5c>] (kernel_init_freeable) from [<c076f1fc>] (kernel_init+0x8/0x114)
[    0.020233] [<c076f1fc>] (kernel_init) from [<c03010e8>] (ret_from_fork+0x14/0x2c)
[    0.020242] Exception stack(0xef05dfb0 to 0xef05dff8)
[    0.020253] dfa0:                                     00000000 00000000 00000000 00000000
[    0.020268] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    0.020281] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    0.020346] ---[ end trace 8ea5ad8de92c366a ]---
[    0.020380] ------------[ cut here ]------------
[    0.020398] WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1016 gic_irq_domain_translate+0x74/0xf4
[    0.020405] Modules linked in:
[    0.020420] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W         4.19.23 #0
[    0.020428] Hardware name: Generic DT based system
[    0.020447] [<c030e6f4>] (unwind_backtrace) from [<c030b15c>] (show_stack+0x10/0x14)
[    0.020466] [<c030b15c>] (show_stack) from [<c075b8f0>] (dump_stack+0x88/0x9c)
[    0.020485] [<c075b8f0>] (dump_stack) from [<c031c34c>] (__warn+0xd4/0xf0)
[    0.020503] [<c031c34c>] (__warn) from [<c031c438>] (warn_slowpath_null+0x40/0x48)
[    0.020522] [<c031c438>] (warn_slowpath_null) from [<c04fead8>] (gic_irq_domain_translate+0x74/0xf4)
[    0.020540] [<c04fead8>] (gic_irq_domain_translate) from [<c035fa08>] (irq_create_fwspec_mapping+0xc4/0x328)
[    0.020557] [<c035fa08>] (irq_create_fwspec_mapping) from [<c035fcb8>] (irq_create_of_mapping+0x4c/0x54)
[    0.020573] [<c035fcb8>] (irq_create_of_mapping) from [<c0638444>] (of_irq_get+0x5c/0x94)
[    0.020588] [<c0638444>] (of_irq_get) from [<c0638494>] (of_irq_to_resource+0x18/0xb0)
[    0.020603] [<c0638494>] (of_irq_to_resource) from [<c0638548>] (of_irq_to_resource_table+0x1c/0x48)
[    0.020621] [<c0638548>] (of_irq_to_resource_table) from [<c0634360>] (of_device_alloc+0xfc/0x14c)
[    0.020639] [<c0634360>] (of_device_alloc) from [<c06343f8>] (of_platform_device_create_pdata+0x48/0xb8)
[    0.020657] [<c06343f8>] (of_platform_device_create_pdata) from [<c0634764>] (of_platform_bus_create+0x2b8/0x340)
[    0.020676] [<c0634764>] (of_platform_bus_create) from [<c06347a0>] (of_platform_bus_create+0x2f4/0x340)
[    0.020693] [<c06347a0>] (of_platform_bus_create) from [<c063491c>] (of_platform_populate+0x54/0xa0)
[    0.020713] [<c063491c>] (of_platform_populate) from [<c0918ef4>] (of_platform_default_populate_init+0xa0/0xb8)
[    0.020731] [<c0918ef4>] (of_platform_default_populate_init) from [<c0302690>] (do_one_initcall+0x7c/0x184)
[    0.020748] [<c0302690>] (do_one_initcall) from [<c0900e5c>] (kernel_init_freeable+0x140/0x1dc)
[    0.020764] [<c0900e5c>] (kernel_init_freeable) from [<c076f1fc>] (kernel_init+0x8/0x114)
[    0.020780] [<c076f1fc>] (kernel_init) from [<c03010e8>] (ret_from_fork+0x14/0x2c)
[    0.020789] Exception stack(0xef05dfb0 to 0xef05dff8)
[    0.020800] dfa0:                                     00000000 00000000 00000000 00000000
[    0.020816] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    0.020829] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    0.020838] ---[ end trace 8ea5ad8de92c366b ]---
[    0.020890] ------------[ cut here ]------------
[    0.020908] WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1016 gic_irq_domain_translate+0x74/0xf4
[    0.020915] Modules linked in:
[    0.020929] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W         4.19.23 #0
[    0.020937] Hardware name: Generic DT based system
[    0.020954] [<c030e6f4>] (unwind_backtrace) from [<c030b15c>] (show_stack+0x10/0x14)
[    0.020973] [<c030b15c>] (show_stack) from [<c075b8f0>] (dump_stack+0x88/0x9c)
