U-Boot 1.1.4 modification for routers
==========
+Ready snapshot/test images
+--------------------------
+Starting from 24.09.2016, ready images, built on **Raspberry Pi 3** with **LEDE** toolchain, are available **[on my server](http://projects.dymacz.pl)**.
+
+Images are built and uploaded on FTP only when master branch in repository was updated - custom script checks this once per day. On the FTP you will find also toolchain which is used to build images.
+
Table of contents
-----------------
-[README w języku polskim/README in Polish language](https://github.com/pepe2k/u-boot_mod/blob/master/READMEPL.md)
-
- [Introduction](#introduction)
- [Supported devices](#supported-devices)
- [Known issues](#known-issues)
- [Using external programmer](#using-external-programmer)
- [Using UART, U-Boot console and TFTP server](#using-uart-u-boot-console-and-tftp-server)
- [Important notice!](#important-notice)
- - [Step by step instruction](#step-by-step-instruction)
+ - [Step by step instructions](#step-by-step-instructions)
- [Using OpenWrt](#using-openwrt)
- [Using DD-WRT](#using-dd-wrt)
- [How to use it?](#how-to-use-it)
- [How to compile the code?](#how-to-compile-the-code)
+ - [Building on Linux](#building-on-linux)
+ - [Building on OS X](#building-on-macos-os-x)
- [FAQ](#faq)
- [License, outdated sources etc.](#license-outdated-sources-etc)
- [Credits](#credits)
The concept for this project came from another U-Boot modification, dedicated to a small and very popular TP-Link router - model **TL-WR703N**, which includes web fail safe mode: **[wr703n-uboot-with-web-failsafe](http://code.google.com/p/wr703n-uboot-with-web-failsafe/)**. I was using it and decided to make my own version, which could have some improvements, additional capabilities, support for different models and work with all modern web browsers.
-First version of this modification was introduced on **OpenWrt** forum in [this thread](https://forum.openwrt.org/viewtopic.php?id=43237), at the end of March 2013 and was dedicated only for TP-Link routers with **Atheros AR9331** SoC. Now, it supports also models from different manufacturers, devices with **Atheros AR934x** (like **TP-Link TL-WDR3600**, **TL-WDR43x0**, **TL-WR841N/D v8**, **TL-WA830RE v2**) and other (in the near future **Qualcomm Atheros QCA955x**) are under development.
+First version of this modification was introduced on **OpenWrt** forum in [this thread](https://forum.openwrt.org/viewtopic.php?id=43237), at the end of March 2013 and was dedicated only for TP-Link routers with **Atheros AR9331** SoC. Now, it supports also models from different manufacturers, devices with **Atheros AR934x**, **Qualcomm Atheros QCA953x**, **Qualcomm Atheros QCA955x** and other (in the near future **Qualcomm Atheros QCA956x** and **MediaTek MT762x**) are under development.
You can find some information about previous versions of this project also on my [blog](http://www.tech-blog.pl), in [this article](http://www.tech-blog.pl/2013/03/29/zmodyfikowany-u-boot-dla-routerow-tp-link-z-atheros-ar9331-z-trybem-aktualizacji-oprogramowania-przez-www-i-konsola-sieciowa-netconsole/). It is in Polish, but [Google Translator](http://translate.google.com/translate?hl=pl&sl=pl&tl=en&u=http%3A%2F%2Fwww.tech-blog.pl%2F2013%2F03%2F29%2Fzmodyfikowany-u-boot-dla-routerow-tp-link-z-atheros-ar9331-z-trybem-aktualizacji-oprogramowania-przez-www-i-konsola-sieciowa-netconsole%2F&sandbox=1) will help you to understand it.
