1 //-----------------------------------------------------------------------------
2 // Jonathan Westhues, April 2006
3 // iZsh <izsh at fail0verflow.com>, 2014
5 // This code is licensed to you under the terms of the GNU GPL, version 2 or,
6 // at your option, any later version. See the LICENSE.txt file for the text of
8 //-----------------------------------------------------------------------------
9 // Routines to load the FPGA image, and then to configure the FPGA's major
10 // mode once it is configured.
11 //-----------------------------------------------------------------------------
16 #include "fpgaloader.h"
17 #include "proxmark3.h"
23 extern void Dbprintf(const char *fmt
, ...);
25 // remember which version of the bitstream we have already downloaded to the FPGA
26 static int downloaded_bitstream
= FPGA_BITSTREAM_ERR
;
28 // this is where the bitstreams are located in memory:
29 extern uint8_t _binary_fpga_lf_bit_start
, _binary_fpga_lf_bit_end
;
30 extern uint8_t _binary_fpga_hf_bit_start
, _binary_fpga_hf_bit_end
;
31 static uint8_t *fpga_image_ptr
= NULL
;
33 static const uint8_t _bitparse_fixed_header
[] = {0x00, 0x09, 0x0f, 0xf0, 0x0f, 0xf0, 0x0f, 0xf0, 0x0f, 0xf0, 0x00, 0x00, 0x01};
34 #define FPGA_BITSTREAM_FIXED_HEADER_SIZE sizeof(_bitparse_fixed_header)
35 #define OUTPUT_BUFFER_LEN 80
37 //-----------------------------------------------------------------------------
38 // Set up the Serial Peripheral Interface as master
39 // Used to write the FPGA config word
40 // May also be used to write to other SPI attached devices like an LCD
41 //-----------------------------------------------------------------------------
42 void SetupSpi(int mode
)
44 // PA10 -> SPI_NCS2 chip select (LCD)
45 // PA11 -> SPI_NCS0 chip select (FPGA)
46 // PA12 -> SPI_MISO Master-In Slave-Out
47 // PA13 -> SPI_MOSI Master-Out Slave-In
48 // PA14 -> SPI_SPCK Serial Clock
50 // Disable PIO control of the following pins, allows use by the SPI peripheral
51 AT91C_BASE_PIOA
->PIO_PDR
=
58 AT91C_BASE_PIOA
->PIO_ASR
=
64 AT91C_BASE_PIOA
->PIO_BSR
= GPIO_NCS2
;
66 //enable the SPI Peripheral clock
67 AT91C_BASE_PMC
->PMC_PCER
= (1<<AT91C_ID_SPI
);
69 AT91C_BASE_SPI
->SPI_CR
= AT91C_SPI_SPIEN
;
73 AT91C_BASE_SPI
->SPI_MR
=
74 ( 0 << 24) | // Delay between chip selects (take default: 6 MCK periods)
75 (14 << 16) | // Peripheral Chip Select (selects FPGA SPI_NCS0 or PA11)
76 ( 0 << 7) | // Local Loopback Disabled
77 ( 1 << 4) | // Mode Fault Detection disabled
78 ( 0 << 2) | // Chip selects connected directly to peripheral
79 ( 0 << 1) | // Fixed Peripheral Select
80 ( 1 << 0); // Master Mode
81 AT91C_BASE_SPI
->SPI_CSR
[0] =
82 ( 1 << 24) | // Delay between Consecutive Transfers (32 MCK periods)
83 ( 1 << 16) | // Delay Before SPCK (1 MCK period)
84 ( 6 << 8) | // Serial Clock Baud Rate (baudrate = MCK/6 = 24Mhz/6 = 4M baud
85 ( 8 << 4) | // Bits per Transfer (16 bits)
86 ( 0 << 3) | // Chip Select inactive after transfer
87 ( 1 << 1) | // Clock Phase data captured on leading edge, changes on following edge
88 ( 0 << 0); // Clock Polarity inactive state is logic 0
91 AT91C_BASE_SPI
->SPI_MR
=
92 ( 0 << 24) | // Delay between chip selects (take default: 6 MCK periods)
93 (11 << 16) | // Peripheral Chip Select (selects LCD SPI_NCS2 or PA10)
94 ( 0 << 7) | // Local Loopback Disabled
95 ( 1 << 4) | // Mode Fault Detection disabled
96 ( 0 << 2) | // Chip selects connected directly to peripheral
97 ( 0 << 1) | // Fixed Peripheral Select
98 ( 1 << 0); // Master Mode
99 AT91C_BASE_SPI
->SPI_CSR
[2] =
100 ( 1 << 24) | // Delay between Consecutive Transfers (32 MCK periods)
101 ( 1 << 16) | // Delay Before SPCK (1 MCK period)
102 ( 6 << 8) | // Serial Clock Baud Rate (baudrate = MCK/6 = 24Mhz/6 = 4M baud
103 ( 1 << 4) | // Bits per Transfer (9 bits)
104 ( 0 << 3) | // Chip Select inactive after transfer
105 ( 1 << 1) | // Clock Phase data captured on leading edge, changes on following edge
106 ( 0 << 0); // Clock Polarity inactive state is logic 0
108 default: // Disable SPI
109 AT91C_BASE_SPI
->SPI_CR
= AT91C_SPI_SPIDIS
;
114 //-----------------------------------------------------------------------------
115 // Set up the synchronous serial port, with the one set of options that we
116 // always use when we are talking to the FPGA. Both RX and TX are enabled.
117 //-----------------------------------------------------------------------------
118 void FpgaSetupSsc(void)
120 // First configure the GPIOs, and get ourselves a clock.
121 AT91C_BASE_PIOA
->PIO_ASR
=
126 AT91C_BASE_PIOA
->PIO_PDR
= GPIO_SSC_DOUT
;
128 AT91C_BASE_PMC
->PMC_PCER
= (1 << AT91C_ID_SSC
);
130 // Now set up the SSC proper, starting from a known state.
131 AT91C_BASE_SSC
->SSC_CR
= AT91C_SSC_SWRST
;
133 // RX clock comes from TX clock, RX starts when TX starts, data changes
134 // on RX clock rising edge, sampled on falling edge
135 AT91C_BASE_SSC
->SSC_RCMR
= SSC_CLOCK_MODE_SELECT(1) | SSC_CLOCK_MODE_START(1);
137 // 8 bits per transfer, no loopback, MSB first, 1 transfer per sync
138 // pulse, no output sync
139 AT91C_BASE_SSC
->SSC_RFMR
= SSC_FRAME_MODE_BITS_IN_WORD(8) | AT91C_SSC_MSBF
| SSC_FRAME_MODE_WORDS_PER_TRANSFER(0);
141 // clock comes from TK pin, no clock output, outputs change on falling
142 // edge of TK, sample on rising edge of TK, start on positive-going edge of sync
143 AT91C_BASE_SSC
->SSC_TCMR
= SSC_CLOCK_MODE_SELECT(2) | SSC_CLOCK_MODE_START(5);
145 // tx framing is the same as the rx framing
146 AT91C_BASE_SSC
->SSC_TFMR
= AT91C_BASE_SSC
->SSC_RFMR
;
148 AT91C_BASE_SSC
->SSC_CR
= AT91C_SSC_RXEN
| AT91C_SSC_TXEN
;
151 //-----------------------------------------------------------------------------
152 // Set up DMA to receive samples from the FPGA. We will use the PDC, with
153 // a single buffer as a circular buffer (so that we just chain back to
154 // ourselves, not to another buffer). The stuff to manipulate those buffers
155 // is in apps.h, because it should be inlined, for speed.
156 //-----------------------------------------------------------------------------
157 bool FpgaSetupSscDma(uint8_t *buf
, int len
)
163 AT91C_BASE_PDC_SSC
->PDC_PTCR
= AT91C_PDC_RXTDIS
; // Disable DMA Transfer
164 AT91C_BASE_PDC_SSC
->PDC_RPR
= (uint32_t) buf
; // transfer to this memory address
165 AT91C_BASE_PDC_SSC
->PDC_RCR
= len
; // transfer this many bytes
166 AT91C_BASE_PDC_SSC
->PDC_RNPR
= (uint32_t) buf
; // next transfer to same memory address
167 AT91C_BASE_PDC_SSC
->PDC_RNCR
= len
; // ... with same number of bytes
168 AT91C_BASE_PDC_SSC
->PDC_PTCR
= AT91C_PDC_RXTEN
; // go!
174 uint8_t get_from_fpga_stream(z_streamp compressed_fpga_stream
, uint8_t *output_buffer
)
176 if (fpga_image_ptr
== compressed_fpga_stream
->next_out
) { // need more data
177 compressed_fpga_stream
->next_out
= output_buffer
;
178 compressed_fpga_stream
->avail_out
= OUTPUT_BUFFER_LEN
;
179 fpga_image_ptr
= output_buffer
;
180 int res
= inflate(compressed_fpga_stream
, Z_SYNC_FLUSH
);
181 // if (res != Z_OK && res != Z_STREAM_END) {
182 Dbprintf("inflate returned: %d, %s", res
, compressed_fpga_stream
->msg
);
186 Dbprintf("get_from_fpga_stream() returns %02x", *fpga_image_ptr
);
187 return *fpga_image_ptr
++;
191 static voidpf
fpga_inflate_malloc(voidpf opaque
, uInt items
, uInt size
)
193 Dbprintf("zlib requested %d bytes", items
*size
);
194 return BigBuf_malloc(items
*size
);
198 static void fpga_inflate_free(voidpf opaque
, voidpf address
)
200 Dbprintf("zlib wants to free memory");
201 BigBuf_free_keep_EM();
205 void init_fpga_inflate(z_streamp compressed_fpga_stream
, uint8_t *fpga_image_start
, uint32_t fpga_image_size
, uint8_t *output_buffer
)
207 // initialize z_stream structure for inflate:
208 compressed_fpga_stream
->next_in
= fpga_image_start
;
209 compressed_fpga_stream
->avail_in
= fpga_image_size
;
210 compressed_fpga_stream
->next_out
= output_buffer
;
211 compressed_fpga_stream
->avail_out
= OUTPUT_BUFFER_LEN
;
212 compressed_fpga_stream
->zalloc
= &fpga_inflate_malloc
;
213 compressed_fpga_stream
->zfree
= &fpga_inflate_free
;
215 // initialize inflate to automatically detect header:
216 int res
= inflateInit2(compressed_fpga_stream
, 15+32);
218 fpga_image_ptr
= output_buffer
;
220 Dbprintf("InflateInit returned %d", res
);
221 Dbprintf("fpga_image_ptr pointing at %02x %02x %02x %02x", fpga_image_ptr
[0], fpga_image_ptr
[1], fpga_image_ptr
[2], fpga_image_ptr
[3]);
222 Dbprintf("zstream->next_in pointing at %02x %02x %02x %02x", compressed_fpga_stream
->next_in
[0], compressed_fpga_stream
->next_in
[1], compressed_fpga_stream
->next_in
[2], compressed_fpga_stream
->next_in
[3]);
226 bool reset_fpga_stream(int bitstream_version
, z_streamp compressed_fpga_stream
, uint8_t *output_buffer
)
228 uint8_t header
[FPGA_BITSTREAM_FIXED_HEADER_SIZE
];
229 uint8_t *fpga_image_start
;
230 uint32_t fpga_image_size
;
232 if (bitstream_version
== FPGA_BITSTREAM_LF
) {
233 fpga_image_start
= &_binary_fpga_lf_bit_start
;
234 fpga_image_size
= (uint32_t)&_binary_fpga_lf_bit_end
- (uint32_t)&_binary_fpga_lf_bit_start
;
235 } else if (bitstream_version
== FPGA_BITSTREAM_HF
) {
236 fpga_image_start
= &_binary_fpga_hf_bit_start
;
237 fpga_image_size
= (uint32_t)&_binary_fpga_hf_bit_end
- (uint32_t)&_binary_fpga_hf_bit_start
;
242 init_fpga_inflate(compressed_fpga_stream
, fpga_image_start
, fpga_image_size
, output_buffer
);
244 for (uint16_t i
= 0; i
< FPGA_BITSTREAM_FIXED_HEADER_SIZE
; i
++) {
245 header
[i
] = get_from_fpga_stream(compressed_fpga_stream
, output_buffer
);
248 // Check for a valid .bit file (starts with _bitparse_fixed_header)
249 if(memcmp(_bitparse_fixed_header
, header
, FPGA_BITSTREAM_FIXED_HEADER_SIZE
) == 0) {
257 static void DownloadFPGA_byte(unsigned char w
)
259 #define SEND_BIT(x) { if(w & (1<<x) ) HIGH(GPIO_FPGA_DIN); else LOW(GPIO_FPGA_DIN); HIGH(GPIO_FPGA_CCLK); LOW(GPIO_FPGA_CCLK); }
270 // Download the fpga image starting at current stream position with length FpgaImageLen bytes
271 static void DownloadFPGA(int FpgaImageLen
, z_streamp compressed_fpga_stream
, uint8_t *output_buffer
)
273 Dbprintf("Would have loaded FPGA");
278 AT91C_BASE_PIOA
->PIO_OER
= GPIO_FPGA_ON
;
279 AT91C_BASE_PIOA
->PIO_PER
= GPIO_FPGA_ON
;
280 HIGH(GPIO_FPGA_ON
); // ensure everything is powered on
286 // These pins are inputs
287 AT91C_BASE_PIOA
->PIO_ODR
=
290 // PIO controls the following pins
291 AT91C_BASE_PIOA
->PIO_PER
=
295 AT91C_BASE_PIOA
->PIO_PPUER
=
299 // setup initial logic state
300 HIGH(GPIO_FPGA_NPROGRAM
);
303 // These pins are outputs
304 AT91C_BASE_PIOA
->PIO_OER
=
309 // enter FPGA configuration mode
310 LOW(GPIO_FPGA_NPROGRAM
);
312 HIGH(GPIO_FPGA_NPROGRAM
);
315 // wait for FPGA ready to accept data signal
316 while ((i
) && ( !(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_FPGA_NINIT
) ) ) {
320 // crude error indicator, leave both red LEDs on and return
327 while(FpgaImageLen
-->0) {
328 DownloadFPGA_byte(get_from_fpga_stream(compressed_fpga_stream
, output_buffer
));
331 // continue to clock FPGA until ready signal goes high
333 while ( (i
--) && ( !(AT91C_BASE_PIOA
->PIO_PDSR
& GPIO_FPGA_DONE
) ) ) {
334 HIGH(GPIO_FPGA_CCLK
);
337 // crude error indicator, leave both red LEDs on and return
347 /* Simple Xilinx .bit parser. The file starts with the fixed opaque byte sequence
348 * 00 09 0f f0 0f f0 0f f0 0f f0 00 00 01
349 * After that the format is 1 byte section type (ASCII character), 2 byte length
350 * (big endian), <length> bytes content. Except for section 'e' which has 4 bytes
353 int bitparse_find_section(char section_name
, unsigned int *section_length
, z_streamp compressed_fpga_stream
, uint8_t *output_buffer
)
356 #define MAX_FPGA_BIT_STREAM_HEADER_SEARCH 100 // maximum number of bytes to search for the requested section
357 uint16_t numbytes
= 0;
358 while(numbytes
< MAX_FPGA_BIT_STREAM_HEADER_SEARCH
) {
359 char current_name
= get_from_fpga_stream(compressed_fpga_stream
, output_buffer
);
361 unsigned int current_length
= 0;
362 if(current_name
< 'a' || current_name
> 'e') {
363 /* Strange section name, abort */
367 switch(current_name
) {
369 /* Four byte length field */
370 current_length
+= get_from_fpga_stream(compressed_fpga_stream
, output_buffer
) << 24;
371 current_length
+= get_from_fpga_stream(compressed_fpga_stream
, output_buffer
) << 16;
373 default: /* Fall through, two byte length field */
374 current_length
+= get_from_fpga_stream(compressed_fpga_stream
, output_buffer
) << 8;
375 current_length
+= get_from_fpga_stream(compressed_fpga_stream
, output_buffer
) << 0;
379 if(current_name
!= 'e' && current_length
> 255) {
380 /* Maybe a parse error */
384 if(current_name
== section_name
) {
386 *section_length
= current_length
;
391 for (uint16_t i
= 0; i
< current_length
&& numbytes
< MAX_FPGA_BIT_STREAM_HEADER_SEARCH
; i
++) {
392 get_from_fpga_stream(compressed_fpga_stream
, output_buffer
);
401 //-----------------------------------------------------------------------------
402 // Find out which FPGA image format is stored in flash, then call DownloadFPGA
403 // with the right parameters to download the image
404 //-----------------------------------------------------------------------------
405 void FpgaDownloadAndGo(int bitstream_version
)
407 z_stream compressed_fpga_stream
;
408 uint8_t output_buffer
[OUTPUT_BUFFER_LEN
];
410 // check whether or not the bitstream is already loaded
411 if (downloaded_bitstream
== bitstream_version
)
414 if (!reset_fpga_stream(bitstream_version
, &compressed_fpga_stream
, output_buffer
)) {
418 unsigned int bitstream_length
;
419 if(bitparse_find_section('e', &bitstream_length
, &compressed_fpga_stream
, output_buffer
)) {
420 DownloadFPGA(bitstream_length
, &compressed_fpga_stream
, output_buffer
);
421 downloaded_bitstream
= bitstream_version
;
422 return; /* All done */
427 void FpgaGatherVersion(int bitstream_version
, char *dst
, int len
)
429 unsigned int fpga_info_len
;
431 z_stream compressed_fpga_stream
;
432 uint8_t output_buffer
[OUTPUT_BUFFER_LEN
];
436 if (!reset_fpga_stream(bitstream_version
, &compressed_fpga_stream
, output_buffer
)) {
440 if(bitparse_find_section('a', &fpga_info_len
, &compressed_fpga_stream
, output_buffer
)) {
441 for (uint16_t i
= 0; i
< fpga_info_len
; i
++) {
442 char c
= (char)get_from_fpga_stream(&compressed_fpga_stream
, output_buffer
);
443 if (i
< sizeof(tempstr
)) {
447 if (!memcmp("fpga_lf", tempstr
, 7))
448 strncat(dst
, "LF ", len
-1);
449 else if (!memcmp("fpga_hf", tempstr
, 7))
450 strncat(dst
, "HF ", len
-1);
452 strncat(dst
, "FPGA image built", len
-1);
453 if(bitparse_find_section('b', &fpga_info_len
, &compressed_fpga_stream
, output_buffer
)) {
454 strncat(dst
, " for ", len
-1);
455 for (uint16_t i
= 0; i
< fpga_info_len
; i
++) {
456 char c
= (char)get_from_fpga_stream(&compressed_fpga_stream
, output_buffer
);
457 if (i
< sizeof(tempstr
)) {
461 strncat(dst
, tempstr
, len
-1);
463 if(bitparse_find_section('c', &fpga_info_len
, &compressed_fpga_stream
, output_buffer
)) {
464 strncat(dst
, " on ", len
-1);
465 for (uint16_t i
= 0; i
< fpga_info_len
; i
++) {
466 char c
= (char)get_from_fpga_stream(&compressed_fpga_stream
, output_buffer
);
467 if (i
< sizeof(tempstr
)) {
471 strncat(dst
, tempstr
, len
-1);
473 if(bitparse_find_section('d', &fpga_info_len
, &compressed_fpga_stream
, output_buffer
)) {
474 strncat(dst
, " at ", len
-1);
475 for (uint16_t i
= 0; i
< fpga_info_len
; i
++) {
476 char c
= (char)get_from_fpga_stream(&compressed_fpga_stream
, output_buffer
);
477 if (i
< sizeof(tempstr
)) {
481 strncat(dst
, tempstr
, len
-1);
486 //-----------------------------------------------------------------------------
487 // Send a 16 bit command/data pair to the FPGA.
488 // The bit format is: C3 C2 C1 C0 D11 D10 D9 D8 D7 D6 D5 D4 D3 D2 D1 D0
489 // where C is the 4 bit command and D is the 12 bit data
490 //-----------------------------------------------------------------------------
491 void FpgaSendCommand(uint16_t cmd
, uint16_t v
)
493 SetupSpi(SPI_FPGA_MODE
);
494 while ((AT91C_BASE_SPI
->SPI_SR
& AT91C_SPI_TXEMPTY
) == 0); // wait for the transfer to complete
495 AT91C_BASE_SPI
->SPI_TDR
= AT91C_SPI_LASTXFER
| cmd
| v
; // send the data
497 //-----------------------------------------------------------------------------
498 // Write the FPGA setup word (that determines what mode the logic is in, read
499 // vs. clone vs. etc.). This is now a special case of FpgaSendCommand() to
500 // avoid changing this function's occurence everywhere in the source code.
501 //-----------------------------------------------------------------------------
502 void FpgaWriteConfWord(uint8_t v
)
504 FpgaSendCommand(FPGA_CMD_SET_CONFREG
, v
);
507 //-----------------------------------------------------------------------------
508 // Set up the CMOS switches that mux the ADC: four switches, independently
509 // closable, but should only close one at a time. Not an FPGA thing, but
510 // the samples from the ADC always flow through the FPGA.
511 //-----------------------------------------------------------------------------
512 void SetAdcMuxFor(uint32_t whichGpio
)
514 AT91C_BASE_PIOA
->PIO_OER
=
520 AT91C_BASE_PIOA
->PIO_PER
=
526 LOW(GPIO_MUXSEL_HIPKD
);
527 LOW(GPIO_MUXSEL_HIRAW
);
528 LOW(GPIO_MUXSEL_LORAW
);
529 LOW(GPIO_MUXSEL_LOPKD
);