Adding support for Mercusys MR90X

For Developers
104

Hey everyone!
so I've bought a 3-pack halo h90x and decided to flash openwrt with the instructions @csharper2005 gave us (thanks)
I know it's kinda different device, but we live once :slight_smile: and now one of my ap's is dead.
I've went the UART way, cuz ssh/telnet doesn't work here (I saw somewhere on the forum was posted about root's pass not being correct)
everything went smooth until sysupgrade -n fw.bin
the device rebooted and between the console output I've seen the
*** UBI is read-only mode *** error
then it booted into the recovery http console (looks like mercusys stock recovery)
then I've tried again and again the same thing (who expects a different result?) and always got the same
the console output after a reboot after the "upgrade" process:

https://pastebin.com/raw/yVKxS8vc

and here starts the http recovery console on 192.168.0.1:80

here is the console output after a initramfs-kernel.bin boot:

https://pastebin.com/raw/6WiRXew6

and here I try to flash openwrt again:

https://pastebin.com/raw/66EsBJxE

I've tried to get some info about the ubi devices:

https://pastebin.com/raw/dnK8VC2k

and as far as I can understand there is only one ubi0 device (the 50mb one?) but the fw expects two (ubi0/ubi1), yes?

after all that I've tried to flash the stock fw (the stock recovery still works) but it didn't end well:

https://pastebin.com/raw/A8vznXMb

and it just spits it all the time, I thinks that's because tp_data was formatted....

sorry for a long, I've tried to give as much info as I could and I hope somebody can help me with all this
thanks in advance :slight_smile:

105

Can you paste the uboot printenv?

To boot Openwrt tp_boot_idx 0 is required but from what you're describing I'm expecting you have tp_boot_idx 1.

fw_printenv 
baudrate=115200
bootargs=ubi.mtd=ubi1 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
bootcmd=bootp; setenv bootargs root=/dev/nfs nfsroot=${serverip}:${rootpath} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off; bootm
bootdelay=5
fdtcontroladdr=5ffb0430
has_default_mac=1
ipaddr=192.168.1.1
loadaddr=0x46000000
mtdids=spi-nand0=spi-nand0
mtdparts=spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)
netmask=255.255.255.0
product_id=48905800
product_language=US
product_name=H90X
product_ver=1.0
serverip=192.168.1.2
special_id=45550000
stderr=serial@11002000
stdin=serial@11002000
stdout=serial@11002000
tp_boot_idx=1
vendor_name=Mercusys
vendor_url=www.mercusys.com
106

Pulled the printenv out of your pastebin.
What do you mean by one of the aps is dead, does it still boot the initramfs kernel bin?

You've changed the fdt control address

${fdtcontroladdr} = A variable holding the address of the flattened device tree in memory

107

my mystake, it's not completely dead
I meant that it wont boot the stock fw anymore (after recovery) and I can't flash sysupgrade
I can indeed boot initramfs via UART

108

Also, I've re-read the console output after another sysupgrade -n fw.bin and I can see that sysupgrade was successful
but one remark: I've changed the mtdparts parameter to spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),8M(userconfig),4M(tp_data) (removed the ubi1), just to try....
but anyway the ap can't boot:

Reading from volume 'uboot' to 0x41dfffc0, size 0x0 ... *** Cannot find volume 'uboot' ***
volume uboot read error -19
-----boot from ubi0 fail, try another one
change to mtd ubi1!
-----boot from ubi1 fail, try another one
change to mtd ubi1!
ubi_boot_image: try two times failed
Start web server.
109

Ok, so we need to fix your uboot environment variables first, as you've set a lot of mr90x variables

This feature provides for run-time configuration of U-Boot via a flattened devicetree (fdt). This feature aims to make it possible for a single U-Boot binary to support multiple boards, with the exact configuration of each board controlled by a flattened devicetree (fdt).

So the mr90x and the h90x more than likely share the same uboot binary but use separate flattened device trees to boot.

Can you set the fdtcontroladdr back to

fdtcontroladdr=5ffb0430
2 Likes
110

omg, that really helped, it successfully booted
thanks a lot!
is there anything else I should fix or I can continue with setting things up?
I still get a few errors after boot and I haven't tested anything yet, only the http gui
https://pastebin.com/raw/qDUxujk5

1 Like
111

Set things up and test, see how stable it is.

112

well, it looks quite stable
I've setup the ethernet interfaces and a few other things, but I have no wireless interfaces
wifi config generates an empty file and I can't setup it through LUCI either

maybe it's somehow related to this?

