tools/firmware-utils/src/tplink-safeloader.c

   1 /*
   2   Copyright (c) 2014, Matthias Schiffer <mschiffer@universe-factory.net>
   3   All rights reserved.
   4
   5   Redistribution and use in source and binary forms, with or without
   6   modification, are permitted provided that the following conditions are met:
   7
   8     1. Redistributions of source code must retain the above copyright notice,
   9        this list of conditions and the following disclaimer.
  10     2. Redistributions in binary form must reproduce the above copyright notice,
  11        this list of conditions and the following disclaimer in the documentation
  12        and/or other materials provided with the distribution.
  13
  14   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  15   AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16   IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  17   DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  18   FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19   DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  20   SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  21   CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  22   OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  23   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24 */
  25
  26
  27 /*
  28    tplink-safeloader
  29
  30    Image generation tool for the TP-LINK SafeLoader as seen on
  31    TP-LINK Pharos devices (CPE210/220/510/520)
  32 */
  33
  34
  35 #include <assert.h>
  36 #include <errno.h>
  37 #include <stdbool.h>
  38 #include <stdio.h>
  39 #include <stdint.h>
  40 #include <stdlib.h>
  41 #include <string.h>
  42 #include <time.h>
  43 #include <unistd.h>
  44
  45 #include <arpa/inet.h>
  46
  47 #include <sys/types.h>
  48 #include <sys/stat.h>
  49
  50 #include "md5.h"
  51
  52
  53 #define ALIGN(x,a) ({ typeof(a) __a = (a); (((x) + __a - 1) & ~(__a - 1)); })
  54
  55
  56 #define MAX_PARTITIONS  32
  57
  58 /** An image partition table entry */
  59 struct image_partition_entry {
  60         const char *name;
  61         size_t size;
  62         uint8_t *data;
  63 };
  64
  65 /** A flash partition table entry */
  66 struct flash_partition_entry {
  67         const char *name;
  68         uint32_t base;
  69         uint32_t size;
  70 };
  71
  72 /** Firmware layout description */
  73 struct device_info {
  74         const char *id;
  75         const char *vendor;
  76         const char *support_list;
  77         char support_trail;
  78         const char *soft_ver;
  79         const struct flash_partition_entry partitions[MAX_PARTITIONS+1];
  80         const char *first_sysupgrade_partition;
  81         const char *last_sysupgrade_partition;
  82 };
  83
  84 /** The content of the soft-version structure */
  85 struct __attribute__((__packed__)) soft_version {
  86         uint32_t magic;
  87         uint32_t zero;
  88         uint8_t pad1;
  89         uint8_t version_major;
  90         uint8_t version_minor;
  91         uint8_t version_patch;
  92         uint8_t year_hi;
  93         uint8_t year_lo;
  94         uint8_t month;
  95         uint8_t day;
  96         uint32_t rev;
  97         uint8_t pad2;
  98 };
  99
 100
 101 static const uint8_t jffs2_eof_mark[4] = {0xde, 0xad, 0xc0, 0xde};
 102
 103
 104 /**
 105    Salt for the MD5 hash
 106
 107    Fortunately, TP-LINK seems to use the same salt for most devices which use
 108    the new image format.
 109 */
 110 static const uint8_t md5_salt[16] = {
 111         0x7a, 0x2b, 0x15, 0xed,
 112         0x9b, 0x98, 0x59, 0x6d,
 113         0xe5, 0x04, 0xab, 0x44,
 114         0xac, 0x2a, 0x9f, 0x4e,
 115 };
 116
 117
 118 /** Firmware layout table */
 119 static struct device_info boards[] = {
 120         /** Firmware layout for the CPE210/220 */
 121         {
 122                 .id     = "CPE210",
 123                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 124                 .support_list =
 125                         "SupportList:\r\n"
 126                         "CPE210(TP-LINK|UN|N300-2):1.0\r\n"
 127                         "CPE210(TP-LINK|UN|N300-2):1.1\r\n"
 128                         "CPE210(TP-LINK|US|N300-2):1.1\r\n"
 129                         "CPE210(TP-LINK|EU|N300-2):1.1\r\n"
 130                         "CPE220(TP-LINK|UN|N300-2):1.1\r\n"
 131                         "CPE220(TP-LINK|US|N300-2):1.1\r\n"
 132                         "CPE220(TP-LINK|EU|N300-2):1.1\r\n",
 133                 .support_trail = '\xff',
 134                 .soft_ver = NULL,
 135
 136                 .partitions = {
 137                         {"fs-uboot", 0x00000, 0x20000},
 138                         {"partition-table", 0x20000, 0x02000},
 139                         {"default-mac", 0x30000, 0x00020},
 140                         {"product-info", 0x31100, 0x00100},
 141                         {"signature", 0x32000, 0x00400},
 142                         {"os-image", 0x40000, 0x170000},
 143                         {"soft-version", 0x1b0000, 0x00100},
 144                         {"support-list", 0x1b1000, 0x00400},
 145                         {"file-system", 0x1c0000, 0x600000},
 146                         {"user-config", 0x7c0000, 0x10000},
 147                         {"default-config", 0x7d0000, 0x10000},
 148                         {"log", 0x7e0000, 0x10000},
 149                         {"radio", 0x7f0000, 0x10000},
 150                         {NULL, 0, 0}
 151                 },
 152
 153                 .first_sysupgrade_partition = "os-image",
 154                 .last_sysupgrade_partition = "file-system",
 155         },
 156
 157         /** Firmware layout for the CPE510/520 */
 158         {
 159                 .id     = "CPE510",
 160                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 161                 .support_list =
 162                         "SupportList:\r\n"
 163                         "CPE510(TP-LINK|UN|N300-5):1.0\r\n"
 164                         "CPE510(TP-LINK|UN|N300-5):1.1\r\n"
 165                         "CPE510(TP-LINK|UN|N300-5):1.1\r\n"
 166                         "CPE510(TP-LINK|US|N300-5):1.1\r\n"
 167                         "CPE510(TP-LINK|EU|N300-5):1.1\r\n"
 168                         "CPE520(TP-LINK|UN|N300-5):1.1\r\n"
 169                         "CPE520(TP-LINK|US|N300-5):1.1\r\n"
 170                         "CPE520(TP-LINK|EU|N300-5):1.1\r\n",
 171                 .support_trail = '\xff',
 172                 .soft_ver = NULL,
 173
 174                 .partitions = {
 175                         {"fs-uboot", 0x00000, 0x20000},
 176                         {"partition-table", 0x20000, 0x02000},
 177                         {"default-mac", 0x30000, 0x00020},
 178                         {"product-info", 0x31100, 0x00100},
 179                         {"signature", 0x32000, 0x00400},
