TP-LINK TL-WR840N v4

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
bgn (N300)
300Mbps Wireless Router
Homepage Product page
Support Support page
Wikipedia TP-Link
WikiDevi.wi-cat.ru TP-LINK TL-WR840N v4
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Supported
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
Brand • Model • Rev TP-LINK TL-WR840N v4
FCC ID TE7WR841NV13
Board ID 2050500850
Type wireless router
CPU1 checkY MediaTek MT7628N
CPU1 Type MIPS 24KEc
CPU1 Speed 575 MHz 32-bit
Flash1 Chip GigaDevice GD25Q64B
Flash1 Size 8 MiB 8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
RAM1 Size 64 MiB 67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (DDR2)
RAM1 Chip Winbond W9751G6KB-25
ETH chip1 MediaTek MT7628N
Switch MediaTek MT7628N
Ethernet Port Count 1-100MbE-WAN
4-100MbE-LAN
Wired Standard IEEE 802.3i/3u

802dot11 OUI: F4:F2:6D (5 E, 5 W), 18:D6:C7 (3 E, 2 W)
Ethernet OUI: F4:F2:6D (5 E, 5 W), 18:D6:C7 (3 E, 2 W)

Stock bootloader U-Boot 1.1.3 Ralink 4.3.0.0
Stock FW OS Linux 2.6.36
Expansion IF types none specified
Power 9 VDC, 0.6 A
Connector type barrel
Serial Port (UART) yes, 3.3V TTL, (115200 8N1)
Other

Default SSID: TP-LINK_XXXX (47 addl. devices)
Default IP address: 192.168.0.1
the IP 192.168.0.1 is used by 825 additional devices
of which 110 are TP-LINK devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1358 additional devices
of which 283 are TP-LINK devices

3rd Party Firmware Support LEDE Project (obsolete, OpenWrt) • (List)
, OpenWrt • (List | Dev | DLs)
Retail
Availability End of Life
FCC approval date 01 December 2016
Country of manuf China
Radio 1
Chip1 MediaTek MT7628N
Wireless interface OUI F4:F2:6D, 18:D6:C7
Antenna Connector Type none specified
MIMO status 2x2:2
Wireless Standard IEEE 802.11b/g/n
802.11n up to 300 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
 FCC ID
TP-LINK TL-WR841N v13.xTE7WR841NV13
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
TP-LINK TL-WR840N v1BroadcomBroadcom
TP-LINK TL-WR840N v1 (China only?)AtherosAtheros
TP-LINK TL-WR840N v2Qualcomm AtherosQualcomm Atheros
TP-LINK TL-WR840N v3Qualcomm AtherosQualcomm Atheros
TP-LINK TL-WR840N v4MediaTekMediaTek
TP-LINK TL-WR840N v5MediaTekMediaTek
TP-LINK TL-WR840N v6MediaTekMediaTek

For a list of all currently documented MediaTek chipsets with specifications, see MediaTek.

For a list of all currently documented TP-LINK devices with specifications, see TP-LINK.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class

Overview

"2050500850" and "1642" is silkscreened on the board in the FCC photos.

Links of Interest

Forum threads

Note: TL-WR840N v4 have 5 leds: power, wifi, lan (one led for all ports), wan, lock(wps).
TL-WR841N v13 have 8 leds: power, wifi, lan4, lan3, lan2, lan1, wan, lock(wps).
ramips: add initial support for TP-LINK TL-WR840N v4
Specification:
- SoC: MediaTek MT7628NN (580MHz)
- RAM: 64 MiB (Winbond W9751G6JB-25)
- Flash: 8 MiB (GigaDevice GD25Q64CSIG)
- LAN: 4x 100M
- WAN: 1x 100M
- Antennas: 2x non-detachable
- LED: 5x green
- Buttons: 1x reset
CPU: MediaTek MT7628NN @575MHz
Flash: GigaDevice GD25Q64B (8MB)
RAM: Winbond W9751G6KB-25 (64MB)
CPU: MediaTek MT7628NN @575MHz
Flash: GigaDevice GD25Q32B (4MB)
RAM: ESMT M14D5121632A (64MB)

Flashing

Flashing OpenWrt

Target: ramips
Subtarget: mt76x8
Package architecture: mipsel_24kc
Supported Since Commit
Support started version: 18.06.0
Current supported version: 25.12.2
LAN Hardware: MediaTek MT7628N
WLAN Hardware: MediaTek MT7628N
WLAN Comment: 2T2R 2.4 GHz
Installation method(s):
U-Boot TFTP recovery, see git-commit
Recovery method(s):
U-Boot TFTP recovery
git • >>
ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13
TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with
5-port FE switch and non-detachable antennas. Both are very similar
and are based on MediaTek MT7628NN (aka MT7628N) WiSoC.

The difference between these two models is in number of available
LEDs, buttons and power input switch.

This work is partially based on GitHub PR#974.

Specification:

- MT7628N/N (580 MHz)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH
- 2T2R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x external, non-detachable antennas
- UART (J1) header on PCB (115200 8n1)
- TL-WR840N v4: 5x LED (GPIO-controlled), 1x button
- TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input
  switch

* WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't
  (fully) supported by gpio-leds driver. This type of LED requires both
  GPIOs state change at the same time to select color or turn it off.
  For now, we support/use only the green part of the LED.

Factory image notes:

These devices use version 3 of TP-Link header, fortunately without RSA
signature (at least in case of devices sold in Europe). The difference
lays in the requirement for a non-zero value in "Additional Hardware
Version" field. Ideally, it should match the value stored in vendor
firmware header on device ("0x4"/"0x13" for these devices) but it seems
that anything other than "0" is correct.

We are able to prepare factory firwmare file which is accepted and
(almost) correctly flashed from the vendor GUI. As it turned out, it
accepts files without U-Boot image with second header at the beginning
but due to some kind of bug in upgrade routine, flashed image gets
corrupted before it's written to flash.

Tests showed that the GUI upgrade routine copies value of "Additional
Hardware Version" from existing firmware into offset "0x2023c" in
provided file, _before_ storing it in flash. In case of vendor firmware
upgrade files (which all include U-Boot image and two headers), this
offset points to the matching field in kernel+rootfs firmware part
header. Unfortunately, in case of LEDE factory image file which contains
only one header, it points to the offset "0x2023c" in kernel image. This
leads to a corrupted kernel and ends up with a "soft-bricked" device.

The good news is that U-Boot in these devices contains well known tftp
recovery mode, which can be triggered with "reset" button. What's more,
in comparison to some of older MediaTek based TP-Link devices, this
recovery mode doesn't write whole file at offset "0x0" in flash, without
verifying provided file in advance. In case of recovery mode in these
devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes
from rest of the file are stored in flash at offset "0x20000".

Flash instruction:

Until (if at all) TP-Link fixes described problem, the only way to flash
LEDE image in these devices is to use tftp recovery mode in U-Boot:

1. Configure PC with static IP 192.168.0.66/24 and tftp server.
2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin"
   to "tp_recovery.bin" and place it in tftp server directory.
3. Connect PC with one of LAN ports, press the reset button, power up
   the router and keep button pressed for around 6-7 seconds, until
   device starts downloading the file.
4. Router will download file from server, write it to flash and reboot.

To access U-Boot CLI, keep pressed "4" key during boot.