Oh well, sorry even noticed yesterday your replay. Everything went well and works like I assumed.
But, how can I flash back to factory tp link firmware. it seems the tftp mode didnt work when i use 192.168.0.66.
Hi philjohn,
Thx for pointing that out. This is definitely the application that is doing the communication between the two processors. Problem is: The Ethernet device on ipq806x side does not come up. My rough guess is that the MII clock is missing as it is not yet generated by the BCM. But how do I send the command to it to activate everything?
@Zeraphim Thank you for your instructions. This actually worked well on EU version VR2600 v1. An official TP-LINK firmware was released in 2016 so plenty of vulnerabilities and no user for authentication, just password (still cant believe it). I will be testing it soon and will feed back any issues
Regards
lotkas
Its been a while since I loaded v17.01.4 to my VR2600 and it works well. Once again thank you for making my journey to OpenWRT/LEDE easier.
I recently switched to Linksys WRT32X and loaded one of the r7xxx snapshots. VR2600 will be my testing router moving forward.
According to "board-ipq806x-gpiomux.c" GPL Tp-Link file, also GPIO2 and 66 should be involved to have the internal ethernet working:
#ifdef CONFIG_TP_IMAGE
static struct msm_gpiomux_config ipq806x_tp_gpiomux[] = {
ipq_mux( 0, mdio_n, mdio_n),
ipq_mux( 1, mdio_n, mdio_n),
ipq_mux( 2, nss_gmac0_rgmii_set1, nss_gmac0_rgmii_set1),
....
ipq_mux(66, nss_gmac0_rgmii_set2, nss_gmac0_rgmii_set2),
};
#endif
static struct gpiomux_setting nss_gmac0_rgmii_set1 = {
.func = GPIOMUX_FUNC_GPIO,
.drv = GPIOMUX_DRV_16MA,
.pull = GPIOMUX_PULL_NONE,
};
#ifdef CONFIG_TP_IMAGE
static struct gpiomux_setting nss_gmac0_rgmii_set2 = {
.func = GPIOMUX_FUNC_GPIO,
.drv = GPIOMUX_DRV_16MA,
.pull = GPIOMUX_PULL_UP,
};
#endif
So I edited my dts like this:
Before rgmii2_pins: rgmii2_pins {
rgmii1_pins: rgmii1_pins {
set_1 {
pins = "gpio2" ;
function = "gpio";
drive-strength = <16>;
bias-disable;
};
set_2 {
pins = "gpio66";
function = "gpio";
drive-strength = <16>;
bias-pull-up;
};
};
And before "gmac1: ethernet@37200000": {
gmac0: ethernet@37000000 {
status = "ok";
phy-mode = "rgmii";
qcom,id = <0>;
pinctrl-0 = <&rgmii1_pins>;
pinctrl-names = "default";
mtd-mac-address = <&defaultmac 0>;
mtd-mac-address-increment = <2>;
fixed-link {
speed = <1000>;
full-duplex;
};
};
However I got always the same error:
[ 25.202588] ipq806x-gmac-dwmac 37000000.ethernet: Failed to reset the dma
[ 25.204544] ipq806x-gmac-dwmac 37000000.ethernet eth0: stmmac_hw_setup: DMA e
ngine initialization failed
[ 25.211226] ipq806x-gmac-dwmac 37000000.ethernet eth0: stmmac_open: Hw setup
failed
BUT my VR2600 has the Broadcom part not working (the stock firmware hangs during the boot), so these changes could work using a fully functional unit! 
Looks like this hasn't been tried yet? I have a known working VR2600 (non-v) with known working xDSL, and I've recently put openwrt onto this box. If someone can point me at the current status if it's discussed somewhere else, that would be great - happy to help.
Looks like it might be related to get the NSS drivers working. Here's the last post about it: IPQ806x NSS Drivers
The Broadcom part is pretty much locked up. No more usable interfaces except serial, dsl (+phone stuff for v). Even firmware upgrade seems to be triggered through this msgapp...