Support for Mikrotik RB3011UiAS-RM?

The memory size is in the dts file:

memory {
                device_type = "memory";
                reg = <0x80000000 0x10000000>;
        };

I'll reduce mine to 128mb,
Mine is also the NT5CC64M16GP-DI

I will create a new DTS file for the hap ac2 and post my results.
Great find!

I just got mine to boot !!!

RouterBOOT booter 6.43.4

RouterBOARD D52G-5HacD2HnD-TC

CPU frequency: 716 MHz
  Memory size: 128 MiB
 Storage size:  16 MiB

Press any key within 2 seconds to enter setup..
trying bootp protocol.... OK
Got IP address: 10.128.41.140
resolved mac address 4C:5E:0C:ED:82:8E
Gateway: 10.128.41.1
transfer started ............................... transfer ok, time=4.82s
setting up elf image... OK
jumping to kernel code
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.14.118 (dhutchison@build.linora.com) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r9534-137b98a)) #0 SMP Mon Mar 25 22:55:41 9
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: Mikrotik RouterBOARD LHGG-60ad
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] OF: reserved mem: OVERLAP DETECTED!
[    0.000000] rsvd2@87B00000 (0x87b00000--0x88000000) overlaps with smem@87e00000 (0x87e00000--0x87e80000)
[    0.000000] random: get_random_bytes called from start_kernel+0x88/0x3c0 with crng_init=0
[    0.000000] percpu: Embedded 15 pages/cpu s29324 r8192 d23924 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 28448
[    0.000000] Kernel command line: 
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Memory: 101704K/114688K available (4348K kernel code, 138K rwdata, 1200K rodata, 5120K init, 228K bss, 12984K reserved, 0K cma-reserve)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xc7800000 - 0xff800000   ( 896 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xc7000000   ( 112 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0208000 - 0xc073f358   (5341 kB)
[    0.000000]       .init : 0xc0900000 - 0xc0e00000   (5120 kB)
[    0.000000]       .data : 0xc0e00000 - 0xc0e22bc0   ( 139 kB)
[    0.000000]        .bss : 0xc0e24000 - 0xc0e5d298   ( 229 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] arch_timer: cp15 timer(s) running at 48.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 440795203732 ns
[    0.000008] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns
[    0.000023] Switching to timer-based delay loop, resolution 20ns
[    0.000249] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=480000)
[    0.000268] pid_max: default: 32768 minimum: 301
[    0.000419] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000439] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.001098] CPU: Testing write buffer coherency: ok
[    0.001890] Setting up static identity map for 0x80300000 - 0x80300060
[    0.002050] Hierarchical SRCU implementation.
[    0.002759] smp: Bringing up secondary CPUs ...
[    0.005680] smp: Brought up 1 node, 4 CPUs
[    0.005700] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.005709] CPU: All CPU(s) started in SVC mode.
[    0.009733] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.010013] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.010042] futex hash table entries: 1024 (order: 4, 65536 bytes)
[    0.010297] pinctrl core: initialized pinctrl subsystem
[    0.011251] NET: Registered protocol family 16
[    0.011644] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.012731] cpuidle: using governor ladder
[    0.012776] cpuidle: using governor menu
[    0.027443] usbcore: registered new interface driver usbfs
[    0.027510] usbcore: registered new interface driver hub
[    0.027593] usbcore: registered new device driver usb
[    0.027656] pps_core: LinuxPPS API ver. 1 registered
[    0.027666] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.027691] PTP clock support registered
[    0.028874] clocksource: Switched to clocksource arch_sys_counter
[    0.029725] NET: Registered protocol family 2
