projects / openwrt / staging / mkresin.git / blob
? search:


a872cbaa4be05bf13dcb0a14d6d5fb08bda0707d
[openwrt/staging/mkresin.git] / tools / firmware-utils / src / tplink-safeloader.c
1 /*
2 Copyright (c) 2014, Matthias Schiffer <mschiffer@universe-factory.net>
3 All rights reserved.
4
5 Redistribution and use in source and binary forms, with or without
6 modification, are permitted provided that the following conditions are met:
7
8 1. Redistributions of source code must retain the above copyright notice,
9 this list of conditions and the following disclaimer.
10 2. Redistributions in binary form must reproduce the above copyright notice,
11 this list of conditions and the following disclaimer in the documentation
12 and/or other materials provided with the distribution.
13
14 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
15 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
17 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
18 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
20 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
21 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
22 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26
27 /*
28 tplink-safeloader
29
30 Image generation tool for the TP-LINK SafeLoader as seen on
31 TP-LINK Pharos devices (CPE210/220/510/520)
32 */
33
34
35 #include <assert.h>
36 #include <errno.h>
37 #include <stdbool.h>
38 #include <stdio.h>
39 #include <stdint.h>
40 #include <stdlib.h>
41 #include <string.h>
42 #include <time.h>
43 #include <unistd.h>
44
45 #include <arpa/inet.h>
46
47 #include <sys/types.h>
48 #include <sys/stat.h>
49
50 #include "md5.h"
51
52
53 #define ALIGN(x,a) ({ typeof(a) __a = (a); (((x) + __a - 1) & ~(__a - 1)); })
54
55
56 #define MAX_PARTITIONS 32
57
58 /** An image partition table entry */
59 struct image_partition_entry {
60 const char *name;
61 size_t size;
62 uint8_t *data;
63 };
64
65 /** A flash partition table entry */
66 struct flash_partition_entry {
67 const char *name;
68 uint32_t base;
69 uint32_t size;
70 };
71
72 /** Firmware layout description */
73 struct device_info {
74 const char *id;
75 const char *vendor;
76 const char *support_list;
77 char support_trail;
78 const struct flash_partition_entry partitions[MAX_PARTITIONS+1];
79 const char *first_sysupgrade_partition;
80 const char *last_sysupgrade_partition;
81 };
82
83 /** The content of the soft-version structure */
84 struct __attribute__((__packed__)) soft_version {
85 uint32_t magic;
86 uint32_t zero;
87 uint8_t pad1;
88 uint8_t version_major;
89 uint8_t version_minor;
90 uint8_t version_patch;
91 uint8_t year_hi;
92 uint8_t year_lo;
93 uint8_t month;
94 uint8_t day;
95 uint32_t rev;
96 uint8_t pad2;
97 };
98
99
100 static const uint8_t jffs2_eof_mark[4] = {0xde, 0xad, 0xc0, 0xde};
101
102
103 /**
104 Salt for the MD5 hash
105
106 Fortunately, TP-LINK seems to use the same salt for most devices which use
107 the new image format.
108 */
109 static const uint8_t md5_salt[16] = {
110 0x7a, 0x2b, 0x15, 0xed,
111 0x9b, 0x98, 0x59, 0x6d,
112 0xe5, 0x04, 0xab, 0x44,
113 0xac, 0x2a, 0x9f, 0x4e,
114 };
115
116
117 /** Firmware layout table */
118 static struct device_info boards[] = {
119 /** Firmware layout for the CPE210/220 */
120 {
121 .id = "CPE210",
122 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
123 .support_list =
124 "SupportList:\r\n"
125 "CPE210(TP-LINK|UN|N300-2):1.0\r\n"
126 "CPE210(TP-LINK|UN|N300-2):1.1\r\n"
127 "CPE210(TP-LINK|US|N300-2):1.1\r\n"
128 "CPE210(TP-LINK|EU|N300-2):1.1\r\n"
129 "CPE220(TP-LINK|UN|N300-2):1.1\r\n"
130 "CPE220(TP-LINK|US|N300-2):1.1\r\n"
131 "CPE220(TP-LINK|EU|N300-2):1.1\r\n",
132 .support_trail = '\xff',
133
134 .partitions = {
135 {"fs-uboot", 0x00000, 0x20000},
