]>
Commit | Line | Data |
---|---|---|
6658905f | 1 | #include <proxmark3.h>\r |
2 | \r | |
8fcbf652 | 3 | struct common_area common_area __attribute__((section(".commonarea")));\r |
6949aca9 | 4 | unsigned int start_addr, end_addr, bootrom_unlocked;\r |
8fcbf652 | 5 | extern char _bootrom_start, _bootrom_end, _flash_start, _flash_end;\r |
6 | \r | |
6658905f | 7 | static void ConfigClocks(void)\r |
8 | {\r | |
9 | // we are using a 16 MHz crystal as the basis for everything\r | |
10 | // slow clock runs at 32Khz typical regardless of crystal\r | |
11 | \r | |
12 | // enable system clock and USB clock\r | |
6949aca9 | 13 | AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK | AT91C_PMC_UDP;\r |
6658905f | 14 | \r |
15 | // enable the clock to the following peripherals\r | |
6949aca9 | 16 | AT91C_BASE_PMC->PMC_PCER =\r |
17 | (1<<AT91C_ID_PIOA) |\r | |
18 | (1<<AT91C_ID_ADC) |\r | |
19 | (1<<AT91C_ID_SPI) |\r | |
20 | (1<<AT91C_ID_SSC) |\r | |
21 | (1<<AT91C_ID_PWMC) |\r | |
22 | (1<<AT91C_ID_UDP);\r | |
6658905f | 23 | \r |
24 | // worst case scenario, with 16Mhz xtal startup delay is 14.5ms\r | |
25 | // with a slow clock running at it worst case (max) frequency of 42khz\r | |
26 | // max startup delay = (14.5ms*42k)/8 = 76 = 0x4C round up to 0x50\r | |
27 | \r | |
28 | // enable main oscillator and set startup delay\r | |
6949aca9 | 29 | AT91C_BASE_PMC->PMC_MOR =\r |
30 | PMC_MAIN_OSC_ENABLE |\r | |
31 | PMC_MAIN_OSC_STARTUP_DELAY(0x50);\r | |
6658905f | 32 | \r |
33 | // wait for main oscillator to stabilize\r | |
6949aca9 | 34 | while ( !(AT91C_BASE_PMC->PMC_SR & PMC_MAIN_OSC_STABILIZED) )\r |
6658905f | 35 | ;\r |
36 | \r | |
37 | // minimum PLL clock frequency is 80 MHz in range 00 (96 here so okay)\r | |
38 | // frequency is crystal * multiplier / divisor = 16Mhz * 12 / 2 = 96Mhz\r | |
6949aca9 | 39 | AT91C_BASE_PMC->PMC_PLLR =\r |
40 | PMC_PLL_DIVISOR(2) |\r | |
41 | PMC_PLL_COUNT_BEFORE_LOCK(0x50) |\r | |
42 | PMC_PLL_FREQUENCY_RANGE(0) |\r | |
43 | PMC_PLL_MULTIPLIER(12) |\r | |
44 | PMC_PLL_USB_DIVISOR(1);\r | |
6658905f | 45 | \r |
46 | // wait for PLL to lock\r | |
6949aca9 | 47 | while ( !(AT91C_BASE_PMC->PMC_SR & PMC_MAIN_OSC_PLL_LOCK) )\r |
6658905f | 48 | ;\r |
49 | \r | |
50 | // we want a master clock (MCK) to be PLL clock / 2 = 96Mhz / 2 = 48Mhz\r | |
51 | // as per datasheet, this register must be programmed in two operations\r | |
52 | // when changing to PLL, program the prescaler first then the source\r | |
6949aca9 | 53 | AT91C_BASE_PMC->PMC_MCKR = PMC_CLK_PRESCALE_DIV_2;\r |
6658905f | 54 | \r |
55 | // wait for main clock ready signal\r | |
6949aca9 | 56 | while ( !(AT91C_BASE_PMC->PMC_SR & PMC_MAIN_OSC_MCK_READY) )\r |
6658905f | 57 | ;\r |
58 | \r | |
59 | // set the source to PLL\r | |
6949aca9 | 60 | AT91C_BASE_PMC->PMC_MCKR = AT91C_PMC_CSS_PLL_CLK | PMC_CLK_PRESCALE_DIV_2;\r |
6658905f | 61 | \r |
62 | // wait for main clock ready signal\r | |
6949aca9 | 63 | while ( !(AT91C_BASE_PMC->PMC_SR & PMC_MAIN_OSC_MCK_READY) )\r |
6658905f | 64 | ;\r |
65 | }\r | |
66 | \r | |
