Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Next revisionBoth sides next revision
toh:mercusys:mr90x_v1 [2024/02/12 11:13] – external edit toh:mercusys:mr90x_v1 [2024/11/30 21:25] – [UART method] csharper2005
Line 6: Line 6:
  
 The MERCUSYS MR90X(EU) v1 router supports 4 802.11ax streams on both 2.4GHz @40MHz and 5GHz @160MHz for a combined 6000Mbps wireless speed. It is based on the MediaTek MT7986B SoC. The MERCUSYS MR90X(EU) v1 router supports 4 802.11ax streams on both 2.4GHz @40MHz and 5GHz @160MHz for a combined 6000Mbps wireless speed. It is based on the MediaTek MT7986B SoC.
 +
 +The Chinese model X60G(AX6000) is **NOT** the same, which doesn't have a 2.5 Gpbs PHY either.
  
 /*****/ /*****/
Line 160: Line 162:
 16. Login as root via SSH (IP ''192.168.1.1'', port ''22'') 16. Login as root via SSH (IP ''192.168.1.1'', port ''22'')
  
-17. Upload OpenWrt ''sysupgrade.bin'' image to the ''/tmp'' dir of the router+17. Once inside OpenWrt, set (or update) env variables: 
 +<code bash> 
 +fw_setenv baudrate 115200 
 +fw_setenv bootargs "ubi.mtd=ubi0 console=ttyS0,115200n1 loglevel=8 earlycon=uart8250,mmio32,0x11002000 init=/etc/preinit" 
 +fw_setenv fdtcontroladdr 5ffc0e70 
 +fw_setenv ipaddr 192.168.1.1 
 +fw_setenv loadaddr 0x46000000 
 +fw_setenv mtdids "spi-nand0=spi-nand0" 
 +fw_setenv mtdparts "spi-nand0:2M(boot),1M(u-boot-env),50M(ubi0),50M(ubi1),8M(userconfig),4M(tp_data)" 
 +fw_setenv netmask 255.255.255.0 
 +fw_setenv serverip 192.168.1.2 
 +fw_setenv stderr serial@11002000 
 +fw_setenv stdin serial@11002000 
 +fw_setenv stdout serial@11002000 
 +fw_setenv tp_boot_idx 0 
 +</code> 
 + 
 +18. Upload OpenWrt ''sysupgrade.bin'' image to the ''/tmp'' dir of the router
  
-18. Run sysupgrade:+19. Run sysupgrade:
 <code bash> <code bash>
 sysupgrade -n /tmp/sysupgrade.bin sysupgrade -n /tmp/sysupgrade.bin
Line 198: Line 217:
 5. Run ''sysupgrade -n'' with the sysupgrade OpenWrt image 5. Run ''sysupgrade -n'' with the sysupgrade OpenWrt image
  
