Cant unbrick my Mr90x

Installing and Using OpenWrt
1

Hello

About a year ago I’ve bricked my router and was trying to fix it for about a month or so

I was following the MR90X tutorial to flash Openwrt in U-Boot layout guid, but since I deleted all partitions I have no MT7986_EEPROM.bin or default-mac, so can anyone tell me for to make factory partition without them or where to find them? I’ve tried to just set bl2 and sysupgrade partitions, but upon booting i get

Net:
Error: ethernet@15100000 address ff:ff:ff:ff:ff:ff illegal value
eth0: ethernet@15100000
Error: ethernet@15100000 address ff:ff:ff:ff:ff:ff illegal value

and it stops booting with

<6>[ 4.758269] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
<6>[ 4.767493] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
<6>[ 4.778224] mt7530-mdio mdio-bus:1f lan0 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=POLL)
<6>[ 4.800650] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=POLL)
<6>[ 4.822788] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=POLL)
<6>[ 4.834709] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
<6>[ 4.841681] DSA: tree 0 setup
<6>[ 4.845197] clk: Disabling unused clocks
<6>[ 4.849799] Waiting for root device /dev/fit0...

Thanks ahead for any response

2

Flash layout is listed on the wiki page you linked to ?

3

Yes, but as Ive said, Ive deleted them all with mtd by accident
mtd list output

* spi-nand0
  - device: spi_nand@1
  - parent: spi@1100a000
  - driver: spi_nand
  - path: /spi@1100a000/spi_nand@1
  - type: NAND flash
  - block size: 0x20000 bytes
  - min I/O: 0x800 bytes
  - OOB size: 128 bytes
  - OOB available: 63 bytes
  - 0x000000000000-0x000008000000 : "spi-nand0"
          - 0x000000000000-0x000000100000 : "bl2"
          - 0x000000100000-0x000000200000 : "factory"
          - 0x000000200000-0x000008000000 : "ubi"

ubi list

0: fip
1: ubootenv
2: ubootenv2
3: fit
4: rootfs_data
4

Then recreate them based on the wiki ?

5

Tbh I cant find any articles on how to do it, so… Can you please provide some? Or do you mean recreating partitions? Isnt it better to dump them than?

6

You can see the details of each partition/layout from the device’s DTS file: https://github.com/openwrt/openwrt/blob/main/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1-ubi.dts#L30-L66

boot encompasses bl2 and factory partitions. It has a size of 2 MiB (1 MiB from each partition).

factory encompasses the eeprom and macaddr layouts.

You will need to have the eeprom shared by someone or you will need to dump it from a different device. I can’t help you there. The size of the eeprom layout is 4 KiB and starts at offset 0 from the factory partition.

macaddr layout is pretty obvious, since its size is 6 bytes (the exact size of a mac address). You might be able to just create a fake mac address yourself. Offset for this layout is at byte 32768.

Once you have the eeprom data, you can create the factory image using the same steps described in the wiki.

1 Like
7

You might even be able to get yourtp_databack, assuming it didn’t get zeroed or overwritten.

Dump yourubipartition and then run this Python script (or something equivalent):

import sys
import pathlib

ubi = pathlib.Path(sys.argv[1].strip())

with ubi.open('rb') as fin, ubi.with_suffix(".out").open('wb') as fout:
    fin.seek(0x06F00000 - 0x00200000)
    fout.write(fin.read(0x400000))

Then verify if the .outfile has a MT7986_EEPROM.binfile and a default-macfile.

8

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.