67 | static void Fatal(void)\r | |
68 | {\r | |
69 | for(;;);\r | |
70 | }\r | |
71 | \r | |
72 | void UsbPacketReceived(BYTE *packet, int len)\r | |
73 | {\r | |
8fcbf652 | 74 | int i, dont_ack=0;\r |
6658905f | 75 | UsbCommand *c = (UsbCommand *)packet;\r |
76 | volatile DWORD *p;\r | |
77 | \r | |
78 | if(len != sizeof(*c)) {\r | |
79 | Fatal();\r | |
80 | }\r | |
81 | \r | |
82 | switch(c->cmd) {\r | |
83 | case CMD_DEVICE_INFO:\r | |
8fcbf652 | 84 | dont_ack = 1;\r |
85 | c->cmd = CMD_DEVICE_INFO;\r | |
1dea88f9 | 86 | c->arg[0] = DEVICE_INFO_FLAG_BOOTROM_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM |\r |
8fcbf652 | 87 | DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH;\r |
1dea88f9 | 88 | if(common_area.flags.osimage_present) c->arg[0] |= DEVICE_INFO_FLAG_OSIMAGE_PRESENT;\r |
8fcbf652 | 89 | UsbSendPacket(packet, len);\r |
6658905f | 90 | break;\r |
91 | \r | |
92 | case CMD_SETUP_WRITE:\r | |
8fcbf652 | 93 | /* The temporary write buffer of the embedded flash controller is mapped to the\r |
6949aca9 | 94 | * whole memory region, only the last 8 bits are decoded.\r |
8fcbf652 | 95 | */\r |
96 | p = (volatile DWORD *)&_flash_start;\r | |
6658905f | 97 | for(i = 0; i < 12; i++) {\r |
1dea88f9 | 98 | p[i+c->arg[0]] = c->d.asDwords[i];\r |
6658905f | 99 | }\r |
100 | break;\r | |
101 | \r | |
102 | case CMD_FINISH_WRITE:\r | |
8fcbf652 | 103 | p = (volatile DWORD *)&_flash_start;\r |
6658905f | 104 | for(i = 0; i < 4; i++) {\r |
105 | p[i+60] = c->d.asDwords[i];\r | |
106 | }\r | |
107 | \r | |
8fcbf652 | 108 | /* Check that the address that we are supposed to write to is within our allowed region */\r |
1dea88f9 | 109 | if( ((c->arg[0]+AT91C_IFLASH_PAGE_SIZE-1) >= end_addr) || (c->arg[0] < start_addr) ) {\r |
8fcbf652 | 110 | /* Disallow write */\r |
111 | dont_ack = 1;\r | |
112 | c->cmd = CMD_NACK;\r | |
113 | UsbSendPacket(packet, len);\r | |
114 | } else {\r | |
115 | /* Translate address to flash page and do flash, update here for the 512k part */\r | |
6949aca9 | 116 | AT91C_BASE_EFC0->EFC_FCR = MC_FLASH_COMMAND_KEY |\r |
1dea88f9 | 117 | MC_FLASH_COMMAND_PAGEN((c->arg[0]-(int)&_flash_start)/AT91C_IFLASH_PAGE_SIZE) |\r |
6949aca9 | 118 | AT91C_MC_FCMD_START_PROG;\r |
8fcbf652 | 119 | }\r |
4ab62816 | 120 | \r |
121 | uint32_t sr;\r | |
122 | \r | |
123 | while(!((sr = AT91C_BASE_EFC0->EFC_FSR) & MC_FLASH_STATUS_READY))\r | |
6658905f | 124 | ;\r |
4ab62816 | 125 | if(sr & (MC_FLASH_STATUS_LOCKE | MC_FLASH_STATUS_PROGE)) { \r |
126 | dont_ack = 1;\r | |
127 | c->cmd = CMD_NACK;\r | |
128 | UsbSendPacket(packet, len);\r | |
129 | }\r | |
6658905f | 130 | break;\r |
131 | \r | |
132 | case CMD_HARDWARE_RESET:\r | |
8fcbf652 | 133 | USB_D_PLUS_PULLUP_OFF();\r |
6949aca9 | 134 | AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;\r |
6658905f | 135 | break;\r |
6949aca9 | 136 | \r |
8fcbf652 | 137 | case CMD_START_FLASH:\r |
1dea88f9 | 138 | if(c->arg[2] == START_FLASH_MAGIC) bootrom_unlocked = 1;\r |
8fcbf652 | 139 | else bootrom_unlocked = 0;\r |
140 | {\r | |
