Installing OpenWrt on Mercusys MR90X v1.2

I've got an MR90X(EU) v1.2.

The web interface shows this info:
Firmware Version: 1.0.2 Build 20230808 rel.59994(4555)
Hardware Version: MR90X v1.0

When I run fw_printenv I don't see tp_boot_idx at all in the output. Other than that, I've successfully followed the steps up to 12, right before Delete old and create a new one kernel volume.

My question is: Should I go ahead applying changes to the kernel volume or should I attempt to apply the previous stock firmware - rel57784 - first and redo the steps?

I imagine that if I apply the change, worst case scenario I'll be able to follow the debricking procedure, but not 100% sure.

Here's more info.

Firmware versions
The Mercusys MR90X firmware page has the following firmware options:

  1. For v1.2, MR90X(EU)_V1.20_230808
  2. For v1.0, MR90X(EU)_V1_1.0.1 Build 20230808. This one and the one above contain the same .bin file. The file's got 20230808-rel59994 in the name and the file contents are the same.
  3. For v1.0, MR90X(EU)_V1_1.1.0 Build 20220916. This one has a .bin file with 20220916-rel57784 in the name. It's the same one as the Firmware OEM Stock URL on the MR90X OpenWrt page.

MTD

cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00200000 00020000 "boot"
mtd1: 00100000 00020000 "u-boot-env"
mtd2: 03200000 00020000 "ubi0"
mtd3: 03200000 00020000 "ubi1"
mtd4: 00800000 00020000 "userconfig"
mtd5: 00400000 00020000 "tp_data"

ubinfo

ubinfo --all
UBI version:                    1
Count of UBI devices:           3
UBI control device major/minor: 10:62
Present UBI devices:            ubi0, ubi1, ubi2

ubi0
Volumes count:                           3
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     400 (50790400 bytes, 48.4 MiB)
Amount of available logical eraseblocks: 175 (22220800 bytes, 21.1 MiB)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  20
Current maximum erase counter value:     1
Minimum input/output unit size:          2048 bytes
Character device major/minor:            250:0
Present volumes:                         0, 1, 2

Volume ID:   0 (on ubi0)
Type:        static
Alignment:   1
Size:        6 LEBs /tmp(761856 bytes, 744.0 KiB)
Data bytes:  747152 bytes (729.6 KiB)
State:       OK
Name:        uboot
Character device major/minor: 250:1
-----------------------------------
Volume ID:   1 (on ubi0)
Type:        static
Alignment:   1
Size:        26 LEBs (3301376 bytes, 3.1 MiB)
Data bytes:  3216284 bytes (3.0 MiB)
State:       OK
Name:        kernel
Character device major/minor: 250:2
-----------------------------------
Volume ID:   2 (on ubi0)
Type:        static
Alignment:   1
Size:        169 LEBs (21458944 bytes, 20.4 MiB)
Data bytes:  21450752 bytes (20.4 MiB)
State:       OK
Name:        rootfs
Character device major/minor: 250:3

===================================

ubi1
Volumes count:                           1
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     32 (4063232 bytes, 3.8 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  10
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            249:0
Present volumes:                         0

Volume ID:   0 (on ubi1)
Type:        dynamic
Alignment:   1
Size:        18 LEBs (2285568 bytes, 2.1 MiB)
State:       OK
Name:        tp_data
Character device major/minor: 249:1

===================================

ubi2
Volumes count:                           2
Logical eraseblock size:                 126976 bytes, 124.0 KiB
Total amount of logical eraseblocks:     64 (8126464 bytes, 7.7 MiB)
Amount of available logical eraseblocks: 0 (0 bytes)
Maximum count of volumes                 128
Count of bad physical eraseblocks:       0
Count of reserved physical eraseblocks:  20
Current maximum erase counter value:     2
Minimum input/output unit size:          2048 bytes
Character device major/minor:            248:0
Present volumes:                         0, 1

Volume ID:   0 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        20 LEBs (2539520 bytes, 2.4 MiB)
State:       OK
Name:        user_data1
Character device major/minor: 248:1
-----------------------------------
Volume ID:   1 (on ubi2)
Type:        dynamic
Alignment:   1
Size:        20 LEBs (2539520 bytes, 2.4 MiB)
State:       OK
Name:        user_data2
Character device major/minor: 248:2

I would install the previous firmware and see if it takes, worse case scenario you would end up in recovery.

Can you post your current uboot printenv?

This is what I get.

$ fw_printenv 
Warning: Bad CRC, using default environment
bootargs=ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
bootcmd=bootp; setenv bootargs root=/dev/nfs nfsroot=${serverip}:${rootpath} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off; bootm
bootdelay=5
baudrate=115200
ipaddr=192.168.1.1
serverip=192.168.1.2
netmask=255.255.255.0
loadaddr=0x46000000

As suggested, I've installed the old firmware version - 1.0.0 Build 20220916 rel.57784(4555). I'm able to follow all steps up to 12 - Check initramfs-kernel.bin size - like I did for the new firmware version just fine.

Output from ubinfo --all is almost identical to the output I had with the newer firmware. Main difference is that the maximum erase counter value for both ubi0 and ubi2 has changed by one. I guess this is normal.

fw_printenv now shows this:

$ fw_printenv 
bootargs=ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit
bootcmd=bootp; setenv bootargs root=/dev/nfs nfsroot=${serverip}:${rootpath} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}::off; bootm
bootdelay=5
baudrate=115200
ipaddr=192.168.1.1
serverip=192.168.1.2
netmask=255.255.255.0
loadaddr=0x46000000
tp_boot_idx=1

So no Warning: Bad CRC, using default environment in the message. However, I now get tp_boot_idx=1!

Step 3 on the instruction says:

If the result is tp_boot_idx=1 then install MERCUSYS stock firmware using web interface and start from the p.2.

Only problem is that installing MERCUSYS stock firmware using the web interface is what I've just done.

I don't really know what tp_boot_idx=1 indicates.

Any suggestions?

Tp_boot_idx is secure boot, you need to set it to 0 to run unsigned code like Openwrt.

1 = secure boot enabled
0 = secure boot disabled

Thanks for the help @hecatae. It worked in the end!

I continued using firmware 1.0.0, set tp_boot_idx to 0 with fw_setenv, but after rebooting the router, the firmware went back to version 1.0.2 Build 20230808 rel.59994(4555). Once this happened, I went ahead with the installation steps from the start and got OpenWrt running.

To summarize what should work for someone starting from scratch:
a) If you've got v1.2 of the MR90X router, continue with the pre-installed version 1.0.2 firmware. You can confirm the version from the router's web interface, at the bottom of the login page.
b) Gain root access via Telnet as described in the OpenWrt Installation instructions. Run fw_setenv tp_boot_idx 0.
c) Reboot. You may do it by running reboot from the Telnet session.
d) Perform all the steps in the OpwenWrt Installation instructions from the start. Ignore comments about tp_boot_idx in step 3 and proceed with subsequent steps.
e) You should be able to log in via SSH to 192.168.1.1 on port 22 with root user (ssh root@192.168.1.1).

For definitive instructions, one would need to confirm whether steps (b) and (c) are really necessary. It's possible that following all standard installation steps would work directly.

1 Like