rbutil/mkamsboot/mkamsboot.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * mkamsboot.c - a tool for merging bootloader code into an Sansa V2
  11  *               (AMS) firmware file
  12  *
  13  * Copyright (C) 2008 Dave Chapman
  14  *
  15  * This program is free software; you can redistribute it and/or
  16  * modify it under the terms of the GNU General Public License
  17  * as published by the Free Software Foundation; either version 2
  18  * of the License, or (at your option) any later version.
  19  *
  20  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  21  * KIND, either express or implied.
  22  *
  23  ****************************************************************************/
  24
  25 /*
  26
  27 Insert a Rockbox bootloader into a Sansa AMS original firmware file.
  28
  29 Layout of a Sansa AMS original firmware file:
  30
  31  ----------------------  0x0
  32 |        HEADER        |
  33 |----------------------| 0x400
  34 |    FIRMWARE BLOCK    | (contains the OF version on some fuzev2 firmwares
  35 |----------------------| 0x600
  36 |    FIRMWARE BLOCK    |
  37 |----------------------| 0x400 + firmware block size
  38 |    LIBRARIES/DATA    |
  39  ----------------------  END
  40
  41 We replace the main firmware block while preserving the potential OF version
  42 (bytes 0x600..0x400+firmware_size) as follows:
  43
  44
  45  ----------------------  0x0
  46 |                      |
  47 |    Dual-boot code    |
  48 |                      |
  49 |----------------------|
  50 |     EMPTY SPACE      |
  51 |----------------------|
  52 |                      |
  53 | compressed RB image  |
  54 |                      |
  55 |----------------------|
  56 |                      |
  57 | compressed OF image  |
  58 |                      |
  59 |----------------------|
  60 | UCL unpack function  |
  61  ----------------------
  62
  63 This entire block fits into the space previously occupied by the main
  64 firmware block - the space saved by compressing the OF image is used
  65 to store the compressed version of the Rockbox bootloader.
  66
  67 On version 1 firmwares, the OF image is typically about 120KB, which allows
  68 us to store a Rockbox bootloader with an uncompressed size of about 60KB-70KB.
  69 Version 2 firmwares are bigger and are stored in SDRAM (instead of IRAM).
  70 In both cases, the RAM we are using is mapped at offset 0x0.
  71
  72 mkamsboot then corrects the checksums and writes a new legal firmware
  73 file which can be installed on the device.
  74
  75 When the Sansa device boots, this firmware block is loaded to RAM at
  76 address 0x0 and executed.
  77
  78 Firstly, the dual-boot code will copy the UCL unpack function to the
  79 end of RAM.
  80
  81 Then, depending on the detection of the dual-boot keypress, either the
  82 OF image or the Rockbox image is copied to the end of RAM (just before
  83 the ucl unpack function) and uncompressed to the start of RAM.
  84
  85 Finally, the ucl unpack function branches to address 0x0, passing
  86 execution to the uncompressed firmware.
  87
  88
  89 */
  90
  91 #include <stdio.h>
  92 #include <stdlib.h>
  93 #include <stdint.h>
  94 #include <sys/types.h>
  95 #include <sys/stat.h>
  96 #include <fcntl.h>
  97 #include <unistd.h>
  98 #include <string.h>
  99
 100 #include <ucl/ucl.h>
 101
 102 #include "mkamsboot.h"
 103
 104 #include "md5.h"
 105
 106 /* Header for ARM code binaries */
 107 #include "dualboot.h"
 108
 109 /* Win32 compatibility */
 110 #ifndef O_BINARY
 111 #define O_BINARY 0
 112 #endif
 113
 114 /* 4 for m200, 2 for e200/c200, 1 or 2 for fuze/clip, 1 for clip+ */
 115 const unsigned short hw_revisions[] = {
 116     [MODEL_FUZE]    = 1,
 117     [MODEL_CLIP]    = 1,
 118     [MODEL_CLIPV2]  = 2,
 119     [MODEL_E200V2]  = 2,
 120     [MODEL_M200V4]  = 4,
 121     [MODEL_C200V2]  = 2,
 122     [MODEL_CLIPPLUS]= 1,
 123     [MODEL_FUZEV2]  = 2,
 124 };
 125
 126 /* version 2 is used in Clipv2, Clip+ and Fuzev2 firmwares */
 127 const unsigned short fw_revisions[] = {
 128     [MODEL_FUZE]    = 1,
 129     [MODEL_CLIP]    = 1,
 130     [MODEL_CLIPV2]  = 2,
 131     [MODEL_E200V2]  = 1,
 132     [MODEL_M200V4]  = 1,
 133     [MODEL_C200V2]  = 1,
 134     [MODEL_CLIPPLUS]= 2,
 135     [MODEL_FUZEV2]  = 2,
 136 };
 137
 138 /* Descriptive name of these models */
 139 const char* model_names[] = {
 140     [MODEL_FUZE]    = "Fuze",
 141     [MODEL_CLIP]    = "Clip",
 142     [MODEL_CLIPV2]  = "Clip",
 143     [MODEL_CLIPPLUS]= "Clip+",
 144     [MODEL_E200V2]  = "e200",
 145     [MODEL_M200V4]  = "m200",
 146     [MODEL_C200V2]  = "c200",
 147     [MODEL_FUZEV2]  = "Fuze",
 148 };
 149
 150 /* Dualboot functions for these models */
 151 static const unsigned char* bootloaders[] = {
 152     [MODEL_FUZE]    = dualboot_fuze,
 153     [MODEL_CLIP]    = dualboot_clip,
 154     [MODEL_CLIPV2]  = dualboot_clipv2,
 155     [MODEL_E200V2]  = dualboot_e200v2,
 156     [MODEL_M200V4]  = dualboot_m200v4,
 157     [MODEL_C200V2]  = dualboot_c200v2,
 158     [MODEL_CLIPPLUS]= dualboot_clipplus,
 159     [MODEL_FUZEV2]  = dualboot_fuzev2,
 160 };
 161
 162 /* Size of dualboot functions for these models */
 163 const int bootloader_sizes[] = {
 164     [MODEL_FUZE]    = sizeof(dualboot_fuze),
 165     [MODEL_CLIP]    = sizeof(dualboot_clip),
 166     [MODEL_CLIPV2]  = sizeof(dualboot_clipv2),
 167     [MODEL_E200V2]  = sizeof(dualboot_e200v2),
 168     [MODEL_M200V4]  = sizeof(dualboot_m200v4),
 169     [MODEL_C200V2]  = sizeof(dualboot_c200v2),
 170     [MODEL_CLIPPLUS]= sizeof(dualboot_clipplus),
 171     [MODEL_FUZEV2]  = sizeof(dualboot_fuzev2),
 172 };
 173
 174 /* Model names used in the Rockbox header in ".sansa" files - these match the
 175    -add parameter to the "scramble" tool */
 176 static const char* rb_model_names[] = {
 177     [MODEL_FUZE]    = "fuze",
 178     [MODEL_CLIP]    = "clip",
 179     [MODEL_CLIPV2]  = "clv2",
 180     [MODEL_E200V2]  = "e2v2",
 181     [MODEL_M200V4]  = "m2v4",
 182     [MODEL_C200V2]  = "c2v2",
 183     [MODEL_CLIPPLUS]= "cli+",
 184     [MODEL_FUZEV2]  = "fuz2",
 185 };
 186
 187 /* Model numbers used to initialise the checksum in the Rockbox header in
 188    ".sansa" files - these are the same as MODEL_NUMBER in config-target.h */
 189 static const int rb_model_num[] = {
 190     [MODEL_FUZE]    = 43,
 191     [MODEL_CLIP]    = 40,
 192     [MODEL_CLIPV2]  = 60,
 193     [MODEL_E200V2]  = 41,
 194     [MODEL_M200V4]  = 42,
 195     [MODEL_C200V2]  = 44,
 196     [MODEL_CLIPPLUS]= 66,
 197     [MODEL_FUZEV2]  = 68,
 198 };
 199
 200 /* Checksums of unmodified original firmwares - for safety, and device
 201    detection */
 202 static struct md5sums sansasums[] = {
 203     /* NOTE: Different regional versions of the firmware normally only
 204              differ in the filename - the md5sums are identical */
 205
 206     /*   model       version    md5                        */
 207     { MODEL_E200V2, "3.01.11", "e622ca8cb6df423f54b8b39628a1f0a3" },
 208     { MODEL_E200V2, "3.01.14", "2c1d0383fc3584b2cc83ba8cc2243af6" },
 209     { MODEL_E200V2, "3.01.16", "12563ad71b25a1034cf2092d1e0218c4" },
 210
 211     { MODEL_FUZE,   "1.01.11", "cac8ffa03c599330ac02c4d41de66166" },
 212     { MODEL_FUZE,   "1.01.15", "df0e2c1612727f722c19a3c764cff7f2" },
 213     { MODEL_FUZE,   "1.01.22", "5aff5486fe8dd64239cc71eac470af98" },
 214     { MODEL_FUZE,   "1.02.26", "7c632c479461c48c8833baed74eb5e4f" },
 215     { MODEL_FUZE,   "1.02.28", "5b34260f6470e75f702a9c6825471752" },
 216     { MODEL_FUZE,   "1.02.31", "66d01b37462a5ef7ccc6ad37188b4235" },
 217
 218     { MODEL_C200V2, "3.02.05", "b6378ebd720b0ade3fad4dc7ab61c1a5" },
 219
 220     { MODEL_M200V4, "4.00.45", "82e3194310d1514e3bbcd06e84c4add3" },
 221     { MODEL_M200V4, "4.01.08-A", "fc9dd6116001b3e6a150b898f1b091f0" },
 222     { MODEL_M200V4, "4.01.08-E", "d3fb7d8ec8624ee65bc99f8dab0e2369" },
 223
 224     { MODEL_CLIP,   "1.01.17", "12caad785d506219d73f538772afd99e" },
 225     { MODEL_CLIP,   "1.01.18", "d720b266bd5afa38a198986ef0508a45" },
 226     { MODEL_CLIP,   "1.01.20", "236d8f75189f468462c03f6d292cf2ac" },
 227     { MODEL_CLIP,   "1.01.29", "c12711342169c66e209540cd1f27cd26" },
 228     { MODEL_CLIP,   "1.01.30", "f2974d47c536549c9d8259170f1dbe4d" },
 229     { MODEL_CLIP,   "1.01.32", "d835d12342500732ffb9c4ee54abec15" },
 230     { MODEL_CLIP,   "1.01.35", "b4d0edb3b8f2a4e8eee0a344f7f8e480" },
 231
 232     { MODEL_CLIPV2, "2.01.16", "c57fb3fcbe07c2c9b360f060938f80cb" },
 233     { MODEL_CLIPV2, "2.01.32", "0ad3723e52022509089d938d0fbbf8c5" },
 234     { MODEL_CLIPV2, "2.01.35", "a3cbbd22b9508d7f8a9a1a39acc342c2" },
 235
 236     { MODEL_CLIPPLUS, "01.02.09", "656d38114774c2001dc18e6726df3c5d" },
 237     { MODEL_CLIPPLUS, "01.02.13", "5f89872b79ef440b0e5ee3a7a44328b2" },
 238     { MODEL_CLIPPLUS, "01.02.15", "680a4f521e790ad25b93b1b16f3a207d" },
 239
 240     { MODEL_FUZEV2, "2.01.17", "8b85fb05bf645d08a4c8c3e344ec9ebe" },
 241     { MODEL_FUZEV2, "2.02.26", "d4f6f85c3e4a8ea8f2e5acc421641801" },
 242     { MODEL_FUZEV2, "2.03.31", "74fb197ccd51707388f3b233402186a6" },
 243     { MODEL_FUZEV2, "2.03.33", "1599cc73d02ea7fe53fe2d4379c24b66" },
 244 };
 245
 246 #define NUM_MD5S (sizeof(sansasums)/sizeof(sansasums[0]))
 247
 248 static unsigned int model_memory_size(int model)
 249 {
 250     /* The OF boots with IRAM (320kB) mapped at 0x0 */
 251
 252     if(model == MODEL_CLIPV2)
 253     {
 254         /* The decompressed Clipv2 OF is around 380kB.
 255          * Let's use the full IRAM (1MB on AMSv2)
 256          */
 257         return 1 << 20;
 258     }
 259     else
 260     {
 261         /* The IRAM is 320kB on AMSv1, and 320 will be enough on Fuzev1/Clip+ */
 262         return 320 << 10;
 263     }
 264 }
 265
 266 int firmware_revision(int model)
 267 {
 268     return fw_revisions[model];
 269 }
 270
 271 static off_t filesize(int fd)
 272 {
 273     struct stat buf;
 274
 275     if (fstat(fd, &buf) < 0) {
 276         perror("[ERR]  Checking filesize of input file");
 277         return -1;
 278     } else {
 279         return(buf.st_size);
 280     }
 281 }
 282
 283 static uint32_t get_uint32le(unsigned char* p)
 284 {
 285     return p[0] | (p[1] << 8) | (p[2] << 16) | (p[3] << 24);
 286 }
 287
 288 static uint32_t get_uint32be(unsigned char* p)
 289 {
 290     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
 291 }
 292
 293 static void put_uint32le(unsigned char* p, uint32_t x)
 294 {
 295     p[0] = x & 0xff;
 296     p[1] = (x >> 8) & 0xff;
 297     p[2] = (x >> 16) & 0xff;
 298     p[3] = (x >> 24) & 0xff;
 299 }
 300
 301 void calc_MD5(unsigned char* buf, int len, char *md5str)
 302 {
 303     int i;
 304     md5_context ctx;
 305     unsigned char md5sum[16];
 306
 307     md5_starts(&ctx);
 308     md5_update(&ctx, buf, len);
 309     md5_finish(&ctx, md5sum);
 310
 311     for (i = 0; i < 16; ++i)
 312         sprintf(md5str + 2*i, "%02x", md5sum[i]);
 313 }
 314
 315 /* Calculate a simple checksum used in Sansa Original Firmwares */
 316 static uint32_t calc_checksum(unsigned char* buf, uint32_t n)
 317 {
 318     uint32_t sum = 0;
 319     uint32_t i;
 320
 321     for (i=0;i<n;i+=4)
 322         sum += get_uint32le(buf + i);
 323
 324     return sum;
 325 }
 326
 327 /* Compress using nrv2e algorithm : Thumb decompressor fits in 168 bytes ! */
 328 static unsigned char* uclpack(unsigned char* inbuf, int insize, int* outsize)
 329 {
 330     int maxsize;
 331     unsigned char* outbuf;
 332     int r;
 333
 334     /* The following formula comes from the UCL documentation */
 335     maxsize = insize + (insize / 8) + 256;
 336
 337     /* Allocate some memory for the output buffer */
 338     outbuf = malloc(maxsize);
 339
 340     if (outbuf == NULL)
 341         return NULL;
 342
 343     r = ucl_nrv2e_99_compress(
 344             (const ucl_bytep) inbuf,
 345             (ucl_uint) insize,
 346             (ucl_bytep) outbuf,
 347             (ucl_uintp) outsize,
 348             0, 10, NULL, NULL);
 349
 350     if (r != UCL_E_OK || *outsize > maxsize) {
 351         /* this should NEVER happen, and implies memory corruption */
 352         fprintf(stderr, "internal error - compression failed: %d\n", r);
 353         free(outbuf);
 354         return NULL;
 355     }
 356
 357     return outbuf;
 358 }
 359
 360 #define ERROR(format, ...) \
 361     do { \
 362         snprintf(errstr, errstrsize, format, __VA_ARGS__); \
 363         goto error; \
 364     } while(0)
 365
 366 /* Loads a Sansa AMS Original Firmware file into memory */
 367 unsigned char* load_of_file(
 368         char* filename, int model, off_t* bufsize, struct md5sums *sum,
 369         int* firmware_size, unsigned char** of_packed,
 370         int* of_packedsize, char* errstr, int errstrsize)
 371 {
 372     int fd;
 373     unsigned char* buf =NULL;
 374     off_t n;
 375     unsigned int i=0;
 376     uint32_t checksum;
 377     unsigned int last_word;
 378
 379     fd = open(filename, O_RDONLY|O_BINARY);
 380     if (fd < 0)
 381         ERROR("[ERR]  Could not open %s for reading\n", filename);
 382
 383     *bufsize = filesize(fd);
 384
 385     buf = malloc(*bufsize);
 386     if (buf == NULL)
 387         ERROR("[ERR]  Could not allocate memory for %s\n", filename);
 388
 389     n = read(fd, buf, *bufsize);
 390
 391     if (n != *bufsize)
 392         ERROR("[ERR]  Could not read file %s\n", filename);
 393
 394     /* check the file */
 395
 396     /* Calculate MD5 checksum of OF */
 397     calc_MD5(buf, *bufsize, sum->md5);
 398
 399     while ((i < NUM_MD5S) && (strcmp(sansasums[i].md5, sum->md5) != 0))
 400         i++;
 401
 402     if (i < NUM_MD5S) {
 403         *sum = sansasums[i];
 404         if(sum->model != model) {
 405             ERROR("[ERR]  OF File provided is %sv%d version %s, not for %sv%d\n",
 406                 model_names[sum->model], hw_revisions[sum->model],
 407                 sum->version, model_names[model], hw_revisions[model]
 408             );
 409         }
 410     } else {
 411         /* OF unknown, give a list of tested versions for the requested model */
 412
 413         char tested_versions[100];
 414         tested_versions[0] = '\0';
 415
 416         for (i = 0; i < NUM_MD5S ; i++)
 417             if (sansasums[i].model == model) {
 418                 if (tested_versions[0] != '\0') {
 419                     strncat(tested_versions, ", ",
 420                         sizeof(tested_versions) - strlen(tested_versions) - 1);
 421                 }
 422                 strncat(tested_versions, sansasums[i].version,
 423                     sizeof(tested_versions) - strlen(tested_versions) - 1);
 424             }
 425
 426         ERROR("[ERR]  Original firmware unknown, please try an other version." \
 427               " Tested %sv%d versions are : %s\n",
 428               model_names[model], hw_revisions[model], tested_versions);
 429     }
 430
 431     /* TODO: Do some more sanity checks on the OF image. Some images (like
 432        m200v4) dont have a checksum at the end, only padding (0xdeadbeef). */
 433     last_word = *bufsize - 4;
 434     checksum = get_uint32le(buf + last_word);
 435     if (checksum != 0xefbeadde && checksum != calc_checksum(buf, last_word))
 436         ERROR("%s", "[ERR]  Whole file checksum failed\n");
 437
 438     if (bootloaders[sum->model] == NULL)
 439         ERROR("[ERR]  Unsupported model - \"%s\"\n", model_names[sum->model]);
 440
 441     /* Get the firmware size */
 442     if (fw_revisions[sum->model] == 1)
 443         *firmware_size = get_uint32le(&buf[0x0c]);
 444     else if (fw_revisions[sum->model] == 2)
 445         *firmware_size = get_uint32le(&buf[0x10]);
 446
 447     /* Compress the original firmware image */
 448     *of_packed = uclpack(buf + 0x400, *firmware_size, of_packedsize);
 449     if (*of_packed == NULL)
 450         ERROR("[ERR]  Could not compress %s\n", filename);
 451
 452     return buf;
 453
 454 error:
 455     free(buf);
 456     return NULL;
 457 }
 458
 459 /* Loads a rockbox bootloader file into memory */
 460 unsigned char* load_rockbox_file(
 461             char* filename, int *model, int* bufsize, int* rb_packedsize,
 462             char* errstr, int errstrsize)
 463 {
 464     int fd;
 465     unsigned char* buf = NULL;
 466     unsigned char* packed = NULL;
 467     unsigned char header[8];
 468     uint32_t sum;
 469     off_t n;
