Adding support for Mercusys MR90X

Mercusys MR90X

https://www.mercusys.com/en/product/details/mr90x

Hardware highlights

  • CPU: MediaTek MT7986BLA, Cortex-A53, 64-bit
  • Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
  • SPI NAND: GigaDevice GD5F1GQ5UEYIGY (128 MB)
  • RAM: MediaTek MT7986BLA (512MB)
  • WLAN 2g: MediaTek MT7975N
  • WLAN 5g: MediaTek MT7975P(N)
1 Like

Stock layout

0x000000000000-0x000000200000 : "boot"        0x200000
0x000000200000-0x000000300000 : "u-boot-env"  0x100000
0x000000300000-0x000003500000 : "ubi0"        0x3200000
0x000003500000-0x000006700000 : "ubi1"        0x3200000
0x000006700000-0x000006f00000 : "userconfig"  0x800000
0x000006f00000-0x000007300000 : "tp_data"     0x400000

"boot"

MT7986> version
U-Boot 2022.01-rc4 (Sep 15 2022 - 20:55:22 +0800)

aarch64-openwrt-linux-musl-gcc.bin (OpenWrt GCC 8.4.0 r0-c067e3725) 8.4.0
GNU ld (GNU Binutils) 2.34

"ubi0" format

+---------------------+--------------------+---------------------+---------------------+
| UBI Image:          |                    |                     |                     |
| Volume Name: uboot  | Volume Name: uboot | Volume Name: kernel | Volume Name: rootfs |
| Volume Name: kernel | Vol ID: 0          | Vol ID: 1           | Vol ID: 2           |
| Volume Name: rootfs | Vol_type: 'static' | Vol_type: 'static'  | Vol_type: 'static'  |
+---------------------+--------------------+---------------------+---------------------+

uboot - secondary u-boot in UBI

ubireader_display_info ubi0
UBI File
---------------------
        Min I/O: 2048
        LEB Size: 126976
        PEB Size: 131072
        Total Block Count: 400
        Data Block Count: 200
        Layout Block Count: 2
        Internal Volume Block Count: 0
        Unknown Block Count: 198
        First UBI PEB Number: 0

        Image: 302291140
        ---------------------
                Image Sequence Num: 302291140
                Volume Name:uboot
                Volume Name:kernel
                Volume Name:rootfs
                PEB Range: 2 - 399

                Volume: uboot
                ---------------------
                        Vol ID: 0
                        Name: uboot
                        Block Count: 6

                        Volume Record
                        ---------------------
                                alignment: 1
                                crc: '0xaea9197b'
                                data_pad: 0
                                errors: ''
                                flags: 0
                                name: 'uboot'
                                name_len: 5
                                padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
                                rec_index: 0
                                reserved_pebs: 6
                                upd_marker: 0
                                vol_type: 'static'


                Volume: kernel
                ---------------------
                        Vol ID: 1
                        Name: kernel
                        Block Count: 26

                        Volume Record
                        ---------------------
                                alignment: 1
                                crc: '0xca6c7adb'
                                data_pad: 0
                                errors: ''
                                flags: 0
                                name: 'kernel'
                                name_len: 6
                                padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
                                rec_index: 1
                                reserved_pebs: 26
                                upd_marker: 0
                                vol_type: 'static'


                Volume: rootfs
                ---------------------
                        Vol ID: 2
                        Name: rootfs
                        Block Count: 168

                        Volume Record
                        ---------------------
                                alignment: 1
                                crc: '0xe75eee88'
                                data_pad: 0
                                errors: ''
                                flags: 0
                                name: 'rootfs'
                                name_len: 6
                                padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
                                rec_index: 2
                                reserved_pebs: 168
                                upd_marker: 0
                                vol_type: 'static'

Smells a bit like TP-LINK TL-XAP6030GI

1 Like

By hardware or wild things like second u-boot? :slightly_smiling_face:

  1. I was unable to start OpenWrt from flash with an empty uboot partition in UBI due to wrong hashes.
Log
MT7986> bootm
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.109
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000ec
     Data Size:    3850909 Bytes = 3.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   e21f97ef
     Hash algo:    sha1
     Hash value:   e012632a97626c1c311b5e947dece7f3fddf850f
   Verifying Hash Integrity ... crc32 error!
Bad hash value for 'hash@1' hash node in 'kernel-1' image node
Bad Data Hash
ERROR: can't get kernel image!
  1. I managed to start OpenWrt after inserting original Mercusys second uboot blob in UBI.
Log
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0141 [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):02e589f3e-dirty
NOTICE:  BL2: Built : 20:56:26, Sep 15 2022
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 512MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0x1
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):02e589f3e-dirty
NOTICE:  BL31: Built : 20:56:31, Sep 15 2022


U-Boot 2022.01-rc4 (Sep 15 2022 - 20:55:22 +0800)

CPU:   MediaTek MT7986
Model: mt7986-rfb
DRAM:  512 MiB
MMC:   mmc@11230000: 0
Loading Environment from MTD... spi-nand: spi_nand spi_nand@1: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 06:a8:ee:e2:20:5f
eth0: ethernet@15100000
press ctrl-c or t to go to uboot cmdline                                                                                                                                                                                                   0 new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
ubi0: attaching mtd3
ubi0: scanning is finished
ubi0: attached mtd3 (name "ubi0", size 50 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 400, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1682884766
ubi0: available PEBs: 0, total reserved PEBs: 400, PEBs reserved for bad PEB handling: 20
Reading from volume 'uboot' to 0x41dfffc0, size 0x0 ... OK
Reading from volume 'rootfs' to 0x4a000000, size 0x0 ... OK
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Booting kernel from Legacy Image at 41dfffc0 ...
   Image Name:   seconduboot
   Image Type:   ARM Linux Standalone Program (uncompressed)
   Data Size:    747088 Bytes = 729.6 KiB
   Load Address: 00000000
   Entry Point:  41e00000
   Verifying Checksum ... OK
   Loading Standalone Program


U-Boot 2022.01-rc4 (Sep 15 2022 - 20:54:19 +0800)

CPU:   MediaTek MT7986
Model: mt7986-rfb
DRAM:  512 MiB
MMC:   mmc@11230000: 0
Loading Environment from MTD... spi-nand: spi_nand spi_nand@1: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 76:66:a5:e5:27:df
eth0: ethernet@15100000
new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
second uboot to boot kernel @46000000
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.109
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000ec
     Data Size:    3850909 Bytes = 3.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   e21f97ef
     Hash algo:    sha1
     Hash value:   e012632a97626c1c311b5e947dece7f3fddf850f
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt mercusys_mr90x-v1 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x463ac4d0
     Data Size:    32768 Bytes = 32 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   954f2e9e
     Hash algo:    sha1
     Hash value:   9290a27149c35c8f047183145174c814f8449118
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x463ac4d0
   Uncompressing Kernel Image
   Loading Device Tree to 000000005f7ef000, end 000000005f7f9fff ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.15.109 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22702-cf8d861978) 12.2.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Sun Apr 30 19:59:26 2023
[    0.000000] Machine model: Mercusys MR90X v1
[    0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[    0.000000] printk: bootconsole [uart8250] enabled
[    0.000000] Zone ranges:

The main open points:

  • Obtain root access for flashing without UART - check for Mercusys / TP-Link CVEs
  • What to do with second uboot:
    1. Сontinue to use the stock blob?
    2. Compile the opensource U-Boot and then insert it in the UBI image at the build time?
1 Like

Same HW as Mercusys Halo H90X (Wifi Mesh system)

https://www.mercusys.com/en/product/details/halo-h90x/v1/2-pack/

Really. Mercusys Halo H90X has almost the same hardware and almost the same firmware.

I've been testing my Mercusys MR90X with the OpenWrt installed for ~3 days as the main AP (dumb AP mode). Impressions are amazing. mt76 works great with the new wireless chips. These routers definitely deserves to be officially supported by the OpenWrt.

1 Like

Pull Request

2 Likes