Acer Predator W6 with OpenWrt

Please avoid posting the same to multiple posts.

2 Likes

Looks like W6x only has 256MB rom according to most websites.
So looks inferior to me despite having similar chip

Hi @nikita2206,

I do not know why nobody is answering your question – maybe because predictions are difficult, especially when they concern the future.

What is most likely to happen if you use your Acer Predator Connect W6 with manufacturer's firmware and connect the device to the internet: The firmware (i.e. the u-boot partition) will be upgraded to the newest version (if it is not installed already). You will be able to install OpenWrt later (via the serial connection) but you will need to hold down the reset and the wps buttons during power-up to do so, and you will have to setenv bootmenu_default (and the rest of the u-boot environment) correctly to get the device to boot into OpenWrt persistently.

What might happen: If Acer releases a new firmware that prevents booting from firmware images not signed by Acer and/or using the known workarounds to manually set the actual boot partition – and if your device updates to that firmware automatically, you probably will not be able to switch to OpenWrt later. Whether that will happen is something only the people at Acer know, and maybe even they have not decided yet.

Much appreciated :pray:
Just the latest known state is what I was after, not the future, so that perfectly answers it. Thank you!

Thanks everybody who contributed in this thread, I’ve updated the device page to include the latest findings and make it a bit easier to follow for those who do this for the first time.

Questions about the setenv dual_boot.slot_0_invalid 1 (for two slots) and the bootmenu_default 7 commands.
Do I understand correctly that with these we no longer need to zero-fill the partitions with the original firmware? This is what I wrote in the device page but correct me if I got it wrong. (and it seems to work for me)
Setting bootmenu_default to 7 was meant to set it to the menu entry that doesn’t exist, on my router I have 10 entries though. Wondering if I should change it?

After actually trying again I realized that no this doesn’t work yet for me.

How should it boot into OpenWrt exactly? I have set the bootcmd to the correct one and saved it to MMC, so when I manually run boot within uboot console, it boots up OpenWrt. However it won’t do it by itself when turning on the router.

What happens when I turn on the router: if the boot slots are marked invalid, then it just stops there saying that they are invalid. If I unmark them, then it will try to boot but will say:

Trying to boot from image slot 1
Reading from 0x22880000 to 0x46000000, size 0x200 ... OK
Error: Invalid image format
Error: kernel verification failed
Firmware integrity verification failed
Failed to boot from current image slot, error -74
Saving Environment to MMC... Writing to MMC(0)... OK
Saving Environment to MMC... Writing to MMC(0)... OK
Trying to boot from image slot 0
Reading from 0x880000 to 0x46000000, size 0x200 ... OK
Reading from 0x880000 to 0x46000000, size 0x3a145c ... OK
## Checking hash(es) for FIT Image at 46000000 ...
   Hash(es) for Image 0 (kernel-1): crc32+ sha1+
   Hash(es) for Image 1 (fdt-1): crc32+ sha1+
Reading from 0x2880000 to 0x463a145c, size 0x200 ... OK
Reading from 0x2880000 to 0x463a145c, size 0x5e4efa ... OK
No rootfs node found in FIT image!
Error: rootfs verification failed
Firmware integrity verification failed
Failed to boot from next image slot, error -74
Saving Environment to MMC... Writing to MMC(0)... OK

This I’m assuming happens because it tries to load firmware from the partition that was zero-filled.

And after that it starts a failsafe UI.

Edit: I think I missed from this thread, that with the newer firmware this is what we get. No way to avoid loading into the failsafe UI. I can only think of adding a little microcontroller connected to the serial of the router, so that it can always detect a restart and press ctrl-c to exit the failsafe UI.
Edit2: Yup rigging an ESP32 to do this job was extremely easy, even if though it's an overkill microcontroller for this.

I think I missed from this thread, that with the newer firmware this is what we get. No way to avoid loading into the failsafe UI.

That's not what I experienced using W6 devices with u-boot version 2023.04. These devices are smoothly booting into OpenWrt every time without user (or µC) interaction if:

  • OpenWrt is installed on (default) /dev/mmcblk0p6
  • the first 128 bytes of /dev/mmcblk0p7 have been overwritten with zeros
  • initially the first 128 bytes of /dev/mmcblk0p5 also have been overwritten with zeros (but Acer's u-boot restores them later, so maybe it does not matter)

and with the following settings in u-boot environment (on /dev/mmcblk0p2):

  • bootcmd=mmc read 0x40000000 0x00004400 0x0010000; fdt addr $(fdtcontroladdr); fdt rm /signature; bootm 0x40000000
  • bootmenu_0=Startup system (Default)=mtkboardboot
    ...
    bootmenu_8=Start Web failsafe=httpd
    (generated by Acer)
  • bootmenu_default=9

Using these settings, values (0|1) of dual_boot.current_slot, dual_boot.slot_0_invalid, and dual_boot.slot_1_invalid do not seem to matter at all: The devices cannot boot into Acer's firmware in any slot, and it seems that they try to use bootcmd only because bootmenu_default is set to no valid menu entry. (Maybe others can chime in at this point.)

