Sander Vanheule [Fri, 3 Feb 2023 22:03:15 +0000 (23:03 +0100)]
tplink-safeloader: stricter free_image_partition()
Instead of only free()-ing the allocated data block, also clear the name
and size of a payload entry to indicate that it's become invalid.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Mark Ceeha [Sun, 29 Jan 2023 14:28:42 +0000 (15:28 +0100)]
tplink-safeloader: Add support for Deco M4R V4
Software version:
soft_ver:1.0.0 Build
20211202 Rel. 69482
Partition table:
00000000 00040000 fs-uboot
00040000 00400000 os-image
00440000 00b60000 file-system
00fa0000 00000300 default-mac
00fa0300 00000100 device-id
00fa0400 0000fc00 product-info
00fb0000 00004000 group-info
00fb4000 0000c000 user-config
00fc0000 00010000 device-config
00fd0000 00010000 default-config
00fe0000 00000800 partition-table
00fe0800 00000100 soft-version
00fe0900 00000200 support-list
00fe0b00 00003000 profile
00fe3b00 00000100 extra-para
00ff0000 00010000 radio
`os-image` and `file-system` have been merged into `firmware`.
Signed-off-by: Mark Ceeha <hi@shiz.me>
Andrew Cameron [Wed, 9 Nov 2022 13:23:01 +0000 (13:23 +0000)]
tplink-safeloader: add TP-Link CPE605 v1 Support
Enable creating images compatible with the TP-Link CPE605 v1 Router
Original partitions from stock firmware are:
partition fs-uboot base 0x00000 size 0x20000
partition partition-table base 0x20000 size 0x02000
partition default-mac base 0x30000 size 0x00020
partition serial-number base 0x30100 size 0x00020
partition product-info base 0x31100 size 0x00100
partition device-info base 0x31400 size 0x00400
partition signature base 0x32000 size 0x00400
partition device-id base 0x33000 size 0x00100
partition os-image base 0x40000 size 0x170000
partition soft-version base 0x1b0000 size 0x00100
partition support-list base 0x1b1000 size 0x01000
partition file-system base 0x1c0000 size 0x600000
partition user-config base 0x7c0000 size 0x10000
partition default-config base 0x7d0000 size 0x10000
partition log base 0x7e0000 size 0x10000
partition radio base 0x7f0000 size 0x10000
The 'soft-version' and 'support-list' partitions are relocated afther the
'file-system' partition. This creates ones contiguous firmware area,
allowing for dynamic partition splitting.
Tested by forum user ruildias
Signed-off-by: Andrew Cameron <apcameron@softhome.net>
[add original partition overview and note on relocation commit message,
update support_list and part_trail properties to match vendor FW]
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Yoonji Park [Sat, 4 Jun 2022 09:08:07 +0000 (09:08 +0000)]
iptime-crc32: add support for A6004MX
Add support for A6004MX image creation.
Signed-off-by: Yoonji Park <koreapyj@dcmys.kr>
Nick French [Sat, 13 Aug 2022 18:51:52 +0000 (13:51 -0500)]
tplink-safeloader: add TP-Link Deco S4 v2 support
Support creating images for TP-Link Deco S4R v2.
Original partition layout from OEM image:
partition fs-uboot base 0x00000 size 0x80000
partition product-info base 0x80000 size 0x05000
partition default-mac base 0x85000 size 0x01000
partition device-id base 0x86000 size 0x01000
partition support-list base 0x87000 size 0x10000
partition user-config base 0xa7000 size 0x10000
partition device-config base 0xb7000 size 0x10000
partition group-info base 0xc7000 size 0x10000
partition partition-table base 0xd7000 size 0x02000
partition soft-version base 0xd9000 size 0x10000
partition profile base 0xe9000 size 0x10000
partition default-config base 0xf9000 size 0x10000
partition url-sig base 0x1e0000 size 0x10000
partition radio base 0x1f0000 size 0x10000
partition os-image base 0x200000 size 0x200000
partition file-system base 0x400000 size 0xc00000
The 'os-image' and 'file-system' partitions were merged into 'firmware'
to make use of the automatic mtd split.
Signed-off-by: Nick French <nickfrench@gmail.com>
Jan Hoffmann [Wed, 27 Jul 2022 19:31:44 +0000 (21:31 +0200)]
mkh3cvfs: add filesystem tool for H3C devices
The bootloader can only boot images from a custom filesystem which
normally spans most of the flash on the device. This tool creates a
filesystem image containing a single file (which should be a firmware
image created using mkh3cimg).
The size of the filesystem is hardcoded in the bootloader. However, an
image that is only slightly larger than its content is sufficient, as
long as no write operations are performed in the bootloader menu. This
allows to append further data (i.e. rootfs) after the end of the
filesystem image.
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
Jan Hoffmann [Wed, 27 Jul 2022 19:31:43 +0000 (21:31 +0200)]
mkh3cimg: add image tool for H3C devices
Firmware images for these devices can contain multiple files, such as
application files or bootloader images. This tool only creates images
with a single application file. In the case of OpenWrt, this is going
to contain the kernel image.
Compressed files are supported by the image format, in this case the
supplied input file needs to be a 7z archive with LZMA compression.
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
André Valentin [Fri, 17 Jun 2022 18:26:27 +0000 (20:26 +0200)]
firmware-utils: Add support for ZyXEL LTE3301-Plus
Add header mapping for ZyXEL LTE3301-Plus to zytrx.
Signed-off-by: André Valentin <avalentin@marcant.net>
Sander Vanheule [Mon, 27 Jun 2022 16:31:24 +0000 (18:31 +0200)]
tplink-safeloader: drop unqualified EAP225-V3 IDs
After adding the regionless identifiers in commit
9563fe8e78cb
("tplink-safeloader: add regionless EAP225-V3 IDs"), the generated
support-list partition exceeded the allocated space of 256 bytes. This
resulted in the tool failing to generate factory images with the
following warning:
support-list partition too big (more than 256 bytes): Success
Although this message reports "Success", the tool actually fails with a
return code of 1.
This essentialy reverts commit
9563fe8e78cb, since the region-qualified
IDs are also compatible with the non region-qualified devices. The
change makes the generated support-list partition fit within the
allocated space again.
Tested-by: Andre Klärner <kandre@ak-online.be>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Sander Vanheule [Sun, 26 Jun 2022 14:43:07 +0000 (16:43 +0200)]
tplink-safeloader: fix EAP225-Outdoor model IDs
The model IDs for EAP225-Outdoor v1 and EAP225-Outdoor v3 contain
"AC1200". The corresponding identifiers grouped under EAP225-V3 contain
"AC1350" however, which is a copy-paste error from the EAP225 v3/v3.2/v4
IDs. Modify the strings in SupportList to actually match the ones on devices.
Fixes: 9563fe8e78cb ("tplink-safeloader: add regionless EAP225-V3 IDs")
Fixes: 365458e00ed7 ("tplink-safeloader: join EAP225-V3 compatible devices")
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Sander Vanheule [Sun, 26 Jun 2022 14:30:34 +0000 (16:30 +0200)]
tplink-safeloader: add regionless EAP225-V3 IDs
Devices whose model ID does not contain a region identifier will not
match the "CA" and "CA,JP" qualified model IDs in the current EAP225-V3
SupportList. This results in the stock firmware giving the following
error when trying to flash a factory image:
Upgrade failed because the firmware is incompatible
Add the IDs without region qualifiers to also support these devices.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Yoonji Park [Sat, 4 Jun 2022 10:50:57 +0000 (10:50 +0000)]
tplink-safeloader: Add support for Mercusys MR70X
Add support for Mercusys MR70X image creation.
Software version:
soft_ver:1.0.3 Build
20201222 Rel. 50381
Partition table:
00000000 00040000 fs-uboot
00040000 00400000 os-image
00440000 00b60000 file-system
00fa0000 00000200 default-mac
00fa0200 00000100 pin
00fa0300 00000100 device-id
00fa0400 0000fc00 product-info
00fb0000 00008000 default-config
00fb8000 00008000 ap-def-config
00fc0000 0000c000 user-config
00fcc000 00004000 certificate
00fd0000 00008000 ap-config
00fd8000 00008000 router-config
00fe0000 00000800 partition-table
00fe0800 00000100 soft-version
00fe0900 00000200 support-list
00fe0b00 00003000 profile
00fe3b00 00000100 extra-para
00ff0000 00010000 radio
os-image and file-system is merged for dynamic split.
