The firmware image that is used in TP-Link RE450 (and some more devices from
the RE series) is tplink-safeloader.
In the kernel partition, the kernel is compressed in a regular tp-link
firmware that is just used for booting. Since it is only used for compressing
and booting, only four fields are filled in the header:
Vendor, version, kernel load address and kernel entry point.
mktplinkfw-kernel is a simpler version of mktpolinkfw that generate such
images. It also specifies the hardware id (as it is in the product info
section), so when doing a sysupgrade - the existing code will check for
hardware compatibility.
Signed-off-by: Tal Keren <kooolk@gmail.com>
[rd@radekdostal.com: add build target to .../image/tp-link.mk]
Signed-off-by: Radek Dostál <rd@radekdostal.com>
The TL-WR1043ND v4 uses a kernel image with a mktplinkfw header inside the
os-image partition of a tplink-safeloader image.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
In order to make it easier to add new boards in the future, refactor the code
to describe the image layouts of supported boards in a struct array and alter
the image generation routines to figure out the sysupgrade partitions
automatically.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Adds support for new EU and US variants; removes a few strings that were
never actually used and have been removed from the stock firmwares.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Our current implementation is pretty old and uses some pre-standard/old
ANSI C style that triggers warnings like:
warning: call to function 'MD5_Init' without a real prototype [-Wunprototyped-calls]
This is caused by declarations specified in a following way:
src/md5.h:60:6: note: 'MD5_Init' was declared here
void MD5_Init ();
Having these warnings makes it harded to notice real problems. We could
try hiding them but it makes more sense to just use a cleaner code.
Another tiny gain from this switch is slightly reduced binary size, on
x86_64 tplink-safeloader's size 48104 became 48003.
The new code is public domain, uses "heavily cut-down BSD license".
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Earlier compilers such as GCC 4 do not like anynomous unions, make it a named
union "u", and update the code where relevant.
Fixes FS#298
Fixes: a72e1692b8 ("firmware-utils: Add support for the Cisco Meraki MX60/MX60W")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
This patch adds header support for the Cisco Meraki MX60/MX60W, which
are a part of the apm821xx target. Some structure changes were needed
due to the fact this device uses U-Boot (unlike other devices in
mkmerakifw.c) which uses a different header structure to define the load
offsets for the image.
A thanks to Christian for helping implement this properly.
Cc: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Chris Blake <chrisrblake93@gmail.com>
Recent refactoring introduced a regression. It ignored second argument
of make_support_list function which was originally true for C2600. The
new generic build_image function always passes false.
This patch allows specifying trailing char in a device specific info. It
also switches Archer C9 to the \0 char to make it compliant with vendor
images.
I verified generated images to be binary identical to the ones that
were created before whole refactoring.
Reported-by: Jo-Philipp Wich <jo@mein.io>
Fixes: fd924d2068 ("firmware-utils: tplink-safeloader: use one function for generating images")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Looking into /usr/include/stdlib.h, there's a `devname()` function defined
under some #ifdef's which conflicts with the `static char *devname` definition
in `src/mkwrggimg.c`.
Defining `_ANSI_SOURCE` in the `src/mkwrggimg.c` file, omits that part of the
header.
Another more intrusive approach is to rename `devname` to something like
`g_devname` in `src/mkwrggimg.c`. But I think the `_ANSI_SOURCE` define should
be enough.
Compilation error is:
src/mkwrggimg.c:64:14: error: redefinition of 'devname' as different kind of symbol
static char *devname;
^
/usr/include/stdlib.h:286:7: note: previous definition is here
char *devname(dev_t, mode_t);
^
src/mkwrggimg.c:147:12: error: non-object type 'char *(dev_t, mode_t)' (aka 'char *(int, unsigned short)') is not assignable
devname = optarg;
~~~~~~~ ^
src/mkwrggimg.c:192:6: warning: comparison of function 'devname' equal to a null pointer is always false [-Wtautological-pointer-compare]
if (devname == NULL) {
^~~~~~~ ~~~~
src/mkwrggimg.c:192:6: note: prefix with the address-of operator to silence this warning
if (devname == NULL) {
^
&
src/mkwrggimg.c:251:27: warning: incompatible pointer types passing 'char *(dev_t, mode_t)' (aka 'char *(int, unsigned short)') to parameter of type 'const char *' [-Wincompatible-pointer-types]
strncpy(header->devname, devname, sizeof(header->devname));
^~~~~~~
/usr/include/secure/_string.h:119:34: note: expanded from macro 'strncpy'
__builtin___strncpy_chk (dest, src, len, __darwin_obsz (dest))
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
[Jo-Philipp Wich: slightly reformat commit message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Some gcc versions seem to miscompile code using ternary operators,
work around this by just returning the result if exp is 0.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
TP-Link has changed the way the region is stored in the firmware header,
and now provides US- and EU-specific images for the Archer C7. Adding the
new region codes is necessary to make LEDE/OpenWrt flashable on devices
with the new stock firmwares again.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
The CPE210 was still described for the OEM upgrade as compatible,
even the wireless configuration isn't compatible anymore between
both series (2ghz and 5ghz).
