3 * Copyright (C) 2007-2008 OpenWrt.org
4 * Copyright (C) 2007-2008 Gabor Juhos <juhosg at openwrt.org>
6 * This code was based on the information of the ZyXEL's firmware
7 * image format written by Kolja Waschk, can be found at:
8 * http://www.ixo.de/info/zyxel_uclinux
10 * This program is free software; you can redistribute it and/or modify it
11 * under the terms of the GNU General Public License version 2 as published
12 * by the Free Software Foundation.
20 #include <unistd.h> /* for unlink() */
22 #include <getopt.h> /* for getopt() */
26 #include <endian.h> /* for __BYTE_ORDER */
27 #if defined(__CYGWIN__)
28 # include <byteswap.h>
33 #if (__BYTE_ORDER == __LITTLE_ENDIAN)
34 # define HOST_TO_LE16(x) (x)
35 # define HOST_TO_LE32(x) (x)
36 # define LE16_TO_HOST(x) (x)
37 # define LE32_TO_HOST(x) (x)
38 # define HOST_TO_BE16(x) bswap_16(x)
39 # define HOST_TO_BE32(x) bswap_32(x)
40 # define BE16_TO_HOST(x) bswap_16(x)
41 # define BE32_TO_HOST(x) bswap_32(x)
43 # define HOST_TO_BE16(x) (x)
44 # define HOST_TO_BE32(x) (x)
45 # define BE16_TO_HOST(x) (x)
46 # define BE32_TO_HOST(x) (x)
47 # define HOST_TO_LE16(x) bswap_16(x)
48 # define HOST_TO_LE32(x) bswap_32(x)
49 # define LE16_TO_HOST(x) bswap_16(x)
50 # define LE32_TO_HOST(x) bswap_32(x)
53 #define ALIGN(x,y) (((x)+((y)-1)) & ~((y)-1))
55 #define MAX_NUM_BLOCKS 8
56 #define MAX_ARG_COUNT 32
57 #define MAX_ARG_LEN 1024
58 #define FILE_BUF_LEN (16*1024)
68 uint32_t align; /* alignment of this block */
69 char *file_name; /* name of the file */
70 uint32_t file_size; /* length of the file */
71 char *mmap_name; /* name in the MMAP table */
72 int type; /* block type */
77 #define BLOCK_TYPE_BOOTEXT 0
78 #define BLOCK_TYPE_RAW 1
86 #define MMAP_DATA_SIZE 1024
90 char *name; /* model name */
91 char *desc; /* description */
92 uint16_t vendor; /* vendor id */
93 uint16_t model; /* model id */
94 uint32_t flash_base; /* flash base address */
95 uint32_t flash_size; /* board flash size */
96 uint32_t code_start; /* code start address */
97 uint32_t romio_offs; /* offset of the firmware within the flash */
98 uint32_t bootext_size; /* maximum size of bootext block */
108 struct board_info *board = NULL;
110 struct fw_block blocks[MAX_NUM_BLOCKS];
111 struct fw_block *bootext_block = NULL;
114 #define ADM5120_FLASH_BASE 0xBFC00000
115 #define ADM5120_CODE_START 0x80008000
117 /* TODO: check values for AR7 */
118 #define AR7_FLASH_BASE 0xB0000000
119 #define AR7_CODE_START 0x94008000
121 #define ATHEROS_FLASH_BASE 0xBFC00000
122 #define ATHEROS_CODE_START 0x80e00000
124 #define BOARD(n, d, v, m, fb, fs, cs, fo) { \
125 .name = (n), .desc=(d), \
126 .vendor = (v), .model = (m), \
127 .flash_base = (fb), .flash_size = (fs)<<20, \
128 .code_start = (cs), .romio_offs = (fo), \
129 .bootext_size = BOOTEXT_DEF_SIZE \
132 #define ADMBOARD1(n, d, m, fs) BOARD(n, d, ZYNOS_VENDOR_ID_ZYXEL, m, \
133 ADM5120_FLASH_BASE, fs, ADM5120_CODE_START, 0x8000)
135 #define ADMBOARD2(n, d, m, fs) BOARD(n, d, ZYNOS_VENDOR_ID_ZYXEL, m, \
