Installing OpenWrt on TP-Link WR849N v5 & v6

One of the least expensive wireless routers you can buy currently in Brazil is the TP-Link WR849N. Unfortunately, as it seems it is not widely distributed worldwide, there was no OpenWrt image for it. I bought a v5 and looking at the hardware it seemed that it was the same as the WR840v5. I did the trick of grabbing the bootloader off the image file on TP-Link´s site (as it is explained on the c20i page) and adding it to the WR840v5 image. It worked, although the stock image runs out of flash space and there is no way to keep configuration information on reboot. Nothing that a pared down custom image won´t fix.

Then version 6 came out. There was no image on the site to get the bootloader. Using the v5 bootloader did not work. On TP-Link´s site you could get the GPL files to make you own bootloader, but, as we could expect, it did not work out of the box, Some files were missing and following the README file instructions did not work.

We resorted on copying the flash memory using a flash memory reader, and extracting the bootloader from it. The bootloader on v6 is smaller, a single 64k block instead of the usual two blocks. This messes with the entry point of kernel. So I had to recompile the kernel. To make a long story short, I was finally able to do it, and there is now a working image for the v6 as well.

If there is interest, I can post the image and the information you can use to build your own. The dmesg output of the v6 follows below:

dmesg

[    0.000000] Linux version 4.14.63 (schara@camboinhas) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7258-5eb055306f)) #0 Thu Aug 16 07:51:15 2018
[    0.000000] Board has DDR1
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is TP-Link TL-WR849N v6
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 02000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000001ffffff]
[    0.000000] On node 0 totalpages: 8192
[    0.000000] free_area_init_node: node 0, pgdat 803caf50, node_mem_map 81000040
[    0.000000]   Normal zone: 64 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 8192 pages, LIFO batch:0
[    0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 8128
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 128 (order: -3, 512 bytes)
[    0.000000] Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Writing ErrCtl register=00000004
[    0.000000] Readback ErrCtl register=00000004
[    0.000000] Memory: 28088K/32768K available (3056K kernel code, 163K rwdata, 668K rodata, 200K init, 201K bss, 4680K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 580MHz
[    0.000000] timer_probe: no matching timers found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
[    0.000010] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
[    0.007533] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.073488] pid_max: default: 32768 minimum: 301
[    0.078150] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.084493] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.096116] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.105596] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.111543] pinctrl core: initialized pinctrl subsystem
[    0.117042] NET: Registered protocol family 16
[    0.142387] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.148015] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.153499] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.162844] clocksource: Switched to clocksource MIPS
[    0.168759] NET: Registered protocol family 2
[    0.173793] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.180481] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.186659] TCP: Hash tables configured (established 1024 bind 1024)
[    0.192919] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.198519] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.204849] NET: Registered protocol family 1
[    0.209034] PCI: CLS 0 bytes, default 32
[    0.212051] Crashlog allocated RAM at address 0x1f00000
[    0.218524] workingset: timestamp_bits=30 max_order=13 bucket_order=0
[    0.230038] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.235655] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.254206] io scheduler noop registered
[    0.257935] io scheduler deadline registered (default)
[    0.263711] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    0.270848] console [ttyS0] disabled
[    0.274337] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[    0.283047] console [ttyS0] enabled
[    0.290051] bootconsole [early0] disabled
[    0.298593] cacheinfo: Failed to find cpu0 device node
[    0.303838] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.310675] spi-mt7621 10000b00.spi: sys_freq: 193333333
[    0.329099] m25p80 spi0.0: w25q32 (4096 Kbytes)
[    0.333770] 3 fixed-partitions partitions found on MTD device spi0.0
[    0.340207] Creating 3 MTD partitions on "spi0.0":
[    0.345083] 0x000000000000-0x000000010000 : "boot"
[    0.350773] 0x000000010000-0x0000003f0000 : "firmware"
[    0.382918] 2 tplink-fw partitions found on MTD device firmware
[    0.388943] 0x000000010000-0x000000152705 : "kernel"
[    0.394838] 0x000000152708-0x0000003f0000 : "rootfs"
[    0.400580] mtd: device 3 (rootfs) set to be root filesystem
[    0.407768] 1 squashfs-split partitions found on MTD device rootfs
[    0.414103] 0x000000300000-0x0000003f0000 : "rootfs_data"
[    0.420429] 0x0000003f0000-0x000000400000 : "factory"
[    0.427047] libphy: Fixed MDIO Bus: probed
[    0.442474] rt3050-esw 10110000.esw: link changed 0x00
[    0.449212] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    0.458602] NET: Registered protocol family 17
[    0.463236] 8021q: 802.1Q VLAN Support v1.8
[    0.480198] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[    0.488488] Freeing unused kernel memory: 200K
[    0.493024] This architecture does not have kernel memory protection.
[    1.515850] init: Console is alive
[    1.519507] init: - watchdog -
[    2.132852] random: fast init done
[    2.500910] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.699297] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.717155] init: - preinit -
[    4.087175] rt3050-esw 10110000.esw: link changed 0x00
[    7.300251] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[    7.328348] urandom-seed: Seed file not found (/etc/urandom.seed)
[    7.444522] procd: - early -
[    7.447542] procd: - watchdog -
[    7.624164] rt3050-esw 10110000.esw: link changed 0x04
[    8.071158] procd: - watchdog -
[    8.074680] procd: - ubus -
[    8.122170] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.130111] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.137134] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.144610] procd: - init -
[    8.763799] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.773800] Loading modules backported from Linux version wt-2017-11-01-0-gfe248fc2c180
[    8.781922] Backport generated by backports.git v4.14-rc2-1-31-g86cf0e5d
[    8.794619] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[    8.853274] xt_time: kernel timezone is -0000
[    8.959430] ip_tables: (C) 2000-2006 Netfilter Core Team
[    9.001971] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[    9.011305] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[    9.017387] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[    9.042840] firmware init done
[    9.204691] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[    9.273877] PPP generic driver version 2.4.2
[    9.280923] NET: Registered protocol family 24
[    9.289364] kmodloader: done loading kernel modules from /etc/modules.d/*
[   10.535137] urandom_read: 5 callbacks suppressed
[   10.535146] random: jshn: uninitialized urandom read (4 bytes read)
[   10.610578] random: jshn: uninitialized urandom read (4 bytes read)
[   15.000172] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[   15.026887] jffs2_build_filesystem(): unlocking the mtd device...
[   15.026941] done.
[   15.035215] jffs2_build_filesystem(): erasing all blocks after the end marker...
[   18.435561] br-lan: port 1(eth0.1) entered blocking state
[   18.448689] br-lan: port 1(eth0.1) entered disabled state
[   18.454472] device eth0.1 entered promiscuous mode
[   18.459331] device eth0 entered promiscuous mode
[   18.590165] br-lan: port 1(eth0.1) entered blocking state
[   18.595711] br-lan: port 1(eth0.1) entered forwarding state
[   21.354266] done.
[   21.356265] jffs2: notice: (785) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[   21.569656] overlayfs: upper fs does not support tmpfile.
[  122.702900] random: crng init done