Signed-off-by: Yoonji Park <koreapyj@dcmys.kr>
Sander Vanheule [Thu, 26 May 2022 07:11:29 +0000 (09:11 +0200)]
tplink-safeloader: join EAP225-V3 compatible devices
Since FW v5.0.0, TP-Link has provided unified firmware images for
EAP225-v3 and EAP225-Outdoor-v1 devices. Although there may be hardware
differences, the relevant details for image generation are identical.
More recently, the following devices have also been added to the support
list:
- EAP225-v3.20
- EAP225-Outdoor-v3
- EAP225-v4
The country codes appended the device descriptors were introduced with
FW v5.0.7: "Combined firmware versions for different countries/regions."
The release notes provide no further upgrade instructions, so these
firmware images should be backwards compatible.
Add the new compatible devices, with region codes, to the support list
of the EAP225-V3 board ID. The now redundant EAP225-OUTDOOR-V1 ID will
be dropped later.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Sander Vanheule [Thu, 26 May 2022 07:00:08 +0000 (09:00 +0200)]
tplink-safeloader: fix chunked support-list prints
When reading long support-list partitions, to print out as image info,
the string is read in chunks of 128 bytes. However, in cases where there
is more than one chunk, they are not properly terminated. This leads to
an out-of-bounds access by puts() printing the buffer chunks.
Ensure the read partial string is always NULL terminated, and print
chunk by chunk without extra line terminations. Terminate still with a
newline to maintain current behaviour.
Fixes: e1d76f4e8721 ("firmware-utils: tplink-safeloader: support displaying fw info")
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Ole Kristian Lona [Mon, 16 May 2022 13:50:06 +0000 (15:50 +0200)]
tplink-safeloader: Patch to handle partitions with alternate names.
Some devices, specifically Deco M4R-v3 / M5 have partition names that
deviate from the scheme other devices use. They have an added "@0"
and "@1" for some partition names.
The devices have fallback partitions which will be used in case the
device determines that the primary partition set is unbootable.
This patch introduces an option to set these alternate partition names
in the device definition of tplink-safeloader.
Signed-off-by: Ole Kristian Lona <oklo@oklona.net>
Reviewed-by: Sander Vanheule <sander@svanheule.net>
Stijn Segers [Sun, 8 May 2022 11:31:12 +0000 (13:31 +0200)]
firmware-utils: tplink-safeloader: add support for Archer A6 v2 (EU)
The Archer A6 v2 (EU) matches the C6 v2 (EU) and uses the same firmware ID.
See also https://forum.openwrt.org/t/tp-link-archer-a6-v2-0-cannot-install/119403/34.
Tested-by: Kamil Jońca <kjonca@poczta.onet.pl>
Signed-off-by: Stijn Segers <foss@volatilesystems.org>
Sander Vanheule [Fri, 29 Apr 2022 18:19:36 +0000 (20:19 +0200)]
tplink-safeloader: fix alphabetical order
DECO-M4R-V1 was added after EAP615-WALL, but that's not how the alphabet
is sorted. Move it in between 'ARCHER' and 'EAP'.
Reported-by: Ole Kristian Lona <ole.kristian@lona.name>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Sander Vanheule [Sun, 20 Mar 2022 11:55:14 +0000 (12:55 +0100)]
tplink-safeloader: add TP-Link EAP265 HD support
The FCC ID request for this device indicates that the hardware is
identical to the EAP245v3. Since FW 5.0.0, TP-Link provides unified
images for both devices.
Partial output of 'tplink-safeloader -i':
[Software version]
Version: 5.0.4
Date: 2021-10-21
Revision: 57494
[Support list]
SupportList:
EAP245(TP-Link|UN|AC1750-D):3.0
EAP265 HD(TP-Link|UN|AC1750-D):1.0
Link: https://fccid.io/TE7EAP265HD/Letter/6-Request-for-FCC-Change-ID-4823578.pdf
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Foica David [Sun, 24 Apr 2022 16:09:51 +0000 (19:09 +0300)]
tplink-safeloader: add TP-Link Deco M4R v1 and v2 support
Support creating images for TP-Link Deco M4R v1 and v2.
Original partition layout from OEM image:
partition fs-uboot base 0x00000 size 0x80000
partition os-image base 0x80000 size 0x200000
partition file-system base 0x280000 size 0xc00000
partition product-info base 0xe80000 size 0x05000
partition default-mac base 0xe85000 size 0x01000
partition device-id base 0xe86000 size 0x01000
partition support-list base 0xe87000 size 0x10000
partition user-config base 0xea7000 size 0x10000
partition device-config base 0xeb7000 size 0x10000
partition group-info base 0xec7000 size 0x10000
partition partition-table base 0xed7000 size 0x02000
partition soft-version base 0xed9000 size 0x10000
partition profile base 0xee9000 size 0x10000
partition default-config base 0xef9000 size 0x10000
partition url-sig base 0xfe0000 size 0x10000
partition radio base 0xff0000 size 0x10000
The 'os-image' and 'file-system' partitions were merged into 'firmware'
to make use of the automatic mtd split.
The first 2 versions of the device use the same firmware image,
v3 and v4 are different.
Signed-off-by: Foica David <superh552@gmail.com>
Marcin Gordziejewski [Thu, 7 Apr 2022 18:43:25 +0000 (20:43 +0200)]
tplink-safeloader: TP-Link RE650 v2 support
Support creating images for TP-Link RE650 v2.
Partition table pulled from OEM firmware on the device:
partition fs-uboot base 0x00000 size 0x20000
partition os-image base 0x20000 size 0x330000
partition file-system base 0x350000 size 0x470000
partition partition-table base 0x7c0000 size 0x02000
partition default-mac base 0x7c2000 size 0x00020
partition pin base 0x7c2100 size 0x00020
partition product-info base 0x7c3100 size 0x01000
partition soft-version base 0x7c4200 size 0x01000
partition support-list base 0x7c5200 size 0x01000
partition profile base 0x7c6200 size 0x08000
partition config-info base 0x7ce200 size 0x00400
partition user-config base 0x7d0000 size 0x10000
partition default-config base 0x7e0000 size 0x10000
partition radio base 0x7f0000 size 0x10000
One notable difference from v1 in terms of safeloader, is that it requires
soft_ver to be defined for device to accept the firmware, otherwise it
otherwise it denies the firmware file. Version v1 has also 16MB of Flash
instead of 8MB that v2 has, so the paritions had to be shrinked
accordingly.
In OpenWRT "firmware" partition is merged into one, it's made out of
os-image and file-system partitions.
Signed-off-by: Marcin Gordziejewski <openwrt@flicksfix.com>
Rosen Penev [Mon, 28 Feb 2022 07:34:26 +0000 (23:34 -0800)]
firmware-utils: fix compilation with macOS
__bswap_32 is a GNU extension.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Acked-by: Paul Spooren <mail@aparcar.org>
Piotr Dymacz [Sat, 26 Feb 2022 22:54:03 +0000 (23:54 +0100)]
tplink-safeloader: add TP-Link Archer A9 v6 support
Support creating images compatible with TP-Link Archer A9 v6.
Original partition layout:
partition factory-boot base 0x00000 size 0x20000
partition fs-uboot base 0x20000 size 0x20000
partition partition-table base 0x40000 size 0x10000
partition radio base 0x50000 size 0x10000
partition default-mac base 0x60000 size 0x00200
partition pin base 0x60200 size 0x00200
partition device-id base 0x60400 size 0x00100
partition product-info base 0x60500 size 0x0fb00
partition soft-version base 0x70000 size 0x01000
partition extra-para base 0x71000 size 0x01000
partition support-list base 0x72000 size 0x0a000
partition profile base 0x7c000 size 0x04000
partition user-config base 0x80000 size 0x10000
partition ap-config base 0x90000 size 0x10000
partition apdef-config base 0xa0000 size 0x10000
partition router-config base 0xb0000 size 0x10000
partition os-image base 0xc0000 size 0x120000
partition file-system base 0x1e0000 size 0xde0000
partition log base 0xfc0000 size 0x20000
partition certificate base 0xfe0000 size 0x10000
partition default-config base 0xff0000 size 0x10000
To make use of automatic mtd split, the 'os-image' and 'file-system'
partitions were merged into 'firmware' for OpenWrt.
