openwrt/target/linux/ramips/image/mt76x8.mk

501 lines
13 KiB
Makefile
Raw Normal View History

#
# MT76x8 Profiles
#
define Device/tplink
TPLINK_FLASHLAYOUT :=
TPLINK_HWID :=
TPLINK_HWREV :=
TPLINK_HWREVADD :=
TPLINK_HVERSION :=
KERNEL := $(KERNEL_DTB)
KERNEL_INITRAMFS := $(KERNEL_DTB) | tplink-v2-header -e
IMAGES += tftp-recovery.bin
IMAGE/factory.bin := tplink-v2-image -e
IMAGE/tftp-recovery.bin := pad-extra 128k | $$(IMAGE/factory.bin)
IMAGE/sysupgrade.bin := tplink-v2-image -s -e | append-metadata | \
check-size $$$$(IMAGE_SIZE)
endef
DEVICE_VARS += TPLINK_FLASHLAYOUT TPLINK_HWID TPLINK_HWREV TPLINK_HWREVADD TPLINK_HVERSION
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13 TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-21 12:16:15 +00:00
define Device/alfa-network_awusfree1
DTS := AWUSFREE1
IMAGE_SIZE := $(ralink_default_fw_size_8M)
DEVICE_TITLE := ALFA Network AWUSFREE1
DEVICE_PACKAGES := uboot-envtools
endef
TARGET_DEVICES += alfa-network_awusfree1
ramips: add CUDY WR1000 support Cudy WR1200 is an AC1200 AP with 3-port FE and 2 non-detachable antennas Specifications: MT7628 (580 MHz) 64 MB of RAM (DDR2) 8 MB of FLASH 2T2R 2.4 GHz (MT7628) 2T2R 5 GHz (MT7612E) 3x 10/100 Mbps Ethernet (2 LAN + 1 WAN) 2x external, non-detachable antennas (5dbi) UART header on PCB (57600 8n1) 7x LED, 2x button Known issues: The Power LED is always ON, probably because it is connected directly to power. Flash instructions ------------------ Load the ...-factory.bin image via the stock web interface. Openwrt upgrade instructions ---------------------------- Use the ...-sysupgrade.bin image for future upgrades. Revert to stock FW ------------------ Warning! This tutorial will work only with the following OEM FW: WR1000_EU_92.122.2.4987.201806261618.bin WR1000_US_92.122.2.4987.201806261609.bin If in the future these firmwares will not be available anymore, you have to find the new XOR key. 1) Download the original FW from the Cudy website. (For example WR1000_EU_92.122.2.4987.201806261618.bin) 2) Remove the header. dd if="WR1000_EU_92.122.2.4987.201806261618.bin" of="WR1000_EU_92.122.2.4987.201806261618.bin.mod" skip=8 bs=64 3) XOR the new file with the region key. FOR EU: 7B76741E67594351555042461D625F4545514B1B03050208000603020803000D FOR US: 7B76741E675943555D5442461D625F454555431F03050208000603060007010C You can use OpenWrt's tools/firmware-utils/src/xorimage.c tool for this: xorimage -i WR1000..bin.mod -o stock-firmware.bin -x -p 7B767.. Or, you can use this tool (CHANGE THE XOR KEY ACCORDINGLY!): https://gchq.github.io/CyberChef/#recipe=XOR(%7B'option':'Hex','string':''%7D,'',false) 4) Check the resulting decrypted image. Check if bytes from 0x20 to 0x3f are: 4C 69 6E 75 78 20 4B 65 72 6E 65 6C 20 49 6D 61 67 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Alternatively, you can use u-boot's tool dumpimage tool to check if the decryption was successful. It should look like: # dumpimage -l stock-firmware.bin Image Name: Linux Kernel Image Created: Tue Jun 26 10:24:54 2018 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 4406635 Bytes = 4303.35 KiB = 4.20 MiB Load Address: 80000000 Entry Point: 8000c150 5) Flash it via forced firmware upgrade and don't "Keep Settings" CLI: sysupgrade -F -n stock-firmware.bin LuCI: make sure to click on the "Keep settings" checkbox to disable it. You'll need to do this !TWICE! because on the first try, LuCI will refuse the image and reset the "Keep settings" to enable. However a new "Force upgrade" checkbox will appear as well. Make sure to do this very carefully! Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com> Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [added wifi compatible, spiffed-up the returned to stock instructions]
2019-05-20 03:20:37 +00:00
define Device/cudy_wr1000
DTS := WR1000
IMAGE_SIZE := $(ralink_default_fw_size_8M)
IMAGES += factory.bin
IMAGE/factory.bin := \
$$(sysupgrade_bin) | check-size $$$$(IMAGE_SIZE) | jcg-header 92.122
JCG_MAXSIZE := 8060928
DEVICE_TITLE := Cudy WR1000
DEVICE_PACKAGES := kmod-mt76x2