[    0.030426] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.030460] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
[    0.030491] TCP: Hash tables configured (established 1024 bind 1024)
[    0.030612] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.030653] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.030862] NET: Registered protocol family 1
[    0.111468] No memory allocated for crashlog
[    0.111698] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    0.114961] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.114975] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.120890] io scheduler noop registered
[    0.120909] io scheduler deadline registered (default)
[    0.122179] OF: PCI: host bridge /soc/pci@40000000 ranges:
[    0.122217] OF: PCI:    IO 0x40200000..0x402fffff -> 0x40200000
[    0.122238] OF: PCI:   MEM 0x40300000..0x40ffffff -> 0x40300000
[    1.238876] qcom-pcie 40000000.pci: phy link never came up
[    1.248907] qcom-pcie 40000000.pci: cannot initialize host
[    1.249030] qcom-pcie: probe of 40000000.pci failed with error -110
[    1.250391] bam-dma-engine 8e04000.dma: num-channels unspecified in dt
[    1.250411] bam-dma-engine 8e04000.dma: num-ees unspecified in dt
[    1.251059] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[    1.251150] tcsr 1953000.ess_tcsr: setting ess interface select = 1
[    1.251227] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[    1.251446] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.252024] msm_serial 78af000.serial: msm_serial: detected port #0
[    1.252071] msm_serial 78af000.serial: uartclk = 1843200
[    1.252125] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 25, base_baud = 115200) is a MSM
[    1.252152] msm_serial: console setup on port #0
[    1.800704] console [ttyMSM0] enabled
[    1.805570] msm_serial: driver initialized
[    1.813477] loop: module loaded
[    1.814601] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    1.816771] m25p80 spi0.0: unrecognized JEDEC id bytes: ff, ff, ff
[    1.823308] m25p80: probe of spi0.0 failed with error -2
[    1.829813] libphy: ipq40xx_mdio: probed
[    1.875038] libphy: Fixed MDIO Bus: probed
[    2.018903] EDMA using MAC@ - using
[    2.018922] 32:65:09:d8:d8:3b
[    2.024455] i2c /dev entries driver
[    2.051764] NET: Registered protocol family 10
[    2.053171] Segment Routing with IPv6
[    2.055188] NET: Registered protocol family 17
[    2.059277] 8021q: 802.1Q VLAN Support v1.8
?[    2.080639] Freeing unused kernel memory: 5120Ker
[    2.147355] init: Console is alive
[    2.147570] init: - watchdog -
[    2.157271] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.170447] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.189518] init: - preinit -
[    2.427408] random: jshn: uninitialized urandom read (4 bytes read)
[    2.468228] random: jshn: uninitialized urandom read (4 bytes read)
get_mac_binary: file  not found!
[    2.530711] random: jshn: uninitialized urandom read (4 bytes read)
[    2.765871] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    5.938651] procd: - early -
[    5.938792] procd: - watchdog -
[    6.600047] procd: - watchdog -
[    6.602952] procd: - ubus -
[    6.614263] urandom_read: 5 callbacks suppressed
[    6.614274] random: ubusd: uninitialized urandom read (4 bytes read)
[    6.663683] random: ubusd: uninitialized urandom read (4 bytes read)
[    6.675654] procd: - init -
Please press Enter to activate this console.
[    6.818768] kmodloader: loading kernel modules from /etc/modules.d/*
[    6.823921] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    6.833319] ip_tables: (C) 2000-2006 Netfilter Core Team
[    6.838317] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[    6.868674] xt_time: kernel timezone is -0000
[    6.875479] PPP generic driver version 2.4.2
[    6.876573] NET: Registered protocol family 24
[    6.880994] kmodloader: done loading kernel modules from /etc/modules.d/*