- **Atheros AR9331**:
- 8devices Carambola 2 (for version with development board, [photos in my gallery](http://galeria.tech-blog.pl/8devices_Carambola_2/))
+ - ALFA NETWORK AP121F
+ - ALFA NETWORK Hornet-UB/Hornet-UB-64 (aka Hornet-UB x2)
+ - Black Swift
+ - CreatComm Technology D3321
+ - Dragino 2 (MS14)
+ - GL Innovations GL-AR150
+ - GL Innovations GL.iNet 64xxA ([photos in my gallery](http://galeria.tech-blog.pl/GLiNet/))
+ - GS-Oolite/Elink EL-M150 module with dev board ([photos in my gallery](http://galeria.tech-blog.pl/Elink_EL-M150_Development-Board/))
+ - TP-Link TL-MR10U v1 ([photos in my gallery](http://galeria.tech-blog.pl/TP-Link_TL-MR10U/))
+ - TP-Link TL-MR13U v1
- TP-Link TL-MR3020 v1 ([photos in my gallery](http://galeria.tech-blog.pl/TPLINK_TL-MR3020/))
- TP-Link TL-MR3040 v1 and v2
+ - TP-Link TL-MR3220 v2
- TP-Link TL-WR703N v1, ([photos in my gallery](http://galeria.tech-blog.pl/TPLINK_TL-WR703N/))
- - TP-Link TL-WR720N v3 (version for Chinese market)
- TP-Link TL-WR710N v1 (version for European market, [photos in my gallery](http://galeria.tech-blog.pl/TP-Link_TL-WR710N-EU/))
- - TP-Link TL-MR10U v1 ([photos in my gallery](http://galeria.tech-blog.pl/TP-Link_TL-MR10U/))
- - TP-Link TL-MR13U v1
+ - TP-Link TL-WR720N v3 (version for Chinese market)
- TP-Link TL-WR740N v4 (and similar, like TL-WR741ND v4)
- - TP-Link TL-MR3220 v2
- - GS-Oolite/Elink EL-M150 module with dev board ([photos in my gallery](http://galeria.tech-blog.pl/Elink_EL-M150_Development-Board/))
- - Dragino 2 (MS14)
- Village Telco Mesh Potato 2 (based on Dragino MS14)
- - GL.iNet 64xxA ([photos in my gallery](http://galeria.tech-blog.pl/GLiNet/))
- **Atheros AR1311 (similar to AR9331)**
- D-Link DIR-505 H/W ver. A1 ([photos in my gallery](http://galeria.tech-blog.pl/D-Link_DIR-505/))
- **Atheros AR9341**:
+ - EnGenius ENS202EXT
- TP-Link TL-MR3420 v2
- - TP-Link TL-WR841N/D v8
- - TP-Link TL-WA830RE v2
- TP-Link TL-WA801ND v2
+ - TP-Link TL-WA830RE v2
+ - TP-Link TL-WR841N/D v8
+ - YunCore CPE870
- **Atheros AR9344**:
+ - TP-Link TL-WDR3500 v1
- TP-Link TL-WDR3600 v1
- TP-Link TL-WDR43x0 v1
- - TP-Link TL-WDR3500 v1
+
+- **Qualcomm Atheros QCA953x**:
+ - Comfast CF-E314N
+ - Comfast CF-E320N v2
+ - Comfast CF-E520N/CF-E530N
+ - P&W CPE505N
+ - P&W R602N
+ - TP-Link TL-MR3420 v3
+ - TP-Link TL-WA850RE v2
+ - TP-Link TL-WR802N
+ - TP-Link TL-WR810N
+ - TP-Link TL-WR820N (version for Chinese market)
+ - TP-Link TL-WR841N/D v9, v10, v11
+ - TP-Link TL-WR842N/D v3
+ - TP-Link TL-WR902AC v1
+ - Wallys DR531
+ - YunCore AP90Q
+ - YunCore CPE830
+ - Zbtlink ZBT-WE1526
I tested this modification on most of these devices, with OpenWrt and OFW firmware. If you are not sure about the version of your device, please contact with me **before** you try to make an upgrade. Changing bootloader to a wrong version will probably damage your router and you will need special hardware to fix it, so please, **be very careful**.
| Model | SoC | FLASH | RAM | U-Boot image | U-Boot env |
|:--- | :--- | ---: | ---: | ---: | ---: |
-| [8devices Carambola 2](http://8devices.com/carambola-2) | AR9331 | 16 MiB | 64 MiB DDR2 | 256 KiB | 64 KiB, R/W |
-| [TP-Link TL-MR3020 v1](http://wiki.openwrt.org/toh/tp-link/tl-mr3020) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
-| [TP-Link TL-MR3040 v1/2](http://wiki.openwrt.org/toh/tp-link/tl-mr3040) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
-| [TP-Link TL-WR703N](http://wiki.openwrt.org/toh/tp-link/tl-wr703n) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
-| [TP-Link TL-WR720N v3](http://wiki.openwrt.org/toh/tp-link/tl-wr720n) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
-| [TP-Link TL-WR710N v1](http://wiki.openwrt.org/toh/tp-link/tl-wr710n) | AR9331 | 8 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [8devices Carambola 2](http://8devices.com/carambola-2) | AR9331 | 16 MiB | 64 MiB DDR2 | 256 KiB | R/W |