136 ADM5120_FLASH_BASE, fs, ADM5120_CODE_START, 0x10000)
138 #define AR7BOARD1(n, d, m, fs) BOARD(n, d, ZYNOS_VENDOR_ID_ZYXEL, m, \
139 AR7_FLASH_BASE, fs, AR7_CODE_START, 0x8000)
141 #define ATHEROSBOARD1(n, d, m, fs) BOARD(n, d, ZYNOS_VENDOR_ID_ZYXEL, m, \
142 ATHEROS_FLASH_BASE, fs, ATHEROS_CODE_START, 0x30000)
144 static struct board_info boards[] = {
146 * Infineon/ADMtek ADM5120 based boards
148 ADMBOARD2("ES-2024A", "ZyXEL ES-2024A", ZYNOS_MODEL_ES_2024A, 4),
149 ADMBOARD2("ES-2024PWR", "ZyXEL ES-2024PWR", ZYNOS_MODEL_ES_2024PWR, 4),
150 ADMBOARD2("ES-2108", "ZyXEL ES-2108", ZYNOS_MODEL_ES_2108, 4),
151 ADMBOARD2("ES-2108-F", "ZyXEL ES-2108-F", ZYNOS_MODEL_ES_2108_F, 4),
152 ADMBOARD2("ES-2108-G", "ZyXEL ES-2108-G", ZYNOS_MODEL_ES_2108_G, 4),
153 ADMBOARD2("ES-2108-LC", "ZyXEL ES-2108-LC", ZYNOS_MODEL_ES_2108_LC, 4),
154 ADMBOARD2("ES-2108PWR", "ZyXEL ES-2108PWR", ZYNOS_MODEL_ES_2108PWR, 4),
155 ADMBOARD1("HS-100", "ZyXEL HomeSafe 100", ZYNOS_MODEL_HS_100, 2),
156 ADMBOARD1("HS-100W", "ZyXEL HomeSafe 100W", ZYNOS_MODEL_HS_100W, 2),
157 ADMBOARD1("P-334", "ZyXEL Prestige 334", ZYNOS_MODEL_P_334, 2),
158 ADMBOARD1("P-334U", "ZyXEL Prestige 334U", ZYNOS_MODEL_P_334U, 4),
159 ADMBOARD1("P-334W", "ZyXEL Prestige 334W", ZYNOS_MODEL_P_334W, 2),
160 ADMBOARD1("P-334WH", "ZyXEL Prestige 334WH", ZYNOS_MODEL_P_334WH, 4),
161 ADMBOARD1("P-334WHD", "ZyXEL Prestige 334WHD", ZYNOS_MODEL_P_334WHD, 4),
162 ADMBOARD1("P-334WT", "ZyXEL Prestige 334WT", ZYNOS_MODEL_P_334WT, 4),
163 ADMBOARD1("P-335", "ZyXEL Prestige 335", ZYNOS_MODEL_P_335, 4),
164 ADMBOARD1("P-335Plus", "ZyXEL Prestige 335Plus", ZYNOS_MODEL_P_335PLUS, 4),
165 ADMBOARD1("P-335U", "ZyXEL Prestige 335U", ZYNOS_MODEL_P_335U, 4),
166 ADMBOARD1("P-335WT", "ZyXEL Prestige 335WT", ZYNOS_MODEL_P_335WT, 4),
169 .name = "P-2602HW-D1A",
170 .desc = "ZyXEL P-2602HW-D1A",
171 .vendor = ZYNOS_VENDOR_ID_ZYXEL,
172 .model = ZYNOS_MODEL_P_2602HW_D1A,
173 .flash_base = AR7_FLASH_BASE,
174 .flash_size = 4*1024*1024,
175 .code_start = 0x94008000,
176 .romio_offs = 0x20000,
177 .bootext_size = BOOTEXT_DEF_SIZE,
182 * Texas Instruments AR7 based boards
184 AR7BOARD1("P-660H-61", "ZyXEL P-660H-61", ZYNOS_MODEL_P_660H_61, 2),
185 AR7BOARD1("P-660H-63", "ZyXEL P-660H-63", ZYNOS_MODEL_P_660H_63, 2),
186 AR7BOARD1("P-660H-D1", "ZyXEL P-660H-D1", ZYNOS_MODEL_P_660H_D1, 2),
187 AR7BOARD1("P-660H-D3", "ZyXEL P-660H-D3", ZYNOS_MODEL_P_660H_D3, 2),
188 AR7BOARD1("P-660HW-61", "ZyXEL P-660HW-61", ZYNOS_MODEL_P_660HW_61, 2),
189 AR7BOARD1("P-660HW-63", "ZyXEL P-660HW-63", ZYNOS_MODEL_P_660HW_63, 2),
190 AR7BOARD1("P-660HW-67", "ZyXEL P-660HW-67", ZYNOS_MODEL_P_660HW_67, 2),
191 AR7BOARD1("P-660HW-D1", "ZyXEL P-660HW-D1", ZYNOS_MODEL_P_660HW_D1, 2),
192 AR7BOARD1("P-660HW-D3", "ZyXEL P-660HW-D3", ZYNOS_MODEL_P_660HW_D3, 2),
193 AR7BOARD1("P-660R-61", "ZyXEL P-660R-61", ZYNOS_MODEL_P_660R_61, 2),
194 AR7BOARD1("P-660R-61C", "ZyXEL P-660R-61C", ZYNOS_MODEL_P_660R_61C, 2),
