Mercusys MR90X
https://www.mercusys.com/en/product/details/mr90x

Hardware highlights
- CPU: MediaTek MT7986BLA, Cortex-A53, 64-bit
- Ethernet: MediaTek MT7531AE + 2.5GbE MaxLinear GPY211C0VC (SLNW8)
- SPI NAND: GigaDevice GD5F1GQ5UEYIGY (128 MB)
- RAM: MediaTek MT7986BLA (512MB)
- WLAN 2g: MediaTek MT7975N
- WLAN 5g: MediaTek MT7975P(N)
1 Like
Stock layout
0x000000000000-0x000000200000 : "boot" 0x200000
0x000000200000-0x000000300000 : "u-boot-env" 0x100000
0x000000300000-0x000003500000 : "ubi0" 0x3200000
0x000003500000-0x000006700000 : "ubi1" 0x3200000
0x000006700000-0x000006f00000 : "userconfig" 0x800000
0x000006f00000-0x000007300000 : "tp_data" 0x400000
"boot"
MT7986> version
U-Boot 2022.01-rc4 (Sep 15 2022 - 20:55:22 +0800)
aarch64-openwrt-linux-musl-gcc.bin (OpenWrt GCC 8.4.0 r0-c067e3725) 8.4.0
GNU ld (GNU Binutils) 2.34
"ubi0" format
+---------------------+--------------------+---------------------+---------------------+
| UBI Image: | | | |
| Volume Name: uboot | Volume Name: uboot | Volume Name: kernel | Volume Name: rootfs |
| Volume Name: kernel | Vol ID: 0 | Vol ID: 1 | Vol ID: 2 |
| Volume Name: rootfs | Vol_type: 'static' | Vol_type: 'static' | Vol_type: 'static' |
+---------------------+--------------------+---------------------+---------------------+
uboot - secondary u-boot in UBI
ubireader_display_info ubi0
UBI File
---------------------
Min I/O: 2048
LEB Size: 126976
PEB Size: 131072
Total Block Count: 400
Data Block Count: 200
Layout Block Count: 2
Internal Volume Block Count: 0
Unknown Block Count: 198
First UBI PEB Number: 0
Image: 302291140
---------------------
Image Sequence Num: 302291140
Volume Name:uboot
Volume Name:kernel
Volume Name:rootfs
PEB Range: 2 - 399
Volume: uboot
---------------------
Vol ID: 0
Name: uboot
Block Count: 6
Volume Record
---------------------
alignment: 1
crc: '0xaea9197b'
data_pad: 0
errors: ''
flags: 0
name: 'uboot'
name_len: 5
padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
rec_index: 0
reserved_pebs: 6
upd_marker: 0
vol_type: 'static'
Volume: kernel
---------------------
Vol ID: 1
Name: kernel
Block Count: 26
Volume Record
---------------------
alignment: 1
crc: '0xca6c7adb'
data_pad: 0
errors: ''
flags: 0
name: 'kernel'
name_len: 6
padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
rec_index: 1
reserved_pebs: 26
upd_marker: 0
vol_type: 'static'
Volume: rootfs
---------------------
Vol ID: 2
Name: rootfs
Block Count: 168
Volume Record
---------------------
alignment: 1
crc: '0xe75eee88'
data_pad: 0
errors: ''
flags: 0
name: 'rootfs'
name_len: 6
padding: '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
rec_index: 2
reserved_pebs: 168
upd_marker: 0
vol_type: 'static'
Smells a bit like TP-LINK TL-XAP6030GI
1 Like
By hardware or wild things like second u-boot? 
- I was unable to start OpenWrt from flash with an empty uboot partition in UBI due to wrong hashes.
Log
MT7986> bootm
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-5.15.109
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000ec
Data Size: 3850909 Bytes = 3.7 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x48000000
Entry Point: 0x48000000
Hash algo: crc32
Hash value: e21f97ef
Hash algo: sha1
Hash value: e012632a97626c1c311b5e947dece7f3fddf850f
Verifying Hash Integrity ... crc32 error!
