2 Copyright (c) 2014, Matthias Schiffer <mschiffer@universe-factory.net>
5 Redistribution and use in source and binary forms, with or without
6 modification, are permitted provided that the following conditions are met:
8 1. Redistributions of source code must retain the above copyright notice,
9 this list of conditions and the following disclaimer.
10 2. Redistributions in binary form must reproduce the above copyright notice,
11 this list of conditions and the following disclaimer in the documentation
12 and/or other materials provided with the distribution.
14 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
15 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
17 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
18 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
20 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
21 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
22 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 Image generation tool for the TP-LINK SafeLoader as seen on
31 TP-LINK Pharos devices (CPE210/220/510/520)
45 #include <arpa/inet.h>
47 #include <sys/types.h>
53 #define ALIGN(x,a) ({ typeof(a) __a = (a); (((x) + __a - 1) & ~(__a - 1)); })
56 #define MAX_PARTITIONS 32
58 /** An image partition table entry */
59 struct image_partition_entry
{
65 /** A flash partition table entry */
66 struct flash_partition_entry
{
72 /** Firmware layout description */
76 const char *support_list
;
79 const struct flash_partition_entry partitions
[MAX_PARTITIONS
+1];
80 const char *first_sysupgrade_partition
;
81 const char *last_sysupgrade_partition
;
84 /** The content of the soft-version structure */
85 struct __attribute__((__packed__
)) soft_version
{
89 uint8_t version_major
;
90 uint8_t version_minor
;
91 uint8_t version_patch
;
101 static const uint8_t jffs2_eof_mark
[4] = {0xde, 0xad, 0xc0, 0xde};
105 Salt for the MD5 hash
107 Fortunately, TP-LINK seems to use the same salt for most devices which use
108 the new image format.
110 static const uint8_t md5_salt
[16] = {
111 0x7a, 0x2b, 0x15, 0xed,
112 0x9b, 0x98, 0x59, 0x6d,
113 0xe5, 0x04, 0xab, 0x44,
114 0xac, 0x2a, 0x9f, 0x4e,
118 /** Firmware layout table */
119 static struct device_info boards
[] = {
120 /** Firmware layout for the CPE210/220 */
123 .vendor
= "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
126 "CPE210(TP-LINK|UN|N300-2):1.0\r\n"
127 "CPE210(TP-LINK|UN|N300-2):1.1\r\n"
128 "CPE210(TP-LINK|US|N300-2):1.1\r\n"
129 "CPE210(TP-LINK|EU|N300-2):1.1\r\n"
130 "CPE220(TP-LINK|UN|N300-2):1.1\r\n"
131 "CPE220(TP-LINK|US|N300-2):1.1\r\n"
132 "CPE220(TP-LINK|EU|N300-2):1.1\r\n",
133 .support_trail
= '\xff',
137 {"fs-uboot", 0x00000, 0x20000},
138 {"partition-table", 0x20000, 0x02000},
139 {"default-mac", 0x30000, 0x00020},
140 {"product-info", 0x31100, 0x00100},
141 {"signature", 0x32000, 0x00400},
142 {"os-image", 0x40000, 0x170000},
143 {"soft-version", 0x1b0000, 0x00100},
144 {"support-list", 0x1b1000, 0x00400},
145 {"file-system", 0x1c0000, 0x600000},
146 {"user-config", 0x7c0000, 0x10000},
147 {"default-config", 0x7d0000, 0x10000},
148 {"log", 0x7e0000, 0x10000},
149 {"radio", 0x7f0000, 0x10000},
153 .first_sysupgrade_partition
= "os-image",
154 .last_sysupgrade_partition
= "file-system",
157 /** Firmware layout for the CPE510/520 */
160 .vendor
= "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
163 "CPE510(TP-LINK|UN|N300-5):1.0\r\n"
164 "CPE510(TP-LINK|UN|N300-5):1.1\r\n"
165 "CPE510(TP-LINK|UN|N300-5):1.1\r\n"
166 "CPE510(TP-LINK|US|N300-5):1.1\r\n"
167 "CPE510(TP-LINK|EU|N300-5):1.1\r\n"
168 "CPE520(TP-LINK|UN|N300-5):1.1\r\n"
169 "CPE520(TP-LINK|US|N300-5):1.1\r\n"
170 "CPE520(TP-LINK|EU|N300-5):1.1\r\n",
171 .support_trail
= '\xff',
175 {"fs-uboot", 0x00000, 0x20000},
176 {"partition-table", 0x20000, 0x02000},
177 {"default-mac", 0x30000, 0x00020},
178 {"product-info", 0x31100, 0x00100},
179 {"signature", 0x32000, 0x00400},
180 {"os-image", 0x40000, 0x170000},
181 {"soft-version", 0x1b0000, 0x00100},
182 {"support-list", 0x1b1000, 0x00400},
183 {"file-system", 0x1c0000, 0x600000},
184 {"user-config", 0x7c0000, 0x10000},
185 {"default-config", 0x7d0000, 0x10000},
186 {"log", 0x7e0000, 0x10000},
187 {"radio", 0x7f0000, 0x10000},
191 .first_sysupgrade_partition
= "os-image",
192 .last_sysupgrade_partition
= "file-system",
197 .vendor
= "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
200 "WBS210(TP-LINK|UN|N300-2):1.20\r\n"
201 "WBS210(TP-LINK|US|N300-2):1.20\r\n"
202 "WBS210(TP-LINK|EU|N300-2):1.20\r\n",
203 .support_trail
= '\xff',
207 {"fs-uboot", 0x00000, 0x20000},
208 {"partition-table", 0x20000, 0x02000},
209 {"default-mac", 0x30000, 0x00020},
210 {"product-info", 0x31100, 0x00100},
211 {"signature", 0x32000, 0x00400},
212 {"os-image", 0x40000, 0x170000},
