Support for Mikrotik RB3011UiAS-RM?

Most likely we have a new revision of QCA8075 here.

It could easily be, but I doubt it as MDIO id of 4dd0b1 actually matches one of 2 listed in OpenWrt driver.
Only one I know that could here is @chunkeey
He is kind of IPQ40xx expert

I finished working on the code that allows to inject callbacks into any function of RouterOS kernel. As it turned out, the management of the QCA8075 through mdio is done from switch.ko kernel module:

	7f053000 t switch_port_mdio_write	[switch]
	7f057934 t switch_port_mdio_read	[switch]

so I injected callbacks into these two functions.
The result was a software mdio sniffer.

Every second, the switch driver polls the port status:

My mdio_read callback: 0xbe559000, 0x19, 0x1
My mdio_read callback: 0xbe55b000, 0x1b, 0x1
My mdio_read callback: 0xbe558000, 0x18, 0x1
My mdio_read callback: 0xbe55a000, 0x1a, 0x1
My mdio_read callback: 0xbe55c000, 0x1c, 0x1

If I try to disable Port5:

My mdio_write callback: 0xbe55c000, 0x1c, 0x0, 0x800

If I try to enable Port5:

My mdio_write callback: 0xbe55c000, 0x1c, 0x0, 0x8000
My mdio_write callback: 0xbe55c000, 0x1c, 0x0, 0x1200
My mdio_write callback: 0xbe55c000, 0x1c, 0x0, 0x9000
My mdio_write callback: 0xbe55c000, 0x1c, 0x0, 0x1200
My mdio_write callback: 0xbe55c000, 0x1c, 0x0, 0x1200
    and then port status reading:
My mdio_read callback: 0xbe55c000, 0x1c, 0x0
My mdio_read callback: 0xbe55c000, 0x1c, 0x4
My mdio_read callback: 0xbe55c000, 0x1c, 0x5
My mdio_read callback: 0xbe55c000, 0x1c, 0x9
My mdio_read callback: 0xbe55c000, 0x1c, 0xa


So, mdio phy_ids for ports is 0x18 .. 0x1c !

Hey. I fix U-Boot network:

(IPQ40xx) # ping 172.20.1.1
miiphy_init
No ART partition found
MAC0 addr:0:3:7f:ba:db:ad
Allocating IPQ MDIO bus
mdio_register: device name 'IPQ MDIO0'
PHY ID1: 0x4d
PHY ID2: 0xd0b1
qca8075_id = 4dd0b1
ipq40xx_ess_sw_init done
eth0
eth0 PHY0 up Speed :1000 Full duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 up Speed :1000 Full duplex
Using eth0 device

diff --git a/uboot/drivers/net/ipq40xx/ipq40xx_qca8075.c b/uboot/drivers/net/ipq40xx/ipq40xx_qca8075.c
index cb04a05..b8b2db3 100644
--- a/uboot/drivers/net/ipq40xx/ipq40xx_qca8075.c
+++ b/uboot/drivers/net/ipq40xx/ipq40xx_qca8075.c
@@ -28,12 +28,20 @@ static u32 qca8075_id;
 static u16 qca8075_phy_reg_write(u32 dev_id, u32 phy_id,
                u32 reg_id, u16 reg_val)
 {
+       u32 _phy_id = phy_id;
+       if(phy_id < 0x5)
+               phy_id += 0x18;
+       //printf("0x%x(0x%x), 0x%x, 0x%x\n", phy_id, _phy_id, reg_id, reg_val);
        ipq40xx_mdio_write(phy_id, reg_id, reg_val);
        return 0;
 }
 
 u16 qca8075_phy_reg_read(u32 dev_id, u32 phy_id, u32 reg_id)
 {
+       u32 _phy_id = phy_id;
+       if(phy_id < 0x5)
+               phy_id += 0x18;
+       //printf("0x%x(0x%x), 0x%x\n", phy_id, _phy_id, reg_id);
        return ipq40xx_mdio_read(phy_id, reg_id, NULL);
 }

And finally, after many hours of reverse engineering, network on RB450Gx4 works !!!

