aboutsummaryrefslogtreecommitdiffstats
path: root/tools/firmware-utils/src/tplink-safeloader.c
Commit message (Collapse)AuthorAgeFilesLines
* ath79: add support for TP-Link TL-WR941HP v1Diogenes Rengo2021-07-041-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Specifications: SOC: Qualcomm Atheros TP9343 (750 MHz) Flash: 8 Mb (GigaDevice GD25Q64CSIG) RAM: 64 Mb (Zentel A3R12E40DBF-8E) Serial: yes, 4-pin header Wlan: Qualcomm Atheros TP9343, antenna: MIM0 3x3:3 RP-SMA 3 x 2.4GHz power amp module Skyworks (SiGe) SE2576L Ethernet: Qualcomm Atheros TP9343 Lan speed: 100M ports: 4 Lan speed: 100M ports: 1 Other info: same case, ram and flash that TP-Link TL-WR841HP, different SOC https://forum.openwrt.org/t/adding-device-support-tp-link-wr941hp/ Label MAC addresses based on vendor firmware: LAN *:ee label WAN *:ef label +1 WLAN *:ee label The label MAC address found in "config" partition at 0x8 Flash instruction: Upload the generated factory firmware on web interface. Signed-off-by: Diogenes Rengo <rengocbx250@gmail.com> [remove various whitespace issues, squash commits, use short 0x0] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* firmware-utils: tplink-safeloader: support Archer A6 v3 CAStijn Segers2021-06-201-0/+1
| | | | | | | | | The Canadian edition of the TP-Link Archer A6 v3 uses a different header, but otherwise it's identical to the already supported EU/US editions. Signed-off-by: Stijn Segers <foss@volatilesystems.org> Tested-by: Brian Lee <dev@leebrian.me> Reviewed-by: Philip Prindeville <philipp@redfish-solutions.com>
* ramips: add support for TP-Link Archer C6 v3Amish Vishwakarma2021-06-131-0/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch adds support for the TP-Link Archer C6 v3 (FCC ID TE7A6V3) The patch adds identification changes to the existing TP-Link Archer A6, by Vinay Patil <post2vinay@gmail.com>, which has identical hardware. Specification ------------- MediaTek MT7621 SOC RAM: 128MB DDR3 SPI Flash: W25Q128 (16MB) Ethernet: MT7530 5x 1000Base-T WiFi 5GHz: Mediatek MT7613BE WiFi 2.4GHz: Mediatek MT7603E UART/Serial: 115200 8n1 Device Configuration & Serial Port Pins --------------------------------------- ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN _______________________ | | Serial Pins: | VCC GND TXD RXD | |_____________________| LEDs: Power Wifi2G Wifi5G LAN WAN Build Output ------------ The build will generate following set of files [1] openwrt-ramips-mt7621-tplink_archer-c6-v3-initramfs-kernel.bin [2] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-factory.bin [3] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-sysupgrade.bin How to Use - Flashing from TP-Link Web Interface ------------------------------------------------ * Go to "Advanced/System Tools/Firmware Update". * Click "Browse" and upload the OpenWrt factory image: factory.bin[2] * Click the "Upgrade" button, and select "Yes" when prompted. TFTP Booting ------------ Setup a TFTP boot server with address 192.168.0.5. While starting U-boot press '4' key to stop autoboot. Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin From u-boot command prompt run tftpboot followed by bootm. Recovery -------- Archer A6 V3 has recovery page activated if SPI booting from flash fails. Recovery page can be activated by powercycling the router four times before the boot process is complete. Note: TFTP boot can be activated only from u-boot serial console. Device recovery address: 192.168.0.1 Signed-off-by: Amish Vishwakarma <vishwakarma.amish@gmail.com> [fix indent] Signed-off-by: David Bauer <mail@david-bauer.net>
* ath79: use dynamic partitioning for TP-Link CPE seriesMichael Pratt2021-06-051-22/+11
| | | | | | | | | | | | | | | | | | | | | | | | | CPExxx and WBSxxx boards with AR9344 SOC use the OKLI lzma kernel loader with the offset of 3 blocks of length 4k (0x3000) in order to have a fake "kernel" that cannot grow larger than how it is defined in the now static OEM partition table. Before recent changes to the mtdsplit driver, the uImage parser for OKLI only supported images that started exactly on an eraseblock boundary. The mtdsplit parser for uImage now supports identifying images with any magic number value and at any offset from the eraseblock boundary using DTS properties to define those values. So, it is no longer necessary to use fixed sizes for kernel and rootfs Tested-by: Andrew Cameron <apcameron@softhome.net> [CPE510 v2] Tested-by: Bernhard Geier <freifunk@geierb.de> [WBS210 v2] Tested-by: Petrov <d7c48mWsPKx67w2@gmail.com> [CPE210 v1] Signed-off-by: Michael Pratt <mcpratt@pm.me>
* ramips: add support for TP-Link Archer C6U v1 (EU)Georgi Vlaev2021-05-261-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for TP-Link Archer C6U v1 (EU). The device is also known in some market as Archer C6 v3. This patch supports only Archer C6U v1 (EU). Specifications: -------------- * SoC: Mediatek MT7621AT 2C2T, 880MHz * RAM: 128MB DDR3 * Flash: 16MB SPI NOR flash (Winbond 25Q128) * WiFi 5GHz: Mediatek MT7613BEN (2x2:2) * WiFi 2.4GHz: Mediatek MT7603EN (2x2:2) * Ethernet: MT7630, 5x 1000Base-T. * LED: Power, WAN, LAN, WiFi 2GHz and 5GHz, USB * Buttons: Reset, WPS. * UART: Serial console (115200 8n1), J1(GND:3) * USB: One USB2 port. Installation: ------------ Install the OpenWrt factory image for C6U is from the TP-Link web interface. 1) Go to "Advanced/System Tools/Firmware Update". 2) Click "Browse" and upload the OpenWrt factory image: openwrt-ramips-mt7621-tplink_archer-c6u-v1-squashfs-factory.bin. 3) Click the "Upgrade" button, and select "Yes" when prompted. Recovery to stock firmware: -------------------------- The C6U bootloader has a failsafe mode that provides a web interface (running at 192.168.0.1) for reverting back to the stock TP-Link firmware. The failsafe interface is triggered from the serial console or on failed kernel boot. Unfortunately, there's no key combination that enables the failsafe mode. This gives us two options for recovery: 1) Recover using the serial console (J1 header). The recovery interface can be selected by hitting 'x' when prompted on boot. 2) Trigger the bootloader failsafe mode. A more dangerous option is force the bootloader into recovery mode by erasing the OpenWrt partition from the OpenWrt's shell - e.g "mtd erase firmware". Please be careful, since erasing the wrong partition can brick your device. MAC addresses: ------------- OEM firmware configuration: D8:07:B6:xx:xx:83 : 5G D8:07:B6:xx:xx:84 : LAN (label) D8:07:B6:xx:xx:84 : 2.4G D8:07:B6:xx:xx:85 : WAN Signed-off-by: Georgi Vlaev <georgi.vlaev@konsulko.com>
