Commit graph

1920 commits

Author SHA1 Message Date
L. D. Pinney
3e36ca4b43 ramips: merge mt7628/mt7688 into mt76x8
The ramips subtargets of mt7628 and mt7688 dts files all #include "mt7628an.dtsi"

They are essentially a single subtarget.

This patch merges the ramips subtargets mt7628 and mt7688 into a single subtarget mt76x8.

Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
2017-08-30 17:05:10 +02:00
Koen Vandeputte
40213cc154 kernel: update 4.9 to 4.9.45
Refreshed all patches

Compiled & run-tested on targets: cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
2017-08-30 17:05:10 +02:00
John Crispin
a3f52f6165 ramips: refresh kernel patches
the reordering patch fixes random kernel hangs. bug/fix was reported by MTK/WCN.

Signed-off-by: John Crispin <john@phrozen.org>
2017-08-24 10:09:46 +02:00
John Crispin
5c971cd6fd ramips: make mt7621 select WEAK_REORDERING_BEYOND_LLSC
Signed-off-by: John Crispin <john@phrozen.org>
2017-08-24 08:32:54 +02:00
L. D. Pinney
e9eb6e7bb3 ramips: set ethernet mac address for VoCore2
This patch sets the mac address for the VoCore2 devices.

Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
2017-08-23 15:09:05 +02:00
Pavel Kubelun
6e283cdc0d ramips: add Xiaomi Mi Router 3G support
This commit adds support for Xiaomi Mi WiFi Router 3G.

Short specification:
 - MT7621AT + MT7603EN + 7612EN
 - 256MB DDR3 RAM
 - 128MB NAND flash
 - 1+2 x 1000M Ethernet
 - 1x USB 3.0 port
 - reset button
 - yellow, blue, red leds

Installation through telnet/ssh:
- copy lede-ramips-mt7621-mir3g-squashfs-kernel1.bin and
lede-ramips-mt7621-mir3g-squashfs-rootfs0.bin to usb disk or wget it
from LEDE download site to /tmp
- switch to /extdisks/sda1/ (if copied to USB drive) or to /tmp if
wgetted from LEDE download site
- run: mtd write lede-ramips-mt7621-mir3g-squashfs-kernel1.bin kernel1
- run: mtd write lede-ramips-mt7621-mir3g-squashfs-rootfs0.bin rootfs0
- run: mtd erase kernel0
- run: reboot

Originally stock firmware has following partitions:
 - ...
 - kernel0 (primary kernel image)
 - kernel1 (secondary kernel image, used by u-boot in failsafe routine)
 - rootfs0 (primary rootfs)
 - rootfs1 (secondary rootfs in case primary fails)
 - overlay (used as ubi overlay)

This commit squashes rootfs0, rootfs1 and overlay partitions into 1, so
it can be used by LEDE fully for package installation, resulting in 117,5MiB.

This device lacks hw watchdog, so adding softdog instead (stock does the same).

Signed-off-by: Pavel Kubelun <be.dissent@gmail.com>
2017-08-23 14:59:12 +02:00
Stijn Tintel
2d02a4f5bd kernel: update 4.9 to 4.9.44
Refresh patches.
Adapt 704-phy-no-genphy-soft-reset.patch.
Remove brcm2708/950-0005-mm-Remove-the-PFN-busy-warning.patch.
Compile-tested on brcm2708/bcm2708 and x86/64.
Runtime-tested on brcm2708/bcm2708 and x86/64.

Fixes the following vulnerabilities:
- CVE-2017-7533
- CVE-2017-1000111
- CVE-2017-1000112

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
2017-08-17 12:34:34 +02:00
L. D. Pinney
df3295f50e ramips: add support for the VoCore2 Lite
The VoCore2 Lite uses the same PCB as the Vocore2.
This patch moves the common VoCore2 parts into dtsi.