RouterBOOT booter 6.43.12

RB450Gx4

CPU frequency: 716 MHz
  Memory size: 1024 MiB
    NAND size: 512 MiB

Press any key within 2 seconds to enter setup..
trying bootp protocol.... OK
Got IP address: 172.20.1.51
resolved mac address 0C:54:A5:45:C4:E9
Gateway: 172.20.1.1
transfer started .................................. transfer ok, time=3.82s
setting up elf image... OK
jumping to kernel code

TEXT_BASE = 0x81820000

Kernel header:
  ih_magic = 27051956. magic OK
  ih_size = 4445819
  ih_name = 'ARM OpenWrt Linux-4.14.98'

Copy kernel...Done
Starting kernel at 0x80208000

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.14.98 (root@adron-nout.yapic.net) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r9274-ab185
40)) #0 SMP Mon Feb 11 18:04:06 2019
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: Meraki MR33 Access Point
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] random: get_random_bytes called from start_kernel+0x88/0x3c0 with crng_init=0
[    0.000000] percpu: Embedded 15 pages/cpu @cfdaf000 s29324 r8192 d23924 u61440
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64512
[    0.000000] Kernel command line: 
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 242792K/260096K available (4216K kernel code, 137K rwdata, 1172K rodata, 8192K init, 228K b
ss, 17304K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0xd0800000 - 0xff800000   ( 752 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xd0000000   ( 256 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .text : 0xc0208000 - 0xc071e048   (5209 kB)
[    0.000000]       .init : 0xc0900000 - 0xc1100000   (8192 kB)
[    0.000000]       .data : 0xc1100000 - 0xc1122640   ( 138 kB)
[    0.000000]        .bss : 0xc1124000 - 0xc115d258   ( 229 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[    0.000000] arch_timer: cp15 timer(s) running at 48.00MHz (virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0xb11fd3bfb, max_idle_ns: 4407952
03732 ns
[    0.000007] sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 4398046511096ns
[    0.000021] Switching to timer-based delay loop, resolution 20ns
[    0.000237] Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=4800
00)
[    0.000255] pid_max: default: 32768 minimum: 301
[    0.000391] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000407] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000998] CPU: Testing write buffer coherency: ok
[    0.001642] Setting up static identity map for 0x80300000 - 0x80300060
[    0.001780] Hierarchical SRCU implementation.
[    0.002400] smp: Bringing up secondary CPUs ...
[    0.004999] smp: Brought up 1 node, 4 CPUs
[    0.005019] SMP: Total of 4 processors activated (384.00 BogoMIPS).
[    0.005027] CPU: All CPU(s) started in SVC mode.
[    0.008722] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.008879] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.008902] futex hash table entries: 1024 (order: 4, 65536 bytes)
[    0.009073] pinctrl core: initialized pinctrl subsystem
[    0.009891] NET: Registered protocol family 16
[    0.010201] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.011183] cpuidle: using governor ladder
[    0.011227] cpuidle: using governor menu
[    0.025468] usbcore: registered new interface driver usbfs
[    0.025538] usbcore: registered new interface driver hub
[    0.025614] usbcore: registered new device driver usb
[    0.025658] pps_core: LinuxPPS API ver. 1 registered
[    0.025667] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.025690] PTP clock support registered
[    0.026758] clocksource: Switched to clocksource arch_sys_counter
[    0.027520] NET: Registered protocol family 2
[    0.028091] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    0.028133] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    0.028184] TCP: Hash tables configured (established 2048 bind 2048)
[    0.028291] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.028327] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.028508] NET: Registered protocol family 1
[    0.110214] No memory allocated for crashlog
[    0.110403] workingset: timestamp_bits=30 max_order=16 bucket_order=0
[    0.113500] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.113514] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.119032] io scheduler noop registered
[    0.119050] io scheduler deadline registered (default)
[    0.121077] bam-dma-engine 8e04000.dma: num-channels unspecified in dt
[    0.121094] bam-dma-engine 8e04000.dma: num-ees unspecified in dt
[    0.122303] tcsr 1953000.ess_tcsr: setting ess interface select = 0
[    0.122381] tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
[    0.122450] tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
[    0.122661] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.123184] msm_serial 78af000.serial: msm_serial: detected port #0
[    0.123228] msm_serial 78af000.serial: uartclk = 1843200
