rbutil/mkimxboot/mkimxboot.c

   1 /***************************************************************************
   2  *             __________               __   ___.
   3  *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
   4  *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
   5  *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
   6  *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
   7  *                     \/            \/     \/    \/            \/
   8  * $Id$
   9  *
  10  * Copyright (C) 2011 by Amaury Pouly
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  18  * KIND, either express or implied.
  19  *
  20  ****************************************************************************/
  21 #include <stdio.h>
  22 #include <stdlib.h>
  23 #include <stdarg.h>
  24 #include "mkimxboot.h"
  25 #include "sb.h"
  26 #include "dualboot.h"
  27 #include "md5.h"
  28
  29 struct imx_fw_variant_desc_t
  30 {
  31     /* Offset within file */
  32     size_t offset;
  33     /* Total size of the firmware */
  34     size_t size;
  35 };
  36
  37 struct imx_md5sum_t
  38 {
  39     /* Device model */
  40     enum imx_model_t model;
  41     /* md5sum of the file */
  42     char *md5sum;
  43     /* Variant descriptions */
  44     struct imx_fw_variant_desc_t fw_variants[VARIANT_COUNT];
  45 };
  46
  47 struct imx_model_desc_t
  48 {
  49     /* Descriptive name of this model */
  50     const char *model_name;
  51     /* Dualboot code for this model */
  52     const unsigned char *dualboot;
  53     /* Size of dualboot functions for this model */
  54     int dualboot_size;
  55     /* Model name used in the Rockbox header in ".sansa" files - these match the
  56        -add parameter to the "scramble" tool */
  57     const char *rb_model_name;
  58     /* Model number used to initialise the checksum in the Rockbox header in
  59        ".sansa" files - these are the same as MODEL_NUMBER in config-target.h */
  60     const int rb_model_num;
  61     /* Number of keys needed to decrypt/encrypt */
  62     int nr_keys;
  63     /* Array of keys */
  64     struct crypto_key_t *keys;
  65     /* Dualboot load address */
  66     uint32_t dualboot_addr;
  67     /* Bootloader load address */
  68     uint32_t bootloader_addr;
  69 };
  70
  71 static const char *imx_fw_variant[] =
  72 {
  73     [VARIANT_DEFAULT] = "default",
  74     [VARIANT_ZENXFI2_RECOVERY] = "ZEN X-Fi2 Recovery",
  75     [VARIANT_ZENXFI2_NAND] = "ZEN X-Fi2 NAND",
  76     [VARIANT_ZENXFI2_SD] = "ZEN X-Fi2 eMMC/SD",
  77 };
  78
  79 static const struct imx_md5sum_t imx_sums[] =
  80 {
  81     {
  82         /* Version 2.38.6 */
  83         MODEL_FUZEPLUS, "c3e27620a877dc6b200b97dcb3e0ecc7",
  84         { [VARIANT_DEFAULT] = { 0, 34652624 } }
  85     },
  86     {
  87         /* Version 1.23.01e */
  88         MODEL_ZENXFI2, "e37e2c24abdff8e624d0a29f79157850",
  89     },
  90     {
  91         /* Version 1.23.01e */
  92         MODEL_ZENXFI2, "2beff2168212d332f13cfc36ca46989d",
  93         { [VARIANT_ZENXFI2_RECOVERY] = { 0x93010, 684192},
  94           [VARIANT_ZENXFI2_NAND] = { 0x13a0b0, 42410704 },
  95           [VARIANT_ZENXFI2_SD] = { 0x29ac380, 42304208 }
  96         }
  97     },
  98     {
  99         /* Version 1.00.22e */
 100         MODEL_ZENXFI3, "658a24eeef5f7186ca731085d8822a87",
 101         { [VARIANT_DEFAULT] = {0, 18110576} }
 102     },
 103 };
 104
 105 static struct crypto_key_t zero_key =
 106 {
 107     .method = CRYPTO_KEY,
 108     .u.key = {0}
 109 };
 110
 111 static const struct imx_model_desc_t imx_models[] =
 112 {
 113     [MODEL_FUZEPLUS] = { "Fuze+",  dualboot_fuzeplus, sizeof(dualboot_fuzeplus), "fuz+", 72,
 114                           1, &zero_key, 0, 0x40000000 },
 115     [MODEL_ZENXFI2] = {"Zen X-Fi2", dualboot_zenxfi2, sizeof(dualboot_zenxfi2), "zxf2", 82,
 116                        1, &zero_key, 0, 0x40000000 },
 117     [MODEL_ZENXFI3] = {"Zen X-Fi3", dualboot_zenxfi3, sizeof(dualboot_zenxfi3), "zxf3", 83,
 118                        1, &zero_key, 0, 0x40000000 },
 119 };
 120
 121 #define NR_IMX_SUMS     (sizeof(imx_sums) / sizeof(imx_sums[0]))
 122 #define NR_IMX_MODELS   (sizeof(imx_models) / sizeof(imx_models[0]))
 123
 124 #define MAGIC_ROCK      0x726f636b /* 'rock' */
 125 #define MAGIC_RECOVERY  0xfee1dead
 126 #define MAGIC_NORMAL    0xcafebabe
 127
 128 static enum imx_error_t patch_std_zero_host_play(int jump_before, int model,
 129  enum imx_output_type_t type, struct sb_file_t *sb_file, void *boot, size_t boot_sz)
 130 {
 131     /* We assume the file has three boot sections: ____, host, play and one
 132      * resource section rsrc.