@subixonfire when you found the memory chip changed, I pulled DTS out of RouterOS mtdblock1 and found:

00017190  6d 65 6d 6f 72 79 40 38  30 30 30 30 30 30 30 00  |memory@80000000.|
000171a0  00 00 00 03 00 00 00 07  00 00 00 a4 6d 65 6d 6f  |............memo|
000171b0  72 79 00 00 00 00 00 03  00 00 00 08 00 00 00 be  |ry..............|
000171c0  80 00 00 00 10 00 00 00  00 00 00 02 00 00 00 01  |................|
000171d0  72 65 73 65 72 76 65 64  2d 6d 65 6d 6f 72 79 00  |reserved-memory.|
000171e0  00 00 00 03 00 00 00 04  00 00 00 00 00 00 00 01  |................|
000171f0  00 00 00 03 00 00 00 04  00 00 00 0f 00 00 00 01  |................|
00017200  00 00 00 03 00 00 00 00  00 00 00 ee 00 00 00 01  |................|
00017210  72 73 76 64 31 40 38 37  30 30 30 30 30 30 00 00  |rsvd1@87000000..|
00017220  00 00 00 03 00 00 00 08  00 00 00 be 87 00 00 00  |................|
00017230  00 50 00 00 00 00 00 03  00 00 00 00 00 00 07 a1  |.P..............|
00017240  00 00 00 02 00 00 00 01  77 69 66 69 5f 64 75 6d  |........wifi_dum|
00017250  70 40 38 37 35 30 30 30  30 30 00 00 00 00 00 03  |p@87500000......|
00017260  00 00 00 08 00 00 00 be  87 50 00 00 00 60 00 00  |.........P...`..|
00017270  00 00 00 03 00 00 00 00  00 00 07 a1 00 00 00 02  |................|
00017280  00 00 00 01 72 73 76 64  32 40 38 37 42 30 30 30  |....rsvd2@87B000|
00017290  30 30 00 00 00 00 00 03  00 00 00 08 00 00 00 be  |00..............|
000172a0  87 b0 00 00 00 50 00 00  00 00 00 03 00 00 00 00  |.....P..........|
000172b0  00 00 07 a1 00 00 00 02  00 00 00 02 00 00 00 01  |................|

I then updated memory size, as well as added "reserved-memory" stanza with same values ( found on http://wiki.dreamrunner.org/public_html/Embedded-System/Qcom-ipq40xx/ipq40xx-device-tree-overview.html )

Here is my hand-hacked LHG60 DTS changes:

memory {
                device_type = "memory";
                reg = <0x80000000 0x08000000>; /* 128MB */
        };

        reserved-memory {
                #address-cells = <1>;
                #size-cells = <1>;
                ranges;
                rsvd1@87000000 {
                        /* Reserved for other subsystem */
                        reg = <0x87000000 0x500000>;
                        no-map;
                };
                wifi_dump@87500000 {
                        reg = <0x87500000 0x600000>;
                        no-map;
                };

                rsvd2@87B00000 {
                        /* Reserved for other subsystem */
                        reg = <0x87B00000 0x500000>;
                        no-map;
                };
        };

Here is full DTS file so you can test:

/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
 * Copyright (c) 2019, Robert Marko <robimarko@gmail.com>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 *
 */

#include "qcom-ipq4019.dtsi"
#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
#include <dt-bindings/soc/qcom,tcsr.h>

/ {
	model = "Mikrotik RouterBOARD LHGG-60ad";
	compatible = "mikrotik,lhgg-60ad";

	chosen {
		stdout-path = "serial0:115200n8";
	};

	memory {
                device_type = "memory";
                reg = <0x80000000 0x08000000>; /* 128MB */
        };

        reserved-memory {
                #address-cells = <1>;
                #size-cells = <1>;
                ranges;
                rsvd1@87000000 {
                        /* Reserved for other subsystem */
                        reg = <0x87000000 0x500000>;
                        no-map;
                };
                wifi_dump@87500000 {
                        reg = <0x87500000 0x600000>;
                        no-map;
                };

                rsvd2@87B00000 {
                        /* Reserved for other subsystem */
                        reg = <0x87B00000 0x500000>;
                        no-map;
                };
        };

	aliases {
		led-boot = &user;
		led-failsafe = &user;
		led-running = &user;
		led-upgrade = &user;
	};

	soc {
		mdio@90000 {
			status = "okay";
		};

		counter@4a1000 {
			compatible = "qcom,qca-gcnt";
			reg = <0x4a1000 0x4>;
		};

		tcsr@1949000 {
			compatible = "qcom,tcsr";
			reg = <0x1949000 0x100>;
			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
		};

		ess_tcsr@1953000 {
			compatible = "qcom,tcsr";
			reg = <0x1953000 0x1000>;
			qcom,ess-interface-select = <TCSR_ESS_PSGMII_RGMII5>;
		};

		tcsr@1957000 {
			compatible = "qcom,tcsr";
			reg = <0x1957000 0x100>;
			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
		};

		crypto@8e3a000 {
			status = "okay";
		};

