4 * Copyright (C) 2007-2008 OpenWrt.org
5 * Copyright (C) 2007-2008 Gabor Juhos <juhosg at openwrt.org>
7 * This code was based on the information of the ZyXEL's firmware
8 * image format written by Kolja Waschk, can be found at:
9 * http://www.ixo.de/info/zyxel_uclinux
11 * This program is free software; you can redistribute it and/or modify it
12 * under the terms of the GNU General Public License version 2 as published
13 * by the Free Software Foundation.
21 #include <unistd.h> /* for unlink() */
23 #include <getopt.h> /* for getopt() */
27 #include <endian.h> /* for __BYTE_ORDER */
28 #if defined(__CYGWIN__)
29 # include <byteswap.h>
34 #if (__BYTE_ORDER == __LITTLE_ENDIAN)
35 # define HOST_TO_LE16(x) (x)
36 # define HOST_TO_LE32(x) (x)
37 # define LE16_TO_HOST(x) (x)
38 # define LE32_TO_HOST(x) (x)
39 # define HOST_TO_BE16(x) bswap_16(x)
40 # define HOST_TO_BE32(x) bswap_32(x)
41 # define BE16_TO_HOST(x) bswap_16(x)
42 # define BE32_TO_HOST(x) bswap_32(x)
44 # define HOST_TO_BE16(x) (x)
45 # define HOST_TO_BE32(x) (x)
46 # define BE16_TO_HOST(x) (x)
47 # define BE32_TO_HOST(x) (x)
48 # define HOST_TO_LE16(x) bswap_16(x)
49 # define HOST_TO_LE32(x) bswap_32(x)
50 # define LE16_TO_HOST(x) bswap_16(x)
51 # define LE32_TO_HOST(x) bswap_32(x)
54 #define ALIGN(x,y) (((x)+((y)-1)) & ~((y)-1))
56 #define MAX_NUM_BLOCKS 8
57 #define MAX_ARG_COUNT 32
58 #define MAX_ARG_LEN 1024
59 #define FILE_BUF_LEN (16*1024)
69 uint32_t align; /* alignment of this block */
70 char *file_name; /* name of the file */
71 uint32_t file_size; /* length of the file */
72 char *mmap_name; /* name in the MMAP table */
73 int type; /* block type */
78 #define BLOCK_TYPE_BOOTEXT 0
79 #define BLOCK_TYPE_RAW 1
87 #define MMAP_DATA_SIZE 1024
91 char *name; /* model name */
92 char *desc; /* description */
93 uint16_t vendor; /* vendor id */
94 uint16_t model; /* model id */
95 uint32_t flash_base; /* flash base address */
96 uint32_t flash_size; /* board flash size */
97 uint32_t code_start; /* code start address */
98 uint32_t romio_offs; /* offset of the firmware within the flash */
99 uint32_t bootext_size; /* maximum size of bootext block */
109 struct board_info *board = NULL;
111 struct fw_block blocks[MAX_NUM_BLOCKS];
112 struct fw_block *bootext_block = NULL;
115 #define ADM5120_FLASH_BASE 0xBFC00000
116 #define ADM5120_CODE_START 0x80008000
118 /* TODO: check values for AR7 */
119 #define AR7_FLASH_BASE 0xB0000000
120 #define AR7_CODE_START 0x94008000
122 #define ATHEROS_FLASH_BASE 0xBFC00000
123 #define ATHEROS_CODE_START 0x80e00000
125 #define BOARD(n, d, v, m, fb, fs, cs, fo) { \
126 .name = (n), .desc=(d), \
127 .vendor = (v), .model = (m), \
128 .flash_base = (fb), .flash_size = (fs)<<20, \
129 .code_start = (cs), .romio_offs = (fo), \
130 .bootext_size = BOOTEXT_DEF_SIZE \
133 #define ADMBOARD1(n, d, m, fs) BOARD(n, d, ZYNOS_VENDOR_ID_ZYXEL, m, \
134 ADM5120_FLASH_BASE, fs, ADM5120_CODE_START, 0x8000)
136 #define ADMBOARD2(n, d, m, fs) BOARD(n, d, ZYNOS_VENDOR_ID_ZYXEL, m, \
