I created a patch to add full support for this device in the 19.07 branch, since it has limited flash. Where would be a good point to publish the patch, my findings and an firmware image, if anyone else is intrested? An issue on github, the wiki or here?
the patch, you could post here ...
the files, you can share through gdrive or MEGA.
Fine, thanks for the clarification.
I wanted to have OpenWRT on this device since years, because it has this nice form factor with the AC pass-through and an annoying custom repeater implementation altering the mac addresses of forwarded packages....
So, first, the process of putting OpenWRT on this device is not for the faint-hearted:
- Device is of 4/32MB category -> only 19.07 with reduced features
- I didn't find any failsafe procedure to bring bootloader into tftp mode
- I only found the TX uart line on the board -> you can read but not write
In conclusion only way to put OpenWRT on the device was to flash it directly to spi flash chip using a programmer (ch341a + flashrom). You can use a test clip, then lifting up the chips ground pin is sufficient to take control from the mediatek chip. Power the device not from mains when doing this, else you might fry your hardware and yourself during the process!
You can find the firmware image here: https://drive.google.com/file/d/1LKiJaxHFGg6MklHRXoNdg8ExgBcXjW3T/view?usp=drive_link
Flash it to region 0x00020000 to 0x003f0000. (If you use flashrom you need to create a full image by dumping the original image and replacing the above region with the provided image.)
It might be that the official web interface accepts an OpenWRT image, but I never tested that.
Details
- Router board runs on 3.3V
- Uart interface is exposed via test points (TP5 - TX). I tried to send data through TP4 but I never got that working. So it might be that RX is unconnected.
- SoC MT7628NN, RAM 32 MB, ROM 4 MB spi flash
- Partition Layout
00000000:0001ffff U-Boot
00020000:003effff system
003f0000:003fffff radio (DO NOT OVERWRITE!)
-
The Bootloader jumps immediately to boot from flash (no timeout). Luckily, the GPL tarball from TP-Link contains an compilable version. I modified it to boot from tftp to ram for development. Find the binary here https://drive.google.com/file/d/1oysrHoaD-RtpSjNeRCx4QRr4SlG2Sfr6/view?usp=drive_link
serverip=192.168.0.184
bootfile="tftp.bin" -
To flash it I used an test clip + ch341a + flashrom. If you flash in circuit, you have to inhebit the SoC from accessing the flash. The ground pin (4) is accessible so I de-soldered it, lifted it a little bit and put tape below it.
Image
- The device is kind of hybrid. It has a Mediatek chip, which is used with the TP-Link header v2, but in this device not. So I had to modify mktplinkfw to support the Mediatek flash layout to get an image with v1 header.
- I created a device tree from a similar device and adapted the button and led mapping. I left the eth switch mapping as it was -> you will see the unconnected eth ports.
- Due to the restricted flash I went with Luci but without ppp and opkg. I needed to optimize the kernel for size to squeeze everything in there. But apart from this you have everything in the image.
Original boot log: https://drive.google.com/file/d/1DHCsW07ceS394LF1Aw8dcikw28QeBbq5/view?usp=drive_link
Patch against OpenWrt 19.07.10: https://drive.google.com/file/d/1T7pPDniuOaiwF__EXsN0J-CpdvjEC8mZ/view?usp=drive_link
Image config: https://drive.google.com/file/d/1TugnfKl7_2DyEzRvaPY-sm8OWPAFzPPM/view?usp=drive_link
All files: https://drive.google.com/drive/folders/1VfO23zefXenDbGg44B_bWGe5y_Feiudx?usp=drive_link
Two minor things I couldn't really figure out:
- mktplinkfw takes an argument '-X' to reserve space at the end of the image. What is that for?
- Since this device has only one eth port, the possibility to configure the switch is a bit pointless. How to configure the device tree and the default config correctly so that the switch configuration can be removed from the image?