 470     int i;
 471
 472     fd = open(filename, O_RDONLY|O_BINARY);
 473     if (fd < 0)
 474         ERROR("[ERR]  Could not open %s for reading\n", filename);
 475
 476     /* Read Rockbox header */
 477     n = read(fd, header, sizeof(header));
 478     if (n != sizeof(header))
 479         ERROR("[ERR]  Could not read file %s\n", filename);
 480
 481     for(*model = 0; *model < NUM_MODELS; (*model)++)
 482         if (memcmp(rb_model_names[*model], header + 4, 4) == 0)
 483             break;
 484
 485     if(*model == NUM_MODELS)
 486         ERROR("[ERR]  Model name \"%4.4s\" unknown. Is this really a rockbox bootloader?\n", header + 4);
 487
 488     *bufsize = filesize(fd) - sizeof(header);
 489
 490     buf = malloc(*bufsize);
 491     if (buf == NULL)
 492         ERROR("[ERR]  Could not allocate memory for %s\n", filename);
 493
 494     n = read(fd, buf, *bufsize);
 495
 496     if (n != *bufsize)
 497         ERROR("[ERR]  Could not read file %s\n", filename);
 498
 499     /* Check checksum */
 500     sum = rb_model_num[*model];
 501     for (i = 0; i < *bufsize; i++) {
 502          /* add 8 unsigned bits but keep a 32 bit sum */
 503          sum += buf[i];
 504     }
 505
 506     if (sum != get_uint32be(header))
 507         ERROR("[ERR]  Checksum mismatch in %s\n", filename);
 508
 509     packed = uclpack(buf, *bufsize, rb_packedsize);
 510     if(packed == NULL)
 511         ERROR("[ERR]  Could not compress %s\n", filename);
 512
 513     free(buf);
 514     return packed;
 515
 516 error:
 517     free(buf);
 518     return NULL;
 519 }
 520
 521 #undef ERROR
 522
 523 /* Patches a Sansa AMS Original Firmware file */
 524 void patch_firmware(
 525         int model, int fw_revision, int firmware_size, unsigned char* buf,
 526         int len, unsigned char* of_packed, int of_packedsize,
 527         unsigned char* rb_packed, int rb_packedsize)
 528 {
 529     unsigned char *p;
 530     uint32_t sum, filesum;
 531     uint32_t ucl_dest;
 532     unsigned int i;
 533
 534     /* Zero the original firmware area - not needed, but helps debugging */
 535     memset(buf + 0x600, 0, firmware_size);
 536
 537     /* Insert dual-boot bootloader at offset 0x200, we preserve the OF
 538      * version string located between 0x0 and 0x200 */
 539     memcpy(buf + 0x600, bootloaders[model], bootloader_sizes[model]);
 540
 541     /* Insert vectors, they won't overwrite the OF version string */
 542
 543     /* Reset vector: branch 0x200 bytes away, to our dualboot code */
 544     static const uint8_t b_0x200[4] = { 0x7e, 0x00, 0x00, 0xea }; // b 0x200
 545     memcpy(buf + 0x400, b_0x200, sizeof(b_0x200));
 546
 547     /* Other vectors: infinite loops */
 548     static const uint8_t b_1b[4]    = { 0xfe, 0xff, 0xff, 0xea }; // 1: b 1b
 549     for (i=1; i < 8; i++)
 550         memcpy(buf + 0x400 + 4*i, b_1b, sizeof(b_1b));
 551
 552     /* We are filling the firmware buffer backwards from the end */
 553     p = buf + 0x400 + firmware_size;
 554
 555     /* 1 - UCL unpack function */
 556     p -= sizeof(nrv2e_d8);
 557     memcpy(p, nrv2e_d8, sizeof(nrv2e_d8));
 558
 559     /* 2 - Compressed copy of original firmware */
 560     p -= of_packedsize;
 561     memcpy(p, of_packed, of_packedsize);
 562
 563     /* 3 - Compressed copy of Rockbox bootloader */
 564     p -= rb_packedsize;
 565     memcpy(p, rb_packed, rb_packedsize);
 566
 567     /* Write the locations of the various images to the variables at the