+| ALFA NETWORK AP121F | AR9331 | 16 MiB | 64 MiB DDR1 | 192 KiB, LZMA | R/W |
+| [ALFA NETWORK Hornet-UB](https://wiki.openwrt.org/toh/alfa.network/hornet-ub) | AR9331 | 8/16 MiB | 32/64 MiB DDR1 | 256 KiB | R/W |
+| [Black Swift](http://www.black-swift.com) | AR9331 | 16 MiB | 64 MiB DDR2 | 128 KiB, LZMA | R/W |
+| Comfast CF-E314N | QCA9531 | 16 MiB | 64 MiB DDR2 | 64 KiB, LZMA | RO |
+| Comfast CF-E320N v2 | QCA9531 | 16 MiB | 64 MiB DDR2 | 64 KiB, LZMA | RO |
+| Comfast CF-E520N/CF-E530N | QCA9531 | 8 MiB | 32 MiB DDR2 | 64 KiB, LZMA | RO |
+| CreatComm Technology D3321| AR9331 | 8 MiB | 32 MiB DDR1 | 256 KiB | RW |
+| [D-Link DIR-505 H/W ver. A1](http://wiki.openwrt.org/toh/d-link/dir-505) | AR1311 | 8 MiB | 64 MiB DDR2 | 64 KiB, LZMA | RO |
+| [Dragino 2 (MS14)](http://wiki.openwrt.org/toh/dragino/ms14) | AR9331 | 16 MiB | 64 MiB DDR1 | 192 KiB | R/W |
+| [EnGenius ENS202EXT](https://wiki.openwrt.org/toh/engenius/engenius_ens202ext_1.0.0) | AR9341 | 16 MiB | 64 MiB DDR1 | 256 KiB | R/W |
+| GL Innovations GL-AR150 | AR9331 | 16 MiB | 64 MiB DDR2 | 256 KiB | R/W |
+| [GL Innovations GL.iNet 64xxA](http://wiki.openwrt.org/toh/gl-inet/gl-inet) | AR9331 | 8/16 MiB | 64 MiB DDR1 | 64 KiB | RO |
+| GS-Oolite/Elink EL-M150 module | AR9331 | 4/8/16 MiB | 64 MiB DDR2 | 64 KiB, LZMA | RO |
+| P&W CPE505N | QCA9531 | 16 MiB | 64 MiB DDR2 | 256 KiB | R/W |
+| P&W R602N | QCA9531 | 16 MiB | 64 MiB DDR2 | 256 KiB | R/W |
| [TP-Link TL-MR10U v1](http://wiki.openwrt.org/toh/tp-link/tl-mr10u) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
| [TP-Link TL-MR13U v1](http://wiki.openwrt.org/toh/tp-link/tl-mr13u) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
-| [TP-Link TL-WR740N v4](http://wiki.openwrt.org/toh/tp-link/tl-wr740n) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-MR3020 v1](http://wiki.openwrt.org/toh/tp-link/tl-mr3020) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-MR3040 v1/2](http://wiki.openwrt.org/toh/tp-link/tl-mr3040) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
| [TP-Link TL-MR3220 v2](http://wiki.openwrt.org/toh/tp-link/tl-mr3420) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
-| GS-Oolite/Elink EL-M150 module | AR9331 | 4/8/16 MiB | 64 MiB DDR2 | 64 KiB, LZMA | RO |
-| [Dragino 2 (MS14)](http://wiki.openwrt.org/toh/dragino/ms14) | AR9331 | 16 MiB | 64 MiB DDR1 | 192 KiB | R/W |
-| Village Telco Mesh Potato 2 | AR9331 | 16 MiB | 64 MiB DDR1 | 192 KiB | R/W |
-| [GL.iNet](http://wiki.openwrt.org/toh/gl-inet/gl-inet) | AR9331 | 8/16 MiB | 64 MiB DDR1 | 64 KiB | RO |
| [TP-Link TL-MR3420 v2](http://wikidevi.com/wiki/TP-LINK_TL-MR3420_v2) | AR9341 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
-| [TP-Link TL-WR841N/D v8](http://wiki.openwrt.org/toh/tp-link/tl-wr841nd) | AR9341 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
-| [TP-Link TL-WA830RE v2](http://wikidevi.com/wiki/TP-LINK_TL-WA830RE_v2) | AR9341 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-MR3420 v3](http://wikidevi.com/wiki/TP-LINK_TL-MR3420_v3) | QCA9531 | 4 MiB | 32 MiB DDR2 | 64 KiB, LZMA | RO |
| [TP-Link TL-WA801ND v2](http://wikidevi.com/wiki/TP-LINK_TL-WA801ND_v2) | AR9341 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WA830RE v2](http://wikidevi.com/wiki/TP-LINK_TL-WA830RE_v2) | AR9341 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| TP-Link TL-WA850RE v2 | QCA9533 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WDR3500 v1](http://wiki.openwrt.org/toh/tp-link/tl-wdr3500) | AR9344 | 8 MiB | 128 MiB DDR2 | 64 KiB, LZMA | RO |
| [TP-Link TL-WDR3600 v1](http://wiki.openwrt.org/toh/tp-link/tl-wdr3600) | AR9344 | 8 MiB | 128 MiB DDR2 | 64 KiB, LZMA | RO |
| [TP-Link TL-WDR43x0 v1](http://wiki.openwrt.org/toh/tp-link/tl-wdr4300) | AR9344 | 8 MiB | 128 MiB DDR2 | 64 KiB, LZMA | RO |
