TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.
The difference between these two models is in number of available
LEDs, buttons and power input switch.
This work is partially based on GitHub PR#974.
Specification:
- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
switch
* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
(fully) supported by gpio-leds driver. This type of LED requires both
GPIOs state change at the same time to select color or turn it off.
For now, we support/use only the green part of the LED.
Factory image notes:
These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.
We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.
Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.
The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".
Flash instruction:
Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.
To access U-Boot CLI, keep pressed "4" key during boot.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
This patch adds support for the Ubiquiti EdgeRouter X-SFP and
improves support for the EdgeRouter X (PoE-passthrough).
Specification:
- SoC: MediaTek MT7621AT
- Flash: 256 MiB
- RAM: 265 MiB
- Ethernet: 5 x LAN (1000 Mbps)
- UART: 1 x UART on PCB (3.3V, RX, TX, GND) - 57600 8N1
- EdgeRouter X:
- 1 x PoE-Passtrough (Eth4)
- powered by Wallwart or passive PoE
- EdgeRouter X-SFP:
- 5 x PoE-Out (24V, passive)
- 1 x SFP (unknown status)
- powered by Wallwart (24V)
Doesn't work:
* SoC has crypto engine but no open driver.
* SoC has nat acceleration, but no open driver.
* This router has 2MB spi flash soldered in but MT
nand/spi drivers do not support pin sharing,
so it is not accessable and disabled. Stock
firmware could read it and it was empty.
Installation
via vendor firmware:
- build an Initrd-image (> 3MiB) and upload the factory-image
- initrd can have luci-mod-failsafe
- flash final firmware via LuCI / sysupgrade on rebooted system
via TFTP:
- stop uboot into tftp-load into option "1"
- upload factory.bin image
Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
The "reserved" partition should probably be read-only, just in case. Even
not knowing it's content, other devices have marked it as such, so it
seems a good idea to do so also for this device.
Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
CC: Mathias Kresin <dev@kresin.me>
CC: Hanqing Wong <hquu@outlook.com>
Neither the AsiaRF AWM002 or AWM003 actually has an LED on the module
board. The ld1 and ld2 do not represent actual LEDs. These pins might
connect to LEDS on an eval board or other carrier board, but that is
outside the scope of this device tree file.
Signed-off-by: Russell Senior <russell@personaltelco.net>
This patch adds supports for the GL-inet GL-MT300N-V2.
Specification:
- SoC: MediaTek MT7628AN
- Flash: 16 MiB (W25Q128FVSG)
- RAM: 128 MiB DDR
- Ethernet: 1 x WAN (100 Mbps) and 1 x LAN (100 Mbps)
- USB: 1 x USB 2.0 port
- Button: 1 x switch button, 1 x reset button
- LED: 3 x LEDS (system power led is not GPIO controller)
- UART: 1 x UART on PCB (JP1: 3.3V, RX, TX, GND)
Installation through Luci:
- The original firmware is LEDE, so both LuCI or sysupgrade can be used.
- Do not keep settings, for sysupgrade please use the -n option.
Installation through bootloader webserver:
- Plug power and hold reset button until red LED blink to bright.
- Install sysupgrade image using web interface on 192.168.1.1.
Signed-off-by: Kyson Lok <kysonlok@gmail.com>
[match maximum image size with firmware partition]
Signed-off-by: Mathias Kresin <dev@kresin.me>
Specification:
- SoC: MediaTek MT7620A (580 MHz)
- RAM: 64 MiB (Winbond W9751G6JB-25)
- Flash: 16 MiB (Spansion S25FL128SAIF00)
- LAN: x4 100M
- WAN: x1 100M
- Others: USB 2.0, reset button, wps button and 9 LEDs
Issues:
- 5 GHz band is not functional (missing driver support)
Installation:
Asus windows recovery tool:
- install the Asus firmware restoration utility
- unplug the router, hold the reset button while powering it on
- release when the power LED flashes slowly
- specify a static IP on your computer:
IP address: 192.168.1.75;
Subnet mask 255.255.255.0
- Start the Asus firmware restoration utility, specify the sysupgrade
image, and press upload
TFTP Recovery method:
- set computer to a static ip, 192.168.1.75
- connect computer to the LAN 1 port of the router
- hold the reset button while powering on the router for a few seconds
- send firmware image using a tftp client; i.e from linux:
$ tftp
tftp> binary
tftp> connect 192.168.1.1
tftp> put lede-ramips-mt7620-rt-ac51u-squashfs-sysupgrade.bin
tftp> quit
Signed-off-by: Ørjan Malde <foxyred333@gmail.com>
This device exactly same as NBG-419N but with USB port and USB Led.
