Trendnet TEW-810DR mtd partition

shep · April 5, 2020, 10:47pm

Forked from a discussion on TEW-810DR.

The TEW-810DR shares a Cameo manufactured board, identical cpu, spi and ram chips, with the D-Link DIR-810L. I was using the D-Link as a template. Thanks to @123serge123 an issue with the LEDS has been addressed.

My builds have been unstable and I have identified a difference in the mtd partitions in the DIR-810L dts. The Trendnet Flash, on the hardware page, differs from the OEM bootlog 1.0 which differs from OEM bootlog 1.1. which differs from the D-Link
The DIR-810L Version ?

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00010000 00010000 "5G_RF"
mtd5: 00010000 00010000 "Wolf_Config"
mtd6: 00080000 00010000 "MyDLink"
mtd7: 00080000 00010000 "Jffs2"
mtd8: 000f8f8d 00010000 "Kernel"
mtd9: 00597073 00010000 "RootFS"
mtd10: 00690000 00010000 "Kernel_RootFS"

The TEW-810DR 1.0

# cat /proc/mtd 

dev:    size   erasesize  name  
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00010000 00010000 "5G_RF"
mtd5: 00010000 00010000 "Wolf_Config"
mtd6: 00080000 00010000 "MyDLink"
mtd7: 00080000 00010000 "Jffs2"
mtd8: 000f8ebc 00010000 "Kernel"
mtd9: 00597144 00010000 "RootFS"

The Trendnet 1.1

cat /proc/mtd

dev: size erasesize name
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00010000 00010000 "5G_RF"
mtd5: 00010000 00010000 "Wolf_Config"
mtd6: 00080000 00010000 "MyDLink"
mtd7: 00080000 00010000 "Jffs2"
mtd8: 000f95f5 00010000 "Kernel"
mtd9: 00596a0b 00010000 "RootFS"
mtd10: 00690000 00010000 "Kernel_RootFS"

The present TEW-810DR dts, adapted from the DIR-810L

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "u-boot";
				reg = <0x0 0x30000>;
				read-only;
			};

			partition@30000 {
				label = "u-boot-env";
				reg = <0x30000 0x10000>;
				read-only;
			};

			factory: partition@40000 {
				label = "factory";
				reg = <0x40000 0x10000>;
				read-only;
			};

			factory5g: partition@50000 {
				label = "factory5g";
				reg = <0x50000 0x10000>;
				read-only;
			};

			partition@60000 {
				label = "Wolf_Config";
				reg = <0x60000 0x10000>;
				read-only;
			};

			partition@70000 {
				label = "MyDlink";
				reg = <0x70000 0x80000>;
				read-only;
			};

			partition@f0000 {
				label = "Jffs2";
				reg = <0xf0000 0x80000>;
				read-only;
			};

			partition@170000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x170000 0x690000>;
			};

The hardware page Flash Layout for the TEW-810 is inconsistent with the Boot Logs
One complicating feature is the flash is really 16mb with ~1/2 used for an emergency rescue. If Trendnets emergency partition is different than D-Links could cause problems. Should the dts be modified to match OEM out of caution? I think I understand the # cat /proc/mtd output and the dts up to mtd 6 "Wolf_Config, but the size=00080000 in MyDlink and Jffs2 mean they are overlays? What happened to RootFS and where does the 'firmware' partition fit in?

123serge123 · April 6, 2020, 3:22am

These partitioning are the same. In case of dir-810l additional mtd10 partition ("Kernel_RootFS") overlap mtd8 and mtd9 ("Kernel" and "RootFS") to simplify firmware installation. So mtd10 is equivalent to openwrt "firmware" partition.
BTW, openwrt split "firmware" partition into "rootfs" and "rootfs_data" (skipping "kernel") dynamically at boot with special mtd-parser:

[    0.830000] 8 ofpart partitions found on MTD device spi32766.0
[    0.840000] Creating 8 MTD partitions on "spi32766.0":
[    0.850000] 0x000000000000-0x000000030000 : "u-boot"
[    0.860000] 0x000000030000-0x000000040000 : "u-boot-env"
[    0.870000] 0x000000040000-0x000000050000 : "factory"
[    0.880000] 0x000000050000-0x000000060000 : "factory5g"
[    0.900000] 0x000000060000-0x000000070000 : "Wolf_Config"
[    0.910000] 0x000000070000-0x0000000f0000 : "MyDlink"
[    0.920000] 0x0000000e0000-0x000000160000 : "Jffs2"
[    0.930000] 0x000000170000-0x000000800000 : "firmware"
[    0.940000] 0x00000028003e-0x000000800000 : "rootfs"
[    0.950000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.980000] mtd: device 8 (rootfs) set to be root filesystem
[    0.990000] mtd: partition "rootfs_data" created automatically, ofs=0x4a0000, len=0x360000
[    1.010000] 0x0000004a0000-0x000000800000 : "rootfs_data"

Then openwrt format "rootfs_data" into jffs2 filesystem and use it as R/W overlay.

You are wrong. Flash chip

[    0.820000] m25p80 spi32766.0: mx25l6405d (8192 Kbytes)

is exactly 64Mbit = 8Mbytes.
It's possible that OEM partiotions "MyDLink" and "Jffs2" are used for recovery. So openwrt don't touch its and use only "firmware" (or "Kernel_RootFS") partition.

shep · April 6, 2020, 12:20pm

I was basing the Flash Chip size on
https://wikidevi.wi-cat.ru/TRENDnet_TEW-810DR.

CPU1: MediaTek MT7620A
FLA1: 16 MiB (Brand? SPI)
RAM1: 64 MiB (ESMT Model?)

If the file system is OK, then I need to look further on why my build failed. One thing I'm considering is that I built in the master/snapshot code pull, in part because I hoped to submit. Would you recommend building in 19.07.1 for actual hardware testing. Then migrating the code to master for submitting?

123serge123 · April 6, 2020, 12:56pm

But bootlog and board/chip inspection say than flash size is 8Mbytes. So I think that it's error at wikidev.wi-cat.ru. BTW DIR-810L at the same site have 8Mbytes flash too.
To submit patches you have to use current snapshot.
I use release 19.07.1 because all my boards already supported and in release 19.07.2 mtd-parser patch was committed. But it sometimes erase partitions. The patch was reverted (by this commit).

shep · April 16, 2020, 5:01pm

My build on git Master still results in a boot - kernel crash loop.

    0.630194] NET: Registered protocol family 17
[    0.638963] 8021q: 802.1Q VLAN Support v1.8
[    0.647892] of_serial 10000c00.uartlite: could not find pctldev for node /pinctrl/uartlite, deferring probe
[    0.668720] Warning: unable to open an initial console.
[    0.679875] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    0.694676] Please append a correct "root=" boot option; here are the available partitions:
[    0.711249] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    0.728508] Rebooting in 1 seconds..

There was a DIR-810 commit
6b7a525a725a78ff961d91a76e4ea9fbb7066178
That adjusted the mtd partition. The *dts you provided was based on pre-commit mtd partitions
and I'm still not sure the new layout is correct

			partition@70000 {
				label = "MyDlink";
				reg = <0x70000 0x80000>;
				read-only;
			};

			partition@f0000 {
				label = "Jffs2";
				reg = <0xf0000 0x80000>;
				read-only;
			};

			partition@170000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x170000 0x690000>;

8 + f(16) = 18 (24)

Shouldn't this be

			partition@180000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x180000 0x690000>;

It is also odd that your dts, using the mtd partitions prior to the commit works fine.

123serge123 · April 16, 2020, 5:54pm

Just little error:

really 8 + f(15) = 17 (23), so I think that partitioning is Ok.
Can you show full boot log?

shep · April 16, 2020, 10:15pm

Forgot that numbering starts from Zero


Edit:  I found some DIR-810 dts changes that I had not applied to the *dts you supplied.  I confess that I was also trying to generate a *.dtsi for both the D-Link and Trendnet.  I'm going to focus on a working Trendnet in git/master and once it is working then the dtsi.  My guess is I can cmp the dedicated Trendnet build with the shared dtsi build and they should be the same.

