Support for TP-Link WDR8620 V3

For Developers
1

I bought this router from aliexpress last year. It came with a Chinese firmware with no option to change the language. Since it wasn't sold outside China I couldn't find any custom firmwares for this so I decided to build one myself. I don't have prior experience using/building openwrt so any help is welcome.

I did mail them asking for the source code, they replied "Sorry, this information is not available."

Here's what I found,

Specs: 8MB flash, 128MB DDR3 RAM, MT7621

Bootlog:

===================================================================

     		MT7621   stage1 code 10:33:55 (ASIC)

     		CPU=500000000 HZ BUS=166666666 HZ

==================================================================

Change MPLL source from XTAL to CR...

do MEMPLL setting..

MEMPLL Config : 0x11000000

3PLL mode + External loopback

=== XTAL-40Mhz === DDR-1200Mhz ===

PLL2 FB_DL: 0xb, 1/0 = 640/384 2D000000

PLL4 FB_DL: 0xc, 1/0 = 690/334 31000000

PLL3 FB_DL: 0x14, 1/0 = 739/285 51000000

do DDR setting..[01F40000]

Apply DDR3 Setting...(use default AC)

          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120

      --------------------------------------------------------------------------------

0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000D:|    0    0    0    0    0    0    0    0    0    0    0    0    1    1    1    1

000E:|    0    0    0    0    0    0    1    1    1    1    1    1    1    1    1    1

000F:|    0    0    1    1    1    1    1    1    1    1    1    0    0    0    0    0

0010:|    1    1    1    1    1    1    1    0    0    0    0    0    0    0    0    0

0011:|    1    1    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

rank 0 coarse = 14

rank 0 fine = 88

B:|    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0    0

opt_dle value:9

DRAMC_R0DELDLY[018]=00001A1C

==================================================================

		RX	DQS perbit delay software calibration 

==================================================================

1.0-15 bit dq delay value

==================================================================

bit|     0  1  2  3  4  5  6  7  8  9

--------------------------------------

0 |    9 9 9 11 9 9 9 8 8 7 

10 |    9 9 8 9 8 9 

--------------------------------------



==================================================================

2.dqs window

x=pass dqs delay value (min~max)center 

y=0-7bit DQ of every group

input delay:DQS0 =28 DQS1 = 26

==================================================================

bit	DQS0	 bit      DQS1

0  (1~52)26  8  (1~49)25

1  (1~55)28  9  (1~48)24

2  (1~53)27  10  (2~51)26

3  (1~52)26  11  (1~46)23

4  (1~53)27  12  (1~47)24

5  (1~56)28  13  (0~47)23

6  (1~53)27  14  (1~50)25

7  (1~55)28  15  (1~48)24

==================================================================

3.dq delay value last

==================================================================

bit|    0  1  2  3  4  5  6  7  8   9

--------------------------------------

0 |    11 9 10 13 10 9 10 8 9 9 

10 |    9 12 10 12 9 11 

==================================================================

==================================================================

     TX  perbyte calibration 

==================================================================

DQS loop = 15, cmp_err_1 = ffff0000 

dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 

dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 

DQ loop=15, cmp_err_1 = ffff01aa

DQ loop=14, cmp_err_1 = ffff00a2

dqs_perbyte_dly.last_dqdly_pass[1]=14,  finish count=1 

DQ loop=13, cmp_err_1 = ffff0080

DQ loop=12, cmp_err_1 = ffff0000

dqs_perbyte_dly.last_dqdly_pass[0]=12,  finish count=2 

byte:0, (DQS,DQ)=(9,8)

byte:1, (DQS,DQ)=(8,8)

20,data:89

[EMI] DRAMC calibration passed




===================================================================

     		MT7621   stage1 code done 

     		CPU=500000000 HZ BUS=166666666 HZ

===================================================================



U-Boot 1.1.3 (Nov 29 2018 - 10:51:06)


Board: Ralink APSoC DRAM:  128 MB

relocate_code Pointer at: 87fa8000

#Reset_MT7530

set LAN/WAN WWLLL


Config XHCI 40M PLL 

flash manufacture id: c8, device id 40 17

find flash: GD25Q64B

*** Warning - bad CRC, using default environment


Press reset button to enter recovery mode.


Autobooting in 1 seconds

copying flash to 0x82000000

verifying uboot partition...

ok

verifying kernel and romfs partition...

ok

## jump to 0xBFC30000, PHYS_FLASH_1 0xBC000000



U-Boot 1.1.3 (Nov 29 2018 - 11:04:43)


Board: Ralink APSoC DRAM:  128 MB

relocate_code Pointer at: 87fbc000


Config XHCI 40M PLL 

flash manufacture id: c8, device id 40 17

find flash: GD25Q64B

*** Warning - bad CRC, using default environment


============================================ 

Ralink UBoot Version: 4.3.S.0

-------------------------------------------- 

ASIC MT7621A DualCore (MAC to MT7530 Mode)

DRAM_CONF_FROM: Auto-Detection 

DRAM_TYPE: DDR3 

DRAM bus: 16 bit

Xtal Mode=3 OCP Ratio=1/3

Flash component: SPI Flash

Date:Nov 29 2018  Time:11:04:43

============================================ 

icache: sets:256, ways:4, linesz:32 ,total:32768

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 880 MHZ #### 

 estimate memory size =128 Mbytes

#Reset_MT7530

set LAN/WAN WWLLL


Autobooting in 1 seconds

## Booting image at bfc40000 ...

addr:0xbfc40000

---- tpHdr = bfc40000

---- text base = 81001000

---- entry point = 81001000

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 81001000) ...

