Rockbox

This is the bug/patch tracker for Rockbox. Click here for more information.

Quick links: Bugs · Patches · Rockbox frontpage

Tasklist

FS#9396 - Enhancement to the firmware patcher for SansaV2

Attached to Project: Rockbox
Opened by Rafaël Carré (funman) - Friday, 12 September 2008, 18:40 GMT+2
Last edited by Dave Chapman (linuxstb) - Thursday, 02 October 2008, 01:28 GMT+2
Task Type Patches
Category Bootloader
Status Closed
Assigned To No-one
Player Type Another
Severity Low
Priority Normal
Reported Version Daily build (which?)
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Private No

Details

Currently we are limited for our code to 512 bytes - what is used by the original firmware.
This value varies depending the firmware version, but it's clear that it's not enough for a bootloader.

This patch aims to make extra room for code in the firmware, the current program will use memmove to relocate the firmware but it's confirmed to produce buggy files (tested on e200v2)

The button mapping figured so far is valid for Clip & E200v2 only (other models not tested)

You may want to remove also the code which makes the buttons led blink, because this has been tested only on E200 & Clip (this is GPIO pin D7), and there is no indication that driving this pin high will not damage other models.

How this works:
We find the largest block of aligned 32 bits words filled with the same value (most of the time it's 0)

We will write the stage2 at this offset, and the stage1 will copy the ROM content into RAM, and overwrite this area with the original word before branching back to the OF; because we don't know if it's meaningful or not.
We write offset, size, and word in the "data" segment of stage1.

What the code does:

Check GPIO A3 & A6, if set: clean the RAM, resume OF
(A3 is hold on the Clip & USB on the E200, A6 is USB on the Clip)
Continue to stage2, which will make the led blink (D7)
Return to stage1, which will clean the RAM and resume OF.

The button check can be used as software recovery mode.
Hackers can only modify stage2.S , mkamsinfo will check if it fits in the area we found, and will refuse to write the firmware if so.
This task depends upon

Closed by  Dave Chapman (linuxstb)
Thursday, 02 October 2008, 01:28 GMT+2
Reason for closing:  Out of Date
Additional comments about closing:  Superseded by the UCL compression method added to SVN on 1 October 2008.
Comment by Rafaël Carré (funman) - Friday, 12 September 2008, 18:41 GMT+2
Here is the patch
   bootloader-ams.diff.txt (14.7 KiB)
Comment by Maurus Cuelenaere (mcuelenaere) - Friday, 12 September 2008, 23:13 GMT+2
You seem to have TABs in your patch, please read http://svn.rockbox.org/viewvc.cgi/trunk/docs/CONTRIBUTING
Comment by Rafaël Carré (funman) - Friday, 12 September 2008, 23:42 GMT+2
here is a patch without tabs (except in Makefile), sorry for not checking that
   bootloader-ams.diff.txt (15.7 KiB)
Comment by Rafaël Carré (funman) - Saturday, 13 September 2008, 19:58 GMT+2
I just found something interesting: driving pin A7 low, reading from it will give you #1 if any button has been pressed (including power so you would have to release it quickly before the code runs).

If this is confirmed on other models, I will use it for the patch to be a safe cross-model recovery mode
Comment by Rafaël Carré (funman) - Saturday, 13 September 2008, 20:40 GMT+2
false alarm: I was not releasing the button quickly enough: A7 is always power
Comment by Rafaël Carré (funman) - Sunday, 28 September 2008, 00:49 GMT+2
Here is a patch which uses a .c file for the 2nd stage, much more clear for hacking at the expense of maybe a bit more bigger files.
I'll do precise mesurements when I converted all my code into C.
   bootloader.diff (15.3 KiB) 
 test.S        |   11 -----
 stage1.S      |   70 ++++++++++++++++++++++++++++++++++
 find-offset.c |  119 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 stage2.c      |   31 +++++++++++++++
 crt0.S        |    6 ++
 stage2.h      |   15 +++++++
 Makefile      |   33 ++++++++++------
 mkamsboot.c   |  116 +++++++++++++++++++++++++++++++++++++++++++-------------
 8 files changed, 353 insertions(+), 48 deletions(-)

Comment by Rafaël Carré (funman) - Sunday, 28 September 2008, 02:18 GMT+2
There is no visible impact on binary code size :)
Comment by Marcin Łukasik (Moarc) - Monday, 29 September 2008, 16:47 GMT+2
Newest version of patch doesn't apply on code fully and doesn't compile.
   mkamsboot.c.rej (1 KiB)
Comment by Rafaël Carré (funman) - Monday, 29 September 2008, 17:31 GMT+2
It was broken today by revision 18663, here is an updated patch.

I generated it with git, but you can apply it on a svn tree this way:
$ cd rockbox; patch -p1 < bootloader.patch

Marcin if you want to join the hacking, be sure to read the forum thread : http://forums.rockbox.org/index.php?topic=14064
   bootloader.diff (15 KiB) 
 b/utils/AMS/hacking/Makefile      |   33 +++++++---
 b/utils/AMS/hacking/crt0.S        |    6 +
 b/utils/AMS/hacking/find-offset.c |  119 ++++++++++++++++++++++++++++++++++++++
 b/utils/AMS/hacking/mkamsboot.c   |  103 ++++++++++++++++++++++++++++----
 b/utils/AMS/hacking/stage1.S      |   70 ++++++++++++++++++++++
 b/utils/AMS/hacking/stage2.c      |   31 +++++++++
 b/utils/AMS/hacking/stage2.h      |   15 ++++
 b/utils/AMS/hacking/test.S        |   11 ---
 8 files changed, 351 insertions(+), 37 deletions(-)

Comment by Rafaël Carré (funman) - Tuesday, 30 September 2008, 10:04 GMT+2
Here is a patch without tabs ..
The Clip specific check in stage2 has been commented out, and the stage1 only checks gpio A3 (which is mapped to a button on all tested models)
I also had forgotten to add crt0.o to clean: target in Makefile
   bootloader.diff (15.5 KiB) 
 b/utils/AMS/hacking/Makefile      |   33 +++++++---
 b/utils/AMS/hacking/crt0.S        |    6 +
 b/utils/AMS/hacking/find-offset.c |  119 ++++++++++++++++++++++++++++++++++++++
 b/utils/AMS/hacking/mkamsboot.c   |  106 +++++++++++++++++++++++++++++----
 b/utils/AMS/hacking/stage1.S      |   69 ++++++++++++++++++++++
 b/utils/AMS/hacking/stage2.c      |   33 ++++++++++
 b/utils/AMS/hacking/stage2.h      |   15 ++++
 a/utils/AMS/hacking/test.S        |   11 ---
 8 files changed, 355 insertions(+), 37 deletions(-)

Loading...