137 ADM5120_FLASH_BASE, fs, ADM5120_CODE_START, 0x10000)
139 #define AR7BOARD1(n, d, m, fs) BOARD(n, d, ZYNOS_VENDOR_ID_ZYXEL, m, \
140 AR7_FLASH_BASE, fs, AR7_CODE_START, 0x8000)
142 #define ATHEROSBOARD1(n, d, m, fs) BOARD(n, d, ZYNOS_VENDOR_ID_ZYXEL, m, \
143 ATHEROS_FLASH_BASE, fs, ATHEROS_CODE_START, 0x30000)
145 static struct board_info boards[] = {
147 * Infineon/ADMtek ADM5120 based boards
149 ADMBOARD2("ES-2024A", "ZyXEL ES-2024A", ZYNOS_MODEL_ES_2024A, 4),
150 ADMBOARD2("ES-2024PWR", "ZyXEL ES-2024PWR", ZYNOS_MODEL_ES_2024PWR, 4),
151 ADMBOARD2("ES-2108", "ZyXEL ES-2108", ZYNOS_MODEL_ES_2108, 4),
152 ADMBOARD2("ES-2108-F", "ZyXEL ES-2108-F", ZYNOS_MODEL_ES_2108_F, 4),
153 ADMBOARD2("ES-2108-G", "ZyXEL ES-2108-G", ZYNOS_MODEL_ES_2108_G, 4),
154 ADMBOARD2("ES-2108-LC", "ZyXEL ES-2108-LC", ZYNOS_MODEL_ES_2108_LC, 4),
155 ADMBOARD2("ES-2108PWR", "ZyXEL ES-2108PWR", ZYNOS_MODEL_ES_2108PWR, 4),
156 ADMBOARD1("HS-100", "ZyXEL HomeSafe 100", ZYNOS_MODEL_HS_100, 2),
157 ADMBOARD1("HS-100W", "ZyXEL HomeSafe 100W", ZYNOS_MODEL_HS_100W, 2),
158 ADMBOARD1("P-334", "ZyXEL Prestige 334", ZYNOS_MODEL_P_334, 2),
159 ADMBOARD1("P-334U", "ZyXEL Prestige 334U", ZYNOS_MODEL_P_334U, 4),
160 ADMBOARD1("P-334W", "ZyXEL Prestige 334W", ZYNOS_MODEL_P_334W, 2),
161 ADMBOARD1("P-334WH", "ZyXEL Prestige 334WH", ZYNOS_MODEL_P_334WH, 4),
162 ADMBOARD1("P-334WHD", "ZyXEL Prestige 334WHD", ZYNOS_MODEL_P_334WHD, 4),
163 ADMBOARD1("P-334WT", "ZyXEL Prestige 334WT", ZYNOS_MODEL_P_334WT, 4),
164 ADMBOARD1("P-335", "ZyXEL Prestige 335", ZYNOS_MODEL_P_335, 4),
165 ADMBOARD1("P-335Plus", "ZyXEL Prestige 335Plus", ZYNOS_MODEL_P_335PLUS, 4),
166 ADMBOARD1("P-335U", "ZyXEL Prestige 335U", ZYNOS_MODEL_P_335U, 4),
167 ADMBOARD1("P-335WT", "ZyXEL Prestige 335WT", ZYNOS_MODEL_P_335WT, 4),
170 .name = "P-2602HW-D1A",
171 .desc = "ZyXEL P-2602HW-D1A",
172 .vendor = ZYNOS_VENDOR_ID_ZYXEL,
173 .model = ZYNOS_MODEL_P_2602HW_D1A,
174 .flash_base = AR7_FLASH_BASE,
175 .flash_size = 4*1024*1024,
176 .code_start = 0x94008000,
177 .romio_offs = 0x20000,
178 .bootext_size = BOOTEXT_DEF_SIZE,
183 * Texas Instruments AR7 based boards
185 AR7BOARD1("P-660H-61", "ZyXEL P-660H-61", ZYNOS_MODEL_P_660H_61, 2),
186 AR7BOARD1("P-660H-63", "ZyXEL P-660H-63", ZYNOS_MODEL_P_660H_63, 2),
187 AR7BOARD1("P-660H-D1", "ZyXEL P-660H-D1", ZYNOS_MODEL_P_660H_D1, 2),
188 AR7BOARD1("P-660H-D3", "ZyXEL P-660H-D3", ZYNOS_MODEL_P_660H_D3, 2),
189 AR7BOARD1("P-660HW-61", "ZyXEL P-660HW-61", ZYNOS_MODEL_P_660HW_61, 2),
190 AR7BOARD1("P-660HW-63", "ZyXEL P-660HW-63", ZYNOS_MODEL_P_660HW_63, 2),
191 AR7BOARD1("P-660HW-67", "ZyXEL P-660HW-67", ZYNOS_MODEL_P_660HW_67, 2),
192 AR7BOARD1("P-660HW-D1", "ZyXEL P-660HW-D1", ZYNOS_MODEL_P_660HW_D1, 2),
193 AR7BOARD1("P-660HW-D3", "ZyXEL P-660HW-D3", ZYNOS_MODEL_P_660HW_D3, 2),
194 AR7BOARD1("P-660R-61", "ZyXEL P-660R-61", ZYNOS_MODEL_P_660R_61, 2),
195 AR7BOARD1("P-660R-61C", "ZyXEL P-660R-61C", ZYNOS_MODEL_P_660R_61C, 2),
