TP-Link TL-WA855RE v1 is a wall-plug N300 Wi-Fi range extender,
based on Qualcomm/Atheros QCA9533 v2.
Short specification:
- 550/397/198 MHz (CPU/DDR/AHB)
- 1x 10/100 Mbps Ethernet
- 32 MB of RAM (DDR1)
- 4 MB of FLASH
- 2T2R 2.4 GHz
- 2x external antennas
- 2x LED (green and orange in the same package), 2x button
- UART: TP5(TX) and TP4(RX) test points on PCB
Flash instruction: use "factory" image directly in vendor GUI.
Warning: this device does not include any kind of recovery mechanism
in the bootloader and disassembling process is not trivial.
You can access vendor firmware over serial line using:
- login: root
- password: sohoadmin
Image was tested only in EU version of the device, but should work
also with the same device version sold in other countries.
Signed-off-by: Federico Cappon <dududede371@gmail.com>
The sum variable need to be initialised, otherwise it will points to
random stack memory and a bogus image checksum might be calculated.
While at it, fix the segfault in case the product region code isn't
specified and enable compiler warnings which had revealed all the code
issues.
Signed-off-by: Mathias Kresin <dev@kresin.me>
Use the timestamp from the enviroment SOURCE_DATE_EPOCH
if set instead of the build time.
Fixes reproducible builds for certain firmware images.
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
This adds the necessary firmware layout definitions for the Archer C25.
It has an addtional partition containing some static data ("extra-para")
without which no factory flash is possible, therefore put_data() has been
added.
Signed-off-by: Ludwig Thomeczek <ledesrc@wxorx.net>
TP-Link TL-WR942N v1 is a 2.4 GHz single-band N450 router, based on
Qualcomm/Atheros QCA9561.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x USB 2.0
- 11x LED (most are controlled by 74HC595)
- 2x button
- UART header on PCB*
* Serial console is disabled in OEM non-beta firmwares and corresponding
GPIO pins 14 and 15 are assigned to control USB1 and USB2 LEDs by
production (non-beta) U-Boot and firmware.
Currently not working:
1. USB1 and USB2 LEDs if UART RX and TX pins are assigned to their GPIOs
by some U-Boot versions.
Flash instruction under vendor GUI:
1. Download "lede-ar71xx-generic-tl-wr942n-v1-squashfs-factory.bin".
2. Go to WEB interface and perform usual firmware upgrade.
FLash instruction under U-Boot recovery mode (doesn't work in beta
firmware):
1. Setup PC with static IP "192.168.0.66/24" and tftp server.
2. Change "*-factory" image filename to "WR942v1_recovery.bin" and make
it available to download from your tftp server.
3. Press "reset" button and power up the router, wait till "WPS" LED
turns on.
Flash instruction under U-Boot, using UART (can be done only with
preinstalled UART-enabled U-Boot version!):
1. Use "tpl" to stop autobooting and obtain U-Boot CLI access.
2. Setup ip addresses for U-Boot and your tftp server.
3. Issue below commands:
tftp 0x81000000 lede-ar71xx-generic-tl-wr942n-v1-sysupgrade.bin
erase 0x9f020000 +$filesize
cp.b 0x81000000 0x9f020000 $filesize
reset
Signed-off-by: Serg Studzinskii <serguzhg@gmail.com>
[minor code style fixes, extended commit message]
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Some TP-Link routers (C25, C59, C60) contain a version string instead
of a binary structure in the soft_version partition.
Flashing LEDE from the original firmware's GUI, this version string
taken from the soft_ver partition of the firmware image is written to
the router's config partition.
When using tftp recovery to go back to the original Archer C25 firmware,
a version check compares that version to the version of the firmware to
be flashed.
Without proper contents in the config partition, reverting to the
original firmware fails.
Therefore, write the string "soft_ver:1.0.0\n" to that soft_ver
partition.
Signed-off-by: Jan Niehusmann <jan@gondor.com>
TP-Link TL-WA850RE v2 is a wall-plug N300 Wi-Fi range extender,
based on Qualcomm/Atheros QCA9533 v2.
Short specification:
- 550/391/195 MHz (CPU/DDR/AHB)
- 1x 10/100 Mbps Ethernet
- 32 MB of RAM (DDR1)
- 4 MB of FLASH
- 2T2R 2.4 GHz
- 2x internal antennas (embedded on PCB)
- 9x LED (all can be turned off with GPIO15), 2x button
- UART (J3) header on PCB
Flash instruction: use "factory" image directly in vendor GUI.
Warning: this device does not include any kind of recovery mechanism
in the bootloader and disassembling process is not trivial.
You can access vendor firmware over serial line using:
- login: root
- password: sohoadmin
Image was tested only in US version of the device, but should work
also with the same device version sold in other countries.
