]> git.zerfleddert.de Git - proxmark3-svn/blob - bootrom/bootrom.c
da0de9c72190c28e3f70e866712a4bbde2caf493
[proxmark3-svn] / bootrom / bootrom.c
1 #include <proxmark3.h>
2
3 struct common_area common_area __attribute__((section(".commonarea")));
4 unsigned int start_addr, end_addr, bootrom_unlocked;
5 extern char _bootrom_start, _bootrom_end, _flash_start, _flash_end;
6
7 static void ConfigClocks(void)
8 {
9 // we are using a 16 MHz crystal as the basis for everything
10 // slow clock runs at 32Khz typical regardless of crystal
11
12 // enable system clock and USB clock
13 AT91C_BASE_PMC->PMC_SCER = AT91C_PMC_PCK | AT91C_PMC_UDP;
14
15 // enable the clock to the following peripherals
16 AT91C_BASE_PMC->PMC_PCER =
17 (1<<AT91C_ID_PIOA) |
18 (1<<AT91C_ID_ADC) |
19 (1<<AT91C_ID_SPI) |
20 (1<<AT91C_ID_SSC) |
21 (1<<AT91C_ID_PWMC) |
22 (1<<AT91C_ID_UDP);
23
24 // worst case scenario, with 16Mhz xtal startup delay is 14.5ms
25 // with a slow clock running at it worst case (max) frequency of 42khz
26 // max startup delay = (14.5ms*42k)/8 = 76 = 0x4C round up to 0x50
27
28 // enable main oscillator and set startup delay
29 AT91C_BASE_PMC->PMC_MOR =
30 PMC_MAIN_OSC_ENABLE |
31 PMC_MAIN_OSC_STARTUP_DELAY(0x50);
32
33 // wait for main oscillator to stabilize
34 while ( !(AT91C_BASE_PMC->PMC_SR & PMC_MAIN_OSC_STABILIZED) )
35 ;
36
37 // minimum PLL clock frequency is 80 MHz in range 00 (96 here so okay)
38 // frequency is crystal * multiplier / divisor = 16Mhz * 12 / 2 = 96Mhz
39 AT91C_BASE_PMC->PMC_PLLR =
40 PMC_PLL_DIVISOR(2) |
41 PMC_PLL_COUNT_BEFORE_LOCK(0x50) |
42 PMC_PLL_FREQUENCY_RANGE(0) |
43 PMC_PLL_MULTIPLIER(12) |
44 PMC_PLL_USB_DIVISOR(1);
45
46 // wait for PLL to lock
47 while ( !(AT91C_BASE_PMC->PMC_SR & PMC_MAIN_OSC_PLL_LOCK) )
48 ;
49
50 // we want a master clock (MCK) to be PLL clock / 2 = 96Mhz / 2 = 48Mhz
51 // as per datasheet, this register must be programmed in two operations
52 // when changing to PLL, program the prescaler first then the source
53 AT91C_BASE_PMC->PMC_MCKR = PMC_CLK_PRESCALE_DIV_2;
54
55 // wait for main clock ready signal
56 while ( !(AT91C_BASE_PMC->PMC_SR & PMC_MAIN_OSC_MCK_READY) )
57 ;
58
59 // set the source to PLL
60 AT91C_BASE_PMC->PMC_MCKR = AT91C_PMC_CSS_PLL_CLK | PMC_CLK_PRESCALE_DIV_2;
61
62 // wait for main clock ready signal
63 while ( !(AT91C_BASE_PMC->PMC_SR & PMC_MAIN_OSC_MCK_READY) )
64 ;
65 }
66
67 static void Fatal(void)
68 {
69 for(;;);
70 }
71
72 void UsbPacketReceived(BYTE *packet, int len)
73 {
74 int i, dont_ack=0;
75 UsbCommand *c = (UsbCommand *)packet;
76 volatile DWORD *p;
77
78 if(len != sizeof(*c)) {
79 Fatal();
80 }
81
82 switch(c->cmd) {
83 case CMD_DEVICE_INFO:
84 dont_ack = 1;
85 c->cmd = CMD_DEVICE_INFO;
86 c->arg[0] = DEVICE_INFO_FLAG_BOOTROM_PRESENT | DEVICE_INFO_FLAG_CURRENT_MODE_BOOTROM |
87 DEVICE_INFO_FLAG_UNDERSTANDS_START_FLASH;
88 if(common_area.flags.osimage_present) c->arg[0] |= DEVICE_INFO_FLAG_OSIMAGE_PRESENT;
89 UsbSendPacket(packet, len);
90 break;
91
92 case CMD_SETUP_WRITE:
93 /* The temporary write buffer of the embedded flash controller is mapped to the
94 * whole memory region, only the last 8 bits are decoded.
