1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, April 2006
4 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
5 // at your option, any later version. See the LICENSE.txt file for the text of
7 //-----------------------------------------------------------------------------
8 // Routines to load the FPGA image, and then to configure the FPGA's major
9 // mode once it is configured.
10 //-----------------------------------------------------------------------------
12 #include "proxmark3.h"
17 //-----------------------------------------------------------------------------
18 // Set up the Serial Peripheral Interface as master
19 // Used to write the FPGA config word
20 // May also be used to write to other SPI attached devices like an LCD
21 //-----------------------------------------------------------------------------
22 void SetupSpi(int mode
)
24 // PA10 -> SPI_NCS2 chip select (LCD)
25 // PA11 -> SPI_NCS0 chip select (FPGA)
26 // PA12 -> SPI_MISO Master-In Slave-Out
27 // PA13 -> SPI_MOSI Master-Out Slave-In
28 // PA14 -> SPI_SPCK Serial Clock
30 // Disable PIO control of the following pins, allows use by the SPI peripheral
31 AT91C_BASE_PIOA
->PIO_PDR
=
38 AT91C_BASE_PIOA
->PIO_ASR
=
44 AT91C_BASE_PIOA
->PIO_BSR
= GPIO_NCS2
;
46 //enable the SPI Peripheral clock
47 AT91C_BASE_PMC
->PMC_PCER
= (1<<AT91C_ID_SPI
);
49 AT91C_BASE_SPI
->SPI_CR
= AT91C_SPI_SPIEN
;
53 AT91C_BASE_SPI
->SPI_MR
=
54 ( 0 << 24) | // Delay between chip selects (take default: 6 MCK periods)
55 (14 << 16) | // Peripheral Chip Select (selects FPGA SPI_NCS0 or PA11)
56 ( 0 << 7) | // Local Loopback Disabled
57 ( 1 << 4) | // Mode Fault Detection disabled
58 ( 0 << 2) | // Chip selects connected directly to peripheral
59 ( 0 << 1) | // Fixed Peripheral Select
60 ( 1 << 0); // Master Mode
61 AT91C_BASE_SPI
->SPI_CSR
[0] =
62 ( 1 << 24) | // Delay between Consecutive Transfers (32 MCK periods)
63 ( 1 << 16) | // Delay Before SPCK (1 MCK period)
64 ( 6 << 8) | // Serial Clock Baud Rate (baudrate = MCK/6 = 24Mhz/6 = 4M baud
65 ( 8 << 4) | // Bits per Transfer (16 bits)
66 ( 0 << 3) | // Chip Select inactive after transfer
67 ( 1 << 1) | // Clock Phase data captured on leading edge, changes on following edge
68 ( 0 << 0); // Clock Polarity inactive state is logic 0
71 AT91C_BASE_SPI
->SPI_MR
=
72 ( 0 << 24) | // Delay between chip selects (take default: 6 MCK periods)
73 (11 << 16) | // Peripheral Chip Select (selects LCD SPI_NCS2 or PA10)
74 ( 0 << 7) | // Local Loopback Disabled
75 ( 1 << 4) | // Mode Fault Detection disabled
76 ( 0 << 2) | // Chip selects connected directly to peripheral
77 ( 0 << 1) | // Fixed Peripheral Select
78 ( 1 << 0); // Master Mode
79 AT91C_BASE_SPI
->SPI_CSR
[2] =
80 ( 1 << 24) | // Delay between Consecutive Transfers (32 MCK periods)
81 ( 1 << 16) | // Delay Before SPCK (1 MCK period)
82 ( 6 << 8) | // Serial Clock Baud Rate (baudrate = MCK/6 = 24Mhz/6 = 4M baud
83 ( 1 << 4) | // Bits per Transfer (9 bits)
84 ( 0 << 3) | // Chip Select inactive after transfer
85 ( 1 << 1) | // Clock Phase data captured on leading edge, changes on following edge
86 ( 0 << 0); // Clock Polarity inactive state is logic 0
88 default: // Disable SPI
89 AT91C_BASE_SPI
->SPI_CR
= AT91C_SPI_SPIDIS
;
94 //-----------------------------------------------------------------------------
95 // Set up the synchronous serial port, with the one set of options that we
96 // always use when we are talking to the FPGA. Both RX and TX are enabled.
97 //-----------------------------------------------------------------------------
98 void FpgaSetupSsc(void)
100 // First configure the GPIOs, and get ourselves a clock.