136 {"partition-table", 0x20000, 0x02000},
137 {"default-mac", 0x30000, 0x00020},
138 {"product-info", 0x31100, 0x00100},
139 {"signature", 0x32000, 0x00400},
140 {"os-image", 0x40000, 0x170000},
141 {"soft-version", 0x1b0000, 0x00100},
142 {"support-list", 0x1b1000, 0x00400},
143 {"file-system", 0x1c0000, 0x600000},
144 {"user-config", 0x7c0000, 0x10000},
145 {"default-config", 0x7d0000, 0x10000},
146 {"log", 0x7e0000, 0x10000},
147 {"radio", 0x7f0000, 0x10000},
148 {NULL, 0, 0}
149 },
150
151 .first_sysupgrade_partition = "os-image",
152 .last_sysupgrade_partition = "file-system",
153 },
154
155 /** Firmware layout for the CPE510/520 */
156 {
157 .id = "CPE510",
158 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
159 .support_list =
160 "SupportList:\r\n"
161 "CPE510(TP-LINK|UN|N300-5):1.0\r\n"
162 "CPE510(TP-LINK|UN|N300-5):1.1\r\n"
163 "CPE510(TP-LINK|UN|N300-5):1.1\r\n"
164 "CPE510(TP-LINK|US|N300-5):1.1\r\n"
165 "CPE510(TP-LINK|EU|N300-5):1.1\r\n"
166 "CPE520(TP-LINK|UN|N300-5):1.1\r\n"
167 "CPE520(TP-LINK|US|N300-5):1.1\r\n"
168 "CPE520(TP-LINK|EU|N300-5):1.1\r\n",
169 .support_trail = '\xff',
170
171 .partitions = {
172 {"fs-uboot", 0x00000, 0x20000},
173 {"partition-table", 0x20000, 0x02000},
174 {"default-mac", 0x30000, 0x00020},
175 {"product-info", 0x31100, 0x00100},
176 {"signature", 0x32000, 0x00400},
177 {"os-image", 0x40000, 0x170000},
178 {"soft-version", 0x1b0000, 0x00100},
179 {"support-list", 0x1b1000, 0x00400},
180 {"file-system", 0x1c0000, 0x600000},
181 {"user-config", 0x7c0000, 0x10000},
182 {"default-config", 0x7d0000, 0x10000},
183 {"log", 0x7e0000, 0x10000},
184 {"radio", 0x7f0000, 0x10000},
185 {NULL, 0, 0}
186 },
187
188 .first_sysupgrade_partition = "os-image",
189 .last_sysupgrade_partition = "file-system",
190 },
191
192 {
193 .id = "WBS210",
194 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
195 .support_list =
196 "SupportList:\r\n"
197 "WBS210(TP-LINK|UN|N300-2):1.20\r\n"
198 "WBS210(TP-LINK|US|N300-2):1.20\r\n"
199 "WBS210(TP-LINK|EU|N300-2):1.20\r\n",
200 .support_trail = '\xff',
201
202 .partitions = {
203 {"fs-uboot", 0x00000, 0x20000},
204 {"partition-table", 0x20000, 0x02000},
205 {"default-mac", 0x30000, 0x00020},
206 {"product-info", 0x31100, 0x00100},
207 {"signature", 0x32000, 0x00400},
208 {"os-image", 0x40000, 0x170000},
209 {"soft-version", 0x1b0000, 0x00100},
210 {"support-list", 0x1b1000, 0x00400},
211 {"file-system", 0x1c0000, 0x600000},
212 {"user-config", 0x7c0000, 0x10000},
213 {"default-config", 0x7d0000, 0x10000},
214 {"log", 0x7e0000, 0x10000},
215 {"radio", 0x7f0000, 0x10000},
216 {NULL, 0, 0}
217 },
218
219 .first_sysupgrade_partition = "os-image",
220 .last_sysupgrade_partition = "file-system",
221 },
222
223 {
224 .id = "WBS510",
225 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
226 .support_list =
227 "SupportList:\r\n"
228 "WBS510(TP-LINK|UN|N300-5):1.20\r\n"
229 "WBS510(TP-LINK|US|N300-5):1.20\r\n"
230 "WBS510(TP-LINK|EU|N300-5):1.20\r\n",
231 .support_trail = '\xff',
232
233 .partitions = {
234 {"fs-uboot", 0x00000, 0x20000},
235 {"partition-table", 0x20000, 0x02000},
236 {"default-mac", 0x30000, 0x00020},
237 {"product-info", 0x31100, 0x00100},
238 {"signature", 0x32000, 0x00400},
239 {"os-image", 0x40000, 0x170000},
240 {"soft-version", 0x1b0000, 0x00100},
241 {"support-list", 0x1b1000, 0x00400},
242 {"file-system", 0x1c0000, 0x600000},
243 {"user-config", 0x7c0000, 0x10000},
244 {"default-config", 0x7d0000, 0x10000},
245 {"log", 0x7e0000, 0x10000},
246 {"radio", 0x7f0000, 0x10000},
247 {NULL, 0, 0}
248 },
249
250 .first_sysupgrade_partition = "os-image",
251 .last_sysupgrade_partition = "file-system",
252 },
253
254 /** Firmware layout for the C2600 */
255 {
256 .id = "C2600",