Update the CPE210 image profile to use the new profile.
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Remove the whole board list from mktplinkfw, as OpenWrt doesn't use it and
it was severely out of sync with the list of built images for ar71xx.
Also:
* fix -Wall warnings
* add const where appropriate
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 49214
This tool creates factory images for JCG routers.
Details can be found in the header comment of jcgimage.c.
Signed-off-by: Reinhard Max <reinhard@m4x.de>
Reviewed-by: Torsten Duwe <duwe@lst.de>
SVN-Revision: 48888
The new u-boot version bundled with the 5.6.x firmwares from Ubiquiti gets
confused by the smaller rootfs partition size; this can lead to various
issues:
1. We've gotten reports that flashing from the 5.6.x stock firmware to
OpenWrt will brick devices; I wasn't able to reproduce this myself
2. Flashing from 5.5.x stock firmware to OpenWrt and back to stock (via
TFTP recovery), following by an update to 5.6.x via web interface can
yield a bricked device with the following properties:
- It can't be booted without entering commands over a serial console, as
u-boot supplies the wrong MTD layout
- The web interface won't accept any image with the original flash
layout, so stock firmware upgrades are impossible
- As the TFTP recovery doesn't update u-boot, returning to the old
u-boot from firmware 5.5.x is impossible
To recover from 2., creating an OpenWrt image which doesn't set u-boot as
read-only and flashing a backup of the old u-boot from there is the only
way known to me. (Fixing the mtdparts variable in u-boot-env from OpenWrt
might also work; settings this from u-boot over serial didn't have
any permanent effect.)
Fix all of this by setting the correct flash layout also used by the stock
firmware. Flashing has been tested from both firmware 5.5.x and 5.6.x. The
fixed layout also matches the mtdparts defined by OpenWrt.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 48829
The ubdev01 profile defines its own MTDPARTS with smaller firmware
partition, so give it its own UBNT_BOARD in mkfwimage.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 48828
It has an important feature (compared to seama) of using multiple input
files, aligning them and padding zeroes until reaching a specified
absolute offset. This is needed for a proper flash layout on NAND. We
want kernel partition to be big enough to handle future updates without
a need to resize it and wipe whole "ubi" partition. It's important as
we don't want to lose block counters.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
SVN-Revision: 48601
This adds basic support for TP-Link VR200v.
Currently the following parts are not working: FXO, Voice, DECT, WIFI (both)
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
SVN-Revision: 48328
mostly implicit defines due to missing includes plus one const that
shouldn't be one.
Signed-off-by: Felix Kaechele <felix@kaechele.ca>
SVN-Revision: 47865
Due to the LWL/LWR SMP issue on BCM6368, booting with squash might fail
if the rootfs is not word aligned. As a quick fix, work around it by
ensuring this condition is always true.
Reported-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 47380
Sets the LEDs to boardname:color:led-name
Sets the LAN to eth0
Other corrections such as the Machine Name and HWIDs
v2 corrects the profile names in the Makefile and changes tabs to spaces
in the Makefile 'define Device/' like the other devices.
Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
SVN-Revision: 47221
The hardware is identical to version 1.0, add the new models to the support
list.
