]> git.zerfleddert.de Git - proxmark3-svn/blob - client/flash.c
Merge pull request #600 from marshmellow42/master
[proxmark3-svn] / client / flash.c
1 //-----------------------------------------------------------------------------
2 // Copyright (C) 2010 Hector Martin "marcan" <marcan@marcansoft.com>
3 //
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
6 // the license.
7 //-----------------------------------------------------------------------------
8 // ELF file flasher
9 //-----------------------------------------------------------------------------
10
11 #include <stdio.h>
12 #include <string.h>
13 #include <stdlib.h>
14 #include <inttypes.h>
15 #include <unistd.h>
16 #include "proxmark3.h"
17 #include "util.h"
18 #include "util_posix.h"
19 #include "flash.h"
20 #include "elf.h"
21 #include "proxendian.h"
22 #include "usb_cmd.h"
23 #include "uart.h"
24
25 void SendCommand(UsbCommand* txcmd);
26 void ReceiveCommand(UsbCommand* rxcmd);
27
28 serial_port sp;
29
30 #define FLASH_START 0x100000
31 #define FLASH_SIZE (256*1024)
32 #define FLASH_END (FLASH_START + FLASH_SIZE)
33 #define BOOTLOADER_SIZE 0x2000
34 #define BOOTLOADER_END (FLASH_START + BOOTLOADER_SIZE)
35
36 #define BLOCK_SIZE 0x200
37
38 static const uint8_t elf_ident[] = {
39 0x7f, 'E', 'L', 'F',
40 ELFCLASS32,
41 ELFDATA2LSB,
42 EV_CURRENT
43 };
44
45 void CloseProxmark(const char *serial_port_name) {
46 // Clean up the port
47 uart_close(sp);
48 // Fix for linux, it seems that it is extremely slow to release the serial port file descriptor /dev/*
49 unlink(serial_port_name);
50 }
51
52 bool OpenProxmark(size_t i, const char *serial_port_name) {
53 sp = uart_open(serial_port_name);
54 if (sp == INVALID_SERIAL_PORT || sp == CLAIMED_SERIAL_PORT) {
55 //poll once a second
56 return false;
57 }
58
59 return true;
60 }
61
62 // Turn PHDRs into flasher segments, checking for PHDR sanity and merging adjacent
63 // unaligned segments if needed
64 static int build_segs_from_phdrs(flash_file_t *ctx, FILE *fd, Elf32_Phdr *phdrs, int num_phdrs)
65 {
66 Elf32_Phdr *phdr = phdrs;
67 flash_seg_t *seg;
68 uint32_t last_end = 0;
69
70 ctx->segments = malloc(sizeof(flash_seg_t) * num_phdrs);
71 if (!ctx->segments) {
72 fprintf(stderr, "Out of memory\n");
73 return -1;
74 }
75 ctx->num_segs = 0;
76 seg = ctx->segments;
77
78 fprintf(stderr, "Loading usable ELF segments:\n");
79 for (int i = 0; i < num_phdrs; i++) {
80 if (le32(phdr->p_type) != PT_LOAD) {
81 phdr++;
82 continue;
83 }
84 uint32_t vaddr = le32(phdr->p_vaddr);
85 uint32_t paddr = le32(phdr->p_paddr);
86 uint32_t filesz = le32(phdr->p_filesz);
87 uint32_t memsz = le32(phdr->p_memsz);
88 uint32_t offset = le32(phdr->p_offset);
89 uint32_t flags = le32(phdr->p_flags);
90 if (!filesz) {
91 phdr++;
92 continue;
93 }
94 fprintf(stderr, "%d: V 0x%08x P 0x%08x (0x%08x->0x%08x) [%c%c%c] @0x%x\n",
95 i, vaddr, paddr, filesz, memsz,
96 flags & PF_R ? 'R' : ' ',
97 flags & PF_W ? 'W' : ' ',
98 flags & PF_X ? 'X' : ' ',
99 offset);
100 if (filesz != memsz) {
101 fprintf(stderr, "Error: PHDR file size does not equal memory size\n"
102 "(DATA+BSS PHDRs do not make sense on ROM platforms!)\n");
103 return -1;
104 }
105 if (paddr < last_end) {
106 fprintf(stderr, "Error: PHDRs not sorted or overlap\n");
107 return -1;
108 }
109 if (paddr < FLASH_START || (paddr+filesz) > FLASH_END) {
110 fprintf(stderr, "Error: PHDR is not contained in Flash\n");
111 return -1;
112 }
113 if (vaddr >= FLASH_START && vaddr < FLASH_END && (flags & PF_W)) {
114 fprintf(stderr, "Error: Flash VMA segment is writable\n");
115 return -1;
116 }
117
118 uint8_t *data;
119 // make extra space if we need to move the data forward
120 data = malloc(filesz + BLOCK_SIZE);
121 if (!data) {
122 fprintf(stderr, "Out of memory\n");