Removed memory node in the device tree source file.
Memory is detected automatically.

http://vocore.io/
http://vonger.net/
http://vonger.cn/

Specifications:
- SoC: MediaTek MT7688AN
- RAM: 64MB DDR2 EtronTech EM68B16CWQH-25H
- Flash: 8MB NOR SPI Flash GigaDevice GD25Q64CWIG
- Wireless: Built into MT7688AN with onboard IPEX connector

Firmware installation:
- VoCore2-Lite ships with firmware forked from OpenWrt.
- Installation from the bootloader is recommended.
- If using luci/sysupgrade use the -n option (do not keep settings)
  original firmware uses a modified proprietary MediaTek wireless driver.
- The wireless is disabled by default in LEDE.
- If reverting to factory firmware using the bootloader is recommended.

Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
Tested by: Noble Pepper <noblepepper@gmail.com>
2017-08-11 18:12:56 +02:00
Mathias Kresin
8c9f847a80 ramips: fix WHR-1166D WAN port
By adding the ICPlus IP1001 phy driver an already set RGMII delay mode
is reset during driver load.

Set the rgmii rx delay to fix corrupt/no packages in case the WAN port
negotiates to 1000MBit.

Fixes: FS#670

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-08-11 18:12:56 +02:00
Thibaut VARENE
370aacf532 ramips: ArcherC50v1: fix wlan2g MAC address
By default the wlan eprom contains the generic ralink MAC which is not
the vendor (TP-Link) one. Based on OFW bootlog, it appears that addresses
are decremented from the ethernet MAC.

This patch fixes the MAC address for wlan2g in line with OFW.

Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
2017-08-06 09:22:03 +02:00
Qin Wie
de350550ef ramips: fix cd-poll sd card remove randomly
Fix when add 'mediatek,cd-poll' to dts cause the sd card be removed randomly.
Special for the device without card-detect pin.

Signed-off-by: Qin Wie <me@vonger.cn>
2017-08-04 23:13:18 +02:00
Mathias Kresin
313ce3afbb ramips: move common parts into dtsi
Move the common parts of boards with multiple flash size variants into
dtsi files.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-08-03 19:37:41 +02:00
L. D. Pinney
70b192f573 ramips: update device tree source files
Use the GPIO dt-bindings macros and add compatible strings in the
ramips device tree source files.

Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-08-03 19:37:40 +02:00
Thibaut VARENE
695f5ea85a ramips: Add support for Netgear EX3800
The Netgear EX3800 is essentially an EX3700 with a mains output socket.

Both devices use the exact same firmware image (original firmware is named
EX3700-EX3800-version.chk).

This patch adds suport by renaming the EX3700 device to EX3700/EX3800 and
updating the necessary glue.

Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
2017-08-03 00:11:25 +02:00
Thibaut VARENE
8a13895a2e ramips: EX3700: rename factory.bin to factory.chk
The stock firmware upgrade interface requires the file to end with a .chk
extension.

Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
2017-08-03 00:11:25 +02:00
Thibaut VARENE
1780d40f2b ramips: cleanup EX2700 and WN3000RPv3 LEDs
This patch cleans up the WN3000RPv3 and EX2700 setup, bringing it in line
with other similar devices:

The power led is a bicolor one. The bootloader brings the red side on at
powerup.

Instead of blinking the red side in diag.sh and need to forcefully turn it off
in 01_leds, this patch simplifies the setup by relying on the default off state
of the gpio-led driver for the red side and blinking the green side as with
other devices.

Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
2017-08-03 00:11:25 +02:00
Mathias Kresin
419fa7a15f ramips: cleanup AsiaRF AWM002 eval board support
Cleanup the dtsi files and remove one layer of dtsi. Set the size of
the firmware partition to a value matching the flash size from the
board (variant) name.