195 AR7BOARD1("P-660R-63", "ZyXEL P-660R-63", ZYNOS_MODEL_P_660R_63, 2),
196 AR7BOARD1("P-660R-63C", "ZyXEL P-660R-63C", ZYNOS_MODEL_P_660R_63C, 2),
197 AR7BOARD1("P-660R-67", "ZyXEL P-660R-67", ZYNOS_MODEL_P_660R_67, 2),
198 AR7BOARD1("P-660R-D1", "ZyXEL P-660R-D1", ZYNOS_MODEL_P_660R_D1, 2),
199 AR7BOARD1("P-660R-D3", "ZyXEL P-660R-D3", ZYNOS_MODEL_P_660R_D3, 2),
203 .desc = "O2 DSL Surf & Phone",
204 .vendor = ZYNOS_VENDOR_ID_O2,
205 .model = ZYNOS_MODEL_O2SURF,
206 .flash_base = AR7_FLASH_BASE,
207 .flash_size = 8*1024*1024,
208 .code_start = 0x94014000,
209 .romio_offs = 0x40000,
210 .bootext_size = BOOTEXT_DEF_SIZE,
216 ATHEROSBOARD1("NBG-318S", "ZyXEL NBG-318S", ZYNOS_MODEL_NBG_318S, 4),
224 #define ERR(fmt, ...) do { \
226 fprintf(stderr, "[%s] *** error: " fmt "\n", \
227 progname, ## __VA_ARGS__ ); \
230 #define ERRS(fmt, ...) do { \
233 fprintf(stderr, "[%s] *** error: " fmt ", %s\n", \
234 progname, ## __VA_ARGS__, strerror(save)); \
237 #define WARN(fmt, ...) do { \
238 fprintf(stderr, "[%s] *** warning: " fmt "\n", \
239 progname, ## __VA_ARGS__ ); \
242 #define DBG(lev, fmt, ...) do { \
243 if (verblevel < lev) \
245 fprintf(stderr, "[%s] " fmt "\n", progname, ## __VA_ARGS__ ); \
249 #define ERR_INVALID_IMAGE -2
257 FILE *stream = (status != EXIT_SUCCESS) ? stderr : stdout;
258 struct board_info *board;
260 fprintf(stream, "Usage: %s [OPTIONS...]\n", progname);
264 " -B <board> create image for the board specified with <board>.\n"
265 " valid <board> values:\n"
267 for (board = boards; board->name != NULL; board++){
270 board->name, board->desc);
273 " -b <file>[:<align>]\n"
274 " add boot extension block to the image\n"
275 " -r <file>[:<align>]\n"
276 " add raw block to the image\n"
277 " -o <file> write output to the file <file>\n"
278 " -h show this screen\n"
289 str2u32(char *arg, uint32_t *val)
295 t = strtoul(arg, &err, 0);
296 if (errno || (err==arg) || ((err != NULL) && *err)) {
306 str2u16(char *arg, uint16_t *val)
312 t = strtoul(arg, &err, 0);
313 if (errno || (err==arg) || ((err != NULL) && *err) || (t >= 0x10000)) {
322 str2u8(char *arg, uint8_t *val)
328 t = strtoul(arg, &err, 0);
329 if (errno || (err==arg) || ((err != NULL) && *err) || (t >= 0x100)) {
338 str2sig(char *arg, uint32_t *sig)
340 if (strlen(arg) != 4)
343 *sig = arg[0] | (arg[1] << 8) | (arg[2] << 16) | (arg[3] << 24);
350 parse_arg(char *arg, char *buf, char *argv[])
358 memset(argv, 0, MAX_ARG_COUNT * sizeof(void *));
371 if (argl >= MAX_ARG_LEN) {
372 /* argument is too long */
373 argl = MAX_ARG_LEN-1;
376 memcpy(buf, arg, argl);
379 for (i = 0; i < MAX_ARG_COUNT; i++) {
380 tok = strsep(ap, ":");
385 else if (tok[0] == '\0') {
398 required_arg(char c, char *arg)
400 if (arg == NULL || *arg != '-')
403 ERR("option -%c requires an argument\n", c);
409 is_empty_arg(char *arg)
420 csum_init(struct csum_state *css)
429 csum_update(uint8_t *p, uint32_t len, struct csum_state *css)
435 css->sum += (css->tmp << 8) + p[0];
436 if (css->sum > 0xFFFF) {
