tools/firmware-utils/src/tplink-safeloader.c

   1 /*
   2   Copyright (c) 2014, Matthias Schiffer <mschiffer@universe-factory.net>
   3   All rights reserved.
   4
   5   Redistribution and use in source and binary forms, with or without
   6   modification, are permitted provided that the following conditions are met:
   7
   8     1. Redistributions of source code must retain the above copyright notice,
   9        this list of conditions and the following disclaimer.
  10     2. Redistributions in binary form must reproduce the above copyright notice,
  11        this list of conditions and the following disclaimer in the documentation
  12        and/or other materials provided with the distribution.
  13
  14   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  15   AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16   IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  17   DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  18   FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19   DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  20   SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  21   CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  22   OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  23   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24 */
  25
  26
  27 /*
  28    tplink-safeloader
  29
  30    Image generation tool for the TP-LINK SafeLoader as seen on
  31    TP-LINK Pharos devices (CPE210/220/510/520)
  32 */
  33
  34
  35 #include <assert.h>
  36 #include <errno.h>
  37 #include <stdbool.h>
  38 #include <stdio.h>
  39 #include <stdint.h>
  40 #include <stdlib.h>
  41 #include <string.h>
  42 #include <time.h>
  43 #include <unistd.h>
  44
  45 #include <arpa/inet.h>
  46
  47 #include <sys/types.h>
  48 #include <sys/stat.h>
  49 #include <limits.h>
  50
  51 #include "md5.h"
  52
  53
  54 #define ALIGN(x,a) ({ typeof(a) __a = (a); (((x) + __a - 1) & ~(__a - 1)); })
  55
  56
  57 #define MAX_PARTITIONS  32
  58
  59 /** An image partition table entry */
  60 struct image_partition_entry {
  61         const char *name;
  62         size_t size;
  63         uint8_t *data;
  64 };
  65
  66 /** A flash partition table entry */
  67 struct flash_partition_entry {
  68         char *name;
  69         uint32_t base;
  70         uint32_t size;
  71 };
  72
  73 /** Firmware layout description */
  74 struct device_info {
  75         const char *id;
  76         const char *vendor;
  77         const char *support_list;
  78         char support_trail;
  79         const char *soft_ver;
  80         struct flash_partition_entry partitions[MAX_PARTITIONS+1];
  81         const char *first_sysupgrade_partition;
  82         const char *last_sysupgrade_partition;
  83 };
  84
  85 /** The content of the soft-version structure */
  86 struct __attribute__((__packed__)) soft_version {
  87         uint32_t magic;
  88         uint32_t zero;
  89         uint8_t pad1;
  90         uint8_t version_major;
  91         uint8_t version_minor;
  92         uint8_t version_patch;
  93         uint8_t year_hi;
  94         uint8_t year_lo;
  95         uint8_t month;
  96         uint8_t day;
  97         uint32_t rev;
  98         uint8_t pad2;
  99 };
 100
 101
 102 static const uint8_t jffs2_eof_mark[4] = {0xde, 0xad, 0xc0, 0xde};
 103
 104
 105 /**
 106    Salt for the MD5 hash
 107
 108    Fortunately, TP-LINK seems to use the same salt for most devices which use
 109    the new image format.
 110 */
 111 static const uint8_t md5_salt[16] = {
 112         0x7a, 0x2b, 0x15, 0xed,
 113         0x9b, 0x98, 0x59, 0x6d,
 114         0xe5, 0x04, 0xab, 0x44,
 115         0xac, 0x2a, 0x9f, 0x4e,
 116 };
 117
 118
 119 /** Firmware layout table */
 120 static struct device_info boards[] = {
 121         /** Firmware layout for the CPE210/220 */
 122         {
 123                 .id     = "CPE210",
 124                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 125                 .support_list =
 126                         "SupportList:\r\n"
 127                         "CPE210(TP-LINK|UN|N300-2):1.0\r\n"
 128                         "CPE210(TP-LINK|UN|N300-2):1.1\r\n"
 129                         "CPE210(TP-LINK|US|N300-2):1.1\r\n"
 130                         "CPE210(TP-LINK|EU|N300-2):1.1\r\n"
 131                         "CPE220(TP-LINK|UN|N300-2):1.1\r\n"
 132                         "CPE220(TP-LINK|US|N300-2):1.1\r\n"
 133                         "CPE220(TP-LINK|EU|N300-2):1.1\r\n",
 134                 .support_trail = '\xff',
 135                 .soft_ver = NULL,
 136
 137                 .partitions = {
 138                         {"fs-uboot", 0x00000, 0x20000},
 139                         {"partition-table", 0x20000, 0x02000},
 140                         {"default-mac", 0x30000, 0x00020},
 141                         {"product-info", 0x31100, 0x00100},
 142                         {"signature", 0x32000, 0x00400},
 143                         {"os-image", 0x40000, 0x1c0000},
 144                         {"file-system", 0x200000, 0x5b0000},
 145                         {"soft-version", 0x7b0000, 0x00100},
 146                         {"support-list", 0x7b1000, 0x00400},
 147                         {"user-config", 0x7c0000, 0x10000},
 148                         {"default-config", 0x7d0000, 0x10000},
 149                         {"log", 0x7e0000, 0x10000},
 150                         {"radio", 0x7f0000, 0x10000},
 151                         {NULL, 0, 0}
 152                 },
 153
 154                 .first_sysupgrade_partition = "os-image",
 155                 .last_sysupgrade_partition = "support-list",
 156         },
 157
 158         /** Firmware layout for the CPE210 V2 */
 159         {
 160                 .id     = "CPE210V2",
 161                 .vendor = "CPE210(TP-LINK|UN|N300-2|00000000):2.0\r\n",
 162                 .support_list =
 163                         "SupportList:\r\n"
 164                         "CPE210(TP-LINK|EU|N300-2|00000000):2.0\r\n"
 165                         "CPE210(TP-LINK|EU|N300-2|45550000):2.0\r\n"
 166                         "CPE210(TP-LINK|EU|N300-2|55530000):2.0\r\n"
 167                         "CPE210(TP-LINK|UN|N300-2|00000000):2.0\r\n"
 168                         "CPE210(TP-LINK|UN|N300-2|45550000):2.0\r\n"
 169                         "CPE210(TP-LINK|UN|N300-2|55530000):2.0\r\n"
 170                         "CPE210(TP-LINK|US|N300-2|55530000):2.0\r\n"
 171                         "CPE210(TP-LINK|UN|N300-2):2.0\r\n"
 172                         "CPE210(TP-LINK|EU|N300-2):2.0\r\n"
 173                         "CPE210(TP-LINK|US|N300-2):2.0\r\n",
 174                 .support_trail = '\xff',
 175                 .soft_ver = NULL,
 176
 177                 .partitions = {
 178                         {"fs-uboot", 0x00000, 0x20000},
 179                         {"partition-table", 0x20000, 0x02000},
 180                         {"default-mac", 0x30000, 0x00020},
 181                         {"product-info", 0x31100, 0x00100},
 182                         {"device-info", 0x31400, 0x00400},
 183                         {"signature", 0x32000, 0x00400},
 184                         {"device-id", 0x33000, 0x00100},
 185                         {"os-image", 0x40000, 0x1c0000},
 186                         {"file-system", 0x200000, 0x5b0000},
 187                         {"soft-version", 0x7b0000, 0x00100},
 188                         {"support-list", 0x7b1000, 0x01000},
 189                         {"user-config", 0x7c0000, 0x10000},
 190                         {"default-config", 0x7d0000, 0x10000},
 191                         {"log", 0x7e0000, 0x10000},
 192                         {"radio", 0x7f0000, 0x10000},
 193                         {NULL, 0, 0}
 194                 },
 195
 196                 .first_sysupgrade_partition = "os-image",
 197                 .last_sysupgrade_partition = "support-list",
 198         },
 199
 200         /** Firmware layout for the CPE510/520 */
 201         {
 202                 .id     = "CPE510",
 203                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 204                 .support_list =
 205                         "SupportList:\r\n"
 206                         "CPE510(TP-LINK|UN|N300-5):1.0\r\n"
 207                         "CPE510(TP-LINK|UN|N300-5):1.1\r\n"
 208                         "CPE510(TP-LINK|UN|N300-5):1.1\r\n"
 209                         "CPE510(TP-LINK|US|N300-5):1.1\r\n"
 210                         "CPE510(TP-LINK|EU|N300-5):1.1\r\n"
 211                         "CPE520(TP-LINK|UN|N300-5):1.1\r\n"
 212                         "CPE520(TP-LINK|US|N300-5):1.1\r\n"
 213                         "CPE520(TP-LINK|EU|N300-5):1.1\r\n"
 214                         "CPE510(TP-LINK|EU|N300-5|00000000):2.0\r\n"
 215                         "CPE510(TP-LINK|EU|N300-5|45550000):2.0\r\n"
 216                         "CPE510(TP-LINK|EU|N300-5|55530000):2.0\r\n"
 217                         "CPE510(TP-LINK|UN|N300-5|00000000):2.0\r\n"
 218                         "CPE510(TP-LINK|UN|N300-5|45550000):2.0\r\n"
 219                         "CPE510(TP-LINK|UN|N300-5|55530000):2.0\r\n"
 220                         "CPE510(TP-LINK|US|N300-5|55530000):2.0\r\n"
 221                         "CPE510(TP-LINK|UN|N300-5):2.0\r\n"
 222                         "CPE510(TP-LINK|EU|N300-5):2.0\r\n"
 223                         "CPE510(TP-LINK|US|N300-5):2.0\r\n",
 224                 .support_trail = '\xff',
 225                 .soft_ver = NULL,
 226
 227                 .partitions = {
 228                         {"fs-uboot", 0x00000, 0x20000},
 229                         {"partition-table", 0x20000, 0x02000},
 230                         {"default-mac", 0x30000, 0x00020},
 231                         {"product-info", 0x31100, 0x00100},
 232                         {"signature", 0x32000, 0x00400},
 233                         {"os-image", 0x40000, 0x1c0000},
 234                         {"file-system", 0x200000, 0x5b0000},
 235                         {"soft-version", 0x7b0000, 0x00100},
 236                         {"support-list", 0x7b1000, 0x00400},
 237                         {"user-config", 0x7c0000, 0x10000},
 238                         {"default-config", 0x7d0000, 0x10000},
 239                         {"log", 0x7e0000, 0x10000},
 240                         {"radio", 0x7f0000, 0x10000},
 241                         {NULL, 0, 0}
 242                 },
 243
 244                 .first_sysupgrade_partition = "os-image",
 245                 .last_sysupgrade_partition = "support-list",
 246         },
 247
 248         {
 249                 .id     = "WBS210",
 250                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 251                 .support_list =
 252                         "SupportList:\r\n"
 253                         "WBS210(TP-LINK|UN|N300-2):1.20\r\n"
 254                         "WBS210(TP-LINK|US|N300-2):1.20\r\n"
 255                         "WBS210(TP-LINK|EU|N300-2):1.20\r\n",
 256                 .support_trail = '\xff',
 257                 .soft_ver = NULL,
 258
 259                 .partitions = {
 260                         {"fs-uboot", 0x00000, 0x20000},
 261                         {"partition-table", 0x20000, 0x02000},
 262                         {"default-mac", 0x30000, 0x00020},
 263                         {"product-info", 0x31100, 0x00100},
 264                         {"signature", 0x32000, 0x00400},
 265                         {"os-image", 0x40000, 0x1c0000},
 266                         {"file-system", 0x200000, 0x5b0000},
 267                         {"soft-version", 0x7b0000, 0x00100},
 268                         {"support-list", 0x7b1000, 0x00400},
 269                         {"user-config", 0x7c0000, 0x10000},
 270                         {"default-config", 0x7d0000, 0x10000},
 271                         {"log", 0x7e0000, 0x10000},
 272                         {"radio", 0x7f0000, 0x10000},
 273                         {NULL, 0, 0}
 274                 },
 275
 276                 .first_sysupgrade_partition = "os-image",
 277                 .last_sysupgrade_partition = "support-list",
 278         },
 279
 280         {
 281                 .id     = "WBS510",
 282                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 283                 .support_list =
 284                         "SupportList:\r\n"
 285                         "WBS510(TP-LINK|UN|N300-5):1.20\r\n"
 286                         "WBS510(TP-LINK|US|N300-5):1.20\r\n"
 287                         "WBS510(TP-LINK|EU|N300-5):1.20\r\n",
 288                 .support_trail = '\xff',
 289                 .soft_ver = NULL,
 290
 291                 .partitions = {
 292                         {"fs-uboot", 0x00000, 0x20000},
 293                         {"partition-table", 0x20000, 0x02000},
 294                         {"default-mac", 0x30000, 0x00020},
 295                         {"product-info", 0x31100, 0x00100},
 296                         {"signature", 0x32000, 0x00400},
 297                         {"os-image", 0x40000, 0x1c0000},
 298                         {"file-system", 0x200000, 0x5b0000},
 299                         {"soft-version", 0x7b0000, 0x00100},
 300                         {"support-list", 0x7b1000, 0x00400},
 301                         {"user-config", 0x7c0000, 0x10000},
 302                         {"default-config", 0x7d0000, 0x10000},
 303                         {"log", 0x7e0000, 0x10000},
 304                         {"radio", 0x7f0000, 0x10000},
 305                         {NULL, 0, 0}
 306                 },
 307
 308                 .first_sysupgrade_partition = "os-image",
 309                 .last_sysupgrade_partition = "support-list",
 310         },
 311
 312         /** Firmware layout for the C2600 */
 313         {
 314                 .id = "C2600",
 315                 .vendor = "",
 316                 .support_list =
 317                         "SupportList:\r\n"
 318                         "{product_name:Archer C2600,product_ver:1.0.0,special_id:00000000}\r\n",
 319                 .support_trail = '\x00',
 320                 .soft_ver = NULL,
 321
 322                 /**
 323                     We use a bigger os-image partition than the stock images (and thus
 324                     smaller file-system), as our kernel doesn't fit in the stock firmware's
 325                     2 MB os-image since kernel 4.14.
