|
|
|
|
#
|
|
|
|
|
# MT76x8 Profiles
|
|
|
|
|
#
|
|
|
|
|
|
|
|
|
|
DEVICE_VARS += TPLINK_FLASHLAYOUT TPLINK_HWID TPLINK_HWREV TPLINK_HWREVADD TPLINK_HVERSION
|
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13
TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.
The difference between these two models is in number of available
LEDs, buttons and power input switch.
This work is partially based on GitHub PR#974.
Specification:
- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
switch
* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
(fully) supported by gpio-leds driver. This type of LED requires both
GPIOs state change at the same time to select color or turn it off.
For now, we support/use only the green part of the LED.
Factory image notes:
These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.
We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.
Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.
The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".
Flash instruction:
Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.
To access U-Boot CLI, keep pressed "4" key during boot.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
7 years ago
|
|
|
|
|
|
|
|
define Device/duzun-dm06
|
|
|
|
|
DTS := DUZUN-DM06
|
|
|
|
|
DEVICE_TITLE := DuZun DM06
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += duzun-dm06
|
|
|
|
|
|
|
|
|
|
define Device/gl-mt300n-v2
|
|
|
|
|
DTS := GL-MT300N-V2
|
|
|
|
|
IMAGE_SIZE := 16064k
|
|
|
|
|
DEVICE_TITLE := GL-iNet GL-MT300N-V2
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += gl-mt300n-v2
|
|
|
|
|
|
|
|
|
|
define Device/hc5661a
|
|
|
|
|
DTS := HC5661A
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_16M)
|
|
|
|
|
DEVICE_TITLE := HiWiFi HC5661A
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += hc5661a
|
|
|
|
|
|
|
|
|
|
define Device/LinkIt7688
|
|
|
|
|
DTS := LINKIT7688
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_32M)
|
|
|
|
|
SUPPORTED_DEVICES := linkits7688 linkits7688d
|
|
|
|
|
DEVICE_TITLE := MediaTek LinkIt Smart 7688
|
|
|
|
|
DEVICE_PACKAGES:= kmod-usb2 kmod-usb-ohci uboot-envtools
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += LinkIt7688
|
|
|
|
|
|
|
|
|
|
define Device/mac1200r-v2
|
|
|
|
|
DTS := MAC1200RV2
|
|
|
|
|
DEVICE_TITLE := Mercury MAC1200R v2.0
|
|
|
|
|
SUPPORTED_DEVICES := mac1200rv2
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += mac1200r-v2
|
|
|
|
|
|
|
|
|
|
define Device/miwifi-nano
|
|
|
|
|
DTS := MIWIFI-NANO
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_16M)
|
|
|
|
|
DEVICE_TITLE := Xiaomi MiWiFi Nano
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += miwifi-nano
|
|
|
|
|
|
|
|
|
|
define Device/mt7628
|
|
|
|
|
DTS := MT7628
|
|
|
|
|
BLOCKSIZE := 64k
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_4M)
|
|
|
|
|
DEVICE_TITLE := MediaTek MT7628 EVB
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/omega2
|
|
|
|
|
DTS := OMEGA2
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_16M)
|
|
|
|
|
DEVICE_TITLE := Onion Omega2
|
|
|
|
|
DEVICE_PACKAGES:= kmod-usb2 kmod-usb-ohci uboot-envtools
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/omega2p
|
|
|
|
|
DTS := OMEGA2P
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_32M)
|
|
|
|
|
DEVICE_TITLE := Onion Omega2+
|
|
|
|
|
DEVICE_PACKAGES:= kmod-usb2 kmod-usb-ohci uboot-envtools kmod-sdhci-mt7620
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += omega2 omega2p
|
|
|
|
|
|
|
|
|
|
define Device/pbr-d1
|
|
|
|
|
DTS := PBR-D1
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_16M)
|
|
|
|
|
DEVICE_TITLE := PBR-D1
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += pbr-d1
|
|
|
|
|
|
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13
TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.
The difference between these two models is in number of available
LEDs, buttons and power input switch.
This work is partially based on GitHub PR#974.
Specification:
- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
switch
* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
(fully) supported by gpio-leds driver. This type of LED requires both
GPIOs state change at the same time to select color or turn it off.
For now, we support/use only the green part of the LED.
Factory image notes:
These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.
We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.
Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.
The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".
Flash instruction:
Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.
