MikroTik RBMetalG-52SHPacn

The MikroTik Metal 52 ac (RBMetalG-52SHPacn) is an outdoor-capable, single-radio high-power access point based on the Qualcomm Atheros QCA9556 SoC. It has one Gigabit Ethernet port (AR8033 SGMII PHY) and a single dual-band 1×1 802.11ac radio that serves either the 2.4 GHz or the 5 GHz band, paired with an external high-power amplifier. The radio chip is marked QCA9889 but is detected and driven as a QCA9887 by ath10k (same PCI ID / chip id). It is not supported by official OpenWrt; an external community port is available (see below).

Not supported by the official OpenWrt tree.

A working external port (device tree, image definition, calibration extraction, LED/GPIO kernel patch and build instructions) is maintained here:

• https://github.com/defencore/openwrt_rbmetalg-52shpacn

• External port & build guide: https://github.com/defencore/openwrt_rbmetalg-52shpacn
• Based on the wAP ac (mikrotik,routerboard-wap-g-5hact2hnd), same SoC.

Built against OpenWrt v25.12.4 (kernel 6.12, apk package manager). Sources, patches and instructions:

• https://github.com/defencore/openwrt_rbmetalg-52shpacn

The device is installed by network-booting the OpenWrt initramfs image over Ethernet and then running sysupgrade. RouterBOOT 6.48.6 requires the plain ...squashfs-sysupgrade.bin (the -v7 image is for RouterBOOT 7+ only).

1. Build (or obtain) the images from the external port. You need ...initramfs-kernel.bin (netboot) and ...squashfs-sysupgrade.bin (flash).
2. On the host, serve the initramfs over TFTP/DHCP (example uses interface enp0s8):

   cd bin/targets/ath79/mikrotik/
   sudo dnsmasq -d -p0 -i enp0s8 --bind-interfaces \
     --dhcp-authoritative --bootp-dynamic \
     -F 192.168.1.100,192.168.1.200 \
     --dhcp-boot=openwrt-ath79-mikrotik-mikrotik_routerboard-metal-52ac-initramfs-kernel.bin \
     --enable-tftp --tftp-root="$(pwd)"

3. In RouterOS arm a one-shot Ethernet boot, then power-cycle (or hold Reset until the file is sent):

   /system routerboard settings set boot-device=try-ethernet-once-then-nand

4. OpenWrt comes up in RAM at 192.168.1.1. Copy and flash the sysupgrade image (Dropbear in 25.12 has no sftp-server, use scp -O):

   scp -O openwrt-ath79-mikrotik-mikrotik_routerboard-metal-52ac-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
   ssh root@192.168.1.1
   sysupgrade -n /tmp/openwrt-ath79-mikrotik-mikrotik_routerboard-metal-52ac-squashfs-sysupgrade.bin

If you see RouterBOOT 6 and earlier requires ELF-in-YAFFS image, you flashed the -v7 image by mistake -- use the plain ...sysupgrade.bin.

The bootloader and hard_config (license/calibration) live in the read-only RouterBoot partition and are not touched by OpenWrt. To return to RouterOS, use MikroTik Netinstall. Network boot (try-ethernet-once-then-nand) remains a safety net even if a flashed image fails to start.

→ generic.debrick

→ failsafe_and_factory_reset

After flashing, proceed with Basic configuration. Wi-Fi is disabled on first boot (default OpenWrt behaviour).

The default network configuration is:

The MAC base is read from hard_config (/sys/firmware/mikrotik/hard_config/mac_base).

→ hardware.button

16 MiB SPI NOR. RouterBoot (mtd0) is read-only and holds the bootloader and hard_config (license, WLAN calibration, MAC base). mtd1-mtd5 are sub-partitions of RouterBoot; kernel/rootfs are sub-partitions of firmware; rootfs_data is the writable overlay inside rootfs (values from /proc/mtd):

Insert photo of front of the casing

Insert photo of back of the casing

Insert photo of backside label

Insert photo of PCB

→ port.serial

The kernel exposes ttyS0 at 0x18020000 (16550A, 115200 8N1)

→ port.jtag

• The radio chip is marked QCA9889 but enumerates with the QCA9887 PCI ID (168c:0050, chip id 0x004000ff) and is driven by ath10k as a QCA9887.
• A single radio serves both bands (2.4 and 5 GHz, one at a time); the SoC built-in 2.4 GHz MAC is not wired and is omitted from the device tree.
• LEDs: green:eth (SoC GPIO 16) and, on the radio chip's own GPIOs, green:wlan plus a 4-segment signal bar (green:rssilow ... green:rssihigh). The chip GPIOs are exposed via a kernel patch that re-adds the ath10k gpiochip (stripped from mainline). The ath10k-leds node therefore probes only after the radio loads (a deferred probe pending line for it during early boot is expected). The RSSI bar reflects link signal only in station/client mode; in AP mode it has nothing to measure, and the chip GPIOs are controllable only while the radio firmware is running.
• Optional MikroTik-style boot beep on the passive piezo (SoC GPIO 4) via gpioset (square wave); see the external repo.
• Package manager is apk (OpenWrt 25.x), not opkg.
• Key components (from the PCB): SoC Qualcomm Atheros QCA9556; radio QCA9889/QCA9887; RAM Nanya NT5TU32M16FG-AC (DDR2, 64 MiB); flash ISSI IS25LP128 (16 MiB SPI NOR); Ethernet PHY Qualcomm AR8033.
• RF front-end: 2x Qorvo RFPA5562 (5 GHz Wi-Fi PA, 4.9-5.925 GHz), 1x Qorvo RFPA5208 (2.4 GHz Wi-Fi PA), 1x Skyworks SKY13373 SP3T antenna/band switch -- this is the “high-power” front-end of the Metal 52 ac.
• ADC / voltage & temperature monitor: The board uses a ZillTek ZT2046Q (QFN-16, serial 4-wire SPI, internal reference) for supply-voltage and temperature monitoring. It is pin- and software-compatible with the Auramicro AUR3840GQR, XPT2046 and ADS7846. The equivalence is confirmed in the MikroTik CRS226 repair guide (p. 21, section “Temperature and Voltage monitor or LCD does not work”), where ZT2046Q and AUR3840GQR are listed as interchangeable replacements. The Linux driver is ads7846 (``CONFIG_TOUCHSCREEN_ADS7846``).

How to add tags