## Giving linux memsize in MB, 128


Starting kernel ...



LINUX started...

 THIS IS ASIC
[    0.000000] Linux version 3.10.14 (jenkins@Sohocilnx1) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 SMP Thu Nov 29 11:07:14 CST 2018
[    0.000000] 
[    0.000000]  The CPU feqenuce set to 880 MHz
[    0.000000] GCMP present
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] Software DMA cache coherency
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x00000000-0x00ffffff]
[    0.000000]   Normal   [mem 0x01000000-0x07ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
[    0.000000] Detected 3 available secondary CPU(s)
[    0.000000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] PERCPU: Embedded 7 pages/cpu @815ad000 s6400 r8192 d14080 u32768
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line: console=ttyS1,57600n8 root=/dev/mtdblock6 rootfstype=squashfs,jffs2 noinitrd rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=0000630e
[    0.000000] Readback ErrCtl register=0000630e
[    0.000000] Memory: 125036k/131072k available (3530k kernel code, 6036k reserved, 852k data, 220k init, 0k highmem)
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS1] enabled
[    0.120000] Calibrating delay loop... 577.53 BogoMIPS (lpj=1155072)
[    0.160000] pid_max: default: 32768 minimum: 301
[    0.164000] Mount-cache hash table entries: 512
[    0.168000] launch: starting cpu1
[    0.172000] launch: cpu1 gone!
[    0.172000] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.172000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.172000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.172000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.204000] Synchronize counters for CPU 1: done.
[    0.212000] launch: starting cpu2
[    0.216000] launch: cpu2 gone!
[    0.216000] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.216000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.216000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.216000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.248000] Synchronize counters for CPU 2: done.
[    0.256000] launch: starting cpu3
[    0.260000] launch: cpu3 gone!
[    0.260000] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.260000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes.
[    0.260000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.260000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.288000] Synchronize counters for CPU 3: done.
[    0.296000] Brought up 4 CPUs
[    0.300000] NET: Registered protocol family 16
[    0.536000] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.548000] PCIE PHY initialize
[    0.552000] ***** Xtal 40MHz *****
[    0.560000] start MT7621 PCIe register access
[    1.016000] RALINK_RSTCTRL = 7000000
[    1.024000] RALINK_CLKCFG1 = 77ffeff8
[    1.032000] 
[    1.032000] *************** MT7621 PCIe RC mode *************
[    1.420000] PCIE2 no card, disable it(RST&CLK)
[    1.428000] pcie_link status = 0x3
[    1.436000] RALINK_RSTCTRL= 3000000
[    1.444000] *** Configure Device number setting of Virtual PCI-PCI bridge ***
[    1.456000] RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2
[    1.468000] PCIE0 enabled
[    1.472000] PCIE1 enabled
[    1.476000] interrupt enable status: 300000
[    1.488000] Port 1 N_FTS = 1b105000
[    1.492000] Port 0 N_FTS = 1b105000
[    1.500000] config reg done
[    1.504000] init_rt2880pci done
[    1.532000] bio: create slab <bio-0> at 0
[    1.540000] SCSI subsystem initialized
[    1.552000] usbcore: registered new interface driver usbfs
[    1.560000] usbcore: registered new interface driver hub
[    1.572000] usbcore: registered new device driver usb
[    1.584000] PCI host bridge to bus 0000:00
[    1.592000] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    1.604000] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    1.620000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.636000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.652000] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.668000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
[    1.680000] pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000)
[    1.696000] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    1.708000] pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
[    1.720000] pci 0000:00:00.0: BAR 1: assigned [mem 0x60200000-0x6020ffff]
[    1.736000] pci 0000:00:01.0: BAR 1: assigned [mem 0x60210000-0x6021ffff]
[    1.748000] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[    1.764000] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.772000] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    1.788000] pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
[    1.800000] pci 0000:00:01.0: PCI bridge to [bus 02]
[    1.812000] pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
[    1.824000] PCI: Enabling device 0000:00:00.0 (0004 -> 0006)
[    1.836000] PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
[    1.848000] BAR0 at slot 0 = 0
[    1.852000] bus=0x0, slot = 0x0
[    1.860000] res[0]->start = 0
[    1.864000] res[0]->end = 0
[    1.872000] res[1]->start = 60200000
[    1.876000] res[1]->end = 6020ffff
[    1.884000] res[2]->start = 0
[    1.888000] res[2]->end = 0
[    1.896000] res[3]->start = 0
[    1.900000] res[3]->end = 0
[    1.908000] res[4]->start = 0
[    1.912000] res[4]->end = 0
[    1.920000] res[5]->start = 0
[    1.924000] res[5]->end = 0
[    1.928000] BAR0 at slot 1 = 0
[    1.936000] bus=0x0, slot = 0x1
[    1.940000] res[0]->start = 0
[    1.948000] res[0]->end = 0
[    1.952000] res[1]->start = 60210000
[    1.960000] res[1]->end = 6021ffff
[    1.968000] res[2]->start = 0
[    1.972000] res[2]->end = 0
[    1.980000] res[3]->start = 0
[    1.984000] res[3]->end = 0
[    1.992000] res[4]->start = 0
[    1.996000] res[4]->end = 0
[    2.000000] res[5]->start = 0
[    2.008000] res[5]->end = 0
[    2.012000] bus=0x1, slot = 0x0, irq=0x4
[    2.020000] res[0]->start = 60000000
[    2.028000] res[0]->end = 600fffff
[    2.036000] res[1]->start = 0
[    2.040000] res[1]->end = 0
[    2.044000] res[2]->start = 0
[    2.052000] res[2]->end = 0