[    0.020991] [<c075b8f0>] (dump_stack) from [<c031c34c>] (__warn+0xd4/0xf0)
[    0.021010] [<c031c34c>] (__warn) from [<c031c438>] (warn_slowpath_null+0x40/0x48)
[    0.021028] [<c031c438>] (warn_slowpath_null) from [<c04fead8>] (gic_irq_domain_translate+0x74/0xf4)
[    0.021047] [<c04fead8>] (gic_irq_domain_translate) from [<c04fef30>] (gic_irq_domain_alloc+0x30/0x7c)
[    0.021064] [<c04fef30>] (gic_irq_domain_alloc) from [<c035f69c>] (__irq_domain_alloc_irqs+0x140/0x240)
[    0.021080] [<c035f69c>] (__irq_domain_alloc_irqs) from [<c035fb7c>] (irq_create_fwspec_mapping+0x238/0x328)
[    0.021097] [<c035fb7c>] (irq_create_fwspec_mapping) from [<c035fcb8>] (irq_create_of_mapping+0x4c/0x54)
[    0.021113] [<c035fcb8>] (irq_create_of_mapping) from [<c0638444>] (of_irq_get+0x5c/0x94)
[    0.021128] [<c0638444>] (of_irq_get) from [<c0638494>] (of_irq_to_resource+0x18/0xb0)
[    0.021143] [<c0638494>] (of_irq_to_resource) from [<c0638548>] (of_irq_to_resource_table+0x1c/0x48)
[    0.021160] [<c0638548>] (of_irq_to_resource_table) from [<c0634360>] (of_device_alloc+0xfc/0x14c)
[    0.021178] [<c0634360>] (of_device_alloc) from [<c06343f8>] (of_platform_device_create_pdata+0x48/0xb8)
[    0.021196] [<c06343f8>] (of_platform_device_create_pdata) from [<c0634764>] (of_platform_bus_create+0x2b8/0x340)
[    0.021214] [<c0634764>] (of_platform_bus_create) from [<c06347a0>] (of_platform_bus_create+0x2f4/0x340)
[    0.021232] [<c06347a0>] (of_platform_bus_create) from [<c063491c>] (of_platform_populate+0x54/0xa0)
[    0.021251] [<c063491c>] (of_platform_populate) from [<c0918ef4>] (of_platform_default_populate_init+0xa0/0xb8)
[    0.021270] [<c0918ef4>] (of_platform_default_populate_init) from [<c0302690>] (do_one_initcall+0x7c/0x184)
[    0.021287] [<c0302690>] (do_one_initcall) from [<c0900e5c>] (kernel_init_freeable+0x140/0x1dc)
[    0.021303] [<c0900e5c>] (kernel_init_freeable) from [<c076f1fc>] (kernel_init+0x8/0x114)
[    0.021318] [<c076f1fc>] (kernel_init) from [<c03010e8>] (ret_from_fork+0x14/0x2c)
[    0.021327] Exception stack(0xef05dfb0 to 0xef05dff8)
[    0.021339] dfa0:                                     00000000 00000000 00000000 00000000
[    0.021353] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    0.021366] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    0.021375] ---[ end trace 8ea5ad8de92c366c ]---
[    0.030472] usbcore: registered new interface driver usbfs
[    0.030542] usbcore: registered new interface driver hub
[    0.030617] usbcore: registered new device driver usb
[    0.030665] pps_core: LinuxPPS API ver. 1 registered
[    0.030674] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.030699] PTP clock support registered
[    0.031963] clocksource: Switched to clocksource arch_sys_counter
[    0.032832] NET: Registered protocol family 2
[    0.033445] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes)
[    0.033479] TCP established hash table entries: 8192 (order: 3, 32768 bytes)
[    0.033578] TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
[    0.033740] TCP: Hash tables configured (established 8192 bind 8192)
[    0.033871] UDP hash table entries: 512 (order: 2, 16384 bytes)
[    0.033926] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
[    0.034155] NET: Registered protocol family 1
[    0.102691] No memory allocated for crashlog
[    0.102900] workingset: timestamp_bits=30 max_order=18 bucket_order=0
[    0.106653] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.106666] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.111768] bounce: pool size: 64 pages