		watchdog@b017000 {
			status = "okay";
		};

		ess-switch@c000000 {
			switch_mac_mode = <0x3>; /* mac mode for RGMII RMII */
			switch_lan_bmp = <0x0>; /* lan port bitmap */
			switch_wan_bmp = <0x10>; /* wan port bitmap */
		};

		edma@c080000 {
			qcom,single-phy;
			qcom,num_gmac = <1>;
			phy-mode = "rgmii-id";
			status = "okay";
		};
	};

	keys {
		compatible = "gpio-keys";

		reset {
			label = "reset";
			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};
	};

	leds {
		compatible = "gpio-leds";

		power: power {
			label = "lhgg-60ad:blue:power";
			gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
			default-state = "keep";
			panic-indicator;
		};

		user: user {
			label = "lhgg-60ad:yellow:user";
			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
		};

		wlan {
			label = "lhgg-60ad:green:wlan";
			gpios = <&tlmm 58 GPIO_ACTIVE_HIGH>;
		};

		align-left {
			label = "lhgg-60ad:green:align-left";
			gpios = <&tlmm 1 GPIO_ACTIVE_HIGH>;
		};

		align-right {
			label = "lhgg-60ad:green:align-right";
			gpios = <&tlmm 2 GPIO_ACTIVE_HIGH>;
		};

		wlan-rx {
			label = "lhgg-60ad:green:wlan-rx";
			gpios = <&tlmm 4 GPIO_ACTIVE_HIGH>;
		};

		wlan-tx {
			label = "lhgg-60ad:green:wlan-tx";
			gpios = <&tlmm 5 GPIO_ACTIVE_HIGH>;
		};
	};
};

&tlmm {
	serial_pins: serial_pinmux {
		mux {
			pins = "gpio60", "gpio61";
			function = "blsp_uart0";
			bias-disable;
		};
	};

	spi_0_pins: spi-0-pinmux {
		pinmux {
			function = "blsp_spi0";
			pins = "gpio13", "gpio14", "gpio15";
			bias-disable;
		};

		pinmux_cs {
			function = "gpio";
			pins = "gpio12";
			bias-disable;
			output-high;
		};
	};
};

&blsp_dma {
	status = "okay";
};

&blsp1_spi1 {
	pinctrl-0 = <&spi_0_pins>;
	pinctrl-names = "default";
	cs-gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>;
	status = "okay";

	m25p80@0 {
		reg = <0>;
		compatible = "jedec,spi-nor";
		spi-max-frequency = <24000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition0@0 {
				label = "RouterBoot";
				reg = <0x80000 0xe000>;
				read-only;
			};

			partition1@8e000 {
				label = "hard_config";
				reg = <0x8e000 0x01000>;
			};

			partition2@90000 {
				label = "dts_config";
				reg = <0x90000 0x10000>;
				read-only;
			};

			partition3@bd000 {
				label = "soft_config";
				reg = <0xbd000 0x01000>;
			};

			partition4@1000000 {
				compatible = "mikrotik,minor";
				label = "firmware";
				reg = <0x100000 0xf00000>;
			};
		};
	};
};

&blsp1_uart1 {
	pinctrl-0 = <&serial_pins>;
	pinctrl-names = "default";
	status = "okay";
};

&cryptobam {
	status = "okay";
};

&pcie0 {
	status = "okay";
	perst-gpio = <&tlmm 42 GPIO_ACTIVE_HIGH>;

	bridge@0,0 {
		reg = <0x00000000 0 0 0 0>;
		#address-cells = <3>;
		#size-cells = <2>;
		ranges;

		/* wil6210 802.11ad card */
		wifi: wifi@1,0 {
			status = "okay";
			/* wil6210 driver has no compatible */
			reg = <0x00010000 0 0 0 0>;
		};
	};
};

&gmac0 {
	qcom,phy_mdio_addr = <0>;
	qcom,poll_required = <1>;
	vlan_tag = <0 0x20>;
};

Can you try removing the memory node?
Linux should be able to autodetect the memory size

1 Like

Deleting the memory node makes image unbootable, autodetect fails?
Entering 0x08000000 as memory size works for all versions, as expected older 256mb version sees and uses only 128mb.