213 {"soft-version", 0x1b0000, 0x00100},
214 {"support-list", 0x1b1000, 0x00400},
215 {"file-system", 0x1c0000, 0x600000},
216 {"user-config", 0x7c0000, 0x10000},
217 {"default-config", 0x7d0000, 0x10000},
218 {"log", 0x7e0000, 0x10000},
219 {"radio", 0x7f0000, 0x10000},
223 .first_sysupgrade_partition
= "os-image",
224 .last_sysupgrade_partition
= "file-system",
229 .vendor
= "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
232 "WBS510(TP-LINK|UN|N300-5):1.20\r\n"
233 "WBS510(TP-LINK|US|N300-5):1.20\r\n"
234 "WBS510(TP-LINK|EU|N300-5):1.20\r\n",
235 .support_trail
= '\xff',
239 {"fs-uboot", 0x00000, 0x20000},
240 {"partition-table", 0x20000, 0x02000},
241 {"default-mac", 0x30000, 0x00020},
242 {"product-info", 0x31100, 0x00100},
243 {"signature", 0x32000, 0x00400},
244 {"os-image", 0x40000, 0x170000},
245 {"soft-version", 0x1b0000, 0x00100},
246 {"support-list", 0x1b1000, 0x00400},
247 {"file-system", 0x1c0000, 0x600000},
248 {"user-config", 0x7c0000, 0x10000},
249 {"default-config", 0x7d0000, 0x10000},
250 {"log", 0x7e0000, 0x10000},
251 {"radio", 0x7f0000, 0x10000},
255 .first_sysupgrade_partition
= "os-image",
256 .last_sysupgrade_partition
= "file-system",
259 /** Firmware layout for the C2600 */
265 "{product_name:Archer C2600,product_ver:1.0.0,special_id:00000000}\r\n",
266 .support_trail
= '\x00',
270 {"SBL1", 0x00000, 0x20000},
271 {"MIBIB", 0x20000, 0x20000},
272 {"SBL2", 0x40000, 0x20000},
273 {"SBL3", 0x60000, 0x30000},
274 {"DDRCONFIG", 0x90000, 0x10000},
275 {"SSD", 0xa0000, 0x10000},
276 {"TZ", 0xb0000, 0x30000},
277 {"RPM", 0xe0000, 0x20000},
278 {"fs-uboot", 0x100000, 0x70000},
279 {"uboot-env", 0x170000, 0x40000},
280 {"radio", 0x1b0000, 0x40000},
281 {"os-image", 0x1f0000, 0x200000},
282 {"file-system", 0x3f0000, 0x1b00000},
283 {"default-mac", 0x1ef0000, 0x00200},
284 {"pin", 0x1ef0200, 0x00200},
285 {"product-info", 0x1ef0400, 0x0fc00},
286 {"partition-table", 0x1f00000, 0x10000},
287 {"soft-version", 0x1f10000, 0x10000},
288 {"support-list", 0x1f20000, 0x10000},
289 {"profile", 0x1f30000, 0x10000},
290 {"default-config", 0x1f40000, 0x10000},
291 {"user-config", 0x1f50000, 0x40000},
292 {"qos-db", 0x1f90000, 0x40000},
293 {"usb-config", 0x1fd0000, 0x10000},
294 {"log", 0x1fe0000, 0x20000},
298 .first_sysupgrade_partition
= "os-image",
299 .last_sysupgrade_partition
= "file-system"
302 /** Firmware layout for the C25v1 */
304 .id
= "ARCHER-C25-V1",
307 "{product_name:ArcherC25,product_ver:1.0.0,special_id:00000000}\n"
308 "{product_name:ArcherC25,product_ver:1.0.0,special_id:55530000}\n"
309 "{product_name:ArcherC25,product_ver:1.0.0,special_id:45550000}\n",
310 .support_trail
= '\x00',
311 .soft_ver
= "soft_ver:1.0.0\n",
314 We use a bigger os-image partition than the stock images (and thus
315 smaller file-system), as our kernel doesn't fit in the stock firmware's
319 {"factory-boot", 0x00000, 0x20000},
320 {"fs-uboot", 0x20000, 0x10000},
321 {"os-image", 0x30000, 0x180000}, /* Stock: base 0x30000 size 0x100000 */
322 {"file-system", 0x1b0000, 0x620000}, /* Stock: base 0x130000 size 0x6a0000 */
323 {"user-config", 0x7d0000, 0x04000},
324 {"default-mac", 0x7e0000, 0x00100},
325 {"device-id", 0x7e0100, 0x00100},
326 {"extra-para", 0x7e0200, 0x00100},
327 {"pin", 0x7e0300, 0x00100},
328 {"support-list", 0x7e0400, 0x00400},
329 {"soft-version", 0x7e0800, 0x00400},
330 {"product-info", 0x7e0c00, 0x01400},
331 {"partition-table", 0x7e2000, 0x01000},
332 {"profile", 0x7e3000, 0x01000},
333 {"default-config", 0x7e4000, 0x04000},
334 {"merge-config", 0x7ec000, 0x02000},
335 {"qos-db", 0x7ee000, 0x02000},
336 {"radio", 0x7f0000, 0x10000},
340 .first_sysupgrade_partition
= "os-image",
341 .last_sysupgrade_partition
= "file-system",
344 /** Firmware layout for the C58v1 */
346 .id
= "ARCHER-C58-V1",
350 "{product_name:Archer C58,product_ver:1.0.0,special_id:00000000}\r\n"
351 "{product_name:Archer C58,product_ver:1.0.0,special_id:45550000}\r\n"
352 "{product_name:Archer C58,product_ver:1.0.0,special_id:55530000}\r\n",
353 .support_trail
= '\x00',
354 .soft_ver
= "soft_ver:1.0.0\n",
357 {"fs-uboot", 0x00000, 0x10000},
358 {"default-mac", 0x10000, 0x00200},
359 {"pin", 0x10200, 0x00200},
360 {"product-info", 0x10400, 0x00100},
361 {"partition-table", 0x10500, 0x00800},
362 {"soft-version", 0x11300, 0x00200},
363 {"support-list", 0x11500, 0x00100},
364 {"device-id", 0x11600, 0x00100},
365 {"profile", 0x11700, 0x03900},
366 {"default-config", 0x15000, 0x04000},
367 {"user-config", 0x19000, 0x04000},
368 {"os-image", 0x20000, 0x180000},
369 {"file-system", 0x1a0000, 0x648000},
370 {"certyficate", 0x7e8000, 0x08000},
371 {"radio", 0x7f0000, 0x10000},
375 .first_sysupgrade_partition
= "os-image",
376 .last_sysupgrade_partition
= "file-system",
379 /** Firmware layout for the C59v1 */
