Ipq806x: LEDE support for TP-Link Archer VR2600v

On Archer D7 connection between the router and modem by eth. all the status data are also in this connection. If I use command: ifconfig ethX down the webinterface lose any data from "modem"
Look here: http://tplink-forum.pl/uploader/uploads/1422556118.png
It looks like "modem" its connected to "router" switch.
http://tplink-forum.pl/index.php?/topic/3026-archer-d7/

I try install openwrt on Archer D7, but it cant run. When I change uboot from C7 then openwrt run, but modem have bootloop.

Did You try check if swconfig see "link" on other ports?
Normaly on C2600 GMAC0 and GMAC6 is connected to switch chip ( port 0 and 6)

The switch has only 7 ports. Two are connected to the ipq, 4 are for LAN with PHY and there is an additional WAN Ethernet which is the last port on the switch. This is similar to the C2600. The modem processor is connected on GMAC0. This is from the factory ipq firmware:

ath0      Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:2290  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ath5      Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F8  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:2290  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br0       Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:816 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3182 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:59648 (58.2 KiB)  TX bytes:751260 (733.6 KiB)

eth0      Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:816 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12242 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:76190 (74.4 KiB)  TX bytes:3198281 (3.0 MiB)
          Interrupt:2 

eth0.2    Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:816 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3186 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:61502 (60.0 KiB)  TX bytes:796176 (777.5 KiB)

eth0.3    Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3018 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:784335 (765.9 KiB)

eth0.4    Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3017 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:784205 (765.8 KiB)

eth0.5    Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3017 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:784205 (765.8 KiB)

eth1      Link encap:Ethernet  HWaddr 9A:C7:BF:0C:C4:F7  
          inet addr:10.42.21.167  Bcast:10.42.21.255  Mask:255.255.255.0
          inet6 addr: fe80::98c7:bfff:fe0c:c4f7/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1228 errors:0 dropped:0 overruns:0 frame:0
          TX packets:538 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:170409 (166.4 KiB)  TX bytes:45266 (44.2 KiB)
          Interrupt:255 

eth2      Link encap:Ethernet  HWaddr 76:0E:D1:BC:E0:66  
          inet6 addr: fe80::740e:d1ff:febc:e066/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:341 errors:0 dropped:0 overruns:0 frame:0
          TX packets:51 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:53078 (51.8 KiB)  TX bytes:6484 (6.3 KiB)
          Interrupt:252 

eth2.1    Link encap:Ethernet  HWaddr 76:0E:D1:BC:E0:66  
          inet6 addr: fe80::740e:d1ff:febc:e066/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:341 errors:0 dropped:301 overruns:0 frame:0
          TX packets:47 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:46940 (45.8 KiB)  TX bytes:5888 (5.7 KiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4961 (4.8 KiB)  TX bytes:4961 (4.8 KiB)

wifi0     Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F6  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:539 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:68 Memory:e1800000-e1a00000 

wifi1     Link encap:Ethernet  HWaddr 50:C7:BF:0C:C4:F8  
          inet6 addr: fe80::52c7:bfff:fe0c:c4f8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:539 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:90 Memory:e1c00000-e1e00000 

Sadly my tests did not bring up the Ethernet interface yet. In the factory image they are doing some stuff on the Ethernet controller's registers while bringing up the interface in /etc/init.d/rcS:

# for dsl remote
ifconfig eth2 up
devmem2 0x00801020 w 0x1C0
#devmem2 0x00801420 w 0x1C1
devmem2 0x00801420 w 0x3C3
vconfig add eth2 1
ifconfig eth2.1 up
# end

On the BCM63168 there is a process named msgapp which could do the communication. But it's clearly not doing it over IPv4 as there are no addresses setup. So the communication is either via IPv6 or some other protocol.

Did you try to flash the modem processor or just the main processor?

BTW, is the VR600v the small brother of the VR2600v? Is has also the BCM63168.

Would anyone know whether the sysupgrade image for the vr2600v can be installed on a vr2600 (so without the "voice" stuff) ?

Another question:
Would the u-boot TFTP recovery procedure boot an initramfs image ?
If so, that would allow a sysupgrade from there end opening the case and soldering a serial header could be skipped.

The VR600v uses only the BCM63168 as far as I know. The VR2600v has an ipq806x as main processor and an BCM63168 as co procesor to do the xDSL stuff.

