Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Next revisionBoth sides next revision
toh:mercusys:mr90x_v1 [2024/07/04 05:50] – add a note about its similar model sold in China hizukiayakatoh:mercusys:mr90x_v1 [2024/11/30 21:25] – [UART method] csharper2005
Line 217: Line 217:
 5. Run ''sysupgrade -n'' with the sysupgrade OpenWrt image 5. Run ''sysupgrade -n'' with the sysupgrade OpenWrt image
  
 +==== Installation (OpenWrt U-Boot layout) ====
 +
 +1. Download files from //https://downloads.openwrt.org/ -> **Choose release you need** -> targets -> mediatek -> filogic://
 +  openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip
 +  openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
 +  openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin
 +  openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb
 +
 +2. Connect network cable to the LAN1 port of the router 
 +
 +3. Login as root via SSH (router IP, port ''20001'', password - your web interface password)
 +
 +<code bash>
 +BusyBox v1.19.4 (2022-09-15 21:10:21 CST) built-in shell (ash)
 +Enter 'help' for a list of built-in commands.
 +
 +     MM           NM                    MMMMMMM          M       M
 +   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
 +  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
 +MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
 +MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
 +MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
 +MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
 +MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
 +MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
 +MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
 +MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
 +  MMMMMMM:      MMMMMMM             MMMMMMMMMMMM  MMMMMMM MMMMMMM
 +    MMMMMM       MMMMN               MMMMMMMMM      MMMM    MMMM
 +     MMMM          M                    MMMMMMM        M       M
 +       M
 + ---------------------------------------------------------------
 +   For those about to rock... (Attitude Adjustment, unknown)
 + ---------------------------------------------------------------
 +admin@Akronite:/root$
 +</code>
 +
 +4. Run the following command: 
 +
 +<code bash>
 +fw_printenv | grep tp_boot_idx
 +</code>
 +
 +If the result is ''tp_boot_idx=1'' then install MERCUSYS stock firmware using web interface and start from the p.2. Otherwise, go to the next step.
 +
 +5. Open for editing ''/etc/hotplug.d/iface/65-iptv'' (e.g., using WinSCP and SSH settings from the p.2)
 +
 +6.  Add a newline after ''#!/bin/sh'':
 +<code bash>
 +telnetd -l /bin/login.sh
 +</code>
 +
 +7.  Save ''65-iptv'' file
 +
 +8.  Toggle ''IPTV/VLAN Enable'' checkbox in the router web interface and save
 +
 +9.  Make sure that telnetd is running:
 +<code bash>
 +netstat -ltunp | grep 23
 +</code>
 +
 +10.  Login via telnet to router IP, port ''23'' (no username and password are required)
 +
 +<code>
 +BusyBox v1.19.4 (2022-09-15 21:10:21 CST) built-in shell (ash)
 +Enter 'help' for a list of built-in commands.
 +
 +     MM           NM                    MMMMMMM          M       M
 +   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
 +  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
 +MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
 +MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
 +MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
 +MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
 +MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
 +MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
 +MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
 +MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
 +  MMMMMMM:      MMMMMMM             MMMMMMMMMMMM  MMMMMMM MMMMMMM
 +    MMMMMM       MMMMN               MMMMMMMMM      MMMM    MMMM
 +     MMMM          M                    MMMMMMM        M       M
 +       M
 + ---------------------------------------------------------------
 +   For those about to rock... (Attitude Adjustment, unknown)
 + ---------------------------------------------------------------
 +root@Akronite:/#
 +</code>
 +
 +11.  Upload OpenWrt ''openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb'' to the ''/tmp'' folder of the router (e.g., using WinSCP and SSH settings from the p.3, or with ''cat openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb | ssh -p 20001 root@YOUR_ROUTER_IP "cat > /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb"'' -- can't simply ''scp'' the file because there's no SFTP on the router)
 +    
 +12.  Stock busybox doesn't contain ''ubiupdatevol'' command. Hence, we need to download and upload the full version of busybox to the router. For example, from ArchLinux - https://archlinuxarm.org/packages/aarch64/busybox. 