 +==== Installation (OpenWrt U-Boot layout) ====
 +
 +1. Download files from //https://downloads.openwrt.org/ -> **Choose release you need** -> targets -> mediatek -> filogic://
 +  openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip
 +  openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
 +  openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin
 +  openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb
 +
 +2. Connect network cable to the LAN1 port of the router 
 +
 +3. Login as root via SSH (router IP, port ''20001'', password - your web interface password)
 +
 +<code bash>
 +BusyBox v1.19.4 (2022-09-15 21:10:21 CST) built-in shell (ash)
 +Enter 'help' for a list of built-in commands.
 +
 +     MM           NM                    MMMMMMM          M       M
 +   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
 +  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
 +MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
 +MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
 +MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
 +MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
 +MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
 +MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
 +MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
 +MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
 +  MMMMMMM:      MMMMMMM             MMMMMMMMMMMM  MMMMMMM MMMMMMM
 +    MMMMMM       MMMMN               MMMMMMMMM      MMMM    MMMM
 +     MMMM          M                    MMMMMMM        M       M
 +       M
 + ---------------------------------------------------------------
 +   For those about to rock... (Attitude Adjustment, unknown)
 + ---------------------------------------------------------------
 +admin@Akronite:/root$
 +</code>
 +
 +4. Run the following command: 
 +
 +<code bash>
 +fw_printenv | grep tp_boot_idx
 +</code>
 +
 +If the result is ''tp_boot_idx=1'' then install MERCUSYS stock firmware using web interface and start from the p.2. Otherwise, go to the next step.
 +
 +5. Open for editing ''/etc/hotplug.d/iface/65-iptv'' (e.g., using WinSCP and SSH settings from the p.2)
 +
 +6.  Add a newline after ''#!/bin/sh'':
 +<code bash>
 +telnetd -l /bin/login.sh
 +</code>
 +
 +7.  Save ''65-iptv'' file
 +
 +8.  Toggle ''IPTV/VLAN Enable'' checkbox in the router web interface and save
 +
 +9.  Make sure that telnetd is running:
 +<code bash>
 +netstat -ltunp | grep 23
 +</code>
 +
 +10.  Login via telnet to router IP, port ''23'' (no username and password are required)
 +
 +<code>
 +BusyBox v1.19.4 (2022-09-15 21:10:21 CST) built-in shell (ash)
 +Enter 'help' for a list of built-in commands.
 +
 +     MM           NM                    MMMMMMM          M       M
 +   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
 +  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
 +MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
 +MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
 +MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
 +MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
 +MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
 +MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
 +MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
 +MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
 +  MMMMMMM:      MMMMMMM             MMMMMMMMMMMM  MMMMMMM MMMMMMM
 +    MMMMMM       MMMMN               MMMMMMMMM      MMMM    MMMM
 +     MMMM          M                    MMMMMMM        M       M
 +       M
 + ---------------------------------------------------------------
 +   For those about to rock... (Attitude Adjustment, unknown)
 + ---------------------------------------------------------------
 +root@Akronite:/#
 +</code>
 +
 +11.  Upload OpenWrt ''openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb'' to the ''/tmp'' folder of the router (e.g., using WinSCP and SSH settings from the p.3, or with ''cat openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb | ssh -p 20001 root@YOUR_ROUTER_IP "cat > /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb"'' -- can't simply ''scp'' the file because there's no SFTP on the router)
 +    
 +12.  Stock busybox doesn't contain ''ubiupdatevol'' command. Hence, we need to download and upload the full version of busybox to the router. For example, from ArchLinux - https://archlinuxarm.org/packages/aarch64/busybox. 
 +
 +Download the ''pkg.tar.xz'' file, unpack it with ''tar xvf busybox-1.36.1-1-aarch64.pkg.tar.xz'', then upload ''usr/bin/busybox'' to the ''/tmp'' dir of the router and run in the telnet shell:
 +<code bash>
 +cd /tmp
 +chmod a+x busybox
 +</code>
 +
 +13. Check ''initramfs-kernel.bin'' size:
 +<code bash>
 +du -h openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
 +</code>
 +
 +14. Delete old and create a new one ''kernel'' volume with appropriate size (greater than ''initramfs-kernel.bin'' size):
 +<code bash>
 +ubirmvol /dev/ubi0 -N kernel
 +ubimkvol /dev/ubi0 -n 1 -N kernel -s 9MiB
 +</code>
 +
 +15. Write OpenWrt ''initramfs-kernel.bin'' to the flash:
 +<code bash>
 +./busybox ubiupdatevol /dev/ubi0_1 /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
 +</code>
 +
 +16. Make backups:
 +<code bash>
 +cat /dev/mtd0 > /tmp/boot.bin
 +cat /dev/mtd5 > /tmp/tp_data.bin
 +</code>
 +Copy ''/tp_data dir'' content, ''/tmp/boot.bin'' and ''/tmp/tp_data.bin'' and to your PC using scp. You can also backup the remaining partititons. Copy backups to a safe place, they are required for the next steps and stock firmware recovery.
 +
 +17. Reboot to OpenWrt initramfs:
 +<code bash>
 +reboot
 +</code>
 +
 +18. Copy OpenWrt ''openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip'', ''openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin'', ''openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb'' and ''MT7986_EEPROM.bin'', ''default-mac'' (from ''/tp_data'' backup) to the ''/tmp'' folder of the router using scp.
 +
 +19. Prepare UBI:
 +<code bash>
 +ubidetach -p /dev/mtd3; ubiformat /dev/mtd3 -y; ubiattach -p /dev/mtd3
 +ubimkvol /dev/ubi0 -N fip -t static -s 1MiB
 +ubiupdatevol /dev/ubi0_0 /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip
 +ubimkvol /dev/ubi0 -N ubootenv -s 0x1f000
 +ubimkvol /dev/ubi0 -N ubootenv2 -s 0x1f000
 +</code>
 +
 +20.  Install ''kmod-mtd-rw'' and unlock partitions:
 +<code bash>
 +opkg update && opkg install kmod-mtd-rw
 +insmod mtd-rw i_want_a_brick=1
 +mtd unlock boot
 +mtd unlock bl2
 +mtd unlock factory
 +</code>
 +
 +21. Prepare "factory" partition:
 +<code bash>
 +dd if=/dev/zero bs=$((0x8000)) count=1 | tr '\000' '\377' > /tmp/factory.bin
 +dd if=/tmp/MT7986_EEPROM.bin of=/tmp/factory.bin conv=notrunc
 +dd if=/tmp/default-mac >> /tmp/factory.bin
 +</code>
 +
 +22. Write "factory" partition:
 +<code bash>
 +mtd erase factory
 +mtd write /tmp/factory.bin factory
 +</code>
 +
 +23. Write preloader partition:
 +<code bash>
 +mtd erase bl2
 +mtd write /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin bl2
 +</code>
 +
 +24. Write OpenWrt sysupgrade image:
 +<code bash>
 +sysupgrade -n /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb
 +</code>
 ==== Flash Layout ==== ==== Flash Layout ====
 <code bash> <code bash>
Line 276: Line 464:
 4. Do what you need (restore partitions from a backup, install OpenWrt etc.) 4. Do what you need (restore partitions from a backup, install OpenWrt etc.)
  
 +===== Debricking (OpenWrt U-Boot layout) =====
 +
 +1. Place OpenWrt ''openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb'' image on the tftp server (IP: ''192.168.1.254'').
 +
 +2. Press "reset" button and power on the router. After ~10 sec release the button.
 +
 +3. Use OpenWrt initramfs system for recovery.
 +
 +==== BL2 and FIP recovery ====
 +
 +Use ''mtk_uartboot'' and UART connetion if BL2 or FIP in UBI is destroyed:
 +
 +https://github.com/981213/mtk_uartboot
 +
 +https://openwrt.org/toh/mercusys/mr90x_v1#serial
 ===== Failsafe mode ===== ===== Failsafe mode =====
 -> [[docs:guide-user:troubleshooting:failsafe_and_factory_reset]] -> [[docs:guide-user:troubleshooting:failsafe_and_factory_reset]]
  • Last modified: 2024/12/07 20:00
  • by csharper2005