 326                 */
 327                 .partitions = {
 328                         {"SBL1", 0x00000, 0x20000},
 329                         {"MIBIB", 0x20000, 0x20000},
 330                         {"SBL2", 0x40000, 0x20000},
 331                         {"SBL3", 0x60000, 0x30000},
 332                         {"DDRCONFIG", 0x90000, 0x10000},
 333                         {"SSD", 0xa0000, 0x10000},
 334                         {"TZ", 0xb0000, 0x30000},
 335                         {"RPM", 0xe0000, 0x20000},
 336                         {"fs-uboot", 0x100000, 0x70000},
 337                         {"uboot-env", 0x170000, 0x40000},
 338                         {"radio", 0x1b0000, 0x40000},
 339                         {"os-image", 0x1f0000, 0x400000}, /* Stock: base 0x1f0000 size 0x200000 */
 340                         {"file-system", 0x5f0000, 0x1900000}, /* Stock: base 0x3f0000 size 0x1b00000 */
 341                         {"default-mac", 0x1ef0000, 0x00200},
 342                         {"pin", 0x1ef0200, 0x00200},
 343                         {"product-info", 0x1ef0400, 0x0fc00},
 344                         {"partition-table", 0x1f00000, 0x10000},
 345                         {"soft-version", 0x1f10000, 0x10000},
 346                         {"support-list", 0x1f20000, 0x10000},
 347                         {"profile", 0x1f30000, 0x10000},
 348                         {"default-config", 0x1f40000, 0x10000},
 349                         {"user-config", 0x1f50000, 0x40000},
 350                         {"qos-db", 0x1f90000, 0x40000},
 351                         {"usb-config", 0x1fd0000, 0x10000},
 352                         {"log", 0x1fe0000, 0x20000},
 353                         {NULL, 0, 0}
 354                 },
 355
 356                 .first_sysupgrade_partition = "os-image",
 357                 .last_sysupgrade_partition = "file-system"
 358         },
 359
 360         /** Firmware layout for the A7-V5 */
 361         {
 362                 .id = "ARCHER-A7-V5",
 363                 .support_list =
 364                         "SupportList:\n"
 365                         "{product_name:Archer A7,product_ver:5.0.0,special_id:45550000}\n"
 366                         "{product_name:Archer A7,product_ver:5.0.0,special_id:55530000}\n"
 367                         "{product_name:Archer A7,product_ver:5.0.0,special_id:43410000}\n"
 368                         "{product_name:Archer A7,product_ver:5.0.0,special_id:4A500000}\n"
 369                         "{product_name:Archer A7,product_ver:5.0.0,special_id:54570000}\n",
 370                 .support_trail = '\x00',
 371                 .soft_ver = "soft_ver:1.0.0\n",
 372
 373                 /* We're using a dynamic kernel/rootfs split here */
 374                 .partitions = {
 375                         {"factory-boot", 0x00000, 0x20000},
 376                         {"fs-uboot", 0x20000, 0x20000},
 377                         {"firmware", 0x40000, 0xec0000},        /* Stock: name os-image base 0x40000 size 0x120000 */
 378                                                                 /* Stock: name file-system base 0x160000 size 0xda0000 */
 379                         {"default-mac", 0xf40000, 0x00200},
 380                         {"pin", 0xf40200, 0x00200},
 381                         {"device-id", 0xf40400, 0x00100},
 382                         {"product-info", 0xf40500, 0x0fb00},
 383                         {"soft-version", 0xf50000, 0x00100},
 384                         {"extra-para", 0xf51000, 0x01000},
 385                         {"support-list", 0xf52000, 0x0a000},
 386                         {"profile", 0xf5c000, 0x04000},
 387                         {"default-config", 0xf60000, 0x10000},
 388                         {"user-config", 0xf70000, 0x40000},
 389                         {"certificate", 0xfb0000, 0x10000},
 390                         {"partition-table", 0xfc0000, 0x10000},
 391                         {"log", 0xfd0000, 0x20000},
 392                         {"radio", 0xff0000, 0x10000},
 393                         {NULL, 0, 0}
 394                 },
 395
 396                 .first_sysupgrade_partition = "os-image",
 397                 .last_sysupgrade_partition = "file-system",
 398         },
 399
 400         /** Firmware layout for the C25v1 */
 401         {
 402                 .id = "ARCHER-C25-V1",
 403                 .support_list =
 404                         "SupportList:\n"
 405                         "{product_name:ArcherC25,product_ver:1.0.0,special_id:00000000}\n"
 406                         "{product_name:ArcherC25,product_ver:1.0.0,special_id:55530000}\n"
 407                         "{product_name:ArcherC25,product_ver:1.0.0,special_id:45550000}\n",
 408                 .support_trail = '\x00',
 409                 .soft_ver = "soft_ver:1.0.0\n",
 410
 411                 /* We're using a dynamic kernel/rootfs split here */
 412                 .partitions = {
 413                         {"factory-boot", 0x00000, 0x20000},
 414                         {"fs-uboot", 0x20000, 0x10000},
 415                         {"firmware", 0x30000, 0x7a0000},        /* Stock: name os-image base 0x30000 size 0x100000 */
 416                                                                 /* Stock: name file-system base 0x130000 size 0x6a0000 */
 417                         {"user-config", 0x7d0000, 0x04000},
 418                         {"default-mac", 0x7e0000, 0x00100},
 419                         {"device-id", 0x7e0100, 0x00100},
 420                         {"extra-para", 0x7e0200, 0x00100},
 421                         {"pin", 0x7e0300, 0x00100},
 422                         {"support-list", 0x7e0400, 0x00400},
 423                         {"soft-version", 0x7e0800, 0x00400},
 424                         {"product-info", 0x7e0c00, 0x01400},
 425                         {"partition-table", 0x7e2000, 0x01000},
 426                         {"profile", 0x7e3000, 0x01000},
 427                         {"default-config", 0x7e4000, 0x04000},
 428                         {"merge-config", 0x7ec000, 0x02000},
 429                         {"qos-db", 0x7ee000, 0x02000},
 430                         {"radio", 0x7f0000, 0x10000},
 431                         {NULL, 0, 0}
 432                 },
 433
 434                 .first_sysupgrade_partition = "os-image",
 435                 .last_sysupgrade_partition = "file-system",
 436         },
 437
 438         /** Firmware layout for the C58v1 */
 439         {
 440                 .id     = "ARCHER-C58-V1",
 441                 .vendor = "",
 442                 .support_list =
 443                         "SupportList:\r\n"
 444                         "{product_name:Archer C58,product_ver:1.0.0,special_id:00000000}\r\n"
 445                         "{product_name:Archer C58,product_ver:1.0.0,special_id:45550000}\r\n"
 446                         "{product_name:Archer C58,product_ver:1.0.0,special_id:55530000}\r\n",
 447                 .support_trail = '\x00',
 448                 .soft_ver = "soft_ver:1.0.0\n",
 449
 450                 .partitions = {
 451                         {"fs-uboot", 0x00000, 0x10000},
 452                         {"default-mac", 0x10000, 0x00200},
 453                         {"pin", 0x10200, 0x00200},
 454                         {"product-info", 0x10400, 0x00100},
 455                         {"partition-table", 0x10500, 0x00800},
 456                         {"soft-version", 0x11300, 0x00200},
 457                         {"support-list", 0x11500, 0x00100},
 458                         {"device-id", 0x11600, 0x00100},
 459                         {"profile", 0x11700, 0x03900},
 460                         {"default-config", 0x15000, 0x04000},
 461                         {"user-config", 0x19000, 0x04000},
 462                         {"firmware", 0x20000, 0x7c8000},
 463                         {"certyficate", 0x7e8000, 0x08000},
 464                         {"radio", 0x7f0000, 0x10000},
 465                         {NULL, 0, 0}
 466                 },
 467
 468                 .first_sysupgrade_partition = "os-image",
 469                 .last_sysupgrade_partition = "file-system",
 470         },
 471
 472         /** Firmware layout for the C59v1 */
 473         {
 474                 .id     = "ARCHER-C59-V1",
 475                 .vendor = "",
 476                 .support_list =
 477                         "SupportList:\r\n"
 478                         "{product_name:Archer C59,product_ver:1.0.0,special_id:00000000}\r\n"
 479                         "{product_name:Archer C59,product_ver:1.0.0,special_id:45550000}\r\n"
 480                         "{product_name:Archer C59,product_ver:1.0.0,special_id:52550000}\r\n"
 481                         "{product_name:Archer C59,product_ver:1.0.0,special_id:55530000}\r\n",
 482                 .support_trail = '\x00',
 483                 .soft_ver = "soft_ver:1.0.0\n",
 484
 485                 /* We're using a dynamic kernel/rootfs split here */
 486                 .partitions = {
 487                         {"fs-uboot", 0x00000, 0x10000},
 488                         {"default-mac", 0x10000, 0x00200},
 489                         {"pin", 0x10200, 0x00200},
 490                         {"device-id", 0x10400, 0x00100},
 491                         {"product-info", 0x10500, 0x0fb00},
 492                         {"firmware", 0x20000, 0xe30000},
 493                         {"partition-table", 0xe50000, 0x10000},
 494                         {"soft-version", 0xe60000, 0x10000},
 495                         {"support-list", 0xe70000, 0x10000},
 496                         {"profile", 0xe80000, 0x10000},
 497                         {"default-config", 0xe90000, 0x10000},
 498                         {"user-config", 0xea0000, 0x40000},
 499                         {"usb-config", 0xee0000, 0x10000},
 500                         {"certificate", 0xef0000, 0x10000},
 501                         {"qos-db", 0xf00000, 0x40000},
 502                         {"log", 0xfe0000, 0x10000},
 503                         {"radio", 0xff0000, 0x10000},
 504                         {NULL, 0, 0}
 505                 },
 506
 507                 .first_sysupgrade_partition = "os-image",
 508                 .last_sysupgrade_partition = "file-system",
 509         },
 510
 511         /** Firmware layout for the C59v2 */
 512         {
 513                 .id     = "ARCHER-C59-V2",
 514                 .vendor = "",
 515                 .support_list =
 516                         "SupportList:\r\n"
 517                         "{product_name:Archer C59,product_ver:2.0.0,special_id:00000000}\r\n"
 518                         "{product_name:Archer C59,product_ver:2.0.0,special_id:45550000}\r\n"
 519                         "{product_name:Archer C59,product_ver:2.0.0,special_id:55530000}\r\n",
 520                 .support_trail = '\x00',
 521                 .soft_ver = "soft_ver:2.0.0 Build 20161206 rel.7303\n",
 522
 523                 /** We're using a dynamic kernel/rootfs split here */
 524                 .partitions = {
 525                         {"factory-boot", 0x00000, 0x20000},
 526                         {"fs-uboot", 0x20000, 0x10000},
 527                         {"default-mac", 0x30000, 0x00200},
 528                         {"pin", 0x30200, 0x00200},
 529                         {"device-id", 0x30400, 0x00100},
 530                         {"product-info", 0x30500, 0x0fb00},
 531                         {"firmware", 0x40000, 0xe10000},
 532                         {"partition-table", 0xe50000, 0x10000},
 533                         {"soft-version", 0xe60000, 0x10000},
 534                         {"support-list", 0xe70000, 0x10000},
 535                         {"profile", 0xe80000, 0x10000},
 536                         {"default-config", 0xe90000, 0x10000},
 537                         {"user-config", 0xea0000, 0x40000},
 538                         {"usb-config", 0xee0000, 0x10000},
 539                         {"certificate", 0xef0000, 0x10000},
 540                         {"extra-para", 0xf00000, 0x10000},
 541                         {"qos-db", 0xf10000, 0x30000},
 542                         {"log", 0xfe0000, 0x10000},