 180                         {"os-image", 0x40000, 0x170000},
 181                         {"soft-version", 0x1b0000, 0x00100},
 182                         {"support-list", 0x1b1000, 0x00400},
 183                         {"file-system", 0x1c0000, 0x600000},
 184                         {"user-config", 0x7c0000, 0x10000},
 185                         {"default-config", 0x7d0000, 0x10000},
 186                         {"log", 0x7e0000, 0x10000},
 187                         {"radio", 0x7f0000, 0x10000},
 188                         {NULL, 0, 0}
 189                 },
 190
 191                 .first_sysupgrade_partition = "os-image",
 192                 .last_sysupgrade_partition = "file-system",
 193         },
 194
 195         {
 196                 .id     = "WBS210",
 197                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 198                 .support_list =
 199                         "SupportList:\r\n"
 200                         "WBS210(TP-LINK|UN|N300-2):1.20\r\n"
 201                         "WBS210(TP-LINK|US|N300-2):1.20\r\n"
 202                         "WBS210(TP-LINK|EU|N300-2):1.20\r\n",
 203                 .support_trail = '\xff',
 204                 .soft_ver = NULL,
 205
 206                 .partitions = {
 207                         {"fs-uboot", 0x00000, 0x20000},
 208                         {"partition-table", 0x20000, 0x02000},
 209                         {"default-mac", 0x30000, 0x00020},
 210                         {"product-info", 0x31100, 0x00100},
 211                         {"signature", 0x32000, 0x00400},
 212                         {"os-image", 0x40000, 0x170000},
 213                         {"soft-version", 0x1b0000, 0x00100},
 214                         {"support-list", 0x1b1000, 0x00400},
 215                         {"file-system", 0x1c0000, 0x600000},
 216                         {"user-config", 0x7c0000, 0x10000},
 217                         {"default-config", 0x7d0000, 0x10000},
 218                         {"log", 0x7e0000, 0x10000},
 219                         {"radio", 0x7f0000, 0x10000},
 220                         {NULL, 0, 0}
 221                 },
 222
 223                 .first_sysupgrade_partition = "os-image",
 224                 .last_sysupgrade_partition = "file-system",
 225         },
 226
 227         {
 228                 .id     = "WBS510",
 229                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 230                 .support_list =
 231                         "SupportList:\r\n"
 232                         "WBS510(TP-LINK|UN|N300-5):1.20\r\n"
 233                         "WBS510(TP-LINK|US|N300-5):1.20\r\n"
 234                         "WBS510(TP-LINK|EU|N300-5):1.20\r\n",
 235                 .support_trail = '\xff',
 236                 .soft_ver = NULL,
 237
 238                 .partitions = {
 239                         {"fs-uboot", 0x00000, 0x20000},
 240                         {"partition-table", 0x20000, 0x02000},
 241                         {"default-mac", 0x30000, 0x00020},
 242                         {"product-info", 0x31100, 0x00100},
 243                         {"signature", 0x32000, 0x00400},
 244                         {"os-image", 0x40000, 0x170000},
 245                         {"soft-version", 0x1b0000, 0x00100},
 246                         {"support-list", 0x1b1000, 0x00400},
 247                         {"file-system", 0x1c0000, 0x600000},
 248                         {"user-config", 0x7c0000, 0x10000},
 249                         {"default-config", 0x7d0000, 0x10000},
 250                         {"log", 0x7e0000, 0x10000},
 251                         {"radio", 0x7f0000, 0x10000},
 252                         {NULL, 0, 0}
 253                 },
 254
 255                 .first_sysupgrade_partition = "os-image",
 256                 .last_sysupgrade_partition = "file-system",
 257         },
 258
 259         /** Firmware layout for the C2600 */
 260         {
 261                 .id = "C2600",
 262                 .vendor = "",
 263                 .support_list =
 264                         "SupportList:\r\n"
 265                         "{product_name:Archer C2600,product_ver:1.0.0,special_id:00000000}\r\n",
 266                 .support_trail = '\x00',
 267                 .soft_ver = NULL,
 268
 269                 .partitions = {
 270                         {"SBL1", 0x00000, 0x20000},
 271                         {"MIBIB", 0x20000, 0x20000},
 272                         {"SBL2", 0x40000, 0x20000},
 273                         {"SBL3", 0x60000, 0x30000},
 274                         {"DDRCONFIG", 0x90000, 0x10000},
 275                         {"SSD", 0xa0000, 0x10000},
 276                         {"TZ", 0xb0000, 0x30000},
 277                         {"RPM", 0xe0000, 0x20000},
 278                         {"fs-uboot", 0x100000, 0x70000},
 279                         {"uboot-env", 0x170000, 0x40000},
 280                         {"radio", 0x1b0000, 0x40000},
 281                         {"os-image", 0x1f0000, 0x200000},
 282                         {"file-system", 0x3f0000, 0x1b00000},
 283                         {"default-mac", 0x1ef0000, 0x00200},
 284                         {"pin", 0x1ef0200, 0x00200},
 285                         {"product-info", 0x1ef0400, 0x0fc00},
 286                         {"partition-table", 0x1f00000, 0x10000},
 287                         {"soft-version", 0x1f10000, 0x10000},
 288                         {"support-list", 0x1f20000, 0x10000},
 289                         {"profile", 0x1f30000, 0x10000},
 290                         {"default-config", 0x1f40000, 0x10000},
 291                         {"user-config", 0x1f50000, 0x40000},
 292                         {"qos-db", 0x1f90000, 0x40000},
 293                         {"usb-config", 0x1fd0000, 0x10000},
 294                         {"log", 0x1fe0000, 0x20000},
 295                         {NULL, 0, 0}
 296                 },
 297
 298                 .first_sysupgrade_partition = "os-image",
 299                 .last_sysupgrade_partition = "file-system"
 300         },
 301
 302         /** Firmware layout for the C25v1 */
 303         {
 304                 .id = "ARCHER-C25-V1",
 305                 .support_list =
 306                         "SupportList:\n"
 307                         "{product_name:ArcherC25,product_ver:1.0.0,special_id:00000000}\n"
 308                         "{product_name:ArcherC25,product_ver:1.0.0,special_id:55530000}\n"
 309                         "{product_name:ArcherC25,product_ver:1.0.0,special_id:45550000}\n",
 310                 .support_trail = '\x00',
 311                 .soft_ver = "soft_ver:1.0.0\n",
 312
 313                 /**
 314                     We use a bigger os-image partition than the stock images (and thus
 315                     smaller file-system), as our kernel doesn't fit in the stock firmware's
 316                     1MB os-image.