There are only 3 official vendor's firmware releases for this device,
all were successfully tested for migration to OpenWrt:
1.1.1 Build
20210315 rel.40637
1.0.6 Build
20200114 rel.73164
1.0.3 Build
20190226 rel.62939
According to the 'SupportList' from vendor's latest firmware release,
this hardware might be also available under name 'Archer C90 v6',
probably dedicated for US market:
SupportList:
{product_name:Archer A9,product_ver:6.0,special_id:
55530000}
{product_name:Archer A9,product_ver:6.0,special_id:
45550000}
{product_name:Archer A9,product_ver:6.0,special_id:
52550000}
{product_name:Archer A9,product_ver:6.0,special_id:
4A500000}
{product_name:Archer C90,product_ver:6.0,special_id:
55530000}
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Joe Mullally [Tue, 22 Feb 2022 23:59:51 +0000 (23:59 +0000)]
tplink-safeloader: add TL-WPA8631P v3 support
Enable creating images compatible with TP-Link's TL-WPA8631P powerline router.
This matches all current firmwares for all revisions and regions.
Users with older EU "Build
20200314 Rel.3608" & EU "Build
20200508 Rel.41814"
should first upgrade to EU "Build
20200927 Rel.61199" or later before flashing.
The original partition layout is as follows:
partition fs-uboot base 0x00000 size 0x20000
partition os-image base 0x20000 size 0x330000
partition file-system base 0x350000 size 0x3e0000
partition partition-table base 0x730000 size 0x02000
partition default-mac base 0x732000 size 0x00020
partition pin base 0x732100 size 0x00020
partition device-id base 0x732200 size 0x00030
partition default-region base 0x732300 size 0x00010
partition product-info base 0x732400 size 0x00200
partition extra-para base 0x732600 size 0x00200
partition soft-version base 0x732800 size 0x00200
partition support-list base 0x732a00 size 0x00100
partition profile base 0x732b00 size 0x00100
partition default-config base 0x732c00 size 0x00800
partition plc-type base 0x733400 size 0x00020
partition default-pib base 0x733500 size 0x06000
partition user-config base 0x740000 size 0x10000
partition plc-pib base 0x750000 size 0x10000
partition plc-nvm base 0x760000 size 0x90000
partition radio base 0x7f0000 size 0x10000
For OpenWrt, the os-image and file-system partition are merged into one
firmware partition, to enable dynamic rootfs partition splits.
Review of partitions in all known firmwares. This patch supports
layout md5sum
0771948573fffa726b8927ca6259ea16.
filename
grep -ao "partition .*$" filename | md5sum
support_list
wpa8631pv3_eu-up-ver3-0-0-P1-
20200314-rel3608.bin
33df2a8474670e785fb487dc9392dadf
{product_name:TL-WPA8631P,product_ver:3.0.0,special_id:
45550000}
wpa8631pv3_eu-up-ver3-0-0-P1-
20200508-rel41814-APPLC.bin
68f3408ac2310e81fead071be4238aa9
{product_name:TL-WPA8631P,product_ver:3.0.0,special_id:
45550000}
wpa8631pv3_us-up-ver3-0-0-P1-
20200820-rel39000-APPLC.bin
0771948573fffa726b8927ca6259ea16
{product_name:TL-WPA8631P,product_ver:3.0.0,special_id:
55530000}
wpa8631pv3_eu-up-ver3-0-0-P1-
20200927-rel61199-APPLC.bin
0771948573fffa726b8927ca6259ea16
{product_name:TL-WPA8631P,product_ver:3.0.0,special_id:
45550000}
wpa8631pv3_eu-up-ver3-0-0-P1-
20210514-rel45003-APPLC.bin
0771948573fffa726b8927ca6259ea16
{product_name:TL-WPA8631P,product_ver:3.0.0,special_id:
45550000}
wpa8631pv3_us-up-ver3-0-0-P1-
20210625-rel35759-APPLC.bin
0771948573fffa726b8927ca6259ea16
{product_name:TL-WPA8631P,product_ver:3.0.0,special_id:
55530000}
wpa8631pv3_au-up-ver3-0-0-P1-
20210625-rel42417-APPLC.bin
0771948573fffa726b8927ca6259ea16
{product_name:TL-WPA8631P,product_ver:3.0.0,special_id:
41550000}
Signed-off-by: Joe Mullally <jwmullally@gmail.com>
[pepe2k@gmail.com: added 'TL-' prefix in model name, in commit desc]
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Stijn Tintel [Thu, 27 Jan 2022 09:35:54 +0000 (11:35 +0200)]
tplink-safeloader: TP-Link EAP615-Wall v1 support
Support creating images for the TP-Link EAP615-Wall v1.
Original partition layout:
partition fs-uboot base 0x00000 size 0x80000
partition partition-table base 0x80000 size 0x02000
partition default-mac base 0x90000 size 0x01000
partition support-list base 0x91000 size 0x00100
partition product-info base 0x91100 size 0x00400
partition soft-version base 0x92000 size 0x00100
partition os-image base 0xa0000 size 0x380000
partition file-system base 0x420000 size 0x970000
partition user-config base 0xd90000 size 0x60000
partition mutil-log base 0xf30000 size 0x80000
partition oops base 0xfb0000 size 0x40000
partition radio base 0xff0000 size 0x10000
In OpenWrt, the os-image and file-system partitions are merged into a
single firmware partition.
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Sander Vanheule <sander@svanheule.net>
Kim Namu [Wed, 9 Feb 2022 14:43:28 +0000 (23:43 +0900)]
iptime-crc32: add support for AX8004M
This commit is preparations for adding support for device AX8004M
similar to AX2004M.
Signed-off-by: Kim Namu <namu@theseed.io>
Daniel Kestrel [Mon, 17 Jan 2022 08:36:29 +0000 (09:36 +0100)]
firmware-utils: support checksum for AVM fritzbox wasp SOCs
This patch adds creating the checksum to be able to create an
image and boot the secondary ath79 based wireless assist (WASP)
SoC with a second instance of OpenWrt for some AVM Fritzbox
devices (3390, 3490, 5490, 7490).
The utility is called avm-wasp-checksum and was originally
created by Andreas Boehler.
Signed-off-by: Daniel Kestrel <kestrel1974@t-online.de>
João Orui [Thu, 3 Feb 2022 15:30:28 +0000 (00:30 +0900)]
tplink-safeloader: support for Archer A6 v3 JP
Add the missing tp-link firmware ID for the TP-Link Archer A6 v3 (JP)
Signed-off-by: João Orui <joao@joao.jp>
Sungbo Eo [Tue, 4 Jan 2022 14:47:27 +0000 (23:47 +0900)]
iptime-crc32: add image header tool for new ipTIME models
Some ipTIME models (e.g. A8004T-XR) started to use a new 56-byte header
format which uses accumulated CRC-32 for its checksum algorithm. This tool
helps to pass through the factory image verification process on the
applicable models.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Sungbo Eo [Sat, 1 Jan 2022 08:03:35 +0000 (17:03 +0900)]
iptime-naspkg: add image header tool for ipTIME NAS series
The purpose of this tool is to pass the factory image verification process,
and it does not provide a full image with kernel and rootfs. The tool prepends
a factory header to kernel image, and rootfs should be appended separately.
This tool has been developed and tested on NAS1 and NAS1dual, but it can
also be used on other similar models with additional tweaking.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Brian Norris [Sun, 16 Jan 2022 05:48:31 +0000 (21:48 -0800)]
cros-vbutil: add Chrome OS vboot kernel-signing utility
Chrom{ium,e} OS based devices use a Coreboot+Depthcharge-based firmware,
which verifies and loads a kernel packed in a verified-boot payload. The
verification tooling (both for creating and verifying payloads) is
implemented here:
https://chromium.googlesource.com/chromiumos/platform/vboot_reference
Devices running such bootloaders also tend to support a "developer
mode," where a device can be unlocked to run arbitrary kernel payloads,
using the same verified-boot format plus well-known developer keys. More
information can be found here:
https://chromium.googlesource.com/chromiumos/docs/+/master/developer_mode.md
Rather than build and package the vboot_reference utilities as part of
the base OpenWRT tools, I chose to reimplement just the portion that's
required for signing payloads. I also embed the developer key directly
in the source for convenience, though it's certainly possible to
provide other keys too, if one were to build their own firmware that
accepts it.
