https://www.mercusys.com/en/product/details/mr90x
0x000000000000-0x000000200000 : "boot" 0x200000
0x000000200000-0x000000300000 : "u-boot-env" 0x100000
0x000000300000-0x000003500000 : "ubi0" 0x3200000
0x000003500000-0x000006700000 : "ubi1" 0x3200000
0x000006700000-0x000006f00000 : "userconfig" 0x800000
0x000006f00000-0x000007300000 : "tp_data" 0x400000
MT7986> version
U-Boot 2022.01-rc4 (Sep 15 2022 - 20:55:22 +0800)
aarch64-openwrt-linux-musl-gcc.bin (OpenWrt GCC 8.4.0 r0-c067e3725) 8.4.0
GNU ld (GNU Binutils) 2.34
+---------------------+--------------------+---------------------+---------------------+
| UBI Image: | | | |
| Volume Name: uboot | Volume Name: uboot | Volume Name: kernel | Volume Name: rootfs |
| Volume Name: kernel | Vol ID: 0 | Vol ID: 1 | Vol ID: 2 |
| Volume Name: rootfs | Vol_type: 'static' | Vol_type: 'static' | Vol_type: 'static' |
+---------------------+--------------------+---------------------+---------------------+
uboot - secondary u-boot in UBI
ubireader_display_info ubi0
UBI File
---------------------
Min I/O: 2048
LEB Size: 126976
PEB Size: 131072
Total Block Count: 400
Data Block Count: 200
Layout Block Count: 2
Internal Volume Block Count: 0
Unknown Block Count: 198
First UBI PEB Number: 0
Image: 302291140
---------------------
Image Sequence Num: 302291140
Volume Name:uboot
Volume Name:kernel
Volume Name:rootfs
PEB Range: 2 - 399
Volume: uboot
---------------------
Vol ID: 0
Name: uboot
Block Count: 6
Volume Record
---------------------
alignment: 1
crc: '0xaea9197b'
data_pad: 0
errors: ''
flags: 0
name: 'uboot'
name_len: 5
padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
rec_index: 0
reserved_pebs: 6
upd_marker: 0
vol_type: 'static'
Volume: kernel
---------------------
Vol ID: 1
Name: kernel
Block Count: 26
Volume Record
---------------------
alignment: 1
crc: '0xca6c7adb'
data_pad: 0
errors: ''
flags: 0
name: 'kernel'
name_len: 6
padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
rec_index: 1
reserved_pebs: 26
upd_marker: 0
vol_type: 'static'
Volume: rootfs
---------------------
Vol ID: 2
Name: rootfs
Block Count: 168
Volume Record
---------------------
alignment: 1
crc: '0xe75eee88'
data_pad: 0
errors: ''
flags: 0
name: 'rootfs'
name_len: 6
padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
rec_index: 2
reserved_pebs: 168
upd_marker: 0
vol_type: 'static'
Smells a bit like TP-LINK TL-XAP6030GI
By hardware or wild things like second u-boot? 
MT7986> bootm
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-5.15.109
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000ec
Data Size: 3850909 Bytes = 3.7 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x48000000
Entry Point: 0x48000000
Hash algo: crc32
Hash value: e21f97ef
Hash algo: sha1
Hash value: e012632a97626c1c311b5e947dece7f3fddf850f
Verifying Hash Integrity ... crc32 error!
Bad hash value for 'hash@1' hash node in 'kernel-1' image node
Bad Data Hash
ERROR: can't get kernel image!
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0141 [010F]
Jump to BL
NOTICE: BL2: v2.6(release):02e589f3e-dirty
NOTICE: BL2: Built : 20:56:26, Sep 15 2022
NOTICE: WDT: disabled
NOTICE: EMI: Using DDR3 settings
NOTICE: EMI: Detected DRAM size: 512MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0x1
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.6(release):02e589f3e-dirty
NOTICE: BL31: Built : 20:56:31, Sep 15 2022
U-Boot 2022.01-rc4 (Sep 15 2022 - 20:55:22 +0800)
CPU: MediaTek MT7986
Model: mt7986-rfb
DRAM: 512 MiB
MMC: mmc@11230000: 0
Loading Environment from MTD... spi-nand: spi_nand spi_nand@1: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
OK
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 06:a8:ee:e2:20:5f
eth0: ethernet@15100000
press ctrl-c or t to go to uboot cmdline 0 new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
ubi0: attaching mtd3
ubi0: scanning is finished
ubi0: attached mtd3 (name "ubi0", size 50 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 400, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1682884766
ubi0: available PEBs: 0, total reserved PEBs: 400, PEBs reserved for bad PEB handling: 20
Reading from volume 'uboot' to 0x41dfffc0, size 0x0 ... OK
Reading from volume 'rootfs' to 0x4a000000, size 0x0 ... OK
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Booting kernel from Legacy Image at 41dfffc0 ...
