tools/firmware-utils/src/tplink-safeloader.c

   1 /*
   2   Copyright (c) 2014, Matthias Schiffer <mschiffer@universe-factory.net>
   3   All rights reserved.
   4
   5   Redistribution and use in source and binary forms, with or without
   6   modification, are permitted provided that the following conditions are met:
   7
   8     1. Redistributions of source code must retain the above copyright notice,
   9        this list of conditions and the following disclaimer.
  10     2. Redistributions in binary form must reproduce the above copyright notice,
  11        this list of conditions and the following disclaimer in the documentation
  12        and/or other materials provided with the distribution.
  13
  14   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
  15   AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16   IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  17   DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
  18   FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19   DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  20   SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  21   CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  22   OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  23   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24 */
  25
  26
  27 /*
  28    tplink-safeloader
  29
  30    Image generation tool for the TP-LINK SafeLoader as seen on
  31    TP-LINK Pharos devices (CPE210/220/510/520)
  32 */
  33
  34
  35 #include <assert.h>
  36 #include <errno.h>
  37 #include <stdbool.h>
  38 #include <stdio.h>
  39 #include <stdint.h>
  40 #include <stdlib.h>
  41 #include <string.h>
  42 #include <time.h>
  43 #include <unistd.h>
  44
  45 #include <arpa/inet.h>
  46
  47 #include <sys/types.h>
  48 #include <sys/stat.h>
  49 #include <limits.h>
  50
  51 #include "md5.h"
  52
  53
  54 #define ALIGN(x,a) ({ typeof(a) __a = (a); (((x) + __a - 1) & ~(__a - 1)); })
  55
  56
  57 #define MAX_PARTITIONS  32
  58
  59 /** An image partition table entry */
  60 struct image_partition_entry {
  61         const char *name;
  62         size_t size;
  63         uint8_t *data;
  64 };
  65
  66 /** A flash partition table entry */
  67 struct flash_partition_entry {
  68         char *name;
  69         uint32_t base;
  70         uint32_t size;
  71 };
  72
  73 /** Firmware layout description */
  74 struct device_info {
  75         const char *id;
  76         const char *vendor;
  77         const char *support_list;
  78         char support_trail;
  79         const char *soft_ver;
  80         struct flash_partition_entry partitions[MAX_PARTITIONS+1];
  81         const char *first_sysupgrade_partition;
  82         const char *last_sysupgrade_partition;
  83 };
  84
  85 /** The content of the soft-version structure */
  86 struct __attribute__((__packed__)) soft_version {
  87         uint32_t magic;
  88         uint32_t zero;
  89         uint8_t pad1;
  90         uint8_t version_major;
  91         uint8_t version_minor;
  92         uint8_t version_patch;
  93         uint8_t year_hi;
  94         uint8_t year_lo;
  95         uint8_t month;
  96         uint8_t day;
  97         uint32_t rev;
  98         uint8_t pad2;
  99 };
 100
 101
 102 static const uint8_t jffs2_eof_mark[4] = {0xde, 0xad, 0xc0, 0xde};
 103
 104
 105 /**
 106    Salt for the MD5 hash
 107
 108    Fortunately, TP-LINK seems to use the same salt for most devices which use
 109    the new image format.
 110 */
 111 static const uint8_t md5_salt[16] = {
 112         0x7a, 0x2b, 0x15, 0xed,
 113         0x9b, 0x98, 0x59, 0x6d,
 114         0xe5, 0x04, 0xab, 0x44,
 115         0xac, 0x2a, 0x9f, 0x4e,
 116 };
 117
 118
 119 /** Firmware layout table */
 120 static struct device_info boards[] = {
 121         /** Firmware layout for the CPE210/220 */
 122         {
 123                 .id     = "CPE210",
 124                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 125                 .support_list =
 126                         "SupportList:\r\n"
 127                         "CPE210(TP-LINK|UN|N300-2):1.0\r\n"
 128                         "CPE210(TP-LINK|UN|N300-2):1.1\r\n"
 129                         "CPE210(TP-LINK|US|N300-2):1.1\r\n"
 130                         "CPE210(TP-LINK|EU|N300-2):1.1\r\n"
 131                         "CPE220(TP-LINK|UN|N300-2):1.1\r\n"
 132                         "CPE220(TP-LINK|US|N300-2):1.1\r\n"
 133                         "CPE220(TP-LINK|EU|N300-2):1.1\r\n",
 134                 .support_trail = '\xff',
 135                 .soft_ver = NULL,
 136
 137                 .partitions = {
 138                         {"fs-uboot", 0x00000, 0x20000},
 139                         {"partition-table", 0x20000, 0x02000},
 140                         {"default-mac", 0x30000, 0x00020},
 141                         {"product-info", 0x31100, 0x00100},
 142                         {"signature", 0x32000, 0x00400},
 143                         {"os-image", 0x40000, 0x1c0000},
 144                         {"file-system", 0x200000, 0x5b0000},
 145                         {"soft-version", 0x7b0000, 0x00100},
 146                         {"support-list", 0x7b1000, 0x00400},
 147                         {"user-config", 0x7c0000, 0x10000},
 148                         {"default-config", 0x7d0000, 0x10000},
 149                         {"log", 0x7e0000, 0x10000},
 150                         {"radio", 0x7f0000, 0x10000},
 151                         {NULL, 0, 0}
 152                 },
 153
 154                 .first_sysupgrade_partition = "os-image",
 155                 .last_sysupgrade_partition = "support-list",
 156         },
 157
 158         /** Firmware layout for the CPE210 V2 */
 159         {
 160                 .id     = "CPE210V2",
 161                 .vendor = "CPE210(TP-LINK|UN|N300-2|00000000):2.0\r\n",
 162                 .support_list =
 163                         "SupportList:\r\n"
 164                         "CPE210(TP-LINK|EU|N300-2|00000000):2.0\r\n"
 165                         "CPE210(TP-LINK|EU|N300-2|45550000):2.0\r\n"
 166                         "CPE210(TP-LINK|EU|N300-2|55530000):2.0\r\n"
 167                         "CPE210(TP-LINK|UN|N300-2|00000000):2.0\r\n"
 168                         "CPE210(TP-LINK|UN|N300-2|45550000):2.0\r\n"
 169                         "CPE210(TP-LINK|UN|N300-2|55530000):2.0\r\n"
 170                         "CPE210(TP-LINK|US|N300-2|55530000):2.0\r\n"
 171                         "CPE210(TP-LINK|UN|N300-2):2.0\r\n"
 172                         "CPE210(TP-LINK|EU|N300-2):2.0\r\n"
 173                         "CPE210(TP-LINK|US|N300-2):2.0\r\n",
 174                 .support_trail = '\xff',
 175                 .soft_ver = NULL,
 176
 177                 .partitions = {
 178                         {"fs-uboot", 0x00000, 0x20000},
 179                         {"partition-table", 0x20000, 0x02000},
 180                         {"default-mac", 0x30000, 0x00020},
 181                         {"product-info", 0x31100, 0x00100},
 182                         {"device-info", 0x31400, 0x00400},
 183                         {"signature", 0x32000, 0x00400},
 184                         {"device-id", 0x33000, 0x00100},
 185                         {"os-image", 0x40000, 0x1c0000},
 186                         {"file-system", 0x200000, 0x5b0000},
 187                         {"soft-version", 0x7b0000, 0x00100},
 188                         {"support-list", 0x7b1000, 0x01000},
 189                         {"user-config", 0x7c0000, 0x10000},
 190                         {"default-config", 0x7d0000, 0x10000},
 191                         {"log", 0x7e0000, 0x10000},
 192                         {"radio", 0x7f0000, 0x10000},
 193                         {NULL, 0, 0}
 194                 },
 195
 196                 .first_sysupgrade_partition = "os-image",
 197                 .last_sysupgrade_partition = "support-list",
 198         },
 199
 200         /** Firmware layout for the CPE510/520 */
 201         {
 202                 .id     = "CPE510",
 203                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 204                 .support_list =
 205                         "SupportList:\r\n"
 206                         "CPE510(TP-LINK|UN|N300-5):1.0\r\n"
 207                         "CPE510(TP-LINK|UN|N300-5):1.1\r\n"
 208                         "CPE510(TP-LINK|UN|N300-5):1.1\r\n"
 209                         "CPE510(TP-LINK|US|N300-5):1.1\r\n"
 210                         "CPE510(TP-LINK|EU|N300-5):1.1\r\n"
 211                         "CPE520(TP-LINK|UN|N300-5):1.1\r\n"
 212                         "CPE520(TP-LINK|US|N300-5):1.1\r\n"
 213                         "CPE520(TP-LINK|EU|N300-5):1.1\r\n"
 214                         "CPE510(TP-LINK|EU|N300-5|00000000):2.0\r\n"
 215                         "CPE510(TP-LINK|EU|N300-5|45550000):2.0\r\n"
 216                         "CPE510(TP-LINK|EU|N300-5|55530000):2.0\r\n"
 217                         "CPE510(TP-LINK|UN|N300-5|00000000):2.0\r\n"
 218                         "CPE510(TP-LINK|UN|N300-5|45550000):2.0\r\n"
 219                         "CPE510(TP-LINK|UN|N300-5|55530000):2.0\r\n"
 220                         "CPE510(TP-LINK|US|N300-5|55530000):2.0\r\n"
 221                         "CPE510(TP-LINK|UN|N300-5):2.0\r\n"
 222                         "CPE510(TP-LINK|EU|N300-5):2.0\r\n"
 223                         "CPE510(TP-LINK|US|N300-5):2.0\r\n",
 224                 .support_trail = '\xff',
 225                 .soft_ver = NULL,
 226
 227                 .partitions = {
 228                         {"fs-uboot", 0x00000, 0x20000},
 229                         {"partition-table", 0x20000, 0x02000},
 230                         {"default-mac", 0x30000, 0x00020},
 231                         {"product-info", 0x31100, 0x00100},
 232                         {"signature", 0x32000, 0x00400},
 233                         {"os-image", 0x40000, 0x1c0000},
 234                         {"file-system", 0x200000, 0x5b0000},
 235                         {"soft-version", 0x7b0000, 0x00100},
 236                         {"support-list", 0x7b1000, 0x00400},
 237                         {"user-config", 0x7c0000, 0x10000},
 238                         {"default-config", 0x7d0000, 0x10000},
 239                         {"log", 0x7e0000, 0x10000},
 240                         {"radio", 0x7f0000, 0x10000},
 241                         {NULL, 0, 0}
 242                 },
 243
 244                 .first_sysupgrade_partition = "os-image",
 245                 .last_sysupgrade_partition = "support-list",
 246         },
 247
 248         {
 249                 .id     = "WBS210",
 250                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 251                 .support_list =
 252                         "SupportList:\r\n"
 253                         "WBS210(TP-LINK|UN|N300-2):1.20\r\n"
 254                         "WBS210(TP-LINK|US|N300-2):1.20\r\n"
 255                         "WBS210(TP-LINK|EU|N300-2):1.20\r\n",
 256                 .support_trail = '\xff',
 257                 .soft_ver = NULL,
 258
 259                 .partitions = {
 260                         {"fs-uboot", 0x00000, 0x20000},
 261                         {"partition-table", 0x20000, 0x02000},
 262                         {"default-mac", 0x30000, 0x00020},
 263                         {"product-info", 0x31100, 0x00100},
 264                         {"signature", 0x32000, 0x00400},
 265                         {"os-image", 0x40000, 0x1c0000},
 266                         {"file-system", 0x200000, 0x5b0000},
 267                         {"soft-version", 0x7b0000, 0x00100},
 268                         {"support-list", 0x7b1000, 0x00400},
 269                         {"user-config", 0x7c0000, 0x10000},
 270                         {"default-config", 0x7d0000, 0x10000},
 271                         {"log", 0x7e0000, 0x10000},
 272                         {"radio", 0x7f0000, 0x10000},
 273                         {NULL, 0, 0}
 274                 },
 275
 276                 .first_sysupgrade_partition = "os-image",
 277                 .last_sysupgrade_partition = "support-list",
 278         },
 279
 280         {
 281                 .id     = "WBS510",
 282                 .vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",
 283                 .support_list =
 284                         "SupportList:\r\n"
 285                         "WBS510(TP-LINK|UN|N300-5):1.20\r\n"
 286                         "WBS510(TP-LINK|US|N300-5):1.20\r\n"
 287                         "WBS510(TP-LINK|EU|N300-5):1.20\r\n",
 288                 .support_trail = '\xff',
 289                 .soft_ver = NULL,
 290
 291                 .partitions = {
 292                         {"fs-uboot", 0x00000, 0x20000},
 293                         {"partition-table", 0x20000, 0x02000},
 294                         {"default-mac", 0x30000, 0x00020},
 295                         {"product-info", 0x31100, 0x00100},
 296                         {"signature", 0x32000, 0x00400},
 297                         {"os-image", 0x40000, 0x1c0000},
 298                         {"file-system", 0x200000, 0x5b0000},
 299                         {"soft-version", 0x7b0000, 0x00100},
 300                         {"support-list", 0x7b1000, 0x00400},
 301                         {"user-config", 0x7c0000, 0x10000},
 302                         {"default-config", 0x7d0000, 0x10000},
 303                         {"log", 0x7e0000, 0x10000},
 304                         {"radio", 0x7f0000, 0x10000},
 305                         {NULL, 0, 0}
 306                 },
 307
 308                 .first_sysupgrade_partition = "os-image",
 309                 .last_sysupgrade_partition = "support-list",
 310         },
 311
 312         /** Firmware layout for the C2600 */
 313         {
 314                 .id = "C2600",
 315                 .vendor = "",
 316                 .support_list =
 317                         "SupportList:\r\n"
 318                         "{product_name:Archer C2600,product_ver:1.0.0,special_id:00000000}\r\n",
 319                 .support_trail = '\x00',
 320                 .soft_ver = NULL,
 321
 322                 /**
 323                     We use a bigger os-image partition than the stock images (and thus
 324                     smaller file-system), as our kernel doesn't fit in the stock firmware's
 325                     2 MB os-image since kernel 4.14.