101 AT91C_BASE_PIOA
->PIO_ASR
=
106 AT91C_BASE_PIOA
->PIO_PDR
= GPIO_SSC_DOUT
;
108 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_SSC
);
110 // Now set up the SSC proper, starting from a known state.
111 AT91C_BASE_SSC
->SSC_CR
= AT91C_SSC_SWRST
;
113 // RX clock comes from TX clock, RX starts when TX starts, data changes
114 // on RX clock rising edge, sampled on falling edge
115 AT91C_BASE_SSC
->SSC_RCMR
= SSC_CLOCK_MODE_SELECT(1) | SSC_CLOCK_MODE_START(1);
117 // 8 bits per transfer, no loopback, MSB first, 1 transfer per sync
118 // pulse, no output sync
119 AT91C_BASE_SSC
->SSC_RFMR
= SSC_FRAME_MODE_BITS_IN_WORD(8) | AT91C_SSC_MSBF
| SSC_FRAME_MODE_WORDS_PER_TRANSFER(0);
121 // clock comes from TK pin, no clock output, outputs change on falling
122 // edge of TK, sample on rising edge of TK, start on positive-going edge of sync
123 AT91C_BASE_SSC
->SSC_TCMR
= SSC_CLOCK_MODE_SELECT(2) | SSC_CLOCK_MODE_START(5);
125 // tx framing is the same as the rx framing
126 AT91C_BASE_SSC
->SSC_TFMR
= AT91C_BASE_SSC
->SSC_RFMR
;
128 AT91C_BASE_SSC
->SSC_CR
= AT91C_SSC_RXEN
| AT91C_SSC_TXEN
;
131 //-----------------------------------------------------------------------------
132 // Set up DMA to receive samples from the FPGA. We will use the PDC, with
133 // a single buffer as a circular buffer (so that we just chain back to
134 // ourselves, not to another buffer). The stuff to manipulate those buffers
135 // is in apps.h, because it should be inlined, for speed.
136 //-----------------------------------------------------------------------------
137 bool FpgaSetupSscDma(uint8_t *buf
, int len
)
143 AT91C_BASE_PDC_SSC
->PDC_PTCR
= AT91C_PDC_RXTDIS
; // Disable DMA Transfer
144 AT91C_BASE_PDC_SSC
->PDC_RPR
= (uint32_t) buf
; // transfer to this memory address
145 AT91C_BASE_PDC_SSC
->PDC_RCR
= len
; // transfer this many bytes
146 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) buf
; // next transfer to same memory address
147 AT91C_BASE_PDC_SSC
->PDC_RNCR
= len
; // ... with same number of bytes
148 AT91C_BASE_PDC_SSC
->PDC_PTCR
= AT91C_PDC_RXTEN
; // go!
153 static void DownloadFPGA_byte(unsigned char w
)
155 #define SEND_BIT(x) { if(w & (1<<x) ) HIGH(GPIO_FPGA_DIN); else LOW(GPIO_FPGA_DIN); HIGH(GPIO_FPGA_CCLK); LOW(GPIO_FPGA_CCLK); }
166 // Download the fpga image starting at FpgaImage and with length FpgaImageLen bytes
167 // If bytereversal is set: reverse the byte order in each 4-byte word
168 static void DownloadFPGA(const char *FpgaImage
, int FpgaImageLen
, int bytereversal
)
172 AT91C_BASE_PIOA
->PIO_OER
= GPIO_FPGA_ON
;
173 AT91C_BASE_PIOA
->PIO_PER
= GPIO_FPGA_ON
;
174 HIGH(GPIO_FPGA_ON
); // ensure everything is powered on
180 // These pins are inputs
181 AT91C_BASE_PIOA
->PIO_ODR
=
184 // PIO controls the following pins
185 AT91C_BASE_PIOA
->PIO_PER
=
189 AT91C_BASE_PIOA
->PIO_PPUER
=
193 // setup initial logic state
194 HIGH(GPIO_FPGA_NPROGRAM
);
197 // These pins are outputs
198 AT91C_BASE_PIOA
->PIO_OER
=
203 // enter FPGA configuration mode
204 LOW(GPIO_FPGA_NPROGRAM
);
206 HIGH(GPIO_FPGA_NPROGRAM
);
209 // wait for FPGA ready to accept data signal
210 while ((i
) && ( !(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_FPGA_NINIT
) ) ) {
214 // crude error indicator, leave both red LEDs on and return
222 /* This is only supported for uint32_t aligned images */
223 if( ((int)FpgaImage
% sizeof(uint32_t)) == 0 ) {
225 while(FpgaImageLen
-->0)
226 DownloadFPGA_byte(FpgaImage
[(i
++)^0x3]);
227 /* Explanation of the magic in the above line:
228 * i^0x3 inverts the lower two bits of the integer i, counting backwards
229 * for each 4 byte increment. The generated sequence of (i++)^3 is
230 * 3 2 1 0 7 6 5 4 11 10 9 8 15 14 13 12 etc. pp.
