boardesp/webserver.c

#include "stdlib.h"
#include "ets_sys.h"
#include "osapi.h"
#include "gpio.h"
#include "mem.h"
#include "os_type.h"
#include "user_interface.h"
#include "espconn.h"
#include "upgrade.h"

#include "crypto/rsa.h"
#include "crypto/sha.h"

#include "obj/gitversion.h"
#include "obj/cert.h"

#define max(a,b) ((a) > (b) ? (a) : (b))
#define min(a,b) ((a) < (b) ? (a) : (b))
#define espconn_send_string(conn, x) espconn_send(conn, x, strlen(x))

#define MAX_RESP 0x800
char resp[MAX_RESP];
char pageheader[] = "HTTP/1.0 200 OK\nContent-Type: text/html\n\n"
"<!DOCTYPE html>\n"
"<html>\n"
"<head>\n"
"<title>Panda</title>\n"
"</head>\n"
"<body>\n"
"<pre>This is your comma.ai panda\n\n"
"It's open source. Find the code <a href=\"https://github.com/commaai/panda\">here</a>\n"
"Designed to work with our dashcam, <a href=\"http://chffr.comma.ai\">chffr</a>\n";

char pagefooter[] = "</pre>\n"
"</body>\n"
"</html>\n";

char OK_header[] = "HTTP/1.0 200 OK\nContent-Type: text/html\n\n";

static struct espconn web_conn;
static esp_tcp web_proto;
extern char ssid[];
extern int wifi_secure_mode;

char *st_firmware;
int real_content_length, content_length = 0;
char *st_firmware_ptr;
LOCAL os_timer_t ota_reboot_timer;

#define FIRMWARE_SIZE 503808

typedef struct {
  uint16_t ep;
  uint16_t extra_len;
  union {
    struct {
      uint8_t request_type;
      uint8_t request;
      uint16_t value;
      uint16_t index;
      uint16_t length;
    } control;
    uint8_t data[0x10];
  } u;
} usb_msg;

int ICACHE_FLASH_ATTR usb_cmd(int ep, int len, int request,
                              int value, int index, char *data) {
  usb_msg usb = {0};

  usb.ep = ep;
  usb.extra_len = (ep == 0) ? 0 : len;
  if (ep == 0) {
    usb.u.control.request_type = 0xc0;
    usb.u.control.request = request;
    usb.u.control.value = value;
    usb.u.control.index = index;
  } else {
    memcpy(&usb.u.data, data, usb.extra_len);
  }

  uint32_t recv[0x44/4];
  spi_comm(&usb, sizeof(usb), recv, 0x40);

  return recv[0];
}
 

void ICACHE_FLASH_ATTR st_flash() {
  if (st_firmware != NULL) {
    // boot mode
    os_printf("st_flash: enter boot mode\n");
    st_set_boot_mode(1);

    // echo
    os_printf("st_flash: wait for echo\n");
    for (int i = 0; i < 10; i++) {
      os_printf("  attempt: %d\n", i);
      if (usb_cmd(0, 0, 0xb0, 0, 0, NULL) > 0) break;
    }

    // unlock flash
    os_printf("st_flash: unlock flash\n");
    usb_cmd(0, 0, 0xb1, 0, 0, NULL);

    // erase sector 1
    os_printf("st_flash: erase sector 1\n");
    usb_cmd(0, 0, 0xb2, 1, 0, NULL);

    if (real_content_length >= 16384) {
      // erase sector 2
      os_printf("st_flash: erase sector 2\n");
      usb_cmd(0, 0, 0xb2, 2, 0, NULL);
    }

    // real content length will always be 0x10 aligned
    os_printf("st_flash: flashing\n");
    for (int i = 0; i < real_content_length; i += 0x10) {
      int rl = min(0x10, real_content_length-i);
      usb_cmd(2, rl, 0, 0, 0, &st_firmware[i]);
      system_soft_wdt_feed();
    }

    // reboot into normal mode
    os_printf("st_flash: rebooting\n");
    usb_cmd(0, 0, 0xd8, 0, 0, NULL);

    // done with this
    os_free(st_firmware);
    st_firmware = NULL;
  }
}

typedef enum {
    NOT_STARTED,
    CONNECTION_ESTABLISHED,
    RECEIVING_HEADER,
    RECEIVING_ST_FIRMWARE,
    RECEIVING_ESP_FIRMWARE,
    REBOOTING,
    ERROR
} web_state_t;

web_state_t state = NOT_STARTED;
int esp_address, esp_address_erase_limit, start_address;

void ICACHE_FLASH_ATTR hexdump(char *data, int len) {
  int i;
  for (i=0;i<len;i++) {
    if (i!=0 && (i%0x10)==0) os_printf("\n");
    os_printf("%02X ", data[i]);
  }
  os_printf("\n");
}

void ICACHE_FLASH_ATTR st_reset() {
  // reset the ST
  gpio16_output_conf();
  gpio16_output_set(0);
  os_delay_us(1000);
  gpio16_output_set(1);
  os_delay_us(10000);
}

void ICACHE_FLASH_ATTR st_set_boot_mode(int boot_mode) {
  if (boot_mode) {
    // boot mode (pull low)
    gpio_output_set(0, (1 << 4), (1 << 4), 0);
    st_reset();
  } else {
    // no boot mode (pull high)
    gpio_output_set((1 << 4), 0, (1 << 4), 0);
    st_reset();
  }

  // float boot pin
  gpio_output_set(0, 0, 0, (1 << 4));
}

static void ICACHE_FLASH_ATTR web_rx_cb(void *arg, char *data, uint16_t len) {
  int i;
  struct espconn *conn = (struct espconn *)arg;
  if (state == CONNECTION_ESTABLISHED) {
    state = RECEIVING_HEADER;
    os_printf("%s %d\n", data, len);

    // index
    if (memcmp(data, "GET / ", 6) == 0) {
      memset(resp, 0, MAX_RESP);

      strcpy(resp, pageheader);
      ets_strcat(resp, "\nssid: ");
      ets_strcat(resp, ssid);
      ets_strcat(resp, "\n");

      ets_strcat(resp, "\nst version:     ");
      uint32_t recvData[0x11];
      int len = spi_comm("\x00\x00\x00\x00\x40\xD6\x00\x00\x00\x00\x40\x00", 0xC, recvData, 0x40);
      ets_memcpy(resp+strlen(resp), recvData+1, len);

      ets_strcat(resp, "\nesp version:    ");
      ets_strcat(resp, gitversion);
      uint8_t current = system_upgrade_userbin_check();
      if (current == UPGRADE_FW_BIN1) {
        ets_strcat(resp, "\nesp flash file: user2.bin");
      } else {
        ets_strcat(resp, "\nesp flash file: user1.bin");
      }

      if (wifi_secure_mode) {
        ets_strcat(resp, "\nin secure mode");
      } else {
        ets_strcat(resp, "\nin INSECURE mode...<a href=\"/secure\">secure it</a>");
      }
      
      ets_strcat(resp,"\nSet USB Mode:"
        "<button onclick=\"var xhr = new XMLHttpRequest(); xhr.open('GET', 'set_property?usb_mode=0'); xhr.send()\" type='button'>Client</button>"
        "<button onclick=\"var xhr = new XMLHttpRequest(); xhr.open('GET', 'set_property?usb_mode=1'); xhr.send()\" type='button'>CDP</button>"
        "<button onclick=\"var xhr = new XMLHttpRequest(); xhr.open('GET', 'set_property?usb_mode=2'); xhr.send()\" type='button'>DCP</button>\n");

      ets_strcat(resp, pagefooter);
      
      espconn_send_string(&web_conn, resp);
      espconn_disconnect(conn);
    } else if (memcmp(data, "GET /secure", 11) == 0 && !wifi_secure_mode) {
      wifi_configure(1);
    } else if (memcmp(data, "GET /set_property?usb_mode=", 27) == 0 && wifi_secure_mode) {
      char mode_value = data[27] - '0';
        if (mode_value >= '\x00' && mode_value <= '\x02') {
          memset(resp, 0, MAX_RESP);
          char set_usb_mode_packet[] = "\x00\x00\x00\x00\x40\xE6\x00\x00\x00\x00\x40\x00";
          set_usb_mode_packet[6] = mode_value;
          uint32_t recvData[1];
          spi_comm(set_usb_mode_packet, 0xC, recvData, 0);
          os_sprintf(resp, "%sUSB Mode set to %02x\n\n", OK_header, mode_value);
          espconn_send_string(&web_conn, resp);
          espconn_disconnect(conn);
        }  
    } else if (memcmp(data, "PUT /stupdate ", 14) == 0 && wifi_secure_mode) {
      os_printf("init st firmware\n");
      char *cl = strstr(data, "Content-Length: ");
      if (cl != NULL) {
        // get content length
        cl += strlen("Content-Length: ");
        content_length = skip_atoi(&cl);
        os_printf("with content length %d\n", content_length);

        // should be small enough to fit in RAM
        real_content_length = (content_length+0xF)&(~0xF);
        st_firmware_ptr = st_firmware = os_malloc(real_content_length);
        memset(st_firmware, 0, real_content_length);
        state = RECEIVING_ST_FIRMWARE;
      }
      
    } else if (((memcmp(data, "PUT /espupdate1 ", 16) == 0) ||
                (memcmp(data, "PUT /espupdate2 ", 16) == 0)) && wifi_secure_mode) {
      // 0x1000   = user1.bin
      // 0x81000  = user2.bin
      // 0x3FE000 = blank.bin
      os_printf("init esp firmware\n");
      char *cl = strstr(data, "Content-Length: ");
      if (cl != NULL) {
        // get content length
        cl += strlen("Content-Length: ");
        content_length = skip_atoi(&cl);
        os_printf("with content length %d\n", content_length);