* ramips: add support for TP-Link Archer A6 v3Vinay Patil2021-05-261-1/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The patch adds support for the TP-Link Archer A6 v3 The router is sold in US and India with FCC ID TE7A6V3 Specification ------------- MediaTek MT7621 SOC RAM: 128MB DDR3 SPI Flash: W25Q128 (16MB) Ethernet: MT7530 5x 1000Base-T WiFi 5GHz: Mediatek MT7613BE WiFi 2.4GHz: Mediatek MT7603E UART/Serial: 115200 8n1 Device Configuration & Serial Port Pins --------------------------------------- ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN _______________________ | | Serial Pins: | VCC GND TXD RXD | |_____________________| LEDs: Power Wifi2G Wifi5G LAN WAN Build Output ------------ The build will generate following set of files [1] openwrt-ramips-mt7621-tplink_archer-a6-v3-initramfs-kernel.bin [2] openwrt-ramips-mt7621-tplink_archer-a6-v3-squashfs-factory.bin [3] openwrt-ramips-mt7621-tplink_archer-a6-v3-squashfs-sysupgrade.bin How to Use - Flashing from TP-Link Web Interface ------------------------------------------------ * Go to "Advanced/System Tools/Firmware Update". * Click "Browse" and upload the OpenWrt factory image: factory.bin[2] * Click the "Upgrade" button, and select "Yes" when prompted. TFTP Booting ------------ Setup a TFTP boot server with address 192.168.0.5. While starting U-boot press '4' key to stop autoboot. Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin From u-boot command prompt run tftpboot followed by bootm. Recovery -------- Archer A6 V3 has recovery page activated if SPI booting from flash fails. Recovery page can be activated from serial console only. Press 'x' while u-boot is starting Note: TFTP boot can be activated only from u-boot serial console. Device recovery address: 192.168.0.1 Thanks to: Frankis for Randmon MAC address fix. Signed-off-by: Vinay Patil <post2vinay@gmail.com> [remove superfluous factory image definition, whitespacing] Signed-off-by: David Bauer <mail@david-bauer.net>
* tplink-safeloader: fix product_name of TP-Link AD7200Alex Henrie2021-05-061-1/+1
| | | | | | | | | | | | | | The stock firmware does not accept firmware with "Talon" in the name. Tested on firmware version 1.0.10 Build 20160902 rel. 57400 which came preinstalled, as well as latest firmware version 2.0.1 Build 20170103 rel.71053 flashed from AD7200v1-up-ver2-0-1-P1[20170103-rel71053]_2017-01-04_10.08.28.bin. Fixes: 1a775a4fd033 ("ipq806x: add support for TP-Link Talon AD7200") Signed-off-by: Alex Henrie <alexhenrie24@gmail.com> [added details about vendor firmware] Signed-off-by: Petr Štetiar <ynezz@true.cz>
* firmware-utils: tplink-safeloader: support displaying fw infoRafał Miłecki2021-04-141-4/+127
| | | | | | | | | | Add "-i" option for reading & displaying firmware info. First it lists in-firmware partitions ("fwup-ptn"). Then it checks for human understandable partitions and prints data found in each of them. This new feature is meant for development & debug purposes. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* tplink-safeloader: fix C7v5 factory flashing from vendor fw > v1.1.xPetr Štetiar2021-04-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently it's not possible to flash factory images on devices shipped with vendor firmware versions 1.1.0 Build 20201120 rel. 50406 (published 2020-12-22): (curFw_ver, newFw_ver) == (1.1, 1.0) [NM_Error](nm_checkSoftVer) 00848: Firmwave not supports, check failed. [NM_Error](nm_checkUpdateContent) 01084: software version dismatched [NM_Error](nm_buildUpgradeStruct) 01188: checkUpdateContent failed. They've even following note in release notes: Note: You will be unable to downgrade to the previous firmware version after updating this firmware. This version check in vendor firmware is implemented in /usr/bin/nvrammanager binary likely as following C code[1]: sscanf(buf, "%d.%d.%*s",&upd_fw_major, &upd_fw_minor); ... if (((int)upd_fw_major < (int)cur_fw_major) || ((ret = 1, cur_fw_major == upd_fw_major && (upd_fw_minor < (int)cur_fw_minor)))) { ret = 0; printf("[NM_Error](%s) %05d: Firmwave not supports, check failed.\r\n\r\n","nm_checkSoftVer" ,0x350); } ... return ret; So in order to fix this and make it future proof it should be enough to ship our factory firmware images with major version 7 (lucky number). Tested on latest firmware version 1.1.2 Build 20210125 rel.37999: Firmwave supports, check OK. (curFw_ver, newFw_ver) == (1.1, 7.0) check firmware ok! Flashing back to vendor firmware c7v5_us-up-ver1-1-2-P1[20210125-rel37999]_2021-01-25_10.33.55.bin works as well: U-Boot 1.1.4-gbec22107-dirty (Nov 18 2020 - 18:19:12) ... Firmware downloaded... filesize = 0xeeae77 fileaddr = 0x80060000. Firmware Recovery file length : 15642231 Firmware process id 2. handle_fw_cloud 146 Image verify OK! Firmware file Verify ok! product-info:product_name:Archer C7 product_ver:5.0.0 special_id:55530000 [Error]sysmgr_cfg_checkSupportList(): 1023 @ specialId 45550000 NOT Match. Firmware supports, check OK. Firmware Recovery check ok! 1. https://gist.github.com/ynezz/2e0583647d863386a66c3d231541b6d1 Signed-off-by: Petr Štetiar <ynezz@true.cz>
* ramips: mt7621: add TP-Link EAP235-Wall supportSander Vanheule2021-02-191-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The TP-Link EAP235-Wall is a wall-mounted, PoE-powered AC1200 access point with four gigabit ethernet ports. When connecting to the device's serial port, it is strongly advised to use an isolated UART adapter. This prevents linking different power domains created by the PoE power supply, which may damage your devices. The device's U-Boot supports saving modified environments with `saveenv`. However, there is no u-boot-env partition, and saving modifications will cause the partition table to be overwritten. This is not an issue for running OpenWrt, but will prevent the vendor FW from functioning properly. Device specifications: * SoC: MT7621DAT * RAM: 128MiB * Flash: 16MiB SPI-NOR * Wireless 2.4GHz (MT7603EN): b/g/n, 2x2 * Wireless 5GHz (MT7613BEN): a/n/ac, 2x2 * Ethernet: 4× GbE * Back side: ETH0, PoE PD port * Bottom side: ETH1, ETH2, ETH3 * Single white device LED * LED button, reset button (available for failsafe) * PoE pass-through on port ETH3 (enabled with GPIO) Datasheet of the flash chip specifies a maximum frequency of 33MHz, but that didn't work. 20MHz gives no errors with reading (flash dump) or writing (sysupgrade). Device mac addresses: Stock firmware uses the same MAC address for ethernet (on device label) and 2.4GHz wireless. The 5GHz wireless address is incremented by one. This address is stored in the 'info' ('default-mac') partition at an offset of 8 bytes. From OEM ifconfig: eth a4:2b:b0:...:88 ra0 a4:2b:b0:...:88 rai0 a4:2b:b0:...:89 Flashing instructions: * Enable SSH in the web interface, and SSH into the target device * run `cliclientd stopcs`, this should return "success" * upload the factory image via the web interface Debricking: U-boot can be interrupted during boot, serial console is 57600 baud, 8n1 This allows installing a sysupgrade image, or fixing the device in another way. * Access serial header from the side of the board, close to ETH3, pin-out is (1:TX, 2:RX, 3:GND, 4:3.3V), with pin 1 closest to ETH3. * Interrupt bootloader by holding '4' during boot, which drops the bootloader into its shell * Change default 'serverip' and 'ipaddr' variables (optional) * Download initramfs with `tftpboot`, and boot image with `bootm` # tftpboot 84000000 openwrt-initramfs.bin # bootm Revert to stock: Using the tplink-safeloader utility from the firmware-utils package, TP-Link's firmware image can be converted to an OpenWrt-compatible sysupgrade image: $ ./staging_dir/host/bin/tplink-safeloader -B EAP235-WALL-V1 \ -z EAP235-WALLv1_XXX_up_signed.bin -o eap235-sysupgrade.bin This can then be flashed using the OpenWrt sysupgrade interface. The image will appear to be incompatible and must be force flashed, without keeping the current configuration. Known issues: - DFS support is incomplete (known issue with MT7613) - MT7613 radio may stop responding when idling, reboot required. This was an issue with the ddc75ff704 version of mt76, but appears to have improved/disappeared with bc3963764d. Error notice example: [ 7099.554067] mt7615e 0000:02:00.0: Message 73 (seq 1) timeout Hardware was kindly provided for porting by Stijn Segers. Tested-by: Stijn Segers <foss@volatilesystems.org> Signed-off-by: Sander Vanheule <sander@svanheule.net>