 317                 */
 318                 .partitions = {
 319                         {"factory-boot", 0x00000, 0x20000},
 320                         {"fs-uboot", 0x20000, 0x10000},
 321                         {"os-image", 0x30000, 0x180000},        /* Stock: base 0x30000 size 0x100000 */
 322                         {"file-system", 0x1b0000, 0x620000},    /* Stock: base 0x130000 size 0x6a0000 */
 323                         {"user-config", 0x7d0000, 0x04000},
 324                         {"default-mac", 0x7e0000, 0x00100},
 325                         {"device-id", 0x7e0100, 0x00100},
 326                         {"extra-para", 0x7e0200, 0x00100},
 327                         {"pin", 0x7e0300, 0x00100},
 328                         {"support-list", 0x7e0400, 0x00400},
 329                         {"soft-version", 0x7e0800, 0x00400},
 330                         {"product-info", 0x7e0c00, 0x01400},
 331                         {"partition-table", 0x7e2000, 0x01000},
 332                         {"profile", 0x7e3000, 0x01000},
 333                         {"default-config", 0x7e4000, 0x04000},
 334                         {"merge-config", 0x7ec000, 0x02000},
 335                         {"qos-db", 0x7ee000, 0x02000},
 336                         {"radio", 0x7f0000, 0x10000},
 337                         {NULL, 0, 0}
 338                 },
 339
 340                 .first_sysupgrade_partition = "os-image",
 341                 .last_sysupgrade_partition = "file-system",
 342         },
 343
 344         /** Firmware layout for the C58v1 */
 345         {
 346                 .id     = "ARCHER-C58-V1",
 347                 .vendor = "",
 348                 .support_list =
 349                         "SupportList:\r\n"
 350                         "{product_name:Archer C58,product_ver:1.0.0,special_id:00000000}\r\n"
 351                         "{product_name:Archer C58,product_ver:1.0.0,special_id:45550000}\r\n"
 352                         "{product_name:Archer C58,product_ver:1.0.0,special_id:55530000}\r\n",
 353                 .support_trail = '\x00',
 354                 .soft_ver = "soft_ver:1.0.0\n",
 355
 356                 .partitions = {
 357                         {"fs-uboot", 0x00000, 0x10000},
 358                         {"default-mac", 0x10000, 0x00200},
 359                         {"pin", 0x10200, 0x00200},
 360                         {"product-info", 0x10400, 0x00100},
 361                         {"partition-table", 0x10500, 0x00800},
 362                         {"soft-version", 0x11300, 0x00200},
 363                         {"support-list", 0x11500, 0x00100},
 364                         {"device-id", 0x11600, 0x00100},
 365                         {"profile", 0x11700, 0x03900},
 366                         {"default-config", 0x15000, 0x04000},
 367                         {"user-config", 0x19000, 0x04000},
 368                         {"os-image", 0x20000, 0x180000},
 369                         {"file-system", 0x1a0000, 0x648000},
 370                         {"certyficate", 0x7e8000, 0x08000},
 371                         {"radio", 0x7f0000, 0x10000},
 372                         {NULL, 0, 0}
 373                 },
 374
 375                 .first_sysupgrade_partition = "os-image",
 376                 .last_sysupgrade_partition = "file-system",
 377         },
 378
 379         /** Firmware layout for the C59v1 */
 380         {
 381                 .id     = "ARCHER-C59-V1",
 382                 .vendor = "",
 383                 .support_list =
 384                         "SupportList:\r\n"
 385                         "{product_name:Archer C59,product_ver:1.0.0,special_id:00000000}\r\n"
 386                         "{product_name:Archer C59,product_ver:1.0.0,special_id:45550000}\r\n"
 387                         "{product_name:Archer C59,product_ver:1.0.0,special_id:52550000}\r\n"
 388                         "{product_name:Archer C59,product_ver:1.0.0,special_id:55530000}\r\n",
 389                 .support_trail = '\x00',
 390                 .soft_ver = "soft_ver:1.0.0\n",
 391
 392                 .partitions = {
 393                         {"fs-uboot", 0x00000, 0x10000},
 394                         {"default-mac", 0x10000, 0x00200},
 395                         {"pin", 0x10200, 0x00200},
 396                         {"device-id", 0x10400, 0x00100},
 397                         {"product-info", 0x10500, 0x0fb00},
 398                         {"os-image", 0x20000, 0x180000},
 399                         {"file-system", 0x1a0000, 0xcb0000},
 400                         {"partition-table", 0xe50000, 0x10000},
 401                         {"soft-version", 0xe60000, 0x10000},
 402                         {"support-list", 0xe70000, 0x10000},
 403                         {"profile", 0xe80000, 0x10000},
 404                         {"default-config", 0xe90000, 0x10000},
 405                         {"user-config", 0xea0000, 0x40000},
 406                         {"usb-config", 0xee0000, 0x10000},
 407                         {"certificate", 0xef0000, 0x10000},
 408                         {"qos-db", 0xf00000, 0x40000},
 409                         {"log", 0xfe0000, 0x10000},
 410                         {"radio", 0xff0000, 0x10000},
 411                         {NULL, 0, 0}
 412                 },
 413
 414                 .first_sysupgrade_partition = "os-image",
 415                 .last_sysupgrade_partition = "file-system",
 416         },
 417
 418         /** Firmware layout for the C60v1 */
 419         {
 420                 .id     = "ARCHER-C60-V1",
 421                 .vendor = "",
 422                 .support_list =
 423                         "SupportList:\r\n"
 424                         "{product_name:Archer C60,product_ver:1.0.0,special_id:00000000}\r\n"
 425                         "{product_name:Archer C60,product_ver:1.0.0,special_id:45550000}\r\n"
 426                         "{product_name:Archer C60,product_ver:1.0.0,special_id:55530000}\r\n",
 427                 .support_trail = '\x00',
 428                 .soft_ver = "soft_ver:1.0.0\n",
 429
 430                 .partitions = {
 431                         {"fs-uboot", 0x00000, 0x10000},
 432                         {"default-mac", 0x10000, 0x00200},
 433                         {"pin", 0x10200, 0x00200},
 434                         {"product-info", 0x10400, 0x00100},
 435                         {"partition-table", 0x10500, 0x00800},
 436                         {"soft-version", 0x11300, 0x00200},
 437                         {"support-list", 0x11500, 0x00100},
 438                         {"device-id", 0x11600, 0x00100},
 439                         {"profile", 0x11700, 0x03900},
 440                         {"default-config", 0x15000, 0x04000},
 441                         {"user-config", 0x19000, 0x04000},
 442                         {"os-image", 0x20000, 0x180000},
 443                         {"file-system", 0x1a0000, 0x648000},
 444                         {"certyficate", 0x7e8000, 0x08000},
 445                         {"radio", 0x7f0000, 0x10000},
 446                         {NULL, 0, 0}
 447                 },
 448
 449                 .first_sysupgrade_partition = "os-image",
 450                 .last_sysupgrade_partition = "file-system",
 451         },
 452
 453         /** Firmware layout for the C5 */
 454         {
 455                 .id = "ARCHER-C5-V2",
 456                 .vendor = "",
 457                 .support_list =
 458                         "SupportList:\r\n"
 459                         "{product_name:ArcherC5,product_ver:2.0.0,special_id:00000000}\r\n"
 460                         "{product_name:ArcherC5,product_ver:2.0.0,special_id:55530000}\r\n"
 461                         "{product_name:ArcherC5,product_ver:2.0.0,special_id:4A500000}\r\n", /* JP version */
 462                 .support_trail = '\x00',
 463                 .soft_ver = NULL,
 464
 465                 .partitions = {
 466                         {"fs-uboot", 0x00000, 0x40000},
 467                         {"os-image", 0x40000, 0x200000},
 468                         {"file-system", 0x240000, 0xc00000},
 469                         {"default-mac", 0xe40000, 0x00200},
 470                         {"pin", 0xe40200, 0x00200},
 471                         {"product-info", 0xe40400, 0x00200},
 472                         {"partition-table", 0xe50000, 0x10000},
 473                         {"soft-version", 0xe60000, 0x00200},
 474                         {"support-list", 0xe61000, 0x0f000},
 475                         {"profile", 0xe70000, 0x10000},
 476                         {"default-config", 0xe80000, 0x10000},
 477                         {"user-config", 0xe90000, 0x50000},
 478                         {"log", 0xee0000, 0x100000},
 479                         {"radio_bk", 0xfe0000, 0x10000},
 480                         {"radio", 0xff0000, 0x10000},
 481                         {NULL, 0, 0}
 482                 },
 483
 484                 .first_sysupgrade_partition = "os-image",
 485                 .last_sysupgrade_partition = "file-system"
 486         },
 487
 488         /** Firmware layout for the C7 */
 489         {
 490                 .id = "ARCHER-C7-V4",
 491                 .support_list =
 492                         "SupportList:\n"
 493                         "{product_name:Archer C7,product_ver:4.0.0,special_id:00000000}\n"
 494                         "{product_name:Archer C7,product_ver:4.0.0,special_id:41550000}\n"
 495                         "{product_name:Archer C7,product_ver:4.0.0,special_id:45550000}\n"
 496                         "{product_name:Archer C7,product_ver:4.0.0,special_id:4B520000}\n"
 497                         "{product_name:Archer C7,product_ver:4.0.0,special_id:42520000}\n"
 498                         "{product_name:Archer C7,product_ver:4.0.0,special_id:4A500000}\n"
 499                         "{product_name:Archer C7,product_ver:4.0.0,special_id:52550000}\n"
 500                         "{product_name:Archer C7,product_ver:4.0.0,special_id:54570000}\n"
 501                         "{product_name:Archer C7,product_ver:4.0.0,special_id:55530000}\n"
 502                         "{product_name:Archer C7,product_ver:4.0.0,special_id:43410000}\n",
 503                 .support_trail = '\x00',
 504                 .soft_ver = "soft_ver:1.0.0\n",
 505
 506                 /**
 507                     We use a bigger os-image partition than the stock images (and thus
 508                     smaller file-system), as our kernel doesn't fit in the stock firmware's
 509                     1MB os-image.