123 return -1;
124 }
125 if (fseek(fd, offset, SEEK_SET) < 0 || fread(data, 1, filesz, fd) != filesz) {
126 fprintf(stderr, "Error while reading PHDR payload\n");
127 free(data);
128 return -1;
129 }
130
131 uint32_t block_offset = paddr & (BLOCK_SIZE-1);
132 if (block_offset) {
133 if (ctx->num_segs) {
134 flash_seg_t *prev_seg = seg - 1;
135 uint32_t this_end = paddr + filesz;
136 uint32_t this_firstblock = paddr & ~(BLOCK_SIZE-1);
137 uint32_t prev_lastblock = (last_end - 1) & ~(BLOCK_SIZE-1);
138
139 if (this_firstblock == prev_lastblock) {
140 uint32_t new_length = this_end - prev_seg->start;
141 uint32_t this_offset = paddr - prev_seg->start;
142 uint32_t hole = this_offset - prev_seg->length;
143 uint8_t *new_data = malloc(new_length);
144 if (!new_data) {
145 fprintf(stderr, "Out of memory\n");
146 free(data);
147 return -1;
148 }
149 memset(new_data, 0xff, new_length);
150 memcpy(new_data, prev_seg->data, prev_seg->length);
151 memcpy(new_data + this_offset, data, filesz);
152 fprintf(stderr, "Note: Extending previous segment from 0x%x to 0x%x bytes\n",
153 prev_seg->length, new_length);
154 if (hole)
155 fprintf(stderr, "Note: 0x%x-byte hole created\n", hole);
156 free(data);
157 free(prev_seg->data);
158 prev_seg->data = new_data;
159 prev_seg->length = new_length;
160 last_end = this_end;
161 phdr++;
162 continue;
163 }
164 }
165 fprintf(stderr, "Warning: segment does not begin on a block boundary, will pad\n");
166 memmove(data + block_offset, data, filesz);
167 memset(data, 0xFF, block_offset);
168 filesz += block_offset;
169 paddr -= block_offset;
170 }
171
172 seg->data = data;
173 seg->start = paddr;
174 seg->length = filesz;
175 seg++;
176 ctx->num_segs++;
177
178 last_end = paddr + filesz;
179 phdr++;
180 }
181 return 0;
182 }
183
184 // Sanity check segments and check for bootloader writes
185 static int check_segs(flash_file_t *ctx, int can_write_bl) {
186 for (int i = 0; i < ctx->num_segs; i++) {
187 flash_seg_t *seg = &ctx->segments[i];
188
189 if (seg->start & (BLOCK_SIZE-1)) {
190 fprintf(stderr, "Error: Segment is not aligned\n");
191 return -1;
192 }
193 if (seg->start < FLASH_START) {
194 fprintf(stderr, "Error: Segment is outside of flash bounds\n");
195 return -1;
196 }
197 if (seg->start + seg->length > FLASH_END) {
198 fprintf(stderr, "Error: Segment is outside of flash bounds\n");
199 return -1;
200 }
201 if (!can_write_bl && seg->start < BOOTLOADER_END) {
202 fprintf(stderr, "Attempted to write bootloader but bootloader writes are not enabled\n");
203 return -1;
204 }
205 }
206 return 0;
207 }
208
209 // Load an ELF file and prepare it for flashing
210 int flash_load(flash_file_t *ctx, const char *name, int can_write_bl)
211 {
212 FILE *fd = NULL;
213 Elf32_Ehdr ehdr;
214 Elf32_Phdr *phdrs = NULL;
215 int num_phdrs;
216 int res;
217
218 fd = fopen(name, "rb");
219 if (!fd) {
220 fprintf(stderr, "Could not open file '%s': ", name);
221 perror(NULL);
222 goto fail;
223 }
224
225 fprintf(stderr, "Loading ELF file '%s'...\n", name);
226
227 if (fread(&ehdr, sizeof(ehdr), 1, fd) != 1) {
228 fprintf(stderr, "Error while reading ELF file header\n");
229 goto fail;
230 }
231 if (memcmp(ehdr.e_ident, elf_ident, sizeof(elf_ident))
232 || le32(ehdr.e_version) != 1)
233 {
234 fprintf(stderr, "Not an ELF file or wrong ELF type\n");
235 goto fail;
236 }
237 if (le16(ehdr.e_type) != ET_EXEC) {
238 fprintf(stderr, "ELF is not executable\n");
239 goto fail;
240 }
241 if (le16(ehdr.e_machine) != EM_ARM) {
242 fprintf(stderr, "Wrong ELF architecture\n");
243 goto fail;
244 }
245 if (!ehdr.e_phnum || !ehdr.e_phoff) {
246 fprintf(stderr, "ELF has no PHDRs\n");
247 goto fail;
248 }
249 if (le16(ehdr.e_phentsize) != sizeof(Elf32_Phdr)) {
250 // could be a structure padding issue...
