Hi
Do not judge strictly, this is my first post.
Tell me about this issue, if I collect the firmware with a suitable Target System (processor MT7628) and Target Profile default Profile. Will it work properly on the router TL-WR841N v13 or TL-WR840N 4.0?

Techdata:

CPU1: MediaTek MT7628N (575 MHz)
FLA1: 8 MiB (GigaDevice GD25Q64B)
RAM1: 64 MiB (Winbond W9751G6KB-25)

Took from here
-wikidevi.com/wiki/TP-LINK_TL-WR840N_v4
-wikidevi.com/wiki/TP-LINK_TL-WR841N_v13.x
-wiki.openwrt.org/toh/tp-link/tl-wr840n#links

I wanna know exactly this same thing. I just bought my WR840N v4, so excited to flash a custom firmware, but I cannot find one. They have all other version of WR840N and WR841N but not these two. I hope someone can save for us here! hahahaha

i tried flushing all bin files on mt7628 no luck. doesn't work with default profile. device goes into boot loop. used tftp to recover router. my device is tl-wr841n.

there is some boot log taken with serial console on wr840n. i asume they are same except apperiance. i can work on it but i don't know what to do. so it may take some time.

i need serial console i ordered the cable. it will be delivered in 3-4 days. i have some work to do before digging into it. after i will investigate errors on boot. then i can port it.

(Last edited by bagciozgur on 22 Apr 2017, 00:29)

i think i bricked my device this time. tftp recovery not working. i will wait for an openwrt firmware and try it.

oh boy ... thanks anyways ... i hope u can recover your router =/

made a stripped firmware now. it is not working either. but bootlooader can't be damaged. tftp recovery via ethernet working. any ideas why isn't it work?

same problem.
wr841n v13 log from uart (flashing stripped firmware via tftp and cycling boot):

[04060C0A][04060C0D]
DDR Calibration DQS reg = 00008988


U-Boot 1.1.3 (Nov 15 2016 - 14:52:03)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
gpiomode1 55054404.
gpiomode2 05540554.
gpiomode2 00000000.
gpiomode2 05550555.
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 15 2016  Time:14:52:03
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!..................................................
starting recovery...
TODO, Read MAC Address from Flash


 netboot_common, argc= 3 

 NetTxPacket = 0x83FE7480 

 KSEG1ADDR(NetTxPacket) = 0xA3FE7480 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!! 
TFTP from server 192.168.0.66; our IP address is 192.168.0.2
Filename 'tp_recovery.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80060000
Loading: checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (00:15:17:e9:db:4f)
Got it
#################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     ##
done
Bytes transferred = 7995392 (7a0000 hex)
NetBootFileXferSize= 007a0000

 Erase flash !!
From 0x20000 length 0x7A0000
..........................................................................................................................

 Copy 0x80080000 to 0x00020000, count 0x7A0000.... 
..........................................................................................................................
[04060C09][04060C0B]
DDR Calibration DQS reg = 00008887


U-Boot 1.1.3 (Nov 15 2016 - 14:52:03)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************
Software System Reset Occurred
******************************
gpiomode1 55054404.
gpiomode2 05540554.
gpiomode2 00000000.
gpiomode2 05550555.
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 15 2016  Time:14:52:03
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
continue to starting system.
 0 
disable switch phyport...
   
3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
[04060C09][04060C0B]
DDR Calibration DQS reg = 00008887


U-Boot 1.1.3 (Nov 15 2016 - 14:52:03)

Board: Ralink APSoC DRAM:  64 MB
relocate_code Pointer at: 83fb8000
******************************
Software System Reset Occurred
******************************
gpiomode1 55054404.
gpiomode2 05540554.
gpiomode2 00000000.
gpiomode2 05550555.
flash manufacture id: ef, device id 40 17
find flash: W25Q64BV
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Nov 15 2016  Time:14:52:03
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
continue to starting system.
 0 
disable switch phyport...
   