U-Boot 1.1.3 (Jan 17 2013 - 10:14:35)


Board: Ralink APSoC DRAM:  00

oefg Coftware System Reset Occurred

*********(201
flash: MX25L64

C d8======== yalr00
a00 000] random: get_random_bytes called from start_kernel+0x98/0x4a0 withcrng_init=0
[    0.00000] Built 1 zonelists, mobility grouping on.  Total pages:16240
[   0.000000] Kernel commnd line:console=ttyS0,57600 ootfstype=squashfs,jffs2
[    0.000000] PID hah table entries:256 (order: -2, 1024 bytes)
[    0000000] Dentr cache hash table entries: 8192 (order: 3, 3768 bytes)
[    0.000000] Inode-cache hash table etries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=0002f404
[    0.000000] Readback ErrCtl register=0002f404
[    0.000000] Memory: 58368K/65536K available (3920K kernel code, 191K rwdata, 896K rodata, 1192K ini, 212K bss, 7168K resered, 0K cma-eserved)
[   0.000000] SLUB: HWalign=32, Order=0-3, MinObects=0, CPUs=1, Nodes1
[    0.000000] NR_IRQS: 256
[    0.000000] CPU Clock: 580MHz
[    0.000000] clocksourc: systick: mask: 0xffff ma_cycles: 0xffff, max_idle_ns: 583261500 ns
[    0.000000] systick: enable autosleep mode
[    0.0000] systick: running - mult: 214748, shift: 32
[    0.000000] cocksource:MIPS: mask: 0xffffffff max_yces: 0xffffffff max_idlens: 659053264 ns
   0.000011] sched_clock: 32 bits at 20MHz, resolution 3ns, wraps every 7405115902ns
] Calibrating delay loop... 385.84 BogoMIPS (lpj=192921)
[    0.087729] pid_max: default: 32768 inimum: 30
[    0.097182] Mount-cache hash table entres: 1024 (order: , 4096 btes)
[    0.110208] Mountpoint-cacheash table etrie: 124 (order: 0, 4096 bytes)
[   0.13062] clocksource: jiffies: mak: 0xffffffff max_cycles: 0xffffffff,ma_idle_ns: 1911260462750000 ns
[    0.150112] futexhash table entries: 256 (order: -1, 3072 bytes)
[    0.162336] pinctrl core: initializedpinctrl subsystem
[    0.173199] NET: Registered protocol family 16
[    0.184562] rt2880-pinmux pinctrl: rror claiming hogs: -22
[   0.195545] rt288-pinmux pinctrl: could not claim hogs: -22
    0.206844] r2880-pinmux: probe of pinctrl failed with error -22
] clocksource: Swtched to clocksource systick
[   0.280418] NET: Registered rotocol family 2
[    0.28986] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.30364] TCP bind hash table entries: 1024 (order: , 4096 byes)
[   0.316235] TCP: Hash tables confiure (established 104 bind 1024)
[    0.329021] UDP ashtable entris: 256 (order: 0,4096 bytes)
[  0.34048] UDP-Lite hash table entries: 25 (orer: 0, 4096 bytes)
[    0.353312] ET:Registered protocol family 1
[    0.364817] rt-timer 10000100.timer: aximu freqency is 1220H
[    0.377612] Crashlog allocated AM ataddress 0x3f00000
[    0.39002] workingset:timestap_bits=14 max_order=14 ucket_order=0
[    0.410040] squashfs: version 4.0 (2009/01/1) Phillip Lougher
[    0.421545] jffs2: version 2.2 (NAND) (UMMARY) (LZMA) (RIME) (CMODE_PIRITY) (c) 2001-2006 Red Hat, Inc.
551] io scheduler noop registered
[    0.461261] io scheduler eadline registere(default)
[    0.472204] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[   0.48519] of_serial 10000c00.ite: could not find pctldev for node /pinctrl/urtlite,deferring probe
[    0.50641] libphy:Fixed MDIO Bus: probed
[    0.525994] gsw: setting port4 to ephy mode
[    0.534265] mtk_soc_eth 10100000.etherne: generated random MAC address 86:56:2e:96:72:8a
[   0.50560 mtk_soc_eth 10100000.ethernet: loaded mt7620 drive
[    0.562916] mtk_soc_eth 10100000.etheret eth0: mediatekfram engine at 0xb010000, irq 5
[    0.579768] rt2880_wdt 10000120.watchdog: nitialized
[    0.51114] NET: Registered protocol family 10
[l family 17
[    0.620158] 8021q: 802.1Q VLAN Support v1.8
[    0.629159]of_seria 10000c00.uartlite: could not find pctldev for node /pinctrl/uartlite, deferring probe
[   0.64999] Warning: unabe toopen an initial console.
[    0.661157] VF: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    0.675958] Please append a correct "root=" boot option; here are the available partiions:
[    0.69253] Kernel panic - not syncing: VFSenable eph 5SS