-| [TP-Link TL-WDR3500 v1](http://wiki.openwrt.org/toh/tp-link/tl-wdr3500) | AR9344 | 8 MiB | 128 MiB DDR2 | 64 KiB, LZMA | RO |
-| [D-Link DIR-505 H/W ver. A1](http://wiki.openwrt.org/toh/d-link/dir-505) | AR1311 | 8 MiB | 64 MiB DDR2 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WR703N](http://wiki.openwrt.org/toh/tp-link/tl-wr703n) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WR710N v1](http://wiki.openwrt.org/toh/tp-link/tl-wr710n) | AR9331 | 8 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WR720N v3](http://wiki.openwrt.org/toh/tp-link/tl-wr720n) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WR740N v4](http://wiki.openwrt.org/toh/tp-link/tl-wr740n) | AR9331 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WR802N](https://wikidevi.com/wiki/TP-LINK_TL-WR802N_v1.0) | QCA9533 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WR810N](https://wiki.openwrt.org/toh/tp-link/tl-wr810n) | QCA9531 | 8 MiB | 64 MiB DDR2 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WR820N](https://wiki.openwrt.org/toh/tp-link/tl-wr820n) | QCA9531 | 4 MiB | 64 MiB DDR2 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WR841N/D v8](http://wiki.openwrt.org/toh/tp-link/tl-wr841nd) | AR9341 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| [TP-Link TL-WR841N/D v9/10/11](https://wiki.openwrt.org/toh/tp-link/tl-wr841nd) | QCA9533 | 4 MiB | 32 MiB DDR1 | 64 KiB, LZMA | RO |
+| TP-Link TL-WR842N/D v3 | QCA9531 | 16 MiB | 64 MiB DDR2 | 64 KiB, LZMA | RO |
+| TP-Link TL-WR902AC v1 | QCA9531 | 8 MiB | 64 MiB DDR2 | 128 KiB, LZMA | RO |
+| Village Telco Mesh Potato 2 | AR9331 | 16 MiB | 64 MiB DDR1 | 192 KiB | R/W |
+| Wallys DR531 | QCA9531 | 8 MiB | 64 MiB DDR2 | 192 KiB | R/W |
+| YunCore AP90Q | QCA9531 | 16 MiB | 128 MiB DDR2 | 256 KiB | R/W |
+| YunCore CPE830 | QCA9531 | 16 MiB | 64 MiB DDR2 | 256 KiB | R/W |
+| YunCore CPE870 | AR9341 | 8 MiB | 64 MiB DDR2 | 64 KiB, LZMA | R/W |
+| Zbtlink ZBT-WE1526 | QCA9531 | 16 MiB | 128 MiB DDR2 | 256 KiB | R/W |
*(LZMA) - U-Boot binary image is compressed with LZMA.*
*(R/W) - environment exists in separate FLASH block which allows you to save it and keep after power down.*
Known issues
------------
-Current release is not loading kernel from some versions of TP-Link's official firmware. If you want to use the so-called OFW in any of supported TP-Link's router, do not use this modification. I am working on a solution for this issue.
+~~Current release is not loading kernel from some versions of TP-Link's official firmware. If you want to use the so-called OFW in any of supported TP-Link's router, do not use this modification. I am working on a solution for this issue.~~
Modifications, changes
----------------------
### Web server
-The most important change is an inclusion of a web server, based on **[uIP 0.9 TCP/IP stack](http://www.gaisler.com/doc/net/uip-0.9/doc/html/main.html)**. It allows to upgrade **firmware**, **U-Boot** and **ART** (Atheros Radio Test) images, directly from your web browser, without need to access serial console and running a TFTP server. You can find similar firmware recovery mode, also based on uIP 0.9 TCP/IP stack, in **D-Link** routers.
+The most important change is an inclusion of a web server, based on **[uIP 0.9 TCP/IP stack](https://github.com/adamdunkels/uip/tags)**. It allows to upgrade **firmware**, **U-Boot** and **ART** (Atheros Radio Test) images, directly from your web browser, without need to access serial console and running a TFTP server. You can find similar firmware recovery mode, also based on uIP 0.9 TCP/IP stack, in **D-Link** routers.
Web server contains 7 pages:
Erased sectors: 1
-Writting at address: 0x9F010000
+Writing at address: 0x9F010000
uboot> reset
```
Erased sectors: 60
Copying to FLASH...