234 while(FpgaImageLen
-->0)
235 DownloadFPGA_byte(*FpgaImage
++);
238 // continue to clock FPGA until ready signal goes high
240 while ( (i
--) && ( !(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_FPGA_DONE
) ) ) {
241 HIGH(GPIO_FPGA_CCLK
);
244 // crude error indicator, leave both red LEDs on and return
253 static char *bitparse_headers_start
;
254 static char *bitparse_bitstream_end
;
255 static int bitparse_initialized
= 0;
256 /* Simple Xilinx .bit parser. The file starts with the fixed opaque byte sequence
257 * 00 09 0f f0 0f f0 0f f0 0f f0 00 00 01
258 * After that the format is 1 byte section type (ASCII character), 2 byte length
259 * (big endian), <length> bytes content. Except for section 'e' which has 4 bytes
262 static const char _bitparse_fixed_header
[] = {0x00, 0x09, 0x0f, 0xf0, 0x0f, 0xf0, 0x0f, 0xf0, 0x0f, 0xf0, 0x00, 0x00, 0x01};
263 static int bitparse_init(void * start_address
, void *end_address
)
265 bitparse_initialized
= 0;
267 if(memcmp(_bitparse_fixed_header
, start_address
, sizeof(_bitparse_fixed_header
)) != 0) {
268 return 0; /* Not matched */
270 bitparse_headers_start
= ((char*)start_address
) + sizeof(_bitparse_fixed_header
);
271 bitparse_bitstream_end
= (char*)end_address
;
272 bitparse_initialized
= 1;
277 int bitparse_find_section(char section_name
, char **section_start
, unsigned int *section_length
)
279 char *pos
= bitparse_headers_start
;
282 if(!bitparse_initialized
) return 0;
284 while(pos
< bitparse_bitstream_end
) {
285 char current_name
= *pos
++;
286 unsigned int current_length
= 0;
287 if(current_name
< 'a' || current_name
> 'e') {
288 /* Strange section name, abort */
292 switch(current_name
) {
294 /* Four byte length field */
295 current_length
+= (*pos
++) << 24;
296 current_length
+= (*pos
++) << 16;
297 default: /* Fall through, two byte length field */
298 current_length
+= (*pos
++) << 8;
299 current_length
+= (*pos
++) << 0;
302 if(current_name
!= 'e' && current_length
> 255) {
303 /* Maybe a parse error */
307 if(current_name
== section_name
) {
309 *section_start
= pos
;
310 *section_length
= current_length
;
315 pos
+= current_length
; /* Skip section */
321 //-----------------------------------------------------------------------------
322 // Find out which FPGA image format is stored in flash, then call DownloadFPGA
323 // with the right parameters to download the image
324 //-----------------------------------------------------------------------------
325 extern char _binary_fpga_lf_bit_start
, _binary_fpga_lf_bit_end
;
326 extern char _binary_fpga_hf_bit_start
, _binary_fpga_hf_bit_end
;
327 void FpgaDownloadAndGo(int bitstream_version
)
332 // check whether or not the bitstream is already loaded
333 if (FpgaGatherBitstreamVersion() == bitstream_version
)
336 if (bitstream_version
== FPGA_BITSTREAM_LF
) {
337 bit_start
= &_binary_fpga_lf_bit_start
;
338 bit_end
= &_binary_fpga_lf_bit_end
;
339 } else if (bitstream_version
== FPGA_BITSTREAM_HF
) {
340 bit_start
= &_binary_fpga_hf_bit_start
;
341 bit_end
= &_binary_fpga_hf_bit_end
;
344 /* Check for the new flash image format: Should have the .bit file at &_binary_fpga_bit_start
346 if(bitparse_init(bit_start
, bit_end
)) {
347 /* Successfully initialized the .bit parser. Find the 'e' section and
348 * send its contents to the FPGA.