Image Name: seconduboot
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 747088 Bytes = 729.6 KiB
Load Address: 00000000
Entry Point: 41e00000
Verifying Checksum ... OK
Loading Standalone Program
U-Boot 2022.01-rc4 (Sep 15 2022 - 20:54:19 +0800)
CPU: MediaTek MT7986
Model: mt7986-rfb
DRAM: 512 MiB
MMC: mmc@11230000: 0
Loading Environment from MTD... spi-nand: spi_nand spi_nand@1: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
OK
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 76:66:a5:e5:27:df
eth0: ethernet@15100000
new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
second uboot to boot kernel @46000000
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-5.15.109
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000ec
Data Size: 3850909 Bytes = 3.7 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x48000000
Entry Point: 0x48000000
Hash algo: crc32
Hash value: e21f97ef
Hash algo: sha1
Hash value: e012632a97626c1c311b5e947dece7f3fddf850f
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt mercusys_mr90x-v1 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x463ac4d0
Data Size: 32768 Bytes = 32 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 954f2e9e
Hash algo: sha1
Hash value: 9290a27149c35c8f047183145174c814f8449118
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x463ac4d0
Uncompressing Kernel Image
Loading Device Tree to 000000005f7ef000, end 000000005f7f9fff ... OK
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 5.15.109 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22702-cf8d861978) 12.2.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Sun Apr 30 19:59:26 2023
[ 0.000000] Machine model: Mercusys MR90X v1
[ 0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[ 0.000000] printk: bootconsole [uart8250] enabled
[ 0.000000] Zone ranges:
The main open points:
* Obtain root access for flashing without UART - check for Mercusys / TP-Link CVEs
* What to do with second uboot:
1. Сontinue to use the stock blob?
2. Compile the opensource U-Boot and then insert it in the UBI image at the build time?
Same HW as Mercusys Halo H90X (Wifi Mesh system)
https://www.mercusys.com/en/product/details/halo-h90x/v1/2-pack/
Really. Mercusys Halo H90X has almost the same hardware and almost the same firmware.
I've been testing my Mercusys MR90X with the OpenWrt installed for ~3 days as the main AP (dumb AP mode). Impressions are amazing. mt76 works great with the new wireless chips. These routers definitely deserves to be officially supported by the OpenWrt.
Pull Request
How easy to access the UART? Are the pins / connector populated? Is it easy to open the device? Is the device sealed with some warranty label?
It's not so easy (open the case && connect the UART). Case latches are very tight. There is no warranty label. Good news - we don't need UART to install OpenWrt. Please, check my Pull Request for the installation guide.
Awesome, thanks! 
- Login as root via SSH (router IP, port 20001, password - your web
interface password)
That root user is a restricted user in the first step as you have to start a telnetd? 
Yes. SSH "root" has no power. That's why we need to start telnetd using a tricky method to obtain the real root rights.
23.05.0-rc1 also works nice. Another merge conflict in the pull request, so I had to reboot to make a run test after the changes.
I just saw with delight that MR90X became available as a regular compiled binary in the snapshot downloads.
It seems that so far this is the only Filogic device that would right now be available in regional shops for me. But I tend to skip buying it, if 23.05 does not look like a realistic target scenario (When aiming at v24, probably more filogic devices become easily purchasable)
Does anyone know, if MR90X is in current discussion, to be added to the 23 release, e.g. 23.05(rc2)?
I have already opened a pull request that backports device support to 23.05. So there is some chance (not 100%). This depends on the committers interest/decision.
too bad, it does not seem to make it in time for rc2, which is in prep stage at the moment.
(But nevertheless many thanks for your awesome MR90X integration work)
23.05.0-rc2 has already tagged. The backport was prepared in time. At the same time Netgear WAX220 users were more active and quick (hey, @Borromini) - they first asked merge their backport despite it was opened later. 
He that blows best, bears away the horn. Why intermediate release candidate is important for you?
Sorry 
. I just happened to be on IRC when Hauke asked if it was okay to tag RC2, and I knew the WAX220 backport was still pending, so I asked if he could sneak that in before tagging.
If this device was already merged into main, a backport should be trivial. Just poke a dev on IRC I'd say.
That's ok. For me, that was a good example of positive activity. 
We should have asked Hauke too if we're interested. Personally, I'm not in a hurry and it's not difficult for me to fix the merge conflict.
I saw your backport PR on Github because I created one for my ZTE device as well. Last time, I just pinged Hauke in the Github PR.
I'm not in a hurry for any RC for my PR, do you know how many RCs we are going to have? Or does that depend on the feedback?
There will be a third release candidate at least. Not sure after that.