-Writting at address: 0x9F020000
+Writing at address: 0x9F020000
Done!
FLASH type detection may be very useful for people who has exchanged the FLASH chip in their routers. You will not need to recompile U-Boot sources, to have access to overall FLASH space in U-Boot console.
-If you use FLASH type which is not listed below, this version of U-Boot will use default size for your router and, in most supported models, updating the ART image will not be available.
+If you use FLASH type which is not listed below, this version of U-Boot will try to get information about the chip using **Serial Flash Discoverable Parameter** (**SFDP**, more information: https://www.jedec.org/standards-documents/docs/jesd216b) standard. If your chip does not support SFDP, it will use default size for your router and, in most supported models, updating the ART image will not be available.
Currently supported FLASH types:
- Micron M25P32 (4 MiB, JEDEC ID: 20 2016)
- Windbond W25Q32 (4 MiB, JEDEC ID: EF 4016)
- Macronix MX25L320 (4 MiB, JEDEC ID: C2 2016)
+- GigaDevice GD25Q32 (4 MiB, JEDEC ID: C8 4016)*
**8 MiB**:
- Micron M25P64 (8 MiB, JEDEC ID: 20 2017)
- Windbond W25Q64 (8 MiB, JEDEC ID: EF 4017)*
- Macronix MX25L64 (8 MiB, JEDEC ID: C2 2017, C2 2617)
+- GigaDevice GD25Q64 (8 MiB, JEDEC ID: C8 4017)
**16 MiB**:
- Winbond W25Q128 (16 MB, JEDEC ID: EF 4018)*
+- Winbond W25Q128FW (16 MB, JEDEC ID: EF 6018, 1,8 V)*
- Macronix MX25L128 (16 MB, JEDEC ID: C2 2018, C2 2618)
- Spansion S25FL127S (16 MB, JEDEC ID: 01 2018)*
+- Micron N25Q128 (16 MB, JEDEC ID: 20 BA18)
+- GigaDevice GD25Q128 (16 MiB, JEDEC ID: C8 4018)
(*) tested
Below image with beginning part of FLASH memory map for TP-Link TL-MR3020 shows differences between stock version and this modification.
-
+
On the other hand, U-Boot image in **Carambola 2** from **8devices** may have up to **256 KiB** (4x 64 KiB block), they use uncompressed version and environment stored in FLASH. Immediately after the Carambola 2 U-Boot partition is an area which contains U-Boot environment variables (1x 64 KiB block), called `u-boot-env`:
### Using OpenWrt
+**This method is recommended!**
+
Starting from official release "**[2014-11-19](https://github.com/pepe2k/u-boot_mod/releases/tag/2014-11-19)**", you will find ready **OpenWrt** images, with unlocked `u-boot` partition, embedded U-Boot image and dedicated small script for easy update process inside release tarball. All you need to do is download last release, select proper OpenWrt image for your device, install it and invoke one command: `u-boot-upgrade`:
```
### Using DD-WRT
-#### Step by step instructions
+**WARNING! This method is not recommended!**
+
+1. Login into the router using telnet or SSH and find out which of the mtd partitions is the first one. In DD-WRT it is usally called `RedBoot`:
+
+ ```
+ root@DD-WRT:~# cat /proc/mtd
+ dev: size erasesize name
+ mtd0: 00020000 00010000 "RedBoot"
+ mtd1: 003c0000 00010000 "linux"
+ mtd2: 002c0000 00010000 "rootfs"
+ mtd3: 00010000 00010000 "ddwrt"
+ mtd4: 00010000 00010000 "nvram"
+ mtd5: 00010000 00010000 "board_config"
+ mtd6: 00400000 00010000 "fullflash"
+ mtd7: 00020000 00010000 "fullboot"
+ ```
+
+ In this case, for **TP-Link TL-MR3020**, the `RedBoot` partition is the one, which contains U-Boot and additional data (MAC address, model number, PIN).
+
+ **Warning!** If size of the first partition is smaller than the size of the modified U-Boot image, you should not continue!
+
+2. Using SCP or other method, transfer the new U-Boot image and corresponding MD5 file to the `/tmp` folder in device.
+
+ ```
+ root@DD-WRT:/tmp# ls -la
+ [...]
+ -rw-r--r-- 1 root root 125952 Nov 5 2015 uboot_for_tp-link_tl-mr3020.bin
+ -rw-r--r-- 1 root root 66 Nov 5 2015 uboot_for_tp-link_tl-mr3020.md5
+ [...]