Remove the usb led trigger. There is neither a default config for the
usb led trigger nor a LED for usb activity indication.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-08-03 00:11:25 +02:00
Mathias Kresin
b82ac84229 ramips: drop AsiaRF AWM003 eval board
Everything is identical to the AWM002 8m eval board. No need to
duplicate it once more.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-08-03 00:11:25 +02:00
Mathias Kresin
861b867d9c ramips: fix Omnima MiniEMBWiFi image
Reference the Omnima MiniEMBWiFi device tree source file in the image
build code. Otherwise the dts of the image processed before is used.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-08-03 00:07:56 +02:00
Mathias Kresin
afc1ccf955 ramips: build HuaWei HG255D image
The code to build an image was disabled some time ago for unknown
reasons albeit the image looks fine.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-08-03 00:07:56 +02:00
Mathias Kresin
60f6c2b2eb ramips: drop Edimax BR-6425 support
Code to build an image for the Edimax BR-6425 never existed.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-08-03 00:07:56 +02:00
Mathias Kresin
1eb1916c5f ramips: add missing partitions
The partitions were lost during migration to device tree.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-08-03 00:07:56 +02:00
Ilya Katsnelson
bb4d5006c0 ramips: fix PCI init on MT7620 with Linux 4.9+
So, this is kind of complicated. This has been upstream for a while,
imported from OpenWRT/LEDE with some cleanups. LEDE ramips has stayed
on linux-4.4 this whole time, with the old(er) version of the patch
that had correct behavior[0], while upstream got changed[1].

When LEDE updated to kernel 4.9, the older version of the code from
the patch got replaced with the upstream version containing the bug.

The original behavior, however, seems to be correct here, as the
official programming guide[2] indicates that bit 31 (PDRV_SW_SET)
in register PPLL_CFG1 is reserved, but bit 23 (added as PPLL_LD)
is the PPLL lock state (which also happens to line up with the
error message).

The original confusion probably comes from the double definition
of PDRV_SW_SET[3, 4] in the upstream code, with one correct definition
(31) and one incorrect one (23).

I've also used the opportunity to clean up the error message a bit -
it's still not really helpful to anyone who doesn't already know what
the PPLL is, but at least it's slightly more readable now.

This will probably need to be upstreamed as well, since with the way
it's currently set up, it's unlikely PCI ever worked for anyone who's
running an upstream kernel on that SoC.

[0]: 05d6e92594/target/linux/ramips/patches-4.4/0009-PCI-MIPS-adds-mt7620a-pcie-driver.patch (L259)
[1]: 026d15f6b9/arch/mips/pci/pci-mt7620.c (L246)
[2]: http://www.anz.ru/files/mediatek/MT7620_ProgrammingGuide.pdf
[3]: 026d15f6b9/arch/mips/pci/pci-mt7620.c (L36)
[4]: 026d15f6b9/arch/mips/pci/pci-mt7620.c (L39)

Signed-off-by: Ilya Katsnelson <me@0upti.me>
2017-07-31 21:28:37 +02:00
Thibaut VARENE
a6f6f8df23 ramips: Archer C50v1: fix power led
01_leds had a workaround for the power led to compensate for the
inverted GPIO state. This patch was missing from my previous commit.

Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
[add the power led default-state which was omitted in the last commit
by me]
Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-29 12:06:35 +02:00
Thibaut VARENE
5d7e23f5ad ramips: Archer C50v1: fix switch port numbering
Luci shows switch ports in wrong order on that device.
This patch fixes switch port numbering and matches them to the device
silkscreen.

Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
2017-07-29 09:24:32 +02:00
Thibaut VARENE
0c81bc2969 ramips: Archer C50v1: fix LEDs active levels
All LEDs GPIOs are active low on this device.

WAN and POWER states were inverted. Add default state for power.

Tested on Archer C50v1.

Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
2017-07-29 09:24:32 +02:00
Mathias Kresin
99f1097c0a ramips: fix Mercury MAC1200R v2.0 board name
With d2b6bf1416 ("ramips: fix image validation errors") the board
name was changed to fix an image validation error. But this change
wasn't applied to all other files using the board name, which broke
sysupgrade.