445 for ( ; len > 1; len -= 2, p +=2 ) {
446 css->sum += (p[0] << 8) + p[1];
447 if (css->sum > 0xFFFF) {
461 csum_get(struct csum_state *css)
465 csum_update(&pad, 1, css);
470 csum_buf(uint8_t *p, uint32_t len)
472 struct csum_state css;
475 csum_update(p, len, &css);
476 return csum_get(&css);
481 * routines to write data to the output file
484 write_out_data(FILE *outfile, uint8_t *data, size_t len,
485 struct csum_state *css)
489 fwrite(data, len, 1, outfile);
491 ERR("unable to write output file");
496 csum_update(data, len, css);
504 write_out_padding(FILE *outfile, size_t len, uint8_t padc,
505 struct csum_state *css)
508 size_t buflen = sizeof(buf);
510 memset(buf, padc, buflen);
515 if (write_out_data(outfile, buf, buflen, css))
526 write_out_data_align(FILE *outfile, uint8_t *data, size_t len, size_t align,
527 struct csum_state *css)
532 res = write_out_data(outfile, data, len, css);
536 padlen = ALIGN(len,align) - len;
537 res = write_out_padding(outfile, padlen, 0xFF, css);
544 write_out_header(FILE *outfile, struct zyn_rombin_hdr *hdr)
546 struct zyn_rombin_hdr t;
549 if (fseek(outfile, 0, SEEK_SET) != 0) {
550 ERRS("fseek failed on output file");
554 /* setup temporary header fields */
555 memset(&t, 0, sizeof(t));
556 t.addr = HOST_TO_BE32(hdr->addr);
557 memcpy(&t.sig, ROMBIN_SIGNATURE, ROMBIN_SIG_LEN);
559 t.flags = hdr->flags;
560 t.osize = HOST_TO_BE32(hdr->osize);
561 t.csize = HOST_TO_BE32(hdr->csize);
562 t.ocsum = HOST_TO_BE16(hdr->ocsum);
563 t.ccsum = HOST_TO_BE16(hdr->ccsum);
564 t.mmap_addr = HOST_TO_BE32(hdr->mmap_addr);
566 DBG(2, "hdr.addr = 0x%08x", hdr->addr);
567 DBG(2, "hdr.type = 0x%02x", hdr->type);
568 DBG(2, "hdr.osize = 0x%08x", hdr->osize);
569 DBG(2, "hdr.csize = 0x%08x", hdr->csize);
570 DBG(2, "hdr.flags = 0x%02x", hdr->flags);
571 DBG(2, "hdr.ocsum = 0x%04x", hdr->ocsum);
572 DBG(2, "hdr.ccsum = 0x%04x", hdr->ccsum);
573 DBG(2, "hdr.mmap_addr = 0x%08x", hdr->mmap_addr);
575 return write_out_data(outfile, (uint8_t *)&t, sizeof(t), NULL);
580 write_out_mmap(FILE *outfile, struct fw_mmap *mmap, struct csum_state *css)
582 struct zyn_mmt_hdr *mh;
583 uint8_t buf[MMAP_DATA_SIZE];
588 memset(buf, 0, sizeof(buf));
590 mh = (struct zyn_mmt_hdr *)buf;
592 /* TODO: needs to recreate the memory map too? */
595 /* Build user data section */
596 data = buf+sizeof(*mh);
597 data += sprintf(data, "Vendor 1 %d", board->vendor);
599 data += sprintf(data, "Model 1 %d", BE16_TO_HOST(board->model));
601 /* TODO: make hardware version configurable? */
602 data += sprintf(data, "HwVerRange 2 %d %d", 0, 0);
605 user_size = (uint8_t *)data - buf;
606 mh->user_start= HOST_TO_BE32(mmap->addr+sizeof(*mh));
607 mh->user_end= HOST_TO_BE32(mmap->addr+user_size);
608 mh->csum = HOST_TO_BE16(csum_buf(buf+sizeof(*mh), user_size));
610 res = write_out_data(outfile, buf, sizeof(buf), css);
617 block_stat_file(struct fw_block *block)
622 if (block->file_name == NULL)
625 res = stat(block->file_name, &st);