Available FLASH space, with LEDE trunk, is only 240 KB.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
some of Buffalo DHP series use slightly different trx magic, buffalo-enc,
buffalo-tag, and factory image begin with 'bgn'.
this patch adds support for building those images.
Signed-off-by: FUKAUMI Naoki <naobsd@gmail.com>
TP-Link Archer C59v1 is a dual-band AC1350 router, based on Qualcomm/Atheros
QCA9561+QCA9886.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 2T2R 5 GHz
- 5x 10/100 Mbps Ethernet
- USB 2.0 port
- 8x LED (controled by 74HC595), 3x button
- UART header on PCB
TP-Link Archer C60v1 is a dual-band AC1350 router, based on Qualcomm/Atheros
QCA9561+QCA9886.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 2T2R 5 GHz
- 5x 10/100 Mbps Ethernet
- 7x LED, 2x button
- UART header on PCB
Currently not working:
- Port LAN1 on C59, LAN4 on C60
- WiFi 5GHz (missing ath10k firmware for QCA9886 chip)
- Update from oficial web interface ( tplink-saveloader not support "product-info")
Flash instruction:
1. Set PC to fixed ip address 192.168.0.66
2. Download lede-ar71xx-generic-archer-cXX-v1-squashfs-factory.bin
and rename it to tp_recovery.bin
3. Start a tftp server with the file tp_recovery.bin in its root directory
4. Turn off the router
5. Press and hold Reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time
the firmware should be transferred from the tftp server
8. Wait ~30 second to complete recovery.
Flash instruction under U-Boot, using UART:
1. tftp 0x81000000 lede-ar71xx-...-sysupgrade.bin
2. erase 0x9f020000 +$filesize
3. cp.b $fileaddr 0x9f020000 $filesize
4. reset
Signed-off-by: Henryk Heisig <hyniu@o2.pl>
[Jo-Philipp Wich: remove duplicate ATH79_MACH_ARCHER_C59/C60_V1 entries]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The firmware image that is used in TP-Link RE450 (and some more devices from
the RE series) is tplink-safeloader.
In the kernel partition, the kernel is compressed in a regular tp-link
firmware that is just used for booting. Since it is only used for compressing
and booting, only four fields are filled in the header:
Vendor, version, kernel load address and kernel entry point.
mktplinkfw-kernel is a simpler version of mktpolinkfw that generate such
images. It also specifies the hardware id (as it is in the product info
section), so when doing a sysupgrade - the existing code will check for
hardware compatibility.
Signed-off-by: Tal Keren <kooolk@gmail.com>
[rd@radekdostal.com: add build target to .../image/tp-link.mk]
Signed-off-by: Radek Dostál <rd@radekdostal.com>
The TL-WR1043ND v4 uses a kernel image with a mktplinkfw header inside the
os-image partition of a tplink-safeloader image.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
In order to make it easier to add new boards in the future, refactor the code
to describe the image layouts of supported boards in a struct array and alter
the image generation routines to figure out the sysupgrade partitions
automatically.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Adds support for new EU and US variants; removes a few strings that were
never actually used and have been removed from the stock firmwares.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Our current implementation is pretty old and uses some pre-standard/old
ANSI C style that triggers warnings like:
warning: call to function 'MD5_Init' without a real prototype [-Wunprototyped-calls]
This is caused by declarations specified in a following way:
src/md5.h:60:6: note: 'MD5_Init' was declared here
void MD5_Init ();
Having these warnings makes it harded to notice real problems. We could
try hiding them but it makes more sense to just use a cleaner code.
Another tiny gain from this switch is slightly reduced binary size, on
x86_64 tplink-safeloader's size 48104 became 48003.
The new code is public domain, uses "heavily cut-down BSD license".
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Earlier compilers such as GCC 4 do not like anynomous unions, make it a named
union "u", and update the code where relevant.
Fixes FS#298
Fixes: a72e1692b8 ("firmware-utils: Add support for the Cisco Meraki MX60/MX60W")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
This patch adds header support for the Cisco Meraki MX60/MX60W, which
are a part of the apm821xx target. Some structure changes were needed
due to the fact this device uses U-Boot (unlike other devices in
mkmerakifw.c) which uses a different header structure to define the load
offsets for the image.
A thanks to Christian for helping implement this properly.
Cc: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Chris Blake <chrisrblake93@gmail.com>
Recent refactoring introduced a regression. It ignored second argument
of make_support_list function which was originally true for C2600. The
new generic build_image function always passes false.
This patch allows specifying trailing char in a device specific info. It
also switches Archer C9 to the \0 char to make it compliant with vendor
images.
