- [Modifications, changes](#modifications-changes)
- [Web server](#web-server)
- [Network Console](#network-console)
+ - [Writable environment variables](#writable-environment-variables)
- [Other](#other)
- [Supported FLASH chips](#supported-flash-chips)
- [How to install it?](#how-to-install-it)
- [Using external programmer](#using-external-programmer)
- [Using UART, U-Boot console and TFTP server](#using-uart-u-boot-console-and-tftp-server)
- [Important notice!](#important-notice)
- - [Step by step instruction](#step-by-step-instruction)
+ - [Step by step instructions](#step-by-step-instructions)
- [Using OpenWrt](#using-openwrt)
- [Using DD-WRT](#using-dd-wrt)
- [How to use it?](#how-to-use-it)
Introduction
------------
-In short, this project is a deep modification of **U-Boot 1.1.4** sources, mostly from **TP-Link**, but some code fragments were taken also from **D-Link**.
+In short, this project is a deep modification of **U-Boot 1.1.4** sources, mostly from **TP-Link**, but some code fragments were taken also from **D-Link**, **Netgear**, **ZyXEL** and **Belkin**. All these companies are using SDK from Qualcomm/Atheros which includes modified version of **U-Boot 1.1.4**.
You can download original sources from the following pages:
- [TP-Link GPL Code Center](http://www.tp-link.com/en/support/gpl/ "TP-Link GPL Code Center")
- [D-Link GPL Source Code Support](http://tsd.dlink.com.tw/GPL.asp "D-Link GPL Source Code Support")
+- [NETGEAR Open Source Code for Programmers (GPL)](http://kb.netgear.com/app/answers/detail/a_id/2649/~/netgear-open-source-code-for-programmers-%28gpl%29 "NETGEAR Open Source Code for Programmers (GPL)")
+- [ZyXEL GPL-OSS](http://www.zyxel.com/us/en/form/gpl_oss_form.shtml "ZyXEL GPL-OSS")
+- [Belkin Open Source Code Center](http://www.belkin.com/us/support-article?articleNum=51238 "Belkin Open Source Code Center")
The concept for this project came from another U-Boot modification, dedicated to a small and very popular TP-Link router - model **TL-WR703N**, which includes web fail safe mode: **[wr703n-uboot-with-web-failsafe](http://code.google.com/p/wr703n-uboot-with-web-failsafe/)**. I was using it and decided to make my own version, which could have some improvements, additional capabilities, support for different models and work with all modern web browsers.
- TP-Link TL-MR3220 v2
- GS-Oolite/Elink EL-M150 module with dev board ([photos in my gallery](http://galeria.tech-blog.pl/Elink_EL-M150_Development-Board/))
- Dragino 2 (MS14)
+ - Village Telco Mesh Potato 2 (based on Dragino MS14)
+ - GL.iNet 64xxA ([photos in my gallery](http://galeria.tech-blog.pl/GLiNet/))
+ - Black Swift
- **Atheros AR1311 (similar to AR9331)**
- D-Link DIR-505 H/W ver. A1 ([photos in my gallery](http://galeria.tech-blog.pl/D-Link_DIR-505/))
| [TP-Link TL-MR3220 v2](http://wiki.openwrt.org/toh/tp-link/tl-mr3420) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
| GS-Oolite/Elink EL-M150 module | AR9331 | 4/8/16 MiB | 64 MiB DDR2 | 64 KiB, LZMA | RO |
| [Dragino 2 (MS14)](http://wiki.openwrt.org/toh/dragino/ms14) | AR9331 | 16 MiB | 64 MiB DDR1 | 192 KiB | R/W |
+| Village Telco Mesh Potato 2 | AR9331 | 16 MiB | 64 MiB DDR1 | 192 KiB | R/W |
+| [GL.iNet](http://wiki.openwrt.org/toh/gl-inet/gl-inet) | AR9331 | 8/16 MiB | 64 MiB DDR1 | 64 KiB | RO |
+| [Black Swift](http://www.black-swift.com) | AR9331 | 16 MiB | 64 MiB DDR2 | 128 KiB, LZMA | R/W |
| [TP-Link TL-MR3420 v2](http://wikidevi.com/wiki/TP-LINK_TL-MR3420_v2) | AR9341 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
| [TP-Link TL-WR841N/D v8](http://wiki.openwrt.org/toh/tp-link/tl-wr841nd) | AR9341 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
| [TP-Link TL-WA830RE v2](http://wikidevi.com/wiki/TP-LINK_TL-WA830RE_v2) | AR9341 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
6. fail.html
7. style.css
-
+
+
+
+
+
+
### Network Console
+You could also use netcat instead of Hercules utility on Mac/Linux:
+```
+# nc -u -p 6666 192.168.1.1 6666
+```
+
+### Writable environment variables
+
+U-Boot uses special "**environment variables**" which are used for storing values of many different settings, like IP addresses of device and remote server for TFTP transaction, serial console baud rate, boot command, etc. Environment is usually stored in separate FLASH sector or its part, so all changes can be saved permanently.