* tplink-safeloader: add support for TP-Link Archer A7 v5 (RU)Alexey Kunitskiy2021-02-051-1/+2
| | | | | | | | | | | | | | | | | | | Although provided in separate zip archives, the firmwares for EU and RU version are byte-identical. This adds the missing ID compared to the support-list in the vendor firmware. Note (since I checked it anyway): Partitions and support list are unchanged for all three existing firmware versions: * 20200721-rel40773 * 20201029-rel43238 * 20201120-rel50399 Signed-off-by: Alexey Kunitskiy <alexey.kv@gmail.com> [rewrite commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ipq806x: add support for TP-Link Talon AD7200Gary Cooper2021-01-051-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Device hardware: https://deviwiki.com/wiki/TP-LINK_AD7200_(Talon) The Talon AD7200 is basically an Archer C2600 with a third PCIe lane and an 802.11ad radio. It looks like the Archers C2600/5400 but the housing is slightly larger. Specifications -------------- - IPQ8064 dual-core 1400MHz - QCA9988 2.4GHz WiFi - QCA9990 5GHz WiFi - QCA9500 60GHz WiFi - 32MB SPI Flash - 512MiB RAM - 5 GBit Ports (QCA8337) Installation ------------ Installation is possible from the OEM web interface. Sysupgrade is possible. TFTP recovery is possible. - Image: AD7200_1.0_tp_recovery.bin Notes - This will be the first 802.11ad device supported by mainline. Signed-off-by: Gary Cooper <gaco@bitmessage.de>
* tplink-safeloader: add support for TP-Link CPE510 v3.20Gioacchino Mazzurco2020-12-141-1/+4
| | | | | | | | | | | | | This adds new strings for the v3.20 to the support list of the already supported TP-Link CPE510 v3. The underlying hardware appears to be the same, similar to the situation with CPE210 v3.20 in 4a2380a1e778 ("tplink-safeloader: expand support list for TP-Link CPE210 v3") Signed-off-by: Gioacchino Mazzurco <gio@altermundi.net> [extended commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* firmware-utils: tplink-safeloader: refactor meta-partition paddingSander Vanheule2020-12-071-67/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Because some padding values in the TP-Link safeloader image generation were hardcoded, different values were sometimes used throughout a factory image. TP-Link's upgrade images use the same value everywhere, so let's do the same here. Although a lot of TP-Link's safeloader images have padded partition payloads, images for the EAP-series of AC devices don't. This padding is therefore also made optional. By replacing the type of the padding value byte with a wider datatype, new values outside of the previously valid range become available. Use these new values to denote that padding should not be performed. Because char might be signed, also replace the char literals by a numeric literal. Otherwise '\xff' might be sign extended to 0xffff. This results in factory images differing by 1 byte for: * C2600 * ARCHER-C5-V2 * ARCHERC9 * TLWA850REV2 * TLWA855REV1 * TL-WPA8630P-V2-EU * TL-WPA8630P-V2-INT * TL-WPA8630P-V2.1-EU * TLWR1043NDV4 * TL-WR902AC-V1 * TLWR942NV1 * RE200-V2 * RE200-V3 * RE220-V2 * RE305-V1 * RE350-V1 * RE350K-V1 * RE355 * RE450 * RE450-V2 * RE450-V3 * RE500-V1 * RE650-V1 The following factory images no longer have padding, shrinking the factory images by a few bytes for: * EAP225-OUTDOOR-V1 * EAP225-V3 * EAP225-WALL-V2 * EAP245-V1 * EAP245-V3 Signed-off-by: Sander Vanheule <sander@svanheule.net>
* firmware-utils: tplink-safeloader: refactor meta-partition generationSander Vanheule2020-12-071-83/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link safeloader firmware images contain a number of (small) partitions with information about the device. These consist of: * The data length as a 32-bit integer * A 32-bit zero padding * The partition data, with its length set in the first field The OpenWrt factory image partitions that follow this structure are soft-version, support-list, and extra-para. Refactor the code to put all common logic into one allocation call, and let the rest of the data be filled in by the original functions. Due to the extra-para changes, this patch results in factory images that change by 2 bytes (not counting the checksum) for three devices: * ARCHER-A7-V5 * ARCHER-C7-V4 * ARCHER-C7-V5 These were the devices where the extra-para blob didn't match the common format. The hardcoded data also didn't correspond to TP-Link's (recent) upgrade images, which actually matches the meta-partition format. A padding byte is also added to the extra-para partition for EAP245-V3. Signed-off-by: Sander Vanheule <sander@svanheule.net>
* ath79: support for TP-Link EAP225 v3Sander Vanheule2020-11-231-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link EAP225 v3 is an AC1350 (802.11ac Wave-2) ceiling mount access point. Serial port access for debricking requires fine soldering. Device specifications: * SoC: QCA9563 @ 775MHz * RAM: 128MiB DDR2 * Flash: 16MiB SPI-NOR * Wireless 2.4GHz (SoC): b/g/n, 3x3 * Wireless 5Ghz (QCA9886): a/n/ac, 2x2 MU-MINO * Ethernet (AR8033): 1× 1GbE, 802.3at PoE Flashing instructions: * ssh into target device and run `cliclientd stopcs` * Upgrade with factory image via web interface Debricking: * Serial port can be soldered on PCB J3 (1: TXD, 2: RXD, 3: GND, 4: VCC) * Bridge unpopulated resistors R225 (TXD) and R237 (RXD). Do NOT bridge R230. * Use 3.3V, 115200 baud, 8n1 * Interrupt bootloader by holding CTRL+B during boot * tftp initramfs to flash via LuCI web interface setenv ipaddr 192.168.1.1 # default, change as required setenv serverip 192.168.1.10 # default, change as required tftp 0x80800000 initramfs.bin bootelf $fileaddr MAC addresses: MAC address (as on device label) is stored in device info partition at an offset of 8 bytes. ath9k device has same address as ethernet, ath10k uses address incremented by 1. From OEM boot log: Using interface ath0 with hwaddr b0:...:3e and ssid "..." Using interface ath10 with hwaddr b0:...:3f and ssid "..." Tested by forum user blinkstar88 Signed-off-by: Sander Vanheule <sander@svanheule.net>
* ath79: support for TP-Link EAP225-Outdoor v1Sander Vanheule2020-11-231-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link EAP225-Outdoor v1 is an AC1200 (802.11ac Wave-2) pole or wall mount access point. Debricking requires access to the serial port, which is non-trivial. Device specifications: * SoC: QCA9563 @ 775MHz * Memory: 128MiB DDR2 * Flash: 16MiB SPI-NOR * Wireless 2.4GHz (SoC): b/g/n 2x2 * Wireless 5GHz (QCA9886): a/n/ac 2x2 MU-MIMO * Ethernet (AR8033): 1× 1GbE, PoE Flashing instructions: * ssh into target device with recent (>= v1.6.0) firmware * run `cliclientd stopcs` on target device * upload factory image via web interface Debricking: To recover the device, you need access to the serial port. This requires fine soldering to test points, or the use of probe pins. * Open the case and solder wires to the test points: RXD, TXD and TPGND4 * Use a 3.3V UART, 115200 baud, 8n1 * Interrupt bootloader by holding ctrl+B during boot * upload initramfs via built-in tftp client and perform sysupgrade setenv ipaddr 192.168.1.1 # default, change as required setenv serverip 192.168.1.10 # default, change as required tftp 0x80800000 initramfs.bin bootelf $fileaddr MAC addresses: MAC address (as on device label) is stored in device info partition at an offset of 8 bytes. ath9k device has same address as ethernet, ath10k uses address incremented by 1. From stock ifconfig: ath0 Link encap:Ethernet HWaddr D8:...:2E ath10 Link encap:Ethernet HWaddr D8:...:2F br0 Link encap:Ethernet HWaddr D8:...:2E eth0 Link encap:Ethernet HWaddr D8:...:2E Tested by forum user PolynomialDivision on firmware v1.7.0. UART access tested by forum user arinc9. Signed-off-by: Sander Vanheule <sander@svanheule.net>