196 AR7BOARD1("P-660R-63", "ZyXEL P-660R-63", ZYNOS_MODEL_P_660R_63, 2),
197 AR7BOARD1("P-660R-63C", "ZyXEL P-660R-63C", ZYNOS_MODEL_P_660R_63C, 2),
198 AR7BOARD1("P-660R-67", "ZyXEL P-660R-67", ZYNOS_MODEL_P_660R_67, 2),
199 AR7BOARD1("P-660R-D1", "ZyXEL P-660R-D1", ZYNOS_MODEL_P_660R_D1, 2),
200 AR7BOARD1("P-660R-D3", "ZyXEL P-660R-D3", ZYNOS_MODEL_P_660R_D3, 2),
204 .desc = "O2 DSL Surf & Phone",
205 .vendor = ZYNOS_VENDOR_ID_O2,
206 .model = ZYNOS_MODEL_O2SURF,
207 .flash_base = AR7_FLASH_BASE,
208 .flash_size = 8*1024*1024,
209 .code_start = 0x94014000,
210 .romio_offs = 0x40000,
211 .bootext_size = BOOTEXT_DEF_SIZE,
217 ATHEROSBOARD1("NBG-318S", "ZyXEL NBG-318S", ZYNOS_MODEL_NBG_318S, 4),
225 #define ERR(fmt, ...) do { \
227 fprintf(stderr, "[%s] *** error: " fmt "\n", \
228 progname, ## __VA_ARGS__ ); \
231 #define ERRS(fmt, ...) do { \
234 fprintf(stderr, "[%s] *** error: " fmt ", %s\n", \
235 progname, ## __VA_ARGS__, strerror(save)); \
238 #define WARN(fmt, ...) do { \
239 fprintf(stderr, "[%s] *** warning: " fmt "\n", \
240 progname, ## __VA_ARGS__ ); \
243 #define DBG(lev, fmt, ...) do { \
244 if (verblevel < lev) \
246 fprintf(stderr, "[%s] " fmt "\n", progname, ## __VA_ARGS__ ); \
250 #define ERR_INVALID_IMAGE -2
258 FILE *stream = (status != EXIT_SUCCESS) ? stderr : stdout;
259 struct board_info *board;
261 fprintf(stream, "Usage: %s [OPTIONS...]\n", progname);
265 " -B <board> create image for the board specified with <board>.\n"
266 " valid <board> values:\n"
268 for (board = boards; board->name != NULL; board++){
271 board->name, board->desc);
274 " -b <file>[:<align>]\n"
275 " add boot extension block to the image\n"
276 " -r <file>[:<align>]\n"
277 " add raw block to the image\n"
278 " -o <file> write output to the file <file>\n"
279 " -h show this screen\n"
290 str2u32(char *arg, uint32_t *val)
296 t = strtoul(arg, &err, 0);
297 if (errno || (err==arg) || ((err != NULL) && *err)) {
307 str2u16(char *arg, uint16_t *val)
313 t = strtoul(arg, &err, 0);
314 if (errno || (err==arg) || ((err != NULL) && *err) || (t >= 0x10000)) {
323 str2u8(char *arg, uint8_t *val)
329 t = strtoul(arg, &err, 0);
330 if (errno || (err==arg) || ((err != NULL) && *err) || (t >= 0x100)) {
339 str2sig(char *arg, uint32_t *sig)
341 if (strlen(arg) != 4)
344 *sig = arg[0] | (arg[1] << 8) | (arg[2] << 16) | (arg[3] << 24);
351 parse_arg(char *arg, char *buf, char *argv[])
359 memset(argv, 0, MAX_ARG_COUNT * sizeof(void *));
372 if (argl >= MAX_ARG_LEN) {
373 /* argument is too long */
374 argl = MAX_ARG_LEN-1;
377 memcpy(buf, arg, argl);
380 for (i = 0; i < MAX_ARG_COUNT; i++) {
381 tok = strsep(ap, ":");
386 else if (tok[0] == '\0') {
399 required_arg(char c, char *arg)
401 if (arg == NULL || *arg != '-')
404 ERR("option -%c requires an argument\n", c);
410 is_empty_arg(char *arg)
421 csum_init(struct csum_state *css)
430 csum_update(uint8_t *p, uint32_t len, struct csum_state *css)
436 css->sum += (css->tmp << 8) + p[0];
437 if (css->sum > 0xFFFF) {