 326                 */
 327                 .partitions = {
 328                         {"SBL1", 0x00000, 0x20000},
 329                         {"MIBIB", 0x20000, 0x20000},
 330                         {"SBL2", 0x40000, 0x20000},
 331                         {"SBL3", 0x60000, 0x30000},
 332                         {"DDRCONFIG", 0x90000, 0x10000},
 333                         {"SSD", 0xa0000, 0x10000},
 334                         {"TZ", 0xb0000, 0x30000},
 335                         {"RPM", 0xe0000, 0x20000},
 336                         {"fs-uboot", 0x100000, 0x70000},
 337                         {"uboot-env", 0x170000, 0x40000},
 338                         {"radio", 0x1b0000, 0x40000},
 339                         {"os-image", 0x1f0000, 0x400000}, /* Stock: base 0x1f0000 size 0x200000 */
 340                         {"file-system", 0x5f0000, 0x1900000}, /* Stock: base 0x3f0000 size 0x1b00000 */
 341                         {"default-mac", 0x1ef0000, 0x00200},
 342                         {"pin", 0x1ef0200, 0x00200},
 343                         {"product-info", 0x1ef0400, 0x0fc00},
 344                         {"partition-table", 0x1f00000, 0x10000},
 345                         {"soft-version", 0x1f10000, 0x10000},
 346                         {"support-list", 0x1f20000, 0x10000},
 347                         {"profile", 0x1f30000, 0x10000},
 348                         {"default-config", 0x1f40000, 0x10000},
 349                         {"user-config", 0x1f50000, 0x40000},
 350                         {"qos-db", 0x1f90000, 0x40000},
 351                         {"usb-config", 0x1fd0000, 0x10000},
 352                         {"log", 0x1fe0000, 0x20000},
 353                         {NULL, 0, 0}
 354                 },
 355
 356                 .first_sysupgrade_partition = "os-image",
 357                 .last_sysupgrade_partition = "file-system"
 358         },
 359
 360         /** Firmware layout for the A7-V5 */
 361         {
 362                 .id = "ARCHER-A7-V5",
 363                 .support_list =
 364                         "SupportList:\n"
 365                         "{product_name:Archer A7,product_ver:5.0.0,special_id:45550000}\n"
 366                         "{product_name:Archer A7,product_ver:5.0.0,special_id:55530000}\n"
 367                         "{product_name:Archer A7,product_ver:5.0.0,special_id:43410000}\n"
 368                         "{product_name:Archer A7,product_ver:5.0.0,special_id:4A500000}\n"
 369                         "{product_name:Archer A7,product_ver:5.0.0,special_id:54570000}\n",
 370                 .support_trail = '\x00',
 371                 .soft_ver = "soft_ver:1.0.0\n",
 372
 373                 /* We're using a dynamic kernel/rootfs split here */
 374                 .partitions = {
 375                         {"factory-boot", 0x00000, 0x20000},
 376                         {"fs-uboot", 0x20000, 0x20000},
 377                         {"firmware", 0x40000, 0xec0000},        /* Stock: name os-image base 0x40000 size 0x120000 */
 378                                                                 /* Stock: name file-system base 0x160000 size 0xda0000 */
 379                         {"default-mac", 0xf40000, 0x00200},
 380                         {"pin", 0xf40200, 0x00200},
 381                         {"device-id", 0xf40400, 0x00100},
 382                         {"product-info", 0xf40500, 0x0fb00},
 383                         {"soft-version", 0xf50000, 0x00100},
 384                         {"extra-para", 0xf51000, 0x01000},
 385                         {"support-list", 0xf52000, 0x0a000},
 386                         {"profile", 0xf5c000, 0x04000},
 387                         {"default-config", 0xf60000, 0x10000},
 388                         {"user-config", 0xf70000, 0x40000},
 389                         {"certificate", 0xfb0000, 0x10000},
 390                         {"partition-table", 0xfc0000, 0x10000},
 391                         {"log", 0xfd0000, 0x20000},
 392                         {"radio", 0xff0000, 0x10000},
 393                         {NULL, 0, 0}
 394                 },
 395
 396                 .first_sysupgrade_partition = "os-image",
 397                 .last_sysupgrade_partition = "file-system",
 398         },
 399
 400         /** Firmware layout for the C25v1 */
 401         {
 402                 .id = "ARCHER-C25-V1",
 403                 .support_list =
 404                         "SupportList:\n"
 405                         "{product_name:ArcherC25,product_ver:1.0.0,special_id:00000000}\n"
 406                         "{product_name:ArcherC25,product_ver:1.0.0,special_id:55530000}\n"
 407                         "{product_name:ArcherC25,product_ver:1.0.0,special_id:45550000}\n",
 408                 .support_trail = '\x00',
 409                 .soft_ver = "soft_ver:1.0.0\n",
 410
 411                 /* We're using a dynamic kernel/rootfs split here */
 412                 .partitions = {
 413                         {"factory-boot", 0x00000, 0x20000},
 414                         {"fs-uboot", 0x20000, 0x10000},
 415                         {"firmware", 0x30000, 0x7a0000},        /* Stock: name os-image base 0x30000 size 0x100000 */
 416                                                                 /* Stock: name file-system base 0x130000 size 0x6a0000 */
 417                         {"user-config", 0x7d0000, 0x04000},
 418                         {"default-mac", 0x7e0000, 0x00100},
 419                         {"device-id", 0x7e0100, 0x00100},
 420                         {"extra-para", 0x7e0200, 0x00100},
 421                         {"pin", 0x7e0300, 0x00100},
 422                         {"support-list", 0x7e0400, 0x00400},
 423                         {"soft-version", 0x7e0800, 0x00400},
 424                         {"product-info", 0x7e0c00, 0x01400},
 425                         {"partition-table", 0x7e2000, 0x01000},
 426                         {"profile", 0x7e3000, 0x01000},
 427                         {"default-config", 0x7e4000, 0x04000},
 428                         {"merge-config", 0x7ec000, 0x02000},
 429                         {"qos-db", 0x7ee000, 0x02000},
 430                         {"radio", 0x7f0000, 0x10000},
 431                         {NULL, 0, 0}
 432                 },
 433
 434                 .first_sysupgrade_partition = "os-image",
 435                 .last_sysupgrade_partition = "file-system",
 436         },
 437
 438         /** Firmware layout for the C58v1 */
 439         {
 440                 .id     = "ARCHER-C58-V1",
 441                 .vendor = "",
 442                 .support_list =
 443                         "SupportList:\r\n"
 444                         "{product_name:Archer C58,product_ver:1.0.0,special_id:00000000}\r\n"
 445                         "{product_name:Archer C58,product_ver:1.0.0,special_id:45550000}\r\n"
 446                         "{product_name:Archer C58,product_ver:1.0.0,special_id:55530000}\r\n",
 447                 .support_trail = '\x00',
 448                 .soft_ver = "soft_ver:1.0.0\n",
 449
 450                 .partitions = {
 451                         {"fs-uboot", 0x00000, 0x10000},
 452                         {"default-mac", 0x10000, 0x00200},
 453                         {"pin", 0x10200, 0x00200},
 454                         {"product-info", 0x10400, 0x00100},
 455                         {"partition-table", 0x10500, 0x00800},
 456                         {"soft-version", 0x11300, 0x00200},
 457                         {"support-list", 0x11500, 0x00100},
 458                         {"device-id", 0x11600, 0x00100},
 459                         {"profile", 0x11700, 0x03900},
 460                         {"default-config", 0x15000, 0x04000},
 461                         {"user-config", 0x19000, 0x04000},
 462                         {"firmware", 0x20000, 0x7c8000},
 463                         {"certyficate", 0x7e8000, 0x08000},
 464                         {"radio", 0x7f0000, 0x10000},
 465                         {NULL, 0, 0}
 466                 },
 467
 468                 .first_sysupgrade_partition = "os-image",
 469                 .last_sysupgrade_partition = "file-system",
 470         },
 471
 472         /** Firmware layout for the C59v1 */
 473         {
 474                 .id     = "ARCHER-C59-V1",
 475                 .vendor = "",
 476                 .support_list =
 477                         "SupportList:\r\n"
 478                         "{product_name:Archer C59,product_ver:1.0.0,special_id:00000000}\r\n"
 479                         "{product_name:Archer C59,product_ver:1.0.0,special_id:45550000}\r\n"
 480                         "{product_name:Archer C59,product_ver:1.0.0,special_id:52550000}\r\n"
 481                         "{product_name:Archer C59,product_ver:1.0.0,special_id:55530000}\r\n",
 482                 .support_trail = '\x00',
 483                 .soft_ver = "soft_ver:1.0.0\n",
 484
 485                 /* We're using a dynamic kernel/rootfs split here */
 486                 .partitions = {
 487                         {"fs-uboot", 0x00000, 0x10000},
 488                         {"default-mac", 0x10000, 0x00200},
 489                         {"pin", 0x10200, 0x00200},
 490                         {"device-id", 0x10400, 0x00100},
 491                         {"product-info", 0x10500, 0x0fb00},
 492                         {"firmware", 0x20000, 0xe30000},
 493                         {"partition-table", 0xe50000, 0x10000},
 494                         {"soft-version", 0xe60000, 0x10000},
 495                         {"support-list", 0xe70000, 0x10000},
 496                         {"profile", 0xe80000, 0x10000},
 497                         {"default-config", 0xe90000, 0x10000},
 498                         {"user-config", 0xea0000, 0x40000},
 499                         {"usb-config", 0xee0000, 0x10000},
 500                         {"certificate", 0xef0000, 0x10000},
 501                         {"qos-db", 0xf00000, 0x40000},
 502                         {"log", 0xfe0000, 0x10000},
 503                         {"radio", 0xff0000, 0x10000},
 504                         {NULL, 0, 0}
 505                 },
 506
 507                 .first_sysupgrade_partition = "os-image",
 508                 .last_sysupgrade_partition = "file-system",
 509         },
 510
 511         /** Firmware layout for the C59v2 */
 512         {
 513                 .id     = "ARCHER-C59-V2",
 514                 .vendor = "",
 515                 .support_list =
 516                         "SupportList:\r\n"
 517                         "{product_name:Archer C59,product_ver:2.0.0,special_id:00000000}\r\n"
 518                         "{product_name:Archer C59,product_ver:2.0.0,special_id:45550000}\r\n"
 519                         "{product_name:Archer C59,product_ver:2.0.0,special_id:55530000}\r\n",
 520                 .support_trail = '\x00',
 521                 .soft_ver = "soft_ver:2.0.0 Build 20161206 rel.7303\n",
 522
 523                 /** We're using a dynamic kernel/rootfs split here */
 524                 .partitions = {
 525                         {"factory-boot", 0x00000, 0x20000},
 526                         {"fs-uboot", 0x20000, 0x10000},
 527                         {"default-mac", 0x30000, 0x00200},
 528                         {"pin", 0x30200, 0x00200},
 529                         {"device-id", 0x30400, 0x00100},
 530                         {"product-info", 0x30500, 0x0fb00},
 531                         {"firmware", 0x40000, 0xe10000},
 532                         {"partition-table", 0xe50000, 0x10000},
 533                         {"soft-version", 0xe60000, 0x10000},
 534                         {"support-list", 0xe70000, 0x10000},
 535                         {"profile", 0xe80000, 0x10000},
 536                         {"default-config", 0xe90000, 0x10000},
 537                         {"user-config", 0xea0000, 0x40000},
 538                         {"usb-config", 0xee0000, 0x10000},
 539                         {"certificate", 0xef0000, 0x10000},
 540                         {"extra-para", 0xf00000, 0x10000},
 541                         {"qos-db", 0xf10000, 0x30000},