Some more info:

root@OpenWrt:/# df
Filesystem           1K-blocks      Used Available Use% Mounted on
/dev/root                 1792      1792         0 100% /rom
tmpfs                    14144        56     14088   0% /tmp
tmpfs                    14144        24     14120   0% /tmp/root
tmpfs                      512         0       512   0% /dev
/dev/mtdblock4             960       212       748  22% /overlay
overlayfs:/overlay         960       212       748  22% /
root@OpenWrt:/# free
             total       used       free     shared    buffers     cached
Mem:         28288      16688      11600         80       1496       4576
-/+ buffers/cache:      10616      17672
Swap:            0          0          0
root@OpenWrt:/# ifconfig
br-lan    Link encap:Ethernet  HWaddr AC:84:C6:XX:XX:XX
          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:342 (342.0 B)

eth0      Link encap:Ethernet  HWaddr AC:84:C6:XX:XX:XX
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:120 errors:0 dropped:41 overruns:0 frame:0
          TX packets:792 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:15316 (14.9 KiB)  TX bytes:274729 (268.2 KiB)
          Interrupt:5

eth0.1    Link encap:Ethernet  HWaddr AC:84:C6:XX:XX:XX
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:342 (342.0 B)

eth0.2    Link encap:Ethernet  HWaddr AC:84:C6:XX:XX:XX
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:790 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:270180 (263.8 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:416 errors:0 dropped:0 overruns:0 frame:0
          TX packets:416 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:28288 (27.6 KiB)  TX bytes:28288 (27.6 KiB)
root@OpenWrt:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00010000 00010000 "boot"
mtd1: 003e0000 00010000 "firmware"
mtd2: 00142705 00010000 "kernel"
mtd3: 0029d8f8 00010000 "rootfs"
mtd4: 000f0000 00010000 "rootfs_data"
mtd5: 00010000 00010000 "factory"

