OpenWRT on MERCUSYS MR90X v1

The MERCUSYS MR90X(US) v1 router is a powerful device that boasts an impressive 4 802.11ax streams on both 2.4GHz @40MHz and 5GHz @160MHz, resulting in a combined 6000Mbps wireless speed. Built on the MediaTek MT7986B SoC, this router is a great candidate for installing OpenWRT, a popular open-source firmware.

Important Note: This guide is compatible with any V1 Hardware Version of the MERCUSYS MR90X(US) router.

Disclaimer: This guide has been tested with the MR90X V1 Hardware and OpenWRT 24.10.0. If you are using a later version (both hardware and software), please refer to the official OpenWRT wiki for compatibility and updates.

Firmware Preparation

To begin, we need to prepare our firmware. Follow these steps:

1. Visit the OpenWRT Firmware Selector website and select the latest version of OpenWRT from the dropdown menu (avoid SNAPSHOT).
2. Click on "Customize installed packages and/or first boot script."
3. Without altering the original packages, append new ones such as irqbalance, nano, btop, luci-app-wireguard, luci-proto-wireguard, wireguard-tools, and kmod-wireguard (you can add others, but ensure they don't exceed the available ROM space of 95MB).
4. Click on "Request Build" to generate the customized firmware.
5. Download the required files for the MERCUSYS MR90X(US) v1.
6. We will use the latest UBI method to flash the router.

Installation (OpenWrt U-Boot layout)

To install OpenWRT on your MERCUSYS MR90X(US) v1 router, follow these steps:

1. Rename the downloaded files to the correct names:
   • openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip
   • openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
   • openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin
   • openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb
2. Connect a network cable to the LAN1 port of the router (the 3rd port from the power plug, not the one beside the WAN port).
3. Log in as root via SSH (router IP, port 20001, password - your web interface password).
4. Run the following command: fw_printenv | grep tp_boot_idx
   • If the result is tp_boot_idx=1, install the MERCUSYS stock firmware using the web interface and start from step 2. Otherwise, proceed to the next step. If you don't receive any output, you're good to go to step 5.
5. Open the /etc/hotplug.d/iface/65-iptv file for editing (e.g., using WinSCP and SSH settings from step 2).
6. Add a newline after #!/bin/sh and add the following line: telnetd -l /bin/login.sh
7. Save the 65-iptv file.
8. Toggle the IPTV/VLAN Enable checkbox in the router web interface and save.
9. Ensure that telnetd is running: netstat -ltunp | grep 23
10. Log in via telnet to the router IP, port 23 (no username and password are required) using an app like Termius.
11. Transfer OpenWRT's openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb to the /tmp folder of the router using (Win)SCP: scp -p 20001 -O openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb root@YOUR_ROUTER_IP:/tmp
12. The stock BusyBox doesn't contain the ubiupdatevol command. Download and upload the full version of BusyBox to the router (e.g., from ArchLinux - https://archlinuxarm.org/packages/aarch64/busybox).
13. Download the pkg.tar.xz file, unpack it with tar xvf busybox-1.36.1-1-aarch64.pkg.tar.xz, transfer (same way as in step 11) usr/bin/busybox to the /tmp dir of the router, and run in the telnet shell: cd /tmp, chmod a+x busybox
14. Check the size of openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb: du -h openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
15. Delete the old and create a new kernel volume with an appropriate size (greater than the openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb size):
    • ubirmvol /dev/ubi0 -N kernel
    • ubimkvol /dev/ubi0 -n 1 -N kernel -s 9MiB
16. Write OpenWRT openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb to the flash: ./busybox ubiupdatevol /dev/ubi0_1 /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
17. Make backups:
    • cat /dev/mtd0 > /tmp/boot.bin
    • cat /dev/mtd5 > /tmp/tp_data.bin
18. Copy the /tp_data dir (you may need to chmod -R 777 the folder from SSH), /tmp/boot.bin, and /tmp/tp_data.bin to your PC using SCP. You can also backup the remaining partitions. Copy backups to a safe place, as they are required for the next steps and stock firmware recovery.

Reboot to OpenWRT initramfs

1. Reboot: reboot
2. Copy OpenWRT openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip, openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin, openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb, and MT7986_EEPROM.bin (default-mac from /tp_data backup) to the /tmp folder of the router using SCP.

Prepare UBI

1. ubidetach -p /dev/mtd3; ubiformat /dev/mtd3 -y; ubiattach -p /dev/mtd3
2. ubimkvol /dev/ubi0 -N fip -t static -s 1MiB
3. ubiupdatevol /dev/ubi0_0 /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip
4. ubimkvol /dev/ubi0 -N ubootenv -s 0x1f000
5. ubimkvol /dev/ubi0 -N ubootenv2 -s 0x1f000

Install kmod-mtd-rw and unlock partitions

1. opkg update && opkg install kmod-mtd-rw
2. insmod mtd-rw i_want_a_brick=1
3. mtd unlock boot
4. mtd unlock bl2
5. mtd unlock factory

Prepare the "factory" partition

1. dd if=/dev/zero bs=$((0x8000)) count=1 | tr '\000' '\377' > /tmp/factory.bin
2. dd if=/tmp/MT7986_EEPROM.bin of=/tmp/factory.bin conv=notrunc
3. dd if=/tmp/default-mac >> /tmp/factory.bin

Write the "factory" partition

1. mtd erase factory
2. mtd write /tmp/factory.bin factory

Write the preloader

1. mtd erase bl2
2. mtd write /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin bl2

Write OpenWRT sysupgrade image

1. sysupgrade -n /tmp/openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb

Flash Layout

You don't need to type this on the console:

0x000000000000-0x000000200000 : "boot"        0x200000
0x000000200000-0x000000300000 : "u-boot-env"  0x100000
0x000000300000-0x000003500000 : "ubi0"        0x3200000
0x000003500000-0x000006700000 : "ubi1"        0x3200000
0x000006700000-0x000006f00000 : "userconfig"  0x800000
0x000006f00000-0x000007300000 : "tp_data"     0x400000

UBI Structure

+---------------------+--------------------+---------------------+---------------------+
| UBI Image:          |                    |                     |                     |
| Volume Name: uboot  | Volume Name: uboot | Volume Name: kernel | Volume Name: rootfs |
| Volume Name: kernel | Vol ID: 0          | Vol ID: 1           | Vol ID: 2           |
| Volume Name: rootfs | Vol_type: 'static' | Vol_type: 'static'  | Vol_type: 'static'  |
+---------------------+--------------------+---------------------+---------------------+

The uboot is the secondary u-boot in UBI.

Post-Install

Once you have installed everything and the router is operational, log in and set up the basic stuff.

1. Disable Packet Steering from Interfaces -> Global Network Options (this doesn't work well with Hardware Flow Offloading and results in slow file transfer speed (Samba) over the network).
2. Enable Hardware Flow Offloading from Network -> Firewall.
3. Log in via SSH and enable irqbalance:
   • nano /etc/config/irqbalance!
   • Change the option enabled from "0" to "1".
4. Enable it by:
   • /etc/init.d/irqbalance start
   • /etc/init.d/irqbalance enable
5. Reboot.
6. Set up WiFi, choosing "Panama" as the country code, as this will allow the maximum TX power of 28 dBm.

That's it!

5Ghz 160Mhz Band WiFi 6 Performance from a local server with 2.5G LAN Card..... !

If something goes wrong and you need to debrick, visit [https://openwrt.org/toh/mercusys/mr90x_v1].