SUPPORTED_DEVICES += wr1000
endef
TARGET_DEVICES += cudy_wr1000
define Device/tama_w06
DTS := W06
IMAGE_SIZE := 15040k
DEVICE_TITLE := Tama W06
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
endef
TARGET_DEVICES += tama_w06
define Device/duzun-dm06
DTS := DUZUN-DM06
DEVICE_TITLE := DuZun DM06
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += duzun-dm06
define Device/gl-mt300n-v2
DTS := GL-MT300N-V2
IMAGE_SIZE := 16064k
DEVICE_TITLE := GL-iNet GL-MT300N-V2
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
endef
TARGET_DEVICES += gl-mt300n-v2
define Device/glinet_vixmini
DTS := VIXMINI
IMAGE_SIZE := 7872k
DEVICE_TITLE := GL.iNet VIXMINI
SUPPORTED_DEVICES += vixmini
endef
TARGET_DEVICES += glinet_vixmini
define Device/hc5661a
DTS := HC5661A
IMAGE_SIZE := $(ralink_default_fw_size_16M)
DEVICE_TITLE := HiWiFi HC5661A
endef
TARGET_DEVICES += hc5661a
define Device/hilink_hlk-7628n
DTS := HLK-7628N
IMAGE_SIZE := $(ralink_default_fw_size_32M)
DEVICE_TITLE := HILINK HLK7628N
endef
TARGET_DEVICES += hilink_hlk-7628n
define Device/hiwifi_hc5861b
DTS := HC5861B
IMAGE_SIZE := 15808k
DEVICE_TITLE := HiWiFi HC5861B
DEVICE_PACKAGES := kmod-mt76x2
endef
TARGET_DEVICES += hiwifi_hc5861b
define Device/LinkIt7688
DTS := LINKIT7688
IMAGE_SIZE := $(ralink_default_fw_size_32M)
SUPPORTED_DEVICES := linkits7688 linkits7688d
DEVICE_TITLE := MediaTek LinkIt Smart 7688
DEVICE_PACKAGES:= kmod-usb2 kmod-usb-ohci uboot-envtools
endef
TARGET_DEVICES += LinkIt7688
define Device/mac1200r-v2
DTS := MAC1200RV2
DEVICE_TITLE := Mercury MAC1200R v2.0
SUPPORTED_DEVICES := mac1200rv2
DEVICE_PACKAGES := kmod-mt76x2
endef
TARGET_DEVICES += mac1200r-v2
define Device/miwifi-nano
DTS := MIWIFI-NANO
IMAGE_SIZE := $(ralink_default_fw_size_16M)
DEVICE_TITLE := Xiaomi MiWiFi Nano
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += miwifi-nano
define Device/mt7628
DTS := MT7628
BLOCKSIZE := 64k
IMAGE_SIZE := $(ralink_default_fw_size_4M)
DEVICE_TITLE := MediaTek MT7628 EVB
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += mt7628
define Device/netgear_r6120
DTS := R6120
BLOCKSIZE := 64k
IMAGE_SIZE := $(ralink_default_fw_size_16M)
DEVICE_TITLE := Netgear R6120
DEVICE_PACKAGES := kmod-mt76x2 kmod-usb2 kmod-usb-ohci
SERCOMM_HWID := CGQ
SERCOMM_HWVER := A001
SERCOMM_SWVER := 0x0040
IMAGES += factory.img
IMAGE/default := append-kernel | pad-to $$$$(BLOCKSIZE)| append-rootfs | pad-rootfs
IMAGE/sysupgrade.bin := $$(IMAGE/default) | append-metadata | check-size $$$$(IMAGE_SIZE)
IMAGE/factory.img := pad-extra 576k | $$(IMAGE/default) | pad-to $$$$(BLOCKSIZE) | \
sercom-footer | pad-to 128 | zip R6120.bin | sercom-seal
endef
TARGET_DEVICES += netgear_r6120
define Device/omega2
DTS := OMEGA2
IMAGE_SIZE := $(ralink_default_fw_size_16M)
DEVICE_TITLE := Onion Omega2
DEVICE_PACKAGES:= kmod-usb2 kmod-usb-ohci uboot-envtools
endef
TARGET_DEVICES += omega2
define Device/omega2p
DTS := OMEGA2P
IMAGE_SIZE := $(ralink_default_fw_size_32M)
DEVICE_TITLE := Onion Omega2+
DEVICE_PACKAGES:= kmod-usb2 kmod-usb-ohci uboot-envtools kmod-sdhci-mt7620
endef
TARGET_DEVICES += omega2p
define Device/pbr-d1
DTS := PBR-D1
IMAGE_SIZE := $(ralink_default_fw_size_16M)
DEVICE_TITLE := PBR-D1
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
endef
TARGET_DEVICES += pbr-d1
define Device/rakwireless_rak633
DTS := RAK633
DEVICE_TITLE := Rakwireless RAK633
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
endef
TARGET_DEVICES += rakwireless_rak633
define Device/skylab_skw92a