It might be possible. Can you post a photo of the PCB? Maybe than we can say more. They might have just not assembled the DSP for DECT and POTS.

I have not tested that. Might be possible. If I find time I will have a look into it.

Keep in mind that the VR2600v image provided only Ethernet and Wifi. The xDSL is still not working as I did not manage to get the Ethernet device between the two processors up.

Came to realize that the xDSL is still unsupported after I ordered the vr2600; which is a mistake since it would replace a modem/router at a customers site. I will try to deploy it first as kind of C2600 in combination with the old modem set to bridge mode - or run it with the stock firmware, though that would leave me with other problems (VLAN etc.) . Once xDSL works the old modem can be dropped. Before deployment I'll try to run some tests, but first the vr2600 has to arrive.

Somebody knows if the latest release LEDE v17.01.1 contemplates the stability with Acher C2600 v1.1? somebody did some tests?

Any news here ?

@Zeraphim

I'm a bit new to TP Link, but have experience with AVM devices, Banana Pi R1 etc. Please could you or someone else post a picture from the jp2 solder pins. I dont have a multimeter right now by my hand. I would look forwart to contribute to this device :slight_smile:

It's me again :smiley: I got it and made a picture.

But now I'm in trouble. I can get the Lede image via 'tftpboot lede-17.01.2-ipq806x-VR2600v-squashfs-sysupgrade.bin' to my device, but I dont know how to write this into nand? could somebody help me out?

Hi nebkas,

Sorry for not seeing your post sooner. You did find the right connector. You should see there the output of the serial console. Interrupt the bootloader by pressing any key. It should look like this:

U-Boot 2012.07 [Standard IPQ806X.LN,r40858] (Dec 08 2015 - 15:14:35)

smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  ipq_nand: unknown NAND device manufacturer: 0 device: 0
ipq_nand: failed to identify device
SF: we have a match, call probe
SF: Detected W25Q128 with page size 64 KiB, total 16 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x1000000
16 MiB
MMC:   
*** Warning - bad CRC, using default environment

PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
Net:   No ART partition found
MAC1 addr:0:3:7f:ba:db:1
S17c athrs17_init_switch  done.
WJL: athrs17_reg_init() reg-0x30=0x80000700.1.
WJL: athrs17_reg_init() reg-0x30=0x80000401.2.
WJL: athrs17_reg_init: PAD config after SOFT_RESET. 
WJL: athrs17_reg_init: 0x0000007c=0x00001080.1.
WJL: athrs17_reg_init: 0x00000094=0x00001080.2.
athrs17_reg_init: complete
S17c init done (WJL-07-10-1829, uboot task - internal loopback)
MAC2 addr:0:3:7f:ba:db:2
eth0
Warning: eth0 MAC addresses don't match:
Address in SROM is         00:03:7f:ba:db:01
Address in environment is  00:aa:bb:cc:dd:ee
, eth1
Hit any key to stop autoboot:  0 
athrs17_vlan_config ...done
(IPQ) #

What you need in in order to flash the box is a TFTP server. Connect it somehow to one of the Ethernet ports of the box and copy the sysupgrade image to it. I renamed the file to just sysupgrade.bin on my server for easier typing.

First thing you have to do is setup the ip address of the box and the TFTP server. Also disabling autoboot and probing for the serial flash. This will enable you to write to the flash:

(IPQ) # setenv ipaddr 10.42.21.50
(IPQ) # setenv serverip 10.42.21.200
(IPQ) # setenv autoboot false
(IPQ) # sf probe

The ping command is available in the bootloader. You could check the connection to your server before proceeding. What has to be done now is transfer the image from the TFTP server to the RAM and then writing it to the flash. Careful here. Any badly written value can brick your box! Note that the erase command will take some time to finish.

(IPQ) # tftpboot 0x44000000 sysupgrade.bin
Using eth0 device
TFTP from server 10.42.21.200; our IP address is 10.42.21.50
Filename 'sysupgrade.bin'.
Load address: 0x44000000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ###############
done
Bytes transferred = 4980906 (4c00aa hex)
(IPQ) # sf erase 0x320000 0xc60000
(IPQ) # sf write 0x44000000 0x320000 0x4c00aa

Note that I used the same amount of data that was read from TFTP to write it to the flash (0x4c00aa). You should do the same. Reboot the box and enjoy LEDE.

Once you have booted LEDE you can just use the sysupgrade command for further flashing.