* ath79: support for TP-Link EAP245 v1Sander Vanheule2020-11-231-0/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link EAP245 v1 is an AC1750 (802.11ac Wave-1) ceiling mount access point. Device specifications: * SoC: QCA9563 @ 775MHz * RAM: 128MiB DDR2 * Flash: 16MiB SPI-NOR * Wireless 2.4GHz (SoC): b/g/n, 3x3 * Wireless 5Ghz (QCA9880): a/n/ac, 3x3 * Ethernet (AR8033): 1× 1GbE, 802.3at PoE Flashing instructions: * Upgrade the device to firmware v1.4.0 if necessary * Exploit the user management page in the web interface to start telnetd by changing the username to `;/usr/sbin/telnetd -l/bin/sh&`. * Immediately change the malformed username back to something valid (e.g. 'admin') to make ssh work again. * Use the root shell via telnet to make /tmp world writeable (chmod 777) * Extract /usr/bin/uclited from the device via ssh and apply the binary patch listed below. The patch is required to prevent `uclited -u` in the last step from crashing. * Copy the patched uclited programme back to the device at /tmp/uclited (via ssh) * Upload the factory image to /tmp/upgrade.bin (via ssh) * Run `chmod +x /tmp/uclited && /tmp/uclited -u` to install OpenWrt. --- xxd uclited +++ xxd uclited-patched @@ -53796,7 +53796,7 @@ 000d2240: 8c44 0000 0320 f809 0000 0000 8fbc 0010 .D... .......... 000d2250: 8fa6 0a4c 02c0 2821 8f82 87b8 0000 0000 ...L..(!........ -000d2260: 8c44 0000 0c13 45e0 27a7 0018 8fbc 0010 .D....E.'....... +000d2260: 8c44 0000 2402 0000 0000 0000 8fbc 0010 .D..$........... 000d2270: 1040 001d 0000 1821 8f99 8374 3c04 0058 .@.....!...t<..X 000d2280: 3c05 0056 2484 a898 24a5 9a30 0320 f809 <..V$...$..0. .. Debricking: * Serial port can be soldered on PCB J3 (1: TXD, 2: RXD, 3: GND, 4: VCC) * Bridge unpopulated resistors R225 (TXD) and R237 (RXD). Do NOT bridge R230. * Use 3.3V, 115200 baud, 8n1 * Interrupt bootloader by holding CTRL+B during boot * tftp initramfs to flash via the LuCI web interface setenv ipaddr 192.168.1.1 # default, change as required setenv serverip 192.168.1.10 # default, change as required tftp 0x80800000 initramfs.bin bootelf $fileaddr Tested on the EAP245 v1 running the latest firmware (v1.4.0). The binary patch might not apply to uclited from other firmware versions. EAP245 v1 device support was originally developed and maintained by Julien Dusser out-of-tree. This patch and "ath79: prepare for 1-port TP-Link EAP2x5 devices" are based on that work. Signed-off-by: Sander Vanheule <sander@svanheule.net>
* ramips: add support for TP-Link RE200 v4Richard Fröhning2020-10-201-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link RE200 v4 is a wireless range extender with Ethernet and 2.4G and 5G WiFi with internal antennas. It's based on MediaTek MT7628AN+MT7610EN like the v2/v3. Specifications -------------- - MediaTek MT7628AN (580 Mhz) - 64 MB of RAM - 8 MB of FLASH - 2T2R 2.4 GHz and 1T1R 5 GHz - 1x 10/100 Mbps Ethernet - 8x LED (GPIO-controlled), 2x button - UART connection holes on PCB (57600 8n1) There are 2.4G and 5G LEDs in red and green which are controlled separately. MAC addresses ------------- The MAC address assignment matches stock firmware, i.e.: LAN : *:8E 2.4G: *:8D 5G : *:8C MAC address assignment has been done according to the RE200 v2. The label MAC address matches the OpenWrt ethernet address. Installation ------------ Web Interface ------------- It is possible to upgrade to OpenWrt via the web interface. Simply flash the -factory.bin from OEM. In contrast to a stock firmware, this will not overwrite U-Boot. Recovery -------- Unfortunately, this devices does not offer a recovery mode or a tftp installation method. If the web interface upgrade fails, you have to open your device and attach serial console. Instructions for serial console and recovery may be checked out in commit 6d6f36ae787c ("ramips: add support for TP-Link RE200 v2") or on the device's Wiki page. Signed-off-by: Richard Fröhning <misanthropos@gmx.de> [removed empty line, fix commit message formatting] Signed-off-by: David Bauer <mail@david-bauer.net>
* ath79: rename TP-Link TL-WPA8630P v2 (EU) to v2.0 (EU)Adrian Schmutzler2020-10-041-1/+1
| | | | | | | Since we have a v2.1 (EU) with different partitioning now, rename the v2.0 to make the difference visible to the user more directly. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: add support for TP-Link TL-WPA8630P (EU) v2.1Joe Mullally2020-10-041-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds support for the TP-Link TL-WPA8630P (EU) in its v2.1 version. The only unique aspect for the firmware compared to v2 layout is the partition layout. Note that while the EU version has different partitioning for v2.0 and v2.1, the v2.1 (AU) is supported by the v2-int image. If you plan to use this device, make sure you have a look at the Wiki page to check whether the device is supported and which image needs to be taken. Specifications -------------- - QCA9563 750MHz, 2.4GHz WiFi - QCA9888 5GHz WiFi - 8MiB SPI Flash - 128MiB RAM - 3 GBit Ports (QCA8337) - PLC (QCA7550) Installation ------------ Installation is possible from the OEM web interface. Make sure to install the latest OEM firmware first, so that the PLC firmware is at the latest version. However, please also check the Wiki page for hints according to altered partitioning between OEM firmware revisions. Notes ----- The OEM firmware has 0x620000 to 0x680000 unassigned, so we leave this empty as well. It is complicated enough already ... Signed-off-by: Joe Mullally <jwmullally@gmail.com> [improve partitions, use v2 DTSI, add entry in 02_network, rewrite and extend commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: support for TP-Link EAP225-Wall v2Sander Vanheule2020-09-121-0/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link EAP225-Wall v2 is an AC1200 (802.11ac Wave-2) wall plate access point. UART access and debricking require fine soldering. The device was kindly provided for porting by Stijn Segers. Device specifications: * SoC: QCA9561 @ 775MHz * RAM: 128MiB DDR2 * Flash: 16MiB SPI-NOR (GD25Q127CSIG) * Wireless 2.4GHz (SoC): b/g/n, 2x2 * Wireless 5Ghz (QCA9886): a/n/ac, 2x2 MU-MIMO * Ethernet (SoC): 4× 100Mbps * Eth0 (back): 802.3af/at PoE in * Eth1, Eth2 (bottom) * Eth3 (bottom): PoE out (can be toggled by GPIO) * One status LED * Two buttons (both work as failsafe) * LED button, implemented as KEY_BRIGHTNESS_TOGGLE * Reset button Flashing instructions, requires recent firmware (tested on 1.20.0): * ssh into target device and run `cliclientd stopcs` * Upgrade with factory image via web interface Debricking: * Serial port can be soldered on PCB J4 (1: TXD, 2: RXD, 3: GND, 4: VCC) * Bridge unpopulated resistors R162 (TXD) and R165 (RXD) Do NOT bridge R164 * Use 3.3V, 115200 baud, 8n1 * Interrupt bootloader by holding CTRL+B during boot * tftp initramfs to flash via sysupgrade or LuCI web interface MAC addresses: MAC address (as on device label) is stored in device info partition at an offset of 8 bytes. ath9k device has same address as ethernet, ath10k uses address incremented by 1. From OEM ifconfig: br0 Link encap:Ethernet HWaddr 50:...:04 eth0 Link encap:Ethernet HWaddr 50:...:04 wifi0 Link encap:UNSPEC HWaddr 50-...