ramips: add support for Skylab SKW92A in EVB Specifically, SKW92A_E16, described here: http://www.skylabmodule.com/wp-content/uploads/SkyLab_SKW92A_V1.04_datasheet.pdf Specification: - MediaTek MT7628N/N (580 Mhz) - 64 MB of RAM - 16 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x u.FL - Power by micro-USB connector at USB1 on EVB - UART via micro-USB connector at USB3 on EVB (57600 8n1) - 5x Ethernet LEDs - 1x WLAN LEDs - 1x WPS LED connected by jumper wire from I2S_CK on J20 to WPS_LED pin hole next to daughter board on EVB - WPS/Reset button (S2 on EVB) - RESET button (S1 on EVB) is *not* connected to RST hole next to daughter board Flash instruction: >From Skylab firmware: 1. Associate with SKYLAP_AP 2. In a browser, load: http://10.10.10.254/ 3. Username/password: admin/admin 4. In web admin interface: Administration / Upload Firmware, browse to sysupgrade image, apply, flash will fail with a message: Not a valid firmware. *** Warning: "/var/tmpFW" has corrupted data! 5. Telnet to 10.10.10.254, drops you into a root shell with no credentials 6. # cd /var 7. # mtd_write -r write tmpFW mtd4 Unlocking mtd4 ... Writing from tmpFW to mtd4 ... [e] 8. When flash has completed, you will have booted into your firmware. >From U-boot via TFTP and initramfs: 1. Place openwrt-ramips-mt76x8-skw92a-initramfs-kernel.bin on a TFTP server 2. Connect to serial console at USB3 on EVB 3. Connect ethernet between port 1 (not WAN) and your TFTP server (e.g. 192.168.11.20) 4. Start terminal software (e.g. screen /dev/ttyUSB0 57600) on PC 5. Apply power to EVB 6. Interrupt u-boot with keypress of "1" 7. At u-boot prompts: Input device IP (10.10.10.123) ==:192.168.11.21 Input server IP (10.10.10.3) ==:192.168.11.20 Input Linux Kernel filename (root_uImage) ==:openwrt-ramips-mt76x8-skw92a-initramfs-kernel.bin 8. Move ethernet to port 0 (WAN) on EVB 9. At new OpenWrt console shell, fetch squashfs-sysupgrade image and flash with sysupgrade. >From U-boot via TFTP direct flash: 1. Place openwrt-ramips-mt76x8-skw92a-squashfs-sysupgrade.bin on a TFTP server 2. Connect to serial console at USB3 on EVB (57600 8N1) 3. Connect ethernet between port 1 (not WAN) an your TFTP server (e.g. 192.168.11.20) 4. Start terminal software (e.g. screen /dev/ttyUSB0 57600) on PC 5. Apply power to EVB 6. Interrupt u-boot with keypress of "2" 7. At u-boot prompts: Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N) Y Input device IP (10.10.10.123) ==:192.168.11.21 Input server IP (10.10.10.3) ==:192.168.11.20 Input Linux Kernel filename (root_uImage) ==:openwrt-ramips-mt76x8-skw92a-squashfs-sysupgrade.bin 8. When transfer is complete or as OpenWrt begins booting, move ethernet to port 0 (WAN). Signed-off-by: Russell Senior <russell@personaltelco.net>
2018-11-25 11:39:19 +00:00
DTS := SKW92A
IMAGE_SIZE := 16064k
DEVICE_TITLE := Skylab SKW92A
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
endef
TARGET_DEVICES += skylab_skw92a
ramips: add support for Skylab SKW92A in EVB Specifically, SKW92A_E16, described here: http://www.skylabmodule.com/wp-content/uploads/SkyLab_SKW92A_V1.04_datasheet.pdf Specification: - MediaTek MT7628N/N (580 Mhz) - 64 MB of RAM - 16 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x u.FL - Power by micro-USB connector at USB1 on EVB - UART via micro-USB connector at USB3 on EVB (57600 8n1) - 5x Ethernet LEDs - 1x WLAN LEDs - 1x WPS LED connected by jumper wire from I2S_CK on J20 to WPS_LED pin hole next to daughter board on EVB - WPS/Reset button (S2 on EVB) - RESET button (S1 on EVB) is *not* connected to RST hole next to daughter board Flash instruction: >From Skylab firmware: 1. Associate with SKYLAP_AP 2. In a browser, load: http://10.10.10.254/ 3. Username/password: admin/admin 4. In web admin interface: Administration / Upload Firmware, browse to sysupgrade image, apply, flash will fail with a message: Not a valid firmware. *** Warning: "/var/tmpFW" has corrupted data! 5. Telnet to 10.10.10.254, drops you into a root shell with no credentials 6. # cd /var 7. # mtd_write -r write tmpFW mtd4 Unlocking mtd4 ... Writing from tmpFW to mtd4 ... [e] 8. When flash has completed, you will have booted into your firmware. >From U-boot via TFTP and initramfs: 1. Place openwrt-ramips-mt76x8-skw92a-initramfs-kernel.bin on a TFTP server 2. Connect to serial console at USB3 on EVB 3. Connect ethernet between port 1 (not WAN) and your TFTP server (e.g. 192.168.11.20) 4. Start terminal software (e.g. screen /dev/ttyUSB0 57600) on PC 5. Apply power to EVB 6. Interrupt u-boot with keypress of "1" 7. At u-boot prompts: Input device IP (10.10.10.123) ==:192.168.11.21 Input server