To access U-Boot CLI, keep pressed "4" key during boot.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
7 years ago
|
|
|
define Device/tl-wr840n-v4
|
|
|
|
|
DTS := TL-WR840NV4
|
|
|
|
|
IMAGE_SIZE := 7808k
|
|
|
|
|
DEVICE_TITLE := TP-Link TL-WR840N v4
|
|
|
|
|
TPLINK_FLASHLAYOUT := 8Mmtk
|
|
|
|
|
TPLINK_HWID := 0x08400004
|
|
|
|
|
TPLINK_HWREV := 0x1
|
|
|
|
|
TPLINK_HWREVADD := 0x4
|
|
|
|
|
TPLINK_HVERSION := 3
|
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13
TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.
The difference between these two models is in number of available
LEDs, buttons and power input switch.
This work is partially based on GitHub PR#974.
Specification:
- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
switch
* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
(fully) supported by gpio-leds driver. This type of LED requires both
GPIOs state change at the same time to select color or turn it off.
For now, we support/use only the green part of the LED.
Factory image notes:
These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.
We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.
Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.
The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".
Flash instruction:
Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.
To access U-Boot CLI, keep pressed "4" key during boot.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
7 years ago
|
|
|
KERNEL := $(KERNEL_DTB)
|
|
|
|
|
KERNEL_INITRAMFS := $(KERNEL_DTB) | tplink-v2-header -e
|
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13
TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.
The difference between these two models is in number of available
LEDs, buttons and power input switch.
This work is partially based on GitHub PR#974.
Specification:
- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
switch
* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
(fully) supported by gpio-leds driver. This type of LED requires both
GPIOs state change at the same time to select color or turn it off.
For now, we support/use only the green part of the LED.
Factory image notes:
These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.
We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.
Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.
The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".
Flash instruction:
Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.
To access U-Boot CLI, keep pressed "4" key during boot.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
7 years ago
|
|
|
IMAGES += tftp-recovery.bin
|
|
|
|
|
IMAGE/factory.bin := tplink-v2-image -e
|
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13
TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.
The difference between these two models is in number of available
LEDs, buttons and power input switch.
This work is partially based on GitHub PR#974.
Specification:
- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
switch
* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
(fully) supported by gpio-leds driver. This type of LED requires both
GPIOs state change at the same time to select color or turn it off.
For now, we support/use only the green part of the LED.
Factory image notes:
These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.
We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.
Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.
The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".
Flash instruction:
Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.
To access U-Boot CLI, keep pressed "4" key during boot.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
7 years ago
|
|
|
IMAGE/tftp-recovery.bin := pad-extra 128k | $$(IMAGE/factory.bin)
|
|
|
|
|
IMAGE/sysupgrade.bin := tplink-v2-image -s -e | append-metadata | \
|
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13
TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.
The difference between these two models is in number of available
LEDs, buttons and power input switch.
This work is partially based on GitHub PR#974.
Specification:
- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
switch
* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
(fully) supported by gpio-leds driver. This type of LED requires both
GPIOs state change at the same time to select color or turn it off.
For now, we support/use only the green part of the LED.
Factory image notes:
These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.
We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.
Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.
The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".
Flash instruction:
Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.
To access U-Boot CLI, keep pressed "4" key during boot.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
7 years ago
|
|
|
check-size $$$$(IMAGE_SIZE)
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/tl-wr840n-v5
|
|
|
|
|
DTS := TL-WR840NV5
|
|
|
|
|
IMAGE_SIZE := 3840k
|
|
|
|
|
DEVICE_TITLE := TP-Link TL-WR840N v5
|
|
|
|
|
TPLINK_FLASHLAYOUT := 4Mmtk
|
|
|
|
|
TPLINK_HWID := 0x08400005
|
|
|
|
|
TPLINK_HWREV := 0x1
|
|
|
|
|
TPLINK_HWREVADD := 0x5
|
|
|
|
|
TPLINK_HVERSION := 3
|
|
|
|
|
KERNEL := $(KERNEL_DTB)
|
|
|
|
|
KERNEL_INITRAMFS := $(KERNEL_DTB) | tplink-v2-header -e
|
|
|
|
|
IMAGE/sysupgrade.bin := tplink-v2-image -s -e | append-metadata | \
|
|
|
|
|
check-size $$$$(IMAGE_SIZE)
|
|
|
|
|
endef
|
|
|
|
|
|
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13
TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.
The difference between these two models is in number of available
LEDs, buttons and power input switch.
This work is partially based on GitHub PR#974.