 568        start of the dualboot image - we save the location of the last byte
 569        in each image, along with the size in bytes */
 570
 571     /* UCL unpack function */
 572     put_uint32le(&buf[0x604], firmware_size - 1);
 573     put_uint32le(&buf[0x608], sizeof(nrv2e_d8));
 574
 575     /* Compressed original firmware image */
 576     put_uint32le(&buf[0x60c], firmware_size - sizeof(nrv2e_d8) - 1);
 577     put_uint32le(&buf[0x610], of_packedsize);
 578
 579     /* Compressed Rockbox image */
 580     put_uint32le(&buf[0x614], firmware_size - sizeof(nrv2e_d8) - of_packedsize
 581             - 1);
 582     put_uint32le(&buf[0x618], rb_packedsize);
 583
 584     ucl_dest = model_memory_size(model) - 1; /* last byte of memory */
 585     put_uint32le(&buf[0x61c], ucl_dest);
 586
 587     /* Update the firmware block checksum */
 588     sum = calc_checksum(buf + 0x400, firmware_size);
 589
 590     if (fw_revision == 1) {
 591         put_uint32le(&buf[0x04], sum);
 592         put_uint32le(&buf[0x204], sum);
 593     } else if (fw_revision == 2) {
 594         put_uint32le(&buf[0x08], sum);
 595         put_uint32le(&buf[0x208], sum);
 596
 597         /* Update the header checksums */
 598         put_uint32le(&buf[0x1fc], calc_checksum(buf, 0x1fc));
 599         put_uint32le(&buf[0x3fc], calc_checksum(buf + 0x200, 0x1fc));
 600     }
 601
 602     /* Update the whole-file checksum */
 603     filesum = 0;
 604     for (i=0;i < (unsigned)len - 4; i+=4)
 605         filesum += get_uint32le(&buf[i]);
 606
 607     put_uint32le(buf + len - 4, filesum);
 608 }
 609
 610 /* returns != 0 if the firmware can be safely patched */
 611 int check_sizes(int model, int rb_packed_size, int rb_unpacked_size,
 612         int of_packed_size, int of_unpacked_size, int *total_size,
 613         char *errstr, int errstrsize)
 614 {
 615     /* XXX: we keep the first 0x200 bytes block unmodified, we just replace
 616      * the ARM vectors */
 617     unsigned int packed_size = bootloader_sizes[model] + sizeof(nrv2e_d8) +
 618             of_packed_size + rb_packed_size + 0x200;
 619
 620     /* how much memory is available */
 621     unsigned int memory_size = model_memory_size(model);
 622
 623     /* the memory used when unpacking the OF */
 624     unsigned int ram_of = sizeof(nrv2e_d8) + of_packed_size + of_unpacked_size;
 625
 626     /* the memory used when unpacking the bootloader */
 627     unsigned int ram_rb = sizeof(nrv2e_d8) + rb_packed_size + rb_unpacked_size;
 628
 629     *total_size = packed_size;
 630
 631 #define ERROR(format, ...) \
 632     do { \
 633         snprintf(errstr, errstrsize, format, __VA_ARGS__); \
 634         return 0; \
 635     } while(0)
 636
 637     /* will packed data fit in the OF file ? */
 638     if(packed_size > of_unpacked_size)
 639         ERROR(
 640             "[ERR]  Packed data (%d bytes) doesn't fit in the firmware "
 641             "(%d bytes)\n", packed_size, of_unpacked_size
 642             );
 643
 644     else if(ram_rb > memory_size)
 645         ERROR("[ERR]  Rockbox can't be unpacked at runtime, needs %d bytes "
 646             "of memory and only %d available\n", ram_rb, memory_size
 647             );
 648
 649     else if(ram_of > memory_size)
 650         ERROR("[ERR]  OF can't be unpacked at runtime, needs %d bytes "
 651             "of memory and only %d available\n", ram_of, memory_size
 652             );
 653
 654     return 1;
 655
 656 #undef ERROR
 657 }