-04-... wifi1 Link encap:UNSPEC HWaddr 50-...-05-... Signed-off-by: Sander Vanheule <sander@svanheule.net> [fix IMAGE_SIZE] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: add support for TP-Link EAP245-v3Sander Vanheule2020-09-091-0/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link EAP245 v3 is an AC1750 (802.11ac Wave-2) ceiling mount access point. UART access (for debricking) requires non-trivial soldering. Specifications: * SoC: QCA9563 (CPU/DDR/AHB @ 775/650/258 MHz) * RAM: 128MiB * Flash: 16MiB SPI-NOR * Wireless 2.4GHz (SoC): b/g/n 3x3 * Wireless 5GHz (QCA9982): a/n/ac 3x3 with MU-MIMO * Ethernet (QCA8337N switch): 2× 1GbE, ETH1 (802.3at PoE) and ETH2 * Green and amber status LEDs * Reset switch (GPIO, available for failsafe) Flashing instructions: All recent firmware versions (latest is 2.20.0), can disable firmware signature verification and use a padded firmware file to flash OpenWrt: * ssh into target device and run `cliclientd stopcs` * upload factory image via web interface The stopcs-method is supported from firmware version 2.3.0. Earlier versions need to be upgraded to a newer stock version before flashing OpenWrt. Factory images for these devices are RSA signed by TP-Link. While the signature verification can be disabled, the factory image still needs to have a (fake) 1024 bit signature added to pass file checks. Debricking instructions: You can recover using u-boot via the serial port: * Serial port is available from J3 (1:TX, 2:RX, 3:GND, 4:3.3V) * Bridge R237 to connect RX, located next to J3 * Bridge R225 to connect TX, located inside can on back-side of board * Serial port is 115200 baud, 8n1, interrupt u-boot by holding ctrl+B * Upload initramfs with tftp and upgrade via OpenWrt Device mac addresses: Stock firmware has the same mac address for 2.4GHz wireless and ethernet, 5GHz is incremented by one. The base mac address is stored in the 'default-mac' partition (offset 0x90000) at an offset of 8 bytes. ART blobs contain no mac addresses. From OEM ifconfig: ath0 Link encap:Ethernet HWaddr 74:..:E2 ath10 Link encap:Ethernet HWaddr 74:..:E3 br0 Link encap:Ethernet HWaddr 74:..:E2 eth0 Link encap:Ethernet HWaddr 74:..:E2 Signed-off-by: Sander Vanheule <sander@svanheule.net> Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
* firmware-utils/tplink-safeloader: add compat levelSander Vanheule2020-09-091-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link has introduced a compatibility level to prevent certain downgrades. This information is stored in the soft-version partition, changing the data length from 0xc to 0x10. The compatibility level doesn't change frequently. For example, it has the following values for the EAP245v3 (released 2018-Q4): * FW v2.2.0 (2019-05-30): compat_level=0 * FW v2.3.0 (2019-07-31): compat_level=0 * FW v2.3.1 (2019-10-29): compat_level=1 * FW v2.20.0 (2020-04-23): compat_level=1 Empty flash values (0xffffffff) are interpreted as compat_level=0. If a firmware upgrade file has a soft-version block without compatibility level (data length < 0x10), this is also interpreted as compat_level=0. By including a high enough compatibility level in factory images, stock firmware can be convinced to accept the image. A compatibility level aware firmware will keep the original value. Example upgrade log of TP-Link EAP245v3 FWv2.3.0 to FWv2.20.0: [NM_Debug](nm_fwup_verifyFwupFile) 02073: curSoftVer:2.3.0 Build 20190731 Rel. 51932,newSoftVer:2.20.0 Build 20200423 Rel. 36779 ... AddiHardwareVer check: NEW(0x1) >= CUR(0x0), Success. ... [NM_NOTICE](updateDataToNvram) 00575: Restore old additionalHardVer: 0x0.(new 0x1) [NM_NOTICE](updateDataToNvram) 00607: PTN 07: name = soft-version, base = 0x00092000, size = 0x00000100 Bytes, upDataType = 1, upDataStart = 7690604b, upDataLen = 00000018 [NM_Debug](updateDataToNvram) 00738: PTN 07: write bytes = 000002eb Other firmware upgrades have been observed to modify the compabitility stored level (e.g. TP-Link EAP225-Outdoor FWv1.4.1 to FWv1.7.0). Therefore, it seems to be the safest option to set the OpenWrt compatibility level to the highest known value instead of the highest possible value (0xfffffffe), to ensure users do not get unexpectedly refused firmware upgrades when using a device reverted back to stock. To remain compatible with existing devices and not produce different images, the image builder doesn't store a compatibility level if it is zero. Signed-off-by: Sander Vanheule <sander@svanheule.net>
* firmware-utils/tplink-safeloader: soft-version magic is data lengthSander Vanheule2020-09-091-2/+3
| | | | | | | | | | | | | | | The soft-version partition actually contains a header and trailing data: * header: {data length, [zero]} * data: {version, bcd encoded date, revision} The data length is currently treated as a magic number, but should contain the length of the partition data. This header is also present the following partitions (non-exhaustive): * string-based soft-version * support-list Signed-off-by: Sander Vanheule <sander@svanheule.net>
* ath79: increase kernel partition for ar9344 TP-Link CPE/WBSAdrian Schmutzler2020-08-301-22/+22
| | | | | | | | | | | | The kernel has become too big again for the ar9344-based TP-Link CPE/WBS devices which still have no firmware-partition splitter. Current buildbots produce a kernel size of about 2469 kiB, while the partition is only 2048 kiB (0x200000). Therefore, increase it to 0x300000 to provide enough room for this and, hopefully, the next kernel. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* tools/tplink-safeloader: use soft_ver 1.9.1 for archer c6 v2Alexander Couzens2020-08-191-2/+2
| | | | | | | | | | | TP-LINK published a firmware update for the archer c6 v2. This updates also reached the factory devices. Newer software version rejects downgrading to 1.2.x. Use 1.9.x to allow installing the factory images and have a little bit time to change it again. Tested on archer c6 v2 with firmware 1.3.1 Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
* ath79: add support for TP-Link TL-WPA8630P v2Andreas Böhler2020-08-101-0/+72
