Mikrotik RB750 r2 series POE

Will give it a try when i get back home.

I updated the sh file. Added setup the lock and fuse bits. Please reload!

Not working, all i get are a tone of responses like this.

}
{
  action: "raw_send",
  tx: "0x40 0x00 0x19 0x81",
  rx: "0x00 0x00 0x00 0x00"
}
{
  action: "raw_send",
  tx: "0x48 0x00 0x19 0x50",
  rx: "0x00 0x00 0x00 0x00"
}
{
  action: "raw_send",
  tx: "0x40 0x00 0x1A 0x80",
  rx: "0x00 0x00 0x00 0x00"
}
{
  action: "raw_send",
  tx: "0x48 0x00 0x1A 0x93",
  rx: "0x00 0x00 0x00 0x00"
}

rx is always zero.... :frowning:

Let's start in order.

echo 0 > /sys/class/gpio/gpio14/value
mtpoe_ctrl --action=raw_send --raw_hex_val="AC 53 00 00"

What returns?

Ok, here we go....

root@OpenWrt:~# echo 0 > /sys/class/gpio/gpio14/value
root@OpenWrt:~# mtpoe_ctrl --action=raw_send --raw_hex_val="AC 53 00 00"
{
  action: "raw_send",
  tx: "0xAC 0x53 0x00 0x00",
  rx: "0x00 0x00 0x00 0x00"
}

This is bad. ATtiny does not even go into programming mode. There can be several reasons: microcontroller hardware malfunction or a set previously value of the fuse bits that prohibit reprogramming.

Hm,I am gotta try the avrdude way tommorow.
And, I am sure that they have programming pins on one of the headers.
Mikrotik usually always leave stuff like that for production programming

avrdude does not help. Lets see https://github.com/SpenceKonde/ATTinyCore/blob/master/avr/avrdude.conf

Search for string: "ATtiny461"
pgm_enable          = "1 0 1 0  1 1 0 0   0 1 0 1  0 0 1 1",
"x x x x x x x x x x x x x x x x";

"1 0 1 0 1 1 0 0 0 1 0 1 0 0 1 1" this is "AC 53" - Programming Enable.

In response, the microcontroller should respond "0x00 0x00 0x53 0x00"

The ATtiny461a programming is carried out via the SPI bus at a LOW level on the GPIO 14. There are no other options.

If I were you, I'd look for where to buy a new chip, solder it instead of the old and try to program it using the above script.

And on my test PowerBox after the commands:

echo 0 > /sys/class/gpio/gpio14/value
mtpoe_ctrl --action=raw_send --raw_hex_val="AC 53 00 00"

I get what I need in return: 0x00 0x00 0x53 0x00

It could easily bee that lock bit was set and SPI or HVP programming wont work

Yes. And also because of the fuse bits, the microcontroller can use the external clock source that is missing.

@adron I finally got some fresh Attiny461-s, I will replace the not working one in a day or two and then try flashing the firmware using your mtpoe_ctrl package.

Do I have to use you script linked above?

Hello. No, I not tested http://hosting.yapic.net/lede/attiny_write.sh.txt
I do not want to turn the device into a brick.

Just finished a rework of the mtpoe_ctrl to support the Mikrotik's PoE(gigabit) version 3. Checked on the RB960PGS device.

A RB960pgs, unlike the RB750UPr2, has version 3 PoE, implemented on the ATMega ATSAMD20J15 microcontroller. The communication protocol is slightly different.

At this moment, I checked a workage of the mtpoe_ctrl on the following devices:
RB750UPr2
RB750P-PBr2
RB960PGS

1 Like

Awesome job, I will give your script a go since POE already does not work and I got 5 new Attiny-s.
Have you had a POEv4 device yet?

I have a CRS328 switch that has 3 POE PCB-s and 3 POEv4 controllers.
Completely forgot to not which MCU does it use

Hello. I've never heard of the PoE version 4. Are you sure that it exists?
Inside the RouterOS squashfs, too, there is nothing like that:

# pwd
/tmp/23/squashfs-root/lib/modules/3.3.5/misc
# ls -l ./*poe*
-rw-r--r-- 1 root root  7608 ноя 27 16:24 ./poe_simple.ko
-rw-r--r-- 1 root root  7620 ноя 27 16:24 ./poeupdate.ko
-rw-r--r-- 1 root root  8212 ноя 27 16:24 ./poe_v2.ko
-rw-r--r-- 1 root root 18228 ноя 27 16:24 ./poe_v3.ko

Unfortunately, I do not have a CRS328.

Oh. You are right. If we look at routeros-arm then we see this:

-rw-r--r-- 1 root root  8084 ноя 12 13:35 ./poe_simple.ko
-rw-r--r-- 1 root root 21620 ноя 12 13:35 ./poe_v4.ko

I am sure as I jailbroke CRS328-24P-4S+RM and there are 3 POE v4 devices registered on SPI0.4, SPI0.5 and SPI0.6

I forgot to check which MCU is used, altough I doubt that MCU use matters really.
What was the difference between v2 and v3?

CRS328 is perfect candidate for OpenWRT as the switch used also has a ARMv7 CPU and is fully upstreamed.
There are only 2 issues, POE and fans are registered via kmod and controller with a STM8 MCU.
Also, they have multiple hwmon devices measuring voltage and current for both 24V and 58V ranges but only total coming from PSU