 133      *
 134      * Dual Boot:
 135      * ----------
 136      * We patch the file by inserting the dualboot code before the <jump_before>th
 137      * call in the ____ section. We give it as argument the section name 'rock'
 138      * and add a section called 'rock' after rsrc which contains the bootloader.
 139      *
 140      * Single Boot & Recovery:
 141      * -----------------------
 142      * We patch the file by inserting the bootloader code after the <jump_before>th
 143      * call in the ____ section and get rid of everything else. In recovery mode,
 144      * we give 0xfee1dead as argument */
 145
 146     /* Do not override real key and IV */
 147     sb_file->override_crypto_iv = false;
 148     sb_file->override_real_key = false;
 149
 150     /* first locate the good instruction */
 151     struct sb_section_t *sec = &sb_file->sections[0];
 152     int jump_idx = 0;
 153     while(jump_idx < sec->nr_insts && jump_before > 0)
 154         if(sec->insts[jump_idx++].inst == SB_INST_CALL)
 155             jump_before--;
 156     if(jump_idx == sec->nr_insts)
 157     {
 158         printf("[ERR] Cannot locate call in section ____\n");
 159         return IMX_DONT_KNOW_HOW_TO_PATCH;
 160     }
 161
 162     if(type == IMX_DUALBOOT)
 163     {
 164         /* create a new instruction array with a hole for two instructions */
 165         struct sb_inst_t *new_insts = xmalloc(sizeof(struct sb_inst_t) * (sec->nr_insts + 2));
 166         memcpy(new_insts, sec->insts, sizeof(struct sb_inst_t) * jump_idx);
 167         memcpy(new_insts + jump_idx + 2, sec->insts + jump_idx,
 168             sizeof(struct sb_inst_t) * (sec->nr_insts - jump_idx));
 169         /* first instruction is be a load */
 170         struct sb_inst_t *load = &new_insts[jump_idx];
 171         memset(load, 0, sizeof(struct sb_inst_t));
 172         load->inst = SB_INST_LOAD;
 173         load->size = imx_models[model].dualboot_size;
 174         load->addr = imx_models[model].dualboot_addr;
 175         /* duplicate memory because it will be free'd */
 176         load->data = memdup(imx_models[model].dualboot, imx_models[model].dualboot_size);
 177         /* second instruction is a call */
 178         struct sb_inst_t *call = &new_insts[jump_idx + 1];
 179         memset(call, 0, sizeof(struct sb_inst_t));
 180         call->inst = SB_INST_CALL;
 181         call->addr = imx_models[model].dualboot_addr;
 182         call->argument = MAGIC_ROCK;
 183         /* free old instruction array */
 184         free(sec->insts);
 185         sec->insts = new_insts;
 186         sec->nr_insts += 2;
 187
 188         /* create a new section */
 189         struct sb_section_t rock_sec;
 190         memset(&rock_sec, 0, sizeof(rock_sec));
 191         /* section has two instructions: load and call */
 192         rock_sec.identifier = MAGIC_ROCK;
 193         rock_sec.alignment = BLOCK_SIZE;
 194         rock_sec.nr_insts = 2;
 195         rock_sec.insts = xmalloc(2 * sizeof(struct sb_inst_t));
 196         memset(rock_sec.insts, 0, 2 * sizeof(struct sb_inst_t));
 197         rock_sec.insts[0].inst = SB_INST_LOAD;
 198         rock_sec.insts[0].size = boot_sz;
 199         rock_sec.insts[0].data = memdup(boot, boot_sz);