350 char *bitstream_start
;
351 unsigned int bitstream_length
;
352 if(bitparse_find_section('e', &bitstream_start
, &bitstream_length
)) {
353 DownloadFPGA(bitstream_start
, bitstream_length
, 0);
355 return; /* All done */
359 /* Fallback for the old flash image format: Check for the magic marker 0xFFFFFFFF
360 * 0xAA995566 at address 0x102000. This is raw bitstream with a size of 336,768 bits
361 * = 10,524 uint32_t, stored as uint32_t e.g. little-endian in memory, but each DWORD
362 * is still to be transmitted in MSBit first order. Set the invert flag to indicate
363 * that the DownloadFPGA function should invert every 4 byte sequence when doing
364 * the bytewise download.
366 if( *(uint32_t*)0x102000 == 0xFFFFFFFF && *(uint32_t*)0x102004 == 0xAA995566 )
367 DownloadFPGA((char*)0x102000, 10524*4, 1);
370 int FpgaGatherBitstreamVersion()
373 FpgaGatherVersion(temp
, sizeof (temp
));
374 if (!memcmp("LF", temp
, 2))
375 return FPGA_BITSTREAM_LF
;
376 else if (!memcmp("HF", temp
, 2))
377 return FPGA_BITSTREAM_HF
;
378 return FPGA_BITSTREAM_ERR
;
381 void FpgaGatherVersion(char *dst
, int len
)
384 unsigned int fpga_info_len
;
386 if(!bitparse_find_section('e', &fpga_info
, &fpga_info_len
)) {
387 strncat(dst
, "FPGA image: legacy image without version information", len
-1);
389 /* USB packets only have 48 bytes data payload, so be terse */
390 if(bitparse_find_section('a', &fpga_info
, &fpga_info_len
) && fpga_info
[fpga_info_len
-1] == 0 ) {
391 if (!memcmp("fpga_lf", fpga_info
, 7))
392 strncat(dst
, "LF ", len
-1);
393 else if (!memcmp("fpga_hf", fpga_info
, 7))
394 strncat(dst
, "HF ", len
-1);
396 strncat(dst
, "FPGA image built", len
-1);
398 if(bitparse_find_section('b', &fpga_info
, &fpga_info_len
) && fpga_info
[fpga_info_len
-1] == 0 ) {
399 strncat(dst
, " for ", len
-1);
400 strncat(dst
, fpga_info
, len
-1);
403 if(bitparse_find_section('c', &fpga_info
, &fpga_info_len
) && fpga_info
[fpga_info_len
-1] == 0 ) {
404 strncat(dst
, " on ", len
-1);
405 strncat(dst
, fpga_info
, len
-1);
407 if(bitparse_find_section('d', &fpga_info
, &fpga_info_len
) && fpga_info
[fpga_info_len
-1] == 0 ) {
408 strncat(dst
, " at ", len
-1);
409 strncat(dst
, fpga_info
, len
-1);
414 //-----------------------------------------------------------------------------
415 // Send a 16 bit command/data pair to the FPGA.
416 // The bit format is: C3 C2 C1 C0 D11 D10 D9 D8 D7 D6 D5 D4 D3 D2 D1 D0
417 // where C is the 4 bit command and D is the 12 bit data
418 //-----------------------------------------------------------------------------
419 void FpgaSendCommand(uint16_t cmd
, uint16_t v
)
421 SetupSpi(SPI_FPGA_MODE
);
422 while ((AT91C_BASE_SPI
->SPI_SR
& AT91C_SPI_TXEMPTY
) == 0); // wait for the transfer to complete
423 AT91C_BASE_SPI
->SPI_TDR
= AT91C_SPI_LASTXFER
| cmd
| v
; // send the data
425 //-----------------------------------------------------------------------------
426 // Write the FPGA setup word (that determines what mode the logic is in, read
427 // vs. clone vs. etc.). This is now a special case of FpgaSendCommand() to
428 // avoid changing this function's occurence everywhere in the source code.
429 //-----------------------------------------------------------------------------
430 void FpgaWriteConfWord(uint8_t v
)
432 FpgaSendCommand(FPGA_CMD_SET_CONFREG
, v
);
435 //-----------------------------------------------------------------------------
436 // Set up the CMOS switches that mux the ADC: four switches, independently
437 // closable, but should only close one at a time. Not an FPGA thing, but
438 // the samples from the ADC always flow through the FPGA.
439 //-----------------------------------------------------------------------------
440 void SetAdcMuxFor(uint32_t whichGpio
)
442 AT91C_BASE_PIOA
->PIO_OER
=
448 AT91C_BASE_PIOA
->PIO_PER
=
454 LOW(GPIO_MUXSEL_HIPKD
);
455 LOW(GPIO_MUXSEL_HIRAW
);
456 LOW(GPIO_MUXSEL_LORAW
);
457 LOW(GPIO_MUXSEL_LOPKD
);