Bad hash value for 'hash@1' hash node in 'kernel-1' image node
Bad Data Hash
ERROR: can't get kernel image!
- I managed to start OpenWrt after inserting original Mercusys second uboot blob in UBI.
Log
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0141 [010F]
Jump to BL
NOTICE: BL2: v2.6(release):02e589f3e-dirty
NOTICE: BL2: Built : 20:56:26, Sep 15 2022
NOTICE: WDT: disabled
NOTICE: EMI: Using DDR3 settings
NOTICE: EMI: Detected DRAM size: 512MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0x1
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.6(release):02e589f3e-dirty
NOTICE: BL31: Built : 20:56:31, Sep 15 2022
U-Boot 2022.01-rc4 (Sep 15 2022 - 20:55:22 +0800)
CPU: MediaTek MT7986
Model: mt7986-rfb
DRAM: 512 MiB
MMC: mmc@11230000: 0
Loading Environment from MTD... spi-nand: spi_nand spi_nand@1: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
OK
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 06:a8:ee:e2:20:5f
eth0: ethernet@15100000
press ctrl-c or t to go to uboot cmdline 0 new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
ubi0: attaching mtd3
ubi0: scanning is finished
ubi0: attached mtd3 (name "ubi0", size 50 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 400, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 4, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1682884766
ubi0: available PEBs: 0, total reserved PEBs: 400, PEBs reserved for bad PEB handling: 20
Reading from volume 'uboot' to 0x41dfffc0, size 0x0 ... OK
Reading from volume 'rootfs' to 0x4a000000, size 0x0 ... OK
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Booting kernel from Legacy Image at 41dfffc0 ...
Image Name: seconduboot
Image Type: ARM Linux Standalone Program (uncompressed)
Data Size: 747088 Bytes = 729.6 KiB
Load Address: 00000000
Entry Point: 41e00000
Verifying Checksum ... OK
Loading Standalone Program
U-Boot 2022.01-rc4 (Sep 15 2022 - 20:54:19 +0800)
CPU: MediaTek MT7986
Model: mt7986-rfb
DRAM: 512 MiB
MMC: mmc@11230000: 0
Loading Environment from MTD... spi-nand: spi_nand spi_nand@1: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
OK
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 76:66:a5:e5:27:df
eth0: ethernet@15100000
new bootarg:ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
second uboot to boot kernel @46000000
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-5.15.109
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000ec
Data Size: 3850909 Bytes = 3.7 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x48000000
Entry Point: 0x48000000
Hash algo: crc32
Hash value: e21f97ef
Hash algo: sha1
Hash value: e012632a97626c1c311b5e947dece7f3fddf850f
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt mercusys_mr90x-v1 device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x463ac4d0
Data Size: 32768 Bytes = 32 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 954f2e9e
Hash algo: sha1
Hash value: 9290a27149c35c8f047183145174c814f8449118
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x463ac4d0
Uncompressing Kernel Image
Loading Device Tree to 000000005f7ef000, end 000000005f7f9fff ... OK
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 5.15.109 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 12.2.0 r22702-cf8d861978) 12.2.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Sun Apr 30 19:59:26 2023
[ 0.000000] Machine model: Mercusys MR90X v1
[ 0.000000] earlycon: uart8250 at MMIO32 0x0000000011002000 (options '')
[ 0.000000] printk: bootconsole [uart8250] enabled
[ 0.000000] Zone ranges:
The main open points:
- Obtain root access for flashing without UART - check for Mercusys / TP-Link CVEs
- What to do with second uboot:
1. Сontinue to use the stock blob?
2. Compile the opensource U-Boot and then insert it in the UBI image at the build time?
1 Like
Really. Mercusys Halo H90X has almost the same hardware and almost the same firmware.
I've been testing my Mercusys MR90X with the OpenWrt installed for ~3 days as the main AP (dumb AP mode). Impressions are amazing. mt76 works great with the new wireless chips. These routers definitely deserves to be officially supported by the OpenWrt.
1 Like