Revert this change and use the former board name in the metadata
instead.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-29 09:24:32 +02:00
L. D. Pinney
45dbd65850 ramips: mt7621: add compatible strings
Add compatible strings to all mt7621 based device tree source files to
fix formal issues.

Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
2017-07-29 09:24:32 +02:00
Mathias Kresin
0a17d2970a ramips: add NULL clock fix send upstream
Make the behaviour of clk_get_rate consistent with common clk's
clk_get_rate by accepting NULL clocks as parameter. Some device
drivers rely on this, and will cause an OOPS otherwise.

Fixes: FS#735

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-29 09:24:23 +02:00
Mathias Kresin
7985bf23ef ramips: drop stray kernel 4.4 configs
The kernel 4.4 patches where already removed with the bump to 4.9. Drop
the the subtarget configs as well.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-27 09:17:25 +02:00
Oliver Fleischmann
a92c64e8ae ramips: add support for Loewe WMDR-143N
The WMDR-143N is a small module originally used as a Wifi client
in some Loewe smart TV sets. It is sold cheaply at german surplus
shops. The module contains a RT3662 SOC.

Specifications:

- 500 MHz CPU Clock
- 1x 10/100Mbps Ethernet (pin header)
- 32 MB of RAM
- 8 MB of FLASH
- 2T3R 2.4/5 GHz (SOC internal)
- 3 Antennas on PCB
- UART pads on PCB (J3: 1 = +3.3V, 2 = RX, 3 = TX, 4 = GND), TX
  and RX are 3,3V only! The square hole is pin 1
- Power supply pads on PCB (J6: 1 and 2 = +5V, 3 and 4 = GND)
  The square hole is pin 1

The original firmware has two identical kernel/rootfs images and
two "Factory" calibration data blocks in flash. The LEDE image
leaves only the first "Factory" block in place and uses both
"Kernel" blocks and the redundant "Factory" block together to gain
enough space for the jffs2 partition.

Flash instructions:

You need UART and Ethernet connections to flash the board. Use
the LEDE "sysupgrade.bin" image with tftp.

Apply power to the board and in the first 5 seconds, hit 2 to
select TFTP upload. The bootloader asks for board- and server IP
addresses and filename.

Alternate method: With the vendor firmware running, assign an IP
address to the ethernet port, tftp the firmware image to
/tmp and write to mtd4 ("KernelA").

Signed-off-by: Oliver Fleischmann <ogf@bnv-bamberg.de>
[remove pinctrl node from dts, no pin is used as GPIO]
Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-27 09:13:27 +02:00
Mathias Kresin
a3995a6785 ramips: pinctrl: return proper error if pinctrl0 is empty
Children of the pinctrl0 node are optional. Return EINVAL (=missing)
instead of 0. Fixes a hang if the pinctrl0 has no children.

Signed-off-by: Mathias Kresin <dev@kresin.me>
Acked-by: John Crispin <john@phrozen.org>
2017-07-27 09:12:15 +02:00
John Crispin
9551d91b1d ramips: refresh the rcu_sched patch and remove debug info
Signed-off-by: John Crispin <john@phrozen.org>
2017-07-26 09:32:22 +02:00
John Crispin
6acb53c526 ralink: fix rcu_sched stalls on mt7621
there were 2 bugs
*) core1 came up with a bad bogo mips, looks like the clock needed time to stabilize
*) HPT frequency was not set making r4k timers not come up properly

Signed-off-by: John Crispin <john@phrozen.org>
2017-07-26 09:14:20 +02:00
L. D. Pinney
77645ffcd9 ramips: add support for the GnuBee Personal Cloud One
The GnuBee Personal Cloud One crowdfunded on https://www.crowdsupply.com
    It is a low-cost, low-power, network-attached storage device.