251 fprintf(stderr, "Either the ELF file or this code is made of fail\n");
252 goto fail;
253 }
254 num_phdrs = le16(ehdr.e_phnum);
255
256 phdrs = malloc(le16(ehdr.e_phnum) * sizeof(Elf32_Phdr));
257 if (!phdrs) {
258 fprintf(stderr, "Out of memory\n");
259 goto fail;
260 }
261 if (fseek(fd, le32(ehdr.e_phoff), SEEK_SET) < 0) {
262 fprintf(stderr, "Error while reading ELF PHDRs\n");
263 goto fail;
264 }
265 if (fread(phdrs, sizeof(Elf32_Phdr), num_phdrs, fd) != num_phdrs) {
266 fprintf(stderr, "Error while reading ELF PHDRs\n");
267 goto fail;
268 }
269
270 res = build_segs_from_phdrs(ctx, fd, phdrs, num_phdrs);
271 if (res < 0)
272 goto fail;
273 res = check_segs(ctx, can_write_bl);
274 if (res < 0)
275 goto fail;
276
277 free(phdrs);
278 fclose(fd);
279 ctx->filename = name;
280 return 0;
281
282 fail:
283 if (phdrs)
284 free(phdrs);
285 if (fd)
286 fclose(fd);
287 flash_free(ctx);
288 return -1;
289 }
290
291 // Get the state of the proxmark, backwards compatible
292 static int get_proxmark_state(uint32_t *state)
293 {
294 UsbCommand c;
295 c.cmd = CMD_DEVICE_INFO;
296 SendCommand(&c);
297 UsbCommand resp;
298 ReceiveCommand(&resp);
299
300 // Three outcomes:
301 // 1. The old bootrom code will ignore CMD_DEVICE_INFO, but respond with an ACK
302 // 2. The old os code will respond with CMD_DEBUG_PRINT_STRING and "unknown command"
303 // 3. The new bootrom and os codes will respond with CMD_DEVICE_INFO and flags
304
305 switch (resp.cmd) {
306 case CMD_ACK:
307 *state = DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM;
308 break;
309 case CMD_DEBUG_PRINT_STRING:
310 *state = DEVICE_INFO_FLAG_CURRENT_MODE_OS;
311 break;
312 case CMD_DEVICE_INFO:
313 *state = resp.arg[0];
314 break;
315 default:
316 fprintf(stderr, "Error: Couldn't get proxmark state, bad response type: 0x%04" PRIx64 "\n", resp.cmd);
317 return -1;
318 break;
319 }
320
321 return 0;
322 }
323
324 // Enter the bootloader to be able to start flashing
325 static int enter_bootloader(char *serial_port_name)
326 {
327 uint32_t state;
328
329 if (get_proxmark_state(&state) < 0)
330 return -1;
331
332 if (state & DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM) {
333 /* Already in flash state, we're done. */
334 return 0;
335 }
336
337 if (state & DEVICE_INFO_FLAG_CURRENT_MODE_OS) {
338 fprintf(stderr,"Entering bootloader...\n");
339 UsbCommand c;
340 memset(&c, 0, sizeof (c));
341
342 if ((state & DEVICE_INFO_FLAG_BOOTROM_PRESENT)
343 && (state & DEVICE_INFO_FLAG_OSIMAGE_PRESENT))
344 {
345 // New style handover: Send CMD_START_FLASH, which will reset the board
346 // and enter the bootrom on the next boot.
