Acer Predator W6 with OpenWrt

Thanks @hackpascal for this sad information :frowning:

I was suspecting that this is the case, but could not confirm it. How do we know that full-chain secure boot is enabled?

I do not see in serial console log anything about secure boot and in U-Boot console, command 'is_sec_boot_enabled' is not available.

Thanks,
Przemek

BootROM and BL2 doesn't provide indication about whether secure boot is enabled.
But according to the BL2 boot log:

NOTICE: Verifying BL Anti-Rollback Version ... bl_ar_ver:0=0+ OK

Secure boot is the prerequisite for anti-rollback. Since anti-rollback is enabled, secure boot must also be enabled.

command 'is_sec_boot_enabled' is not available

There's no such command provided by MediaTek.

2 Likes

Thanks for double confirmation and explanation.

Indeed, I found 'is_sec_boot_enabled' command in Dynalink DL-WRX36 thread and it is based on Qualcomm, not on MediaTek.

Ok, so to sum up OpenWrt on Acer Predator W6 / W6d routers:

  1. It is possible to install vanilla OpenWrt, it needs to be done via serial connection with USB TTL adapter, there is no need to open the router, soldering is also not needed - instructions can be found in git commit (link in first post)

  2. Unfortunatelly, after every router restart it is needed to connect laptop with USB TTL adapter and interrupt autoboot to launch again vanilla OpenWrt, because image signature verification is used by stock Acer U-Boot - if autoboot is not interrupted, stock sw will be launched

  3. It is not possible to replace stock Acer U-Boot because Acer enables full-chain secure boot which means that BL2 preloader is signed and will be verified by BootROM - it is not possible to replace stock BL2 without signing it with the same RSA private key Acer is using

CONCLUSION:
Acer provided router with decent platform (2 GHz quad core CPU, 1GB RAM, 4GB eMMC), they used OpenWrt 21.02 as base for their stock firmware, however they locked U-Boot bootloader so that it is not possible to normally boot vanilla OpenWrt. The only way to boot vanilla OpenWrt is to connect serial cable, interrupt autoboot and boot OpenWrt without signature check. It needs to be done after every system restart which makes this router not suitable for daily use because for every restart it is needed to connect laptop with USB TTL adapter and interrupt autoboot.

Cheers,
Przemek

P.S. Is it possible to add link to this post in Table Of Hardware for Acer W6? By looking at ToH, this router looks like a very good choice - strong HW, support for latest release of OpenWrt, but in reality user experience is not so perfect...

3 Likes

It's such a pity to view this conclusion since Acer indeed create a geneous hardware platform. My solution is to create a simple circuit board to solve the booting problem by plugging it into Predator's UART port(drain few power from UART pin) and answer the booting message automatically. It works like a charm.
some pics

4 Likes

If you are ever interested in selling that pcb, please let me know. Iā€™m sure more people will be interested.

What is your over experience with this router?

I am also interested in buying. @pokonyan Do you plan to opensource the design?

Could something similar be done with commodity hardware, for example with an arduino or esp32?

Since I do not have the device yet, I would like to ask if anybody has tested how much power the usb 3.0 can provide. Is it the standard usb3.0 5v 900mA or higher?

Theoretically most MCU equipped with UART port can do this, but the PCBA's power consumption must stay very low otherwise the UART port of Predator's main chip might be burned out. (Not a problem if supply with external power source instead of drain from UART pin).
I'm considering to factory make a small quantity of this boot-helper PCBA, further information will be update here once happened. Who are also interested in buying have to take his/her own risk(see above), and must have some handy skills to soldering the Predator-W6's UART pin header.
This boot-helper PCBA had been tested on Predator-W6 only. Other models may be supported if give the message log.

2 Likes

Interested as well - waiting for updates :star_struck:

There seems to be also a new version added to this family of routers:

Acer Connect Vero W6m

Looking in the specs, it seems to be a cut-down version of the W6e (with the 6ghz band) , by lacking the 2.5 gbps port and the large antennas.

flash this to a rp2040 (with micropython) connect pins 4 5

also download the file do not copy paste - not sure if the escape sequence is copyable :slight_smile:

1 Like

btw has anyone worked on the leds ? can you disable them by software?

Who has requested the GPL source code from Acer for this model? Anyone?

i will do it

e: these clowns are hiding behind contact forms, serial number queries and requiring an account.

their actual mail is cc.[countrycode]@acer.com i have gone with the US one, lets see.

Hi it's my first device with openwrt ( if it works) :smiley:.
But how do I open the case without breaking it?
Can someone start a wiki page with a few informations? I already found the screws below the rubber feet's but I don't how to open the rest :confused:

Use the internal photos from https://fccid.io/HLZW6, to figure out where the latches are located.

Status update:
The boot-helper module is available now.
I'd also like to share the circuit here and encourage hobbist to build it on their own.
https://lurl.cc/djx9J

so everyone, i think i have an fix for you all and the solution :slight_smile:
first big THANKS to @blocktrron and @MyIgel for your help these evening!!!!

After you followed the instructions in the MR from blocktrron you have to do the following things:

  1. reboot the device and make sure its the same uboot version. at my system and blocktrron it was U-Boot 2022.07-rc3 (Sep 08 2022 - 12:14:58 +0800), Build: jenkins-YX6_MT7986-AX7800-197 ( version after stopping the auto boot to get the version)
  2. boot into openwrt
  3. check with cat the uvent entrys if they are the same partition like on our devices to make sure your not deleting something wrong. It should look like these:
root@OpenWrt:/# cat /sys/class/block/mmcblk0p5/uevent 
MAJOR=179
MINOR=5
DEVNAME=mmcblk0p5
DEVTYPE=partition
DISKSEQ=9
PARTN=5
PARTNAME=kernel

root@OpenWrt:/# cat /sys/class/block/mmcblk0p7/uevent 
MAJOR=179
MINOR=7
DEVNAME=mmcblk0p7
DEVTYPE=partition
DISKSEQ=9
PARTN=7
PARTNAME=kernel1
  1. (optional) make an backup and save it to your system like these for the backup:
dd if=/dev/mmcblk0p5 of=/tmp/mmcblk0p5
dd if=/dev/mmcblk0p7 of=/tmp/mmcblk0p7
tar -cvf /tmp/mmcblk0px.tar /tmp/mmcblk0p*
  1. overwrite these two partitions with 0
dd if=/dev/zero of=/dev/mmcblk0p5 bs=1 count=128
dd if=/dev/zero of=/dev/mmcblk0p7 bs=1 count=128
  1. do a sysupgrade

now everything should work without problems :smile:
please let me know if it works on your systems too if yes i will make an wiki entry :slight_smile:

2 Likes

wiki entry is created, and the commentary at the hardware page is removed that the boot is not working smoothly
https://openwrt.org/toh/acer/predator_w6#supported_versions
i filled it out as far as i could :slight_smile:

1 Like

well i just power cycled my router (i was using the official fw in the other partition) and it is very dead.

the serial reports:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 103F 0000
F3: 1006 0033 [0200]
F3: 4001 00E0 [0200]
F3: 4002 0000
F6: 102C 0000
F5: 1026 0000
00: 1005 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 103F 0000
F3: 4001 00E0 [0200]
F3: 4002 0000
F6: 102C 0000
01: 102A 0001
02: 1005 0000
BP: 2000 02C0 [0001]
EC: 0000 0000 [2000]
T0: 0000 0148 [000F]
System halt!