123serge123 · April 17, 2020, 3:12am

Something wrong with spi-controller. Neither spi-controller nor mtd partitioning messages exist in log. One of possible reason is spi overclocking. In current source tree I see:

flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <50000000>;

Just for test decrease spi-max-frequency down to 10000000.

shep · April 17, 2020, 1:01pm

The spi-max-frequency was tested. Results in this commit
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=a508ab1ac843c5a60a134bf3cdc8837aee6b8ccc

Personally, I don't see that the 50MHz results would make a noticeable improvment over 10MHz at the expense of running hotter.

I was wondering if the removal of the pinctrl-names and pinctrl-0 lines caused

[    0.184562] rt2880-pinmux pinctrl: error claiming hogs: -22
[   0.195545] rt288-pinmux pinctrl: could not claim hogs: -22
    0.206844] r2880-pinmux: probe of pinctrl failed with error -22

Was:

 &gsw {
	pinctrl-names = "default";
	pinctrl-0 = <&ephy_pins>;

	mediatek,port4 = "ephy";
};

Now:

&gsw {
	mediatek,port4 = "ephy";
};

123serge123 · April 17, 2020, 1:34pm

As I understand you don't try spi-max-frequency workaround?
My tests to increase frequency for the same chip mx25l64 failed at 25MHz.
The results was unstable flash readings.
Just test.

shep · April 17, 2020, 2:19pm

Building now with an spi-max-frequency of 10000000

Thanks

shep · April 18, 2020, 12:58am

With this mt7620a_trendnet_tew-810dr.dts

/dts-v1/;

#include "mt7620a.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>

/ {
	compatible = "trendnet,tew-810dr", "ralink,mt7620a-soc";
	model = "TRENDnet TEW-810DR";

	aliases {
		led-boot = &led_power_green;
		led-failsafe = &led_power_green;
		led-running = &led_power_green;
		led-upgrade = &led_power_green;
		label-mac-device = &ethernet;
	};

	keys {
		compatible = "gpio-keys";

		reset {
			label = "reset";
			gpios = <&gpio0 1 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_RESTART>;
		};

		wps {
			label = "wps";
			gpios = <&gpio0 2 GPIO_ACTIVE_LOW>;
			linux,code = <KEY_WPS_BUTTON>;
		};
	};

	leds {
		compatible = "gpio-leds";

		led_power_green: power_green {
			label = "tew-810dr:green:power";
			gpios = <&gpio0 9 GPIO_ACTIVE_HIGH>;
		};

		wan {
			label = "tew-810dr:orange:wan";
			gpios = <&gpio0 12 GPIO_ACTIVE_HIGH>;
		};

		power_orange {
			label = "tew-810dr:orange:power";
			gpios = <&gpio0 13 GPIO_ACTIVE_HIGH>;
		};
                lan {
                        label = "tew-810dr:green:lan";
                        gpios = <&gpio2 0 GPIO_ACTIVE_HIGH>;
                };
	};
};

&spi0 {
	status = "okay";

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <10000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "u-boot";
				reg = <0x0 0x30000>;
				read-only;
			};

			partition@30000 {
				label = "u-boot-env";
				reg = <0x30000 0x10000>;
				read-only;
			};

			factory: partition@40000 {
				label = "factory";
				reg = <0x40000 0x10000>;
				read-only;
			};

			factory5g: partition@50000 {
				label = "factory5g";
				reg = <0x50000 0x10000>;
				read-only;
			};

			partition@60000 {
				label = "Wolf_Config";
				reg = <0x60000 0x10000>;
				read-only;
			};

			partition@70000 {
				label = "MyDlink";
				reg = <0x70000 0x80000>;
				read-only;
			};

			partition@f0000 {
				label = "Jffs2";
				reg = <0xf0000 0x80000>;
				read-only;
			};

			partition@170000 {
				compatible = "denx,uimage";
				label = "firmware";
				reg = <0x170000 0x690000>;
			};
		};
	};
};

&state_default {
	gpio {
		groups = "i2c", "uartf", "ephy";
		function = "gpio";
	};
};

&ethernet {
	mtd-mac-address = <&factory 0x28>;
	mediatek,portmap = "llllw";
};