[    0.111794] io scheduler noop registered
[    0.111804] io scheduler deadline registered (default)
[    0.112696] gpio-export gpio-export: 1 gpio(s) exported
[    0.114416] bam-dma-engine 8e04000.dma: num-channels unspecified in dt
[    0.114432] bam-dma-engine 8e04000.dma: num-ees unspecified in dt
[    0.115700] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[    0.115782] tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7
[    0.115857] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[    0.115930] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[    0.116152] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.116717] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.116758] msm_serial 78af000.serial: uartclk = 1843200
[    0.116805] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 25, base_baud = 115200) is a MSM
[    0.116833] msm_serial: console setup on port #0
[    1.616938] console [ttyMSM0] enabled
[    1.621860] msm_serial: driver initialized
[    1.629230] loop: module loaded
[    1.630634] nand: device found, Manufacturer ID: 0x98, Chip ID: 0xdc
[    1.632234] nand: Toshiba NAND 512MiB 3,3V 8-bit
[    1.638786] nand: 512 MiB, SLC, erase size: 256 KiB, page size: 4096, OOB size: 128
[    1.643463] 2 fixed-partitions partitions found on MTD device qcom_nand.0
[    1.650767] Creating 2 MTD partitions on "qcom_nand.0":
[    1.657739] 0x000000000000-0x000001000000 : "kernel"
[    1.677613] 0x000001000000-0x000020000000 : "ubi"
[    1.691370] random: fast init done
[    2.117438] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    2.127277] m25p80 spi0.0: w25q16jv (2048 Kbytes)
[    2.127326] 1 fixed-partitions partitions found on MTD device spi0.0
[    2.130960] Creating 1 MTD partitions on "spi0.0":
[    2.137408] 0x000000080000-0x0000000c0000 : "RouterBoot"
[    2.143297] libphy: ipq40xx_mdio: probed
[    2.209901] ESS reset ok!
[    2.240211] ESS reset ok!
[    2.672381] libphy: Fixed MDIO Bus: probed
[    2.673283] EDMA using MAC@ - using
[    2.673298] b6:49:00:90:ac:f8
[    2.679551] EDMA using MAC@ - using
[    2.679562] 12:e1:c0:45:62:de
[    2.782961] i2c /dev entries driver
[    2.784935] sdhci: Secure Digital Host Controller Interface driver
[    2.785257] sdhci: Copyright(c) Pierre Ossman
[    2.791504] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.796143] ------------[ cut here ]------------
[    2.801675] WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1016 gic_irq_domain_translate+0x74/0xf4
[    2.806293] Modules linked in:
[    2.815394] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W         4.19.23 #0
[    2.818505] Hardware name: Generic DT based system
[    2.826071] [<c030e6f4>] (unwind_backtrace) from [<c030b15c>] (show_stack+0x10/0x14)
[    2.830671] [<c030b15c>] (show_stack) from [<c075b8f0>] (dump_stack+0x88/0x9c)
[    2.838570] [<c075b8f0>] (dump_stack) from [<c031c34c>] (__warn+0xd4/0xf0)
[    2.845599] [<c031c34c>] (__warn) from [<c031c438>] (warn_slowpath_null+0x40/0x48)
[    2.852456] [<c031c438>] (warn_slowpath_null) from [<c04fead8>] (gic_irq_domain_translate+0x74/0xf4)
[    2.860013] [<c04fead8>] (gic_irq_domain_translate) from [<c035fa08>] (irq_create_fwspec_mapping+0xc4/0x328)
[    2.869301] [<c035fa08>] (irq_create_fwspec_mapping) from [<c035fcb8>] (irq_create_of_mapping+0x4c/0x54)
[    2.879109] [<c035fcb8>] (irq_create_of_mapping) from [<c0638444>] (of_irq_get+0x5c/0x94)
[    2.888572] [<c0638444>] (of_irq_get) from [<c056de04>] (platform_get_irq+0x28/0xe4)
[    2.896643] [<c056de04>] (platform_get_irq) from [<c062648c>] (sdhci_pltfm_init+0x48/0x104)