IP (10.10.10.3) ==:192.168.11.20 Input Linux Kernel filename (root_uImage) ==:openwrt-ramips-mt76x8-skw92a-initramfs-kernel.bin 8. Move ethernet to port 0 (WAN) on EVB 9. At new OpenWrt console shell, fetch squashfs-sysupgrade image and flash with sysupgrade. >From U-boot via TFTP direct flash: 1. Place openwrt-ramips-mt76x8-skw92a-squashfs-sysupgrade.bin on a TFTP server 2. Connect to serial console at USB3 on EVB (57600 8N1) 3. Connect ethernet between port 1 (not WAN) an your TFTP server (e.g. 192.168.11.20) 4. Start terminal software (e.g. screen /dev/ttyUSB0 57600) on PC 5. Apply power to EVB 6. Interrupt u-boot with keypress of "2" 7. At u-boot prompts: Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N) Y Input device IP (10.10.10.123) ==:192.168.11.21 Input server IP (10.10.10.3) ==:192.168.11.20 Input Linux Kernel filename (root_uImage) ==:openwrt-ramips-mt76x8-skw92a-squashfs-sysupgrade.bin 8. When transfer is complete or as OpenWrt begins booting, move ethernet to port 0 (WAN). Signed-off-by: Russell Senior <russell@personaltelco.net>
2018-11-25 11:39:19 +00:00
define Device/totolink_lr1200
DTS := TOTOLINK-LR1200
IMAGE_SIZE := 7872k
DEVICE_TITLE := TOTOLINK LR1200
DEVICE_PACKAGES := kmod-mt76x2 kmod-usb2 uqmi
endef
TARGET_DEVICES += totolink_lr1200
define Device/tplink_tl-wa801nd-v5
$(Device/tplink)
DTS := TL-WA801NDV5
IMAGE_SIZE := 7808k
DEVICE_TITLE := TP-Link TL-WA801ND v5
TPLINK_FLASHLAYOUT := 8Mmtk
TPLINK_HWID := 0x08010005
TPLINK_HWREV := 0x1
TPLINK_HWREVADD := 0x5
TPLINK_HVERSION := 3
endef
TARGET_DEVICES += tplink_tl-wa801nd-v5
define Device/tplink_tl-wr802n-v4
$(Device/tplink)
DTS := TL-WR802NV4
IMAGE_SIZE := 7808k
DEVICE_TITLE := TP-Link TL-WR802N v4
TPLINK_FLASHLAYOUT := 8Mmtk
TPLINK_HWID := 0x08020004
TPLINK_HWREV := 0x1
TPLINK_HWREVADD := 0x4
TPLINK_HVERSION := 3
endef
TARGET_DEVICES += tplink_tl-wr802n-v4
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13 TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-21 12:16:15 +00:00
define Device/tl-wr840n-v4
$(Device/tplink)
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13 TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-21 12:16:15 +00:00
DTS := TL-WR840NV4
IMAGE_SIZE := 7808k
DEVICE_TITLE := TP-Link TL-WR840N v4
TPLINK_FLASHLAYOUT := 8Mmtk
TPLINK_HWID := 0x08400004
TPLINK_HWREV := 0x1
TPLINK_HWREVADD := 0x4
TPLINK_HVERSION := 3
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13 TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-21 12:16:15 +00:00
endef
TARGET_DEVICES += tl-wr840n-v4
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13 TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-21 12:16:15 +00:00
ramips: add support for TP-Link TL-WR840N v5 TP-Link TL-WR840N v5 is simple N300 router with 5-port FE switch and non-detachable antennas, based on MediaTek MT7628NN (aka MT7628N) WiSoC. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 4 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - 1x LED (GPIO-controlled), 1x button * LED in TL-WR840N v5 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Orange LED is registered so you can later use it for your own purposes. Flash instruction: Unlike TL-WR840N v4 flashing through WEB UI works in v5. 1. Download lede-ramips-mt76x8-tl-wr840n-v5-squashfs-sysupgrade.bin image. 2. Go to 192.168.0.1 3. Flash the sysupgrade image through Firmware upgrade section of WEB UI. 4. Wait until green LED stops flashing and use the router. Notes: TFTP recovery is broken since TP-Link reused bootloader code for v4 and that does not take into account only 4 MB of flash and bricks the device. So do not use TFTP Recovery or you will have to rewrite SPI flash. They fixed it in later GPL code,but it is unknown which version of bootloader you have. After manually compiling and flashing bootloader from GPL sources TFTP recovery works properly. Signed-off-by: Robert Marko <robimarko@gmail.com>
2017-11-08 13:00:06 +00:00
define Device/tl-wr840n-v5
DTS := TL-WR840NV5
IMAGE_SIZE := 3904k