 542                         {"log", 0xfe0000, 0x10000},
 543                         {"radio", 0xff0000, 0x10000},
 544                         {NULL, 0, 0}
 545                 },
 546
 547                 .first_sysupgrade_partition = "os-image",
 548                 .last_sysupgrade_partition = "file-system",
 549         },
 550
 551         /** Firmware layout for the C6v2 */
 552         {
 553                 .id     = "ARCHER-C6-V2",
 554                 .vendor = "",
 555                 .support_list =
 556                         "SupportList:\r\n"
 557                         "{product_name:Archer C6,product_ver:2.0.0,special_id:45550000}\r\n"
 558                         "{product_name:Archer C6,product_ver:2.0.0,special_id:52550000}\r\n"
 559                         "{product_name:Archer C6,product_ver:2.0.0,special_id:4A500000}\r\n",
 560                 .support_trail = '\x00',
 561                 .soft_ver = "soft_ver:1.0.0\n",
 562
 563                 .partitions = {
 564                         {"fs-uboot", 0x00000, 0x20000},
 565                         {"default-mac", 0x20000, 0x00200},
 566                         {"pin", 0x20200, 0x00100},
 567                         {"product-info", 0x20300, 0x00200},
 568                         {"device-id", 0x20500, 0x0fb00},
 569                         {"firmware", 0x30000, 0x7a9400},
 570                         {"soft-version", 0x7d9400, 0x00100},
 571                         {"extra-para", 0x7d9500, 0x00100},
 572                         {"support-list", 0x7d9600, 0x00200},
 573                         {"profile", 0x7d9800, 0x03000},
 574                         {"default-config", 0x7dc800, 0x03000},
 575                         {"partition-table", 0x7df800, 0x00800},
 576                         {"user-config", 0x7e0000, 0x0c000},
 577                         {"certificate", 0x7ec000, 0x04000},
 578                         {"radio", 0x7f0000, 0x10000},
 579                         {NULL, 0, 0}
 580                 },
 581
 582                 .first_sysupgrade_partition = "os-image",
 583                 .last_sysupgrade_partition = "file-system",
 584         },
 585
 586
 587         /** Firmware layout for the C60v1 */
 588         {
 589                 .id     = "ARCHER-C60-V1",
 590                 .vendor = "",
 591                 .support_list =
 592                         "SupportList:\r\n"
 593                         "{product_name:Archer C60,product_ver:1.0.0,special_id:00000000}\r\n"
 594                         "{product_name:Archer C60,product_ver:1.0.0,special_id:45550000}\r\n"
 595                         "{product_name:Archer C60,product_ver:1.0.0,special_id:55530000}\r\n",
 596                 .support_trail = '\x00',
 597                 .soft_ver = "soft_ver:1.0.0\n",
 598
 599                 .partitions = {
 600                         {"fs-uboot", 0x00000, 0x10000},
 601                         {"default-mac", 0x10000, 0x00200},
 602                         {"pin", 0x10200, 0x00200},
 603                         {"product-info", 0x10400, 0x00100},
 604                         {"partition-table", 0x10500, 0x00800},
 605                         {"soft-version", 0x11300, 0x00200},
 606                         {"support-list", 0x11500, 0x00100},
 607                         {"device-id", 0x11600, 0x00100},
 608                         {"profile", 0x11700, 0x03900},
 609                         {"default-config", 0x15000, 0x04000},
 610                         {"user-config", 0x19000, 0x04000},
 611                         {"firmware", 0x20000, 0x7c8000},
 612                         {"certyficate", 0x7e8000, 0x08000},
 613                         {"radio", 0x7f0000, 0x10000},
 614                         {NULL, 0, 0}
 615                 },
 616
 617                 .first_sysupgrade_partition = "os-image",
 618                 .last_sysupgrade_partition = "file-system",
 619         },
 620
 621         /** Firmware layout for the C60v2 */
 622         {
 623                 .id     = "ARCHER-C60-V2",
 624                 .vendor = "",
 625                 .support_list =
 626                         "SupportList:\r\n"
 627                         "{product_name:Archer C60,product_ver:2.0.0,special_id:42520000}\r\n"
 628                         "{product_name:Archer C60,product_ver:2.0.0,special_id:45550000}\r\n"
 629                         "{product_name:Archer C60,product_ver:2.0.0,special_id:55530000}\r\n",
 630                 .support_trail = '\x00',
 631                 .soft_ver = "soft_ver:2.0.0\n",
 632
 633                 .partitions = {
 634                         {"factory-boot", 0x00000, 0x1fb00},
 635                         {"default-mac", 0x1fb00, 0x00200},
 636                         {"pin", 0x1fd00, 0x00100},
 637                         {"product-info", 0x1fe00, 0x00100},
 638                         {"device-id", 0x1ff00, 0x00100},
 639                         {"fs-uboot", 0x20000, 0x10000},
 640                         {"firmware", 0x30000, 0x7a0000},
 641                         {"soft-version", 0x7d9500, 0x00100},
 642                         {"support-list", 0x7d9600, 0x00100},
 643                         {"extra-para", 0x7d9700, 0x00100},
 644                         {"profile", 0x7d9800, 0x03000},
 645                         {"default-config", 0x7dc800, 0x03000},
 646                         {"partition-table", 0x7df800, 0x00800},
 647                         {"user-config", 0x7e0000, 0x0c000},
 648                         {"certificate", 0x7ec000, 0x04000},
 649                         {"radio", 0x7f0000, 0x10000},
 650                         {NULL, 0, 0}
 651                 },
 652
 653                 .first_sysupgrade_partition = "os-image",
 654                 .last_sysupgrade_partition = "file-system",
 655         },
 656
 657         /** Firmware layout for the C5 */
 658         {
 659                 .id = "ARCHER-C5-V2",
 660                 .vendor = "",
 661                 .support_list =
 662                         "SupportList:\r\n"
 663                         "{product_name:ArcherC5,product_ver:2.0.0,special_id:00000000}\r\n"
 664                         "{product_name:ArcherC5,product_ver:2.0.0,special_id:55530000}\r\n"
 665                         "{product_name:ArcherC5,product_ver:2.0.0,special_id:4A500000}\r\n", /* JP version */
 666                 .support_trail = '\x00',
 667                 .soft_ver = NULL,
 668
 669                 .partitions = {
 670                         {"fs-uboot", 0x00000, 0x40000},
 671                         {"os-image", 0x40000, 0x200000},
 672                         {"file-system", 0x240000, 0xc00000},
 673                         {"default-mac", 0xe40000, 0x00200},
 674                         {"pin", 0xe40200, 0x00200},
 675                         {"product-info", 0xe40400, 0x00200},
 676                         {"partition-table", 0xe50000, 0x10000},
 677                         {"soft-version", 0xe60000, 0x00200},
 678                         {"support-list", 0xe61000, 0x0f000},
 679                         {"profile", 0xe70000, 0x10000},
 680                         {"default-config", 0xe80000, 0x10000},
 681                         {"user-config", 0xe90000, 0x50000},
 682                         {"log", 0xee0000, 0x100000},
 683                         {"radio_bk", 0xfe0000, 0x10000},
 684                         {"radio", 0xff0000, 0x10000},
 685                         {NULL, 0, 0}
 686                 },
 687
 688                 .first_sysupgrade_partition = "os-image",
 689                 .last_sysupgrade_partition = "file-system"
 690         },
 691
 692         /** Firmware layout for the C7 */
 693         {
 694                 .id = "ARCHER-C7-V4",
 695                 .support_list =
 696                         "SupportList:\n"
 697                         "{product_name:Archer C7,product_ver:4.0.0,special_id:00000000}\n"
 698                         "{product_name:Archer C7,product_ver:4.0.0,special_id:41550000}\n"
 699                         "{product_name:Archer C7,product_ver:4.0.0,special_id:45550000}\n"
 700                         "{product_name:Archer C7,product_ver:4.0.0,special_id:4B520000}\n"
 701                         "{product_name:Archer C7,product_ver:4.0.0,special_id:42520000}\n"
 702                         "{product_name:Archer C7,product_ver:4.0.0,special_id:4A500000}\n"
 703                         "{product_name:Archer C7,product_ver:4.0.0,special_id:52550000}\n"
 704                         "{product_name:Archer C7,product_ver:4.0.0,special_id:54570000}\n"
 705                         "{product_name:Archer C7,product_ver:4.0.0,special_id:55530000}\n"
 706                         "{product_name:Archer C7,product_ver:4.0.0,special_id:43410000}\n",
 707                 .support_trail = '\x00',
 708                 .soft_ver = "soft_ver:1.0.0\n",
 709
 710                 /* We're using a dynamic kernel/rootfs split here */
 711                 .partitions = {
 712                         {"factory-boot", 0x00000, 0x20000},
 713                         {"fs-uboot", 0x20000, 0x20000},
 714                         {"firmware", 0x40000, 0xEC0000},        /* Stock: name os-image base 0x40000 size 0x120000 */
 715                                                                 /* Stock: name file-system base 0x160000 size 0xda0000 */
 716                         {"default-mac", 0xf00000, 0x00200},
 717                         {"pin", 0xf00200, 0x00200},
 718                         {"device-id", 0xf00400, 0x00100},
 719                         {"product-info", 0xf00500, 0x0fb00},
 720                         {"soft-version", 0xf10000, 0x00100},
 721                         {"extra-para", 0xf11000, 0x01000},
 722                         {"support-list", 0xf12000, 0x0a000},
 723                         {"profile", 0xf1c000, 0x04000},
 724                         {"default-config", 0xf20000, 0x10000},
 725                         {"user-config", 0xf30000, 0x40000},
 726                         {"qos-db", 0xf70000, 0x40000},
 727                         {"certificate", 0xfb0000, 0x10000},
 728                         {"partition-table", 0xfc0000, 0x10000},
 729                         {"log", 0xfd0000, 0x20000},
 730                         {"radio", 0xff0000, 0x10000},
 731                         {NULL, 0, 0}
 732                 },
 733
 734                 .first_sysupgrade_partition = "os-image",
 735                 .last_sysupgrade_partition = "file-system",
 736         },
 737
 738         /** Firmware layout for the C7 v5*/
 739         {
 740                 .id = "ARCHER-C7-V5",
 741                 .support_list =
 742                         "SupportList:\n"
 743                         "{product_name:Archer C7,product_ver:5.0.0,special_id:00000000}\n"
 744                         "{product_name:Archer C7,product_ver:5.0.0,special_id:45550000}\n"
 745                         "{product_name:Archer C7,product_ver:5.0.0,special_id:55530000}\n"
 746                         "{product_name:Archer C7,product_ver:5.0.0,special_id:43410000}\n"
 747                         "{product_name:Archer C7,product_ver:5.0.0,special_id:4A500000}\n"
 748                         "{product_name:Archer C7,product_ver:5.0.0,special_id:54570000}\n",
 749
 750                 .support_trail = '\x00',
 751                 .soft_ver = "soft_ver:1.0.0\n",
 752
 753                 /* We're using a dynamic kernel/rootfs split here */
 754                 .partitions = {
 755                         {"factory-boot",    0x00000,  0x20000},
 756                         {"fs-uboot",        0x20000,  0x20000},
 757                         {"partition-table", 0x40000,  0x10000},
 758                         {"radio",           0x50000,  0x10000},
 759                         {"default-mac",     0x60000,  0x00200},
 760                         {"pin",             0x60200,  0x00200},
 761                         {"device-id",       0x60400,  0x00100},
 762                         {"product-info",    0x60500,  0x0fb00},
 763                         {"soft-version",    0x70000,  0x01000},
 764                         {"extra-para",      0x71000,  0x01000},