This tool is essentially the same as running something like this, using
the Chromium OS tooling:
vbutil_kernel --pack kernel_partition.bin \
--keyblock /usr/share/vboot/devkeys/kernel.keyblock \
--signprivate /usr/share/vboot/devkeys/kernel_data_key.vbprivk \
--version 1 \
--vmlinuz kernel.bin \
--bootloader zero.txt \
--config commnad_line.txt \
--arch ${ARCH}
I have also packaged the Chromium OS vboot_reference tooling for the
packages feed, as it can be useful beyond simply creating a bootable
image (e.g., manipulating Chromium OS specific GPT attributes, handling
other NVRAM attributes, vboot packing/unpacking/verifying):
https://github.com/openwrt/packages/pull/12829
The vboot_reference tools are released by Google under a BSD 3-clause
license. I've provided the original license text as well as a GPL-2
notice for my modifications (essentially just borrowing the data
structures and rewriting everything else).
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Brian Norris [Sun, 16 Jan 2022 05:48:30 +0000 (21:48 -0800)]
ptgen: add Chromium OS kernel partition support
Chrom{ium,e} OS (shortened as "CrOS") bootloaders use a custom GPT
partition type to locate their kernel(s), with custom attributes for
noting properties around which partition(s) should be active and how
many times they've been tried as part of their A/B in-place upgrade
system.
OpenWRT doesn't use A/B updates for upgrades (instead, just shutting
things down far enough to reprogram the necessary partitions), so all we
need to do is tell the bootloader which one is the kernel partition, and
how to use it (i.e., set the "successful" and "priority" attributes).
ptgen already supports some basic GPT partition creation, so just
add support for a '-T <GPT partition type>' argument. Currently, this
only supports '-T cros_kernel', but it could be extended if there are
other GPT partition types needed.
For GPT attribute and GUID definitions, see the CrOS verified boot
sources:
https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/refs/heads/master/firmware/lib/cgptlib/include/cgptlib_internal.h
https://chromium.googlesource.com/chromiumos/platform/vboot_reference/+/refs/heads/master/firmware/include/gpt.h
Wikipedia (!!) even notes the GUIDs:
https://en.wikipedia.org/wiki/GUID_Partition_Table#Partition_type_GUIDs
The GUID is also recognized in fdisk, and likely other utilities, but
creation/manipulation is typically done via the 'cgpt' utility, provided
as part of the Chromium vboot_reference project.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Henrique de Moraes Holschuh [Wed, 8 Dec 2021 13:14:57 +0000 (10:14 -0300)]
tplink-safeloader: support Archer C6v3.0 (BR)
Add the missing tp-link firmware ID for the TP-Link Archer C6v3.0 (BR),
which is currently sold in Brazil. It uses exactly the same vendor
firmware as the A6v3 and C6v3.20.
Signed-off-by: Henrique de Moraes Holschuh <henrique@nic.br>
Matthias Schiffer [Fri, 14 Jan 2022 22:08:49 +0000 (23:08 +0100)]
tplink-safeloader: fix Archer A7v5 factory flashing from vendor fw > v1.1.x
Apply the same fix that was previously done for the Archer C7v5 to the
A7v5 as well to make the web UI accept our images again.
Tested-by: Luflosi <luflosi@luflosi.de>
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Rafał Miłecki [Sat, 27 Nov 2021 15:31:04 +0000 (16:31 +0100)]
otrx: support TRX from stdin when extracting
It allows e.g.
dd if=firmware.chk skip=1 bs=58 | otrx extract - -1 kernel.bin
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Sat, 27 Nov 2021 15:31:03 +0000 (16:31 +0100)]
otrx: support unsorted partitions offsets
TRX format doesn't guarantee that it contains partitions offsets in a
sorted order. Store partitions info in context struct and make sure it's
sorted.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Sat, 27 Nov 2021 15:31:02 +0000 (16:31 +0100)]
otrx: extract shared code opening & parsing TRX format
This avoids some code duplication.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 26 Nov 2021 16:17:08 +0000 (17:17 +0100)]
oseama: support extracting entity to stdout
This allows using oseama in a pipe. It's very useful for writing data to
flash using e.g.
oseama extract firmware.bin -e 0 | mtd write - firmware
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 26 Nov 2021 16:17:07 +0000 (17:17 +0100)]
oseama: allow reading from stdin
This adds support for reading Seama seal from stdin when using "info" or
"extract" command. It allows e.g.
cat firmware.bin | oseama info -
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 26 Nov 2021 06:41:17 +0000 (07:41 +0100)]
otrx: allow validating TRX from stdin
This makes "otrx check" work with stdin to allow e.g.
dd if=firmware.chk skip=1 bs=58 | otrx check -
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 26 Nov 2021 06:23:10 +0000 (07:23 +0100)]
otrx: avoid unneeded fseek() when calculating CRC32
Just use already read data.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Sander Vanheule [Sat, 20 Nov 2021 13:06:56 +0000 (14:06 +0100)]
tplink-safeloader: add EAP225 v1 support
Allow creating images compatible with TP-Link's EAP225v1 access point.
The original partition layout is as follows:
partition fs-uboot base 0x00000 size 0x20000
partition partition-table base 0x20000 size 0x02000
partition default-mac base 0x30000 size 0x01000
partition support-list base 0x31000 size 0x00100
partition product-info base 0x31100 size 0x00400
partition soft-version base 0x32000 size 0x00100
partition os-image base 0x40000 size 0x180000
partition file-system base 0x1c0000 size 0xc00000
partition user-config base 0xdc0000 size 0x30000
partition radio base 0xff0000 size 0x10000
For OpenWrt, the os-image and file-system partition are merged into one
firmware partition, to enable dynamic rootfs partition splits.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Alexandru Ardelean [Fri, 29 Oct 2021 08:54:44 +0000 (11:54 +0300)]
build, cmake: switch OPENSSL_CRYPTO_LIBRARY -> OPENSSL_CRYPTO_LIBRARIES
OPENSSL_CRYPTO_LIBRARY returns just the full path to libcrypto.a
OPENSSL_CRYPTO_LIBRARIES returns also any other libraries required to fully
link an executable with libcrypto.a. This can be -lpthread, or -ldl, or
something else.
The FindOpenSSL.cmake module does a good job of identifying these dependent
libs, but the OPENSSL_CRYPTO_LIBRARIES variable must be used (same as using
ZLIB_LIBRARIES).
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Reviewed-by: Petr Štetiar <ynezz@true.cz>
Alexandru Ardelean [Fri, 29 Oct 2021 08:54:43 +0000 (11:54 +0300)]
build, cmake: add quotes for FW_UTIL variable arguments
CMake macro arguments are special, so when passing ${ZLIB_LIBRARIES} as
an argument, this can actually be a list of strings.
In this case, the first library (for zlib) will be added to
TARGET_LINK_LIBRARIES() and the others will be discarded. This is likely
due to some expansion from the FW_UTIL macro.
So, if FindZLIB returns more libraries for linking, they will not be
considered.
This is the case when trying to change OPENSSL_CRYPTO_LIBRARY ->
OPENSSL_CRYPTO_LIBRARIES.
OPENSSL_CRYPTO_LIBRARY is just libcrypto.a
OPENSSL_CRYPTO_LIBRARIES can also include -ldl
There's a few points made here about macros:
https://cmake.org/cmake/help/latest/command/macro.html#argument-caveats
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Reviewed-by: Petr Štetiar <ynezz@true.cz>
Adrian Schmutzler [Sat, 30 Oct 2021 16:53:13 +0000 (18:53 +0200)]
ramips: add support for TP-Link RE305 v3
Signed-off-by: Michal Kozuch <servitkar@gmail.com>
[prepare for separate submission to firmware-utils repo,
update soft_ver]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Fabrice Fontaine [Sun, 17 Oct 2021 08:10:30 +0000 (10:10 +0200)]
Add more missing include for byte swap operations
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Kevin Darbyshire-Bryant [Tue, 5 Oct 2021 19:45:24 +0000 (20:45 +0100)]
Add more missing includes for byte swap operations
And fix a couple of spelling errors while we're here
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Rafał Miłecki [Fri, 6 Aug 2021 12:58:39 +0000 (14:58 +0200)]
xiaomifw: new tool for managing Xiaomi firmwares
This has been tested with Xiaomi routers images (r1cl, r1cm, r2100, r3,
r3d, r3g, r4cm, ra70) but it should also be compatible with other
devices as Xiaomi seems to share the same format across most of their
products.