Specification:
- SoC: Ralink RT3052 (MIPS24Kc) @384MHz
- RAM: 32 MiB
- Flash: 8 MiB
- WLAN: WiSoC 2T2R/300Mbps (2.4GHz)
- LAN: 4x100M
- WAN: 1x100M
- USB: 1x2.0
Installation via serial console (57600 8N1) from TFTP server
- rename the firmware to something shorter, for example
"sysupgrade.bin" (max. 32 chars)
- copy firmware TFTP server's directory
- when you power on device, and see U-Boot log, immediatly push "2"
once.
- You will see this message:
2: System Load Linux Kernel then write to Flash via TFTP.
Warning!! Erase Linux in Flash then burn new one. Are you sure?
- Push "y", and enter: device IP, then TFTP server's IP, and then
image firmware file name.
The firmware will be downloaded within ~30 seconds and flashed to the
device (It will take about 2 minutes).
Signed-off-by: Alexey Belyaev <spider@spider.vc>
[squash commits, compact commit message, fix compatible string, remove
superfluous pinmuxes]
Signed-off-by: Mathias Kresin <dev@kresin.me>
Add the changes suggested by FS#716 to fix the switch driver initialization
on the ZTE Q7.
Also remove the `pinctrl-names` field obsoleted by the changes.
Reported-by: Harry Lau <harrylwc@gmail.com>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Fix a copy/paste error and include the ZBT-WE826 dtsi instead of the
ZBT-WG3526 one.
Fix the syntax error in the ZBT-WE826 dtsi to prevent an compile error.
Signed-off-by: Mathias Kresin <dev@kresin.me>
The ZBT-WG826 is available with 16 or 32 MByte of flash. Split the
device tree source file, rename the currently supported 16 MByte
version and add the 32 MByte variant.
Signed-off-by: Mathias Kresin <dev@kresin.me>
The Digineo AC1200 Pro is the 32MB flash variant of the ZBT-WG3526 with
unpopulated/exposed sdhci slot. Rename to board to the OEM/ODM name and
add the sdhci kernel module to use it for multiple clones.
Signed-off-by: Mathias Kresin <dev@kresin.me>
The ZBT-WG3526 is available with 16 or 32 MByte of flash. Rename the
current supported 16MByte version to indicate which flash size variant
is supported.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Specification:
- SoC: MT7621AT, MT7603EN and MT7612EN
- Flash: 16 MiB (W25Q128FVSG)
- RAM: 512 MiB (EM6GE16EWXD-12H)
- Ethernet: 1 x WAN (10/100/1000Mbps) and 4 x LAN (10/100/1000 Mbps)
- Others: USB 2.0, micro SD slot, reset button and 8 x LEDs
Issues:
- Two LEDs for 2.4 GHz and 5 GHz Wi-Fi do not work, can't find GPIOs.
- The pwr LED is not GPIO controllable
How to install:
- The original firmware is OpenWrt, so both LuCI or sysupgrade can be used.
- Do not keep settings, for sysupgrade please use the -n option.
Signed-off-by: Jiawei Wang <buaawjw@gmail.com>
The wan port is connected to switch port 0. Fix the mediatek,portmap as
well as the default switch config.