I verified generated images to be binary identical to the ones that
were created before whole refactoring.
Reported-by: Jo-Philipp Wich <jo@mein.io>
Fixes: fd924d2068 ("firmware-utils: tplink-safeloader: use one function for generating images")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Looking into /usr/include/stdlib.h, there's a `devname()` function defined
under some #ifdef's which conflicts with the `static char *devname` definition
in `src/mkwrggimg.c`.
Defining `_ANSI_SOURCE` in the `src/mkwrggimg.c` file, omits that part of the
header.
Another more intrusive approach is to rename `devname` to something like
`g_devname` in `src/mkwrggimg.c`. But I think the `_ANSI_SOURCE` define should
be enough.
Compilation error is:
src/mkwrggimg.c:64:14: error: redefinition of 'devname' as different kind of symbol
static char *devname;
^
/usr/include/stdlib.h:286:7: note: previous definition is here
char *devname(dev_t, mode_t);
^
src/mkwrggimg.c:147:12: error: non-object type 'char *(dev_t, mode_t)' (aka 'char *(int, unsigned short)') is not assignable
devname = optarg;
~~~~~~~ ^
src/mkwrggimg.c:192:6: warning: comparison of function 'devname' equal to a null pointer is always false [-Wtautological-pointer-compare]
if (devname == NULL) {
^~~~~~~ ~~~~
src/mkwrggimg.c:192:6: note: prefix with the address-of operator to silence this warning
if (devname == NULL) {
^
&
src/mkwrggimg.c:251:27: warning: incompatible pointer types passing 'char *(dev_t, mode_t)' (aka 'char *(int, unsigned short)') to parameter of type 'const char *' [-Wincompatible-pointer-types]
strncpy(header->devname, devname, sizeof(header->devname));
^~~~~~~
/usr/include/secure/_string.h:119:34: note: expanded from macro 'strncpy'
__builtin___strncpy_chk (dest, src, len, __darwin_obsz (dest))
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
[Jo-Philipp Wich: slightly reformat commit message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Some gcc versions seem to miscompile code using ternary operators,
work around this by just returning the result if exp is 0.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
TP-Link has changed the way the region is stored in the firmware header,
and now provides US- and EU-specific images for the Archer C7. Adding the
new region codes is necessary to make LEDE/OpenWrt flashable on devices
with the new stock firmwares again.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
The CPE210 was still described for the OEM upgrade as compatible,
even the wireless configuration isn't compatible anymore between
both series (2ghz and 5ghz).
Update the CPE210 image profile to use the new profile.
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Remove the whole board list from mktplinkfw, as OpenWrt doesn't use it and
it was severely out of sync with the list of built images for ar71xx.
Also:
* fix -Wall warnings
* add const where appropriate
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 49214
This tool creates factory images for JCG routers.
Details can be found in the header comment of jcgimage.c.
Signed-off-by: Reinhard Max <reinhard@m4x.de>
Reviewed-by: Torsten Duwe <duwe@lst.de>
SVN-Revision: 48888
The new u-boot version bundled with the 5.6.x firmwares from Ubiquiti gets
confused by the smaller rootfs partition size; this can lead to various
issues:
1. We've gotten reports that flashing from the 5.6.x stock firmware to
OpenWrt will brick devices; I wasn't able to reproduce this myself
2. Flashing from 5.5.x stock firmware to OpenWrt and back to stock (via
TFTP recovery), following by an update to 5.6.x via web interface can
yield a bricked device with the following properties:
- It can't be booted without entering commands over a serial console, as
u-boot supplies the wrong MTD layout
- The web interface won't accept any image with the original flash
layout, so stock firmware upgrades are impossible
- As the TFTP recovery doesn't update u-boot, returning to the old
u-boot from firmware 5.5.x is impossible
To recover from 2., creating an OpenWrt image which doesn't set u-boot as
read-only and flashing a backup of the old u-boot from there is the only
way known to me. (Fixing the mtdparts variable in u-boot-env from OpenWrt
might also work; settings this from u-boot over serial didn't have
any permanent effect.)
Fix all of this by setting the correct flash layout also used by the stock
firmware. Flashing has been tested from both firmware 5.5.x and 5.6.x. The
fixed layout also matches the mtdparts defined by OpenWrt.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 48829
The ubdev01 profile defines its own MTDPARTS with smaller firmware
partition, so give it its own UBNT_BOARD in mkfwimage.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 48828
It has an important feature (compared to seama) of using multiple input
files, aligning them and padding zeroes until reaching a specified
absolute offset. This is needed for a proper flash layout on NAND. We
want kernel partition to be big enough to handle future updates without
a need to resize it and wipe whole "ubi" partition. It's important as
we don't want to lose block counters.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48601
This adds basic support for TP-Link VR200v.
