Adding support for Mercusys MR90X

Mercusys MR90X

https://www.mercusys.com/en/product/details/mr90x

Hardware highlights

  • CPU: MediaTek MT7986BLA, Cortex-A53, 64-bit
  • Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
  • SPI NAND: GigaDevice GD5F1GQ5UEYIGY (128 MB)
  • RAM: MediaTek MT7986BLA (512MB)
  • WLAN 2g: MediaTek MT7975N
  • WLAN 5g: MediaTek MT7975P(N)

OpenWrt ToH

4 Likes

Stock layout

0x000000000000-0x000000200000 : "boot"        0x200000
0x000000200000-0x000000300000 : "u-boot-env"  0x100000
0x000000300000-0x000003500000 : "ubi0"        0x3200000
0x000003500000-0x000006700000 : "ubi1"        0x3200000
0x000006700000-0x000006f00000 : "userconfig"  0x800000
0x000006f00000-0x000007300000 : "tp_data"     0x400000

"boot"

MT7986> version
U-Boot 2022.01-rc4 (Sep 15 2022 - 20:55:22 +0800)

aarch64-openwrt-linux-musl-gcc.bin (OpenWrt GCC 8.4.0 r0-c067e3725) 8.4.0
GNU ld (GNU Binutils) 2.34

"ubi0" format

+---------------------+--------------------+---------------------+---------------------+
| UBI Image:          |                    |                     |                     |
| Volume Name: uboot  | Volume Name: uboot | Volume Name: kernel | Volume Name: rootfs |
| Volume Name: kernel | Vol ID: 0          | Vol ID: 1           | Vol ID: 2           |
| Volume Name: rootfs | Vol_type: 'static' | Vol_type: 'static'  | Vol_type: 'static'  |
+---------------------+--------------------+---------------------+---------------------+

uboot - secondary u-boot in UBI

ubireader_display_info ubi0
UBI File
---------------------
        Min I/O: 2048
        LEB Size: 126976
        PEB Size: 131072
        Total Block Count: 400
        Data Block Count: 200
        Layout Block Count: 2
        Internal Volume Block Count: 0
        Unknown Block Count: 198
        First UBI PEB Number: 0

        Image: 302291140
        ---------------------
                Image Sequence Num: 302291140
                Volume Name:uboot
                Volume Name:kernel
                Volume Name:rootfs
                PEB Range: 2 - 399

                Volume: uboot
                ---------------------
                        Vol ID: 0
                        Name: uboot
                        Block Count: 6

                        Volume Record
                        ---------------------
                                alignment: 1
                                crc: '0xaea9197b'
                                data_pad: 0
                                errors: ''
                                flags: 0
                                name: 'uboot'
                                name_len: 5
                                padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
                                rec_index: 0
                                reserved_pebs: 6
                                upd_marker: 0
                                vol_type: 'static'


                Volume: kernel
                ---------------------
                        Vol ID: 1
                        Name: kernel
                        Block Count: 26

                        Volume Record
                        ---------------------
                                alignment: 1
                                crc: '0xca6c7adb'
                                data_pad: 0
                                errors: ''
                                flags: 0
                                name: 'kernel'
                                name_len: 6
                                padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
                                rec_index: 1
                                reserved_pebs: 26
                                upd_marker: 0
                                vol_type: 'static'


                Volume: rootfs
                ---------------------
                        Vol ID: 2
                        Name: rootfs
                        Block Count: 168

                        Volume Record
                        ---------------------
                                alignment: 1
                                crc: '0xe75eee88'
                                data_pad: 0
                                errors: ''
                                flags: 0
                                name: 'rootfs'
                                name_len: 6
                                padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
                                rec_index: 2
                                reserved_pebs: 168
                                upd_marker: 0
                                vol_type: 'static'

Smells a bit like TP-LINK TL-XAP6030GI

3 Likes

By hardware or wild things like second u-boot? :slightly_smiling_face:

  1. I was unable to start OpenWrt from flash with an empty uboot partition in UBI due to wrong hashes.
Log
MT7986> bootm
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.109
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000ec
     Data Size:    3850909 Bytes = 3.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   e21f97ef
     Hash algo:    sha1
     Hash value:   e012632a97626c1c311b5e947dece7f3fddf850f
   Verifying Hash Integrity ... crc32 error!
Bad hash value for 'hash@1' hash node in 'kernel-1' image node
Bad Data Hash
ERROR: can't get kernel image!
  1. I managed to start OpenWrt after inserting original Mercusys second uboot blob in UBI.
Log
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0141 [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):02e589f3e-dirty
NOTICE:  BL2: Built : 20:56:26, Sep 15 2022
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 512MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0x1
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):02e589f3e-dirty
NOTICE:  BL31: Built : 20:56:31, Sep 15 2022


U-Boot 2022.01-rc4 (Sep 15 2022 - 20:55:22 +0800)