257 .vendor = "",
258 .support_list =
259 "SupportList:\r\n"
260 "{product_name:Archer C2600,product_ver:1.0.0,special_id:00000000}\r\n",
261 .support_trail = '\x00',
262
263 .partitions = {
264 {"SBL1", 0x00000, 0x20000},
265 {"MIBIB", 0x20000, 0x20000},
266 {"SBL2", 0x40000, 0x20000},
267 {"SBL3", 0x60000, 0x30000},
268 {"DDRCONFIG", 0x90000, 0x10000},
269 {"SSD", 0xa0000, 0x10000},
270 {"TZ", 0xb0000, 0x30000},
271 {"RPM", 0xe0000, 0x20000},
272 {"fs-uboot", 0x100000, 0x70000},
273 {"uboot-env", 0x170000, 0x40000},
274 {"radio", 0x1b0000, 0x40000},
275 {"os-image", 0x1f0000, 0x200000},
276 {"file-system", 0x3f0000, 0x1b00000},
277 {"default-mac", 0x1ef0000, 0x00200},
278 {"pin", 0x1ef0200, 0x00200},
279 {"product-info", 0x1ef0400, 0x0fc00},
280 {"partition-table", 0x1f00000, 0x10000},
281 {"soft-version", 0x1f10000, 0x10000},
282 {"support-list", 0x1f20000, 0x10000},
283 {"profile", 0x1f30000, 0x10000},
284 {"default-config", 0x1f40000, 0x10000},
285 {"user-config", 0x1f50000, 0x40000},
286 {"qos-db", 0x1f90000, 0x40000},
287 {"usb-config", 0x1fd0000, 0x10000},
288 {"log", 0x1fe0000, 0x20000},
289 {NULL, 0, 0}
290 },
291
292 .first_sysupgrade_partition = "os-image",
293 .last_sysupgrade_partition = "file-system"
294 },
295
296 /** Firmware layout for the C59v1 */
297 {
298 .id = "ARCHER-C59-V1",
299 .vendor = "",
300 .support_list =
301 "SupportList:\r\n"
302 "{product_name:Archer C59,product_ver:1.0.0,special_id:00000000}\r\n"
303 "{product_name:Archer C59,product_ver:1.0.0,special_id:45550000}\r\n"
304 "{product_name:Archer C59,product_ver:1.0.0,special_id:55530000}\r\n",
305 .support_trail = '\x00',
306
307 .partitions = {
308 {"fs-uboot", 0x00000, 0x10000},
309 {"default-mac", 0x10000, 0x00200},
310 {"pin", 0x10200, 0x00200},
311 {"device-id", 0x10400, 0x00100},
312 {"product-info", 0x10500, 0x0fb00},
313 {"os-image", 0x20000, 0x180000},
314 {"file-system", 0x1a0000, 0xcb0000},
315 {"partition-table", 0xe50000, 0x10000},
316 {"soft-version", 0xe60000, 0x10000},
317 {"support-list", 0xe70000, 0x10000},
318 {"profile", 0xe80000, 0x10000},
319 {"default-config", 0xe90000, 0x10000},
320 {"user-config", 0xea0000, 0x40000},
321 {"usb-config", 0xee0000, 0x10000},
322 {"certificate", 0xef0000, 0x10000},
323 {"qos-db", 0xf00000, 0x40000},
324 {"log", 0xfe0000, 0x10000},
325 {"radio", 0xff0000, 0x10000},
326 {NULL, 0, 0}
327 },
328
329 .first_sysupgrade_partition = "os-image",
330 .last_sysupgrade_partition = "file-system",
331 },
332
333 /** Firmware layout for the C60v1 */
334 {
335 .id = "ARCHER-C60-V1",
336 .vendor = "",
337 .support_list =
338 "SupportList:\r\n"
339 "{product_name:Archer C60,product_ver:1.0.0,special_id:00000000}\r\n"
340 "{product_name:Archer C60,product_ver:1.0.0,special_id:45550000}\r\n"
341 "{product_name:Archer C60,product_ver:1.0.0,special_id:55530000}\r\n",
342 .support_trail = '\x00',
343
344 .partitions = {
345 {"fs-uboot", 0x00000, 0x10000},
346 {"default-mac", 0x10000, 0x00200},
347 {"pin", 0x10200, 0x00200},
348 {"product-info", 0x10400, 0x00100},
349 {"partition-table", 0x10500, 0x00800},
350 {"soft-version", 0x11300, 0x00200},
351 {"support-list", 0x11500, 0x00100},
352 {"device-id", 0x11600, 0x00100},
353 {"profile", 0x11700, 0x03900},
354 {"default-config", 0x15000, 0x04000},
355 {"user-config", 0x19000, 0x04000},
356 {"os-image", 0x20000, 0x150000},
357 {"file-system", 0x170000, 0x678000},
358 {"certyficate", 0x7e8000, 0x08000},
359 {"radio", 0x7f0000, 0x10000},
360 {NULL, 0, 0}
361 },
362
363 .first_sysupgrade_partition = "os-image",
364 .last_sysupgrade_partition = "file-system",
365 },
366
367 /** Firmware layout for the C9 */
368 {
369 .id = "ARCHERC9",
370 .vendor = "",
371 .support_list =
372 "SupportList:\n"
373 "{product_name:ArcherC9,"