 765                         {"support-list",    0x72000,  0x0a000},
 766                         {"profile",         0x7c000,  0x04000},
 767                         {"user-config",     0x80000,  0x40000},
 768
 769
 770                         {"firmware",        0xc0000,  0xf00000},        /* Stock: name os-image base 0xc0000  size 0x120000 */
 771                                                                         /* Stock: name file-system base 0x1e0000 size 0xde0000 */
 772
 773                         {"log",             0xfc0000, 0x20000},
 774                         {"certificate",     0xfe0000, 0x10000},
 775                         {"default-config",  0xff0000, 0x10000},
 776                         {NULL, 0, 0}
 777
 778                 },
 779
 780                 .first_sysupgrade_partition = "os-image",
 781                 .last_sysupgrade_partition = "file-system",
 782         },
 783
 784         /** Firmware layout for the C9 */
 785         {
 786                 .id = "ARCHERC9",
 787                 .vendor = "",
 788                 .support_list =
 789                         "SupportList:\n"
 790                         "{product_name:ArcherC9,"
 791                         "product_ver:1.0.0,"
 792                         "special_id:00000000}\n",
 793                 .support_trail = '\x00',
 794                 .soft_ver = NULL,
 795
 796                 .partitions = {
 797                         {"fs-uboot", 0x00000, 0x40000},
 798                         {"os-image", 0x40000, 0x200000},
 799                         {"file-system", 0x240000, 0xc00000},
 800                         {"default-mac", 0xe40000, 0x00200},
 801                         {"pin", 0xe40200, 0x00200},
 802                         {"product-info", 0xe40400, 0x00200},
 803                         {"partition-table", 0xe50000, 0x10000},
 804                         {"soft-version", 0xe60000, 0x00200},
 805                         {"support-list", 0xe61000, 0x0f000},
 806                         {"profile", 0xe70000, 0x10000},
 807                         {"default-config", 0xe80000, 0x10000},
 808                         {"user-config", 0xe90000, 0x50000},
 809                         {"log", 0xee0000, 0x100000},
 810                         {"radio_bk", 0xfe0000, 0x10000},
 811                         {"radio", 0xff0000, 0x10000},
 812                         {NULL, 0, 0}
 813                 },
 814
 815                 .first_sysupgrade_partition = "os-image",
 816                 .last_sysupgrade_partition = "file-system"
 817         },
 818
 819         /** Firmware layout for the EAP120 */
 820         {
 821                 .id     = "EAP120",
 822                 .vendor = "EAP120(TP-LINK|UN|N300-2):1.0\r\n",
 823                 .support_list =
 824                         "SupportList:\r\n"
 825                         "EAP120(TP-LINK|UN|N300-2):1.0\r\n",
 826                 .support_trail = '\xff',
 827                 .soft_ver = NULL,
 828
 829                 .partitions = {
 830                         {"fs-uboot", 0x00000, 0x20000},
 831                         {"partition-table", 0x20000, 0x02000},
 832                         {"default-mac", 0x30000, 0x00020},
 833                         {"support-list", 0x31000, 0x00100},
 834                         {"product-info", 0x31100, 0x00100},
 835                         {"soft-version", 0x32000, 0x00100},
 836                         {"os-image", 0x40000, 0x180000},
 837                         {"file-system", 0x1c0000, 0x600000},
 838                         {"user-config", 0x7c0000, 0x10000},
 839                         {"backup-config", 0x7d0000, 0x10000},
 840                         {"log", 0x7e0000, 0x10000},
 841                         {"radio", 0x7f0000, 0x10000},
 842                         {NULL, 0, 0}
 843                 },
 844
 845                 .first_sysupgrade_partition = "os-image",
 846                 .last_sysupgrade_partition = "file-system"
 847         },
 848
 849         /** Firmware layout for the TL-WA850RE v2 */
 850         {
 851                 .id     = "TLWA850REV2",
 852                 .vendor = "",
 853                 .support_list =
 854                         "SupportList:\n"
 855                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:55530000}\n"
 856                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:00000000}\n"
 857                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:55534100}\n"
 858                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:45550000}\n"
 859                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:4B520000}\n"
 860                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:42520000}\n"
 861                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:4A500000}\n"
 862                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:43410000}\n"
 863                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:41550000}\n"
 864                         "{product_name:TL-WA850RE,product_ver:2.0.0,special_id:52550000}\n",
 865                 .support_trail = '\x00',
 866                 .soft_ver = NULL,
 867
 868                 /**
 869                    576KB were moved from file-system to os-image
 870                    in comparison to the stock image
 871                 */
 872                 .partitions = {
 873                         {"fs-uboot", 0x00000, 0x20000},
 874                         {"os-image", 0x20000, 0x150000},
 875                         {"file-system", 0x170000, 0x240000},
 876                         {"partition-table", 0x3b0000, 0x02000},
 877                         {"default-mac", 0x3c0000, 0x00020},
 878                         {"pin", 0x3c0100, 0x00020},
 879                         {"product-info", 0x3c1000, 0x01000},
 880                         {"soft-version", 0x3c2000, 0x00100},
 881                         {"support-list", 0x3c3000, 0x01000},
 882                         {"profile", 0x3c4000, 0x08000},
 883                         {"user-config", 0x3d0000, 0x10000},
 884                         {"default-config", 0x3e0000, 0x10000},
 885                         {"radio", 0x3f0000, 0x10000},
 886                         {NULL, 0, 0}
 887                 },
 888
 889                 .first_sysupgrade_partition = "os-image",
 890                 .last_sysupgrade_partition = "file-system"
 891         },
 892
 893         /** Firmware layout for the TL-WA855RE v1 */
 894         {
 895                 .id     = "TLWA855REV1",
 896                 .vendor = "",
 897                 .support_list =
 898                         "SupportList:\n"
 899                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:00000000}\n"
 900                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:55530000}\n"
 901                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:45550000}\n"
 902                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:4B520000}\n"
 903                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:42520000}\n"
 904                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:4A500000}\n"
 905                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:43410000}\n"
 906                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:41550000}\n"
 907                         "{product_name:TL-WA855RE,product_ver:1.0.0,special_id:52550000}\n",
 908                 .support_trail = '\x00',
 909                 .soft_ver = NULL,
 910
 911                 .partitions = {
 912                         {"fs-uboot", 0x00000, 0x20000},
 913                         {"os-image", 0x20000, 0x150000},
 914                         {"file-system", 0x170000, 0x240000},
 915                         {"partition-table", 0x3b0000, 0x02000},
 916                         {"default-mac", 0x3c0000, 0x00020},
 917                         {"pin", 0x3c0100, 0x00020},
 918                         {"product-info", 0x3c1000, 0x01000},
 919                         {"soft-version", 0x3c2000, 0x00100},
 920                         {"support-list", 0x3c3000, 0x01000},
 921                         {"profile", 0x3c4000, 0x08000},
 922                         {"user-config", 0x3d0000, 0x10000},
 923                         {"default-config", 0x3e0000, 0x10000},
 924                         {"radio", 0x3f0000, 0x10000},
 925                         {NULL, 0, 0}
 926                 },
 927
 928                 .first_sysupgrade_partition = "os-image",
 929                 .last_sysupgrade_partition = "file-system"
 930         },
 931
 932         /** Firmware layout for the TL-WR1043 v5 */
 933         {
 934                 .id     = "TLWR1043NV5",
 935                 .vendor = "",
 936                 .support_list =
 937                         "SupportList:\n"
 938                         "{product_name:TL-WR1043N,product_ver:5.0.0,special_id:45550000}\n"
 939                         "{product_name:TL-WR1043N,product_ver:5.0.0,special_id:55530000}\n",
 940                 .support_trail = '\x00',
 941                 .soft_ver = "soft_ver:1.0.0\n",
 942                 .partitions = {
 943                         {"factory-boot", 0x00000, 0x20000},
 944                         {"fs-uboot", 0x20000, 0x20000},
 945                         {"firmware", 0x40000, 0xec0000},
 946                         {"default-mac", 0xf00000, 0x00200},
 947                         {"pin", 0xf00200, 0x00200},
 948                         {"device-id", 0xf00400, 0x00100},
 949                         {"product-info", 0xf00500, 0x0fb00},
 950                         {"soft-version", 0xf10000, 0x01000},
 951                         {"extra-para", 0xf11000, 0x01000},
 952                         {"support-list", 0xf12000, 0x0a000},
 953                         {"profile", 0xf1c000, 0x04000},
 954                         {"default-config", 0xf20000, 0x10000},
 955                         {"user-config", 0xf30000, 0x40000},
 956                         {"qos-db", 0xf70000, 0x40000},
 957                         {"certificate", 0xfb0000, 0x10000},
 958                         {"partition-table", 0xfc0000, 0x10000},
 959                         {"log", 0xfd0000, 0x20000},
 960                         {"radio", 0xff0000, 0x10000},
 961                         {NULL, 0, 0}
 962                 },
 963                 .first_sysupgrade_partition = "os-image",
 964                 .last_sysupgrade_partition = "file-system"
 965         },
 966
 967         /** Firmware layout for the TL-WR1043 v4 */
 968         {
 969                 .id     = "TLWR1043NDV4",
 970                 .vendor = "",
 971                 .support_list =
 972                         "SupportList:\n"
 973                         "{product_name:TL-WR1043ND,product_ver:4.0.0,special_id:45550000}\n",
 974                 .support_trail = '\x00',
 975                 .soft_ver = NULL,
 976
 977                 /* We're using a dynamic kernel/rootfs split here */
 978                 .partitions = {
 979                         {"fs-uboot", 0x00000, 0x20000},
 980                         {"firmware", 0x20000, 0xf30000},
 981                         {"default-mac", 0xf50000, 0x00200},
 982                         {"pin", 0xf50200, 0x00200},
 983                         {"product-info", 0xf50400, 0x0fc00},
 984                         {"soft-version", 0xf60000, 0x0b000},
 985                         {"support-list", 0xf6b000, 0x04000},
 986                         {"profile", 0xf70000, 0x04000},
 987                         {"default-config", 0xf74000, 0x0b000},
 988                         {"user-config", 0xf80000, 0x40000},
 989                         {"partition-table", 0xfc0000, 0x10000},
 990                         {"log", 0xfd0000, 0x20000},
 991                         {"radio", 0xff0000, 0x10000},
 992                         {NULL, 0, 0}
 993                 },
 994
 995                 .first_sysupgrade_partition = "os-image",
 996                 .last_sysupgrade_partition = "file-system"
 997         },
 998
 999         /** Firmware layout for the TL-WR902AC v1 */