&gsw {
	pinctrl-names = "default";
	pinctrl-0 = <&ephy_pins>;

	mediatek,port4 = "ephy";
};

&gpio2 {
	status = "okay";
};

&pcie {
	status = "okay";
};

&wmac {
	pinctrl-names = "default";
	pinctrl-0 = <&pa_pins>;

	ralink,mtd-eeprom = <&factory 0x0>;
	mtd-mac-address = <&factory 0x28>;
};

&pcie0 {
	wifi@0,0 {
		reg = <0x0000 0 0 0 0>;
		mediatek,mtd-eeprom = <&factory 0x8000>;
		ieee80211-freq-limit = <5000000 6000000>;
		mtd-mac-address = <&factory 0x28>;
		mtd-mac-address-increment = <2>;
	};
};

The router bricked in the usual fashion. I disassembled and flashed via an 8-pin clip. This time I could not do a serial tftp to install. There was no serial output and the power led did not progress to green in the usual fashion. I think the flash chip was wiggled one too many times with the clip.

I did order 5 flash chips, on a slow boat from China, that have yet to arrive. I plan to flash one of the new chips, remove the old chip and solder the new one in.

My remaining router is also a TEW-810, but I'm not flashing it until I'm confident it won't brick.

I also order one of these but the price was so good that I'm afraid there must be something wrong with it.
https://www.ebay.com/itm/1200M-Wireless-OpenWrt-Gigabit-Router-512M-DDR3-4-antennas-USB-3-0-NAS-FTP-Print/353027966148?hash=item52321b44c4:g:oMwAAOSwWWxebbXT
This is supported by OpenWRT
https://openwrt.org/toh/hwdata/d-team/d-team_newifi_d2

123serge123 · April 18, 2020, 2:19am

This

&state_default {
	gpio {
		groups = "i2c", "uartf", "ephy";
		function = "gpio";
	};
};

conflict with

&gsw {
	pinctrl-names = "default";
	pinctrl-0 = <&ephy_pins>;
	...
	
};

It's a fake. See comment.

shep · April 18, 2020, 1:02pm

Which comment?

123serge123 · April 18, 2020, 1:11pm

"See feedback" at you link

shep · April 18, 2020, 1:22pm

Thanks. Fortunately, Ebay covers fake items but I will have to jump through alot of hoops.

You are covered by the eBay Money Back Guarantee if you receive an item that is not as described in the listing.

If and when it arrives, I'll open it up and look at the chips. If they look valid, will look at the serial ttl bootlog and pull the *bin from the flash chip.

shep · April 18, 2020, 1:28pm

I modified

&gsw {
             mediatek,port4 = "ephy4"
};

I was restoring my router by flashing back the factory image and using the factory U-boot to tftp flash the OpenWRT image. Can I directly flash the OpenWRT image?

123serge123 · April 18, 2020, 1:36pm

What do you mean?

shep · April 18, 2020, 3:56pm

Bricked router (not accepting U-boot commands --programmer flash of OEM pull from flashchip --> router with OEM firmware --tftp serial flash from OEM U-boot --> router w/ OpenWrt

vs

Bricked router --programmer flash of OpenWRT--> router w/ OpenWrt

Just found this
https://openwrt.org/toh/tp-link/td-w9980

Upload the U-Boot Image from another terminal via:

# cat u-boot.asc > /dev/ttyUSB0
Watch the loading progress via the console and wait a few minutes until it boots the U-Boot file.

Interrupt booting by pressing “t” key several times.

Disconnect the R225 pin from GND. Though you can keep it there until the flashing is done.

Flash Firmware

Now we need to upload the new firmware via tftp and erase the OEM firmware via the following commands:

tftp $(loadaddr) openwrt-18.06.1-lantiq-xrx200-tplink_tdw8980-squashfs-sysupgrade.bin
# Note: If you get timeouts (T) executing this command, you probably did not set up the networking/tftpd correctly or your ethernet cable is bad.
sf erase 0x20000 0x7a0000
sf write $(loadaddr) 0x20000 0x$(filesize)
reset

123serge123 · April 18, 2020, 4:45pm

For this procedure you need prepare special flash dump. Cut 0x170000 bytes of orignal dump, append openwrt sysupgrade.bin image and if needed pad upto 8 Mbytes.