 543                         {"radio", 0xff0000, 0x10000},
 544                         {NULL, 0, 0}
 545                 },
 546
 547                 .first_sysupgrade_partition = "os-image",
 548                 .last_sysupgrade_partition = "file-system",
 549         },
 550
 551         /** Firmware layout for the C6v2 */
 552         {
 553                 .id     = "ARCHER-C6-V2",
 554                 .vendor = "",
 555                 .support_list =
 556                         "SupportList:\r\n"
 557                         "{product_name:Archer C6,product_ver:2.0.0,special_id:45550000}\r\n"
 558                         "{product_name:Archer C6,product_ver:2.0.0,special_id:52550000}\r\n"
 559                         "{product_name:Archer C6,product_ver:2.0.0,special_id:4A500000}\r\n",
 560                 .support_trail = '\x00',
 561                 .soft_ver = "soft_ver:1.0.0\n",
 562
 563                 .partitions = {
 564                         {"fs-uboot", 0x00000, 0x20000},
 565                         {"default-mac", 0x20000, 0x00200},
 566                         {"pin", 0x20200, 0x00100},
 567                         {"product-info", 0x20300, 0x00200},
 568                         {"device-id", 0x20500, 0x0fb00},
 569                         {"firmware", 0x30000, 0x7a9400},
 570                         {"soft-version", 0x7d9400, 0x00100},
 571                         {"extra-para", 0x7d9500, 0x00100},
 572                         {"support-list", 0x7d9600, 0x00200},
 573                         {"profile", 0x7d9800, 0x03000},
 574                         {"default-config", 0x7dc800, 0x03000},
 575                         {"partition-table", 0x7df800, 0x00800},
 576                         {"user-config", 0x7e0000, 0x0c000},
 577                         {"certificate", 0x7ec000, 0x04000},
 578                         {"radio", 0x7f0000, 0x10000},
 579                         {NULL, 0, 0}
 580                 },
 581
 582                 .first_sysupgrade_partition = "os-image",
 583                 .last_sysupgrade_partition = "file-system",
 584         },
 585
 586
 587         /** Firmware layout for the C60v1 */
 588         {
 589                 .id     = "ARCHER-C60-V1",
 590                 .vendor = "",
 591                 .support_list =
 592                         "SupportList:\r\n"
 593                         "{product_name:Archer C60,product_ver:1.0.0,special_id:00000000}\r\n"
 594                         "{product_name:Archer C60,product_ver:1.0.0,special_id:45550000}\r\n"
 595                         "{product_name:Archer C60,product_ver:1.0.0,special_id:55530000}\r\n",
 596                 .support_trail = '\x00',
 597                 .soft_ver = "soft_ver:1.0.0\n",
 598
 599                 .partitions = {
 600                         {"fs-uboot", 0x00000, 0x10000},
 601                         {"default-mac", 0x10000, 0x00200},
 602                         {"pin", 0x10200, 0x00200},
 603                         {"product-info", 0x10400, 0x00100},
 604                         {"partition-table", 0x10500, 0x00800},
 605                         {"soft-version", 0x11300, 0x00200},
 606                         {"support-list", 0x11500, 0x00100},
 607                         {"device-id", 0x11600, 0x00100},
 608                         {"profile", 0x11700, 0x03900},
 609                         {"default-config", 0x15000, 0x04000},
 610                         {"user-config", 0x19000, 0x04000},
 611                         {"firmware", 0x20000, 0x7c8000},
 612                         {"certyficate", 0x7e8000, 0x08000},
 613                         {"radio", 0x7f0000, 0x10000},
 614                         {NULL, 0, 0}
 615                 },
 616
 617                 .first_sysupgrade_partition = "os-image",
 618                 .last_sysupgrade_partition = "file-system",
 619         },
 620
 621         /** Firmware layout for the C60v2 */
 622         {
 623                 .id     = "ARCHER-C60-V2",
 624                 .vendor = "",
 625                 .support_list =
 626                         "SupportList:\r\n"
 627                         "{product_name:Archer C60,product_ver:2.0.0,special_id:42520000}\r\n"
 628                         "{product_name:Archer C60,product_ver:2.0.0,special_id:45550000}\r\n"
 629                         "{product_name:Archer C60,product_ver:2.0.0,special_id:55530000}\r\n",
 630                 .support_trail = '\x00',
 631                 .soft_ver = "soft_ver:2.0.0\n",
 632
 633                 .partitions = {
 634                         {"factory-boot", 0x00000, 0x1fb00},
 635                         {"default-mac", 0x1fb00, 0x00200},
 636                         {"pin", 0x1fd00, 0x00100},
 637                         {"product-info", 0x1fe00, 0x00100},
 638                         {"device-id", 0x1ff00, 0x00100},
 639                         {"fs-uboot", 0x20000, 0x10000},
 640                         {"firmware", 0x30000, 0x7a0000},
 641                         {"soft-version", 0x7d9500, 0x00100},
 642                         {"support-list", 0x7d9600, 0x00100},
 643                         {"extra-para", 0x7d9700, 0x00100},
 644                         {"profile", 0x7d9800, 0x03000},
 645                         {"default-config", 0x7dc800, 0x03000},
 646                         {"partition-table", 0x7df800, 0x00800},
 647                         {"user-config", 0x7e0000, 0x0c000},
 648                         {"certificate", 0x7ec000, 0x04000},
 649                         {"radio", 0x7f0000, 0x10000},
 650                         {NULL, 0, 0}
 651                 },
 652
 653                 .first_sysupgrade_partition = "os-image",
 654                 .last_sysupgrade_partition = "file-system",
 655         },
 656
 657         /** Firmware layout for the C5 */
 658         {
 659                 .id = "ARCHER-C5-V2",
 660                 .vendor = "",
 661                 .support_list =
 662                         "SupportList:\r\n"
 663                         "{product_name:ArcherC5,product_ver:2.0.0,special_id:00000000}\r\n"
 664                         "{product_name:ArcherC5,product_ver:2.0.0,special_id:55530000}\r\n"
 665                         "{product_name:ArcherC5,product_ver:2.0.0,special_id:4A500000}\r\n", /* JP version */
 666                 .support_trail = '\x00',
 667                 .soft_ver = NULL,
 668
 669                 .partitions = {
 670                         {"fs-uboot", 0x00000, 0x40000},
 671                         {"os-image", 0x40000, 0x200000},
 672                         {"file-system", 0x240000, 0xc00000},
 673                         {"default-mac", 0xe40000, 0x00200},
 674                         {"pin", 0xe40200, 0x00200},
 675                         {"product-info", 0xe40400, 0x00200},
 676                         {"partition-table", 0xe50000, 0x10000},
 677                         {"soft-version", 0xe60000, 0x00200},
 678                         {"support-list", 0xe61000, 0x0f000},
 679                         {"profile", 0xe70000, 0x10000},
 680                         {"default-config", 0xe80000, 0x10000},
 681                         {"user-config", 0xe90000, 0x50000},
 682                         {"log", 0xee0000, 0x100000},
 683                         {"radio_bk", 0xfe0000, 0x10000},
 684                         {"radio", 0xff0000, 0x10000},
 685                         {NULL, 0, 0}
 686                 },
 687
 688                 .first_sysupgrade_partition = "os-image",
 689                 .last_sysupgrade_partition = "file-system"
 690         },
 691
 692         /** Firmware layout for the C7 */
 693         {
 694                 .id = "ARCHER-C7-V4",
 695                 .support_list =
 696                         "SupportList:\n"
 697                         "{product_name:Archer C7,product_ver:4.0.0,special_id:00000000}\n"
 698                         "{product_name:Archer C7,product_ver:4.0.0,special_id:41550000}\n"
 699                         "{product_name:Archer C7,product_ver:4.0.0,special_id:45550000}\n"
 700                         "{product_name:Archer C7,product_ver:4.0.0,special_id:4B520000}\n"
 701                         "{product_name:Archer C7,product_ver:4.0.0,special_id:42520000}\n"
 702                         "{product_name:Archer C7,product_ver:4.0.0,special_id:4A500000}\n"
 703                         "{product_name:Archer C7,product_ver:4.0.0,special_id:52550000}\n"
 704                         "{product_name:Archer C7,product_ver:4.0.0,special_id:54570000}\n"
 705                         "{product_name:Archer C7,product_ver:4.0.0,special_id:55530000}\n"
 706                         "{product_name:Archer C7,product_ver:4.0.0,special_id:43410000}\n",
 707                 .support_trail = '\x00',
 708                 .soft_ver = "soft_ver:1.0.0\n",
 709
 710                 /* We're using a dynamic kernel/rootfs split here */
 711                 .partitions = {
 712                         {"factory-boot", 0x00000, 0x20000},
 713                         {"fs-uboot", 0x20000, 0x20000},
 714                         {"firmware", 0x40000, 0xEC0000},        /* Stock: name os-image base 0x40000 size 0x120000 */
 715                                                                 /* Stock: name file-system base 0x160000 size 0xda0000 */
 716                         {"default-mac", 0xf00000, 0x00200},
 717                         {"pin", 0xf00200, 0x00200},
 718                         {"device-id", 0xf00400, 0x00100},
 719                         {"product-info", 0xf00500, 0x0fb00},
 720                         {"soft-version", 0xf10000, 0x00100},
 721                         {"extra-para", 0xf11000, 0x01000},
 722                         {"support-list", 0xf12000, 0x0a000},
 723                         {"profile", 0xf1c000, 0x04000},
 724                         {"default-config", 0xf20000, 0x10000},
 725                         {"user-config", 0xf30000, 0x40000},
 726                         {"qos-db", 0xf70000, 0x40000},
 727                         {"certificate", 0xfb0000, 0x10000},
 728                         {"partition-table", 0xfc0000, 0x10000},
 729                         {"log", 0xfd0000, 0x20000},
 730                         {"radio", 0xff0000, 0x10000},
 731                         {NULL, 0, 0}
 732                 },
 733
 734                 .first_sysupgrade_partition = "os-image",
 735                 .last_sysupgrade_partition = "file-system",
 736         },
 737
 738         /** Firmware layout for the C7 v5*/
 739         {
 740                 .id = "ARCHER-C7-V5",
 741                 .support_list =
 742                         "SupportList:\n"
 743                         "{product_name:Archer C7,product_ver:5.0.0,special_id:00000000}\n"
 744                         "{product_name:Archer C7,product_ver:5.0.0,special_id:45550000}\n"
 745                         "{product_name:Archer C7,product_ver:5.0.0,special_id:55530000}\n"
 746                         "{product_name:Archer C7,product_ver:5.0.0,special_id:43410000}\n"
 747                         "{product_name:Archer C7,product_ver:5.0.0,special_id:4A500000}\n"
 748                         "{product_name:Archer C7,product_ver:5.0.0,special_id:54570000}\n"
 749                         "{product_name:Archer C7,product_ver:5.0.0,special_id:52550000}\n",
 750
 751                 .support_trail = '\x00',
 752                 .soft_ver = "soft_ver:1.0.0\n",
 753
 754                 /* We're using a dynamic kernel/rootfs split here */
 755                 .partitions = {
 756                         {"factory-boot",    0x00000,  0x20000},
 757                         {"fs-uboot",        0x20000,  0x20000},
 758                         {"partition-table", 0x40000,  0x10000},
 759                         {"radio",           0x50000,  0x10000},
 760                         {"default-mac",     0x60000,  0x00200},
 761                         {"pin",             0x60200,  0x00200},
 762                         {"device-id",       0x60400,  0x00100},
 763                         {"product-info",    0x60500,  0x0fb00},
 764                         {"soft-version",    0x70000,  0x01000},