The original bootlog of the v6 is below (thanks to some soldering and a usb-3.3V serial dongle):

[04020C0E][04020D08][89880000][24234746][00242346]
▒▒Ġ▒▒tting C▒▒Ӡ▒▒▒e


U-Boot 1.1.3 (Dec 26 2017 - 08:53:01)

Boar▒: ▒alink APSoC ▒RAMĺ  32 MB
reloj▒▒▒facW՗▒▒id:▒Yr at"▒▒٥▒▒ id▒0 ▒▒▒▒ȥnd +▒͡i W2MT&▒
==OOO▒▒==ٽOOO▒▒==▒OO▒▒▒==OOO▒▒===OOO▒▒=
P▒j▒7628▒A▒ 256▒S頬▒▒ DD▒--▒KKKꭩͺ▒▒th L▒▒▒▒AM ɬ▒▒נL▒ter▒Z▒K끢.3 r▒R
==▒OO▒▒▒==OOO▒▒===OOO▒▒===OOO▒▒==ϽOOO▒▒ Fl▒.▒
##▒+▒CPU ▒V殁= 58MH▒ڂ                   ▒Zꍬ▒▒e: ▒W▒512,▒麅▒▒i4, +˕▒▒:3啲▒toW▒▒ⱶMM▒▒▒▒▒he▒▒▒▒▒:25Ѷ      ▒▒▒s:4▒b嬥▒▒sz:&&b▒▒tal▒&▒▒R
TOD▒▒6ݲ▒▒▒▒d MP(▒▒2 Mꚬ▒ѕ▒)
                ▒▒re▒.2ɽm F▒X.b▒▒ux ▒▒▒▒XoU▒▒i
#J▒깥trd▒h▒▒Ʌ▒▒fer▒Z▒́cont▒▒▒▒▒▒▒pre▒▒▒K▒dre▒.▒▒0c1MJrr.
▒$:▒vin▒b▒祹▒x m▒[ծK▒ inj       ▒▒&&!H▒hE▒▒tinZɕ▒ɹel▒▒▒R
▒ɀ▒▒▒▒▒▒▒▒fff▒▒~▒▒~fx▒▒▒▒▒▒怘▒怘▒f▒▒▒▒f▒▒▒▒f▒f▒▒▒Linux version 2.6.36 (tomcat@buildserver) (gcc version 4.6.3 (Buildroot 2012.11.1) ) #1 Tue Dec 26 08:55:35 CST 2017