CPU:   MediaTek MT7986
Model: mt7986-rfb
DRAM:  512 MiB
MMC:   mmc@11230000: 0
Loading Environment from MTD... spi-nand: spi_nand spi_nand@1: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 06:a8:ee:e2:20:5f
eth0: ethernet@15100000
press ctrl-c or t to go to uboot cmdline                                                                                                                                                                                                   0 new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
ubi0: attaching mtd3
ubi0: scanning is finished
ubi0: attached mtd3 (name "ubi0", size 50 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 400, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1682884766
ubi0: available PEBs: 0, total reserved PEBs: 400, PEBs reserved for bad PEB handling: 20
Reading from volume 'uboot' to 0x41dfffc0, size 0x0 ... OK
Reading from volume 'rootfs' to 0x4a000000, size 0x0 ... OK
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Booting kernel from Legacy Image at 41dfffc0 ...
   Image Name:   seconduboot
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    747088 Bytes = 729.6 KiB
   Load Address: 00000000
   Entry Point:  41e00000
   Verifying Checksum ... OK
   Loading Standalone Program


U-Boot 2022.01-rc4 (Sep 15 2022 - 20:54:19 +0800)

CPU:   MediaTek MT7986
Model: mt7986-rfb
DRAM:  512 MiB
MMC:   mmc@11230000: 0
Loading Environment from MTD... spi-nand: spi_nand spi_nand@1: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 76:66:a5:e5:27:df
eth0: ethernet@15100000
new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
second uboot to boot kernel @46000000
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.109
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000ec
     Data Size:    3850909 Bytes = 3.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   e21f97ef
     Hash algo:    sha1
     Hash value:   e012632a97626c1c311b5e947dece7f3fddf850f
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt mercusys_mr90x-v1 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x463ac4d0
     Data Size:    32768 Bytes = 32 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   954f2e9e
     Hash algo:    sha1
     Hash value:   9290a27149c35c8f047183145174c814f8449118
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x463ac4d0
   Uncompressing Kernel Image
   Loading Device Tree to 000000005f7ef000, end 000000005f7f9fff ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.109 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22702-cf8d861978) 12.2.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Sun Apr 30 19:59:26 2023
[    0.000000] Machine model: Mercusys MR90X v1
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] Zone ranges:

The main open points:
* Obtain root access for flashing without UART - check for Mercusys / TP-Link CVEs
* What to do with second uboot:
1. Сontinue to use the stock blob?
2. Compile the opensource U-Boot and then insert it in the UBI image at the build time?

2 Likes

Same HW as Mercusys Halo H90X (Wifi Mesh system)

https://www.mercusys.com/en/product/details/halo-h90x/v1/2-pack/

Really. Mercusys Halo H90X has almost the same hardware and almost the same firmware.

I've been testing my Mercusys MR90X with the OpenWrt installed for ~3 days as the main AP (dumb AP mode). Impressions are amazing. mt76 works great with the new wireless chips. These routers definitely deserves to be officially supported by the OpenWrt.

3 Likes

Pull Request

4 Likes

How easy to access the UART? Are the pins / connector populated? Is it easy to open the device? Is the device sealed with some warranty label?

It's not so easy (open the case && connect the UART). Case latches are very tight. There is no warranty label. Good news - we don't need UART to install OpenWrt. Please, check my Pull Request for the installation guide.

3 Likes

Awesome, thanks! :tada:

  1. Login as root via SSH (router IP, port 20001, password - your web
    interface password)

That root user is a restricted user in the first step as you have to start a telnetd? :woman_facepalming:

Yes. SSH "root" has no power. That's why we need to start telnetd using a tricky method to obtain the real root rights.

2 Likes

23.05.0-rc1 also works nice. Another merge conflict in the pull request, so I had to reboot to make a run test after the changes.

3 Likes

I just saw with delight that MR90X became available as a regular compiled binary in the snapshot downloads.

It seems that so far this is the only Filogic device that would right now be available in regional shops for me. But I tend to skip buying it, if 23.05 does not look like a realistic target scenario (When aiming at v24, probably more filogic devices become easily purchasable)

Does anyone know, if MR90X is in current discussion, to be added to the 23 release, e.g. 23.05(rc2)?

1 Like

I have already opened a pull request that backports device support to 23.05. So there is some chance (not 100%). This depends on the committers interest/decision.

3 Likes

too bad, it does not seem to make it in time for rc2, which is in prep stage at the moment.

(But nevertheless many thanks for your awesome MR90X integration work)

23.05.0-rc2 has already tagged. The backport was prepared in time. At the same time Netgear WAX220 users were more active and quick (hey, @Borromini) - they first asked merge their backport despite it was opened later. :smile: He that blows best, bears away the horn. Why intermediate release candidate is important for you?

1 Like

Sorry :angel:. I just happened to be on IRC when Hauke asked if it was okay to tag RC2, and I knew the WAX220 backport was still pending, so I asked if he could sneak that in before tagging.

If this device was already merged into main, a backport should be trivial. Just poke a dev on IRC I'd say.

1 Like

That's ok. For me, that was a good example of positive activity. :+1: We should have asked Hauke too if we're interested. Personally, I'm not in a hurry and it's not difficult for me to fix the merge conflict.

1 Like

I saw your backport PR on Github because I created one for my ZTE device as well. Last time, I just pinged Hauke in the Github PR.

I'm not in a hurry for any RC for my PR, do you know how many RCs we are going to have? Or does that depend on the feedback?

There will be a third release candidate at least. Not sure after that.

1 Like