141 | int prot_start = (int)&_bootrom_start;\r | |
142 | int prot_end = (int)&_bootrom_end;\r | |
143 | int allow_start = (int)&_flash_start;\r | |
144 | int allow_end = (int)&_flash_end;\r | |
1dea88f9 | 145 | int cmd_start = c->arg[0];\r |
146 | int cmd_end = c->arg[1];\r | |
6949aca9 | 147 | \r |
8fcbf652 | 148 | /* Only allow command if the bootrom is unlocked, or the parameters are outside of the protected\r |
6949aca9 | 149 | * bootrom area. In any case they must be within the flash area.\r |
8fcbf652 | 150 | */\r |
151 | if( (bootrom_unlocked || ((cmd_start >= prot_end) || (cmd_end < prot_start)))\r | |
152 | && (cmd_start >= allow_start) && (cmd_end <= allow_end) ) {\r | |
153 | start_addr = cmd_start;\r | |
154 | end_addr = cmd_end;\r | |
155 | } else {\r | |
156 | start_addr = end_addr = 0;\r | |
157 | dont_ack = 1;\r | |
158 | c->cmd = CMD_NACK;\r | |
159 | UsbSendPacket(packet, len);\r | |
160 | }\r | |
161 | }\r | |
162 | break;\r | |
6949aca9 | 163 | \r |
6658905f | 164 | default:\r |
165 | Fatal();\r | |
166 | break;\r | |
167 | }\r | |
168 | \r | |
8fcbf652 | 169 | if(!dont_ack) {\r |
170 | c->cmd = CMD_ACK;\r | |
171 | UsbSendPacket(packet, len);\r | |
172 | }\r | |
173 | }\r | |
174 | \r | |
175 | static void flash_mode(int externally_entered)\r | |
176 | {\r | |
177 | start_addr = 0;\r | |
178 | end_addr = 0;\r | |
179 | bootrom_unlocked = 0;\r | |
6949aca9 | 180 | \r |
8fcbf652 | 181 | UsbStart();\r |
182 | for(;;) {\r | |
183 | WDT_HIT();\r | |
6949aca9 | 184 | \r |
8fcbf652 | 185 | UsbPoll(TRUE);\r |
6949aca9 | 186 | \r |
8fcbf652 | 187 | if(!externally_entered && !BUTTON_PRESS()) {\r |
188 | /* Perform a reset to leave flash mode */\r | |
189 | USB_D_PLUS_PULLUP_OFF();\r | |
190 | LED_B_ON();\r | |
6949aca9 | 191 | AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;\r |
8fcbf652 | 192 | for(;;);\r |
193 | }\r | |
194 | if(externally_entered && BUTTON_PRESS()) {\r | |
195 | /* Let the user's button press override the automatic leave */\r | |
196 | externally_entered = 0;\r | |
197 | }\r | |
198 | }\r | |
6658905f | 199 | }\r |
200 | \r | |
e3ae0257 | 201 | extern char _osimage_entry;\r |
6658905f | 202 | void BootROM(void)\r |
203 | {\r | |
204 | //------------\r | |
205 | // First set up all the I/O pins; GPIOs configured directly, other ones\r | |
206 | // just need to be assigned to the appropriate peripheral.\r | |
207 | \r | |
208 | // Kill all the pullups, especially the one on USB D+; leave them for\r | |
209 | // the unused pins, though.\r | |
6949aca9 | 210 | AT91C_BASE_PIOA->PIO_PPUDR =\r |
211 | GPIO_USB_PU |\r | |
212 | GPIO_LED_A |\r | |
213 | GPIO_LED_B |\r | |
214 | GPIO_LED_C |\r | |
215 | GPIO_LED_D |\r | |
216 | GPIO_FPGA_DIN |\r | |
217 | GPIO_FPGA_DOUT |\r | |
218 | GPIO_FPGA_CCLK |\r | |
219 | GPIO_FPGA_NINIT |\r | |
220 | GPIO_FPGA_NPROGRAM |\r | |
221 | GPIO_FPGA_DONE |\r | |
222 | GPIO_MUXSEL_HIPKD |\r | |
223 | GPIO_MUXSEL_HIRAW |\r | |
224 | GPIO_MUXSEL_LOPKD |\r | |
225 | GPIO_MUXSEL_LORAW |\r | |
226 | GPIO_RELAY |\r | |
227 | GPIO_NVDD_ON;\r | |
228 | // (and add GPIO_FPGA_ON)\r | |