[    2.056000] res[3]->start = 0
[    2.064000] res[3]->end = 0
[    2.068000] res[4]->start = 0
[    2.076000] res[4]->end = 0
[    2.080000] res[5]->start = 0
[    2.088000] res[5]->end = 0
[    2.092000] bus=0x2, slot = 0x1, irq=0x18
[    2.100000] res[0]->start = 60100000
[    2.108000] res[0]->end = 601fffff
[    2.112000] res[1]->start = 0
[    2.120000] res[1]->end = 0
[    2.124000] res[2]->start = 0
[    2.132000] res[2]->end = 0
[    2.136000] res[3]->start = 0
[    2.144000] res[3]->end = 0
[    2.148000] res[4]->start = 0
[    2.152000] res[4]->end = 0
[    2.160000] res[5]->start = 0
[    2.164000] res[5]->end = 0
[    2.172000] Switching to clocksource MIPS
[    2.176000] NET: Registered protocol family 2
[    2.184000] TCP established hash table entries: 1024 (order: 1, 8192 bytes)
[    2.200000] TCP bind hash table entries: 1024 (order: 1, 8192 bytes)
[    2.212000] TCP: Hash tables configured (established 1024 bind 1024)
[    2.224000] TCP: reno registered
[    2.232000] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    2.244000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    2.256000] NET: Registered protocol family 1
[    2.352000] 4 CPUs re-calibrate udelay(lpj = 1167360)
[    2.364000] Load Kernel WDG Timer Module
[    2.376000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.384000] jffs2: version 2.2. (NAND) (SUMMARY)  (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.404000] msgmni has been set to 244
[    2.416000] io scheduler noop registered (default)
[    2.428000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    2.444000] serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A
[    2.456000] serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A
[    2.472000] flash manufacture id: c8, device id 40 17
[    2.480000] GD25Q64B(c8 40170000) (8192 Kbytes)
[    2.488000] mtd .name = raspi, .size = 0x00800000 (8M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
[    2.508000] Searching for RedBoot partition table
[    2.520000] 9 RedBoot partitions found on MTD device raspi
[    2.528000] Creating 9 MTD partitions on "raspi":
[    2.540000] 0x000000000000-0x00000001d800 : "factory_boot"
[    2.548000] mtd: partition "factory_boot" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    2.576000] 0x00000001d800-0x00000001e000 : "factory_info"
[    2.588000] 0x00000001e000-0x000000020000 : "art"
[    2.600000] 0x000000020000-0x000000030000 : "config"
[    2.608000] 0x000000030000-0x000000040000 : "normal_boot"
[    2.620000] 0x000000040000-0x0000001c5b0c : "kernel"
[    2.632000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    2.656000] 0x0000001c5b0c-0x000000700000 : "rootfs"
[    2.668000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    2.692000] mtd: device 6 (rootfs) set to be root filesystem
[    2.704000] 0x000000700000-0x000000800000 : "rootfs_data"
[    2.716000] 0x000000040000-0x000000800000 : "firmware"
[    2.728000] rdm_major = 253
[    2.736000] GMAC1_MAC_ADRH -- : 0x0000000c
[    2.744000] GMAC1_MAC_ADRL -- : 0x432880c3
[    2.752000] Ralink APSoC Ethernet Driver Initilization. v3.1  1024 rx/tx descriptors allocated, mtu = 1500!
[    2.772000] GMAC1_MAC_ADRH -- : 0x0000000c
[    2.780000] GMAC1_MAC_ADRL -- : 0x432880d7
[    2.788000] PROC INIT OK!
[    2.792000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.804000] ehci-pci: EHCI PCI platform driver
[    2.816000] *****run project phy.
[    2.832000] FM_OUT value: u4FmOut = 0(0x00000000)
[    2.852000] FM_OUT value: u4FmOut = 0(0x00000000)
[    2.872000] FM_OUT value: u4FmOut = 0(0x00000000)
[    2.892000] FM_OUT value: u4FmOut = 0(0x00000000)
[    2.912000] FM_OUT value: u4FmOut = 0(0x00000000)
[    2.932000] FM_OUT value: u4FmOut = 0(0x00000000)
[    2.952000] FM_OUT value: u4FmOut = 0(0x00000000)
[    2.972000] FM_OUT value: u4FmOut = 0(0x00000000)
[    2.992000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.012000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.056000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.076000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.096000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.116000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.136000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.156000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.176000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.196000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.216000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.236000] FM_OUT value: u4FmOut = 0(0x00000000)
[    3.376000] xhci-hcd xhci-hcd: xHCI Host Controller
[    3.384000] xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 1
[    3.400000] xhci-hcd xhci-hcd: irq 22, io mem 0x1e1c0000
[    3.412000] hub 1-0:1.0: USB hub found
[    3.420000] hub 1-0:1.0: 2 ports detected
[    3.428000] xhci-hcd xhci-hcd: xHCI Host Controller
[    3.436000] xhci-hcd xhci-hcd: new USB bus registered, assigned bus number 2
[    3.452000] hub 2-0:1.0: USB hub found
[    3.460000] hub 2-0:1.0: 1 port detected
[    3.468000] usbcore: registered new interface driver usb-storage
[    3.480000] Mirror/redirect action on
[    3.488000] u32 classifier
[    3.492000]     Performance counters on
[    3.500000]     input device check on
[    3.508000]     Actions configured
[    3.516000] Netfilter messages via NETLINK v0.30.
[    3.524000] nf_conntrack version 0.5.0 (1953 buckets, 7812 max)
[    3.536000] ip_set: protocol 6
[    3.540000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    3.552000] Type=Restricted Cone
[    3.560000] TCP: cubic registered
[    3.564000] NET: Registered protocol family 10
[    3.576000] NET: Registered protocol family 17
[    3.584000] 8021q: 802.1Q VLAN Support v1.8
[    3.596000] Registered character driver slp_flash_chrdev
[    3.612000] Flash UID signiture check OK.
[    3.624000] VFS: Mounted root (squashfs filesystem) readonly on device 31:6.
[    3.636000] Freeing unused kernel memory: 220K (81449000 - 81480000)
- preinit -
- regular preinit -
[    5.108000] jffs2: notice: (434) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
switching to jffs2
- init -