627 ERRS("stat failed on %s", block->file_name);
631 block->file_size = st.st_size;
637 read_magic(uint16_t *magic)
643 f = fopen(bootext_block->file_name,"r");
645 ERRS("unable to open file: %s", bootext_block->file_name);
650 fread(magic, 2, 1, f);
652 ERRS("unable to read from file: %s", bootext_block->file_name);
666 write_out_file(FILE *outfile, char *name, size_t len, struct csum_state *css)
668 char buf[FILE_BUF_LEN];
669 size_t buflen = sizeof(buf);
673 DBG(2, "writing out file, name=%s, len=%d",
679 ERRS("unable to open file: %s", name);
687 /* read data from source file */
689 fread(buf, buflen, 1, f);
691 ERRS("unable to read from file: %s",name);
696 res = write_out_data(outfile, buf, buflen, css);
709 write_out_block(FILE *outfile, struct fw_block *block, struct csum_state *css)
716 if (block->file_name == NULL)
719 if (block->file_size == 0)
722 res = write_out_file(outfile, block->file_name,
723 block->file_size, css);
729 write_out_image(FILE *outfile)
731 struct fw_block *block;
733 struct zyn_rombin_hdr hdr;
734 struct csum_state css;
741 /* setup header fields */
742 memset(&hdr, 0, sizeof(hdr));
743 hdr.addr = board->code_start;
744 hdr.type = OBJECT_TYPE_BOOTEXT;
745 hdr.flags = ROMBIN_FLAG_OCSUM;
747 offset = board->romio_offs;
749 res = write_out_header(outfile, &hdr);
753 offset += sizeof(hdr);
756 res = write_out_block(outfile, bootext_block, &css);
760 offset += bootext_block->file_size;
761 if (offset > (board->romio_offs + board->bootext_size)) {
762 ERR("bootext file '%s' is too big", bootext_block->file_name);
766 padlen = ALIGN(offset, MMAP_ALIGN) - offset;
767 res = write_out_padding(outfile, padlen, 0xFF, &css);
773 mmap.addr = board->flash_base + offset;
774 res = write_out_mmap(outfile, &mmap, &css);
778 offset += MMAP_DATA_SIZE;
780 if ((offset - board->romio_offs) < board->bootext_size) {
781 padlen = board->romio_offs + board->bootext_size - offset;
782 res = write_out_padding(outfile, padlen, 0xFF, &css);
787 DBG(2, "bootext end at %08x", offset);
790 for (i = 0; i < num_blocks; i++) {
793 if (block->type == BLOCK_TYPE_BOOTEXT)
796 padlen = ALIGN(offset, block->align) - offset;
797 res = write_out_padding(outfile, padlen, 0xFF, &css);
802 res = write_out_block(outfile, block, &css);
805 offset += block->file_size;
808 padlen = ALIGN(offset, 4) - offset;
809 res = write_out_padding(outfile, padlen, 0xFF, &css);
814 csum = csum_get(&css);
815 hdr.mmap_addr = mmap.addr;
818 res = read_magic(&hdr.ocsum);
821 hdr.ocsum = BE16_TO_HOST(hdr.ocsum);
823 if (csum <= hdr.ocsum)
824 t = hdr.ocsum - csum;
826 t = hdr.ocsum - csum - 1;
828 DBG(2, "ocsum=%04x, csum=%04x, fix=%04x", hdr.ocsum, csum, t);
831 res = write_out_data(outfile, (uint8_t *)&t, 2, NULL);
836 res = write_out_header(outfile, &hdr);
843 find_board(char *name)
845 struct board_info *ret;
846 struct board_info *board;
849 for (board = boards; board->name != NULL; board++){
850 if (strcasecmp(name, board->name) == 0) {
861 parse_opt_board(char ch, char *arg)