Which u-boot version is showing up in your W6's boot log?

Hey @goldwrt thanks for responding! I will need to check if your suggestion works during this week, I remember noticing that there was very little space left after installing OpenWrt so maybe I installed it on the wrong partition.
I do notice that my boot menu has more entries so it must be a different uboot version as well. I have implemented the ESP hack at the moment and now am learning my ways with OpenWrt, I realized that a nice thing about this hack is that I can make that ESP into a remote serial interface for my router btw :grin: so no need to ever tether to the router again.

I’m wondering if all 3 radios on this router should be useable to set up APs on them, or if one of the radios (presumably the 6Ghz one) isn’t supported yet, as I couldn’t get it to work.

6ghz radio is misconfigured in latest snapshot. We are missing 1 setting, also channel list is not showing up besides other options. I manged to fix it with this

uci set wireless.radio1.band='6g'
uci set wireless.radio1.channel='69'
uci commit wireless
wifi reload

WPA3 should also be enabled along with 802.11w Management Frame Protection set to Required.

Hi @dywersant,

6ghz radio is misconfigured in latest snapshot. We are missing 1 setting, ...

are you talking about snapshot r28146-52b6c92479, released on 11/22/2024?

Yes, ive managed to fix it by looking at configuration set by older snapshot version, which had 6ghz working fine.

Thank you. I downloaded that version now – just being curious. Maybe I will search for recent changes of default settings [scripts] tomorrow (when the next snapshot version will most likely be released).

Hello @dywersant,

I am sorry to inform you that I cannot reproduce the wifi misconfiguration you observed.

My W6 devices are used in production environments, so I had to use a spare W6m device for testing. It has the same wifi hardware as W6 devices and Acer's u-boot version 2022.07-rc3 pre-installed.

I upgraded the device to snapshot version r28146-52b6c92479 deleting all customizations, i.e. the wifi configuration (sysupgrade -n <image_file>). After reboot, board information, network and wifi configuration, etc. were automatically set to their defaults. As you can see, wireless.radio1.band was also set correctly:

# uci show | grep '^wireless'
wireless.radio0=wifi-device
wireless.radio0.type='mac80211'
wireless.radio0.path='soc/11280000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
wireless.radio0.band='2g'
wireless.radio0.channel='1'
wireless.radio0.htmode='HE20'
wireless.radio0.disabled='1'
wireless.default_radio0=wifi-iface
wireless.default_radio0.device='radio0'
wireless.default_radio0.network='lan'
wireless.default_radio0.mode='ap'
wireless.default_radio0.ssid='OpenWrt'
wireless.default_radio0.encryption='none'
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.path='soc/11280000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0+1'
wireless.radio1.band='6g'
wireless.radio1.channel='auto'
wireless.radio1.htmode='HE80'
wireless.radio1.disabled='1'
wireless.default_radio1=wifi-iface
wireless.default_radio1.device='radio1'
wireless.default_radio1.network='lan'
wireless.default_radio1.mode='ap'
wireless.default_radio1.ssid='OpenWrt'
wireless.default_radio1.encryption='none'
wireless.radio2=wifi-device
wireless.radio2.type='mac80211'
wireless.radio2.path='platform/soc/18000000.wifi'
wireless.radio2.band='5g'
wireless.radio2.channel='36'
wireless.radio2.htmode='HE80'
wireless.radio2.disabled='1'
wireless.default_radio2=wifi-iface
wireless.default_radio2.device='radio2'
wireless.default_radio2.network='lan'
wireless.default_radio2.mode='ap'
wireless.default_radio2.ssid='OpenWrt'
wireless.default_radio2.encryption='none'

The u-boot environment contains appropriate wifi entries:

# echo '/dev/mmcblk0p2 0x0 0x80000' > /etc/fw_env.config
# fw_printenv | grep '^[256]g' | sed -e 's/\(:..\)\{3\}$/:xx:xx:xx/' -e 's/\(Connect\|-\)..../\1xxxx/'
2gMAC=70:5A:6F:xx:xx:xx
2gpwd=Connectxxxx
2gssid=VeroW6m-xxxx-2.4GHz
5gMAC=70:5A:6F:xx:xx:xx
5gpwd=Connectxxxx
5gssid=VeroW6m-xxxx-5GHz
6gMAC=70:5A:6F:xx:xx:xx
6gpwd=Connectxxxx
6gssid=VeroW6m-xxxx-6GHz

I don't think that it's a matter of using W6(e) or W6m.

Which u-boot version is installed on your W6, did you upgrade directly from Acer's firmware, and what are the u-boot settings of your W6?

This is true, the default config is correct. Now watch what happens when i set encryption with password in Luci:

root@OpenWrt:~# uci show wireless | grep 'radio1'
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.path='soc/11280000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0+1'
wireless.radio1.htmode='HE80'
wireless.radio1.cell_density='0'
wireless.default_radio1=wifi-iface
wireless.default_radio1.device='radio1'
wireless.default_radio1.network='lan'
wireless.default_radio1.mode='ap'
wireless.default_radio1.ssid='OpenWrt'
wireless.default_radio1.encryption='sae'
wireless.default_radio1.key='xxxxxxxxxxxxxxxxxx'
wireless.default_radio1.ocv='0'

Yea, its missing settings now. Besides that the option to select channel number is missing in GUI.