[    0.123274] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 26, base_baud = 115200) is a MSM
[    0.123299] msm_serial: console setup on port #0
[    0.623749] console [ttyMSM0] enabled
[    0.628708] msm_serial 78b0000.serial: msm_serial: detected port #1
[    0.632002] msm_serial 78b0000.serial: uartclk = 48000000
[    0.638115] 78b0000.serial: ttyMSM1 at MMIO 0x78b0000 (irq = 27, base_baud = 3000000) is a MSM
[    0.643811] msm_serial: driver initialized
[    0.656071] loop: module loaded
[    0.657611] nand: device found, Manufacturer ID: 0x98, Chip ID: 0xdc
[    0.659225] nand: Toshiba NAND 512MiB 3,3V 8-bit
[    0.665823] nand: 512 MiB, SLC, erase size: 256 KiB, page size: 4096, OOB size: 128
[    0.670549] 12 fixed-partitions partitions found on MTD device qcom_nand.0
[    0.677822] Creating 12 MTD partitions on "qcom_nand.0":
[    0.684754] 0x000000000000-0x000000100000 : "sbl1"
[    0.691714] 0x000000100000-0x000000200000 : "mibib"
[    0.696250] 0x000000200000-0x000000300000 : "bootconfig"
[    0.701003] 0x000000300000-0x000000400000 : "qsee"
[    0.706543] 0x000000400000-0x000000500000 : "qsee_alt"
[    0.711168] 0x000000500000-0x000000580000 : "cdt"
[    0.715834] 0x000000580000-0x000000600000 : "cdt_alt"
[    0.720637] 0x000000600000-0x000000680000 : "ddrparams"
[    0.725651] 0x000000700000-0x000000900000 : "u-boot"
[    0.731971] 0x000000900000-0x000000b00000 : "u-boot-backup"
[    0.737161] 0x000000b00000-0x000000b80000 : "ART"
[    0.741187] 0x000000c00000-0x000007c00000 : "ubi"
[    0.761938] random: fast init done
[    0.838262] libphy: ipq40xx_mdio: probed
[    0.904314] ESS reset ok!
[    0.934620] ESS reset ok!
[    1.367143] libphy: Fixed MDIO Bus: probed
[    1.368034] EDMA using MAC@ - using
[    1.368048] 62:b5:22:3e:0b:de
[    1.374207] EDMA using MAC@ - using
[    1.374219] 1a:37:43:d9:24:cc
[    1.477739] i2c /dev entries driver
[    1.478017] i2c_qup 78b7000.i2c: using default clock-frequency 100000
[    1.697833] i2c_qup 78b8000.i2c: using default clock-frequency 100000
[    1.727757] NET: Registered protocol family 10
[    1.729069] Segment Routing with IPv6
[    1.731175] NET: Registered protocol family 17
[    1.735152] 8021q: 802.1Q VLAN Support v1.8
[    1.739243] Registering SWP/SWPB emulation handler
[    1.748471] UBI: auto-attach mtd11
[    1.748509] ubi0: attaching mtd11
[    2.794073] ubi0: scanning is finished
[    2.794130] ubi0 error: ubi_read_volume_table: the layout volume was not found
[    2.796904] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd11, error -22
[    2.803960] UBI error: cannot attach mtd11
[    2.8�[    2.828229] Freeing unused kernel memory: 8192K
[    2.886442] init: Console is alive
[    2.886660] init: - watchdog -
[    2.896120] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.904161] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.907079] init: - preinit -
[    3.010870] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    3.010957] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    6.163587] procd: - early -
[    6.163694] procd: - watchdog -
[    6.817835] procd: - watchdog -
[    6.820579] procd: - ubus -
[    6.840613] random: ubusd: uninitialized urandom read (4 bytes read)
[    6.881453] random: ubusd: uninitialized urandom read (4 bytes read)
[    6.884088] random: ubusd: uninitialized urandom read (4 bytes read)
[    6.888333] procd: - init -
Please press Enter to activate this console.
[    7.020523] kmodloader: loading kernel modules from /etc/modules.d/*
[    7.023650] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    7.032825] Loading modules backported from Linux version v4.19.7-0-g61c68f2a2af0
[    7.032865] Backport generated by backports.git v4.19.7-1-0-g148b072d
[    7.041656] ip_tables: (C) 2000-2006 Netfilter Core Team
[    7.050053] nf_conntrack version 0.5.0 (4096 buckets, 16384 max)
[    7.075400] xt_time: kernel timezone is -0000
[    7.100121] PPP generic driver version 2.4.2
[    7.101013] NET: Registered protocol family 24
[    7.117408] kmodloader: done loading kernel modules from /etc/modules.d/*
[    8.200751] urandom_read: 5 callbacks suppressed
[    8.200762] random: jshn: uninitialized urandom read (4 bytes read)
[    8.242457] random: jshn: uninitialized urandom read (4 bytes read)
[   10.952548] br-lan: port 1(eth0) entered blocking state
[   10.952597] br-lan: port 1(eth0) entered disabled state
root@Owl-rb3011-1:/# ping 172.20.1.1
PING 172.20.1.1 (172.20.1.1): 56 data bytes
64 bytes from 172.20.1.1: seq=0 ttl=64 time=0.873 ms
64 bytes from 172.20.1.1: seq=1 ttl=64 time=2.051 ms
^C
--- 172.20.1.1 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max = 0.873/1.462/2.051 ms
diff -rrNu a/mdio-ipq40xx.c b/mdio-ipq40xx.c
--- a/mdio-ipq40xx.c	2019-02-14 05:07:43.682695354 +0300
+++ b/mdio-ipq40xx.c	2019-02-14 05:04:23.000000000 +0300
@@ -71,6 +71,9 @@
 	int value = 0;
 	unsigned int cmd = 0;
 