95 */
96 p = (volatile DWORD *)&_flash_start;
97 for(i = 0; i < 12; i++) {
98 p[i+c->arg[0]] = c->d.asDwords[i];
99 }
100 break;
101
102 case CMD_FINISH_WRITE:
103 p = (volatile DWORD *)&_flash_start;
104 for(i = 0; i < 4; i++) {
105 p[i+60] = c->d.asDwords[i];
106 }
107
108 /* Check that the address that we are supposed to write to is within our allowed region */
109 if( ((c->arg[0]+AT91C_IFLASH_PAGE_SIZE-1) >= end_addr) || (c->arg[0] < start_addr) ) {
110 /* Disallow write */
111 dont_ack = 1;
112 c->cmd = CMD_NACK;
113 UsbSendPacket(packet, len);
114 } else {
115 /* Translate address to flash page and do flash, update here for the 512k part */
116 AT91C_BASE_EFC0->EFC_FCR = MC_FLASH_COMMAND_KEY |
117 MC_FLASH_COMMAND_PAGEN((c->arg[0]-(int)&_flash_start)/AT91C_IFLASH_PAGE_SIZE) |
118 AT91C_MC_FCMD_START_PROG;
119 }
120
121 uint32_t sr;
122
123 while(!((sr = AT91C_BASE_EFC0->EFC_FSR) & MC_FLASH_STATUS_READY))
124 ;
125 if(sr & (MC_FLASH_STATUS_LOCKE | MC_FLASH_STATUS_PROGE)) {
126 dont_ack = 1;
127 c->cmd = CMD_NACK;
128 UsbSendPacket(packet, len);
129 }
130 break;
131
132 case CMD_HARDWARE_RESET:
133 USB_D_PLUS_PULLUP_OFF();
134 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
135 break;
136
137 case CMD_START_FLASH:
138 if(c->arg[2] == START_FLASH_MAGIC) bootrom_unlocked = 1;
139 else bootrom_unlocked = 0;
140 {
141 int prot_start = (int)&_bootrom_start;
142 int prot_end = (int)&_bootrom_end;
143 int allow_start = (int)&_flash_start;
144 int allow_end = (int)&_flash_end;
145 int cmd_start = c->arg[0];
146 int cmd_end = c->arg[1];
147
148 /* Only allow command if the bootrom is unlocked, or the parameters are outside of the protected
149 * bootrom area. In any case they must be within the flash area.
150 */
151 if( (bootrom_unlocked || ((cmd_start >= prot_end) || (cmd_end < prot_start)))
152 && (cmd_start >= allow_start) && (cmd_end <= allow_end) ) {
153 start_addr = cmd_start;
154 end_addr = cmd_end;
155 } else {
156 start_addr = end_addr = 0;
157 dont_ack = 1;
158 c->cmd = CMD_NACK;
159 UsbSendPacket(packet, len);
160 }
161 }
162 break;
163
164 default:
165 Fatal();
166 break;
167 }
168
169 if(!dont_ack) {
170 c->cmd = CMD_ACK;
171 UsbSendPacket(packet, len);
172 }
173 }
174
175 static void flash_mode(int externally_entered)
176 {
177 start_addr = 0;
178 end_addr = 0;
179 bootrom_unlocked = 0;
180
181 UsbStart();
182 for(;;) {
183 WDT_HIT();
184
185 UsbPoll(TRUE);
186
187 if(!externally_entered && !BUTTON_PRESS()) {
188 /* Perform a reset to leave flash mode */
189 USB_D_PLUS_PULLUP_OFF();
190 LED_B_ON();
191 AT91C_BASE_RSTC->RSTC_RCR = RST_CONTROL_KEY | AT91C_RSTC_PROCRST;
192 for(;;);
193 }
194 if(externally_entered && BUTTON_PRESS()) {
195 /* Let the user's button press override the automatic leave */
196 externally_entered = 0;
197 }
198 }
199 }
200
201 extern char _osimage_entry;
202 void BootROM(void)
203 {
204 //------------
205 // First set up all the I/O pins; GPIOs configured directly, other ones
206 // just need to be assigned to the appropriate peripheral.