Can we somehow enter two possible memory sizes in dts, or we have to make two dts files( for 128mb and 256mb)?

Hm, then RouterBoot is most likely not injecting a blank memory node like U-boot, can you simply try including a empty memory node?

Otherwise you need 2 DTS-es

1 Like

Tryed this, didnt work...

	memory {
                device_type = "memory";
                reg = <0x80000000>; /* 128MB */
        };

Maybe to try this when i come home?

	memory {
                device_type = "memory";
                reg = <0x80000000 0x00000000>; /* 128MB */
        };

Their product spec shows 128MB of RAM, should we just leave at 128?

I tried with no luck

memory@80000000 {
         device_type = "memory";
}

Probably the best, we can allways leave some info on the wiki about 256MB models, and change needed to use all 256MB in dts...

Or leave that for later and work on making other things work....

1 Like

Simply have an empty memory node, but I dont think that it will work here.

1 Like

I'm making good progress,

have SPI Flash chip working ( pinmux gpios 55,56,57. CS is GPIO 54 )
Ethernet is also working

Created new DTS file.

root@OpenWrt:/# ifconfig eth1
eth1      Link encap:Ethernet  HWaddr DA:9D:B7:19:4C:D1  
          inet addr:10.128.41.200  Bcast:10.128.41.255  Mask:255.255.255.0
          inet6 addr: fe80::d89d:b7ff:fe19:4cd1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:723 errors:0 dropped:22 overruns:0 frame:0
          TX packets:76 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:98880 (96.5 KiB)  TX bytes:7954 (7.7 KiB)

root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 0000e000 00010000 "RouterBoot"
mtd1: 00001000 00001000 "hard_config"
mtd2: 00010000 00010000 "dts_config"
mtd3: 00001000 00001000 "soft_config"
mtd4: 00f00000 00010000 "firmware"
root@OpenWrt:/# cat /proc/cpuinfo
processor       : 0
model name      : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 67.03
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xc07
CPU revision    : 5

processor       : 1
model name      : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 67.03
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xc07
CPU revision    : 5

processor       : 2
model name      : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 67.03
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xc07
CPU revision    : 5

processor       : 3
model name      : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 67.03
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xc07
CPU revision    : 5

Hardware        : Generic DT based system
Revision        : 0000
Serial          : 0000000000000000
1 Like

USB works, usb-power-off is on GPIO 2

root@OpenWrt:/sys/class/gpio# echo 2 > export
root@OpenWrt:/sys/class/gpio# echo out > gpio2/direction 
root@OpenWrt:/sys/class/gpio# [ 74.082191] usb 1-1: USB disconnect, device number 2
root@OpenWrt:/sys/class/gpio# echo 0 > gpio2/value

root@OpenWrt:/sys/class/gpio# echo 1 > gpio2/value
root@OpenWrt:/sys/class/gpio# [ 86.462170] usb 1-1: new high-speed USB device number 3 using xhci-hcd
root@OpenWrt:/sys/class/gpio# lsusb
Bus 003 Device 001: ID 1d6b:0002
Bus 001 Device 001: ID 1d6b:0002
Bus 001 Device 003: ID 04e8:6860
Bus 004 Device 001: ID 1d6b:0003
Bus 002 Device 001: ID 1d6b:0003

Here is updated DTS file, only need to finish WiFi.

/* Copyright (c) 2015, The Linux Foundation. All rights reserved.
 * Copyright (c) 2019, David Hutchison <dhutchison@bluemesh.net>
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 *
 */

#include "qcom-ipq4019.dtsi"
#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
#include <dt-bindings/soc/qcom,tcsr.h>