+ ```
+
+3. Verify the MD5 sum of the image:
+
+ ```
+ root@DD-WRT:/tmp# md5sum uboot_for_tp-link_tl-mr3020.bin
+ aaae0f772ce007f7d1542b9233dd765b uboot_for_tp-link_tl-mr3020.bin
+
+ root@DD-WRT:/tmp# cat uboot_for_tp-link_tl-mr3020.md5
+ aaae0f772ce007f7d1542b9233dd765b *uboot_for_tp-link_tl-mr3020.bin
+ ```
+
+4. Make a backup of the current `RedBoot` partition (`mtd0`):
+
+ ```
+ root@DD-WRT:/tmp# dd if=/dev/mtd0 of=uboot_factory.bin
+ 256+0 records in
+ 256+0 records out
+ ```
+
+5. Using SCP or other method, transfer backuped `RedBoot` original partition to some safe place (I highly recommended you to save backup somewhere!).
+
+6. You need to combine together original image and the one with U-Boot modification, but it seems that `dd` from DD-WRT does not support `conv=notrunc`, so we will use different approach:
+
+ ```
+ root@DD-WRT:/tmp# dd if=uboot_factory.bin of=uboot_rest.bin bs=1 skip=$(wc -c < uboot_for_tp-link_tl-mr3020.bin)
+ 5120+0 records in
+ 5120+0 records out
-Tutorial untested and taken from [here](http://zhujunsan.net/index.php/2013/08/install-web-failsafe-u-boot-for-wr703n/).
-
-1. Copy the following, and save to a shell script on your local computer (e.g. makeu.sh)
-
- ```bash
- #! /bin/sh
- # high chance need have a change ...
-
- UBOOT_NAME=wr703n_tuboot_test_2012_06_06.bin
- MD5SUM_SHOULD_BE="623dc0bba6fab68c22e5fb2f329d7d09"
-
- # need check the md5sum, any one byte in bootloader shoud right ...
- CURRENT_MD5SUM_VAL=$( md5sum $UBOOT_NAME |awk '{print $1 }' )
- echo "$UBOOT_NAME md5sum : $CURRENT_MD5SUM_VAL"
-
- if [ $MD5SUM_SHOULD_BE = $CURRENT_MD5SUM_VAL ]; then
- echo "$UBOOT_NAME md5sum check pass"
- else
- echo "###############$UBOOT_NAME md5sum check fail###############"
- exit
- fi
-
- RAW_UBOOT_LEN=`wc -c $UBOOT_NAME | awk '{print $1 }'`
- NEED_PAD_LEN=$((0x1fc00-$RAW_UBOOT_LEN))
-
- # Generate a file used as pad ...
- dd if=/dev/zero of=pad.bin bs=1 count=$NEED_PAD_LEN
- cat $UBOOT_NAME pad.bin >tuboot_0x1fc00.bin
-
- echo "Backup some config first, just like MAC address ..."
- dd if=/dev/mtd0 of=./config.bin bs=1 skip=$((0x1fc00))
- cat ./tuboot_0x1fc00.bin ./config.bin >uboot_0x20000.bin
- ```
-
-2. Edit the lines 3 and 4 to the name of the file you will flash, and its MD5 sum. e.g.:
-
- ```bash
- ..
- UBOOT_NAME=uboot_for_tl-wr740n_v4.bin
- MD5SUM_SHOULD_BE="0c09e1d87724dc3e45872e8641b28916"
- ..
- ```
-
- **IMPORTANT**: If you're editing the file in Windows, it's best to use Notepad++. Before you save **make sure** to **Edit -> EOL Conversion -> UNIX/OSX Format**. Otherwise, your script will not run, and will return an Error 2(it stops seeing the "then" on line 8, because the EOL character breaks it).
-
- You can grab the bin file's sum by running **md5sum uboot_for_tl-wr740n_v4.bin** under Linux, or use a tool like [HashTab for Windows](http://implbits.com/HashTab/HashTabWindows.aspx).
-
-3. Once you have your shell script, and your bin file, place them in a folder(in this example, we'll call it **yourfolder**), and SCP the folder into /tmp on the router (for Windows, you can use [WinSCP](http://winscp.net/eng/index.php)).
-
-4. SSH into the router, and run the following first, to make a backup of your current U-Boot partition:
-
- ```bash
- cd /tmp/yourfolder
- cat /dev/mtd0 > ./uboot_backup.bin
- ```
-
- SCP that file back to your computer for safe keeping.
-
-5. Fix your script's permissions by invoking:
-
- ```bash
- chmod 777 /tmp/yourfolder/makeu.sh
- ```
-
-6. Run the builder script by invoking:
-
- ```bash
- ./makeu.sh
- ```
-
- You must get output similar to:
-
- ```ShellSession
- root@superhornet:/tmp/superhornet# chmod 777 makeu.sh
- root@superhornet:/tmp/superhornet# ./makeu.sh
- uboot_for_tl-wr740n_v4.bin md5sum : 0c09e1d87724dc3e45872e8641b28916
- uboot_for_tl-wr740n_v4.bin md5sum check pass
- 64512+0 records in
- 64512+0 records out
- Backup some config first,just like MAC address ...