Regardning fw version, not sure how to check uboot version from console, but it was the recent one, from 01.2024 if i remember correctly.

2gMAC=C0:98:79:xx:xx:xx
2gpwd=Connectxxxx
2gssid=PredatorW6-xxxx-2.4GHz
5gMAC=C0:98:79:xx:xx:xx
5gpwd=Connectxxxx
5gssid=PredatorW6-xxxx-5GHz
6gMAC=C0:98:79:xx:xx:xx
6gpwd=Connectxxxx
6gssid=PredatorW6-xxxx-6GHz

Thank you. The u-boot environment seems not to be the problem. (Acer compiled u-boot version 2023.04 in January 2024 btw, and I have not seen any newer version on W6/W6d/W6m since.)

I upgraded to (current) snapshot version r28203-f4492b6b1c and still cannot reproduce the error starting here:

# uci show wireless | grep radio1
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.path='soc/11280000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0+1'
wireless.radio1.band='6g'
wireless.radio1.channel='auto'
wireless.radio1.htmode='HE80'
wireless.radio1.disabled='1'
wireless.default_radio1=wifi-iface
wireless.default_radio1.device='radio1'
wireless.default_radio1.network='lan'
wireless.default_radio1.mode='ap'
wireless.default_radio1.ssid='OpenWrt'
wireless.default_radio1.encryption='none'

...then logon into the web interface (luci), select "Network" -> "Wireless" page, edit the default_radio1 (6 GHz) interface, select "WPA3-SAE (strong security)" encryption, enter (absolutely-safe-because-totally-unexpected) key, enable the wireless network, logout, and check the wifi configuration via command line again:

# uci show wireless | grep radio1
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.path='soc/11280000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0+1'
wireless.radio1.band='6g'
wireless.radio1.channel='auto'
wireless.radio1.htmode='HE80'
wireless.radio1.cell_density='0'
wireless.default_radio1=wifi-iface
wireless.default_radio1.device='radio1'
wireless.default_radio1.network='lan'
wireless.default_radio1.mode='ap'
wireless.default_radio1.ssid='OpenWrt'
wireless.default_radio1.encryption='sae'
wireless.default_radio1.key='nobodyexpectsthespanishinquisition!'
wireless.default_radio1.ocv='0'

Is that what you did? – Maybe the luci version does matter:

# apk list luci
luci-24.330.73959~fefb9ac noarch {feeds/luci/collections/luci} (Apache-2.0) [installed]

Old versions of luci may not handle 6 GHz settings properly.

Wipe all settings, go to wireless, edit radio1, set wpa3 with password, save, save and apply.
My Luci version is same as yours.

Speaking of 6GHz radio...

AFAICT the wireless regulatory database for the US [ https://git.kernel.org/pub/scm/linux/kernel/git/wens/wireless-regdb.git/tree/db.txt#n1932 ] forbids acting as an AP (NO-IR + 12 dBm power limit). Things work if I choose CA(lifornia) [okay really Canada] which has nearly the same rules.

See:
country US: DFS-FCC
...
# 6g band
# https://www.federalregister.gov/documents/2020/05/26/2020-11236/unlicensed-use-of-the-6ghz-band
(5925 - 7125 @ 320), (12), NO-OUTDOOR, NO-IR

vs

country CA: DFS-FCC
...
(5925 - 7125 @ 320), (12), NO-OUTDOOR

By my reading of the FCC documents, 6GHz is open to indoor low power (not weather proof) appropriately labelled ('indoor use only') APs at 18dBm (and only clients are limited -6dBm less than the AP, ie. to NO-IR 12 dBm). [You can also do higher power provided you check in an online database, but ignore that here]

I'm not sure what the right fix for this is... a new country code for US-INDOOR-AP ? Some sort of override??

Seems like the right rule would be something more like:

AP: (5925 - 7125 @ 320), (18), NO-OUTDOOR
STA: (5925 - 7125 @ 320), (12), NO-OUTDOOR, NO-IR

or

(5925 - 7125 @ 320), (18), NO-OUTDOOR, STA-NO-IR, STA-MINUS-6DBM

[and even that isn't fully correct, since you can do far more with a periodic online DB check...]

Thanks for this. This just got merged and went to snapshot build. I can finally shut off this damn blue led.

If anyone is wondering this got added in SNAPSHOT (r28214-5a4eb56a7b)
Get this packages:

apk add i2c-tools kmod-leds-ktd202x

Then use this to turn off the led. Put it in startup or something:

i2cset -f -y 0 0x68 0x2 0x0
1 Like

I would just like to add that you can do the same thing in luci by going to System-Software and install i2c-tools, the other should install automatically.
Then go to System - LED configuration, make a new activity, select - rgb:status and choose what you want it to do (always on/always off/network activity etc)