cvs.zerfleddert.de Git - proxmark3-svn/blob - bootrom/bootrom.c

   1 //-----------------------------------------------------------------------------
   2 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
   3 // at your option, any later version. See the LICENSE.txt file for the text of
   4 // the license.
   5 //-----------------------------------------------------------------------------
   6 // Main code for the bootloader
   7 //-----------------------------------------------------------------------------
   8
   9 #include <proxmark3.h>
  10
  11 struct common_area common_area __attribute__((section(".commonarea")));
  12 unsigned int start_addr, end_addr, bootrom_unlocked;
  13 extern char _bootrom_start, _bootrom_end, _flash_start, _flash_end;
  14
  15 static void ConfigClocks(void)
  16 {
  17     // we are using a 16 MHz crystal as the basis for everything
  18     // slow clock runs at 32Khz typical regardless of crystal
  19
  20     // enable system clock and USB clock
  21     AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK | AT91C_PMC_UDP;
  22
  23         // enable the clock to the following peripherals
  24     AT91C_BASE_PMC->PMC_PCER =
  25                 (1<<AT91C_ID_PIOA)      |
  26                 (1<<AT91C_ID_ADC)       |
  27                 (1<<AT91C_ID_SPI)       |
  28                 (1<<AT91C_ID_SSC)       |
  29                 (1<<AT91C_ID_PWMC)      |
  30                 (1<<AT91C_ID_UDP);
  31
  32         // worst case scenario, with MAINCK = 16Mhz xtal, startup delay is 1.4ms
  33         // if SLCK slow clock runs at its worst case (max) frequency of 42khz
  34         // max startup delay = (1.4ms*42k)/8 = 7.356 so round up to 8
  35
  36         // enable main oscillator and set startup delay
  37     AT91C_BASE_PMC->PMC_MOR =
  38         AT91C_CKGR_MOSCEN |
  39         PMC_MAIN_OSC_STARTUP_DELAY(8);
  40
  41         // wait for main oscillator to stabilize
  42         while ( !(AT91C_BASE_PMC->PMC_SR & AT91C_PMC_MOSCS) )
  43                 ;
  44
  45     // PLL output clock frequency in range  80 - 160 MHz needs CKGR_PLL = 00
  46     // PLL output clock frequency in range 150 - 180 MHz needs CKGR_PLL = 10
  47     // PLL output is MAINCK * multiplier / divisor = 16Mhz * 12 / 2 = 96Mhz
  48     AT91C_BASE_PMC->PMC_PLLR =
  49         PMC_PLL_DIVISOR(2) |
  50                 PMC_PLL_COUNT_BEFORE_LOCK(0x50) |
  51                 PMC_PLL_FREQUENCY_RANGE(0) |
  52                 PMC_PLL_MULTIPLIER(12) |
  53                 PMC_PLL_USB_DIVISOR(1);
  54
  55         // wait for PLL to lock
  56         while ( !(AT91C_BASE_PMC->PMC_SR & AT91C_PMC_LOCK) )
  57                 ;
  58
  59         // we want a master clock (MCK) to be PLL clock / 2 = 96Mhz / 2 = 48Mhz
  60         // datasheet recommends that this register is programmed in two operations
  61         // when changing to PLL, program the prescaler first then the source
  62     AT91C_BASE_PMC->PMC_MCKR = AT91C_PMC_PRES_CLK_2;
  63
  64         // wait for main clock ready signal
  65         while ( !(AT91C_BASE_PMC->PMC_SR & AT91C_PMC_MCKRDY) )
  66                 ;
  67
  68         // set the source to PLL
  69     AT91C_BASE_PMC->PMC_MCKR = AT91C_PMC_PRES_CLK_2 | AT91C_PMC_CSS_PLL_CLK;
  70
  71         // wait for main clock ready signal
  72         while ( !(AT91C_BASE_PMC->PMC_SR & AT91C_PMC_MCKRDY) )
  73                 ;
  74 }
  75
  76 static void Fatal(void)
  77 {
  78     for(;;);
  79 }
  80
  81 void UsbPacketReceived(uint8_t *packet, int len)
  82 {
  83     int i, dont_ack=0;
  84     UsbCommand *c = (UsbCommand *)packet;
  85     volatile uint32_t *p;
  86
  87     if(len != sizeof(*c)) {
  88         Fatal();
  89     }
  90
  91     switch(c->cmd) {
  92         case CMD_DEVICE_INFO:
  93             dont_ack = 1;
  94             c->cmd = CMD_DEVICE_INFO;
  95             c->arg[0] = DEVICE_INFO_FLAG_BOOTROM_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM |
  96                 DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH;
  97             if(common_area.flags.osimage_present) c->arg[0] |= DEVICE_INFO_FLAG_OSIMAGE_PRESENT;
  98             UsbSendPacket(packet, len);
  99             break;
 100
 101         case CMD_SETUP_WRITE:
 102             /* The temporary write buffer of the embedded flash controller is mapped to the
 103              * whole memory region, only the last 8 bits are decoded.
 104              */
 105             p = (volatile uint32_t *)&_flash_start;
 106             for(i = 0; i < 12; i++) {
 107                 p[i+c->arg[0]] = c->d.asDwords[i];
 108             }
 109             break;
 110
 111         case CMD_FINISH_WRITE:
 112             p = (volatile uint32_t *)&_flash_start;
 113             for(i = 0; i < 4; i++) {
 114                 p[i+60] = c->d.asDwords[i];
 115             }
 116
 117             /* Check that the address that we are supposed to write to is within our allowed region */
 118             if( ((c->arg[0]+AT91C_IFLASH_PAGE_SIZE-1) >= end_addr) || (c->arg[0] < start_addr) ) {
 119                 /* Disallow write */
 120                 dont_ack = 1;
 121                 c->cmd = CMD_NACK;
 122                 UsbSendPacket(packet, len);
 123             } else {
 124                 /* Translate address to flash page and do flash, update here for the 512k part */
 125                 AT91C_BASE_EFC0->EFC_FCR = MC_FLASH_COMMAND_KEY |
 126                     MC_FLASH_COMMAND_PAGEN((c->arg[0]-(int)&_flash_start)/AT91C_IFLASH_PAGE_SIZE) |
 127                     AT91C_MC_FCMD_START_PROG;
 128             }
 129
 130             uint32_t sr;
 131
 132             while(!((sr = AT91C_BASE_EFC0->EFC_FSR) & AT91C_MC_FRDY))
 133                 ;
 134             if(sr & (AT91C_MC_LOCKE | AT91C_MC_PROGE)) {
 135                     dont_ack = 1;
 136                     c->cmd = CMD_NACK;
 137                     UsbSendPacket(packet, len);
 138             }
 139             break;
 140
 141         case CMD_HARDWARE_RESET:
 142             USB_D_PLUS_PULLUP_OFF();
 143             AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
 144             break;
 145
 146         case CMD_START_FLASH:
 147             if(c->arg[2] == START_FLASH_MAGIC) bootrom_unlocked = 1;
 148             else bootrom_unlocked = 0;
 149             {
 150                 int prot_start = (int)&_bootrom_start;
 151                 int prot_end = (int)&_bootrom_end;
 152                 int allow_start = (int)&_flash_start;
 153                 int allow_end = (int)&_flash_end;
 154                 int cmd_start = c->arg[0];
 155                 int cmd_end = c->arg[1];
 156
 157                 /* Only allow command if the bootrom is unlocked, or the parameters are outside of the protected
 158                  * bootrom area. In any case they must be within the flash area.
 159                  */
 160                 if( (bootrom_unlocked || ((cmd_start >= prot_end) || (cmd_end < prot_start)))
 161                     && (cmd_start >= allow_start) && (cmd_end <= allow_end) ) {
 162                     start_addr = cmd_start;
 163                     end_addr = cmd_end;
 164                 } else {
 165                     start_addr = end_addr = 0;
 166                     dont_ack = 1;
 167                     c->cmd = CMD_NACK;
 168                     UsbSendPacket(packet, len);
 169                 }
 170             }
 171             break;
 172
 173         default:
 174             Fatal();
 175             break;
 176     }
 177
 178     if(!dont_ack) {
 179         c->cmd = CMD_ACK;
 180         UsbSendPacket(packet, len);
 181     }
 182 }
 183
 184 static void flash_mode(int externally_entered)
 185 {
 186         start_addr = 0;
 187         end_addr = 0;
 188         bootrom_unlocked = 0;
 189
 190         UsbStart();
 191         for(;;) {
 192                 WDT_HIT();
 193
 194                 UsbPoll(TRUE);
 195
 196                 if(!externally_entered && !BUTTON_PRESS()) {
 197                         /* Perform a reset to leave flash mode */
 198                         USB_D_PLUS_PULLUP_OFF();
 199                         LED_B_ON();
 200                         AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
 201                         for(;;);
 202                 }
 203                 if(externally_entered && BUTTON_PRESS()) {
 204                         /* Let the user's button press override the automatic leave */
 205                         externally_entered = 0;
 206                 }
 207         }
 208 }
 209
 210 extern char _osimage_entry;
 211 void BootROM(void)
 212 {
 213     //------------
 214     // First set up all the I/O pins; GPIOs configured directly, other ones
 215     // just need to be assigned to the appropriate peripheral.