347 c.cmd = CMD_START_FLASH;
348 SendCommand(&c);
349 fprintf(stderr,"(Press and release the button only to abort)\n");
350 } else {
351 // Old style handover: Ask the user to press the button, then reset the board
352 c.cmd = CMD_HARDWARE_RESET;
353 SendCommand(&c);
354 fprintf(stderr,"Press and hold down button NOW if your bootloader requires it.\n");
355 }
356
357 msleep(100);
358 CloseProxmark(serial_port_name);
359
360 fprintf(stderr,"Waiting for Proxmark to reappear on %s",serial_port_name);
361 do {
362 sleep(1);
363 fprintf(stderr, ".");
364 } while (!OpenProxmark(0, serial_port_name));
365
366 fprintf(stderr," Found.\n");
367
368 return 0;
369 }
370
371 fprintf(stderr, "Error: Unknown Proxmark mode\n");
372 return -1;
373 }
374
375 static int wait_for_ack(void)
376 {
377 UsbCommand ack;
378 ReceiveCommand(&ack);
379 if (ack.cmd != CMD_ACK) {
380 printf("Error: Unexpected reply 0x%04" PRIx64 " (expected ACK)\n", ack.cmd);
381 return -1;
382 }
383 return 0;
384 }
385
386 // Go into flashing mode
387 int flash_start_flashing(int enable_bl_writes,char *serial_port_name)
388 {
389 uint32_t state;
390
391 if (enter_bootloader(serial_port_name) < 0)
392 return -1;
393
394 if (get_proxmark_state(&state) < 0)
395 return -1;
396
397 if (state & DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH) {
398 // This command is stupid. Why the heck does it care which area we're
399 // flashing, as long as it's not the bootloader area? The mind boggles.
400 UsbCommand c = {CMD_START_FLASH};
401
402 if (enable_bl_writes) {
403 c.arg[0] = FLASH_START;
404 c.arg[1] = FLASH_END;
405 c.arg[2] = START_FLASH_MAGIC;
406 } else {
407 c.arg[0] = BOOTLOADER_END;
408 c.arg[1] = FLASH_END;
409 c.arg[2] = 0;
410 }
411 SendCommand(&c);
412 return wait_for_ack();
413 } else {
414 fprintf(stderr, "Note: Your bootloader does not understand the new START_FLASH command\n");
415 fprintf(stderr, " It is recommended that you update your bootloader\n\n");
416 }
417
418 return 0;
419 }
420
421 static int write_block(uint32_t address, uint8_t *data, uint32_t length)
422 {
423 uint8_t block_buf[BLOCK_SIZE];
424
425 memset(block_buf, 0xFF, BLOCK_SIZE);
426 memcpy(block_buf, data, length);
427 UsbCommand c;
428 c.cmd = CMD_FINISH_WRITE;
429 c.arg[0] = address;
430 memcpy(c.d.asBytes, block_buf, length);
431 SendCommand(&c);
432 return wait_for_ack();
433 }
434
435 // Write a file's segments to Flash
436 int flash_write(flash_file_t *ctx)
437 {
438 fprintf(stderr, "Writing segments for file: %s\n", ctx->filename);
439 for (int i = 0; i < ctx->num_segs; i++) {
440 flash_seg_t *seg = &ctx->segments[i];
441
442 uint32_t length = seg->length;
443 uint32_t blocks = (length + BLOCK_SIZE - 1) / BLOCK_SIZE;
444 uint32_t end = seg->start + length;
445
446 fprintf(stderr, " 0x%08x..0x%08x [0x%x / %d blocks]",
447 seg->start, end - 1, length, blocks);
448
449 int block = 0;
450 uint8_t *data = seg->data;
451 uint32_t baddr = seg->start;
452
453 while (length) {
454 uint32_t block_size = length;
455 if (block_size > BLOCK_SIZE)
456 block_size = BLOCK_SIZE;
457
458 if (write_block(baddr, data, block_size) < 0) {
459 fprintf(stderr, " ERROR\n");
460 fprintf(stderr, "Error writing block %d of %d\n", block, blocks);
461 return -1;
462 }
463
464 data += block_size;
465 baddr += block_size;
466 length -= block_size;
467 block++;
468 fprintf(stderr, ".");
469 }
470 fprintf(stderr, " OK\n");
471 }
472 return 0;
473 }
474
475 // free a file context
476 void flash_free(flash_file_t *ctx)
477 {
478 if (!ctx)
479 return;
480 if (ctx->segments) {
481 for (int i = 0; i < ctx->num_segs; i++)
482 free(ctx->segments[i].data);
483 free(ctx->segments);
484 ctx->segments = NULL;
485 ctx->num_segs = 0;
486 }
487 }
488
489 // just reset the unit
490 int flash_stop_flashing(void) {
491 UsbCommand c = {CMD_HARDWARE_RESET};
492 SendCommand(&c);
493 msleep(100);
494 return 0;
495 }
Impressum, Datenschutz