+
+None of the popular manufacturers provides this feature and use so called "**read-only environment**" (embedded in U-Boot image), which means that all changes made during a runtime will be lost after device restart and there is no way to store them in FLASH.
+
+This modification uses writable environment variables in almost all supported devices, so you can do for example:
+
+```
+uboot> setenv ipaddr 192.168.1.100
+uboot> saveenv
+Saving environment to FLASH...
+
+Erase FLASH from 0x9F010000 to 0x9F01FFFF in bank #1
+Erasing: #
+
+Erased sectors: 1
+
+Writting at address: 0x9F010000
+
+uboot> reset
+```
+
+Which will change device IP address and save updated environment variables in FLASH. From next power up, the device will use new value for its IP address.
+
+Using command **run** and writable environment variables you are able to write custom, small scripts like below example, used for firmware upgrade using TFTP method:
+
+```
+uboot> printenv
+[...]
+firmware_addr=0x9F020000
+firmware_name=firmware.bin
+firmware_upg=if ping $serverip; then tftp $loadaddr $firmware_name && erase $firmware_addr +$filesize && cp.b $loadaddr $firmware_addr $filesize && echo OK!; else echo ERROR! Server not reachable!; fi
+[...]
+
+uboot> run firmware_upg
+Ethernet mode (duplex/speed): 1/100 Mbps
+Using eth0 device
+
+Ping OK, host 192.168.1.2 is alive!
+
+
+TFTP from IP: 192.168.1.2
+ Our IP: 192.168.1.1
+ Filename: 'firmware.bin'
+Load address: 0x80800000
+ Using: eth0
+
+ Loading: ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ ########################################
+ #########
+
+TFTP transfer complete!
+
+Bytes transferred: 3932160 (0x3c0000)
+Erase FLASH from 0x9F020000 to 0x9F3DFFFF in bank #1
+Erasing: #######################################
+ #####################
+
+Erased sectors: 60
+
+Copying to FLASH...
+Writting at address: 0x9F020000
+
+Done!
+
+OK!
+uboot>
+```
+
### Other
Moreover:
- FLASH chip is automatically recognized (using JEDEC ID)
- Ethernet MAC is set from FLASH (no more "No valid address in FLASH. Using fixed address")
- Automatic kernel booting can be interrupted using any key
+- Better UART serial console driver with support for different baud rates
- Press and hold reset button to run:
- Web server (min. 3 seconds)
- U-Boot serial console (min. 5 seconds)
- U-Boot network console (min. 7 seconds)
- Additional commands (in comparison to the default version; availability depends on router model):
+ - defenv
- httpd
+ - itest
+ - loadb
+ - loady
- printmac
- setmac
- printmodel
- printpin
- startnc
- startsc
- - eraseenv
- ping
- dhcp
- sntp
- Micron M25P64 (8 MiB, JEDEC ID: 20 2017)
- Windbond W25Q64 (8 MiB, JEDEC ID: EF 4017)*
- Macronix MX25L64 (8 MiB, JEDEC ID: C2 2017, C2 2617)
-- SST 25VF064C (8 MiB, JEDEC ID: BF 254B)
**16 MiB**:
mtd5: 00fd0000 00010000 "firmware"
```
-As you can see, `u-boot` partition size is **0x20000** (128 KiB) and my image for this model has size of **0x10000** (64 KiB) - it is a very important difference! You should remember about this if you want to use `mtd` utility, to change U-Boot.
+As you can see, `u-boot` partition size is **0x20000** (128 KiB) and my image for this model has smaller size: **0x1EC00** (123 KiB) - it is a very important difference! You should remember about this if you want to use `mtd` utility or serial console and U-Boot command line, to change the bootloader.