 The CPU feqenuce set to 575 MHz

 MIPS CPU sleep mode enabled.
CPU revision is: 00019655 (MIPS 24Kc)
Software DMA cache coherency
Determined physical RAM map:
 memory: 02000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS1,115200 root=/dev/mtdblock2 rootfstype=squashfs init=/sbin/init
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Writing ErrCtl register=0000000a
Readback ErrCtl register=0000000a
Memory: 29268k/32768k available (2165k kernel code, 3500k reserved, 557k data, 156k init, 0k highmem)
NR_IRQS:128
console [ttyS1] enabled
Calibrating delay loop... 386.04 BogoMIPS (lpj=772096)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource Ralink Systick timer
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 57
io scheduler noop registered
io scheduler deadline registered (default)
Ralink gpio driver initialized
Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
brd: module loaded
flash manufacture id: ef, device id 40 16
W25Q32BV(ef 40160000) (4096 Kbytes)
mtd .name = raspi, .size = 0x00400000 (4M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
Creating 5 MTD partitions on "raspi":
0x000000000000-0x000000010000 : "boot"
0x000000010000-0x000000100000 : "kernel"
0x000000100000-0x0000003e0000 : "rootfs"
mtd: partition "rootfs" set to be root filesystem
0x0000003e0000-0x0000003f0000 : "config"
0x0000003f0000-0x000000400000 : "radio"
Register flash device:flash0
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
Mirror/redirect action on
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (457 buckets, 1828 max)
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Linux
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
SQUASHFS error: Xattrs in filesystem, these will be ignored
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 156k freed
starting pid 28, tty '': '/etc/init.d/rcS'
mount: mounting devpts on /dev/pts failed: No such device
rdm_major = 253
spiflash_ioctl_read, Read from 0x003ff100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(  3ff100) ffffffac-ffffff84-ffffffc6-1d-ffffff93-ffffffbe
GMAC1_MAC_ADRH -- : 0x0000ac84
GMAC1_MAC_ADRL -- : 0xc61d93be
Ralink APSoC Ethernet Driver Initilization. v3.1  256 rx/tx descriptors allocated, mtu = 1500!
NAPI enable, Tx Ring = 256, Rx Ring = 256
spiflash_ioctl_read, Read from 0x003ff100 length 0x6, ret 0, retlen 0x6
Read MAC from flash(  3ff100) ffffffac-ffffff84-ffffffc6-1d-ffffff93-ffffffbe
GMAC1_MAC_ADRH -- : 0x0000ac84
GMAC1_MAC_ADRL -- : 0xc61d93be
PROC INIT OK!
add domain:tplinkwifi.net
add domain:tplinkap.net
add domain:tplinkrepeater.net
add domain:tplinklogin.net
tp_domain init ok
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
Set: phy[0].reg[0] = 3900
Set: phy[1].reg[0] = 3900
Set: phy[2].reg[0] = 3900
Set: phy[3].reg[0] = 3900
Set: phy[4].reg[0] = 3900
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[0] = 3300
resetMiiPortV over.
Set: phy[0].reg[4] = 01e1
Set: phy[0].reg[0] = 3300
Set: phy[1].reg[4] = 01e1
Set: phy[1].reg[0] = 3300
Set: phy[2].reg[4] = 01e1
Set: phy[2].reg[0] = 3300
Set: phy[3].reg[4] = 01e1
Set: phy[3].reg[0] = 3300
Set: phy[4].reg[4] = 01e1
Set: phy[4].reg[0] = 3300
turn off flow control over.
starting pid 77, tty '/dev/ttyS1': '/bin/sh'
~ # [ util_execSystem ] 139:  ipt_init cmd is "/var/tmp/dconf/rc.router"

[ dm_readFile ] 2061:  can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/reduced_data_model.xml
spiflash_ioctl_read, Read from 0x003e0000 length 0x10000, ret 0, retlen 0x10000
spiflash_ioctl_read, Read from 0x003e0000 length 0x9b2f, ret 0, retlen 0x9b2f
===>Enter AP modspiflash_ioctl_read, Read from 0x003ff100 length 0x6, ret 0, retlen 0x6
e
spiflash_ioctl_read, Read from 0x003ff200 length 0x4, ret 0, retlen 0x4
spiflash_ioctl_read, Read from 0x003ff300 length 0x4, ret 0, retlen 0x4
spiflash_ioctl_read, Read from 0x003ff400 length 0x10, ret 0, retlen 0x10
spiflash_ioctl_read, Read from 0x003ff500 length 0x29, ret 0, retlen 0x29
spiflash_ioctl_read, Read from 0x003ff600 length 0x21, ret 0, retlen 0x21
spiflash_ioctl_read, Read from 0x003ff700 length 0x10, ret 0, retlen 0x10
spiflash_ioctl_read, Read from 0x003ff700 length 0x10, ret 0, retlen 0x10
spiflash_ioctl_read, Read from 0x00010000 length 0x1d0, ret 0, retlen 0x1d0
spiflash_ioctl_read, Read from 0x003ff100 length 0x6, ret 0, retlen 0x6
sendto: No such file or directory
pid 76 send 2001 error
[ util_execSystem ] 139:  oal_startDynDns cmd is "dyndns /var/tmp/dconf/dyndns.conf"

Get SNTP new config
[ util_execSystem ] 139:  oal_startNoipDns cmd is "noipdns /var/tmp/dconf/noipdns.conf"

[ util_execSystem ] 139:  oal_startCmxDns cmd is "cmxdns /var/tmp/dconf/cmxdns.conf"

ioctl: No such device
[ util_execSystem ] 139:  oal_br_addBridge cmd is "brctl addbr br0;brctl setfd br0 0;brctl stp br0 off"

[ util_execSystem ] 139:  oal_ipt_addLanRules cmd is "iptables -t filter -A INPUT -i br+ -j ACCEPT
"

[ rsl_initLanIpIntfObj ] 1015:  Smart DHCP, use 192.168.0.1/255.255.255.0 as default Static IP at initial stage!

