Support for Mikrotik RB3011UiAS-RM?

Yeah, just saw email.
I granted access to you and everybody with direct link

Ok. I download it.

Hard config detected at 0x8e000
DTS config detected at 0x90000
Soft config detected at 0xbd000

Try to change byte on offset 0x0008e04c from 01 to 00:

Ok, I can try it tommorow afternoon after university.

Yes, and it is very similar that the kernel image is still packed with the old-time kind Mikrotik's YAFFS!

So maybe kernel2minor is needed too.
They really love their YAFFS for unkown reason.

I gotta get some SOIC8, TSSOP8 and similar sockets to not have to desolder NOR every time I need to test something.
For some reason they put a VIA stitched thermal pad to GND under NOR which is in a plastic case and pretty much last thing you need to worry about temperature wise

So, instead of 01 44 28 00 try

00 44 28 00

or maybe(such value is used in RB450Gx4)

00 00 43 00

I decompiled DTB file from you dump, and console should be on COM1:

			serial_pinmux {
				phandle = <0x48>;

				mux {
					pins = "gpio60", "gpio61";
					function = "blsp_uart0";
		serial@78af000 {
			compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
			reg = <0x78af000 0x200>;
			interrupts = <0x0 0x6b 0x0>;
			status = "ok";
			clocks = <0x2 0x1a 0x2 0x15>;
			clock-names = "core", "iface";
			pinctrl-0 = <0x48>;
			pinctrl-names = "default";

		serial@78b0000 {
			compatible = "qcom,msm-uartdm-v1.4", "qcom,msm-uartdm";
			reg = <0x78b0000 0x200>;
			interrupts = <0x0 0x6c 0x0>;
			status = "disabled";
			clocks = <0x2 0x1b 0x2 0x15>;
			clock-names = "core", "iface";

I know, also decompiled DTB as soon as dump was made.
Will give it a try tommorow.
It was most likely getting stuck on missing YAFFS, so I can try using kernel2minor on it but without UART everything is a pain to get working

@adron Good news.
Changing 01 to 00 at 0x0008e04c did the trick and UART works.
Gotta go to university now so I will see what is stopping netbooting image later today.

In the meantime, I'm cooking openwrt for my RB3011. Just finally understood why it didn’t want to work with the second ethernet switch(QCA8337). The whole thing turned out to be in gpio-17 which at the kernel start should be set to high signal level! Without this, the switch refuses to answer via mdio.

cat /sys/kernel/debug/gpio

GPIOs 0-151, msmgpio:
gpio-0 (mdio ) in hi
gpio-1 (mdc ) out lo
gpio-3 (rst_n ) out hi
gpio-4 (usb-power-off ) out hi
gpio-8 (sda ) in hi
gpio-9 (scl ) in hi
gpio-10 (mdio ) in hi
gpio-11 (mdc ) out lo
gpio-13 (ts_irq ) in hi
gpio-14 (gpio-beep ) out lo
gpio-16 (switch1-reset ) out hi
gpio-17 (switch2-reset ) out hi
gpio-26 (poe-on ) out hi
gpio-27 (rgmii ) in hi
gpio-28 (rgmii ) in hi
gpio-29 (rgmii ) in hi
gpio-30 (rgmii ) in lo
gpio-31 (rgmii ) in lo
gpio-32 (rgmii ) in lo
gpio-33 (user-led ) out lo
gpio-48 (lcd ) out hi
gpio-49 (sfp-tx-disable ) out lo
gpio-50 (sfp-rate-select ) out lo
gpio-51 (rgmii ) in lo
gpio-52 (rgmii ) in lo
gpio-53 (sda ) in hi
gpio-54 (scl ) in hi
gpio-56 (poe-status ) in lo
gpio-57 (lcd_cs ) out lo
gpio-59 (rgmii ) in lo
gpio-60 (rgmii ) in lo
gpio-61 (rgmii ) in lo
gpio-62 (rgmii ) in lo
gpio-63 (sfp-module-detect ) in hi
gpio-64 (lcd_a0 ) out hi
gpio-66 (button ) in hi
gpio-67 (sfp-tx-fault ) in hi
gpio-68 (sfp-rx-lose ) in hi

One more weird design by Mikrotik.
I figured out why devices was not actually booting OpenWrt over TFTP.
It fetches the image but gets stuck on setting up elf image...
Gotta give legacy image a go

RouterBOOT booter 6.44


CPU frequency: 716 MHz
  Memory size: 256 MiB
 Storage size:  16 MiB

Press any key within 2 seconds to enter setup..
trying dhcp protocol.................. OK
resolved mac address C4:93:00:0F:30:DA
transfer started ................................................... transfer ok, time=4.63s
setting up elf image...

Hello. Try to change to TEXT_BASE2 := 0x00000000 in aux-loader Makefile, and try again.

Ok, will give it a go

Boot process does not reach the aux-loader start. This is RouterBOOT freezes. This is BUG in it!

I can try reflashing the RouterBoot with older version but it moves through the setting part in 1 second when booting RouterOS

I think it will not help. It is necessary to select proper TEXT_BASE2 for this platform and RouterBOOT. Maybe it equals to 0x0 or 0x80000000 or ....

You were correct, 0x00000000 works as TEXT_BASE2

Ok. This is great.
You can pass it directly in Build/aux-loader-common:

define Build/aux-loader-common
	rm -rf $@.src
	$(MAKE) -C aux-loader \
		PKG_BUILD_DIR="$@.src" \
		TARGET_DIR="$(dir $@)" LOADER_NAME="$(notdir $@)" \
		TEXT_BASE2="0x00000000" \

Good thing is that it boots.
But now its guessing time for MDIO offset and PCI-E which refuses to start.
Mikrotik has some GPIO Booster in PCI-E driver on GPIO66.
I tried exporting GPIO66 as both ACTIVE_LOW and ACTIVE_HIGH and it makes no difference.
@chunkeey Have you seen something like this?
This LHGG60-ad is similar to MR33 in regards that it also has AR8035 as PHY and single port