1000         {
1001                 .id     = "TL-WR902AC-V1",
1002                 .vendor = "",
1003                 .support_list =
1004                         "SupportList:\n"
1005                         "{product_name:TL-WR902AC,product_ver:1.0.0,special_id:45550000}\n"
1006                         "{product_name:TL-WR902AC,product_ver:1.0.0,special_id:55530000}\n",
1007                 .support_trail = '\x00',
1008                 .soft_ver = NULL,
1009
1010                 /**
1011                    384KB were moved from file-system to os-image
1012                    in comparison to the stock image
1013                 */
1014                 .partitions = {
1015                         {"fs-uboot", 0x00000, 0x20000},
1016                         {"firmware", 0x20000, 0x730000},
1017                         {"default-mac", 0x750000, 0x00200},
1018                         {"pin", 0x750200, 0x00200},
1019                         {"product-info", 0x750400, 0x0fc00},
1020                         {"soft-version", 0x760000, 0x0b000},
1021                         {"support-list", 0x76b000, 0x04000},
1022                         {"profile", 0x770000, 0x04000},
1023                         {"default-config", 0x774000, 0x0b000},
1024                         {"user-config", 0x780000, 0x40000},
1025                         {"partition-table", 0x7c0000, 0x10000},
1026                         {"log", 0x7d0000, 0x20000},
1027                         {"radio", 0x7f0000, 0x10000},
1028                         {NULL, 0, 0}
1029                 },
1030
1031                 .first_sysupgrade_partition = "os-image",
1032                 .last_sysupgrade_partition = "file-system",
1033         },
1034
1035         /** Firmware layout for the TL-WR942N V1 */
1036         {
1037                 .id     = "TLWR942NV1",
1038                 .vendor = "",
1039                 .support_list =
1040                         "SupportList:\r\n"
1041                         "{product_name:TL-WR942N,product_ver:1.0.0,special_id:00000000}\r\n"
1042                         "{product_name:TL-WR942N,product_ver:1.0.0,special_id:52550000}\r\n",
1043                 .support_trail = '\x00',
1044                 .soft_ver = NULL,
1045
1046                 .partitions = {
1047                         {"fs-uboot", 0x00000, 0x20000},
1048                         {"firmware", 0x20000, 0xe20000},
1049                         {"default-mac", 0xe40000, 0x00200},
1050                         {"pin", 0xe40200, 0x00200},
1051                         {"product-info", 0xe40400, 0x0fc00},
1052                         {"partition-table", 0xe50000, 0x10000},
1053                         {"soft-version", 0xe60000, 0x10000},
1054                         {"support-list", 0xe70000, 0x10000},
1055                         {"profile", 0xe80000, 0x10000},
1056                         {"default-config", 0xe90000, 0x10000},
1057                         {"user-config", 0xea0000, 0x40000},
1058                         {"qos-db", 0xee0000, 0x40000},
1059                         {"certificate", 0xf20000, 0x10000},
1060                         {"usb-config", 0xfb0000, 0x10000},
1061                         {"log", 0xfc0000, 0x20000},
1062                         {"radio-bk", 0xfe0000, 0x10000},
1063                         {"radio", 0xff0000, 0x10000},
1064                         {NULL, 0, 0}
1065                 },
1066
1067                 .first_sysupgrade_partition = "os-image",
1068                 .last_sysupgrade_partition = "file-system",
1069         },
1070
1071         /** Firmware layout for the RE350 v1 */
1072         {
1073                 .id = "RE350-V1",
1074                 .vendor = "",
1075                 .support_list =
1076                         "SupportList:\n"
1077                         "{product_name:RE350,product_ver:1.0.0,special_id:45550000}\n"
1078                         "{product_name:RE350,product_ver:1.0.0,special_id:00000000}\n"
1079                         "{product_name:RE350,product_ver:1.0.0,special_id:41550000}\n"
1080                         "{product_name:RE350,product_ver:1.0.0,special_id:55530000}\n"
1081                         "{product_name:RE350,product_ver:1.0.0,special_id:43410000}\n"
1082                         "{product_name:RE350,product_ver:1.0.0,special_id:4b520000}\n"
1083                         "{product_name:RE350,product_ver:1.0.0,special_id:4a500000}\n",
1084                 .support_trail = '\x00',
1085                 .soft_ver = NULL,
1086
1087                 /** We're using a dynamic kernel/rootfs split here */
1088                 .partitions = {
1089                         {"fs-uboot", 0x00000, 0x20000},
1090                         {"firmware", 0x20000, 0x5e0000},
1091                         {"partition-table", 0x600000, 0x02000},
1092                         {"default-mac", 0x610000, 0x00020},
1093                         {"pin", 0x610100, 0x00020},
1094                         {"product-info", 0x611100, 0x01000},
1095                         {"soft-version", 0x620000, 0x01000},
1096                         {"support-list", 0x621000, 0x01000},
1097                         {"profile", 0x622000, 0x08000},
1098                         {"user-config", 0x630000, 0x10000},
1099                         {"default-config", 0x640000, 0x10000},
1100                         {"radio", 0x7f0000, 0x10000},
1101                         {NULL, 0, 0}
1102                 },
1103
1104                 .first_sysupgrade_partition = "os-image",
1105                 .last_sysupgrade_partition = "file-system"
1106         },
1107
1108         /** Firmware layout for the RE355 */
1109         {
1110                 .id = "RE355",
1111                 .vendor = "",
1112                 .support_list =
1113                         "SupportList:\r\n"
1114                         "{product_name:RE355,product_ver:1.0.0,special_id:00000000}\r\n"
1115                         "{product_name:RE355,product_ver:1.0.0,special_id:55530000}\r\n"
1116                         "{product_name:RE355,product_ver:1.0.0,special_id:45550000}\r\n"
1117                         "{product_name:RE355,product_ver:1.0.0,special_id:4A500000}\r\n"
1118                         "{product_name:RE355,product_ver:1.0.0,special_id:43410000}\r\n"
1119                         "{product_name:RE355,product_ver:1.0.0,special_id:41550000}\r\n"
1120                         "{product_name:RE355,product_ver:1.0.0,special_id:4B520000}\r\n"
1121                         "{product_name:RE355,product_ver:1.0.0,special_id:55534100}\r\n",
1122                 .support_trail = '\x00',
1123                 .soft_ver = NULL,
1124
1125                 /* We're using a dynamic kernel/rootfs split here */
1126                 .partitions = {
1127                         {"fs-uboot", 0x00000, 0x20000},
1128                         {"firmware", 0x20000, 0x5e0000},
1129                         {"partition-table", 0x600000, 0x02000},
1130                         {"default-mac", 0x610000, 0x00020},
1131                         {"pin", 0x610100, 0x00020},
1132                         {"product-info", 0x611100, 0x01000},
1133                         {"soft-version", 0x620000, 0x01000},
1134                         {"support-list", 0x621000, 0x01000},
1135                         {"profile", 0x622000, 0x08000},
1136                         {"user-config", 0x630000, 0x10000},
1137                         {"default-config", 0x640000, 0x10000},
1138                         {"radio", 0x7f0000, 0x10000},
1139                         {NULL, 0, 0}
1140                 },
1141
1142                 .first_sysupgrade_partition = "os-image",
1143                 .last_sysupgrade_partition = "file-system"
1144         },
1145
1146         /** Firmware layout for the RE450 */
1147         {
1148                 .id = "RE450",
1149                 .vendor = "",
1150                 .support_list =
1151                         "SupportList:\r\n"
1152                         "{product_name:RE450,product_ver:1.0.0,special_id:00000000}\r\n"
1153                         "{product_name:RE450,product_ver:1.0.0,special_id:55530000}\r\n"
1154                         "{product_name:RE450,product_ver:1.0.0,special_id:45550000}\r\n"
1155                         "{product_name:RE450,product_ver:1.0.0,special_id:4A500000}\r\n"
1156                         "{product_name:RE450,product_ver:1.0.0,special_id:43410000}\r\n"
1157                         "{product_name:RE450,product_ver:1.0.0,special_id:41550000}\r\n"
1158                         "{product_name:RE450,product_ver:1.0.0,special_id:4B520000}\r\n"
1159                         "{product_name:RE450,product_ver:1.0.0,special_id:55534100}\r\n",
1160                 .support_trail = '\x00',
1161                 .soft_ver = NULL,
1162
1163                 /** We're using a dynamic kernel/rootfs split here */
1164                 .partitions = {
1165                         {"fs-uboot", 0x00000, 0x20000},
1166                         {"firmware", 0x20000, 0x5e0000},
1167                         {"partition-table", 0x600000, 0x02000},
1168                         {"default-mac", 0x610000, 0x00020},
1169                         {"pin", 0x610100, 0x00020},
1170                         {"product-info", 0x611100, 0x01000},
1171                         {"soft-version", 0x620000, 0x01000},
1172                         {"support-list", 0x621000, 0x01000},
1173                         {"profile", 0x622000, 0x08000},
1174                         {"user-config", 0x630000, 0x10000},
1175                         {"default-config", 0x640000, 0x10000},
1176                         {"radio", 0x7f0000, 0x10000},
1177                         {NULL, 0, 0}
1178                 },
1179
1180                 .first_sysupgrade_partition = "os-image",
1181                 .last_sysupgrade_partition = "file-system"
1182         },
1183
1184         /** Firmware layout for the RE450 v2 */
1185         {
1186                 .id = "RE450-V2",
1187                 .vendor = "",
1188                 .support_list =
1189                         "SupportList:\r\n"
1190                         "{product_name:RE450,product_ver:2.0.0,special_id:00000000}\r\n"
1191                         "{product_name:RE450,product_ver:2.0.0,special_id:55530000}\r\n"
1192                         "{product_name:RE450,product_ver:2.0.0,special_id:45550000}\r\n"
1193                         "{product_name:RE450,product_ver:2.0.0,special_id:4A500000}\r\n"
1194                         "{product_name:RE450,product_ver:2.0.0,special_id:43410000}\r\n"
1195                         "{product_name:RE450,product_ver:2.0.0,special_id:41550000}\r\n"
1196                         "{product_name:RE450,product_ver:2.0.0,special_id:41530000}\r\n"
1197                         "{product_name:RE450,product_ver:2.0.0,special_id:4B520000}\r\n"
1198                         "{product_name:RE450,product_ver:2.0.0,special_id:42520000}\r\n",
1199                 .support_trail = '\x00',
1200                 .soft_ver = NULL,
1201
1202                 /* We're using a dynamic kernel/rootfs split here */
1203                 .partitions = {
1204                         {"fs-uboot", 0x00000, 0x20000},
1205                         {"firmware", 0x20000, 0x5e0000},
1206                         {"partition-table", 0x600000, 0x02000},
1207                         {"default-mac", 0x610000, 0x00020},
1208                         {"pin", 0x610100, 0x00020},
1209                         {"product-info", 0x611100, 0x01000},
1210                         {"soft-version", 0x620000, 0x01000},
1211                         {"support-list", 0x621000, 0x01000},
1212                         {"profile", 0x622000, 0x08000},
1213                         {"user-config", 0x630000, 0x10000},
1214                         {"default-config", 0x640000, 0x10000},
1215                         {"radio", 0x7f0000, 0x10000},
1216
1217                         {NULL, 0, 0}
1218                 },
1219
1220                 .first_sysupgrade_partition = "os-image",
1221                 .last_sysupgrade_partition = "file-system"
1222         },
1223
1224         {}