Please press Enter to activate this console. Thu Nov 29 03:07:22 UTC 2018
[    7.192000] NTFS driver 2.1.30 [Flags: R/O MODULE].
[    7.344000] PPP generic driver version 2.4.2
[    8.556000] mt7615e: module license 'Proprietary' taints kernel.
[    8.568000] Disabling lock debugging due to kernel taint
[    8.644000] register mt_drv
[    8.656000] 
[    8.656000] 
[    8.656000] === pAd = c0a01000, size = 2977688 ===
[    8.656000] 
[    8.676000] <-- RTMPAllocAdapterBlock, Status=0
[    8.688000] pAd->PciHif.CSRBaseAddress =0xc0900000, csr_addr=0xc0900000!
[    8.700000] RTMPInitPCIeDevice():device_id=0x7615
[    8.708000] DriverOwn()::Try to Clear FW Own...
[    9.016000] DriverOwn()::Success to clear FW Own
[    9.028000] mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615
[    9.040000] mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001
[    9.052000] RtmpChipOpsHook(492): Not support for HIF_MT yet! MACVersion=0x0
[    9.064000] mt7615_init()-->
[    9.072000] Use 1st iPAiLNA default bin.
[    9.080000] Use 0st /etc_ro/wlan/MT7615E_EEPROM1.bin default bin.
[    9.092000] <--mt7615_init()
[    9.096000] ChipOpsMCUHook
[    9.108000] cut_through_token_list_init(): TokenList inited done!id_head/tail=0/4096
[    9.124000] cut_through_token_list_init(): 86082988,86082988
[    9.136000] cut_through_token_list_init(): TokenList inited done!id_head/tail=0/4096
[    9.148000] cut_through_token_list_init(): 86082998,86082998
[    9.160000] <-- RTMPAllocTxRxRingMemory, Status=0
[    9.180000] 
[    9.180000] 
[    9.180000] === pAd = c0e01000, size = 2977688 ===
[    9.180000] 
[    9.200000] <-- RTMPAllocAdapterBlock, Status=0
[    9.208000] pAd->PciHif.CSRBaseAddress =0xc0d00000, csr_addr=0xc0d00000!
[    9.220000] RTMPInitPCIeDevice():device_id=0x7611
[    9.232000] DriverOwn()::Try to Clear FW Own...
[    9.540000] DriverOwn()::Success to clear FW Own
[    9.548000] mt_pci_chip_cfg(): HWVer=0x8a10, FWVer=0x8a10, pAd->ChipID=0x7615
[    9.564000] mt_pci_chip_cfg(): HIF_SYS_REV=0x76150001
[    9.572000] RtmpChipOpsHook(492): Not support for HIF_MT yet! MACVersion=0x0
[    9.588000] mt7615_init()-->
[    9.592000] Use 2nd iPAiLNA default bin.
[    9.600000] Use 1st /etc_ro/wlan/MT7615E_EEPROM2.bin default bin.
[    9.612000] <--mt7615_init()
[    9.616000] ChipOpsMCUHook
[    9.628000] cut_through_token_list_init(): TokenList inited done!id_head/tail=0/4096
[    9.644000] cut_through_token_list_init(): 858dcb88,858dcb88
[    9.656000] cut_through_token_list_init(): TokenList inited done!id_head/tail=0/4096
[    9.672000] cut_through_token_list_init(): 858dcb98,858dcb98
[    9.680000] <-- RTMPAllocTxRxRingMemory, Status=0
[    9.732000] gre: GRE over IPv4 demultiplexor driver
[    9.752000] ip_gre: GRE over IPv4 tunneling driver
[    9.828000] exFAT: Version 1.2.9
[   10.068000] xt_time: kernel timezone is -0000
[   10.136000] NET: Registered protocol family 24
[   10.400000] PPTP driver version 0.8.5
[   11.088000] nf_conntrack_rtsp v0.6.21 loading
[   11.108000] nf_nat_rtsp v0.6.21 loading
[   11.340000] fuse init (API version 7.22)
mtk_calculate_check is a shell function
2+0 records in
2+0 records out
2+0 records in
2+0 records out
[   12.556000] lan ip is 0xc0a80001
interface
wifi-freq
interface
wifi-freq
interface
interface
interface
interface