[ util_execSystem ] 139:  oal_intf_setIntf cmd is "Raeth v3.1 (ifconfig br0 192NAPI
.168.0.1 netmask,SkbRecycle 255.255.255.0 u)
p"

[ util_exe
phy_tx_ring = 0x00c96000, tx_ring = 0xa0c96000
cSystem ] 139:
phy_rx_ring0 = 0x00c97000, rx_ring0 = 0xa0c97000
oal_util_setProc[fe_sw_init:5185]rt305x_esw_init.
LanAddr cmd is "echo "br0 16820416," > /proc/net/conntract_LocalAddr"

[ util_execSystem ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0 up"

disable switch phyport...
GMAC1_MAC_ADRH -- : 0x0000ac84
GMAC1_MAC_ADRL -- : 0xc61d93be
RT305x_ESW: Link Status Changed
[ util_execSystem ] 139:  rsl_initLanEthIntfObj cmd is "ifconfig eth0 up"

[ util_execSystem ] 139:  oal_br_addIntfIntoBridge cmd is "brctldevice eth0 entered promiscuous mode
 addif br0 eth0"br0: port 1(eth0) entering forwarding state


br0: port 1(eth0) entering forwarding state
[ util_execSystem ] 139:  oal_addVlanTagIntf cmd is "vconfig add eth0 3"

[ util_execSystem ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0.3 up"

set if eth0.3 to *not wan dev
[ util_execSystem ] 139:  oal_br_device eth0.3 entered promiscuous mode
addIntfIntoBridgbr0: port 2(eth0.3) entering forwarding state
e cmd is "brctl br0: port 2(eth0.3) entering forwarding state
addif br0 eth0.3"

[ util_execSystem ] 139:  oal_addVlanTagIntf cmd is "vconfig add eth0 4"

[ util_execSystem ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0.4 up"

set if eth0.4 to *not wan dev
[ util_execSystem ] device eth0.4 entered promiscuous mode
139:  oal_br_addbr0: port 3(eth0.4) entering forwarding state
IntfIntoBridge cbr0: port 3(eth0.4) entering forwarding state
md is "brctl addif br0 eth0.4"

[ util_execSystem ] 139:  oal_addVlanTagIntf cmd is "vconfig add eth0 5"

[ util_execSystem ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0.5 up"

set if eth0.5 to *not wan dev
[ utildevice eth0.5 entered promiscuous mode
_execSystem ] 13br0: port 4(eth0.5) entering forwarding state
9:  oal_br_addInbr0: port 4(eth0.5) entering forwarding state
tfIntoBridge cmd is "brctl addif br0 eth0.5"

[ util_execSystem ] 139:  oal_addVlanTagIntf cmd is "vconfig add eth0 6"

[ util_execSystem ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0.6 up"

set if eth0.6 to *not wdevice eth0.6 entered promiscuous mode
an dev
[ util_ebr0: port 5(eth0.6) entering forwarding state
xecSystem ] 139:br0: port 5(eth0.6) entering forwarding state
  oal_br_addIntfIntoBridge cmd is "brctl addif br0 eth0.6"

[ util_execSystem ] 139:  oal_addVlanTagIntf cmd is "vconfig add eth0 7"

[ util_execSystem ] 139:  oal_intf_enableIntf cmd is "ifconfig eth0.7 up"

set if etdevice eth0.7 entered promiscuous mode
h0.7 to *not wanbr0: port 6(eth0.7) entering forwarding state
 dev
[ util_exebr0: port 6(eth0.7) entering forwarding state
cSystem ] 139:  oal_br_addIntfIntoBridge cmd is "brctl addif br0 eth0.7"

[ utbr0: port 1(eth0) entering forwarding state
il_execSystem ] 139:  oal_br_delIntfFromBridge cmd is "brctl delif br0 eth0"

[ util_execSystem ] 139:  oal_eth_setIGMPSnoopParam cmd is "for i in /sys/devices/virtual/net/*/bridge/multicast_snooping;do echo 1 > $i ; done"

[ util_execSystem ] 139:  rsl_initApIgmpSnoop cmd is "for i in /sys/devices/virtual/net/*/bridge/igmp_query_version; do echo 3 > $i; done"

[ util_execSystem ] 139:  oal_wlan_ra_setCountryRegion cmd is "cp /etc/SingleSKU_FCC.dat /var/Wireless/RT2860AP/SingleSKU.dat"

[ util_execSystem ] 139:  oal_wlan_ra_setCountryRegion cmd is "iwpriv ra0 set CountryRegion=8"

ra0       no private ioctls.