 200         rock_sec.insts[0].addr = imx_models[model].bootloader_addr;
 201         rock_sec.insts[1].inst = SB_INST_JUMP;
 202         rock_sec.insts[1].addr = imx_models[model].bootloader_addr;
 203         rock_sec.insts[1].argument = MAGIC_NORMAL;
 204
 205         sb_file->sections = augment_array(sb_file->sections,
 206             sizeof(struct sb_section_t), sb_file->nr_sections,
 207             &rock_sec, 1);
 208         sb_file->nr_sections++;
 209
 210         return IMX_SUCCESS;
 211     }
 212     else if(type == IMX_SINGLEBOOT || type == IMX_RECOVERY)
 213     {
 214         bool recovery = type == IMX_RECOVERY;
 215         /* remove everything after the call and add two instructions: load and call */
 216         struct sb_inst_t *new_insts = xmalloc(sizeof(struct sb_inst_t) * (jump_idx + 2));
 217         memcpy(new_insts, sec->insts, sizeof(struct sb_inst_t) * jump_idx);
 218         for(int i = jump_idx; i < sec->nr_insts; i++)
 219             sb_free_instruction(sec->insts[i]);
 220         memset(new_insts + jump_idx, 0, 2 * sizeof(struct sb_inst_t));
 221         new_insts[jump_idx + 0].inst = SB_INST_LOAD;
 222         new_insts[jump_idx + 0].size = boot_sz;
 223         new_insts[jump_idx + 0].data = memdup(boot, boot_sz);
 224         new_insts[jump_idx + 0].addr = imx_models[model].bootloader_addr;
 225         new_insts[jump_idx + 1].inst = SB_INST_JUMP;
 226         new_insts[jump_idx + 1].addr = imx_models[model].bootloader_addr;
 227         new_insts[jump_idx + 1].argument = recovery ? MAGIC_RECOVERY : MAGIC_NORMAL;
 228
 229         free(sec->insts);
 230         sec->insts = new_insts;
 231         sec->nr_insts = jump_idx + 2;
 232         /* remove all other sections */
 233         for(int i = 1; i < sb_file->nr_sections; i++)
 234             sb_free_section(sb_file->sections[i]);
 235         struct sb_section_t *new_sec = xmalloc(sizeof(struct sb_section_t));
 236         memcpy(new_sec, &sb_file->sections[0], sizeof(struct sb_section_t));
 237         free(sb_file->sections);
 238         sb_file->sections = new_sec;
 239         sb_file->nr_sections = 1;
 240
 241         return IMX_SUCCESS;
 242     }
 243     else
 244     {
 245         printf("[ERR] Bad output type !\n");
 246         return IMX_DONT_KNOW_HOW_TO_PATCH;
 247     }
 248 }
 249
 250 static enum imx_error_t patch_firmware(enum imx_model_t model,
 251     enum imx_firmware_variant_t variant, enum imx_output_type_t type,
 252     struct sb_file_t *sb_file, void *boot, size_t boot_sz)
 253 {
 254     switch(model)
 255     {
 256         case MODEL_FUZEPLUS:
 257             /* The Fuze+ uses the standard ____, host, play sections, patch after third
 258              * call in ____ section */
 259             return patch_std_zero_host_play(3, model, type, sb_file, boot, boot_sz);
 260         case MODEL_ZENXFI3:
 261             /* The ZEN X-Fi3 uses the standard ____, hSst, pSay sections, patch after third
 262              * call in ____ section. Although sections names use the S variant, they are standard. */
 263             return patch_std_zero_host_play(3, model, type, sb_file, boot, boot_sz);
 264         case MODEL_ZENXFI2:
 265             /* The ZEN X-Fi2 has two types of firmware: recovery and normal.
