bootloader/main-pp.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * Copyright (C) 2006 by Barry Wardell
  11  *
  12  * Based on Rockbox iriver bootloader by Linus Nielsen Feltzing
  13  * and the ipodlinux bootloader by Daniel Palffy and Bernard Leach
  14  *
  15  * All files in this archive are subject to the GNU General Public License.
  16  * See the file COPYING in the source tree root for full license agreement.
  17  *
  18  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19  * KIND, either express or implied.
  20  *
  21  ****************************************************************************/
  22 #include <stdio.h>
  23 #include <stdlib.h>
  24 #include "common.h"
  25 #include "cpu.h"
  26 #include "file.h"
  27 #include "system.h"
  28 #include "kernel.h"
  29 #include "lcd.h"
  30 #include "font.h"
  31 #include "ata.h"
  32 #include "button.h"
  33 #include "disk.h"
  34 #include "crc32-mi4.h"
  35 #include <string.h>
  36 #include "power.h"
  37 #if defined(SANSA_E200)
  38 #include "i2c.h"
  39 #include "backlight-target.h"
  40 #endif
  41 #if defined(SANSA_E200) || defined(SANSA_C200)
  42 #include "usb.h"
  43 #include "arcotg_udc.h"
  44 #endif
  45
  46
  47 /* Button definitions */
  48 #if CONFIG_KEYPAD == IRIVER_H10_PAD
  49 #define BOOTLOADER_BOOT_OF      BUTTON_LEFT
  50
  51 #elif CONFIG_KEYPAD == SANSA_E200_PAD
  52 #define BOOTLOADER_BOOT_OF      BUTTON_LEFT
  53
  54 #elif CONFIG_KEYPAD == SANSA_C200_PAD
  55 #define BOOTLOADER_BOOT_OF      BUTTON_LEFT
  56
  57 #endif
  58
  59 /* Maximum allowed firmware image size. 10MB is more than enough */
  60 #define MAX_LOADSIZE (10*1024*1024)
  61
  62 /* A buffer to load the original firmware or Rockbox into */
  63 unsigned char *loadbuffer = (unsigned char *)DRAM_START;
  64
  65 /* Bootloader version */
  66 char version[] = APPSVERSION;
  67
  68 /* Locations and sizes in hidden partition on Sansa */
  69 #if defined(SANSA_E200) || defined(SANSA_C200)
  70 #define PPMI_SECTOR_OFFSET  1024
  71 #define PPMI_SECTORS        1
  72 #define MI4_HEADER_SECTORS  1
  73 #define NUM_PARTITIONS      2
  74
  75 #else
  76 #define NUM_PARTITIONS      1
  77
  78 #endif
  79
  80 #define MI4_HEADER_SIZE     0x200
  81
  82 /* mi4 header structure */
  83 struct mi4header_t {
  84     unsigned char magic[4];
  85     uint32_t version;
  86     uint32_t length;
  87     uint32_t crc32;
  88     uint32_t enctype;
  89     uint32_t mi4size;
  90     uint32_t plaintext;
  91     uint32_t dsa_key[10];
  92     uint32_t pad[109];
  93     unsigned char type[4];
  94     unsigned char model[4];
  95 };
  96
  97 /* PPMI header structure */
  98 struct ppmi_header_t {
  99     unsigned char magic[4];
 100     uint32_t length;
 101     uint32_t pad[126];
 102 };
 103
 104 inline unsigned int le2int(unsigned char* buf)
 105 {
 106    int32_t res = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
 107
 108    return res;
 109 }
 110
 111 inline void int2le(unsigned int val, unsigned char* addr)
 112 {
 113     addr[0] = val & 0xFF;
 114     addr[1] = (val >> 8) & 0xff;
 115     addr[2] = (val >> 16) & 0xff;
 116     addr[3] = (val >> 24) & 0xff;
 117 }
 118
 119 struct tea_key {
 120   const char * name;
 121   uint32_t     key[4];
 122 };
 123
 124 #define NUM_KEYS (sizeof(tea_keytable)/sizeof(tea_keytable[0]))
 125 struct tea_key tea_keytable[] = {
 126   { "default" ,          { 0x20d36cc0, 0x10e8c07d, 0xc0e7dcaa, 0x107eb080 } },
 127   { "sansa",             { 0xe494e96e, 0x3ee32966, 0x6f48512b, 0xa93fbb42 } },
 128   { "sansa_gh",          { 0xd7b10538, 0xc662945b, 0x1b3fce68, 0xf389c0e6 } },
 129   { "sansa_103",         { 0x1d29ddc0, 0x2579c2cd, 0xce339e1a, 0x75465dfe } },
 130   { "rhapsody",          { 0x7aa9c8dc, 0xbed0a82a, 0x16204cc7, 0x5904ef38 } },
 131   { "p610",              { 0x950e83dc, 0xec4907f9, 0x023734b9, 0x10cfb7c7 } },
 132   { "p640",              { 0x220c5f23, 0xd04df68e, 0x431b5e25, 0x4dcc1fa1 } },
 133   { "virgin",            { 0xe83c29a1, 0x04862973, 0xa9b3f0d4, 0x38be2a9c } },
 134   { "20gc_eng",          { 0x0240772c, 0x6f3329b5, 0x3ec9a6c5, 0xb0c9e493 } },
 135   { "20gc_fre",          { 0xbede8817, 0xb23bfe4f, 0x80aa682d, 0xd13f598c } },
 136   { "elio_p722",         { 0x6af3b9f8, 0x777483f5, 0xae8181cc, 0xfa6d8a84 } },
 137   { "c200",              { 0xbf2d06fa, 0xf0e23d59, 0x29738132, 0xe2d04ca7 } },
 138   { "c200_103",          { 0x2a7968de, 0x15127979, 0x142e60a7, 0xe49c1893 } },
 139   { "c200_106",          { 0xa913d139, 0xf842f398, 0x3e03f1a6, 0x060ee012 } },
 140 };
 141
 142 /*
 143
 144 tea_decrypt() from http://en.wikipedia.org/wiki/Tiny_Encryption_Algorithm
 145
 146 "Following is an adaptation of the reference encryption and decryption
 147 routines in C, released into the public domain by David Wheeler and
 148 Roger Needham:"
 149
 150 */
 151
 152 /* NOTE: The mi4 version of TEA uses a different initial value to sum compared
 153          to the reference implementation and the main loop is 8 iterations, not
 154          32.
 155 */
 156
 157 static void tea_decrypt(uint32_t* v0, uint32_t* v1, uint32_t* k) {
 158     uint32_t sum=0xF1BBCDC8, i;                    /* set up */
 159     uint32_t delta=0x9E3779B9;                     /* a key schedule constant */
 160     uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */
 161     for(i=0; i<8; i++) {                               /* basic cycle start */
 162         *v1 -= ((*v0<<4) + k2) ^ (*v0 + sum) ^ ((*v0>>5) + k3);
 163         *v0 -= ((*v1<<4) + k0) ^ (*v1 + sum) ^ ((*v1>>5) + k1);
 164         sum -= delta;                                   /* end cycle */
 165     }
 166 }
 167
 168 /* mi4 files are encrypted in 64-bit blocks (two little-endian 32-bit
 169    integers) and the key is incremented after each block
 170  */
 171
 172 static void tea_decrypt_buf(unsigned char* src, unsigned char* dest, size_t n, uint32_t * key)
 173 {
 174     uint32_t v0, v1;
 175     unsigned int i;
 176
 177     for (i = 0; i < (n / 8); i++) {
 178         v0 = le2int(src);
 179         v1 = le2int(src+4);
 180
 181         tea_decrypt(&v0, &v1, key);
 182
 183         int2le(v0, dest);
 184         int2le(v1, dest+4);
 185
 186         src += 8;
 187         dest += 8;
 188
 189         /* Now increment the key */
 190         key[0]++;
 191         if (key[0]==0) {
 192             key[1]++;
 193             if (key[1]==0) {
 194                 key[2]++;
 195                 if (key[2]==0) {
 196                     key[3]++;
 197                 }
 198             }
 199         }
 200     }
 201 }
 202
 203 static inline bool tea_test_key(unsigned char magic_enc[8], uint32_t * key, int unaligned)
 204 {
 205     unsigned char magic_dec[8];
 206     tea_decrypt_buf(magic_enc, magic_dec, 8, key);
 207
 208     return (le2int(&magic_dec[4*unaligned]) == 0xaa55aa55);
 209 }
 210
 211 static int tea_find_key(struct mi4header_t *mi4header, int fd)
 212 {
 213     unsigned int i;
 214     int rc;
 215     unsigned int j;
 216     uint32_t key[4];
 217     unsigned char magic_enc[8];
 218     int key_found = -1;
 219     unsigned int magic_location = mi4header->length-4;
 220     int unaligned = 0;
 221
 222     if ( (magic_location % 8) != 0 )
 223     {
 224         unaligned = 1;
 225         magic_location -= 4;
 226     }
 227
 228     /* Load encrypted magic 0xaa55aa55 to check key */
 229     lseek(fd, MI4_HEADER_SIZE + magic_location, SEEK_SET);
 230     rc = read(fd, magic_enc, 8);
 231     if(rc < 8 )
 232         return EREAD_IMAGE_FAILED;
 233
 234     printf("Searching for key:");
 235
 236     for (i=0; i < NUM_KEYS && (key_found<0) ; i++) {
 237         key[0] = tea_keytable[i].key[0];
 238         key[1] = tea_keytable[i].key[1];
 239         key[2] = tea_keytable[i].key[2];
 240         key[3] = tea_keytable[i].key[3];
 241
 242         /* Now increment the key */
 243         for(j=0; j<((magic_location-mi4header->plaintext)/8); j++){
 244             key[0]++;
 245             if (key[0]==0) {
 246                 key[1]++;
 247                 if (key[1]==0) {
 248                     key[2]++;
 249                     if (key[2]==0) {
 250                         key[3]++;
 251                     }
 252                 }
 253             }
 254         }
 255
 256         if (tea_test_key(magic_enc,key,unaligned))
 257         {
 258             key_found = i;
 259             printf("%s...found", tea_keytable[i].name);
 260         } else {
 261            /* printf("%s...failed", tea_keytable[i].name); */
 262         }
 263     }
 264
 265     return key_found;
 266 }
 267
 268
 269 /* Load mi4 format firmware image */
 270 int load_mi4(unsigned char* buf, char* firmware, unsigned int buffer_size)
 271 {
 272     int fd;
 273     struct mi4header_t mi4header;
 274     int rc;
 275     unsigned long sum;
 276     char filename[MAX_PATH];
 277
 278     snprintf(filename,sizeof(filename),"/.rockbox/%s",firmware);
 279     fd = open(filename, O_RDONLY);
 280     if(fd < 0)
 281     {
 282         snprintf(filename,sizeof(filename),"/%s",firmware);
 283         fd = open(filename, O_RDONLY);
 284         if(fd < 0)
 285             return EFILE_NOT_FOUND;
 286     }
 287
 288     read(fd, &mi4header, MI4_HEADER_SIZE);
 289
 290     /* MI4 file size */
 291     printf("mi4 size: %x", mi4header.mi4size);
 292
 293     if ((mi4header.mi4size-MI4_HEADER_SIZE) > buffer_size)
 294         return EFILE_TOO_BIG;
 295
 296     /* CRC32 */
 297     printf("CRC32: %x", mi4header.crc32);
 298
 299     /* Rockbox model id */
 300     printf("Model id: %.4s", mi4header.model);
 301
 302     /* Read binary type (RBOS, RBBL) */
 303     printf("Binary type: %.4s", mi4header.type);
 304
 305     /* Load firmware file */
 306     lseek(fd, MI4_HEADER_SIZE, SEEK_SET);
 307     rc = read(fd, buf, mi4header.mi4size-MI4_HEADER_SIZE);
 308     if(rc < (int)mi4header.mi4size-MI4_HEADER_SIZE)
 309         return EREAD_IMAGE_FAILED;
 310
 311     /* Check CRC32 to see if we have a valid file */
 312     sum = chksum_crc32 (buf, mi4header.mi4size - MI4_HEADER_SIZE);
 313
 314     printf("Calculated CRC32: %x", sum);
 315
 316     if(sum != mi4header.crc32)
 317         return EBAD_CHKSUM;
 318
 319     if( (mi4header.plaintext + MI4_HEADER_SIZE) != mi4header.mi4size)
 320     {
 321         /* Load encrypted firmware */
 322         int key_index = tea_find_key(&mi4header, fd);
 323
 324         if (key_index < 0)
 325             return EINVALID_FORMAT;
 326
 327         /* Plaintext part is already loaded */
 328         buf += mi4header.plaintext;
 329
 330         /* Decrypt in-place */
 331         tea_decrypt_buf(buf, buf,
 332                         mi4header.mi4size-(mi4header.plaintext+MI4_HEADER_SIZE),
 333                         tea_keytable[key_index].key);
 334
 335         printf("%s key used", tea_keytable[key_index].name);
 336
 337         /* Check decryption was successfull */
 338         if(le2int(&buf[mi4header.length-mi4header.plaintext-4]) != 0xaa55aa55)
 339         {
 340             return EREAD_IMAGE_FAILED;
 341         }
 342     }
 343
 344     return EOK;
 345 }
 346
 347 #if defined(SANSA_E200) || defined(SANSA_C200)
 348 /* Load mi4 firmware from a hidden disk partition */
 349 int load_mi4_part(unsigned char* buf, struct partinfo* pinfo,
 350                   unsigned int buffer_size, bool disable_rebuild)
 351 {
 352     struct mi4header_t mi4header;
 353     struct ppmi_header_t ppmi_header;
 354     unsigned long sum;
 355
 356     /* Read header to find out how long the mi4 file is. */
 357     ata_read_sectors(IF_MV2(0,) pinfo->start + PPMI_SECTOR_OFFSET,
 358                             PPMI_SECTORS, &ppmi_header);
 359
 360     /* The first four characters at 0x80000 (sector 1024) should be PPMI*/
 361     if( memcmp(ppmi_header.magic, "PPMI", 4) )
 362         return EFILE_NOT_FOUND;
 363
 364     printf("BL mi4 size: %x", ppmi_header.length);
 365
 366     /* Read mi4 header of the OF */
 367     ata_read_sectors(IF_MV2(0,) pinfo->start + PPMI_SECTOR_OFFSET + PPMI_SECTORS
 368                        + (ppmi_header.length/512), MI4_HEADER_SECTORS, &mi4header);
 369
 370     /* We don't support encrypted mi4 files yet */
 371     if( (mi4header.plaintext) != (mi4header.mi4size-MI4_HEADER_SIZE))
 372         return EINVALID_FORMAT;
 373
 374     /* MI4 file size */
 375     printf("OF mi4 size: %x", mi4header.mi4size);
 376
 377     if ((mi4header.mi4size-MI4_HEADER_SIZE) > buffer_size)
 378         return EFILE_TOO_BIG;
 379
 380     /* CRC32 */
 381     printf("CRC32: %x", mi4header.crc32);
 382
 383     /* Rockbox model id */
 384     printf("Model id: %.4s", mi4header.model);
 385
 386     /* Read binary type (RBOS, RBBL) */
 387     printf("Binary type: %.4s", mi4header.type);
 388
 389     /* Load firmware */
 390     ata_read_sectors(IF_MV2(0,) pinfo->start + PPMI_SECTOR_OFFSET + PPMI_SECTORS
 391                         + (ppmi_header.length/512) + MI4_HEADER_SECTORS,
 392                         (mi4header.mi4size-MI4_HEADER_SIZE)/512, buf);
 393
 394     /* Check CRC32 to see if we have a valid file */
 395     sum = chksum_crc32 (buf,mi4header.mi4size-MI4_HEADER_SIZE);
 396
 397     printf("Calculated CRC32: %x", sum);
 398
 399     if(sum != mi4header.crc32)
 400         return EBAD_CHKSUM;
 401
 402 #ifdef SANSA_E200
 403     if (disable_rebuild)
 404     {
 405         char block[512];
 406
 407         printf("Disabling database rebuild");
 408
 409         ata_read_sectors(IF_MV2(0,) pinfo->start + 0x3c08, 1, block);
 410         block[0xe1] = 0;
 411         ata_write_sectors(IF_MV2(0,) pinfo->start + 0x3c08, 1, block);
 412     }
 413 #else
 414     (void) disable_rebuild;
 415 #endif
 416
 417     return EOK;
 418 }
 419 #endif
 420
 421 void* main(void)
 422 {
 423     int i;
 424     int btn;
 425     int rc;
 426     int num_partitions;
 427     struct partinfo* pinfo;
 428 #if defined(SANSA_E200) || defined(SANSA_C200)
 429     int usb_retry = 0;
 430     bool usb = false;
 431 #else
 432     char buf[256];
 433     unsigned short* identify_info;
 434 #endif
 435
 436     chksum_crc32gentab ();
 437
 438     system_init();
 439     kernel_init();
 440     lcd_init();
 441     font_init();
 442     button_init();
 443 #if defined(SANSA_E200)
 444     i2c_init();
 445     _backlight_on();
 446 #endif
 447     lcd_set_foreground(LCD_WHITE);
 448     lcd_set_background(LCD_BLACK);
 449     lcd_clear_display();
 450
 451     if (button_hold())
 452     {
 453         verbose = true;
 454         printf("Hold switch on");
 455         printf("Shutting down...");
 456         sleep(HZ);
 457         power_off();
 458     }
 459
 460     btn = button_read_device();
 461 #if defined(SANSA_E200) || defined(SANSA_C200)
 462     usb_init();
 463     while ((UDC_OTGSC&0x800) && usb_retry < 5 && !usb)
 464     {
 465         usb_retry++;
 466         sleep(HZ/4);
 467         usb = (usb_detect() == USB_INSERTED);
 468     }
 469     if (usb)
 470         btn |= BOOTLOADER_BOOT_OF;
 471 #endif
 472     /* Enable bootloader messages if any button is pressed */
 473     if (btn)
 474         verbose = true;
 475
 476     lcd_setfont(FONT_SYSFIXED);
 477
 478     printf("Rockbox boot loader");
 479     printf("Version: %s", version);
 480     printf(MODEL_NAME);
 481
 482     i=ata_init();
 483 #if !defined(SANSA_E200) && !defined(SANSA_C200)
 484     if (i==0) {
 485         identify_info=ata_get_identify();
 486         /* Show model */
 487         for (i=0; i < 20; i++) {
 488             ((unsigned short*)buf)[i]=htobe16(identify_info[i+27]);
 489         }
 490         buf[40]=0;
 491         for (i=39; i && buf[i]==' '; i--) {
 492             buf[i]=0;
 493         }
 494         printf(buf);
 495     } else {
 496         error(EATA, i);
 497     }
 498 #endif
 499
 500     disk_init(IF_MV(0));
 501     num_partitions = disk_mount_all();
 502     if (num_partitions<=0)
 503     {
 504         error(EDISK,num_partitions);
 505     }
 506
 507     /* Just list the first 2 partitions since we don't have any devices yet
 508        that have more than that */
 509     for(i=0; i<NUM_PARTITIONS; i++)
 510     {
 511         pinfo = disk_partinfo(i);
 512         printf("Partition %d: 0x%02x %ld MB",
 513                 i, pinfo->type, pinfo->size / 2048);
 514     }
 515
 516     if(btn & BOOTLOADER_BOOT_OF)
 517     {
 518         /* Load original mi4 firmware in to a memory buffer called loadbuffer.
 519            The rest of the loading is done in crt0.S.
 520            1) First try reading from the hidden partition (on Sansa only).
 521            2) Next try a decrypted mi4 file in /System/OF.mi4
 522            3) Finally, try a raw firmware binary in /System/OF.mi4. It should be
 523               a mi4 firmware decrypted and header stripped using mi4code.
 524         */
 525         printf("Loading original firmware...");
 526
 527 #if defined(SANSA_E200) || defined(SANSA_C200)
 528         /* First try a (hidden) firmware partition */
 529         printf("Trying firmware partition");
 530         pinfo = disk_partinfo(1);
 531         if(pinfo->type == PARTITION_TYPE_OS2_HIDDEN_C_DRIVE)
 532         {
 533             rc = load_mi4_part(loadbuffer, pinfo, MAX_LOADSIZE, usb);
 534             if (rc < EOK) {
 535                 printf("Can't load from partition");
 536                 printf(strerror(rc));
 537             } else {
 538                 return (void*)loadbuffer;
 539             }
 540         } else {
 541             printf("No hidden partition found.");
 542         }
 543 #endif
 544
 545         printf("Trying /System/OF.mi4");
 546         rc=load_mi4(loadbuffer, "/System/OF.mi4", MAX_LOADSIZE);
 547         if (rc < EOK) {
 548             printf("Can't load /System/OF.mi4");
 549             printf(strerror(rc));
 550         } else {
 551             return (void*)loadbuffer;
 552         }
 553
 554         printf("Trying /System/OF.bin");
 555         rc=load_raw_firmware(loadbuffer, "/System/OF.bin", MAX_LOADSIZE);
 556         if (rc < EOK) {
 557             printf("Can't load /System/OF.bin");
 558             printf(strerror(rc));
 559         } else {
 560             return (void*)loadbuffer;
 561         }
 562
 563         error(0, 0);
 564
 565     } else {
 566 #if 0 /* e200: enable to be able to dump the hidden partition */
 567         if(btn & BUTTON_UP)
 568         {
 569             int fd;
 570             pinfo = disk_partinfo(1);
 571             fd = open("/part.bin", O_CREAT|O_RDWR);
 572             char sector[512];
 573             for(i=0; i<40960; i++){
 574                 if (!(i%100))
 575                 {
 576                     printf("dumping sector %d", i);
 577                 }
 578                 ata_read_sectors(IF_MV2(0,) pinfo->start + i, 1, sector);
 579                 write(fd,sector,512);
 580             }
 581             close(fd);
 582         }
 583 #endif
 584         printf("Loading Rockbox...");
 585         rc=load_mi4(loadbuffer, BOOTFILE, MAX_LOADSIZE);
 586         if (rc < EOK) {
 587             printf("Can't load %s:", BOOTFILE);
 588             printf(strerror(rc));
 589
 590 #ifdef OLD_BOOTFILE
 591             /* Try loading rockbox from old rockbox.e200/rockbox.h10 format */
 592             rc=load_firmware(loadbuffer, OLD_BOOTFILE, MAX_LOADSIZE);
 593             if (rc < EOK) {
 594                 printf("Can't load %s:", OLD_BOOTFILE);
 595                 error(EBOOTFILE, rc);
 596             }
 597 #endif
 598         }
 599     }
 600
 601     return (void*)loadbuffer;
 602 }
 603
 604 #if !defined(SANSA_E200) && !defined(SANSA_C200)
 605 /* These functions are present in the firmware library, but we reimplement
 606    them here because the originals do a lot more than we want */
 607 void usb_acknowledge(void)
 608 {
 609 }
 610
 611 void usb_wait_for_disconnect(void)
 612 {
 613 }
 614 #endif
 615