/ {
	model = "Mikrotik RouterBOARD hAP AC2";
	compatible = "mikrotik,rbd52g";

	memory {
		device_type = "memory";
		reg = <0x80000000 0x08000000>; /* 128MB */
	};

	reserved-memory {
                #address-cells = <1>;
                #size-cells = <1>;
                ranges;
                rsvd1@87000000 {
                        /* Reserved for other subsystem */
                        reg = <0x87000000 0x500000>;
                        no-map;
                };
                wifi_dump@87500000 {
                        reg = <0x87500000 0x600000>;
                        no-map;
                };

                rsvd2@87B00000 {
                        /* Reserved for other subsystem */
                        reg = <0x87B00000 0x500000>;
                        no-map;
                };
	};

	chosen {
		stdout-path = "serial0:115200n8";
	};

	aliases {
		led-boot = &user;
		led-failsafe = &user;
		led-running = &user;
		led-upgrade = &user;
	};

	soc {
		mdio@90000 {
			status = "okay";
		};

		counter@4a1000 {
			compatible = "qcom,qca-gcnt";
			reg = <0x4a1000 0x4>;
		};

		tcsr@1949000 {
			compatible = "qcom,tcsr";
			reg = <0x1949000 0x100>;
			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
		};

		tcsr@194b000 {
			/* select hostmode */
			compatible = "qcom,tcsr";
			reg = <0x194b000 0x100>;
			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
			status = "okay";
		};

		ess_tcsr@1953000 {
			compatible = "qcom,tcsr";
			reg = <0x1953000 0x1000>;
			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
		};

		tcsr@1957000 {
			compatible = "qcom,tcsr";
			reg = <0x1957000 0x100>;
			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
		};

		crypto@8e3a000 {
			status = "okay";
		};

		wifi@a000000 {
                        status = "ok";
                };

                wifi@a800000 {
                        status = "ok";
                };

		usb2@60f8800 {
                        status = "okay";
                };

                usb3@8af8800 {
                        status = "okay";
                };

		watchdog@b017000 {
			status = "okay";
		};

		ess-switch@c000000 {
			status = "okay";
		};

		edma@c080000 {
			status = "okay";
		};
	};

	keys {
		compatible = "gpio-keys";

		reset {
			label = "reset";
			gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};
		
		mode {
			label = "mode";
			gpios = <&tlmm 5 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};
	};

	leds {
		compatible = "gpio-leds";

		power: power {
			label = "rbd52g:green:power";
			gpios = <&tlmm 0 GPIO_ACTIVE_HIGH>;
			default-state = "keep";
			panic-indicator;
		};

		user: user {
			label = "rbd52g:green:user";
			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
		};
	};
};

&tlmm {
	serial_pins: serial_pinmux {
		mux {
			pins = "gpio60", "gpio61";
			function = "blsp_uart0";
			bias-disable;
		};
	};

	spi_0_pins: spi-0-pinmux {
		pinmux {
			function = "blsp_spi0";
			pins = "gpio55", "gpio56", "gpio57";
			bias-disable;
		};

		pinmux_cs {
			function = "gpio";
			pins = "gpio54";
			bias-disable;
			output-high;
		};
	};
};

&blsp_dma {
	status = "okay";
};

&blsp1_spi1 {
	pinctrl-0 = <&spi_0_pins>;
	pinctrl-names = "default";
	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
	status = "okay";

	m25p80@0 {
		reg = <0>;
		compatible = "jedec,spi-nor";
		spi-max-frequency = <24000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition0@0 {
				label = "RouterBoot";
				reg = <0x80000 0xe000>;
				read-only;
			};

			partition1@8e000 {
				label = "hard_config";
				reg = <0x8e000 0x01000>;
			};

			partition2@90000 {
				label = "dts_config";
				reg = <0x90000 0x10000>;
				read-only;
			};

			partition3@bd000 {
				label = "soft_config";
				reg = <0xbd000 0x01000>;
			};

			partition4@1000000 {
				compatible = "mikrotik,minor";
				label = "firmware";
				reg = <0x100000 0xf00000>;
			};
		};
	};
};

&blsp1_uart1 {
	pinctrl-0 = <&serial_pins>;
	pinctrl-names = "default";
	status = "okay";
};

&cryptobam {
	status = "okay";
};

&usb3_hs_phy {
	status = "okay";
};

&usb3_ss_phy {
        status = "okay";
};

&usb2_hs_phy {
	status = "okay";
};
1 Like

Mikrotik has always put their radio calibration data in the hard_config. I copied over the arch/mips/ath79/routerboot.c and kludged it together to work on ARM.

