Fix buffer overflow when adding a radio preset.
[kugel-rb.git] / firmware / rolo.c
blob0375a7ac82d61414bd41414bd54b85245a1e4d37
1 /***************************************************************************
2 * __________ __ ___.
3 * Open \______ \ ____ ____ | | _\_ |__ _______ ___
4 * Source | _// _ \_/ ___\| |/ /| __ \ / _ \ \/ /
5 * Jukebox | | ( <_> ) \___| < | \_\ ( <_> > < <
6 * Firmware |____|_ /\____/ \___ >__|_ \|___ /\____/__/\_ \
7 * \/ \/ \/ \/ \/
8 * $Id$
10 * Copyright (C) 2002 Randy D. Wood
12 * All files in this archive are subject to the GNU General Public License.
13 * See the file COPYING in the source tree root for full license agreement.
15 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
16 * KIND, either express or implied.
18 ****************************************************************************/
20 #include "config.h"
21 #include "lcd.h"
22 #include "lcd-remote.h"
23 #include "kernel.h"
24 #include "sprintf.h"
25 #include "button.h"
26 #include "file.h"
27 #include "audio.h"
28 #include "system.h"
29 #include "i2c.h"
30 #include "string.h"
31 #include "buffer.h"
33 #if !defined(IRIVER_IFP7XX_SERIES) && \
34 (CONFIG_CPU != PP5002) && (CONFIG_CPU != S3C2440)
35 /* FIX: this doesn't work on iFP, 3rd Gen ipods */
37 #define IRQ0_EDGE_TRIGGER 0x80
39 #ifdef CPU_PP
40 /* Handle the COP properly - it needs to jump to a function outside SDRAM while
41 * the new firmware is being loaded, and then jump to the start of SDRAM
42 * TODO: Use the mailboxes built into the PP processor for this
45 volatile unsigned char IDATA_ATTR cpu_message = 0;
46 volatile unsigned char IDATA_ATTR cpu_reply = 0;
48 void rolo_restart_cop(void) ICODE_ATTR;
49 void rolo_restart_cop(void)
51 /* Invalidate cache */
52 invalidate_icache();
54 /* Disable cache */
55 CACHE_CTL = CACHE_DISABLE;
57 /* Tell the main core that we're ready to reload */
58 cpu_reply = 2;
60 /* Wait while RoLo loads the image into SDRAM */
61 /* TODO: Accept checksum failure gracefully */
62 while(cpu_message == 1) {}
64 /* Acknowledge the CPU and then reload */
65 cpu_reply = 1;
67 asm volatile(
68 "mov r0, #0x10000000 \n"
69 "mov pc, r0 \n"
72 #endif
74 static void rolo_error(const char *text)
76 lcd_clear_display();
77 lcd_puts(0, 0, "ROLO error:");
78 lcd_puts_scroll(0, 1, text);
79 lcd_update();
80 button_get(true);
81 button_get(true);
82 button_get(true);
83 lcd_stop_scroll();
86 #if CONFIG_CPU == SH7034
87 /* these are in assembler file "descramble.S" */
88 extern unsigned short descramble(const unsigned char* source,
89 unsigned char* dest, int length);
90 extern void rolo_restart(const unsigned char* source, unsigned char* dest,
91 int length);
92 #else
93 void rolo_restart(const unsigned char* source, unsigned char* dest,
94 long length) __attribute__ ((section (".icode")));
95 void rolo_restart(const unsigned char* source, unsigned char* dest,
96 long length)
98 long i;
99 unsigned char* localdest = dest;
100 #if (CONFIG_CPU==PP5020) || (CONFIG_CPU==PP5024)
101 unsigned long* memmapregs = (unsigned long*)0xf000f000;
102 #endif
104 for(i = 0;i < length;i++)
105 *localdest++ = *source++;
107 #if defined(CPU_COLDFIRE)
108 asm (
109 "movec.l %0,%%vbr \n"
110 "move.l (%0)+,%%sp \n"
111 "move.l (%0),%0 \n"
112 "jmp (%0) \n"
113 : : "a"(dest)
115 #elif (CONFIG_CPU==PP5020) || (CONFIG_CPU==PP5024)
117 /* Tell the COP that we've finished loading and started rebooting */
118 cpu_message = 0;
120 /* Flush cache */
121 flush_icache();
123 /* Disable cache */
124 CACHE_CTL = CACHE_DISABLE;
126 /* Reset the memory mapping registers to zero */
127 for (i=0;i<8;i++)
128 memmapregs[i]=0;
130 /* Wait for the COP to tell us it is rebooting */
131 while(cpu_reply != 1) {}
133 asm volatile(
134 "mov r0, #0x10000000 \n"
135 "mov pc, r0 \n"
137 #endif
139 #endif
141 /* This is assigned in the linker control file */
142 extern unsigned long loadaddress;
144 /***************************************************************************
146 * Name: rolo_load_app(char *filename,int scrambled)
147 * Filename must be a fully defined filename including the path and extension
149 ***************************************************************************/
150 int rolo_load(const char* filename)
152 int fd;
153 long length;
154 #if defined(CPU_COLDFIRE) || defined(CPU_PP)
155 int i;
156 unsigned long checksum,file_checksum;
157 #else
158 long file_length;
159 unsigned short checksum,file_checksum;
160 #endif
161 unsigned char* ramstart = (void*)&loadaddress;
163 lcd_clear_display();
164 lcd_puts(0, 0, "ROLO...");
165 lcd_puts(0, 1, "Loading");
166 lcd_update();
167 #ifdef HAVE_REMOTE_LCD
168 lcd_remote_clear_display();
169 lcd_remote_puts(0, 0, "ROLO...");
170 lcd_remote_puts(0, 1, "Loading");
171 lcd_remote_update();
172 #endif
174 audio_stop();
176 fd = open(filename, O_RDONLY);
177 if(-1 == fd) {
178 rolo_error("File not found");
179 return -1;
182 length = filesize(fd) - FIRMWARE_OFFSET_FILE_DATA;
184 #if defined(CPU_COLDFIRE) || defined(CPU_PP)
185 /* Read and save checksum */
186 lseek(fd, FIRMWARE_OFFSET_FILE_CRC, SEEK_SET);
187 if (read(fd, &file_checksum, 4) != 4) {
188 rolo_error("Error Reading checksum");
189 return -1;
192 /* Rockbox checksums are big-endian */
193 file_checksum = betoh32(file_checksum);
194 #ifdef CPU_PP
195 cpu_message = COP_REBOOT;
196 COP_CTL = PROC_WAKE;
197 lcd_puts(0, 2, "Waiting for coprocessor...");
198 lcd_update();
199 while(cpu_reply != 2) {}
200 lcd_puts(0, 2, " ");
201 lcd_update();
202 #endif
204 lseek(fd, FIRMWARE_OFFSET_FILE_DATA, SEEK_SET);
206 if (read(fd, audiobuf, length) != length) {
207 rolo_error("Error Reading File");
208 return -1;
211 checksum = MODEL_NUMBER;
213 for(i = 0;i < length;i++) {
214 checksum += audiobuf[i];
217 /* Verify checksum against file header */
218 if (checksum != file_checksum) {
219 rolo_error("Checksum Error");
220 return -1;
223 lcd_puts(0, 1, "Executing");
224 lcd_update();
225 #ifdef HAVE_REMOTE_LCD
226 lcd_remote_puts(0, 1, "Executing");
227 lcd_remote_update();
228 #endif
230 set_irq_level(HIGHEST_IRQ_LEVEL);
231 #elif CONFIG_CPU == SH7034
232 /* Read file length from header and compare to real file length */
233 lseek(fd, FIRMWARE_OFFSET_FILE_LENGTH, SEEK_SET);
234 if(read(fd, &file_length, 4) != 4) {
235 rolo_error("Error Reading File Length");
236 return -1;
238 if (length != file_length) {
239 rolo_error("File length mismatch");
240 return -1;
243 /* Read and save checksum */
244 lseek(fd, FIRMWARE_OFFSET_FILE_CRC, SEEK_SET);
245 if (read(fd, &file_checksum, 2) != 2) {
246 rolo_error("Error Reading checksum");
247 return -1;
249 lseek(fd, FIRMWARE_OFFSET_FILE_DATA, SEEK_SET);
251 /* verify that file can be read and descrambled */
252 if ((audiobuf + (2*length)+4) >= audiobufend) {
253 rolo_error("Not enough room to load file");
254 return -1;
257 if (read(fd, &audiobuf[length], length) != (int)length) {
258 rolo_error("Error Reading File");
259 return -1;
262 lcd_puts(0, 1, "Descramble");
263 lcd_update();
265 checksum = descramble(audiobuf + length, audiobuf, length);
267 /* Verify checksum against file header */
268 if (checksum != file_checksum) {
269 rolo_error("Checksum Error");
270 return -1;
273 lcd_puts(0, 1, "Executing ");
274 lcd_update();
276 set_irq_level(HIGHEST_IRQ_LEVEL);
278 /* Calling these 2 initialization routines was necessary to get the
279 the origional Archos version of the firmware to load and execute. */
280 system_init(); /* Initialize system for restart */
281 i2c_init(); /* Init i2c bus - it seems like a good idea */
282 ICR = IRQ0_EDGE_TRIGGER; /* Make IRQ0 edge triggered */
283 TSTR = 0xE0; /* disable all timers */
284 /* model-specific de-init, needed when flashed */
285 /* Especially the Archos software is picky about this */
286 #if defined(ARCHOS_RECORDER) || defined(ARCHOS_RECORDERV2) || \
287 defined(ARCHOS_FMRECORDER)
288 PAIOR = 0x0FA0;
289 #endif
290 #endif
291 rolo_restart(audiobuf, ramstart, length);
293 return 0; /* this is never reached */
295 #else /* !defined(IRIVER_IFP7XX_SERIES) */
296 int rolo_load(const char* filename)
298 /* dummy */
299 (void)filename;
300 return 0;
303 #endif /* !defined(IRIVER_IFP7XX_SERIES) */