Also remove the empty line at the end of the support list, the current
stock images don't have it either.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 47212
The first 4 bytes of the support list and the vendor information are
supposed to contain the length of these fields.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 47211
ARM defaults to unsigned char and that breaks the calculation, as it
relies on sign extension
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
SVN-Revision: 47186
The device is similar to the TD-W8970, beside a different Atheros 2.4 GHz
wireless chip and the additional, PCI connected, WAVE300 5 GHz wireless.
Signed-off-by: Mathias Kresin <openwrt@kresin.me>
SVN-Revision: 47130
Signed-off-by: Weijie Gao <hackpascal@gmail.com>
This patch adds header version 2 option for mktplinkfw.
The version 2 header is used for AR/QCA firmwares and is not the same as
the header generated by mktplinkfw2.
Instead, it is nearly the same as version 1 header except for the header
version and the RSA signature.
The header version 2 support is used for newer TP-Link routers which have
only a 64kb bootloader part, e.g. TL-WDR6500 v2.
SVN-Revision: 46661
This patch adds support for the Onion Omega.
https://onion.io/omega
Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
Acked-by: Boken Lin <bl@onion.io>
Tested-by: Jacky Huang <huangfangcheng@163.com>
SVN-Revision: 46458
This patch adds support for the Bitmain Antminer S3 Cryptocurrency Miner
http://wiki.openwrt.org/toh/bitmain/s3
Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
SVN-Revision: 46236
The hardware should be almost the same as TL-WR720N-v3. WiFi and LAN networks
were tested by "Lo Yuk Fai <loyukfai@gmail.com>". Failsafe and slider switch
were tested by "Wong min <alpha080@gmail.com>".
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
SVN-Revision: 46046
This patch adds support for the Bitmain Antminer S1 Cryptocurrency Miner
http://wiki.openwrt.org/toh/bitmain/s1
Signed-off-by: L. D. Pinney <ldpinney@gmail.com>
Acked-by: James Hilliard <james.hilliard1@gmail.com>
SVN-Revision: 46044
VGV7519 is currently the only device with brnboot support. It seems to
be happy with 0x2083b8ed as CRC32 poly. However, VGV7510KW22 fails to
validate the checksum - it requires 0x04c11db7 instead.
I have built an brnboot image manually on the command line, once with
the old code and then with the new code but passing the old CRC32
poly value. Both resulted in a brnboot image with the same sha1sum.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
SVN-Revision: 45881
We do not need to align the start of read only rootfs's to erase blocks.
This allows us to write the squashfs rootfs directly behind the kernel,
potentially freeing up one erase block.
We still need to align for jffs2, so add a flag for imagetag to
optionally align the rootfs start.
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
SVN-Revision: 44556
memset() was called with a size argument against a pointer size, not the
structure size itself.
Signed-off-by: Florian Fainelli <florian@openwrt.org>
SVN-Revision: 43913
The new TP-LINK Pharos series uses a new bootloader, the "TP-LINK Safeloader".
It uses an advanced firmware image format, containing an image partition table
and a flash partition table (and image partitions are mapped to the
corresponding flash partitions). The exact image format is documented in the
source code.
Furthermore, the bootloader expects the kernel image as an ELF executable.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 43384
(Reposted due to an issue with the patchwork server during original submission)
Unbranded. Silkscreen on PCB is “A5-V11”, believed to be made by Bococom (or at least uses Bococom image encryption - as used on poray devices - but different key)
Signed-off-by: Gareth Bryan <gareth@mx9.org>
SVN-Revision: 43102
This patch adds factory image building for the DGN3500, all variants,
and fixes sysupgrade images to make them play nice with the sercomm
secondary boot loader.
The factory images can be used directly in the update dialog in the
interface of the stock firmware and via the special Sercomm bootmode
and a special windows flashing utility (allegedly present in the CD
that came with the device -- but it's also compatible with the NSLU2
Upgrade_207_XP utility.) The special bootmode can be activated by
turning the device on while holding the reset button pressed, then
releasing it when the power led starts blinking red and green. Please
notice that if using the 207 utility, it will always report that the
flashing failed even though it completed successfully. Just power
cycle the router manually after the utility reports the failure and
OpenWRT will boot. This same utility (despite reporting failure in
this case too) can revert a DGN3500 (any variant) to the appropriate
stock Netgear firmware.