I so far have the kernel reporting the following:

[    2.040067] rb: Board: RBD52G-5HacD2HnD
[    2.042339] rb: Serial Number: B4A30A591AC6
[    2.046153] rb: Running rb_sysfs_init for SysFS file
[    2.050311] rb: Search for calibration
[    2.055536] rb: Find Tag: 22

I can set the board name, serial number, and mac address now.

The RB_ID_WLAN_DATA found where the ART calibration data is located.

I couldn't get rle_decode() or lzo1x_decompress_safe() to handle this new format. For now I took the RB_ID_WLAN_DATA and passed it directly to /sys/firmware/routerboot/ext_wlan_data so we can see it.

root@OpenWrt:/sys/firmware/routerboot# hexdump -C ext_wlan_data 
00000000  4c 5a 4f 52 00 0f 44 52  45 00 01 00 3f 2f fc 20  |LZOR..DRE...?/. |
00000010  2f bd f5 02 01 fa 74 4d  28 5d a5 69 02 00 fc 20  |/.....tM(].i... |
00000020  00 2a 20 03 00 ff 60 74  90 00 17 07 06 00 ff 10  |.* ...`t........|
00000030  02 00 fe 10 33 03 00 fd  08 00 08 15 00 02 29 fe  |....3.........).|
00000040  33 01 05 00 03 33 ff f4  02 f2 ed 00 3c 14 06 00  |3....3......<...|
00000050  f8 e3 8f 3f ec 00 00 11  03 14 39 00 ff c0 10 00  |...?......9.....|
00000060  fe 90 01 04 00 fe 01 00  04 ff 2a 00 ff 0f 09 00  |..........*.....|

There is a new MAGIC header: 4c 5a 4f 52
The RB_MAGIC_ERD is still found further down: 44 52 45 00

The new header is "LZOR" since Mikrotik in the past has always used either RLE or LZO, i am speculating that "LZOR" is "lzo-rle". I am not entirely sure about that, as it appears to be a Mikrotik header.

Any ideas with how to possibly extract the ART data?

1 Like

A post was split to a new topic: Mikrotik CCR1016-12g stuck at Starting services

Is anyone booting LHGG-60ad from flash or net booting only? I read back through this thread but could not answer that for myself. The initramfs image I'm building is quite a bit larger than the mtd0 partition...

Any progress on RB3011? Are there any patches available for testing?

I would love to test and improve the port, if something is available. I have a RB3011 ready to work on this.

If I understand you correctly, Mikrotik compresses the calibration data?

On other devices with the same hardware, the calibration data seems to take 2x 12 KB:


So, it seems a bit tight to fit 24 KB of data into a 4 KB partition, even with compression! Maybe that's why they had to switch to a new compression scheme.

I have uploaded the partitions extracted from a hAP ac² device here: https://pub.polyno.me/openwrt/hap-ac2/

The "ext_wlan_data" you noticed is in mtd3_hard_config.bin, at offset 0x148 (328 decimal).

I just found out that this hard_config partition is formatted as little-endian TLVs on ARM, while on MIPS it was big-endian TLVs. Other than that it's the same overall format.

Regarding the calibration data itself, I extracted the ath10k calibration data from another device that uses the same hardware, to see what kind of format we should obtain after decoding: https://pub.polyno.me/openwrt/nbg6617/
After playing a bit with decoding, the Mikrotik does seem to be using some sort of RLE encoding. I managed to get an output that looks very much like the expected format (but it's not complete yet)

I'm getting a 403 forbidden error while trying to download your calibration bin files.

How did you extract/decode the data so far?

I'll post my routerboot.c modifications here in a little bit.

Oops, fixed the download links.

You mean the data from the nbg6617? I just copied it from /lib/firmware/ath10k/, the hotplug script extracts the calibration data there. In the non-mikrotik world this is just locating the data on flash + copying it.

If you are changing routerboot.c, make sure to read package/boot/rbcfg/src/main.c, they already handle things like endianness.

In my experiments with decoding the LZOR data, I wrote a small python script for RLE decoding, and I also used the miniLZO source for raw LZO decompression. So far, neither of those gave a complete result yet :frowning: