blob: 1761fc9cb2e6d411ed8bd3b75d78cedacb0ec3f6 [file] [log] [blame]
Amaury Pouly303c4862011-11-06 19:44:03 +00001/***************************************************************************
2 * __________ __ ___.
3 * Open \______ \ ____ ____ | | _\_ |__ _______ ___
4 * Source | _// _ \_/ ___\| |/ /| __ \ / _ \ \/ /
5 * Jukebox | | ( <_> ) \___| < | \_\ ( <_> > < <
6 * Firmware |____|_ /\____/ \___ >__|_ \|___ /\____/__/\_ \
7 * \/ \/ \/ \/ \/
8 * $Id$
9 *
10 * Copyright (C) 2011 by Amaury Pouly
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
16 *
17 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
18 * KIND, either express or implied.
19 *
20 ****************************************************************************/
21#include <stdio.h>
22#include <stdlib.h>
23#include <stdarg.h>
Amaury Pouly42a725f2013-01-29 11:50:46 +000024#include <string.h>
25#include <ctype.h>
Amaury Pouly303c4862011-11-06 19:44:03 +000026#include "mkimxboot.h"
27#include "sb.h"
28#include "dualboot.h"
29#include "md5.h"
Amaury Poulyd5610172013-06-16 01:33:16 +020030#include "elf.h"
Amaury Pouly303c4862011-11-06 19:44:03 +000031
Amaury Pouly58e27b92013-06-15 22:13:08 +020032/* abstract structure to represent a Rockbox firmware. It can be a scrambled file
33 * or an ELF file or whatever. */
34struct rb_fw_t
35{
Amaury Poulyd5610172013-06-16 01:33:16 +020036 int nr_insts;
37 struct sb_inst_t *insts;
38 int entry_idx;
Amaury Pouly58e27b92013-06-15 22:13:08 +020039};
40
Amaury Poulye09c1e32012-05-19 13:55:33 +020041struct imx_fw_variant_desc_t
Amaury Pouly303c4862011-11-06 19:44:03 +000042{
Amaury Poulye09c1e32012-05-19 13:55:33 +020043 /* Offset within file */
44 size_t offset;
45 /* Total size of the firmware */
46 size_t size;
Amaury Pouly303c4862011-11-06 19:44:03 +000047};
48
49struct imx_md5sum_t
50{
Amaury Poulye09c1e32012-05-19 13:55:33 +020051 /* Device model */
52 enum imx_model_t model;
53 /* md5sum of the file */
Amaury Pouly303c4862011-11-06 19:44:03 +000054 char *md5sum;
Amaury Pouly4b1c48f2013-01-15 19:10:01 +000055 /* Version string */
56 const char *version;
Amaury Poulye09c1e32012-05-19 13:55:33 +020057 /* Variant descriptions */
58 struct imx_fw_variant_desc_t fw_variants[VARIANT_COUNT];
Amaury Pouly303c4862011-11-06 19:44:03 +000059};
60
61struct imx_model_desc_t
62{
63 /* Descriptive name of this model */
64 const char *model_name;
65 /* Dualboot code for this model */
66 const unsigned char *dualboot;
67 /* Size of dualboot functions for this model */
68 int dualboot_size;
69 /* Model name used in the Rockbox header in ".sansa" files - these match the
70 -add parameter to the "scramble" tool */
71 const char *rb_model_name;
72 /* Model number used to initialise the checksum in the Rockbox header in
73 ".sansa" files - these are the same as MODEL_NUMBER in config-target.h */
74 const int rb_model_num;
75 /* Number of keys needed to decrypt/encrypt */
76 int nr_keys;
77 /* Array of keys */
78 struct crypto_key_t *keys;
79 /* Dualboot load address */
80 uint32_t dualboot_addr;
81 /* Bootloader load address */
82 uint32_t bootloader_addr;
83};
84
Amaury Poulye09c1e32012-05-19 13:55:33 +020085static const char *imx_fw_variant[] =
86{
87 [VARIANT_DEFAULT] = "default",
88 [VARIANT_ZENXFI2_RECOVERY] = "ZEN X-Fi2 Recovery",
89 [VARIANT_ZENXFI2_NAND] = "ZEN X-Fi2 NAND",
90 [VARIANT_ZENXFI2_SD] = "ZEN X-Fi2 eMMC/SD",
Amaury Poulyf2dfc842013-01-26 18:37:12 +000091 [VARIANT_ZENXFISTYLE_RECOVERY] = "ZEN X-Fi Style Recovery",
Amaury Pouly55babd52013-06-18 15:02:01 +020092 [VARIANT_ZENSTYLE_RECOVERY] = "ZEN Style 100/300 Recovery",
Amaury Poulye09c1e32012-05-19 13:55:33 +020093};
94
Amaury Pouly303c4862011-11-06 19:44:03 +000095static const struct imx_md5sum_t imx_sums[] =
96{
Amaury Pouly05bd3e42013-08-22 00:48:55 +020097 /** Fuze+ */
Amaury Poulye09c1e32012-05-19 13:55:33 +020098 {
99 /* Version 2.38.6 */
Amaury Pouly4b1c48f2013-01-15 19:10:01 +0000100 MODEL_FUZEPLUS, "c3e27620a877dc6b200b97dcb3e0ecc7", "2.38.6",
Amaury Poulye09c1e32012-05-19 13:55:33 +0200101 { [VARIANT_DEFAULT] = { 0, 34652624 } }
102 },
Amaury Pouly05bd3e42013-08-22 00:48:55 +0200103 /** Zen X-Fi2 */
Amaury Poulye09c1e32012-05-19 13:55:33 +0200104 {
Amaury Pouly7fda6922013-01-28 21:02:19 +0000105 /* Version 1.23.01 */
106 MODEL_ZENXFI2, "e37e2c24abdff8e624d0a29f79157850", "1.23.01",
107 {
108 [VARIANT_ZENXFI2_RECOVERY] = { 602128, 684192},
109 [VARIANT_ZENXFI2_NAND] = { 1286320, 42406608 },
110 [VARIANT_ZENXFI2_SD] = { 43692928, 42304208 }
111 }
Amaury Poulye09c1e32012-05-19 13:55:33 +0200112 },
113 {
114 /* Version 1.23.01e */
Amaury Pouly4b1c48f2013-01-15 19:10:01 +0000115 MODEL_ZENXFI2, "2beff2168212d332f13cfc36ca46989d", "1.23.01e",
Amaury Pouly2c36c822013-01-26 18:37:05 +0000116 {
117 [VARIANT_ZENXFI2_RECOVERY] = { 0x93010, 684192},
118 [VARIANT_ZENXFI2_NAND] = { 0x13a0b0, 42410704 },
119 [VARIANT_ZENXFI2_SD] = { 0x29ac380, 42304208 }
Amaury Poulye09c1e32012-05-19 13:55:33 +0200120 }
121 },
Amaury Pouly05bd3e42013-08-22 00:48:55 +0200122 /** Zen X-Fi3 */
Amaury Poulye09c1e32012-05-19 13:55:33 +0200123 {
Amaury Pouly4b1c48f2013-01-15 19:10:01 +0000124 /* Version 1.00.15e */
125 MODEL_ZENXFI3, "658a24eeef5f7186ca731085d8822a87", "1.00.15e",
126 { [VARIANT_DEFAULT] = {0, 18110576} }
127 },
128 {
Amaury Poulye09c1e32012-05-19 13:55:33 +0200129 /* Version 1.00.22e */
Amaury Pouly4b1c48f2013-01-15 19:10:01 +0000130 MODEL_ZENXFI3, "a5114cd45ea4554ec221f51a71083862", "1.00.22e",
Amaury Poulye09c1e32012-05-19 13:55:33 +0200131 { [VARIANT_DEFAULT] = {0, 18110576} }
132 },
Amaury Poulyf2dfc842013-01-26 18:37:12 +0000133 {
Amaury Pouly05bd3e42013-08-22 00:48:55 +0200134 /* Version 1.00.25e */
135 MODEL_ZENXFI3, "7aa036a349feb93d2ec397b1149c9260", "1.00.25e",
136 { [VARIANT_DEFAULT] = {0, 18110576 } }
137 },
138 /** Zen X-Fi Style */
139 {
Amaury Poulyf2dfc842013-01-26 18:37:12 +0000140 /* Version 1.03.04e */
141 MODEL_ZENXFISTYLE, "32a731b7f714e9f99a95991003759c98", "1.03.04",
142 {
143 [VARIANT_DEFAULT] = {842960, 29876944},
144 [VARIANT_ZENXFISTYLE_RECOVERY] = {610272, 232688},
145 }
146 },
147 {
148 /* Version 1.03.04e */
149 MODEL_ZENXFISTYLE, "2c7ee52d9984d85dd39aa49b3331e66c", "1.03.04e",
150 {
151 [VARIANT_DEFAULT] = {842960, 29876944},
152 [VARIANT_ZENXFISTYLE_RECOVERY] = {610272, 232688},
153 }
154 },
Amaury Pouly55babd52013-06-18 15:02:01 +0200155 {
156 /* Version 1.03.04e */
157 MODEL_ZENSTYLE, "dbebec8fe666412061d9740ff68605dd", "1.03.04e",
158 {
159 [VARIANT_DEFAULT] = {758848, 6641344},
160 [VARIANT_ZENSTYLE_RECOVERY] = {610272, 148576},
161 }
162 },
Amaury Pouly6ac481e2013-09-25 14:30:35 +0200163 /** Sony NWZ-E370 */
164 {
165 /* Version 1.00.00 */
166 MODEL_NWZE370, "a615fdb70b3e1bfb0355a5bc2bf237ab", "1.00.00",
167 { [VARIANT_DEFAULT] = {0, 16056320 } }
168 },
Amaury Poulyd13e5b92013-09-28 12:13:30 +0200169 {
170 /* Version 1.00.01 */
171 MODEL_NWZE370, "ee83f3c6026cbcc07097867f06fd585f", "1.00.01",
172 { [VARIANT_DEFAULT] = {0, 16515072 } }
173 },
Amaury Pouly6ac481e2013-09-25 14:30:35 +0200174 /** Sony NWZ-E360 */
175 {
176 /* Version 1.00.00 */
177 MODEL_NWZE360, "d0047f8a87d456a0032297b3c802a1ff", "1.00.00",
178 { [VARIANT_DEFAULT] = {0, 20652032 } }
Amaury Pouly192f3022013-11-13 21:30:52 +0000179 },
180 /** Sony NWZ-E380 */
181 {
182 /* Version 1.00.00 */
183 MODEL_NWZE370, "412f8ccd453195c0bebcc1fd8376322f", "1.00.00",
184 { [VARIANT_DEFAULT] = {0, 16429056 } }
Amaury Pouly6ac481e2013-09-25 14:30:35 +0200185 }
Amaury Pouly303c4862011-11-06 19:44:03 +0000186};
187
188static struct crypto_key_t zero_key =
189{
190 .method = CRYPTO_KEY,
191 .u.key = {0}
192};
193
194static const struct imx_model_desc_t imx_models[] =
195{
Amaury Poulye09c1e32012-05-19 13:55:33 +0200196 [MODEL_FUZEPLUS] = { "Fuze+", dualboot_fuzeplus, sizeof(dualboot_fuzeplus), "fuz+", 72,
Amaury Poulyd9b7d582011-11-06 20:40:54 +0000197 1, &zero_key, 0, 0x40000000 },
Amaury Poulye09c1e32012-05-19 13:55:33 +0200198 [MODEL_ZENXFI2] = {"Zen X-Fi2", dualboot_zenxfi2, sizeof(dualboot_zenxfi2), "zxf2", 82,
199 1, &zero_key, 0, 0x40000000 },
200 [MODEL_ZENXFI3] = {"Zen X-Fi3", dualboot_zenxfi3, sizeof(dualboot_zenxfi3), "zxf3", 83,
201 1, &zero_key, 0, 0x40000000 },
Amaury Poulyf2dfc842013-01-26 18:37:12 +0000202 [MODEL_ZENXFISTYLE] = {"Zen X-Fi Style", NULL, 0, "", -1,
203 1, &zero_key, 0, 0x40000000 },
Amaury Pouly55babd52013-06-18 15:02:01 +0200204 [MODEL_ZENSTYLE] = {"Zen Style 100/300", NULL, 0, "", -1,
205 1, &zero_key, 0, 0x40000000 },
Amaury Pouly6ac481e2013-09-25 14:30:35 +0200206 [MODEL_NWZE370] = {"NWZ-E370", dualboot_nwze370, sizeof(dualboot_nwze370), "e370", 88,
207 1, &zero_key, 0, 0x40000000 },
208 [MODEL_NWZE360] = {"NWZ-E360", dualboot_nwze360, sizeof(dualboot_nwze360), "e360", 89,
209 1, &zero_key, 0, 0x40000000 },
Amaury Pouly303c4862011-11-06 19:44:03 +0000210};
211
212#define NR_IMX_SUMS (sizeof(imx_sums) / sizeof(imx_sums[0]))
213#define NR_IMX_MODELS (sizeof(imx_models) / sizeof(imx_models[0]))
214
215#define MAGIC_ROCK 0x726f636b /* 'rock' */
216#define MAGIC_RECOVERY 0xfee1dead
217#define MAGIC_NORMAL 0xcafebabe
218
Amaury Poulyd5610172013-06-16 01:33:16 +0200219static int rb_fw_get_sb_inst_count(struct rb_fw_t *fw)
220{
221 return fw->nr_insts;
222}
223
224/* fill sb instruction for the firmware, fill fill rb_fw_get_sb_inst_count() instructions */
225static void rb_fw_fill_sb(struct rb_fw_t *fw, struct sb_inst_t *inst,
226 uint32_t entry_arg)
227{
228 memcpy(inst, fw->insts, fw->nr_insts * sizeof(struct sb_inst_t));
229 /* copy data if needed */
230 for(int i = 0; i < fw->nr_insts; i++)
231 if(fw->insts[i].inst == SB_INST_LOAD)
232 fw->insts[i].data = memdup(fw->insts[i].data, fw->insts[i].size);
233 /* replace call argument of the entry point */
234 inst[fw->entry_idx].argument = entry_arg;
235}
236
Amaury Pouly303c4862011-11-06 19:44:03 +0000237static enum imx_error_t patch_std_zero_host_play(int jump_before, int model,
Amaury Pouly58e27b92013-06-15 22:13:08 +0200238 enum imx_output_type_t type, struct sb_file_t *sb_file, struct rb_fw_t boot_fw)
Amaury Pouly303c4862011-11-06 19:44:03 +0000239{
240 /* We assume the file has three boot sections: ____, host, play and one
241 * resource section rsrc.
242 *
243 * Dual Boot:
244 * ----------
245 * We patch the file by inserting the dualboot code before the <jump_before>th
246 * call in the ____ section. We give it as argument the section name 'rock'
247 * and add a section called 'rock' after rsrc which contains the bootloader.
248 *
249 * Single Boot & Recovery:
250 * -----------------------
251 * We patch the file by inserting the bootloader code after the <jump_before>th
252 * call in the ____ section and get rid of everything else. In recovery mode,
253 * we give 0xfee1dead as argument */
254
255 /* Do not override real key and IV */
256 sb_file->override_crypto_iv = false;
257 sb_file->override_real_key = false;
258
Amaury Poulyd5610172013-06-16 01:33:16 +0200259 /* used to manipulate entries */
260 int nr_boot_inst = rb_fw_get_sb_inst_count(&boot_fw);
261
Amaury Pouly303c4862011-11-06 19:44:03 +0000262 /* first locate the good instruction */
263 struct sb_section_t *sec = &sb_file->sections[0];
264 int jump_idx = 0;
265 while(jump_idx < sec->nr_insts && jump_before > 0)
266 if(sec->insts[jump_idx++].inst == SB_INST_CALL)
267 jump_before--;
268 if(jump_idx == sec->nr_insts)
269 {
270 printf("[ERR] Cannot locate call in section ____\n");
271 return IMX_DONT_KNOW_HOW_TO_PATCH;
272 }
273
274 if(type == IMX_DUALBOOT)
275 {
276 /* create a new instruction array with a hole for two instructions */
277 struct sb_inst_t *new_insts = xmalloc(sizeof(struct sb_inst_t) * (sec->nr_insts + 2));
278 memcpy(new_insts, sec->insts, sizeof(struct sb_inst_t) * jump_idx);
279 memcpy(new_insts + jump_idx + 2, sec->insts + jump_idx,
280 sizeof(struct sb_inst_t) * (sec->nr_insts - jump_idx));
281 /* first instruction is be a load */
282 struct sb_inst_t *load = &new_insts[jump_idx];
283 memset(load, 0, sizeof(struct sb_inst_t));
284 load->inst = SB_INST_LOAD;
285 load->size = imx_models[model].dualboot_size;
286 load->addr = imx_models[model].dualboot_addr;
287 /* duplicate memory because it will be free'd */
288 load->data = memdup(imx_models[model].dualboot, imx_models[model].dualboot_size);
289 /* second instruction is a call */
290 struct sb_inst_t *call = &new_insts[jump_idx + 1];
291 memset(call, 0, sizeof(struct sb_inst_t));
292 call->inst = SB_INST_CALL;
293 call->addr = imx_models[model].dualboot_addr;
294 call->argument = MAGIC_ROCK;
295 /* free old instruction array */
296 free(sec->insts);
297 sec->insts = new_insts;
298 sec->nr_insts += 2;
299
300 /* create a new section */
301 struct sb_section_t rock_sec;
302 memset(&rock_sec, 0, sizeof(rock_sec));
Amaury Poulyd5610172013-06-16 01:33:16 +0200303 /* section can have any number of instructions */
Amaury Pouly303c4862011-11-06 19:44:03 +0000304 rock_sec.identifier = MAGIC_ROCK;
305 rock_sec.alignment = BLOCK_SIZE;
Amaury Poulyd5610172013-06-16 01:33:16 +0200306 rock_sec.nr_insts = nr_boot_inst;
307 rock_sec.insts = xmalloc(nr_boot_inst * sizeof(struct sb_inst_t));
308 rb_fw_fill_sb(&boot_fw, rock_sec.insts, MAGIC_NORMAL);
Amaury Pouly303c4862011-11-06 19:44:03 +0000309
310 sb_file->sections = augment_array(sb_file->sections,
311 sizeof(struct sb_section_t), sb_file->nr_sections,
312 &rock_sec, 1);
313 sb_file->nr_sections++;
314
315 return IMX_SUCCESS;
316 }
317 else if(type == IMX_SINGLEBOOT || type == IMX_RECOVERY)
318 {
319 bool recovery = type == IMX_RECOVERY;
Amaury Poulyd5610172013-06-16 01:33:16 +0200320 /* remove everything after the call and add instructions for firmware */
321 struct sb_inst_t *new_insts = xmalloc(sizeof(struct sb_inst_t) * (jump_idx + nr_boot_inst));
Amaury Pouly303c4862011-11-06 19:44:03 +0000322 memcpy(new_insts, sec->insts, sizeof(struct sb_inst_t) * jump_idx);
323 for(int i = jump_idx; i < sec->nr_insts; i++)
324 sb_free_instruction(sec->insts[i]);
Amaury Poulyd5610172013-06-16 01:33:16 +0200325 rb_fw_fill_sb(&boot_fw, &new_insts[jump_idx], recovery ? MAGIC_RECOVERY : MAGIC_NORMAL);
Amaury Pouly58e27b92013-06-15 22:13:08 +0200326
Amaury Pouly303c4862011-11-06 19:44:03 +0000327 free(sec->insts);
328 sec->insts = new_insts;
Amaury Poulyd5610172013-06-16 01:33:16 +0200329 sec->nr_insts = jump_idx + nr_boot_inst;
Amaury Pouly303c4862011-11-06 19:44:03 +0000330 /* remove all other sections */
331 for(int i = 1; i < sb_file->nr_sections; i++)
332 sb_free_section(sb_file->sections[i]);
333 struct sb_section_t *new_sec = xmalloc(sizeof(struct sb_section_t));
334 memcpy(new_sec, &sb_file->sections[0], sizeof(struct sb_section_t));
335 free(sb_file->sections);
336 sb_file->sections = new_sec;
337 sb_file->nr_sections = 1;
338
339 return IMX_SUCCESS;
340 }
341 else
342 {
343 printf("[ERR] Bad output type !\n");
344 return IMX_DONT_KNOW_HOW_TO_PATCH;
345 }
346}
347
Amaury Pouly42a725f2013-01-29 11:50:46 +0000348static enum imx_error_t parse_subversion(const char *s, const char *end, uint16_t *ver)
349{
350 int len = (end == NULL) ? strlen(s) : end - s;
351 if(len > 4)
352 {
353 printf("[ERR] Bad subversion override '%s' (too long)\n", s);
354 return IMX_ERROR;
355 }
356 *ver = 0;
357 for(int i = 0; i < len; i++)
358 {
359 if(!isdigit(s[i]))
360 {
361 printf("[ERR] Bad subversion override '%s' (not a digit)\n", s);
362 return IMX_ERROR;
363 }
364 *ver = *ver << 4 | (s[i] - '0');
365 }
366 return IMX_SUCCESS;
367}
368
369static enum imx_error_t parse_version(const char *s, struct sb_version_t *ver)
370{
371 const char *dot1 = strchr(s, '.');
372 if(dot1 == NULL)
373 {
374 printf("[ERR] Bad version override '%s' (missing dot)\n", s);
375 return IMX_ERROR;
376 }
377 const char *dot2 = strchr(dot1 + 1, '.');
378 if(dot2 == NULL)
379 {
380 printf("[ERR] Bad version override '%s' (missing second dot)\n", s);
381 return IMX_ERROR;
382 }
383 enum imx_error_t ret = parse_subversion(s, dot1, &ver->major);
384 if(ret != IMX_SUCCESS) return ret;
385 ret = parse_subversion(dot1 + 1, dot2, &ver->minor);
386 if(ret != IMX_SUCCESS) return ret;
387 ret = parse_subversion(dot2 + 1, NULL, &ver->revision);
388 if(ret != IMX_SUCCESS) return ret;
389 return IMX_SUCCESS;
390}
391
Amaury Poulye09c1e32012-05-19 13:55:33 +0200392static enum imx_error_t patch_firmware(enum imx_model_t model,
393 enum imx_firmware_variant_t variant, enum imx_output_type_t type,
Amaury Pouly58e27b92013-06-15 22:13:08 +0200394 struct sb_file_t *sb_file, struct rb_fw_t boot_fw,
Amaury Pouly42a725f2013-01-29 11:50:46 +0000395 const char *force_version)
Amaury Pouly303c4862011-11-06 19:44:03 +0000396{
Amaury Pouly42a725f2013-01-29 11:50:46 +0000397 if(force_version)
398 {
399 enum imx_error_t err = parse_version(force_version, &sb_file->product_ver);
400 if(err != IMX_SUCCESS) return err;
401 err = parse_version(force_version, &sb_file->component_ver);
402 if(err != IMX_SUCCESS) return err;
403 }
Amaury Pouly303c4862011-11-06 19:44:03 +0000404 switch(model)
405 {
406 case MODEL_FUZEPLUS:
407 /* The Fuze+ uses the standard ____, host, play sections, patch after third
408 * call in ____ section */
Amaury Pouly58e27b92013-06-15 22:13:08 +0200409 return patch_std_zero_host_play(3, model, type, sb_file, boot_fw);
Amaury Poulye09c1e32012-05-19 13:55:33 +0200410 case MODEL_ZENXFI3:
411 /* The ZEN X-Fi3 uses the standard ____, hSst, pSay sections, patch after third
412 * call in ____ section. Although sections names use the S variant, they are standard. */
Amaury Pouly58e27b92013-06-15 22:13:08 +0200413 return patch_std_zero_host_play(3, model, type, sb_file, boot_fw);
Amaury Pouly6ac481e2013-09-25 14:30:35 +0200414 case MODEL_NWZE360:
415 case MODEL_NWZE370:
416 /* The NWZ-E360/E370 uses the standard ____, host, play sections, patch after first
417 * call in ____ section. */
418 return patch_std_zero_host_play(1, model, type, sb_file, boot_fw);
Amaury Poulye09c1e32012-05-19 13:55:33 +0200419 case MODEL_ZENXFI2:
420 /* The ZEN X-Fi2 has two types of firmware: recovery and normal.
421 * Normal uses the standard ___, host, play sections and recovery only ____ */
422 switch(variant)
423 {
424 case VARIANT_ZENXFI2_RECOVERY:
425 case VARIANT_ZENXFI2_NAND:
426 case VARIANT_ZENXFI2_SD:
Amaury Pouly58e27b92013-06-15 22:13:08 +0200427 return patch_std_zero_host_play(1, model, type, sb_file, boot_fw);
Amaury Poulye09c1e32012-05-19 13:55:33 +0200428 default:
429 return IMX_DONT_KNOW_HOW_TO_PATCH;
430 }
431 break;
Amaury Pouly303c4862011-11-06 19:44:03 +0000432 default:
433 return IMX_DONT_KNOW_HOW_TO_PATCH;
434 }
435}
436
Amaury Pouly303c4862011-11-06 19:44:03 +0000437static uint32_t get_uint32be(unsigned char *p)
438{
439 return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
440}
441
Amaury Poulye09c1e32012-05-19 13:55:33 +0200442void dump_imx_dev_info(const char *prefix)
443{
444 printf("%smkimxboot models:\n", prefix);
445 for(int i = 0; i < NR_IMX_MODELS; i++)
446 {
447 printf("%s %s: idx=%d rb_model=%s rb_num=%d\n", prefix,
448 imx_models[i].model_name, i, imx_models[i].rb_model_name,
449 imx_models[i].rb_model_num);
450 }
451 printf("%smkimxboot variants:\n", prefix);
452 for(int i = 0; i < VARIANT_COUNT; i++)
453 {
454 printf("%s %d: %s\n", prefix, i, imx_fw_variant[i]);
455 }
456 printf("%smkimxboot mapping:\n", prefix);
457 for(int i = 0; i < NR_IMX_SUMS; i++)
458 {
Amaury Pouly4b1c48f2013-01-15 19:10:01 +0000459 printf("%s md5sum=%s -> idx=%d, ver=%s\n", prefix, imx_sums[i].md5sum,
460 imx_sums[i].model, imx_sums[i].version);
Amaury Poulye09c1e32012-05-19 13:55:33 +0200461 for(int j = 0; j < VARIANT_COUNT; j++)
462 if(imx_sums[i].fw_variants[j].size)
463 printf("%s variant=%d -> offset=%#x size=%#x\n", prefix,
464 j, (unsigned)imx_sums[i].fw_variants[j].offset,
465 (unsigned)imx_sums[i].fw_variants[j].size);
466 }
467}
468
Amaury Pouly58e27b92013-06-15 22:13:08 +0200469/* find an entry into imx_sums which matches the MD5 sum of a file */
470static enum imx_error_t find_model_by_md5sum(uint8_t file_md5sum[16], int *md5_idx)
Amaury Pouly303c4862011-11-06 19:44:03 +0000471{
Amaury Pouly58e27b92013-06-15 22:13:08 +0200472 int i = 0;
473 while(i < NR_IMX_SUMS)
Amaury Pouly303c4862011-11-06 19:44:03 +0000474 {
Amaury Pouly58e27b92013-06-15 22:13:08 +0200475 uint8_t md5[20];
476 if(strlen(imx_sums[i].md5sum) != 32)
Amaury Pouly303c4862011-11-06 19:44:03 +0000477 {
Amaury Pouly58e27b92013-06-15 22:13:08 +0200478 printf("[INFO] Invalid MD5 sum in imx_sums\n");
479 return IMX_ERROR;
Amaury Pouly303c4862011-11-06 19:44:03 +0000480 }
Amaury Pouly58e27b92013-06-15 22:13:08 +0200481 for(int j = 0; j < 16; j++)
Amaury Pouly303c4862011-11-06 19:44:03 +0000482 {
Amaury Pouly58e27b92013-06-15 22:13:08 +0200483 byte a, b;
484 if(convxdigit(imx_sums[i].md5sum[2 * j], &a) || convxdigit(imx_sums[i].md5sum[2 * j + 1], &b))
Amaury Pouly303c4862011-11-06 19:44:03 +0000485 {
Amaury Pouly58e27b92013-06-15 22:13:08 +0200486 printf("[ERR][INTERNAL] Bad checksum format: %s\n", imx_sums[i].md5sum);
Amaury Pouly303c4862011-11-06 19:44:03 +0000487 return IMX_ERROR;
488 }
Amaury Pouly58e27b92013-06-15 22:13:08 +0200489 md5[j] = (a << 4) | b;
Amaury Pouly303c4862011-11-06 19:44:03 +0000490 }
Amaury Pouly58e27b92013-06-15 22:13:08 +0200491 if(memcmp(file_md5sum, md5, 16) == 0)
492 break;
493 i++;
494 }
495 if(i == NR_IMX_SUMS)
Amaury Pouly303c4862011-11-06 19:44:03 +0000496 {
Amaury Pouly58e27b92013-06-15 22:13:08 +0200497 printf("[ERR] MD5 sum doesn't match any known file\n");
498 return IMX_NO_MATCH;
499 }
500 *md5_idx = i;
501 return IMX_SUCCESS;
Amaury Pouly303c4862011-11-06 19:44:03 +0000502}
Amaury Poulyf6e44562013-01-26 18:24:06 +0000503
Amaury Pouly58e27b92013-06-15 22:13:08 +0200504/* read a file to a buffer */
505static enum imx_error_t read_file(const char *file, void **buffer, size_t *size)
Amaury Poulyf6e44562013-01-26 18:24:06 +0000506{
Amaury Pouly58e27b92013-06-15 22:13:08 +0200507 FILE *f = fopen(file, "rb");
508 if(f == NULL)
509 {
510 printf("[ERR] Cannot open file '%s' for reading: %m\n", file);
511 return IMX_OPEN_ERROR;
Amaury Poulyf6e44562013-01-26 18:24:06 +0000512 }
Amaury Pouly58e27b92013-06-15 22:13:08 +0200513 fseek(f, 0, SEEK_END);
514 *size = ftell(f);
515 fseek(f, 0, SEEK_SET);
516 *buffer = xmalloc(*size);
517 if(fread(*buffer, *size, 1, f) != 1)
518 {
519 free(*buffer);
520 fclose(f);
521 printf("[ERR] Cannot read file '%s': %m\n", file);
522 return IMX_READ_ERROR;
523 }
524 fclose(f);
525 return IMX_SUCCESS;
526}
527
528/* write a file from a buffer */
529static enum imx_error_t write_file(const char *file, void *buffer, size_t size)
530{
531 FILE *f = fopen(file, "wb");
532 if(f == NULL)
533 {
534 printf("[ERR] Cannot open file '%s' for writing: %m\n", file);
535 return IMX_OPEN_ERROR;
536 }
537 if(fwrite(buffer, size, 1, f) != 1)
538 {
539 fclose(f);
540 printf("[ERR] Cannot write file '%s': %m\n", file);
541 return IMX_WRITE_ERROR;
542 }
543 fclose(f);
544 return IMX_SUCCESS;
545}
546
547/* compute MD5 sum of a buffer */
548static enum imx_error_t compute_md5sum_buf(void *buf, size_t sz, uint8_t file_md5sum[16])
549{
550 md5_context ctx;
551 md5_starts(&ctx);
552 md5_update(&ctx, buf, sz);
553 md5_finish(&ctx, file_md5sum);
554 return IMX_SUCCESS;
555}
556
557/* compute MD5 of a file */
558static enum imx_error_t compute_md5sum(const char *file, uint8_t file_md5sum[16])
559{
Amaury Poulyda8ebce2013-07-30 17:12:23 +0200560 void *buf;
561 size_t sz;
562 enum imx_error_t err = read_file(file, &buf, &sz);
563 if(err != IMX_SUCCESS)
564 return err;
Amaury Pouly58e27b92013-06-15 22:13:08 +0200565 compute_md5sum_buf(buf, sz, file_md5sum);
566 free(buf);
567 return IMX_SUCCESS;
568}
569
570static enum imx_error_t load_sb_file(const char *file, int md5_idx,
571 struct imx_option_t opt, struct sb_file_t **sb_file)
572{
573 if(imx_sums[md5_idx].fw_variants[opt.fw_variant].size == 0)
574 {
575 printf("[ERR] Input file does not contain variant '%s'\n", imx_fw_variant[opt.fw_variant]);
576 return IMX_VARIANT_MISMATCH;
577 }
578 enum imx_model_t model = imx_sums[md5_idx].model;
579 enum sb_error_t err;
580 g_debug = opt.debug;
581 clear_keys();
582 add_keys(imx_models[model].keys, imx_models[model].nr_keys);
583 *sb_file = sb_read_file_ex(file, imx_sums[md5_idx].fw_variants[opt.fw_variant].offset,
Amaury Pouly99f3ca12013-08-21 22:20:53 +0200584 imx_sums[md5_idx].fw_variants[opt.fw_variant].size, false, NULL, generic_std_printf, &err);
Amaury Pouly58e27b92013-06-15 22:13:08 +0200585 if(*sb_file == NULL)
586 {
587 clear_keys();
588 return IMX_FIRST_SB_ERROR + err;
589 }
590 return IMX_SUCCESS;
591}
592
Amaury Poulyd5610172013-06-16 01:33:16 +0200593/* Load a rockbox firwmare from a buffer. Data is copied. Assume firmware is
594 * using our scramble format. */
595static enum imx_error_t rb_fw_load_buf_scramble(struct rb_fw_t *fw, uint8_t *buf,
596 size_t sz, enum imx_model_t model)
Amaury Pouly58e27b92013-06-15 22:13:08 +0200597{
598 if(sz < 8)
599 {
600 printf("[ERR] Bootloader file is too small to be valid\n");
601 return IMX_BOOT_INVALID;
602 }
603 /* check model name */
604 uint8_t *name = buf + 4;
605 if(memcmp(name, imx_models[model].rb_model_name, 4) != 0)
606 {
607 printf("[ERR] Bootloader model doesn't match found model for input file\n");
608 return IMX_BOOT_MISMATCH;
609 }
610 /* check checksum */
611 uint32_t sum = imx_models[model].rb_model_num;
612 for(int i = 8; i < sz; i++)
613 sum += buf[i];
614 if(sum != get_uint32be(buf))
615 {
616 printf("[ERR] Bootloader checksum mismatch\n");
617 return IMX_BOOT_CHECKSUM_ERROR;
618 }
Amaury Poulyd5610172013-06-16 01:33:16 +0200619 /* two instructions: load and jump */
620 fw->nr_insts = 2;
621 fw->entry_idx = 1;
622 fw->insts = xmalloc(fw->nr_insts * sizeof(struct sb_inst_t));
623 memset(fw->insts, 0, fw->nr_insts * sizeof(struct sb_inst_t));
624 fw->insts[0].inst = SB_INST_LOAD;
625 fw->insts[0].addr = imx_models[model].bootloader_addr;
626 fw->insts[0].size = sz - 8;
627 fw->insts[0].data = memdup(buf + 8, sz - 8);
628 fw->insts[1].inst = SB_INST_JUMP;
629 fw->insts[1].addr = imx_models[model].bootloader_addr;
Amaury Pouly58e27b92013-06-15 22:13:08 +0200630 return IMX_SUCCESS;
631}
632
Amaury Poulyd5610172013-06-16 01:33:16 +0200633struct elf_user_t
634{
635 void *buf;
636 size_t sz;
637};
638
Amaury Poulya2d4a4a2013-08-22 17:49:50 +0200639static bool elf_read(void *user, uint32_t addr, void *buf, size_t count)
640{
641 struct elf_user_t *u = user;
642 if(addr + count <= u->sz)
643 {
644 memcpy(buf, u->buf + addr, count);
645 return true;
646 }
647 else
648 return false;
649}
650
Amaury Poulyd5610172013-06-16 01:33:16 +0200651/* Load a rockbox firwmare from a buffer. Data is copied. Assume firmware is
652 * using ELF format. */
653static enum imx_error_t rb_fw_load_buf_elf(struct rb_fw_t *fw, uint8_t *buf,
654 size_t sz, enum imx_model_t model)
655{
656 struct elf_params_t elf;
657 struct elf_user_t user;
658 user.buf = buf;
659 user.sz = sz;
660 elf_init(&elf);
Amaury Poulya2d4a4a2013-08-22 17:49:50 +0200661 if(!elf_read_file(&elf, elf_read, generic_std_printf, &user))
Amaury Poulyd5610172013-06-16 01:33:16 +0200662 {
663 elf_release(&elf);
664 printf("[ERR] Error parsing ELF file\n");
665 return IMX_BOOT_INVALID;
666 }
Amaury Poulyd5610172013-06-16 01:33:16 +0200667 fw->nr_insts = elf_get_nr_sections(&elf) + 1;
668 fw->insts = xmalloc(fw->nr_insts * sizeof(struct sb_inst_t));
669 fw->entry_idx = fw->nr_insts - 1;
670 memset(fw->insts, 0, fw->nr_insts * sizeof(struct sb_inst_t));
671 struct elf_section_t *sec = elf.first_section;
672 for(int i = 0; sec; i++, sec = sec->next)
673 {
Amaury Pouly21672ba2013-08-06 21:24:12 +0200674 fw->insts[i].addr = elf_translate_virtual_address(&elf, sec->addr);
Amaury Poulyd5610172013-06-16 01:33:16 +0200675 fw->insts[i].size = sec->size;
676 if(sec->type == EST_LOAD)
677 {
678 fw->insts[i].inst = SB_INST_LOAD;
679 fw->insts[i].data = memdup(sec->section, sec->size);
680 }
681 else if(sec->type == EST_FILL)
682 {
683 fw->insts[i].inst = SB_INST_FILL;
684 fw->insts[i].pattern = sec->pattern;
685 }
686 else
687 {
688 printf("[WARN] Warning parsing ELF file: unsupported section type mapped to NOP!\n");
689 fw->insts[i].inst = SB_INST_NOP;
690 }
691 }
692 fw->insts[fw->nr_insts - 1].inst = SB_INST_JUMP;
693 if(!elf_get_start_addr(&elf, &fw->insts[fw->nr_insts - 1].addr))
694 {
695 elf_release(&elf);
696 printf("[ERROR] Error parsing ELF file: it has no entry point!\n");
697 return IMX_BOOT_INVALID;
698 }
699 elf_release(&elf);
700 return IMX_SUCCESS;
701}
702
703/* Load a rockbox firwmare from a buffer. Data is copied. */
704static enum imx_error_t rb_fw_load_buf(struct rb_fw_t *fw, uint8_t *buf,
705 size_t sz, enum imx_model_t model)
706{
707 /* detect file format */
708 if(sz >= 4 && buf[0] == 0x7f && memcmp(buf + 1, "ELF", 3) == 0)
709 return rb_fw_load_buf_elf(fw, buf, sz, model);
710 else
711 return rb_fw_load_buf_scramble(fw, buf, sz, model);
712}
713
Amaury Pouly58e27b92013-06-15 22:13:08 +0200714/* load a rockbox firmware from a file. */
715static enum imx_error_t rb_fw_load(struct rb_fw_t *fw, const char *file,
716 enum imx_model_t model)
717{
718 void *buf;
719 size_t sz;
720 int ret = read_file(file, &buf, &sz);
721 if(ret == IMX_SUCCESS)
722 {
723 ret = rb_fw_load_buf(fw, buf, sz, model);
724 free(buf);
725 }
726 return ret;
727}
728
729/* free rockbox firmware */
730static void rb_fw_free(struct rb_fw_t *fw)
731{
Amaury Poulyd5610172013-06-16 01:33:16 +0200732 for(int i = 0; i < fw->nr_insts; i++)
733 sb_free_instruction(fw->insts[i]);
734 free(fw->insts);
735 memset(fw, 0, sizeof(struct rb_fw_t));
Amaury Pouly58e27b92013-06-15 22:13:08 +0200736}
737
738enum imx_error_t mkimxboot(const char *infile, const char *bootfile,
739 const char *outfile, struct imx_option_t opt)
740{
741 /* sanity check */
742 if(opt.fw_variant > VARIANT_COUNT)
743 return IMX_ERROR;
744 /* Dump tables */
745 dump_imx_dev_info("[INFO] ");
746 /* compute MD5 sum of the file */
747 uint8_t file_md5sum[16];
748 enum imx_error_t ret = compute_md5sum(infile, file_md5sum);
749 if(ret != IMX_SUCCESS)
750 return ret;
Amaury Poulyf6e44562013-01-26 18:24:06 +0000751 printf("[INFO] MD5 sum of the file: ");
Amaury Pouly21672ba2013-08-06 21:24:12 +0200752 print_hex(NULL, misc_std_printf, file_md5sum, 16, true);
Amaury Poulyf6e44562013-01-26 18:24:06 +0000753 /* find model */
Amaury Poulyf6e44562013-01-26 18:24:06 +0000754 int md5_idx;
Amaury Pouly58e27b92013-06-15 22:13:08 +0200755 ret = find_model_by_md5sum(file_md5sum, &md5_idx);
756 if(ret != IMX_SUCCESS)
757 return ret;
758 enum imx_model_t model = imx_sums[md5_idx].model;
Amaury Poulyf6e44562013-01-26 18:24:06 +0000759 printf("[INFO] File is for model %d (%s, version %s)\n", model,
760 imx_models[model].model_name, imx_sums[md5_idx].version);
Amaury Pouly58e27b92013-06-15 22:13:08 +0200761 /* load rockbox file */
762 struct rb_fw_t boot_fw;
763 ret = rb_fw_load(&boot_fw, bootfile, model);
764 if(ret != IMX_SUCCESS)
765 return ret;
766 /* load OF file */
767 struct sb_file_t *sb_file;
768 ret = load_sb_file(infile, md5_idx, opt, &sb_file);
769 if(ret != IMX_SUCCESS)
770 {
771 rb_fw_free(&boot_fw);
772 return ret;
773 }
774 /* produce file */
775 ret = patch_firmware(model, opt.fw_variant, opt.output,
776 sb_file, boot_fw, opt.force_version);
777 if(ret == IMX_SUCCESS)
Amaury Pouly99f3ca12013-08-21 22:20:53 +0200778 ret = sb_write_file(sb_file, outfile, NULL, generic_std_printf);
Amaury Poulyf6e44562013-01-26 18:24:06 +0000779
Amaury Pouly58e27b92013-06-15 22:13:08 +0200780 clear_keys();
781 rb_fw_free(&boot_fw);
782 sb_free(sb_file);
783 return ret;
784}
785
786enum imx_error_t extract_firmware(const char *infile,
787 enum imx_firmware_variant_t fw_variant, const char *outfile)
788{
789 /* sanity check */
790 if(fw_variant > VARIANT_COUNT)
791 return IMX_ERROR;
792 /* dump tables */
793 dump_imx_dev_info("[INFO] ");
794 /* compute MD5 sum of the file */
795 void *buf;
796 size_t sz;
797 uint8_t file_md5sum[16];
798 int ret = read_file(infile, &buf, &sz);
799 if(ret != IMX_SUCCESS)
800 return ret;
801 ret = compute_md5sum_buf(buf, sz, file_md5sum);
802 if(ret != IMX_SUCCESS)
803 {
804 free(buf);
805 return ret;
806 }
807 printf("[INFO] MD5 sum of the file: ");
Amaury Pouly21672ba2013-08-06 21:24:12 +0200808 print_hex(NULL, misc_std_printf, file_md5sum, 16, true);
Amaury Pouly58e27b92013-06-15 22:13:08 +0200809 /* find model */
810 int md5_idx;
811 ret = find_model_by_md5sum(file_md5sum, &md5_idx);
812 if(ret != IMX_SUCCESS)
813 {
814 free(buf);
815 return ret;
816 }
817 enum imx_model_t model = imx_sums[md5_idx].model;
818 printf("[INFO] File is for model %d (%s, version %s)\n", model,
819 imx_models[model].model_name, imx_sums[md5_idx].version);
820 /* extract firmware */
Amaury Poulyf6e44562013-01-26 18:24:06 +0000821 if(imx_sums[md5_idx].fw_variants[fw_variant].size == 0)
822 {
823 printf("[ERR] Input file does not contain variant '%s'\n", imx_fw_variant[fw_variant]);
824 free(buf);
825 return IMX_VARIANT_MISMATCH;
826 }
827
Amaury Pouly58e27b92013-06-15 22:13:08 +0200828 ret = write_file(outfile,
829 buf + imx_sums[md5_idx].fw_variants[fw_variant].offset,
830 imx_sums[md5_idx].fw_variants[fw_variant].size);
Amaury Poulyf6e44562013-01-26 18:24:06 +0000831 free(buf);
Amaury Poulyf6e44562013-01-26 18:24:06 +0000832 return ret;
833}