3: System Boot system code via Flash.(0xbc020000)
do_bootm:argc=2, addr=0xbc020000
## Booting image at bc020000 ...
   Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover

tpl command not work. and there is no 1 sec waiting for boot.

This looks like the old Ralink bootloaders. Try hitting number keys on the serial during a normal boot.  Especially "4" which might be for a bootloader prompt.

(Last edited by mk24 on 25 Apr 2017, 18:59)

hope someone can solve this. i really need this router to run openwrt.

edit: i will try to compile and flash this bootloader: https://github.com/qdk0901/openwrt-uboo … master/src

(Last edited by bagciozgur on 29 Apr 2017, 03:16)

number keys do not work too. old bootloader? may be, but normal boot displayed in wiki tl-wr840n page is some older. so i have one wr840n v4 with stock firmware too, but not did uart for it yet.

p.s. stock firmware on this routers affected "telnet via ping page" vulnerability, so it can be full stock fs dumped with stock binaries for analyze :-)

(Last edited by sldr on 26 Apr 2017, 10:05)

I have the same problem, I intended to buy TL-WR841N v11, but they all came v13
Did anyone had any success running openwrt on this version?

hey i am now trying this: https://github.com/lede-project/source/ … 5705769728
will keep you up to date.

edit: working lede firmware(works with tftp recovery, probably works for tl-wr840 v4 also since it is originally for 840, but labelled as tl-wr841 v13): https://drive.google.com/open?id=0Bwgtd … nM2bWNfQUk

(Last edited by bagciozgur on 29 Apr 2017, 21:12)

the link is working:
https://github.com/lede-project/source/ … 5705769728

thanks. it works. but it need some fixes via shifted ports in switch and some broken leads. :-)

can you detail it a little more. since i haven't have time to test it.

1. switch in 841v13 have port 0 (with blue color) as wan and ports 1-4 (yellow) as lan. tagged port 6 connected to cpu. default lede configuration set port 4 as wan and ports 0-3 as lan.
2. leds in default settings: correct working only wifi led, lan led 2 show activity on all lan and wan ports and always show connected status. power led is turned off.

switch configuration can be fixed from configs (with changing 'ports' and 'roles' in /etc/board.json for correct names in luci network vlan page), but i didn't fix lan leds.

i did not test it on 840v4 yet. there is difference beetween 841v13 and 840v4. 841v13 have 8 leds (from left to right): power, wifi, lan4, lan3, lan2, lan1, wan, lock(wps). 840v4 have 5 leds: power, wifi, lan (one led for all ports), wan, lock(wps).

(Last edited by sldr on 4 May 2017, 09:28)

thank you i will fix it after my exam tomorrow.

edit: i think i can get gpio pins from v11.

(Last edited by bagciozgur on 8 May 2017, 18:49)

Yep, the patch above for wr840n v4 works for wr841n v13 works (if all references to wr840n changed to wr841n). However, it seems that mt7603 wifi is broken. Pretty much like it was described in the pull request conversation (see comment from sanitariu from May 4.

Also, I have this warning message in kernel. It seems that it was triggered by watchdog.