- 1024+0 records in
- 1024+0 records out
- root@superhornet:/tmp/superhornet#
- ```
-
- This will output several files into yourfolder. The idea is that this takes part of mtd0 from address 0x1fc00 onwards, and then writes out the 64KB U-boot bin, followed by some padding, and the the information from 0x1fc00 to build a full 128KB U-boot that also contains your router's MAC Address. This is required, in order to make a file that's safely flashable. The one you're interested in will be **uboot_0x20000.bin**.
-
-7. Explore your folder, to make sure the file you're about to flash (uboot_0x200000.bin) has the correct non-zero length:
- ```bash
- ls -l
- ```
-
- Example output:
-
- ```ShellSession
- root@superhornet:/tmp/superhornet# ls -l
- -rw-r--r-- 1 root root 1024 May 19 14:06 config.bin
- -rwxrwxrwx 1 root root 876 May 18 16:03 makeu.sh
- -rw-r--r-- 1 root root 64512 May 19 14:06 pad.bin
- -rw-r--r-- 1 root root 130048 May 19 14:06 tuboot_0x1fc00.bin
- -rw-r--r-- 1 root root 131072 May 19 14:06 uboot_0x20000.bin
- -rw-r--r-- 1 root root 131072 May 18 17:45 uboot_backup.bin
- -rw-r--r-- 1 root root 65536 Jun 19 2013 uboot_for_tl-wr740n_v4.bin
- root@superhornet:/tmp/superhornet#
- ```
-
-8. Check the name of your mtd0 partition:
-
- ```bash
- cat /proc/mtd
- ```
-
- e.g.:
-
- ```ShellSession
- root@superhornet:/tmp/superhornet# cat /proc/mtd
- dev: size erasesize name
- mtd0: 00020000 00010000 "RedBoot"
- mtd1: 003c0000 00010000 "linux"
- mtd2: 002c0000 00010000 "rootfs"
- mtd3: 00010000 00010000 "ddwrt"
- mtd4: 00010000 00010000 "nvram"
- mtd5: 00010000 00010000 "board_config"
- mtd6: 00400000 00010000 "fullflash"
- mtd7: 00020000 00010000 "fullboot"
- root@superhornet:/tmp/superhornet#
- ```
-
- The one you want is mtd0. In some devices it may be labeled "u-boot", instead of "RedBoot". As long as the size reads 00020000(128KB), you are ok.
-
-9. (Point of no return step!) Flash the created image onto your mtd0. Invoke:
-
- ```bash
- mtd write uboot_0x20000.bin RedBoot
- ```
-
- In the above RedBoot is the name of the partition - it may be different between devices. This was tested successfully on TP-LINK TL-WR740 v4.23 board with a **EON EN25Q32 (4 MiB, JEDEC ID: 1C 3016)** memory chip.
-
- If an error is displayed at any point **IMMEDIATELY** revert the changes you made by restoring the backup you took earlier:
- ```bash
- mtd write uboot_backup.bin RedBoot
- ```
-
- If flashing completes with no errors, you may issue a **reboot** to reboot your router. It should start as normal.
-
-**Warning**: if the U-Boot partition is broken and the device is restarted, it becomes a superbrick (especially true for devices like tlwr740 that don't have JTAG).
+ root@DD-WRT:/tmp# cat uboot_for_tp-link_tl-mr3020.bin uboot_rest.bin > uboot_new.bin
+ ```
+
+7. **Danger**: This is the point of no return, if you have any errors or problems, please revert the original image at any time using:
+
+ ```
+ root@DD-WRT:/tmp# mtd write uboot_factory.bin "RedBoot"
+ Unlocking RedBoot ...
+ Writing from uboot_orig.bin to RedBoot ...
+ ```
+
+8. Now, to actually flash the new image, run:
+
+ ```
+ root@DD-WRT:/tmp# mtd write uboot_new.bin "RedBoot"
+ Unlocking RedBoot ...
+ Writing from uboot_new.bin to RedBoot ...
+ ```
+
+9. If you are sure that everything went OK, you may reboot the device:
+
+ ```
+ root@DD-WRT:/tmp# reboot
+ ```
How to use it?
--------------
How to compile the code?