ramips: add support for TP-Link TL-WR840N v5 TP-Link TL-WR840N v5 is simple N300 router with 5-port FE switch and non-detachable antennas, based on MediaTek MT7628NN (aka MT7628N) WiSoC. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 4 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - 1x LED (GPIO-controlled), 1x button * LED in TL-WR840N v5 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Orange LED is registered so you can later use it for your own purposes. Flash instruction: Unlike TL-WR840N v4 flashing through WEB UI works in v5. 1. Download lede-ramips-mt76x8-tl-wr840n-v5-squashfs-sysupgrade.bin image. 2. Go to 192.168.0.1 3. Flash the sysupgrade image through Firmware upgrade section of WEB UI. 4. Wait until green LED stops flashing and use the router. Notes: TFTP recovery is broken since TP-Link reused bootloader code for v4 and that does not take into account only 4 MB of flash and bricks the device. So do not use TFTP Recovery or you will have to rewrite SPI flash. They fixed it in later GPL code,but it is unknown which version of bootloader you have. After manually compiling and flashing bootloader from GPL sources TFTP recovery works properly. Signed-off-by: Robert Marko <robimarko@gmail.com>
2017-11-08 13:00:06 +00:00
DEVICE_TITLE := TP-Link TL-WR840N v5
TPLINK_FLASHLAYOUT := 4Mmtk
TPLINK_HWID := 0x08400005
TPLINK_HWREV := 0x1
TPLINK_HWREVADD := 0x5
TPLINK_HVERSION := 3
KERNEL := $(KERNEL_DTB)
KERNEL_INITRAMFS := $(KERNEL_DTB) | tplink-v2-header -e
IMAGE/sysupgrade.bin := tplink-v2-image -s -e | append-metadata | \
check-size $$$$(IMAGE_SIZE)
endef
TARGET_DEVICES += tl-wr840n-v5
ramips: add support for TP-Link TL-WR840N v5 TP-Link TL-WR840N v5 is simple N300 router with 5-port FE switch and non-detachable antennas, based on MediaTek MT7628NN (aka MT7628N) WiSoC. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 4 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - 1x LED (GPIO-controlled), 1x button * LED in TL-WR840N v5 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Orange LED is registered so you can later use it for your own purposes. Flash instruction: Unlike TL-WR840N v4 flashing through WEB UI works in v5. 1. Download lede-ramips-mt76x8-tl-wr840n-v5-squashfs-sysupgrade.bin image. 2. Go to 192.168.0.1 3. Flash the sysupgrade image through Firmware upgrade section of WEB UI. 4. Wait until green LED stops flashing and use the router. Notes: TFTP recovery is broken since TP-Link reused bootloader code for v4 and that does not take into account only 4 MB of flash and bricks the device. So do not use TFTP Recovery or you will have to rewrite SPI flash. They fixed it in later GPL code,but it is unknown which version of bootloader you have. After manually compiling and flashing bootloader from GPL sources TFTP recovery works properly. Signed-off-by: Robert Marko <robimarko@gmail.com>
2017-11-08 13:00:06 +00:00
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13 TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-21 12:16:15 +00:00
define Device/tl-wr841n-v13
$(Device/tplink)
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13 TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-21 12:16:15 +00:00
DTS := TL-WR841NV13
IMAGE_SIZE := 7808k
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13 TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-21 12:16:15 +00:00
DEVICE_TITLE := TP-Link TL-WR841N v13
TPLINK_FLASHLAYOUT := 8Mmtk
TPLINK_HWID := 0x08410013
TPLINK_HWREV := 0x268
TPLINK_HWREVADD := 0x13
TPLINK_HVERSION := 3
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13 TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-21 12:16:15 +00:00
endef
TARGET_DEVICES += tl-wr841n-v13
define Device/tplink_tl-wr841n-v14
$(Device/tplink)
DTS := TL-WR841NV14
IMAGE_SIZE := 3968k
DEVICE_TITLE := TP-Link TL-WR841N v14
TPLINK_FLASHLAYOUT := 4Mmtk
TPLINK_HWID := 0x08410014
TPLINK_HWREV := 0x1
TPLINK_HWREVADD := 0x14
TPLINK_HVERSION := 3
IMAGE/tftp-recovery.bin := pad-extra 64k | $$(IMAGE/factory.bin)
endef
TARGET_DEVICES += tplink_tl-wr841n-v14
define Device/tplink_c20-v4
$(Device/tplink)
DTS := ArcherC20v4