This patch is a heavily modified version of a package I found on the
OpenWRT forum with a couple fixes and features added -- mainly the
generation of all the different image variants to support all known
models directly, atm known variants are AnnexA-WW, AnnexA-NA and
AnnexB-DE/GR.
I tested the patch successfully on my device.
Signed-off-by: Marco Antonio Mauro <marcus90@gmail.com>
SVN-Revision: 41236
Generates webflash-compatible images for a few RT2880 routers based
on Gemtek OEM boards.
Signed-off-by: Claudio Leite <leitec@staticky.com>
SVN-Revision: 40551
The version of TL-WDR4300 sold in Israel comes with a different
hardware id.
Patch-by: Daniel <daniel@makrotopia.org>
Patchwork: http://patchwork.openwrt.org/patch/5001/
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 40037
- fix crc32 calculation if -F was enabled.
- don't convert the crc32 to little endian twice.
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
SVN-Revision: 38962
A few things had to be changed to add support for these devices:
- support code patterns with 8 characters
- new board definition for the range extender device
Patchwork: http://patchwork.openwrt.org/patch/4280/
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 38685
RSPRO has 16MiB of Flash, using the following layout:
[ 2.930000] 0x000000000000-0x000000030000 : "RedBoot"
[ 2.940000] 0x000000030000-0x000000130000 : "kernel"
[ 2.950000] 0x000000130000-0x000000ff0000 : "rootfs"
[ 2.960000] 0x000000ff0000-0x000000fff000 : "FIS directory"
[ 2.970000] 0x000000fff000-0x000001000000 : "RedBoot config"
Firmware images contain kernel and rootfs, so they can use up to 0xFF0000 -
0x30000 = 0xFC0000 (15,75MiB) of space. We don't include the RedBoot and FIS
partitions and leave an extra 0xC0000 (768KiB) of space.
This is based on revision 18410 which sets the limit to 0xB00000 (11 MiB).
Signed-off-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 38484
This commit adds the basic elements to support Poray brand routers.
It contains a tool to do the encryption/obfuscation that is used in
Poray routers.
Support for Poray devices was worked on by:
Felix Kaechele <heffer@fedoraproject.org>
Luis Soltero <lsoltero@globalmarinenet.com>
Michel Stempin <michel.stempin@wanadoo.fr>
Signed-off-by: Felix Kaechele <heffer@fedoraproject.org>
SVN-Revision: 37635
Add Netgear WNCE2001.
This is a small RT3052 device with 4MB spi flash and 32MB ram.
2 built-in antennas, 1x fastE, no USB, reset & wps switch.
On my model the AP/RT switch is unpopulated, but I verified the gpio
mapping for it.
The stock firmware is running an unprotected tftpd which allows you
to read any file from the filesystem.
Serial port is present on testpads (See image on the wiki page).
There are more testpads below the shield near the SoC, which
may have JTAG.
Slight annoyance: The bootloader is checksumming kernel&rootfs, but
can be tricked by zeroing checksum and length fields in the checksum
partition, see
target/linux/ramips/base-files/lib/preinit/04_disable_wnce2001_flash_checksumming
The manufacturer image is very similar to the DAP one, so I slightly
modified mkdapimg to support generating it.
The resulting
openwrt-ramips-rt305x-wnce2001-squashfs-factory-(worldwide|northamerica).bin
can be used to flash from stock to OpenWRT using the stock firmware
upgrade function, without using the serial port.
http://www.netgear.com/landing/wnce2001.aspxhttp://wiki.openwrt.org/toh/netgear/wnce2001
Signed-off-by: Tobias Diedrich <ranma+openwrt@tdiedrich.de>
SVN-Revision: 36289
Based on the following patch:
http://patchwork.openwrt.org/patch/3043/
Signed-off-by: Cezary Jackiewicz <cezary.jackiewicz@gmail.com>
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
SVN-Revision: 34781
While the disadvantage is less available flash space, it's easy and
safe to flash without opening the device.
Going back to the original firmware is also possible.
This patch add two firmware utilities, mkbrncmdline and mkbrnboot.
mkbrncmdline patches the uncompressed kernel so the registeres a0 to
a3 are initialized and the memory size is passed in.
mkbrnboot takes the lzma compressed kernel and squashfs images and
creates a firmware image that can be flashed using the BRN-BOOT
recovery kernel, which is booted by holding both buttons when
powering up the device and will listen on http://192.168.2.1.
