TP-Link TL-WR942N v1 is a 2.4 GHz single-band N450 router, based on
Qualcomm/Atheros QCA9561.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 5x 10/100 Mbps Ethernet
- 2x USB 2.0
- 11x LED (most are controlled by 74HC595)
- 2x button
- UART header on PCB*
* Serial console is disabled in OEM non-beta firmwares and corresponding
GPIO pins 14 and 15 are assigned to control USB1 and USB2 LEDs by
production (non-beta) U-Boot and firmware.
Currently not working:
1. USB1 and USB2 LEDs if UART RX and TX pins are assigned to their GPIOs
by some U-Boot versions.
Flash instruction under vendor GUI:
1. Download "lede-ar71xx-generic-tl-wr942n-v1-squashfs-factory.bin".
2. Go to WEB interface and perform usual firmware upgrade.
FLash instruction under U-Boot recovery mode (doesn't work in beta
firmware):
1. Setup PC with static IP "192.168.0.66/24" and tftp server.
2. Change "*-factory" image filename to "WR942v1_recovery.bin" and make
it available to download from your tftp server.
3. Press "reset" button and power up the router, wait till "WPS" LED
turns on.
Flash instruction under U-Boot, using UART (can be done only with
preinstalled UART-enabled U-Boot version!):
1. Use "tpl" to stop autobooting and obtain U-Boot CLI access.
2. Setup ip addresses for U-Boot and your tftp server.
3. Issue below commands:
tftp 0x81000000 lede-ar71xx-generic-tl-wr942n-v1-sysupgrade.bin
erase 0x9f020000 +$filesize
cp.b 0x81000000 0x9f020000 $filesize
reset
Signed-off-by: Serg Studzinskii <serguzhg@gmail.com>
[minor code style fixes, extended commit message]
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Some TP-Link routers (C25, C59, C60) contain a version string instead
of a binary structure in the soft_version partition.
Flashing LEDE from the original firmware's GUI, this version string
taken from the soft_ver partition of the firmware image is written to
the router's config partition.
When using tftp recovery to go back to the original Archer C25 firmware,
a version check compares that version to the version of the firmware to
be flashed.
Without proper contents in the config partition, reverting to the
original firmware fails.
Therefore, write the string "soft_ver:1.0.0\n" to that soft_ver
partition.
Signed-off-by: Jan Niehusmann <jan@gondor.com>
TP-Link TL-WA850RE v2 is a wall-plug N300 Wi-Fi range extender,
based on Qualcomm/Atheros QCA9533 v2.
Short specification:
- 550/391/195 MHz (CPU/DDR/AHB)
- 1x 10/100 Mbps Ethernet
- 32 MB of RAM (DDR1)
- 4 MB of FLASH
- 2T2R 2.4 GHz
- 2x internal antennas (embedded on PCB)
- 9x LED (all can be turned off with GPIO15), 2x button
- UART (J3) header on PCB
Flash instruction: use "factory" image directly in vendor GUI.
Warning: this device does not include any kind of recovery mechanism
in the bootloader and disassembling process is not trivial.
You can access vendor firmware over serial line using:
- login: root
- password: sohoadmin
Image was tested only in US version of the device, but should work
also with the same device version sold in other countries.
Available FLASH space, with LEDE trunk, is only 240 KB.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
some of Buffalo DHP series use slightly different trx magic, buffalo-enc,
buffalo-tag, and factory image begin with 'bgn'.
this patch adds support for building those images.
Signed-off-by: FUKAUMI Naoki <naobsd@gmail.com>
TP-Link Archer C59v1 is a dual-band AC1350 router, based on Qualcomm/Atheros
QCA9561+QCA9886.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 2T2R 5 GHz
- 5x 10/100 Mbps Ethernet
- USB 2.0 port
- 8x LED (controled by 74HC595), 3x button
- UART header on PCB
TP-Link Archer C60v1 is a dual-band AC1350 router, based on Qualcomm/Atheros
QCA9561+QCA9886.
