i have the same one, at my system its related to 5GHz device disconnection. take a look at my issue i opened at github, sadly nobody was able to help me atm. https://github.com/openwrt/mt76/issues/888
Has anybody managed to get the W6d (Non-6e variant) to work with wireless? I managed to get the latest 23.05.3 to work even after the power cycle using the guide but somehow the wireless doesn't work as the wireless hardware is different it seems 7976 (W6) vs 7975 (W6d). I thought kmod-mt7915-firmware might work but unfortunately it didn't.
Also the device updated itself upon restoring the stock firmware and now the U-Boot has a version dated Jan 2024 and there's no delay on boot. I guess I need to try:
mount_root
fw_setenv bootmenu_delay 10
fw_setenv bootdelay 10
reboot
EDIT:
I tried the 20sec reset press but seems like there's no safe mode on the new OEM fw and no way to add any bootmenu delay.
Just came to this thread as I research for a WiFi 6E (6GHz) router to purchase.
Is there an uboot binary/executable dump somewhere? I want to do a bit offline analysis and see if any uboot env variable would persist over reboot for boot command injection.
the boot is working fine for me, i had it reboot a couple of times now without problems. just follow the description on the wiki
https://openwrt.org/toh/acer/predator_w6#supported_versions
the other random crash problem should be also fixed in near time https://github.com/openwrt/mt76/issues/888#issuecomment-2295415561
2 Likes
Thanks; i totally missed that page previously.
1 Like
@bigman I'm trying to get this working myself and also have newer firmware like bigman (at cursory glance same logs). It looks like holding WPS button (not reset) during power on is the trick. Then hit '0' twice at the appropriate screen and you get to uboot.
1 Like
Ok, the device I received was apparently on old firmware, but I made the mistake of working on it while plugged into the internet, and it upgraded itself (probably overnight)...
w6$ cat p9/event_monitor/event.log | egrep -a -B7 -A2 'FW Upgrade'
[2023-02-24 07:05:13][get_versionType:23488] -------- OS Version: W6_1.30.308516 --------
[2024-08-28 02:13:28][process_CMD_UM_SET_CLIENT_READY:2817]Client Ready: DM Client
[2024-08-28 02:13:28][process_CMD_UM_SET_CLIENT_READY:2817]Client Ready: LED Client
[2024-08-28 02:13:28][process_CMD_UM_SET_CLIENT_READY:2817]Client Ready: App Adaptor
[2024-08-28 02:13:54][process_CMD_UM_SET_CLIENT_READY:2817]Client Ready: WiFi Manager
[2024-08-28 02:13:55][process_CMD_UM_SET_CLIENT_READY:2817]Client Ready: Network Server
[2024-08-28 02:14:04][process_CMD_UM_SET_CLIENT_READY:2817]Client Ready: Web Server
[2024-08-28 02:14:43][system_reboot_action:23300]ResetEvent: FW Upgrade
[2024-08-28 02:14:57][main:23676]Start UM(0) : YX5.20230823.720f28a
[2024-08-28 02:15:12][get_versionType:23491] -------- OS Version: W6_2.15.402115 --------
[2024-08-28 02:17:07][process_CMD_UM_SET_CLIENT_READY:2818]Client Ready: DM Client
[2024-08-28 02:17:07][process_CMD_UM_SET_CLIENT_READY:2818]Client Ready: App Adaptor
[2024-08-28 02:17:07][process_CMD_UM_SET_CLIENT_READY:2818]Client Ready: LED Client
[2024-08-28 02:17:07][set_update_result:1301]GET_UPDATE_RES: Status=1, Command=1, OS_VER=W6_2.15.402115, ErrMsg=None
[2024-08-28 02:17:07][process_CMD_UM_GET_UPDATE_STATUS:2212]FW Upgrade: success=1 version=W6_2.15.402115
[2024-08-28 02:18:27][process_CMD_UM_SET_CLIENT_READY:2818]Client Ready: WiFi Manager
[2024-08-28 02:18:28][process_CMD_UM_SET_CLIENT_READY:2818]Client Ready: Network Server
Furthermore the new image included a new BL2/fip.bin
w6$ cat p8/etc/vendor/cust_swver
W6_1.30.308516
w6$ cat p6/etc/vendor/cust_swver; find | egrep -i 'bl2|fip'
W6_2.15.402115
./p6/usr/bin/fip.bin
./p6/usr/bin/bl2.img
and this matches what is there now:
w6$ cmp -l mmcblk0boot0 p6/usr/bin/bl2.img
cmp: EOF on p6/usr/bin/bl2.img after byte 241720
So basically I bought a new but -presumably- working due to old fw router, and it upgraded itself before I managed to get serial/openwrt on it.
Anyone with a still automatically booting OpenWrt care to share a dump of their partitions with me? Maybe I can still flash back assuming some anti rollback hasn't been triggered...
I have noticed that the Acer Connect Vero W6m (with Wifi6E) are being sold out to very low prices at some places - it seems to share the same hardware as the Predator W6 including holes for serial flash.