374 "product_ver:1.0.0,"
375 "special_id:00000000}\n",
376 .support_trail = '\x00',
377
378 .partitions = {
379 {"fs-uboot", 0x00000, 0x40000},
380 {"os-image", 0x40000, 0x200000},
381 {"file-system", 0x240000, 0xc00000},
382 {"default-mac", 0xe40000, 0x00200},
383 {"pin", 0xe40200, 0x00200},
384 {"product-info", 0xe40400, 0x00200},
385 {"partition-table", 0xe50000, 0x10000},
386 {"soft-version", 0xe60000, 0x00200},
387 {"support-list", 0xe61000, 0x0f000},
388 {"profile", 0xe70000, 0x10000},
389 {"default-config", 0xe80000, 0x10000},
390 {"user-config", 0xe90000, 0x50000},
391 {"log", 0xee0000, 0x100000},
392 {"radio_bk", 0xfe0000, 0x10000},
393 {"radio", 0xff0000, 0x10000},
394 {NULL, 0, 0}
395 },
396
397 .first_sysupgrade_partition = "os-image",
398 .last_sysupgrade_partition = "file-system"
399 },
400
401 /** Firmware layout for the EAP120 */
402 {
403 .id = "EAP120",
404 .vendor = "EAP120(TP-LINK|UN|N300-2):1.0\r\n",
405 .support_list =
406 "SupportList:\r\n"
407 "EAP120(TP-LINK|UN|N300-2):1.0\r\n",
408 .support_trail = '\xff',
409
410 .partitions = {
411 {"fs-uboot", 0x00000, 0x20000},
412 {"partition-table", 0x20000, 0x02000},
413 {"default-mac", 0x30000, 0x00020},
414 {"support-list", 0x31000, 0x00100},
415 {"product-info", 0x31100, 0x00100},
416 {"soft-version", 0x32000, 0x00100},
417 {"os-image", 0x40000, 0x180000},
418 {"file-system", 0x1c0000, 0x600000},
419 {"user-config", 0x7c0000, 0x10000},
420 {"backup-config", 0x7d0000, 0x10000},
421 {"log", 0x7e0000, 0x10000},
422 {"radio", 0x7f0000, 0x10000},
423 {NULL, 0, 0}
424 },
425
426 .first_sysupgrade_partition = "os-image",
427 .last_sysupgrade_partition = "file-system"
428 },
429
430 /** Firmware layout for the TL-WA850RE v2 */
431 {
432 .id = "TLWA850REV2",
433 .vendor = "",
434 .support_list =
435 "SupportList:\n"
436 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:55530000}\n"
437 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:00000000}\n"
438 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:55534100}\n"
439 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:45550000}\n"
440 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:4B520000}\n"
441 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:42520000}\n"
442 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:4A500000}\n"
443 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:43410000}\n"
444 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:41550000}\n"
445 "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:52550000}\n",
446 .support_trail = '\x00',
447
448 /**
449 576KB were moved from file-system to os-image
450 in comparison to the stock image
451 */
452 .partitions = {
453 {"fs-uboot", 0x00000, 0x20000},
454 {"os-image", 0x20000, 0x150000},
455 {"file-system", 0x170000, 0x240000},
456 {"partition-table", 0x3b0000, 0x02000},
457 {"default-mac", 0x3c0000, 0x00020},
458 {"pin", 0x3c0100, 0x00020},
459 {"product-info", 0x3c1000, 0x01000},
460 {"soft-version", 0x3c2000, 0x00100},
461 {"support-list", 0x3c3000, 0x01000},
462 {"profile", 0x3c4000, 0x08000},
463 {"user-config", 0x3d0000, 0x10000},
464 {"default-config", 0x3e0000, 0x10000},
465 {"radio", 0x3f0000, 0x10000},
466 {NULL, 0, 0}
467 },
468
469 .first_sysupgrade_partition = "os-image",
470 .last_sysupgrade_partition = "file-system"
471 },
472
473 /** Firmware layout for the TL-WR1043 v4 */
474 {
475 .id = "TLWR1043NDV4",
476 .vendor = "",
477 .support_list =
478 "SupportList:\n"
479 "{product_name:TL-WR1043ND,product_ver:4.0.0,special_id:45550000}\n",
480 .support_trail = '\x00',
481
482 /**
483 We use a bigger os-image partition than the stock images (and thus
484 smaller file-system), as our kernel doesn't fit in the stock firmware's
485 1MB os-image.
