summaryrefslogtreecommitdiff
path: root/tools/firmware-utils/src/mktplinkfw2.c
Commit message (Collapse)AuthorAgeFilesLines
* ramips: add support for TP-Link Archer C20 v1Maxim Anisimov2017-09-131-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link Archer C20 v1 is a router with 5-port FE switch and non-detachable antennas. It's very similiar to TP-Link Archer C50. Also it's based on MediaTek MT7620A+MT7610EN. Specification: - MediaTek MT7620A (580 Mhz) - 64 MB of RAM - 8 MB of FLASH - 2T2R 2.4 GHz and 1T1R 5 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - 8x LED (GPIO-controlled*), 2x button, power input switch - 1 x USB 2.0 port * WAN LED in this devices is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the blue part of the LED. * MT7610EN ac chip isn't not supported by LEDE. Therefore 5Ghz won't work. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. So, to flash this device we must to prepare image using original firmware from tp-link site with uboot. Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot. There are two ways to flash the device to LEDE: 1) Using tftp mode with UART connection and original LEDE image - Place lede-ramips-mt7620-ArcherC20-squashfs-factory.bin in tftp server directory - Configure PC with static IP 192.168.0.66/24 and tftp server. - Connect PC with one of LAN ports, power up the router and press key "4" to access U-Boot CLI. - Use the following commands to update the device to LEDE: setenv serverip 192.168.0.66 tftp 0x80060000 lede-ramips-mt7620-ArcherC20-squashfs-factory.bin erase tplink 0x20000 0x7a0000 cp.b 0x80060000 0x20000 0x7a0000 reset - After that the device will reboot and boot to LEDE 2) Using tftp mode without UART connection but require some manipulations with target image - Download and unpack TP-Link Archer C20 v1 firmware from original web site - Split uboot.bin from original firmware by this command (example): dd if=Archer_C20v1_0.9.1_4.0_up_boot(160427)_2016-04-27_13.53.59.bin of=uboot.bin bs=512 count=256 skip=1 - Create ArcherC20V1_tp_recovery.bin using this command: cat uboot.bin lede-ramips-mt7620-ArcherC20-squashfs-factory.bin > ArcherC20V1_tp_recovery.bin - Place ArcherC20V1_tp_recovery.bin in tftp server directory. - Configure PC with static IP 192.168.0.66/24 and tftp server. - Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. - Router will download file from server, write it to flash and reboot. Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
* tools/firmware-utils: mktplinkfw2: allow parameter overrideThibaut VARENE2017-09-091-9/+7
| | | | | | This patch enables commandline override of board hw_ver and hw_ver_add Signed-off-by: Thibaut VARENE <hacks@slashdirt.org>
* firmware-utils: mktplinkfw2: respect -e option when reading fw infoRafał Miłecki2017-07-311-3/+5
| | | | | | | | When -e option it specified a corresponding flag is set in the custom_board. By using custom_board as fallback -e option gets respected for unknown boards. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* firmware-utils: mktplinkfw2: fix info for images with LE kernel LA/EPRafał Miłecki2017-07-311-1/+7
| | | | | | | With this change endianness is also respected when reading firmware info. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* firmware-utils: mktplinkfw2: replace "endian_swap" field with "flags"Rafał Miłecki2017-07-311-8/+10
| | | | | | This will allow adding more similar tricks needed by other hardware. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* firmware-utils: mktplinkfw2: use static board struct for custom valuesRafał Miłecki2017-07-081-18/+15
| | | | | | | | | It seems simpler to store all custom (command line set) option values in a struct identical to the predefined ones. It doesn't require: 1) Having so many global variables 2) Copying data from the predefined boards Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* firmware-utils: mktplinkfw2: update firmware headerRafał Miłecki2017-07-081-26/+26
| | | | | | | 1) Be consistent and use tabs 2) Drop FIXME from boot comments - some images use these fields normally Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* firmware-utils: mktplinkfw2: add missing options descriptionsPiotr Dymacz2017-07-041-0/+3
| | | | Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* firmware-utils: mktplinkfw2: fix MD5 saltRafał Miłecki2017-07-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | LEDE supports few devices using TP-Link firmware format (V2 or V3): ArcherC20i, ArcherC50, ArcherMR200, TDW8970, TDW8980, TL-WR840N v4, TL-WR841N v13 and VR200v Testing mktplinkfw2 tool with official (vendor generated) firmware files for above devices has shown an error when comparing calculated and included MD5 sum, e.g.: > mktplinkfw2 -i Archer_C20iv1_0.9.1_3.2_up_boot\(170221\)_2017-02-21_17.14.03.bin | grep -A 1 MD5Sum1 Header MD5Sum1 : 22 5a cb 92 10 d2 95 7b df 62 9a f8 62 17 37 10 (*ERROR*) --> expected : ad 19 11 d1 78 98 a7 42 5f 2e 64 da 8a 34 ec cb This problem has been verified to occur with: Archer_C20iv1_0.9.1_3.2_up_boot(170221)_2017-02-21_17.14.03.bin Archer MR200v1_0.9.1_1.1_up_boot_v004a.0 Build 160905 Rel.60037n.bin TD-W8970v3_0.9.1_2.0_up_boot(160816)_2016-08-16_10.40.57.bin TD-W8980v1_0.6.0_1.8_up_boot(150514)_2015-05-14_11.16.43.bin Archer_VR200vv2_0.2.0_0.8.0_up_boot(161202)_2016-12-05_14.39.06.bin For some images, e.g.: Archer_C50v3_EU_0.9.1_0.3_up_boot[170417-rel52298].bin TL-WR840Nv4_EU_0.9.1_4.16_up_boot[170421-rel70692].bin TL-WR841Nv13_0.9.1_3.16_up_boot(161012).bin mktplinkfw2 calculates zero MD5 so these has to be fixed separately: > mktplinkfw2 -i TL-WR841Nv13_0.9.1_3.16_up_boot\(161012\).bin | grep -A 1 MD5Sum1 Header MD5Sum1 : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (*ERROR*) --> expected : 6f 1d 9b 57 5d 42 14 6d bf a2 03 9d 46 7d 55 55 It's most likely that MD5 salt used in mktplinkfw2 has been always wrong (and it's not a matter of e.g. a vendor change). Update it to fix MD5 calculation. This has been also verified to calculate MD5 correctly for other (not yet supported) devices, e.g.: Archer_C3150v2_0.1.0_0.9.1_up_boot(160812)_2016-08-12_10.52.54.bin Archer_C3200v1_0.9.1_0.1_up_boot(160704)_2016-07-04_15.48.28.bin Signed-off-by: Rafał Miłecki <rafal@milecki.pl> Acked-by: Mathias Kresin <dev@kresin.me>
* firmware-utils: mktplinkfw2: fix support for -w optionRafał Miłecki2017-07-021-1/+1
| | | | | | | This fixes copy & paste typo when reading -w argument. Fixes: 4b35e174caa5b ("firmware-utils: mktplinkfw2: support additional hardware version") Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
* ramips: add support for TP-Link TL-WR840N v4 and TL-WR841N v13Piotr Dymacz2017-06-291-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TP-Link TL-WR840N v4 and TL-WR841N v13 are simple N300 routers with 5-port FE switch and non-detachable antennas. Both are very similar and are based on MediaTek MT7628NN (aka MT7628N) WiSoC. The difference between these two models is in number of available LEDs, buttons and power input switch. This work is partially based on GitHub PR#974. Specification: - MT7628N/N (580 MHz) - 64 MB of RAM (DDR2) - 8 MB of FLASH - 2T2R 2.4 GHz - 5x 10/100 Mbps Ethernet - 2x external, non-detachable antennas - UART (J1) header on PCB (115200 8n1) - TL-WR840N v4: 5x LED (GPIO-controlled), 1x button - TL-WR841N v13: 8x LED (GPIO-controlled*), 2x button, power input switch * WAN LED in TL-WR841N v13 is a dual-color, dual-leads type which isn't (fully) supported by gpio-leds driver. This type of LED requires both GPIOs state change at the same time to select color or turn it off. For now, we support/use only the green part of the LED. Factory image notes: These devices use version 3 of TP-Link header, fortunately without RSA signature (at least in case of devices sold in Europe). The difference lays in the requirement for a non-zero value in "Additional Hardware Version" field. Ideally, it should match the value stored in vendor firmware header on device ("0x4"/"0x13" for these devices) but it seems that anything other than "0" is correct. We are able to prepare factory firwmare file which is accepted and (almost) correctly flashed from the vendor GUI. As it turned out, it accepts files without U-Boot image with second header at the beginning but