To backup `u-boot` partition in RAM, run:
If you have an external FLASH programmer (all supported devices have **SPI NOR FLASH** chips), you probably know how to use it. Download package with prebuilt images or compile the code, choose right file for your device and put it on FLASH at the beginning (offset `0x00000`). Remember to first erase block(s) - with high probability, if you use some kind of automatic mode, the programmer will do it for you.
-All prebuilt images are padded with 0xFF, so their size will always be a **multiple of 64 KiB block** and they will not be bigger than the original versions. For example, **TP-Link** uses only first **64 KiB** block to store compressed U-Boot image (in most of their modern devices). In the second 64 KiB block they store additional information like MAC address, model number and WPS pin number.
+All prebuilt images are padded with 0xFF and since change "****", in most supported devices, **their size is no longer a multiple of 64 KiB block**. For example, **TP-Link** uses only first **64 KiB** block to store compressed U-Boot image (in most of their modern devices). In the second 64 KiB block they store additional information like MAC address, model number and WPS pin number. This modification will use both sectors for U-Boot image and also other data, including small block for writable environment variables.
+
+Below image with beginning part of FLASH memory map for TP-Link TL-MR3020 shows differences between stock version and this modification.
+
+
On the other hand, U-Boot image in **Carambola 2** from **8devices** may have up to **256 KiB** (4x 64 KiB block), they use uncompressed version and environment stored in FLASH. Immediately after the Carambola 2 U-Boot partition is an area which contains U-Boot environment variables (1x 64 KiB block), called `u-boot-env`:
### Using UART, U-Boot console and TFTP server
+**WARNING! This method is highly not recommended!**
+
It is probably the most common method to change firmware in case of any problems. Main disadvantage of this approach is the need to connect with device using a serial port (this does not apply to Carambola 2 with development board, which already has a built-in USB-UART adapter, based on FTDI FT232RQ).
#### Important notice!
For a long time I have been using without any problems a small and very cheap (about 1-2 USD) **CP2102** based adapter. Go to [Serial Console article in OpenWrt Wiki](http://wiki.openwrt.org/doc/hardware/port.serial) for more, detailed information.
-#### Step by step instruction
+#### Step by step instructions
1. Install and configure any **TFTP server** on your PC (on Windows, you can use [TFTP32](http://tftpd32.jounin.net)).
serverip=192.168.1.2
```
-7. Download and store in RAM proper image for your router, using `tftpboot` command in U-Boot console (in this example, for **TP-Link TL-MR3020**):
+7. Due to differences in FLASH memory map and sizes of original and modified version of U-Boot, you must first make a backup of the partition with original version in RAM. **If you skip this step or make a mistake, your device will be probably broken!**
+
+ This step is different between supported models, so you should pay attention to the size of image with modified version of U-Boot, **round it to the nearest multiple of 64 KiB** and use this value in all next steps.
+
+ For example, if image of the modified version is **123 KiB** (**0x1EC00**) you must first make a backup of **128 KiB** (**0x20000**) in RAM, at the same address where you are going to download the image:
```
- tftpboot 0x80800000 uboot_for_tp-link_tl-mr3020.bin
+ hornet> cp.b 0x9F000000 0x80800000 0x20000
+ ```
+
+ Using the same offset address in RAM for backup and new image will end up with combination of both images and preserve additional data like MAC address, model number and PIN.
+8. Download and store in RAM proper image for your router, using `tftpboot` command in U-Boot console (in this example, for **TP-Link TL-MR3020**):
+
+ ```
+ hornet> tftpboot 0x80800000 uboot_for_tp-link_tl-mr3020.bin
eth1 link down
Using eth0 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'uboot_for_tp-link_tl-mr3020.bin'.
Load address: 0x80800000
- Loading: #############
+ Loading: #########################
done
- Bytes transferred = 65536 (10000 hex)
+ Bytes transferred = 125952 (1ec00 hex)
+
hornet>
```
-8. Next step is very risky! You are going to delete existing U-Boot image from FLASH in your device and copy from RAM the new one. If something goes wrong (for example, a power failure), your router, without bootloader, will not boot again!
+9. Next step is very risky! You are going to delete existing U-Boot image from FLASH in your device and copy from RAM the new one. If something goes wrong (for example, a power failure), your router, without bootloader, will not boot again!