+	if(mii_id < 0x5)
+		mii_id += 0x18;
+
 	lockdep_assert_held(&bus->mdio_lock);
 
 	if (ipq40xx_mdio_wait_busy(am))
@@ -100,6 +103,9 @@
 	struct ipq40xx_mdio_data *am = bus->priv;
 	unsigned int cmd = 0;
 
+	if(mii_id < 0x5)
+		mii_id += 0x18;
+
 	lockdep_assert_held(&bus->mdio_lock);
 
 	if (ipq40xx_mdio_wait_busy(am))

root@Owl-rb3011-1:/# swconfig list
Found: switch0 - 90000.mdio
root@Owl-rb3011-1:/# swconfig dev switch0 show | grep link
        linkdown: ???
        link: port:0 link:up speed:1000baseT full-duplex txflow rxflow 
        link: port:1 link:up speed:1000baseT full-duplex txflow rxflow auto
        link: port:2 link:down
        link: port:3 link:down
        link: port:4 link:down
        link: port:5 link:down

I made a simple patch:

cat ./704-add-mii_id_offset-vars-to-mdio-ipq40xx.patch 
diff -rNu a/drivers/net/phy/mdio-ipq40xx.c b/drivers/net/phy/mdio-ipq40xx.c
--- a/drivers/net/phy/mdio-ipq40xx.c	2019-02-14 05:07:43.000000000 +0300
+++ b/drivers/net/phy/mdio-ipq40xx.c	2019-02-14 12:57:02.000000000 +0300
@@ -20,6 +20,7 @@
 #include <linux/io.h>
 #include <linux/of_address.h>
 #include <linux/of_mdio.h>
+#include <linux/of.h>
 #include <linux/phy.h>
 #include <linux/platform_device.h>
 
@@ -42,6 +43,8 @@
 	void __iomem	*membase;
 	int		phy_irq[PHY_MAX_ADDR];
 	struct device	*dev;
+	u32 mii_id_offset_limit;
+	u32 mii_id_offset;
 };
 
 static int ipq40xx_mdio_wait_busy(struct ipq40xx_mdio_data *am)
@@ -71,6 +74,9 @@
 	int value = 0;
 	unsigned int cmd = 0;
 