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The TL-WPA8630P v2 is a HomePlug AV2 compatible device with a QCA9563 SoC and 2.4GHz and 5GHz WiFi modules. Specifications -------------- - QCA9563 750MHz, 2.4GHz WiFi - QCA9888 5GHz WiFi - 8MiB SPI Flash - 128MiB RAM - 3 GBit Ports (QCA8337) - PLC (QCA7550) MAC address assignment ---------------------- WiFi 2.4GHz and LAN share the same MAC address as printed on the label. 5GHz WiFi uses LAN-1, based on assumptions from similar devices. LAN Port assignment ------------------- While there are 3 physical LAN ports on the device, there will be 4 visible ports in OpenWrt. The fourth port (internal port 5) is used by the PowerLine Communication SoC and thus treated like a regular LAN port. Versions -------- Note that both TL-WPA8630 and TL-WPA8630P, as well as the different country-versions, differ in partitioning, and therefore shouldn't be cross-flashed. This adds support for the two known partitioning variants of the TL-WPA8630P, where the variants can be safely distinguished via the tplink-safeloader SupportList. For the non-P variants (TL-WPA8630), at least two additional partitioning schemes exist, and the same SupportList entry can have different partitioning. Thus, we don't support those officially (yet). Also note that the P version for Germany (DE) requires the international image version, but is properly protected by SupportList. In any case, please check the OpenWrt Wiki pages for the device before flashing anything! Installation ------------ Installation is possible from the OEM web interface. Make sure to install the latest OEM firmware first, so that the PLC firmware is at the latest version. However, please also check the Wiki page for hints according to altered partitioning between OEM firmware revisions. Additional thanks to Jon Davies and Joe Mullally for bringing order into the partitioning mess. Signed-off-by: Andreas Böhler <dev@aboehler.at> [minor DTS adjustments, add label-mac-device, drop chosen, move common partitions to DTSI, rename de to int, add AU support strings, adjust TPLINK_BOARD_ID, create common node in generic-tp-link.mk, adjust commit message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* tools/firmware-utils: use UTC for image timestampsSander Vanheule2020-08-071-1/+1
| | | | | | | | By using localtime() to determine the timestamp that goes into factory images, the resulting image depends on the timezone of the build system. Use gmtime() instead, which results in more reproducible images. Signed-off-by: Sander Vanheule <sander@svanheule.net>
* ramips: add support for TP-Link RE200 v3Richard Fröhning2020-08-031-0/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link RE200 v3 is a wireless range extender with Ethernet and 2.4G and 5G WiFi with internal antennas. It's based on MediaTek MT7628AN+MT7610EN like the v2. Specifications -------------- - MediaTek MT7628AN (580 Mhz) - 64 MB of RAM - 8 MB of FLASH - 2T2R 2.4 GHz and 1T1R 5 GHz - 1x 10/100 Mbps Ethernet - 8x LED (GPIO-controlled), 2x button Unverified: - UART header on PCB (57600 8n1) There are 2.4G and 5G LEDs in red and green which are controlled separately. MAC addresses ------------- MAC address assignment has been done according to the RE200 v2. The label MAC address matches the OpenWrt ethernet address. Installation ------------ Web Interface ------------- It is possible to upgrade to OpenWrt via the web interface. Simply flash the -factory.bin from OEM. In contrast to a stock firmware, this will not overwrite U-Boot. Recovery -------- Unfortunately, this devices does not offer a recovery mode or a tftp installation method. If the web interface upgrade fails, you have to open your device and attach serial console. The device has not been opened for adding support. However, it is expected that the behavior is similar to the RE200 v2. Instructions for serial console and recovery may be checked out in commit 6d6f36ae787c ("ramips: add support for TP-Link RE200 v2") or on the device's Wiki page. Signed-off-by: Richard Fröhning <misanthropos@gmx.de> [adjust commit title/message, sort support list] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* tplink-safeloader: expand support list for TP-Link CPE210 v3Adrian Schmutzler2020-07-201-1/+8
| | | | | | | | | | | | | | This adds new strings to the support list for the TP-Link CPE210 v3 that are supposed to work with the existing setup. Without it, the factory image won't be accepted by the vendor UI on these newer revisions. Tested on a CPE210 v3.20 (EU). Ref: https://forum.openwrt.org/t/build-for-cpe210-v3-20/68000 Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for TP-Link RE500 v1Christoph Krapp2020-07-071-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This device uses the same hardware as RE650 v1 which got supported in 8c51dde. Hardware specification: - SoC 880 MHz - MediaTek MT7621AT - 128 MB of DDR3 RAM - 16 MB - Winbond 25Q128FVSG - 4T4R 2.4 GHz - MediaTek MT7615E - 4T4R 5 GHz - MediaTek MT7615E - 1x 1 Gbps Ethernet - MT7621AT integrated - 7x LEDs (Power, 2G, 5G, WPS(x2), Lan(x2)) - 4x buttons (Reset, Power, WPS, LED) - UART header (J1) - 2:GND, 3:RX, 4:TX Serial console @ 57600,8n1 Flash instructions: Upload openwrt-ramips-mt7621-tplink_re500-v1-squashfs-factory.bin from the RE500 web interface. TFTP recovery to stock firmware: Unfortunately, I can't find an easy way to recover the RE without opening the device and using modified binaries. The TFTP upload will only work if selected from u-boot, which means you have to open the device and attach to the serial console. The TFTP update procedure does *not* accept the published vendor firmware binaries. However, it allows to flash kernel + rootfs binaries, and this works if you have a backup of the original contents of the flash. It's probably possible to create special image out of the vendor binaries and use that as recovery image. Signed-off-by: Christoph Krapp <achterin@googlemail.com> [remove dts-v1 in DTSI, do not touch WiFi LEDs for RE650, keep state_default in DTS files, fix label-mac-device, use lower case for WiFi LEDs] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for TP-Link RE220 v2Rowan Border2020-06-301-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link RE220 v2 is a wireless range extender with Ethernet and 2.4G and 5G WiFi with internal antennas. It's based on MediaTek MT7628AN+MT7610EN. This port of OpenWRT leverages work done by Andreas Böhler <dev@aboehler.at> for the TP-Link RE200 v2 as both devices share the same SoC, flash layout and GPIO pinout. Specifications MediaTek MT7628AN (580 Mhz) 64 MB of RAM 8 MB of FLASH 2T2R 2.4 GHz and 1T1R 5 GHz 1x 10/100 Mbps Ethernet UART header on PCB (57600 8n1) 8x LED (GPIO-controlled), 2x button There are 2.4G and 5G LEDs in red and green which are controlled separately. Web Interface Installation It is possible to upgrade to OpenWrt via the web interface. Simply flash the -factory.bin from OEM. In contrast to a stock firmware, this will not overwrite U-Boot. Signed-off-by: Rowan Border <rowanjborder@gmail.com>
* ath79: add support for TP-Link CPE610 v2Andrew Cameron2020-06-201-0/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link CPE610 v2 is an outdoor wireless CPE for 5 GHz with one Ethernet port based on Atheros AR9344 Specifications: - 560/450/225 MHz (CPU/DDR/AHB) - 1x 10/100 Mbps Ethernet - 64 MB of DDR2 RAM - 8 MB of SPI-NOR Flash - 23dBi high-gain directional 2×2 MIMO antenna and a dedicated metal reflector - Power, LAN, WLAN5G green LEDs - 3x green RSSI LEDs Flashing instructions: Flash factory image through stock firmware WEB UI or through TFTP To get to TFTP recovery just hold reset button while powering on for around 4-5 seconds and release. Rename factory image to recovery.bin Stock TFTP server IP:192.168.0.100 Stock device TFTP adress:192.168.0.254 Signed-off-by: Andrew Cameron <apcameron@softhome.net>