446 for ( ; len > 1; len -= 2, p +=2 ) {
447 css->sum += (p[0] << 8) + p[1];
448 if (css->sum > 0xFFFF) {
462 csum_get(struct csum_state *css)
466 csum_update(&pad, 1, css);
471 csum_buf(uint8_t *p, uint32_t len)
473 struct csum_state css;
476 csum_update(p, len, &css);
477 return csum_get(&css);
482 * routines to write data to the output file
485 write_out_data(FILE *outfile, uint8_t *data, size_t len,
486 struct csum_state *css)
490 fwrite(data, len, 1, outfile);
492 ERR("unable to write output file");
497 csum_update(data, len, css);
505 write_out_padding(FILE *outfile, size_t len, uint8_t padc,
506 struct csum_state *css)
509 size_t buflen = sizeof(buf);
511 memset(buf, padc, buflen);
516 if (write_out_data(outfile, buf, buflen, css))
527 write_out_data_align(FILE *outfile, uint8_t *data, size_t len, size_t align,
528 struct csum_state *css)
533 res = write_out_data(outfile, data, len, css);
537 padlen = ALIGN(len,align) - len;
538 res = write_out_padding(outfile, padlen, 0xFF, css);
545 write_out_header(FILE *outfile, struct zyn_rombin_hdr *hdr)
547 struct zyn_rombin_hdr t;
550 if (fseek(outfile, 0, SEEK_SET) != 0) {
551 ERRS("fseek failed on output file");
555 /* setup temporary header fields */
556 memset(&t, 0, sizeof(t));
557 t.addr = HOST_TO_BE32(hdr->addr);
558 memcpy(&t.sig, ROMBIN_SIGNATURE, ROMBIN_SIG_LEN);
560 t.flags = hdr->flags;
561 t.osize = HOST_TO_BE32(hdr->osize);
562 t.csize = HOST_TO_BE32(hdr->csize);
563 t.ocsum = HOST_TO_BE16(hdr->ocsum);
564 t.ccsum = HOST_TO_BE16(hdr->ccsum);
565 t.mmap_addr = HOST_TO_BE32(hdr->mmap_addr);
567 DBG(2, "hdr.addr = 0x%08x", hdr->addr);
568 DBG(2, "hdr.type = 0x%02x", hdr->type);
569 DBG(2, "hdr.osize = 0x%08x", hdr->osize);
570 DBG(2, "hdr.csize = 0x%08x", hdr->csize);
571 DBG(2, "hdr.flags = 0x%02x", hdr->flags);
572 DBG(2, "hdr.ocsum = 0x%04x", hdr->ocsum);
573 DBG(2, "hdr.ccsum = 0x%04x", hdr->ccsum);
574 DBG(2, "hdr.mmap_addr = 0x%08x", hdr->mmap_addr);
576 return write_out_data(outfile, (uint8_t *)&t, sizeof(t), NULL);
581 write_out_mmap(FILE *outfile, struct fw_mmap *mmap, struct csum_state *css)
583 struct zyn_mmt_hdr *mh;
584 uint8_t buf[MMAP_DATA_SIZE];
589 memset(buf, 0, sizeof(buf));
591 mh = (struct zyn_mmt_hdr *)buf;
593 /* TODO: needs to recreate the memory map too? */
596 /* Build user data section */
597 data = buf+sizeof(*mh);
598 data += sprintf(data, "Vendor 1 %d", board->vendor);
600 data += sprintf(data, "Model 1 %d", BE16_TO_HOST(board->model));
602 /* TODO: make hardware version configurable? */
603 data += sprintf(data, "HwVerRange 2 %d %d", 0, 0);
606 user_size = (uint8_t *)data - buf;
607 mh->user_start= HOST_TO_BE32(mmap->addr+sizeof(*mh));
608 mh->user_end= HOST_TO_BE32(mmap->addr+user_size);
609 mh->csum = HOST_TO_BE16(csum_buf(buf+sizeof(*mh), user_size));
611 res = write_out_data(outfile, buf, sizeof(buf), css);
618 block_stat_file(struct fw_block *block)
623 if (block->file_name == NULL)
626 res = stat(block->file_name, &st);