The biggest & probably unresolvable problem is RSA 256 B signature.
Without the key it's impossible to create an image that official UI
would accept.
This tool may be still useful for flashing original Xiaomi firmwares
(e.g. when reverting to official image) and for development purposes.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Andrew Cameron [Mon, 12 Apr 2021 18:24:33 +0000 (13:24 -0500)]
ath79: add support for TP-Link CPE710-v1
TP-Link CPE710-v1 is an outdoor wireless CPE for 5 GHz with
one Ethernet port based on the AP152 reference board
Specifications:
- SoC: QCA9563-AL3A MIPS 74kc @ 775MHz, AHB @ 258MHz
- RAM: 128MiB DDR2 @ 650MHz
- Flash: 16MiB SPI NOR Based on the GD25Q128
- Wi-Fi 5Ghz: ath10k chip (802.11ac for up to 867Mbps on 5GHz wireless
data rate) Based on the QCA9896
- Ethernet: one 1GbE port
- 23dBi high-gain directional 2×2 MIMO antenna and a dedicated metal
reflector
- Power, LAN, WLAN5G Blue LEDs
- 3x Blue LEDs
Flashing instructions:
Flash factory image through stock firmware WEB UI or through TFTP
To get to TFTP recovery just hold reset button while powering on for
around 30-40 seconds and release.
Rename factory image to recovery.bin
Stock TFTP server IP:192.168.0.100
Stock device TFTP address:192.168.0.254
Signed-off-by: Andrew Cameron <apcameron@softhome.net>
[convert to nvmem, fix MAC assignment in 11-ath10k-caldata]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Alan Luck [Tue, 20 Apr 2021 09:44:01 +0000 (19:44 +1000)]
ramips: add missing information to dlink headers
Add additional header information required for newer
bootloaders found on DIR-2660-A1 & A2.
Also remove the MTD splitter compatible from the second firmware
partition, as OpenWrt only supports handling of the first one.
Signed-off-by: Alan Luck <luckyhome2008@gmail.com>
[rephrase commit message, remove removal of read-only flags]
Signed-off-by: David Bauer <mail@david-bauer.net>
Sander Vanheule [Fri, 10 Sep 2021 08:57:19 +0000 (10:57 +0200)]
firmware-utils: tplink-safeloader: set EAP235-Wall v1 soft-version
Starting with v3 of the vendor firmware for the TP-Link EAP235-Wall v1,
downgrades to firmware versions below v3 as not allowed. Since OpenWrt
uses version 0.0.0 as a default, this causes the factory install to fail
on devices with a recent firmware. This failure is associated by the
following message on the device's serial console:
EAP235/230-Wall forbid fw reverted from 3.x.x to lower version!
Vendor firmware (v3) also uses build and release numbers to compare
images, so identical version numbers are very unlikely to cause issues.
Bump the firmware version to 3.0.0 to ensure users can install OpenWrt
on their devices.
Reported-by: Colton Conor <colton.conor@gmail.com>
Tested-by: Colton Conor <colton.conor@gmail.com>
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Sander Vanheule [Fri, 10 Sep 2021 08:57:18 +0000 (10:57 +0200)]
firmware-utils: tplink-safeloader: improve soft-version customisation
Some devices using the safeloader firmware format require a minimum or
specific version to be set in the soft-version metadata partition.
Currently only custom text values can be provided, but not all device
firmware support this format.
Modify the device info struct to allow for more well-defined types of
soft-version overwrites, and provide a few macros for easy value
initialisation. Requires all existing values to be updated to match the
new structure.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
[Adapt TL-WA1201-V2 entry too]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Sander Vanheule [Wed, 1 Sep 2021 19:15:57 +0000 (21:15 +0200)]
firmware-utils: tplink-safeloader: use revision field
The structured soft-version partition has a field which contains a
(source) revision number. Factory images used to include this, but
it was accidentaly removed during an earlier refactoring.
Include the source revision number again in the generated soft-version
partition. Additionaly, also show this revision number when printing
image info.
Fixes: 1a211af2cb3b ("firmware-utils: tplink-safeloader: refactor meta-partition generation")
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Rafał Miłecki [Fri, 6 Aug 2021 10:59:56 +0000 (12:59 +0200)]
firmware-utils: seama.h: replace LGPL-2.1-or-later boilerplate with SPDX
This was missed because scancode license scanner was confused by a
slightly different than expected license text (96,75% license score).
License text included "file" instead of "library" in the main part of
the licensing info. It also used "The GNU C Library" instead of the
standard "This library" in 2nd and 3rd paragraphs.
The first paragraph clearly mentions LGPL-2.1-or-later and the use of
"file" instead of "library" should not affect licensing.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Robert Balas [Thu, 2 Sep 2021 15:07:14 +0000 (17:07 +0200)]
ath79: add support for TP-Link TL-WA1201 v2
This device is a wireless access point working on the 2.4 GHz and 5 GHz
band, based on Qualcomm/Atheros QCA9563 + QCA9886.
Specification
- 775 MHz CPU
- 128 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- QCA9563: 2.4 GHz 3x3
- QCA9886: 5 GHz
- AR8033: 1x 1 Gbs Ethernet
- 4x LED, WPS factory reset and power button
- bare UART on PCB (accessible through testpoints)
Methods for Flashing:
- Apply factory image in OEM firmware web-gui. Wait a minute after the
progress bar completes and restart the device.
- Sysupgrade on top of existing OpenWRT image
- Solder wires onto UART testpoints and attach a terminal.
Boot the device and press enter to enter u-boot's menu. Then issue the
following commands
1. setenv serverip your-server-ip
setenv ipaddr your-device-ip
2. tftp 0x80060000 openwrt-squashfs.bin (Rembember output of size in
hex, henceforth "sizeinhex")
3. erase 0x9f030000 +"sizeinhex"
4. cp.b 0x80060000 0x9f030000 0x"sizeinhex"
5. reboot
Recover:
- U-boot serial console
Signed-off-by: Robert Balas <balasr@iis.ee.ethz.ch>
[convert to nvmem]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Matthew Hagan [Thu, 5 Aug 2021 22:24:40 +0000 (22:24 +0000)]
firmware-utils: mkmerakifw-old: Add le32 support
mkmerakifw-old was created for the z1 which uses the AR9344 SoC with
be32 addressing. The MX64/MX65 devices use the same header style, however
these boards use a BCM NSP SoC with le32 addressing.
Since we may be booting initramfs images with this header, which may be
of any size, within reason, board->imagelen is set to 0. The kernel
image shoule be limited in the image Makefile.
Signed-off-by: Matthew Hagan <mnhagan88@gmail.com>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Kevin Darbyshire-Bryant [Sat, 21 Aug 2021 19:08:07 +0000 (20:08 +0100)]
firmware-utils: fix build on not Linux
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Vincent Wiemann [Mon, 2 Aug 2021 22:21:46 +0000 (00:21 +0200)]
firmware-utils: add support for ZyXEL ZLD firmware
This commit adds a tool for extracting and creating firmware archives for:
- ZyXEL NWA5121-N
- ZyXEL NWA5121-NI
- ZyXEL NWA5123-NI
- ZyXEL NWA5123-AC
- ZyXEL NWA5301
- ZyXEL NWA3560N v2
- ZyXEL WAC6100
- ZyXEL WAC6500
And maybe others...
Signed-off-by: Vincent Wiemann <vincent.wiemann@ironai.com>
Rafał Miłecki [Fri, 6 Aug 2021 10:59:23 +0000 (12:59 +0200)]
firmware-utils: nand_ecc: replace GPL boilerplate with SPDX
Cc: yajin <yajin@vm-kernel.org>
Cc: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 6 Aug 2021 10:59:22 +0000 (12:59 +0200)]
firmware-utils: trx: replace GPL-2.0-or-later boilerplate with SPDX
This was missed because scancode license scanner was confused by
comments about crc32buf().