- You should also note the size of downloaded image. For supported **TP-Link** and **D-Link** routers it will be always **0x10000** (64 KiB), but for Carambola 2 image size is different: **0x40000** (256 KiB). In all cases, the start address of FLASH is **0x9F000000** and for RAM: **0x80000000** (as you may noticed, I did not use start address of RAM to store image and you should follow this approach).
+ You should also note the size of image and use value from step 7. In all cases, the start address of FLASH is **0x9F000000** and for RAM: **0x80000000** (as you may noticed, I did not use start address of RAM to store image and you should follow this approach).
Please, do not make any mistake with offsets and sizes during next steps!
-9. Erase appropriate FLASH space for new U-Boot image (this command will remove default U-Boot image!):
+10. Erase appropriate FLASH space for new U-Boot image (this command will remove default U-Boot image!):
```
- hornet> erase 0x9F000000 +0x10000
+ hornet> erase 0x9F000000 +0x20000
- First 0x0 last 0x0 sector size 0x10000
- 0
- Erased 1 sectors
+ First 0x0 last 0x1 sector size 0x10000
+ Erased 2 sectors
+ hornet>
```
-10. Now your router does not have U-Boot, so do not wait and copy to FLASH the new one, stored earlier in RAM:
+11. Now your router does not have U-Boot, so do not wait and copy to FLASH the new one, stored earlier in RAM:
```
- hornet> cp.b 0x80800000 0x9F000000 0x10000
+ hornet> cp.b 0x80800000 0x9F000000 0x20000
Copy to Flash... write addr: 9f000000
done
```
-11. If you want, you can check content of the newly written FLASH and compare it to the image on your PC (or better also do such a "legit memory content" comparison prior to writing!), using `md` command in U-Boot console, which prints indicated memory area (press only ENTER after first execution of this command to move further in memory):
+12. If you want, you can check content of the newly written FLASH and compare it to the image on your PC (or better also do such a "legit memory content" comparison prior to writing!), using `md` command in U-Boot console, which prints indicated memory area (press only ENTER after first execution of this command to move further in memory):
```
hornet> md 0x9F000000
9f0000f0: 100001ea 00000000 100001e8 00000000 ................
```
-12. If you are sure that everything went OK, you may reset the board:
+12. If you are sure that everything went OK, you may reset the board using below command or just reset power:
```
hornet> reset
### Using OpenWrt
-[TODO]
+**This method is recommended!**
+
+Starting from official release "**[2014-11-19](https://github.com/pepe2k/u-boot_mod/releases/tag/2014-11-19)**", you will find ready **OpenWrt** images, with unlocked `u-boot` partition, embedded U-Boot image and dedicated small script for easy update process inside release tarball. All you need to do is download last release, select proper OpenWrt image for your device, install it and invoke one command: `u-boot-upgrade`:
+
+```
+root@OpenWrt:/# u-boot-upgrade
+
+=================================================================
+ DISCLAIMER: you are using this script at your own risk!
+
+ The author of U-Boot modification and this script takes
+ no responsibility for any of the results of using them.
+
+ Updating U-Boot is a very dangerous operation
+ and may damage your device! You have been warned!
+=================================================================
+ Are you sure you want to continue (type 'yes' or 'no')? yes
+=================================================================
+
+[ ok ] Found U-Boot image file: uboot_for_tp-link_tl-mr3020.bin
+ Do you want to use this file (type 'yes' or 'no')? yes
+[ ok ] MD5 checksum of new U-Boot image file is correct
+[ ok ] Backup of /dev/mtd0 successfully created
+ Do you want to store backup in /etc/u-boot_mod/backup/ (recommended, type 'yes' or 'no')? no
+[ ok ] New U-Boot image successfully combined with backup file
+[info] New U-Boot image is ready to be written into FLASH
+ Are you sure you want to continue (type 'yes' or 'no')? yes
+[ ok ] New U-Boot image successfully written info FLASH
+[ ok ] MD5 checksum of mtd0 and new U-Boot image are equal
+[info] Done!
+```
### Using DD-WRT
-[TODO]
+**WARNING! This method is not recommended!**
+
+1. Login into the router using telnet or SSH and find out which of the mtd partitions is the first one. In DD-WRT it is usally called `RedBoot`:
+
+ ```
+ root@DD-WRT:~# cat /proc/mtd
+ dev: size erasesize name
+ mtd0: 00020000 00010000 "RedBoot"
+ mtd1: 003c0000 00010000 "linux"
+ mtd2: 002c0000 00010000 "rootfs"
+ mtd3: 00010000 00010000 "ddwrt"
+ mtd4: 00010000 00010000 "nvram"
+ mtd5: 00010000 00010000 "board_config"
+ mtd6: 00400000 00010000 "fullflash"
+ mtd7: 00020000 00010000 "fullboot"
+ ```
+
+ In this case, for **TP-Link TL-MR3020**, the `RedBoot` partition is the one, which contains U-Boot and additional data (MAC address, model number, PIN).