[CFG_MAC]user did not configured wan2 mac, use default.
wifi-freq
wifi-freq
Command failed: Not found
Command failed: Not found
Command failed: Not found
Command failed: Not found
7621 use an independent gmac as lan, WLLLL
[   13.904000] raether double wan mode enabled
Set port 0 pvid 2.
Set port 1 pvid 3.
switch reg write offset=2610, value=81000000
switch reg write offset=2004, value=ff0003
switch reg write offset=2104, value=ff0003
switch reg write offset=2204, value=ff0003
switch reg write offset=2304, value=ff0003
switch reg write offset=2404, value=ff0003
switch reg write offset=2504, value=ff0003
switch reg write offset=2604, value=ff0003
tag vid at port 6
Command failed: Not found
[   14.656000]  0: 0:78:FFFFFFBE:FFFFFFE5:7F
[   14.664000] Raeth v3.1 (Tasklet)
[   14.672000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1
[   14.688000] phy_free_head is 0xca4000!!!
[   14.696000] phy_free_tail_phy is 0xca5ff0!!!
[   14.704000] txd_pool=a0ca8000 phy_txd_pool=00CA8000
[   14.712000] ei_local->skb_free start address is 0x87ec26dc.
[   14.724000] free_txd: 00ca8010, ei_local->cpu_ptr: 00CA8000
[   14.736000]  POOL  HEAD_PTR | DMA_PTR | CPU_PTR 
[   14.744000] ----------------+---------+--------
[   14.756000]      0xa0ca8000 0x00CA8000 0x00CA8000
[   14.764000] 
[   14.764000] phy_qrx_ring = 0x00ca6000, qrx_ring = 0xa0ca6000
[   14.780000] 
[   14.780000] phy_rx_ring0 = 0x00cb0000, rx_ring0 = 0xa0cb0000
[   14.816000] MT7530 Reset Completed!!
[   14.828000] change HW-TRAP to 0x17ccf
[   14.836000] set LAN/WAN WLLLL
[   14.848000] GMAC1_MAC_ADRH -- : 0x0000000c
[   14.856000] GMAC1_MAC_ADRL -- : 0x432880d7
[   14.864000] CDMA_CSG_CFG = 81000000
[   14.872000] GDMA1_FWD_CFG = 20710000
[   14.880000] device eth0 entered promiscuous mode
[   14.892000] IPv6: ADDRCONF(NETDEV_UP): eth0.3: link is not ready
[   14.908000] IPv6: ADDRCONF(NETDEV_UP): eth0.2: link is not ready
[   14.924000] device eth0.1 entered promiscuous mode
[   14.932000] br-lan: port 1(eth0.1) entered forwarding state
[   14.944000] br-lan: port 1(eth0.1) entered forwarding state
ethreg: eth1: No such device
ethreg: eth1: No such device
ethreg: eth1: No such device
uci: Entry not found (module_spec.module_spec.wifison_role)
uci: Entry not found (wireless.freq2.device)
[   15.904000] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
convert_cfg src_cfg wireless dst_cfg wireless
uci: Entry not found (module_spec.module_spec.wifison_role)
uci: Entry not found (wireless.freq2.device)
[   16.948000] br-lan: port 1(eth0.1) entered forwarding state
convert_cfg src_cfg /tmp/etc/tmp_wireless dst_cfg /tmp/etc/private_wireless
convert_cfg src_cfg guest_network dst_cfg /tmp/etc/private_wireless
killall: ap_client: no process killed
killall: ap_client: no process killed
[   20.840000] DriverOwn()::Return since already in Driver Own...
[   20.856000] E2pAccessMode=2
[   20.860000] SSID[0]=TP-LINK_55DB, EdcaIdx=0
[   20.868000] SSID[1]=TPGuest_55DB, EdcaIdx=0
[   20.876000] RTMPSetProfileParameters(): DBDC Mode=0
[   20.888000] cfg_mode=9
[   20.892000] cfg_mode=9
[   20.896000] wmode_band_equal(): Band Equal!
[   20.908000] BandSteering=0
[   20.912000] [TxPower] BAND0: 100 
[   20.920000] [PERCENTAGEenable] BAND0: 1 
[   20.932000] APEdca0
[   20.936000] APEdca1
[   20.940000] APEdca2
[   20.944000] APEdca3
2