628 ERRS("stat failed on %s", block->file_name);
632 block->file_size = st.st_size;
638 read_magic(uint16_t *magic)
644 f = fopen(bootext_block->file_name,"r");
646 ERRS("unable to open file: %s", bootext_block->file_name);
651 fread(magic, 2, 1, f);
653 ERRS("unable to read from file: %s", bootext_block->file_name);
667 write_out_file(FILE *outfile, char *name, size_t len, struct csum_state *css)
669 char buf[FILE_BUF_LEN];
670 size_t buflen = sizeof(buf);
674 DBG(2, "writing out file, name=%s, len=%d",
680 ERRS("unable to open file: %s", name);
688 /* read data from source file */
690 fread(buf, buflen, 1, f);
692 ERRS("unable to read from file: %s",name);
697 res = write_out_data(outfile, buf, buflen, css);
710 write_out_block(FILE *outfile, struct fw_block *block, struct csum_state *css)
717 if (block->file_name == NULL)
720 if (block->file_size == 0)
723 res = write_out_file(outfile, block->file_name,
724 block->file_size, css);
730 write_out_image(FILE *outfile)
732 struct fw_block *block;
734 struct zyn_rombin_hdr hdr;
735 struct csum_state css;
742 /* setup header fields */
743 memset(&hdr, 0, sizeof(hdr));
744 hdr.addr = board->code_start;
745 hdr.type = OBJECT_TYPE_BOOTEXT;
746 hdr.flags = ROMBIN_FLAG_OCSUM;
748 offset = board->romio_offs;
750 res = write_out_header(outfile, &hdr);
754 offset += sizeof(hdr);
757 res = write_out_block(outfile, bootext_block, &css);
761 offset += bootext_block->file_size;
762 if (offset > (board->romio_offs + board->bootext_size)) {
763 ERR("bootext file '%s' is too big", bootext_block->file_name);
767 padlen = ALIGN(offset, MMAP_ALIGN) - offset;
768 res = write_out_padding(outfile, padlen, 0xFF, &css);
774 mmap.addr = board->flash_base + offset;
775 res = write_out_mmap(outfile, &mmap, &css);
779 offset += MMAP_DATA_SIZE;
781 if ((offset - board->romio_offs) < board->bootext_size) {
782 padlen = board->romio_offs + board->bootext_size - offset;
783 res = write_out_padding(outfile, padlen, 0xFF, &css);
788 DBG(2, "bootext end at %08x", offset);
791 for (i = 0; i < num_blocks; i++) {
794 if (block->type == BLOCK_TYPE_BOOTEXT)
797 padlen = ALIGN(offset, block->align) - offset;
798 res = write_out_padding(outfile, padlen, 0xFF, &css);
803 res = write_out_block(outfile, block, &css);
806 offset += block->file_size;
809 padlen = ALIGN(offset, 4) - offset;
810 res = write_out_padding(outfile, padlen, 0xFF, &css);
815 csum = csum_get(&css);
816 hdr.mmap_addr = mmap.addr;
819 res = read_magic(&hdr.ocsum);
822 hdr.ocsum = BE16_TO_HOST(hdr.ocsum);
824 if (csum <= hdr.ocsum)
825 t = hdr.ocsum - csum;
827 t = hdr.ocsum - csum - 1;
829 DBG(2, "ocsum=%04x, csum=%04x, fix=%04x", hdr.ocsum, csum, t);
832 res = write_out_data(outfile, (uint8_t *)&t, 2, NULL);
837 res = write_out_header(outfile, &hdr);
844 find_board(char *name)
846 struct board_info *ret;
847 struct board_info *board;
850 for (board = boards; board->name != NULL; board++){
851 if (strcasecmp(name, board->name) == 0) {
862 parse_opt_board(char ch, char *arg)