+	if(mii_id < am->mii_id_offset_limit)
+		mii_id += am->mii_id_offset;
+
 	lockdep_assert_held(&bus->mdio_lock);
 
 	if (ipq40xx_mdio_wait_busy(am))
@@ -100,6 +106,9 @@
 	struct ipq40xx_mdio_data *am = bus->priv;
 	unsigned int cmd = 0;
 
+	if(mii_id < am->mii_id_offset_limit)
+		mii_id += am->mii_id_offset;
+
 	lockdep_assert_held(&bus->mdio_lock);
 
 	if (ipq40xx_mdio_wait_busy(am))
@@ -126,6 +135,7 @@
 {
 	struct ipq40xx_mdio_data *am;
 	struct resource *res;
+	struct device_node *mdio_node;
 	int i;
 
 	am = devm_kzalloc(&pdev->dev, sizeof(*am), GFP_KERNEL);
@@ -138,6 +148,10 @@
 		return -ENXIO;
 	}
 
+	mdio_node = of_node_get(pdev->dev.of_node);
+	of_property_read_u32(mdio_node, "mii_id_offset", &am->mii_id_offset);
+	of_property_read_u32(mdio_node, "mii_id_offset_limit", &am->mii_id_offset_limit);
+
 	am->membase = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(am->membase)) {
 		dev_err(&pdev->dev, "unable to ioremap registers\n");

and in DTS:

...
soc {
		mdio@90000 {
			status = "okay";
			mii_id_offset = <0x18>;
			mii_id_offset_limit = <0x5>;
		};
...
}

Really awesome job, just tried it on my board and it works.
Even port order is like I blindly configured it.

Thanks for many hours of time spent

Thank you too for your work. Then I come back to work on aux-loader. Can you show your current dts file in which the network and nand works? I want to try to pack a kernel and boot from nand.

I have been regularly updating my branch here.
Only thing that is missing is DTS property for MDIO offset, that will be added soon.

I made a simple patch:

cat ./704-add-mii_id_offset-vars-to-mdio-ipq40xx.patch 
diff -rNu a/drivers/net/phy/mdio-ipq40xx.c b/drivers/net/phy/mdio-ipq40xx.c
--- a/drivers/net/phy/mdio-ipq40xx.c	2019-02-14 05:07:43.000000000 +0300
+++ b/drivers/net/phy/mdio-ipq40xx.c	2019-02-14 12:57:02.000000000 +0300
@@ -20,6 +20,7 @@
 #include <linux/io.h>
 #include <linux/of_address.h>
 #include <linux/of_mdio.h>
+#include <linux/of.h>
 #include <linux/phy.h>
 #include <linux/platform_device.h>
 
@@ -42,6 +43,8 @@
 	void __iomem	*membase;
 	int		phy_irq[PHY_MAX_ADDR];
 	struct device	*dev;
+	u32 mii_id_offset_limit;
+	u32 mii_id_offset;
 };
 
 static int ipq40xx_mdio_wait_busy(struct ipq40xx_mdio_data *am)
@@ -71,6 +74,9 @@
 	int value = 0;
 	unsigned int cmd = 0;
 
+	if(mii_id < am->mii_id_offset_limit)
+		mii_id += am->mii_id_offset;
+
 	lockdep_assert_held(&bus->mdio_lock);
 
 	if (ipq40xx_mdio_wait_busy(am))
@@ -100,6 +106,9 @@
 	struct ipq40xx_mdio_data *am = bus->priv;
 	unsigned int cmd = 0;
 
+	if(mii_id < am->mii_id_offset_limit)
+		mii_id += am->mii_id_offset;
+
 	lockdep_assert_held(&bus->mdio_lock);
 
 	if (ipq40xx_mdio_wait_busy(am))
@@ -126,6 +135,7 @@
 {
 	struct ipq40xx_mdio_data *am;
 	struct resource *res;
+	struct device_node *mdio_node;
 	int i;
 
 	am = devm_kzalloc(&pdev->dev, sizeof(*am), GFP_KERNEL);
@@ -138,6 +148,10 @@
 		return -ENXIO;
 	}
 