[ util_execSystem ] 166:  execute ok, exit status = 255

[ util_execSystem ] 139:  oal_wlan_ra_loadDriver cmd is "insmod /lib/modules/kmdir/kernel/drivers/net/wireless/mt_wifi_ap/mt_wifi.ko"



=== pAd = c087a000, size = 1497864 ===

<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
<-- RTMPAllocAdapterBlock, Status=0
RtmpChipOpsHook(492): Not support for HIF_MT yet!
mt7628_init()-->
mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
e2.bin mt7628_init(1156)::(2), pChipCap->fw_len(64560)
mt_bcn_buf_init(218): Not support for HIF_MT yet!
<--mt7628_init()
[ util_execSystem ] 139:  oal_wlan_ra_initWlan cmd is "ifconfig TX_BCN DESC a0eab000 size = 320
ra0 up"

RX[0] DESC a0ead000 size = 2048
RX[1] DESC a0eb0000 size = 2048
RT_CfgSetApcliMacAddress : invalid mac setting
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
AndesSendCmdMsg: Could not send in band command due to diable fRTMP_ADAPTER_MCU_SEND_IN_BAND_CMD
APSDCapable[0]=0
APSDCapable[1]=0
APSDCapable[2]=0
APSDCapable[3]=0
APSDCapable[4]=0
APSDCapable[5]=0
APSDCapable[6]=0
APSDCapable[7]=0
APSDCapable[8]=0
APSDCapable[9]=0
APSDCapable[10]=0
APSDCapable[11]=0
APSDCapable[12]=0
APSDCapable[13]=0
APSDCapable[14]=0
APSDCapable[15]=0
default ApCliAPSDCapable[0]=0
Key1Str is Invalid key length(0) or Type(0)
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
WscKeyASCII=8
WscKeyASCII=8
[RTMPReadParametersHook:297]wifi read profile faild.
load fw image from fw_header_image
AndesMTLoadFwMethod1(2263)::pChipCap->fw_len(64560)
FW Version:1
FW Build Date:20161213152835
CmdAddressLenReq:(ret = 0)
CmdFwStartReq: override = 1, address = 1048576
CmdStartDLRsp: WiFI FW Download Success
MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
efuse_probe: efuse = 10000012
RtmpChipOpsEepromHook::e2p_type=0, inf_Type=4
RtmpEepromGetDefault::e2p_dafault=2
RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
NVM is FLASH mode

(... too big, had to cut the end ...)

Last words: be careful when soldering the serial port. I damaged two routers this way, one lost the serial port, and the other was a total loss. Although my eyes are not what they used to be, I am quite adept at soldering, so I do not know what happened - maybe my soldering iron is leaking current and I zapped the ports. Also, if the serial port is plugged, TFTP will not work. So you have to disconnect the port to upload a new image. Finally, sometimes the router will not boot with the serial port connected (one of the routers I thought I lost does boot, but not with the serial port connected). Maybe somebody in the group will know the reasons for that and give me a tip on how to work around and maybe even fix the broken hardware.

Cheers,

--schara

3 Likes

can you please post a link to TP-Link WR849N v5 openwrt firmware?

There is no v5 listed in the Table of Hardware - it appears unsupported.

Please consider opening a new thread in the future.

You may want to directly message @schara to ask what images he used.

So, you are able to create a OpenWRT firmware image for the TL-WR849N v6? Can you post it? I'm from Brazil too and the OEM firmware is terrible.
I'm afraid of trying doing some custom image and ends bricking my router.
Thank you for the help!

I sent the image, but I do not know if it reached you. It seems that as I sent from another address it was not posted. Do you still want the image?

S.

Yes, I am active, but I do not read it everyday. I do not know how to post a file here.

S.

I put three files on this folder

https://drive.google.com/drive/folders/1RD0VDEJgT9BRc_qxajJaJGHhqh5DQw8H?usp=sharing

tp_recovery.bin_v5 and v6 allow you to upload an image via TFPT, your computer should have the address 192.168.0.66, and hava a TFTP server installed. Rename the file to tp_recovery.bin.

The openwrt file allows you to update to an image with LUCI (v5 only, will post v6 on demand).