 510                 */
 511                 .partitions = {
 512                         {"factory-boot", 0x00000, 0x20000},
 513                         {"fs-uboot", 0x20000, 0x20000},
 514                         {"os-image", 0x40000, 0x180000},        /* Stock: base 0x40000 size 0x120000 */
 515                         {"file-system", 0x1c0000, 0xd40000},    /* Stock: base 0x160000 size 0xda0000 */
 516                         {"default-mac", 0xf00000, 0x00200},
 517                         {"pin", 0xf00200, 0x00200},
 518                         {"device-id", 0xf00400, 0x00100},
 519                         {"product-info", 0xf00500, 0x0fb00},
 520                         {"soft-version", 0xf10000, 0x00100},
 521                         {"extra-para", 0xf11000, 0x01000},
 522                         {"support-list", 0xf12000, 0x0a000},
 523                         {"profile", 0xf1c000, 0x04000},
 524                         {"default-config", 0xf20000, 0x10000},
 525                         {"user-config", 0xf30000, 0x40000},
 526                         {"qos-db", 0xf70000, 0x40000},
 527                         {"certificate", 0xfb0000, 0x10000},
 528                         {"partition-table", 0xfc0000, 0x10000},
 529                         {"log", 0xfd0000, 0x20000},
 530                         {"radio", 0xff0000, 0x10000},
 531                         {NULL, 0, 0}
 532                 },
 533
 534                 .first_sysupgrade_partition = "os-image",
 535                 .last_sysupgrade_partition = "file-system",
 536         },
 537
 538         /** Firmware layout for the C9 */
 539         {
 540                 .id = "ARCHERC9",
 541                 .vendor = "",
 542                 .support_list =
 543                         "SupportList:\n"
 544                         "{product_name:ArcherC9,"
 545                         "product_ver:1.0.0,"
 546                         "special_id:00000000}\n",
 547                 .support_trail = '\x00',
 548                 .soft_ver = NULL,
 549
 550                 .partitions = {
 551                         {"fs-uboot", 0x00000, 0x40000},
 552                         {"os-image", 0x40000, 0x200000},
 553                         {"file-system", 0x240000, 0xc00000},
 554                         {"default-mac", 0xe40000, 0x00200},
 555                         {"pin", 0xe40200, 0x00200},
 556                         {"product-info", 0xe40400, 0x00200},
 557                         {"partition-table", 0xe50000, 0x10000},
 558                         {"soft-version", 0xe60000, 0x00200},
 559                         {"support-list", 0xe61000, 0x0f000},
 560                         {"profile", 0xe70000, 0x10000},
 561                         {"default-config", 0xe80000, 0x10000},
 562                         {"user-config", 0xe90000, 0x50000},
 563                         {"log", 0xee0000, 0x100000},
 564                         {"radio_bk", 0xfe0000, 0x10000},
 565                         {"radio", 0xff0000, 0x10000},
 566                         {NULL, 0, 0}
 567                 },
 568
 569                 .first_sysupgrade_partition = "os-image",
 570                 .last_sysupgrade_partition = "file-system"
 571         },
 572
 573         /** Firmware layout for the EAP120 */
 574         {
 575                 .id     = "EAP120",
 576                 .vendor = "EAP120(TP-LINK|UN|N300-2):1.0\r\n",
 577                 .support_list =
 578                         "SupportList:\r\n"
 579                         "EAP120(TP-LINK|UN|N300-2):1.0\r\n",
 580                 .support_trail = '\xff',
 581                 .soft_ver = NULL,
 582
 583                 .partitions = {
 584                         {"fs-uboot", 0x00000, 0x20000},
 585                         {"partition-table", 0x20000, 0x02000},
 586                         {"default-mac", 0x30000, 0x00020},
 587                         {"support-list", 0x31000, 0x00100},
 588                         {"product-info", 0x31100, 0x00100},
 589                         {"soft-version", 0x32000, 0x00100},
 590                         {"os-image", 0x40000, 0x180000},
 591                         {"file-system", 0x1c0000, 0x600000},
 592                         {"user-config", 0x7c0000, 0x10000},
 593                         {"backup-config", 0x7d0000, 0x10000},
 594                         {"log", 0x7e0000, 0x10000},
 595                         {"radio", 0x7f0000, 0x10000},
 596                         {NULL, 0, 0}
 597                 },
 598
 599                 .first_sysupgrade_partition = "os-image",
 600                 .last_sysupgrade_partition = "file-system"
 601         },
 602
 603         /** Firmware layout for the TL-WA850RE v2 */
 604         {
 605                 .id     = "TLWA850REV2",
 606                 .vendor = "",
 607                 .support_list =
 608                         "SupportList:\n"
 609                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:55530000}\n"
 610                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:00000000}\n"
 611                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:55534100}\n"
 612                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:45550000}\n"
 613                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:4B520000}\n"
 614                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:42520000}\n"
 615                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:4A500000}\n"
 616                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:43410000}\n"
 617                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:41550000}\n"
 618                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:52550000}\n",
 619                 .support_trail = '\x00',
 620                 .soft_ver = NULL,
 621
 622                 /**
 623                    576KB were moved from file-system to os-image
 624                    in comparison to the stock image
 625                 */
 626                 .partitions = {
 627                         {"fs-uboot", 0x00000, 0x20000},
 628                         {"os-image", 0x20000, 0x150000},
 629                         {"file-system", 0x170000, 0x240000},
 630                         {"partition-table", 0x3b0000, 0x02000},
 631                         {"default-mac", 0x3c0000, 0x00020},
 632                         {"pin", 0x3c0100, 0x00020},
 633                         {"product-info", 0x3c1000, 0x01000},
 634                         {"soft-version", 0x3c2000, 0x00100},
 635                         {"support-list", 0x3c3000, 0x01000},
 636                         {"profile", 0x3c4000, 0x08000},
 637                         {"user-config", 0x3d0000, 0x10000},
 638                         {"default-config", 0x3e0000, 0x10000},
 639                         {"radio", 0x3f0000, 0x10000},
 640                         {NULL, 0, 0}
 641                 },
 642
 643                 .first_sysupgrade_partition = "os-image",
 644                 .last_sysupgrade_partition = "file-system"
 645         },
 646
 647         /** Firmware layout for the TL-WA855RE v1 */
 648         {
 649                 .id     = "TLWA855REV1",
 650                 .vendor = "",
 651                 .support_list =
 652                         "SupportList:\n"
 653                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:00000000}\n"
 654                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:55530000}\n"
 655                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:45550000}\n"
 656                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:4B520000}\n"
 657                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:42520000}\n"
 658                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:4A500000}\n"
 659                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:43410000}\n"
 660                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:41550000}\n"
 661                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:52550000}\n",
 662                 .support_trail = '\x00',
 663                 .soft_ver = NULL,
 664
 665                 .partitions = {
 666                         {"fs-uboot", 0x00000, 0x20000},
 667                         {"os-image", 0x20000, 0x150000},
 668                         {"file-system", 0x170000, 0x240000},
 669                         {"partition-table", 0x3b0000, 0x02000},
 670                         {"default-mac", 0x3c0000, 0x00020},
 671                         {"pin", 0x3c0100, 0x00020},
 672                         {"product-info", 0x3c1000, 0x01000},
 673                         {"soft-version", 0x3c2000, 0x00100},
 674                         {"support-list", 0x3c3000, 0x01000},
 675                         {"profile", 0x3c4000, 0x08000},
 676                         {"user-config", 0x3d0000, 0x10000},
 677                         {"default-config", 0x3e0000, 0x10000},
 678                         {"radio", 0x3f0000, 0x10000},
 679                         {NULL, 0, 0}
 680                 },
 681
 682                 .first_sysupgrade_partition = "os-image",
 683                 .last_sysupgrade_partition = "file-system"
 684         },
 685
 686         /** Firmware layout for the TL-WR1043 v4 */
 687         {
 688                 .id     = "TLWR1043NDV4",
 689                 .vendor = "",
 690                 .support_list =
 691                         "SupportList:\n"
 692                         "{product_name:TL-WR1043ND,product_ver:4.0.0,special_id:45550000}\n",
 693                 .support_trail = '\x00',
 694                 .soft_ver = NULL,
 695
 696                 /**
 697                     We use a bigger os-image partition than the stock images (and thus
 698                     smaller file-system), as our kernel doesn't fit in the stock firmware's
 699                     1MB os-image.