 216
 217     // Kill all the pullups, especially the one on USB D+; leave them for
 218     // the unused pins, though.
 219     AT91C_BASE_PIOA->PIO_PPUDR =
 220         GPIO_USB_PU                     |
 221                 GPIO_LED_A                      |
 222                 GPIO_LED_B                      |
 223                 GPIO_LED_C                      |
 224                 GPIO_LED_D                      |
 225                 GPIO_FPGA_DIN           |
 226                 GPIO_FPGA_DOUT          |
 227                 GPIO_FPGA_CCLK          |
 228                 GPIO_FPGA_NINIT         |
 229                 GPIO_FPGA_NPROGRAM      |
 230                 GPIO_FPGA_DONE          |
 231                 GPIO_MUXSEL_HIPKD       |
 232                 GPIO_MUXSEL_HIRAW       |
 233                 GPIO_MUXSEL_LOPKD       |
 234                 GPIO_MUXSEL_LORAW       |
 235                 GPIO_RELAY                      |
 236                 GPIO_NVDD_ON;
 237                 // (and add GPIO_FPGA_ON)
 238         // These pins are outputs
 239     AT91C_BASE_PIOA->PIO_OER =
 240         GPIO_LED_A                      |
 241                 GPIO_LED_B                      |
 242                 GPIO_LED_C                      |
 243                 GPIO_LED_D                      |
 244                 GPIO_RELAY                      |
 245                 GPIO_NVDD_ON;
 246         // PIO controls the following pins
 247     AT91C_BASE_PIOA->PIO_PER =
 248         GPIO_USB_PU                     |
 249                 GPIO_LED_A                      |
 250                 GPIO_LED_B                      |
 251                 GPIO_LED_C                      |
 252                 GPIO_LED_D;
 253
 254     USB_D_PLUS_PULLUP_OFF();
 255     LED_D_OFF();
 256     LED_C_ON();
 257     LED_B_OFF();
 258     LED_A_OFF();
 259
 260         AT91C_BASE_EFC0->EFC_FMR =
 261                 AT91C_MC_FWS_1FWS |
 262                 MC_FLASH_MODE_MASTER_CLK_IN_MHZ(48);
 263
 264     // Initialize all system clocks
 265     ConfigClocks();
 266
 267     LED_A_ON();
 268
 269     int common_area_present = 0;
 270     switch(AT91C_BASE_RSTC->RSTC_RSR & AT91C_RSTC_RSTTYP) {
 271     case AT91C_RSTC_RSTTYP_WATCHDOG:
 272     case AT91C_RSTC_RSTTYP_SOFTWARE:
 273     case AT91C_RSTC_RSTTYP_USER:
 274             /* In these cases the common_area in RAM should be ok, retain it if it's there */
 275             if(common_area.magic == COMMON_AREA_MAGIC && common_area.version == 1) {
 276                     common_area_present = 1;
 277             }
 278             break;
 279     default: /* Otherwise, initialize it from scratch */
 280             break;
 281     }
 282
 283     if(!common_area_present){
 284             /* Common area not ok, initialize it */
 285             int i; for(i=0; i<sizeof(common_area); i++) { /* Makeshift memset, no need to drag util.c into this */
 286                     ((char*)&common_area)[i] = 0;
 287             }
 288             common_area.magic = COMMON_AREA_MAGIC;
 289             common_area.version = 1;
 290             common_area.flags.bootrom_present = 1;
 291     }
 292
 293     common_area.flags.bootrom_present = 1;
 294     if(common_area.command == COMMON_AREA_COMMAND_ENTER_FLASH_MODE) {
 295             common_area.command = COMMON_AREA_COMMAND_NONE;
 296             flash_mode(1);
 297     } else if(BUTTON_PRESS()) {
 298             flash_mode(0);
 299     } else if(*(uint32_t*)&_osimage_entry == 0xffffffffU) {
 300             flash_mode(1);
 301     } else {
 302             // jump to Flash address of the osimage entry point (LSBit set for thumb mode)
 303             asm("bx %0\n" : : "r" ( ((int)&_osimage_entry) | 0x1 ) );
 304     }
 305 }