Does anyone have an opinion if its a valid choice (since its one the few options for 6GHz with OpenWRT) or maybe a waste of money since its probably not going to be possible to flash ?
I managed to flash OpenWRT to the W6 that i just purchased, after workaround to the u-boot console access problem with this newer u-boot/firmware.
The stock FW i got had:
NOTICE: BL2: v2.6(release):09e9bc711-dirty
NOTICE: BL2: Built : 14:04:35, Jan 12 2023
BL31: v2.6(release):09e9bc711-dirty
BL31: Built : 14:04:42, Jan 12 2023
U-Boot 2022.07-rc3 (Jan 12 2023 - 14:03:18 +0800), Build: jenkins-YX6_MT7986-AX7800-367
[ 0.000000] Linux version 5.4.225 (jenkins@jenkins) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r0-607ce83e2)) #0 SMP Fri Oct 6 08:20:09
2023
What I found is that, i can manipulate u-boot env var from linux shell with the command fw_printenv and fw_setenv.
I ended up enabling uboot console access by simply fw_setenv bootmenu_delay 10 from linux shell, so it no longer skip the menu prompting for console access at u-boot.
Then i saw the uboot prompt like below, and was able to proceed with the rest of the steps to get OpenWRT flashed and booting automatically:
*** U-Boot Boot Menu ***
1. Startup system (Default)
2. Upgrade firmware
3. Upgrade ATF BL2
4. Upgrade ATF FIP
5. Upgrade eMMC partition table
6. Upgrade single image
7. Load image
0. U-Boot console
Hit any key to stop autoboot: 4
Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit
Yeah, the apparently critically important thing for new hardware is to not let it ever boot up (into the stock firmware) while connected to the internet. If you do it will self update (at least within a day or two) to the blocked FIP/BL2. While the fip/bl2 coming from the factory is still the hackable one.
I bought a second one and now have two predators: one that works (old fip/bl2) and one that requires ^C during the boot process (newer fip/bl2).
1 Like
It looks very ugly imho...
And you think the Predator W6 looks good ?
This would be to use the hardware inside - not the ugly case.
Yes of course - thats why i've bought my dynalink wrx36 and xiaomi ax3000t, cudy ap3000, bpi r4 and more of my play with devices. Ugly devices are for basement.
Well, it seems I'm getting some kernel panics:
[28932.331246] mt7530-mdio mdio-bus:1f lan2: Link is Down
[83852.382681] Unable to handle kernel read from unreadable memory at virtual address 0000000000000024
[83852.391720] Mem abort info:
[83852.394510] ESR = 0x0000000096000005
[83852.398244] EC = 0x25: DABT (current EL), IL = 32 bits
[83852.403542] SET = 0, FnV = 0
[83852.406581] EA = 0, S1PTW = 0
[83852.409706] FSC = 0x05: level 1 translation fault
[83852.414569] Data abort info:
[83852.417435] ISV = 0, ISS = 0x00000005
[83852.421252] CM = 0, WnR = 0
[83852.424209] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000046ffc000
[83852.430629] [0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[83852.439313] Internal error: Oops: 0000000096000005 [#1] SMP
[83852.444868] Modules linked in: nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet nft_reject_ipt
[83852.507017] CPU: 3 PID: 1631 Comm: hostapd Not tainted 5.15.162 #0
[83852.513179] Hardware name: Acer Predator W6 (DT)
[83852.517780] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[83852.524721] pc : 0xffffffc000a07284 [mt76@000000005bb08a81+0x11000]
[83852.530978] lr : 0xffffffc000a07264 [mt76@000000005bb08a81+0x11000]
[83852.537226] sp : ffffffc00a453700
[83852.540525] x29: ffffffc00a453700 x28: ffffff80008c0b80 x27: ffffffc00a453dd0
[83852.547641] x26: ffffff80000af080 x25: ffffffc008b54440 x24: 0000000000000001
[83852.554757] x23: ffffffc000a07514 x22: 0000000000000000 x21: ffffff80065d6cc8
[83852.561873] x20: ffffffc00a453748 x19: ffffff8005b62900 x18: 0000000000000000
[83852.568989] x17: 00000000000007f8 x16: ffffffc008e55000 x15: 0000000000000330
[83852.576104] x14: ffffff80065d6e28 x13: ffffff80065d6e28 x12: 0000000000000000
[83852.583218] x11: 0000000000000000 x10: ffffff80065d6e30 x9 : ffffff80065d6e28
[83852.590333] x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000000
[83852.597448] x5 : ffffffc000a41870 x4 : 0000000000000000 x3 : 0000000000000001
[83852.604563] x2 : 0000000000000000 x1 : ffffff80008c0b80 x0 : 0000000000000024
[83852.611679] Call trace:
[83852.614112] 0xffffffc000a07284 [mt76@000000005bb08a81+0x11000]
[83852.620017] 0xffffffc000a07514 [mt76@000000005bb08a81+0x11000]
[83852.625918] 0xffffffc000a075ec [mt76@000000005bb08a81+0x11000]
[83852.631819] 0xffffffc000a29ac4 [mt7915e@000000004dfbe88e+0x22000]
[83852.637979] 0xffffffc00097edd4 [mac80211@000000002cd95363+0x84000]
[83852.644226] 0xffffffc00098340c [mac80211@000000002cd95363+0x84000]