    Specifications:

    - SoC: MediaTek MT7621AT
    - RAM: DDR3 512 MB
    - Flash: 32 MB
    - Six SATA ports for 2.5" Drives
    - One micro SDcard
    - One USB 3.0
    - Two USB 2.0
    - Gigabit Ethernet: 1 x WAN and 1 x LAN
    - UART 3.5mm Audio Jack or 3 pin header - 57600 8N1
    - Four GPIOs available on a pin header

    Flash instructions:

    The GnuBee Personal Cloud One ships with libreCMC installed.
    libreCMC is a Free Software Foundation approved fork of LEDE/OpenWrt.
    As such one can upgrade using the webinterface or sysupgrade.

    Das U-Boot has multiple options for recovery or updates including :

    - USB
    - http
    - tftp

Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
[use switchdev led trigger, all interfaces are in vlan1; rename leds
according to board.d setting; remove ge2 group from the pinmux, this
group doesn't exist in the driver]
Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-25 21:02:53 +02:00
Thibaut VARENE
4faf314933 ramips: DIR-860L-B1 fix switch port numbering
Luci shows switch ports in inverted order on that device.
This patch fixes switch port numbering and matches them to the device
silkscreen.

Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
2017-07-25 21:02:53 +02:00
Giuseppe Lippolis
786f7426c2 ramips: fix wps button gpio for DWR-512
The WPS button is at GPIO#7.

Signed-off-by: Giuseppe Lippolis <giu.lippolis@gmail.com>
2017-07-25 21:02:53 +02:00
Paul Wassi
c51c976db8 ramips: DTS: VoCore2 improvements/fixes
The VoCore2 features 128MB of RAM, therefore set
memory in DTS to 128*1024*1024 = 0x8000000
The board's LED is connected to GND, set it to
ACTIVE_HIGH here.
Make serial console working again on kernel 4.9 by
change of pinmux configuration.

Signed-off-by: Paul Wassi <p.wassi@gmx.at>
2017-07-25 21:02:53 +02:00
Alex Maclean
f683385e73 ramips: add support for TP-Link RE350
The TP-Link RE350 is a wall-wart AC1200 range extender/access point with
a single gigabit ethernet port and two non-detachable antennas, based on
the MT7621A SoC with MT7603E and MT7612E radios.

Firmware wise it is very similar to the QCA based RE450.

SoC: MediaTek MT7621A (880MHz)
Flash: 8MiB (Winbond W25Q64)
RAM:   64MiB (DDR2)
Ethernet: 1x 1Gbit
Wireless: 2T2R 2.4Ghz (MT7603E) and 5GHz (MT7612E)
LEDs: Power, 2.4G, 5G (blue), WPS (red and blue), ethernet link/act
(green)
Buttons: On/off, LED, reset, WPS

Serial header at J1, 57600 8n1:
Pin 1 TX
Pin 2 RX
Pin 3 GND
Pin 4 3.3V

Factory image can be uploaded directly through the stock UI.

Signed-off-by: Alex Maclean <monkeh@monkeh.net>
2017-07-25 21:02:53 +02:00
Chuanhong Guo
a4c84b2d73 ramips: add support for Phicomm K2P
It uses one MT7615D radio chip with DBDC mode enabled. This mode allows
this single chip act as an 2x2 11n radio and an 2x2 11ac radio at the
same time. However mt76 doesn't  support it currently so there is no
wireless available.

Specification:
- SoC: MediaTek MT7621AT
- Flash: 16 MB
- RAM: 128 MB
- Ethernet: 1 x WAN (10/100/1000Mbps) and 4 x LAN (10/100/1000 Mbps)
- Wireless radio: MT7615D on PCIE0
- UART: 1 x UART on PCB - 57600 8N1

Issue:
- Wireless radio doesn't work due to the lack of driver.

Flash instruction:
Using UART:
1. Configure PC with a static IP address and setup an TFTP server.
2. Put the firmware into the tftp directory.
3. Connect the UART line as described on the PCB.
4. Power up the device and press 2,then follow the instruction to
   set device and tftp server IP address and input the firmware
   file name.U-boot will then load the firmware and write it into
   the flash.

Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
2017-07-20 19:10:29 +02:00
Mathias Kresin
e0b9ec8e96 treewide: drop target board_name functions
They are not used any longer.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-15 23:13:34 +02:00
Mathias Kresin
f12a32630f treewide: use the generic board_name function
Use the generic function instead ot the target specific ones.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-15 23:13:34 +02:00
Mathias Kresin
ac3e05c5d7 treewide: populate boardname and model earlier
For targets using the generic board detection and board specific
settings in diag.sh, the board name is still unset at the time the
set_state() provided by diag.sh is called by 10_indicate_preinit.

Change the execution order to ensure the boardname is populated before
required the first time. Do the target specific board detection as
early as possible, directly followed by the generic one to allow a
seamless switch to the generic function for populating /tmp/sysinfo/.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-15 23:13:34 +02:00
John Marrett
4531bc4267 ramips: fix GL-inet GL-MT300N-V2 WAN/LAN MAC address
Correct MAC address lookup to appropriate offset based on vendor
source.

Override the WAN MAC to use the same address as LAN. The switch driver
increments the base MAC address for the WAN vlan but the stock firmware
uses the same MAC address for all interfaces.

Based on vendor source commit
https://github.com/domino-team/lede-1701/commit/efb0518

Signed-off-by: John Marrett <johnf@zioncluster.ca>
2017-07-15 07:02:59 +02:00
Koen Vandeputte
cd54b2d42b kernel: update kernel 4.9 to 4.9.37
- Refreshed all patches
- Removed upstreamed
- Adapted 4 patches:

473-fix-marvell-phy-initialization-issues.patch
-----------------------------------------------
Removed hunk 5 which got upstreamed

403-net-phy-avoid-setting-unsupported-EEE-advertisments.patch
404-net-phy-restart-phy-autonegotiation-after-EEE-advert.patch
--------------------------------------------------------------
Adapted these 2 RFC patches, merging the delta's from an upstream commit
(see below) which made it before these 2.

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-
stable.git/commit/?h=v4.9.36&id=97ace183074d306942b903a148aebd5d061758f0

180-usb-xhci-add-support-for-performing-fake-doorbell.patch
-----------------------------------------------------------
- Moved fake_doorbell bitmask due to new item

Compile tested on: cns3xxx, imx6
Run tested on: cns3xxx, imx6

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
2017-07-15 00:13:05 +02:00
Mathias Kresin
01819254af ramips: sound-mt7620: fix dependencies for kernel 4.9
With kernel 4.8 common used code was moved to a shared kmod. Add the
missing dependency to the shared snd-soc-simple-card-utils.ko.

Signed-off-by: Mathias Kresin <dev@kresin.me>
2017-07-07 07:56:24 +02:00
Matthias Schiffer
4b32d66216
ramips: simplify ubnt-erx-sfp device definition
Most of the ubnt-erx definition can be reused; the package removals in
DEVICE_PACKAGES have become redundant after d17cb4a68a "ramips: purge
default packages on MT7621".

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
2017-07-06 19:45:09 +02:00
John Crispin
fddc78bc11 ramips: bump to v4.9
Signed-off-by: John Crispin <john@phrozen.org>
2017-07-06 06:37:03 +02:00
Piotr Dymacz
24043a0d2e ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13
TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.

The difference between these two models is in number of available
LEDs, buttons and power input switch.

This work is partially based on GitHub PR#974.

Specification:

- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
  switch

* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
  (fully) supported by gpio-leds driver. This type of LED requires both
  GPIOs state change at the same time to select color or turn it off.
  For now, we support/use only the green part of the LED.

Factory image notes:

These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.

We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.

Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.

The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".

Flash instruction:

Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:

1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
   to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
   the router and keep button pressed for around 6-7 seconds, until
   device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.

To access U-Boot CLI, keep pressed "4" key during boot.

Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-29 10:37:36 +02:00
Piotr Dymacz
c55fadcacb ramips: image: simplify TP-Link Archer devices definitions
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
2017-06-29 10:37:36 +02:00