Signed-off-by: Alexey Belyaev <spider@spider.vc>
PSG1218 got only 4 Ethernet ports and WAN on port 3 while
PSG1218K2C got 5 Ethernet ports and WAN on port 4
Switch to use kmod-kt76x2 instead of kmod-mt76 for both devices while
at it.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Fix the PCIe 5GHz wireless by using the on flash eeprom/caldata.
Disable the 2.4GHz band as this band has no antennas attached but is
enabled in the eeprom/caldata.
Fixes: FS#691
Signed-off-by: Mathias Kresin <dev@kresin.me>
Fix the PCIe 5GHz wireless by using the ralink mtd-eeprom property as
this board have a RT5592 and uses the rt2x00 driver. The mediathek
device tree bindings do not work here.
Fixes: FS#691
Fixes: d8dd207ea6 ("ramips: use the ralink,mtd-eeprom device tree property")
Signed-off-by: Mathias Kresin <dev@kresin.me>
Even the commit message of the patch adding support for the MiWiFi Nano
says that a 16 MB flash chip is used. Extend the firmware partition to
make use of all available flash space.
Fixes: FS#622
Signed-off-by: Mathias Kresin <dev@kresin.me>
This patch adds support for the Zbtlink ZBT-WE2026.
Specification:
- SoC: MediaTek MT7620N (580MHz)
- RAM: 64 MiB
- Flash: 8 MiB SPI
- LAN: 4x100M
- WAN: 1x100M
Installation through bootloader webserver:
- With the power unplugged press and hold reset button.
- Plug power and hold reset button until LED starts to blink.
- Install sysupgrade image using web interface on 192.168.1.1.
Signed-off-by: Vaclav Svoboda <svoboda@neng.cz>
Specifications:
* SoC: MT7620A
* RAM: 64 MB DDR
* Flash: 8MB NOR SPI flash
* WiFi: MT7612E (5Ghz) and builtin MT7620A (2.4GHz)
* LAN: 1x100M
The -factory images can be flashed from the device's web
interface or via nmrpflash.
Co-authored-by: Paul Oranje <por@xs4all.nl>
Signed-off-by: Paul Oranje <por@xs4all.nl>
Signed-off-by: Joseph C. Lehner <joseph.c.lehner@gmail.com>
This patch adds support for the Netgear R6220, aka Netgear AC1200 and
R6220-100NAS.
Specification:
- SoC: MediaTek MT7621ST (880 MHz)
- Falsh: 128 MiB (Macronix MX30LF1G08AA-TI)
- RAM: 128 MiB (Nanya NT5CB64M16FP-DH)
- Wireless: MediaTek MT7603EN b/g/n , MediaTek MT7612EN an+ac
- LAN speed: 10/100/1000
- LAN ports: 4
- WAN speed: 10/100/1000
- WAN ports: 1
- Serial baud rate of Bootloader and factory firmware: 57600
Installation through telnet:
- Copy kernel.bin and rootfs.bin to a USB flash disk, plug to usb port
on the router.
- Enable telnet with link: http://192.168.1.1/setup.cgi?todo=debug
(login if required, default: admin password)
- You will see "Debug Enabled!"
- Telnet 192.168.1.1 and login with "root"
- ls /mnt/shares/ to find out path of your USB disk. 'myUdisk' for
example.
- cd /mnt/shares/myUdisk
- mtd_write write rootfs.bin Rootfs
- mtd_write write kernel.bin Kernel
- reboot
nmrpflash can be used to recover to the netgear firmware if a broken
image was flashed.
Signed-off-by: Hanqing Wong <hquu@outlook.com>
* The left most mini-PCIe slot (the one attached to SIM2) can be
power-cycled by setting GPIO 0 to high/low.
* The D240 only needs the MT76x2 module, so update makefile to reflect this.
Note that until the default mt7620 target is updated, then kmod-mt76 (and thus
kmod-mt7603) will be selected by default.
v2->v3:
* Indentation error.
v1->v2:
* Rename gpio and remove redundant comment (thanks Piotr Dymacz)
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
This device features both a 2.4 and 5Ghz radio, and supports
802.11a/b/g/n/ac modes.