[    2.904454] [<c062648c>] (sdhci_pltfm_init) from [<c0627ae0>] (sdhci_msm_probe+0x58/0x15f8)
[    2.912528] [<c0627ae0>] (sdhci_msm_probe) from [<c056daa8>] (platform_drv_probe+0x34/0x70)
[    2.920858] [<c056daa8>] (platform_drv_probe) from [<c056c2e8>] (really_probe+0x14c/0x2b4)
[    2.929193] [<c056c2e8>] (really_probe) from [<c056c710>] (__driver_attach+0x90/0xc4)
[    2.937525] [<c056c710>] (__driver_attach) from [<c056a884>] (bus_for_each_dev+0x48/0x98)
[    2.945425] [<c056a884>] (bus_for_each_dev) from [<c056b884>] (bus_add_driver+0xe8/0x200)
[    2.953583] [<c056b884>] (bus_add_driver) from [<c056ce14>] (driver_register+0xbc/0xf8)
[    2.961747] [<c056ce14>] (driver_register) from [<c0302690>] (do_one_initcall+0x7c/0x184)
[    2.969559] [<c0302690>] (do_one_initcall) from [<c0900e5c>] (kernel_init_freeable+0x140/0x1dc)
[    2.977892] [<c0900e5c>] (kernel_init_freeable) from [<c076f1fc>] (kernel_init+0x8/0x114)
[    2.986398] [<c076f1fc>] (kernel_init) from [<c03010e8>] (ret_from_fork+0x14/0x2c)
[    2.994722] Exception stack(0xef05dfb0 to 0xef05dff8)
[    3.002187] dfa0:                                     00000000 00000000 00000000 00000000
[    3.007314] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    3.015473] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    3.023739] ---[ end trace 8ea5ad8de92c366d ]---
[    3.030118] sdhci_msm 7824900.sdhci: No vreg data found for vdd
[    3.034937] sdhci_msm 7824900.sdhci: No vreg data found for vdd-io
[    3.040565] sdhci_msm 7824900.sdhci: Parsing Pinctrl failed with -19, falling back on GPIO lib
[    3.046936] ------------[ cut here ]------------
[    3.055422] WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1016 gic_irq_domain_translate+0x74/0xf4
[    3.060171] Modules linked in:
[    3.069305] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W         4.19.23 #0
[    3.072409] Hardware name: Generic DT based system
[    3.079973] [<c030e6f4>] (unwind_backtrace) from [<c030b15c>] (show_stack+0x10/0x14)
[    3.084577] [<c030b15c>] (show_stack) from [<c075b8f0>] (dump_stack+0x88/0x9c)
[    3.092476] [<c075b8f0>] (dump_stack) from [<c031c34c>] (__warn+0xd4/0xf0)
[    3.099504] [<c031c34c>] (__warn) from [<c031c438>] (warn_slowpath_null+0x40/0x48)
[    3.106362] [<c031c438>] (warn_slowpath_null) from [<c04fead8>] (gic_irq_domain_translate+0x74/0xf4)
[    3.113919] [<c04fead8>] (gic_irq_domain_translate) from [<c035fa08>] (irq_create_fwspec_mapping+0xc4/0x328)
[    3.123206] [<c035fa08>] (irq_create_fwspec_mapping) from [<c035fcb8>] (irq_create_of_mapping+0x4c/0x54)
[    3.133011] [<c035fcb8>] (irq_create_of_mapping) from [<c0638444>] (of_irq_get+0x5c/0x94)
[    3.142476] [<c0638444>] (of_irq_get) from [<c056df38>] (platform_get_irq_byname+0x3c/0x68)
[    3.150550] [<c056df38>] (platform_get_irq_byname) from [<c06289cc>] (sdhci_msm_probe+0xf44/0x15f8)
[    3.158709] [<c06289cc>] (sdhci_msm_probe) from [<c056daa8>] (platform_drv_probe+0x34/0x70)
[    3.167734] [<c056daa8>] (platform_drv_probe) from [<c056c2e8>] (really_probe+0x14c/0x2b4)
[    3.176069] [<c056c2e8>] (really_probe) from [<c056c710>] (__driver_attach+0x90/0xc4)
[    3.184399] [<c056c710>] (__driver_attach) from [<c056a884>] (bus_for_each_dev+0x48/0x98)
[    3.192298] [<c056a884>] (bus_for_each_dev) from [<c056b884>] (bus_add_driver+0xe8/0x200)
[    3.200458] [<c056b884>] (bus_add_driver) from [<c056ce14>] (driver_register+0xbc/0xf8)
[    3.208617] [<c056ce14>] (driver_register) from [<c0302690>] (do_one_initcall+0x7c/0x184)
[    3.216431] [<c0302690>] (do_one_initcall) from [<c0900e5c>] (kernel_init_freeable+0x140/0x1dc)