Specification:
- 775/650/258 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 8 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 2T2R 5 GHz
- 5x 10/100 Mbps Ethernet
- 7x LED, 2x button
- UART header on PCB
Currently not working:
- Port LAN1 on C59, LAN4 on C60
- WiFi 5GHz (missing ath10k firmware for QCA9886 chip)
- Update from oficial web interface ( tplink-saveloader not support "product-info")
Flash instruction:
1. Set PC to fixed ip address 192.168.0.66
2. Download lede-ar71xx-generic-archer-cXX-v1-squashfs-factory.bin
and rename it to tp_recovery.bin
3. Start a tftp server with the file tp_recovery.bin in its root directory
4. Turn off the router
5. Press and hold Reset button
6. Turn on router with the reset button pressed and wait ~15 seconds
7. Release the reset button and after a short time
the firmware should be transferred from the tftp server
8. Wait ~30 second to complete recovery.
Flash instruction under U-Boot, using UART:
1. tftp 0x81000000 lede-ar71xx-...-sysupgrade.bin
2. erase 0x9f020000 +$filesize
3. cp.b $fileaddr 0x9f020000 $filesize
4. reset
Signed-off-by: Henryk Heisig <hyniu@o2.pl>
[Jo-Philipp Wich: remove duplicate ATH79_MACH_ARCHER_C59/C60_V1 entries]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
The firmware image that is used in TP-Link RE450 (and some more devices from
the RE series) is tplink-safeloader.
In the kernel partition, the kernel is compressed in a regular tp-link
firmware that is just used for booting. Since it is only used for compressing
and booting, only four fields are filled in the header:
Vendor, version, kernel load address and kernel entry point.
mktplinkfw-kernel is a simpler version of mktpolinkfw that generate such
images. It also specifies the hardware id (as it is in the product info
section), so when doing a sysupgrade - the existing code will check for
hardware compatibility.
Signed-off-by: Tal Keren <kooolk@gmail.com>
[rd@radekdostal.com: add build target to .../image/tp-link.mk]
Signed-off-by: Radek Dostál <rd@radekdostal.com>
The TL-WR1043ND v4 uses a kernel image with a mktplinkfw header inside the
os-image partition of a tplink-safeloader image.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
In order to make it easier to add new boards in the future, refactor the code
to describe the image layouts of supported boards in a struct array and alter
the image generation routines to figure out the sysupgrade partitions
automatically.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Adds support for new EU and US variants; removes a few strings that were
never actually used and have been removed from the stock firmwares.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Our current implementation is pretty old and uses some pre-standard/old
ANSI C style that triggers warnings like:
warning: call to function 'MD5_Init' without a real prototype [-Wunprototyped-calls]
This is caused by declarations specified in a following way:
src/md5.h:60:6: note: 'MD5_Init' was declared here
void MD5_Init ();
Having these warnings makes it harded to notice real problems. We could
try hiding them but it makes more sense to just use a cleaner code.
Another tiny gain from this switch is slightly reduced binary size, on
x86_64 tplink-safeloader's size 48104 became 48003.
The new code is public domain, uses "heavily cut-down BSD license".
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Earlier compilers such as GCC 4 do not like anynomous unions, make it a named
union "u", and update the code where relevant.
Fixes FS#298
Fixes: a72e1692b8 ("firmware-utils: Add support for the Cisco Meraki MX60/MX60W")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
This patch adds header support for the Cisco Meraki MX60/MX60W, which
are a part of the apm821xx target. Some structure changes were needed
due to the fact this device uses U-Boot (unlike other devices in
mkmerakifw.c) which uses a different header structure to define the load
offsets for the image.
A thanks to Christian for helping implement this properly.
Cc: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Chris Blake <chrisrblake93@gmail.com>
Recent refactoring introduced a regression. It ignored second argument
of make_support_list function which was originally true for C2600. The
new generic build_image function always passes false.
This patch allows specifying trailing char in a device specific info. It
also switches Archer C9 to the \0 char to make it compliant with vendor
images.
I verified generated images to be binary identical to the ones that
were created before whole refactoring.
Reported-by: Jo-Philipp Wich <jo@mein.io>
Fixes: fd924d2068 ("firmware-utils: tplink-safeloader: use one function for generating images")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Looking into /usr/include/stdlib.h, there's a `devname()` function defined
under some #ifdef's which conflicts with the `static char *devname` definition
in `src/mkwrggimg.c`.