381 .id
= "ARCHER-C59-V1",
385 "{product_name:Archer C59,product_ver:1.0.0,special_id:00000000}\r\n"
386 "{product_name:Archer C59,product_ver:1.0.0,special_id:45550000}\r\n"
387 "{product_name:Archer C59,product_ver:1.0.0,special_id:52550000}\r\n"
388 "{product_name:Archer C59,product_ver:1.0.0,special_id:55530000}\r\n",
389 .support_trail
= '\x00',
390 .soft_ver
= "soft_ver:1.0.0\n",
393 {"fs-uboot", 0x00000, 0x10000},
394 {"default-mac", 0x10000, 0x00200},
395 {"pin", 0x10200, 0x00200},
396 {"device-id", 0x10400, 0x00100},
397 {"product-info", 0x10500, 0x0fb00},
398 {"os-image", 0x20000, 0x180000},
399 {"file-system", 0x1a0000, 0xcb0000},
400 {"partition-table", 0xe50000, 0x10000},
401 {"soft-version", 0xe60000, 0x10000},
402 {"support-list", 0xe70000, 0x10000},
403 {"profile", 0xe80000, 0x10000},
404 {"default-config", 0xe90000, 0x10000},
405 {"user-config", 0xea0000, 0x40000},
406 {"usb-config", 0xee0000, 0x10000},
407 {"certificate", 0xef0000, 0x10000},
408 {"qos-db", 0xf00000, 0x40000},
409 {"log", 0xfe0000, 0x10000},
410 {"radio", 0xff0000, 0x10000},
414 .first_sysupgrade_partition
= "os-image",
415 .last_sysupgrade_partition
= "file-system",
418 /** Firmware layout for the C60v1 */
420 .id
= "ARCHER-C60-V1",
424 "{product_name:Archer C60,product_ver:1.0.0,special_id:00000000}\r\n"
425 "{product_name:Archer C60,product_ver:1.0.0,special_id:45550000}\r\n"
426 "{product_name:Archer C60,product_ver:1.0.0,special_id:55530000}\r\n",
427 .support_trail
= '\x00',
428 .soft_ver
= "soft_ver:1.0.0\n",
431 {"fs-uboot", 0x00000, 0x10000},
432 {"default-mac", 0x10000, 0x00200},
433 {"pin", 0x10200, 0x00200},
434 {"product-info", 0x10400, 0x00100},
435 {"partition-table", 0x10500, 0x00800},
436 {"soft-version", 0x11300, 0x00200},
437 {"support-list", 0x11500, 0x00100},
438 {"device-id", 0x11600, 0x00100},
439 {"profile", 0x11700, 0x03900},
440 {"default-config", 0x15000, 0x04000},
441 {"user-config", 0x19000, 0x04000},
442 {"os-image", 0x20000, 0x180000},
443 {"file-system", 0x1a0000, 0x648000},
444 {"certyficate", 0x7e8000, 0x08000},
445 {"radio", 0x7f0000, 0x10000},
449 .first_sysupgrade_partition
= "os-image",
450 .last_sysupgrade_partition
= "file-system",
453 /** Firmware layout for the C5 */
455 .id
= "ARCHER-C5-V2",
459 "{product_name:ArcherC5,product_ver:2.0.0,special_id:00000000}\r\n"
460 "{product_name:ArcherC5,product_ver:2.0.0,special_id:55530000}\r\n"
461 "{product_name:ArcherC5,product_ver:2.0.0,special_id:4A500000}\r\n", /* JP version */
462 .support_trail
= '\x00',
466 {"fs-uboot", 0x00000, 0x40000},
467 {"os-image", 0x40000, 0x200000},
468 {"file-system", 0x240000, 0xc00000},
469 {"default-mac", 0xe40000, 0x00200},
470 {"pin", 0xe40200, 0x00200},
471 {"product-info", 0xe40400, 0x00200},
472 {"partition-table", 0xe50000, 0x10000},
473 {"soft-version", 0xe60000, 0x00200},
474 {"support-list", 0xe61000, 0x0f000},
475 {"profile", 0xe70000, 0x10000},
476 {"default-config", 0xe80000, 0x10000},
477 {"user-config", 0xe90000, 0x50000},
478 {"log", 0xee0000, 0x100000},
479 {"radio_bk", 0xfe0000, 0x10000},
480 {"radio", 0xff0000, 0x10000},
484 .first_sysupgrade_partition
= "os-image",
485 .last_sysupgrade_partition
= "file-system"
488 /** Firmware layout for the C7 */
490 .id
= "ARCHER-C7-V4",
493 "{product_name:Archer C7,product_ver:4.0.0,special_id:00000000}\n"
494 "{product_name:Archer C7,product_ver:4.0.0,special_id:41550000}\n"
495 "{product_name:Archer C7,product_ver:4.0.0,special_id:45550000}\n"
496 "{product_name:Archer C7,product_ver:4.0.0,special_id:4B520000}\n"
497 "{product_name:Archer C7,product_ver:4.0.0,special_id:42520000}\n"
498 "{product_name:Archer C7,product_ver:4.0.0,special_id:4A500000}\n"
499 "{product_name:Archer C7,product_ver:4.0.0,special_id:52550000}\n"
500 "{product_name:Archer C7,product_ver:4.0.0,special_id:54570000}\n"
501 "{product_name:Archer C7,product_ver:4.0.0,special_id:55530000}\n"
502 "{product_name:Archer C7,product_ver:4.0.0,special_id:43410000}\n",
503 .support_trail
= '\x00',
504 .soft_ver
= "soft_ver:1.0.0\n",
507 We use a bigger os-image partition than the stock images (and thus
508 smaller file-system), as our kernel doesn't fit in the stock firmware's
512 {"factory-boot", 0x00000, 0x20000},
513 {"fs-uboot", 0x20000, 0x20000},
514 {"os-image", 0x40000, 0x180000}, /* Stock: base 0x40000 size 0x120000 */
515 {"file-system", 0x1c0000, 0xd40000}, /* Stock: base 0x160000 size 0xda0000 */
516 {"default-mac", 0xf00000, 0x00200},
517 {"pin", 0xf00200, 0x00200},
518 {"device-id", 0xf00400, 0x00100},
519 {"product-info", 0xf00500, 0x0fb00},
520 {"soft-version", 0xf10000, 0x00100},
521 {"extra-para", 0xf11000, 0x01000},
522 {"support-list", 0xf12000, 0x0a000},
523 {"profile", 0xf1c000, 0x04000},
524 {"default-config", 0xf20000, 0x10000},