[83852.650474] 0xffffffc000984700 [mac80211@000000002cd95363+0x84000]
[83852.656722] 0xffffffc000984a8c [mac80211@000000002cd95363+0x84000]
[83852.662969] 0xffffffc00099c5d8 [mac80211@000000002cd95363+0x84000]
[83852.669218] 0xffffffc000945ec4 [cfg80211@00000000296a9de7+0x44000]
[83852.675466] 0xffffffc0086df6c4
[83852.678591] 0xffffffc0086dfb50
[83852.681716] 0xffffffc0086de838
[83852.684842] 0xffffffc0086df014
[83852.687967] 0xffffffc0086ddff4
[83852.691091] 0xffffffc0086de28c
[83852.694216] 0xffffffc0086411d0
[83852.697340] 0xffffffc0086439e0
[83852.700466] 0xffffffc008643b14
[83852.703591] 0xffffffc008643b90
[83852.706716] 0xffffffc00801f3fc
[83852.709840] 0xffffffc00801f4d0
[83852.712965] 0xffffffc008834f88
[83852.716089] 0xffffffc008835c30
[83852.719213] 0xffffffc0080115cc
[83852.722342] Code: d2800002 910092c0 52800023 f9800011 (885ffc01)
[83852.728415] ---[ end trace d9d7f29786f19592 ]---
[83852.738973] Kernel panic - not syncing: Oops: Fatal exception in interrupt
[83852.745831] SMP: stopping secondary CPUs
[83852.749740] Kernel Offset: disabled
[83852.753212] CPU features: 0x0,00000000,20000802
[83852.757726] Memory Limit: none
[83852.766657] Rebooting in 3 seconds..
4 posts were split to a new topic: Acer Vero W6m (6E) with OpenWrt
If You get any progress now?
I just get this new router very cheap, strait open and connect to UART console and get exactly same output.
Tryed to keep WPS or power buttons pressed during startup without result, still same output.
Holding the WPS button while you turn it on should allow you to interrupt the boot process and interact with u-boot. If that doesn't work... re-check your cabling.
Cabling is look good. At least I can read router TX output in console.
~1 second after power applied:
</>
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 103F 0000
F3: 1006 0033 [0200]
F3: 4001 00E0 [0200]
F3: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [2000]
T0: 0000 026F [010F]
Jump to BL
</>
~5 second later:
</>
U-Boot 2023.04 (Jan 15 2024 - 14:30:51 +0800), Build: jenkins-YX6ES_mesh-187
CPU: MediaTek MT7986
Model: mt7986-rfb
(mediatek,mt7986-emmc-rfb)
DRAM: 1 GiB
Core: 70 devices, 20 uclasses, devicetree: separate
MMC: mmc@11230000: 0
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 5.4.225 (jenkins@jenkins) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r0-607ce83e2)) #0 SMP Mon Jan 15 06:25:18 2024
[ 0.000000] Machine model: MediaTek MT7986a RFB
[ 0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[ 0.000000] printk: bootconsole [uart8250] enabled
</>
I try almost all combinations: holding WPS or reset buttons during power ON, press them strait after power ON
I try lo connect to router LAN on 192.168.76.1 in SSH, RAW, Rlogin, SCP, SFTP, FTP Alway get responce: connection refused.
Router brand new from box never get acces to internet.
Any idea?
I'm afraid since my unit is already flashed (and uboot configuration is edited) I can no longer check any more. But, from what I can recall, it needs to receive serial console input a fair bit before it prints "Booting Linux".
It should be a simple matter of powering it on while holding WPS depressed, then interrupting the normal boot process via the serial console. Either Ctrl+C or 0 should work - likely twice. It might be easiest to just hold the '0' key on your keyboard while holding WPS while powering it on.
Also as a reminder a 3-pin serial connection does not have any wires for hardware flow control - so that option should be disabled.
btw. I was able to interrupt the boot process (via serial input) and get to a prompt without even pressing WPS but the uboot console prompt ended up unusable (it seemed to be constantly reading newlines even though I wasn't pressing anything)
Also: it is entirely possible for a serial cable to have a single loose wire and for the connection to be one way. I had this problem on my RT3200 just a few days ago (though the problem was in the opposite direction).
AFAIK trying to do anything via networking is pointless until you get serial access to uboot. Furthermore the factory default IP is 192.168.1.1 (not 192.168.76.1) and IFIRC the default tftp server ip is 192.168.1.254 (though both of these ips can trivially be changed over serial via the uboot prompt - something like "env set ipaddr 192.168.x.x" "env set serverip 192.168.x.y" with "saveenv" if you want it to stick across reset/reboot)
Technically, I think if you hold reset (possibly for a long time) while powering it on, you can trigger emergency recovery mode where it will try to fetch either BL2 or FIP over TFTP, but we don't have a useful (ie. signed) payload to serve, so this doesn't help at all.
1 Like