I found this device tree on some Chinese forum, looks similar to the one from the logs

// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
/dts-v1/;

#include "mt7621.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>

/ {
	compatible = "tplink,tl-wdr8620-v3", "mediatek,mt7621-soc";
	model = "TP-Link TL-WDR8620 v3";

	aliases {
		led-boot = &led_power;
		led-failsafe = &led_power;
		led-running = &led_power;
		led-upgrade = &led_power;
		label-mac-device = &gmac0;
	};

	chosen {
		bootargs = "console=ttyS0,57600";
	};

	leds {
		compatible = "gpio-leds";

		led_power: power {
			label = "tl-wdr8620-v3:blue:power";
			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
		};
	};

	keys {
		compatible = "gpio-keys";

		reset {
			label = "reset";
			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};
	};
};

&spi0 {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <80000000>;
		m25p,fast-read;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "factory_boot";
				reg = <0x0 0x1d800>;
				read-only;
			};

			factory_info: partition@1d800 {
				label = "factory_info";
				reg = <0x1d800 0x800>;
				read-only;
			};

			art: partition@1e000 {
				label = "art";
				reg = <0x1e000 0x2000>;
				read-only;
			};

			partition@20000 {
				label = "config";
				reg = <0x20000 0x10000>;
				read-only;
			};

			partition@30000 {
				label = "normal_boot";
				reg = <0x30000 0x10000>;
				read-only;
			};

			partition@40000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x40000 0x7c0000>;
			};
		};
	};
};

&pcie {
	status = "okay";
};

&pcie0 {
	wifi@0,0 {
		compatible = "mediatek,mt76";
		reg = <0x0000 0 0 0 0>;
		mediatek,mtd-eeprom = <&art 0x0>;
		ieee80211-freq-limit = <2400000 2500000>;
		mtd-mac-address = <&factory_info 0xd>;
	};
};

&pcie1 {
	wifi@0,0 {
		compatible = "mediatek,mt76";
		reg = <0x0000 0 0 0 0>;
		mediatek,mtd-eeprom = <&art 0x1000>;
		ieee80211-freq-limit = <5000000 6000000>;
		mtd-mac-address = <&factory_info 0xd>;
		mtd-mac-address-increment = <2>;
	};
};

&gmac0 {
	mtd-mac-address = <&factory_info 0xd>;
};

&switch0 {
	ports {
		port@0 {
			status = "okay";
			label = "wan";
			mtd-mac-address = <&factory_info 0xd>;
			mtd-mac-address-increment = <1>;
		};

		port@1 {
			status = "okay";
			label = "lan1";
		};

		port@2 {
			status = "okay";
			label = "lan2";
		};

		port@3 {
			status = "okay";
			label = "lan3";
		};

		port@4 {
			status = "okay";
			label = "lan4";
		};
	};
};

&state_default {
	gpio {
		groups = "i2c", "uart3";
		function = "gpio";
	};
};
3

I build a initramfs kernel using a following config

define Device/tplink_tl-wdr8620-v3
  DEVICE_VENDOR := TP-Link
  DEVICE_MODEL := TL-WDR8620
  DEVICE_VARIANT := v3
  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware kmod-usb3
  IMAGE_SIZE := 7936k
  KERNEL := $(KERNEL_DTB)
  KERNEL_INITRAMFS := $(KERNEL_DTB) | lzma
  TPLINK_FLASHLAYOUT := 8Mlzma
  DEVICE_TITLE := TP-LINK TL-WDR8620 v3
endef
TARGET_DEVICES += tplink_tl-wdr8620-v3

But when I tried to boot it I'm getting the following error " Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover"