207
208 // Kill all the pullups, especially the one on USB D+; leave them for
209 // the unused pins, though.
210 AT91C_BASE_PIOA->PIO_PPUDR =
211 GPIO_USB_PU |
212 GPIO_LED_A |
213 GPIO_LED_B |
214 GPIO_LED_C |
215 GPIO_LED_D |
216 GPIO_FPGA_DIN |
217 GPIO_FPGA_DOUT |
218 GPIO_FPGA_CCLK |
219 GPIO_FPGA_NINIT |
220 GPIO_FPGA_NPROGRAM |
221 GPIO_FPGA_DONE |
222 GPIO_MUXSEL_HIPKD |
223 GPIO_MUXSEL_HIRAW |
224 GPIO_MUXSEL_LOPKD |
225 GPIO_MUXSEL_LORAW |
226 GPIO_RELAY |
227 GPIO_NVDD_ON;
228 // (and add GPIO_FPGA_ON)
229 // These pins are outputs
230 AT91C_BASE_PIOA->PIO_OER =
231 GPIO_LED_A |
232 GPIO_LED_B |
233 GPIO_LED_C |
234 GPIO_LED_D |
235 GPIO_RELAY |
236 GPIO_NVDD_ON;
237 // PIO controls the following pins
238 AT91C_BASE_PIOA->PIO_PER =
239 GPIO_USB_PU |
240 GPIO_LED_A |
241 GPIO_LED_B |
242 GPIO_LED_C |
243 GPIO_LED_D;
244
245 USB_D_PLUS_PULLUP_OFF();
246 LED_D_OFF();
247 LED_C_ON();
248 LED_B_OFF();
249 LED_A_OFF();
250
251 // if 512K FLASH part - TODO make some defines :)
252 if ((AT91C_BASE_DBGU->DBGU_CIDR | 0xf00) == 0xa00) {
253 AT91C_BASE_EFC0->EFC_FMR =
254 MC_FLASH_MODE_FLASH_WAIT_STATES(1) |
255 MC_FLASH_MODE_MASTER_CLK_IN_MHZ(0x48);
256 AT91C_BASE_EFC1->EFC_FMR =
257 MC_FLASH_MODE_FLASH_WAIT_STATES(1) |
258 MC_FLASH_MODE_MASTER_CLK_IN_MHZ(0x48);
259 } else {
260 AT91C_BASE_EFC0->EFC_FMR =
261 MC_FLASH_MODE_FLASH_WAIT_STATES(0) |
262 MC_FLASH_MODE_MASTER_CLK_IN_MHZ(48);
263 }
264
265 // Initialize all system clocks
266 ConfigClocks();
267
268 LED_A_ON();
269
270 int common_area_present = 0;
271 switch(AT91C_BASE_RSTC->RSTC_RSR & AT91C_RSTC_RSTTYP) {
272 case AT91C_RSTC_RSTTYP_WATCHDOG:
273 case AT91C_RSTC_RSTTYP_SOFTWARE:
274 case AT91C_RSTC_RSTTYP_USER:
275 /* In these cases the common_area in RAM should be ok, retain it if it's there */
276 if(common_area.magic == COMMON_AREA_MAGIC && common_area.version == 1) {
277 common_area_present = 1;
278 }
279 break;
280 default: /* Otherwise, initialize it from scratch */
281 break;
282 }
283
284 if(!common_area_present){
285 /* Common area not ok, initialize it */
286 int i; for(i=0; i<sizeof(common_area); i++) { /* Makeshift memset, no need to drag util.c into this */
287 ((char*)&common_area)[i] = 0;
288 }
289 common_area.magic = COMMON_AREA_MAGIC;
290 common_area.version = 1;
291 common_area.flags.bootrom_present = 1;
292 }
293
294 common_area.flags.bootrom_present = 1;
295 if(common_area.command == COMMON_AREA_COMMAND_ENTER_FLASH_MODE) {
296 common_area.command = COMMON_AREA_COMMAND_NONE;
297 flash_mode(1);
298 } else if(BUTTON_PRESS()) {
299 flash_mode(0);
300 } else if(*(uint32_t*)&_osimage_entry == 0xffffffffU) {
301 flash_mode(1);
302 } else {
303 // jump to Flash address of the osimage entry point (LSBit set for thumb mode)
304 asm("bx %0\n" : : "r" ( ((int)&_osimage_entry) | 0x1 ) );
305 }
306 }
Impressum, Datenschutz