Acer Predator W6
5 Likes
Thanks hé IS surely m'y future router if thé flash IS simply 
read the commit, it's the same as for the AX4200 - serial required.
1. Connect to the device using serial console.
2. Interrupt the Autoboot process when promted by sending '0' twice.
3. Serve the OpenWrt initramfs image using TFTP at 192.168.1.66. Name
the image "predator.bin" and conenct the TFTP server to the routers
LAN port.
4. Configure U-Boot to allow loading unsigned images from MMC
$ setenv bootcmd 'mmc read 0x40000000 0x00004400 0x0010000;
fdt addr $(fdtcontroladdr); fdt rm /signature; bootm 0x40000000';
saveenv
5. Transfer the image from U-Boot
$ setenv serverip 192.168.1.66; setenv ipaddr 192.168.1.1;
tftpboot 0x46000000 predator.bin; fdt addr $(fdtcontroladdr);
fdt rm /signature; bootm
6. Wait for OpenWrt to boot
7. Transfer the OpenWrt sysupgrade image to the router using scp.
8. Install OpenWrt using sysupgrade
I know what it says, no need to C&P it, the link is 4 posts up.
If you’re willing and able to connect to the serial console of this router other Filogic 830 MT7986 devices which can only be installed with serial console help could also be the model of your choice.
If not: just buy the predecessor generation: MT7622 with MT7915 WiFi controller, for example Netgear WAX206 or Linksys E8450. Stable, good OpenWrt support and WiFi 6 AX. Available today and no serial console access needed for installation.
1 Like
Thanks for thé réponse odrt
i has Never try by serial console,
I will sée on YouTube for USB to ttl and flashing etc
@oli Thanks for this, been looking at AX routers. MT7986A and 1GB ram is exciting. There is no mention if this one has a serial header already on the board. I know the Asus AX4200 does not and needs soldering. (I personally don't want to buy a router without a header, want to support companies that include those).
1 Like
if there are holes in the PCB for the pins, you don't really need to solder anything ...
1 Like
Ok thanks if it has those then that's a step in the right direction. I still don't want to buy products that support router companies without a header or some easy means of easily flashing a firmware.
didn't say it did, there's a reason why there was an if in the sentence
1 Like
This router is quite expensive in the EU at around 250€.
Yea it's $250 in US too. That's why I asked about the serial header, been looking at jumping into the AX router market trying to decide where to start.
Hello all,
@phinn Thank you for specifying this aspect,I didn't know that these routers don't come with a header, too bad then I'm still on the linksys wrt1900acs v2, it's very strange why these companies don't bring all the support for the router!
I was about to buy it, if it needs soldering, I don't bother...!
I have to admit that I am very tempted to buy this router, maybe if someone comes with a tutorial or something more explicit about the entire OpenWrt installation procedure, I will buy it
1 Like
Yes I feel the same, thanks for confirming my main device is similar to you, WRT32X.
Just want to support companies that make them flashable or at the very least throw a simple header on it if I can... Looking to jump into the AX game soon, maybe this, or maybe the DL-WRX36.
6 GHz capable devices (mixed in with other high-end features) are still expensive...
1 Like
Just got one of these today, and it does not seem like the installation instructions work 100%. Was able to go through all of the steps successfully, but the only way I can get it to actually boot OpenWRT is by interrupting the boot via serial, and then manually running the 'boot' command to trigger the custom 'bootcmd' that was set.
Without that interruption, it seems to boot into the factory firmware (I think it's executing 'mtkboardboot' instead of the bootcmd that's set).
Can anyone assist with this?
Edit: Adding 'censored' printenv output if it's of any use
MT7986> printenv
2gMAC=xx:xx:xx:xx:xx:xx
2gpwd=ConnectkR4h
2gssid=PredatorW6-ZiRt-2.4GHz
5gMAC=xx:xx:xx:xx:xx:xx
5gpwd=ConnectkR4h
5gssid=PredatorW6-ZiRt-5GHz
6gMAC=xx:xx:xx:xx:xx:xx
6gpwd=ConnectkR4h
6gssid=PredatorW6-ZiRt-6GHz
LANMAC=xx:xx:xx:xx:xx:xx
WANMAC=xx:xx:xx:xx:xx:xx
baudrate=115200
bootcmd=mmc read 0x40000000 0x00004400 0x0010000; fdt addr $(fdtcontroladdr); fdt rm /signature; bootm 0x40000000
bootdelay=5
bootmenu_0=Startup system (Default)=mtkboardboot
bootmenu_1=Upgrade firmware=mtkupgrade fw
bootmenu_2=Upgrade ATF BL2=mtkupgrade bl2
bootmenu_3=Upgrade ATF FIP=mtkupgrade fip
bootmenu_4=Upgrade eMMC partition table=mtkupgrade gpt
bootmenu_5=Upgrade single image=mtkupgrade simg
bootmenu_6=Load image=mtkload
dn=Predator Connect W6
dual_boot.current_slot=1
dual_boot.slot_0_invalid=0
dual_boot.slot_1_invalid=0
efuse=1
ethaddr=xx:xx:xx:xx:xx:xx
fdtaddr=7f7fced0
fdtcontroladdr=7f7fced0
hw_id=0100
mbsn=C2FYX6EM32QM03T1
pj_id=00
pw=xxx
qsn=YX6EST3145K2A01A
sku=US
sn=FFG22AA0013140014969M2
stderr=serial@11002000
stdin=serial@11002000
stdout=serial@11002000
Sorry to double post here, but @daniel - Since I am able to get OpenWRT to boot here and it's a Mediatek platform, do you think it would be feasible to create & flash a custom u-boot on this device in a similar fashion to others like the Linksys E8450, Xiaomi Redmi AX6000, etc.? Or I guess is there some information I can query that would help to determine the feasibility?