1225 };
1226
1227 #define error(_ret, _errno, _str, ...)                          \
1228         do {                                                    \
1229                 fprintf(stderr, _str ": %s\n", ## __VA_ARGS__,  \
1230                         strerror(_errno));                      \
1231                 if (_ret)                                       \
1232                         exit(_ret);                             \
1233         } while (0)
1234
1235
1236 /** Stores a uint32 as big endian */
1237 static inline void put32(uint8_t *buf, uint32_t val) {
1238         buf[0] = val >> 24;
1239         buf[1] = val >> 16;
1240         buf[2] = val >> 8;
1241         buf[3] = val;
1242 }
1243
1244 /** Allocates a new image partition */
1245 static struct image_partition_entry alloc_image_partition(const char *name, size_t len) {
1246         struct image_partition_entry entry = {name, len, malloc(len)};
1247         if (!entry.data)
1248                 error(1, errno, "malloc");
1249
1250         return entry;
1251 }
1252
1253 /** Frees an image partition */
1254 static void free_image_partition(struct image_partition_entry entry) {
1255         free(entry.data);
1256 }
1257
1258 static time_t source_date_epoch = -1;
1259 static void set_source_date_epoch() {
1260         char *env = getenv("SOURCE_DATE_EPOCH");
1261         char *endptr = env;
1262         errno = 0;
1263         if (env && *env) {
1264                 source_date_epoch = strtoull(env, &endptr, 10);
1265                 if (errno || (endptr && *endptr != '\0')) {
1266                         fprintf(stderr, "Invalid SOURCE_DATE_EPOCH");
1267                         exit(1);
1268                 }
1269         }
1270 }
1271
1272 /** Generates the partition-table partition */
1273 static struct image_partition_entry make_partition_table(const struct flash_partition_entry *p) {
1274         struct image_partition_entry entry = alloc_image_partition("partition-table", 0x800);
1275
1276         char *s = (char *)entry.data, *end = (char *)(s+entry.size);
1277
1278         *(s++) = 0x00;
1279         *(s++) = 0x04;
1280         *(s++) = 0x00;
1281         *(s++) = 0x00;
1282
1283         size_t i;
1284         for (i = 0; p[i].name; i++) {
1285                 size_t len = end-s;
1286                 size_t w = snprintf(s, len, "partition %s base 0x%05x size 0x%05x\n", p[i].name, p[i].base, p[i].size);
1287
1288                 if (w > len-1)
1289                         error(1, 0, "flash partition table overflow?");
1290
1291                 s += w;
1292         }
1293
1294         s++;
1295
1296         memset(s, 0xff, end-s);
1297
1298         return entry;
1299 }
1300
1301
1302 /** Generates a binary-coded decimal representation of an integer in the range [0, 99] */
1303 static inline uint8_t bcd(uint8_t v) {
1304         return 0x10 * (v/10) + v%10;
1305 }
1306
1307
1308 /** Generates the soft-version partition */
1309 static struct image_partition_entry make_soft_version(uint32_t rev) {
1310         struct image_partition_entry entry = alloc_image_partition("soft-version", sizeof(struct soft_version));
1311         struct soft_version *s = (struct soft_version *)entry.data;
1312
1313         time_t t;
1314
1315         if (source_date_epoch != -1)
1316                 t = source_date_epoch;
1317         else if (time(&t) == (time_t)(-1))
1318                 error(1, errno, "time");
1319
1320         struct tm *tm = localtime(&t);
1321
1322         s->magic = htonl(0x0000000c);
1323         s->zero = 0;
1324         s->pad1 = 0xff;
1325
1326         s->version_major = 0;
1327         s->version_minor = 0;
1328         s->version_patch = 0;
1329
1330         s->year_hi = bcd((1900+tm->tm_year)/100);
1331         s->year_lo = bcd(tm->tm_year%100);
1332         s->month = bcd(tm->tm_mon+1);
1333         s->day = bcd(tm->tm_mday);
1334         s->rev = htonl(rev);
1335
1336         s->pad2 = 0xff;
1337
1338         return entry;
1339 }
1340
1341 static struct image_partition_entry make_soft_version_from_string(const char *soft_ver) {
1342         /** String length _including_ the terminating zero byte */
1343         uint32_t ver_len = strlen(soft_ver) + 1;
1344         /** Partition contains 64 bit header, the version string, and one additional null byte */
1345         size_t partition_len = 2*sizeof(uint32_t) + ver_len + 1;
1346         struct image_partition_entry entry = alloc_image_partition("soft-version", partition_len);
1347
1348         uint32_t *len = (uint32_t *)entry.data;
1349         len[0] = htonl(ver_len);
1350         len[1] = 0;
1351         memcpy(&len[2], soft_ver, ver_len);
1352
1353         entry.data[partition_len - 1] = 0;
1354
1355         return entry;
1356 }
1357
1358 /** Generates the support-list partition */
1359 static struct image_partition_entry make_support_list(struct device_info *info) {
1360         size_t len = strlen(info->support_list);
1361         struct image_partition_entry entry = alloc_image_partition("support-list", len + 9);
1362
1363         put32(entry.data, len);
1364         memset(entry.data+4, 0, 4);
1365         memcpy(entry.data+8, info->support_list, len);
1366         entry.data[len+8] = info->support_trail;
1367
1368         return entry;
1369 }
1370
1371 /** Creates a new image partition with an arbitrary name from a file */
1372 static struct image_partition_entry read_file(const char *part_name, const char *filename, bool add_jffs2_eof, struct flash_partition_entry *file_system_partition) {
1373         struct stat statbuf;
1374
1375         if (stat(filename, &statbuf) < 0)
1376                 error(1, errno, "unable to stat file `%s'", filename);
1377
1378         size_t len = statbuf.st_size;
1379
1380         if (add_jffs2_eof)
1381                 if (file_system_partition)
1382                         len = ALIGN(len + file_system_partition->base, 0x10000) + sizeof(jffs2_eof_mark) - file_system_partition->base;
1383                 else
1384                         len = ALIGN(len, 0x10000) + sizeof(jffs2_eof_mark);
1385
1386         struct image_partition_entry entry = alloc_image_partition(part_name, len);
1387
1388         FILE *file = fopen(filename, "rb");
1389         if (!file)
1390                 error(1, errno, "unable to open file `%s'", filename);
1391
1392         if (fread(entry.data, statbuf.st_size, 1, file) != 1)
1393                 error(1, errno, "unable to read file `%s'", filename);
1394
1395         if (add_jffs2_eof) {
1396                 uint8_t *eof = entry.data + statbuf.st_size, *end = entry.data+entry.size;
1397
1398                 memset(eof, 0xff, end - eof - sizeof(jffs2_eof_mark));
1399                 memcpy(end - sizeof(jffs2_eof_mark), jffs2_eof_mark, sizeof(jffs2_eof_mark));
1400         }
1401
1402         fclose(file);
1403
1404         return entry;
1405 }
1406
1407 /** Creates a new image partition from arbitrary data */
1408 static struct image_partition_entry put_data(const char *part_name, const char *datain, size_t len) {
1409
1410         struct image_partition_entry entry = alloc_image_partition(part_name, len);
1411
1412         memcpy(entry.data, datain, len);
1413
1414         return entry;
1415 }
1416
1417 /**
1418    Copies a list of image partitions into an image buffer and generates the image partition table while doing so
1419
1420    Example image partition table:
1421
1422      fwup-ptn partition-table base 0x00800 size 0x00800
1423      fwup-ptn os-image base 0x01000 size 0x113b45
1424      fwup-ptn file-system base 0x114b45 size 0x1d0004
1425      fwup-ptn support-list base 0x2e4b49 size 0x000d1
1426
1427    Each line of the partition table is terminated with the bytes 09 0d 0a ("\t\r\n"),
1428    the end of the partition table is marked with a zero byte.
1429
1430    The firmware image must contain at least the partition-table and support-list partitions
1431    to be accepted. There aren't any alignment constraints for the image partitions.
1432
1433    The partition-table partition contains the actual flash layout; partitions
1434    from the image partition table are mapped to the corresponding flash partitions during
1435    the firmware upgrade. The support-list partition contains a list of devices supported by
1436    the firmware image.
1437
1438    The base offsets in the firmware partition table are relative to the end
1439    of the vendor information block, so the partition-table partition will
1440    actually start at offset 0x1814 of the image.
1441
1442    I think partition-table must be the first partition in the firmware image.
1443 */
1444 static void put_partitions(uint8_t *buffer, const struct flash_partition_entry *flash_parts, const struct image_partition_entry *parts) {
1445         size_t i, j;
1446         char *image_pt = (char *)buffer, *end = image_pt + 0x800;
1447
1448         size_t base = 0x800;
1449         for (i = 0; parts[i].name; i++) {
1450                 for (j = 0; flash_parts[j].name; j++) {
1451                         if (!strcmp(flash_parts[j].name, parts[i].name)) {
1452                                 if (parts[i].size > flash_parts[j].size)
1453                                         error(1, 0, "%s partition too big (more than %u bytes)", flash_parts[j].name, (unsigned)flash_parts[j].size);
1454                                 break;
1455                         }
1456                 }
1457
1458                 assert(flash_parts[j].name);
1459
1460                 memcpy(buffer + base, parts[i].data, parts[i].size);
1461
1462                 size_t len = end-image_pt;
1463                 size_t w = snprintf(image_pt, len, "fwup-ptn %s base 0x%05x size 0x%05x\t\r\n", parts[i].name, (unsigned)base, (unsigned)parts[i].size);
1464
1465                 if (w > len-1)
1466                         error(1, 0, "image partition table overflow?");
1467
1468                 image_pt += w;
1469
1470                 base += parts[i].size;
1471         }
1472 }
1473
1474 /** Generates and writes the image MD5 checksum */
1475 static void put_md5(uint8_t *md5, uint8_t *buffer, unsigned int len) {
1476         MD5_CTX ctx;
1477
1478         MD5_Init(&ctx);
1479         MD5_Update(&ctx, md5_salt, (unsigned int)sizeof(md5_salt));
1480         MD5_Update(&ctx, buffer, len);
1481         MD5_Final(md5, &ctx);
1482 }
1483
1484
1485 /**
1486    Generates the firmware image in factory format
1487
1488    Image format:
1489
1490      Bytes (hex)  Usage
1491      -----------  -----
1492      0000-0003    Image size (4 bytes, big endian)
1493      0004-0013    MD5 hash (hash of a 16 byte salt and the image data starting with byte 0x14)
1494      0014-0017    Vendor information length (without padding) (4 bytes, big endian)
1495      0018-1013    Vendor information (4092 bytes, padded with 0xff; there seem to be older
1496                   (VxWorks-based) TP-LINK devices which use a smaller vendor information block)
1497      1014-1813    Image partition table (2048 bytes, padded with 0xff)
1498      1814-xxxx    Firmware partitions
1499 */
1500 static void * generate_factory_image(struct device_info *info, const struct image_partition_entry *parts, size_t *len) {
1501         *len = 0x1814;
1502
1503         size_t i;
1504         for (i = 0; parts[i].name; i++)
1505                 *len += parts[i].size;
1506
1507         uint8_t *image = malloc(*len);
1508         if (!image)
1509                 error(1, errno, "malloc");
1510
1511         memset(image, 0xff, *len);
1512         put32(image, *len);
1513
1514         if (info->vendor) {
1515                 size_t vendor_len = strlen(info->vendor);
1516                 put32(image+0x14, vendor_len);
1517                 memcpy(image+0x18, info->vendor, vendor_len);
1518         }
1519
1520         put_partitions(image + 0x1014, info->partitions, parts);
1521         put_md5(image+0x04, image+0x14, *len-0x14);
1522
1523         return image;
1524 }
1525
1526 /**
1527    Generates the firmware image in sysupgrade format
1528
1529    This makes some assumptions about the provided flash and image partition tables and
1530    should be generalized when TP-LINK starts building its safeloader into hardware with
1531    different flash layouts.