 765                         {"extra-para",      0x71000,  0x01000},
 766                         {"support-list",    0x72000,  0x0a000},
 767                         {"profile",         0x7c000,  0x04000},
 768                         {"user-config",     0x80000,  0x40000},
 769
 770
 771                         {"firmware",        0xc0000,  0xf00000},        /* Stock: name os-image base 0xc0000  size 0x120000 */
 772                                                                         /* Stock: name file-system base 0x1e0000 size 0xde0000 */
 773
 774                         {"log",             0xfc0000, 0x20000},
 775                         {"certificate",     0xfe0000, 0x10000},
 776                         {"default-config",  0xff0000, 0x10000},
 777                         {NULL, 0, 0}
 778
 779                 },
 780
 781                 .first_sysupgrade_partition = "os-image",
 782                 .last_sysupgrade_partition = "file-system",
 783         },
 784
 785         /** Firmware layout for the C9 */
 786         {
 787                 .id = "ARCHERC9",
 788                 .vendor = "",
 789                 .support_list =
 790                         "SupportList:\n"
 791                         "{product_name:ArcherC9,"
 792                         "product_ver:1.0.0,"
 793                         "special_id:00000000}\n",
 794                 .support_trail = '\x00',
 795                 .soft_ver = NULL,
 796
 797                 .partitions = {
 798                         {"fs-uboot", 0x00000, 0x40000},
 799                         {"os-image", 0x40000, 0x200000},
 800                         {"file-system", 0x240000, 0xc00000},
 801                         {"default-mac", 0xe40000, 0x00200},
 802                         {"pin", 0xe40200, 0x00200},
 803                         {"product-info", 0xe40400, 0x00200},
 804                         {"partition-table", 0xe50000, 0x10000},
 805                         {"soft-version", 0xe60000, 0x00200},
 806                         {"support-list", 0xe61000, 0x0f000},
 807                         {"profile", 0xe70000, 0x10000},
 808                         {"default-config", 0xe80000, 0x10000},
 809                         {"user-config", 0xe90000, 0x50000},
 810                         {"log", 0xee0000, 0x100000},
 811                         {"radio_bk", 0xfe0000, 0x10000},
 812                         {"radio", 0xff0000, 0x10000},
 813                         {NULL, 0, 0}
 814                 },
 815
 816                 .first_sysupgrade_partition = "os-image",
 817                 .last_sysupgrade_partition = "file-system"
 818         },
 819
 820         /** Firmware layout for the EAP120 */
 821         {
 822                 .id     = "EAP120",
 823                 .vendor = "EAP120(TP-LINK|UN|N300-2):1.0\r\n",
 824                 .support_list =
 825                         "SupportList:\r\n"
 826                         "EAP120(TP-LINK|UN|N300-2):1.0\r\n",
 827                 .support_trail = '\xff',
 828                 .soft_ver = NULL,
 829
 830                 .partitions = {
 831                         {"fs-uboot", 0x00000, 0x20000},
 832                         {"partition-table", 0x20000, 0x02000},
 833                         {"default-mac", 0x30000, 0x00020},
 834                         {"support-list", 0x31000, 0x00100},
 835                         {"product-info", 0x31100, 0x00100},
 836                         {"soft-version", 0x32000, 0x00100},
 837                         {"os-image", 0x40000, 0x180000},
 838                         {"file-system", 0x1c0000, 0x600000},
 839                         {"user-config", 0x7c0000, 0x10000},
 840                         {"backup-config", 0x7d0000, 0x10000},
 841                         {"log", 0x7e0000, 0x10000},
 842                         {"radio", 0x7f0000, 0x10000},
 843                         {NULL, 0, 0}
 844                 },
 845
 846                 .first_sysupgrade_partition = "os-image",
 847                 .last_sysupgrade_partition = "file-system"
 848         },
 849
 850         /** Firmware layout for the TL-WA850RE v2 */
 851         {
 852                 .id     = "TLWA850REV2",
 853                 .vendor = "",
 854                 .support_list =
 855                         "SupportList:\n"
 856                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:55530000}\n"
 857                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:00000000}\n"
 858                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:55534100}\n"
 859                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:45550000}\n"
 860                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:4B520000}\n"
 861                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:42520000}\n"
 862                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:4A500000}\n"
 863                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:43410000}\n"
 864                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:41550000}\n"
 865                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:52550000}\n",
 866                 .support_trail = '\x00',
 867                 .soft_ver = NULL,
 868
 869                 /**
 870                    576KB were moved from file-system to os-image
 871                    in comparison to the stock image
 872                 */
 873                 .partitions = {
 874                         {"fs-uboot", 0x00000, 0x20000},
 875                         {"os-image", 0x20000, 0x150000},
 876                         {"file-system", 0x170000, 0x240000},
 877                         {"partition-table", 0x3b0000, 0x02000},
 878                         {"default-mac", 0x3c0000, 0x00020},
 879                         {"pin", 0x3c0100, 0x00020},
 880                         {"product-info", 0x3c1000, 0x01000},
 881                         {"soft-version", 0x3c2000, 0x00100},
 882                         {"support-list", 0x3c3000, 0x01000},
 883                         {"profile", 0x3c4000, 0x08000},
 884                         {"user-config", 0x3d0000, 0x10000},
 885                         {"default-config", 0x3e0000, 0x10000},
 886                         {"radio", 0x3f0000, 0x10000},
 887                         {NULL, 0, 0}
 888                 },
 889
 890                 .first_sysupgrade_partition = "os-image",
 891                 .last_sysupgrade_partition = "file-system"
 892         },
 893
 894         /** Firmware layout for the TL-WA855RE v1 */
 895         {
 896                 .id     = "TLWA855REV1",
 897                 .vendor = "",
 898                 .support_list =
 899                         "SupportList:\n"
 900                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:00000000}\n"
 901                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:55530000}\n"
 902                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:45550000}\n"
 903                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:4B520000}\n"
 904                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:42520000}\n"
 905                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:4A500000}\n"
 906                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:43410000}\n"
 907                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:41550000}\n"
 908                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:52550000}\n",
 909                 .support_trail = '\x00',
 910                 .soft_ver = NULL,
 911
 912                 .partitions = {
 913                         {"fs-uboot", 0x00000, 0x20000},
 914                         {"os-image", 0x20000, 0x150000},
 915                         {"file-system", 0x170000, 0x240000},
 916                         {"partition-table", 0x3b0000, 0x02000},
 917                         {"default-mac", 0x3c0000, 0x00020},
 918                         {"pin", 0x3c0100, 0x00020},
 919                         {"product-info", 0x3c1000, 0x01000},
 920                         {"soft-version", 0x3c2000, 0x00100},
 921                         {"support-list", 0x3c3000, 0x01000},
 922                         {"profile", 0x3c4000, 0x08000},
 923                         {"user-config", 0x3d0000, 0x10000},
 924                         {"default-config", 0x3e0000, 0x10000},
 925                         {"radio", 0x3f0000, 0x10000},
 926                         {NULL, 0, 0}
 927                 },
 928
 929                 .first_sysupgrade_partition = "os-image",
 930                 .last_sysupgrade_partition = "file-system"
 931         },
 932
 933         /** Firmware layout for the TL-WR1043 v5 */
 934         {
 935                 .id     = "TLWR1043NV5",
 936                 .vendor = "",
 937                 .support_list =
 938                         "SupportList:\n"
 939                         "{product_name:TL-WR1043N,product_ver:5.0.0,special_id:45550000}\n"
 940                         "{product_name:TL-WR1043N,product_ver:5.0.0,special_id:55530000}\n",
 941                 .support_trail = '\x00',
 942                 .soft_ver = "soft_ver:1.0.0\n",
 943                 .partitions = {
 944                         {"factory-boot", 0x00000, 0x20000},
 945                         {"fs-uboot", 0x20000, 0x20000},
 946                         {"firmware", 0x40000, 0xec0000},
 947                         {"default-mac", 0xf00000, 0x00200},
 948                         {"pin", 0xf00200, 0x00200},
 949                         {"device-id", 0xf00400, 0x00100},
 950                         {"product-info", 0xf00500, 0x0fb00},
 951                         {"soft-version", 0xf10000, 0x01000},
 952                         {"extra-para", 0xf11000, 0x01000},
 953                         {"support-list", 0xf12000, 0x0a000},
 954                         {"profile", 0xf1c000, 0x04000},
 955                         {"default-config", 0xf20000, 0x10000},
 956                         {"user-config", 0xf30000, 0x40000},
 957                         {"qos-db", 0xf70000, 0x40000},
 958                         {"certificate", 0xfb0000, 0x10000},
 959                         {"partition-table", 0xfc0000, 0x10000},
 960                         {"log", 0xfd0000, 0x20000},
 961                         {"radio", 0xff0000, 0x10000},
 962                         {NULL, 0, 0}
 963                 },
 964                 .first_sysupgrade_partition = "os-image",
 965                 .last_sysupgrade_partition = "file-system"
 966         },
 967
 968         /** Firmware layout for the TL-WR1043 v4 */
 969         {
 970                 .id     = "TLWR1043NDV4",
 971                 .vendor = "",
 972                 .support_list =
 973                         "SupportList:\n"
 974                         "{product_name:TL-WR1043ND,product_ver:4.0.0,special_id:45550000}\n",
 975                 .support_trail = '\x00',
 976                 .soft_ver = NULL,
 977
 978                 /* We're using a dynamic kernel/rootfs split here */
 979                 .partitions = {
 980                         {"fs-uboot", 0x00000, 0x20000},
 981                         {"firmware", 0x20000, 0xf30000},
 982                         {"default-mac", 0xf50000, 0x00200},
 983                         {"pin", 0xf50200, 0x00200},
 984                         {"product-info", 0xf50400, 0x0fc00},
 985                         {"soft-version", 0xf60000, 0x0b000},
 986                         {"support-list", 0xf6b000, 0x04000},
 987                         {"profile", 0xf70000, 0x04000},
 988                         {"default-config", 0xf74000, 0x0b000},
 989                         {"user-config", 0xf80000, 0x40000},
 990                         {"partition-table", 0xfc0000, 0x10000},
 991                         {"log", 0xfd0000, 0x20000},
 992                         {"radio", 0xff0000, 0x10000},
 993                         {NULL, 0, 0}
 994                 },
 995
 996                 .first_sysupgrade_partition = "os-image",
 997                 .last_sysupgrade_partition = "file-system"
 998         },
 999
