在前面的文章 tiny4412 led 裸机程序中遇到一个问题,使用 mkbl2 来将裸机程序制作成 BL2.bin 时报错。
./mkbl2 led.bin bl2.bin 14336
Usage: unsupported size
我尝试把 14336 改成 led.bin 文件的实际大小后,烧写到 emmc 程序无法按照预期执行。那么问题出在哪?
BL2 位于设备偏移地址(512 +8K)字节处,BL1从这个位置读入 14K 字节的数据,存在iRAM 地址 0x02023400 处。 BL2不能大于(14K – 4)字节,最后 4字节用于存放较验码。
那么我猜测,当我们的 led.bin 小于 14K 的时候,我们生成的 bl2.bin 也得是14K大小,并且最后4字节是校验码。
来看看 mkbl2 的源码:
/*
* Copyright (c) 2010 Samsung Electronics Co., Ltd.
* http://www.samsung.com/
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main (int argc, char *argv[])
{
FILE *fp;
unsigned char src;
char *Buf, *a;
int BufLen;
int nbytes, fileLen;
unsigned int checksum = 0;
int i;
if (argc != 4)
{
printf("Usage: mkbl1 <source file> <destination file> <size> \n");
return -1;
}
BufLen = atoi(argv[3]);
Buf = (char *)malloc(BufLen);
memset(Buf, 0x00, BufLen);
fp = fopen(argv[1], "rb");
if( fp == NULL)
{
printf("source file open error\n");
free(Buf);
return -1;
}
fseek(fp, 0L, SEEK_END);
fileLen = ftell(fp);
fseek(fp, 0L, SEEK_SET);
if ( BufLen > fileLen )
{
printf("Usage: unsupported size\n");
free(Buf);
fclose(fp);
return -1;
}
nbytes = fread(Buf, 1, BufLen, fp);
if ( nbytes != BufLen )
{
printf("source file read error\n");
free(Buf);
fclose(fp);
return -1;
}
fclose(fp);
for(i = 0;i < (14 * 1024) - 4;i++)
{
checksum += (unsigned char)(Buf[i]);
}
*(unsigned int*)(Buf+i) = checksum;
fp = fopen(argv[2], "wb");
if (fp == NULL)
{
printf("destination file open error\n");
free(Buf);
return -1;
}
a = Buf;
nbytes = fwrite( a, 1, BufLen, fp);
if ( nbytes != BufLen )
{
printf("destination file write error\n");
free(Buf);
fclose(fp);
return -1;
}
free(Buf);
fclose(fp);
return 0;
}
代码很简单,问题很明显,当我们的 Led.bin 小于14K时,我们输入文件实际大小,Bufsize == filesize ,但是它在计算校验的时候居然是按照 14k 的大小来计算的,数组都溢出了!!!
修改:
/*
* Copyright (c) 2010 Samsung Electronics Co., Ltd.
* http://www.samsung.com/
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main (int argc, char *argv[])
{
FILE *fp;
unsigned char src;
char *Buf, *a;
int BufLen;
int nbytes, fileLen;
unsigned int checksum = 0;
int i;
if (argc != 4)
{
printf("Usage: mkbl1 <source file> <destination file> <size> \n");
return -1;
}
BufLen = atoi(argv[3]);
Buf = (char *)malloc(BufLen);
memset(Buf, 0x00, BufLen);
fp = fopen(argv[1], "rb");
if( fp == NULL)
{
printf("source file open error\n");
free(Buf);
return -1;
}
fseek(fp, 0L, SEEK_END);
fileLen = ftell(fp);
fseek(fp, 0L, SEEK_SET);
/*
if ( BufLen > fileLen )
{
printf("Usage: unsupported size\n");
free(Buf);
fclose(fp);
return -1;
}
*/
//nbytes = fread(Buf, 1, BufLen, fp);
if(BufLen > fileLen)
nbytes = fread(Buf, 1, fileLen, fp);
else
nbytes = fread(Buf, 1, BufLen, fp);
/*
if ( nbytes != BufLen )
{
printf("source file read error\n");
free(Buf);
fclose(fp);
return -1;
}
*/
fclose(fp);
for(i = 0;i < (14 * 1024) - 4;i++)
{
checksum += (unsigned char)(Buf[i]);
}
*(unsigned int*)(Buf+i) = checksum;
fp = fopen(argv[2], "wb");
if (fp == NULL)
{
printf("destination file open error\n");
free(Buf);
return -1;
}
a = Buf;
nbytes = fwrite( a, 1, BufLen, fp);
if ( nbytes != BufLen )
{
printf("destination file write error\n");
free(Buf);
fclose(fp);
return -1;
}
free(Buf);
fclose(fp);
return 0;
}
- gcc -o mkbl2 V310-EVT1-mkbl2.c
mkbl2 led.bin bl2.bin 14336
实验验证上述做法是正确的,对4412的启动流程的了解又加深了一步。
总结:
mkbl2 原理:读取源文件14k-4字节,计算校验和,写入14k-4至14k的地方,生成bl2.bin。
无论是sd卡,还是emmc,BL2存放在第17个扇区,大小14K,校验和必须存放在14k-4的位置,估计BL1会到这个位置取出校验和进行校验文件是否损坏。