Here's the corresponding log

MT7621 # tftpboot

 netboot_common, argc= 1

 NetTxPacket = 0x87FE3A80

 KSEG1ADDR(NetTxPacket) = 0xA7FE3A80

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
*** Warning: no boot file name; using 'test.bin'
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x82000000
Loading: T T T T T T checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
T Got ARP REPLY, set server/gtwy eth addr (2c:60:0c:f4:ac:b0)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###########checksum bad
checksum bad
checksum bad
##checksum bad
####################################################
         #################################################################
         ########checksum bad
###
done
Bytes transferred = 2715317 (296eb5 hex)
NetBootFileXferSize= 00296eb5
MT7621 # bootm
## Booting image at 82000000 ...
---- tpHdr = 82000000
---- text base = 31fa0fe6
---- entry point = db2f6667
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
4

binwalk of the original tp-link firmware

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
12960         0x32A0          U-Boot version string, "U-Boot 1.1.3 (Dec 22 2017 - 14:38:57)"
13008         0x32D0          CRC32 polynomial table, little endian
14236         0x379C          uImage header, header size: 64 bytes, header CRC: 0x492B0A68, created: 2017-12-22 06:38:59, image size: 29432 bytes, Data Address: 0x80400000, Entry Point: 0x80400000, data CRC: 0x220E3430, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image"
14300         0x37DC          LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 67600 bytes
66560         0x10400         LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 4528128 bytes
1611368       0x189668        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 5153198 bytes, 1356 inodes, blocksize: 262144 bytes, created: 2017-12-22 06:41:43
5

I tried compiling again with tp-link-header(v1) and this time I didn't get any lzma error but the console hangs at "Starting Kernel". This is strange considering the original firmware didn't have any tplink headers.

Any idea on how to get past "Starting kernel"? or is there any option to make it more verbose?

6

Hey there, good work so far

So it looks like to me that the command bootm has a different procedure than automatic booting when you power the board and do nothing. This is because you said that it worked with a tp-link header v1 while the original firmware does not have that. Also I can see in the failing boot log that there is garbage values for the kernel text base and entry point. This makes me think it is taking values from the beginning of the kernel as if there is a header there with the correct values, but instead it is uImage header or LZMA data. Also the line with tpHdr is a clue of this.

## Booting image at 82000000 ...
---- tpHdr = 82000000
---- text base = 31fa0fe6
---- entry point = db2f6667

compared to

## Booting image at bfc40000 ...

addr:0xbfc40000
---- tpHdr = bfc40000
---- text base = 81001000
---- entry point = 81001000

where 0x81 or 0x82 refers to RAM bus address
and 0xbf refers to the flash chip bus address
and 0x31fa0fe6 and 0xdb2f6667 is just garbage

This probably means that your initramfs image will need the tp-link header v1 but your future factory.bin and sysupgrade.bin will not have it

Just to make sure that there is no header in the original firmware you can search for the entry point within it. According to the OEM boot log, it seems the tp-link header is at 0x4000 in flash which is consistent with where the kernel is in the kernel log for mtd partitions.

hexdump -C /path/to/original/image | grep '81 00 10 00'

or if you have access to a shell with the original firmware this might work
hexdump -C /dev/mtd5 | grep '81 00 10 00'

Why in your binwalk is u-boot not at 0x0?

1 Like
7

I'm totally new to this so thank you for explaining in detail.

I checked the original firmware for the entry point and it's there although I couldn't make any sense out it. Here's the output.

$ hexdump -C wdr.bin  | grep '81 00 10 00'
00010210  bc f0 d4 32 70 c7 aa 55  81 00 10 00 81 00 10 00  |...2p..U........|

I grep'd few more lines to see if it made any sense

$ hexdump -C wdr.bin  | grep -B 4 -A 20 '81 00 10 00'
0000aad0  10 cc 35 00 ff ff ff ff  ff ff ff ff ff ff ff ff  |..5.............|
0000aae0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
00010200  00 00 01 00 55 aa 9d d1  a8 c8 83 31 c9 69 fb bf  |....U......1.i..|
00010210  bc f0 d4 32 70 c7 aa 55  81 00 10 00 81 00 10 00  |...2p..U........|
00010220  00 00 00 00 00 00 00 09  00 00 00 00 00 01 d8 00  |................|
00010230  00 01 d8 00 00 00 08 00  00 01 e0 00 00 00 20 00  |.............. .|
00010240  00 02 00 00 00 01 00 00  00 03 00 00 00 01 00 00  |................|
00010250  00 04 00 00 00 00 02 00  00 04 02 00 00 17 92 68  |...............h|
00010260  00 1b 94 68 00 54 6b 98  00 70 00 00 00 10 00 00  |...h.Tk..p......|
00010270  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00010290  54 fa 07 36 3a 21 ea 5e  7c a1 36 e5 b6 d9 b6 fc  |T..6:!.^|.6.....|
000102a0  3d 60 3b 4d 01 29 64 6c  f2 45 a9 77 b7 cf e0 b8  |=`;M.)dl.E.w....|
000102b0  33 a9 57 7b 96 b6 46 7e  d9 16 0c 76 9a 77 e2 63  |3.W{..F~...v.w.c|
000102c0  57 44 52 38 36 32 30 56  33 00 00 00 00 00 00 02  |WDR8620V3.......|
000102d0  1f 8e 18 5d d1 45 b7 c9  ea e8 92 3b aa 17 16 c9  |...].E.....;....|
000102e0  39 92 8b 73 f2 30 70 c5  9d 4d 07 37 50 e1 31 5e  |9..s.0p..M.7P.1^|
000102f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00010400  6d 00 00 80 00 00 18 45  00 00 00 00 00 00 00 6f  |m......E.......o|
00010410  fd ff ff a3 b7 7f be 70  bf 82 86 e2 78 dc 5a 78  |.......p....x.Zx|
00010420  a3 4b cf d9 7a 37 7e 8f  38 ca 1d 92 3d 5d aa a5  |.K..z7~.8...=]..|
00010430  0a f5 b7 96 21 8e 37 57  82 55 95 74 a8 a9 14 9b  |....!.7W.U.t....|
00010440  60 96 e9 e6 d4 4b 40 27  bd a6 f2 9a 3c 34 a0 78  |`....K@'....<4.x|