Currently the following parts are not working: FXO, Voice, DECT, WIFI (both)
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 48328
mostly implicit defines due to missing includes plus one const that
shouldn't be one.
Signed-off-by: Felix Kaechele <felix@kaechele.ca>
SVN-Revision: 47865
Due to the LWL/LWR SMP issue on BCM6368, booting with squash might fail
if the rootfs is not word aligned. As a quick fix, work around it by
ensuring this condition is always true.
Reported-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 47380
Sets the LEDs to boardname:color:led-name
Sets the LAN to eth0
Other corrections such as the Machine Name and HWIDs
v2 corrects the profile names in the Makefile and changes tabs to spaces
in the Makefile 'define Device/' like the other devices.
Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
SVN-Revision: 47221
The hardware is identical to version 1.0, add the new models to the support
list.
Also remove the empty line at the end of the support list, the current
stock images don't have it either.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 47212
The first 4 bytes of the support list and the vendor information are
supposed to contain the length of these fields.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 47211
ARM defaults to unsigned char and that breaks the calculation, as it
relies on sign extension
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 47186
The device is similar to the TD-W8970, beside a different Atheros 2.4 GHz
wireless chip and the additional, PCI connected, WAVE300 5 GHz wireless.
Signed-off-by: Mathias Kresin <openwrt@kresin.me>
SVN-Revision: 47130
Signed-off-by: Weijie Gao <hackpascal@gmail.com>
This patch adds header version 2 option for mktplinkfw.
The version 2 header is used for AR/QCA firmwares and is not the same as
the header generated by mktplinkfw2.
Instead, it is nearly the same as version 1 header except for the header
version and the RSA signature.
The header version 2 support is used for newer TP-Link routers which have
only a 64kb bootloader part, e.g. TL-WDR6500 v2.
SVN-Revision: 46661
This patch adds support for the Onion Omega.
https://onion.io/omega
Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
Acked-by: Boken Lin <bl@onion.io>
Tested-by: Jacky Huang <huangfangcheng@163.com>
SVN-Revision: 46458
This patch adds support for the Bitmain Antminer S3 Cryptocurrency Miner
http://wiki.openwrt.org/toh/bitmain/s3
Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
SVN-Revision: 46236
The hardware should be almost the same as TL-WR720N-v3. WiFi and LAN networks
were tested by "Lo Yuk Fai <loyukfai@gmail.com>". Failsafe and slider switch
were tested by "Wong min <alpha080@gmail.com>".
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
SVN-Revision: 46046
This patch adds support for the Bitmain Antminer S1 Cryptocurrency Miner
http://wiki.openwrt.org/toh/bitmain/s1
Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
Acked-by: James Hilliard <james.hilliard1@gmail.com>
SVN-Revision: 46044
VGV7519 is currently the only device with brnboot support. It seems to
be happy with 0x2083b8ed as CRC32 poly. However, VGV7510KW22 fails to
validate the checksum - it requires 0x04c11db7 instead.
I have built an brnboot image manually on the command line, once with
the old code and then with the new code but passing the old CRC32
poly value. Both resulted in a brnboot image with the same sha1sum.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
SVN-Revision: 45881
We do not need to align the start of read only rootfs's to erase blocks.
This allows us to write the squashfs rootfs directly behind the kernel,
potentially freeing up one erase block.
We still need to align for jffs2, so add a flag for imagetag to
optionally align the rootfs start.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 44556
memset() was called with a size argument against a pointer size, not the
structure size itself.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
SVN-Revision: 43913
The new TP-LINK Pharos series uses a new bootloader, the "TP-LINK Safeloader".
It uses an advanced firmware image format, containing an image partition table
and a flash partition table (and image partitions are mapped to the
corresponding flash partitions). The exact image format is documented in the
source code.
Furthermore, the bootloader expects the kernel image as an ELF executable.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 43384
Jean-Pierre St-Yves
Henryk Heisig
Federico Cappon
Mathias Kresin
Alexander Couzens
Ludwig Thomeczek
Serg Studzinskii
Jan Niehusmann
Rafał Miłecki
Piotr Dymacz
FUKAUMI Naoki
John Crispin
Yousong Zhou
Matthias Schiffer
Radek Dostál
Tal Keren
Jo-Philipp Wich
Florian Fainelli
Chris Blake
Vitaly Chekryzhev
Alexandru Ardelean
Stijn Tintel
Jonas Gorski
Felix Fietkau
Christian Lamparter
Rafał Miłecki
Ash Benz
John Crispin
Felix Fietkau
Hauke Mehrtens
Jonas Gorski
Jo-Philipp Wich
Florian Fainelli
Imre Kaloz