 700                 */
 701                 .partitions = {
 702                         {"fs-uboot", 0x00000, 0x20000},
 703                         {"os-image", 0x20000, 0x180000},
 704                         {"file-system", 0x1a0000, 0xdb0000},
 705                         {"default-mac", 0xf50000, 0x00200},
 706                         {"pin", 0xf50200, 0x00200},
 707                         {"product-info", 0xf50400, 0x0fc00},
 708                         {"soft-version", 0xf60000, 0x0b000},
 709                         {"support-list", 0xf6b000, 0x04000},
 710                         {"profile", 0xf70000, 0x04000},
 711                         {"default-config", 0xf74000, 0x0b000},
 712                         {"user-config", 0xf80000, 0x40000},
 713                         {"partition-table", 0xfc0000, 0x10000},
 714                         {"log", 0xfd0000, 0x20000},
 715                         {"radio", 0xff0000, 0x10000},
 716                         {NULL, 0, 0}
 717                 },
 718
 719                 .first_sysupgrade_partition = "os-image",
 720                 .last_sysupgrade_partition = "file-system"
 721         },
 722
 723         /** Firmware layout for the TL-WR902AC v1 */
 724         {
 725                 .id     = "TL-WR902AC-V1",
 726                 .vendor = "",
 727                 .support_list =
 728                         "SupportList:\n"
 729                         "{product_name:TL-WR902AC,product_ver:1.0.0,special_id:45550000}\n"
 730                         "{product_name:TL-WR902AC,product_ver:1.0.0,special_id:55530000}\n",
 731                 .support_trail = '\x00',
 732                 .soft_ver = NULL,
 733
 734                 /**
 735                    384KB were moved from file-system to os-image
 736                    in comparison to the stock image
 737                 */
 738                 .partitions = {
 739                         {"fs-uboot", 0x00000, 0x20000},
 740                         {"os-image", 0x20000, 0x180000},
 741                         {"file-system", 0x1a0000, 0x5b0000},
 742                         {"default-mac", 0x750000, 0x00200},
 743                         {"pin", 0x750200, 0x00200},
 744                         {"product-info", 0x750400, 0x0fc00},
 745                         {"soft-version", 0x760000, 0x0b000},
 746                         {"support-list", 0x76b000, 0x04000},
 747                         {"profile", 0x770000, 0x04000},
 748                         {"default-config", 0x774000, 0x0b000},
 749                         {"user-config", 0x780000, 0x40000},
 750                         {"partition-table", 0x7c0000, 0x10000},
 751                         {"log", 0x7d0000, 0x20000},
 752                         {"radio", 0x7f0000, 0x10000},
 753                         {NULL, 0, 0}
 754                 },
 755
 756                 .first_sysupgrade_partition = "os-image",
 757                 .last_sysupgrade_partition = "file-system",
 758         },
 759
 760         /** Firmware layout for the TL-WR942N V1 */
 761         {
 762                 .id     = "TLWR942NV1",
 763                 .vendor = "",
 764                 .support_list =
 765                         "SupportList:\r\n"
 766                         "{product_name:TL-WR942N,product_ver:1.0.0,special_id:00000000}\r\n"
 767                         "{product_name:TL-WR942N,product_ver:1.0.0,special_id:52550000}\r\n",
 768                 .support_trail = '\x00',
 769                 .soft_ver = NULL,
 770
 771                 .partitions = {
 772                         {"fs-uboot", 0x00000, 0x20000},
 773                         {"os-image", 0x20000, 0x180000},
 774                         {"file-system", 0x1a0000, 0xca0000},
 775                         {"default-mac", 0xe40000, 0x00200},
 776                         {"pin", 0xe40200, 0x00200},
 777                         {"product-info", 0xe40400, 0x0fc00},
 778                         {"partition-table", 0xe50000, 0x10000},
 779                         {"soft-version", 0xe60000, 0x10000},
 780                         {"support-list", 0xe70000, 0x10000},
 781                         {"profile", 0xe80000, 0x10000},
 782                         {"default-config", 0xe90000, 0x10000},
 783                         {"user-config", 0xea0000, 0x40000},
 784                         {"qos-db", 0xee0000, 0x40000},
 785                         {"certificate", 0xf20000, 0x10000},
 786                         {"usb-config", 0xfb0000, 0x10000},
 787                         {"log", 0xfc0000, 0x20000},
 788                         {"radio-bk", 0xfe0000, 0x10000},
 789                         {"radio", 0xff0000, 0x10000},
 790                         {NULL, 0, 0}
 791                 },
 792
 793                 .first_sysupgrade_partition = "os-image",
 794                 .last_sysupgrade_partition = "file-system",
 795         },
 796
 797         /** Firmware layout for the RE350 v1 */
 798         {
 799                 .id = "RE350-V1",
 800                 .vendor = "",
 801                 .support_list =
 802                         "SupportList:\n"
 803                         "{product_name:RE350,product_ver:1.0.0,special_id:45550000}\n"
 804                         "{product_name:RE350,product_ver:1.0.0,special_id:00000000}\n"
 805                         "{product_name:RE350,product_ver:1.0.0,special_id:41550000}\n"
 806                         "{product_name:RE350,product_ver:1.0.0,special_id:55530000}\n"
 807                         "{product_name:RE350,product_ver:1.0.0,special_id:43410000}\n"
 808                         "{product_name:RE350,product_ver:1.0.0,special_id:4b520000}\n"
 809                         "{product_name:RE350,product_ver:1.0.0,special_id:4a500000}\n",
 810                 .support_trail = '\x00',
 811                 .soft_ver = NULL,
 812
 813                 /**
 814                         The original os-image partition is too small,
 815                         so we enlarge it to 1.6M
 816                 */
 817                 .partitions = {
 818                         {"fs-uboot", 0x00000, 0x20000},
 819                         {"os-image", 0x20000, 0x1a0000},
 820                         {"file-system", 0x1c0000, 0x440000},
 821                         {"partition-table", 0x600000, 0x02000},
 822                         {"default-mac", 0x610000, 0x00020},
 823                         {"pin", 0x610100, 0x00020},
 824                         {"product-info", 0x611100, 0x01000},
 825                         {"soft-version", 0x620000, 0x01000},
 826                         {"support-list", 0x621000, 0x01000},
 827                         {"profile", 0x622000, 0x08000},
 828                         {"user-config", 0x630000, 0x10000},
 829                         {"default-config", 0x640000, 0x10000},
 830                         {"radio", 0x7f0000, 0x10000},
 831                         {NULL, 0, 0}
 832                 },
 833
 834                 .first_sysupgrade_partition = "os-image",
 835                 .last_sysupgrade_partition = "file-system"
 836         },
 837
 838         /** Firmware layout for the RE450 */
 839         {
 840                 .id = "RE450",
 841                 .vendor = "",
 842                 .support_list =
 843                         "SupportList:\r\n"
 844                         "{product_name:RE450,product_ver:1.0.0,special_id:00000000}\r\n"
 845                         "{product_name:RE450,product_ver:1.0.0,special_id:55530000}\r\n"
 846                         "{product_name:RE450,product_ver:1.0.0,special_id:45550000}\r\n"
 847                         "{product_name:RE450,product_ver:1.0.0,special_id:4A500000}\r\n"
 848                         "{product_name:RE450,product_ver:1.0.0,special_id:43410000}\r\n"
 849                         "{product_name:RE450,product_ver:1.0.0,special_id:41550000}\r\n"
 850                         "{product_name:RE450,product_ver:1.0.0,special_id:4B520000}\r\n"
 851                         "{product_name:RE450,product_ver:1.0.0,special_id:55534100}\r\n",
 852                 .support_trail = '\x00',
 853                 .soft_ver = NULL,
 854
 855                 /**
 856                    The flash partition table for RE450;
 857                    it is almost the same as the one used by the stock images,
 858                    576KB were moved from file-system to os-image.