+	mdio_node = of_node_get(pdev->dev.of_node);
+	of_property_read_u32(mdio_node, "mii_id_offset", &am->mii_id_offset);
+	of_property_read_u32(mdio_node, "mii_id_offset_limit", &am->mii_id_offset_limit);
+
 	am->membase = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(am->membase)) {
 		dev_err(&pdev->dev, "unable to ioremap registers\n");

and in DTS:

...
soc {
		mdio@90000 {
			status = "okay";
			mii_id_offset = <0x18>;
			mii_id_offset_limit = <0x5>;
		};
...
}

Yeah, I saw it.
Its just not in that branch as I simply hardcoded the values.
It will be there soon, I think that qcom, mdio_offset would be better as it shows that its vendor specific extension.

Ok. Like this:

diff -rNu a/drivers/net/phy/mdio-ipq40xx.c b/drivers/net/phy/mdio-ipq40xx.c
--- a/drivers/net/phy/mdio-ipq40xx.c	2019-02-14 05:07:43.000000000 +0300
+++ b/drivers/net/phy/mdio-ipq40xx.c	2019-02-14 13:20:56.055776166 +0300
@@ -20,6 +20,7 @@
 #include <linux/io.h>
 #include <linux/of_address.h>
 #include <linux/of_mdio.h>
+#include <linux/of.h>
 #include <linux/phy.h>
 #include <linux/platform_device.h>
 
@@ -42,6 +43,8 @@
 	void __iomem	*membase;
 	int		phy_irq[PHY_MAX_ADDR];
 	struct device	*dev;
+	u32 mdio_offset_limit;
+	u32 mdio_offset;
 };
 
 static int ipq40xx_mdio_wait_busy(struct ipq40xx_mdio_data *am)
@@ -71,6 +74,9 @@
 	int value = 0;
 	unsigned int cmd = 0;
 
+	if(mii_id < am->mdio_offset_limit)
+		mii_id += am->mdio_offset;
+
 	lockdep_assert_held(&bus->mdio_lock);
 
 	if (ipq40xx_mdio_wait_busy(am))
@@ -100,6 +106,9 @@
 	struct ipq40xx_mdio_data *am = bus->priv;
 	unsigned int cmd = 0;
 
+	if(mii_id < am->mdio_offset_limit)
+		mii_id += am->mdio_offset;
+
 	lockdep_assert_held(&bus->mdio_lock);
 
 	if (ipq40xx_mdio_wait_busy(am))
@@ -126,6 +135,7 @@
 {
 	struct ipq40xx_mdio_data *am;
 	struct resource *res;
+	struct device_node *mdio_node;
 	int i;
 
 	am = devm_kzalloc(&pdev->dev, sizeof(*am), GFP_KERNEL);
@@ -138,6 +148,10 @@
 		return -ENXIO;
 	}
 
+	mdio_node = of_node_get(pdev->dev.of_node);
+	of_property_read_u32(mdio_node, "mdio_offset", &am->mdio_offset);
+	of_property_read_u32(mdio_node, "mdio_offset_limit", &am->mdio_offset_limit);
+
 	am->membase = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(am->membase)) {
 		dev_err(&pdev->dev, "unable to ioremap registers\n");

Something similar.
I edited the property to be qcom,mdio_offset which is in line with other extenstions of driver.
Its pushed to the previously linked branch

Our next problem is a RouterBOOT and boot from NAND. If you just create an Kernel volume in Ubi and place a "loader" file under the name of "kernel", then nothing works!
RouterBOOT use UBI too but some modified version of it.

cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00800000 00040000 "RouterBoard NAND 1 Boot"
mtd1: 1f800000 00040000 "RouterBoard NAND 1 Main"
mtd2: 00040000 00001000 "RouterBoot"
ubi1:RouterOS on /flash type ubifs (rw,noatime)
ubi0:Kernel on /flash/boot type ubifs (rw,noatime,compr=none)
ubi1:RouterOS           450532     10716    434980   2% /flash
ubi0:Kernel               2564      1652       712  70% /flash/boot