486 */
487 .partitions = {
488 {"fs-uboot", 0x00000, 0x20000},
489 {"os-image", 0x20000, 0x180000},
490 {"file-system", 0x1a0000, 0xdb0000},
491 {"default-mac", 0xf50000, 0x00200},
492 {"pin", 0xf50200, 0x00200},
493 {"product-info", 0xf50400, 0x0fc00},
494 {"soft-version", 0xf60000, 0x0b000},
495 {"support-list", 0xf6b000, 0x04000},
496 {"profile", 0xf70000, 0x04000},
497 {"default-config", 0xf74000, 0x0b000},
498 {"user-config", 0xf80000, 0x40000},
499 {"partition-table", 0xfc0000, 0x10000},
500 {"log", 0xfd0000, 0x20000},
501 {"radio", 0xff0000, 0x10000},
502 {NULL, 0, 0}
503 },
504
505 .first_sysupgrade_partition = "os-image",
506 .last_sysupgrade_partition = "file-system"
507 },
508
509 /** Firmware layout for the RE450 */
510 {
511 .id = "RE450",
512 .vendor = "",
513 .support_list =
514 "SupportList:\r\n"
515 "{product_name:RE450,product_ver:1.0.0,special_id:00000000}\r\n"
516 "{product_name:RE450,product_ver:1.0.0,special_id:55530000}\r\n"
517 "{product_name:RE450,product_ver:1.0.0,special_id:45550000}\r\n"
518 "{product_name:RE450,product_ver:1.0.0,special_id:4A500000}\r\n"
519 "{product_name:RE450,product_ver:1.0.0,special_id:43410000}\r\n"
520 "{product_name:RE450,product_ver:1.0.0,special_id:41550000}\r\n"
521 "{product_name:RE450,product_ver:1.0.0,special_id:4B520000}\r\n"
522 "{product_name:RE450,product_ver:1.0.0,special_id:55534100}\r\n",
523 .support_trail = '\x00',
524
525 /**
526 The flash partition table for RE450;
527 it is almost the same as the one used by the stock images,
528 576KB were moved from file-system to os-image.
529 */
530 .partitions = {
531 {"fs-uboot", 0x00000, 0x20000},
532 {"os-image", 0x20000, 0x150000},
533 {"file-system", 0x170000, 0x4a0000},
534 {"partition-table", 0x600000, 0x02000},
535 {"default-mac", 0x610000, 0x00020},
536 {"pin", 0x610100, 0x00020},
537 {"product-info", 0x611100, 0x01000},
538 {"soft-version", 0x620000, 0x01000},
539 {"support-list", 0x621000, 0x01000},
540 {"profile", 0x622000, 0x08000},
541 {"user-config", 0x630000, 0x10000},
542 {"default-config", 0x640000, 0x10000},
543 {"radio", 0x7f0000, 0x10000},
544 {NULL, 0, 0}
545 },
546
547 .first_sysupgrade_partition = "os-image",
548 .last_sysupgrade_partition = "file-system"
549 },
550
551 {}
552 };
553
554 #define error(_ret, _errno, _str, ...) \
555 do { \
556 fprintf(stderr, _str ": %s\n", ## __VA_ARGS__, \
557 strerror(_errno)); \
558 if (_ret) \
559 exit(_ret); \
560 } while (0)
561
562
563 /** Stores a uint32 as big endian */
564 static inline void put32(uint8_t *buf, uint32_t val) {
565 buf[0] = val >> 24;
566 buf[1] = val >> 16;
567 buf[2] = val >> 8;
568 buf[3] = val;
569 }
570
571 /** Allocates a new image partition */
572 static struct image_partition_entry alloc_image_partition(const char *name, size_t len) {
573 struct image_partition_entry entry = {name, len, malloc(len)};
574 if (!entry.data)
575 error(1, errno, "malloc");
576
577 return entry;
578 }
579
580 /** Frees an image partition */
581 static void free_image_partition(struct image_partition_entry entry) {
582 free(entry.data);
583 }
584
585 /** Generates the partition-table partition */
586 static struct image_partition_entry make_partition_table(const struct flash_partition_entry *p) {
587 struct image_partition_entry entry = alloc_image_partition("partition-table", 0x800);
588
589 char *s = (char *)entry.data, *end = (char *)(s+entry.size);
590
591 *(s++) = 0x00;
592 *(s++) = 0x04;
593 *(s++) = 0x00;
594 *(s++) = 0x00;
595
596 size_t i;
597 for (i = 0; p[i].name; i++) {
598 size_t len = end-s;
599 size_t w = snprintf(s, len, "partition %s base 0x%05x size 0x%05x\n", p[i].name, p[i].base, p[i].size);
600
601 if (w > len-1)
602 error(1, 0, "flash partition table overflow?");
603
604 s += w;
605 }
606
607 s++;
608
609 memset(s, 0xff, end-s);