6658905f | 229 | // These pins are outputs\r |
6949aca9 | 230 | AT91C_BASE_PIOA->PIO_OER =\r |
231 | GPIO_LED_A |\r | |
232 | GPIO_LED_B |\r | |
233 | GPIO_LED_C |\r | |
234 | GPIO_LED_D |\r | |
235 | GPIO_RELAY |\r | |
236 | GPIO_NVDD_ON;\r | |
6658905f | 237 | // PIO controls the following pins\r |
6949aca9 | 238 | AT91C_BASE_PIOA->PIO_PER =\r |
239 | GPIO_USB_PU |\r | |
240 | GPIO_LED_A |\r | |
241 | GPIO_LED_B |\r | |
242 | GPIO_LED_C |\r | |
243 | GPIO_LED_D;\r | |
6658905f | 244 | \r |
245 | USB_D_PLUS_PULLUP_OFF();\r | |
246 | LED_D_OFF();\r | |
247 | LED_C_ON();\r | |
248 | LED_B_OFF();\r | |
249 | LED_A_OFF();\r | |
6949aca9 | 250 | \r |
8fcbf652 | 251 | // if 512K FLASH part - TODO make some defines :)\r |
6949aca9 | 252 | if ((AT91C_BASE_DBGU->DBGU_CIDR | 0xf00) == 0xa00) {\r |
253 | AT91C_BASE_EFC0->EFC_FMR =\r | |
254 | MC_FLASH_MODE_FLASH_WAIT_STATES(1) |\r | |
255 | MC_FLASH_MODE_MASTER_CLK_IN_MHZ(0x48);\r | |
256 | AT91C_BASE_EFC1->EFC_FMR =\r | |
257 | MC_FLASH_MODE_FLASH_WAIT_STATES(1) |\r | |
258 | MC_FLASH_MODE_MASTER_CLK_IN_MHZ(0x48);\r | |
8fcbf652 | 259 | } else {\r |
6949aca9 | 260 | AT91C_BASE_EFC0->EFC_FMR =\r |
261 | MC_FLASH_MODE_FLASH_WAIT_STATES(0) |\r | |
262 | MC_FLASH_MODE_MASTER_CLK_IN_MHZ(48);\r | |
8fcbf652 | 263 | }\r |
6949aca9 | 264 | \r |
8fcbf652 | 265 | // Initialize all system clocks\r |
6658905f | 266 | ConfigClocks();\r |
6949aca9 | 267 | \r |
6658905f | 268 | LED_A_ON();\r |
6949aca9 | 269 | \r |
8fcbf652 | 270 | int common_area_present = 0;\r |
6949aca9 | 271 | switch(AT91C_BASE_RSTC->RSTC_RSR & AT91C_RSTC_RSTTYP) {\r |
272 | case AT91C_RSTC_RSTTYP_WATCHDOG:\r | |
273 | case AT91C_RSTC_RSTTYP_SOFTWARE:\r | |
274 | case AT91C_RSTC_RSTTYP_USER:\r | |
8fcbf652 | 275 | /* In these cases the common_area in RAM should be ok, retain it if it's there */\r |
276 | if(common_area.magic == COMMON_AREA_MAGIC && common_area.version == 1) {\r | |
277 | common_area_present = 1;\r | |
278 | }\r | |
279 | break;\r | |
280 | default: /* Otherwise, initialize it from scratch */\r | |
281 | break;\r | |
282 | }\r | |
6949aca9 | 283 | \r |
8fcbf652 | 284 | if(!common_area_present){\r |
285 | /* Common area not ok, initialize it */\r | |
286 | int i; for(i=0; i<sizeof(common_area); i++) { /* Makeshift memset, no need to drag util.c into this */\r | |
287 | ((char*)&common_area)[i] = 0;\r | |
288 | }\r | |
289 | common_area.magic = COMMON_AREA_MAGIC;\r | |
290 | common_area.version = 1;\r | |
291 | common_area.flags.bootrom_present = 1;\r | |
292 | }\r | |
6949aca9 | 293 | \r |
8fcbf652 | 294 | common_area.flags.bootrom_present = 1;\r |
295 | if(common_area.command == COMMON_AREA_COMMAND_ENTER_FLASH_MODE) {\r | |
296 | common_area.command = COMMON_AREA_COMMAND_NONE;\r | |
297 | flash_mode(1);\r | |
298 | } else if(BUTTON_PRESS()) {\r | |
299 | flash_mode(0);\r | |
300 | } else {\r | |
301 | // jump to Flash address of the osimage entry point (LSBit set for thumb mode)\r | |
302 | asm("bx %0\n" : : "r" ( ((int)&_osimage_entry) | 0x1 ) );\r | |
6658905f | 303 | }\r |
304 | }\r |