The firmware file from bin/lantiq/ to use is
openwrt-lantiq-danube-ARV4525PW-BRNDTW502-brnImage
The BRN-BOOT recovery kernel does size-check the image, so if it's
too big to fit into flash it will complain accordingly.
A second patch is needed to make the wired network interface work
since there is no u-boot to pre-initialise it.
Signed-off-by: Tobias Diedrich <ranma+openwrt@tdiedrich.de>
SVN-Revision: 30532
Add two helpers for generating correctly tagged images for the T-Home
Speedport W 303V Typ B as well as xor'd ones as required by CFE.
Signed-off-by: Jonas Gorski <jonas.gorski+openwrt@gmail.com>
SVN-Revision: 26877
Dual image capable CFEs store an image sequence at the same place as
currently OpenWrt stores the actual rootfs length, so it will get
overwritten when flashing through such a CFE.
To prevent this from happening, move the rootfs length field to the next
four bytes, thus completely using the reserved1 field.
Since the reserved1 field is now completely in use, it does not make sense
to allow it to be set from the imagetag utility, so remove the option.
Signed-off-by: Jonas Gorski <jonas.gorski+openwrt@gmail.com>
SVN-Revision: 26680
Same as TL-WR741ND but with different hardware ID and without
detachable antenna.
Signed-off-by: Paul Fertser <fercerpav@gmail.com>
SVN-Revision: 24811
CFE does not boot images generated with these checksums because of
wrong checksum.
After flashing then with tftp to my Asus wl500-GPv1 the following messages
are show:
Null Rescue Flag.
Boot program checksum is invalid
Hello!! Enter Rescue Mode: (Check error)
SVN-Revision: 22418
* reduce image size for CRC calculation by fs_mark size
sysupgrade sometimes failed for me and I noticed that it was due
to incorrect CRC values in trx-header after performing it.
It seems that the fs_mark was completely included in the calculation
and that it was nevertheless modified by sysupgrade while appending
the jffs data.
This only occurs for the first boot after sysupgrade as the flashmap
driver recalculates the CRC to an even smaller area when it boots.
SVN-Revision: 22396
Attached patch enhances the mktplinkfw utility:
1. existing firmware files in TP-Link format can now be inspected, showing eg. the used offsets
2. optionally the kernel and rootfs parts can be extracted (saves calculations for dd)
3. when generating firmwares, kernel entry point, load address and rootfs offset can be overwritten (for experienced users)
Patch-by: Pieter "Fate" Hollants <pieter@hollants.com>
SVN-Revision: 22169
* changed addpattern.c to preset the stable and try flags used in TRXv2 images
to dupe CFE and pretend a stable image.
* changed trx.c to calculate TRXv2 CRC with stable and try flags set to 0xFF
like CFE does on startup
* fixed compile warnings in trx.c by explicit casting
SVN-Revision: 22012
The test if a file can fit in an image considers the current offset
twice. So a image that would fit is too big.
Thanks-to: Michael Kurz <michi.kurz@googlemail.com>
SVN-Revision: 21445
- hacked addpattern due to changes in header format
- added "-5" to addpattern, some 0xFF are needed for trx2 header
"-4" broke CRC checking in CFE
- hacked trx.c due to new header format version
- added target to create trx-V2 images
the flashmap driver possibly needs to be customized.
SVN-Revision: 20433
Adds board support for the TP-Link TL-WR1043ND Based on the Atheros AP81 platform.
Presently the RTL8366RB switch support is missing due to no driver.
The ethernet works with 5 ports@1Gbit but is missing vlan support.
Hope Ive done this right, First time submiting a patch.
Signed-off-by: Andrew Tarabaras <andrew@advancedtechnologies.com.au>
SVN-Revision: 18696
This replaces the proprietary bcmImageBuilder program from the Broadcom source
drops. It basically adds a 256 bytes header in front of the kernel + rootfs
which contains a few text signatures, the locations of the data as well as the
checksums of the data and the tag. It also adds a 12 bytes header in front of
the LZMA kernel which contains the load address, kernel entry and the size of
the compressed LZMA data.
Signed-off-by: Axel Gembe <ago@bastart.eu.org>
SVN-Revision: 11170