610
611 return entry;
612 }
613
614
615 /** Generates a binary-coded decimal representation of an integer in the range [0, 99] */
616 static inline uint8_t bcd(uint8_t v) {
617 return 0x10 * (v/10) + v%10;
618 }
619
620
621 /** Generates the soft-version partition */
622 static struct image_partition_entry make_soft_version(uint32_t rev) {
623 struct image_partition_entry entry = alloc_image_partition("soft-version", sizeof(struct soft_version));
624 struct soft_version *s = (struct soft_version *)entry.data;
625
626 time_t t;
627
628 if (time(&t) == (time_t)(-1))
629 error(1, errno, "time");
630
631 struct tm *tm = localtime(&t);
632
633 s->magic = htonl(0x0000000c);
634 s->zero = 0;
635 s->pad1 = 0xff;
636
637 s->version_major = 0;
638 s->version_minor = 0;
639 s->version_patch = 0;
640
641 s->year_hi = bcd((1900+tm->tm_year)/100);
642 s->year_lo = bcd(tm->tm_year%100);
643 s->month = bcd(tm->tm_mon+1);
644 s->day = bcd(tm->tm_mday);
645 s->rev = htonl(rev);
646
647 s->pad2 = 0xff;
648
649 return entry;
650 }
651
652 /** Generates the support-list partition */
653 static struct image_partition_entry make_support_list(const struct device_info *info) {
654 size_t len = strlen(info->support_list);
655 struct image_partition_entry entry = alloc_image_partition("support-list", len + 9);
656
657 put32(entry.data, len);
658 memset(entry.data+4, 0, 4);
659 memcpy(entry.data+8, info->support_list, len);
660 entry.data[len+8] = info->support_trail;
661
662 return entry;
663 }
664
665 /** Creates a new image partition with an arbitrary name from a file */
666 static struct image_partition_entry read_file(const char *part_name, const char *filename, bool add_jffs2_eof) {
667 struct stat statbuf;
668
669 if (stat(filename, &statbuf) < 0)
670 error(1, errno, "unable to stat file `%s'", filename);
671
672 size_t len = statbuf.st_size;
673
674 if (add_jffs2_eof)
675 len = ALIGN(len, 0x10000) + sizeof(jffs2_eof_mark);
676
677 struct image_partition_entry entry = alloc_image_partition(part_name, len);
678
679 FILE *file = fopen(filename, "rb");
680 if (!file)
681 error(1, errno, "unable to open file `%s'", filename);
682
683 if (fread(entry.data, statbuf.st_size, 1, file) != 1)
684 error(1, errno, "unable to read file `%s'", filename);
685
686 if (add_jffs2_eof) {
687 uint8_t *eof = entry.data + statbuf.st_size, *end = entry.data+entry.size;
688
689 memset(eof, 0xff, end - eof - sizeof(jffs2_eof_mark));
690 memcpy(end - sizeof(jffs2_eof_mark), jffs2_eof_mark, sizeof(jffs2_eof_mark));
691 }
692
693 fclose(file);
694
695 return entry;
696 }
697
698
699 /**
700 Copies a list of image partitions into an image buffer and generates the image partition table while doing so
701
702 Example image partition table:
703
704 fwup-ptn partition-table base 0x00800 size 0x00800
705 fwup-ptn os-image base 0x01000 size 0x113b45
706 fwup-ptn file-system base 0x114b45 size 0x1d0004
707 fwup-ptn support-list base 0x2e4b49 size 0x000d1
708
709 Each line of the partition table is terminated with the bytes 09 0d 0a ("\t\r\n"),
710 the end of the partition table is marked with a zero byte.
711
712 The firmware image must contain at least the partition-table and support-list partitions
713 to be accepted. There aren't any alignment constraints for the image partitions.
714
715 The partition-table partition contains the actual flash layout; partitions
716 from the image partition table are mapped to the corresponding flash partitions during
717 the firmware upgrade. The support-list partition contains a list of devices supported by
718 the firmware image.
719
720 The base offsets in the firmware partition table are relative to the end
721 of the vendor information block, so the partition-table partition will
722 actually start at offset 0x1814 of the image.