 +
 +Download the ''pkg.tar.xz'' file, unpack it with ''tar xvf busybox-1.36.1-1-aarch64.pkg.tar.xz'', then upload ''usr/bin/busybox'' to the ''/tmp'' dir of the router and run in the telnet shell:
 +<code bash>
 +cd /tmp
 +chmod a+x busybox
 +</code>
 +
 +13. Check ''initramfs-kernel.bin'' size:
 +<code bash>
 +du -h openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
 +</code>
 +
 +14. Delete old and create a new one ''kernel'' volume with appropriate size (greater than ''initramfs-kernel.bin'' size):
 +<code bash>
 +ubirmvol /dev/ubi0 -N kernel
 +ubimkvol /dev/ubi0 -n 1 -N kernel -s 9MiB
 +</code>
 +
 +15. Write OpenWrt ''initramfs-kernel.bin'' to the flash:
 +<code bash>
 +./busybox ubiupdatevol /dev/ubi0_1 /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
 +</code>
 +
 +16. Make backups:
 +<code bash>
 +cat /dev/mtd0 > /tmp/boot.bin
 +cat /dev/mtd5 > /tmp/tp_data.bin
 +</code>
 +Copy ''/tp_data dir'' content, ''/tmp/boot.bin'' and ''/tmp/tp_data.bin'' and to your PC using scp. You can also backup the remaining partititons. Copy backups to a safe place, they are required for the next steps and stock firmware recovery.
 +
 +17. Reboot to OpenWrt initramfs:
 +<code bash>
 +reboot
 +</code>
 +
 +18. Copy OpenWrt ''openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip'', ''openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin'', ''openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb'' and ''MT7986_EEPROM.bin'', ''default-mac'' (from ''/tp_data'' backup) to the ''/tmp'' folder of the router using scp.
 +
 +19. Prepare UBI:
 +<code bash>
 +ubidetach -p /dev/mtd3; ubiformat /dev/mtd3 -y; ubiattach -p /dev/mtd3
 +ubimkvol /dev/ubi0 -N fip -t static -s 1MiB
 +ubiupdatevol /dev/ubi0_0 /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip
 +ubimkvol /dev/ubi0 -N ubootenv -s 0x1f000
 +ubimkvol /dev/ubi0 -N ubootenv2 -s 0x1f000
 +</code>
 +
 +20.  Install ''kmod-mtd-rw'' and unlock partitions:
 +<code bash>
 +opkg update && opkg install kmod-mtd-rw
 +insmod mtd-rw i_want_a_brick=1
 +mtd unlock boot
 +mtd unlock bl2
 +mtd unlock factory
 +</code>
 +
 +21. Prepare "factory" partition:
 +<code bash>
 +dd if=/dev/zero bs=$((0x8000)) count=1 | tr '\000' '\377' > /tmp/factory.bin
 +dd if=/tmp/MT7986_EEPROM.bin of=/tmp/factory.bin conv=notrunc
 +dd if=/tmp/default-mac >> /tmp/factory.bin
 +</code>
 +
 +22. Write "factory" partition:
 +<code bash>
 +mtd erase factory
 +mtd write /tmp/factory.bin factory
 +</code>
 +
 +23. Write preloader partition:
 +<code bash>
 +mtd erase bl2
 +mtd write /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin bl2
 +</code>
 +
 +24. Write OpenWrt sysupgrade image:
 +<code bash>
 +sysupgrade -n /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb
 +</code>
 ==== Flash Layout ==== ==== Flash Layout ====
 <code bash> <code bash>
Line 295: Line 464:
 4. Do what you need (restore partitions from a backup, install OpenWrt etc.) 4. Do what you need (restore partitions from a backup, install OpenWrt etc.)
  
 +===== Debricking (OpenWrt U-Boot layout) =====
 +
 +1. Place OpenWrt ''openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb'' image on the tftp server (IP: ''192.168.1.254'').
 +
 +2. Press "reset" button and power on the router. After ~10 sec release the button.
 +
 +3. Use OpenWrt initramfs system for recovery.
 +
 +==== BL2 and FIP recovery ====
 +
 +Use ''mtk_uartboot'' and UART connetion if BL2 or FIP in UBI is destroyed:
 +
 +https://github.com/981213/mtk_uartboot
 +
 +https://openwrt.org/toh/mercusys/mr90x_v1#serial
 ===== Failsafe mode ===== ===== Failsafe mode =====
 -> [[docs:guide-user:troubleshooting:failsafe_and_factory_reset]] -> [[docs:guide-user:troubleshooting:failsafe_and_factory_reset]]
  • Last modified: 2024/12/07 20:00
  • by csharper2005