Defining `_ANSI_SOURCE` in the `src/mkwrggimg.c` file, omits that part of the
header.
Another more intrusive approach is to rename `devname` to something like
`g_devname` in `src/mkwrggimg.c`. But I think the `_ANSI_SOURCE` define should
be enough.
Compilation error is:
src/mkwrggimg.c:64:14: error: redefinition of 'devname' as different kind of symbol
static char *devname;
^
/usr/include/stdlib.h:286:7: note: previous definition is here
char *devname(dev_t, mode_t);
^
src/mkwrggimg.c:147:12: error: non-object type 'char *(dev_t, mode_t)' (aka 'char *(int, unsigned short)') is not assignable
devname = optarg;
~~~~~~~ ^
src/mkwrggimg.c:192:6: warning: comparison of function 'devname' equal to a null pointer is always false [-Wtautological-pointer-compare]
if (devname == NULL) {
^~~~~~~ ~~~~
src/mkwrggimg.c:192:6: note: prefix with the address-of operator to silence this warning
if (devname == NULL) {
^
&
src/mkwrggimg.c:251:27: warning: incompatible pointer types passing 'char *(dev_t, mode_t)' (aka 'char *(int, unsigned short)') to parameter of type 'const char *' [-Wincompatible-pointer-types]
strncpy(header->devname, devname, sizeof(header->devname));
^~~~~~~
/usr/include/secure/_string.h:119:34: note: expanded from macro 'strncpy'
__builtin___strncpy_chk (dest, src, len, __darwin_obsz (dest))
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
[Jo-Philipp Wich: slightly reformat commit message]
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Some gcc versions seem to miscompile code using ternary operators,
work around this by just returning the result if exp is 0.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
TP-Link has changed the way the region is stored in the firmware header,
and now provides US- and EU-specific images for the Archer C7. Adding the
new region codes is necessary to make LEDE/OpenWrt flashable on devices
with the new stock firmwares again.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
The CPE210 was still described for the OEM upgrade as compatible,
even the wireless configuration isn't compatible anymore between
both series (2ghz and 5ghz).
Update the CPE210 image profile to use the new profile.
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Remove the whole board list from mktplinkfw, as OpenWrt doesn't use it and
it was severely out of sync with the list of built images for ar71xx.
Also:
* fix -Wall warnings
* add const where appropriate
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 49214
This tool creates factory images for JCG routers.
Details can be found in the header comment of jcgimage.c.
Signed-off-by: Reinhard Max <reinhard@m4x.de>
Reviewed-by: Torsten Duwe <duwe@lst.de>
SVN-Revision: 48888
The new u-boot version bundled with the 5.6.x firmwares from Ubiquiti gets
confused by the smaller rootfs partition size; this can lead to various
issues:
1. We've gotten reports that flashing from the 5.6.x stock firmware to
OpenWrt will brick devices; I wasn't able to reproduce this myself
2. Flashing from 5.5.x stock firmware to OpenWrt and back to stock (via
TFTP recovery), following by an update to 5.6.x via web interface can
yield a bricked device with the following properties:
- It can't be booted without entering commands over a serial console, as
u-boot supplies the wrong MTD layout
- The web interface won't accept any image with the original flash
layout, so stock firmware upgrades are impossible
- As the TFTP recovery doesn't update u-boot, returning to the old
u-boot from firmware 5.5.x is impossible
To recover from 2., creating an OpenWrt image which doesn't set u-boot as
read-only and flashing a backup of the old u-boot from there is the only
way known to me. (Fixing the mtdparts variable in u-boot-env from OpenWrt
might also work; settings this from u-boot over serial didn't have
any permanent effect.)
Fix all of this by setting the correct flash layout also used by the stock
firmware. Flashing has been tested from both firmware 5.5.x and 5.6.x. The
fixed layout also matches the mtdparts defined by OpenWrt.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 48829
The ubdev01 profile defines its own MTDPARTS with smaller firmware
partition, so give it its own UBNT_BOARD in mkfwimage.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
SVN-Revision: 48828