723
724 I think partition-table must be the first partition in the firmware image.
725 */
726 static void put_partitions(uint8_t *buffer, const struct flash_partition_entry *flash_parts, const struct image_partition_entry *parts) {
727 size_t i, j;
728 char *image_pt = (char *)buffer, *end = image_pt + 0x800;
729
730 size_t base = 0x800;
731 for (i = 0; parts[i].name; i++) {
732 for (j = 0; flash_parts[j].name; j++) {
733 if (!strcmp(flash_parts[j].name, parts[i].name)) {
734 if (parts[i].size > flash_parts[j].size)
735 error(1, 0, "%s partition too big (more than %u bytes)", flash_parts[j].name, (unsigned)flash_parts[j].size);
736 break;
737 }
738 }
739
740 assert(flash_parts[j].name);
741
742 memcpy(buffer + base, parts[i].data, parts[i].size);
743
744 size_t len = end-image_pt;
745 size_t w = snprintf(image_pt, len, "fwup-ptn %s base 0x%05x size 0x%05x\t\r\n", parts[i].name, (unsigned)base, (unsigned)parts[i].size);
746
747 if (w > len-1)
748 error(1, 0, "image partition table overflow?");
749
750 image_pt += w;
751
752 base += parts[i].size;
753 }
754 }
755
756 /** Generates and writes the image MD5 checksum */
757 static void put_md5(uint8_t *md5, uint8_t *buffer, unsigned int len) {
758 MD5_CTX ctx;
759
760 MD5_Init(&ctx);
761 MD5_Update(&ctx, md5_salt, (unsigned int)sizeof(md5_salt));
762 MD5_Update(&ctx, buffer, len);
763 MD5_Final(md5, &ctx);
764 }
765
766
767 /**
768 Generates the firmware image in factory format
769
770 Image format:
771
772 Bytes (hex) Usage
773 ----------- -----
774 0000-0003 Image size (4 bytes, big endian)
775 0004-0013 MD5 hash (hash of a 16 byte salt and the image data starting with byte 0x14)
776 0014-0017 Vendor information length (without padding) (4 bytes, big endian)
777 0018-1013 Vendor information (4092 bytes, padded with 0xff; there seem to be older
778 (VxWorks-based) TP-LINK devices which use a smaller vendor information block)
779 1014-1813 Image partition table (2048 bytes, padded with 0xff)
780 1814-xxxx Firmware partitions
781 */
782 static void * generate_factory_image(const struct device_info *info, const struct image_partition_entry *parts, size_t *len) {
783 *len = 0x1814;
784
785 size_t i;
786 for (i = 0; parts[i].name; i++)
787 *len += parts[i].size;
788
789 uint8_t *image = malloc(*len);
790 if (!image)
791 error(1, errno, "malloc");
792
793 memset(image, 0xff, *len);
794 put32(image, *len);
795
796 if (info->vendor) {
797 size_t vendor_len = strlen(info->vendor);
798 put32(image+0x14, vendor_len);
799 memcpy(image+0x18, info->vendor, vendor_len);
800 }
801
802 put_partitions(image + 0x1014, info->partitions, parts);
803 put_md5(image+0x04, image+0x14, *len-0x14);
804
805 return image;
806 }
807
808 /**
809 Generates the firmware image in sysupgrade format
810
811 This makes some assumptions about the provided flash and image partition tables and
812 should be generalized when TP-LINK starts building its safeloader into hardware with
813 different flash layouts.
814 */
815 static void * generate_sysupgrade_image(const struct device_info *info, const struct image_partition_entry *image_parts, size_t *len) {
816 size_t i, j;
817 size_t flash_first_partition_index = 0;
818 size_t flash_last_partition_index = 0;
819 const struct flash_partition_entry *flash_first_partition = NULL;
820 const struct flash_partition_entry *flash_last_partition = NULL;
821 const struct image_partition_entry *image_last_partition = NULL;
822
823 /** Find first and last partitions */
824 for (i = 0; info->partitions[i].name; i++) {
825 if (!strcmp(info->partitions[i].name, info->first_sysupgrade_partition)) {
826 flash_first_partition = &info->partitions[i];
827 flash_first_partition_index = i;
828 } else if (!strcmp(info->partitions[i].name, info->last_sysupgrade_partition)) {
829 flash_last_partition = &info->partitions[i];
830 flash_last_partition_index = i;
831 }
832 }
833
834 assert(flash_first_partition && flash_last_partition);
835 assert(flash_first_partition_index < flash_last_partition_index);
836
837 /** Find last partition from image to calculate needed size */
838 for (i = 0; image_parts[i].name; i++) {
839 if (!strcmp(image_parts[i].name, info->last_sysupgrade_partition)) {
840 image_last_partition = &image_parts[i];
841 break;
842 }
843 }