+
+ **Warning!** If size of the first partition is smaller than the size of the modified U-Boot image, you should not continue!
+
+2. Using SCP or other method, transfer the new U-Boot image and corresponding MD5 file to the `/tmp` folder in device.
+
+ ```
+ root@DD-WRT:/tmp# ls -la
+ [...]
+ -rw-r--r-- 1 root root 125952 Nov 5 2015 uboot_for_tp-link_tl-mr3020.bin
+ -rw-r--r-- 1 root root 66 Nov 5 2015 uboot_for_tp-link_tl-mr3020.md5
+ [...]
+ ```
+
+3. Verify the MD5 sum of the image:
+
+ ```
+ root@DD-WRT:/tmp# md5sum uboot_for_tp-link_tl-mr3020.bin
+ aaae0f772ce007f7d1542b9233dd765b uboot_for_tp-link_tl-mr3020.bin
+
+ root@DD-WRT:/tmp# cat uboot_for_tp-link_tl-mr3020.md5
+ aaae0f772ce007f7d1542b9233dd765b *uboot_for_tp-link_tl-mr3020.bin
+ ```
+
+4. Make a backup of the current `RedBoot` partition (`mtd0`):
+
+ ```
+ root@DD-WRT:/tmp# dd if=/dev/mtd0 of=uboot_factory.bin
+ 256+0 records in
+ 256+0 records out
+ ```
+
+5. Using SCP or other method, transfer backuped `RedBoot` original partition to some safe place (I highly recommended you to save backup somewhere!).
+
+6. You need to combine together original image and the one with U-Boot modification, but it seems that `dd` from DD-WRT does not support `conv=notrunc`, so we will use different approach:
+
+ ```
+ root@DD-WRT:/tmp# dd if=uboot_factory.bin of=uboot_rest.bin bs=1 skip=$(wc -c < uboot_for_tp-link_tl-mr3020.bin)
+ 5120+0 records in
+ 5120+0 records out
+
+ root@DD-WRT:/tmp# cat uboot_for_tp-link_tl-mr3020.bin uboot_rest.bin > uboot_new.bin
+ ```
+
+7. **Danger**: This is the point of no return, if you have any errors or problems, please revert the original image at any time using:
+
+ ```
+ root@DD-WRT:/tmp# mtd write uboot_factory.bin "RedBoot"
+ Unlocking RedBoot ...
+ Writing from uboot_orig.bin to RedBoot ...
+ ```
+
+8. Now, to actually flash the new image, run:
+
+ ```
+ root@DD-WRT:/tmp# mtd write uboot_new.bin "RedBoot"
+ Unlocking RedBoot ...
+ Writing from uboot_new.bin to RedBoot ...
+ ```
+
+9. If you are sure that everything went OK, you may reboot the device:
+
+ ```
+ root@DD-WRT:/tmp# reboot
+ ```
How to use it?
--------------
#### 5. My device does not boot after upgrade!
-*I told you... bootloader, in this case U-Boot, is the most important piece of code inside your device. It is responsible for hardware initialization and booting an OS (kernel in this case), i.e. it's the bridge head for delegating to / flashing kernel and rootfs images. So, if during the upgrade something went wrong, your device will not boot any more. The only way to recover from such a situation in a mild way is via a JTAG adapter connection. In case of a lack of JTAG connection, you would even need to remove the FLASH chip, load proper image using an external programmer and solder it back.*
+*I told you... bootloader, in this case U-Boot, is the most important piece of code inside your device. It is responsible for hardware initialization and booting an OS (kernel in this case), i.e. it is the bridge head for delegating to / flashing kernel and rootfs images. So, if during the upgrade something went wrong, your device will not boot any more. The only way to recover from such a situation in a mild way is via a JTAG adapter connection. In case of a lack of JTAG connection, you would even need to remove the FLASH chip, load proper image using an external programmer and solder it back.*
License, outdated sources etc.
------------------------------
projects / oweals / u-boot_mod.git / blobdiff