I tried manually adding the kernel load and entry address to initramfs with this

KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | tplink-v1-header -E 0x81001000 -L 0x81001000

But even this doesn't seem to work as it hangs again at Starting kernel

MT7621 # tftpboot

 netboot_common, argc= 1

 NetTxPacket = 0x87FE3A80

 KSEG1ADDR(NetTxPacket) = 0xA7FE3A80

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
*** Warning: no boot file name; using 'test.bin'
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x82000000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (2c:60:0c:f4:ac:b0)
Got it
#################################################################
         ######################################################checksum bad
###########
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###########
done
Bytes transferred = 2715883 (2970eb hex)
NetBootFileXferSize= 002970eb
MT7621 # bootm
## Booting image at 82000000 ...
---- tpHdr = 82000000
---- text base = 00000000
---- entry point = 72313132
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 72313132) ...
## Giving linux memsize in MB, 128

Starting kernel ...

As you can see it's still not picking up the correct addresses.

Is there any issue with the address in which kernel is loaded by tftp(0x82000000)?

8

Sorry I didn't completely finish the whole idea. You can't do this, these things are unique to the kernel and are probably different than the OEM kernel. The tplink-v1-header image command already uses variables to set them according to the same values used when the kernel was built.

https://github.com/openwrt/openwrt/blob/master/include/image-commands.mk#L336

It's starting to look like the header is actually something else, or maybe totally unique.

Also it looks more like auto boot and bootm is actually the same, and to say it is working better with tplink-v1-header is not really true.

Just to be sure you can try a gzip uimage instead, trying two different things at the same time. This could possibilty eliminate an LZMA problem and the header problem, or we will see which one is incorrect first

KERNEL_INITRAMFS := $(KERNEL_DTB) | gzip | uImage gzip

Also you can search for what the board tries to use for text base and entry point in the image that you are trying to boot. It will help to know the exact hex address of what it's using as those values.

1 Like
9

KERNEL_INITRAMFS := $(KERNEL_DTB) | gzip | uImage gzip

using gzip throws lzma error

MT7621 # tftpboot

 netboot_common, argc= 1

 NetTxPacket = 0x87FE3A80

 KSEG1ADDR(NetTxPacket) = 0xA7FE3A80

 NetLoop,call eth_halt !

 NetLoop,call eth_init !
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!!
*** Warning: no boot file name; using 'test.bin'
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'test.bin'.

 TIMEOUT_COUNT=10,Load address: 0x82000000
Loading: checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (2c:60:0c:f4:ac:b0)
Got it
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #############
done
Bytes transferred = 2724158 (29913e hex)
NetBootFileXferSize= 0029913e
MT7621 # bootm
## Booting image at 82000000 ...
---- tpHdr = 82000000
---- text base = ac3581e9
---- entry point = 05050201
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover

Also you can search for what the board tries to use for text base and entry point in the image that you are trying to boot

Ah, now I understood the logic behind it.

$ hexdump -C openwrt-ramips-mt7621-tplink_tl-wdr8620-v3-initramfs-kernel.bin | grep '05 05 02 01'
00000010  81 00 10 00 81 00 10 00  ac 35 81 e9 05 05 02 01  |.........5......|

So is this a padding issue?

10

Ok so we know that the header is the issue, its not tplink-v1 and its not uImage...

I would make a new forum post real quick with the first 0x100 of the OEM kernel (which would be all of the header plus a little data) with a topic like "unknown TP link header"

1 Like
11

It looks like this is the actual kernel, where the header is starting at 0x10200

12

Just created a new thread here Unknown TP-Link header

13

Can You post some internal photos ? Where did You find dts posted earlier ?

14

you can find internal photos with the FCC ID

15

FCC ID for Device sold only in China ?? If for some unknown reason it is true than please point me to where I can find FCC ID for it.