[    3.224766] [<c0900e5c>] (kernel_init_freeable) from [<c076f1fc>] (kernel_init+0x8/0x114)
[    3.233272] [<c076f1fc>] (kernel_init) from [<c03010e8>] (ret_from_fork+0x14/0x2c)
[    3.241596] Exception stack(0xef05dfb0 to 0xef05dff8)
[    3.249060] dfa0:                                     00000000 00000000 00000000 00000000
[    3.254189] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    3.262346] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[    3.270605] ---[ end trace 8ea5ad8de92c366e ]---
[    3.292139] sdhci_msm 7824900.sdhci: Linked as a consumer to regulator.1
[    3.344787] mmc0: SDHCI controller on 7824900.sdhci [7824900.sdhci] using ADMA 64-bit
[    3.367331] NET: Registered protocol family 10
[    3.369207] Segment Routing with IPv6
[    3.370801] NET: Registered protocol family 17
[    3.374877] 8021q: 802.1Q VLAN Support v1.8
[    3.378781] Registering SWP/SWPB emulation handler
[    3.389802] UBI: auto-attach mtd1
[    3.389840] ubi0: attaching mtd1
[    3.559509] mmc0: new high speed SD card at address 2125
[    3.560183] mmcblk0: mmc0:2125 APPSD 1.88 GiB
[    3.565393]  mmcblk0: p1
[    4.884522] random: crng init done
[    9.792762] ubi0: scanning is finished
[    9.810561] ubi0 warning: ubi_read_volume_table: volume table copy #2 is corrupted
[    9.823614] ubi0: volume table was restored
[    9.826206] ubi0 warning: ubi_eba_init: cannot reserve enough PEBs for bad PEB handling, reserved 28, need 33
[    9.827885] ubi0: attached mtd1 (name "ubi", size 496 MiB)
[    9.836727] ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
[    9.842084] ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
[    9.848920] ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
[    9.855795] ubi0: good PEBs: 1977, bad PEBs: 7, corrupted PEBs: 0
[    9.862558] ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
[    9.868795] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 3006866048
[    9.875932] ubi0: available PEBs: 0, total reserved PEBs: 1977, PEBs reserved for bad PEB handling: 28
[    9.885248] ubi0: background thread "ubi_bgt0d" started, PID 95
[    9.8    .909139] Freeing unused kernel memory: 5120K
[    9.944785] Run /init as init process
[    9.964717] init: Console is alive
[    9.964946] init: - watchdog -
[    9.976110] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    9.988001] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[   10.002691] init: - preinit -
[   10.574241] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   10.574334] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   13.748426] procd: - early -
[   13.748558] procd: - watchdog -
[   14.383085] procd: - watchdog -
[   14.385930] procd: - ubus -
[   14.457757] procd: - init -
Please press Enter to activate this console.
[   14.581164] kmodloader: loading kernel modules from /etc/modules.d/*
[   14.592762] input: beeper as /devices/platform/beeper/input/input0
[   14.608338] xt_time: kernel timezone is -0000
[   14.620093] PPP generic driver version 2.4.2
[   14.620974] NET: Registered protocol family 24
[   14.630811] kmodloader: done loading kernel modules from /etc/modules.d/*
[   18.111822] br-lan: port 1(eth0) entered blocking state
[   18.111868] br-lan: port 1(eth0) entered disabled state
[   18.116232] device eth0 entered promiscuous mode
[   18.123284] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   18.144948] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   19.122010] br-lan: port 1(eth0) entered blocking state
[   19.122048] br-lan: port 1(eth0) entered forwarding state
[   19.126880] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready



BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r9419-809306e927

I dont understand what are you trying to do?
If you flashed OpenWrt then there is no RouterOS anymore

@robimarko
I just want keep the routeros, and add some software such as softether vpn bridge, frps automatic running when routeros booted.

To archive this, here are something I must do (as same as what I did on RB450G):

  1. get root shell permanently ( So I should add some script on routeros init stage to do https://github.com/0ki/mikrotik-tools/blob/master/exploit-defconf/make_usb.sh, and the first thing is I should mount the routeros root filesystem and modify the init scripts)

  2. add a plugin script in routeros init stage

cat > /mnt2/etc/rc.d/run.d/S09PlugIn <<EOF
#!/bin/bash

run_scripts() {
        for i in /rw/pckg/plugin/*; do
        echo $i
        [ -d $i  ] && [ -f $i/run.sh ] && chmod +x $i/* &&  $i/run.sh & 2>&1
        done
}


[ ! -d  /rw/pckg/plugin ] &&  mkdir /rw/pckg/plugin

run_scripts &

EOF

chmod +x /mnt2/etc/rc.d/run.d/S09PlugIn

  1. when reboot, the routeros should be rooted, and then, I can add any extra program such as softether vpn , and the routeros should run them automatically.

So, I dont see what is that gotta do with running OpenWrt

On old rb450g, when netbooted the openwrt in device momery, I mount the routeros original root filesystem like this:

root@OpenWrt:/# mkdir -p /mnt2                                                                                     
root@OpenWrt:/# mount -t yaffs2 -o rw /dev/mtdblock6 /mnt2
[  259.610000] yaffs: dev is 32505862 name is "mtdblock6" rw
[  259.610000] yaffs: passed flags ""
root@OpenWrt:/# 
root@OpenWrt:/# ls /mnt2/                                                                                          
CDINSTALL   boot        etc         lost+found  nova        var
bin         dev         home        nio         rw
root@OpenWrt:/# touch /mnt2/nova/etc/devel-login
root@OpenWrt:/# ls -l /mnt2/nova/etc/                                                                              
-rw-r--r--    1 root     root             0 Sep 29 07:13 devel-login
drwxr-xr-x    1 root     root          2048 Nov 23  2012 loader

and then, I reboot the device, it get root shell permanently.

Well since there is no YAFFS anymore and RouterOS is in UBIFS you really cant do that, especially since kernel partition had to be left larger since it cant be easily changed later.
So you cant do that, and please dont go offtopic since it does not matter to OpenWrt at all

Ok, thank you, I'll try it by myself.