UBIFS: mounted UBI device 0, volume 0, name "Kernel"
UBIFS: file system size:   4317184 bytes (4216 KiB, 4 MiB, 17 LEBs)
UBIFS: journal size:       2031617 bytes (1984 KiB, 1 MiB, 6 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: none
UBIFS: reserved for root:  203911 bytes (199 KiB)

ubiformat /dev/mtd0 -y
ubiattach -p /dev/mtd0
ubimkvol /dev/ubi0 -N Kernel -s 9388608
mount -t ubifs ubi0:Kernel /mnt -o compr=none

What we are going to do? Will create our own packer for the Mikrotik's version of ubifs?

Hm, its weird as all tools I have use dont indicate that anything special is being used.

Volume Kernel
	alignment	-a 1
	default_compr	-x none
	fanout		-f 8
	image_seq	-Q 3521347800
	key_hash	-k r5
	leb_size	-e 253952
	log_lebs	-l 3
	max_bud_bytes	-j 761856
	max_leb_cnt	-c 26
	min_io_size	-m 4096
	name		-N Kernel
	orph_lebs	-p 1
	peb_size	-p 262144
	sub_page_size	-s 4096
	version		-x 1
	vid_hdr_offset	-O 4096
	vol_id		-n 0

	#ubinize.ini#
	[Kernel]
	vol_name=Kernel
	vol_size=6602752
	vol_flags=0
	vol_type=dynamic
	vol_alignment=1
	vol_id=0

According to ubi_reader this should generate a image with same parameters as current UBI.

#!/bin/sh
/usr/sbin/mkfs.ubifs -m 4096 -e 253952 -c 26 -x none -f 8 -k r5 -p 1 -l 3 -r $1 img-3521347800_0.ubifs
/usr/sbin/ubinize -p 262144 -m 4096 -O 4096 -s 4096 -x 1 -Q 3521347800 -o img-3521347800.ubi img-3521347800.ini

.ini is:

[Kernel]
mode = ubi
image = img-3521347800_0.ubifs
vol_name = Kernel
vol_size = 6602752
vol_flags = 0
vol_type = dynamic
vol_alignment = 1
vol_id = 0

heh, this is something new. I know that single-PHY chips (like the AR8033/5) allow setting a PHYADDRESS by strapping different pins (kinda like on i2c). Now, I haven't seen this before with the QCA8075, but unlike it's fully-integrated QCA8337 the QCA8075/2 are in a way just a "Five Port Ethernet Transceiver" or 5 Port "Phy".

So I would recon, that the offset setting should be moved to the ar40xx driver. But ideally, @ffainelli should have a look on this as well.

@chunkeey
Any idea why only eth0 is being created?
I cant get eth1 which is WAN to be created?

swconfig clearly shows that other ports work too.

Do you have "qcom,num_gmac = <1>;" in your dts?

Yes, I do indeed.
And without it eth1 shows up.
Gotta correct port ordering now.

Ok. RouterBOOT is loading kernel but only if we use a separate ubi mtd for kernel:

nand@0 {
		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;
			partition@0 {
				label = "kernel";
				reg = <0x000000 0x800000>;
			};
			partition@1 {
				label = "ubi";
				reg = <0x800000 0x1f800000>;
			};
		};
	};

RouterBOOT booter 6.43.12

RB450Gx4

CPU frequency: 716 MHz
  Memory size: 1024 MiB
    NAND size: 512 MiB

Press any key within 2 seconds to enter setup..

loading kernel... OK
setting up elf image... OK
jumping to kernel code

TEXT_BASE = 0x81820000

Kernel header:
  ih_magic = 27051956. magic OK
  ih_size = 2117077
  ih_name = 'ARM OpenWrt Linux-4.14.98'

Copy kernel...Done
Starting kernel at 0x80208000

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.14.98 (root@adron-nout.yapic.net) (gcc version 7.4.0 (OpenWrt GCC 7.4.0 r9274-ab185
40)) #0 SMP Mon Feb 11 18:04:06 2019
...