 859                 */
 860                 .partitions = {
 861                         {"fs-uboot", 0x00000, 0x20000},
 862                         {"os-image", 0x20000, 0x180000},
 863                         {"file-system", 0x1a0000, 0x460000},
 864                         {"partition-table", 0x600000, 0x02000},
 865                         {"default-mac", 0x610000, 0x00020},
 866                         {"pin", 0x610100, 0x00020},
 867                         {"product-info", 0x611100, 0x01000},
 868                         {"soft-version", 0x620000, 0x01000},
 869                         {"support-list", 0x621000, 0x01000},
 870                         {"profile", 0x622000, 0x08000},
 871                         {"user-config", 0x630000, 0x10000},
 872                         {"default-config", 0x640000, 0x10000},
 873                         {"radio", 0x7f0000, 0x10000},
 874                         {NULL, 0, 0}
 875                 },
 876
 877                 .first_sysupgrade_partition = "os-image",
 878                 .last_sysupgrade_partition = "file-system"
 879         },
 880
 881         {}
 882 };
 883
 884 #define error(_ret, _errno, _str, ...)                          \
 885         do {                                                    \
 886                 fprintf(stderr, _str ": %s\n", ## __VA_ARGS__,  \
 887                         strerror(_errno));                      \
 888                 if (_ret)                                       \
 889                         exit(_ret);                             \
 890         } while (0)
 891
 892
 893 /** Stores a uint32 as big endian */
 894 static inline void put32(uint8_t *buf, uint32_t val) {
 895         buf[0] = val >> 24;
 896         buf[1] = val >> 16;
 897         buf[2] = val >> 8;
 898         buf[3] = val;
 899 }
 900
 901 /** Allocates a new image partition */
 902 static struct image_partition_entry alloc_image_partition(const char *name, size_t len) {
 903         struct image_partition_entry entry = {name, len, malloc(len)};
 904         if (!entry.data)
 905                 error(1, errno, "malloc");
 906
 907         return entry;
 908 }
 909
 910 /** Frees an image partition */
 911 static void free_image_partition(struct image_partition_entry entry) {
 912         free(entry.data);
 913 }
 914
 915 static time_t source_date_epoch = -1;
 916 static void set_source_date_epoch() {
 917         char *env = getenv("SOURCE_DATE_EPOCH");
 918         char *endptr = env;
 919         errno = 0;
 920         if (env && *env) {
 921                 source_date_epoch = strtoull(env, &endptr, 10);
 922                 if (errno || (endptr && *endptr != '\0')) {
 923                         fprintf(stderr, "Invalid SOURCE_DATE_EPOCH");
 924                         exit(1);
 925                 }
 926         }
 927 }
 928
 929 /** Generates the partition-table partition */
 930 static struct image_partition_entry make_partition_table(const struct flash_partition_entry *p) {
 931         struct image_partition_entry entry = alloc_image_partition("partition-table", 0x800);
 932
 933         char *s = (char *)entry.data, *end = (char *)(s+entry.size);
 934
 935         *(s++) = 0x00;
 936         *(s++) = 0x04;
 937         *(s++) = 0x00;
 938         *(s++) = 0x00;
 939
 940         size_t i;
 941         for (i = 0; p[i].name; i++) {
 942                 size_t len = end-s;
 943                 size_t w = snprintf(s, len, "partition %s base 0x%05x size 0x%05x\n", p[i].name, p[i].base, p[i].size);
 944
 945                 if (w > len-1)
 946                         error(1, 0, "flash partition table overflow?");
 947
 948                 s += w;
 949         }
 950
 951         s++;
 952
 953         memset(s, 0xff, end-s);
 954
 955         return entry;
 956 }
 957
 958
 959 /** Generates a binary-coded decimal representation of an integer in the range [0, 99] */
 960 static inline uint8_t bcd(uint8_t v) {
 961         return 0x10 * (v/10) + v%10;
 962 }
 963
 964
 965 /** Generates the soft-version partition */
 966 static struct image_partition_entry make_soft_version(uint32_t rev) {
 967         struct image_partition_entry entry = alloc_image_partition("soft-version", sizeof(struct soft_version));
 968         struct soft_version *s = (struct soft_version *)entry.data;
 969
 970         time_t t;
 971
 972         if (source_date_epoch != -1)
 973                 t = source_date_epoch;
 974         else if (time(&t) == (time_t)(-1))
 975                 error(1, errno, "time");
 976
 977         struct tm *tm = localtime(&t);
 978
 979         s->magic = htonl(0x0000000c);
 980         s->zero = 0;
 981         s->pad1 = 0xff;
 982
 983         s->version_major = 0;
 984         s->version_minor = 0;
 985         s->version_patch = 0;
 986
 987         s->year_hi = bcd((1900+tm->tm_year)/100);
 988         s->year_lo = bcd(tm->tm_year%100);
 989         s->month = bcd(tm->tm_mon+1);
 990         s->day = bcd(tm->tm_mday);
 991         s->rev = htonl(rev);
 992
 993         s->pad2 = 0xff;
 994
 995         return entry;
 996 }
 997
 998 static struct image_partition_entry make_soft_version_from_string(const char *soft_ver) {
 999         /** String length _including_ the terminating zero byte */
1000         uint32_t ver_len = strlen(soft_ver) + 1;
1001         /** Partition contains 64 bit header, the version string, and one additional null byte */
1002         size_t partition_len = 2*sizeof(uint32_t) + ver_len + 1;
1003         struct image_partition_entry entry = alloc_image_partition("soft-version", partition_len);
1004
1005         uint32_t *len = (uint32_t *)entry.data;
1006         len[0] = htonl(ver_len);
1007         len[1] = 0;
1008         memcpy(&len[2], soft_ver, ver_len);
1009
1010         entry.data[partition_len - 1] = 0;
1011
1012         return entry;
1013 }
1014
1015 /** Generates the support-list partition */
1016 static struct image_partition_entry make_support_list(const struct device_info *info) {
1017         size_t len = strlen(info->support_list);
1018         struct image_partition_entry entry = alloc_image_partition("support-list", len + 9);
1019
1020         put32(entry.data, len);
1021         memset(entry.data+4, 0, 4);
1022         memcpy(entry.data+8, info->support_list, len);
1023         entry.data[len+8] = info->support_trail;
1024
1025         return entry;
1026 }
1027
1028 /** Creates a new image partition with an arbitrary name from a file */
1029 static struct image_partition_entry read_file(const char *part_name, const char *filename, bool add_jffs2_eof) {