It has 5 Gb-Ethernet ports and a USB 3.0 host port.
It is powered by the Mediatek MT7621 SoC, and the MT7602E and MT7612E wifi
chipsets, together with 128MB of RAM and 16 MB of SPI Flash.
The stock firmware is in fact based on some openwrt barrier breaker, with a
mediatek SDK kernel, and an afoundry custom made web interface (not LuCI
based).
Firmware update page on the stock web interface can not accept sysupgrade
images, it bricks the device.
At this point, the only working solution I found was to connect to the
serial console port (available on J4 header) and to use opkg to install
dropbear.
Then scp the sysupgrade file in the device's /tmp and run sysupgrade from
console without preserving configuration files.
Signed-off-by: Francois Goudal <francois@goudal.net>
This patch adds supports for the HiWiFi HC5962(gee4) http://www.hiwifi.com
Short specification:
- MT7621AT + MT7612EN + 7603EN
- 256MB DDR3 RAM
- 128MB NAND flash
- 1+3 x 1000M Ethernet
- 1x USB 2.0 port. 1x USB 3.0 port.
- reset button
- UART pad on PCB (JP3: TX, RX, GND, 3.3V)
Flash instruction:
1, Download lede-ramips-mt7621-hc5962-squashfs-factory.bin
2, Login as root via SSH on 192.168.199.1 and then copy factory.bin(using wget or nc or...) to /tmp/
3, use the following commands:
$ mtd write /tmp/lede-ramips-mt7621-hc5962-squashfs-factory.bin firmware
$ mtd erase firmware_backup && reboot
After reboot you should be able to login as root via SSH on 192.168.1.1
Signed-off-by: ZengFei Zhang <zhangzengfei@kunteng.org>
HC5661A is almost the same as HC5661 but MT7628AN is used instead of MT7620A.
- MT7628AN
- 128 MiB DDR2 RAM (W971GG6KB-25)
- 16 MiB SPI NOR flash (W25Q128)
- SD slot (not work yet)
- 1+4 x 100M Ethernet
- 802.11 b/g/n Wi-Fi
- 3 x LED
- 1 x button
- UART pad on PCB (JP1: TX, RX, GND, 3.3V)
The factory flash layout seems different from HC5661.
"hwf_config" is renamed to "oem" and its size changes to 0x20000.
It is modified accordingly in the dts file.
0x000000000000-0x000000030000 : "u-boot"
0x000000030000-0x000000040000 : "hw_panic"
0x000000040000-0x000000050000 : "Factory"
0x000000050000-0x000000160000 : "kernel"
0x000000160000-0x000000fc0000 : "rootfs"
0x000000bb0000-0x000000fc0000 : "rootfs_data"
0x000000fc0000-0x000000fe0000 : "oem"
0x000000fe0000-0x000000ff0000 : "bdinfo"
0x000000ff0000-0x000001000000 : "backup"
0x000000050000-0x000000fc0000 : "firmware"
To install LEDE, enabled the "developer mode",
which will *void your warranty* and open the SSH server at port 1022.
sysupgrade -n -F lede-ramips-mt7628-hc5661a-squashfs-sysupgrade.bin
SD slot:
- Tried to add modules kmod-sdhci kmod-sdhci-mt7620, and corresponding dts block.
- It will block WAN + 3xLAN ports, only one LAN works.
- I'm not sure why, everything else works fine.
Signed-off-by: Wang JiaWei <buaawjw@gmail.com>
GPIO18 and GPIO19 on OMEGA2(+) should be GPIO mode, enable PWM lead to a conflict
[ 0.290633] rt2880-pinmux pinctrl: pin io18 already requested by pinctrl; cannot claim for 10005000.pwm
[ 0.299722] rt2880-pinmux pinctrl: pin-18 (10005000.pwm) status -22
[ 0.305729] rt2880-pinmux pinctrl: could not request pin 18 (io18) from group pwm0 on device rt2880-pinmux
[ 0.315131] mtk-pwm 10005000.pwm: Error applying setting, reverse things back
Keep PWM disabled.