525 {"user-config", 0xf30000, 0x40000},
526 {"qos-db", 0xf70000, 0x40000},
527 {"certificate", 0xfb0000, 0x10000},
528 {"partition-table", 0xfc0000, 0x10000},
529 {"log", 0xfd0000, 0x20000},
530 {"radio", 0xff0000, 0x10000},
534 .first_sysupgrade_partition
= "os-image",
535 .last_sysupgrade_partition
= "file-system",
538 /** Firmware layout for the C9 */
544 "{product_name:ArcherC9,"
546 "special_id:00000000}\n",
547 .support_trail
= '\x00',
551 {"fs-uboot", 0x00000, 0x40000},
552 {"os-image", 0x40000, 0x200000},
553 {"file-system", 0x240000, 0xc00000},
554 {"default-mac", 0xe40000, 0x00200},
555 {"pin", 0xe40200, 0x00200},
556 {"product-info", 0xe40400, 0x00200},
557 {"partition-table", 0xe50000, 0x10000},
558 {"soft-version", 0xe60000, 0x00200},
559 {"support-list", 0xe61000, 0x0f000},
560 {"profile", 0xe70000, 0x10000},
561 {"default-config", 0xe80000, 0x10000},
562 {"user-config", 0xe90000, 0x50000},
563 {"log", 0xee0000, 0x100000},
564 {"radio_bk", 0xfe0000, 0x10000},
565 {"radio", 0xff0000, 0x10000},
569 .first_sysupgrade_partition
= "os-image",
570 .last_sysupgrade_partition
= "file-system"
573 /** Firmware layout for the EAP120 */
576 .vendor
= "EAP120(TP-LINK|UN|N300-2):1.0\r\n",
579 "EAP120(TP-LINK|UN|N300-2):1.0\r\n",
580 .support_trail
= '\xff',
584 {"fs-uboot", 0x00000, 0x20000},
585 {"partition-table", 0x20000, 0x02000},
586 {"default-mac", 0x30000, 0x00020},
587 {"support-list", 0x31000, 0x00100},
588 {"product-info", 0x31100, 0x00100},
589 {"soft-version", 0x32000, 0x00100},
590 {"os-image", 0x40000, 0x180000},
591 {"file-system", 0x1c0000, 0x600000},
592 {"user-config", 0x7c0000, 0x10000},
593 {"backup-config", 0x7d0000, 0x10000},
594 {"log", 0x7e0000, 0x10000},
595 {"radio", 0x7f0000, 0x10000},
599 .first_sysupgrade_partition
= "os-image",
600 .last_sysupgrade_partition
= "file-system"
603 /** Firmware layout for the TL-WA850RE v2 */
609 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:55530000}\n"
610 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:00000000}\n"
611 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:55534100}\n"
612 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:45550000}\n"
613 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:4B520000}\n"
614 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:42520000}\n"
615 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:4A500000}\n"
616 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:43410000}\n"
617 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:41550000}\n"
618 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:52550000}\n",
619 .support_trail
= '\x00',
623 576KB were moved from file-system to os-image
624 in comparison to the stock image
627 {"fs-uboot", 0x00000, 0x20000},
628 {"os-image", 0x20000, 0x150000},
629 {"file-system", 0x170000, 0x240000},
630 {"partition-table", 0x3b0000, 0x02000},
631 {"default-mac", 0x3c0000, 0x00020},
632 {"pin", 0x3c0100, 0x00020},
633 {"product-info", 0x3c1000, 0x01000},
634 {"soft-version", 0x3c2000, 0x00100},
635 {"support-list", 0x3c3000, 0x01000},
636 {"profile", 0x3c4000, 0x08000},
637 {"user-config", 0x3d0000, 0x10000},
638 {"default-config", 0x3e0000, 0x10000},
639 {"radio", 0x3f0000, 0x10000},
643 .first_sysupgrade_partition
= "os-image",
644 .last_sysupgrade_partition
= "file-system"
647 /** Firmware layout for the TL-WA855RE v1 */
653 "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:00000000}\n"
654 "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:55530000}\n"
655 "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:45550000}\n"
656 "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:4B520000}\n"
657 "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:42520000}\n"
658 "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:4A500000}\n"
659 "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:43410000}\n"
660 "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:41550000}\n"
661 "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:52550000}\n",
662 .support_trail
= '\x00',
666 {"fs-uboot", 0x00000, 0x20000},
667 {"os-image", 0x20000, 0x150000},
668 {"file-system", 0x170000, 0x240000},
669 {"partition-table", 0x3b0000, 0x02000},
670 {"default-mac", 0x3c0000, 0x00020},
671 {"pin", 0x3c0100, 0x00020},
672 {"product-info", 0x3c1000, 0x01000},
673 {"soft-version", 0x3c2000, 0x00100},
674 {"support-list", 0x3c3000, 0x01000},
675 {"profile", 0x3c4000, 0x08000},
676 {"user-config", 0x3d0000, 0x10000},
677 {"default-config", 0x3e0000, 0x10000},
678 {"radio", 0x3f0000, 0x10000},
682 .first_sysupgrade_partition
= "os-image",
683 .last_sysupgrade_partition
= "file-system"
686 /** Firmware layout for the TL-WR1043 v4 */
688 .id
= "TLWR1043NDV4",
692 "{product_name:TL-WR1043ND,product_ver:4.0.0,special_id:45550000}\n",