* ath79: add support for TP-Link RE450 v3Andreas Wiese2020-05-311-0/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link RE450 v3 is a dual band router/range-extender based on Qualcomm/Atheros QCA9563 + QCA9880. This device is nearly identical to RE450 v2 besides a modified flash layout (hence I think force-flashing a RE450v2 image will lead to at least loss of MAC address). Specification: - 775 MHz CPU - 64 MB of RAM (DDR2) - 8 MB of FLASH (SPI NOR) - 3T3R 2.4 GHz - 3T3R 5 GHz - 1x 10/100/1000 Mbps Ethernet (AR8033 PHY) - 7x LED, 4x button- - possible UART header on PCB¹ Flash instruction: Apply factory image in OEM firmware web-gui. ¹ Didn't check to connect as I didn't even manage to connect on RE450v2 (AFAIU it requires disconnecting some resistors, which I was too much of a coward to do). But given the similarities to v2 I think it's the same or very similar procedure (and most likely also the only way to debrick). Signed-off-by: Andreas Wiese <aw-openwrt@meterriblecrew.net> [remove dts-v1 and compatible in DTSI] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* tplink-safeloader: update soft_ver for TP-Link Archer C6 v2 (EU)Georgi Vlaev2020-03-301-1/+1
| | | | | | | | | | | | The last couple of TP-Link firmware releases for Archer C6 v2 (EU) have switched to version 1.2.x. Bump the soft_ver to "1.2.1" to allow firmware updates from the vendor web interface. TP-Link vendor firmware releases supported by this change: * Archer C6(EU)_V2_200110: soft_ver:1.2.1 Build 20200110 rel.60119 * Archer C6(EU)_V2_191014: soft_ver:1.2.0 Build 20191014 rel.33289 Signed-off-by: Georgi Vlaev <georgi.vlaev@gmail.com>
* ath79: add support for TP-Link Archer C60 v3Adrian Schmutzler2020-03-181-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link Archer C60 v3 is a dual-band AC1350 router, based on Qualcomm/Atheros QCA9561 + QCA9886. It seems to be identical to the v2 revision, except that it lacks a WPS LED and has different GPIO for amber WAN LED. Specification: - 775/650/258 MHz (CPU/DDR/AHB) - 64 MB of RAM (DDR2) - 8 MB of FLASH (SPI NOR) - 3T3R 2.4 GHz - 2T2R 5 GHz - 5x 10/100 Mbps Ethernet - 6x LED, 2x button - UART header on PCB Flash instruction (WebUI): Download *-factory.bin image and upload it via the firmwary upgrade function of the stock firmware WebUI. Flash instruction (TFTP): 1. Set PC to fixed IP address 192.168.0.66 2. Download *-factory.bin image and rename it to tp_recovery.bin 3. Start a tftp server with the file tp_recovery.bin in its root directory 4. Turn off the router 5. Press and hold reset button 6. Turn on router with the reset button pressed and wait ~15 seconds 7. Release the reset button and after a short time the firmware should be transferred from the tftp server 8. Wait ~30 second to complete recovery While TFTP works for OpenWrt images, my device didn't accept the only available official firmware "Archer C60(EU)_V3.0_190115.bin". In contrast to earlier revisions (v2), the v3 contains the (same) MAC address twice, once in 0x1fa08 and again in 0x1fb08. While the partition-table on the device refers to the latter, the firmware image contains a different partition-table for that region: name device firmware factory-boot 0x00000-0x1fb00 0x00000-0x1fa00 default-mac 0x1fb00-0x1fd00 0x1fa00-0x1fc00 pin 0x1fd00-0x1fe00 0x1fc00-0x1fd00 product-info 0x1fe00-0x1ff00 0x1fd00-0x1ff00 device-id 0x1ff00-0x20000 0x1ff00-0x20000 While the MAC address is present twice, other data like the PIN isn't, so with the partitioning from the firmware image the PIN on the device would actually be outside of its partition. Consequently, the patch uses the MAC location from the device (which is the same as for the v2). Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ramips: add support for TP-Link RE200 v2Andreas Böhler2020-02-011-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link RE200 v2 is a wireless range extender with Ethernet and 2.4G and 5G WiFi with internal antennas. It's based on MediaTek MT7628AN+MT7610EN. Specifications -------------- - MediaTek MT7628AN (580 Mhz) - 64 MB of RAM - 8 MB of FLASH - 2T2R 2.4 GHz and 1T1R 5 GHz - 1x 10/100 Mbps Ethernet - UART header on PCB (57600 8n1) - 8x LED (GPIO-controlled), 2x button There are 2.4G and 5G LEDs in red and green which are controlled separately. MAC addresses ------------- The MAC address assignment matches stock firmware, i.e.: LAN : *:0D 2.4G: *:0E 5G : *:0F Installation ------------ Web Interface ------------- It is possible to upgrade to OpenWrt via the web interface. Simply flash the -factory.bin from OEM. In contrast to a stock firmware, this will not overwrite U-Boot. Serial console -------------- Opening the case is quite hard, since it is welded together. Rename the OpenWrt factory image to "test.bin", then plug in the device and quickly press "2" to enter flash mode (no line feed). Follow the prompts until OpenWrt is installed. Unfortunately, this devices does not offer a recovery mode or a tftp installation method. If the web interface upgrade fails, you have to open your device and attach serial console. Additonal notes --------------- It is possible to flash back to stock by using tplink-safeloader to create a sysupgrade image based on a stock update. After the first boot, it is necessary upgrade to another stock image, otherwise subsequent boots fail with LZMA ERROR 1 and you have to attach serial to recover the device. Signed-off-by: Andreas Böhler <dev@aboehler.at> [remove DEVICE_VARS change] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ar71xx: use dynamic partitioning for TP-Link TL-WA850RE v2Adrian Schmutzler2020-01-221-2/+1
| | | | | | | This moves the TP-Link TL-WA850RE v2 to dynamic partitioning and will allow to use this for ath79 as well. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* tools: tplink-safeloader: update soft_ver for TP-Link Archer C6 v2 (EU)Anderson Vulczak2020-01-191-1/+1
| | | | | | | | | | | | | | | | This patch updates "soft_ver" for TP-Link Archer C6 v2 (EU). It makes possible to upload OpenWrt on lastest vendor's firmware as the web-based updater checks for major.minor version during upload. Due to that on next major/minor version update TP-Link will stop us from using the web-based firmware update tool, so it will require a new patch on soft_ver to match major and minor version. Up to today's latest stock firmware the patch (major.minor.patch) version does not matters, that allows downgrade from 1.1.4 to 1.1.1 but do not allow downgrade from 1.1.X to 1.0.X. Signed-off-by: Anderson Vulczak <andi@andi.com.br>
* ramips: add support for TP-Link RE305 v1Steffen Förster2020-01-181-0/+36
| | | | | | | | | | | | | | | | | | | | | | Specification: SoC: MediaTek MT7628AN RAM: 64MiB Flash: 8MiB Wifi: - 2.4GHz: MT7628AN - 5GHz: MT7612EN LAN: 1x 10/100 Mbps Flash instructions: Flash factory image through stock firmware WEB UI. Back to stock is possible by using TFTP and stripping down the Firmware provided by TP-Link to a initramfs. The flash space between 0x650000 and 0x7f0000 is blank in the stock firmware so I left it out as well. Signed-off-by: Steffen Förster <nemesis@chemnitz.freifunk.net>
* tools: tplink-safeloader: fix whitespace issuesAdrian Schmutzler2019-11-271-42/+42
