.update file format

The upgrade files accepted by MG35 have a specific format. Basically, such a file is composed by 2 main sections:

• a bootloader, which is written to the flash at location 0 and handles the first phase of booting. This component is confirmed to be optional.
• a romfs image, used by the bootloader to obtain
  • the uClinux kernel
  • the root filesystem compressed in cramfs format.

Creating and splitting a .upgrade file to components are easily done using MG35Tool.

Structure of the file

[UPGIXM02] (ASCII)
[VERS]     (Dword) - Firmware version (ie: 03-04-01-00 = v1.4.3)
[BOOT]     (ASCII)
[CKSMb]    (Dword) - Checksum of bootloader
[OFFSb]    (Dword) - Offset to bootloader in flash (0x00000)
[BOOTLEN]  (Dword) - Length of bootloader
[BOOTLDR]  (Data)  - Start of the bootloader data (*)
...bootloader data...
[ROFS]     (ASCII)
[CKSMr]    (Dword) - Checksum of ROFS
[OFFSr]    (Dword) - Offset to ROFS in flash (0x40000)
[ROFSLEN]  (Dword) - Length of ROFS ([OFFSc]+[LINUX]+[CRAMFS])
[OFFSc]    (Dword) - Offset to Cramfs.img in flash (*)
[LINXGZ]   (Data)  - Start of the linux.gz data
... linux.gz data...
[CRAMFS]   (Data)  - Start of the Cramfs.img data
... cramfs.img data...

(* = Section checksum calculation starts here)
(Note: All data is in little-endian byte order)

romfs format

This part of the .upgrade file can also be loaded via tftp using the bootloader console, that's why we treat it separately here.

The MG-35 "ROMFS" image is not a standard, Linux style "ROMFS" image. In fact, it is not even a filesystem. :-) As you can see, it consists of a header followed by a gzipped linux kernel followed by a standard CramFS image. In the table above, the ROMFS section starts with [OFFSc]

The "romfs" image is composed of the 3 parts:

1. 4 bytes locating the offset of the cramfs image.
2. a compressed uClinux kernel, ~linux.gz
3. Cramfs.img

The 4 byte "header" can be easily found in a complete firmware image. To get the correct one, take a ".upgrade" firmware image and delete everything up to 4 bytes before the start of the compressed kernel.

Calculating the section checksums

The firmware is (to some degree) protected against communication errors by checksums. The checksum algorithm is pretty simple: convert each DWORD of a section into a 32bit unsigned integer and add them all together. So the checksum of a section is the sum of its DWORDs.

To calculate the "ROFS" section's checksum, you start with the [OFFSc] DWORD and end with the last bytes of the CramFS image.

If the checksum recorded in the .update file does not match the one calculated at runtime, the upgrader program will abort.

Calculating the offset to Cramfs.img, OFFSc

The OFFSc, ~linux.gz and cramfs.img are placed in flash at OFFSr (i.e. 0x40000) exactly as they appear in the .update file. Therefore, the start of the cramfs.img is at OFFSr + 4 bytes (for the OFFSc) + length of ~linux.gz.