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 6 Aug 2021 10:59:21 +0000 (12:59 +0200)]
firmware-utils: osbridge-crc: replace GPL-2.0-only boilerplate with SPDX
This was missed because scancode license scanner was confused by
comments about crc32buf().
Cc: Gabor Juhos <juhosg@openwrt.org>
Cc: Gabor Juhos <juhosg@freemail.hu>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 6 Aug 2021 10:59:20 +0000 (12:59 +0200)]
firmware-utils: mkmylofw: replace GPL-2.0-or-later boilerplate with SPDX
This was missed because scancode license scanner was confused by a
comment about (no) copyrights in the init_crc_table().
Cc: Gabor Juhos <juhosg@openwrt.org>
Cc: Gabor Juhos <juhosg@freemail.hu>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 6 Aug 2021 10:59:19 +0000 (12:59 +0200)]
firmware-utils: mkmerakifw-old: replace GPL-2.0-only boilerplate with SPDX
This was missed because scancode license scanner was confused by a
comment about Cisco's GPL code github repository.
Cc: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Rafał Miłecki [Wed, 4 Aug 2021 13:58:47 +0000 (15:58 +0200)]
firmware-utils: add GPL 2.0 SPDX to files with no license info
These files fall under the project license: GPL-2.0-only.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Wed, 4 Aug 2021 12:32:14 +0000 (14:32 +0200)]
firmware-utils: tplink-safeloader: replace BSD-2-Clause boilerplate with SPDX
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Matthias Schiffer <mschiffer@universe-factory.net>
Rafał Miłecki [Wed, 4 Aug 2021 12:26:35 +0000 (14:26 +0200)]
firmware-utils: seama: replace BSD-3-Clause boilerplate with SPDX
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Wed, 4 Aug 2021 11:06:24 +0000 (13:06 +0200)]
firmware-utils: replace GPL 2.0+ boilerplate/reference with SPDX
This uses "GPL-2.0-or-later" header for files identified using scancode
license scanner with 100% score as GPL 2.0 or later.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Wed, 4 Aug 2021 10:30:38 +0000 (12:30 +0200)]
firmware-utils: replace GPL 2.0 boilerplate/reference with SPDX
This uses "GPL-2.0-only" header for files identified using scancode
license scanner with 100% score as GPL 2.0.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Stijn Tintel <stijn@linux-ipv6.be>
Roberto Valentini [Thu, 1 Jul 2021 09:56:30 +0000 (11:56 +0200)]
ath79: add support for TP-Link RE455 v1
TP-Link RE455 v1 is a dual band router/range-extender based on
Qualcomm/Atheros QCA9563 + QCA9880.
This device is nearly identical to RE450 v3
Specification:
- 775 MHz CPU
- 64 MB of RAM (DDR2)
- 8 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 3T3R 5 GHz
- 1x 10/100/1000 Mbps Ethernet (AR8033 PHY)
- 7x LED, 4x button
- UART header on PCB[1]
Flash instruction:
Apply factory image in OEM firmware web-gui.
[1] Didn't work, probably need to short unpopulated resistor R64
and R69 as RE450v3
Signed-off-by: Roberto Valentini <valantin89@gmail.com>
Diogenes Rengo [Fri, 25 Jun 2021 14:44:40 +0000 (11:44 -0300)]
ath79: add support for TP-Link TL-WR941HP v1
Specifications:
SOC: Qualcomm Atheros TP9343 (750 MHz)
Flash: 8 Mb (GigaDevice GD25Q64CSIG)
RAM: 64 Mb (Zentel A3R12E40DBF-8E)
Serial: yes, 4-pin header
Wlan: Qualcomm Atheros TP9343, antenna: MIM0 3x3:3 RP-SMA
3 x 2.4GHz power amp module Skyworks (SiGe) SE2576L
Ethernet: Qualcomm Atheros TP9343
Lan speed: 100M ports: 4
Lan speed: 100M ports: 1
Other info: same case, ram and flash that TP-Link TL-WR841HP,
different SOC
https://forum.openwrt.org/t/adding-device-support-tp-link-wr941hp/
Label MAC addresses based on vendor firmware:
LAN *:ee label
WAN *:ef label +1
WLAN *:ee label
The label MAC address found in "config" partition at 0x8
Flash instruction:
Upload the generated factory firmware on web interface.
Signed-off-by: Diogenes Rengo <rengocbx250@gmail.com>
[remove various whitespace issues, squash commits, use short 0x0]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Petr Štetiar [Mon, 5 Jul 2021 09:51:01 +0000 (11:51 +0200)]
cmake: fix missing install target
Add a missing install target so the binaries could be installed.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Petr Štetiar [Mon, 5 Jul 2021 09:02:26 +0000 (11:02 +0200)]
Add initial GitLab CI support
Uses currently proof-of-concept openwrt-ci[1] in order to:
* improve the quality of the codebase in various areas
* decrease code review time and help merging contributions faster
* get automagic feedback loop on various platforms and tools
- out of tree native build on x86/64 with GCC (versions 8, 9, 10) and Clang 11
- out of tree native x86/64 static code analysis with cppcheck and
scan-build from Clang 11
1. https://gitlab.com/ynezz/openwrt-ci/
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Petr Štetiar [Mon, 5 Jul 2021 08:49:57 +0000 (10:49 +0200)]
Add missing includes for byte swap operations
Fixes bunch of following issues:
CMakeFiles/mktplinkfw2.dir/src/mktplinkfw2.c.o: In function `fill_header':
mktplinkfw2.c:(.text+0xad): undefined reference to `bswap_32'
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Petr Štetiar [Mon, 5 Jul 2021 08:48:38 +0000 (10:48 +0200)]
Convert to CMake based project
So it can be built separately.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Stijn Segers [Wed, 16 Jun 2021 12:47:06 +0000 (14:47 +0200)]
firmware-utils: tplink-safeloader: support Archer A6 v3 CA
The Canadian edition of the TP-Link Archer A6 v3 uses a different header, but
otherwise it's identical to the already supported EU/US editions.
Signed-off-by: Stijn Segers <foss@volatilesystems.org>
Tested-by: Brian Lee <dev@leebrian.me>
Reviewed-by: Philip Prindeville <philipp@redfish-solutions.com>
Amish Vishwakarma [Sat, 5 Jun 2021 07:01:00 +0000 (12:31 +0530)]
ramips: add support for TP-Link Archer C6 v3
The patch adds support for the TP-Link Archer C6 v3 (FCC ID TE7A6V3)
The patch adds identification changes to the existing TP-Link Archer A6,
by Vinay Patil <post2vinay@gmail.com>, which has identical hardware.
Specification
-------------
MediaTek MT7621 SOC
RAM: 128MB DDR3
SPI Flash: W25Q128 (16MB)
Ethernet: MT7530 5x 1000Base-T
WiFi 5GHz: Mediatek MT7613BE
WiFi 2.4GHz: Mediatek MT7603E
UART/Serial: 115200 8n1
Device Configuration & Serial Port Pins
---------------------------------------
ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN
_______________________
| |
Serial Pins: | VCC GND TXD RXD |
|_____________________|
LEDs: Power Wifi2G Wifi5G LAN WAN
Build Output
------------
The build will generate following set of files
[1] openwrt-ramips-mt7621-tplink_archer-c6-v3-initramfs-kernel.bin
[2] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-factory.bin
[3] openwrt-ramips-mt7621-tplink_archer-c6-v3-squashfs-sysupgrade.bin
How to Use - Flashing from TP-Link Web Interface
------------------------------------------------
* Go to "Advanced/System Tools/Firmware Update".
* Click "Browse" and upload the OpenWrt factory image: factory.bin[2]
* Click the "Upgrade" button, and select "Yes" when prompted.
TFTP Booting
------------
Setup a TFTP boot server with address 192.168.0.5.
While starting U-boot press '4' key to stop autoboot.
Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin
From u-boot command prompt run tftpboot followed by bootm.
Recovery
--------
Archer A6 V3 has recovery page activated if SPI booting from flash fails.
Recovery page can be activated by powercycling the router four times
before the boot process is complete.
Note: TFTP boot can be activated only from u-boot serial console.