1000         /** Firmware layout for the TL-WR902AC v1 */
1001         {
1002                 .id     = "TL-WR902AC-V1",
1003                 .vendor = "",
1004                 .support_list =
1005                         "SupportList:\n"
1006                         "{product_name:TL-WR902AC,product_ver:1.0.0,special_id:45550000}\n"
1007                         "{product_name:TL-WR902AC,product_ver:1.0.0,special_id:55530000}\n",
1008                 .support_trail = '\x00',
1009                 .soft_ver = NULL,
1010
1011                 /**
1012                    384KB were moved from file-system to os-image
1013                    in comparison to the stock image
1014                 */
1015                 .partitions = {
1016                         {"fs-uboot", 0x00000, 0x20000},
1017                         {"firmware", 0x20000, 0x730000},
1018                         {"default-mac", 0x750000, 0x00200},
1019                         {"pin", 0x750200, 0x00200},
1020                         {"product-info", 0x750400, 0x0fc00},
1021                         {"soft-version", 0x760000, 0x0b000},
1022                         {"support-list", 0x76b000, 0x04000},
1023                         {"profile", 0x770000, 0x04000},
1024                         {"default-config", 0x774000, 0x0b000},
1025                         {"user-config", 0x780000, 0x40000},
1026                         {"partition-table", 0x7c0000, 0x10000},
1027                         {"log", 0x7d0000, 0x20000},
1028                         {"radio", 0x7f0000, 0x10000},
1029                         {NULL, 0, 0}
1030                 },
1031
1032                 .first_sysupgrade_partition = "os-image",
1033                 .last_sysupgrade_partition = "file-system",
1034         },
1035
1036         /** Firmware layout for the TL-WR942N V1 */
1037         {
1038                 .id     = "TLWR942NV1",
1039                 .vendor = "",
1040                 .support_list =
1041                         "SupportList:\r\n"
1042                         "{product_name:TL-WR942N,product_ver:1.0.0,special_id:00000000}\r\n"
1043                         "{product_name:TL-WR942N,product_ver:1.0.0,special_id:52550000}\r\n",
1044                 .support_trail = '\x00',
1045                 .soft_ver = NULL,
1046
1047                 .partitions = {
1048                         {"fs-uboot", 0x00000, 0x20000},
1049                         {"firmware", 0x20000, 0xe20000},
1050                         {"default-mac", 0xe40000, 0x00200},
1051                         {"pin", 0xe40200, 0x00200},
1052                         {"product-info", 0xe40400, 0x0fc00},
1053                         {"partition-table", 0xe50000, 0x10000},
1054                         {"soft-version", 0xe60000, 0x10000},
1055                         {"support-list", 0xe70000, 0x10000},
1056                         {"profile", 0xe80000, 0x10000},
1057                         {"default-config", 0xe90000, 0x10000},
1058                         {"user-config", 0xea0000, 0x40000},
1059                         {"qos-db", 0xee0000, 0x40000},
1060                         {"certificate", 0xf20000, 0x10000},
1061                         {"usb-config", 0xfb0000, 0x10000},
1062                         {"log", 0xfc0000, 0x20000},
1063                         {"radio-bk", 0xfe0000, 0x10000},
1064                         {"radio", 0xff0000, 0x10000},
1065                         {NULL, 0, 0}
1066                 },
1067
1068                 .first_sysupgrade_partition = "os-image",
1069                 .last_sysupgrade_partition = "file-system",
1070         },
1071
1072         /** Firmware layout for the RE350 v1 */
1073         {
1074                 .id = "RE350-V1",
1075                 .vendor = "",
1076                 .support_list =
1077                         "SupportList:\n"
1078                         "{product_name:RE350,product_ver:1.0.0,special_id:45550000}\n"
1079                         "{product_name:RE350,product_ver:1.0.0,special_id:00000000}\n"
1080                         "{product_name:RE350,product_ver:1.0.0,special_id:41550000}\n"
1081                         "{product_name:RE350,product_ver:1.0.0,special_id:55530000}\n"
1082                         "{product_name:RE350,product_ver:1.0.0,special_id:43410000}\n"
1083                         "{product_name:RE350,product_ver:1.0.0,special_id:4b520000}\n"
1084                         "{product_name:RE350,product_ver:1.0.0,special_id:4a500000}\n",
1085                 .support_trail = '\x00',
1086                 .soft_ver = NULL,
1087
1088                 /** We're using a dynamic kernel/rootfs split here */
1089                 .partitions = {
1090                         {"fs-uboot", 0x00000, 0x20000},
1091                         {"firmware", 0x20000, 0x5e0000},
1092                         {"partition-table", 0x600000, 0x02000},
1093                         {"default-mac", 0x610000, 0x00020},
1094                         {"pin", 0x610100, 0x00020},
1095                         {"product-info", 0x611100, 0x01000},
1096                         {"soft-version", 0x620000, 0x01000},
1097                         {"support-list", 0x621000, 0x01000},
1098                         {"profile", 0x622000, 0x08000},
1099                         {"user-config", 0x630000, 0x10000},
1100                         {"default-config", 0x640000, 0x10000},
1101                         {"radio", 0x7f0000, 0x10000},
1102                         {NULL, 0, 0}
1103                 },
1104
1105                 .first_sysupgrade_partition = "os-image",
1106                 .last_sysupgrade_partition = "file-system"
1107         },
1108
1109         /** Firmware layout for the RE355 */
1110         {
1111                 .id = "RE355",
1112                 .vendor = "",
1113                 .support_list =
1114                         "SupportList:\r\n"
1115                         "{product_name:RE355,product_ver:1.0.0,special_id:00000000}\r\n"
1116                         "{product_name:RE355,product_ver:1.0.0,special_id:55530000}\r\n"
1117                         "{product_name:RE355,product_ver:1.0.0,special_id:45550000}\r\n"
1118                         "{product_name:RE355,product_ver:1.0.0,special_id:4A500000}\r\n"
1119                         "{product_name:RE355,product_ver:1.0.0,special_id:43410000}\r\n"
1120                         "{product_name:RE355,product_ver:1.0.0,special_id:41550000}\r\n"
1121                         "{product_name:RE355,product_ver:1.0.0,special_id:4B520000}\r\n"
1122                         "{product_name:RE355,product_ver:1.0.0,special_id:55534100}\r\n",
1123                 .support_trail = '\x00',
1124                 .soft_ver = NULL,
1125
1126                 /* We're using a dynamic kernel/rootfs split here */
1127                 .partitions = {
1128                         {"fs-uboot", 0x00000, 0x20000},
1129                         {"firmware", 0x20000, 0x5e0000},
1130                         {"partition-table", 0x600000, 0x02000},
1131                         {"default-mac", 0x610000, 0x00020},
1132                         {"pin", 0x610100, 0x00020},
1133                         {"product-info", 0x611100, 0x01000},
1134                         {"soft-version", 0x620000, 0x01000},
1135                         {"support-list", 0x621000, 0x01000},
1136                         {"profile", 0x622000, 0x08000},
1137                         {"user-config", 0x630000, 0x10000},
1138                         {"default-config", 0x640000, 0x10000},
1139                         {"radio", 0x7f0000, 0x10000},
1140                         {NULL, 0, 0}
1141                 },
1142
1143                 .first_sysupgrade_partition = "os-image",
1144                 .last_sysupgrade_partition = "file-system"
1145         },
1146
1147         /** Firmware layout for the RE450 */
1148         {
1149                 .id = "RE450",
1150                 .vendor = "",
1151                 .support_list =
1152                         "SupportList:\r\n"
1153                         "{product_name:RE450,product_ver:1.0.0,special_id:00000000}\r\n"
1154                         "{product_name:RE450,product_ver:1.0.0,special_id:55530000}\r\n"
1155                         "{product_name:RE450,product_ver:1.0.0,special_id:45550000}\r\n"
1156                         "{product_name:RE450,product_ver:1.0.0,special_id:4A500000}\r\n"
1157                         "{product_name:RE450,product_ver:1.0.0,special_id:43410000}\r\n"
1158                         "{product_name:RE450,product_ver:1.0.0,special_id:41550000}\r\n"
1159                         "{product_name:RE450,product_ver:1.0.0,special_id:4B520000}\r\n"
1160                         "{product_name:RE450,product_ver:1.0.0,special_id:55534100}\r\n",
1161                 .support_trail = '\x00',
1162                 .soft_ver = NULL,
1163
1164                 /** We're using a dynamic kernel/rootfs split here */
1165                 .partitions = {
1166                         {"fs-uboot", 0x00000, 0x20000},
1167                         {"firmware", 0x20000, 0x5e0000},
1168                         {"partition-table", 0x600000, 0x02000},
1169                         {"default-mac", 0x610000, 0x00020},
1170                         {"pin", 0x610100, 0x00020},
1171                         {"product-info", 0x611100, 0x01000},
1172                         {"soft-version", 0x620000, 0x01000},
1173                         {"support-list", 0x621000, 0x01000},
1174                         {"profile", 0x622000, 0x08000},
1175                         {"user-config", 0x630000, 0x10000},
1176                         {"default-config", 0x640000, 0x10000},
1177                         {"radio", 0x7f0000, 0x10000},
1178                         {NULL, 0, 0}
1179                 },
1180
1181                 .first_sysupgrade_partition = "os-image",
1182                 .last_sysupgrade_partition = "file-system"
1183         },
1184
1185         /** Firmware layout for the RE450 v2 */
1186         {
1187                 .id = "RE450-V2",
1188                 .vendor = "",
1189                 .support_list =
1190                         "SupportList:\r\n"
1191                         "{product_name:RE450,product_ver:2.0.0,special_id:00000000}\r\n"
1192                         "{product_name:RE450,product_ver:2.0.0,special_id:55530000}\r\n"
1193                         "{product_name:RE450,product_ver:2.0.0,special_id:45550000}\r\n"
1194                         "{product_name:RE450,product_ver:2.0.0,special_id:4A500000}\r\n"
1195                         "{product_name:RE450,product_ver:2.0.0,special_id:43410000}\r\n"
1196                         "{product_name:RE450,product_ver:2.0.0,special_id:41550000}\r\n"
1197                         "{product_name:RE450,product_ver:2.0.0,special_id:41530000}\r\n"
1198                         "{product_name:RE450,product_ver:2.0.0,special_id:4B520000}\r\n"
1199                         "{product_name:RE450,product_ver:2.0.0,special_id:42520000}\r\n",
1200                 .support_trail = '\x00',
1201                 .soft_ver = NULL,
1202
1203                 /* We're using a dynamic kernel/rootfs split here */
1204                 .partitions = {
1205                         {"fs-uboot", 0x00000, 0x20000},
1206                         {"firmware", 0x20000, 0x5e0000},
1207                         {"partition-table", 0x600000, 0x02000},
1208                         {"default-mac", 0x610000, 0x00020},
1209                         {"pin", 0x610100, 0x00020},
1210                         {"product-info", 0x611100, 0x01000},
1211                         {"soft-version", 0x620000, 0x01000},
1212                         {"support-list", 0x621000, 0x01000},
1213                         {"profile", 0x622000, 0x08000},
1214                         {"user-config", 0x630000, 0x10000},
1215                         {"default-config", 0x640000, 0x10000},
1216                         {"radio", 0x7f0000, 0x10000},
1217
1218                         {NULL, 0, 0}
1219                 },
1220
1221                 .first_sysupgrade_partition = "os-image",
1222                 .last_sysupgrade_partition = "file-system"
1223         },
1224