864 DBG(1,"parsing board option: -%c %s", ch, arg);
867 ERR("only one board option allowed");
871 if (required_arg(ch, arg))
874 board = find_board(arg);
876 ERR("invalid/unknown board specified: %s", arg);
885 parse_opt_ofname(char ch, char *arg)
888 if (ofname != NULL) {
889 ERR("only one output file allowed");
893 if (required_arg(ch, arg))
903 parse_opt_block(char ch, char *arg)
905 char buf[MAX_ARG_LEN];
906 char *argv[MAX_ARG_COUNT];
909 struct fw_block *block;
912 if ( num_blocks >= MAX_NUM_BLOCKS ) {
913 ERR("too many blocks specified");
917 block = &blocks[num_blocks++];
919 /* setup default field values */
925 ERR("only one boot extension block allowed");
928 block->type = BLOCK_TYPE_BOOTEXT;
929 bootext_block = block;
932 block->type = BLOCK_TYPE_RAW;
936 argc = parse_arg(arg, buf, argv);
940 if (is_empty_arg(p)) {
941 ERR("no file specified in %s", arg);
944 block->file_name = strdup(p);
945 if (block->file_name == NULL) {
946 ERR("not enough memory");
951 if (block->type == BLOCK_TYPE_BOOTEXT)
955 if (!is_empty_arg(p)) {
956 if (str2u32(p, &block->align) != 0) {
957 ERR("invalid block align in %s", arg);
967 calc_block_offsets(int type, uint32_t *offset)
969 struct fw_block *block;
974 DBG(1,"calculating block offsets, starting with %lu",
978 for (i = 0; i < num_blocks; i++) {
981 if (block->type != type)
984 next_offs = ALIGN(*offset, block->align);
985 avail = board->flash_size - board->romio_offs - next_offs;
986 if (next_offs + block->file_size > avail) {
987 ERR("file %s is too big, offset = %u, size=%u,"
988 " align = %u", block->file_name,
990 (unsigned)block->file_size,
991 (unsigned)block->align);
996 block->padlen = next_offs - *offset;
997 *offset += block->file_size;
1004 process_blocks(void)
1006 struct fw_block *block;
1011 /* collecting file stats */
1012 for (i = 0; i < num_blocks; i++) {
1014 res = block_stat_file(block);
1019 offset = board->romio_offs + bootext_block->file_size;
1020 res = calc_block_offsets(BLOCK_TYPE_RAW, &offset);
1027 main(int argc, char *argv[])
1029 int optinvalid = 0; /* flag for invalid option */
1031 int res = EXIT_FAILURE;
1035 progname=basename(argv[0]);
1037 opterr = 0; /* could not print standard getopt error messages */
1041 c = getopt(argc, argv, "b:B:ho:r:v");
1048 optinvalid = parse_opt_block(c,optarg);
1051 optinvalid = parse_opt_board(c,optarg);
1054 optinvalid = parse_opt_ofname(c,optarg);
1060 usage(EXIT_SUCCESS);
1066 if (optinvalid != 0 ) {
1067 ERR("invalid option: -%c", optopt);
1072 if (board == NULL) {
1073 ERR("no board specified");
1077 if (ofname == NULL) {
1078 ERR("no output file specified");
1082 if (optind < argc) {
1083 ERR("invalid option: %s", argv[optind]);
1087 if (process_blocks() != 0) {
1091 outfile = fopen(ofname, "w");
1092 if (outfile == NULL) {
1093 ERRS("could not open \"%s\" for writing", ofname);
1097 if (write_out_image(outfile) != 0)
1100 DBG(1,"Image file %s completed.", ofname);
1107 if (res != EXIT_SUCCESS) {