sil2100//vx developer log

Welcome to my personal web page


Mikrotik RouterBoard 433AH

Some time ago, I have been given the opportunity to work on the Mikrotik RouterBoard 433AH platform. The RB433AH is mostly same as the RB433, just a bit more powerful. It has the standard Atheros AR7130 chipset clocked at 640 MHz (some weaker versions involve a 300MHz processor), 128MB or RAM, 3 10/100 ethernet ports, 3 MiniPCI slots and a microSD card reader. A more detailed hardware specification can be found on the RouterBoard page here. Pretty interesting piece of hardware. One thing that we need to get ready for is the serial port, since in this platform we need a null modem cable for connection.


By default, it comes with a pre-installed RouterBOOT bootloader and a RouterOS Level5 system. The best thing is that the RB433AH chipset is supported by OpenWRT out of the box. Building the system for this platform is quite straightforward, since it only requires to choose the AR71xx target system during configuration - but the OpenWRT team provided some additional informations on their old wiki page here if necessary. Thanks to this we have an open path for lightweight hacking.

The RouterBOOT uses the 'kernel' partition for kernel load during system boot from NAND flash memory. The partition needs to be a yaffs2 filesystem with the kernel as an elf executable of the same name placed on / of the partition directory tree.

The toolchain built during OpenWRT compilation can be later used for building your own system using any cross-compilation toolkit available like Scratchbox or Fakebox (or even no toolkit at all). My choice is, of course, Fakebox - as to why, I will get back to it in a different post later. I also had to hack the toolchain a little bit, since I needed a full iberty library with all the extra object files. But having done this, it's all just compile. Building the kernel will require for us to apply the AR71xx specific patches from OpenWRT first. Now - the interesting part. Basing on the OpenWRT support patches, the flash partition table is defined statically during compile time in drivers/mtd/nand/rb4xx_nand.c. This cannot be modified by a mtdparts cmdline parameter in the kernel. The code is quite obvious. Why not mtdparts? Maybe because the RB4xx are MIPS based and make use of the RouterBOOT bootloader, which seems not to have any means of passing additional commandline arguments? Not sure.

static struct mtd_partition rb4xx_nand_partitions[] = {
        .name   = "booter",
        .offset = 0,
        .size   = (256 * 1024),
        .mask_flags = MTD_WRITEABLE,
        .name   = "kernel",
        .offset = (256 * 1024),
        .size   = (4 * 1024 * 1024) - (256 * 1024),
        .name   = "rootfs",
        .offset = MTDPART_OFS_NXTBLK,
        .size   = MTDPART_SIZ_FULL,

After examining kernel output we can notice that the RB433 has some interesting cmdline arguments passed to it during boot time, such as board, boot, HZ, console etc. Parameters that are not added in CONFIG_CMDLINE in the .config file. How do those paramters get passed to the kernel?
This is another important thing worth noticing in the RB4xx boards - the Atheros SoC has an internal PROM with some board specific data included. The MIPS-configured kernel reads the PROM during boot time and appends the parameters. All the code regarding this procedure can be found in arch/mips/ar71xx/prom.c.

With all that, the Mikrotik RouterBoard 433 platform is a relatively powerful device for experimenting. Worth noting is also the fact that the smaller RB411 uses the very same chipset, with almost no notable differences (besides lacking a few features). It can run the same firmware with no problems. Killing two birds with one stone.

EDIT: After more experiments and gaining experience, I know now that not everything is as I thought during writing this post.