IMAGE_SIZE := 7808k
DEVICE_TITLE := TP-Link ArcherC20 v4
TPLINK_FLASHLAYOUT := 8Mmtk
TPLINK_HWID := 0xc200004
TPLINK_HWREV := 0x1
TPLINK_HWREVADD := 0x4
TPLINK_HVERSION := 3
DEVICE_PACKAGES := kmod-mt76x0e
endef
TARGET_DEVICES += tplink_c20-v4
define Device/tplink_c50-v3
$(Device/tplink)
DTS := ArcherC50V3
IMAGE_SIZE := 7808k
DEVICE_TITLE := TP-Link ArcherC50 v3
TPLINK_FLASHLAYOUT := 8Mmtk
TPLINK_HWID := 0x001D9BA4
TPLINK_HWREV := 0x79
TPLINK_HWREVADD := 0x1
TPLINK_HVERSION := 3
DEVICE_PACKAGES := kmod-mt76x2
endef
TARGET_DEVICES += tplink_c50-v3
ramips: add support for Archer C50 v4 This adds support for the TP-Link Archer C50 v4. It uses the same hardware as the v3 variant, sharing the same FCC-ID. CPU: MediaTek MT7628 (580MHz) RAM: 64M DDR2 FLASH: 8M SPI WiFi: 2.4GHz 2x2 MT7628 b/g/n integrated WiFI: 5GHz 2x2 MT7612 a/n/ac ETH: 1x WAN 4x LAN LED: Power, WiFi2, WiFi5, LAN, WAN, WPS BTN: WPS/WiFi, RESET UART: Near ETH ports, 115200 8n1, TP-Link pinout Create Factory image -------------------- As all installation methods require a U-Boot to be integrated into the Image (and we do not ship one with the image) we are not able to create an image in the OpenWRT build-process. Download a TP-Link image from their Wesite and a OpenWRT sysupgrade image for the device and build yourself a factory image like following: TP-Link image: tpl.bin OpenWRT sysupgrade image: owrt.bin > dd if=tpl.bin of=boot.bin bs=131584 count=1 > cat owrt.bin >> boot.bin Installing via Web-UI --------------------- Upload the boot.bin via TP-Links firmware upgrade tool in the web-interface. Installing via Recovery ----------------------- Activate Web-Recovery by beginning the upgrade Process with a Firmware-Image from TP-Link. After starting the Firmware Upgrade, wait ~3 seconds (When update status is switching to 0%), then disconnect the power supply from the device. Upgrade flag (which activates Web-Recovery) is written before the OS-image is touched and removed after write is succesfull, so this procedure should be safe. Plug the power back in. It will come up in Recovery-Mode on 192.168.0.1. When active, all LEDs but the WPS LED are off. Remeber to assign yourself a static IP-address as DHCP is not active in this mode. The boot.bin can now be uploaded and flashed using the web-recovery. Installing via TFTP ------------------- Prepare an image like following (Filenames from factory image steps apply here) > dd if=/dev/zero of=tp_recovery.bin bs=196608 count=1 > dd if=tpl.bin of=tmp.bin bs=131584 count=1 > dd if=tmp.bin of=boot.bin bs=512 skip=1 > cat boot.bin >> tp_recovery.bin > cat owrt.bin >> tp_recovery.bin Place tp_recovery.bin in root directory of TFTP server and listen on 192.168.0.66/24. Connect router LAN ports with your computer and power up the router while pressing the reset button. The router will download the image via tftp and after ~1 Minute reboot into OpenWRT. U-Boot CLI ---------- U-Boot CLI can be activated by holding down '4' on bootup. Dual U-Boot ----------- This is the first TP-Link MediaTek device to feature a split-uboot design. The first (factory-uboot) provides recovery via TFTP and HTTP, jumping straight into the second (firmware-uboot) if no recovery needs to be performed. The firmware-uboot unpacks and executed the kernel. Web-Recovery ------------ TP-Link integrated a new Web-Recovery like the one on the Archer C7v4 / TL-WR1043v5. Stock-firmware sets a flag in the "romfile" partition before beginning to write and removes it afterwards. If the router boots with this flag set, bootloader will automatically start Web-recovery and listens on 192.168.0.1. This way, the vendor-firmware or an OpenWRT factory image can be written. By doing the same while performing sysupgrade, we can take advantage of the Web-recovery in OpenWRT. It is important to note that Web-Recovery is only based on this flag. It can't detect e.g. a crashing kernel or other means. Once activated it won't boot the OS before a recovery action (either via TFTP or HTTP) is performed. This recovery-mode is indicated by an illuminated WPS-LED on boot. Signed-off-by: David Bauer <mail@david-bauer.net>