Device recovery address: 192.168.0.1
Signed-off-by: Amish Vishwakarma <vishwakarma.amish@gmail.com>
[fix indent]
Signed-off-by: David Bauer <mail@david-bauer.net>
Michael Pratt [Wed, 5 May 2021 03:32:00 +0000 (23:32 -0400)]
ath79: use dynamic partitioning for TP-Link CPE series
CPExxx and WBSxxx boards with AR9344 SOC
use the OKLI lzma kernel loader
with the offset of 3 blocks of length 4k (0x3000)
in order to have a fake "kernel" that cannot grow larger
than how it is defined in the now static OEM partition table.
Before recent changes to the mtdsplit driver,
the uImage parser for OKLI only supported images
that started exactly on an eraseblock boundary.
The mtdsplit parser for uImage now supports identifying images
with any magic number value
and at any offset from the eraseblock boundary
using DTS properties to define those values.
So, it is no longer necessary to use fixed sizes
for kernel and rootfs
Tested-by: Andrew Cameron <apcameron@softhome.net> [CPE510 v2]
Tested-by: Bernhard Geier <freifunk@geierb.de> [WBS210 v2]
Tested-by: Petrov <d7c48mWsPKx67w2@gmail.com> [CPE210 v1]
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Georgi Vlaev [Fri, 31 Jul 2020 11:02:21 +0000 (14:02 +0300)]
ramips: add support for TP-Link Archer C6U v1 (EU)
This patch adds support for TP-Link Archer C6U v1 (EU).
The device is also known in some market as Archer C6 v3.
This patch supports only Archer C6U v1 (EU).
Specifications:
--------------
* SoC: Mediatek MT7621AT 2C2T, 880MHz
* RAM: 128MB DDR3
* Flash: 16MB SPI NOR flash (Winbond 25Q128)
* WiFi 5GHz: Mediatek MT7613BEN (2x2:2)
* WiFi 2.4GHz: Mediatek MT7603EN (2x2:2)
* Ethernet: MT7630, 5x 1000Base-T.
* LED: Power, WAN, LAN, WiFi 2GHz and 5GHz, USB
* Buttons: Reset, WPS.
* UART: Serial console (115200 8n1), J1(GND:3)
* USB: One USB2 port.
Installation:
------------
Install the OpenWrt factory image for C6U is from the
TP-Link web interface.
1) Go to "Advanced/System Tools/Firmware Update".
2) Click "Browse" and upload the OpenWrt factory image:
openwrt-ramips-mt7621-tplink_archer-c6u-v1-squashfs-factory.bin.
3) Click the "Upgrade" button, and select "Yes" when prompted.
Recovery to stock firmware:
--------------------------
The C6U bootloader has a failsafe mode that provides a web
interface (running at 192.168.0.1) for reverting back to the
stock TP-Link firmware. The failsafe interface is triggered
from the serial console or on failed kernel boot. Unfortunately,
there's no key combination that enables the failsafe mode. This
gives us two options for recovery:
1) Recover using the serial console (J1 header).
The recovery interface can be selected by hitting 'x' when
prompted on boot.
2) Trigger the bootloader failsafe mode.
A more dangerous option is force the bootloader into
recovery mode by erasing the OpenWrt partition from the
OpenWrt's shell - e.g "mtd erase firmware". Please be
careful, since erasing the wrong partition can brick
your device.
MAC addresses:
-------------
OEM firmware configuration:
D8:07:B6:xx:xx:83 : 5G
D8:07:B6:xx:xx:84 : LAN (label)
D8:07:B6:xx:xx:84 : 2.4G
D8:07:B6:xx:xx:85 : WAN
Signed-off-by: Georgi Vlaev <georgi.vlaev@konsulko.com>
Vinay Patil [Mon, 19 Apr 2021 01:22:51 +0000 (06:52 +0530)]
ramips: add support for TP-Link Archer A6 v3
The patch adds support for the TP-Link Archer A6 v3
The router is sold in US and India with FCC ID TE7A6V3
Specification
-------------
MediaTek MT7621 SOC
RAM: 128MB DDR3
SPI Flash: W25Q128 (16MB)
Ethernet: MT7530 5x 1000Base-T
WiFi 5GHz: Mediatek MT7613BE
WiFi 2.4GHz: Mediatek MT7603E
UART/Serial: 115200 8n1
Device Configuration & Serial Port Pins
---------------------------------------
ETH Ports: LAN4 LAN3 LAN2 LAN1 WAN
_______________________
| |
Serial Pins: | VCC GND TXD RXD |
|_____________________|
LEDs: Power Wifi2G Wifi5G LAN WAN
Build Output
------------
The build will generate following set of files
[1] openwrt-ramips-mt7621-tplink_archer-a6-v3-initramfs-kernel.bin
[2] openwrt-ramips-mt7621-tplink_archer-a6-v3-squashfs-factory.bin
[3] openwrt-ramips-mt7621-tplink_archer-a6-v3-squashfs-sysupgrade.bin
How to Use - Flashing from TP-Link Web Interface
------------------------------------------------
* Go to "Advanced/System Tools/Firmware Update".
* Click "Browse" and upload the OpenWrt factory image: factory.bin[2]
* Click the "Upgrade" button, and select "Yes" when prompted.
TFTP Booting
------------
Setup a TFTP boot server with address 192.168.0.5.
While starting U-boot press '4' key to stop autoboot.
Copy the initramfs-kernel.bin[1] to TFTP server folder, rename as test.bin
From u-boot command prompt run tftpboot followed by bootm.
Recovery
--------
Archer A6 V3 has recovery page activated if SPI booting from flash fails.
Recovery page can be activated from serial console only.
Press 'x' while u-boot is starting
Note: TFTP boot can be activated only from u-boot serial console.
Device recovery address: 192.168.0.1
Thanks to: Frankis for Randmon MAC address fix.
Signed-off-by: Vinay Patil <post2vinay@gmail.com>
[remove superfluous factory image definition, whitespacing]
Signed-off-by: David Bauer <mail@david-bauer.net>
Kevin Darbyshire-Bryant [Sun, 16 May 2021 10:46:32 +0000 (11:46 +0100)]
firmware-utils: fix coverity zytrx.c resource leak
fix coverity resource leak warning:
*len = stat.st_size;
mapped = mmap(NULL, stat.st_size, PROT_READ, MAP_SHARED, fd, 0);
if (close(fd) < 0)
CID
1484880: Resource leaks (RESOURCE_LEAK)
Variable "mapped" going out of scope leaks the storage it points to.
return NULL;
return mapped;
}
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Bjørn Mork [Mon, 19 Apr 2021 11:00:55 +0000 (13:00 +0200)]
firmware-utils: zytrx: Add util for ZyXEL specific header
The ZyXEL NR7101 prepend an additional header to U-Boot images. This
header use the TRX magic 0x30524448 (HDR0), but is incompatible with
TRX images.
This code is reverse-engineered based on matching 32 bit numbers
found in the header with lengths and different checksum
calculations of the vendor images found on the device. The result
was matched against the validation output produced by the
bootloader to name the associated header fields.
Example bootloader validation output:
Zyxel TRX Image 1 --> Found! Header Checksum OK
============ZyXEL header information==================
chipId : MT7621A
boardId : NR7101
modelId : 07 01 00 01
kernel_len : (
14177560)
kernelChksum : (0x8DD31F69)
swVersionInt : 1.00(ABUV.0)D1
swVersionExt : 1.00(ABUV.0)D1
Zyxel TRX Image 2 --> Found! Header Checksum OK
============ZyXEL header information==================
chipId : MT7621A
boardId : NR7101
modelId : 07 01 00 01
kernel_len : (
14176660)
kernelChksum : (0x951A7637)
swVersionInt : 1.00(ABUV.0)D0
swVersionExt : 1.00(ABUV.0)D0
=================================================
Check image validation:
Image1 Header Magic Number --> OK
Image2 Header Magic Number --> OK
Image1 Header Checksum --> OK
Image2 Header Checksum --> OK
Image1 Data Checksum --> OK
Image2 Data Checksum --> OK
Image1 Stable Flag --> Stable
Image1 Try Counter --> 0
Image1: OK
Image2: OK
The coverage and algorithm for the kernelChksum field is unknown.
This field is not validated by the bootloader or the OEM firmware
upgrade tool. It is therefore set to a static value for now.