Remember that for a v5 I am using a wr840v5 image, build with image builder, excluding some packages so there space left over to make a writable filesystem. The tp_recovery.bin files includes the bootloader (for v5 and v6).

S.

1 Like

I will answer in English and Portuguese. Please bear with me.

The tp_recovery.bin image is a openwrt image plus the bootloader, suitable for installing via tftp, as this is the easiest method to install the image. Once this image is installed you can create others, copy over and install via sysupgrade. To install via TFTP you need to install a tftp server on your computer, set the address on the computer to 192.168.0.66 and turn on the router with the reset button pressed. Your computer should be connected to one of the LAN (yellow) ports on the router. You will see the led flashing rapidly as the image is transferred. DO NOT TURN OFF THE ROUTER. Change the address on your PC to 192.168.1.2 and ping 192.168.1.1. Once it starts pinging you can turn off the router.

Portuguese:

Esta já é a imagem do openwrt para você instalar via TFTP. siga as intruções acima (coloque um servidor tftp no seu computador, coloque seu computador no endereço 192.168.0.66, ligue o 849 com o botão de reset apertado). Pronto, o openwrt está instalado. Aí você pode fazer o que quiser com ele, inclusive instalar outra imagem, se bem que para o 849v6 ainda não tem imagem oficial. Eu vou por a minha lá quando tiver tempo.

--schara

After some tweeking on the GPL files I was able to compile the bootloader for the WR849v6 - not that I needed it. Now there is also an image on TP-Link´s web site, so you can also get a bootloader from there if you want to experiment.

Unfortunately, it seems that v5 was better. All units I have have 64MB of RAM, while all v6 have only 32MB of RAM. In fact, this was why it took me a while to get a workable version, I copied the files from the WR840v5 and did not change the amount of available memory - so it would boot but then panic when accessing memory that wasn´t there.

--schara

I get it. All the routers have the TFTP client by default, So I can install the image using a TFTP server on my PC, right?
Does the 849v6 image on Google Drive have the memory access issue?

Portuguese: =P

Entendi. Então todos os roteadores, por padrão, já tem um cliente TFTP instalado, o qual posso acessar ligando o roteador com o botão reset pressionado. Usando o servidor TFTP instalado no PC, eu posso transferir a imagem para o roteador.
A imagem do 849v6 que você postou no Google drive ainda tem o problema de memória ou está corrigido?

Muito obrigado pela ajuda!!!!
Thanks for the help!!!

Hello @schara thanks for posting this initial support for this model.

According to the dmesg you posted the v6 (and probably the v5) it seem to have kept the same CPU as v4 (https://wikidevi.com/wiki/TP-LINK_TL-WR849N(BR)_v4.0) so it shouldn't take much to get v5 and v6 officially supported too.

The fact it drops RAM size from version v5 to v6 I don't think it should be and issue. Perhaps a bit of stability testing with the 32MB version may be necessary to find out.

Are you able to put anything that is necessary for a pull request and make it go into the OpenWrt tree?

Yes, the bootloader has a tftp client that runs when you boot the AP with one button pressed. You can use wireshark to see the request. It contains the target address and filename.

The v6 image is the one I am using, and it seems fine.

S.

As I have never done it before I do not know what it entails, but if there is a manual I can do it, just point me to the docs.

S.

Hello @schara I am putting below two URLs with instructions on how to submit a patch to the developers. You have to use GitHub. Check if it's ok to follow this and let us know. It will be good to have this router model on the official tree.

the image didnt reached me but i've downloaded from google drive. From the link you posted below. thank you very much!

how can I return from this openwrt firmware to stock firmware?

and I'm having troubles installing luci it says that I dont have space enough on the device. how can solve this problem?

Hello @schara
Did you manage to prepare stuff to send a pull request for this router ? It's a very common one over here and I see a lot of benefit to have it in the tree. As you made it work already it shouldn't take make to include in the tree.
There are also some interesting customization that can be done for this router to be used in ISPs as well.

To return to stock firmware there are two different paths. You can get the original image from TP-Link website, strip header and bootloader and update via sysupgrade or strip header and update via tftp.

S.

Depending on your version, I think I put a sysupgrade image that included luci, but otherwise you have to build your own, see answer below.

S.

@ffredy I have a bit of backlog of urgent tasks, so I did not get around to it yet, but I plan to do that tomorrow at the latest.

S.