1532 */
1533 static void * generate_sysupgrade_image(struct device_info *info, const struct image_partition_entry *image_parts, size_t *len) {
1534         size_t i, j;
1535         size_t flash_first_partition_index = 0;
1536         size_t flash_last_partition_index = 0;
1537         const struct flash_partition_entry *flash_first_partition = NULL;
1538         const struct flash_partition_entry *flash_last_partition = NULL;
1539         const struct image_partition_entry *image_last_partition = NULL;
1540
1541         /** Find first and last partitions */
1542         for (i = 0; info->partitions[i].name; i++) {
1543                 if (!strcmp(info->partitions[i].name, info->first_sysupgrade_partition)) {
1544                         flash_first_partition = &info->partitions[i];
1545                         flash_first_partition_index = i;
1546                 } else if (!strcmp(info->partitions[i].name, info->last_sysupgrade_partition)) {
1547                         flash_last_partition = &info->partitions[i];
1548                         flash_last_partition_index = i;
1549                 }
1550         }
1551
1552         assert(flash_first_partition && flash_last_partition);
1553         assert(flash_first_partition_index < flash_last_partition_index);
1554
1555         /** Find last partition from image to calculate needed size */
1556         for (i = 0; image_parts[i].name; i++) {
1557                 if (!strcmp(image_parts[i].name, info->last_sysupgrade_partition)) {
1558                         image_last_partition = &image_parts[i];
1559                         break;
1560                 }
1561         }
1562
1563         assert(image_last_partition);
1564
1565         *len = flash_last_partition->base - flash_first_partition->base + image_last_partition->size;
1566
1567         uint8_t *image = malloc(*len);
1568         if (!image)
1569                 error(1, errno, "malloc");
1570
1571         memset(image, 0xff, *len);
1572
1573         for (i = flash_first_partition_index; i <= flash_last_partition_index; i++) {
1574                 for (j = 0; image_parts[j].name; j++) {
1575                         if (!strcmp(info->partitions[i].name, image_parts[j].name)) {
1576                                 if (image_parts[j].size > info->partitions[i].size)
1577                                         error(1, 0, "%s partition too big (more than %u bytes)", info->partitions[i].name, (unsigned)info->partitions[i].size);
1578                                 memcpy(image + info->partitions[i].base - flash_first_partition->base, image_parts[j].data, image_parts[j].size);
1579                                 break;
1580                         }
1581
1582                         assert(image_parts[j].name);
1583                 }
1584         }
1585
1586         return image;
1587 }
1588
1589 /** Generates an image according to a given layout and writes it to a file */
1590 static void build_image(const char *output,
1591                 const char *kernel_image,
1592                 const char *rootfs_image,
1593                 uint32_t rev,
1594                 bool add_jffs2_eof,
1595                 bool sysupgrade,
1596                 struct device_info *info) {
1597
1598         size_t i;
1599
1600         struct image_partition_entry parts[7] = {};
1601
1602         struct flash_partition_entry *firmware_partition = NULL;
1603         struct flash_partition_entry *os_image_partition = NULL;
1604         struct flash_partition_entry *file_system_partition = NULL;
1605         size_t firmware_partition_index = 0;
1606
1607         for (i = 0; info->partitions[i].name; i++) {
1608                 if (!strcmp(info->partitions[i].name, "firmware"))
1609                 {
1610                         firmware_partition = &info->partitions[i];
1611                         firmware_partition_index = i;
1612                 }
1613         }
1614
1615         if (firmware_partition)
1616         {
1617                 os_image_partition = &info->partitions[firmware_partition_index];
1618                 file_system_partition = &info->partitions[firmware_partition_index + 1];
1619
1620                 struct stat kernel;
1621                 if (stat(kernel_image, &kernel) < 0)
1622                         error(1, errno, "unable to stat file `%s'", kernel_image);
1623
1624                 if (kernel.st_size > firmware_partition->size)
1625                         error(1, 0, "kernel overflowed firmware partition\n");
1626
1627                 for (i = MAX_PARTITIONS-1; i >= firmware_partition_index + 1; i--)
1628                         info->partitions[i+1] = info->partitions[i];
1629
1630                 file_system_partition->name = "file-system";
1631                 file_system_partition->base = firmware_partition->base + kernel.st_size;
1632
1633                 /* Align partition start to erase blocks for factory images only */
1634                 if (!sysupgrade)
1635                         file_system_partition->base = ALIGN(firmware_partition->base + kernel.st_size, 0x10000);
1636
1637                 file_system_partition->size = firmware_partition->size - file_system_partition->base;
1638
1639                 os_image_partition->name = "os-image";
1640                 os_image_partition->size = kernel.st_size;
1641         }
1642
1643         parts[0] = make_partition_table(info->partitions);
1644         if (info->soft_ver)
1645                 parts[1] = make_soft_version_from_string(info->soft_ver);
1646         else
1647                 parts[1] = make_soft_version(rev);
1648
1649         parts[2] = make_support_list(info);
1650         parts[3] = read_file("os-image", kernel_image, false, NULL);
1651         parts[4] = read_file("file-system", rootfs_image, add_jffs2_eof, file_system_partition);
1652
1653         /* Some devices need the extra-para partition to accept the firmware */
1654         if (strcasecmp(info->id, "ARCHER-C25-V1") == 0 ||
1655             strcasecmp(info->id, "ARCHER-C59-V2") == 0 ||
1656             strcasecmp(info->id, "ARCHER-C60-V2") == 0 ||
1657             strcasecmp(info->id, "TLWR1043NV5") == 0) {
1658                 const char mdat[11] = {0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00};
1659                 parts[5] = put_data("extra-para", mdat, 11);
1660         } else if (strcasecmp(info->id, "ARCHER-A7-V5") == 0 || strcasecmp(info->id, "ARCHER-C7-V4") == 0 || strcasecmp(info->id, "ARCHER-C7-V5") == 0) {
1661                 const char mdat[11] = {0x01, 0x00, 0x00, 0x02, 0x00, 0x00, 0xca, 0x00, 0x01, 0x00, 0x00};
1662                 parts[5] = put_data("extra-para", mdat, 11);
1663         } else if (strcasecmp(info->id, "ARCHER-C6-V2") == 0) {
1664                 const char mdat[11] = {0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00};
1665                 parts[5] = put_data("extra-para", mdat, 11);
1666         }
1667
1668         size_t len;
1669         void *image;
1670         if (sysupgrade)
1671                 image = generate_sysupgrade_image(info, parts, &len);
1672         else
1673                 image = generate_factory_image(info, parts, &len);
1674
1675         FILE *file = fopen(output, "wb");
1676         if (!file)
1677                 error(1, errno, "unable to open output file");
1678
1679         if (fwrite(image, len, 1, file) != 1)
1680                 error(1, 0, "unable to write output file");
1681
1682         fclose(file);
1683
1684         free(image);
1685
1686         for (i = 0; parts[i].name; i++)
1687                 free_image_partition(parts[i]);
1688 }
1689
1690 /** Usage output */
1691 static void usage(const char *argv0) {
1692         fprintf(stderr,
1693                 "Usage: %s [OPTIONS...]\n"
1694                 "\n"
1695                 "Options:\n"
1696                 "  -h              show this help\n"
1697                 "\n"
1698                 "Create a new image:\n"
1699                 "  -B <board>      create image for the board specified with <board>\n"
1700                 "  -k <file>       read kernel image from the file <file>\n"
1701                 "  -r <file>       read rootfs image from the file <file>\n"
1702                 "  -o <file>       write output to the file <file>\n"
1703                 "  -V <rev>        sets the revision number to <rev>\n"
1704                 "  -j              add jffs2 end-of-filesystem markers\n"
1705                 "  -S              create sysupgrade instead of factory image\n"
1706                 "Extract an old image:\n"
1707                 "  -x <file>       extract all oem firmware partition\n"
1708                 "  -d <dir>        destination to extract the firmware partition\n"
1709                 "  -z <file>       convert an oem firmware into a sysupgade file. Use -o for output file\n",
1710                 argv0
1711         );
1712 };
1713
1714
1715 static struct device_info *find_board(const char *id)
1716 {
1717         struct device_info *board = NULL;
1718
1719         for (board = boards; board->id != NULL; board++)
1720                 if (strcasecmp(id, board->id) == 0)
1721                         return board;
1722
1723         return NULL;
1724 }
1725
1726 static int add_flash_partition(
1727                 struct flash_partition_entry *part_list,
1728                 size_t max_entries,
1729                 const char *name,
1730                 unsigned long base,
1731                 unsigned long size)
1732 {
1733         int ptr;
1734         /* check if the list has a free entry */
1735         for (ptr = 0; ptr < max_entries; ptr++, part_list++) {
1736                 if (part_list->name == NULL &&
1737                                 part_list->base == 0 &&
1738                                 part_list->size == 0)
1739                         break;
1740         }
1741
1742         if (ptr == max_entries) {
1743                 error(1, 0, "No free flash part entry available.");
1744         }
1745
1746         part_list->name = calloc(1, strlen(name) + 1);
1747         if (!part_list->name) {
1748                 error(1, 0, "Unable to allocate memory");
1749         }
1750
1751         memcpy((char *)part_list->name, name, strlen(name));
1752         part_list->base = base;
1753         part_list->size = size;
1754
1755         return 0;
1756 }
1757
1758 /** read the partition table into struct flash_partition_entry */
1759 static int read_partition_table(
1760                 FILE *file, long offset,
1761                 struct flash_partition_entry *entries, size_t max_entries,
1762                 int type)
1763 {
1764         char buf[2048];
1765         char *ptr, *end;
1766         const char *parthdr = NULL;
1767         const char *fwuphdr = "fwup-ptn";
1768         const char *flashhdr = "partition";
1769
1770         /* TODO: search for the partition table */
1771
1772         switch(type) {
1773                 case 0:
1774                         parthdr = fwuphdr;
1775                         break;
1776                 case 1:
1777                         parthdr = flashhdr;
1778                         break;
1779                 default:
1780                         error(1, 0, "Invalid partition table");
1781         }
1782
1783         if (fseek(file, offset, SEEK_SET) < 0)
1784                 error(1, errno, "Can not seek in the firmware");
1785
1786         if (fread(buf, 1, 2048, file) < 0)
1787                 error(1, errno, "Can not read fwup-ptn from the firmware");
1788
1789         buf[2047] = '\0';
1790
1791         /* look for the partition header */
1792         if (memcmp(buf, parthdr, strlen(parthdr)) != 0) {
1793                 fprintf(stderr, "DEBUG: can not find fwuphdr\n");
1794                 return 1;
1795         }
1796
1797         ptr = buf;
1798         end = buf + sizeof(buf);
1799         while ((ptr + strlen(parthdr)) < end &&
1800                         memcmp(ptr, parthdr, strlen(parthdr)) == 0) {
1801                 char *end_part;
1802                 char *end_element;
1803
1804                 char name[32] = { 0 };
1805                 int name_len = 0;
1806                 unsigned long base = 0;
1807                 unsigned long size = 0;
1808
1809                 end_part = memchr(ptr, '\n', (end - ptr));
1810                 if (end_part == NULL) {
1811                         /* in theory this should never happen, because a partition always ends with 0x09, 0x0D, 0x0A */
1812                         break;
1813                 }
1814
1815                 for (int i = 0; i <= 4; i++) {
1816                         if (end_part <= ptr)
1817                                 break;
1818
1819                         end_element = memchr(ptr, 0x20, (end_part - ptr));
1820                         if (end_element == NULL) {
1821                                 error(1, errno, "Ignoring the rest of the partition entries.");
1822                                 break;
1823                         }
1824
1825                         switch (i) {
1826                                 /* partition header */
1827                                 case 0:
1828                                         ptr = end_element + 1;
1829                                         continue;