[   10.352295] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20221012174743a
[   10.352295] 
[   10.697821] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20221012174805
[   10.857850] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20221012174937
[   11.002535] mt798x-wmac 18000000.wifi: eeprom load fail, use default bin
[   11.009310] mt798x-wmac 18000000.wifi: Direct firmware load for mediatek/mt7986_eeprom_mt7975_dual.bin failed with error -2
[   11.020419] mt798x-wmac 18000000.wifi: Falling back to sysfs fallback for: mediatek/mt7986_eeprom_mt7975_dual.bin
[   11.131078] mt798x-wmac: probe of 18000000.wifi failed with error -12
113

anything on iw phy via ssh?

114

nope, empty

115

Can you confirm if you can revert to stock firmware, as I'd like to check a few things in stock.

116

I've already tried it yesterday, it won't boot after revert

after all that I've tried to flash the stock fw (the stock recovery still works) but it didn't end well:

https://pastebin.com/raw/A8vznXMb

and it just spits it all the time, I thinks that's because tp_data was formatted

117

image
image1748×444 67 KB

could this be the issue?

I found this commit + the absent tp_data may be the cause of no wireless interfaces

and as far as I understand, the tp_data is stored in ubi1, which is absent on my ap:

image
image1090×1698 150 KB

118

can you get root access on a second h90x stock rom and do a ubinfo -a

My issue at present is you are running a mr90x build therefore it may not recognise some h90x specifics

119

I can't login into a stock H90X with ssh, it won't accept my password
I think it's because H90X can only be configured with mercusys cloud, so the internal root user has an unknown pass
I booted into initramfs and entered ubinfo -a, but:
Снимок экрана 2024-05-21 в 17.29.07

actually, the problem with ssh login is the cause why I started flashing with UART :slight_smile:

maybe this will help you?

[    0.589294] spi-nand spi0.1: ESMT SPI NAND was found.
[    0.594328] spi-nand spi0.1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.602720] 11 fixed-partitions partitions found on MTD device spi0.1
[    0.609152] Creating 11 MTD partitions on "spi0.1":
[    0.614022] 0x000000000000-0x000000200000 : "boot"
[    0.621868] 0x000000200000-0x000000300000 : "u-boot-env"
[    0.629150] 0x000000300000-0x000002d00000 : "ubi0"
[    0.681763] 0x000002d00000-0x000005700000 : "ubi1"
[    0.733514] 0x000005700000-0x000005800000 : "radio"
[    0.740337] 0x000005800000-0x000006100000 : "factory_data"
[    0.756567] 0x000006100000-0x000007200000 : "runtime_data"
[    0.781976] 0x000000000000-0x000007f80000 : "wholeflash"
[    0.803006] 0x000000200000-0x000000300000 : "nvram"
[    0.808730] 0x000000300000-0x000002d00000 : "rootfs_1"
[    0.814810] 0x000002d00000-0x000005700000 : "backup"

this is the stock bootlog:

[    0.492453] spi-nand spi0.0: GigaDevice SPI NAND was found.
[    0.498019] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
[    0.506381] 6 fixed-partitions partitions found on MTD device spi0.0
[    0.512727] Creating 6 MTD partitions on "spi0.0":
[    0.517502] 0x000000000000-0x000000200000 : "boot"
[    0.524774] 0x000000200000-0x000000300000 : "u-boot-env"
[    0.531458] 0x000000300000-0x000003500000 : "ubi0"
[    0.591088] 0x000003500000-0x000006700000 : "ubi1"
[    0.647759] 0x000006700000-0x000006f00000 : "userconfig"
[    0.660828] 0x000006f00000-0x000007300000 : "tp_data"
120

That's causing more issue than it solves, are we dealing with two different NAND?

121

when u-boot is starting this is what I see in bootlog:

CPU:   MediaTek MT7986
Model: mt7986-rfb
DRAM:  512 MiB
MMC:   mmc@11230000: 0
Loading Environment from MTD... spi-nand: spi_nand spi_nand@1: GigaDevice SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
122

It seems that H90x has completely different flash layout and has no tp_data partition. This is the reason why eeprom is unavailable and WiFi doesn't work. MR90x firmware is not suitable. Adding H90x support requires additional activities.

2 Likes
123

It was at this moment he knew, he f'd up.

Looks like you're right.
And I think I'm not ready yet to fulfil all those additional activities.
The first thing that comes to mind to recover the dead ap is to dump the nand from the another stock ap, somehow change the serial and mac (becoming delirious) and write it to the semi-dead ap, but because of all the cloud-activate things I'm pretty sure that won't work.
Maybe someone got any ideas?)

UPD: I just compared the chips on H90X with MR90X, it's got absolutely the same hw, except for the nand, it's a ESMT F50L1G41LB (should've done it earlier)

UPD2: I've posted a few PCB photos here: