From: henryk@ploetzli.ch Date: Tue, 1 Sep 2009 14:44:38 +0000 (+0000) Subject: New bootrom X-Git-Tag: v1.0.0~493 X-Git-Url: http://cvs.zerfleddert.de/cgi-bin/gitweb.cgi/proxmark3-svn/commitdiff_plain/8fcbf652dab8846dd8a2dcb17812af6528539950 New bootrom + Add common area at end of RAM to communicate between main os and bootrom + Lower stack end to make room for common area + Implement CMD_DEVICE_INFO in both OS and bootrom to give information about the current state and supported features + Allow hands-free firmware update: When CMD_START_FLASH is received over USB in OS mode, the device will reset and enter the bootrom Pressing the button in hands-free update mode takes precedence: releasing the button will immediately abort firmware update and perform a reset. Do not press the button. + Require each flash sequence to be preceded by a CMD_START_FLASH to set up the boundaries for the following flash sequence Not compatible with linux flasher before SVN revision 200 Currently no compatible flasher for Windows. WINDOWS USERS: DO NOT UPDATE YOUR BOOTROM YET + Protect bootrom flash area unless magic unlock sequence is given in CMD_START_FLASH --- diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 72d8789e..78ab8691 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -13,7 +13,6 @@ #include "LCD.h" #endif - //============================================================================= // A buffer where we can queue things up to be sent through the FPGA, for // any purpose (fake tag, as reader, whatever). We go MSB first, since that @@ -23,6 +22,7 @@ BYTE ToSend[256]; int ToSendMax; static int ToSendBit; +struct common_area common_area __attribute__((section(".commonarea"))); void BufferClear(void) { @@ -669,7 +669,23 @@ void UsbPacketReceived(BYTE *packet, int len) // We're going to reset, and the bootrom will take control. } break; - + case CMD_START_FLASH: + if(common_area.flags.bootrom_present) { + common_area.command = COMMON_AREA_COMMAND_ENTER_FLASH_MODE; + } + USB_D_PLUS_PULLUP_OFF(); + RSTC_CONTROL = RST_CONTROL_KEY | RST_CONTROL_PROCESSOR_RESET; + for(;;); + break; + + case CMD_DEVICE_INFO: { + UsbCommand c; + c.cmd = CMD_DEVICE_INFO; + c.ext1 = DEVICE_INFO_FLAG_OSIMAGE_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_OS; + if(common_area.flags.bootrom_present) c.ext1 |= DEVICE_INFO_FLAG_BOOTROM_PRESENT; + UsbSendPacket((BYTE*)&c, sizeof(c)); + } + break; default: DbpString("unknown command"); break; @@ -680,6 +696,14 @@ void AppMain(void) { memset(BigBuf,0,sizeof(BigBuf)); SpinDelay(100); + + if(common_area.magic != COMMON_AREA_MAGIC || common_area.version != 1) { + /* Initialize common area */ + memset(&common_area, 0, sizeof(common_area)); + common_area.magic = COMMON_AREA_MAGIC; + common_area.version = 1; + } + common_area.flags.osimage_present = 1; LED_D_OFF(); LED_C_OFF(); diff --git a/armsrc/ldscript b/armsrc/ldscript index 3a01a68f..a3aedef1 100644 --- a/armsrc/ldscript +++ b/armsrc/ldscript @@ -22,4 +22,8 @@ SECTIONS __bss_start__ = .; .bss : { *(.bss) } >ram __bss_end__ = .; + + .commonarea (NOLOAD) : { + *(.commonarea) + } >commonarea } diff --git a/bootrom/Makefile b/bootrom/Makefile index c80b650c..f88b3cdd 100644 --- a/bootrom/Makefile +++ b/bootrom/Makefile @@ -5,6 +5,13 @@ ARMSRC = fromflash.c THUMBSRC = usb.c bootrom.c ASMSRC = ram-reset.s flash-reset.s +## There is a strange bug with the linker: Sometimes it will not emit the glue to call +## BootROM from ARM mode. The symbol is emitted, but the section will be filled with +## zeroes. As a temporary workaround, do not use thumb for the phase 2 bootloader +## -- Henryk Plötz 2009-09-01 +ARMSRC := $(ARMSRC) $(THUMBSRC) +THUMBSRC := + # Do not move this inclusion before the definition of {THUMB,ASM,ARM}SRC include ../common/Makefile.common diff --git a/bootrom/bootrom.c b/bootrom/bootrom.c index 2d94f01a..c8c695cc 100644 --- a/bootrom/bootrom.c +++ b/bootrom/bootrom.c @@ -1,5 +1,9 @@ #include +struct common_area common_area __attribute__((section(".commonarea"))); +unsigned int start_addr, end_addr, bootrom_unlocked; +extern char _bootrom_start, _bootrom_end, _flash_start, _flash_end; + static void ConfigClocks(void) { // we are using a 16 MHz crystal as the basis for everything @@ -63,7 +67,7 @@ static void Fatal(void) void UsbPacketReceived(BYTE *packet, int len) { - int i; + int i, dont_ack=0; UsbCommand *c = (UsbCommand *)packet; volatile DWORD *p; @@ -73,38 +77,113 @@ void UsbPacketReceived(BYTE *packet, int len) switch(c->cmd) { case CMD_DEVICE_INFO: + dont_ack = 1; + c->cmd = CMD_DEVICE_INFO; + c->ext1 = DEVICE_INFO_FLAG_BOOTROM_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM | + DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH; + if(common_area.flags.osimage_present) c->ext1 |= DEVICE_INFO_FLAG_OSIMAGE_PRESENT; + UsbSendPacket(packet, len); break; case CMD_SETUP_WRITE: - p = (volatile DWORD *)0; + /* The temporary write buffer of the embedded flash controller is mapped to the + * whole memory region, only the last 8 bits are decoded. + */ + p = (volatile DWORD *)&_flash_start; for(i = 0; i < 12; i++) { p[i+c->ext1] = c->d.asDwords[i]; } break; case CMD_FINISH_WRITE: - p = (volatile DWORD *)0; + p = (volatile DWORD *)&_flash_start; for(i = 0; i < 4; i++) { p[i+60] = c->d.asDwords[i]; } - MC_FLASH_COMMAND = MC_FLASH_COMMAND_KEY | - MC_FLASH_COMMAND_PAGEN(c->ext1/FLASH_PAGE_SIZE_BYTES) | - FCMD_WRITE_PAGE; + /* Check that the address that we are supposed to write to is within our allowed region */ + if( ((c->ext1+FLASH_PAGE_SIZE_BYTES-1) >= end_addr) || (c->ext1 < start_addr) ) { + /* Disallow write */ + dont_ack = 1; + c->cmd = CMD_NACK; + UsbSendPacket(packet, len); + } else { + /* Translate address to flash page and do flash, update here for the 512k part */ + MC_FLASH_COMMAND = MC_FLASH_COMMAND_KEY | + MC_FLASH_COMMAND_PAGEN((c->ext1-(int)&_flash_start)/FLASH_PAGE_SIZE_BYTES) | + FCMD_WRITE_PAGE; + } while(!(MC_FLASH_STATUS & MC_FLASH_STATUS_READY)) ; break; case CMD_HARDWARE_RESET: + USB_D_PLUS_PULLUP_OFF(); + RSTC_CONTROL = RST_CONTROL_KEY | RST_CONTROL_PROCESSOR_RESET; break; - + + case CMD_START_FLASH: + if(c->ext3 == START_FLASH_MAGIC) bootrom_unlocked = 1; + else bootrom_unlocked = 0; + { + int prot_start = (int)&_bootrom_start; + int prot_end = (int)&_bootrom_end; + int allow_start = (int)&_flash_start; + int allow_end = (int)&_flash_end; + int cmd_start = c->ext1; + int cmd_end = c->ext2; + + /* Only allow command if the bootrom is unlocked, or the parameters are outside of the protected + * bootrom area. In any case they must be within the flash area. + */ + if( (bootrom_unlocked || ((cmd_start >= prot_end) || (cmd_end < prot_start))) + && (cmd_start >= allow_start) && (cmd_end <= allow_end) ) { + start_addr = cmd_start; + end_addr = cmd_end; + } else { + start_addr = end_addr = 0; + dont_ack = 1; + c->cmd = CMD_NACK; + UsbSendPacket(packet, len); + } + } + break; + default: Fatal(); break; } - c->cmd = CMD_ACK; - UsbSendPacket(packet, len); + if(!dont_ack) { + c->cmd = CMD_ACK; + UsbSendPacket(packet, len); + } +} + +static void flash_mode(int externally_entered) +{ + start_addr = 0; + end_addr = 0; + bootrom_unlocked = 0; + + UsbStart(); + for(;;) { + WDT_HIT(); + + UsbPoll(TRUE); + + if(!externally_entered && !BUTTON_PRESS()) { + /* Perform a reset to leave flash mode */ + USB_D_PLUS_PULLUP_OFF(); + LED_B_ON(); + RSTC_CONTROL = RST_CONTROL_KEY | RST_CONTROL_PROCESSOR_RESET; + for(;;); + } + if(externally_entered && BUTTON_PRESS()) { + /* Let the user's button press override the automatic leave */ + externally_entered = 0; + } + } } extern char _osimage_entry; @@ -153,38 +232,55 @@ void BootROM(void) LED_C_ON(); LED_B_OFF(); LED_A_OFF(); - - // if 512K FLASH part - TODO make some defines :) - if ((DBGU_CIDR | 0xf00) == 0xa00) { - MC_FLASH_MODE0 = MC_FLASH_MODE_FLASH_WAIT_STATES(1) | - MC_FLASH_MODE_MASTER_CLK_IN_MHZ(0x48); - MC_FLASH_MODE1 = MC_FLASH_MODE_FLASH_WAIT_STATES(1) | - MC_FLASH_MODE_MASTER_CLK_IN_MHZ(0x48); - } else { - MC_FLASH_MODE0 = MC_FLASH_MODE_FLASH_WAIT_STATES(0) | - MC_FLASH_MODE_MASTER_CLK_IN_MHZ(48); - } - - // Initialize all system clocks + + // if 512K FLASH part - TODO make some defines :) + if ((DBGU_CIDR | 0xf00) == 0xa00) { + MC_FLASH_MODE0 = MC_FLASH_MODE_FLASH_WAIT_STATES(1) | + MC_FLASH_MODE_MASTER_CLK_IN_MHZ(0x48); + MC_FLASH_MODE1 = MC_FLASH_MODE_FLASH_WAIT_STATES(1) | + MC_FLASH_MODE_MASTER_CLK_IN_MHZ(0x48); + } else { + MC_FLASH_MODE0 = MC_FLASH_MODE_FLASH_WAIT_STATES(0) | + MC_FLASH_MODE_MASTER_CLK_IN_MHZ(48); + } + + // Initialize all system clocks ConfigClocks(); - + LED_A_ON(); - - if(BUTTON_PRESS()) { - UsbStart(); - } - - for(;;) { - WDT_HIT(); - - UsbPoll(TRUE); - - if(!BUTTON_PRESS()) { - USB_D_PLUS_PULLUP_OFF(); - LED_B_ON(); - - // jump to Flash address of the osimage entry point (LSBit set for thumb mode) - asm("bx %0\n" : : "r" ( ((int)&_osimage_entry) | 0x1 ) ); - } + + int common_area_present = 0; + switch(RSTC_STATUS & RST_STATUS_TYPE_MASK) { + case RST_STATUS_TYPE_WATCHDOG: + case RST_STATUS_TYPE_SOFTWARE: + case RST_STATUS_TYPE_USER: + /* In these cases the common_area in RAM should be ok, retain it if it's there */ + if(common_area.magic == COMMON_AREA_MAGIC && common_area.version == 1) { + common_area_present = 1; + } + break; + default: /* Otherwise, initialize it from scratch */ + break; + } + + if(!common_area_present){ + /* Common area not ok, initialize it */ + int i; for(i=0; icommonarea } diff --git a/common/Makefile.common b/common/Makefile.common index bba99ecd..51d60cce 100644 --- a/common/Makefile.common +++ b/common/Makefile.common @@ -39,10 +39,11 @@ DETECTED_OS=Windows endif -CC = arm-elf-gcc -AS = arm-elf-as -LD = arm-elf-ld -OBJCOPY = arm-elf-objcopy +CROSS = arm-elf- +CC = $(CROSS)gcc +AS = $(CROSS)as +LD = $(CROSS)ld +OBJCOPY = $(CROSS)objcopy OBJDIR = obj @@ -78,8 +79,8 @@ $(VERSIONOBJ): $(OBJDIR)/%.o: %.c $(INCLUDES) $(OBJDIR)/%.s19: $(OBJDIR)/%.elf $(OBJCOPY) -Osrec --srec-forceS3 --strip-debug --no-change-warnings \ --change-addresses -0x100000 --change-start 0 \ - --change-section-address .bss+0 \ - --change-section-address .data+0 $^ $@ + --change-section-address .bss+0 --change-section-address .data+0 \ + --change-section-address .commonarea+0 $^ $@ # version.c should be remade on every compilation .PHONY: version.c diff --git a/common/ldscript.common b/common/ldscript.common index 98161d3a..ea6fe83b 100644 --- a/common/ldscript.common +++ b/common/ldscript.common @@ -11,12 +11,15 @@ MEMORY bootphase2 : ORIGIN = 0x00100200, LENGTH = 0x2000 - 0x200 /* Main bootloader code, stored in Flash, executed from RAM */ fpgaimage : ORIGIN = 0x00102000, LENGTH = 64k - 0x2000 /* Place where the FPGA image will end up */ osimage : ORIGIN = 0x00110000, LENGTH = 256K - 64k /* Place where the main OS will end up */ - ram : ORIGIN = 0x00200000, LENGTH = 64K + ram : ORIGIN = 0x00200000, LENGTH = 64K - 0x20 /* RAM, minus small common area */ + commonarea : ORIGIN = 0x00200000 + 64K - 0x20, LENGTH = 0x20 /* Communication between bootloader and main OS */ } /* Export some information that can be used from within the firmware */ _bootphase1_version_pointer = ORIGIN(bootphase1) + LENGTH(bootphase1) - 0x4; _osimage_entry = ORIGIN(osimage); +_bootrom_start = ORIGIN(bootphase1); +_bootrom_end = ORIGIN(bootphase2) + LENGTH(bootphase2); _flash_start = ORIGIN(bootphase1); _flash_end = ORIGIN(osimage) + LENGTH(osimage); _stack_end = ORIGIN(ram) + LENGTH(ram) - 8; diff --git a/include/proxmark3.h b/include/proxmark3.h index 7095fc85..31c71642 100644 --- a/include/proxmark3.h +++ b/include/proxmark3.h @@ -70,4 +70,18 @@ struct version_information { char buildtime[30]; /* string with the build time */ } __attribute__((packed)); +#define COMMON_AREA_MAGIC 0x43334d50 +#define COMMON_AREA_COMMAND_NONE 0 +#define COMMON_AREA_COMMAND_ENTER_FLASH_MODE 1 +struct common_area { + int magic; /* Magic sequence, to distinguish against random uninitialized memory */ + char version; /* Must be 1 */ + char command; + struct { + unsigned int bootrom_present:1; /* Set when a bootrom that is capable of parsing the common area is present */ + unsigned int osimage_present:1; /* Set when a osimage that is capable of parsing the common area is present */ + } __attribute__((packed)) flags; + int arg1, arg2; +} __attribute__((packed)); + #endif