 266              * Normal uses the standard ___, host, play sections and recovery only ____ */
 267             switch(variant)
 268             {
 269                 case VARIANT_ZENXFI2_RECOVERY:
 270                 case VARIANT_ZENXFI2_NAND:
 271                 case VARIANT_ZENXFI2_SD:
 272                     return patch_std_zero_host_play(1, model, type, sb_file, boot, boot_sz);
 273                 default:
 274                     return IMX_DONT_KNOW_HOW_TO_PATCH;
 275             }
 276             break;
 277         default:
 278             return IMX_DONT_KNOW_HOW_TO_PATCH;
 279     }
 280 }
 281
 282 static void imx_printf(void *user, bool error, color_t c, const char *fmt, ...)
 283 {
 284     (void) user;
 285     (void) c;
 286     va_list args;
 287     va_start(args, fmt);
 288     /*
 289     if(error)
 290         printf("[ERR] ");
 291     else
 292         printf("[INFO] ");
 293     */
 294     vprintf(fmt, args);
 295     va_end(args);
 296 }
 297
 298 static uint32_t get_uint32be(unsigned char *p)
 299 {
 300     return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3];
 301 }
 302
 303 void dump_imx_dev_info(const char *prefix)
 304 {
 305     printf("%smkimxboot models:\n", prefix);
 306     for(int i = 0; i < NR_IMX_MODELS; i++)
 307     {
 308         printf("%s  %s: idx=%d rb_model=%s rb_num=%d\n", prefix,
 309             imx_models[i].model_name, i, imx_models[i].rb_model_name,
 310             imx_models[i].rb_model_num);
 311     }
 312     printf("%smkimxboot variants:\n", prefix);
 313     for(int i = 0; i < VARIANT_COUNT; i++)
 314     {
 315         printf("%s  %d: %s\n", prefix, i, imx_fw_variant[i]);
 316     }
 317     printf("%smkimxboot mapping:\n", prefix);
 318     for(int i = 0; i < NR_IMX_SUMS; i++)
 319     {
 320         printf("%s  md5sum=%s -> idx=%d\n", prefix, imx_sums[i].md5sum,
 321             imx_sums[i].model);
 322         for(int j = 0; j < VARIANT_COUNT; j++)
 323             if(imx_sums[i].fw_variants[j].size)
 324                 printf("%s    variant=%d -> offset=%#x size=%#x\n", prefix,
 325                     j, (unsigned)imx_sums[i].fw_variants[j].offset,
 326                     (unsigned)imx_sums[i].fw_variants[j].size);
 327     }
 328 }
 329
 330 enum imx_error_t mkimxboot(const char *infile, const char *bootfile,
 331     const char *outfile, struct imx_option_t opt)
 332 {
 333     /* Dump tables */
 334     if(opt.fw_variant > VARIANT_COUNT) {
 335         return IMX_ERROR;
 336     }
 337     dump_imx_dev_info("[INFO] ");
 338     /* compute MD5 sum of the file */
 339     uint8_t file_md5sum[16];
 340     do
 341     {
 342         FILE *f = fopen(infile, "rb");
 343         if(f == NULL)
 344         {
 345             printf("[ERR] Cannot open input file\n");
 346             return IMX_OPEN_ERROR;
 347         }
 348         fseek(f, 0, SEEK_END);
 349         size_t sz = ftell(f);
 350         fseek(f, 0, SEEK_SET);
 351         void *buf = xmalloc(sz);
 352         if(fread(buf, sz, 1, f) != 1)
 353         {
 354             fclose(f);
 355             free(buf);
 356             printf("[ERR] Cannot read file\n");
 357             return IMX_READ_ERROR;
 358         }
 359         fclose(f);
 360         md5_context ctx;
 361         md5_starts(&ctx);
 362         md5_update(&ctx, buf, sz);
 363         md5_finish(&ctx, file_md5sum);
 364         free(buf);
 365     }while(0);
 366     printf("[INFO] MD5 sum of the file: ");
 367     print_hex(file_md5sum, 16, true);
 368     /* find model */
 369     enum imx_model_t model;
 370     int md5_idx;
 371     do
 372     {
 373         int i = 0;
 374         while(i < NR_IMX_SUMS)
 375         {
 376             uint8_t md5[20];
 377             if(strlen(imx_sums[i].md5sum) != 32)
 378             {
 379                 printf("[INFO] Invalid MD5 sum in imx_sums\n");