[  184.570225] WARNING: CPU: 0 PID: 6 at /home/raxp/lede/build_dir/target-mipsel_24kc_musl/linux-ramips_mt7628/mt76-2017-03-17-712b8e8f/mt7603_mac.c:1219 mt7603_mac_work+0xf0/0x284 [mt7603e]()
[  184.588221] Modules linked in: pppoe ppp_async pppox ppp_generic nf_conntrack_ipv6 iptable_nat ipt_REJECT ipt_MASQUERADE xt_time xt_tcpudp xt_state xt_nat xt_multiport xt_mark xt_mac xt_limit xt_conntrack xt_comment xt_TCPMSS xt_REDIRECT xt_LOG slhc nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_nat nf_log_ipv4 nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack iptable_mangle iptable_filter ip_tables crc_ccitt mt76x2e mt7603e mt76 mac80211 cfg80211 compat ip6t_REJECT nf_reject_ipv6 nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables x_tables leds_gpio gpio_button_hotplug
[  184.646051] CPU: 0 PID: 6 Comm: kworker/u2:0 Not tainted 4.4.61 #0
[  184.652332] Workqueue: phy0 mt7603_mac_work [mt7603e]
[  184.657469] Stack : 83803410 8383ab98 00000088 8004ad80 8382dbac 8038ed23 8032bb0c 00000006
[  184.657469]    803537b4 8384bd64 80390000 80048cec 00000088 8004ad80 80331014 80390000
[  184.657469]    00000003 8384bd64 80390000 80038cfc 00000088 8384bd9c 000000ac 00000000
[  184.657469]    00000001 00000000 830251dc 83b5f600 83b5f700 30796870 00000000 00000000
[  184.657469]    00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  184.657469]    ...
[  184.693637] Call Trace:
[  184.696143] [<80014838>] show_stack+0x50/0x84
[  184.700570] [<80025360>] warn_slowpath_common+0xa0/0xd0
[  184.705886] [<80025418>] warn_slowpath_null+0x18/0x24
[  184.711021] [<830252cc>] mt7603_mac_work+0xf0/0x284 [mt7603e]
[  184.716884] [<80036c14>] process_one_work+0x1f8/0x334
[  184.722015] [<80037a28>] worker_thread+0x2b0/0x404
[  184.726894] [<8003bde0>] kthread+0xd8/0xec
[  184.731054] [<80004478>] ret_from_kernel_thread+0x14/0x1c
[  184.736546]
[  184.738061] ---[ end trace 8f62655b5dcd7df8 ]---

i fixed the leds. i will upload the firmware soon. couldn't get power led working but i don't care about it. ports working okay in my case. i don't know why your ports not working. i mean when i connect the cable to wan port there is internet on lan ports. wifi not working in my case too. i don't know if it is a problem with dhcp or some driver problem. i am now looking at wifi problem.

@sldr were you get wifi working?

edit: interestingly wifi only assigns ip address when there is wan connection available. but it is working. (edit: not the case accually)

edit: wifi working for android devices but not with windows 10. i will dig into that. edit: now working caused of windows remembering old config.

so everything works fine with my router. when i change switch config there is no internet. here is final firmware with leds except power working. nobody cares power right lol. https://drive.google.com/file/d/0Bwgtdp … sp=sharing

(Last edited by bagciozgur on 12 May 2017, 01:37)

I found that EEPROM address was set incorrectly for wmac. Basically, it uses default location in the included mt7628an.dtsi file. The real EEPROM on this device is located on the "radio" mtd partition.
To fix this, add this line to TL-WR840NV4.dts into the "wmac" section:

mediatek,mtd-eeprom = <&radio 0x0000>;

And you should replace:

partition@07f0000 {

With this:

radio: partition@07f0000 {

The performance is still poor. However, during the scan of wifi networks through Luci - it reports that another router, which is located at a distance of about 1 meter, is now 100% instead of 50-64% (when 841 is on channel 2 or 3 and txpower 20 dbm). And it is reachable now through 2 rooms.
But still, ping shows packet loss, especially with more than one connected devices. And that watchdog transmit warning in my previous message still appear in dmesg.

@bagciozgur I've tried your build. I don't know what you did with wifi, but I have the same issues

(Last edited by raxp on 15 May 2017, 17:27)

raxp that mt7603e problem is look like something solved in openwrt. i tried to compile openwrt with your modified config. but i couldn't. you may wanna try it i will try it later.

(Last edited by bagciozgur on 19 May 2017, 09:35)

@bagciozgur How can I go back to the original firmware? Currently when I try to flash the original firmware I get LZMA error 1 .

edit Ok I solved by removing some headers with dd

(Last edited by gesucristo on 24 May 2017, 12:57)

can you share stripped firmware here? if any other wants to go back to stock. thx.

The procedure is similar to the previous versions

dd if=orig.bin of=tplink.bin skip=257 bs=512
mtd -r write tplink.bin firmware

(Last edited by gesucristo on 7 Jun 2017, 07:42)

Any news? I am following some progress on darmstadt