1225         {}
1226 };
1227
1228 #define error(_ret, _errno, _str, ...)                          \
1229         do {                                                    \
1230                 fprintf(stderr, _str ": %s\n", ## __VA_ARGS__,  \
1231                         strerror(_errno));                      \
1232                 if (_ret)                                       \
1233                         exit(_ret);                             \
1234         } while (0)
1235
1236
1237 /** Stores a uint32 as big endian */
1238 static inline void put32(uint8_t *buf, uint32_t val) {
1239         buf[0] = val >> 24;
1240         buf[1] = val >> 16;
1241         buf[2] = val >> 8;
1242         buf[3] = val;
1243 }
1244
1245 /** Allocates a new image partition */
1246 static struct image_partition_entry alloc_image_partition(const char *name, size_t len) {
1247         struct image_partition_entry entry = {name, len, malloc(len)};
1248         if (!entry.data)
1249                 error(1, errno, "malloc");
1250
1251         return entry;
1252 }
1253
1254 /** Frees an image partition */
1255 static void free_image_partition(struct image_partition_entry entry) {
1256         free(entry.data);
1257 }
1258
1259 static time_t source_date_epoch = -1;
1260 static void set_source_date_epoch() {
1261         char *env = getenv("SOURCE_DATE_EPOCH");
1262         char *endptr = env;
1263         errno = 0;
1264         if (env && *env) {
1265                 source_date_epoch = strtoull(env, &endptr, 10);
1266                 if (errno || (endptr && *endptr != '\0')) {
1267                         fprintf(stderr, "Invalid SOURCE_DATE_EPOCH");
1268                         exit(1);
1269                 }
1270         }
1271 }
1272
1273 /** Generates the partition-table partition */
1274 static struct image_partition_entry make_partition_table(const struct flash_partition_entry *p) {
1275         struct image_partition_entry entry = alloc_image_partition("partition-table", 0x800);
1276
1277         char *s = (char *)entry.data, *end = (char *)(s+entry.size);
1278
1279         *(s++) = 0x00;
1280         *(s++) = 0x04;
1281         *(s++) = 0x00;
1282         *(s++) = 0x00;
1283
1284         size_t i;
1285         for (i = 0; p[i].name; i++) {
1286                 size_t len = end-s;
1287                 size_t w = snprintf(s, len, "partition %s base 0x%05x size 0x%05x\n", p[i].name, p[i].base, p[i].size);
1288
1289                 if (w > len-1)
1290                         error(1, 0, "flash partition table overflow?");
1291
1292                 s += w;
1293         }
1294
1295         s++;
1296
1297         memset(s, 0xff, end-s);
1298
1299         return entry;
1300 }
1301
1302
1303 /** Generates a binary-coded decimal representation of an integer in the range [0, 99] */
1304 static inline uint8_t bcd(uint8_t v) {
1305         return 0x10 * (v/10) + v%10;
1306 }
1307
1308
1309 /** Generates the soft-version partition */
1310 static struct image_partition_entry make_soft_version(uint32_t rev) {
1311         struct image_partition_entry entry = alloc_image_partition("soft-version", sizeof(struct soft_version));
1312         struct soft_version *s = (struct soft_version *)entry.data;
1313
1314         time_t t;
1315
1316         if (source_date_epoch != -1)
1317                 t = source_date_epoch;
1318         else if (time(&t) == (time_t)(-1))
1319                 error(1, errno, "time");
1320
1321         struct tm *tm = localtime(&t);
1322
1323         s->magic = htonl(0x0000000c);
1324         s->zero = 0;
1325         s->pad1 = 0xff;
1326
1327         s->version_major = 0;
1328         s->version_minor = 0;
1329         s->version_patch = 0;
1330
1331         s->year_hi = bcd((1900+tm->tm_year)/100);
1332         s->year_lo = bcd(tm->tm_year%100);
1333         s->month = bcd(tm->tm_mon+1);
1334         s->day = bcd(tm->tm_mday);
1335         s->rev = htonl(rev);
1336
1337         s->pad2 = 0xff;
1338
1339         return entry;
1340 }
1341
1342 static struct image_partition_entry make_soft_version_from_string(const char *soft_ver) {
1343         /** String length _including_ the terminating zero byte */
1344         uint32_t ver_len = strlen(soft_ver) + 1;
1345         /** Partition contains 64 bit header, the version string, and one additional null byte */
1346         size_t partition_len = 2*sizeof(uint32_t) + ver_len + 1;
1347         struct image_partition_entry entry = alloc_image_partition("soft-version", partition_len);
1348
1349         uint32_t *len = (uint32_t *)entry.data;
1350         len[0] = htonl(ver_len);
1351         len[1] = 0;
1352         memcpy(&len[2], soft_ver, ver_len);
1353
1354         entry.data[partition_len - 1] = 0;
1355
1356         return entry;
1357 }
1358
1359 /** Generates the support-list partition */
1360 static struct image_partition_entry make_support_list(struct device_info *info) {
1361         size_t len = strlen(info->support_list);
1362         struct image_partition_entry entry = alloc_image_partition("support-list", len + 9);
1363
1364         put32(entry.data, len);
1365         memset(entry.data+4, 0, 4);
1366         memcpy(entry.data+8, info->support_list, len);
1367         entry.data[len+8] = info->support_trail;
1368
1369         return entry;
1370 }
1371
1372 /** Creates a new image partition with an arbitrary name from a file */
1373 static struct image_partition_entry read_file(const char *part_name, const char *filename, bool add_jffs2_eof, struct flash_partition_entry *file_system_partition) {
1374         struct stat statbuf;
1375
1376         if (stat(filename, &statbuf) < 0)
1377                 error(1, errno, "unable to stat file `%s'", filename);
1378
1379         size_t len = statbuf.st_size;
1380
1381         if (add_jffs2_eof)
1382                 if (file_system_partition)
1383                         len = ALIGN(len + file_system_partition->base, 0x10000) + sizeof(jffs2_eof_mark) - file_system_partition->base;
1384                 else
1385                         len = ALIGN(len, 0x10000) + sizeof(jffs2_eof_mark);
1386
1387         struct image_partition_entry entry = alloc_image_partition(part_name, len);
1388
1389         FILE *file = fopen(filename, "rb");
1390         if (!file)
1391                 error(1, errno, "unable to open file `%s'", filename);
1392
1393         if (fread(entry.data, statbuf.st_size, 1, file) != 1)
1394                 error(1, errno, "unable to read file `%s'", filename);
1395
1396         if (add_jffs2_eof) {
1397                 uint8_t *eof = entry.data + statbuf.st_size, *end = entry.data+entry.size;
1398
1399                 memset(eof, 0xff, end - eof - sizeof(jffs2_eof_mark));
1400                 memcpy(end - sizeof(jffs2_eof_mark), jffs2_eof_mark, sizeof(jffs2_eof_mark));
1401         }
1402
1403         fclose(file);
1404
1405         return entry;
1406 }
1407
1408 /** Creates a new image partition from arbitrary data */
1409 static struct image_partition_entry put_data(const char *part_name, const char *datain, size_t len) {
1410
1411         struct image_partition_entry entry = alloc_image_partition(part_name, len);
1412
1413         memcpy(entry.data, datain, len);
1414
1415         return entry;
1416 }
1417
1418 /**
1419    Copies a list of image partitions into an image buffer and generates the image partition table while doing so
1420
1421    Example image partition table:
1422
1423      fwup-ptn partition-table base 0x00800 size 0x00800
1424      fwup-ptn os-image base 0x01000 size 0x113b45
1425      fwup-ptn file-system base 0x114b45 size 0x1d0004
1426      fwup-ptn support-list base 0x2e4b49 size 0x000d1
1427
1428    Each line of the partition table is terminated with the bytes 09 0d 0a ("\t\r\n"),
1429    the end of the partition table is marked with a zero byte.
1430
1431    The firmware image must contain at least the partition-table and support-list partitions
1432    to be accepted. There aren't any alignment constraints for the image partitions.
1433
1434    The partition-table partition contains the actual flash layout; partitions
1435    from the image partition table are mapped to the corresponding flash partitions during
1436    the firmware upgrade. The support-list partition contains a list of devices supported by
1437    the firmware image.
1438
1439    The base offsets in the firmware partition table are relative to the end
1440    of the vendor information block, so the partition-table partition will
1441    actually start at offset 0x1814 of the image.
1442
1443    I think partition-table must be the first partition in the firmware image.
1444 */
1445 static void put_partitions(uint8_t *buffer, const struct flash_partition_entry *flash_parts, const struct image_partition_entry *parts) {
1446         size_t i, j;
1447         char *image_pt = (char *)buffer, *end = image_pt + 0x800;
1448
1449         size_t base = 0x800;
1450         for (i = 0; parts[i].name; i++) {
1451                 for (j = 0; flash_parts[j].name; j++) {
1452                         if (!strcmp(flash_parts[j].name, parts[i].name)) {
1453                                 if (parts[i].size > flash_parts[j].size)
1454                                         error(1, 0, "%s partition too big (more than %u bytes)", flash_parts[j].name, (unsigned)flash_parts[j].size);
1455                                 break;
1456                         }
1457                 }
1458
1459                 assert(flash_parts[j].name);
1460
1461                 memcpy(buffer + base, parts[i].data, parts[i].size);
1462
1463                 size_t len = end-image_pt;
1464                 size_t w = snprintf(image_pt, len, "fwup-ptn %s base 0x%05x size 0x%05x\t\r\n", parts[i].name, (unsigned)base, (unsigned)parts[i].size);
1465
1466                 if (w > len-1)
1467                         error(1, 0, "image partition table overflow?");
1468
1469                 image_pt += w;
1470
1471                 base += parts[i].size;
1472         }
1473 }
1474
1475 /** Generates and writes the image MD5 checksum */
1476 static void put_md5(uint8_t *md5, uint8_t *buffer, unsigned int len) {
1477         MD5_CTX ctx;
1478
1479         MD5_Init(&ctx);
1480         MD5_Update(&ctx, md5_salt, (unsigned int)sizeof(md5_salt));
1481         MD5_Update(&ctx, buffer, len);
1482         MD5_Final(md5, &ctx);
1483 }
1484
1485
1486 /**
1487    Generates the firmware image in factory format
1488
1489    Image format:
1490
1491      Bytes (hex)  Usage
1492      -----------  -----
1493      0000-0003    Image size (4 bytes, big endian)
1494      0004-0013    MD5 hash (hash of a 16 byte salt and the image data starting with byte 0x14)
1495      0014-0017    Vendor information length (without padding) (4 bytes, big endian)
1496      0018-1013    Vendor information (4092 bytes, padded with 0xff; there seem to be older
1497                   (VxWorks-based) TP-LINK devices which use a smaller vendor information block)
1498      1014-1813    Image partition table (2048 bytes, padded with 0xff)
1499      1814-xxxx    Firmware partitions
1500 */
1501 static void * generate_factory_image(struct device_info *info, const struct image_partition_entry *parts, size_t *len) {
1502         *len = 0x1814;
1503
1504         size_t i;
1505         for (i = 0; parts[i].name; i++)
1506                 *len += parts[i].size;
1507
1508         uint8_t *image = malloc(*len);
1509         if (!image)
1510                 error(1, errno, "malloc");
1511
1512         memset(image, 0xff, *len);
1513         put32(image, *len);
1514
1515         if (info->vendor) {
1516                 size_t vendor_len = strlen(info->vendor);
1517                 put32(image+0x14, vendor_len);
1518                 memcpy(image+0x18, info->vendor, vendor_len);
1519         }
1520
1521         put_partitions(image + 0x1014, info->partitions, parts);
1522         put_md5(image+0x04, image+0x14, *len-0x14);
1523
1524         return image;
1525 }
1526
1527 /**
1528    Generates the firmware image in sysupgrade format
1529
1530    This makes some assumptions about the provided flash and image partition tables and
1531    should be generalized when TP-LINK starts building its safeloader into hardware with
1532    different flash layouts.