865 DBG(1,"parsing board option: -%c %s", ch, arg);
868 ERR("only one board option allowed");
872 if (required_arg(ch, arg))
875 board = find_board(arg);
877 ERR("invalid/unknown board specified: %s", arg);
886 parse_opt_ofname(char ch, char *arg)
889 if (ofname != NULL) {
890 ERR("only one output file allowed");
894 if (required_arg(ch, arg))
904 parse_opt_block(char ch, char *arg)
906 char buf[MAX_ARG_LEN];
907 char *argv[MAX_ARG_COUNT];
910 struct fw_block *block;
913 if ( num_blocks >= MAX_NUM_BLOCKS ) {
914 ERR("too many blocks specified");
918 block = &blocks[num_blocks++];
920 /* setup default field values */
926 ERR("only one boot extension block allowed");
929 block->type = BLOCK_TYPE_BOOTEXT;
930 bootext_block = block;
933 block->type = BLOCK_TYPE_RAW;
937 argc = parse_arg(arg, buf, argv);
941 if (is_empty_arg(p)) {
942 ERR("no file specified in %s", arg);
945 block->file_name = strdup(p);
946 if (block->file_name == NULL) {
947 ERR("not enough memory");
952 if (block->type == BLOCK_TYPE_BOOTEXT)
956 if (!is_empty_arg(p)) {
957 if (str2u32(p, &block->align) != 0) {
958 ERR("invalid block align in %s", arg);
968 calc_block_offsets(int type, uint32_t *offset)
970 struct fw_block *block;
975 DBG(1,"calculating block offsets, starting with %lu",
979 for (i = 0; i < num_blocks; i++) {
982 if (block->type != type)
985 next_offs = ALIGN(*offset, block->align);
986 avail = board->flash_size - board->romio_offs - next_offs;
987 if (next_offs + block->file_size > avail) {
988 ERR("file %s is too big, offset = %u, size=%u,"
989 " align = %u", block->file_name,
991 (unsigned)block->file_size,
992 (unsigned)block->align);
997 block->padlen = next_offs - *offset;
998 *offset += block->file_size;
1005 process_blocks(void)
1007 struct fw_block *block;
1012 /* collecting file stats */
1013 for (i = 0; i < num_blocks; i++) {
1015 res = block_stat_file(block);
1020 offset = board->romio_offs + bootext_block->file_size;
1021 res = calc_block_offsets(BLOCK_TYPE_RAW, &offset);
1028 main(int argc, char *argv[])
1030 int optinvalid = 0; /* flag for invalid option */
1032 int res = EXIT_FAILURE;
1036 progname=basename(argv[0]);
1038 opterr = 0; /* could not print standard getopt error messages */
1042 c = getopt(argc, argv, "b:B:ho:r:v");
1049 optinvalid = parse_opt_block(c,optarg);
1052 optinvalid = parse_opt_board(c,optarg);
1055 optinvalid = parse_opt_ofname(c,optarg);
1061 usage(EXIT_SUCCESS);
1067 if (optinvalid != 0 ) {
1068 ERR("invalid option: -%c", optopt);
1073 if (board == NULL) {
1074 ERR("no board specified");
1078 if (ofname == NULL) {
1079 ERR("no output file specified");
1083 if (optind < argc) {
1084 ERR("invalid option: %s", argv[optind]);
1088 if (process_blocks() != 0) {
1092 outfile = fopen(ofname, "w");
1093 if (outfile == NULL) {
1094 ERRS("could not open \"%s\" for writing", ofname);
1098 if (write_out_image(outfile) != 0)
1101 DBG(1,"Image file %s completed.", ofname);
1108 if (res != EXIT_SUCCESS) {