Specification:
- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
switch
* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
(fully) supported by gpio-leds driver. This type of LED requires both
GPIOs state change at the same time to select color or turn it off.
For now, we support/use only the green part of the LED.
Factory image notes:
These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.
We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.
Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.
The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".
Flash instruction:
Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.
To access U-Boot CLI, keep pressed "4" key during boot.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
7 years ago
|
|
|
define Device/tl-wr841n-v13
|
|
|
|
|
$(Device/tl-wr840n-v4)
|
|
|
|
|
DTS := TL-WR841NV13
|
|
|
|
|
DEVICE_TITLE := TP-Link TL-WR841N v13
|
|
|
|
|
TPLINK_HWID := 0x08410013
|
|
|
|
|
TPLINK_HWREV := 0x268
|
|
|
|
|
TPLINK_HWREVADD := 0x13
|
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13
TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.
The difference between these two models is in number of available
LEDs, buttons and power input switch.
This work is partially based on GitHub PR#974.
Specification:
- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
switch
* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
(fully) supported by gpio-leds driver. This type of LED requires both
GPIOs state change at the same time to select color or turn it off.
For now, we support/use only the green part of the LED.
Factory image notes:
These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.
We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.
Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.
The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".
Flash instruction:
Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.
To access U-Boot CLI, keep pressed "4" key during boot.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
7 years ago
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += tl-wr840n-v4 tl-wr840n-v5 tl-wr841n-v13
|
|
|
|
|
|
|
|
|
|
define Device/vocore2
|
|
|
|
|
DTS := VOCORE2
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_16M)
|
|
|
|
|
DEVICE_TITLE := VoCore VoCore2
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport \
|
|
|
|
|
kmod-sdhci-mt7620
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/vocore2lite
|
|
|
|
|
DTS := VOCORE2LITE
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_16M)
|
|
|
|
|
DEVICE_TITLE := VoCore VoCore2-Lite
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport \
|
|
|
|
|
kmod-sdhci-mt7620
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += vocore2 vocore2lite
|
|
|
|
|
|
|
|
|
|
define Device/wcr-1166ds
|
|
|
|
|
DTS := WCR-1166DS
|
|
|
|
|
BUFFALO_TAG_PLATFORM := MTK
|
|
|
|
|
BUFFALO_TAG_VERSION := 9.99
|
|
|
|
|
BUFFALO_TAG_MINOR := 9.99
|
|
|
|
|
IMAGES += factory.bin
|
|
|
|
|
IMAGE/sysupgrade.bin := trx | pad-rootfs | append-metadata
|
|
|
|
|
IMAGE/factory.bin := \
|
|
|
|
|
trx -M 0x746f435c | pad-rootfs | append-metadata | \
|
|
|
|
|
buffalo-enc WCR-1166DS $$(BUFFALO_TAG_VERSION) -l | \
|
|
|
|
|
buffalo-tag-dhp WCR-1166DS JP JP | buffalo-enc-tag -l | \
|
|
|
|
|
buffalo-dhp-image
|
|
|
|
|
DEVICE_TITLE := Buffalo WCR-1166DS
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += wcr-1166ds
|
|
|
|
|
|
|
|
|
|
define Device/wl-wn575a3
|
|
|
|
|
DTS := WL-WN575A3
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_8M)
|
|
|
|
|
DEVICE_TITLE := Wavlink WL-WN575A3
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += wl-wn575a3
|
|
|
|
|
|
|
|
|
|
define Device/widora-neo
|
|
|
|
|
DTS := WIDORA-NEO
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_16M)
|
|
|
|
|
DEVICE_TITLE := Widora-NEO
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += widora-neo
|
|
|
|
|
|
|
|
|
|
define Device/wrtnode2p
|
|
|
|
|
DTS := WRTNODE2P
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_16M)
|
|
|
|
|
DEVICE_TITLE := WRTnode 2P
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-ledtrig-usbport
|
|
|
|
|
endef
|
|
|
|
|
|
|
|
|
|
define Device/wrtnode2r
|
|
|
|
|
DTS := WRTNODE2R
|
|
|
|
|
IMAGE_SIZE := $(ralink_default_fw_size_16M)
|
|
|
|
|
DEVICE_TITLE := WRTnode 2R
|
|
|
|
|
DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci
|
|
|
|
|
endef
|
|
|
|
|
TARGET_DEVICES += wrtnode2p wrtnode2r
|