693 .support_trail
= '\x00',
697 We use a bigger os-image partition than the stock images (and thus
698 smaller file-system), as our kernel doesn't fit in the stock firmware's
702 {"fs-uboot", 0x00000, 0x20000},
703 {"os-image", 0x20000, 0x180000},
704 {"file-system", 0x1a0000, 0xdb0000},
705 {"default-mac", 0xf50000, 0x00200},
706 {"pin", 0xf50200, 0x00200},
707 {"product-info", 0xf50400, 0x0fc00},
708 {"soft-version", 0xf60000, 0x0b000},
709 {"support-list", 0xf6b000, 0x04000},
710 {"profile", 0xf70000, 0x04000},
711 {"default-config", 0xf74000, 0x0b000},
712 {"user-config", 0xf80000, 0x40000},
713 {"partition-table", 0xfc0000, 0x10000},
714 {"log", 0xfd0000, 0x20000},
715 {"radio", 0xff0000, 0x10000},
719 .first_sysupgrade_partition
= "os-image",
720 .last_sysupgrade_partition
= "file-system"
723 /** Firmware layout for the TL-WR902AC v1 */
725 .id
= "TL-WR902AC-V1",
729 "{product_name:TL-WR902AC,product_ver:1.0.0,special_id:45550000}\n"
730 "{product_name:TL-WR902AC,product_ver:1.0.0,special_id:55530000}\n",
731 .support_trail
= '\x00',
735 384KB were moved from file-system to os-image
736 in comparison to the stock image
739 {"fs-uboot", 0x00000, 0x20000},
740 {"os-image", 0x20000, 0x180000},
741 {"file-system", 0x1a0000, 0x5b0000},
742 {"default-mac", 0x750000, 0x00200},
743 {"pin", 0x750200, 0x00200},
744 {"product-info", 0x750400, 0x0fc00},
745 {"soft-version", 0x760000, 0x0b000},
746 {"support-list", 0x76b000, 0x04000},
747 {"profile", 0x770000, 0x04000},
748 {"default-config", 0x774000, 0x0b000},
749 {"user-config", 0x780000, 0x40000},
750 {"partition-table", 0x7c0000, 0x10000},
751 {"log", 0x7d0000, 0x20000},
752 {"radio", 0x7f0000, 0x10000},
756 .first_sysupgrade_partition
= "os-image",
757 .last_sysupgrade_partition
= "file-system",
760 /** Firmware layout for the TL-WR942N V1 */
766 "{product_name:TL-WR942N,product_ver:1.0.0,special_id:00000000}\r\n"
767 "{product_name:TL-WR942N,product_ver:1.0.0,special_id:52550000}\r\n",
768 .support_trail
= '\x00',
772 {"fs-uboot", 0x00000, 0x20000},
773 {"os-image", 0x20000, 0x180000},
774 {"file-system", 0x1a0000, 0xca0000},
775 {"default-mac", 0xe40000, 0x00200},
776 {"pin", 0xe40200, 0x00200},
777 {"product-info", 0xe40400, 0x0fc00},
778 {"partition-table", 0xe50000, 0x10000},
779 {"soft-version", 0xe60000, 0x10000},
780 {"support-list", 0xe70000, 0x10000},
781 {"profile", 0xe80000, 0x10000},
782 {"default-config", 0xe90000, 0x10000},
783 {"user-config", 0xea0000, 0x40000},
784 {"qos-db", 0xee0000, 0x40000},
785 {"certificate", 0xf20000, 0x10000},
786 {"usb-config", 0xfb0000, 0x10000},
787 {"log", 0xfc0000, 0x20000},
788 {"radio-bk", 0xfe0000, 0x10000},
789 {"radio", 0xff0000, 0x10000},
793 .first_sysupgrade_partition
= "os-image",
794 .last_sysupgrade_partition
= "file-system",
797 /** Firmware layout for the RE350 v1 */
803 "{product_name:RE350,product_ver:1.0.0,special_id:45550000}\n"
804 "{product_name:RE350,product_ver:1.0.0,special_id:00000000}\n"
805 "{product_name:RE350,product_ver:1.0.0,special_id:41550000}\n"
806 "{product_name:RE350,product_ver:1.0.0,special_id:55530000}\n"
807 "{product_name:RE350,product_ver:1.0.0,special_id:43410000}\n"
808 "{product_name:RE350,product_ver:1.0.0,special_id:4b520000}\n"
809 "{product_name:RE350,product_ver:1.0.0,special_id:4a500000}\n",
810 .support_trail
= '\x00',
814 The original os-image partition is too small,
815 so we enlarge it to 1.6M
818 {"fs-uboot", 0x00000, 0x20000},
819 {"os-image", 0x20000, 0x1a0000},
820 {"file-system", 0x1c0000, 0x440000},
821 {"partition-table", 0x600000, 0x02000},
822 {"default-mac", 0x610000, 0x00020},
823 {"pin", 0x610100, 0x00020},
824 {"product-info", 0x611100, 0x01000},
825 {"soft-version", 0x620000, 0x01000},
826 {"support-list", 0x621000, 0x01000},
827 {"profile", 0x622000, 0x08000},
828 {"user-config", 0x630000, 0x10000},
829 {"default-config", 0x640000, 0x10000},
830 {"radio", 0x7f0000, 0x10000},
834 .first_sysupgrade_partition
= "os-image",
835 .last_sysupgrade_partition
= "file-system"
838 /** Firmware layout for the RE450 */
844 "{product_name:RE450,product_ver:1.0.0,special_id:00000000}\r\n"
845 "{product_name:RE450,product_ver:1.0.0,special_id:55530000}\r\n"
846 "{product_name:RE450,product_ver:1.0.0,special_id:45550000}\r\n"
847 "{product_name:RE450,product_ver:1.0.0,special_id:4A500000}\r\n"
848 "{product_name:RE450,product_ver:1.0.0,special_id:43410000}\r\n"
849 "{product_name:RE450,product_ver:1.0.0,special_id:41550000}\r\n"
850 "{product_name:RE450,product_ver:1.0.0,special_id:4B520000}\r\n"
851 "{product_name:RE450,product_ver:1.0.0,special_id:55534100}\r\n",
852 .support_trail
= '\x00',
856 The flash partition table for RE450;
857 it is almost the same as the one used by the stock images,
858 576KB were moved from file-system to os-image.