844
845 assert(image_last_partition);
846
847 *len = flash_last_partition->base - flash_first_partition->base + image_last_partition->size;
848
849 uint8_t *image = malloc(*len);
850 if (!image)
851 error(1, errno, "malloc");
852
853 memset(image, 0xff, *len);
854
855 for (i = flash_first_partition_index; i <= flash_last_partition_index; i++) {
856 for (j = 0; image_parts[j].name; j++) {
857 if (!strcmp(info->partitions[i].name, image_parts[j].name)) {
858 if (image_parts[j].size > info->partitions[i].size)
859 error(1, 0, "%s partition too big (more than %u bytes)", info->partitions[i].name, (unsigned)info->partitions[i].size);
860 memcpy(image + info->partitions[i].base - flash_first_partition->base, image_parts[j].data, image_parts[j].size);
861 break;
862 }
863
864 assert(image_parts[j].name);
865 }
866 }
867
868 return image;
869 }
870
871 /** Generates an image according to a given layout and writes it to a file */
872 static void build_image(const char *output,
873 const char *kernel_image,
874 const char *rootfs_image,
875 uint32_t rev,
876 bool add_jffs2_eof,
877 bool sysupgrade,
878 const struct device_info *info) {
879 struct image_partition_entry parts[6] = {};
880
881 parts[0] = make_partition_table(info->partitions);
882 parts[1] = make_soft_version(rev);
883 parts[2] = make_support_list(info);
884 parts[3] = read_file("os-image", kernel_image, false);
885 parts[4] = read_file("file-system", rootfs_image, add_jffs2_eof);
886
887 size_t len;
888 void *image;
889 if (sysupgrade)
890 image = generate_sysupgrade_image(info, parts, &len);
891 else
892 image = generate_factory_image(info, parts, &len);
893
894 FILE *file = fopen(output, "wb");
895 if (!file)
896 error(1, errno, "unable to open output file");
897
898 if (fwrite(image, len, 1, file) != 1)
899 error(1, 0, "unable to write output file");
900
901 fclose(file);
902
903 free(image);
904
905 size_t i;
906 for (i = 0; parts[i].name; i++)
907 free_image_partition(parts[i]);
908 }
909
910 /** Usage output */
911 static void usage(const char *argv0) {
912 fprintf(stderr,
913 "Usage: %s [OPTIONS...]\n"
914 "\n"
915 "Options:\n"
916 " -B <board> create image for the board specified with <board>\n"
917 " -k <file> read kernel image from the file <file>\n"
918 " -r <file> read rootfs image from the file <file>\n"
919 " -o <file> write output to the file <file>\n"
920 " -V <rev> sets the revision number to <rev>\n"
921 " -j add jffs2 end-of-filesystem markers\n"
922 " -S create sysupgrade instead of factory image\n"
923 " -h show this help\n",
924 argv0
925 );
926 };
927
928
929 static const struct device_info *find_board(const char *id)
930 {
931 struct device_info *board = NULL;
932
933 for (board = boards; board->id != NULL; board++)
934 if (strcasecmp(id, board->id) == 0)
935 return board;
936
937 return NULL;
938 }
939
940 int main(int argc, char *argv[]) {
941 const char *board = NULL, *kernel_image = NULL, *rootfs_image = NULL, *output = NULL;
942 bool add_jffs2_eof = false, sysupgrade = false;
943 unsigned rev = 0;
944 const struct device_info *info;
945
946 while (true) {
947 int c;
948
949 c = getopt(argc, argv, "B:k:r:o:V:jSh");
950 if (c == -1)
951 break;
952
953 switch (c) {
954 case 'B':
955 board = optarg;
956 break;
957
958 case 'k':
959 kernel_image = optarg;
960 break;
961
962 case 'r':
963 rootfs_image = optarg;
964 break;
965
966 case 'o':
967 output = optarg;
968 break;
969
970 case 'V':
971 sscanf(optarg, "r%u", &rev);
972 break;
973
974 case 'j':
975 add_jffs2_eof = true;
976 break;
977
978 case 'S':
979 sysupgrade = true;
980 break;
981
982 case 'h':
983 usage(argv[0]);
984 return 0;
985
986 default:
987 usage(argv[0]);
988 return 1;
989 }
990 }
991
992 if (!board)
993 error(1, 0, "no board has been specified");
994 if (!kernel_image)
995 error(1, 0, "no kernel image has been specified");
996 if (!rootfs_image)
997 error(1, 0, "no rootfs image has been specified");
998 if (!output)
999 error(1, 0, "no output filename has been specified");
1000
1001 info = find_board(board);
1002
1003 if (info == NULL)
1004 error(1, 0, "unsupported board %s", board);
1005
1006 build_image(output, kernel_image, rootfs_image, rev, add_jffs2_eof, sysupgrade, info);
1007
1008 return 0;
1009 }
Staging tree of Mathias Kresin