1533 */
1534 static void * generate_sysupgrade_image(struct device_info *info, const struct image_partition_entry *image_parts, size_t *len) {
1535         size_t i, j;
1536         size_t flash_first_partition_index = 0;
1537         size_t flash_last_partition_index = 0;
1538         const struct flash_partition_entry *flash_first_partition = NULL;
1539         const struct flash_partition_entry *flash_last_partition = NULL;
1540         const struct image_partition_entry *image_last_partition = NULL;
1541
1542         /** Find first and last partitions */
1543         for (i = 0; info->partitions[i].name; i++) {
1544                 if (!strcmp(info->partitions[i].name, info->first_sysupgrade_partition)) {
1545                         flash_first_partition = &info->partitions[i];
1546                         flash_first_partition_index = i;
1547                 } else if (!strcmp(info->partitions[i].name, info->last_sysupgrade_partition)) {
1548                         flash_last_partition = &info->partitions[i];
1549                         flash_last_partition_index = i;
1550                 }
1551         }
1552
1553         assert(flash_first_partition && flash_last_partition);
1554         assert(flash_first_partition_index < flash_last_partition_index);
1555
1556         /** Find last partition from image to calculate needed size */
1557         for (i = 0; image_parts[i].name; i++) {
1558                 if (!strcmp(image_parts[i].name, info->last_sysupgrade_partition)) {
1559                         image_last_partition = &image_parts[i];
1560                         break;
1561                 }
1562         }
1563
1564         assert(image_last_partition);
1565
1566         *len = flash_last_partition->base - flash_first_partition->base + image_last_partition->size;
1567
1568         uint8_t *image = malloc(*len);
1569         if (!image)
1570                 error(1, errno, "malloc");
1571
1572         memset(image, 0xff, *len);
1573
1574         for (i = flash_first_partition_index; i <= flash_last_partition_index; i++) {
1575                 for (j = 0; image_parts[j].name; j++) {
1576                         if (!strcmp(info->partitions[i].name, image_parts[j].name)) {
1577                                 if (image_parts[j].size > info->partitions[i].size)
1578                                         error(1, 0, "%s partition too big (more than %u bytes)", info->partitions[i].name, (unsigned)info->partitions[i].size);
1579                                 memcpy(image + info->partitions[i].base - flash_first_partition->base, image_parts[j].data, image_parts[j].size);
1580                                 break;
1581                         }
1582
1583                         assert(image_parts[j].name);
1584                 }
1585         }
1586
1587         return image;
1588 }
1589
1590 /** Generates an image according to a given layout and writes it to a file */
1591 static void build_image(const char *output,
1592                 const char *kernel_image,
1593                 const char *rootfs_image,
1594                 uint32_t rev,
1595                 bool add_jffs2_eof,
1596                 bool sysupgrade,
1597                 struct device_info *info) {
1598
1599         size_t i;
1600
1601         struct image_partition_entry parts[7] = {};
1602
1603         struct flash_partition_entry *firmware_partition = NULL;
1604         struct flash_partition_entry *os_image_partition = NULL;
1605         struct flash_partition_entry *file_system_partition = NULL;
1606         size_t firmware_partition_index = 0;
1607
1608         for (i = 0; info->partitions[i].name; i++) {
1609                 if (!strcmp(info->partitions[i].name, "firmware"))
1610                 {
1611                         firmware_partition = &info->partitions[i];
1612                         firmware_partition_index = i;
1613                 }
1614         }
1615
1616         if (firmware_partition)
1617         {
1618                 os_image_partition = &info->partitions[firmware_partition_index];
1619                 file_system_partition = &info->partitions[firmware_partition_index + 1];
1620
1621                 struct stat kernel;
1622                 if (stat(kernel_image, &kernel) < 0)
1623                         error(1, errno, "unable to stat file `%s'", kernel_image);
1624
1625                 if (kernel.st_size > firmware_partition->size)
1626                         error(1, 0, "kernel overflowed firmware partition\n");
1627
1628                 for (i = MAX_PARTITIONS-1; i >= firmware_partition_index + 1; i--)
1629                         info->partitions[i+1] = info->partitions[i];
1630
1631                 file_system_partition->name = "file-system";
1632                 file_system_partition->base = firmware_partition->base + kernel.st_size;
1633
1634                 /* Align partition start to erase blocks for factory images only */
1635                 if (!sysupgrade)
1636                         file_system_partition->base = ALIGN(firmware_partition->base + kernel.st_size, 0x10000);
1637
1638                 file_system_partition->size = firmware_partition->size - file_system_partition->base;
1639
1640                 os_image_partition->name = "os-image";
1641                 os_image_partition->size = kernel.st_size;
1642         }
1643
1644         parts[0] = make_partition_table(info->partitions);
1645         if (info->soft_ver)
1646                 parts[1] = make_soft_version_from_string(info->soft_ver);
1647         else
1648                 parts[1] = make_soft_version(rev);
1649
1650         parts[2] = make_support_list(info);
1651         parts[3] = read_file("os-image", kernel_image, false, NULL);
1652         parts[4] = read_file("file-system", rootfs_image, add_jffs2_eof, file_system_partition);
1653
1654         /* Some devices need the extra-para partition to accept the firmware */
1655         if (strcasecmp(info->id, "ARCHER-C25-V1") == 0 ||
1656             strcasecmp(info->id, "ARCHER-C59-V2") == 0 ||
1657             strcasecmp(info->id, "ARCHER-C60-V2") == 0 ||
1658             strcasecmp(info->id, "TLWR1043NV5") == 0) {
1659                 const char mdat[11] = {0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00};
1660                 parts[5] = put_data("extra-para", mdat, 11);
1661         } else if (strcasecmp(info->id, "ARCHER-A7-V5") == 0 || strcasecmp(info->id, "ARCHER-C7-V4") == 0 || strcasecmp(info->id, "ARCHER-C7-V5") == 0) {
1662                 const char mdat[11] = {0x01, 0x00, 0x00, 0x02, 0x00, 0x00, 0xca, 0x00, 0x01, 0x00, 0x00};
1663                 parts[5] = put_data("extra-para", mdat, 11);
1664         } else if (strcasecmp(info->id, "ARCHER-C6-V2") == 0) {
1665                 const char mdat[11] = {0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00};
1666                 parts[5] = put_data("extra-para", mdat, 11);
1667         }
1668
1669         size_t len;
1670         void *image;
1671         if (sysupgrade)
1672                 image = generate_sysupgrade_image(info, parts, &len);
1673         else
1674                 image = generate_factory_image(info, parts, &len);
1675
1676         FILE *file = fopen(output, "wb");
1677         if (!file)
1678                 error(1, errno, "unable to open output file");
1679
1680         if (fwrite(image, len, 1, file) != 1)
1681                 error(1, 0, "unable to write output file");
1682
1683         fclose(file);
1684
1685         free(image);
1686
1687         for (i = 0; parts[i].name; i++)
1688                 free_image_partition(parts[i]);
1689 }
1690
1691 /** Usage output */
1692 static void usage(const char *argv0) {
1693         fprintf(stderr,
1694                 "Usage: %s [OPTIONS...]\n"
1695                 "\n"
1696                 "Options:\n"
1697                 "  -h              show this help\n"
1698                 "\n"
1699                 "Create a new image:\n"
1700                 "  -B <board>      create image for the board specified with <board>\n"
1701                 "  -k <file>       read kernel image from the file <file>\n"
1702                 "  -r <file>       read rootfs image from the file <file>\n"
1703                 "  -o <file>       write output to the file <file>\n"
1704                 "  -V <rev>        sets the revision number to <rev>\n"
1705                 "  -j              add jffs2 end-of-filesystem markers\n"
1706                 "  -S              create sysupgrade instead of factory image\n"
1707                 "Extract an old image:\n"
1708                 "  -x <file>       extract all oem firmware partition\n"
1709                 "  -d <dir>        destination to extract the firmware partition\n"
1710                 "  -z <file>       convert an oem firmware into a sysupgade file. Use -o for output file\n",
1711                 argv0
1712         );
1713 };
1714
1715
1716 static struct device_info *find_board(const char *id)
1717 {
1718         struct device_info *board = NULL;
1719
1720         for (board = boards; board->id != NULL; board++)
1721                 if (strcasecmp(id, board->id) == 0)
1722                         return board;
1723
1724         return NULL;
1725 }
1726
1727 static int add_flash_partition(
1728                 struct flash_partition_entry *part_list,
1729                 size_t max_entries,
1730                 const char *name,
1731                 unsigned long base,
1732                 unsigned long size)
1733 {
1734         int ptr;
1735         /* check if the list has a free entry */
1736         for (ptr = 0; ptr < max_entries; ptr++, part_list++) {
1737                 if (part_list->name == NULL &&
1738                                 part_list->base == 0 &&
1739                                 part_list->size == 0)
1740                         break;
1741         }
1742
1743         if (ptr == max_entries) {
1744                 error(1, 0, "No free flash part entry available.");
1745         }
1746
1747         part_list->name = calloc(1, strlen(name) + 1);
1748         if (!part_list->name) {
1749                 error(1, 0, "Unable to allocate memory");
1750         }
1751
1752         memcpy((char *)part_list->name, name, strlen(name));
1753         part_list->base = base;
1754         part_list->size = size;
1755
1756         return 0;
1757 }
1758
1759 /** read the partition table into struct flash_partition_entry */
1760 static int read_partition_table(
1761                 FILE *file, long offset,
1762                 struct flash_partition_entry *entries, size_t max_entries,
1763                 int type)
1764 {
1765         char buf[2048];
1766         char *ptr, *end;
1767         const char *parthdr = NULL;
1768         const char *fwuphdr = "fwup-ptn";
1769         const char *flashhdr = "partition";
1770
1771         /* TODO: search for the partition table */
1772
1773         switch(type) {
1774                 case 0:
1775                         parthdr = fwuphdr;
1776                         break;
1777                 case 1:
1778                         parthdr = flashhdr;
1779                         break;
1780                 default:
1781                         error(1, 0, "Invalid partition table");
1782         }
1783
1784         if (fseek(file, offset, SEEK_SET) < 0)
1785                 error(1, errno, "Can not seek in the firmware");
1786
1787         if (fread(buf, 1, 2048, file) < 0)
1788                 error(1, errno, "Can not read fwup-ptn from the firmware");
1789
1790         buf[2047] = '\0';
1791
1792         /* look for the partition header */
1793         if (memcmp(buf, parthdr, strlen(parthdr)) != 0) {
1794                 fprintf(stderr, "DEBUG: can not find fwuphdr\n");
1795                 return 1;
1796         }
1797
1798         ptr = buf;
1799         end = buf + sizeof(buf);
1800         while ((ptr + strlen(parthdr)) < end &&
1801                         memcmp(ptr, parthdr, strlen(parthdr)) == 0) {
1802                 char *end_part;
1803                 char *end_element;
1804
1805                 char name[32] = { 0 };
1806                 int name_len = 0;
1807                 unsigned long base = 0;
1808                 unsigned long size = 0;
1809
1810                 end_part = memchr(ptr, '\n', (end - ptr));
1811                 if (end_part == NULL) {
1812                         /* in theory this should never happen, because a partition always ends with 0x09, 0x0D, 0x0A */
1813                         break;
1814                 }
1815
1816                 for (int i = 0; i <= 4; i++) {
1817                         if (end_part <= ptr)
1818                                 break;
1819
1820                         end_element = memchr(ptr, 0x20, (end_part - ptr));
1821                         if (end_element == NULL) {
1822                                 error(1, errno, "Ignoring the rest of the partition entries.");
1823                                 break;
1824                         }
1825
1826                         switch (i) {
1827                                 /* partition header */
1828                                 case 0:
1829                                         ptr = end_element + 1;
1830                                         continue;