861 {"fs-uboot", 0x00000, 0x20000},
862 {"os-image", 0x20000, 0x180000},
863 {"file-system", 0x1a0000, 0x460000},
864 {"partition-table", 0x600000, 0x02000},
865 {"default-mac", 0x610000, 0x00020},
866 {"pin", 0x610100, 0x00020},
867 {"product-info", 0x611100, 0x01000},
868 {"soft-version", 0x620000, 0x01000},
869 {"support-list", 0x621000, 0x01000},
870 {"profile", 0x622000, 0x08000},
871 {"user-config", 0x630000, 0x10000},
872 {"default-config", 0x640000, 0x10000},
873 {"radio", 0x7f0000, 0x10000},
877 .first_sysupgrade_partition
= "os-image",
878 .last_sysupgrade_partition
= "file-system"
884 #define error(_ret, _errno, _str, ...) \
886 fprintf(stderr, _str ": %s\n", ## __VA_ARGS__, \
893 /** Stores a uint32 as big endian */
894 static inline void put32(uint8_t *buf
, uint32_t val
) {
901 /** Allocates a new image partition */
902 static struct image_partition_entry
alloc_image_partition(const char *name
, size_t len
) {
903 struct image_partition_entry entry
= {name
, len
, malloc(len
)};
905 error(1, errno
, "malloc");
910 /** Frees an image partition */
911 static void free_image_partition(struct image_partition_entry entry
) {
915 static time_t source_date_epoch
= -1;
916 static void set_source_date_epoch() {
917 char *env
= getenv("SOURCE_DATE_EPOCH");
921 source_date_epoch
= strtoull(env
, &endptr
, 10);
922 if (errno
|| (endptr
&& *endptr
!= '\0')) {
923 fprintf(stderr
, "Invalid SOURCE_DATE_EPOCH");
929 /** Generates the partition-table partition */
930 static struct image_partition_entry
make_partition_table(const struct flash_partition_entry
*p
) {
931 struct image_partition_entry entry
= alloc_image_partition("partition-table", 0x800);
933 char *s
= (char *)entry
.data
, *end
= (char *)(s
+entry
.size
);
941 for (i
= 0; p
[i
].name
; i
++) {
943 size_t w
= snprintf(s
, len
, "partition %s base 0x%05x size 0x%05x\n", p
[i
].name
, p
[i
].base
, p
[i
].size
);
946 error(1, 0, "flash partition table overflow?");
953 memset(s
, 0xff, end
-s
);
959 /** Generates a binary-coded decimal representation of an integer in the range [0, 99] */
960 static inline uint8_t bcd(uint8_t v
) {
961 return 0x10 * (v
/10) + v
%10;
965 /** Generates the soft-version partition */
966 static struct image_partition_entry
make_soft_version(uint32_t rev
) {
967 struct image_partition_entry entry
= alloc_image_partition("soft-version", sizeof(struct soft_version
));
968 struct soft_version
*s
= (struct soft_version
*)entry
.data
;
972 if (source_date_epoch
!= -1)
973 t
= source_date_epoch
;
974 else if (time(&t
) == (time_t)(-1))
975 error(1, errno
, "time");
977 struct tm
*tm
= localtime(&t
);
979 s
->magic
= htonl(0x0000000c);
983 s
->version_major
= 0;
984 s
->version_minor
= 0;
985 s
->version_patch
= 0;
987 s
->year_hi
= bcd((1900+tm
->tm_year
)/100);
988 s
->year_lo
= bcd(tm
->tm_year
%100);
989 s
->month
= bcd(tm
->tm_mon
+1);
990 s
->day
= bcd(tm
->tm_mday
);
998 static struct image_partition_entry
make_soft_version_from_string(const char *soft_ver
) {
999 /** String length _including_ the terminating zero byte */
1000 uint32_t ver_len
= strlen(soft_ver
) + 1;
1001 /** Partition contains 64 bit header, the version string, and one additional null byte */
1002 size_t partition_len
= 2*sizeof(uint32_t) + ver_len
+ 1;
1003 struct image_partition_entry entry
= alloc_image_partition("soft-version", partition_len
);
1005 uint32_t *len
= (uint32_t *)entry
.data
;
1006 len
[0] = htonl(ver_len
);
1008 memcpy(&len
[2], soft_ver
, ver_len
);
1010 entry
.data
[partition_len
- 1] = 0;
1015 /** Generates the support-list partition */
1016 static struct image_partition_entry
make_support_list(const struct device_info
*info
) {
1017 size_t len
= strlen(info
->support_list
);
1018 struct image_partition_entry entry
= alloc_image_partition("support-list", len
+ 9);
1020 put32(entry
.data
, len
);
1021 memset(entry
.data
+4, 0, 4);
1022 memcpy(entry
.data
+8, info
->support_list
, len
);
1023 entry
.data
[len
+8] = info
->support_trail
;
1028 /** Creates a new image partition with an arbitrary name from a file */
1029 static struct image_partition_entry
read_file(const char *part_name
, const char *filename
, bool add_jffs2_eof
) {
1030 struct stat statbuf
;
1032 if (stat(filename
, &statbuf
) < 0)
1033 error(1, errno
, "unable to stat file `%s'", filename
);
1035 size_t len
= statbuf
.st_size
;
1038 len
= ALIGN(len
, 0x10000) + sizeof(jffs2_eof_mark
);
1040 struct image_partition_entry entry
= alloc_image_partition(part_name
, len
);
1042 FILE *file
= fopen(filename
, "rb");
1044 error(1, errno