Looking through the GPL dump for the VR900, msgapp is an elf binary in the tar file, running strings on in gives some interesting things: https://pastebin.com/rNbPvJYv

Oh well, sorry even noticed yesterday your replay. Everything went well and works like I assumed.

But, how can I flash back to factory tp link firmware. it seems the tftp mode didnt work when i use 192.168.0.66.

Hi philjohn,

Thx for pointing that out. This is definitely the application that is doing the communication between the two processors. Problem is: The Ethernet device on ipq806x side does not come up. My rough guess is that the MII clock is missing as it is not yet generated by the BCM. But how do I send the command to it to activate everything?

@Zeraphim Thank you for your instructions. This actually worked well on EU version VR2600 v1. An official TP-LINK firmware was released in 2016 so plenty of vulnerabilities and no user for authentication, just password (still cant believe it). I will be testing it soon and will feed back any issues

Regards
lotkas

@Zeraphim

Its been a while since I loaded v17.01.4 to my VR2600 and it works well. Once again thank you for making my journey to OpenWRT/LEDE easier.

I recently switched to Linksys WRT32X and loaded one of the r7xxx snapshots. VR2600 will be my testing router moving forward.

According to "board-ipq806x-gpiomux.c" GPL Tp-Link file, also GPIO2 and 66 should be involved to have the internal ethernet working:

#ifdef CONFIG_TP_IMAGE
static struct msm_gpiomux_config ipq806x_tp_gpiomux[] = {
	ipq_mux( 0, mdio_n,				mdio_n),
	ipq_mux( 1, mdio_n,				mdio_n),
	ipq_mux( 2, nss_gmac0_rgmii_set1,		nss_gmac0_rgmii_set1),
	....
	ipq_mux(66, nss_gmac0_rgmii_set2,		nss_gmac0_rgmii_set2),
};
#endif

static struct gpiomux_setting nss_gmac0_rgmii_set1 = {
	.func = GPIOMUX_FUNC_GPIO,
	.drv = GPIOMUX_DRV_16MA,
	.pull = GPIOMUX_PULL_NONE,
};

#ifdef CONFIG_TP_IMAGE
static struct gpiomux_setting nss_gmac0_rgmii_set2 = {
	.func = GPIOMUX_FUNC_GPIO,
	.drv = GPIOMUX_DRV_16MA,
	.pull = GPIOMUX_PULL_UP,
};

#endif

So I edited my dts like this:
Before rgmii2_pins: rgmii2_pins {

                        rgmii1_pins: rgmii1_pins {
                                set_1 {
                                        pins = "gpio2" ;
                                        function = "gpio";
                                        drive-strength = <16>;
                                        bias-disable;
                                };

                                set_2 {
                                        pins = "gpio66";
                                        function = "gpio";
                                        drive-strength = <16>;
                                        bias-pull-up;
                                };
                        };

And before "gmac1: ethernet@37200000": {

                gmac0: ethernet@37000000 {
                        status = "ok";
                        phy-mode = "rgmii";
                        qcom,id = <0>;

                        pinctrl-0 = <&rgmii1_pins>;
                        pinctrl-names = "default";

                        mtd-mac-address = <&defaultmac 0>;
                        mtd-mac-address-increment = <2>;

                        fixed-link {
                                speed = <1000>;
                                full-duplex;
                        };
                };

However I got always the same error:

[   25.202588] ipq806x-gmac-dwmac 37000000.ethernet: Failed to reset the dma
[   25.204544] ipq806x-gmac-dwmac 37000000.ethernet eth0: stmmac_hw_setup: DMA e
ngine initialization failed
[   25.211226] ipq806x-gmac-dwmac 37000000.ethernet eth0: stmmac_open: Hw setup
failed 

BUT my VR2600 has the Broadcom part not working (the stock firmware hangs during the boot), so these changes could work using a fully functional unit! :slight_smile:

Looks like this hasn't been tried yet? I have a known working VR2600 (non-v) with known working xDSL, and I've recently put openwrt onto this box. If someone can point me at the current status if it's discussed somewhere else, that would be great - happy to help.

Looks like it might be related to get the NSS drivers working. Here's the last post about it: IPQ806x NSS Drivers

The Broadcom part is pretty much locked up. No more usable interfaces except serial, dsl (+phone stuff for v). Even firmware upgrade seems to be triggered through this msgapp...