1030         struct stat statbuf;
1031
1032         if (stat(filename, &statbuf) < 0)
1033                 error(1, errno, "unable to stat file `%s'", filename);
1034
1035         size_t len = statbuf.st_size;
1036
1037         if (add_jffs2_eof)
1038                 len = ALIGN(len, 0x10000) + sizeof(jffs2_eof_mark);
1039
1040         struct image_partition_entry entry = alloc_image_partition(part_name, len);
1041
1042         FILE *file = fopen(filename, "rb");
1043         if (!file)
1044                 error(1, errno, "unable to open file `%s'", filename);
1045
1046         if (fread(entry.data, statbuf.st_size, 1, file) != 1)
1047                 error(1, errno, "unable to read file `%s'", filename);
1048
1049         if (add_jffs2_eof) {
1050                 uint8_t *eof = entry.data + statbuf.st_size, *end = entry.data+entry.size;
1051
1052                 memset(eof, 0xff, end - eof - sizeof(jffs2_eof_mark));
1053                 memcpy(end - sizeof(jffs2_eof_mark), jffs2_eof_mark, sizeof(jffs2_eof_mark));
1054         }
1055
1056         fclose(file);
1057
1058         return entry;
1059 }
1060
1061 /** Creates a new image partition from arbitrary data */
1062 static struct image_partition_entry put_data(const char *part_name, const char *datain, size_t len) {
1063
1064         struct image_partition_entry entry = alloc_image_partition(part_name, len);
1065
1066         memcpy(entry.data, datain, len);
1067
1068         return entry;
1069 }
1070
1071 /**
1072    Copies a list of image partitions into an image buffer and generates the image partition table while doing so
1073
1074    Example image partition table:
1075
1076      fwup-ptn partition-table base 0x00800 size 0x00800
1077      fwup-ptn os-image base 0x01000 size 0x113b45
1078      fwup-ptn file-system base 0x114b45 size 0x1d0004
1079      fwup-ptn support-list base 0x2e4b49 size 0x000d1
1080
1081    Each line of the partition table is terminated with the bytes 09 0d 0a ("\t\r\n"),
1082    the end of the partition table is marked with a zero byte.
1083
1084    The firmware image must contain at least the partition-table and support-list partitions
1085    to be accepted. There aren't any alignment constraints for the image partitions.
1086
1087    The partition-table partition contains the actual flash layout; partitions
1088    from the image partition table are mapped to the corresponding flash partitions during
1089    the firmware upgrade. The support-list partition contains a list of devices supported by
1090    the firmware image.
1091
1092    The base offsets in the firmware partition table are relative to the end
1093    of the vendor information block, so the partition-table partition will
1094    actually start at offset 0x1814 of the image.
1095
1096    I think partition-table must be the first partition in the firmware image.
1097 */
1098 static void put_partitions(uint8_t *buffer, const struct flash_partition_entry *flash_parts, const struct image_partition_entry *parts) {
1099         size_t i, j;
1100         char *image_pt = (char *)buffer, *end = image_pt + 0x800;
1101
1102         size_t base = 0x800;
1103         for (i = 0; parts[i].name; i++) {
1104                 for (j = 0; flash_parts[j].name; j++) {
1105                         if (!strcmp(flash_parts[j].name, parts[i].name)) {
1106                                 if (parts[i].size > flash_parts[j].size)
1107                                         error(1, 0, "%s partition too big (more than %u bytes)", flash_parts[j].name, (unsigned)flash_parts[j].size);
1108                                 break;
1109                         }
1110                 }
1111
1112                 assert(flash_parts[j].name);
1113
1114                 memcpy(buffer + base, parts[i].data, parts[i].size);
1115
1116                 size_t len = end-image_pt;
1117                 size_t w = snprintf(image_pt, len, "fwup-ptn %s base 0x%05x size 0x%05x\t\r\n", parts[i].name, (unsigned)base, (unsigned)parts[i].size);
1118
1119                 if (w > len-1)
1120                         error(1, 0, "image partition table overflow?");
1121
1122                 image_pt += w;
1123
1124                 base += parts[i].size;
1125         }
1126 }
1127
1128 /** Generates and writes the image MD5 checksum */
1129 static void put_md5(uint8_t *md5, uint8_t *buffer, unsigned int len) {
1130         MD5_CTX ctx;
1131
1132         MD5_Init(&ctx);
1133         MD5_Update(&ctx, md5_salt, (unsigned int)sizeof(md5_salt));
1134         MD5_Update(&ctx, buffer, len);
1135         MD5_Final(md5, &ctx);
1136 }
1137
1138
1139 /**
1140    Generates the firmware image in factory format
1141
1142    Image format:
1143
1144      Bytes (hex)  Usage
1145      -----------  -----
1146      0000-0003    Image size (4 bytes, big endian)
1147      0004-0013    MD5 hash (hash of a 16 byte salt and the image data starting with byte 0x14)
1148      0014-0017    Vendor information length (without padding) (4 bytes, big endian)
1149      0018-1013    Vendor information (4092 bytes, padded with 0xff; there seem to be older
1150                   (VxWorks-based) TP-LINK devices which use a smaller vendor information block)
1151      1014-1813    Image partition table (2048 bytes, padded with 0xff)
1152      1814-xxxx    Firmware partitions
1153 */
1154 static void * generate_factory_image(const struct device_info *info, const struct image_partition_entry *parts, size_t *len) {
1155         *len = 0x1814;
1156
1157         size_t i;
1158         for (i = 0; parts[i].name; i++)
1159                 *len += parts[i].size;
1160
1161         uint8_t *image = malloc(*len);
1162         if (!image)
1163                 error(1, errno, "malloc");
1164
1165         memset(image, 0xff, *len);
1166         put32(image, *len);
1167
1168         if (info->vendor) {
1169                 size_t vendor_len = strlen(info->vendor);
1170                 put32(image+0x14, vendor_len);
1171                 memcpy(image+0x18, info->vendor, vendor_len);
1172         }
1173
1174         put_partitions(image + 0x1014, info->partitions, parts);
1175         put_md5(image+0x04, image+0x14, *len-0x14);
1176
1177         return image;
1178 }
1179
1180 /**
1181    Generates the firmware image in sysupgrade format
1182
1183    This makes some assumptions about the provided flash and image partition tables and
1184    should be generalized when TP-LINK starts building its safeloader into hardware with
1185    different flash layouts.