, "unable to open file `%s'", filename
);
1046 if (fread(entry
.data
, statbuf
.st_size
, 1, file
) != 1)
1047 error(1, errno
, "unable to read file `%s'", filename
);
1049 if (add_jffs2_eof
) {
1050 uint8_t *eof
= entry
.data
+ statbuf
.st_size
, *end
= entry
.data
+entry
.size
;
1052 memset(eof
, 0xff, end
- eof
- sizeof(jffs2_eof_mark
));
1053 memcpy(end
- sizeof(jffs2_eof_mark
), jffs2_eof_mark
, sizeof(jffs2_eof_mark
));
1061 /** Creates a new image partition from arbitrary data */
1062 static struct image_partition_entry
put_data(const char *part_name
, const char *datain
, size_t len
) {
1064 struct image_partition_entry entry
= alloc_image_partition(part_name
, len
);
1066 memcpy(entry
.data
, datain
, len
);
1072 Copies a list of image partitions into an image buffer and generates the image partition table while doing so
1074 Example image partition table:
1076 fwup-ptn partition-table base 0x00800 size 0x00800
1077 fwup-ptn os-image base 0x01000 size 0x113b45
1078 fwup-ptn file-system base 0x114b45 size 0x1d0004
1079 fwup-ptn support-list base 0x2e4b49 size 0x000d1
1081 Each line of the partition table is terminated with the bytes 09 0d 0a ("\t\r\n"),
1082 the end of the partition table is marked with a zero byte.
1084 The firmware image must contain at least the partition-table and support-list partitions
1085 to be accepted. There aren't any alignment constraints for the image partitions.
1087 The partition-table partition contains the actual flash layout; partitions
1088 from the image partition table are mapped to the corresponding flash partitions during
1089 the firmware upgrade. The support-list partition contains a list of devices supported by
1092 The base offsets in the firmware partition table are relative to the end
1093 of the vendor information block, so the partition-table partition will
1094 actually start at offset 0x1814 of the image.
1096 I think partition-table must be the first partition in the firmware image.
1098 static void put_partitions(uint8_t *buffer
, const struct flash_partition_entry
*flash_parts
, const struct image_partition_entry
*parts
) {
1100 char *image_pt
= (char *)buffer
, *end
= image_pt
+ 0x800;
1102 size_t base
= 0x800;
1103 for (i
= 0; parts
[i
].name
; i
++) {
1104 for (j
= 0; flash_parts
[j
].name
; j
++) {
1105 if (!strcmp(flash_parts
[j
].name
, parts
[i
].name
)) {
1106 if (parts
[i
].size
> flash_parts
[j
].size
)
1107 error(1, 0, "%s partition too big (more than %u bytes)", flash_parts
[j
].name
, (unsigned)flash_parts
[j
].size
);
1112 assert(flash_parts
[j
].name
);
1114 memcpy(buffer
+ base
, parts
[i
].data
, parts
[i
].size
);
1116 size_t len
= end
-image_pt
;
1117 size_t w
= snprintf(image_pt
, len
, "fwup-ptn %s base 0x%05x size 0x%05x\t\r\n", parts
[i
].name
, (unsigned)base
, (unsigned)parts
[i
].size
);
1120 error(1, 0, "image partition table overflow?");
1124 base
+= parts
[i
].size
;
1128 /** Generates and writes the image MD5 checksum */
1129 static void put_md5(uint8_t *md5
, uint8_t *buffer
, unsigned int len
) {
1133 MD5_Update(&ctx
, md5_salt
, (unsigned int)sizeof(md5_salt
));
1134 MD5_Update(&ctx
, buffer
, len
);
1135 MD5_Final(md5
, &ctx
);
1140 Generates the firmware image in factory format
1146 0000-0003 Image size (4 bytes, big endian)
1147 0004-0013 MD5 hash (hash of a 16 byte salt and the image data starting with byte 0x14)
1148 0014-0017 Vendor information length (without padding) (4 bytes, big endian)
1149 0018-1013 Vendor information (4092 bytes, padded with 0xff; there seem to be older
1150 (VxWorks-based) TP-LINK devices which use a smaller vendor information block)
1151 1014-1813 Image partition table (2048 bytes, padded with 0xff)
1152 1814-xxxx Firmware partitions
1154 static void * generate_factory_image(const struct device_info
*info
, const struct image_partition_entry
*parts
, size_t *len
) {
1158 for (i
= 0; parts
[i
].name
; i
++)
1159 *len
+= parts
[i
].size
;
1161 uint8_t *image
= malloc(*len
);
1163 error(1, errno
, "malloc");
1165 memset(image
, 0xff, *len
);
1169 size_t vendor_len
= strlen(info
->vendor
);
1170 put32(image
+0x14, vendor_len
);
1171 memcpy(image
+0x18, info
->vendor
, vendor_len
);
1174 put_partitions(image
+ 0x1014, info
->partitions
, parts
);
1175 put_md5(image
+0x04, image
+0x14, *len
-0x14);
1181 Generates the firmware image in sysupgrade format
1183 This makes some assumptions about the provided flash and image partition tables and
1184 should be generalized when TP-LINK starts building its safeloader into hardware with
1185 different flash layouts.