Signed-off-by: Furong Xu <xfr@outlook.com>
Some boards were apparently forgotten when ralink,portmap was renamed
to mediatek,portmap -- probably because they used the long obsolete
ralink,port-map attribute.
If this commit breaks ethernet wan/lan assignment, this is because
the port-map attribute wasn't actually parsed, you'll have to replace
"wllll" by "llllw" in the dts file belonging to that board (and send
a patch doing that!)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The DWR-512 embeds the hw slic device si3210. This device have the IRQ line
attached to the gpio1. This patch export the gpio1 with proper name and
parameters to the sysfs.
Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com>
The Sanlinking Technologies D240
(http://www.sanlinking.com/en/29-dual-4g-wifi-router.html) is basically the same
device as the ZBT WE826, so adding support for it in LEDE is straight forward.
The differences is that the D240 has two mini-PCIe slots (instead of one), blue
LEDs and supports PoE.
Specification:
* CPU: MT7620A
* 1x 10/100Mbps POE (802.3af/802.3at) Ethernet, 4x 10/100Mbps.
* 16 MB Flash.
* 128 MB RAM.
* 1x USB 2.0 port.
* 2x mini-PCIe slots.
* 2x SIM slots.
* 1x 2.4Ghz WIFI.
* 1x button.
Wifi, USB, switch and both mini-PCIe slots are working. I have not been able to
test the SD card reader.
The device comes pre-installed with an older version of OpenWRT, including Luci.
In order to install LEDE, you need to follow the existing procedure for updating
OpenWRT/LEDE using Luci. I.e., you need to access the UI and update the firmware
using the sysupgrade-image. Remember to select that you do not want to keep
existing settings. The default router address is 192.168.10.1 and
username/password admin/root (at least on my devices).
If you brick the device, the procedure for recovery is the same as for the
WE826. Please see the wiki page for that device for instructions.
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
Added the missing audio pcm interface in the .dtsi file for the rt5350
device. The update has been verified from the data get from the datasheet
and is very similar to the mt7620a.dtsi
Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com>
Use a vendor prefix as it has to be for all not core driver. Update the
compatible string in the device tree files accordingly.
Signed-off-by: Mathias Kresin <dev@kresin.me>
The comptible string is neither added by any LEDE patch nor exists in
in the kernel. Drop the sound node which was obviously added
accidentally with 9195d8da ("ramips: DTS rework").
Signed-off-by: Mathias Kresin <dev@kresin.me>
Use only the jedec,spi-nor compatible string. Everything else either
never worked or is only support to keep compatibility.
Remove the linux,modalias property. It is obsolete since kernel 4.4.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Uses upstream code to parse DT supported band/frequency information.
Update existing .dts files to the new format and remove unnecessary
overrides.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Buffalo WCR-1166DS is a small wireless router with
- MT7628AN + MT7612E
- 64MiB DDR2 SDRAM
- 16MiB SPI flash
- 2T2R 11ac/a/b/g/n Wi-Fi
- 2x 10/100M ethernet switch
- 8x programmable LED
- 3x button
- UART pad on PCB (J2: 3.3V, GND, TX, RX)
factory image can be installed via stock web UI.
due to the "dual image" function in the bootloader, the second half of
the SPI flash ("firmware2" partition) cannot be used as a part of the
file system.
Signed-off-by: FUKAUMI Naoki <naobsd@gmail.com>
Before this change only port 4 of F5D8235 V1 worked at 1000Mpbs.
Comparing the current driver with the GPL_BELKIN_F5D8235-4_v1000
v1.01.24 sources showed that additional steps are required to set-up
the rlt8366s switch correctly.
Signed-off-by: Tobias Wolf <github-NTEO@vplace.de>
On some EX2700 devices, the MAC address from the eeprom data differs
from the actual MAC address. Fix that, and cleanup the DTS file
while we're at it.
Signed-off-by: Joseph C. Lehner <joseph.c.lehner@gmail.com>