due to some kind of bug in upgrade routine, flashed image gets corrupted before it's written to flash. Tests showed that the GUI upgrade routine copies value of "Additional Hardware Version" from existing firmware into offset "0x2023c" in provided file, _before_ storing it in flash. In case of vendor firmware upgrade files (which all include U-Boot image and two headers), this offset points to the matching field in kernel+rootfs firmware part header. Unfortunately, in case of LEDE factory image file which contains only one header, it points to the offset "0x2023c" in kernel image. This leads to a corrupted kernel and ends up with a "soft-bricked" device. The good news is that U-Boot in these devices contains well known tftp recovery mode, which can be triggered with "reset" button. What's more, in comparison to some of older MediaTek based TP-Link devices, this recovery mode doesn't write whole file at offset "0x0" in flash, without verifying provided file in advance. In case of recovery mode in these devices, first "0x20000" bytes are always skipped and "0x7a0000" bytes from rest of the file are stored in flash at offset "0x20000". Flash instruction: Until (if at all) TP-Link fixes described problem, the only way to flash LEDE image in these devices is to use tftp recovery mode in U-Boot: 1. Configure PC with static IP 192.168.0.66/24 and tftp server. 2. Rename "lede-ramips-mt7628-tl-wr84...-squashfs-tftp-recovery.bin" to "tp_recovery.bin" and place it in tftp server directory. 3. Connect PC with one of LAN ports, press the reset button, power up the router and keep button pressed for around 6-7 seconds, until device starts downloading the file. 4. Router will download file from server, write it to flash and reboot. To access U-Boot CLI, keep pressed "4" key during boot. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* firmware-utils: mktplinkfw2: support additional hardware versionPiotr Dymacz2017-06-291-6/+20
| | | | | | | | | | | | | | | | | | As it turned out, some of new MediaTek based TP-Link devices use value from field at 0x3c offset in version 3 of TP-Link header to specify "Additional Hardware Version". Value from this field is validated during regular (GUI) firmware upgrade on devices like TL-WR840N v4 or TL-WR841N v13. If it's zero (based on some tests, it seems that firmware will accept anything != 0), errors like below are printed on console and upgrade fails: [ rsl_sys_updateFirmware ] 2137: Firmware Additional HardwareVersion check failed [ rdp_updateFirmware ] 345: perror:4506 Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
* ramips: Add support to TP-Link Archer MR200Henryk Heisig2016-12-221-0/+13
| | | | | | | | | | CPU: MT7620N 580MHz Flash: 8MB RAM: 64MB build-in modem 3G/4G four ethernet port 10/100Mbps Signed-off-by: Henryk Heisig <hyniu@o2.pl>
* tools/firmware-utils: Add Archer C50 to mktplinkfw2Henryk Heisig2016-06-131-0/+7
| | | | Signed-off-by: Henryk Heisig <hyniu@o2.pl>
* lantiq: add support for TP-Link VR200vHauke Mehrtens2016-01-181-0/+12
| | | | | | | | | This adds basic support for TP-Link VR200v. Currently the following parts are not working: FXO, Voice, DECT, WIFI (both) Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> SVN-Revision: 48328
* tools: firmware-utils: fix compiler warningsHauke Mehrtens2015-10-111-1/+1
| | | | | | | | This just fixes a lot of compiler warnings. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> SVN-Revision: 47181
* lantiq: Add target TP-Link TD-W8980John Crispin2015-10-051-0/+5
| | | | | | | | | The device is similar to the TD-W8970, beside a different Atheros 2.4 GHz wireless chip and the additional, PCI connected, WAVE300 5 GHz wireless. Signed-off-by: Mathias Kresin <openwrt@kresin.me> SVN-Revision: 47130
* tools/firmware-utils: add version 3 header support for mktplinkfw2Felix Fietkau2015-01-091-9/+42
| | | | | | Signed-off-by: Felix Fietkau <nbd@openwrt.org> SVN-Revision: 43897
* firmware-utils: add a tool TP-Link v2 image generationJohn Crispin2013-08-061-0/+944
Signed-off-by: Gabor Juhos <juhosg@openwrt.org> SVN-Revision: 37726
generated by cgit v1.1 at 2024-07-26 23:16:53 +0000