1187 static void * generate_sysupgrade_image(const struct device_info
*info
, const struct image_partition_entry
*image_parts
, size_t *len
) {
1189 size_t flash_first_partition_index
= 0;
1190 size_t flash_last_partition_index
= 0;
1191 const struct flash_partition_entry
*flash_first_partition
= NULL
;
1192 const struct flash_partition_entry
*flash_last_partition
= NULL
;
1193 const struct image_partition_entry
*image_last_partition
= NULL
;
1195 /** Find first and last partitions */
1196 for (i
= 0; info
->partitions
[i
].name
; i
++) {
1197 if (!strcmp(info
->partitions
[i
].name
, info
->first_sysupgrade_partition
)) {
1198 flash_first_partition
= &info
->partitions
[i
];
1199 flash_first_partition_index
= i
;
1200 } else if (!strcmp(info
->partitions
[i
].name
, info
->last_sysupgrade_partition
)) {
1201 flash_last_partition
= &info
->partitions
[i
];
1202 flash_last_partition_index
= i
;
1206 assert(flash_first_partition
&& flash_last_partition
);
1207 assert(flash_first_partition_index
< flash_last_partition_index
);
1209 /** Find last partition from image to calculate needed size */
1210 for (i
= 0; image_parts
[i
].name
; i
++) {
1211 if (!strcmp(image_parts
[i
].name
, info
->last_sysupgrade_partition
)) {
1212 image_last_partition
= &image_parts
[i
];
1217 assert(image_last_partition
);
1219 *len
= flash_last_partition
->base
- flash_first_partition
->base
+ image_last_partition
->size
;
1221 uint8_t *image
= malloc(*len
);
1223 error(1, errno
, "malloc");
1225 memset(image
, 0xff, *len
);
1227 for (i
= flash_first_partition_index
; i
<= flash_last_partition_index
; i
++) {
1228 for (j
= 0; image_parts
[j
].name
; j
++) {
1229 if (!strcmp(info
->partitions
[i
].name
, image_parts
[j
].name
)) {
1230 if (image_parts
[j
].size
> info
->partitions
[i
].size
)
1231 error(1, 0, "%s partition too big (more than %u bytes)", info
->partitions
[i
].name
, (unsigned)info
->partitions
[i
].size
);
1232 memcpy(image
+ info
->partitions
[i
].base
- flash_first_partition
->base
, image_parts
[j
].data
, image_parts
[j
].size
);
1236 assert(image_parts
[j
].name
);
1243 /** Generates an image according to a given layout and writes it to a file */
1244 static void build_image(const char *output
,
1245 const char *kernel_image
,
1246 const char *rootfs_image
,
1250 const struct device_info
*info
) {
1252 struct image_partition_entry parts
[7] = {};
1254 parts
[0] = make_partition_table(info
->partitions
);
1256 parts
[1] = make_soft_version_from_string(info
->soft_ver
);
1258 parts
[1] = make_soft_version(rev
);
1260 parts
[2] = make_support_list(info
);
1261 parts
[3] = read_file("os-image", kernel_image
, false);
1262 parts
[4] = read_file("file-system", rootfs_image
, add_jffs2_eof
);
1264 if (strcasecmp(info
->id
, "ARCHER-C25-V1") == 0) {
1265 const char mdat
[11] = {0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00};
1266 parts
[5] = put_data("extra-para", mdat
, 11);
1267 } else if (strcasecmp(info
->id
, "ARCHER-C7-V4") == 0) {
1268 const char mdat
[11] = {0x01, 0x00, 0x00, 0x02, 0x00, 0x00, 0xca, 0x00, 0x01, 0x00, 0x00};
1269 parts
[5] = put_data("extra-para", mdat
, 11);
1275 image
= generate_sysupgrade_image(info
, parts
, &len
);
1277 image
= generate_factory_image(info
, parts
, &len
);
1279 FILE *file
= fopen(output
, "wb");
1281 error(1, errno
, "unable to open output file");
1283 if (fwrite(image
, len
, 1, file
) != 1)
1284 error(1, 0, "unable to write output file");
1291 for (i
= 0; parts
[i
].name
; i
++)
1292 free_image_partition(parts
[i
]);
1296 static void usage(const char *argv0
) {
1298 "Usage: %s [OPTIONS...]\n"
1301 " -B <board> create image for the board specified with <board>\n"
1302 " -k <file> read kernel image from the file <file>\n"
1303 " -r <file> read rootfs image from the file <file>\n"
1304 " -o <file> write output to the file <file>\n"
1305 " -V <rev> sets the revision number to <rev>\n"
1306 " -j add jffs2 end-of-filesystem markers\n"
1307 " -S create sysupgrade instead of factory image\n"
1308 " -h show this help\n",
1314 static const struct device_info
*find_board(const char *id
)
1316 struct device_info
*board
= NULL
;
1318 for (board
= boards
; board
->id
!= NULL
; board
++)
1319 if (strcasecmp(id
, board
->id
) == 0)
1325 int main(int argc
, char *argv
[]) {
1326 const char *board
= NULL
, *kernel_image
= NULL
, *rootfs_image
= NULL
, *output
= NULL
;
1327 bool add_jffs2_eof
= false, sysupgrade
= false;
1329 const struct device_info
*info
;
1330 set_source_date_epoch();
1335 c
= getopt(argc
, argv
, "B:k:r:o:V:jSh");
1345 kernel_image
= optarg
;
1349 rootfs_image
= optarg
;
1357 sscanf(optarg
, "r%u", &rev
);
1361 add_jffs2_eof
= true;
1379 error(1, 0, "no board has been specified");
1381 error(1, 0, "no kernel image has been specified");
1383 error(1, 0, "no rootfs image has been specified");
1385 error(1, 0, "no output filename has been specified");
1387 info
= find_board(board
);
1390 error(1, 0, "unsupported board %s", board
);
1392 build_image(output
, kernel_image
, rootfs_image
, rev
, add_jffs2_eof
, sysupgrade
, info
);