1830                                 /* name */
1831                                 case 1:
1832                                         name_len = (end_element - ptr) > 31 ? 31 : (end_element - ptr);
1833                                         strncpy(name, ptr, name_len);
1834                                         name[name_len] = '\0';
1835                                         ptr = end_element + 1;
1836                                         continue;
1837
1838                                 /* string "base" */
1839                                 case 2:
1840                                         ptr = end_element + 1;
1841                                         continue;
1842
1843                                 /* actual base */
1844                                 case 3:
1845                                         base = strtoul(ptr, NULL, 16);
1846                                         ptr = end_element + 1;
1847                                         continue;
1848
1849                                 /* string "size" */
1850                                 case 4:
1851                                         ptr = end_element + 1;
1852                                         /* actual size. The last element doesn't have a sepeartor */
1853                                         size = strtoul(ptr, NULL, 16);
1854                                         /* the part ends with 0x09, 0x0d, 0x0a */
1855                                         ptr = end_part + 1;
1856                                         add_flash_partition(entries, max_entries, name, base, size);
1857                                         continue;
1858                         }
1859                 }
1860         }
1861
1862         return 0;
1863 }
1864
1865 static void write_partition(
1866                 FILE *input_file,
1867                 size_t firmware_offset,
1868                 struct flash_partition_entry *entry,
1869                 FILE *output_file)
1870 {
1871         char buf[4096];
1872         size_t offset;
1873
1874         fseek(input_file, entry->base + firmware_offset, SEEK_SET);
1875
1876         for (offset = 0; sizeof(buf) + offset <= entry->size; offset += sizeof(buf)) {
1877                 if (fread(buf, sizeof(buf), 1, input_file) < 0)
1878                         error(1, errno, "Can not read partition from input_file");
1879
1880                 if (fwrite(buf, sizeof(buf), 1, output_file) < 0)
1881                         error(1, errno, "Can not write partition to output_file");
1882         }
1883         /* write last chunk smaller than buffer */
1884         if (offset < entry->size) {
1885                 offset = entry->size - offset;
1886                 if (fread(buf, offset, 1, input_file) < 0)
1887                         error(1, errno, "Can not read partition from input_file");
1888                 if (fwrite(buf, offset, 1, output_file) < 0)
1889                         error(1, errno, "Can not write partition to output_file");
1890         }
1891 }
1892
1893 static int extract_firmware_partition(FILE *input_file, size_t firmware_offset, struct flash_partition_entry *entry, const char *output_directory)
1894 {
1895         FILE *output_file;
1896         char output[PATH_MAX];
1897
1898         snprintf(output, PATH_MAX, "%s/%s", output_directory, entry->name);
1899         output_file = fopen(output, "wb+");
1900         if (output_file == NULL) {
1901                 error(1, errno, "Can not open output file %s", output);
1902         }
1903
1904         write_partition(input_file, firmware_offset, entry, output_file);
1905
1906         fclose(output_file);
1907
1908         return 0;
1909 }
1910
1911 /** extract all partitions from the firmware file */
1912 static int extract_firmware(const char *input, const char *output_directory)
1913 {
1914         struct flash_partition_entry entries[16] = { 0 };
1915         size_t max_entries = 16;
1916         size_t firmware_offset = 0x1014;
1917         FILE *input_file;
1918
1919         struct stat statbuf;
1920
1921         /* check input file */
1922         if (stat(input, &statbuf)) {
1923                 error(1, errno, "Can not read input firmware %s", input);
1924         }
1925
1926         /* check if output directory exists */
1927         if (stat(output_directory, &statbuf)) {
1928                 error(1, errno, "Failed to stat output directory %s", output_directory);
1929         }
1930
1931         if ((statbuf.st_mode & S_IFMT) != S_IFDIR) {
1932                 error(1, errno, "Given output directory is not a directory %s", output_directory);
1933         }
1934
1935         input_file = fopen(input, "rb");
1936
1937         if (read_partition_table(input_file, firmware_offset, entries, 16, 0) != 0) {
1938                 error(1, 0, "Error can not read the partition table (fwup-ptn)");
1939         }
1940
1941         for (int i = 0; i < max_entries; i++) {
1942                 if (entries[i].name == NULL &&
1943                                 entries[i].base == 0 &&
1944                                 entries[i].size == 0)
1945                         continue;
1946
1947                 extract_firmware_partition(input_file, firmware_offset, &entries[i], output_directory);
1948         }
1949
1950         return 0;
1951 }
1952
1953 static struct flash_partition_entry *find_partition(
1954                 struct flash_partition_entry *entries, size_t max_entries,
1955                 const char *name, const char *error_msg)
1956 {
1957         for (int i = 0; i < max_entries; i++, entries++) {
1958                 if (strcmp(entries->name, name) == 0)
1959                         return entries;
1960         }
1961
1962         error(1, 0, "%s", error_msg);
1963         return NULL;
1964 }
1965
1966 static void write_ff(FILE *output_file, size_t size)
1967 {
1968         char buf[4096];
1969         int offset;
1970
1971         memset(buf, 0xff, sizeof(buf));
1972
1973         for (offset = 0; offset + sizeof(buf) < size ; offset += sizeof(buf)) {
1974                 if (fwrite(buf, sizeof(buf), 1, output_file) < 0)
1975                         error(1, errno, "Can not write 0xff to output_file");
1976         }
1977
1978         /* write last chunk smaller than buffer */
1979         if (offset < size) {
1980                 offset = size - offset;
1981                 if (fwrite(buf, offset, 1, output_file) < 0)
1982                         error(1, errno, "Can not write partition to output_file");
1983         }
1984 }
1985
1986 static void convert_firmware(const char *input, const char *output)
1987 {
1988         struct flash_partition_entry fwup[MAX_PARTITIONS] = { 0 };
1989         struct flash_partition_entry flash[MAX_PARTITIONS] = { 0 };
1990         struct flash_partition_entry *fwup_os_image = NULL, *fwup_file_system = NULL;
1991         struct flash_partition_entry *flash_os_image = NULL, *flash_file_system = NULL;
1992         struct flash_partition_entry *fwup_partition_table = NULL;
1993         size_t firmware_offset = 0x1014;
1994         FILE *input_file, *output_file;
1995
1996         struct stat statbuf;
1997
1998         /* check input file */
1999         if (stat(input, &statbuf)) {
2000                 error(1, errno, "Can not read input firmware %s", input);
2001         }
2002
2003         input_file = fopen(input, "rb");
2004         if (!input_file)
2005                 error(1, 0, "Can not open input firmware %s", input);
2006
2007         output_file = fopen(output, "wb");
2008         if (!output_file)
2009                 error(1, 0, "Can not open output firmware %s", output);
2010
2011         if (read_partition_table(input_file, firmware_offset, fwup, MAX_PARTITIONS, 0) != 0) {
2012                 error(1, 0, "Error can not read the partition table (fwup-ptn)");
2013         }
2014
2015         fwup_os_image = find_partition(fwup, MAX_PARTITIONS,
2016                         "os-image", "Error can not find os-image partition (fwup)");
2017         fwup_file_system = find_partition(fwup, MAX_PARTITIONS,
2018                         "file-system", "Error can not find file-system partition (fwup)");
2019         fwup_partition_table = find_partition(fwup, MAX_PARTITIONS,
2020                         "partition-table", "Error can not find partition-table partition");
2021
2022         /* the flash partition table has a 0x00000004 magic haeder */
2023         if (read_partition_table(input_file, firmware_offset + fwup_partition_table->base + 4, flash, MAX_PARTITIONS, 1) != 0)
2024                 error(1, 0, "Error can not read the partition table (flash)");
2025
2026         flash_os_image = find_partition(flash, MAX_PARTITIONS,
2027                         "os-image", "Error can not find os-image partition (flash)");
2028         flash_file_system = find_partition(flash, MAX_PARTITIONS,
2029                         "file-system", "Error can not find file-system partition (flash)");
2030
2031         /* write os_image to 0x0 */
2032         write_partition(input_file, firmware_offset, fwup_os_image, output_file);
2033         write_ff(output_file, flash_os_image->size - fwup_os_image->size);
2034
2035         /* write file-system behind os_image */
2036         fseek(output_file, flash_file_system->base - flash_os_image->base, SEEK_SET);
2037         write_partition(input_file, firmware_offset, fwup_file_system, output_file);
2038         write_ff(output_file, flash_file_system->size - fwup_file_system->size);
2039
2040         fclose(output_file);
2041         fclose(input_file);
2042 }
2043
2044 int main(int argc, char *argv[]) {
2045         const char *board = NULL, *kernel_image = NULL, *rootfs_image = NULL, *output = NULL;
2046         const char *extract_image = NULL, *output_directory = NULL, *convert_image = NULL;
2047         bool add_jffs2_eof = false, sysupgrade = false;
2048         unsigned rev = 0;
2049         struct device_info *info;
2050         set_source_date_epoch();
2051
2052         while (true) {
2053                 int c;
2054
2055                 c = getopt(argc, argv, "B:k:r:o:V:jSh:x:d:z:");
2056                 if (c == -1)
2057                         break;
2058
2059                 switch (c) {
2060                 case 'B':
2061                         board = optarg;
2062                         break;
2063
2064                 case 'k':
2065                         kernel_image = optarg;
2066                         break;
2067
2068                 case 'r':
2069                         rootfs_image = optarg;
2070                         break;
2071
2072                 case 'o':
2073                         output = optarg;
2074                         break;
2075
2076                 case 'V':
2077                         sscanf(optarg, "r%u", &rev);
2078                         break;
2079
2080                 case 'j':
2081                         add_jffs2_eof = true;
2082                         break;
2083
2084                 case 'S':
2085                         sysupgrade = true;
2086                         break;
2087
2088                 case 'h':
2089                         usage(argv[0]);
2090                         return 0;
2091
2092                 case 'd':
2093                         output_directory = optarg;
2094                         break;
2095
2096                 case 'x':
2097                         extract_image = optarg;
2098                         break;
2099
2100                 case 'z':
2101                         convert_image = optarg;
2102                         break;
2103
2104                 default:
2105                         usage(argv[0]);
2106                         return 1;
2107                 }
2108         }
2109
2110         if (extract_image || output_directory) {
2111                 if (!extract_image)
2112                         error(1, 0, "No factory/oem image given via -x <file>. Output directory is only valid with -x");
2113                 if (!output_directory)
2114                         error(1, 0, "Can not extract an image without output directory. Use -d <dir>");
2115                 extract_firmware(extract_image, output_directory);
2116         } else if (convert_image) {
2117                 if (!output)
2118                         error(1, 0, "Can not convert a factory/oem image into sysupgrade image without output file. Use -o <file>");
2119                 convert_firmware(convert_image, output);
2120         } else {
2121                 if (!board)
2122                         error(1, 0, "no board has been specified");
2123                 if (!kernel_image)
2124                         error(1, 0, "no kernel image has been specified");
2125                 if (!rootfs_image)
2126                         error(1, 0, "no rootfs image has been specified");
2127                 if (!output)
2128                         error(1, 0, "no output filename has been specified");
2129
2130                 info = find_board(board);
2131
2132                 if (info == NULL)
2133                         error(1, 0, "unsupported board %s", board);
2134
2135                 build_image(output, kernel_image, rootfs_image, rev, add_jffs2_eof, sysupgrade, info);
2136         }
2137
2138         return 0;
2139 }