2018-12-31 15:24:26 +00:00
define Device/tplink_c50-v4
$(Device/tplink)
DTS := ArcherC50V4
IMAGE_SIZE := 7616k
DEVICE_TITLE := TP-Link ArcherC50 v4
TPLINK_FLASHLAYOUT := 8MSUmtk
TPLINK_HWID := 0x001D589B
TPLINK_HWREV := 0x93
TPLINK_HWREVADD := 0x2
TPLINK_HVERSION := 3
DEVICE_PACKAGES := kmod-mt76x2
IMAGES := sysupgrade.bin
endef
TARGET_DEVICES += tplink_c50-v4
define Device/tplink_tl-mr3020-v3
$(Device/tplink)
DTS := TL-MR3020V3
IMAGE_SIZE := 7808k
DEVICE_TITLE := TP-Link TL-MR3020 v3
TPLINK_FLASHLAYOUT := 8Mmtk
TPLINK_HWID := 0x30200003
TPLINK_HWREV := 0x3
TPLINK_HWREVADD := 0x3
TPLINK_HVERSION := 3
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += tplink_tl-mr3020-v3
define Device/tplink_tl-mr3420-v5
$(Device/tplink)
DTS := TL-MR3420V5
IMAGE_SIZE := 7808k
DEVICE_TITLE := TP-Link TL-MR3420 v5
TPLINK_FLASHLAYOUT := 8Mmtk
TPLINK_HWID := 0x34200005
TPLINK_HWREV := 0x5
TPLINK_HWREVADD := 0x5
TPLINK_HVERSION := 3
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += tplink_tl-mr3420-v5
define Device/tplink_tl-wr842n-v5
$(Device/tplink)
DTS := TL-WR842NV5
IMAGE_SIZE := 7808k
DEVICE_TITLE := TP-Link TL-WR842N v5
TPLINK_FLASHLAYOUT := 8Mmtk
TPLINK_HWID := 0x08420005
TPLINK_HWREV := 0x5
TPLINK_HWREVADD := 0x5
TPLINK_HVERSION := 3
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += tplink_tl-wr842n-v5
define Device/tplink_tl-wr902ac-v3
$(Device/tplink)
DTS := TL-WR902ACV3
IMAGE_SIZE := 7808k
DEVICE_TITLE := TP-Link TL-WR902AC v3
TPLINK_FLASHLAYOUT := 8Mmtk
TPLINK_HWID := 0x000dc88f
TPLINK_HWREV := 0x89
TPLINK_HWREVADD := 0x1
TPLINK_HVERSION := 3
DEVICE_PACKAGES := kmod-mt76x0e kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += tplink_tl-wr902ac-v3
ramips: add support for UniElec U7628-01 UniElec U7628-01 is a router platform board based on MediaTek MT7628AN. The device has the following specifications: - MT7628AN (580MHz) - 64/128/256 MB of RAM (DDR2) - 8/16 MB of flash (SPI NOR) - 5x 10/100 Mbps Ethernet (MT7628 built-in switch) - 1x 2T2R 2.4 GHz Wi-Fi (MT7628) - 1x miniPCIe slot (with PCIe and USB 2.0 buses) - 1x miniSIM slot - 1x microSD slot - 1x USB 2.0 port - 7x single-color LEDs (GPIO-controlled) - 1x bi-color LED (green GPIO-controlled, red -> LED_WLAN# in miniPCIe) - 1x reset button - 1x UART header (4-pins) - 1x SDXC/GPIO header (10-pins, connected with microSD slot) - 1x DC jack for main power (12 V) The following has been tested and is working: - Ethernet switch - miniPCIe slot (tested with modem and Wi-Fi card) - miniSIM slot - sysupgrade - reset button - USB 2.0 port* Due to a missing driver (MMC over GPIO) this is not supported: - microSD card reader * Warning: USB buses in miniPCIe and regular A-type socket are connected together, without any proper analog switch or USB HUB. Installation: This board might come with a different firmware versions (MediaTek SDK, PandoraBox, Padavan, etc.). If your board comes with PandoraBox, you can install LEDE using sysupgrade. Just SSH to the router and perform forced sysupgrade (due to a board name mismatch). The default IP of this board should be: 192.168.1.1 and username/password: root/admin. In case of a different firmware, you can use web based recovery described below. Use the following command to perform the sysupgrade (for the 128MB RAM/16MB flash version): sysupgrade -n -F lede-ramips-mt76x8-u7628-01-128M-16M-squashfs-sysupgrade.bin Recovery: This board contains a Chinese, closed-source bootloader called Breed (Boot and Recovery Environment for Embedded Devices). Breed supports web recovery and to enter it, you keep the reset button pressed for around 5 seconds during boot. Your machine will be assigned an IP through DHCP and the router will use IP address 192.168.1.1. The recovery website is in Chinese, but is easy to use. Click on the second item in the list to access the recovery page, then the second item on the next page is where you select the firmware. In order to start the recovery, you click the button at the bottom. SDXC/GPIO header (J3): 1. SDXC_D3 / I2C_SCLK 2. SDXC_D2 / I2C_SD 3. SDXC_D1 / I2S_DI 4. SDXC_D0 / I2S_WS 5. SDXC_CMD / I2S_CLK 6. SDXC_CLK / GPIO0 7. SDXC_CD / UART_RXD1 8. UART_TXD1 9. 3V3 10. GND Other notes: 1. The board is available with different amounts of RAM and flash. We have only added support for the 128/16 MB configuration, as that seems to be the default. However, all the required infrastructure is in place for making support for the other configurations easy. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com> Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