 380                 return IMX_ERROR;
 381             }
 382             for(int j = 0; j < 16; j++)
 383             {
 384                 byte a, b;
 385                 if(convxdigit(imx_sums[i].md5sum[2 * j], &a) || convxdigit(imx_sums[i].md5sum[2 * j + 1], &b))
 386                     return false;
 387                 md5[j] = (a << 4) | b;
 388             }
 389             if(memcmp(file_md5sum, md5, 16) == 0)
 390                 break;
 391             i++;
 392         }
 393         if(i == NR_IMX_SUMS)
 394         {
 395             printf("[ERR] MD5 sum doesn't match any known file\n");
 396             return IMX_NO_MATCH;
 397         }
 398         model = imx_sums[i].model;
 399         md5_idx = i;
 400     }while(0);
 401     printf("[INFO] File is for model %d (%s)\n", model, imx_models[model].model_name);
 402     /* load rockbox file */
 403     uint8_t *boot;
 404     size_t boot_size;
 405     do
 406     {
 407         FILE *f = fopen(bootfile, "rb");
 408         if(f == NULL)
 409         {
 410             printf("[ERR] Cannot open boot file\n");
 411             return IMX_OPEN_ERROR;
 412         }
 413         fseek(f, 0, SEEK_END);
 414         boot_size = ftell(f);
 415         fseek(f, 0, SEEK_SET);
 416         boot = xmalloc(boot_size);
 417         if(fread(boot, boot_size, 1, f) != 1)
 418         {
 419             free(boot);
 420             fclose(f);
 421             printf("[ERR] Cannot read boot file\n");
 422             return IMX_READ_ERROR;
 423         }
 424         fclose(f);
 425     }while(0);
 426     /* Check boot file */
 427     do
 428     {
 429         if(boot_size < 8)
 430         {
 431             printf("[ERR] Bootloader file is too small to be valid\n");
 432             free(boot);
 433             return IMX_BOOT_INVALID;
 434         }
 435         /* check model name */
 436         uint8_t *name = boot + 4;
 437         if(memcmp(name, imx_models[model].rb_model_name, 4) != 0)
 438         {
 439             printf("[ERR] Bootloader model doesn't match found model for input file\n");
 440             free(boot);
 441             return IMX_BOOT_MISMATCH;
 442         }
 443         /* check checksum */
 444         uint32_t sum = imx_models[model].rb_model_num;
 445         for(int i = 8; i < boot_size; i++)
 446             sum += boot[i];
 447         if(sum != get_uint32be(boot))
 448         {
 449             printf("[ERR] Bootloader checksum mismatch\n");
 450             free(boot);
 451             return IMX_BOOT_CHECKSUM_ERROR;
 452         }
 453     }while(0);
 454     /* load OF file */
 455     struct sb_file_t *sb_file;
 456     do
 457     {
 458         if(imx_sums[md5_idx].fw_variants[opt.fw_variant].size == 0)
 459         {
 460             printf("[ERR] Input file does not contain variant '%s'\n", imx_fw_variant[opt.fw_variant]);
 461             free(boot);
 462             return IMX_VARIANT_MISMATCH;
 463         }
 464         enum sb_error_t err;
 465         g_debug = opt.debug;
 466         clear_keys();
 467         add_keys(imx_models[model].keys, imx_models[model].nr_keys);
 468         sb_file = sb_read_file_ex(infile, imx_sums[md5_idx].fw_variants[opt.fw_variant].offset,
 469             imx_sums[md5_idx].fw_variants[opt.fw_variant].size, false, NULL, &imx_printf, &err);
 470         if(sb_file == NULL)
 471         {
 472             clear_keys();
 473             free(boot);
 474             return IMX_FIRST_SB_ERROR + err;
 475         }
 476     }while(0);
 477     /* produce file */
 478     enum imx_error_t ret = patch_firmware(model, opt.fw_variant, opt.output, sb_file, boot + 8, boot_size - 8);
 479     if(ret == IMX_SUCCESS)
 480         ret = sb_write_file(sb_file, outfile);
 481
 482     clear_keys();
 483     free(boot);
 484     sb_free(sb_file);
 485     return ret;
 486 }