Adding device support for TP-Link OC200

svanheule · April 30, 2021, 9:12pm

As you see from the staging tree, @stintel (and I) has (have) been looking into this device a bit, as well as @blogic.

The SoC itself is 1.8V, so the board has room for a level shifter to bring that up to 3.3V for the UART header. U13 on the backside of the board takes a MAX3373E, and you'll need to bridge a few unpopulated resistors. Otherwise it's the usual TP-Link layout: TX, RX, GND, VCC.

The device uses a combination of NOR and NAND flash. The (1.8V!) NOR flash has the bootloader, while the main firmware is stored in NAND. Firmware images are signed, and I am not aware of any exploits or measures to defeat the signature checking. Once you have serial access, you can load an initramfs via TFTP. As you can tell, getting to the bootloader is no small feat to start with.
stintel's tree has some FW building script(s), IIRC. My scripts to dump firmware images can be found here:

gist.github.com

https://gist.github.com/svanheule/273fd573c43e3cb0300c4ea31e6bfed0

parse.py

#!/usr/bin/python3
import argparse
import binascii
import hashlib
import struct

# Image header starts with four uint32_be, followed by an MD5 digest
# * version (?)
# * magic number (0xaa55d98f)
# * header length (0x1000)

This file has been truncated. show original

verify.sh

#!/bin/bash
DIGEST_CALC=$(./parse.py -d $1)
DIGEST_SIGN=$(./parse.py -s $1 | xxd -revert -plain | openssl rsautl -verify -pubin -inkey rsa.pem  | xxd -s 15 -plain)

echo "Image contains $DIGEST_CALC"
echo "Calculated     $DIGEST_SIGN"

Finally, the (fast ethernet) switch used in the device is supported by OpenWrt, but only via swconfig. The mvebu target normally uses DSA. As you've found, the GPL sources for the OC200 contain patches to add a DSA driver for the switch, but I'm not sure what other work stintel and blogic have put into this by now.

Be careful with the 1.8V devices, and have fun hacking!