2017-11-03 20:12:49 +00:00
define Device/u7628-01-128M-16M
DTS := U7628-01-128M-16M
IMAGE_SIZE := 16064k
DEVICE_TITLE := UniElec U7628-01 (128M RAM/16M flash)
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += u7628-01-128M-16M
define Device/vocore2
DTS := VOCORE2
IMAGE_SIZE := $(ralink_default_fw_size_16M)
DEVICE_TITLE := VoCore VoCore2
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport \
kmod-sdhci-mt7620
endef
TARGET_DEVICES += vocore2
define Device/vocore2lite
DTS := VOCORE2LITE
IMAGE_SIZE := $(ralink_default_fw_size_16M)
DEVICE_TITLE := VoCore VoCore2-Lite
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport \
kmod-sdhci-mt7620
endef
TARGET_DEVICES += vocore2lite
define Device/wavlink_wl-wn570ha1
DTS := WL-WN570HA1
IMAGE_SIZE := $(ralink_default_fw_size_8M)
DEVICE_TITLE := Wavlink WL-WN570HA1
DEVICE_PACKAGES := kmod-mt76x0e
endef
TARGET_DEVICES += wavlink_wl-wn570ha1
define Device/wavlink_wl-wn575a3
DTS := WL-WN575A3
IMAGE_SIZE := $(ralink_default_fw_size_8M)
DEVICE_TITLE := Wavlink WL-WN575A3
DEVICE_PACKAGES := kmod-mt76x2
SUPPORTED_DEVICES += wl-wn575a3
endef
TARGET_DEVICES += wavlink_wl-wn575a3
define Device/wcr-1166ds
DTS := WCR-1166DS
BUFFALO_TAG_PLATFORM := MTK
BUFFALO_TAG_VERSION := 9.99
BUFFALO_TAG_MINOR := 9.99
IMAGES += factory.bin
IMAGE/sysupgrade.bin := trx | pad-rootfs | append-metadata
IMAGE/factory.bin := \
trx -M 0x746f435c | pad-rootfs | append-metadata | \
buffalo-enc WCR-1166DS $$(BUFFALO_TAG_VERSION) -l | \
buffalo-tag-dhp WCR-1166DS JP JP | buffalo-enc-tag -l | \
buffalo-dhp-image
DEVICE_TITLE := Buffalo WCR-1166DS
DEVICE_PACKAGES := kmod-mt76x2
endef
TARGET_DEVICES += wcr-1166ds
define Device/widora_neo-16m
DTS := WIDORA-NEO-16M
IMAGE_SIZE := $(ralink_default_fw_size_16M)
DEVICE_TITLE := Widora-NEO (16M)
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
SUPPORTED_DEVICES += widora-neo
endef
TARGET_DEVICES += widora_neo-16m
define Device/widora_neo-32m
DTS := WIDORA-NEO-32M
IMAGE_SIZE := $(ralink_default_fw_size_32M)
DEVICE_TITLE := Widora-NEO (32M)
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
endef
TARGET_DEVICES += widora_neo-32m
define Device/wiznet_wizfi630s
DTS := WIZFI630S
IMAGE_SIZE := $(ralink_default_fw_size_32M)
DEVICE_TITLE := WIZnet WizFi630S
endef
TARGET_DEVICES += wiznet_wizfi630s
define Device/wrtnode2p
DTS := WRTNODE2P
IMAGE_SIZE := $(ralink_default_fw_size_16M)
DEVICE_TITLE := WRTnode 2P
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
endef
TARGET_DEVICES += wrtnode2p
define Device/wrtnode2r
DTS := WRTNODE2R
IMAGE_SIZE := $(ralink_default_fw_size_16M)
DEVICE_TITLE := WRTnode 2R
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
endef
TARGET_DEVICES += wrtnode2r
define Device/xiaomi_mir4a-100m
DTS := XIAOMI-MIR4A-100M
IMAGE_SIZE := 14976k
DEVICE_TITLE := Xiaomi Mi Router 4A (100M Edition)
DEVICE_PACKAGES := kmod-mt76x2
endef
TARGET_DEVICES += xiaomi_mir4a-100m
define Device/zbtlink_zbt-we1226
DTS := ZBT-WE1226
IMAGE_SIZE := $(ralink_default_fw_size_8M)
DEVICE_TITLE := ZBTlink ZBT-WE1226
endef
TARGET_DEVICES += zbtlink_zbt-we1226
define Device/zyxel_keenetic-extra-ii
DTS := ki_rb
IMAGE_SIZE := 14912k
BLOCKSIZE := 64k
DEVICE_TITLE := ZyXEL Keenetic Extra II
DEVICE_PACKAGES := kmod-mt76x2 kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
IMAGES += factory.bin
IMAGE/factory.bin := $$(sysupgrade_bin) | pad-to $$$$(BLOCKSIZE) | \
check-size $$$$(IMAGE_SIZE) | zyimage -d 6162 -v "ZyXEL Keenetic Extra II"
endef
TARGET_DEVICES += zyxel_keenetic-extra-ii