The swVersion fields contain free form string values. The OEM firmware
use ZyXEL structured version numbers as shown above. The strings are
not interpreted or validated on boot, so they can be repurposed for
anything we want the bootloader to display to the user. But the OEM
web GUI fails to flash images with freeform strings.
The purpose of the other strings in the header is not known. The
values appear to be static. We assume they are fixed for now, until
we have other examples. One of these strings is the platform name,
which is taken as an input parameter for support other members of
the device family.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Alex Henrie [Tue, 4 May 2021 03:07:17 +0000 (21:07 -0600)]
tplink-safeloader: fix product_name of TP-Link AD7200
The stock firmware does not accept firmware with "Talon" in the name.
Tested on firmware version 1.0.10 Build
20160902 rel. 57400 which came
preinstalled, as well as latest firmware version 2.0.1 Build
20170103
rel.71053 flashed from
AD7200v1-up-ver2-0-1-P1[
20170103-rel71053]_2017-01-04_10.08.28.bin.
Fixes: 1a775a4fd033 ("ipq806x: add support for TP-Link Talon AD7200")
Signed-off-by: Alex Henrie <alexhenrie24@gmail.com>
[added details about vendor firmware]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Rafał Miłecki [Thu, 8 Apr 2021 21:49:43 +0000 (23:49 +0200)]
firmware-utils: tplink-safeloader: support displaying fw info
Add "-i" option for reading & displaying firmware info. First it lists
in-firmware partitions ("fwup-ptn"). Then it checks for human
understandable partitions and prints data found in each of them.
This new feature is meant for development & debug purposes.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Tue, 13 Apr 2021 11:53:57 +0000 (13:53 +0200)]
firmware-utils: mkmylofw: fix blocks padding
The old code didn't make sense as it was using "len" variable which was
guaranteed to be always 0. Loop right above broken code is:
while (len > 0) { }
With this recent ALIGN macro fix this resulted in subtracting block size
from 0 and calling write_out_padding() with a negative length.
To calculate amount of bytes needed for padding & alignment it should be
enough to use % 4.
Fixes: a2f66229450d ("firmware-utils: fix few random warnings")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 9 Apr 2021 09:36:57 +0000 (11:36 +0200)]
firmware-utils: zyimage: drop POSIX SOURCE defines
This fixes:
src/zyimage.c:10:0: warning: "_POSIX_SOURCE" redefined
src/zyimage.c:11:0: warning: "_POSIX_C_SOURCE" redefined
This change has been tested on Linux with -Wextra and on Mac OS.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Petr Štetiar [Fri, 9 Apr 2021 12:52:05 +0000 (14:52 +0200)]
tplink-safeloader: fix C7v5 factory flashing from vendor fw > v1.1.x
Currently it's not possible to flash factory images on devices shipped
with vendor firmware versions 1.1.0 Build
20201120 rel. 50406 (published
2020-12-22):
(curFw_ver, newFw_ver) == (1.1, 1.0) [NM_Error](nm_checkSoftVer) 00848: Firmwave not supports, check failed.
[NM_Error](nm_checkUpdateContent) 01084: software version dismatched
[NM_Error](nm_buildUpgradeStruct) 01188: checkUpdateContent failed.
They've even following note in release notes:
Note: You will be unable to downgrade to the previous firmware version
after updating this firmware.
This version check in vendor firmware is implemented in
/usr/bin/nvrammanager binary likely as following C code[1]:
sscanf(buf, "%d.%d.%*s",&upd_fw_major, &upd_fw_minor);
...
if (((int)upd_fw_major < (int)cur_fw_major) ||
((ret = 1, cur_fw_major == upd_fw_major && (upd_fw_minor < (int)cur_fw_minor)))) {
ret = 0;
printf("[NM_Error](%s) %05d: Firmwave not supports, check failed.\r\n\r\n","nm_checkSoftVer" ,0x350);
}
...
return ret;
So in order to fix this and make it future proof it should be enough to
ship our factory firmware images with major version 7 (lucky number).
Tested on latest firmware version 1.1.2 Build
20210125 rel.37999:
Firmwave supports, check OK.
(curFw_ver, newFw_ver) == (1.1, 7.0) check firmware ok!
Flashing back to vendor firmware
c7v5_us-up-ver1-1-2-P1[
20210125-rel37999]_2021-01-25_10.33.55.bin works
as well:
U-Boot
1.1.4-gbec22107-dirty (Nov 18 2020 - 18:19:12)
...
Firmware downloaded... filesize = 0xeeae77 fileaddr = 0x80060000.
Firmware Recovery file length :
15642231
Firmware process id 2.
handle_fw_cloud 146
Image verify OK!
Firmware file Verify ok!
product-info:product_name:Archer C7
product_ver:5.0.0
special_id:
55530000
[Error]sysmgr_cfg_checkSupportList(): 1023 @ specialId
45550000 NOT Match.
Firmware supports, check OK.
Firmware Recovery check ok!
1. https://gist.github.com/ynezz/
2e0583647d863386a66c3d231541b6d1
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Rafał Miłecki [Thu, 8 Apr 2021 22:12:28 +0000 (00:12 +0200)]
firmware-utils: add -Wall to most tools
This helps spotting possible problems
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 9 Apr 2021 08:43:07 +0000 (10:43 +0200)]
firmware-utils: fix -Wpointer-sign warnings
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 9 Apr 2021 07:21:25 +0000 (09:21 +0200)]
firmware-utils: fix -Wmaybe-uninitialized warnings
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 9 Apr 2021 06:52:03 +0000 (08:52 +0200)]
firmware-utils: fix few random warnings
1. -Wunused-label
2. -Wparentheses
3. -Wmisleading-indentation
4. -Wformat-overflow
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 9 Apr 2021 05:38:46 +0000 (07:38 +0200)]
firmware-utils: fix unused variable warnings
This fixes warnings from the:
1. -Wunused-variable
2. -Wunused-but-set-variable
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Thu, 8 Apr 2021 22:10:53 +0000 (00:10 +0200)]
firmware-utils: fix all -Wformat warnings
1. Use %hhu for uint8_t
2. Use %z for size_t
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Thu, 1 Apr 2021 15:06:47 +0000 (17:06 +0200)]
firmware-utils: bcm4908img: convert into a package
bcm4908img is a tool managing BCM4908 platform images. It's used for
creating them as well as checking, modifying and extracting data from.
It's required by both: host (for building firmware images) and target
(for sysupgrade purposes). Make it a host/target package.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Thu, 8 Apr 2021 07:10:20 +0000 (09:10 +0200)]
firmware-utils: bcm4908img: fix uninitialized var usage
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Wed, 7 Apr 2021 05:59:57 +0000 (07:59 +0200)]
firmware-utils: bcm4908img: extract bootfs without padding
JFFS2 bootfs partition in a BCM4908 image usually includes some padding.
For flashing it individually (writing to designed MTD partition) we want
just JFFS2 data.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Tue, 6 Apr 2021 22:17:40 +0000 (00:17 +0200)]
firmware-utils: bcm4908img: fix extracting cferom
Fix offset to extract proper data when image contains vendor header.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Mon, 5 Apr 2021 17:30:06 +0000 (19:30 +0200)]
firmware-utils: bcm4908img: support extracting bootfs & rootfs
It's required for upgrading firmware using single partitions instead of
just blindly writing whole image.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Mon, 5 Apr 2021 23:06:52 +0000 (01:06 +0200)]
firmware-utils: bcm4908img: replace size with offset
It's much easier to operate on BCM4908 image data with absolute offset
of each section stored. It doesn't require summing sizes over and over.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 2 Apr 2021 15:28:21 +0000 (17:28 +0200)]
firmware-utils: bcm4908img: add bootfs support
This adds support for accessing bootfs JFFS2 partition in the BCM4908
image. Support includes:
1. Listing files
2. Renaming file (requires unchanged name length)
Above commands are useful for flashing BCM4908 images which by defualt
come with cferom.000 file and require renaming it.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 2 Apr 2021 14:31:43 +0000 (16:31 +0200)]
firmware-utils: bcm4908img: support extracting image data
It's useful for upgrading cferom, firmware, etc.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Rafał Miłecki [Fri, 2 Apr 2021 13:04:46 +0000 (15:04 +0200)]
firmware-utils: bcm4908img: find cferom size
It's important for modifying / extracting firmware content. cferom is
optional image content at the file beginning.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
projects / project / firmware-utils.git / log