1831                                 /* name */
1832                                 case 1:
1833                                         name_len = (end_element - ptr) > 31 ? 31 : (end_element - ptr);
1834                                         strncpy(name, ptr, name_len);
1835                                         name[name_len] = '\0';
1836                                         ptr = end_element + 1;
1837                                         continue;
1838
1839                                 /* string "base" */
1840                                 case 2:
1841                                         ptr = end_element + 1;
1842                                         continue;
1843
1844                                 /* actual base */
1845                                 case 3:
1846                                         base = strtoul(ptr, NULL, 16);
1847                                         ptr = end_element + 1;
1848                                         continue;
1849
1850                                 /* string "size" */
1851                                 case 4:
1852                                         ptr = end_element + 1;
1853                                         /* actual size. The last element doesn't have a sepeartor */
1854                                         size = strtoul(ptr, NULL, 16);
1855                                         /* the part ends with 0x09, 0x0d, 0x0a */
1856                                         ptr = end_part + 1;
1857                                         add_flash_partition(entries, max_entries, name, base, size);
1858                                         continue;
1859                         }
1860                 }
1861         }
1862
1863         return 0;
1864 }
1865
1866 static void write_partition(
1867                 FILE *input_file,
1868                 size_t firmware_offset,
1869                 struct flash_partition_entry *entry,
1870                 FILE *output_file)
1871 {
1872         char buf[4096];
1873         size_t offset;
1874
1875         fseek(input_file, entry->base + firmware_offset, SEEK_SET);
1876
1877         for (offset = 0; sizeof(buf) + offset <= entry->size; offset += sizeof(buf)) {
1878                 if (fread(buf, sizeof(buf), 1, input_file) < 0)
1879                         error(1, errno, "Can not read partition from input_file");
1880
1881                 if (fwrite(buf, sizeof(buf), 1, output_file) < 0)
1882                         error(1, errno, "Can not write partition to output_file");
1883         }
1884         /* write last chunk smaller than buffer */
1885         if (offset < entry->size) {
1886                 offset = entry->size - offset;
1887                 if (fread(buf, offset, 1, input_file) < 0)
1888                         error(1, errno, "Can not read partition from input_file");
1889                 if (fwrite(buf, offset, 1, output_file) < 0)
1890                         error(1, errno, "Can not write partition to output_file");
1891         }
1892 }
1893
1894 static int extract_firmware_partition(FILE *input_file, size_t firmware_offset, struct flash_partition_entry *entry, const char *output_directory)
1895 {
1896         FILE *output_file;
1897         char output[PATH_MAX];
1898
1899         snprintf(output, PATH_MAX, "%s/%s", output_directory, entry->name);
1900         output_file = fopen(output, "wb+");
1901         if (output_file == NULL) {
1902                 error(1, errno, "Can not open output file %s", output);
1903         }
1904
1905         write_partition(input_file, firmware_offset, entry, output_file);
1906
1907         fclose(output_file);
1908
1909         return 0;
1910 }
1911
1912 /** extract all partitions from the firmware file */
1913 static int extract_firmware(const char *input, const char *output_directory)
1914 {
1915         struct flash_partition_entry entries[16] = { 0 };
1916         size_t max_entries = 16;
1917         size_t firmware_offset = 0x1014;
1918         FILE *input_file;
1919
1920         struct stat statbuf;
1921
1922         /* check input file */
1923         if (stat(input, &statbuf)) {
1924                 error(1, errno, "Can not read input firmware %s", input);
1925         }
1926
1927         /* check if output directory exists */
1928         if (stat(output_directory, &statbuf)) {
1929                 error(1, errno, "Failed to stat output directory %s", output_directory);
1930         }
1931
1932         if ((statbuf.st_mode & S_IFMT) != S_IFDIR) {
1933                 error(1, errno, "Given output directory is not a directory %s", output_directory);
1934         }
1935
1936         input_file = fopen(input, "rb");
1937
1938         if (read_partition_table(input_file, firmware_offset, entries, 16, 0) != 0) {
1939                 error(1, 0, "Error can not read the partition table (fwup-ptn)");
1940         }
1941
1942         for (int i = 0; i < max_entries; i++) {
1943                 if (entries[i].name == NULL &&
1944                                 entries[i].base == 0 &&
1945                                 entries[i].size == 0)
1946                         continue;
1947
1948                 extract_firmware_partition(input_file, firmware_offset, &entries[i], output_directory);
1949         }
1950
1951         return 0;
1952 }
1953
1954 static struct flash_partition_entry *find_partition(
1955                 struct flash_partition_entry *entries, size_t max_entries,
1956                 const char *name, const char *error_msg)
1957 {
1958         for (int i = 0; i < max_entries; i++, entries++) {
1959                 if (strcmp(entries->name, name) == 0)
1960                         return entries;
1961         }
1962
1963         error(1, 0, "%s", error_msg);
1964         return NULL;
1965 }
1966
1967 static void write_ff(FILE *output_file, size_t size)
1968 {
1969         char buf[4096];
1970         int offset;
1971
1972         memset(buf, 0xff, sizeof(buf));
1973
1974         for (offset = 0; offset + sizeof(buf) < size ; offset += sizeof(buf)) {
1975                 if (fwrite(buf, sizeof(buf), 1, output_file) < 0)
1976                         error(1, errno, "Can not write 0xff to output_file");
1977         }
1978
1979         /* write last chunk smaller than buffer */
1980         if (offset < size) {
1981                 offset = size - offset;
1982                 if (fwrite(buf, offset, 1, output_file) < 0)
1983                         error(1, errno, "Can not write partition to output_file");
1984         }
1985 }
1986
1987 static void convert_firmware(const char *input, const char *output)
1988 {
1989         struct flash_partition_entry fwup[MAX_PARTITIONS] = { 0 };
1990         struct flash_partition_entry flash[MAX_PARTITIONS] = { 0 };
1991         struct flash_partition_entry *fwup_os_image = NULL, *fwup_file_system = NULL;
1992         struct flash_partition_entry *flash_os_image = NULL, *flash_file_system = NULL;
1993         struct flash_partition_entry *fwup_partition_table = NULL;
1994         size_t firmware_offset = 0x1014;
1995         FILE *input_file, *output_file;
1996
1997         struct stat statbuf;
1998
1999         /* check input file */
2000         if (stat(input, &statbuf)) {
2001                 error(1, errno, "Can not read input firmware %s", input);
2002         }
2003
2004         input_file = fopen(input, "rb");
2005         if (!input_file)
2006                 error(1, 0, "Can not open input firmware %s", input);
2007
2008         output_file = fopen(output, "wb");
2009         if (!output_file)
2010                 error(1, 0, "Can not open output firmware %s", output);
2011
2012         if (read_partition_table(input_file, firmware_offset, fwup, MAX_PARTITIONS, 0) != 0) {
2013                 error(1, 0, "Error can not read the partition table (fwup-ptn)");
2014         }
2015
2016         fwup_os_image = find_partition(fwup, MAX_PARTITIONS,
2017                         "os-image", "Error can not find os-image partition (fwup)");
2018         fwup_file_system = find_partition(fwup, MAX_PARTITIONS,
2019                         "file-system", "Error can not find file-system partition (fwup)");
2020         fwup_partition_table = find_partition(fwup, MAX_PARTITIONS,
2021                         "partition-table", "Error can not find partition-table partition");
2022
2023         /* the flash partition table has a 0x00000004 magic haeder */
2024         if (read_partition_table(input_file, firmware_offset + fwup_partition_table->base + 4, flash, MAX_PARTITIONS, 1) != 0)
2025                 error(1, 0, "Error can not read the partition table (flash)");
2026
2027         flash_os_image = find_partition(flash, MAX_PARTITIONS,
2028                         "os-image", "Error can not find os-image partition (flash)");
2029         flash_file_system = find_partition(flash, MAX_PARTITIONS,
2030                         "file-system", "Error can not find file-system partition (flash)");
2031
2032         /* write os_image to 0x0 */
2033         write_partition(input_file, firmware_offset, fwup_os_image, output_file);
2034         write_ff(output_file, flash_os_image->size - fwup_os_image->size);
2035
2036         /* write file-system behind os_image */
2037         fseek(output_file, flash_file_system->base - flash_os_image->base, SEEK_SET);
2038         write_partition(input_file, firmware_offset, fwup_file_system, output_file);
2039         write_ff(output_file, flash_file_system->size - fwup_file_system->size);
2040
2041         fclose(output_file);
2042         fclose(input_file);
2043 }
2044
2045 int main(int argc, char *argv[]) {
2046         const char *board = NULL, *kernel_image = NULL, *rootfs_image = NULL, *output = NULL;
2047         const char *extract_image = NULL, *output_directory = NULL, *convert_image = NULL;
2048         bool add_jffs2_eof = false, sysupgrade = false;
2049         unsigned rev = 0;
2050         struct device_info *info;
2051         set_source_date_epoch();
2052
2053         while (true) {
2054                 int c;
2055
2056                 c = getopt(argc, argv, "B:k:r:o:V:jSh:x:d:z:");
2057                 if (c == -1)
2058                         break;
2059
2060                 switch (c) {
2061                 case 'B':
2062                         board = optarg;
2063                         break;
2064
2065                 case 'k':
2066                         kernel_image = optarg;
2067                         break;
2068
2069                 case 'r':
2070                         rootfs_image = optarg;
2071                         break;
2072
2073                 case 'o':
2074                         output = optarg;
2075                         break;
2076
2077                 case 'V':
2078                         sscanf(optarg, "r%u", &rev);
2079                         break;
2080
2081                 case 'j':
2082                         add_jffs2_eof = true;
2083                         break;
2084
2085                 case 'S':
2086                         sysupgrade = true;
2087                         break;
2088
2089                 case 'h':
2090                         usage(argv[0]);
2091                         return 0;
2092
2093                 case 'd':
2094                         output_directory = optarg;
2095                         break;
2096
2097                 case 'x':
2098                         extract_image = optarg;
2099                         break;
2100
2101                 case 'z':
2102                         convert_image = optarg;
2103                         break;
2104
2105                 default:
2106                         usage(argv[0]);
2107                         return 1;
2108                 }
2109         }
2110
2111         if (extract_image || output_directory) {
2112                 if (!extract_image)
2113                         error(1, 0, "No factory/oem image given via -x <file>. Output directory is only valid with -x");
2114                 if (!output_directory)
2115                         error(1, 0, "Can not extract an image without output directory. Use -d <dir>");
2116                 extract_firmware(extract_image, output_directory);
2117         } else if (convert_image) {
2118                 if (!output)
2119                         error(1, 0, "Can not convert a factory/oem image into sysupgrade image without output file. Use -o <file>");
2120                 convert_firmware(convert_image, output);
2121         } else {
2122                 if (!board)
2123                         error(1, 0, "no board has been specified");
2124                 if (!kernel_image)
2125                         error(1, 0, "no kernel image has been specified");
2126                 if (!rootfs_image)
2127                         error(1, 0, "no rootfs image has been specified");
2128                 if (!output)
2129                         error(1, 0, "no output filename has been specified");
2130
2131                 info = find_board(board);
2132
2133                 if (info == NULL)
2134                         error(1, 0, "unsupported board %s", board);
2135
2136                 build_image(output, kernel_image, rootfs_image, rev, add_jffs2_eof, sysupgrade, info);
2137         }
2138
2139         return 0;
2140 }