        // setup flashing
        uint8_t current = system_upgrade_userbin_check();
        if (data[14] == '2' && current == UPGRADE_FW_BIN1) {
          os_printf("flashing boot2.bin\n");
          state = RECEIVING_ESP_FIRMWARE;
          esp_address = 4*1024 + FIRMWARE_SIZE + 16*1024 + 4*1024;
        } else if (data[14] == '1' && current == UPGRADE_FW_BIN2) {
          os_printf("flashing boot1.bin\n");
          state = RECEIVING_ESP_FIRMWARE;
          esp_address = 4*1024;
        } else {
          espconn_send_string(&web_conn, "HTTP/1.0 404 Not Found\nContent-Type: text/html\n\nwrong!\n");
          espconn_disconnect(conn);
        }
        esp_address_erase_limit = esp_address;
        start_address = esp_address;
      }
    } else {
      espconn_send_string(&web_conn, "HTTP/1.0 404 Not Found\nContent-Type: text/html\n\n404 Not Found!\n");
      espconn_disconnect(conn);
    }
  } else if (state == RECEIVING_ST_FIRMWARE) {
    os_printf("receiving st firmware: %d/%d\n", len, content_length);
    memcpy(st_firmware_ptr, data, min(content_length, len));
    st_firmware_ptr += len;
    content_length -= len;

    if (content_length <= 0 && real_content_length > 1000) {
      state = NOT_STARTED;
      os_printf("done!\n");
      espconn_send_string(&web_conn, "HTTP/1.0 200 OK\nContent-Type: text/html\n\nsuccess!\n");
      espconn_disconnect(conn);

      // reboot
      os_printf("Scheduling st_flash in 100ms.\n");
      os_timer_disarm(&ota_reboot_timer);
      os_timer_setfn(&ota_reboot_timer, (os_timer_func_t *)st_flash, NULL);
      os_timer_arm(&ota_reboot_timer, 100, 0);
    }
  } else if (state == RECEIVING_ESP_FIRMWARE) {
    if ((esp_address+len) < (start_address + FIRMWARE_SIZE)) {
      os_printf("receiving esp firmware: %d/%d -- 0x%x - 0x%x\n", len, content_length,
        esp_address, esp_address_erase_limit);
      content_length -= len;
      while (esp_address_erase_limit < (esp_address + len)) {
        os_printf("erasing 0x%X\n", esp_address_erase_limit);
        spi_flash_erase_sector(esp_address_erase_limit / SPI_FLASH_SEC_SIZE);
        esp_address_erase_limit += SPI_FLASH_SEC_SIZE;
      }
      SpiFlashOpResult res = spi_flash_write(esp_address, data, len);
      if (res != SPI_FLASH_RESULT_OK) {
        os_printf("flash fail @ 0x%x\n", esp_address);
      }
      esp_address += len;

      if (content_length == 0) {

        char digest[SHA_DIGEST_SIZE];
        uint32_t rsa[RSANUMBYTES/4];
        uint32_t dat[0x80/4];
        int ll;
        spi_flash_read(esp_address-RSANUMBYTES, rsa, RSANUMBYTES);

        // 32-bit aligned accesses only
        SHA_CTX ctx;
        SHA_init(&ctx);
        for (ll = start_address; ll < esp_address-RSANUMBYTES; ll += 0x80) {
          spi_flash_read(ll, dat, 0x80);
          SHA_update(&ctx, dat, min((esp_address-RSANUMBYTES)-ll, 0x80));
        }
        memcpy(digest, SHA_final(&ctx), SHA_DIGEST_SIZE);

        if (RSA_verify(&releaseesp_rsa_key, rsa, RSANUMBYTES, digest, SHA_DIGEST_SIZE) ||
          #ifdef ALLOW_DEBUG
            RSA_verify(&debugesp_rsa_key, rsa, RSANUMBYTES, digest, SHA_DIGEST_SIZE)
          #else
            false
          #endif
          ) {
          os_printf("RSA verify success!\n");
          espconn_send_string(&web_conn, "HTTP/1.0 200 OK\nContent-Type: text/html\n\nsuccess!\n");
          system_upgrade_flag_set(UPGRADE_FLAG_FINISH);

          // reboot
          os_printf("Scheduling reboot.\n");
          os_timer_disarm(&ota_reboot_timer);
          os_timer_setfn(&ota_reboot_timer, (os_timer_func_t *)system_upgrade_reboot, NULL);
          os_timer_arm(&ota_reboot_timer, 2000, 0);
        } else {
          os_printf("RSA verify FAILURE\n");
          espconn_send_string(&web_conn, "HTTP/1.0 500 Internal Server Error\nContent-Type: text/html\n\nrsa verify fail\n");
        }
        espconn_disconnect(conn);
      }
    }
  }
}

void ICACHE_FLASH_ATTR web_tcp_connect_cb(void *arg) {
  state = CONNECTION_ESTABLISHED;
  struct espconn *conn = (struct espconn *)arg;
  espconn_set_opt(&web_conn, ESPCONN_NODELAY);
  espconn_regist_recvcb(conn, web_rx_cb);
}

void ICACHE_FLASH_ATTR web_init() {
  web_proto.local_port = 80;
  web_conn.type = ESPCONN_TCP;
  web_conn.state = ESPCONN_NONE;
  web_conn.proto.tcp = &web_proto;
  espconn_regist_connectcb(&web_conn, web_tcp_connect_cb);
  espconn_accept(&web_conn);
}