I guess beyond that, is there a guide you can link me to that describes how you went about creating custom u-boot(s) for multiple platforms?
I encountered the same as @diogenes: after following instructions router boots into factory Acer firmware on reboot. One has to manually enter the command 'boot' at the console in order to boot openwrt from MMC.
My guess is that the MTD image has to be updated in order for openwrt to boot from Slot 1 by default, similar to here:
Upon further inspection the OEM firmware is loading an FIT image:
Here is a snippet of the OEM boot process:
Trying to boot from image slot 1
Reading from 0x22880000 to 0x40000000, size 0x200 ... OK
Reading from 0x22880000 to 0x40000000, size 0x35e663 ... OK
## Checking hash(es) for FIT Image at 40000000 ...
Hash(es) for Image 0 (kernel-1): crc32+ sha1+
Hash(es) for Image 1 (fdt-1): crc32+ sha1+
Reading from 0x24880000 to 0x4035e664, size 0x200 ... OK
Reading from 0x24880000 to 0x4035e664, size 0x2a3f1c0 ... OK
Hash(es) for rootfs: crc32+ sha1+
Firmware integrity verification passed
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Verifying Hash Integrity ... sha1,rsa2048:fit_key+ OK
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-5.4.203
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000e8
Data Size: 3505797 Bytes = 3.3 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x48080000
Entry Point: 0x48080000
Hash algo: crc32
Hash value: 454e21a0
Hash algo: sha1
Hash value: 433d4a929e5e6a78d29f06b64d5e88ff51e3ffdd
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
Using 'config-1' configuration
Verifying Hash Integrity ... sha1,rsa2048:fit_key+ OK
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt mt7986a-ax7800-2500wan-emmc-rfb-sb device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x463580c4
Data Size: 24376 Bytes = 23.8 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 2f8a324a
Hash algo: sha1
Hash value: 51b5403350d1f908082684a48280634329b9fe2f
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x463580c4
Uncompressing Kernel Image
Loading Device Tree to 000000007f7ed000, end 000000007f7f5f37 ... OK
Starting kernel ...
According to [Tutorial] Build, customize and use MediaTek open-source U-Boot and ATF the router has an 'snand' boot partition which is booted by 'mtkboardboot' where the OEM firmware is installed. 'mtkboardboot' is the first boot menu option on reboot.
Whereas our firmware is installed on the mmc and requires the 'mmc read' command to boot.
So some possible solutions: 1) rebuild the openwrt image to be installed on snand using the 'nand_do_upgrade' command. 2) Create a uboot image with an updated boot menu to boot from mmc as the default boot
- I noticed that if I am booted into the OEM image and I press the reset button for about 20secs it will go through this sequence:
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 103F 0000
F3: 1006 0033 [0200]
F3: 4001 00E0 [0200]
F3: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [2000]
T0: 0000 027B [010F]
Jump to BL
NOTICE: BL2: v2.6(release):de65b3e9d-dirty
NOTICE: BL2: Built : 15:22:40, Oct 28 2022
NOTICE: WDT: disabled
NOTICE: CPU: MT7986 (2000MHz)
NOTICE: EMI: Using DDR4 settings
NOTICE: EMI: Detected DRAM size: 1024MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: Verifying BL Anti-Rollback Version ... bl_ar_ver:0=0+ OK
NOTICE: Verifying BL Anti-Rollback Version ... bl_ar_ver:0=0+ OK
NOTICE: Verifying BL Anti-Rollback Version ... bl_ar_ver:0=0+ OK
NOTICE: Verifying BL Anti-Rollback Version ... bl_ar_ver:0=0+ OK
NOTICE: Verifying BL Anti-Rollback Version ... bl_ar_ver:0=0+ OK
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.6(release):de65b3e9d-dirty
NOTICE: BL31: Built : 15:22:47, Oct 28 2022
U-Boot 2022.07-rc3 (Oct 28 2022 - 15:21:39 +0800), Build: jenkins-YX6_MT7986-AX7800-294
CPU: MediaTek MT7986
Model: mt7986-rfb
DRAM: 1 GiB
Core: 68 devices, 19 uclasses, devicetree: separate
MMC: mmc@11230000: 0
Setting bus to 0
Loading Environment from MMC... OK
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
Net: eth0: ethernet@15100000
mtkautoboot gpio_reset:0
Saving Environment to MMC... Writing to MMC(0)... OK
*** Upgrading ATF BL2 ***
Available load methods:
0 - TFTP client (Default)
1 - Xmodem
2 - Ymodem
3 - Kermit
4 - S-Record
Select (enter for default): Input U-Boot's IP address: 192.168.1.1
Input TFTP server's IP address: 192.168.1.66
Input IP netmask: 255.255.255.0
Input file name: YX6-sb-bl2.img
Using ethernet@15100000 device
TFTP from server 192.168.1.66; our IP address is 192.168.1.1
Filename 'YX6-sb-bl2.img'.
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; sta
Notice it is looking for a "'YX6-sb-bl2.img'" boot image, on not finding it it goes through the 'boot' command thus booting into our OpenWRT image.