aboutsummaryrefslogtreecommitdiffstats
path: root/tools/firmware-utils/src/mktplinkfw2.c
Commit message (Collapse)AuthorAgeFilesLines
* ramips: tl-wr840n-v5: increase firmware partition for 4Mmtk layotSerg Studzinskii2018-01-181-1/+1
| | | | | | | | | | | According to console log during TP-Link TL-WR840N v5 OEM firmware update procedure 0x3e0000-0x3f0000 64kB "config" partition, which is used to store router's configuration settings, is erased and recreated again during every OEM firmware update procedure, thus does not contain any valuable factory data. So it is conviniant to use this extra 64kB erase block for jffs overlay due limited flash size on this device like it used on TP-Link's ar71xx boards. Signed-off-by: Serg Studzinskii <serguzhg@gmail.com>
* ramips: add support for TP-Link TL-WR840N v5Robert Marko2017-11-081-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link TL-WR840N v5 is simple N300 router with 5-port FE switch and non-detachable antennas, based on MediaTek MT7628NN (aka MT7628N) WiSoC. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 4 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - 1x LED (GPIO-controlled), 1x button * LED in TL-WR840N v5 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Orange LED is registered so you can later use it for your own purposes. Flash instruction: Unlike TL-WR840N v4 flashing through WEB UI works in v5. 1. Download lede-ramips-mt76x8-tl-wr840n-v5-squashfs-sysupgrade.bin image. 2. Go to 192.168.0.1 3. Flash the sysupgrade image through Firmware upgrade section of WEB UI. 4. Wait until green LED stops flashing and use the router. Notes: TFTP recovery is broken since TP-Link reused bootloader code for v4 and that does not take into account only 4 MB of flash and bricks the device. So do not use TFTP Recovery or you will have to rewrite SPI flash. They fixed it in later GPL code,but it is unknown which version of bootloader you have. After manually compiling and flashing bootloader from GPL sources TFTP recovery works properly. Signed-off-by: Robert Marko <robimarko@gmail.com>
* tools/firmware-utils: mktplinkfw* fix rootfs offsetThibaut VARÈNE2017-11-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With '-a' specified on the command line, the current code: - computes an aligned _kernel length_ instead of an aligned _rootfs offset_. - does not update the rootfs offset after computing the new kernel length, and instead retains the layout default. When the kernel length exceeds the available space left with this fixed offset, the resulting image header contains invalid data, with the recorded rootfs offset overlapping the kernel area. This patch ensures that rootfs offset is correctly computed and reflected in the final image. Furthermore, the build_fw() function special cases the rootfs_align option because of the above invalid logic. This is also fixed and the computed (or command-line provided, or layout-provided) rootfs_ofs value is used in all cases. There seems to be no valid reason to extend the kernel length beyond the actual length of the kernel itself (OFW images don't do it) so this part of the existing behavior is dropped. Example image before the patch: Kernel data offset : 0x00000200 / 512 bytes Kernel data length : 0x00158438 / 1410104 bytes Kernel load address : 0x00000080 Kernel entry point : 0x00000080 Rootfs data offset : 0x00140000 / 1310720 bytes Rootfs data length : 0x001e4f7e / 1986430 bytes Example image after the patch: Kernel data offset : 0x00000200 / 512 bytes Kernel data length : 0x001583fe / 1410046 bytes Kernel load address : 0x00000080 Kernel entry point : 0x00000080 Rootfs data offset : 0x00158600 / 1410560 bytes Rootfs data length : 0x001e4e22 / 1986082 bytes Tested-by: Mathias Kresin <dev@kresin.me> Tested-by: Stefan Lippers-Hollmann <s.l-h@gmx.de> Tested-by: Daniel Engberg <daniel.engberg.lists@pyret.net> Tested-by: Henryk Heisig <hyniu@o2.pl> Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
* tools/firmware-utils: mktplinkfw move build_fw() to libThibaut VARÈNE2017-10-061-71/+12
| | | | | | | | | | | | | | This patch moves build_fw() to mktplinkfw-lib.c The versions of mktplinkfw.c and mktplinkfw2.c had slight differences in code flow, the version from mktplinkfw.c has been preferred. While it's expected that this change will not affect mktplinkfw2, all use cases could not be tested and so this particular change is committed separately. Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
* tools/firmware-utils: mktplinkfw regroup duplicate codeThibaut VARÈNE2017-10-061-248/+6
| | | | | | | | | | | | | This patch carves out the duplicated code of mktplinfw.c and mktplinkfw2.c and moves it to mktplinkfw-lib.c This change is a semantic NOP (the code is unchanged). To ensure compatibility with gcc-5.x and newer without changing the code, -fgnu89-inline is added to the build flags for these two binaries. Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