------------------------
+### Building on Linux
+
You can use one of the free toolchains:
-- [Sourcery CodeBench Lite Edition for MIPS GNU/Linux](https://sourcery.mentor.com/GNUToolchain/subscription3130?lite=MIPS),
-- [OpenWrt Toolchain for AR71xx MIPS](http://downloads.openwrt.org/attitude_adjustment/12.09/ar71xx/generic/OpenWrt-Toolchain-ar71xx-for-mips_r2-gcc-4.6-linaro_uClibc-0.9.33.2.tar.bz2),
-- [ELDK (Embedded Linux Development Kit)](ftp://ftp.denx.de/pub/eldk/),
+- Recommended and used for snapshots build: [LEDE SDK for AR71xx MIPS (17.01.0 release)](https://downloads.lede-project.org/releases/17.01.0/targets/ar71xx/generic/lede-sdk-17.01.0-ar71xx-generic_gcc-5.4.0_musl-1.1.16.Linux-x86_64.tar.xz),
+- Recommended: [LEDE SDK for AR71xx MIPS (trunk snapshot)](https://downloads.lede-project.org/snapshots/targets/ar71xx/generic/lede-sdk-ar71xx-generic_gcc-5.4.0_musl.Linux-x86_64.tar.xz),
+- [OpenWrt SDK for AR71xx MIPS (Chaos Calmer release)](https://downloads.openwrt.org/chaos_calmer/15.05.1/ar71xx/generic/OpenWrt-SDK-15.05.1-ar71xx-generic_gcc-4.8-linaro_uClibc-0.9.33.2.Linux-x86_64.tar.bz2),
+- [OpenWrt Toolchain for AR71xx MIPS (trunk snapshot)](https://downloads.openwrt.org/snapshots/trunk/ar71xx/generic/OpenWrt-Toolchain-ar71xx-generic_gcc-5.3.0_musl-1.1.16.Linux-x86_64.tar.bz2),
+- [ELDK (Embedded Linux Development Kit)](http://bit.ly/2djaTMn),
- or any others...
-I am using **Sourcery CodeBench Lite Edition for MIPS GNU/Linux** on **Ubuntu 12.04 LTS** (32-bit, virtual machine) and all released binary images were/will be built using this set.
+I am using **OpenWrt Toolchain for AR71xx MIPS** (32-bit, virtual machine) and all released binary images were/will be built using this set.
All you need to do, after choosing a toolchain, is to modify [Makefile](Makefile) - change or remove `export MAKECMD` and if needed add `export PATH`. For example, to use OpenWrt Toolchain instead of Sourcery CodeBench Lite, download it and extract into `toolchain` folder, inside the top dir and change first lines in [Makefile](Makefile):
will start building U-Boot image for **TP-Link TL-WR703N**.
+### Building on macOS (OS X)
+
+You can build using the OpenWrt/LEDE toolchain as above under macOS (OS X) as long as you install several gnu command line tools via brew. Note that bash is required to correct the usage of colorized echo output within the Makefiles (I was suprised how inconsistent FreeBSD is with Linux/GNU in this regard).
+
+```
+brew install bash coreutils gnu-sed
+```
+
+Subsequently, in addition to the toolchain being in your path, you will need to point your path as instructed by brew to the gnu binaries (only required for the build).
+
+```
+export PATH=/usr/local/opt/coreutils/libexec/gnubin:/usr/local/opt/gnu-sed/libexec/gnubin:$PATH
+```
+
+This process was tested on Yosemite and El Capitan.
+
FAQ
---
#### 5. My device does not boot after upgrade!
-*I told you... bootloader, in this case U-Boot, is the most important piece of code inside your device. It is responsible for hardware initialization and booting an OS (kernel in this case), i.e. it's the bridge head for delegating to / flashing kernel and rootfs images. So, if during the upgrade something went wrong, your device will not boot any more. The only way to recover from such a situation in a mild way is via a JTAG adapter connection. In case of a lack of JTAG connection, you would even need to remove the FLASH chip, load proper image using an external programmer and solder it back.*
+*I told you... bootloader, in this case U-Boot, is the most important piece of code inside your device. It is responsible for hardware initialization and booting an OS (kernel in this case), i.e. it is the bridge head for delegating to / flashing kernel and rootfs images. So, if during the upgrade something went wrong, your device will not boot any more. The only way to recover from such a situation in a mild way is via a JTAG adapter connection. In case of a lack of JTAG connection, you would even need to remove the FLASH chip, load proper image using an external programmer and solder it back.*
License, outdated sources etc.
------------------------------
Credits
-------
+- Thanks to M-K O'Connell for donating a router with QCA9563
+- Thanks to Krzysztof M. for donating a TL-WDR3600 router
- Thanks to *pupie* from OpenWrt forum for his great help
- Thanks for all donators and for users who contributed in code development
projects / oweals / u-boot_mod.git / blobdiff