1186 */
1187 static void * generate_sysupgrade_image(const struct device_info *info, const struct image_partition_entry *image_parts, size_t *len) {
1188         size_t i, j;
1189         size_t flash_first_partition_index = 0;
1190         size_t flash_last_partition_index = 0;
1191         const struct flash_partition_entry *flash_first_partition = NULL;
1192         const struct flash_partition_entry *flash_last_partition = NULL;
1193         const struct image_partition_entry *image_last_partition = NULL;
1194
1195         /** Find first and last partitions */
1196         for (i = 0; info->partitions[i].name; i++) {
1197                 if (!strcmp(info->partitions[i].name, info->first_sysupgrade_partition)) {
1198                         flash_first_partition = &info->partitions[i];
1199                         flash_first_partition_index = i;
1200                 } else if (!strcmp(info->partitions[i].name, info->last_sysupgrade_partition)) {
1201                         flash_last_partition = &info->partitions[i];
1202                         flash_last_partition_index = i;
1203                 }
1204         }
1205
1206         assert(flash_first_partition && flash_last_partition);
1207         assert(flash_first_partition_index < flash_last_partition_index);
1208
1209         /** Find last partition from image to calculate needed size */
1210         for (i = 0; image_parts[i].name; i++) {
1211                 if (!strcmp(image_parts[i].name, info->last_sysupgrade_partition)) {
1212                         image_last_partition = &image_parts[i];
1213                         break;
1214                 }
1215         }
1216
1217         assert(image_last_partition);
1218
1219         *len = flash_last_partition->base - flash_first_partition->base + image_last_partition->size;
1220
1221         uint8_t *image = malloc(*len);
1222         if (!image)
1223                 error(1, errno, "malloc");
1224
1225         memset(image, 0xff, *len);
1226
1227         for (i = flash_first_partition_index; i <= flash_last_partition_index; i++) {
1228                 for (j = 0; image_parts[j].name; j++) {
1229                         if (!strcmp(info->partitions[i].name, image_parts[j].name)) {
1230                                 if (image_parts[j].size > info->partitions[i].size)
1231                                         error(1, 0, "%s partition too big (more than %u bytes)", info->partitions[i].name, (unsigned)info->partitions[i].size);
1232                                 memcpy(image + info->partitions[i].base - flash_first_partition->base, image_parts[j].data, image_parts[j].size);
1233                                 break;
1234                         }
1235
1236                         assert(image_parts[j].name);
1237                 }
1238         }
1239
1240         return image;
1241 }
1242
1243 /** Generates an image according to a given layout and writes it to a file */
1244 static void build_image(const char *output,
1245                 const char *kernel_image,
1246                 const char *rootfs_image,
1247                 uint32_t rev,
1248                 bool add_jffs2_eof,
1249                 bool sysupgrade,
1250                 const struct device_info *info) {
1251
1252         struct image_partition_entry parts[7] = {};
1253
1254         parts[0] = make_partition_table(info->partitions);
1255         if (info->soft_ver)
1256                 parts[1] = make_soft_version_from_string(info->soft_ver);
1257         else
1258                 parts[1] = make_soft_version(rev);
1259
1260         parts[2] = make_support_list(info);
1261         parts[3] = read_file("os-image", kernel_image, false);
1262         parts[4] = read_file("file-system", rootfs_image, add_jffs2_eof);
1263
1264         if (strcasecmp(info->id, "ARCHER-C25-V1") == 0) {
1265                 const char mdat[11] = {0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00};
1266                 parts[5] = put_data("extra-para", mdat, 11);
1267         } else if (strcasecmp(info->id, "ARCHER-C7-V4") == 0) {
1268                 const char mdat[11] = {0x01, 0x00, 0x00, 0x02, 0x00, 0x00, 0xca, 0x00, 0x01, 0x00, 0x00};
1269                 parts[5] = put_data("extra-para", mdat, 11);
1270         }
1271
1272         size_t len;
1273         void *image;
1274         if (sysupgrade)
1275                 image = generate_sysupgrade_image(info, parts, &len);
1276         else
1277                 image = generate_factory_image(info, parts, &len);
1278
1279         FILE *file = fopen(output, "wb");
1280         if (!file)
1281                 error(1, errno, "unable to open output file");
1282
1283         if (fwrite(image, len, 1, file) != 1)
1284                 error(1, 0, "unable to write output file");
1285
1286         fclose(file);
1287
1288         free(image);
1289
1290         size_t i;
1291         for (i = 0; parts[i].name; i++)
1292                 free_image_partition(parts[i]);
1293 }
1294
1295 /** Usage output */
1296 static void usage(const char *argv0) {
1297         fprintf(stderr,
1298                 "Usage: %s [OPTIONS...]\n"
1299                 "\n"
1300                 "Options:\n"
1301                 "  -B <board>      create image for the board specified with <board>\n"
1302                 "  -k <file>       read kernel image from the file <file>\n"
1303                 "  -r <file>       read rootfs image from the file <file>\n"
1304                 "  -o <file>       write output to the file <file>\n"
1305                 "  -V <rev>        sets the revision number to <rev>\n"
1306                 "  -j              add jffs2 end-of-filesystem markers\n"
1307                 "  -S              create sysupgrade instead of factory image\n"
1308                 "  -h              show this help\n",
1309                 argv0
1310         );
1311 };
1312
1313
1314 static const struct device_info *find_board(const char *id)
1315 {
1316         struct device_info *board = NULL;
1317
1318         for (board = boards; board->id != NULL; board++)
1319                 if (strcasecmp(id, board->id) == 0)
1320                         return board;
1321
1322         return NULL;
1323 }
1324
1325 int main(int argc, char *argv[]) {
1326         const char *board = NULL, *kernel_image = NULL, *rootfs_image = NULL, *output = NULL;
1327         bool add_jffs2_eof = false, sysupgrade = false;
1328         unsigned rev = 0;
1329         const struct device_info *info;
1330         set_source_date_epoch();
1331
1332         while (true) {
1333                 int c;
1334
1335                 c = getopt(argc, argv, "B:k:r:o:V:jSh");
1336                 if (c == -1)
1337                         break;
1338
1339                 switch (c) {
1340                 case 'B':
1341                         board = optarg;
1342                         break;
1343
1344                 case 'k':
1345                         kernel_image = optarg;
1346                         break;
1347
1348                 case 'r':
1349                         rootfs_image = optarg;
1350                         break;
1351
1352                 case 'o':
1353                         output = optarg;
1354                         break;
1355
1356                 case 'V':
1357                         sscanf(optarg, "r%u", &rev);
1358                         break;
1359
1360                 case 'j':
1361                         add_jffs2_eof = true;
1362                         break;
1363
1364                 case 'S':
1365                         sysupgrade = true;
1366                         break;
1367
1368                 case 'h':
1369                         usage(argv[0]);
1370                         return 0;
1371
1372                 default:
1373                         usage(argv[0]);
1374                         return 1;
1375                 }
1376         }
1377
1378         if (!board)
1379                 error(1, 0, "no board has been specified");
1380         if (!kernel_image)
1381                 error(1, 0, "no kernel image has been specified");
1382         if (!rootfs_image)
1383                 error(1, 0, "no rootfs image has been specified");
1384         if (!output)
1385                 error(1, 0, "no output filename has been specified");
1386
1387         info = find_board(board);
1388
1389         if (info == NULL)
1390                 error(1, 0, "unsupported board %s", board);
1391
1392         build_image(output, kernel_image, rootfs_image, rev, add_jffs2_eof, sysupgrade, info);
1393
1394         return 0;
1395 }