* tools/firmware-utils: remove hardcoded values from mktplinkfw2.cThibaut VARÈNE2017-10-061-161/+24
| | | | | | | | | | | | This patch removes all the hardcoded board-specific values from mktplinkfw2.c, and as well as the corresponding support code. By design, this change also deletes all of the broken matching logic that was embedded in mktplinkfw2 and aligns the "inspect" behavior with that of mktplinkfw (i.e. print the parsed header content as they are without further processing). Signed-off-by: Thibaut VARÈNE <hacks@slashdirt.org>
* ramips: add support for TP-Link Archer C20 v1Maxim Anisimov2017-09-131-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link Archer C20 v1 is a router with 5-port FE switch and non-detachable antennas. It's very similiar to TP-Link Archer C50. Also it's based on MediaTek MT7620A+MT7610EN. Specification: - MediaTek MT7620A (580 Mhz) - 64 MB of RAM - 8 MB of FLASH - 2T2R 2.4 GHz and 1T1R 5 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - 8x LED (GPIO-controlled*), 2x button, power input switch - 1 x USB 2.0 port * WAN LED in this devices is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the blue part of the LED. * MT7610EN ac chip isn't not supported by LEDE. Therefore 5Ghz won't work. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. So, to flash this device we must to prepare image using original firmware from tp-link site with uboot. Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot. There are two ways to flash the device to LEDE: 1) Using tftp mode with UART connection and original LEDE image - Place lede-ramips-mt7620-ArcherC20-squashfs-factory.bin in tftp server directory - Configure PC with static IP 192.168.0.66/24 and tftp server. - Connect PC with one of LAN ports, power up the router and press key "4" to access U-Boot CLI. - Use the following commands to update the device to LEDE: setenv serverip 192.168.0.66 tftp 0x80060000 lede-ramips-mt7620-ArcherC20-squashfs-factory.bin erase tplink 0x20000 0x7a0000 cp.b 0x80060000 0x20000 0x7a0000 reset - After that the device will reboot and boot to LEDE 2) Using tftp mode without UART connection but require some manipulations with target image - Download and unpack TP-Link Archer C20 v1 firmware from original web site - Split uboot.bin from original firmware by this command (example): dd if=Archer_C20v1_0.9.1_4.0_up_boot(160427)_2016-04-27_13.53.59.bin of=uboot.bin bs=512 count=256 skip=1 - Create ArcherC20V1_tp_recovery.bin using this command: cat uboot.bin lede-ramips-mt7620-ArcherC20-squashfs-factory.bin > ArcherC20V1_tp_recovery.bin - Place ArcherC20V1_tp_recovery.bin in tftp server directory. - Configure PC with static IP 192.168.0.66/24 and tftp server. - Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. - Router will download file from server, write it to flash and reboot. Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
* tools/firmware-utils: mktplinkfw2: allow parameter overrideThibaut VARENE2017-09-091-9/+7
| | | | | | This patch enables commandline override of board hw_ver and hw_ver_add Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
* firmware-utils: mktplinkfw2: respect -e option when reading fw infoRafał Miłecki2017-07-311-3/+5
| | | | | | | | When -e option it specified a corresponding flag is set in the custom_board. By using custom_board as fallback -e option gets respected for unknown boards. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* firmware-utils: mktplinkfw2: fix info for images with LE kernel LA/EPRafał Miłecki2017-07-311-1/+7
| | | | | | | With this change endianness is also respected when reading firmware info. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* firmware-utils: mktplinkfw2: replace "endian_swap" field with "flags"Rafał Miłecki2017-07-311-8/+10
| | | | | | This will allow adding more similar tricks needed by other hardware. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* firmware-utils: mktplinkfw2: use static board struct for custom valuesRafał Miłecki2017-07-081-18/+15
| | | | | | | | | It seems simpler to store all custom (command line set) option values in a struct identical to the predefined ones. It doesn't require: 1) Having so many global variables 2) Copying data from the predefined boards Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* firmware-utils: mktplinkfw2: update firmware headerRafał Miłecki2017-07-081-26/+26
| | | | | | | 1) Be consistent and use tabs 2) Drop FIXME from boot comments - some images use these fields normally Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* firmware-utils: mktplinkfw2: add missing options descriptionsPiotr Dymacz2017-07-041-0/+3
| | | | Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* firmware-utils: mktplinkfw2: fix MD5 saltRafał Miłecki2017-07-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | LEDE supports few devices using TP-Link firmware format (V2 or V3): ArcherC20i, ArcherC50, ArcherMR200, TDW8970, TDW8980, TL-WR840N v4, TL-WR841N v13 and VR200v Testing mktplinkfw2 tool with official (vendor generated) firmware files for above devices has shown an error when comparing calculated and included MD5 sum, e.g.: > mktplinkfw2 -i Archer_C20iv1_0.9.1_3.2_up_boot\(170221\)_2017-02-21_17.14.03.bin | grep -A 1 MD5Sum1 Header MD5Sum1 : 22 5a cb 92 10 d2 95 7b df 62 9a f8 62 17 37 10 (*ERROR*) --> expected : ad 19 11 d1 78 98 a7 42 5f 2e 64 da 8a 34 ec cb This problem has been verified to occur with: Archer_C20iv1_0.9.1_3.2_up_boot(170221)_2017-02-21_17.14.03.bin Archer MR200v1_0.9.1_1.1_up_boot_v004a.0 Build 160905 Rel.60037n.bin TD-W8970v3_0.9.1_2.0_up_boot(160816)_2016-08-16_10.40.57.bin TD-W8980v1_0.6.0_1.8_up_boot(150514)_2015-05-14_11.16.43.bin Archer_VR200vv2_0.2.0_0.8.0_up_boot(161202)_2016-12-05_14.39.06.bin For some images, e.g.: Archer_C50v3_EU_0.9.1_0.3_up_boot[170417-rel52298].bin TL-WR840Nv4_EU_0.9.1_4.16_up_boot[170421-rel70692].bin TL-WR841Nv13_0.9.1_3.16_up_boot(161012).bin mktplinkfw2 calculates zero MD5 so these has to be fixed separately: > mktplinkfw2 -i TL-WR841Nv13_0.9.1_3.16_up_boot\(161012\).bin | grep -A 1 MD5Sum1 Header MD5Sum1 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (*ERROR*) --> expected : 6f 1d 9b 57 5d 42 14 6d bf a2 03 9d 46 7d 55 55 It's most likely that MD5 salt used in mktplinkfw2 has been always wrong (and it's not a matter of e.g. a vendor change). Update it to fix MD5 calculation. This has been also verified to calculate MD5 correctly for other (not yet supported) devices, e.g.: Archer_C3150v2_0.1.0_0.9.1_up_boot(160812)_2016-08-12_10.52.54.bin Archer_C3200v1_0.9.1_0.1_up_boot(160704)_2016-07-04_15.48.28.bin Signed-off-by: Rafał Miłecki <rafal@milecki.pl> Acked-by: Mathias Kresin <dev@kresin.me>
* firmware-utils: mktplinkfw2: fix support for -w optionRafał Miłecki2017-07-021-1/+1
| | | | | | | This fixes copy & paste typo when reading -w argument. Fixes: 4b35e174caa5b ("firmware-utils: mktplinkfw2: support additional hardware version") Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13Piotr Dymacz2017-06-291-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* firmware-utils: mktplinkfw2: support additional hardware versionPiotr Dymacz2017-06-291-6/+20
| | | | | | | | | | | | | | | | | | As it turned out, some of new MediaTek based TP-Link devices use value from field at 0x3c offset in version 3 of TP-Link header to specify "Additional Hardware Version". Value from this field is validated during regular (GUI) firmware upgrade on devices like TL-WR840N v4 or TL-WR841N v13. If it's zero (based on some tests, it seems that firmware will accept anything != 0), errors like below are printed on console and upgrade fails: [ rsl_sys_updateFirmware ] 2137: Firmware Additional HardwareVersion check failed [ rdp_updateFirmware ] 345: perror:4506 Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* ramips: Add support to TP-Link Archer MR200Henryk Heisig2016-12-221-0/+13
| | | | | | | | | | CPU: MT7620N 580MHz Flash: 8MB RAM: 64MB build-in modem 3G/4G four ethernet port 10/100Mbps Signed-off-by: Henryk Heisig <hyniu@o2.pl>
* tools/firmware-utils: Add Archer C50 to mktplinkfw2Henryk Heisig2016-06-131-0/+7
| | | | Signed-off-by: Henryk Heisig <hyniu@o2.pl>
* lantiq: add support for TP-Link VR200vHauke Mehrtens2016-01-181-0/+12
| | | | | | | | | This adds basic support for TP-Link VR200v. Currently the following parts are not working: FXO, Voice, DECT, WIFI (both) Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> SVN-Revision: 48328
* tools: firmware-utils: fix compiler warningsHauke Mehrtens2015-10-111-1/+1
| | | | | | | | This just fixes a lot of compiler warnings. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> SVN-Revision: 47181
* lantiq: Add target TP-Link TD-W8980John Crispin2015-10-051-0/+5
| | | | | | | | | The device is similar to the TD-W8970, beside a different Atheros 2.4 GHz wireless chip and the additional, PCI connected, WAVE300 5 GHz wireless. Signed-off-by: Mathias Kresin <openwrt@kresin.me> SVN-Revision: 47130
* tools/firmware-utils: add version 3 header support for mktplinkfw2Felix Fietkau2015-01-091-9/+42
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 43897
* firmware-utils: add a tool TP-Link v2 image generationJohn Crispin2013-08-061-0/+944
Signed-off-by: Gabor Juhos <juhosg@openwrt.org> SVN-Revision: 37726
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-04 02:04:59 +0000