| | | | | | | | | This replaces tabs by spaces when preceding an equal sign. This improves consistency in the file and makes the indent look correct on all platforms. While at it, also fix one case of inconsistent leading spaces. Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: add support for TP-Link Archer C6 v2 (US) and A6 (US/TW)Anderson Vulczak2019-11-271-1/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch is based on #1689 and adds support for TP-Link Archer C6 v2 (US) and A6 (US/TW). The hardware is the same as EU and RU variant, except for GPIOs (LEDS/Buttons), flash(chip/partitions) and UART being available on the board. - SOC: Qualcomm QCA9563 @ 775MHz - Flash: GigaDevice GD25Q127CS1G (16MiB) - RAM: Zentel A3R1GE40JBF (128 MiB DDR2) - Ethernet: Qualcomm QCA8337N: 4x 1Gbps LAN + 1x 1Gbps WAN - Wireless: - 2.4GHz (bgn) QCA9563 integrated (3x3) - 5GHz (ac) Qualcomm QCA9886 (2x2) - Button: 1x power, 1x reset, 1x wps - LED: 6x LEDs: power, wlan2g, wlan5g, lan, wan, wps - UART: 115200, 8n1 (header available on board) Known issues: - Wireless: 5GHz is known to have lower RSSI signal, it affects speed and range. Flash instructions: Upload openwrt-ath79-generic-tplink_archer-c6-v2-us-squashfs-factory.bin via the router Web interface. Flash instruction using tftp recovery: 1. Connect the computer to one of the LAN ports of the router 2. Set the computer IP to 192.168.0.66 3. Start a tftp server with the OpenWrt factory image in the tftp root directory renamed to ArcherA6v2_tp_recovery.bin. 4. Connect power cable to router, press and hold the reset button and turn the router on 5. Keep the reset button pressed until the WPS LED lights up 6. Wait ~150 seconds to complete flashing Flash partitioning: I've followed #1689 for defining the partition layout for this patch. The partition named as "tplink" @ 0xfd0000 is marked as read only as it is where some config for stock firmware are stored. On stock firmware those stock partitions starts at 0xfd9400 however I had not been able to make it functional starting on the same address as on stock fw, so it has been partitioned following #1689 and not the stock partition layout for this specific partition. Due to that firmware/rootfs partition lenght is 0xf80000 and not 0xf89400 as stock. According to the GPL code, the EU/RU/JP variant does have different GPIO pins assignment to LEDs and buttons, also the flash memory layout is different. GPL Source Code: https://static.tp-link.com/resources/gpl/gpl-A6v2_us.tar.gz Signed-off-by: Anderson Vulczak <andi@andi.com.br> [wrap commit message, remove soft_ver change for C6 v2 EU, move LED aliases to DTS files, remove dts-v1 in DTSI, node/property reorder in DTSI] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* tplink-safeloader: shorten version number of TP-Link WBS210 v2Bernhard Geier2019-11-231-3/+3
| | | | | | | | | "2.0" instead of "2.00" is sufficient and more in line with the other definitions. Signed-off-by: Bernhard Geier <freifunk@geierb.de> [commit message/title adjustments] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: add support for the TP-LINK WBS510 V1Andrew Cameron2019-11-221-1/+2
| | | | | | | | | | | | | | | | | | | | | | This adds support for a popular low-cost 5GHz N based AP Specifications: - SoC: Atheros AR9344 - RAM: 64MB - Storage: 8 MB SPI NOR - Wireless: 5GHz 300 Mbps, 2x RP-SMA connector, 27 dBm TX power - Ethernet: 1x 10/100 Mbps with 24V POE IN, 1x 10/100 Mbps Installation: Flash factory image through stock firmware WEB UI or through TFTP To get to TFTP recovery just hold reset button while powering on for around 4-5 seconds and release. Rename factory image to recovery.bin Stock TFTP server IP:192.168.0.100 Stock device TFTP adress:192.168.0.254 Signed-off-by: Andrew Cameron <apcameron@softhome.net>
* ath79: add support for the TP-LINK WBS510 V2Andrew Cameron2019-11-221-0/+33
| | | | | | | | | | | | | | | | | | | | | | This adds support for a popular low-cost 5GHz N based AP Specifications: - SoC: Atheros AR9344 - RAM: 64MB - Storage: 8 MB SPI NOR - Wireless: 5GHz 300 Mbps, 2x RP-SMA connector, 27 dBm TX power - Ethernet: 1x 10/100 Mbps with 24V POE IN, 1x 10/100 Mbps Installation: Flash factory image through stock firmware WEB UI or through TFTP To get to TFTP recovery just hold reset button while powering on for around 4-5 seconds and release. Rename factory image to recovery.bin Stock TFTP server IP:192.168.0.100 Stock device TFTP adress:192.168.0.254 Signed-off-by: Andrew Cameron <apcameron@softhome.net>
* ath79: add support for the TP-LINK CPE220 V3Andrew Cameron2019-11-061-0/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds support for a popular low-cost 2.4GHz N based AP Specifications: SoC: Qualcomm Atheros QCA9533 (650MHz) RAM: 64MB Storage: 8 MB SPI NOR Wireless: 2.4GHz N based built into SoC 2x2 Ethernet: 2x 100/10 Mbps, integrated into SoC Installation: Flash factory image through stock firmware WEB UI or through TFTP To get to TFTP recovery just hold reset button while powering on for around 4-5 seconds and release. Rename factory image to recovery.bin Stock TFTP server IP:192.168.0.100 Stock device TFTP adress:192.168.0.254 This also applies some minor changes to the common DTSI: - use &wmac for label-mac-device, as this one is actually set up in common DTSI - move &eth0 to parent DTSI - fix several leading spaces, added/removed newlines Signed-off-by: Andrew Cameron <apcameron@softhome.net> [DTS style fixes/improvements, updated commit message/title] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ath79: add support for TP-Link WBS210 v2Bernhard Geier2019-11-031-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link WBS210 v2 is an outdoor wireless CPE for 2.4 GHz with two Ethernet ports based on Atheros AR9344 The device is the same as TP-Link CPE220 v2, but with higher TX power (27 dBm instead of 12 dBm) and two antenna connectors instead of built-in antennas. Specifications: - SoC: Atheros AR9344 - RAM: 64MB - Storage: 8 MB SPI NOR - Wireless: 2.4GHz 300 Mbps, 2x RP-SMA connector, 27 dBm TX power - Ethernet: 1x 10/100 Mbps with 24V POE IN, 1x 10/100 Mbps Installation: Flash factory image through stock firmware WEB UI or through TFTP To get to TFTP recovery just hold reset button while powering on for around 4-5 seconds and release. Rename factory image to recovery.bin Stock TFTP server IP: 192.168.0.100 Stock device TFTP adress: 192.168.0.254 The TP-Link WBS devices use the same GPIOs as the CPE devices, except for the link4 LED. For this one, WBS devices use "2", while CPE devices use "16". (Tested on WBS210 v2) Signed-off-by: Bernhard Geier <freifunk@geierb.de> [added comment about GPIO] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
* ar71xx: improve support for TP-Link CPE510 v2Adrian Schmutzler2019-10-211-12/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes commit bae927c551fd ("ar71xx: add support for TP-LINK CPE510 V2.0") where the support for this device wasn't optimal. Device support for the CPE510v2 so far has been a hack to enable flashing with CPE510v1 images. Those even have different hardware (e.g. additional ethernet port). With this patch, we provide proper support for this device in ar71xx. Installation: - Flash factory image through stock firmware WEB UI or through TFTP - To get to TFTP recovery just hold reset button while powering on for around 4-5 seconds and release. - Rename factory image to recovery.bin - Stock TFTP server IP: 192.168.0.100 - Stock device TFTP address: 192.168.0.254 Fixes: bae927c551fd ("ar71xx: add support for TP-LINK CPE510 V2.0") Signed-off-by: Andrew Cameron <apcameron@softhome.net> [Rebased onto revert commit, changed comments in mach-cpe510.c, changed commit title and description, fixed eth0 MAC address, removed eth1 initialization] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> [squashed revert, added fixes tag] Signed-off-by: Petr Štetiar <ynezz@true.cz>
* tplink-safeloader: fix compilation warningsIlya Gordeev2019-10-191-12/+13
| | | | Signed-off-by: Ilya Gordeev <Mirraz@users.noreply.github.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-03 18:43:39 +0000